On the Dimensions of Hermitian Subfield Subcodes from Higher-Degree Places

TL;DR

This paper studies Hermitian codes from degree-three places, analyzing their structure and dimensions to advance coding theory and cryptography.

Contribution

The paper introduces new insights into the dimensions of subfield subcodes from higher-degree places on Hermitian curves.

Findings

The Riemann–Roch space basis for degree-three places was characterized.

Lower bounds for the dimensions of subfield subcodes were established.

A conjecture on the dimension of certain subfield subcodes was proposed based on experiments.

Abstract

The focus of our research is the examination of Hermitian curves over finite fields, specifically concentrating on places of degree three and their role in constructing Hermitian codes. We begin by studying the structure of the Riemann–Roch space associated with these degree-three places, aiming to determine essential characteristics such as the basis. The investigation then turns to Hermitian codes, where we analyze both functional and differential codes of degree-three places, focusing on their parameters and automorphisms. In addition, we explore the study of subfield subcodes and trace codes, determining their structure by giving lower bounds for their dimensions. This presents a complex problem in coding theory. Based on numerical experiments, we formulate a conjecture for the dimension of some subfield subcodes of Hermitian codes. Our comprehensive exploration seeks to deepen the understanding of Hermitian codes and their associated subfield subcodes related to degree-three places, thus contributing to the advancement of algebraic coding theory and code-based cryptography.

Full text

1. Introduction

The advent of quantum computers presents significant threats to classical cryptographic schemes, requiring the development of post-quantum cryptographic primitives that resist quantum attacks. In this regard, algebraic geometry (AG) codes have gained considerable attention due to their error-correcting capabilities and potential applications in secure communication and cryptographic protocols. Among various classes of AG codes, subfield subcodes stand out against structural attacks, making them good candidates for deployment in post-quantum cryptography.

Within linear codes over finite field extensions, the process of generating subfield subcodes, commonly referred to as restriction, entails converting a given linear code C over a large field extension $[eqn]$ into a code that is defined over a subfield $[eqn]$ , where m divides n. This strategic approach restricts the codewords of C to elements found within the smaller field $[eqn]$ , effectively concealing the details about the structure inherent in C. A classic example of this concept is the Reed–Solomon codes, which are algebraic geometry (AG) codes constructed over a projective line. They are widely used in practical applications, with their subfield subcodes represented by Goppa codes. In particular, in cryptography, especially within a McEliece cryptosystem, subfield subcodes play a crucial role in hiding the code structure, thus enhancing its resilience against distinguishing attacks [1,2]. The long-lasting security of the McEliece cryptosystem based on Goppa codes [3] emphasizes its effectiveness in preventing such attacks. Despite subsequent proposals exploring Reed–Solomon codes [4], AG codes, and their subcodes [5], all have been susceptible to structural attacks. By imposing restrictions, cryptographic systems can enhance their security by minimizing the risk of potential attacks aimed at distinguishing the chosen subfield subcode. With growing interest in AG codes, particularly Hermitian codes, they are being evaluated as feasible alternatives to Reed–Solomon codes in specific applications [6]. Hermitian codes have been extensively studied in prior research [7,8,9,10,11,12], particularly those associated with the point at infinity of the Hermitian curve. However, in [13,14], the authors introduced an alternative construction of Hermitian codes associated with higher-degree places on the Hermitian curve.

Our contribution involves conducting further research on Hermitian codes associated with degree-three places, deriving additional properties, and establishing explicit bases for the corresponding Riemann–Roch spaces; additionally, this should align with previous findings in [13]. The stabilizer of a degree-three place has order $[eqn]$ ; the action of this group and the associated quotient curve has been studied by Cossidente, Korchmáros, and Torres [15]. We make heavy use of their approach which relates the Hermitian curve with the curve projective curve $[eqn]$ . Beelen, Montanucci, and Vicino [16] studied another class of Hermitian quotient curves, which are obtained by automorphisms stabilizing a degree-three place of the Hermitian curve.

One-point Hermitians of degree-three places have improved minimum distances, as shown by the Matthews–Michel bound [14], and have been further strengthened by Korchmáros and Nagy in [13]. Moreover, we explore the properties of their subfield subcodes, with a particular focus on determining their true dimensions through explicit constructions. This investigation aims to provide a precise understanding of the codes’ capabilities for our future work. Since the family of subfield subcodes of Hermitian codes associated with degree-three places holds promise for the construction of an improved and secure McEliece cryptosystem, the aforementioned investigation will enable a comparison of these parameters with those of other existing codes (see [12], Table 1), such as Goppa codes, to assess the potential improvement in the key size of the McEliece cryptosystem. This suggests that such a proposal could reduce the key size and meet the security level required by NIST [17]. Using bounds on the dimensions offers only an estimate of the code’s performance, which means that this will not help us accurately decide whether these codes can achieve the required security level with an improved key size.

The paper is structured as follows. In Section 2, we introduce the essential background of AG codes constructed from a Hermitian curve, including Hermitian curves, divisors, and the Riemann–Roch space. In Section 3, we provide some facts on the geometry of degree 3 places of the Hermitian curve, and the unitary transformations which stabilize the given degree-three place. Our main tool is the Hermitian sesquilinear form $[eqn]$ and the Frobenius map $[eqn]$ . Section 4 deals with their corresponding Riemann–Roch spaces. We explore their structure and give explicit and practical bases over $[eqn]$ , and a decomposition into invariant subspaces over $[eqn]$ (Theorem 3). In Section 5, we study the functional and differential Hermitian codes of a degree 3 place, where we explicitly give the monomial equivalence between them (Theorem 4). In Section 6, we give the main result on the dimensions of the subfield subcodes of degree 3 place Hermitian codes (Theorem 5). This result consists of a theorem that provides a lower bound on the dimensions of the underlying codes, while the conjecture suggests a possible equality based on numerical experiments.

The computational results were obtained using the HERmitian package [18] within the GAP [19] computer algebra system. This involved implementing higher-degree places of Hermitian curves, their divisors and the associated Hermitian codes. This package employs a generic method for computing the bases of Riemann–Roch spaces, independent of the results presented in this paper. Specifically, we acquired computational evidence supporting Conjecture 1 without relying on the theoretical findings of this work.

2. Algebraic Geometry (AG) Codes

2.1. Hermitian Curves and Their Divisors

For more details, we refer the reader to [15,20,21]. The Hermitian curve, denoted as $[eqn]$ , over the finite field $[eqn]$ in affine coordinates is given by the equation:

$$[eqn]$$

This curve has a genus $[eqn]$ , classifying it as a maximal curve because it achieves the maximum number of $[eqn]$ -rational points, which is $[eqn]$ . Furthermore, $[eqn]$ has a unique point at infinity, denoted $[eqn]$ .

A divisor on $[eqn]$ is a formal sum $[eqn]$ , where $[eqn]$ are integers and $[eqn]$ are points on $[eqn]$ . The degree of the divisor D is defined as $[eqn]$ . The valuation of D at a point $[eqn]$ is $[eqn]$ , and the support of D is the set $[eqn]$ .

The Frobenius automorphism, denoted as $[eqn]$ , is defined over the algebraic closure $[eqn]$ and acts on elements as follows:

$$[eqn]$$

It acts on the points of $[eqn]$ by applying $[eqn]$ to their coordinates. A point Q on $[eqn]$ is $[eqn]$ -rational if and only if it is fixed by $[eqn]$ . Over $[eqn]$ , the points in $[eqn]$ correspond one-to-one to the places in the function field $[eqn]$ .

For a divisor D, its Frobenius image is given by

$$[eqn]$$

and D is $[eqn]$ -rational if $[eqn]$ . In particular, if all points $[eqn]$ are in $[eqn]$ , then D is inherently $[eqn]$ -rational.

2.2. Riemann–Roch Spaces

For a non-zero function g in the function field $[eqn]$ and a place P, $[eqn]$ stands for the order of g at P. If $[eqn]$ , then P is a zero of g, while if $[eqn]$ , then P is a pole of g with multiplicity $[eqn]$ . The principal divisor of a non-zero function g is $[eqn]$ .

The Riemann–Roch space associated with an $[eqn]$ -rational divisor G is the $[eqn]$ vector space

$$[eqn]$$

From ([20], Riemann’s Theorem 1.4.17), we have

$$[eqn]$$

with equality if $[eqn]$ .

In this work, our primary focus is on an $[eqn]$ -rational divisor G of the form $[eqn]$ , where P is a degree r place in $[eqn]$ and s is a positive integer. In the extended constant field $[eqn]$ of $[eqn]$ with degree r, let $[eqn]$ be the extensions of P. These points are degree-one places in $[eqn]$ , and, after appropriately labeling the indices, $[eqn]$ , where the indices are considered modulo r.

2.3. Hermitian Codes

Here, we outline the construction of an AG code from the Hermitian curve.

In algebraic coding theory, Hermitian codes stand out as a significant class of algebraic geometry (AG) codes, renowned for their distinctive properties. These codes are constructed from Hermitian curves defined over finite fields. These codes are typically viewed as functional AG codes, denoted by $[eqn]$ . In this standard approach, the divisor G is usually a multiple of a single place of degree one. The set $[eqn]$ , which encompasses all the rational points in $[eqn]$ , is listed as $[eqn]$ . This approach gives rise to a structure known as a one-point code. However, it is important to note that recent research in the field suggests that the use of a more varied selection for the divisor G can result in the creation of better AG codes [13,14].

Consider a divisor $[eqn]$ , where all $[eqn]$ are distinct rational points, and an $[eqn]$ -rational divisor G such that $[eqn]$ . By numbering the places in the support of D, we define an evaluation map $[eqn]$ such that $[eqn]$ for $[eqn]$ .

The functional AG code associated with the divisor G is

$$[eqn]$$

Theorem 1 ([20], Theorem 2.2.2).

• $[eqn]$ is an $[eqn]$ code with parameters*

$$[eqn]$$

The dual of an AG code can be described as a residue code (see [20] for more details), i.e.,

$$[eqn]$$

Furthermore, the differential code $[eqn]$ is monomially equivalent to the functional code

$$[eqn]$$

where W represents a canonical divisor of $[eqn]$ . The notion of monomial equivalence of codes is defined as follows. Let $[eqn]$ be linear subspaces and $[eqn]$ with non-zero entries. We define the Schur product

$$[eqn]$$

The vector $[eqn]$ is also called a multiplier. Clearly, $[eqn]$ . Two linear codes $[eqn]$ are monomially equivalent if $[eqn]$ for some multiplier $[eqn]$ . Monomially equivalent codes share identical dimensions and minimum distances; however, this correspondence does not preserve all crucial properties of the code.

2.4. Subfield Subcodes and Trace Codes

For the efficient construction of codes over $[eqn]$ , one approach involves working with codes originally defined over an extension field $[eqn]$ . When considering a code $[eqn]$ within $[eqn]$ , a subfield subcode of $[eqn]$ is its restriction to the field $[eqn]$ . This process, often employed in the definition of codes such as BCH codes, Goppa codes, and alternant codes, plays a fundamental role.

Let q be a prime power and m be a positive integer. Let C denote a linear code of parameters $[eqn]$ defined over the finite field $[eqn]$ . The subfield subcode of C over $[eqn]$ , represented as $[eqn]$ , is the set

$$[eqn]$$

which consists of all codewords in C that have their components in $[eqn]$ .

The subfield subcode $[eqn]$ is a linear code over $[eqn]$ with parameters $[eqn]$ , satisfying the inequalities $[eqn]$ and $[eqn]$ . Moreover, a parity check matrix for C over $[eqn]$ provides up to $[eqn]$ linearly independent parity check equations over $[eqn]$ for the subfield subcode $[eqn]$ . Typically, the minimum distance $[eqn]$ of the subfield subcode exceeds that of the original code C.

Let $[eqn]$ denote the trace function from $[eqn]$ down to $[eqn]$ , expressed as

$$[eqn]$$

For any vector $[eqn]$ , we define

$$[eqn]$$

Furthermore, for a linear code C of length n and dimension k over $[eqn]$ , the code

$$[eqn]$$

is a linear code of length n and dimension $[eqn]$ over $[eqn]$ .

A seminal result by Delsarte connects subfield subcodes with trace codes:

Theorem 2 ([22]). Let C be an $[eqn]$ linear code over $[eqn]$ . Then, the dual of the subfield subcode of C is the trace code of the dual code of C, i.e.,

$$[eqn]$$

Finding the exact dimension of a subfield subcode of a linear code is typically a hard problem. However, a basic estimation can be obtained by applying Delsarte’s theorem [22]:

$$[eqn]$$

In [20] (Chapter 9), various results are discussed with respect to the subfield subcodes and trace codes of AG codes. This motivated us to formulate the following propositions on the dimension of the subfield subcodes of AG codes, which are useful for the case $[eqn]$ with a place P of higher degree.

Proposition 1.  Let $[eqn]$ be a positive divisor of the Hermitian curve $[eqn]$ and $[eqn]$ be the sum of $[eqn]$ -rational places such that $[eqn]$ . Assume that $[eqn]$ . Then,

$$[eqn]$$

Proof. Let f be a function in $[eqn]$ such that $[eqn]$ for $[eqn]$ . Then, $[eqn]$ (since $[eqn]$ ), and hence $[eqn]$ , where

$$[eqn]$$

Since $[eqn]$ , it follows that $[eqn]$ and $[eqn]$ , which implies that $[eqn]$ . Consequently, $[eqn]$ . □

3. The Geometry of Hermitian Degree-Three Places

In this section, we collect useful facts on degree-three places of the Hermitian curve, their stabilizer subgroups, and Riemann–Roch spaces.

3.1. The Hermitian Sesquilinear Form

The Hermitian curve $[eqn]$ has the affine equation $[eqn]$ . The Hermitian function field $[eqn]$ is generated by $[eqn]$ so that $[eqn]$ holds. The Frobenius field automorphism $[eqn]$ of the algebraic closure $[eqn]$ includes an action on rational functions, places, divisors, and curve automorphisms. For this action, we continue to use the notation $[eqn]$ in the exponent: $[eqn]$ , $[eqn]$ , $[eqn]$ , etc.

Let K be a field extension of $[eqn]$ . An affine point is a pair $[eqn]$ . A projective point $[eqn]$ is a one-dimensional subspace $[eqn]$ of $[eqn]$ . If $[eqn]$ , then the projective point $[eqn]$ is identified with the affine point $[eqn]$ . For $[eqn]$ $[eqn]$ , we define the Hermitian form

$$[eqn]$$

Clearly, $[eqn]$ is additive in u and v, $[eqn]$ , and

$$[eqn]$$

The point u is self-conjugate if

$$[eqn]$$

This is the projective equation $[eqn]$ of the Hermitian curve $[eqn]$ .

Let $[eqn]$ be a projective point. The polar line of u has equation

$$[eqn]$$

If u is on $[eqn]$ , then $[eqn]$ is the tangent line at u. More precisely, $[eqn]$ intersects $[eqn]$ at u and $[eqn]$ with multiplicities q and 1, respectively. If u is $[eqn]$ -rational, then $[eqn]$ , and the intersection multiplicity is $[eqn]$ .

3.2. Unitary Transformations and Curve Automorphism

Let A be a $[eqn]$ matrix. The linear map $[eqn]$ will also be denoted by A. If A is invertible, then it induces a projective linear transformation, denoted by $[eqn]$ , where

$$[eqn]$$

We use the same notation $[eqn]$ for the partial affine map:

$$[eqn]$$

The action $[eqn]$ of $[eqn]$ on rational functions will be indicated by $[eqn]$ . The following lemma is straightforward.

Lemma 1.  Let $[eqn]$ be a polynomial of total degree n. Define the degree n homogeneous polynomial $[eqn]$ . Then,

$$[eqn]$$

We remark that the line $[eqn]$ can be seen as the pre-image of the line at infinity under $[eqn]$ .

The linear transformation A is unitary if

$$[eqn]$$

holds for all $[eqn]$ . Since $[eqn]$ is non-degenerate, unitary transformations are invertible. Moreover, for all $[eqn]$ , one has

$$[eqn]$$

This implies $[eqn]$ for all v, that is, A and $[eqn]$ commute. This shows that unitary transformations are defined over $[eqn]$ . They form a group which is denoted by $[eqn]$ . A useful fact is that if $[eqn]$ is a basis and

$$[eqn]$$

for all $[eqn]$ , then A is unitary.

Let $[eqn]$ . If $[eqn]$ is a generic point of $[eqn]$ , then $[eqn]$ satisfies

$$[eqn]$$

Therefore, $[eqn]$ is a generic point of $[eqn]$ , and $[eqn]$ induces an automorphism of the function field $[eqn]$ . If A is defined over $[eqn]$ , then $[eqn]$ is an automorphism of $[eqn]$ .

3.3. Places of Degree Three and Their Lines

Let $[eqn]$ be scalars such that $[eqn]$ . In other words, $[eqn]$ is an affine point of $[eqn]$ , defined over $[eqn]$ . Write $[eqn]$ , $[eqn]$ , $[eqn]$ , $[eqn]$ , and $[eqn]$ . Then, $[eqn]$ , $[eqn]$ , and

$$[eqn]$$

hold for $[eqn]$ , with the indices taking modulo three. Since $[eqn]$ is non-trivial, $[eqn]$ . More precisely,

$$[eqn]$$

which shows $[eqn]$ . Clearly, $[eqn]$ and $[eqn]$ . By $[eqn]$ , the vectors $[eqn]$ are linearly independent over $[eqn]$ .

Let K be a field containing $[eqn]$ . Since $[eqn]$ is a basis in $[eqn]$ , any $[eqn]$ can be written as

$$[eqn]$$

with $[eqn]$ . Computing

$$[eqn]$$

we obtain $[eqn]$ . In the basis $[eqn]$ , the Hermitian form has the shape

$$[eqn]$$

In this coordinate frame, the Hermitian curve has projective equation

$$[eqn]$$

Let $[eqn]$ be the generators of the function field $[eqn]$ such that $[eqn]$ . Write

$$[eqn]$$

Then,

$$[eqn]$$

and

$$[eqn]$$

The Hermitian curve $[eqn]$ is non-singular, the places of $[eqn]$ correspond to the projective points over the algebraic closure $[eqn]$ . Let $[eqn]$ denote the place corresponding to $[eqn]$ . $[eqn]$ is defined over $[eqn]$ , $[eqn]$ , and

$$[eqn]$$

is an $[eqn]$ -rational place of degree three.

The line $[eqn]$ is tangent to $[eqn]$ at $[eqn]$ ; the intersection multiplicities are q and 1 at $[eqn]$ and $[eqn]$ , respectively. This implies that the zero divisor $[eqn]$ is $[eqn]$ , and the principal divisor of $[eqn]$ is

$$[eqn]$$

3.4. The Stabilizer of a Degree-Three Place

Let $[eqn]$ be an element such that $[eqn]$ . Define $[eqn]$ , $[eqn]$ . Then,

$$[eqn]$$

For $[eqn]$ , this implies that

$$[eqn]$$

Hence, for all $[eqn]$ ,

$$[eqn]$$

This shows that we can extend the map $[eqn]$ to a unitary linear map $[eqn]$ in the following way. Write

$$[eqn]$$

with $[eqn]$ , and define

$$[eqn]$$

The extension B is a unique unitary transformation. As we have seen in Section 3.2, this implies that $[eqn]$ is a well-defined element of the general unitary group $[eqn]$ . The set

$$[eqn]$$

is a cyclic subgroup of $[eqn]$ , whose order is $[eqn]$ .

In the projective plane, B induces a projective linear transformation $[eqn]$ . $[eqn]$ is trivial if and only if $[eqn]$ , that is, if and only if $[eqn]$ . As $[eqn]$ , $[eqn]$ is trivial if and only if $[eqn]$ . The set $[eqn]$ is a cyclic group of unitary projective linear transformations, whose order is $[eqn]$ .

In a similar way, we fix the elements

$$[eqn]$$

since $[eqn]$ , $[eqn]$ . Moreover,

$$[eqn]$$

As before, the map

$$[eqn]$$

preserves the Hermitian form:

$$[eqn]$$

Hence, $[eqn]$ extends to a unitary linear map, which commutes with $[eqn]$ and normalizes $[eqn]$ . Indeed,

$$[eqn]$$

and hence, $[eqn]$ . $[eqn]$ maps $[eqn]$ to $[eqn]$ , and

$$[eqn]$$

Therefore, $[eqn]$ has order 3.

As introduced in Section 3.2, the unitary transformations B and $[eqn]$ induce automorphisms $[eqn]$ and $[eqn]$ of the function field.

Proposition 2.  The group $[eqn]$ of curve automorphisms has order $[eqn]$ , and $[eqn]$ normalizes $[eqn]$ by

$$[eqn]$$

Both $[eqn]$ and $[eqn]$ stabilize the degree-three place P.

Proposition 3.  Let $[eqn]$ be an element such that $[eqn]$ . Define $[eqn]$ , $[eqn]$ , and the unitary map $[eqn]$ . Then,

$$[eqn]$$

Proof. By Lemma 1,

$$[eqn]$$

where the linear $[eqn]$ over $[eqn]$ depends only on B. Therefore,

$$[eqn]$$

□

4. Riemann–Roch Spaces Associated with a Degree-Three Place

In this section, we keep using the notation of the previous section: $[eqn]$ is a degree-one place of $[eqn]$ associated with the projective point $[eqn]$ . $[eqn]$ ; the index $[eqn]$ always takes modulo three. $[eqn]$ is an $[eqn]$ -rational place of degree three of $[eqn]$ . The generators $[eqn]$ of $[eqn]$ satisfy $[eqn]$ . The rational function $[eqn]$ is obtained from the tangent line of $[eqn]$ at $[eqn]$ .

4.1. Basis and Decomposition of the Riemann–Roch Space

Let $[eqn]$ be positive integers such that $[eqn]$ and $[eqn]$ . Clearly, $[eqn]$ are uniquely defined by s. In [13], the Riemann–Roch space associated with the divisor $[eqn]$ is given as

$$[eqn]$$

The Weierstrass semigroup $[eqn]$ consists of the integers $[eqn]$ such that the pole divisor $[eqn]$ for some $[eqn]$ , see [20] (Section 6.5) and [16]. If $[eqn]$ , then it is called a Weierstrass gap; the set of Weierstrass gaps is denoted by $[eqn]$ . By [13] (Theorem 3.1), we have

$$[eqn]$$

By the Weierstrass Gap Theorem ([20], Theorem 1.6.8), $[eqn]$ for a place of degree one. In our case, P has degree three and the situation is slightly more complicated.

Lemma 2. 

$$[eqn]$$

Proof. The lemma follows from

$$[eqn]$$

□

The following proposition gives an explicit basis for the Riemann–Roch space $[eqn]$ over the extension field $[eqn]$ .

Proposition 4.  Let $[eqn]$ be positive integers such that $[eqn]$ and $[eqn]$ . Define the rational functions

$$[eqn]$$

Define $[eqn]$ as the constant function for $[eqn]$ . Then, the following holds:

• (i) 

• $[eqn]$ .*

• (ii)  The principal divisor of $[eqn]$ is

$$[eqn]$$

In particular, if $[eqn]$ , then $[eqn]$ .

• (iii)  The elements $[eqn]$ , $[eqn]$ , $[eqn]$ are linearly independent with the following exception: $[eqn]$ , $[eqn]$ ,

$$[eqn]$$

• (iv)  The set

$$[eqn]$$

of rational functions is a basis of $[eqn]$ over $[eqn]$ .

Proof. Note first that $[eqn]$ are uniquely defined by t; therefore, $[eqn]$ is well defined. (i) is trivial and (ii) is straightforward from (3). To show (iii), let us write a linear combination in the form

$$[eqn]$$

such that $[eqn]$ . The right-hand side has a valuation of at least $[eqn]$ at $[eqn]$ . If $[eqn]$ and $[eqn]$ , then the right-hand side has valuation $[eqn]$ at $[eqn]$ . Hence, $[eqn]$ for all $[eqn]$ , a contradiction. Assume $[eqn]$ . Then,

$$[eqn]$$

and (5) follows from (2). We can use (5) to eliminate $[eqn]$ from (6); that is, we can assume $[eqn]$ . Then, again, the only term that has a valuation $[eqn]$ at $[eqn]$ is $[eqn]$ with $[eqn]$ . Since the left- and right-hand sides of (6) must have the same valuations at $[eqn]$ , $[eqn]$ must hold, a contradiction.(iv) By (iii), $[eqn]$ consists of linearly independent elements. To show that it is a basis of $[eqn]$ , it suffices to show that $[eqn]$ for $[eqn]$ . On the one hand, in this case, $[eqn]$ . On the other hand,

$$[eqn]$$

where $[eqn]$ if $[eqn]$ , and $[eqn]$ if $[eqn]$ . By Lemma 2, $[eqn]$ , and the claim follows. □

It is useful to have a decomposition of $[eqn]$ over $[eqn]$ .

Theorem 3.  For a $[eqn]$ integer and $[eqn]$ , define the $[eqn]$ -rational function

$$[eqn]$$

and the $[eqn]$ -linear space

$$[eqn]$$

For $[eqn]$ , we have

$$[eqn]$$

The $[eqn]$ -rational Riemann–Roch space $[eqn]$ has the direct sum decomposition

$$[eqn]$$

Proof. For $[eqn]$ , $[eqn]$ is the set of $[eqn]$ -rational functions in the space spanned by $[eqn]$ . The claims follow from Proposition 4. □

4.2. Invariant Subspaces of L(sP)

Lemma 3.  Let $[eqn]$ such that $[eqn]$ . Then, $[eqn]$ and $[eqn]$ .

Proof. By assumption, $[eqn]$ has order $[eqn]$ . The claim follows from the facts that $[eqn]$ and $[eqn]$ are divisible by $[eqn]$ . □

The following lemma shows that the basis elements in $[eqn]$ are eigenvectors of $[eqn]$ .

Lemma 4.  Let $[eqn]$ be an element such that $[eqn]$ . Define $[eqn]$ , $[eqn]$ , and the unitary map $[eqn]$ . Then,

$$[eqn]$$

Proof. Proposition 3 implies

$$[eqn]$$

and

$$[eqn]$$

By Lemma 3, $[eqn]$ . Write $[eqn]$ with $[eqn]$ . Then,

$$[eqn]$$

The result follows from the definition of u and v. □

Proposition 5. 

• (i)  Let $[eqn]$ be an element such that $[eqn]$ , and $[eqn]$ . Then,

$$[eqn]$$

• (ii)  The subspaces $[eqn]$ , $[eqn]$ are $[eqn]$ -invariant.

• (iii)  The $[eqn]$ -modules $[eqn]$ and $[eqn]$ are isomorphic if and only if one of the following holds:

• (a) 

• $[eqn]$ ;*

• (b) 

• $[eqn]$ ;*

• (c) 

• $[eqn]$ .*

Proof. (i) and (ii) follow from Lemma 4. (iii) Let $[eqn]$ be an $[eqn]$ -module isomorphism between $[eqn]$ and $[eqn]$ . It can be written as

$$[eqn]$$

where $[eqn]$ is an $[eqn]$ -linear bijection. Moreover,

$$[eqn]$$

Since $[eqn]$ satisfies $[eqn]$ , this means that for any $[eqn]$ , $[eqn]$ , we have

$$[eqn]$$

Let b be an element of order $[eqn]$ in $[eqn]$ . If $[eqn]$ or $[eqn]$ is in $[eqn]$ , then $[eqn]$ and a) hold. Assume that neither $[eqn]$ nor $[eqn]$ is in $[eqn]$ . Then, $[eqn]$ , and over $[eqn]$ , the minimal polynomial of $[eqn]$ has the degree three. Assume $[eqn]$ with $[eqn]$ . Then,

$$[eqn]$$

As $[eqn]$ is bijective, $[eqn]$ , $[eqn]$ follows. This means that $[eqn]$ has the same minimal polynomial and $[eqn]$ extends to a field automorphism of $[eqn]$ over $[eqn]$ . This implies $[eqn]$ , $[eqn]$ or $[eqn]$ , and the claim follows. □

5. Hermitian Codes of Degree-Three Places and Their Duals

In this section, we explore the one-point Hermitian codes of degree-three places and their dual codes. Let P be a degree-three place on the Hermitian curve $[eqn]$ ; $[eqn]$ are its $[eqn]$ -rational places, where $[eqn]$ . We define the divisors $[eqn]$ , $[eqn]$ , and $[eqn]$ for a positive integer s.

5.1. Functional Hermitian Codes of Degree-Three Places

Given a divisor D and G, we define the degree-three place functional Hermitian code $[eqn]$ as:

$$[eqn]$$

This code forms an $[eqn]$ AG code, where $[eqn]$ , achieving equality when $[eqn]$ . Furthermore, the code has a minimum distance $[eqn]$ , where $[eqn]$ is the designed minimum distance.

Furthermore, another degree-three place functional Hermitian code associated with G, denoted by $[eqn]$ , is constructed by evaluating the functions in $[eqn]$ at all rational points $[eqn]$ and the point at infinity $[eqn]$ as follows:

$$[eqn]$$

Clearly, $[eqn]$ has a length of $[eqn]$ . Concerning the dimensions, we have the following result.

Proposition 6.  If $[eqn]$ , then $[eqn]$ , $[eqn]$ and $[eqn]$ have the same dimensions.

Proof. If $[eqn]$ , then $[eqn]$ , which is trivial if $[eqn]$ . In this case, $[eqn]$ is also trivial. □

Remark 1.  Numerical experiments show that $[eqn]$ , $[eqn]$ and $[eqn]$ have the same dimension if $[eqn]$ .

In the study of the divisors D and $[eqn]$ , we make use of the polynomial

$$[eqn]$$

As shown in [13] (Section 2), the principal divisor of $[eqn]$ is

$$[eqn]$$

Further properties of $[eqn]$ are given in the following proposition.

Proposition 7.  In the function field, we have

$$[eqn]$$

The differential of $[eqn]$ is

$$[eqn]$$

Proof. Clearly,

$$[eqn]$$

and

$$[eqn]$$

Hence, by $[eqn]$ ,

$$[eqn]$$

Using this, we obtain

$$[eqn]$$

Canceling by $[eqn]$ , we get $[eqn]$ , and $[eqn]$ follows immediately. □

5.2. Differential Hermitian Codes of Degree-Three Places

Differential Hermitian codes of degree-three places are essential counterparts to functional codes on the Hermitian curve $[eqn]$ . The dual code $[eqn]$ of $[eqn]$ is called the differential code. It constitutes an $[eqn]$ code, where $[eqn]$ , with $[eqn]$ being its designed distance.

Ref. [20] (Proposition 8.1.2) provides an explicit description of the differential code as a functional code

$$[eqn]$$

where t is an element of $[eqn]$ such that $[eqn]$ for all $[eqn]$ . If $[eqn]$ and $[eqn]$ , then $[eqn]$ is a good choice, with

$$[eqn]$$

see [20] (Lemma 6.4.4). Then, (8) implies the following proposition:

Proposition 8. 

$$[eqn]$$

The computation of $[eqn]$ is more complicated. We claim the next results for the prime powers $[eqn]$ , since the proofs are rather transparent in this case. We are certain that they hold for $[eqn]$ as well. Our opinion is supported by numerical experiments with $[eqn]$ .

Lemma 5.  Assume $[eqn]$ and define the $[eqn]$ -rational function

$$[eqn]$$

Then,

$$[eqn]$$

Proof. We have $[eqn]$ , and

$$[eqn]$$

In one line,

$$[eqn]$$

Hence,

$$[eqn]$$

This implies

$$[eqn]$$

By easy cancellation

$$[eqn]$$

□

Lemma 6.  Assume $[eqn]$ and define the $[eqn]$ -rational functions

$$[eqn]$$

Let G be a divisor of $[eqn]$ whose support is disjoint from the support of $[eqn]$ . Then,

$$[eqn]$$

Proof. We have

$$[eqn]$$

For Riemann–Roch spaces, the results follow. □

Lemma 7.  For any $[eqn]$ , we have

$$[eqn]$$

Proof. We use the local expansion $[eqn]$ of $[eqn]$ at $[eqn]$ . The dots represent terms of a higher degree.

$$[eqn]$$

which implies

$$[eqn]$$

□

Lemma 8.  Assume $[eqn]$ and define the $[eqn]$ -rational functions

$$[eqn]$$

Then, $[eqn]$ .

Proof. Since

$$[eqn]$$

is the product of terms such as $[eqn]$ , it takes the value of 1 at $[eqn]$ . This implies $[eqn]$ . □

Before stating our main result on differential codes, we remind the reader that two linear codes $[eqn]$ are monomially equivalent if $[eqn]$ for some multiplier vector $[eqn]$ .

Theorem 4.  Assume $[eqn]$ and define the $[eqn]$ -rational functions

$$[eqn]$$

Let G be a divisor of $[eqn]$ , whose support is disjoint from the support of $[eqn]$ . Define $[eqn]$ for $[eqn]$ and write $[eqn]$ . Then, all entries $[eqn]$ , and

$$[eqn]$$

Proof. If $[eqn]$ , then $[eqn]$ . Therefore, $[eqn]$ and $[eqn]$ is a well-defined non-zero element in $[eqn]$ . Lemma 8 implies $[eqn]$ . The theorem follows from Lemma 6. □

Corollary 1. 

$$[eqn]$$

6. Hermitian Subfield Subcodes from Degree-Three Places

In this section, we study the subfield subcodes of $[eqn]$ . As before, q is a prime power, $[eqn]$ integer, and P is a place of degree three of the Hermitian curve $[eqn]$ . The divisor $[eqn]$ , $[eqn]$ , is defined as the sum of the $[eqn]$ -rational affine places of $[eqn]$ . The rational place at infinity is $[eqn]$ and $[eqn]$ .

6.1. Trace Maps of Hermitian Functions and Hermitian Codes

We collect properties of the maps $[eqn]$ and $[eqn]$ , where z is either a field element, a function, or a vector. We refer to $[eqn]$ as the trace of z, and to the map itself as the trace map $[eqn]$ . Clearly, Tr is linear over $[eqn]$ .

Lemma 9.  Consider a positive divisor $[eqn]$ . The trace map satisfies the following properties:

• (i)  For any function $[eqn]$ , its trace lies within $[eqn]$ , implying $[eqn]$ .
• (ii)  Similarly, for any codeword $[eqn]$ , its trace resides in $[eqn]$ .
• (iii) 

• $[eqn]$ is an $[eqn]$ -linear subspace of $[eqn]$ .*

Proof. Since $[eqn]$ , we have $[eqn]$ ; hence, (i) holds. Then, (i) implies (ii), and (iii) follows trivially. □

Proposition 9.  Let $[eqn]$ be a positive divisor that satisfies $[eqn]$ . Then, $[eqn]$ is an $[eqn]$ -linear subfield subcode of $[eqn]$ . Its dimension is

$$[eqn]$$

Proof.  $[eqn]$ is an $[eqn]$ -linear subfield subcode by Lemma 9. The trace map Tr and the evaluation map $[eqn]$ commute, and by $[eqn]$ , $[eqn]$ is injective. Define the $[eqn]$ -linear map

$$[eqn]$$

On the one hand,

$$[eqn]$$

We have to show that $[eqn]$ . Define $[eqn]$ such that $[eqn]$ if q is even and $[eqn]$ if q is odd and g is a primitive element in $[eqn]$ . Then, $[eqn]$ . For the rational function $[eqn]$ , we have

$$[eqn]$$

This finishes the proof. □

6.2. An Explicit Subfield Subcode

In this subsection, we study a subfield subcode of $[eqn]$ . As $[eqn]$ , one has

$$[eqn]$$

The vector space $[eqn]$ consists of the functions

$$[eqn]$$

For rational functions $[eqn]$ , we introduce the relation

$$[eqn]$$

This is clearly an equivalence relation, which can be also written in terms of the principal divisor

$$[eqn]$$

or in terms of the evaluation map

$$[eqn]$$

Lemma 10. 

• (i) 

• $[eqn]$ .*

• (ii) 

• $[eqn]$ .*

Proof. Lemma 7 implies $[eqn]$ . In the proof of Lemma 5, we have seen that $[eqn]$ . Therefore, $[eqn]$ for all $[eqn]$ . This shows

$$[eqn]$$

This proves (i). For (ii):

$$[eqn]$$

□

Proposition 10.  The set

$$[eqn]$$

is a three-dimensional $[eqn]$ -linear subfield subcode of $[eqn]$ .

Proof. Lemma 10(ii) implies that $[eqn]$ has $[eqn]$ -entries if and only if $[eqn]$ . □

6.3. Main Result and a Conjecture

Theorem 5.  Let $[eqn]$ be a prime power, $[eqn]$ , $[eqn]$ be the sum of rational affine places of $[eqn]$ , and P be a place of degree three. The dimension of the subfield subcode of the one-point Hermitian code is

$$[eqn]$$

Proof. Set $[eqn]$ . By Proposition 9,

$$[eqn]$$

is an $[eqn]$ -linear subspace in $[eqn]$ . Since $[eqn]$ , $[eqn]$ has dimension seven. This proves $[eqn]$ .Let $[eqn]$ be the three-dimensional $[eqn]$ -linear subfield subcode of $[eqn]$ given in Proposition 10. We show that $[eqn]$ ; the inequality $[eqn]$ will follow. On the one hand,

$$[eqn]$$

On the other hand, using Theorem 3, we have

$$[eqn]$$

As $[eqn]$ is injective on $[eqn]$ , and

$$[eqn]$$

we obtain $[eqn]$ . This completes the proof. □

Our proof was constructive, we used the subfield subcodes given explicitly in the previous subsections. Based on computer calculations for small q, we have the following conjecture.

Conjecture 1.  If $[eqn]$ , then equalities hold in Theorem 5.

The claim of the conjecture has some equivalent formulations.

Proposition 11.  The following are equivalent.

• (i) 

• $[eqn]$ .*

• (ii) 

• $[eqn]$ .*

• (iii) 

• $[eqn]$ for all $[eqn]$ .*

Proof. We use the notation of the proof of Theorem 5. Assume (i). We have $[eqn]$ . Moreover, $[eqn]$ is an $[eqn]$ -module that decomposes into the direct sum of a one-dimensional submodule and a six-dimensional submodule. Note that any non-trivial irreducible $[eqn]$ -module has dimension six. Since $[eqn]$ is a proper submodule, the only possibility is that it is one-dimensional over $[eqn]$ . (ii) follows. Trivially, (ii) implies (iii). Let us now assume (iii).

$$[eqn]$$

and therefore,

$$[eqn]$$

This implies $[eqn]$ . Together with Theorem 5, we have (i). □

We have a partial result related to case (iii) of Proposition 11.

Proposition 12. 

• $[eqn]$ for all $[eqn]$ .*

Proof. Fix an arbitrary integer s in the range $[eqn]$ and consider a generic element $[eqn]$ . This corresponds to a function g in $[eqn]$ such that $[eqn]$ is an element of $[eqn]$ for each $[eqn]$ . We note that there exists a $[eqn]$ such that at least $[eqn]$ of the $[eqn]$ values is equal to $[eqn]$ . In other words, the function $[eqn]$ is in $[eqn]$ and has at least $[eqn]$ zeros on $[eqn]$ . However, a non-zero function in $[eqn]$ cannot have more than $[eqn]$ zeros, leading us to conclude that $[eqn]$ must be the zero function. This implies that every $[eqn]$ is equal to $[eqn]$ , and hence $[eqn]$ consists of constant vectors. This completes the proof. □

7. Conclusions

In summary, our research has uncovered important properties of the family of Hermitian subfield subcodes associated with degree-three places. We achieved this by precisely determining the dimension of these codes for certain parameters and providing explicit bases for the corresponding Riemann–Roch spaces. Moreover, we conducted experiments aimed at calculating the exact dimension of the underlying family of codes across a broad spectrum of parameters. This process has contributed to the reformulation of certain conjectures, with some being proven. Additionally, we have established lower bounds on the dimension of Hermitian subfield subcodes associated with the divisor $[eqn]$ , where P is a degree-three Hermitian place, for specific cases such as $[eqn]$ , $[eqn]$ , and $[eqn]$ , utilizing the bases of the underlying family of codes. Our motivation to explore the properties of Hermitian subfield subcodes stems from their potential as a family of AG codes for post-quantum cryptography use. In our future work, we anticipate using the parameters of subfield subcodes of degree-three Hermitian codes to enhance and secure the McEliece cryptosystem.