Efficient Decoding of Double-circulant and Wozencraft Codes from Square-root Errors

Let c=(c_0,c_1) \in C be a non-zero codeword, where c_0, c_1 \in \mathbb{F}_q^k, we shall show that wt(c) \geq \frac{d} {b} +1. To see this, note that c is a non-zero linear combination of columns of G. Suppose that this linear combination has \ell non-zero entries i_1, \ldots, i_\ell \in [k] for some \ell \in [k].

Then by the structure of G, we have that \mathrm{wt}(c_0) = \ell. Moreover, since A is a (d,b)-design matrix, we have that the i_1 column of G has weight at least d, and the support of any other column from i_2, \ldots, i_\ell intersects the support of i_1 in at most b entries. Consequently, we have that \mathrm{wt}(c_1) \geq \max\{0,d - (\ell-1) \cdot b\}. But this implies in turn that

Finally, note that the righthand expression is minimized when \ell = \frac{d} {b}+1, in which case it equals \frac{d} {b}+1.

For the moreover part, let a \in \mathbb{F}_q^k denote the first column of A, and note that since A is circulant, \mathrm{wt}(a) \leq r. Let c=(c_0,c_1) \in C be a non-zero codeword, where c_0, c_1 \in \mathbb{F}_q^k. Then by Claim 2.5 and the structure of G, we have that c_1 is the length k coefficient vector of a(x) \cdot c_0(x) \; (\bmod\; x^k -1). Suppose that \mathrm{wt}(c_0)=\ell. Then \mathrm{wt}(c_1) \leq \mathrm{wt}(a) \cdot \mathrm{wt}(c_0) \leq r \cdot \ell, and so c has at least \max\{0,k-\ell \cdot r\} zero entries. But this means that

where the righthand expression is minimized when \ell = \frac kr, in which case it equals \frac kr. Finally, note that

Since A is circulant and \mathrm{wt}(a)=d, we clearly have that each column of A has weight d. Next we show that the intersection of the supports of any pair of columns of A has size at most 2.

Fix 1\leq i<j \leq k, we shall show that the intersection of the supports of the i-th and j-th columns of A has size at most 2.

Suppose on the contrary that the intersection has size at least 3.

Then by the circulant structure of A, there exist distinct s_1, s_2, s_3 \in S and distinct s'_1, s'_2, s'_3 \in S so that

or equivalently,

Furthermore, since S \subseteq [k], we have that -k+1\leq s_1-s'_1,s_2-s'_2,s_3-s'_3\leq k-1, therefore they are all equal j-i or j-i-k, since 1\leq j-i\leq k-1. Furthermore, we have that s_1 \neq s'_1, s_2 \neq s'_2, and s_3 \neq s'_3.

Consequently, by the pigeonhole principle, there exist two values out of the three values s_1-s'_1,s_2-s'_2,s_3-s'_3 which are the same, without loss of generality, assume that s_1-s'_1=s_2-s'_2. But by the definition of a Sidon set, this implies in turn that s_1=s_2, which contradicts the assumption that s_1, s_2, s_3 are all distinct.

The decoding algorithm for the code C is given in Figure ? below. For i \in [k], let S_i \subseteq [k] denote the support of the i-th column in A.

The running time of the algorithm is clearly \mathrm{poly}(k, \log q). To show correctness, let w=(w_0, w_1) \in \mathbb{F}_q^{2k} be a received word, where w_0, w_1 \in \mathbb{F}_q^k, and let c=(c_0, c_1) \in C be a codeword so that \mathsf{dist}(c,w) < \frac{d} {2b}, where c_0, c_1 \in \mathbb{F}_q^k. We shall show that the algorithm will output c.

To this end, it suffices to show that the string z which the algorithm computes on Step ? satisfies that z = w_0-c_0, as in this case the algorithm will clearly compute the correct codeword c on Step ?.

Let e=(e_0,e_1):=w-c \in \mathbb{F}_q^{2k}, where e_0, e_1 \in \mathbb{F}_q^k, and note that \mathrm{wt}(e) < \frac{d} {2b} by assumption that \mathsf{dist}(c,w) < \frac{d} {2b}. Moreover, we have that

We would like to show that z=e_0=w_0-c_0. To this end, fix i \in [k], we shall show that z_i = (e_0)_i. Let S := \bigcup_{\ell \in \mathrm{supp}(e_0)\setminus \{i\}} S_\ell. Note that for any j \in S_i so that j \notin S \cup \mathrm{supp}(e_1), we have that y_j = (e_0)_i. We shall show that the majority of j \in S_i satisfy that j \notin S \cup \mathrm{supp}(e_1), and consequently z_i = (e_0)_i.

To see the latter, note that since A is a (d,b)-design matrix, we have that |S_i| \geq d. Moreover, |S_\ell \cap S_i| \leq b for any \ell \neq i, and so

But this implies in turn that

So the majority of j \in S_i satisfy that j \notin S \cup \mathrm{supp}(e_1), and so z_i = (e_0)_i.

For k=2^m -1 \in I, let C_k \subseteq \mathbb{F}_2^k be the dual of the punctured RM code \mathrm{RM}^*(\frac m 2, m). By Fact 2.2 and Proposition 2.4, both C_k = (\mathrm{RM}^*(\frac m 2, m))^\perp and C_k^\perp = \mathrm{RM}^*(\frac m 2, m) are cyclic codes. By Fact 2.3, C_k^\perp = \mathrm{RM}^*(\frac m 2, m) has distance at least d^\perp:=2^{\frac m 2} -1= \Omega(\sqrt{k}), and is decodable from \frac {d^\perp} 2-errors in time \mathrm{poly}(k). Further observe that C_k = (\mathrm{RM}^*(\frac m 2, m))^\perp is the code consisting of all codewords in \mathrm{RM}^*(\frac m 2 -1, m) which correspond to polynomials f(x_1, \ldots, x_m) with f(0)=0. Therefore by Fact 2.3, C_k has distance at least d:=2^{m/2+1}-1 \geq \sqrt{k}, and is decodable from \frac d 2 errors in time \mathrm{poly}(k).

Finally, we note that C_k is d-balanced. To see this, let c be a codeword in C_k = (\mathrm{RM}^*(\frac m 2, m))^\perp associated with some non-zero polynomial f(x_1, \ldots, x_m) of degree at most \frac m 2-1 which satisfies that f(0)=0. Then by the distance property, c has weight at least d, and so c has at least d non-zero entries. Furthermore, we have that 1-f(x_1, \ldots, x_m) is also a polynomial of degree at most \frac m 2 -1 which satisfies that f(0)=1, and so it is not the zero polynomial. So the codeword \bar c \in \mathrm{RM}^*(\frac m 2 -1, m) associated with this polynomial has weight at least d. But this implies in turn that c has at least d zero entries. So we have shown that any non-zero codeword in C_k has at least d non-zero entries, and at least d zero entries, and consequently C_k is d-balanced.

The conclusion then follows by applying Theorem 4.1 to the code family \mathcal{C}.

It suffices to show that for any polynomial f(x) \in \mathbb{F}_{<k}[x],

where we view g(x)\cdot f(x) as a polynomial in \mathbb{F}_{<n}[x].

But the above follows since for any f(x) \in \mathbb{F}_{<k}[x],

By Proposition 2.1, the assumption that q is a primitive root modulo n implies that p_n(x)=\sum_{i=0}^{n-1}x^i is an irreducible polynomial over \mathbb{F}_q. Consequently, x^n-1=(x-1)\cdot p_n(x) is the only non-trivial way to decompose x^n-1.

Let g(x), h(x) denote the generator and check polynomial of C, respectively. Then g(x) \cdot h(x) = x^n-1, and consequently either g(x) or h(x) divides x-1. In the case that g(x) divides x-1, we have that either g(x)=1, in which case C is the identity code of distance 1, or that g(x)=x-1, in which case C is the parity code of distance 2. In the case that h(x) divides x-1, we have that either h^\mathrm{rev}(x) =1, in which case C^\perp is the identity code of distance 1, or that h^\mathrm{rev}(x) = -x+1, in which case C^\perp is the parity code of distance 2. So we have that in either cases, \min\{\Delta(C), \Delta(C^\perp)\}\leq 2.

By assumption that q^s \equiv 1 \; (\bmod \; k), we have that k \mid q^s -1, and so x^k -1 \mid x^{q^s-1} -1. By assumption that r(x) \mid x^k-1, this implies in turn that r(x) \mid x^{q^s-1} -1. Next recall that the roots of x^{q^s-1} -1 are all elements in the multiplicative group of the field \mathbb{F}_{q^s}. Since r(x) \mid x^{q^s-1} -1, the same holds for all roots of r(x), and since r(x) is irreducible over \mathbb{F}_q, this implies in turn that \deg(r(x))\leq s.

Let us assume by contradiction that \min\{\Delta(\mathcal{C}), \Delta(\mathcal{C}^\perp) \} = \Omega(n). We know that for any n \in \mathbb{N}, R(C_n)+R(C_n^\perp)=1, therefore either R(C_n)\geq 1/2 or R(C_n^\perp)\geq 1/2. But since both C_n and C_n^\perp are cyclic codes, this implies in turn the existence of an infinite family of cyclic codes of rate \frac 1 2 and constant relative distance, contradicting Conjecture 5.6.