Abstract 1 Introduction 2 Preliminaries 3 Characterization of the List Decodable Property 4 Connection to the Parity-Check Matrix 5 Random Assignment to Achieve the Capacity References Appendix A Field Size Lower Bound for Capacity-Achieving Rank-Metric Codes Appendix B Proof of Theorem 19 Appendix C Proof of Theorem 20

Gabidulin Codes Achieve List Decoding Capacity with an Order-Optimal Column-To-Row Ratio

Zeyu Guo ORCID Department of Computer Science and Engineering, The Ohio State University, Columbus, OH, USA Chaoping Xing ORCID School of Electronic Information and Electric Engineering, Shanghai Jiao Tong University, China Chen Yuan ORCID School of Electronic Information and Electric Engineering, Shanghai Jiao Tong University, China Zihan Zhang ORCID Department of Computer Science and Engineering, The Ohio State University, Columbus, OH, USA
Abstract

In this paper, we show that random Gabidulin codes of block length n and rate R achieve the (average-radius) list decoding capacity of radius 1Rε in the rank metric with an order-optimal column-to-row ratio of O(ε). This extends the recent work of Guo, Xing, Yuan, and Zhang (FOCS 2024), improving their column-to-row ratio from O(εn) to O(ε). For completeness, we also establish a matching lower bound on the column-to-row ratio for capacity-achieving Gabidulin codes in the rank metric.

Our proof techniques build on the work of Guo and Zhang (FOCS 2023), who showed that randomly punctured Reed–Solomon codes over fields of quadratic size attain the generalized Singleton bound of Shangguan and Tamo (STOC 2020) in the Hamming metric. The proof of our lower bound follows the method of Alrabiah, Guruswami, and Li (SODA 2024) for codes in the Hamming metric.

Keywords and phrases:
coding theory, error-correcting codes, Gabidulin codes, rank-metric codes
Category:
RANDOM
Funding:
Zeyu Guo: Supported by NSF grant CCF-2440926.
Zihan Zhang: Supported by NSF grant CCF-2440926.
Copyright and License:
[Uncaptioned image] © Zeyu Guo, Chaoping Xing, Chen Yuan, and Zihan Zhang; licensed under Creative Commons License CC-BY 4.0
2012 ACM Subject Classification:
Mathematics of computing Coding theory
Acknowledgements:
The authors thank the anonymous RANDOM 2025 reviewers for their helpful comments.
Editors:
Alina Ene and Eshan Chattopadhyay

1 Introduction

Introduced by Delsarte [5], rank-metric codes have since developed into a field of study with applications and connections spanning network coding [16, 26, 17, 25], space-time coding [21, 20], cryptography [10, 9, 18, 19], and pseudorandomness [7, 6, 15, 14, 11].

A rank-metric code is a collection of matrices in 𝔽qm×n with mn, where the distance between two matrices A and B is defined to be their rank distance rank(AB). A rank-metric code C𝔽qm×n of rate R:=log2|C|log2(qmn) and relative minimum (rank) distance δ must satisfy that R+δ1, which is called the Singleton bound. A rank-metric code attaining the Singleton bound is called a maximum rank distance (MRD) code. Gabidulin codes are an important class of MRD codes, which can be seen as the linearized version of Reed–Solomon codes. This analogy allows us to design efficient encoding and unique decoding algorithms for Gabidulin codes. However, when it comes to the list decoding regime, it is known that some Gabidulin codes are not list decodable beyond the unique decoding radius [22, 23]. Thus, it is impossible to design a list decoding algorithm for all Gabidulin codes. Moreover, it was not even clear if any Gabidulin codes were list decodable beyond the unique decoding radius until very recently. Guo, Xing, Yuan and Zhang [12] recently proved that random Gabidulin codes are not only list decodable beyond the unique decoding radius but also attain the optimal generalized Singleton bound (see Lemma 1) with high probability. This settles an open problem of whether there exist list decodable Gabidulin codes.

However, the construction in [12] requires m, the number of rows of matrices, to be at least quadratic in n, so the column-to-row ratio nm=O(1n) tends to zero as n grows. This is analogous to a result of Brakensiek, Gopi, and Makam on Reed–Solomon codes [4], which states that any Reed–Solomon code exactly attaining the generalized Singleton bound must have an exponential field size. Suppose the list decoding radius is slightly off the generalized Singleton bound (with a gap of ε). In that case, Guo and Zhang [13] proved that the field size of Reed–Solomon codes can be brought down to quadratic which was further brought down to linear in the follow-up work of Alrabiah, Guruswami, and Li [2].

Thus, this raises an open problem for rank-metric codes, already asked in [12]: Can we obtain a similar result for Gabidulin codes as well?

Open Problem 1.

Do there exist Gabidulin codes of constant column-to-row ratio that are list decodable in the rank metric?

In this paper, we provide a positive answer to this open problem. We show that if the list decoding radius is slightly off the generalized Singleton bound (with a gap of ε), then a random Gabidulin code C𝔽qm×n with m=O(nε) is list decodable up to this bound with high probability. Moreover, we complement our positive result by proving an upper bound m=Ω(nε) for any list decodable Gabidulin codes approaching the generalized Singleton bound with a gap of ε. One can find the details in the following subsection.

1.1 Main Results

In this paper, we mainly focus on the rank distance, which is defined to be the rank of the difference between two matrices A,B𝔽qm×n i.e., d(A,B):=rank(AB). In what follows, d(,) refers to the rank distance. For ρ[0,1], a code CΣn over an alphabet Σ is said to be (ρ,)-list decodable if for any 𝒚𝔽qn, it holds that

|{𝒙C:d(𝒙,𝒚)ρn}|,

where d(𝒙,𝒚) denotes the distance between 𝒙 and 𝒚. Here, ρ is called the list decoding radius, and is called the list size. The stronger notion of (ρ,)-average-radius list decodability is defined in the same way, except that we replace the maximum of the distances d(𝒄i,𝒚) by the average of these distances. The formal definition is given as follows.

Definition 2 (Average-radius list decodability).

A code CΣn is (ρ,) average-radius list decodable if for any 𝐲Σn and +1 distinct codewords 𝐜0,𝐜1,,𝐜C, it holds that

1+1i=0d(𝒚,𝒄i)>ρn.

In [24], Shangguan and Tamo proved the generalized Singleton bound for list decoding, generalizing the classical Singleton bound for unique decoding. For linear codes, this generalized Singleton bound states that if C𝔽qn is an [n,k]-linear code that is (ρ,)-list decodable in the Hamming metric, then it holds that ρ+1(1kn). In [12], they noted that this generalized Singleton bound also holds for rank-metric codes.

Lemma 1 (Generalized Singleton bound for rank-metric codes [12, Lemma 2.1]).

Let C𝔽qmn be an [n,k]𝔽qm-linear code that is (ρ,)-list decodable in the rank metric. Then it holds that

ρ+1(1kn).

They further showed that this bound is tight for rank-metric codes by proving that random Gabidulin codes attain it with high probability. (This is a nontrivial task; in fact, even proving that random linear rank-metric codes attain the generalized Singleton bound is far from obvious.) However, the column-to-row ratio of these codes is quite small, which makes them less appealing for practical applications.

Theorem 3 ([12, Lemma 1.3]).

Let (α1,,αn) be uniformly distributed over the set of all vectors in 𝔽qmn whose coordinates are linearly independent over 𝔽q. Suppose mcnk+logq(1/δ), where c is a large enough absolute constant. Then it holds with probability at least 1δ that the Gabidulin code 𝒢n,k(α1,,αn)111See the definition of Gabidulin codes in 13. over 𝔽qm is (LL+1(1k/n),L)-list decodable for all L[] in the rank metric.

In this paper, we prove that there exist Gabidulin codes with constant column-to-row ratio Ω(ε) that are list decodable up to the radius +1(1knε).

Theorem 4.

Let ε>0 and n,k be positive integers with kn. Let m and be positive integers such that mc(+1)nε, where c is a sufficiently large absolute constant. Then with probability at least 1qO(n)>0, a random Gabidulin code of rate R=k/n and block length n over 𝔽qmn is (+1(1Rε),) average-radius list decodable.

Complementing this result, we also show that the column-to-row ratio is at most O(ε) for any rank-metric code that is average-radius list decodable up to the generalized Singleton bound. Thus, our results are essentially tight.

Theorem 5.

Let 2. For any R[0,1], any rank-metric code C𝔽qmn of rate R that is ((1Rε)+1,)-average-radius list decodable must have m=Ω(Rnε).

1.2 Proof Overview

Our proof is inspired by [13]. To explain our proof, we first briefly review the techniques in [13]. In [13], they proposed the notion of a reduced intersection matrix, whose kernel corresponds to the list of codewords. Let C be an [n,k] linear code and G be its generator matrix, which is a k×n matrix. Given +1 distinct codewords 𝒄1,,𝒄+1 with 𝒄i=𝒙iG=(ci1,,cin) that are close to a vector 𝒚=(y1,,yn), where the coordinates cij and yj are in the alphabet 𝔽, we define the intersection index set Ij:={h[n]:yh=cjh}. For a subset J[n], let GJ (resp. 𝒚J) be the submatrix (resp. subvector) of G (resp. 𝒚) formed by the columns (resp. components) with indices in J. Then, we have 𝒚Ii𝒙iGIi=0. If aIiIj, then (𝒙i𝒙j)Ga=0. This means that for each element in IiIj, we can establish a linear equation. Since these +1 codewords are very close to 𝒚, it is expected that we can obtain many equations of the form (𝒙i𝒙j)Ga=0. By removing the linear dependence of these equations, we obtain a reduced intersection matrix RG,I[] such that (𝒙2𝒙1,,𝒙+1𝒙1)RG,I[]=0, where I[] is a shorthand for the tuple (I1,,In). On the other hand, if RG,I[] has full rank, then we cannot find +1 distinct codewords that are close to a vector 𝒚 and thus C is list decodable. Thus, the essence of their paper is to investigate the full rankness of RG,I[].

In this paper, we investigate the list decodability of rank-metric codes, where distance is measured using the rank metric rather than the Hamming metric. Thus, we cannot construct the reduced intersection matrix RG,I[] row by row as in [13]. Instead, we present another construction of a reduced intersection matrix, which captures the property of the rank distance. Let us first represent the codeword of our rank-metric code as a vector 𝒄𝔽n where 𝔽 is the extension field of 𝔽q. This is done by fixing an 𝔽q-linear isomorphism 𝔽𝔽q[𝔽:𝔽q]. The rank distance between two codewords d(𝒄1,𝒄2) is the maximum number of 𝔽q-linear independent components in 𝒄1𝒄2. One can find the precise definition in Section 2. Similar to Hamming codes, a linear rank-metric code has a generator matrix G and each codeword can be encoded as 𝒄=𝒙G. Given two vectors 𝒚1,𝒚2𝔽n with rank distance d, we can find a (nd)×n matrix A over 𝔽q of full rank such that A(𝒚1𝒚2)=0. The major difference between the rank metric and the Hamming metric is that for each vector 𝒗 that lies in the vector space spanned by the rows in A, we always have 𝒗(𝒚1𝒚2)=0. Thus, we cannot include all 𝒗 in our equations. Instead, we include A as a whole.

With this observation in mind, we present our new reduced intersection matrix. Assume distinct codewords 𝒄1,,𝒄+1 with 𝒄i=𝒙iG are close to a vector 𝒚=(y1,,yn). Assume that d(𝒚,𝒙iG)=ai and there exists an ai×n matrix Ai of full rank over 𝔽q such that Ai(𝒚𝒙iG)=0. By replacing 𝒚 with 𝒚𝒙1G and 𝒙i=𝒙i𝒙1, we have A1𝒚=0 and Ai(𝒚𝒙iG)=0. Let 𝒱=(V1,,V+1) where Vi is the vector space spanned by the rows in Ai.222In our analysis, we need to consider 𝒱[t]=(V1,,Vt) for t=1,,+1. Here, we only consider 𝒱[+1] for simplicity. Then, we construct a reduced intersection matrix RG,𝒱 to represent all these relations as RG,𝒱(𝒚,𝒙2,,𝒙+1)=0 which can be found in (9). If RG,𝒱 has full rank, which means that we cannot find such +1 distinct codewords, then our rank-metric code is list decodable. Thus, it suffices to study the rank of RG,𝒱. If our decoding radius is slightly off the generalized Singleton bound (with a gap of ε), then RG,𝒱 is not square. This makes the full rank condition easier to meet.

We restrict G to a subspace V by defining GV to be the column space of GA where the columns of A span V. This can be seen as a generalization of puncturing in the Hamming metric. By introducing a subspace V, we obtain a submatrix RG,𝒱V of RG,𝒱 by restricting G to V. Using results from [12], we show that if G is a symbolic Gabidulin code (see Definition 15), then the submatrix RG,𝒱V is invertible and has the same rank as RG,𝒱 when the dimension of V is not too small, i.e., dim(V)nλk, where λ>0 is a small parameter depending on ε. This means if each variable of this symbolic Gabidulin code is chosen uniformly at random, with high probability, RG,𝒱V has full rank. To show that a Gabidulin code is list decodable, we need to enumerate all possible t-tuples (V1,,Vt) for t=1,,+1 and take a union bound over all these tuples. Thus, we need to show that RG,𝒱 is of full rank with high probability 1exp(Ω(n2)) for each 𝒱. To do this, we borrow the idea of [13] to bound the failure probability.

Let us briefly review the idea of our algorithm. Let 𝒆1,,𝒆n be a standard basis of 𝔽qn. We first fix a non-singular maximal square submatrix W of RG,𝒱. The reason we need a square submatrix is that it is easy to calculate the determinant of W to bound the failure probability that W is non-singular. Initially, since G is the generator matrix of a symbolic Gabidulin code, W is a nonsingular matrix. If W remains non-singular with the assignment X1=α1,,Xn=αn, we are done. Otherwise, we face the situation where M is non-singular under the partial assignment X1=α1,,Xj1=αj1 but becomes singular under X1=α1,,Xj=αj. In this case, we call j a faulty index and remove the corresponding columns from the generator matrix G. Then, we come to the submatrix RG,𝒱V for some subspace V=span{𝒆i:i[n]/{j}}. Note that we have already shown that RG,𝒱V has full rank if V has large dimension. Then, we find a new maximal square submatrix W of RG,𝒱V and continue the argument. We show that, with high probability, there are not too many faulty indices, which implies that we can finally find a maximal square submatrix W that has full rank under the assignment. This means RG,𝒱 has full rank, completing the proof.

Complementing our positive result, we also show that a capacity-achieving list decodable rank-metric code must satisfy m=Ω(n/ε). Our proof generalizes the proof in [1] in the rank-metric case. In particular, we first fix a subspace V0𝔽qmn of dimension b=4εn and let V¯0 be a complement of V0. Then, we construct a collection of subspaces of dimension Rε in V¯0, where R is the rate of our rank-metric code. For any two subspaces V1,V2, dim(V1+V2)(R+ε)n. We manage to show that has a large size. Using a probabilistic argument, we find a codeword M in the rank-metric code C such that for most subspaces V, there is a corresponding codeword MV in C satisfying the condition that the kernel of MMV contains V. Since the number of such subspaces is greater than q4εn, by the pigeonhole principle, we can find distinct codewords MV1,MV such that the kernel of MMVi also contains V0. Then, we show that these +1 codewords M,MV1,MV are contained in a ball of small radius in the rank metric. This implies an upper bound on the list decoding radius, thus completing the proof.

 Remark.

It is interesting to note that we require only the ideas from [13] to improve the column-to-row ratio to Ω,ε(1), without relying on the more refined techniques from [2]. This is likely due to the significantly larger alphabet size of rank-metric codes. While the techniques in [2] might further improve lower-order factors, such as the dependence on , we do not pursue this direction here in order to keep the presentation simple.

2 Preliminaries

In this paper, vectors are considered row vectors unless stated otherwise. Define [k]={1,,k}. Let 𝔽q be a finite field with q elements and 𝔽/𝔽q be a (finite or infinite) extension of 𝔽q.

2.1 Vector Spaces

𝔽qn is a vector space of dimension n over 𝔽q. We denote by 𝒙 a row vector in 𝔽qn and 𝒙 a column vector. Let 𝒆1,,𝒆n be the standard basis of 𝔽qn. Given a matrix A𝔽qm×n, we denote by A the subspace spanned by the column vectors in A. For a t-tuple 𝒱[t]=(V1,,Vt) and J[t], define 𝒱J=(Vi)iJ.

Definition 6 (Dual space).

Let V𝔽qn be a linear subspace. The dual space of Vi is denoted as V={𝐯𝔽qn:𝐯𝐱=0,𝐱V}. It is clear that V is well-defined, and dim(V)=ndim(V).

Linear codes

Let 𝔽 be a field. An [n,k]𝔽 linear code C (or [n,k]𝔽 code for short) is simply a subspace of 𝔽n of dimension k. The dual code of an [n,k]𝔽 code C is the [n,nk]𝔽 code C which is the dual space of C.

For an [n,k]𝔽 code C, a matrix G𝔽k×n is said to be a generator matrix of C if C={𝒖G:u𝔽k}, and a matrix H𝔽(nk)×n is said to be a parity-check matrix of C if C={𝒗𝔽n:H𝒗=0}. A generator matrix of C is also a parity-check matrix of the dual code C. Similarly, a parity-check matrix of C is also a generator matrix of C.

Definition 7 (Dimension of a collection of vector spaces).

For a t-tuple 𝒱[t]=(V1,,Vt) of subspaces and J[t], the dimension of 𝒱J is defined as

dim(𝒱J):=iJdim(Vi)dim(iJVi).

We need the following simple lemmas, whose proofs are omitted.

Lemma 2.

Let n. Let T1 be a ×n matrix of full rank over 𝔽. Then there exist matrices M1𝔽n×, M2𝔽n×(n), and T2𝔽(n)×n of full rank such that M1T1+M2T2=In and T1M2=0.

Lemma 3.

Let V1,,V𝔽n. Then

(i=1Vi)=i=1Vi. (1)
Lemma 4.

Let V be a subspace in 𝔽qn and W be a subspace of V. Then, there exists a matrix A𝔽qn×dim(V) with A=V such that there exists a n×dim(W) submatrix B of A with B=W.

Lemma 5.

Let 0<α<β<1 with βα<14. Given a subspace V1𝔽qn of dimension αn, the number of V2𝔽qn with dim(V1+V2)βn and dim(V2)=αn is at most 16n2q(βα)(1+3α2β)n2.

Proof.

Let W=V1V2 and we write V1=WW1 and V2=WW2. Since

dim(V1V2)=dim(V1)+dim(V2)dim(V1+V2)(2αβ)n,

we conclude that a:=dim(W)(2αβ)n and b:=dim(W2)(βα)n. To construct V2, it suffices to construct W and W2 separately. The number of subspaces W equals the number of ways of picking a dim(W)-dimensional subspace from V1, which is at most 4q(αna)a. On the other hand, the number of W2 equals the number of ways of picking a dim(W2)-dimensional subspace that W2V1={0}, which is

i=0dim(W2)1qnqαn+iqdim(W2)qi4q(nb)b.

Thus, for fixed (a,b), the total number of V2 is at most 16q(αna)a+(nb)b subject to a+b=αn and b(βα)n. And we have

(αna)a+(nb)b=b(αnb)+(nb)b=b((α+1)n2b)(βα)(1+3α2β)n2.

The number of possible (a,b) is at most n2. The claim follows by taking the union bound over all possible (a,b).

Corollary 8.

Let 0<α<β<1. There exists a collection of αn-dimensional subspaces in 𝔽qn of size at least Ω(q(αα22(βα)o(1))n2) such that for any V1,V2, dim(V1+V2)βn.

Proof.

There are at least qα(1α)n2 αn-dimensional subspaces in 𝔽qn. For each such subspace V, by Lemma 5, we remove at most 16n2q(βα)(1+3α2β)n2 subspaces W in 𝔽qn such that dim(V+W)βn. Thus, by a greedy algorithm (i.e., iteratively adding subspaces that have not been selected or removed to ), we can find of size at least

116n2qα(1α)n2(βα)(1+3α2β)n2Ω(q(αα22(βα)o(1))n2).

The last inequality is due to 1+3α2β1+α2. The proof is completed. The size of family will be used in the lower bound argument in Appendix A.

2.2 Rank-Metric Codes

We first review some basic facts and results about rank-metric codes. The rank distance d(A,B) between two matrices A,B𝔽qm×n is defined to be the rank of AB, i.e., d(A,B):=rank(AB). Indeed, this defines a distance [8]. A rank-metric code C is a subset of 𝔽qm×n whose rate and minimum distance are given by

R(C):=logq|C|nm and d(C):=minA,BCABd(A,B).

Without loss of generality, we always assume that mn, since otherwise we can exchange n and m. It is convenient to treat an m×n matrix A over 𝔽q as a vector 𝒗=(v1,,vn)𝔽qmn by identifying 𝔽qm with 𝔽qm (by fixing a basis of 𝔽qm) and viewing each column of A as an element in 𝔽qm. Then, we have rank(A)=dim𝔽q(span𝔽q{v1,,vn}). In this way, a rank-metric code C may be viewed as a subset of 𝔽qmn, and we can study linear rank-metric codes, i.e, codes that are 𝔽qm-subspaces.

Linear rank-metric codes over a general field 𝔽/𝔽𝒒

It is convenient for us to consider a general notion of linear rank-metric codes C𝔽n over a field 𝔽/𝔽q that can even be infinite. To properly define this notion, we first define the 𝔽q-rank and the kernel subspace of a vector 𝒗𝔽n.

Definition 9 (𝔽q-rank).

Let 𝔽 be an extension field of 𝔽q. For 𝐯=(v1,,vn)𝔽n, define

rank𝔽q(𝒗):=dim𝔽q(span𝔽q{v1,,vn}),

called the 𝔽q-rank of 𝐯.

Definition 10 (Kernel subspace).

For 𝐯=(v1,,vn)𝔽n, define the 𝔽q-kernel subspace (or simply the kernel subspace) of 𝐯 to be

ker𝔽q(𝒗):={𝒖𝔽qn:𝒖𝒗=0}={(u1,,un)𝔽qn:i=1nuivi=0}.

The following lemma can be seen as an alternative definition of the 𝔽q-rank.

Lemma 6.

rank𝔽q(𝒗)=ndim𝔽q(ker𝔽q(𝒗)).

Proof.

Consider the 𝔽q-linear map 𝔽qn𝔽 sending 𝒖𝔽qn to 𝒖𝒗. The image of this map is span𝔽q{v1,,vn}, whose dimension is rank𝔽q(𝒗) by definition. The kernel of this map is ker𝔽q(𝒗). So rank𝔽q(𝒗)=ndim𝔽q(ker𝔽q(𝒗)).

We can now define the notion of a linear rank-metric code over a field 𝔽/𝔽q.

Definition 11 (Linear rank-metric code).

Let 𝔽 be an extension field of 𝔽q. An [n,k]𝔽 (linear) rank-metric code is simply an [n,k]𝔽 code C𝔽n equipped with the distance function d:𝔽n×𝔽n defined by d(𝐯,𝐯):=rank𝔽q(𝐯𝐯). The minimum distance of C is

d(C):=min𝒗,𝒗C𝒗𝒗d(𝒗,𝒗)=min𝟎𝒗Crank𝔽q(𝒗).

Analogous to the classical setting, one can prove the following Singleton bound for linear rank-metric codes. While this may be well known, we include a proof for completeness.

Theorem 12 (Singleton bound).

Let C be an [n,k]𝔽 rank-metric code. Then d(C)nk+1.333We remark that when 𝔽=𝔽qm, there exists a Singleton bound, |C|qm(nd+1), that also applies to nonlinear rank-metric codes C𝔽n [8]. However, this bound is given in terms of the size of the code, not the dimension, making it inapplicable when 𝔽 is infinite.

Proof.

There exists a nonzero codeword 𝒗=(v1,,vn)C whose first k1 coordinates are zero. So d(C)rank𝔽q(𝒗)=dim𝔽q(span𝔽q{v1,,vn})=dim𝔽q(span𝔽q{vk,,vn})nk+1. A rank-metric code meeting the Singleton bound is called maximum rank distance (MRD) code.

Lemma 7 ([12, Lemma 2.11]).

Let C be an [n,k]𝔽 code. If C is MRD, then C is also MRD.

Lemma 8.

Let G𝔽k×n be a generator matrix of an [n,k]𝔽 code C and H𝔽(nk)×n be a parity-check matrix of code C. Then the following are all equivalent:

  1. 1.

    C is MRD.

  2. 2.

    For any A𝔽qn×k of full rank, the matrix GA𝔽k×k also has full rank.

  3. 3.

    For any B𝔽qn×(nk) of full rank, the matrix HB𝔽(nk)×(nk) also has full rank.

Proof.

For the first two claims, see [12, Lemma 2.10]. Lemma 7 says that H is the generator matrix of a [n,nk]𝔽 MRD code C. The third claim follows by applying the second one to the dual code C.

Gabidulin codes

The most famous MRD codes are Gabidulin codes, which are defined by using the evaluation of linearized polynomials. We briefly review the construction of Gabidulin codes [8] and extend it to a general field 𝔽/𝔽q.

Definition 13 (Gabidulin code over 𝔽).

Let 0<kn be integers. Let 𝔽 be an extension field of 𝔽q such that [𝔽:𝔽q]n. Let α1,,αn𝔽 be linearly independent over 𝔽q. Define the [n,k]𝔽 rank-metric code

𝒢n,k(α1,,αn):={𝒙f=(f(α1),,f(αn)):f𝔽[X]is q-linearized,degq(f)<k},

where f𝔽[X] is said to be q-linearized if it only contains monomials whose degrees are q-powers, and we define degq(f)=d if deg(f)=qd.

For a nonzero codeword 𝒙f=(f(α1),,f(αn))𝒢n,k(α1,,αn), using the fact that f is q-linearized, we have

ker𝔽q(𝒙f)={(u1,,un)𝔽qn:f(i=1nuiαi)=0}

whose dimension over 𝔽q is bounded by k1 since α1,,αn are linearly independent over 𝔽q and f has at most deg(f)qk1 roots. So rank𝔽q(𝒙f)nk+1 by Lemma 6. This shows that Gabidulin codes are MRD codes.

The dual code of a Gabidulin code is also a Gabidulin code, which can be seen as an analogy of a Reed–Solomon code.

Theorem 14 (Duality of Gabidulin codes).

Let 𝔽 be an extension field of 𝔽q, and let α1,,αn𝔽 be linearly independent over 𝔽q. Then there exists (β1,,βn)𝔽n{0} such that

i=1nαiqj1βiqh1=0for (j,h)[k]×[nk]. (2)

The choice of (β1,,βn) satisfying (2) is unique up to a scalar in 𝔽q{0}. Moreover, β1,,βn are linearly independent over 𝔽q, and (βjqi1)i[nk],j[n] is a parity-check matrix of 𝒢n,k(α1,,αn), i.e.,

𝒢n,k(α1,,αn)=𝒢n,nk(β1,,βn).

A proof can be found in [3, Lemma 2.7.2]. We present this proof for completeness.

Proof of Theorem 14.

This holds for any extension field 𝔽 no matter if 𝔽 is finite or infinite. Let β1,,βn be the unique solution up to the scalar such that

i=1nαiqjβi=0,j=k+1n,,k1. (3)

The uniqueness is due to the fact that (αiqkj)(i,j)[n]×[n1] is a Moore matrix of rank n1 if α1,,αn are 𝔽q-linearly independent. Then, for j[k],h[nk], we have

i=1nαiqjβiqh=(i=1nαiqjhβj)qh=0.

This is due to (3) and the fact that k+1njhk1.

Definition 15 (Symbolic Gabidulin code).

Let 0<kn. Let 𝔽=𝔽q(X1,,Xn), where X1,,Xn are transcendental and algebraically independent elements over 𝔽q. A [n,k]𝔽 symbolic Gabidulin code is a 𝔽-linear code with generator matrix G=(Xjqi1)(i,j)[k]×[n], i.e.,

𝒢n,k(X1,,Xn):={𝒙f=(f(X1),,f(Xn)):f𝔽[X]is q-linearized,degq(f)<k}.

2.3 Known Results on the List Decoding of Gabidulin Codes

For G𝔽k×n over an extension field 𝔽/𝔽q, A𝔽qn×d, and V=A𝔽qn, define GV𝔽n to be the column space of GA. The following results on the list decoding of symbolic Gabidulin codes can be found (implicitly) in [12].

Theorem 16 (Implicit in Theorem 1.16, [12]).

Let >0 be an integer. Let 𝒢n,k(X1,,Xn) be a symbolic Gabidulin code with generator matrix G and parity-check matrix H. Let V1,,V be subspaces of 𝔽qn, each of dimension at most k. Then,

dim𝔽(i[]GVi)=maxP1P2Ps=[](i[s]dim𝔽q(jPiVj)(s1)k) (4)

where the maximum is taken over all possible partitions P1P2Ps of []. Let V1,,V be subspaces of 𝔽qn, each of dimension at most nk. Then,

dim𝔽(i[]HVi)=maxP1P2Ps=[](i[s]dim𝔽q(jPiVj)(s1)k). (5)
Lemma 9 (Lemma 6.1, [12]).

Let 𝔽 be an extension field of 𝔽q and let G𝔽k×n. For i=1,,, let Vi be a subspace of 𝔽qn and let Ai𝔽qn×dimVi such that Vi=Ai. Then, GVi=GAi and

dim(i[]GVi)=i[]dimGVirank(G{Ai}i[]), (6)

where we define the matrix G{Ai}i[]:=(GA1GA2GA1GA3GA1GA).

3 Characterization of the List Decodable Property

Let 𝔽 be the extension field of 𝔽q. Let C be a [n,k]𝔽 code with generator matrix G and parity-check matrix H. Assume 𝒙iG𝔽n,i=1,,+1 are +1 codewords close to a vector 𝒚𝔽n, i.e.,

i=1+1rank𝔽q(𝒚𝒙iG)n(1R+ε). (7)

By replacing 𝒚 with 𝒚𝒙1G and 𝒙i with 𝒙i𝒙1 for i>1, we may assume 𝒙1=0. Thus, (7) is equivalent to:

rank(𝒚)+i=2+1rank𝔽q(𝒚𝒙iG)n(1R+ε), (8)

Let Vi=ker(𝒚𝒙iG)𝔽qn be a vector space and Ai𝔽qn×dim(Vi) such that Ai=Vi. It follows that rank(Ai)=dim(Vi)=nrank(𝒚𝒙iG) and (𝒚𝒙iG)Ai=0. Since Ai(𝒚G𝒙i)=0,

(A100A2A2G0A+10A+1G)(𝒚𝒙2𝒙+1)=0. (9)

Let the matrix above be denoted as RG,𝒱[+1] where 𝒱[+1]=(V1,,V+1). Since Ai𝔽qn×dim(Vi), RG,𝒱[+1] is a (i=1+1dim(Vi))×(k+n) matrix.

Lemma 10.

Let ρ(0,1), λ0, and be a positive integer. Let C be an [n,k]𝔽-linear code over a finite field 𝔽q with generator matrix G𝔽k×n. Suppose C is not (ρ,) average-radius list decodable in the rank metric and ρ+1(1(1+λ)kn). Then, there exist t{2,3,,+1} and 𝔽q-linear subspaces V1,,Vt𝔽qn such that

  1. 1.

    ker(RG,𝒱[t])0.

  2. 2.

    dim(𝒱[t])(1+λ)(t1)k

  3. 3.

    dim(𝒱J)(1+λ)(|J|1)k for some non-empty set J[t].

Proof.

As C is not (ρ,) average-radius list decodable in the rank metric, there exists a vector 𝒚𝔽n and +1 codewords 𝒄1,,𝒄+1C such that i[+1]rank𝔽q(𝒚𝒄i)(+1)ρn. Let Vi=ker(𝒚𝒄i) and we have i[+1]dim(Vi)(+1)n(1ρ). This implies that

dim(𝒱[+1])=i[+1]dim(Vi)dim(i[+1]Vi)i[+1]dim(Vi)n(1+λ)k.

Thus, we can choose a minimal set S[+1] of size at least 2 such that dim(VS)(1+λ)(|S|1)k. By permuting the codewords 𝒄1,,𝒄+1, we may assume that S=[t]. By the definition of dim(𝒱J), dim(𝒱J)=0 for any subset J of size 1. Then, for any subset J[t], Item 3 holds due to the minimality of S. It remains to show that Item 1 holds. To see this, we first notice that 𝒄i=𝒙iG for some 𝒙i𝔽qmt. Let Ai𝔽qn×dim(Vi) such that Ai=Vi. Since Vi=ker(𝒚𝒄i), we have (𝒚𝒄i)Ai=(𝒚𝒙iG)Ai=0. Let 𝒚=𝒚𝒙1G and 𝒙i=𝒙i𝒙1 for i=2,,+1. Then (𝒚,𝒙2,,𝒙t)ker(RG,𝒱[t]). This completes the proof.

Definition 17 (Reduced Matrix).

Let 𝒱[t]=(V1,,Vt), where each Vi is a linear subspace of 𝔽qn. Let V𝔽qn be a linear subspace and V^i=ViV be the intersection of Vi and V. The reduced matrix RG,𝒱[t]V is defined as

RG,𝒱[t]V=(A^100A^2A^2G0A^t0A^tG). (10)

where A^i𝔽qn×dim(V^i) of full rank with A^i=V^i. If VJ=span𝔽q{𝐞i:iJ} for some J[n], we shorthand RG,𝒱[t]J:=RG,𝒱[t]VJ if no ambiguity occurs.

Let A𝔽qn×dim(V) with A=V. Since the column vectors in A^i lie in V=A, we may write A^i=ATi where Ti𝔽qdim(V)×dim(V^i) of full rank. Using the above notation, we have the following results.

Lemma 11.

Let G1=GA and Ui=Ti for i=1,,t. Let 𝒰[t]=(U1,,Ut). Assume ker(RG1,𝒰[t])=0, i.e., there is no nonzero solution to

(T100T2T2G10Tt0TtG1)(𝒚𝒙2𝒙t)=0. (11)

Then ker(RG,𝒱[t]V)=0.

Proof.

Assume that there exists a solution (𝒚,𝒙2,,𝒙t)ker(RG,𝒱[t]V). Let 𝒚=𝒚A. Then, (𝒚,𝒙2,,𝒙t) is a solution to (11) by observing

A^iG=(ATi)G=TiAG=Ti(GA)=TiG1.

4 Connection to the Parity-Check Matrix

Definition 18.

Let 𝔽 be the extension field of 𝔽q. Let H be the parity-check matrix of a [n,k]𝔽 code C. Let 𝒱[t]=(V1,,Vt) be a tuple of subspaces of 𝔽qn. Assume that Di𝔽qn×dim(Vi) such that Di=Vi for i[t]. Define the following matrix

MH,𝒱[t]=(HD1HD200HD10HD30HD100HDt). (12)

Since each Di is an n×dim(Vi) matrix over 𝔽q, MH,𝒱[t] is a (t1)(nk)×i=1tdim(Vi) matrix over 𝔽q.

The following theorem connects the matrices MH,𝒱[t] and RG,𝒱[t]. See Appendix B for its proof.

Theorem 19.

Let 𝔽 be an extension field of 𝔽q. Let G and H be the generator and parity-check matrix of a [n,k]𝔽 MRD code C, respectively. Let 𝒱[t]=(V1,,Vt) and 𝒱[t]=(V1,,Vt). Then, there is an injective 𝔽-linear map ϕ:ker(RG,𝒱[t])ker(MH,𝒱[t]).

We note that the matrix RG,𝒱[t] is not a square matrix as (t1)k+n<i[+1]dim(Vi). This means that if RG,𝒱[t] has full rank, there exists a reduced submatrix RG,𝒱[t]V of RG,𝒱[t] that has the same rank as RG,𝒱[t]. The following theorem proves this claim provided that the dimension of V is not too small. See Appendix C for its proof.

Theorem 20.

Let 𝔽=𝔽q(X1,,Xn) where X1,,Xn are transcendental and algebraically independent elements over 𝔽q. Let G=(Xjqi1)(i,j)[k]×[n] be the generator matrix of a [n,k]𝔽 symbolic Gabidulin code. Let λ>0 and t>1. Assume that 𝒱[t]=(V1,,Vt) satisfies that dim(𝒱[t])(1+λ)(t1)k and dim(𝒱J)(|J|1)(1+λ)k for all nonempty J[t]. Let V𝔽qn be a linear space with dim(V)nλkt1. Then, ker(RG,𝒱[t]V)=0.

5 Random Assignment to Achieve the Capacity

5.1 Random Puncturing

Let {𝒆1,,𝒆n} be the standard basis of 𝔽qn. Theorem 20 states that for any subspace V𝔽qn of dimension at least nλkt1, and 𝒱[t]=(V1,,Vt) satisfying Item 2 and Item 3, we have ker(RG,𝒱[t]V)=0. In this section, we focus on the subspace of the form WJ:=span𝔽q{𝒆i:iJ} for some subset J[n]. Recall that we shorthand RG,𝒱WJ as RG,𝒱J. By focusing on the subset J[n], we are able to mimic the technique in [13] to bound the probability that RG,𝒱[t]J is not of full rank when selecting the value of Xi uniformly at random. The connection between RG,𝒱[t]J and RG,𝒱[t] can be found in the following lemma.

Lemma 12.

Let 𝒱[t]=(V1,,Vt)(𝔽qn)t and V𝔽qn. Then, there exist Ai and A^i in (9) and (10) such that RG,𝒱[t]V is a submatrix of RG,𝒱[t].

Proof.

From Lemma 4, we can find Ai𝔽qn×dim(Vi) and its submatrix A^i𝔽qn×dim(V^i) such that Ai=Vi, A^i=V^i. This implies that (A^i,0,,0,A^iG,0,,0) is a submatrix of (Ai,0,,0,AiG,0,,0). In view of the expression of RG,𝒱[t]V and RG,𝒱[t], we conclude that RG,𝒱[t]V is a submatrix of RG,𝒱[t].

Next, we define the faulty index which was first proposed in [13].

Definition 21 (Faulty index).

Assume r. Let A𝔽q(X1,,Xn)r× be a matrix such that rank(A)= and the entries of A are in 𝔽q[X1,,Xn]. For α1,,αn𝔽qm, we say i[n] is the faulty index of A (with respect to α1,,αn) if A|X1=α1,,Xi1=αi1 has full (column) rank but A|X1=α1,,Xi=αi does not.

Algorithm 1 Output faulty indices.
Lemma 13.

Let λ0 and let t1 be an integer. Let 𝒱[t]=(V1,,Vt)(𝔽qn)t such that dim(𝒱[t])(1+λ)(t1)k and dim(𝒱J)(1+λ)(|J|1)k for all nonempty J[t]. Let r be a positive integer with rλkt1+1. Then, for all α1,,αn𝔽qm, running Algorithm 1 on the input 𝒱[t], α1,,αn, and r yields the following two possible scenarios:

  1. 1.

    Algorithm 1 outputs “Success”. In this case, RG,𝒱[t]|X1=α1,,Xn=αn has full rank.

  2. 2.

    Algorithm 1 outputs an r-tuple (i1,,ir)([n]r). In this case, for each j[r], ij is the faulty index of RG,𝒱[t]Sj for Sj=[n]{i1,,ij1}.

Proof.

Assume the algorithm reaches the j-th round of the loop. At the beginning, we have |J|nj+1nr+1nλkt1. Then by Lemma 11 and the fact that G is the generator matrix of a symbolic Gabidulin code, RG,𝒱J has full rank and thus the algorithm never outputs “Fail”. Suppose that the algorithm outputs “Success” and halts in the j-th round. This means that the faulty index of RG,𝒱J does not exist in this round. This implies that RG,𝒱|X1=α1,,Xn=αn has full rank. It remains to consider the case where the algorithm outputs a r-tuple (i1,,ir). For j[r], the index ij is chosen to be the faulty index of RG,𝒱Sj, where Sj=[n]{i1,,ij1}. The distinctness of i1,,ir is due to the fact that if iSj, then RG,𝒱Sj does not contain Xi.

Lemma 14.

Suppose mn and (α1,,αn) are chosen uniformly at random in 𝔽qm. Then, for any r-tuple (i1,,ir)([n]r) and (V1,,Vt)(𝔽qn)t, the probability that Algorithm 1 outputs (i1,,ir) given the input (V1,,Vt), α1,,αn and r is at most ((t1)kqk1qm)r.

Proof.

For j[r], define the following:

  1. 1.

    Sj:=[n]{i1,,ij1}.

  2. 2.

    Let Mj be the smallest nonsingular maximal minor of RG,𝒱Sj in the lexicographic order. The same argument in Lemma 13 implies that for j[r], RG,𝒱Sj has full rank and hence Mj exists.

  3. 3.

    Let Ej be the event that det(Mj|X1=α1,,Xij1=αij1) but det(Mj|X1=α1,,Xij=αij) is zero.

Note that if (i1,,ir) is output by the algorithm, then E1,,Er occurs. So it suffices to prove that Pr[E1Er]((t1)kqk1qm)r.

Let (j1,j2,,jr) be a permutation of (1,2,,r) such that ij1<<ijr, i.e., ij is the -th smallest index among i1,,ir for [r]. For {0,1,,r}, define F:=Ej1Ej, where we let F0 be the event that always occurs. Then Fr=Ej1Ejr=E1Er. If Pr[Fr]=0 then we are done. So assume Pr[Fr]>0. By definition, if F occurs and <, then F also occurs. So Pr[F]>0 for all {0,1,,r}. Note

Pr[E1Er]=Pr[Fr]==1rPr[F]Pr[F1].

So it suffices to prove that Pr[F]Pr[F1](t1)kqk1qm for [r].

Fix [r] and let j=j. Let T be the set of all β=(β1,,βij1)𝔽qij1 such that Pr[(α<ij=β)F1]>0, where α<ij=β is a shorthand for (α1=β1)(αij1=βij1). Note that for βT, the event (α<ij=β)F1 is simply α<ij=β since F1=Ej1Ej1 depends only on α1,,αij1 and is bound to happen conditioned on α<ij=β. We then have

Pr[F]Pr[F1] =βSPr[(α<ij=β)F]βSPr[(α<ij=β)F1]=βSPr[(α<ij=β)Ej]βSPr[α<ij=β]
maxβSPr[(α<ij=β)Ej]Pr[α<ij=β]=maxβSPr[Ejα<ij=β].

Fix β=(β1,,βij1)T. We just need to prove that Pr[Ejα<ij=β](t1)kqk1qm. Let

Q:=det(Mj|X1=β1,,Xij1=βij1)𝔽q[Xij,,Xn].

If Q=0, then Ej never occurs conditioned on α<ij=β and we are done. So assume Q0. View Q as a polynomial in Xij+1,,Xn over the ring 𝔽q[Xij], and let Q0𝔽q[Xij] be the coefficient of a nonzero term of Q. Then conditioned on α<ij=β, the event Ej occurs only if αij is a root of Q00. Note that degQ0degXijQdegXij(det(Mj)), which is bounded by (t1)kqk1 from the expression of RG,𝒱Sj. Also note that conditioned on α<ij=β, the random variable αij is uniformly distributed over 𝔽qm. It follows that Pr[Ejα<ij=β](t1)kqk1qm.

Corollary 22.

Under the notations and conditions in Lemma 14, suppose mn and (α1,,αn) is chosen uniformly at random, then

Pr[ker(RG,𝒱|X1=α1,,Xn=αn)0]((t1)knqkm)r.
Proof.

Take a union bound over sequences (i1,,ir)([n]r), by Lemma 14, the probability that Algorithm 1 outputs a faulty sequence on the input V1,,Vt and α1,,αn is at most nr×((t1)kqkm)r. If this doesn’t happen, by Lemma 13, ker(RG,𝒱|X1=α1,,Xn=αn)0.

5.2 Application to List Decoding

We are ready to prove our main results.

Theorem 23.

Let ε(0,1),c>1 and n,k,m, be positive integers with kn and mc(+1)nε. Then with probability at least 1qΩ(n), a randomly punctured Gabidulin code C𝔽qmn with rate R:=kn is (+1(1Rε),) average-radius list decodable.

Proof.

Let λ=εR=εkn. By Lemma 10, if C with generator matrix G is not (+1(1Rε),) average-radius list decodable in the rank metric, then, there exist t{2,3,,+1} and 𝔽q-linear subspaces V1,,Vt𝔽qn such that

  1. 1.

    ker(RG,𝒱[t])0.

  2. 2.

    dim(𝒱[t])(1+λ)(t1)k

  3. 3.

    dim(𝒱J)(1+λ)(|J|1)k for some non-empty set J[t].

Choose α1,,αn𝔽qm uniformly at random. The probability that α1,,αn are 𝔽q-linearly dependent is at most nq(nm)=qΩ(n). Let G¯=(αjqi1)(i,j)[k]×[n]. To prove this theorem,it suffices to show that Items 13 simultaneously hold with probability at most qO(n2). We fix t{2,3,,+1} and V1,,Vt𝔽qn satisfying Item 2 and Item 3. Let r=λkt1+1λkt1=εnt1. Observe that RG¯,𝒱[t]=RG,𝒱[t]|X1=α1,,Xn=αn where G=(Xjqi1)(i,j)[k]×[n]. By Corollary 22, the probability that ker(RG¯,𝒱[t])0 holds is at most (knqkm)r(knqkm)εn, where we use the fact that rεn. The number of t-tuples 𝒱[t], where t ranges over {2,,+1}, is bounded by t=2+1(qn2)t2q(+1)n2. By the union bound, the probability that Items 13 hold for some t{2,,+1} and V1,,Vt𝔽qn is at most 2q(+1)n2×(knqkm)εn+nqnm=2(knqk+n(+1)/εm)εn/+qΩ(n)=qΩ(n) as mcn(+1)ε for some c>1.

References

  • [1] Omar Alrabiah, Venkatesan Guruswami, and Ray Li. AG codes have no list-decoding friends: Approaching the generalized Singleton bound requires exponential alphabets. In Proceedings of the 2024 Annual ACM-SIAM Symposium on Discrete Algorithms (SODA), pages 1367–1378. SIAM, 2024. doi:10.1137/1.9781611977912.55.
  • [2] Omar Alrabiah, Venkatesan Guruswami, and Ray Li. Randomly punctured Reed–Solomon codes achieve list-decoding capacity over linear-sized fields. In Proceedings of the 56th Annual ACM Symposium on Theory of Computing, pages 1458–1469, 2024. doi:10.1145/3618260.3649634.
  • [3] Hannes Bartz, Lukas Holzbaur, Hedongliang Liu, Sven Puchinger, Julian Renner, Antonia Wachter-Zeh, et al. Rank-metric codes and their applications. Foundations and Trends® in Communications and Information Theory, 19(3):390–546, 2022. doi:10.1561/0100000119.
  • [4] Joshua Brakensiek, Sivakanth Gopi, and Visu Makam. Lower bounds for maximally recoverable tensor codes and higher order MDS codes. IEEE Transactions on Information Theory, 68(11):7125–7140, 2022. doi:10.1109/TIT.2022.3187366.
  • [5] Philippe Delsarte. Bilinear forms over a finite field, with applications to coding theory. J. Comb. Theory, Ser. A, 25(3):226–241, 1978. doi:10.1016/0097-3165(78)90015-8.
  • [6] Michael A. Forbes and Venkatesan Guruswami. Dimension Expanders via Rank Condensers. In Approximation, Randomization, and Combinatorial Optimization. Algorithms and Techniques (APPROX/RANDOM 2015), pages 800–814, 2015. doi:10.4230/LIPIcs.APPROX-RANDOM.2015.800.
  • [7] Michael A Forbes and Amir Shpilka. On identity testing of tensors, low-rank recovery and compressed sensing. In Proceedings of the forty-fourth annual ACM symposium on Theory of computing, pages 163–172, 2012. doi:10.1145/2213977.2213995.
  • [8] Ernst Gabidulin. Theory of codes with maximum rank distance (translation). Problems of Information Transmission, 21:1–12, January 1985.
  • [9] J. K. Gibson. Severely denting the Gabidulin version of the Mceliece public key cryptosystem. Designs, Codes and Cryptography, pages 37–45, 1995. doi:10.1007/BF01390769.
  • [10] J. K. Gibson. The security of the Gabidulin public-key cryptosystem. In Advances in Cryptology – EUROCRYPT’96, LNCS 1070,. Springer, 1996.
  • [11] Zeyu Guo, Ben Lee Volk, Akhil Jalan, and David Zuckerman. Extractors for images of varieties. In Proceedings of the 55th Annual ACM Symposium on Theory of Computing, pages 46–59, 2023. doi:10.1145/3564246.3585109.
  • [12] Zeyu Guo, Chaoping Xing, Chen Yuan, and Zihan Zhang. Random gabidulin codes achieve list decoding capacity in the rank metric. In 65th IEEE Annual Symposium on Foundations of Computer Science, FOCS 2024, Chicago, IL, USA, October 27-30, 2024, pages 1846–1873. IEEE, 2024. doi:10.1109/FOCS61266.2024.00111.
  • [13] Zeyu Guo and Zihan Zhang. Randomly punctured Reed-Solomon codes achieve the list decoding capacity over polynomial-size alphabets. In 2023 IEEE 64th Annual Symposium on Foundations of Computer Science (FOCS), pages 164–176, 2023. doi:10.1109/FOCS57990.2023.00019.
  • [14] Venkatesan Guruswami, Nicolas Resch, and Chaoping Xing. Lossless dimension expanders via linearized polynomials and subspace designs. Comb., 41(4):545–579, 2021. doi:10.1007/s00493-020-4360-1.
  • [15] Venkatesan Guruswami, Carol Wang, and Chaoping Xing. Explicit list-decodable rank-metric and subspace codes via subspace designs. IEEE Trans. Inf. Theory, 62(5):2707–2718, 2016. doi:10.1109/TIT.2016.2544347.
  • [16] R. Koetter and F. R. Kschischang. Coding for errors and erasures in random network coding. In IEEE International Symposium on Information Theory (ISIT 2007), pages 791–795. IEEE, 2007. doi:10.1109/ISIT.2007.4557321.
  • [17] Ralf Koetter and Frank R. Kschischang. Coding for errors and erasures in random network coding. IEEE Trans. Inf. Theory, 54(8):3579–3591, 2008. doi:10.1109/TIT.2008.926449.
  • [18] Pierre Loidreau. Designing a rank metric based mceliece cryptosystem. In Post-Quantum Cryptography: Third International Workshop, PQCrypto 2010, Darmstadt, Germany, May 25-28, 2010. Proceedings 3, pages 142–152. Springer, 2010. doi:10.1007/978-3-642-12929-2_11.
  • [19] Pierre Loidreau. A new rank metric codes based encryption scheme. In Post-Quantum Cryptography: 8th International Workshop, PQCrypto 2017, Utrecht, The Netherlands, June 26-28, 2017, Proceedings 8, pages 3–17. Springer, 2017. doi:10.1007/978-3-319-59879-6_1.
  • [20] Hsiao-feng Lu and P Vijay Kumar. A unified construction of space-time codes with optimal rate-diversity tradeoff. IEEE Transactions on Information Theory, 51(5):1709–1730, 2005. doi:10.1109/TIT.2005.846403.
  • [21] Paul Lusina, Ernst Gabidulin, and Martin Bossert. Maximum rank distance codes as space-time codes. IEEE Transactions on Information Theory, 49(10):2757–2760, 2003. doi:10.1109/TIT.2003.818023.
  • [22] Netanel Raviv and Antonia Wachter-Zeh. Some Gabidulin codes cannot be list decoded efficiently at any radius. IEEE Transactions on Information Theory, 62(4):1605–1615, 2016. doi:10.1109/TIT.2016.2532343.
  • [23] Netanel Raviv and Antonia Wachter-Zeh. A correction to “some Gabidulin codes cannot be list decoded efficiently at any radius”. IEEE Transactions on Information Theory, 63(4):2623–2624, 2017. doi:10.1109/TIT.2017.2659766.
  • [24] Chong Shangguan and Itzhak Tamo. Combinatorial list-decoding of Reed-Solomon codes beyond the Johnson radius. In Proceedings of the 52nd Annual ACM SIGACT Symposium on Theory of Computing, pages 538–551, 2020. doi:10.1145/3357713.3384295.
  • [25] D. Silva and F. R. Kschischang. Fast encoding and decoding of Gabidulin codes. In IEEE International Symposium on Information Theory (ISIT 2009). IEEE, 2009.
  • [26] D. Silva, F.R. Kschischang, and R. Koetter. A rank-metric approach to error control in random network coding. IEEE Transactions on Information Theory, 54(9):3951–3967, 2008. doi:10.1109/TIT.2008.928291.

Appendix A Field Size Lower Bound for Capacity-Achieving Rank-Metric Codes

We prove a lower bound on the field size of capacity achieving rank-metric codes by adapting the argument in [1]. We first prove a lower bound for rank-metric codes with large distance in Theorem 24. Then, we remove this distance requirement in Corollary 25.

Theorem 24.

Let 2. For any r[0,1], any rank-metric code C𝔽qmn of rate R and minimum distance at least (1Rε)n+1 that is ((1Rε)+1,)-avearge-radius list decodable must have m=Ω(Rnε).

Proof.

Fix a subspace V0𝔽qn of dimension b:=4εn. Choose a subspace V¯0 such that V0V¯0=𝔽qn. Let α=Rε and β=R+ε. Let be the collection of subspaces VV¯0 of dimension αn such that for any pair of vector spaces V1,V21, dim(V1+V2)βn. By Corollary 8, the size of can be at least qΩ((αα24εo(1))n2). It suffices to prove that qbm||/2, as this would imply m=Ω(Rnε).

Assume to the contrary that qbm<||/2. Let M be uniformly distributed from C. For a fixed subspace V, let A𝔽qn×αn such that A=V. Let EV be the event that there exists a codeword M1C different from M such that MA=M1A, i.e., (MM1)A=0. If EV does not hold, then M is uniquely determined by MA𝔽qm×αn. As the number of possible values of MA is at most qαnm and |C|=qRmn, we have

Pr[¬EV]qαmnqRmn=qεRmn.

Therefore, over random MC, the expected number of V such that EV happens is V(1Pr[¬EV])||/2. Then, we can fix a codeword MC such that the size of the set

M:={V:EV happens}

is at least ||/2.

Let A0𝔽qn×b such that A0=V0. By the definition of M, for each VM, there exists a codeword MVM such that the kernel subspace of MMV contains V. Since MVA0𝔽qm×b for any codeword MV and qbm<||/2|M|, by the pigeonhole principle, there exists distinct V1,,VM such that MV1A0==MVA0. Moreover, by the definition of M, for i=1,,, there exists Ai𝔽qn×αn with Ai=Vi such that (MMVi)Ai=0.

Assume MVi=MVj for some ij. Then (MMVi)Ai=0 and (MMVi)Aj=0. Let A𝔽qn×dim(Vi+Vj) such that A=Vi+Vj. As the columns of A are in Vi+Vj=Ai+Aj, we have (MMVi)A=0, i.e., Vi+Vj is contained in the kernel subspace of MMVi. Since M and MVi are in code C of minimum distance at least (1Rε)n+1, we have rank(MMVi)(1Rε)n+1. This implies that the kernel subspace of MMVi is at most (R+ε)n1. So dim(Vi+Vj)(R+ε)n1. However, as Vi,Vj and thus dim(Vi+Vj)βn=(R+ε)n, which yields a contradiction. Thus, we conclude that MV1,,MV are all distinct.

Since V¯0V0={0}, there exists B0𝔽qn×(nb) such that B0=V¯0 and (A0B0)𝔽qn×n has full rank. Let Y𝔽qm×n such that (MV1Y)A0==(MVY)A0=0 and (MY)B0=0. This can be achieved by choosing Y=(MV1A0MB0)(A0B0)1.

For i[], we have (MY)Ai=0 since Ai=Vi, ViV¯0, V¯0=B0, and (MY)B0=0. And for i[], we know (MMVi)Ai=0, which implies

(MViY)Ai=(MViM)Ai+(MY)Ai=0and(MViY)A0=0.

Since V0ViV0V¯0={0} for i[], we have dim(V0+Vi)=dimV0+dimVi=b+αn and hence

rank(MViY)n(b+αn)(1R3ε)n,

as b=4εn. As (MY)B0=0, we have rank(MY)ndim(V¯0)=b=4εn. It follows that

rank(MY)+i=1rank(MViY)4εn+(1R3ε)(1Rε)n.

as 2. This contradicts the claim that C is ((1Rε)+1,)-avearge-radius list decodable.

We now show how to remove the minimum distance requirement in Theorem 24.

Corollary 25.

Let 2. For any r[0,1], any rank-metric code C𝔽qmn of rate R that is ((1Rε)+1,)-avearge-radius list decodable must have m=Ω(Rnε).

Proof.

Compared to Theorem 24, this statement only remove the minimum distance requirement. Thus, if we find a subcode of C with minimum distance (1Rε) and the same rate R, then we can apply the argument in Theorem 24 directly to obtain the desired result. To achieve this goal, we prove the claim that for any MC, there are at most 1 codewords T1,,T1 in C that is within minimum distance at most (1Rε)n from M1. Assume not and we find T1,,T such that rank(MTi)(1Rε)n. Let M be the center and we claim that

rank(MM)+i=1rank(MTi)(1Rε).

Thus, C is not ((1Rε)+1,)-avearge-radius list decodable code and a contradiction happens. Therefore, we can find a subcode C1C of size at least |C| such that the minimum distance of C1 is at least (1Rε)n. We can apply the same argument in Theorem 24 to obtain the desired result.

Appendix B Proof of Theorem 19

Proof.

For i[t], let Ai𝔽qn×dimVi such that Ai=Vi. By Lemma 2, there exist full-rank matrices Bi𝔽qn×dim(Vi), Ci𝔽qn×dim(Vi), and Di𝔽qn×dim(Vi) such that CiAi+DiBi=In and Di=Vi. Define the linear map ϕ such that it sends a row vector 𝒗:=(𝒚,𝒙2,,𝒙t)ker(RG,𝒱[t]) to

ϕ(𝒚,𝒙2,,𝒙t)=(𝒚B1,(𝒚𝒙2G)B2,,(𝒚𝒙tG)Bt).

Since Bi is an n×(ndim(Vi)) matrix over 𝔽q, ϕ(𝒗) is a vector of length i=1t(ndim(Vi)) which is exactly the number of columns of MH,𝒱[t]. Next, we show that ϕ(𝒗) belongs to ker(MH,𝒱[t]). To see this, we observe that H𝒚=H(𝒚𝒙2G)==H(𝒚𝒙tG). Also,

H𝒚=H(C1D1)(A1B1)𝒚=H(C1D1)(0B1𝒚)=HD1B1𝒚

and

H(𝒚𝒙iG)=H(CiDi)(AiBi)(𝒚𝒙iG) =H(CiDi)(0Bi(𝒚𝒙iG))
=HDiBi(𝒚𝒙iG).

This implies that HD1B1𝒚=HDiBi(𝒚𝒙iG) for i=2,,t, and thus ϕ(𝒗) belongs to ker(MH,𝒱[t]).

It remains to show that ϕ is an injection. It suffices to show that ϕ(𝒗)=0 implies 𝒗=0 as ϕ is a linear map. As y=(C1D1)(A1B1)𝒚=(C1D1)(0B1𝒚), we know that 𝒚B1=0 implies 𝒚=0. Similarly, as (𝒚𝒙iG)=(CiDi)(AiBi)(𝒚𝒙iG)=(CiDi)(0Bi(𝒚𝒙iG)), we know that (𝒚𝒙iG)Bi=0 implies 𝒚𝒙iG=0 for i=2,,t. So ϕ(𝒗)=0 implies 𝒗=0.

Appendix C Proof of Theorem 20

Proof.

Let n=dim(V). Let A𝔽qn×n such that A=V. Let 𝒰[t]=(U1,,Ut)(𝔽qn)t be given in Lemma 11 and we have dim(Ui)=dim(ViV). Note that

dim(𝒰[t])=i[t]dim(Ui)dim(i=1tUi)dim(𝒱[t])(ndim(V))(t1)(1+λ)(t1)kλk (13)

and

dim(𝒰J)dim(𝒱J)(1+λ)(|J|1)k (14)

for any nonempty set J[t].

By Lemma 11, to prove ker(RG,𝒱[t]V)=0, it suffices to show that ker(RG1,𝒰[t])=0 for G1=GA. Here GA=(Zjqi1)[k]×[n] is also a generator matrix of a symbolic Gabidulin code C by letting (Z1,,Zn)=(X1,,Xn)A. Moreover, by replacing 𝔽qn with V:=i=1tUi and identifying view Ui as a subspace of V, we may assume i=1tUi=𝔽qn.

It follows from (13) and (14) that dim(Ui)dim(𝒰[t])dim(𝒰[t]/{i})k. So dim(Ui)nk. Let H1 be the parity-check matrix of C, i.e., G1H1=0. Define 𝒰[t]=(U1,,Ut). Then, by Definition 18, we have

MH1,𝒰[t]=(H1D1H1D200H1D10H1D30H1D100H1Dt) (15)

where Di𝔽qn×dim(Ui) with Di=Ui. By Theorem 16, we have

dim(i=1tH1Di)=maxP1Ps=[t](i=1sdim(jPiUj)(s1)(nk)). (16)

We proceed to compute the RHS of (16). For s=1 and P1=[t], as i[t]Ui=𝔽qn, we conclude

j[t]Ui=(1)(i[t]Ui)=0. (17)

For s2 and nonempty sets P1,,Ps that forms a partition of [t], we have

i=1sdim(jPiUj)=(1)i=1s(ndim(jPiUj))=sn+i=1sdim(𝒰Pi)i=1sjPidim(Uj) (18)
(14)sn+(λ+1)i=1s(|Pi|1)kj=1tdim(Uj)=sn+(λ+1)k(ts)dim(𝒰[t])n
(13)sn+(λ+1)k(ts)(1+λ)(t1)k+λkn(s1)(nk).

Combining (16), (17), and (18), we conclude that i=1tH1Di=0. Now, by Lemma 9, this implies

rank(MH,𝒱[t])=i=1tdim(HDi)dim(i=1tH1Di)=i=1tdim(HDi)=i=1trank(Di)

The last equality holds since by Lemma 8, the rank of HDi equals rank(Di), as Di𝔽qn×dim(Ui) is of full rank and dim(Ui)=ndim(Ui)nk. Since the number of columns in MH,𝒱[t] is i=1trank(Di) which is equal to its rank, the only solution in ker(MH,𝒱[t]) is 0. The proof is completed.