Power Error Locating Pairs

TL;DR

This paper introduces a new decoding algorithm based on error locating pairs that surpasses traditional error correction limits, unifying algebraic decoding approaches and applicable to various codes, with potential cryptanalysis applications.

Contribution

It presents a novel decoding framework that generalizes power decoding, correcting errors beyond half the minimum distance for codes with error locating pairs.

Findings

Corrects errors up to Sudan's radius asymptotically.

Unifies decoding of algebraic codes using linear algebra.

Applicable to codes without explicit algebraic structure.

Abstract

We present a new decoding algorithm based on error locating pairs and correcting an amount of errors exceeding half the minimum distance. When applied to Reed--Solomon or algebraic geometry codes, the algorithm is a reformulation of the so--called {\em power decoding} algorithm. Asymptotically, it corrects errors up to Sudan's radius. In addition, this new framework applies to any code benefiting from an error locating pair. Similarly to Pellikaan's and K\"otter's approach for unique algebraic decoding, our algorithm provides a unified point of view for decoding codes with an algebraic structure beyond the half minimum distance. It permits to get an abstract description of decoding using only codes and linear algebra and without involving the arithmetic of polynomial and rational function algebras used for the definition of the codes themselves. Such algorithms can be valuable for instance for cryptanalysis to construct a decoding algorithm of a code without having access to the hidden algebraic structure of the code.

Equations

$$\operatorname{ev}_{\boldsymbol{x}}:\left\{\begin{array}[]{ccc}\mathbb{F}_{q}[X]&\longrightarrow&\mathbb{F}_{q}^{n}\\ f&\longmapsto&(f(x_{1}),\ldots,f(x_{n})).\end{array}\right.$$

$${\mathbf{RS}}_q[k]\stackrel{\text{def}}{=}\left\{(f(x_1),\dots ,f(x_n))\text{leavevmode}|\text{leavevmode}f\in {\mathbb{F}}_q[X{]}_{<k}\right\}={\mathrm{ev}}_{\mathbf{x}}\left({\mathbb{F}}_q[X{]}_{<k}\right).$$

$${\mathbf{GRS}}_q[\mathbf{x},\mathbf{y},k]\stackrel{\text{def}}{=}\left\{(y_{1}f(x_1),\dots ,y_{n}f(x_n))\text{leavevmode}|\text{leavevmode}f\in {\mathbb{F}}_q[X{]}_{<k}\right\},$$

$${\mathbf{RS}}_q[k{]}^{\perp }={\mathbf{RS}}_q[n-k].$$

$${\mathbf{y}}^{\prime }=-\frac{1}{y_i{\prod }_{\genfrac{}{}{0ex}{}{j=1}{j\ne i}}^n(x_j-x_i)}\cdot$$

$${\mathcal{C}}_L(\mathcal{X},\mathcal{P},G)\stackrel{\text{def}}{=}\left\{(f(P_1),\dots ,f(P_n))\text{leavevmode}|\text{leavevmode}f\in L(G)\right\},$$

$$(a_1,\dots ,a_n)\ast (b_1,\dots ,b_n)\stackrel{\text{def}}{=}(a_1{b}_1,\dots ,a_n{b}_n).$$

$$⟨\mathbf{a}\ast \mathbf{b},\mathbf{c}⟩=⟨\mathbf{a},\mathbf{b}\ast \mathbf{c}⟩.$$

$${\mathbf{RS}}_q[\mathbf{x},k]\ast {\mathbf{RS}}_q[\mathbf{x},k^{\prime }]={\mathbf{RS}}_q[\mathbf{x},k+k^{\prime }-1].$$

$${\mathcal{C}}_L(\mathcal{X},\mathcal{P},G)\ast {\mathcal{C}}_L(\mathcal{X},\mathcal{P},G^{\prime })={\mathcal{C}}_L(\mathcal{X},\mathcal{P},G+G^{\prime }).$$

$$\text{Stab}(H)\stackrel{\text{def}}{=}\{\mathbf{x}\in {\mathbb{F}}_q^n\text{leavevmode}|\text{leavevmode}\mathbf{x}\ast H\subseteq H\}.$$

$$\dim (A\ast B)⩾\dim A+\dim B-\dim \text{Stab}(A\ast B).$$

$$\dim A\ast B⩾\dim A+\dim B-1.$$

$$\mathbf{y}=\mathbf{c}+\mathbf{e},$$

$$I_{\mathbf{e}}\stackrel{\text{def}}{=}\mathrm{supp}(\mathbf{e})=\{i\in \{1,\dots ,n\}\mid e_i\ne 0\}.$$

$$\Lambda (x_i)y_i=N(x_i).$$

$$\forall i\in \{1,\dots n\},\lambda (x_i)y_i=\nu (x_i).$$

$$\mathrm{deg}(N)⩽\mathrm{deg}(\Lambda )+k-1.$$

$$\displaystyle\boldsymbol{y}=\$$

$$\displaystyle\boldsymbol{y}^{2}=\$$

$$\mathbf{y}$$

$${\mathbf{y}}^2$$

$$N_1\stackrel{\text{def}}{=}\Lambda f,N_2\stackrel{\text{def}}{=}\Lambda f^2.$$

$$\{\begin{array}{rl}\Lambda (x_i)y_i=N_1(x_i)& \forall i\in \{1,\dots ,n\}\\ \Lambda (x_i)y_i^2=N_2(x_i)& \forall i\in \{1,\dots ,n\}\end{array}$$

$$\{\begin{array}{rl}\lambda (x_i)y_i={\nu }_1(x_i),& \forall i\in \{1,\dots ,n\}\\ \lambda (x_i)y_i^2={\nu }_2(x_i),& \forall i\in \{1,\dots ,n\}.\end{array}$$

$$(\Gamma ,\Gamma g,\Gamma g^2)$$

$$\{\begin{array}{rl}\lambda (x_i)y_i={\nu }_1(x_i),& \forall i\in \{1,\dots ,n\}\\ ⋮& \\ \lambda (x_i)y_i^{\ell }={\nu }_{\ell }(x_i),& \forall i\in \{1,\dots ,n\}.\end{array}$$

$$\pi (X)\stackrel{\text{def}}{=}\prod _{i=1}^n(X-x_i)$$

$$t<n-\ell (k-1).$$

$$\#unknowns⩽\#equations+1,$$

$$t⩽\frac{2n\ell -k\ell (\ell +1)+\ell (\ell -1)}{2(\ell +1)}\cdot$$

Full text

**Key words : ** Error correcting codes; Reed–Solomon codes; algebraic geometry codes; decoding algorithms; power decoding; error correcting pairs; cyclic codes.

**MSC : ** 94B35, 94B27, 11T71,14G50.

Introduction

Algebraic codes such as Reed–Solomon codes or algebraic geometry codes are of central interest in coding theory because, compared to random codes, these structured codes benefit from polynomial time decoding algorithms that can correct a significant amount of errors. The decoding of Reed–Solomon and algebraic geometry codes is a fascinating topic at the intersection of algebra, algorithms, computer algebra and complexity theory.

Decoding of Reed–Solomon codes

Reed–Solomon codes benefit from an algebraic structure coming from univariate polynomial algebras. Thanks to this structure, one can easily prove that they are maximum distance separable (MDS). In addition, one can design an efficient unique decoding algorithm based on the resolution of a so–called key equation [Ber68, Ber15, WB83, GS92] and correcting up to half the minimum distance. This decoding algorithm is sometimes referred to as Welch–Berlekamp algorithm in the literature.

In the late nineties, two successive breakthroughs due to Sudan [Sud97] and Guruswami and Sudan [GS99] permitted to prove that Reed–Solomon codes and algebraic geometry codes can be decoded in polynomial time with an asymptotic radius reaching the so–called Johnson bound [Joh62]. These algorithms have decoding radius exceeding half the minimum distance at the price that they may return a list of codewords instead of a single one. This drawback has actually a very limited impact since in practice, the list size is almost always less than or equal to $1$ (see [McE03a] for further details). Note that decoding Reed–Solomon codes beyond the Johnson bound remains a fully open problem: it is proved in [GV05] that the maximum likelihood decoding problem for Reed–Solomon codes is NP–hard but the possible existence of a theoretical limit between the Johnson bound and the covering radius under which decoding is possible in polynomial time remains an open question with only partial answers as in [RW14].

All the previously described decoders are worst case, i.e. correct any corrupted codeword at distance less than or equal to some fixed bound $t$. On the other side, some probabilistic algorithms may correct more errors at the cost of some rare failures. For instance, it is known for a long time that the classical Welch–Berlekamp algorithm applied to interleaved Reed–Solomon is a probabilistic decoder reaching the channel capacity [SSB09] when the number of interleaved codewords tends to infinity. Inspired by this approach Bossert et. al. [SSB10] proposed a probabilistic decoding algorithm for decoding genuine Reed–Solomon codes by interleaving the received word and some of its successive powers with respect to the component wise product. This algorithm has been called power decoding in the sequel. A striking feature of this power decoding is that it has the same decoding radius as Sudan algorithm. Moreover an improvement of the algorithm due to Rosenkilde [RnN18] permits to reach Guruswami–Sudan radius, that is to say the Johnson bound.

However, compared to Sudan algorithm which is worst case and returns always the full list of codewords at bounded distance from the received word, the power decoding algorithm returns at most one element and might fail. The full analysis of its failure probability and the classification of failure cases is still an open problem but practical experimentations give evidences that this failure probability is very low.

Decoding of algebraic geometry codes

All the previously described decoding algorithms for Reed–Solomon codes have natural extensions to algebraic geometry codes at the cost of a slight deterioration of the decoding radius which is proportional to the curve’s genus. The problem of decoding algebraic geometry codes motivated hundreds of articles in the last three decades. The story starts in the late 80’s with an article of Justesen, Larsen, Jensen, Havemose and Høholdt [JLJ*+*89] proposing a syndrome based decoding algorithm for codes from plane curves. The algorithm has then been extended to arbitrary curves by Skorobogatov and Vlăduţ [SV90]. The original description of these algorithms was strongly based on algebraic geometry. However, subsequently, Pellikaan [Pel88, Pel92] and independently Kötter [Köt92] proposed an abstract description of these algorithms expurgated from the formalism of algebraic geometry. This description was based on an object called error correcting pair . An error correcting pair for a code $C$ is a pair of codes $A,B$ satisfying some dimension and minimum distance constraints and such that the space $A*B$ spanned by the component wise products of words of $A$ and $B$ is contained in $C^{\perp}$. The existence of such a pair

Problem 1** (Bounded decoding).**

Let $C\subseteq\mathbb{F}_{q}^{n}$, $\boldsymbol{y}\in\mathbb{F}_{q}^{n}$ and $t\in\{0,\ldots,n\}$. Return (if exists) a word $\boldsymbol{c}\in C$ such that $\operatorname{d}(\boldsymbol{c},\boldsymbol{y})\leqslant t$.

Definition 0.1**.**

For an algorithm solving Problem 1, the largest possible $t$ such that the algorithm succeeds is referred to as the decoding radius of the algorithm.

When $t\leqslant\left\lfloor{(\operatorname{d}(C)-1)}/{2}\right\rfloor$, then the solution, if exists, is unique and the corresponding problem is sometimes referred to as the unambiguous decoding problem. For larger values of $t$, the set of codewords at distance less than or equal to $t$ from $\boldsymbol{y}$ might have more than one element. To solve the bounded decoding problem in such a situation, various decoders exist. Some of them return the closest codeword (if unique), while other ones return the whole list of codewords at distance less than or equal to $t$. The algorithm of the present article, either returns a unique solution or fails.

To conclude this section, let us state an assumption which we suppose to be satisfied for any decoding problems considered in the sequel.

Assumption 1**.**

In the following, given a code $C$ and a positive integer $t$, when considering Problem 1, we always suppose that the received vector $\boldsymbol{y}\in\mathbb{F}_{q}^{n}$ is of the form $\boldsymbol{y}=\boldsymbol{c}+\boldsymbol{e}$ where $\boldsymbol{c}\in C$ and $\operatorname{w}(\boldsymbol{e})=t$. Equivalently, we always suppose that the bounded decoding problem has at least one solution.

0.1 Reed–Solomon codes

The space of polynomials with coefficients in $\mathbb{F}_{q}$ and degree less than $k$ is denoted by $\mathbb{F}_{q}[X]_{<k}$. Given an integer $n\geqslant k$ and a vector $\boldsymbol{x}\in\mathbb{F}_{q}^{n}$ whose entries are distinct, the Reed–Solomon code of length $n$ and dimension $k$ is the image of the space $\mathbb{F}_{q}[X]_{<k}$ by the map

[TABLE]

This code is denoted by $\mathbf{RS}_{q}[\boldsymbol{x},k]$ or $\mathbf{RS}_{q}[k]$ when there is no ambiguity on the vector $\boldsymbol{x}$. That is:

[TABLE]

One can actually consider a larger class of codes called generalised Reed–Solomon codes and defined as:

[TABLE]

where $\boldsymbol{y}\in{(\mathbb{F}_{q}^{\times})}^{n}$. Such a code has length $n$, dimension $k$ and minimum distance $\operatorname{d}=n-k+1$. In this article, for the sake of simplicity, we focus on the case of Reed–Solomon codes ($\boldsymbol{y}=(1,\ldots,1)$) with $n=q$, i.e. the so–called full–support Reed–Solomon codes. This context is much more comfortable for duality since we can assert that

[TABLE]

In the general case, the above statement remains true by replacing Reed–Solomon codes by generalised Reed–Solomon codes with a specific choice of $\boldsymbol{y}$. Indeed, it holds $\mathbf{GRS}_{q}[\boldsymbol{x},\boldsymbol{y},k]^{\perp}=\mathbf{GRS}_{q}[\boldsymbol{x},\boldsymbol{y}^{\prime},n-k]$, where

[TABLE]

See for instance [Rot06, Problem 5.7]. Actually, the results of the present article extend straightforwardly to generalised Reed–Solomon codes at the cost of slightly more technical proofs.

0.2 Algebraic geometry codes

In what follows, by curve we always mean a smooth projective geometrically connected curve defined over $\mathbb{F}_{q}$. Given such a curve $\mathcal{X}$, a divisor $G$ on $\mathcal{X}$ and a sequence $\mathcal{P}=(P_{1},\dots,P_{n})$ of rational points of $\mathcal{X}$ avoiding the support of $G$, one can define the code

[TABLE]

where $L(G)$ denotes the Riemann–Roch space associated to $G$. When $\deg G<n$, such a code has dimension $k\geqslant\deg G+1-g$ where $g$ denotes the genus of $\mathcal{X}$ and minimum distance $\operatorname{d}>n-\deg G$. We refer the reader to [TVN07, Sti09] for further details on algebraic geometry, function fields and algebraic geometry codes.

0.3 Star product of words and codes

The space $\mathbb{F}_{q}^{n}$ is a product of $n$ fields and hence has a natural structure of ring. We denote by $*$ the component wise product of vectors

[TABLE]

Given a vector $\boldsymbol{a}\in\mathbb{F}_{q}^{n}$, the $i$–th power $\boldsymbol{a}^{i}$ of $\boldsymbol{a}$ is defined as $\boldsymbol{a}^{i}\stackrel{{\scriptstyle\textrm{def}}}{{=}}(a_{1}^{i},\dots,a_{n}^{i})$.

Remark 0.2*.*

This product should not be confused with the canonical inner product in $\mathbb{F}_{q}^{n}$ defined by $\langle\boldsymbol{a},\boldsymbol{b}\rangle=\sum_{i=1}^{n}a_{i}b_{i}$. Note that these two operations are related by the following adjunction property

[TABLE]

In particular $\boldsymbol{a}\ast\boldsymbol{b}\in\boldsymbol{c}^{\perp}\iff\boldsymbol{a}\ast\boldsymbol{c}\in\boldsymbol{b}^{\perp}$.

Definition 0.3**.**

Given two codes $A,B\subseteq\mathbb{F}_{q}^{n}$, the star product $A*B$ is the code spanned by all the products $\boldsymbol{a}*\boldsymbol{b}$ for $\boldsymbol{a}\in A$ and $\boldsymbol{b}\in B$. If $A=B$, the product is denoted by $A^{2}$. Inductively, one defines $A^{i}\stackrel{{\scriptstyle\textrm{def}}}{{=}}A*A^{i-1}$ for all $i\geqslant 2$.

0.3.1 Star products of algebraic codes

Algebraic codes satisfy peculiar properties with respect to the star product.

Proposition 0.4** (Star product of Reed–Solomon codes).**

Let $\boldsymbol{x}\in\mathbb{F}_{q}^{n}$ be a vector with distinct entries and $k,k^{\prime}$ be positive integers such that $k+k^{\prime}-1\leqslant n$. Then,

[TABLE]

Remark 0.5*.*

Actually Proposition 0.4 holds true even if $k+k^{\prime}-1>n$ but in this situation the right–hand side becomes $\mathbb{F}_{q}^{n}$.

Proposition 0.6** (Star product of AG codes).**

Let $\mathcal{X}$ be a curve of genus $g$, $\mathcal{P}=(P_{1},\dots,P_{n})$ be a sequence of rational points of $\mathcal{X}$ and $G,G^{\prime}$ be two divisors of $\mathcal{X}$ such that $\deg G\geqslant 2g$ and $\deg G^{\prime}\geqslant 2g+1$. Then,

[TABLE]

Proof.

This is a consequence of [Mum70, Theorem 6]. For instance, see [CMCP17, Corollary 9]. ∎

0.3.2 A Kneser–like theorem

We conclude this section with a result which will be useful in the sequel and can be regarded as a star product counterpart of the famous Kneser Theorem in additive combinatorics (see [TV06, Theorem 5.5]). We first have to introduce a notion.

Definition 0.7**.**

Let $H\subseteq\mathbb{F}_{q}^{n}$ be a code, the stabiliser of $H$ is defined as

[TABLE]

Theorem 0.8**.**

Let $A,B\subseteq\mathbb{F}_{q}^{n}$ be two codes. Then,

[TABLE]

Proof.

See [MZ15, Theorem 18] or [BL17, Theorem 4.1]. ∎

For any code $C$, the stabiliser of $C$ has dimension at least $1$ since it contains the span of the vector $(1,\ldots,1)$. On the other hand, it has been proved in [KS80, Theorem 1.2] that a code $C$ has a stabiliser of dimension $>1$ if and only if it is degenerated, i.e. if and only if either it is a direct sum of subcodes with disjoint supports or any generator matrix of $C$ has a zero column. This leads to the following analog of Cauchy–Davenport Theorem ([TV06, Theorem 5.4]).

Corollary 0.9**.**

Let $A,B\subseteq\mathbb{F}_{q}^{n}$ be two codes such that $A\ast B$ is non degenerated, then

[TABLE]

1 Former decoding algorithms for Reed–Solomon and

algebraic geometry codes

It is known that several different decoding algorithms have been designed for Reed–Solomon and algebraic geometry codes. In particular, depending on the algorithm, we are able to solve either Problem 1 up to half the minimum distance, or to the Johnson bound.

In this section, we recall several decoding algorithms for Reed–Solomon codes. For all of them, a natural extension to algebraic geometry codes is known. Recall that, whenever we discuss a decoding problem we suppose Assumption 1 to be satisfied, i.e. we suppose that the decoding problem has at least one solution. Hence, we can write

[TABLE]

for some $\boldsymbol{c}\in C$ and $\boldsymbol{e}\in\mathbb{F}_{q}^{n}$ with $\operatorname{w}(\boldsymbol{e})=t$. Note that since $C=\mathbf{RS}_{q}[k]$, the codeword $\boldsymbol{c}$ can be written as the evaluation of a polynomial $f(x)$ with $\deg(f)<k$. The vector $\boldsymbol{e}$ is called the error vector. Moreover, we define

[TABLE]

Hence, we have $t=\operatorname{w}(\boldsymbol{e})=|I_{\boldsymbol{e}}|$.

1.1 Welch–Berlekamp algorithm

Welch–Berlekamp algorithm boils down to a linear system based on $n$ key equations. In this case the decoding radius is given by a sufficient condition, i.e. if there is a solution, the algorithm will find it.

Definition 1.1**.**

Given $\boldsymbol{y},\boldsymbol{e}$ and $I_{\boldsymbol{e}}$ as above we define

• •

the error locator polynomial as $\Lambda(X)\stackrel{{\scriptstyle\textrm{def}}}{{=}}\prod_{i\in I_{\boldsymbol{e}}}(X-x_{i})$;

• •

$N(X)\stackrel{{\scriptstyle\textrm{def}}}{{=}}\Lambda(X)f(X)$.

Hence, for any $i\in\{1,\dots,n\}$, the polynomials $\Lambda$ and $N$ verify

[TABLE]

The aim of the algorithm is then to solve the following

Key Problem 1**.**

Find a pair of polynomials $(\lambda,\nu)$ such that $\deg(\lambda)\leqslant t$, $\deg(\nu)\leqslant\leavevmode\nobreak\ t+k-1$ and

[TABLE]

Remark 1.2*.*

Actually, the degrees of $\Lambda$ and $N$ are related by

[TABLE]

With this constraint the problem can be solved using Berlekamp–Massey algorithm. Though in this paper we chose to consider the simplified constraints of Key Problem 1 in order to have linear constrains, which makes the analysis of the decoding radius easier. By the following lemma it will be clear that making this choice has no consequence on the decoding radius of Welch–Berlekamp algorithm.

The system ($S_{\textrm{WB}}$) is linear and has $n$ equations in $2t+k+1$ unknowns. We know that the pair $(\Lambda,\Lambda f)$ is in its solutions space. The following result proves that, for certain values of $t$, actually it is not necessary to find exactly that solution to solve the decoding problem.

Lemma 1.3**.**

Let $t\leqslant\frac{\operatorname{d}-1}{2}$. If $(\lambda,\nu)$ is a nonzero solution of ($S_{\textrm{WB}}$), then $\lambda\neq 0$ and $f=\frac{\nu}{\lambda}$.

For the proof we refer for instance to [JH04, Theorem 4.2.2]. We can finally write the algorithm (see Algorithm 1). Its correctness is entailed by Lemma 1.3 whenever $t\leqslant\frac{\operatorname{d}-1}{2}$, that is, the decoding radius of Welch–Berlekamp algorithm is $t=\lfloor\frac{\operatorname{d}-1}{2}\rfloor\cdot$

1.2 Power decoding algorithm

Introduced by Sidorenko, Schmidt and Bossert, [SSB09], power decoding is inspired from a decoding algorithm for interleaved Reed–Solomon codes. It consists in considering several “powers” (with respect to the star product) of the received vector $\boldsymbol{y}$ in order to have more relations to work on. Given the vector $\boldsymbol{y}=\boldsymbol{c}+\boldsymbol{e}$ we want to correct, we consider the $i$–th powers $\boldsymbol{y}^{i}$ of $\boldsymbol{y}$ for $i=1,\dots,\ell$ (see § 0.3 for the definition of $\boldsymbol{y}^{i}$). In this section, we only present the case $\ell=2$ for simplicity. We have

[TABLE]

We then rename $\boldsymbol{e}$ by $\boldsymbol{e}^{(1)}$ and $2\boldsymbol{c}\ast\boldsymbol{e}+\boldsymbol{e}^{2}$ by $\boldsymbol{e}^{(2)}$ and get

[TABLE]

One can see $\boldsymbol{y}^{2}$ as a perturbation of a word $\boldsymbol{c}^{2}\in C^{2}=\mathbf{RS}_{q}[2k-1]$ by the error vector $\boldsymbol{e}^{(2)}$. Hence $\boldsymbol{y}^{2}$ is an instance of another decoding problem. In addition, we have the following elementary result which is the key of power decoding.

Proposition 1.4**.**

It holds $\operatorname{supp}(\boldsymbol{e}^{(2)})\subseteq\operatorname{supp}(\boldsymbol{e}^{(1)})$.

It asserts that on $\boldsymbol{y}$ and $\boldsymbol{y}^{2}$, the errors are localised at the same positions. More precisely, error positions on $\boldsymbol{y}^{2}$ are error positions on $\boldsymbol{y}$. Hence, we are in the error model of interleaved codes: equations (7) and (8) can be regarded as a decoding problem for the interleaving of two codewords with errors at most at $t$ positions. Therefore, errors can be decoded simultaneously using the same error locator polynomial. To do that, we consider the error locating polynomial $\Lambda(X)=\prod_{i\in I_{\boldsymbol{e}}}(X-x_{i})$ as for Welch–Berlekamp algorithm and the polynomials

[TABLE]

Thanks to Proposition 1.4, it is possible to write the key equations

[TABLE]

Consequently, the Power decoding algorithm consists in solving the following problem.

Key Problem 2**.**

Given $\boldsymbol{y}\in\mathbb{F}_{q}^{n}$ and $t\in\mathbb{N}$, find $(\lambda,\nu_{1},\nu_{2})$ which fulfill

[TABLE]

with $\deg(\lambda)\leqslant t$ and $\deg(\nu_{j})\leqslant t+j(k-1)$ for $j\in\{1,2\}$.

Remark 1.5*.*

Key Problem 2 is slightly different from the problem faced in the original paper describing Power Decoding ([SSB10]). We used a key equation formulation of the problem instead of the syndrome one. The two formulations are equivalent if the right bounds on polynomials’ degrees are taken (see [RnN15]). In particular, one should look for $(\lambda,\nu_{1},\nu_{2})$ such that $\deg(\nu_{j})\leqslant\deg(\lambda)+j(k-1)$ for all $j\in\{1,\dots,\ell\}$. However, similarly as for Welch–Berlekmap algorithm, we consider two weaker constraints which allow to reduce the problem to a linear system to solve. The price is that our Key Problem could get more failure cases than problem in [SSB10]. However, we observed experimentally that these cases are really rare.

The vector $(\Lambda,\Lambda f,\Lambda f^{2})$ is a solution of the linear system ($S_{\textrm{Po}}$). Though, at the moment there is no guaranteed method to recover it among all the solutions. We only know that, if $g$ is a polynomial such that $\deg(g)<k$ and $\operatorname{d}(\operatorname{ev}_{\boldsymbol{x}}(g),\boldsymbol{y})\leqslant t$, then there exists an error locator polynomial $\Gamma$ of the error with respect to $g$, such that the vector

[TABLE]

is solution of ($S_{\textrm{Po}}$). Among all solutions like that, we want to pick the one that gives the closest codeword, that is the one such that $\deg(\Gamma)$ is minimal (see pt.1 in Algorithm 2).

Remark 1.6*.*

The $2n$ equations we obtain in Key Problem 2, consist in the key equations for $\boldsymbol{y}$ and the key equations for $\boldsymbol{y}^{2}$, that is two simultaneous decoding problems. Indeed, the important aspect is that these two decoding problems share the error locator polynomial $\Lambda$. Hence, by adding $n$ relations, we only add $\deg(N_{2})+1$ unknowns instead of $\deg(N_{2})+t+2$.

Remark 1.7*.*

To compute the decoding radius of the Power Decoding algorithm we look for a condition on the size of the system ($S_{\textrm{Po}}$). Note that the algorithm gives one solution or none, hence there cannot be a sufficient condition for the correctness of the algorithm as soon as $t>\frac{\operatorname{d}-1}{2}$. For this reason, we look for a necessary condition for the system ($S_{\textrm{Po}}$) to have a solution space of dimension $1$.

The general case with an arbitrary $\ell$.

For an arbitrary $\ell$, Key Problem 2 is replaced the following system:

[TABLE]

with $\deg\lambda\leqslant t$ and $\deg\nu_{j}\leqslant t+j(k-1)$ for all $j\in\{1,\ldots,\ell\}$.

1.2.1 Decoding radius

Under Assumption 1, we know that $(\Lambda,\Lambda f,\Lambda f^{2})$ is a solution for ($S_{\textrm{Po}}$) and hence, the algorithm returns $\boldsymbol{c}$ if and only if the solution space of ($S_{\textrm{Po}}$) has dimension one.

Let us define the polynomial

[TABLE]

and consider the bounds in Key Problem 2 on the degrees of $\nu_{1}$ and $\nu_{2}$. If $t+2(k-1)\geqslant n$, then we would have $(0,0,\pi)\in Sol$. For a larger $\ell$ this condition becomes

[TABLE]

However, bound (10) is actually much larger than the decoding radius. We look then for a stricter bound on $t$. Another necessary condition to have a solution space of dimension one for ($S_{\textrm{Po}}$), is:

[TABLE]

which gives $t\leqslant\frac{2n-3k+1}{3}\cdot$

Remark 1.8*.*

Actually, starting from $\boldsymbol{y}=\boldsymbol{c}+\boldsymbol{e}$, Algorithm 2 could return another word $\boldsymbol{c}^{\prime}\neq\boldsymbol{c}$ which would be closer to $\boldsymbol{y}$. In such a situation, the solution space of ($S_{\textrm{Po}}$) will not have dimension $1$ since it will contain a triple $(\Lambda,\Lambda f,\Lambda f^{2})$ associated to $\boldsymbol{c}$ and a vector $(\Lambda^{\prime},\Lambda^{\prime}f^{\prime},\Lambda^{\prime}f^{\prime 2})$ associated to $\boldsymbol{c}^{\prime}$ which can be proved to be linearly independent. Therefore, the algorithm may return the closest codeword even in situations when the dimension of the solutions space of ($S_{\textrm{Po}}$) has dimension larger than $1$. The analysis consists in giving a necessary condition for the algorithm to return $\boldsymbol{c}$.

Finally, the same process can be used for a general $\ell$ and we obtain the following decoding radius

[TABLE]

1.3 The error correcting pairs algorithm

The Error Correcting Pairs (ECP) algorithm has been designed by Pellikaan [Pel92] and independently by Kötter [Köt92]. Its formalism gives an abstract description of a decoding algorithm originally arranged for algebraic geometry codes [SV90] and whose description required notions of algebraic geometry. In their works, Pellikaan and Kötter, simplified the instruments needed in the original decoding algorithm and made the algorithm applicable to any linear code benefiting from a certain elementary structure called error correcting pair and defined in Definition 1.9 below. Given a code $C$ and a received vector $\boldsymbol{y}=\boldsymbol{c}+\boldsymbol{e}$ where $\boldsymbol{c}\in C$ and $\operatorname{w}(\boldsymbol{e})\leqslant t$ for some positive integer $t$, the ECP algorithm consists in two steps:

1. (1)

find $J\subseteq\{1,\dots,n\}$ such that $J\supseteq I_{\boldsymbol{e}}$, where $I_{\boldsymbol{e}}$ denotes the support of $\boldsymbol{e}$; 2. (2)

recover the nonzero entries of $\boldsymbol{e}$.

As said before, these steps can be solved if the code has a $t$-error correcting pair where $t=\operatorname{w}(\boldsymbol{e})$ is small enough.

Definition 1.9**.**

Given a linear code $C\subseteq\mathbb{F}_{q}^{n}$, a pair $(A,B)$ of linear codes, with $A,B\subseteq\mathbb{F}_{q}^{n}$ is called $t$-error correcting pair for $C$ if

1. (ECP1)

$A\ast B\subseteq C^{\perp}$; 2. (ECP2)

$\dim(A)>t$; 3. (ECP3)

$\operatorname{d}(B^{\perp})>t$; 4. (ECP4)

$\operatorname{d}(A)+\operatorname{d}(C)>n$.

Remark 1.10*.*

One can observe that, thanks to Remark 0.2,

[TABLE]

Since this notion does not look very intuitive, an example of error correcting pair for Reed–Solomon codes is given further in § 1.4 and an interpretation of the various hypotheses above is given in light of this example in § 1.5. For now, we want to explain more precisely how the ECP algorithm works.

1.3.1 First step of the error correcting pair algorithm

In Step (1) of the ECP algorithm, we wish to find a set which contains $I_{\boldsymbol{e}}$. A good candidate for $J$ could then be $Z(A({I_{\boldsymbol{e}}}))$, indeed the following result (see [Pel92]), entails that ${I_{\boldsymbol{e}}}\subseteq Z(A({I_{\boldsymbol{e}}}))\varsubsetneq\{1,\dots,n\}$ (see Definition LABEL:def:short_punct).

Proposition 1.11**.**

If $\dim(A)>t$, then $A({I_{\boldsymbol{e}}})\neq 0$.

Though, since we do not know ${I_{\boldsymbol{e}}}$, we do not have any information about $A({I_{\boldsymbol{e}}})$. That is why a new vector space is introduced:

[TABLE]

The key of the algorithm is in the following result.

Theorem 1.12**.**

Let $\boldsymbol{y}=\boldsymbol{c}+\boldsymbol{e}$, ${I_{\boldsymbol{e}}}=\operatorname{supp}(\boldsymbol{e})$ and $M_{1}$ as above. If $A\ast B\subseteq C^{\perp}$, then

1. (1)

$A({I_{\boldsymbol{e}}})\subseteq M_{1}\subseteq A$; 2. (2)

if $\operatorname{d}(B^{\perp})>t$, then $A({I_{\boldsymbol{e}}})=M_{1}$;

Proof.

See [Pel92]. ∎

Therefore, if the pair $(A,B)$ fulfills (ECP1-3) in Definition 1.9, then $Z(M_{1})$ is non trivial and contains ${I_{\boldsymbol{e}}}$. Therefore, Step (1) of the algorithm consists in computing $J=Z(M_{1})$.

1.3.2 Second step of the error correcting pair algorithm

Step (2) is nothing but the resolution of a linear system depending on $J$ and the syndrome of $\boldsymbol{y}$. First, some notation is needed.

Notation*.*

Let $H$ be a matrix having $n$ columns and $J\subseteq\{1,\dots,n\}$. We denote by $H_{J}$ the submatrix of $H$ whose columns are those with index $j\in J$.

Suppose we have computed $J\supseteq{I_{\boldsymbol{e}}}$ in Step (1) of the algorithm. Consider a full rank–parity check matrix $H$ for $C$. The vector $\boldsymbol{e}_{J}$ satisfies $H_{J}\cdot\boldsymbol{e}_{J}^{T}=H\cdot\boldsymbol{y}^{T}.$ and we want then to recover $\boldsymbol{e}_{J}$ by solving the linear system

[TABLE]

Though, a priori, the solution may not be unique. Condition (ECP4) in Definition 1.9 yields the following result.

Lemma 1.13**.**

If $\ \operatorname{d}(A)+\operatorname{d}(C)>n$, $\dim(A)>t$ and $J=Z(M_{1})$, then $|J|<\operatorname{d}(C)$.

Proof.

By Proposition 1.11, there exists $\boldsymbol{a}\in A({I_{\boldsymbol{e}}})\setminus\{0\}$. Now, since $\operatorname{d}(A)+\operatorname{d}(C)>n$, we get

[TABLE]

∎

Theorem 1.14**.**

Given $\boldsymbol{y}\in\mathbb{F}_{q}^{n}$ and $J\subseteq\{1,\dots,n\}$ with $t=|J|<\operatorname{d}(C)$, then there exists at most one solution for (13).

This is a well-known result of coding theory and it is easy to prove. This theorem, together with Lemma 1.13, entail that if $J$ contains the support of the error, $\boldsymbol{e}_{J}$ is the unique solution to system (13). Then, the second step of the algorithm consists in finding $\boldsymbol{e}_{J}$ by solving system (13) and recovering $\boldsymbol{e}$ from $\boldsymbol{e}_{J}$ imposing $e_{i}=0$ for all $i\notin J$. The entire algorithm is described in Algorithm 3.

The correctness of the algorithm is proved in [Pel92]. It is straightforward to see that the algorithm returns a unique solution and that a sufficient condition for the algorithm to correct $t$ errors, is the existence of an error correcting pair with parameter $t$. This consideration, leads to the following result.

Corollary 1.15** ([Pel92, Corollary 2.15]).**

If a linear code $C$ has a $t$-error correcting pair, then

[TABLE]

1.4 Error correcting pairs for Reed–Solomon

codes

For an arbitrary code, there is no reason that an error correcting pair exists. Indeed, the existence of an ECP for a given code relies on the existence of a pair $(A,B)$ of codes, both having a sufficiently large dimension and satisfying $A*B\subseteq C^{\perp}$, which is actually a very restrictive condition. Among the codes for which an ECP exists, there are Reed–Solomon codes. Indeed, given $C=\mathbf{RS}_{q}[k]$, consider the pair $(A,B)$:

[TABLE]

Recall that thanks to Proposition 0.4, we have $A*C=\mathbf{RS}_{q}[t+k].$

Lemma 1.16**.**

Given $B$ as above, it holds

[TABLE]

Proposition 1.17**.**

The pair $(A,B)$ of (14) is a $t$-error correcting pair for $C$ for any

[TABLE]

Proof.

We have to prove that (16) is a necessary and sufficient condition for (ECP1–4) in Definition 1.9 to hold. First of all, by Lemma 1.16 we have (ECP3). Moreover $\dim(A)=t+1>t$ by definition of $A$ and this gives (ECP2). By Proposition 0.4, as seen above, the codes $A,B,C$ verify $A\ast C=B^{\perp}$, then by Remark 0.2 we obtain $A\ast B\subseteq C^{\perp}$. Finally, it is easy to see that $\operatorname{d}(A)+\operatorname{d}(C)>n\iff t<\operatorname{d}(C)$. Hence if t\leqslant\Bigl{\lfloor}\frac{\operatorname{d}(C)-1}{2}\Bigr{\rfloor}, (ECP1–4) hold and conversely. ∎

Remark 1.18*.*

In § 2, we are going to work with structures which are slightly different from error correcting pairs, that is, we will still require (ECP1, 2) and (ECP4) to hold together with other conditions. Note that, given $A$ and $B$ as in (14) Conditions (ECP1, 2) and (ECP4) hold if and only if $t<\operatorname{d}(C)$.

1.5 ECP and Welch–Berlekamp key equations

The example of Reed–Solomon also permits to understand the rationale behind EPC’s in light of Welch–Berlekamp algorithm. Indeed, we now show that the choice of $M_{1}$ we made in the ECP algorithm, if one looks at the key equations of Welch–Berlekamp algorithm, appears to be really natural. Let us consider $C=\mathbf{RS}_{q}[k]$ and the pair $(A,B)$ we defined in § 1.4. We can write (4) for any $i\in\{1,\dots,n\}$ using the star product in this way

[TABLE]

From that, we can deduce

• •

$(N(x_{1}),\dots,N(x_{n}))\in\mathbf{RS}_{q}[t+k]=B^{\perp}$;

• •

$(\Lambda(x_{1}),\dots,\Lambda(x_{n}))\in\mathbf{RS}_{q}[t+1]({I_{\boldsymbol{e}}})=A({I_{\boldsymbol{e}}})$;

• •

Moreover $(\Lambda(x_{1}),\dots,\Lambda(x_{n}))\in\underbrace{\{\boldsymbol{a}\in A\mid\langle a\ast\boldsymbol{y},b\rangle=0\ \ \forall\boldsymbol{b}\in B\}}_{M_{1}}$.

In other words, the vector $(\Lambda(x_{1}),\dots,\Lambda(x_{n}))$ belongs to the space $A({I_{\boldsymbol{e}}})$ we are looking for in the ECP algorithm. Moreover it fulfills a property which characterises a space $M_{1}\supseteq A({I_{\boldsymbol{e}}})$, that is exactly the space we define in the ECP algorithm and that turns to be equal to $A({I_{\boldsymbol{e}}})$ under certain conditions.

2 Power error locating pairs algorithm

We now present the Power Error Locating Pairs (PELP) algorithm. As for the error correcting pairs algorithm, we first give a generic description of the algorithm and later some examples of its application. In order to generalise the ECP algorithm to correct more errors, we introduce a new parameter $\ell$ we call power and define a slightly different structure from error correcting pairs. As in the previous paragraphs, we first describe that structure and the algorithm for $\ell=2$ and then explain how to generalise it.

2.1 The case $\ell=2$

In Pellikaan’s paper, a structure called error locating pairs is already defined. It is a pair of codes $(A,B)$ which satisfy (ECP1, 2) and (ECP4). In particular it is shown that, without changing anything in the algorithm, with such a structure it is possible to correct errors if the support of the error vector ${I_{\boldsymbol{e}}}$ is an independent $t$-set of error position with respect to the code $B$ (see [Pel92]).

In the present article, in order to correct beyond half the designed distance, we do not consider particular error supports, but we rather choose to work with a more particular structure than error locating pairs and change the first step of the algorithm.

Definition 2.1** ($2$–Power error locating pairs).**

Given a linear code $C\subseteq\mathbb{F}_{q}^{n}$, a pair of linear codes $(A,B)$ with $A,B\subseteq\mathbb{F}_{q}^{n}$ is a $2$–power $t$–error locating pair for $C$ if

1. ($2$–PELP1)

$A\ast B\subseteq C^{\perp}$; 2. ($2$–PELP2)

$\dim(A)>t$; 3. ($2$–PELP3)

$\operatorname{d}(A^{\perp})>t$; 4. ($2$–PELP4)

$\operatorname{d}(A)+\operatorname{d}(C)>n$; 5. ($2$–PELP5)

$\dim(B)+\dim(B^{\perp}\ast C)^{\perp}\geqslant t$.

Compared to the definition of error correcting pairs, we removed (ECP 3) which is too restrictive to correct errors beyond half the minimum distance. Instead, in the same spirit as the power decoding, we look for a necessary condition for the algorithm to succeed. In this context, under Condition ($2$–PELP3), Condition ($2$–PELP5) provides this necessary condition together with the key tool for the analysis of the decoding radius of our algorithm.

Remark 2.2*.*

In the transition between ECP algorithm and $2$–PELP algorithm, it is very important to get rid of the property $\operatorname{d}(B^{\perp})>t$. Indeed, since we want $A\ast C\subseteq B^{\perp}$, if we had $\operatorname{d}(B^{\perp})>t$, then, assuming that $A*C$ is non degenerate (see § 0.3.2) we would get

[TABLE]

where the second inequality is due to Corollary 0.9. This entails that $t\leqslant\frac{n-\dim(C)}{2}$, which does not represent an improvement of the decoding radius in every situation (see §3).

Let us consider a code $C$, a word $\boldsymbol{y}\in\mathbb{F}_{q}^{n}$ such that $\boldsymbol{y}=\boldsymbol{c}+\boldsymbol{e}$ with $\boldsymbol{c}\in C$ and $t=\operatorname{w}(\boldsymbol{e})$ and let $(A,B)$ be a $2$–power $t$–error locating pair for $C$.

Definition 2.3**.**

Let us look for a necessary condition for this generalised algorithm to return $\boldsymbol{c}$. It can be proven that Theorem LABEL:corrPELP can be adapted to the generalised notion (LABEL:eq:newM) of $M$. The following theorem gives the necessary condition we look for.

Theorem 2.4**.**

If $A({I_{\boldsymbol{e}}})=M$, then $\dim(B)+\sum_{i=2}^{\ell}\dim(B^{\perp}\ast C^{i-1})^{\perp}\geqslant t.$

Again, in order to prove this Theorem, we study the condition $M_{I_{\boldsymbol{e}}}=\{0\}$, since it is equivalent to $A({I_{\boldsymbol{e}}})=M$ by Lemma LABEL:cond_eq_M.

Theorem 2.5**.**

It holds

[TABLE]

where $\boldsymbol{e}^{(i)}=\sum_{h=1}^{i}\binom{i}{h}\boldsymbol{c}^{i-h}\ast\boldsymbol{e}^{h}$ is such that $\boldsymbol{y}^{i}=\boldsymbol{c}^{i}+\boldsymbol{e}^{(i)}$ for all $i=1,\dots,\ell$.

To prove this result, it is possible to adapt the proof of Theorem LABEL:scritM_I and observe that it still holds $A_{I_{\boldsymbol{e}}}=\mathbb{F}_{q}^{t}$. We will use the following remark.

Remark 2.6*.*

Given a vector space $V$ with $\dim(V)=t$ and $A_{1},\dots,A_{n}\subseteq V$, we have

[TABLE]

in addition, it is easy to see that $\dim((\boldsymbol{e}^{(1)}\ast B)_{I_{\boldsymbol{e}}})\leqslant\dim(B)$ and

[TABLE]

Now, it is possible to prove Theorem 2.4.

Proof Theorem 2.4.

It holds

[TABLE]

Now, thanks to Remark 2.6, one can easily see that (17) implies

[TABLE]

∎

2.2 Complexity

To conclude this section, let us discuss the complexity of the algorithm. We denote by $\omega$ the exponent of the complexity of matrix multiplications. First, recall that the computation of the star product of two codes of length $n$ costs $O(n^{4})$ arithmetic operations in $\mathbb{F}_{q}$ using a deterministic algorithm and $O(n^{\omega})$ using a probabilistic algorithm (see for instance [COT17, § VI.A and D]).

The evaluation of the complexity of the power error locating pairs algorithm should be divided in two parts:

• •

the pre-computation phase, that should be done once for good and is independent from the error and the corrupted codeword;

• •

the online phase, which depends on the corrupted codeword.

2.2.1 The precomputation phase

This phase consists essentially in computing generator matrices for the codes ${(B^{\perp}*C^{i-1})}^{\perp}$ for $i\in\{1,\dots,\ell\}$. Each new calculation consists in the computation of a $*$–product and a dual. This yields an overall cost of $O(\ell n^{\omega})$ operations in $\mathbb{F}_{q}$ using a probabilistic algorithm and $O(\ell n^{4})$ operations using a deterministic one.

2.2.2 The online phase

• •

The computation of each space $M_{i}$ boils down to the resolution of a linear system with $\dim A$ variables and $\dim{(B^{\perp}*C^{i-1})}^{\perp}$ equations. Hence a cost of $O(n^{\omega})$ operations in $\mathbb{F}_{q}$.

• •

The computation of $M$ consists in the calculation of $\ell-1$ intersections of spaces. Since the cost of the calculation of an intersection is $O(n^{\omega})$ operations, the cost of the computation of $M$ from the knowledge of the $M_{i}$’s is in $O(\ell n^{\omega})$

In summary, the overall complexity of the online phase is in $O(\ell n^{\omega})$ operations in $\mathbb{F}_{q}$.

Remark 2.7*.*

Note that the previous complexity analysis is purely generic and does not take into account that codes with an error locating pair such as Reed–Solomon code may be described by structured matrices permitting faster linear algebra.

3 $\ell$–PELP algorithm for Reed–Solomon codes

We now give some applications of the $\ell$–PELP algorithm, starting with Reed–Solomon codes. For these codes, the algorithm is much more intuitive. Indeed, as for the error correcting pairs algorithm, it is possible to deduce the PELP algorithm from a former decoding algorithm for Reed–Solomon codes: the power decoding.

Let us consider the code $C=\mathbf{RS}_{q}[k]$ and the pair $(A,B)$, where $A=\mathbf{RS}_{q}[t+1]$ and $B^{\perp}=\mathbf{RS}_{q}[t+k]$. We look for the values of $t$ for which $(A,B)$ is an $\ell$–power $t$–error locating pair for $C$. One can see that, since we no longer ask for $\operatorname{d}(B^{\perp})>t$, by Lemma 1.16, $t$ can be larger than $\frac{\operatorname{d}(C)-1}{2}$. About the conditions to fulfill, we already have seen that properties ($\ell$–PELP1, 2, 4) hold for any $t<\operatorname{d}(C)$ (see §1.4). Let us find the values of $t$ which verify

($\ell$–PELPLABEL:item:pelp3g)

$\operatorname{d}(A^{\perp})>t$;

($\ell$–PELPLABEL:item:pelp5g)

$\dim(B)+\sum_{i=2}^{\ell}\dim(B^{\perp}\ast C^{i-1})^{\perp}\geqslant t$.

Property ($\ell$–PELP3) holds for any $t$ since Reed–Solomon codes are MDS and $A$ has dimension $t+1$. Let us now focus on property ($\ell$–PELP5). By Proposition 0.4, we know that $B^{\perp}\ast C^{i-1}=\mathbf{RS}_{q}[t+i(k-1)+1]$ and these codes are not equal to $\mathbb{F}_{q}^{n}$ as soon as

[TABLE]

If (18) is satisfied, then the bound in property ($\ell$–PELP5) becomes

[TABLE]

which is the decoding radius for the power decoding algorithm for a general $\ell$ (see (11)).

Remark 3.1*.*

Note that (19) came in power decoding as a necessary condition to have a unique solution for a linear system. Here instead, it comes up as a necessary condition for an intersection of some vector spaces to be $\{0\}$.

3.1 The space $M$ and the key equations of power decoding

In § 1.5, we have seen that it is possible to relate the definition of $M_{1}$ with the key equations of Welch–Berlekamp algorithm. One can do the same with the definition of $M$ in the power error locating pairs algorithm and the key equations of the $\ell$–power decoding algorithm. Here, we only consider the case $\ell=2$, since it is easy to generalise the idea for a larger $\ell$. It is possible to write (9) in this way

[TABLE]

where $\operatorname{ev}_{\boldsymbol{x}}$ is the evaluation map introduced in (1). Hence, we can deduce

• •

$\operatorname{ev}_{\boldsymbol{x}}(N_{1})\in\mathbf{RS}_{q}[t+k]=B^{\perp}$;

• •

$\operatorname{ev}_{\boldsymbol{x}}(N_{2})\in\mathbf{RS}_{q}[t+2k-1]=B^{\perp}\ast C$;

• •

$\operatorname{ev}_{\boldsymbol{x}}(\Lambda)\in\mathbf{RS}_{q}[t+1]({I_{\boldsymbol{e}}})=A({I_{\boldsymbol{e}}})$;

• •

$\operatorname{ev}_{\boldsymbol{x}}(\Lambda)\in M$, where $M$ is the set defined in the $2$–power error locating pairs algorithm. Indeed we recall that $M=M_{1}\cap M_{2}$, where

[TABLE]

In other words, in the power decoding algorithm one works with polynomials, while in the power error locating pairs algorithm one works with their evaluations.

3.2 Equivalence of the two algorithms for Reed–Solomon codes

Thanks to the link presented in the previous subsection, it is possible to find an isomorphism between the solution space of power decoding and the space $M$. For the sake of simplicity, we explicit this isomorphism in the case $\ell=2$. The general case can easily be deduced from the following study.

Theorem 3.2**.**

Let $\boldsymbol{y}=\mathbb{F}_{q}^{n}$ and $t$ a positive integer and suppose we run both the power decoding algorithm and the power error locating pairs algorithm with the same $t$ and $\ell=2$. Denote by $Sol$ the solution space of the linear system ($S_{\textrm{Po}}$) in the power decoding. Then the linear map

[TABLE]

is bijective.

Proof.

For the sake of simplicity, we provide the proof in the case $\ell=2$. The proof in the general case is easy to deduce at the cost of heavier notation. First, let us show that $\varphi$ is well defined. Let $(\lambda,\nu_{1},\nu_{2})$ belong to $Sol$. Then, it holds

[TABLE]

As we have seen in § 3, these two conditions are equivalent to the statement

[TABLE]

Conversely, given $\boldsymbol{a}\in M$, there exists $\lambda\in\mathbb{F}_{q}[X]$ with $\deg(\lambda)<t+1$ such that $\operatorname{ev}_{\boldsymbol{x}}(\lambda)=\boldsymbol{a}$. Moreover, since $\boldsymbol{a}\in M$, we have

[TABLE]

Thus, there exist $\nu_{1},\nu_{2}\in\mathbb{F}_{q}[X]$ with $\deg(\nu_{1})<t+k$, $\deg(\nu_{2})<t+2k-1$ and

[TABLE]

We can then define another map

[TABLE]

where $\lambda,\nu_{1}$ and $\nu_{2}$ are the polynomials associated to $\boldsymbol{a}$ as before. It is easy to prove that, under the condition111That is again bound (10).

[TABLE]

it holds $\varphi\circ\psi=Id_{M}$ and $\psi\circ\varphi=Id_{Sol}$. ∎

In summary, for Reed–Solomon codes, power decoding and power error locating pairs algorithms are equivalent. In particular they succeed or fail for the same instances.

4 PELP algorithm for algebraic

geometry codes

As said previously, the power error locating pairs algorithm can be run on any code with a PELP. We have seen that Reed–Solomon codes belong to this class of codes. In the sequel, we show that algebraic geometry codes also belong to it. Similarly to the case of Reed–Solomon codes, this algorithm can be compared with the power decoding algorithm. Power decoding extends naturally from Reed–Solomon codes to algebraic geometry codes. However, its use for decoding AG codes in the literature concerns mainly one–point codes from the Hermitian curve (see [NB15, PRB19]). For this reason, we give a brief presentation together with an analysis of its decoding radius in Appendix A.

In the sequel, we show that the analysis of the power decoding provides a decoding radius which is slightly below that of the power error locating pairs algorithm. Moreover, we observed experimentally that the decoding radius given by the analysis of the PELP algorithm is optimal for both the PELP and the power decoding algorithms. Probably, a more detailed analysis of the power decoding would provide a sharper estimate of the decoding radius, but the point is that the analysis of the PELP algorithm provides an optimal radius in a very elementary manner.

4.1 Context

Let $\mathcal{X}$ be a smooth projective geometrically connected curve of genus $g$ over $\mathbb{F}_{q}$. Let $G$ be a divisor on $\mathcal{X}$ and $\mathcal{P}=(P_{1},\dots,P_{n})$ be an ordered $n$–tuple of pairwise distinct rational points of $\mathcal{X}$ avoiding the support of $G$. We denote by $k$ and $\operatorname{d}$ respectively the dimension and the minimum distance of the code $\mathcal{C}_{L}(\mathcal{X},\mathcal{P},G)$. Moreover, we denote by $D$ the divisor $P_{1}+\dots+P_{n}$ and by $W$ the divisor $(\omega)$ where $\omega\in\Omega(\mathcal{X})$ is a rational differential form such that $v_{P_{i}}(\omega)=\leavevmode\nobreak\ -1$ and $res_{P_{i}}(\omega)=1$ for any $i\in\{1,\dots,n\}$. We now introduce an extra divisor $F$ on $\mathcal{X}$ and the pair $(A,B)$ with

[TABLE]

This pair of codes is our candidate to be a power error locating pair for $C$. We analyse the case $\ell=2$ for simplicity (it is easy to generalise what we are going to see).

4.2 Decoding Radius

In order to find the decoding radius of the $2$–power error correcting pairs algorithm for algebraic geometry codes, we follow the same path as for Reed–Solomon codes. That is, we look for the pairs $(A,B)$ that satisfy properties ($2$–PELP1–5) in Definition 2.1. To do so, we write some additional conditions on the degree of the divisor $F$ and $G$ and on the number of errors $t$. First, note that Property ($2$–PELP1) holds by construction of $A$ and $B$. In order to have properties ($2$–PELP2, 3) and to know the structure of the code $(B^{\perp}\ast C)^{\perp}$, we ask for the two following conditions

Additional Condition 1**.**

$\deg(F)\geqslant t+2g$.

Additional Condition 2**.**

$\deg(G)\geqslant 2g$.

In particular, it is easy to verify that under these two additional conditions, we have by Proposition 0.6

[TABLE]

Let us fix then the value of $\deg(F)$ to be $2g+t$. We now consider the bound given by Condition ($2$–PELP5) for $\ell=2$

[TABLE]

We need to know the exact dimension of these spaces, hence we impose some more conditions on the degree of the divisor222Remember that if $C=C_{L}(\mathcal{X},\mathcal{P},G)$ with $2g-2<\deg(G)<n$, then $\dim(C)=\deg(G)-g+1$. $G$. We ask for

Additional Condition 3**.**

$t<n-2\deg(G)-2g$.

Finally, we get the following result.

Proposition 4.1**.**

Let $\deg(F)=t+2g<n-\deg(G)$, $\deg(G)<2g$ and $t\leqslant n-2\deg(G)-2g$. Then $C=C_{L}(\mathcal{X},\mathcal{P},G)$ admits a $2$–PELP as in (25), if

[TABLE]

In this case, bound (27) gives the decoding radius of the $2$–PELP algorithm.

Proof.

Condition ($2$–PELP1) is obviously satisfied by the codes $A,B$ defined in (25). Moreover, since $\deg(F)=t+2g$, we get $\dim(A)>t$, i.e. Property ($2$–PELP2). Property ($2$–PELP4) is a consequence of the condition $\deg(F)<n-\deg(G)$, which indeed entails

[TABLE]

Thanks to Additional Condition 1, we have ($2$–PELP3). Finally one notes that bound in ($2$–PELP5) becomes the bound on $t$ in (27) thanks to the additional conditions and the property $\deg(F)<n-\deg(G)$. ∎

Remark 4.2*.*

As for Reed–Solomon codes, we want to have $(B^{\perp}\ast C)\subsetneq\mathbb{F}_{q}^{n}$. Indeed in this case if $M$ and $M_{1}$ are as in Definition 2.3, we get $M\subsetneq M_{1}$ and the decoding radius in (27) is usually achieved according to our tests. That is why it is important also to ask

[TABLE]

Note that this bound is achieved whenever we are in the hypothesis of Proposition 4.1 and $g>1$.

The decoding radius can be computed even for arbitrary values of $\ell$. Indeed, if we impose $t\leqslant n-\ell\deg(G)-2g$, we get

[TABLE]

4.3 Comparison with decoding radii of other algorithms for

algebraic geometry codes

We can now compare this decoding radius with the decoding radii of Sudan algorithm and the power decoding algorithm for algebraic geometry codes. We have (see [SW99, Theorem 2.1] and Appendix A):

[TABLE]

First, note that if

[TABLE]

then the decoding radius of the $\ell$–PELP algorithm (28) is even larger than Sudan’s algorithm decoding radius. Furthermore, one can see that for algebraic geometry codes, the power decoding algorithm and the power error locating pairs algorithm no longer have the same decoding radius, but the second one is larger. Actually the implementation of the algorithms put in evidence that power decoding algorithm is actually able to correct more than what expressed by its decoding radius, and up to the recoding radius of the $\ell$–PELP algorithm. It is possible to explain this by considering that in the power decoding algorithm something changes once we pass to algebraic geometry codes from Reed–Solomon codes. Indeed, in both cases, the decoding radius comes as a necessary condition for a vector space to have dimension one. But for Reed–Solomon codes, this is equivalent to have a necessary condition for the algorithm to succeed, while for algebraic geometry codes this is no longer true.

By the tests we made, it seems that the bound (28) is optimal. Though we should precise that we run the algorithms with $\deg(F)=t+2g$. Actually experimentally we have seen that it is possible to run power decoding algorithm with $\deg(F)=t+g$ and obtain an empirical decoding radius

[TABLE]

which indeed corresponds to the empirical result obtained in [NB15].

4.4 Cryptanalytic application

In the last fourty years, many attempts for instantiating McEliece encryption scheme [McE78] using algebraic codes have been proposed in the literature. The use of generalised Reed–Solomon codes is known to be unsecure since Sidelnikov and Shestakov’s attack [SS92] permitting to recover the whole structure of such a code from the very knowledge of a generator matrix. Note that actually, a procedure to recover the structure of a generalised Reed–Solomon code from the data of a generator matrix was already known by Roth and Seroussi [RS85]. Sidelnikov–Shestakov attack has been extended to algebraic geometry codes from curves of genus 1 and 2 [Min07, FM08]. For general algebraic geometry codes, an attack has been given [CMCP17] that permits to recover an error correcting pair or an error correcting array from the knowledge of a generating matrix. This attack does not permits to recover the curve, the divisor and the evaluation points but is enough to break the system as soon as the decoder corrects at most half the designed distance.

In a nutshell, this attack of [CMCP17] consists in computing some filtered sequences of codes from the knowledge of a generator matrix of $\mathcal{C}_{L}(\mathcal{X},\mathcal{P},G)$. Namely, the codes computed are of the form $\mathcal{C}_{L}(\mathcal{X},\mathcal{P},iP)$ and $\mathcal{C}_{L}(\mathcal{X},\mathcal{P},G-iP)$ for a given rational point $P$ and for any integer $i$. For $i$ large enough, the pair $(\mathcal{C}_{L}(\mathcal{X},\mathcal{P},iP),\mathcal{C}_{L}(\mathcal{X},\mathcal{P},G-iP))$ yields an error correcting pair.

Suppose now that McEliece scheme is instantiated with an algebraic geometry code and whose decryption step requires to correct beyond half the designed distance by using Sudan’s or power decoding algorithm. Stricto sensu, such a scheme is out of reach by the attack [CMCP17]. However, the very same approach permits to design a power error locating pair. Then, Algorithm LABEL:algoPELP2 can be run without requiring any further knowledge on the curve and the divisor. This yields an interesting application of this abstract formulation of decoding beyond half the minimum distance. Note that no such cryptographic proposal exists in the literature but [ZZ18] which is unfortunately out of reach of power error locating pairs since it requires the use of a Guruswami–Sudan like decoder yielding a decoding radius close to Johnson bound.

5 PELP algorithm for cyclic

codes

In this section, we give an application of the PELP algorithm for some cyclic codes. In 1994, Duursma and Kötter showed in [DK94] that an ECP algorithm can correct up to half the BCH bound and, in particular cases, also half the Roos bound (see Theorem 5.9 for a definition and [Roo83] for details).

First, we recall the main notions and fix some notation (for more details see [DK94]). Let us consider a field $\mathbb{F}_{q}$ and an integer $n$ with $\gcd(n,q)=1$. Given a vector $\boldsymbol{c}=(c_{0},\dots,c_{n-1})\in\mathbb{F}_{q}^{n}$, we denote by $c(X)$ the image of $\boldsymbol{c}$ by the following linear map:

[TABLE]

It is known that cyclic codes of length $n$ over $\mathbb{F}_{q}$ are in correspondence with the factors of the polynomial $X^{n}-1$. In particular, given $g(X)|X^{n}-1$ in $\mathbb{F}_{q}[X]$, the cyclic code $C_{g}$ associated to $g$ is

[TABLE]

In the same way, the roots of $g$ determine in a unique way the code $C_{g}$. Hence, let us consider an extension $\mathbb{F}\supseteq\mathbb{F}_{q}$ such that $\mathbb{F}$ contains the $n$–th roots of unity and let $\gamma$ be a primitive $n$–th root of unity.

Definition 5.1**.**

Given $R=\{i_{1},\dots,i_{m}\}\subseteq\{1,\dots,n\}$, we define the $m\times n$ matrix

[TABLE]

To any subset $R\subseteq\{1,\dots,n\}$, one can then associate two cyclic codes.

Definition 5.2**.**

$R$ is called defining set for the code $C$ if

[TABLE]

Remark 5.3*.*

One can see that if $C$ is defined as in (29), then $C$ is a cyclic code. Indeed, we have $C=C_{g}$, where $g=\operatorname{lcm}\{m_{i}(x)\mid i\in R\}$ and $m_{i}$ is the minimal polynomial of $\gamma^{i}$ on $\mathbb{F}_{q}$. Note that different defining sets can define the same cyclic code $C$. By applying several times Frobenius morphism to the set $\{\gamma^{i}\mid i\in R\}$, one can find the maximal defining set, also called complete. In this paper we will treat a general situation, where a defining set will not necessarily be complete.

Remark 5.4*.*

Note that, if $R$ is a defining set for a code $C$, then $C=\tilde{C}\cap\mathbb{F}_{q}^{n}$, where $\tilde{C}\subseteq\mathbb{F}^{n}$ is a cyclic code with parity check matrix $M(R)$. If we denote by $\operatorname{d}_{R}$ the minimum distance of the code $\tilde{C}$, we get $\operatorname{d}(C)\geqslant\operatorname{d}_{R}$.

Definition 5.5**.**

$R$ is called generating set for the code $C$ if

[TABLE]

We stress that if $R$ is a generating set for a code $C$, then $C$ is a code with coefficients in the larger alphabet $\mathbb{F}$ and has generating matrix $M(R)$. In particular, $\dim_{\mathbb{F}}(C)=|R|$.

Remark 5.6*.*

Note that a code $C$ as in (30) is a cyclic code. Indeed $C$ is the dual code of the cyclic code $D\subseteq\mathbb{F}^{n}$ with defining set $R$ and it is known that the dual of a cyclic code is cyclic itself.

5.1 Roos bound

There are cases where it is possible to bound the minimum distance of a cyclic code. Apart from the BCH bound, another and more general bound has been given by Roos ([Roo83]).

Definition 5.7**.**

Given $R\subseteq\{1,\dots,n\}$, denote by $\overline{R}$ the smallest set made of consecutive indices modulo $n$ that contains $R$. Moreover, if $S$ is another subset of $\{1,\dots,n\}$, we can define the sum set

[TABLE]

Finally, given $a<n$, we define the set $aR\stackrel{{\scriptstyle\textrm{def}}}{{=}}\{ar\mod n\mid r\in R\}$.

It is possible to relate the star product of two cyclic codes to the sum of their generating sets.

Proposition 5.8**.**

Let $A$, $B$ and $W$ be three cyclic codes with generating sets respectively $S$, $R$ and $S+R$. Then,

[TABLE]

Proof.

First, note that for any $j\in S+R$ we get by Definition 5.7

[TABLE]

for some $s\in S$ and $r\in R$. Hence,

[TABLE]

Now, it is easy to see that the set of generators of $A\ast B$

[TABLE]

is equal to the set composed by the rows of the matrix $M(S+R)$ (see Definition 5.1). Since, by Definition 5.5, this is a generator matrix for the code $W$, we get that $G$ is a set of generators for both $A\ast B$ and $W$, hence $A\ast B=W$. ∎

Theorem 5.9** (Roos bound).**

Let $R,S\subseteq\{1,\dots,n\}$ such that $|\overline{S}|\leqslant|S|+\operatorname{d}_{R}-2$. Then,

[TABLE]

Proof.

See [Roo83]. ∎

Remark 5.10*.*

In the hypothesis of Theorem 5.9, if $C$ is the cyclic code with defining set $R+S$, since $\operatorname{d}(C)\geqslant\operatorname{d}_{R+S}$, then $\operatorname{d}(C)\geqslant|S|+\operatorname{d}_{R}-1$ as well.

Remark 5.11*.*

One can note that in the same hypothesis of Theorem 5.9, the proof given in [Roo83] can be adapted to prove that

[TABLE]

for any $a,b\leqslant n$ with $\gcd(a,n)=\gcd(b,n)=1$.

5.2 $\ell$–PELP algorithm and Roos bound

We now focus on cyclic codes with defining set $R+S$ with $R$ and $S$ satisfying the hypothesis of Roos bound (Theorem 5.9). Actually, we will work with the code in $\mathbb{F}^{n}$ for the sake of simplicity.

Theorem 5.12**.**

Let $a,b\leqslant n$ with $\gcd(a,n)=\gcd(b,n)=1$ and let $A,B\subseteq\mathbb{F}^{n}$ be cyclic codes with generating sets respectively $aS$ and $bR$, where

[TABLE]

Let $\tilde{C}\subseteq\mathbb{F}^{n}$ be the cylic code with parity check matrix $M(aS+bR)$ and $k=\dim(\tilde{C})$. Let us suppose that

1. (i)

for any $i\in\{1,\dots,\ell-1\}$ we have $B^{\perp}\ast\tilde{C}^{i}\varsubsetneq\mathbb{F}_{q}^{n}$; 2. (ii)

any nonzero cyclic subcode of $B$ is non degenerated.

Then $(A,B)$ is an $\ell$–power $t$–error locating pair for the code $\tilde{C}$ with

[TABLE]

where $\delta$ and $\gamma_{1},\dots,\gamma_{\ell-1}$ fulfill

[TABLE]

Remark 5.13*.*

Note that if $(A,B)$ is an $\ell$–power $t$–error locating pair for $\tilde{C}$, then it is an $\ell$–power $t$–error locating pair for the cyclic code $C$ with defining set $aS+bR$ as well. Actually it is a standard procedure for cyclic codes (see for instance [DK94]). In particular, that is why if $\tilde{C}$ is a Reed–Solomon code, the optimised choice of PELP for $\tilde{C}$ with $|S|=t+1$, will give the decoding radius found in § 3.

Remark 5.14*.*

Condition (ii) on $B$ can be reformulated as follows: for any non empty subset $U$ of $R$, there does not exist $i\in\mathbb{Z}/n\mathbb{Z}$ such that $U+i\equiv U\mod n$.

Before proving Theorem 5.12, we need the two following lemmas on the notion of degenerated codes (see § 0.3.2).

Lemma 5.15**.**

Let $C\subseteq\mathbb{F}_{q}^{n}$ be a degenerated code. Then for any code $D\subseteq\mathbb{F}_{q}^{n}$, the code $C\ast D$ is degenerated too.

Proof.

It suffices to observe that $\textrm{Stab}(C)\subseteq\textrm{Stab}(C\ast D)$. ∎

Lemma 5.16**.**

A code $C\subseteq\mathbb{F}_{q}^{n}$ is degenerated if and only if $C^{\perp}$ is degenerated.

Proof.

Using the adjunction property (2) of the star product, one proves that $\textrm{Stab}(C)=\textrm{Stab}(C^{\perp})$. ∎

Proof of Theorem 5.12.

We treat the case $a=b=1$, the general case being an easy generalisation. We have by hypothesis $\dim(A)=|S|>t$. Next, from Proposition 5.8, $A\ast B=\tilde{C}^{\perp}$. Furthermore, we have $\operatorname{d}(A^{\perp})=\operatorname{d}_{S}>t$. Hence, properties ($\ell$–PELPLABEL:item:pelp1g), ($\ell$–PELPLABEL:item:pelp2g) and ($\ell$–PELPLABEL:item:pelp3g) are satisfied.

Now, let us focus on property ($\ell$–PELPLABEL:item:pelp4g). We have that $A$ is contained in the code with generating set $\overline{S}$, whose distance is $n-|\overline{S}|+1$ (note that it is a generalised Reed–Solomon code). Hence, we get $\operatorname{d}(A)\geqslant n-|\overline{S}|+1$, which, together with Roos bound, gives

[TABLE]

In order to check Property ($\ell$–PELPLABEL:item:pelp5g), we first consider the case $\ell=2$. Set $W\stackrel{{\scriptstyle\textrm{def}}}{{=}}\leavevmode\nobreak\ (B^{\perp}\ast\leavevmode\nobreak\ \tilde{C})^{\perp}$. Then,

[TABLE]

From Condition (ii) on $B$, the code $W\ast\tilde{C}$ is non degenerated. This last observation, together with inclusion (34) and Corollary 0.9 yield

[TABLE]

for some nonnegative integer $\gamma_{1}$. Next, since $W\ast\tilde{C}$ is non degenerated, from Lemmas 5.15 and 5.16, the code $W^{\perp}=B^{\perp}\ast C$ is non degenerated too. Thus, we get

[TABLE]

Now, since $A\ast B=\tilde{C}^{\perp}$, using Corollary 0.9 again, we know that there exists $\delta\geqslant 0$ such that

[TABLE]

Hence, by (35) and (36), property ($2$–PELP5) is equivalent to

[TABLE]

It is now easy to generalise the proof for $\ell>2$. Indeed if we consider $i>2$ and $Z\stackrel{{\scriptstyle\textrm{def}}}{{=}}(B^{\perp}\ast\tilde{C}^{i})^{\perp}$, we have as before

[TABLE]

From Condition (ii) together with Lemma 5.15, we deduce that $\tilde{C}^{i}$ is non degenerated. Then, by applying Corollary 0.9 iteratively and thanks to Condition (ii) again, we know that there exist two nonnegative integers $\gamma^{\prime}$ and $\gamma^{\prime\prime}$ such that

[TABLE]

Note that these two equations give (33) with $\gamma_{i}\stackrel{{\scriptstyle\textrm{def}}}{{=}}\gamma^{\prime}+\gamma^{\prime\prime}$. Finally, by combining (33) and (36), we get that Property ($\ell$–PELPLABEL:item:pelp5g) for $\ell>2$ is equivalent to the bound in (32). ∎

Remark 5.17*.*

Note that $\delta$ and the $\gamma_{i}$’s do not depend only on the choice of $R$ and $S$ but also on the parameters $a,b$. Hence, in particular, the decoding radius depends as well on $a,b$.

5.3 Comparison with Roos bound

We now would like to compare the obtained decoding radius to Roos bound. To do so, we consider a particular case of cyclic code. Let $R,S\subseteq\{1,\dots,n\}$ such that $|R|=|\overline{R}|=r$, $|S|>t$ and $|\overline{S}|\leqslant|S|+\operatorname{d}_{R}-2$. Let us denote by $t_{A,B}$ the decoding radius (32) for $\ell=2$ and by $\operatorname{d}_{Roos}$ the amount $|S|+\operatorname{d}_{R}-1$. By the equality $|S|+|R|-1+\delta=n-k$, that is $|S|+r-1+\delta=n-k$, we get

[TABLE]

Remark 5.18*.*

Observe that, if $\gcd(a,n)=\gcd(b,n)=1$, Roos bound holds even for $aS$ and $bR$. Hence (37) gives an useful information about the behaviour of $t_{A,B}$ for any $a,b$ $\in\mathbb{N}$ with $(a,n)=(b,n)=1$.

Equivalence (37) gives a good information about the parameters to have in order to cross half the Roos bound. Indeed by some tests we made it has been possible to see that the decoding radius $t_{A,B}$ is achieved really often.

Example 5.19**.**

We now give an easy example of a $2$–PELP algorithm’s application on a cyclic code (which is not BCH) where $t_{A,B}>\frac{\operatorname{d}_{Roos}-1}{2}$. Let us consider $n=51$, $q=5$ and the sets $S=\{0,\dots,24\}\cup\{30\}$, $R=\{0,\dots,13\}\cup\{19\}$. According to Remark 5.14, one can check that Condition (ii) of Theorem 5.12 is satisfied by $B$. We now consider the cyclic code $\tilde{C}$ with parity check matrix $M(S+R)$. Since we are in the hypothesis of Roos bound and $\operatorname{d}_{R}=15$, we obtain $\frac{\operatorname{d}_{Roos}-1}{2}=19$, while $t_{A,B}=23$. In fact, the true minimum distance of $\tilde{C}$ can be computed to be 45. Hence we get

[TABLE]

Conclusion

We proposed a unified framework for a decoder that can correct beyond half the minimum distance. Exactly as error correcting pairs can be regarded as an abstraction of Welch–Berlekamp algorithm, our approach called power error locating pairs is an abstraction of power decoding for Reed–Solomon and algebraic geometry codes. This algorithm applies to any code equipped to a power error locating pair structure such as some cyclic codes for instance. In addition our results turn out to have interesting consequences on code based cryptography since we proved that a McEliece like system using algebraic geometry codes with a secret decoder correcting up to Sudan’s radius is unsecure.

On the other hand, our algorithm does not decode Reed–Solomon or algebraic geometry codes up to the Johnson radius. In this direction, finding an abstraction of Rosenkilde’s extension of power decoding [RnN18] would represent an interesting challenge. Such a result would for instance yield an attack to any cryptosystem like the one introduced in [ZZ18].

Acknowledgements

The authors express their gratitude to the anonymous referees for their careful work and their many relevant comments permitting a significant improvement of this article. This work was supported by French Agence Nationale de la Recherche Manta : ANR-15-CE39-0013.

Appendix A Power decoding for algebraic geometry

codes

We show how the power decoding algorithm adapts to arbitrary algebraic geometry codes. Let $C=C_{L}(\mathcal{X},\mathcal{P},G)$ and $\textbf{y}=\textbf{c}+\textbf{e}\in\mathbb{F}_{q}^{n}$ the word we want to correct, where $\textbf{c}\in C$. We have then

[TABLE]

Furthermore, as in the previous sections, we suppose that $\operatorname{w}(\textbf{e})=t$ and denote the support of e by ${I_{\boldsymbol{e}}}$. We keep the same idea we used in the version of the algorithm for Reed–Solomon codes. Indeed, let us suppose to have $\Lambda\in\mathbb{F}_{q}(\mathcal{X})$ such that $\Lambda(P_{i})=0$ for all $i\in{I_{\boldsymbol{e}}}$. Then, given $\ell\in\mathbb{N}$ we get

[TABLE]

We would like then to find $\Lambda$ as above. It is easy to see that such a $\Lambda$ has to be searched in $L(F)$ for a certain $F$ such that $\deg(F)\geqslant t+g$. (we will give a better bound for that soon). It is possible to see $(\Lambda,f)$ as a solution of

[TABLE]

that is, a system of $n\ell$ equations whose unknowns are the coordinates of $\lambda$ and $\phi$ in the basis of respectively $L(F)$ and $L(G)$. System (39) is not linear in the unknowns though, hence we linearise it by considering a new function $\nu_{j}\coloneqq\lambda\phi^{j}$ for any equation. For all $j\in\{1,\dots,\ell\}$, we get

[TABLE]

In order to use Theorem 0.6, let us fix $\deg(F)=t+2g$ and suppose $\deg(G)\geqslant 2g+1$. We get then the following problem.

Key Problem 3**.**

Given $\textbf{y}\in\mathbb{F}_{q}^{n}$ and $t\in\mathbb{N}$, look for $\lambda,\nu_{1},\dots,\nu_{\ell}\in\mathbb{F}_{q}^{n}(\mathcal{X})$ such that

• •

$\lambda\in L(F)$ with $\deg(F)=t+2g$;

• •

$\nu_{j}\in L(F+jG)$ for all $j=1,\dots,\ell$;

• •

$\lambda(x_{i})y_{i}=\nu_{j}(x_{i})$ for all $i=1,\dots,n$ and $j=1,\dots,\ell$.

Therefore, even this case, the power decoding algorithm consists in solving a linear system and we will just consider a nonzero solution.

Decoding Radius.

As in the case of Reed–Solomon codes, we would like to have a solution space of dimension one. A necessary condition for that, is

[TABLE]

The number of equations is $n\ell$. For the number of unknowns, we need to know the dimension of the spaces $L(F+jG)$ for all $j=1,\dots,\ell$. The bounds we have set in the hypothesis give

[TABLE]

Hence by condition (40) we get the following decoding radius

[TABLE]

Remark A.1*.*

This bound is not a sufficient condition to have a solution, but it is not even a necessary condition. In fact, as for the power decoding algorithm for Reed–Solomon codes, we could find a good solution even for a larger value of $t$ and on the other hand the algorithm could fail even if $t$ fulfills condition (41).