An Algebraic Method for Constructing Bases in Binary Linear Codes for Information Dispersal Algorithms

Abstract

The algebraic analysis of linear code parameters reveals deep connections with cryptographic constructions, including the Information Dispersal Algorithms (IDAs) and secret-sharing schemes. In this work, we propose an algebraic method for constructing bases of binary linear codes from subsets of codewords selected according to their generalized Hamming weights (GHWs). The approach employs a degree-compatible monomial ordering on the polynomial ring ${\mathbb{F}}_2[x_1,\dots ,x_n]$ and imposes the conditions $d_1\left(C\right)=1$ and $d_k\left(C\right)=n$. Under these assumptions, we prove the existence of a generator matrix containing an invertible $k\times k$ submatrix, which guarantees correct information reconstruction. This structural property enables the direct application of binary linear codes to information dispersal and recovery mechanisms without the need for larger finite fields. We validate the proposed framework through algebraic proofs and an explicit example illustrating both the dispersal and recovery procedures. These results provide a theoretical foundation for the design of information dispersal schemes relying exclusively on binary linear codes.

1. Introduction

The study of linear codes provides a mathematical foundation for secure communication, error detection and correction, and information protection. Furthermore, it underpins modern cryptographic and distributed systems, such as distributed storage, secure multiparty computation, secret-sharing schemes, and Information Dispersal Algorithms (IDAs), along with their associated Information Recovery Algorithms (IRAs) [1,2,3,4,5,6]. IDAs, introduced by Rabin [7], disperse data into n pieces, allowing reconstruction from any $t<n$ pieces to ensure reliability and fault tolerance. Rabin’s construction employs matrices over algebraic structures such as polynomial rings, Euclidean rings, or finite fields [8], for example, Cauchy or Vandermonde matrices with invertible submatrices that enable reconstruction [9].

Traditional IDAs, particularly those based on Reed–Solomon codes, rely on Vandermonde or Cauchy matrices, which necessitate the use of finite fields $GF\left(q\right)$ with $q>n$. This requirement arises because, to ensure that every $k\times k$ submatrix is non-singular (the MDS property), these constructions require n distinct non-zero elements from the field to serve as evaluation points or generators. Consequently, for a large number of shares n, the field size must increase, typically leading to implementations in $GF\left(2^8\right)$ or higher.

Despite the robustness of these methods, binary linear codes are seldom used in IDAs due to the difficulty of ensuring that generator matrices contain the necessary invertible $k\times k$ submatrices, a property more easily found in codes over $\mathbb{R}$ or $\mathbb{C}$. The recent literature has explored related areas; for instance, Dertli and Eren [10] developed access structures for secret-sharing schemes based on torsion codes of MacDonald codes over the ring ${\mathbb{F}}_2+u{\mathbb{F}}_2+v{\mathbb{F}}_2$, leveraging inherent properties like minimum weight for reliability. Similarly, Beimel [2] described linear secret-sharing schemes derived from monotonic formulas and span programs, providing constructions for arbitrary access structures. However, these works focus primarily on secret-sharing logic rather than the explicit use of binary linear codes for information dispersal.

There remains a notable gap in research focused on utilizing the algebraic parameters of fundamental binary codes to support IDAs directly. Parameters such as minimum distance and generalized Hamming weights (GHWs) can indicate the existence of the required invertible structures. Binary codes offer rigid algebraic frameworks ideal for studying GHWs and bases. In this work, we focus on the algebraic conditions that allow binary codes to support IDAs. We demonstrate that codes satisfying $d_1\left(C\right)=1$ and $d_k\left(C\right)=n$ enable IDAs via an invertible $k\times k$ submatrix in the generator matrix, ensuring the validity of Rabin’s scheme. Our method employs a degree-compatible monomial order on ${\mathbb{F}}_2[x_1,\dots ,x_n]$ to select codewords matching the GHW hierarchy, forming a basis for binary IDAs without the overhead associated with larger finite fields.

The paper is organized as follows. Section 2 reviews the necessary background on linear codes, GHWs, monomial orders, and IDAs. Section 3 presents the main algebraic construction, including the selection of a basis guided by GHWs and the definition of the IDA and IRA procedures. Section 4 illustrates the proposed framework through an example of a binary linear code that satisfies the required conditions. Section 5 presents the conclusions and outlines directions for future research. Finally, Appendix A details the method proposed by Johnsen and Verdure [11] for calculating the GHWs of a linear code.

1.1. Literature Review

This work intersects linear coding theory, algebraic methods, and IDAs. The relevant literature is summarized as follows:

1.

The algebraic foundations of linear codes, including generator matrices, parity-check matrices, and structural parameters, are classical and well established; see, for instance, [5,6,12]. These works provide the basic framework for understanding linear codes as vector spaces over finite fields and for analyzing their fundamental parameters.

2.

Generalized Hamming weights (GHWs), introduced by Wei [13], extend the notion of minimum distance and have become central invariants in the structural analysis of linear codes. Subsequent developments connected GHWs with algebraic and combinatorial objects, particularly through the study of matroids and Stanley–Reisner ideals. In this direction, Johnsen and Verdure [11,14] established a deep relationship between GHWs and graded free resolutions, while García-Marco et al. [15] further explored these ideas in the binary case. These results highlight the role of GHWs as tools for understanding the internal structure of linear codes beyond error-correcting capabilities.

3.

From an algebraic point of view, polynomial rings and monomial orders play an important role in the study of linear codes and their associated ideals; see, e.g., [16]. Degree-compatible monomial orders provide a natural way to organize monomials according to their weight, making them suitable for linking algebraic structures with combinatorial properties of codes.

4.

Information Dispersal Algorithms (IDAs) were introduced by Rabin [1,2,4,7,17] as a method for distributing information among multiple participants in a fault-tolerant manner. Classical constructions of IDA usually use matrices from large finite fields, such as Vandermonde or Cauchy matrices, to ensure the existence of invertible submatrices [9,18]. While these approaches are effective, they inherently depend on non-binary fields.

1.2. Contributions

This work presents an algebraic method for constructing bases of binary linear codes with structural properties suitable for information dispersal. The contributions of this paper can be summarized as follows.

• An algebraic method is introduced for selecting a basis of an $[n,k]$ binary linear code by combining GHWs with a degree-compatible monomial order on the polynomial ring ${\mathbb{F}}_2[x_1,\dots ,x_n]$. The resulting basis reflects the hierarchy of supports determined by the GHWs of the code.
• Under the structural assumptions $d_1\left(C\right)=1$ and $d_k\left(C\right)=n$, we prove that the basis obtained through this construction yields a generator matrix containing at least one invertible $k\times k$ submatrix. This result establishes a direct link between GHWs and the existence of invertible substructures in binary generator matrices.
• We provide a systematic procedure for identifying an invertible $k\times k$ submatrix from the generator matrix associated with the constructed basis. The procedure is derived from the algebraic properties of the selected codewords and does not rely on probabilistic or numerical arguments.
• Based on the above structural results, we formalize an information dispersal and reconstruction scheme defined entirely over the binary field. The correctness of the reconstruction follows from the algebraic properties of the constructed basis and the imposed GHWs conditions.

This work highlights new ideas on GHWs that depart from the traditional perspective of error or security analysis. Instead, they are used as structural invariants that provide information about the possible supports of subcodes and, consequently, about the existence of codewords with controlled support properties. These features will be exploited in Section 2 to guide the selection of a suitable basis for the code.

2. Preliminaries

This section establishes the fundamentals of linear coding theory, specifically generator matrices, parity-check matrices, and generalized Hamming weights (GHWs), adopting the standard definitions and notation found in [5,6,12,13]. Furthermore, we detail the use of polynomial rings and monomial orders as discussed in [16]. In this context, these algebraic concepts serve as a structural tool to impose a strict hierarchy on codeword coordinates, facilitating the algebraic analysis of supports and GHWs. Finally, we formally define the Information Dispersal Algorithm (IDA), based on the framework presented in [1].

Linear Codes and Information Dispersal Algorithm

Let $q=p^r$ be a positive integer, where p is a prime number and r is a positive integer. The finite field with q elements is denoted by ${\mathbb{F}}_q$. Let $n,k,d$ be positive integers such that $n\ge k$ and $d\ge 1$. An $[n,k,d]$-linear code C is defined as a subspace of the vector space ${\mathbb{F}}_q^n$.

Matrix $G\in {\mathrm{Mat}}_{k\times n}\left({\mathbb{F}}_q\right)$ is called a generator matrix of C if its rows form a basis of C. Similarly, a matrix $H\in {\mathrm{Mat}}_{(n-k)\times n}\left({\mathbb{F}}_q\right)$ is said to be a parity-check matrix of C if its null space coincides with C; that is, $x{H}^T=0\mathrm{for}\mathrm{all}x\in C,$ where 0 denotes the zero vector in ${\mathbb{F}}_q^{n-k}$. The code C can be generated by multiplying any vector $x\in {\mathbb{F}}_q^k$ by the generator matrix G, that is, by computing the product $xG$.

Given two non-zero vectors $x=(x_1,\dots ,x_n)$ and $y=(y_1,\dots ,y_n)$ in ${\mathbb{F}}_q^n$, the support of x is defined as $\mathrm{supp}\left(x\right)=\left\{i\mid x_i\ne 0\right\}$. The Hamming distance between x and y is given by

$$d(x,y)=\left|\left\{i\mid x_i\ne y_i\right\}\right|.$$

The Hamming weight of a vector x is defined as $w\left(x\right)=d(x,\overline{0})$, where $\overline{0}$ denotes the zero vector. The minimum distance of a linear code C is then defined as

$$d=min\left\{w\left(x\right)\mid x\in C,x\ne \overline{0}\right\}.$$

When the minimum distance of a linear code C is known, the code is described as an $[n,k,d]$-linear code. The elements of C are called codewords, and the parameters n, k, and d are referred to as the basic parameters of the code, representing:

1.

n—the length of the codewords;

2.

k—the dimension of C as a vector space over ${\mathbb{F}}_q$;

3.

d—the minimum distance of C.

The support of a subset $D\subseteq C$ is defined as

$$\mathrm{supp}\left(D\right)=\left\{i\mid \exists c\in D\mathrm{such}\mathrm{that}{c}_i\ne 0\right\}.$$

In the case of a binary linear code, the support of a subset $D\subseteq C$ coincides with the set of coordinate positions for which at least one element of D has a non-zero entry.

Definition 1 ([15]).

The h-th generalized Hamming weight of a linear code C is defined as

$$d_h\left(C\right)=min\left\{\left|\mathrm{supp}\left(E\right)\right|\mid E\in D_h\left(C\right)\right\},$$

where $D_h\left(C\right)$ denotes the collection of all h-dimensional linear subspaces of C, for $h\in \left\{1,\dots ,k\right\}$.

It is worth noting that when $h=1$, the generalized Hamming weight coincides with the minimum distance of the code, that is, $d_1\left(C\right)=d$. Hence, Definition 1 generalizes the classical notion of minimum distance.

The following theorem establishes fundamental properties of the generalized Hamming weights.

Theorem 1 ([13]).

Let C be an $[n,k,d]$-linear code. Then

1. 

$1\le d_1\left(C\right)<d_2\left(C\right)<\cdots <d_k\left(C\right)\le n$;

2. 

(Generalized Singleton Bound) $d_h\left(C\right)\le n-k+h$.

The following classical results from linear algebra and commutative algebra can be found in standard references (see, for instance, [19]).

Corollary 1 ([19]).

Let V be a finite-dimensional vector space of dimension n. Any set of n linearly independent vectors in V forms a basis of V.

Theorem 2 ([5]).

Let $A\in {\mathrm{Mat}}_{n\times n}\left(\mathbb{K}\right)$. Then A is invertible if and only if $det\left(A\right)\ne 0$.

Some fundamental results on polynomial rings are presented in [15]. A degree-compatible monomial order is introduced in [16].

Definition 2 ([16]).

Let X be a collection of n vector variables $X_1,\dots ,X_n$, where each $X_i$ decomposes into $q-1$ components $x_{i,1},\dots ,x_{i,q-1}$ for $i\in \left[n\right]$. A monomial in X is an expression of the form

$$\begin{array}{c}\hfill X^u=X_1^{u_1}\cdots X_n^{u_n}=\prod _{i=1}^n\prod _{j=1}^{q-1}{x}_{i,j}^{u_{i,j}},\end{array}$$

where $u\in {\mathbb{Z}}_{\ge 0}^{n(q-1)}$.

Definition 3.

The polynomial ring $\mathbb{K}\left[X\right]$ is defined as the set of all polynomials in the variables X with coefficients in the field $\mathbb{K}$.

The total degree of a monomial $X^u$ is given by $deg\left(X^u\right)={\sum }_{i=1}^n{\sum }_{j=1}^{q-1}{u}_{i,j}$. In particular, when $u=(0,\dots ,0)$, the monomial reduces to $X^u=1$.

Let X be a set. A partial order on X is a binary relation ≤ that is reflexive, antisymmetric, and transitive. A partial order is said to be a total order if, for any $a,b\in X$, either $a\le b$ or $b\le a$ hold.

Let $\mathbb{K}$ be a field and let $S=\mathbb{K}[x_1,\dots ,x_n]$. Denote by $\mathrm{Mon}\left(S\right)$ the set of all monomials in S.

Definition 4.

A monomial order on S is a total order ≤ on $\mathrm{Mon}\left(S\right)$, satisfying:

1. 

$1\le u$ for all $u\in \mathrm{Mon}\left(S\right)$;

2. 

if $u<v$ and $w\in \mathrm{Mon}\left(S\right)$, then $uw<vw$.

Definition 5 ([16]).

A monomial order ≺ on $\mathbb{K}[x_1,\dots ,x_n]$ is said to be degree-compatible if

$$deg\left(X^a\right)<deg\left(X^b\right)⟹X^a\prec X^b$$

for all monomials $X^a,X^b$.

An example of a degree-compatible monomial order on ${\mathbb{F}}_2[x_1,\dots ,x_n]$ is the graded lexicographic order. It is defined by $X^a{<}_{\mathrm{deglex}}{X}^b$ if and only if:

1.

${\sum }_{i=1}^n{a}_i<{\sum }_{i=1}^n{b}_i$; or

2.

${\sum }_{i=1}^n{a}_i={\sum }_{i=1}^n{b}_i$ and $a_j<b_j$ for $j=min\left\{i\mid a_i\ne b_i\right\}$.

The following definitions, adapted from [1], formally describe the structure of an Information Dispersal Algorithm.

Definition 6 ([1]).

Let $P=\left\{P_1,P_2,\dots ,P_n\right\}$ be a set of n participants, and let t be a positive integer called the threshold. An Information Dispersal Algorithm (IDA) consists of a pair of algorithms $(IDA,IRA)$ defined as follows:$IDA(M,P,t)⟶(X_1,X_2,\dots ,X_n)$, where

• M denotes the plaintext message;
• P is the set of participants;
• t is the reconstruction threshold.

The algorithm produces a collection of shares $(X_1,X_2,\dots ,X_n)$, where each share $X_i$ is distributed to the participant $P_i$.

• $IRA(\{X_i:P_i\in A\},A)$:

• The input consists of a subset $A\subseteq P$ and the corresponding shares;
• If $\left|A\right|\ge t$, the algorithm reconstructs M;
• Otherwise, it produces an error symbol (e.g., ERROR).

The scheme satisfies the following correctness condition:

• (Decoding) For every subset $A\subseteq P$ with $\left|A\right|\ge t$,

$$\mathrm{IRA}(\{X_i:P_i\in A\},A)=M.$$

In classical IDA, correctness is ensured by the existence of invertible submatrices. In contrast, our binary variant relies on GHWs and degree-compatible monomial orders.

3. An Algebraic Framework for Code-Based IDA/IRA Schemes

Let n be a positive integer and consider the notation $\left[n\right]=\{1,\dots ,n\}$. Let C be an $[n,k]$-binary linear code. We define ${\mathcal{M}}_h$ as a family of subsets indexed by $h\in \left[k\right]$, consisting of codewords of C that form generating sets whose support cardinality equals $d_h\left(C\right)$ as follows:

$${\mathcal{M}}_h=\left\{m_i\in C\mid d_h\left(C\right)=\left|supp\left(\langle m_{i_1},m_{i_2}\dots ,m_{i_h}\rangle \right)\right|\right\}.$$

Let ≺ be a graded monomial order compatible with the total degree in ${\mathbb{F}}_2[x_1,\dots ,x_n]$. We define the minimal elements in ${\mathcal{M}}_h$ as follows: for each $i\in \left[k\right]$, we calculate

$$m^i={min}_{\prec }\left({\mathcal{M}}_i\right).$$

Remark 1.

The subset of codewords $\{m^1,\dots ,m^k\}$ from the family ${\mathcal{M}}_h$ satisfies

$${\bigcup }_{i=1}^{t-1}supp\left(m^i\right)\subseteq {\bigcup }_{i=1}^{t}supp\left(m^i\right)\mathrm{for} \mathrm{all} t\in [k].$$

Proof. 

By contradiction, suppose there exists an integer $t\in \left[k\right]$ such that the set $\{m^1,\dots ,m^t\}$ satisfies ${\bigcup }_{i=1}^{t-1}supp\left(m^i\right)\supset {\bigcup }_{i=1}^{t}supp\left(m^i\right)$.

Given that the elements $\{m^1,\dots ,m^{t-1}\}\in {\mathcal{M}}_h$, it follows that $|supp\left(〈m^i,\dots ,m^{t-1}〉\right)|\le d_{t-1}\left(C\right)$. Since ${\bigcup }_{i=1}^{t-1}supp\left(m^i\right)\supset {\bigcup }_{i=1}^{t}supp\left(m^i\right)$, we have that

$$supp\left(〈m^i,\dots ,m^{t-1}〉\right)=supp\left(〈m^i,\dots ,m^{t-1},m^t〉\right).$$

By computing the cardinalities, we obtain

$$|supp\left(〈m^1,\dots ,m^{t-1}〉\right)|=|supp\left(〈m^1,\dots ,m^{t-1},m^t〉\right)|=d_t\left(C\right).$$

The latter equality holds because $\{m^1,\dots ,m^t\}\in {\mathcal{M}}_h$. Consequently, $d_t\left(C\right)\le d_{t-1}\left(C\right)$, which contradicts Theorem 1.    □

Proposition 1.

There exists a subset $O_{\prec }=\{m^1,\dots ,m^k\}\subseteq {\mathcal{M}}_h$ that forms a basis for C.

Proof. 

We prove this by induction on the index $i\in \left[k\right]$.

For $i=1$, the codeword $m^1$ satisfies $d_1\left(C\right)=\left|supp\left(\langle m^1\rangle \right)\right|$. Clearly, $m^1\ne 0$, and since $\alpha m^1=0$ implies $\alpha =0$, the vector $m^1$ is linearly independent.

For illustrative purposes, consider the case $i=2$. The codewords $m^1$ and $m^2$ satisfy $d_2\left(C\right)=\left|supp\left(\langle m^1,m^2\rangle \right)\right|$. Moreover, $m^1\ne m^2$ because $d_1<d_2$, so there is at least one position j where $m^2$ has a 1 and $m^1$ has a 0. Let $m^1=(b_1,\dots ,b_{j-1},0,b_{j+1},\dots ,b_n)$ and $m^2=(b_1^{\prime },\dots ,b_{j-1}^{\prime },1,b_{j+1}^{\prime },\dots ,b_n^{\prime })$, where $b_i,b_i^{\prime }\in \{0,1\}$. Then

$$\begin{array}{cc}\hfill {\alpha }_1{m}^1+{\alpha }_2{m}^2& ={\alpha }_1(b_1,\dots ,b_{j-1},0,b_{j+1},\dots ,b_n)+{\alpha }_2(b_1^{\prime },\dots ,b_{j-1}^{\prime },1,b_{j+1}^{\prime },\dots ,b_n^{\prime })\hfill \\ \hfill & =({\alpha }_1{b}_1+{\alpha }_2{b}_1^{\prime },\dots ,{\alpha }_1{b}_{j-1}+{\alpha }_2{b}_{j-1}^{\prime },{\alpha }_2,{\alpha }_1{b}_{j+1}+{\alpha }_2{b}_{j+1}^{\prime },\dots ,{\alpha }_1{b}_n+{\alpha }_2{b}_n^{\prime })\hfill \\ \hfill & =(0,\dots ,0).\hfill \end{array}$$

From this, ${\alpha }_2=0$. Thus

$$\begin{array}{c}\hfill {\alpha }_1{m}^1+{\alpha }_2{m}^2={\alpha }_1(b_1,\dots ,b_{j-1},0,b_{j+1},\dots ,b_n)={\alpha }_1{m}^1,\end{array}$$

and since $\left\{m^1\right\}$ is linearly independent, ${\alpha }_1=0$. Therefore, ${\alpha }_1={\alpha }_2=0$, so $\{m^1,m^2\}$ is linearly independent.

Assume that $\{m^1,\dots ,m^{k-1}\}$ is linearly independent in C. Now consider $\{m^1,\dots ,m^k\}$ and suppose ${\sum }_{i=1}^k{\alpha }_i{m}^i=0$. By observation 1, if $O_{\prec }$ is such that ${\bigcup }_{i=1}^{k-1}supp\left(m^i\right)={\bigcup }_{i=1}^{t}supp\left(m^i\right)$, we then consider the minimal codeword in the set ${\mathcal{M}}_k$ such that ${\bigcup }_{i=1}^{k-1}supp\left(m^i\right)\subset {\bigcup }_{i=1}^{k}supp\left(m^k\right)$. Since $m^k\ne m^i$ for all $i\in [k-1]$, it follows that $m^k$ has at least one 1 in positions $\{r_1,\dots ,r_j\}$ where the codewords $m^i$ for $i\in [k-1]$ have 0 bits.

Fix position $r_1$. The equation becomes ${\sum }_{i=1}^k{\alpha }_i{m}^i=\left({\sum }_{i=1}^n{\alpha }_i{b}_i,\dots ,{\alpha }_{r_1}{b}_{r_1},\dots ,{\sum }_{i=1}^n{\alpha }_i{b}_i\right)=(0,\dots ,0),$ where $b_i\in \{0,1\}$. From the $r_1$-th coordinate, ${\alpha }_{r_1}{b}_{r_1}=0$, and since $b_{r_1}=1$, we have ${\alpha }_{r_1}=0$. Thus, the system reduces to ${\sum }_{i=1}^{k-1}{\alpha }_i{m}^i=0$. By the induction hypothesis, $\{m^1,\dots ,m^{k-1}\}$ is linearly independent, so ${\alpha }_i=0$ for $i\in [k-1]$. Hence, ${\alpha }_1=\dots ={\alpha }_k=0$, and $O_{\prec }=\{m^1,\dots ,m^k\}$ are linearly independent. By Corollary 1, $O_{\prec }\subset C$ is a basis of C.    □

We restate Proposition 1 as Algorithm 1:

Algorithm 1 Computing a Basis of a Binary Linear Code

Input: An $[n,k]$-binary linear code C and a degree-compatible monomial order in the polynomial ring ${\mathbb{F}}_2[x_1,\dots ,x_n]$.   Output: A basis of C. Operations: A basis of C is obtained as follows: 1. Calculate the family of subsets ${\mathcal{M}}_h$ of C. 2. Order the elements of ${\mathcal{M}}_h$ according to the order ≺ to obtain the sequence of codewords $\{m^1,\dots ,m^k\}$. 3. If $\{m^1,\dots ,m^k\}$ is such that ${\bigcup }_{i=1}^{t-1}supp\left(m^i\right)\subset {\bigcup }_{i=1}^{t}supp\left(m^i\right)$ for all $t\in \left[k\right]$, the algorithm terminates. However, if ${\bigcup }_{i=1}^{t-1}supp\left(m^i\right)={\bigcup }_{i=1}^{t}supp\left(m^i\right)$ for some $t\in \left[k\right]$, then search for the minimal codeword $m^j$ in ${\mathcal{M}}_t$ such that ${\bigcup }_{i=1}^{t-1}supp\left(m^i\right)\subset {\bigcup }_{i=1}^{t}supp\left(m^i\right)$ and replace $m^t$ with $m^j$. Thus, the set $\{m^1,\dots ,m^j,\dots ,m^k\}$ is obtained. 4. Output: The ordered set of codewords $O_{\prec }=\{m^1,\dots ,m^k\}$.

Proposition 2.

Let C be an $[n,k]$-binary linear code such that $d_1\left(C\right)=1$ and $d_k\left(C\right)=n$. Then Algorithms 2 and 3 are valid.

Algorithm 2 IDA Using a basis of a Binary Linear Code

Input: An $[n,k]$-binary linear code C satisfying $d_1\left(C\right)=1$, $d_k\left(C\right)=n$, and a plaintext message M. Output: A dispersal vector d, and $n\times k$ matrix A and the threshold t. Operations: The dispersal vector and the matrix A are obtained as follows: 1. Apply Algorithm 1 to the $[n,k]$-binary linear code C to obtain a basis $O_{\prec }={\left\{m^i\right\}}_{i=1}^k$ for C. 2. Convert the plaintext M into its binary representation, yielding a vector (or a set of vectors) $F\in {\mathbb{F}}_2^k$. 3. Define $A=[m^1,m^2,\dots ,m^k]$. Multiply F (on the right) by A to obtain the dispersal vector d; that is, $A·F=d$. 4. Define the positive integer $n-k$ as the erasure tolerance and the integer $t=k$ as the reconstruction threshold. 5. Output: The dispersal vector d, the $n\times k$ matrix A, and the threshold t.

Algorithm 3 Information Recovery Algorithm (IRA) from a Given Vector

Input: A vector b of length k and a matrix $A\in Ma{t}_{n\times k}\left({\mathbb{F}}_2\right)$. Output: The reconstructed message vector $m\in M$. Operations: The vector d is obtained from b and A as follows. 1. Let $A=[m^1,m^2,\dots ,m^k]$ and denote its rows by $r_i$ for $i\in \left[n\right]$. If $supp\left(r_i\right)=supp\left(r_j\right)$, remove row $r_j$. Repeat this process until all remaining rows are distinct or until $n-k$ rows have been deleted. If A contains no redundant rows, proceed to the next step. 2. For each $i\in \left[n\right]$, if a row $r_i=0$ exists in A, remove that row. 3. Suppose steps 1 and 2 result in p and s row deletions, respectively, where $p,s<n-k$. If $p+s=n-k$, proceed to the next step. If $p+s<n-k$, identify rows $r_i$ of A such that $|supp\left(r_i\right)|\ge |supp\left(r_j\right)|$ for all $j\in [n-(p+s\left)\right]$, ensuring that the removal of these rows does not result in any zero columns $C_i$. Repeat this process for q additional deletions until $p+s+q=n-k$. 4. After deleting $n-k$ rows, rename the resulting column vectors of A as $C_1,C_2,\dots ,C_k$, and define the matrix $B=[C_1,C_2,\dots ,C_k]$. 5. Solve the linear system $Bm=b$ to find m; that is, compute $m=B^{-1}b$. 6. Output: The reconstructed message vector $m\in M$.

Proof. 

Consider a basis for C obtained from Algorithm 1, denoted as $O_{\prec }={\left\{m^i\right\}}_{i=1}^k$. Since $d_1\left(C\right)=1$, the codeword $m^1$ contains exactly one non-zero coordinate at the i-th position; that is, $m^1=(0,\dots ,0,\underset{i}{\underbrace{1}},0,\dots ,0)$. Note that the i-th row in matrix A is not repeated because $m^1$ has a single 1 in position i. Therefore, this row is not omitted. Thus, the vector $C_1$ of matrix B preserves the unique 1 from $m^1$ after removing $n-k$ zero entries, such that $C_1=(0,\dots ,0,\underset{i}{\underbrace{1}},0,\dots ,0)$.

Furthermore, Algorithm 3 omits zero rows and repeated rows in matrix A; hence, the rows of B satisfy $r_i\ne r_j$ for $i\ne j$ and $r_i\ne 0$ for all $i,j\in \left[k\right]$.

Now, suppose ${\sum }_{i=1}^k{\alpha }_i{r}_i=0$, which yields the following system of equations:

$$\left\{\begin{array}{c}{\alpha }_1{b}_{11}+{\alpha }_2{b}_{12}+\cdots +{\alpha }_k{b}_{1k}=0\hfill \\ {\alpha }_1{b}_{21}+{\alpha }_2{b}_{22}+\cdots +{\alpha }_k{b}_{2k}=0\hfill \\ ⋮⋮\hfill \\ {\alpha }_1{b}_{k1}+{\alpha }_2{b}_{k2}+\cdots +{\alpha }_k{b}_{kk}=0\hfill \end{array}\right.(\ast )$$

This system can be rewritten as ${\alpha }_1{C}_1+{\alpha }_2{C}_2+\cdots +{\alpha }_k{C}_k=0$. Note that $C_1=(0,\dots ,{\underbrace{1}}_i,\dots ,0)$. Applying Gaussian elimination to the system leads to:

$$\left(\begin{array}{ccccc}\hfill 0& \hfill b_{12}& \hfill \cdots & \hfill b_{1k}& \hfill 0\\ \hfill ⋮& \hfill ⋮& \hfill \ddots & \hfill ⋮& \hfill ⋮\\ \hfill 1& \hfill b_{i2}& \hfill \cdots & \hfill b_{ik}& \hfill 0\\ \hfill ⋮& \hfill ⋮& \hfill \ddots & \hfill ⋮& \hfill ⋮\\ \hfill 0& \hfill b_{k2}& \hfill \cdots & \hfill b_{kk}& \hfill 0\end{array}\right)\sim \left(\begin{array}{ccccc}\hfill 1& \hfill b_{i2}& \hfill \cdots & \hfill b_{ik}& \hfill 0\\ \hfill 0& \hfill b_{22}& \hfill \cdots & \hfill b_{2k}& \hfill 0\\ \hfill ⋮& \hfill ⋮& \hfill \ddots & \hfill ⋮& \hfill ⋮\\ \hfill 0& \hfill b_{k2}& \hfill \cdots & \hfill b_{kk}& \hfill 0\end{array}\right)$$

From Proposition 1 we have that $O_{\prec }={\left\{m^i\right\}}_{i=1}^k$ is linearly independent; thus, no codeword is a linear combination of the others, ensuring that the rows of matrix A are distinct. Therefore, Step 1 of Algorithm 3 is performed at most s-times, with $s<n$, implying that $supp\left(c_i\right)\subseteq supp\left(m^i\right)$. Consequently, there exists at least one bit $b_{ij}=1$ in each codeword $C_i$.

Suppose that Step 2 of Algorithm 3 is performed p times; that is, p zero rows of matrix A are omitted. In this step, it holds that $supp\left(C_i\right)\subseteq supp\left(m^i\right)$, and since the codewords $m^i$ are elements of the family ${\mathcal{M}}_h$, it follows that $m^i\ne 0$. Thus, $C_i\ne 0$, which implies that there exists at least one bit $b_{ij}=1$ in each codeword $C_i$.

Suppose that Step 3 of Algorithm 3 is iterated q times. From the execution of Step 3, we observe that the rows $r_i$ ensure the columns $C_i$ remain non-zero; therefore, there is at least one bit 1 in each column $C_i$ of the matrix B. For each column $C_i$, apply row swaps to position a 1 at $b_{ij}$, then eliminate below it. Repeating this process k times yields:

$$\left(\begin{array}{ccccc}\hfill 1& \hfill b_{i2}& \hfill \cdots & \hfill b_{ik}& \hfill 0\\ \hfill 0& \hfill 1& \hfill \cdots & \hfill b_{2j}& \hfill 0\\ \hfill ⋮& \hfill ⋮& \hfill \ddots & \hfill ⋮& \hfill ⋮\\ \hfill 0& \hfill 0& \hfill \cdots & \hfill 1& \hfill 0\end{array}\right)$$

Thus, system $(\ast )$ is equivalent to

$$\begin{array}{c}\hfill {\alpha }_1+{\alpha }_2{b}_{12}+\cdots +{\alpha }_k{b}_{1k}=0\\ \hfill {\alpha }_2+\cdots +{\alpha }_k{b}_{2j}=0\\ \hfill ⋮\\ \hfill {\alpha }_k=0\end{array}$$

From the last equation, ${\alpha }_k=0$. From the penultimate equation, ${\alpha }_{k-1}+{\alpha }_k{b}_{k-1,k}=0$, which implies ${\alpha }_{k-1}=0$. Back-substitution yields ${\alpha }_k={\alpha }_{k-1}=\cdots ={\alpha }_1=0$. Thus, the rows $r_i$ of B are linearly independent over ${\mathbb{F}}_2^k$.

By Corollary 1, the rows of B form a basis for ${\mathbb{F}}_2^k$. Since B has the full rank k, it is invertible.    □

Remark 2.

To avoid a trivial permutation of the plaintext, the proposed scheme requires $B\ne B^{-1}$. This condition ensures a non-trivial algebraic transformation during IDA and IRA.

4. Theoretical Validation and Numerical Results

This section presents a concrete example to substantiate the algebraic framework established in Section 3. The example illustrates how basis selection, governed by GHWs, results in a generator matrix suitable for the Information Dispersal Algorithm (IDA). The primary objective is to confirm the theoretical consistency of our approach and elucidate the operational procedures, rather than to evaluate empirical performance. The GHWs are calculated following the method of Johnsen and Verdure [11]. For reference, the pseudocode for determining the GHWs of an $[n,k]$-binary linear code is included in Appendix A.

Example 1.

Let C be a $[10,7]$-binary linear code with generator matrix

$$G=\left(\begin{array}{cccccccccc}1& 0& 1& 1& 0& 1& 1& 0& 0& 1\\ 1& 1& 0& 0& 1& 1& 0& 1& 0& 0\\ 0& 1& 0& 0& 0& 0& 1& 0& 1& 0\\ 1& 1& 0& 1& 1& 1& 0& 1& 0& 0\\ 0& 0& 1& 1& 0& 1& 1& 0& 1& 0\\ 1& 1& 0& 0& 1& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 1& 1& 1& 1& 0\end{array}\right)$$

Using the algorithm described in Appendix A, the generalized Hamming weights of C are computed as

$$\begin{array}{c}\hfill d_1\left(C\right)=1,d_2\left(C\right)=2,d_3\left(C\right)=4,d_4\left(C\right)=5,d_5\left(C\right)=7,d_6\left(C\right)=9,d_7\left(C\right)=10.\end{array}$$

For each $i\in \left[k\right]$, we determine some of the elements of the ${\mathcal{M}}_h$ family of subsets by selecting the codewords that satisfy the defining condition of this set, namely:

$$\begin{array}{cc}\hfill \mathrm{For}i& =1,\left\{\begin{array}{c}\left(0001000000\right),\left(0100000000\right)\hfill \end{array}\right\}\subseteq {\mathcal{M}}_h\hfill \\ \hfill \mathrm{For}i& =2,\left\{\begin{array}{c}\left(0001000000\right),\left(0100000000\right),\left(0101000000\right)\hfill \\ \left(0000010100\right),\left(0010000100\right),\left(0010010000\right),\dots \hfill \end{array}\right\}\subseteq {\mathcal{M}}_h\hfill \\ \hfill \mathrm{For}i& =3,\left\{\begin{array}{c}\left(0001000000\right),\left(0101000000\right),\left(1000100000\right)\hfill \\ \left(0100000000\right),\left(0000001010\right),\left(0010000100\right),\dots \hfill \end{array}\right\}\subseteq {\mathcal{M}}_h\hfill \\ \hfill \mathrm{For}i& =4,\left\{\begin{array}{c}\left(0001000000\right),\left(0101000000\right),\left(0000010100\right)\hfill \\ \left(0100000000\right),\left(0010000100\right),\left(0000001010\right)\dots \hfill \end{array}\right\}\subseteq {\mathcal{M}}_h\hfill \\ \hfill \mathrm{For}i& =5,\left\{\begin{array}{c}\left(0001000000\right),\left(0101000000\right),\left(0000010100\right)\hfill \\ \left(0010000100\right),\left(0010000100\right),\left(1000100000\right),\dots \hfill \end{array}\right\}\subseteq {\mathcal{M}}_h\hfill \\ \hfill \mathrm{For}i& =6,\left\{\begin{array}{c}\left(0001000000\right),\left(0101000000\right),\left(0000010100\right)\hfill \\ \left(0010010000\right),\left(1000100000\right),\left(0000001010\right)\dots \hfill \end{array}\right\}\subseteq {\mathcal{M}}_h\hfill \\ \hfill \mathrm{For}i& =7,\left\{\begin{array}{c}\left(0001000000\right),\left(0101000000\right),\left(0000010100\right)\hfill \\ \left(0000101011\right),\left(0010000100\right),\left(0000001010\right)\dots \hfill \end{array}\right\}\subseteq {\mathcal{M}}_h.\hfill \end{array}$$

We consider the lexicographic graded order ≺, and using SageMath 9.3, we calculate the codewords $m^i\in C$, which are:

$$O_{\prec }=\left\{\begin{array}{c}{m}^1=\left(0001000000\right),m^2=\left(0100000000\right),m^3=\left(0000001010\right),m^4=\left(0000010100\right)\hfill \\ m^5=\left(0010000100\right),m^6=\left(1000100000\right),m^7=\left(0000101011\right)\hfill \end{array}\right\}$$

Furthermore, by the definition of ${\mathcal{M}}_h$, we see that:

$$\begin{array}{cc}\hfill d_1\left(C\right)& =\left|supp\right(〈m^1〉\left)\right|=1\hfill \\ \hfill d_2\left(C\right)& =\left|supp\right(〈m^1,m^2〉\left)\right|=2\hfill \\ \hfill & ⋮\hfill \\ \hfill d_7\left(C\right)& =\left|supp\right(〈m^1,m^2,m^3,m^4,m^5,m^6,m^7〉\left)\right|=10\hfill \end{array}$$

By Proposition 1, we see that the set $O_{\prec }$ forms a basis of the code C.

We then apply the IDA mechanism proposed by Rabin [7] to the set $O_{\prec }$ as follows:

M = “Quantum cryptography is secure” is the plain-text message. We convert the message M into ASCII code, and subsequently into its binary representation

$$\begin{array}{cc}\hfill M& =0101000101110101011000010110111001110100011101010110110100100000\hfill \\ \hfill & 0110001101110010011110010111000001110100011011110110011101110010\hfill \\ \hfill & 0110000101110000011010000111100100100000011010010111001100100000\hfill \\ \hfill & 011100110110010101100011011101010111001001100101\hfill \end{array}$$

Let $P=\left\{P_1,P_2,P_3,P_4,P_5,P_6,P_7,P_8,P_9,P_{10}\right\}$ be a set of 10 participants and ensure tolerance $n-k=3$, and $t=k=7$. We consider the matrix formed by the codewords $m^i$

$$A=\left(\begin{array}{c}{m}^1,m^2,m^3,m^4,m^5,m^6,m^7\end{array}\right)=\left(\begin{array}{ccccccc}0& 0& 0& 0& 0& 1& 0\\ 0& 1& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 1& 0& 0\\ 1& 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 1& 1\\ 0& 0& 0& 1& 1& 0& 0\\ 0& 0& 1& 0& 0& 0& 1\\ 0& 0& 0& 1& 0& 0& 0\\ 0& 0& 1& 0& 0& 0& 1\\ 0& 0& 0& 0& 0& 0& 1\end{array}\right)$$

The message M is partitioned into blocks of length 7, and each block is multiplied by A. For illustration, only the first three resulting vectors are shown:

$$D=AM=(d_1,d_2,d_3,d_4,d_5,\dots )={\left(\begin{array}{c}00011\\ 10101\\ 01110\\ 01001\\ 01010\\ 10010\dots \\ 00010\\ 11100\\ 00010\\ 01001\end{array}\right)}_{10\times \lceil \left|M\right|/7\rceil }$$

where $\lceil ·\rceil$ denotes the ceiling function, and if the length of the final block is less than 7, it is padded with zeros.

Each component of the resulting vectors is distributed among the participants. We assume that participants $P_5$, $P_6$, and $P_9$ are unavailable. Let P represent the set of participants used for reconstruction: $P=\{P_1,P_2,P_3,P_4,P_7,P_8,P_{10}\}$, satisfying $\left|P\right|=7\ge t=k$.

Applying the Information Recovery Algorithm (IRA), the components corresponding to the unavailable participants are removed from each dispersal vector, yielding the vectors $f_i$. To recover the original message, we construct a submatrix B of the dispersal matrix A by deleting the rows corresponding to the unavailable participants.

By Proposition 2, the resulting matrix $B\in {\mathbb{F}}_2^{7\times 7}$ is invertible. Its inverse, computed using SageMath, is explicitly given by

$$B^{-1}=\left(\begin{array}{ccccccc}0& 0& 0& 1& 0& 0& 0\\ 0& 1& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 1& 0& 1\\ 0& 0& 0& 0& 0& 1& 0\\ 0& 0& 1& 0& 0& 0& 0\\ 1& 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 0& 1\end{array}\right).$$

Consequently, the dispersal vectors $d_i$ are recovered by solving the linear system $BM=f_i,$ then, $M=B^{-1}{f}_i,$ so

$$B^{-1}{f}_i=\left(\begin{array}{ccccccc}0& 0& 0& 1& 0& 0& 0\\ 0& 1& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 1& 0& 1\\ 0& 0& 0& 0& 0& 1& 0\\ 0& 0& 1& 0& 0& 0& 0\\ 1& 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 0& 0& 0& 1\end{array}\right)\left(\begin{array}{c}00011\\ 10101\\ 01110\\ 01001\dots \\ 00010\\ 11100\\ 00010\end{array}\right)=\left(\begin{array}{c}01001\\ 10101\\ 01011\\ 11100\dots \\ 01110\\ 00011\\ 01001\end{array}\right)$$

where i indexes the set of message blocks. This result shows that the original message can be retrieved even if up to $n-k$ components are lost in each dispersal vector.

5. Conclusions

The contributions of this work are primarily theoretical. We have demonstrated that generalized Hamming weights (GHWs) serve as effective algebraic tools for constructing bases of binary linear codes suitable for information dispersal. These results establish sufficient algebraic conditions to guarantee the existence of generator matrices with invertible submatrices over ${\mathbb{F}}_2$, thereby enabling the application of the Information Dispersal Algorithm (IDA) and the Information Recovery Algorithm (IRA) within a strictly binary framework.

This study suggests several avenues for future research, particularly regarding computational efficiency and generalized applicability.

Question 1.

How does the efficiency of the proposed binary IDA benchmark compare against classical implementations over finite fields like $GF\left(2^8\right)$ and $GF\left(2^{16}\right)$, as discussed in [20]?

Question 2.

In which parameter regimes $(n,k)$ does the binary IDA/IRA framework offer superior performance or distinct trade-offs compared to traditional approaches over larger fields?

Furthermore, relaxing the generalized Hamming weight conditions presents a compelling direction. It is natural to inquire whether the strict constraints used here can be loosened to accommodate a wider class of binary linear codes.

Question 3.

What are the admissible ranges for $d_1\left(C\right)$ and $d_k\left(C\right)$ (with $d_1\left(C\right)>1$ and $d_k\left(C\right)\le n$) that still permit valid IDA-based dispersal and recovery?

Addressing these questions would deepen the understanding of the interplay between GHWs, algebraic structures, and information dispersal, potentially paving the way for new families of binary codes suitable for distributed storage and secure data dissemination.