Reed-Solomon-Gabidulin Codes

12/21/2018 ∙ by Xavier Caruso, et al. ∙ 0

We introduce Reed-Solomon-Gabidulin codes which is, at the same time, an extension to Reed-Solomon codes on the one hand and Gabidulin codes on the other hand. We prove that our codes have good properties with respect to the minimal distance and design an efficient decoding algorithm.



There are no comments yet.


page 1

page 2

page 3

page 4

This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.


Reed–Solomon codes form a well-known class of error detection and correction codes which have very interesting properties (optimal minimal distance, efficient decoding algorithms). They were introduced in 1960 by Reed and Solomon and are nowadays widely used in everyday life. About twenty years later, Delsarte [4], Gabidulin [5] and Roth [11]—independently—imagined an analogue of Reed–Solomon codes in the context of the rank distance, which is finer than the standard Hamming distance and well suited for some applications (e.g. network coding). These codes are nowadays called Gabidulin codes. Their construction is based on the concept of linearized polynomials over the finite fields. More recently several authors generalized and optimized Gabidulin codes. In 2013, in her thesis [12] and subsequent papers, Wachter-Zeh proposed an efficient implementation of operations with linearized polynomials, together with an equivalent of Gao’s decoding algorithm.

In 2009, Boucher, Geiselmann and Ulmer [1] introduced analogues of BCH codes in the Gabidulin’s context of linearized polynomials (cf also [2]). It worths mentionning that they use Ore polynomials (introduced by Ore in 1933 in [8]) in place of linearized polynomials. Although the two approaches are equivalent in the case of finite fields, it turns out that Ore polynomials are more general objects which continue to make sense in a large variety of settings. Taking advantage of this new point of view, Robert proposed in his thesis [10] an extension of Gabidulin’s code to the caracteristic zero, in which basically finite fields are replaced by number fields.

Another advantage of Boucher, Geiselmann and Ulmer’s approach is that it allows longer codes: while the length of a Gabidulin code is necessarily bounded from above by the degree of the finite field we are working with, this bound can be generally overpassed in Boucher, Geiselmann and Ulmer’s construction. On the other hand, no efficient decoding algorithm is known.

Contribution of the article.

In the present paper, we introduce and study a new generalization of Gabidulin codes, which combines all the benefits of previous constructions. Precisely, we shall show that:

(1) as for Gabidulin codes, our codes are MDS (Maximal Distance Separable),

(2) as in Boucher, Geiselmann and Ulmer’s work, long codes are permitted,

(3) as in Wachter-Zeh’s work, there exists an efficient decoding algorithm.

Besides, the setting we consider includes the case of finite fields (as in Gabidulin’s initial definition) and number fields (as in Robert’s generalization) but it is even more general. For example, our construction allows the base field to be the field of rational fractions in the variable over a finite field equipped with its canonical derivation .

Moreover it turns out that, for a special choice of parameters, our codes extend classical Reed–Solomon codes. For this reason, we have decided to call them Reed–Solomon–Gabidulin (RSG333Be careful at not making the confusion with GRS codes, which stands for Generalized Reed–Solomon codes. for short) codes.

Organization of the article.

This paper is divided in two sections. The first one is devoted to introduce and develop the necessary background on Ore polynomials and related notions. We will study particularly the notion of evaluation morphisms which is the main ingredient we will need for defining GRS codes. In the second section, we introduce GRS codes and state their main properties (cf (1), (2), (3) above). For the sake of brievity, proofs are omitted though intermediate steps are often isolated.

1 Ore polynomials

Throughout this article, we use the following notation: is a field, be a ring homomorphism and be a -derivation, i.e. an additive mapping such that for all .

We shall denote by the subfield of consisting of elements such that and . We will always assume that the extension is finite and will denote by its degree. Our assumption implies in particular that has finite order and thus is bijective.

Definition 1.1 (Ore polynomial ring).

The ring of Ore polynomials is the ring whose elements are polynomials in over endowed with the usual addition and with the multiplication defined by the rule:

Example 1.2.

Throughout this article, we will illustrate our constructions with the two following examples:

  • (This setting is the one in which Gabidulin codes were first defined by Gabidulin in [5], with a slightly different vocabulary.) Let be a prime number, be a power of and be a positive integer. We let denote a finite field with cardinality . We endow it with the Frobenius . The first Ore ring we will be interested in is . In this setting, the subfield of we have introduced is . The degree of the extension is then .

  • More generally, one can pick an arbitrary field , endow it with a finite order automorphism and consider the Ore ring . Beyond the case of finite fields, natural examples are cyclotomic extensions of or Kummer extensions. This case was addressed in Robert’s thesis [10].

  • Let be a field of characteristic . We consider the field and endow it with the natural derivation . We can then form the Ore ring . Here the subfield of is and the degree of the extension is then .

The notion of degree extends verbatim to Ore polynomials: if is an Ore polynomial, its degree is the largest integer for which . Besides, one can prove the existence of a right Euclidean division for Ore polynomials: if with , there exist unique with and . This has the usual consequences: the noncommutative ring is left-principal, right gcds and left lcms are well defined and can be computed by Euclidean algorithm. Similarly, left Euclidean divisions, left gcds and right lcms do exist (since our general assumptions imply that is bijective).

Notation: In what follows, we will denote by the remainder in the right division of by .

The centre.

Recall that the centre of a noncommutative ring is by definition the subset of consisting of elements such that for all . We observe in particular that the centre of is a commutative subring of . In the case of Ore polynomials, the centre can actually be computed precisely. In what follows, we will not need a complete description but only the general structure of the centre as given by the next proposition.

Proposition 1.3.

There exists a central Ore polynomial of degree such that the centre of is , i.e. the subset of Ore polynomials that can be written as a polynomial in with coefficient in .

We observe that the equality:

implies readily that (compare the degrees) and for all . As a consequence the centre is an actual (commutative) ring of univariate polynomials with coefficients in .

On the other hand, we draw the attention of the reader to the fact that the properties of Proposition 1.3 do not determine uniquely but only up to an additive constant in .

Example 1.4.

We continue Example 1.2. In the settings (1) and (1’), it is easily seen that the centre of is . In the setting (2), the centre of (where is a field of characteristic ) is .

Pseudo-linear morphisms.

Another important notion is that of pseudo-linear morphisms. It is defined as follows:

Definition 1.5 (Pseudo-linear morphism).

Let and

be two vector spaces over

. A pseudo-linear morphism is a map verifying for all and .

We observe that any pseudo-linear morphism is a fortiori -linear (where is defined at the beginning of this section).

Pseudo-linear morphisms are relevant in the context of Ore polynomials because the Ore multiplication reflects the composition rule of pseudo-linear morphisms. More precisely, given a pseudo-linear endomorphism and an Ore polynomial , one defines . One then easily checks that where the multiplication on the right hand size is the Ore multiplication. In other words, denoting by the ring of -linear maps from to itself, the “evaluation” mapping

is a ring homomorphism for any pseudo-linear endomorphism .

The case where is itself deserves particular attention. Indeed, we first observe that evaluation is then closely related to Euclidean division thanks to the formula:


which is correct for any pseudo-linear endomorphism of , any and any . Second, we have a complete classification of pseudo-linear endomorphisms of .

Proposition 1.6.

The pseudo-linear endomorphisms of are exactly the maps of the form with .

In what follows, we will often use the notation in place of .

Main properties of the ’s.

We denote by the subset of consisting of elements for which is not of the form with . Except in the very particular case where and (where is obviously empty), one can prove that there is at most one bad value of , i.e. the difference between and consists at most of one element.

Proposition 1.7.

For all , the ring homomorphism is surjective and its kernel is a principal ideal generated by for some element .

Remark 1.8.

The function defined by Proposition 1.7 above is not canonical since it depends on the choice of the constant coefficient of . Two different choices lead to functions and such that for some constant .

Definition 1.9.

Let . We say that and are equivalent if or, equivalently, .

Using Noether–Skolem Theorem, one can prove the following characterization:

Lemma 1.10.

The elements and are equivalent if and only if there exists , such that .

In particular, the equivalence class of is exactly the image of .

Example 1.11.

Let us first focus on the settings (1) and (1’) of Example 1.2. The subset is then . Moreover if we have chosen (see Example 1.4), it is not difficult to prove that the map is the norm of over . In this context, the characterization of Lemma 1.10 is a classical consequence of Hilbert 90 theorem which says that an element has norm if and only if it can be written for some .

When and , we have . In this case, the image of is and there is exactly equivalence classes for the equivalence relation introduced in Definition 1.9.

In the setting (2), we have . Moreover, with the normalization , one can prove444Through the proof is not obvious. that for any . Here, Lemma 1.10 asserts that if and only if the difference is a logarithmic derivative. It is easily seen that a polynomial cannot be a logarithmic derivative. Consequently the elements of are pairwise nonequivalent, implying in particular that there are infinitely many equivalence classes for this relation.

2 Reed–Solomon–Gabidulin codes

We keep the notations of the previous section. In particular, we recall that is the subset of consisting of elements for which is not of the form with .


Throughout this section, we fix a positive integer . We consider a family of elements of which are pairwise non-equivalent in the sense of Definition 1.9. Moreover, for each , we pick a positive integer together with a family of -linearly independant elements of . The latter condition obviously implies that for all . We set . To all these data, we associate the -linear mapping:

Thanks to Eq. (1), the mapping can be rewritten in terms of Euclidean divisions. More precisely, for and , letting:


we have .

For any positive , we let denote the restriction of to the subspace consisting of Ore polynomials of degree less than .

Example 2.1.

Consider the setting (1) of Example 1.2. Let be a multiplicative generator of . Its norm over is a multiplicative generator of . By what we did in Example 1.11, the elements for are pairwise nonequivalent as soon as . (Here, for simplicity, we have shifted our indices so that they start from instead of .) Moreover is a basis of over . One can then take for all and for . With these parameters, we easily compute .

Example 2.2.

Consider the setting (2) of Example 1.2. By Example 1.11 again, we can take any family of pairwise distinct polynomials. Moreover a basis of over is obviously . Therefore, we can take and for . A direct computation leads to .

Taking , , and , we find that the matrix of is:


The kernel of is the principal ideal generated by the Ore polynomial:


The next lemma shows that the assumption we made on the ’s and ’s are directly related to the degree of .

Lemma 2.3.

With the above notations and assumptions, the Ore polynomial has degree .

In particular, the map is bijective.

Example 2.4.

Continuing Example 2.1, the Ore polynomial defined in (4) is where we recall that is the norm map. (Observe that the factors all lie in the centre of so that the product we have written in not ambiguous.) In particular, when , we get .

Example 2.5.

Continuing Example 2.2 and assuming further that the ’s lie in , we find that the polynomial defined in (4) is . In particular, if is a finite field of cardinality and the ’s enumerate the elements of (so that ), we have .

Definition and first properties.

We are now ready to define Gabidulin codes in the extended framework discussed in the introduction of this section.

Definition 2.6.

With the previous notations, the Reed–Solomon–Gabidulin (RSG for short) code associated to c and g is the image of .

Remark 2.7.

From the definition, it follows that the matrix of (in the canonical basis) is a generator matrix of . The matrix (3) then provide an example of a generator matrix of a RSG code.

It is well known that the relevant distance for Gabidulin codes is not the Hamming distance but the rank distance. In the context of Gabidulin codes introduced above, we shall need another distance which is a mixture between Hamming and rank distance. It is defined as follows.

Definition 2.8.

Let . The rank-Hamming weight of is:

Given , the rank-Hamming distance between and is .

Remark 2.9.

The weight is finer that the usual Hamming weight in the sense that, for all , we have if denotes the Hamming weight.

The RSG codes we have defined extend the classical notion of Gabidulin codes introduced in [5]. More precisely, the latter correspond to the case where , and is a finite field. Relaxing the assumption on , we obtain the generalized Gabidulin codes defined by Robert in his thesis [10]. In particular, in this case, the rank-Hamming distance is the usual rank distance.

On the other hand, when and (that is ), the notion of RSG code is nothing but the standard notion of Reed–Solomon code and the rank-Hamming distance reduces to the usual Hamming distance.

Proposition 2.10.

The code has length , dimension and minimal distance .

Example 2.11.

The RSG code corresponding to the generator matrix (3) has length , dimension and minimal distance . It then corrects any error of rank-Hamming weight at most .

Decoding Reed–Solomon–Gabidulin codes.

RSG codes can be decoded by a noncommutative extension of Gao’s algorithm [6]. This fact was already observed in the works of Wachter-Zeh and al. [12] in the special case of usual Gabidulin codes. After what we have done previously, the extension to RSG codes is not difficult.

Gao’s algorithm consists in several steps that we will present below. We suppose that we are given parameters , c and g as above together with a codeword for an Ore polynomial of degree less than . Let denote the ceiling of and let be a vector of rank-Hamming weight at most . We set .

Example 2.12 (Thread example).

We shall illustrate each step of Gao’s algorithm by the following thread example. As in Example 3, we take (equipped with and ), , and . The generator matrix of the corresponding RSG code is the matrix (3). We will work with the following codeword:

and the following error which has rank-Hamming weight . The corresponding received message is:

Step 0: Annihilator.

We compute the Ore polynomial  defined in (4).

If a fast multiplication algorithm of Ore polynomials is available (which is notably the case when  [9, 3]), this computation can be done efficiently by a divide-and-conquer algorithm [3].

We underline that this computation is independant of the received message and then has to be done just once when the RSG code is set up.

Example 2.13.

In our thread example, we have as shown by Example 2.5.

Step 1: Interpolation.

We compute a Ore polynomial  of degree less than such that .

This can be done for example by inverting the -linear map , which is known to be a bijection by Lemma 2.3. Alternatively, can be computed by solving a (noncommutative) Chinese remainder problem. This latter approach is faster when an efficient multiplication algorithm of Ore polynomials is available.

Example 2.14.

In our thread example, we find:

Remark 2.15.

In general, it is possible that denominators appear and that the degrees in get bigger than the maximal degree in in and . However, this growing always stays under control.

Step 2: Partial rgcd.

We compute a relation of the form for Ore polynomials , and with and .

This relation can be computed by applying the extended Euclidean algorithm with the input and stopping it the first time the remainder has degree less than .

Remark 2.16.

Using the theory of resultants and subresultants [7], one can carry out this computation by controlling the degrees in of all intermediate polynomials.

Example 2.17.

In our thread example, after one step in Euclidean algorithm, we obtain:

so that we can take:

The next proposition is the key result on which Gao’s algorithm is based.

Proposition 2.18.

With the above notations, we have the relation where is the Ore polynomial we used to construct the codeword .

Step 3: Left Euclidean division.

We compute the quotient in the left Euclidean division of by .

By Proposition 2.18, and we have decoded the message .

Example 2.19.

In our thread example, the left Euclidean division of by reads ; we have then reconstructed the Ore polynomial we started with.


  • [1] Delphine Boucher, Willi Geiselmann, Felix Ulmer, Skew Cyclic Codes, AAECC (Applied Algebra in Engineering, Communication and Computing), 18 (2007), 379–389
  • [2] Delphine Boucher, Felix Ulmer, Coding with skew polynomial rings, Journal of Symbolic Computation 44 (2009), 1644–1656
  • [3] Xavier Caruso, Jérémy Le Borgne, Fast multiplication for skew polynomials, proceedings ISSAC 2017
  • [4] Philippe Delsarte, Bilinear Forms over a Finite Field with Applications to Coding Theory, J. Combin. Theory 25 (1978), 226–241.
  • [5] Ernst Gabidulin, Theory of codes with maximum rank distance, Problemy Peredachi Informatsii 21 (1985), no. 1, 3–16.
  • [6] Shuhong Gao, A New Algorithm for Decoding Reed-Solomon Codes, Communications, Information and Network Security, 55–68
  • [7] Ziming Li, A subresultant theory for Ore polynomials and applications, proceedings ISSAC 1998
  • [8] Øystein Ore, Theory of non-commutative polynomials, Ann. of Math. 34 (1933), no. 3, 480–508.
  • [9] Sven Puchinger, Antonia Wachter-Zeh, Sub-quadratic decoding of Gabidulin codes, IEEE Int. Symp. Inf. Theory (ISIT) (2016)
  • [10] Gwezheneg Robert, Codes de Gabidulin en caractéristique nulle : application au codage espace-temps, PhD thesis (2015)
  • [11] Ron Roth, Maximum-Rank Array Codes and their Application to Crisscross Error Correction, IEEE Trans. Inform. Theory (1991)
  • [12] Antonia Wachter-Zeh, Decoding of block and convolutional codes in rank metric, PhD thesis (2013)