UNIQUE DECODING OF PLANE AG CODES REVISITED

Abstract

We reformulate an interpolation-based unique decoding algorithm of AG codes, using the theory of Gr$\ddot{o}$bner bases of modules on the coordinate ring of the base curve. The conceptual description of the reformulated algorithm lets us better understand the majority voting procedure, which is central in the interpolation-based unique decoding. Moreover the smaller Gr$\ddot{o}$bner bases imply smaller space and time complexity of the algorithm.

1. Introduction

Recently a new kind of unique decoding algorithm of algebraic geometry codes was presented [4]. The algorithm decodes the primal AG code that consists of codewords obtained by evaluation of functions at rational points of an algebraic curve, unlike the classical syndrome decoding algorithm that decodes the dual code. Based on Gröbner bases of modules over a univariate polynomial ring, the algorithm has a regular data and control structure that is suitable for parallel hardware implementation, like Kötter's algorithm for the syndrome decoding [3]. The ideas used can be traced back to [2, 1].

In this paper, we reformulate the previous algorithm, using the theory of Gröbner bases of modules on the coordinate ring of the base curve. This approach eliminates the technical complexity of the previous algorithm in a large degree, and results in a conceptually clean description of the algorithm which contributes to a better understanding of the majority voting procedure, which plays a central role in the interpolation-based unique decoding. Moreover the new approach allows the algorithm to work with smaller Gröbner bases so that it can run faster and uses less space than the previous algorithm in a serial implementation.

Comparing with the well-known classical unique decoders of AG codes, Berlekamp-Massey-Sakata algorithm [7] and Kötter’s algorithm [3], the features of the new algorithm put it in a unique place in the following table.

That is, the new algorithm corrects the evaluation code C on a plane curve X working with the Gröbner bases on [X], the coordinate ring of X. Thus we may view the new algorithm as a dual version of the BMS algorithm.

Let us briefly review basic facts about AG codes. Like the previous algorithm in [4] and the BMS decoding algorithm in [7], the new algorithm is formulated for the AG codes from the Miura-Kamiya curves [5], which include Hermitian curves as prominent special cases. A Miura-Kamiya curve X is an irreducible plane curve defined by the equation

over a field with gcd(a, b) = 1 and 0 ≠ d ∈ . It is well known that X has a unique point P∞ at infinity and has a unique valuation associated with it. Let for f in the coordinate ring R of X. Then δ(x) = a and δ(y) = b. By the equation of the curve, a function in the coordinate ring R = [x, y] = [X, Y]/⟨E⟩ can be written as a unique -linear combination of the monomials xiyj with i ≥ 0 and 0 ≤ j < a, which we call monomials of R. The numerical semigroup of R at P∞,

is a subset of the Weierstrass semigroup at P∞. See [6] for basic terminology about numerical semigroups. As gcd(a, b) = 1, there is an integer b′ such that b′b ≡ 1 (mod a). If s = ai + bj is a nongap, then b′s mod a = j, (s − bj)/a = i, and therefore i and j are uniquely determined. Hence the monomials of R are in one-to-one correspondence with nongaps in S. For a nongap s, let φs denote the unique monomial with δ(φs) = s.

Let P1, P2, . . . , Pn be nonsingular rational points of X. The evaluation map ev from R to the Hamming space is the -linear map defined by φ ↦ (φ(P1), φ(P2), . . . , φ(Pn)). Let u be a fixed positive integer less than n and define Lu = {f ∈ R | δ(f) ≤ u} = ⟨φs | s ∈ S, s ≤ u⟩, where brackets denote the linear span over . Then the AG code Cu is defined as the image of Lu under ev. As u < n, ev is one-to-one on Lu. So the dimension of the linear code Cu equals Lu = |{s ∈ S | s ≤ u}|.

In Section 2, we review the theory of the Gröbner bases of modules over the coordinate rings of algebraic curves, and outline the interpolation-based decoding algorithm. The algorithm operates by iterating two core steps, the Gröbner basis computation step and the message guessing step by the majority voting procedure. Sections 3 and 4 are devoted to these core steps. In Section 5, we demonstrate the algorithm with a Hermitian code. In the final section, we give some remarks about the complexity of the algorithm.

 

2. Interpolation decoding

We assume a codeword c in Cu is sent through a noisy communication channel and v ∈ is the vector received from the channel. Let v = c+e with the error vector e. Then c = ev(μ) for a unique where we assume that the vector (ωs | s ∈ S, s ≤ u) is the message encoded into the codeword c. The decoding problem is essentially to find ωs for all nongap s ≤ u from the given vector v.

For s ≥ u, let v(s) = v, c(s) = c, and μ(s) = μ. For nongap s ≤ u, let

and for gap s ≤ u, let v(s−1) = v(s) , c(s−1) = c(s), and μ(s−1) = μ(s). Note that

for all s. Hence we see that we can find ωs iteratively.

A polynomial in R[z] defines a function on the product surface of X and the line and can be evaluated at a point (P, α) with P ∈ X, α ∈ . Hence we can define the interpolation module

for v and similarly for v(s). These interpolation modules are indeed modules over R, and finite-dimensional vector space over . Note that

where J = ∩1≤i≤n mi and ev(hv) = v, and mi = ⟨x − αi, y − βi⟩ is the maximal ideal of R associated with Pi = (αi, βi). Recall that by Lagrange interpolation, hv can be computed fast from v. We will see that the key to find ωs is the Gröbner basis of with respect to a monomial order >s, defined as follows.

Let s be an integer. For monomial xiyjzk ∈ R[z], let δs(xiyjzk) = δ(xiyj) + sk. In particular, δs(xiyjz) = ai + bj + s and δs(xiyj) = δ(xiyj) = ai + bj. The order >s on Rz⊕R put the monomials in the order of their δs values, and breaks the tie with higher z-degree. For f in Rz⊕R, the notations lts(f), lms(f), and lcs(f) denote the leading term, the leading monomial, and the leading coefficient of f, respectively, with respect to >s. Note that for f ∈ Rz⊕R, there are unique fU and fD ∈ R such that f = fUz + fD (the superscripts U and D may be read “upstairs” and “downstairs”, respectively, with z being the staircase). By the definitions, we have the following lemma.

Lemma 2.1. Let f = fUz + fD with fU, fD ∈ R. Then lms(f) ∈ Rz ⇔ δ(fU) + s ≥ δ(fD), where equality holds if and only if lms(f) ∈ Rz and lms−1(f) ∈ R.

Now let M be a submodule of Rz⊕R. A finite subset B of M is called a Gröbner basis with respect to >s if the leading term of every element of M is divided by the leading term of some element of B. We will write where are some index sets, with the understanding that each Gi is a basis element such that lms(Gi) ∈ R and each Fj is a basis element such that lms(Fj) ∈ Rz. The sigma set Σs = Σs(M) of M is the set of all leading monomials of the polynomials in M with respect to >s. The delta set Δs = Δs(M) of M is the complement of Σs in the set of all monomials of Rz⊕R. For the case that M is an ideal of R, we may omit the superfluous s from the notations, and denote >s simply by >. Note that if lms(f) ∈ Rz, then lms(f) = lm(fU)z, and if lms(f) ∈ R, then lms(f) = lm(fD). It is easy to see by the definition of Gröbner bases that

where Σ(T), Δ(T) with a set T of polynomials in R have natural definitions.

As J is an ideal of R, it has a Gröbner basis with respect to >, and since J is the ideal associated with the sum of n rational points on X. By (2), we see that (Rz ⊕R/Iv) = (R/J) = n. Let N = δ(hv). The set is then a Gröbner basis of Iv with respect to >N. Let us denote a Gröbner basis of with respect to >s by Observe that if s is a nongap ≤ u, then the set is still a Gröbner basis of with respect to >s, but not with respect to >s−1 in general. These observations lead to the following interpolation decoding algorithm.

Interpolation Decoding Algorithm. Let v be the received vector.

In the next section, we will elaborate on the step M2. The results in the section will lay a foundation for Section 4, in which we give details of the main steps M1 and M2.

 

3. Gröbner basis computation

First we review the concept of the lcm, least common multiple, for the monomials of R. For two monomials φs and φt, we say φs divides φt if there exists a unique monomial λ such that

The unique monomial λ will be denoted by the quotient φt/φs. Note that φs divides φt if and only if t − s is a nongap, and in this case, actually λ = φt−s. Therefore φs and φt do not divide each other if and only if s + S and t + S do not contain each other.

Proposition 3.1. Suppose s +S and t + S do not contain each other. Then there are unique nongaps l1 and l2 such that

Indeed we can take l1 = min(s+ℕa) ∩ (t+ℕb) and l2 = min(s+ℕb) ∩ (t+ℕa).

Proof. Recall that S = ℕa + ℕb. By the definitions of l1 and l2, the inclusions l1 +S ⊂ (s+S)∩(t+S), l2 +S ⊂ (s+S)∩(t+S) are obvious. So it remains to show the reverse inclusion. Suppose c ∈ (s+S)∩(t+S). Then c = s+s1a+s2b = t + t1a+t2b for some s1, s2, t1, t2 ∈ ℕ. By our assumption that s + S and t + S do not contain each other, we either have s1 ≥ t1, s2 < t2 or s1 < t1, s2 ≥ t2. In the former case, s+(s1−t1)a = t+(t2 −s2)b ∈ (s+ℕa)∩(t+ℕb) ⊂ l1+S, and hence c ∈ l1 + S. In the latter case, similarly we have c ∈ l2 + S. This shows that (s + S) ∩ (t + S) ⊂ (l1 + S) ∪ (l2 + S).

By the definition, we call and the lcms of φs and φt. In the case when φs divides φt, we will call φt the lcm of φs and φt.

Let be a Gröbner basis of a submodule M of Rz ⊕ R with respect to >s. We want to compute a Gröbner basis of the same module M with respect to >s−1 from B. Note that while lms−1(Gi) = lms(Gi) ∈ R for all , we may have either lms−1(Fj) = lms(Fj) ∈ Rz or lms−1(Fj) ∈ R depending on . Let Σs and Δs denote the sigma set and the delta set of M with respect to >s, respectively. Observe that Σs−1 ∩ Rz ⊂ Σs ∩ Rz, Σs−1 ∩ R ⊃ Σs ∩ R.

For those such that lms−1(Fj) = lms(Fj) ∈ Rz, define spoly(Fj) = {Fj}. If lms−1(Fj) ∈ R∩Σs, then there is an such that lms(Gi)|lms−1(Fj), and then, with one such i, define

Finally, if lms−1(Fj) ∈ R ∩ Δs, then define

which is generally not a singleton set unlike the previous two cases.

Proposition 3.2. For every f ∈ spoly(Fj), lms−1(f) is in Rz.

Proof. Recall that lms(Fj) ∈ Rz. Suppose lms−1(Fj) ∈ R, and let ψ be an lcm of lms−1(Fj) and lms(Gi) for any . Then by Lemma 2.1,

Therefore On the other hand,

As the monic terms cancel each other, Therefore and hence by Lemma 2.1,

For the case when lms−1(Fj) ∈ R ∩ Σs, notice that lms−1(Fj) is the lcm.

Proposition 3.3. A monomial φ is in R ∩ Σs−1 if and only if there exists an such that lms−1(Gi)|φ or there exists a such that lms−1(Fj) ∈ R∩Δs and lms−1(Fj)|φ.

Proof. Both lms−1(Gi)|φ and lms−1(Fj)|φ imply φ ∈ R ∩ Σs−1. Let us show the converse. If φ ∈ R ∩ Σs, then lms(Gi)|φ for some , and therefore lms−1(Gi)|φ. As R ∩ Σs−1 ⊃ R ∩ Σs, it remains to consider the case when φ ∈ R ∩ (Σs−1 ＼ Σs).

Suppose f ∈ M is such that φ = lms−1(f) ∈ R∩(Σs−1＼Σs). Since φ ∉ R∩Σs, we must have lms(f) ∈ Rz, and hence by Lemma 2.1, δ(fU)+s = δ(fD) = δ(φ). Then lms(Fj)|lms(f) for . As lms(Fj) ∈ Rz, we have where actually equality holds as we will show now. Assume the contrary, that is, Then

These imply contradictory to the assumption φ ∉ R ∩ Σs. Hence and

Therefore lms−1(Fj)|φ, and lms−1(Fj) ∈ R ∩ Δs.

roposition 3.4. A monomial φ is in Rz ∩ Σs−1 if and only if there exists a such that lms−1(f)|φ for some f ∈ spoly(Fj).

Proof. By Proposition 3.2, the converse is clear. Let us assume φ ∈ Rz ∩ Σs−1. Suppose φ = lms−1(f) for some f ∈ M. Then φ = lms(f), and there exists some such that lms(Fj)|φ. If lms−1(Fj) ∈ Rz, then Fj ∈ spoly(Fj) and lms−1(Fj) = lms(Fj)|φ.

Suppose lms−1(Fj) ∈ R∩Σs. Then there is an such that lms(Gi)|lms−1(Fj) and and by (3),

Suppose lms−1(Fj) ∈ R∩Δs. Note that δ(fU)+s > δ(fD), and hence

Thus we see that and hence there is an such that Now there is an lcm ψ of lms−1(Fj) and lms(Gi) such that

and By (3), and finally from (4),

Combining the above results, we obtain

Theorem 3.5. Suppose that is a Gröbner basis of M with respect to >s. Then

is a Gröbner basis of M with respect to >s−1.

In general, the Gröbner basis may contain more elements than necessary. Indeed, we can reduce each set in the union by removing the redundant elements whose leading term is divisible by that of other elements in the set. We will denote this reduced Gröbner basis of M with respect to >s−1 by

 

4. Message Selection

The ideal of the error vector e defined by has a Gröbner basis {ϵi | i ∈ Ɛ} with respect to >, and

Recall that is a Gröbner basis of with respect to >s. Observe that which results in and hence Therefore

Now let s be a nongap ≤ u. Let us consider the module

for w ∈ . Note that is a Gröbner basis of with respect to >s since lms(f(z + wφs)) = lms(f) for all . For the same reason, Observe that Hence

In Theorem 4.3 below, we will characterize ωs as such a w that makes the value smallest, provided that wt(e) is not too large. Recall that in the following arguments.

Lemma 4.1. For

Proof. Observe that Therefore Hence equivalent to the second equality.

Lemma 4.2. |Δ(Jeφs)| = wt(e) + s.

Proof. Note that

The equality |S ＼ (s + S)| = s holds for any numerical semigroup S, since S is closed under addition and contains all large enough integers.

Theorem 4.3. The value is smallest for w = ωs, provided that |Δ(J) ∪ Δ(Rφs)| − s > 2wt(e).

Proof. We need to show that for By (7) and the previous lemmas, a sufficient condition for the above is

since |Δ(J)| = n. Finally note that |Δ(J) ∪ Δ(Jeφs)| ≥ |Δ(J) ∪ Δ(Rφs)|.

since is independent of w. The value can be computed using the Gröbner bases of with respect to >s and >s−1. As we saw in Section 3, the Gröbner basis of with respect to >s−1 is determined from the Gröbner bases of with respect to >s. Precisely, according to Proposition 3.3, the set is determined by the monomials that lies in

We note that for each there is a unique wj ∈ such that lms−1(Fj(z+wjφs)) ∈ Rz, and if and only if w ≠ wj. In fact, where d is the coefficient of the monomial

Proposition 4.4. Let ⊔ denote disjoint union. We have

Proof. The first equality follows from Proposition 3.3. It remains to show that the second union is disjoint. Assume that for c1, c2 ∈ with c1≠ c2, there is a monomial φ ∈ R such that φ is in the intersection of

and

Let and monomials ψ, χ. Then we will show that

contradicting the assumption that Indeed notice that Hence the coefficient of the monomial φ in the first term of the polynomial in (8) is where d1 is the coefficient of the monomial In the same way, the coefficient of the monomial φ in the second term after the minus in (8) is where d2 is the coefficient of the monomial These two coefficients are different because we assumed

Hence (8) follows.

We observe that for c, w ∈ with w≠ c,

Therefore this set is independent of w, and is determined by B(s). Let

Then Proposition 4.4 implies is smallest when w = c with dc largest. Now we elaborate the main steps of the interpolation decoding algorithm as follows.

Theorem 4.5. The algorithm outputs w(s) = ωs for all s ∈ S, s ≤ u if

where ν(s) = |Δ(J) ∪ Δ(Rφs)| − s for s ∈ S. Moreover du ≥ n − u.

Proof. By Theorem 4.3, the condition du > 2wt(e) implies that the algorithm computes w(s) = ωs for each iteration for nongap s from u to 0. To see du ≥ n−u, notice that |Δ(J) ∪ Δ(Rφs)| ≥ |Δ(J)| = n.

 

5. Decoding Hermitian Codes

Let us consider the Hermitian code Cu defined on the Hermitian curves with equation Yq + Y − Xq+1 = 0 over There are q3 rational points on the Hermitian curve, and In Theorem 5.1, we determine the performance of the decoding algorithm for Cu. Recall that the same result was proved for the previous algorithm in Proposition 14 in [4], but the proof for the present algorithm is clearer and short.

Theorem 5.1. For nongap u < q3, let u = aq+b, 0 ≤ b < q. Then du = q3−aq if b ≤ a + q − q2 and du = q3 − u if b > a + q − q2.

Proof. We first compute ν(s) for nongap s = qs1 + s2 < q3. As

we have ν(s) = |{t ∈ S | q3 + t − s ∉ S}| + q3 − s. Note that q3 + t − s = q(q2 +t1 −s1)+t2 −s2 with t = qt1 + t2. Therefore q3 +t−s ∉ S if and only if t2 − s2 ≥ 0, q2 + t1 − s1 < t2 − s2 or t2 − s2 < 0, q2 + t1 − s1 < q + 1 + t2 − s2. The first case is actually impossible since s1 < q2. Hence

Thus ν(s) = s2 max{s1 − s2 + q + 1 − q2, 0} + q3 − s for s = qs1 + s2 < q3. If a−b+q−q2 ≥ 0, then the minimum is attained at s = aq, and hence du = q3−aq while if a − b + q − q2 < 0, then the minimum is attained at s = u, and hence du = q3 − u.

Now we demonstrate the decoding algorithm, using the same example in [4] to facilitate a comparison with the previous algorithm. So we use the Hermitian curve y3 + y − x4 = 0 over with α2 − α − 1 = 0. There are 27 rational points on the affine part of the curve and a unique point P∞ at infinity. As δ(x) = 3 and δ(y) = 4, the numerical semigroup of the coordinate ring R is S = 3ℕ + 4ℕ = {0, 3, 4, 6, 7, 8, 9, 10, . . . }. Note that S has three gaps 1, 2, and 5. The monomials of R correspond to nongaps in S and are displayed in the diagram

Let u = 16. Then the Hermitian code C16 has dimension 14 and minimum distance 11, and the decoding algorithm can correct up to 5 errors. Suppose we received the vector

from a noisy channel. Let us follow the steps of the decoding algorithm.

The algorithm first compute the Lagrange interpolation of v,

The algorithm iterates the main steps for s from N = δ(hv) = 32 to 0. The ideal J has Gröbner basis {η1 = x9 − x}. Hence the Gröbner basis of is

Here the left diagram exhibits the monomials in omitting the common z variable, while the right diagram shows the monomials in The leading terms of the polynomials in the Gröbner basis are also shown.

For s ≥ u = 16 or a gap s, as in the step M1, we will omit the tilde in the following. In the step M2, lm31(F1) = x8y2 ∈ Δ32(G1) ∩ R, and the lcms of lm31(F1) = x8y2 and lm32(G1) = x9 are x9y2 and x12. Hence spoly(F1) = {αxz + α5x8y2 + · · · + α5x2, αyz + α5x11 + · · · + α2xy}. Then the Gröbner basis of is

As lms(F1), lms(F2) ∈ Rz for s = 31, 30, there is no change in the Gröbner basis. So we get to the unaltered Gröbner basis of

Now since lm29(G2) = x8y2 divides lm28(F1) = x8y2 and lm29(G1) = x9 divides lm28(F2) = x11, both lm28(F1) and lm28(F2) are in Σ29(G1,G2) ∩ R Thus

Hence the Gröbner basis of is

Similar steps are iterated. Eventually, we get to the Gröbner basis of

Now s = 16 is a nongap and ≤ u = 16. So in the step M1, we proceed to select ω16 for the monomial φ16 = x4y. The leading coefficient of F1 is α2 and the coefficient of the monomial x6y in F1 is α7, where x6y is the leading monomial of x2φ16. Hence w1 = −(α7/α2) = α. The leading coefficient of F2 is α5 and the coefficient of the monomial x8 in F2 is α7, where x8 is the leading monomial of y2φ16. Hence w2 = −(α7/α5) = α6. So W = {α, α6}. The shape of

is

and thus dα = 2. On the other hand, the shape of

is

and thus Hence we take w(16) = α. Then

In the step M2, So spoly and since the lcm of and the lcms of

Removing redundant elements, we have

Thus the Gröbner basis of is

Continuing in this way, after the last iteration for s = 0, we get to the Gröbner basis of

Finally, the algorithm output the recovered message

 

6. Final Remarks

By carefully counting the number of finite field multiplication operations needed for an execution of the algorithm for the received vector with wt(e) ≤ τ , we can estimate the complexity of the algorithm as With the assumptions this is the same complexity that Sakata et al. obtained for the algorithm in [7].

We now discuss on the advantages of the present algorithm compared with the previous one in [4], in terms of time and space complexity. First note that by the structure of both algorithms, the decoding time and the size of the required space are largely dictated by the number of polynomials that needs to be kept and updated by the algorithm through the iterations. Recall that the present algorithm works with the Gröbner bases of modules over the coordinate ring [x, y], which is realized as the quotient ring of the two-variate polynomial ring modulo the curve equation (1), while the previous algorithm works with the Gröbner bases of the same modules but viewed as modules over [x]. Thus the previous algorithm, from the start, keeps and updates at each iteration 2a polynomials in Rz⊕R. On the other hand, the present algorithm starts with at least 2 polynomials in Rz⊕R, and keeps and updates polynomials whose number grows through the iterations to at most 2a, the precise number depending on the “shape of the error”, Δ(Je).

For the example in Section 5 and also in Section IV of [4], where a = 3, the previous algorithm always keeps and updates 6 polynomials, and the present algorithm starts with 2 polynomials and ends with 4 polynomials. This difference gets amplified as we consider longer codes. For the [64, 53, 8] Hermitian code C58 over which has the largest dimension among the Hermitian codes of length 64 that can correct up to 3 errors, the following table shows the counts of the possible shapes of the errors.

We can see from the table that the number of Fj in B(s) is bounded above by 2 when wt(e) = 1 or 2, and by 3 when wt(e) = 3. The number of Gi in B(s) is bounded above by 4 but usually comes close to the number of Fj , as observed in experiments. This contrasts with 8 polynomials kept and updated by the previous algorithm independent of the number of errors.

For a fair comparison, however, we should note that for the present algorithm to take full advantage of this smaller size of Gröbner bases, it needs to efficiently compute the reduced Gröbner basis (5) by avoiding to compute unnecessary polynomials in spoly(Fj), those that would be discarded anyway to reduce the Gröbner basis. To summarize, the present algorithm has the potential to run faster and use smaller space than the previous algorithm, but the final winner would depend on implementation details in software or hardware.

Finally the author thanks the anonymous referees for valuable comments.