Next Article in Journal
Time-Inhomogeneous Feller-Type Diffusion Process in Population Dynamics
Previous Article in Journal
High-Dimensional Mahalanobis Distances of Complex Random Vectors

Font Type:
Arial Georgia Verdana
Font Size:
Aa Aa Aa
Line Spacing:
Column Width:
Background:
Article

# Decoding Linear Codes over Chain Rings Given by Parity Check Matrices

by
José Gómez-Torrecillas
1,*,
F. J. Lobillo
2 and
Gabriel Navarro
3
1
2
3
Department of Computer Science and Artificial Intelligence and CITIC, University of Granada, E18071 Granada, Spain
*
Author to whom correspondence should be addressed.
Mathematics 2021, 9(16), 1878; https://doi.org/10.3390/math9161878
Submission received: 13 July 2021 / Revised: 4 August 2021 / Accepted: 4 August 2021 / Published: 7 August 2021

## Abstract

:
We design a decoding algorithm for linear codes over finite chain rings given by their parity check matrices. It is assumed that decoding algorithms over the residue field are known at each degree of the adic decomposition.

## 1. Introduction

One of the first applications of linear codes whose underlying alphabet is not a finite field appears in [1], where nonlinear binary codes are built from $Z 4$-linear codes by means of the Gray map. Since then, considerable research efforts have focused on linear codes having a finite ring R as their alphabet. Normally, R is assumed to enjoy suitable properties. For instance, Wood, in [2], states MacWilliams identities for finite Frobenius rings, extending the foundations of coding theory to linear codes over Frobenius rings. In [3] it is proven that finite Frobenius rings are Frobenius algebras over their characteristic subrings, which enriches the duality theory for linear codes over this kind of alphabet.
Feng et al. connect linear codes over finite chain rings to network coding in [4,5] by means of matrix channels. They provide a general description of linear codes over finite chain rings, where the $m$–adic decomposition is made with respect to any set of representatives containing the element zero.
Concerning efficient decoding algorithms, a framework for decoding linear codes over Galois rings is proposed in [6], which generalizes previous works like [7]. This decoding framework assumes that there is a chain of linear codes over the residue field which have efficient decoding algorithms. These codes are defined by their generating matrices.
In this paper we improve the decoding framework of [6] in two ways. In Appendix A we observe that the decoding scheme from [6] works, with slight modifications, over any finite chain ring and for any set of representatives containing 0 in each degree. Anyway, the efficiently decodable codes are still ordered in a chain. In Section 3 we introduce a new framework where the codes are provided by parity check matrices. This viewpoint has an advantage: the codes over the residue field which are associated to each degree in the corresponding $m$-adic decomposition do not need to be ordered in a chain. We gain thus flexibility to build them from codes over fields with good decoding algorithms. In Section 4, Smith normal form of matrices over chain rings are used to compute generating matrices from parity check ones. So a complete coding/decoding scheme is provided. We have also included the Sagemath code of the proposed framework in Appendix B.

## 2. Preliminaries

Throughout this paper, the word ring means finite commutative ring with identity. A ring is said to be a chain ring if its ideals form a chain under inclusion. Every chain ring is a local ring and, therefore, its elements admit “adic” expansions with respect to the maximal ideal. More precisely, let R be a finite local ring with maximal ideal $m$. Nakayama’s Lemma shows that the powers of $m$ form a finite chain with strict inclusions
$R ⊃ m ⊃ ⋯ ⊃ m ν − 1 ⊃ m ν = { 0 } ,$
with $m ν − 1 ≠ { 0 }$ for some positive integer $ν$ called the nilpotency index of R. If R is a chain ring, then all its ideals appear in this chain.
Given $r ∈ R$, we set
$deg ( r ) = max { i ≤ ν : r ∈ m i } ,$
the degree of r. For $i = 0 , … , ν − 1$ we consider the canonical projection maps
$π i : m i → m i / m i + 1 ,$
and we fix maps
$ϵ [ i ] : m i / m i + 1 → m i ,$
such that $π i ϵ [ i ] = id m i / m i + 1$.
Every $r ∈ R$ is expressed as
$r = r [ 0 ] + r [ 1 ] + ⋯ + r [ ν − 1 ] ,$
for uniquely determined $r [ i ] ∈ im ϵ [ i ]$, for $i = 0 , ⋯ , ν − 1$. This expression is referred to as the $( m , ϵ [ 0 ] , ⋯ , ϵ [ ν − 1 ] )$–adic expansion of r. Indeed, if r is written as in (1), then, since $π k ( r [ j ] ) = 0$ whenever $j > k$, we have
$π i ( r [ i ] ) = π i ( r − r [ 0 ] − ⋯ − r [ i − 1 ] ) ,$
for every $i = 1 , … , ν − 1$. Now, $r [ i ] ∈ im ϵ [ i ]$ implies $ϵ [ i ] π i ( r [ i ] ) = r [ i ]$, so we deduce
$r [ i ] = ϵ [ i ] π i ( r − r [ 0 ] − ⋯ − r [ i − 1 ] ) .$
From (1) we also get that $π 0 ( r ) = π 0 ( r [ 0 ] )$ and, thus,
$r [ 0 ] = ϵ [ 0 ] π 0 ( r ) .$
Equality (4), in conjunction with the recursive formula (3), shows that the elements $r [ i ]$ are uniquely determined by r.
This idea also shows how to compute, granting in this way the existence of the expression (1), the elements $r [ i ]$ from a given $r ∈ R$. In fact, $r [ 0 ]$ is computed according to (4), and the subsequent elements $r [ 1 ] , … , r [ ν − 1 ]$ are defined recursively by (3). Observe that
$r − r [ 0 ] − ⋯ − r [ i − 1 ] ∈ m i ,$
as a consequence of a recursive application of the identities $π i ϵ [ i ] = id m i / m i + 1$, (4) and (3). Finally, we may see that $m ν = { 0 }$ implies $ϵ [ ν − 1 ] π ν − 1 = i d m ν − 1$, which, by (3), gives
$r [ ν − 1 ] = ϵ [ ν − 1 ] π ν − 1 ( r − r [ 0 ] − ⋯ − r [ ν − 2 ] ) = r − r [ 0 ] − ⋯ − r [ ν − 2 ] ,$
When R is a chain ring, its maximal ideal is principal, and we may then choose $m ∈ R$ such that $m = R m$ (see e.g., Proposition 2.1 in [8] or §XVII in [9]). It follows that $m i = R m i$ for each $0 ≤ i ≤ ν − 1$.
Taking advantage of the well known fact that $m i / m i + 1$ is a vector space of dimension 1 over the residue field $F = R / m$, we obtain a bijective map
as follows. The multiplication map $R → · m i m i / m i + 1$ induces an isomorphism of R–modules
$λ i : R / m → m i / m i + 1 , ( r + m ↦ r m i + m i + 1 ) .$
In this way, for each $i = 0 , 1 , … , ν − 1$, given $ϵ i : F → R$ such that $π 0 ϵ i = id R / m$, we may define the map $ϵ [ i ] = ( · m i ) ϵ i λ i − 1$. Now, since $λ i π 0 = π i ( · m i )$, we get
$π i ϵ [ i ] = π i ( · m i ) ϵ i λ i − 1 = λ i π 0 ϵ λ i − 1 = λ i id R / m λ i − 1 = id m i / m i + 1 .$
The maps $ϵ [ i ]$ obey the rule
$ϵ [ i ] ( r m i + m i + 1 ) = ϵ i ( r + m ) m i .$
Summing up the relevant information so far obtained, we state the following proposition.
Proposition 1.
Let $F = R / m$ denote the residue field of R. Fix a generator m of $m$ and splitting maps $ϵ 0 , ϵ 1 , ⋯ , ϵ ν − 1 : F → R$ such that $π 0 ϵ i = id F$ for all $0 ≤ i ≤ ν − 1$. Then, for each $r ∈ R$, there exist uniquely determined $ρ 0 , ⋯ , ρ ν − 1 ∈ F$ such that
$r = ϵ 0 ( ρ 0 ) + ϵ 1 ( ρ 1 ) m + ⋯ + ϵ ν − 1 ( ρ ν − 1 ) m ν − 1 .$
Moreover, if $ϵ i ( 0 ) = 0$ for each $0 ≤ i ≤ ν − 1$, then $r ∈ m i$ if and only if $ρ 0 = ⋯ = ρ i − 1 = 0$.
Proof.
Define the maps $ϵ [ i ]$ according to (5). For each $i = 0 , ⋯ , ν − 1$ set, in the unique decomposition (1), $r [ i ] = ϵ i ( ρ i ) m i$ for suitable $ρ i ∈ F$. Indeed, from this last equality we see that $π i ( r [ i ] ) = λ i ( ρ i )$, which proves that $ρ i$ is uniquely determined by $r [ i ]$. We thus obtain the expansion (6).
Now, from (2) we derive
$ρ i = λ i − 1 ( r − ϵ 0 ( ρ 0 ) − ϵ 1 ( ρ 1 ) m − ⋯ − ϵ i − 1 ( ρ i − 1 ) m i − 1 + m i + 1 ) ,$
with $ρ 0 = ϵ 0 ( r + m )$. Using recursively (7), we prove that, when $ϵ i ( 0 ) = 0$, $r ∈ m i$ if and only if $ρ 0 = ⋯ = ρ i − 1 = 0$.    □
Remark 1.
The coefficients $ρ i$ can be computed recursively from (7).
The decomposition (6) depends on $ϵ 0 , ϵ 1 , ⋯ , ϵ ν − 1$ and m. We call it the $( m , ϵ 0 , ϵ 1 , ⋯ , ϵ ν − 1 )$-adic decomposition of r, or m-adic decomposition, when no ambiguity is expected. If $ϵ = ϵ 0 = ϵ 1 = ⋯ = ϵ ν − 1$ and $ϵ ( 0 ) = 0$, this decomposition coincides with that of Equation (2) in [4], since $ϵ$ gives a choice of residuals modulo m.
Definition 1.
A tuple $( m , ϵ 0 , ⋯ , ϵ ν − 1 )$ such that $m = R m$ is called a splitting structure for R if, for each $0 ≤ i ≤ ν − 1$, $ϵ i : F → R$ satisfies $π 0 ϵ i = id F$ and $ϵ i ( 0 ) = 0$,
Remark 2.
Let $( m , ϵ 0 , ⋯ , ϵ ν − 1 )$ be a splitting structure for R. Assume $r = u m i$ for some $u ∈ R$ and let (6) be its m-adic decomposition. Then, by (7) and Proposition 1,
$ρ i = λ i − 1 ( r + m i + 1 ) = λ i − 1 ( u m i + m i + 1 ) = u + m = π 0 ( u ) .$
Hence, $ρ i$ does not depend on the splitting structure.
The m–adic expansion (6) is extended to matrices in a straightforward way. Let $A s × t$ denote the set of all matrices of size $s × t$ with coefficients in a commutative ring A, which is a free A–module. We may extend any map $ϵ : F → R$ component-wise to a map $ϵ : F s × t → R s × t$. Then, every matrix $L ∈ R s × t$ has an m–adic expansion
$L = ϵ 0 ( Λ 0 ) + ϵ 1 ( Λ 1 ) m + ⋯ + ϵ ν − 1 ( Λ ν − 1 ) m ν − 1 ,$
for uniquely determined matrices $Λ i ∈ F s × t$.
Although the splitting maps are not additive neither multiplicative, they obey some relations which will be used. Concretely, let $ρ , σ ∈ F$ and $ϵ i , ϵ j , ϵ k : F → R$ splittings. Since $π 0 : R → F$ is a ring morphism, it follows that
$π 0 ( ϵ i ( ρ + σ ) − ϵ j ( ρ ) − ϵ k ( σ ) ) = ( ρ + σ ) − ρ − σ = 0$
and
$π 0 ( ϵ i ( ρ σ ) − ϵ j ( ρ ) ϵ k ( σ ) ) = ( ρ σ ) − ρ σ = 0 ,$
hence
$ϵ i ( ρ + σ ) − ϵ j ( ρ ) − ϵ k ( σ ) ∈ m , ϵ i ( ρ σ ) − ϵ j ( ρ ) ϵ k ( σ ) ∈ m .$
The structure of the finite chain rings is well known, see (XVII.5) Theorem in [9]. We will not use this description in full generality, so we only recall the rings that appear in our examples.
Example 1.
Recall that a Galois ring $G R ( p α , β )$ is an extension of degree β of $Z / Z p α$, i.e., $G R ( p α , β ) ≅ ( Z / Z p α ) [ x ] / 〈 f 〉$, where f is a basic monic irreducible polynomial in $( Z / Z p α ) [ x ]$ of degree β. Its maximal ideal is generated by the prime p. The nilpotency index of p is α, and $F ≅ ( Z / Z p ) [ x ] / 〈 f ¯ 〉$, where $f ¯$ is the canonical projection of f to $( Z / Z p ) [ x ]$. In particular, $Z / Z p α = G R ( p α , 1 )$ is a chain ring. On the other side, $G F ( p β ) = G R ( p , β )$ is a field, so it is trivially a chain ring.
Example 2.
The ring $F p α [ x ] / 〈 x β 〉$, where $F p α$ is the field with $p α$ elements, is also a chain ring. The maximal ideal is generated by x, and it has nilpotency index β. Of course $F ≅ F p α$.
In the rest of the paper, $C$ is an R–linear code of length n. Vectors are represented by boldface letters, whilst matrices with uppercase letters. We use Latin alphabet to represent elements in R and greek alphabet to represent elements of F. Moreover, given a matrix M over R with n rows, we denote
$im ( M ) = { x M | x ∈ R n } and ker ( M ) = { x ∈ R n | x M = 0 } .$
The same applies to matrices over the residue field F.
Remark 3.
By an abuse of language, for $v = ( v 0 , ⋯ , v n − 1 ) ∈ R n$, we say that $v ∈ m i$ if $v j ∈ m i$ for all $0 ≤ j ≤ n − 1$. The same convention applies to matrices.

## 3. Decoding via Parity Check

Let us fix a chain ring R with maximal ideal $m$ and nilpotency index $ν$, i.e., $m ν = { 0 }$ and $m ν − 1 ≠ { 0 }$. We also fix a splitting structure $( m , ϵ 0 , ⋯ , ϵ ν − 1 )$ for R. There are two standard ways to present an R–linear code $C$, as the image $C = im ( G )$ of a generating matrix G or as the kernel $C = ker ( H )$ of a parity check matrix H. In the first case, by §IV in [5], we do not lose generality if we assume $C = im ( G )$, where
and, for each $0 ≤ i ≤ ν − 1$, $G ( i )$ is a $k i × n$ matrix whose m-adic decomposition is
$G ( i ) = ϵ i ( Γ i ( i ) ) m i + ϵ i + 1 ( Γ i + 1 ( i ) ) m i + 1 + ⋯ + ϵ ν − 1 ( Γ ν − 1 ( i ) ) m ν − 1 ,$
with matrices $Γ j ( i )$ whose entries are in F, and $Γ i ( i )$ is full rank.
The decoding framework introduced in [6] and expounded in Appendix A uses this presentation of codes as images. It needs a chain of linear codes over the residue field F
with efficient decoding algorithms. There are several ways to get it. For instance, even with classical linear codes, if we want to use BCH (Bose-Chaudhuri-Hocquenghem) codes, we shall use a decreasing chain of defining sets to build the chain of codes. Goppa codes can also be used but taking as the Goppa polynomial of one code in the chain a divisor of the Goppa polynomial of the previous code. Anyway, this is a limitation of the possible codes we can use at each degree.
We are interested in the second presentation, so let $C$ be an R-linear code given by a parity check matrix $H ∈ R n × q$, i.e.,
In this section, we develop a new decoding framework based on syndrome decoding for each degree, i.e., we use the parity check matrices and the syndromes of the received words to decode. This strategy allows one to choose independently the linear codes over the residue field at each degree.
By §II.D in [4], we can replace H by its column reduced canonical form, so we do not lose generality if we assume
$H = H ( 0 ) H ( 1 ) ⋯ H ( ν − 1 ) , where H ( i ) = ∑ j = i ν − 1 ϵ j ( Θ j ( i ) ) m j$
for suitable matrices $Θ j ( i ) ∈ F n × q i$ such that the matrices $Θ i ( i )$ are full rank.
As usual, let $y = c + e$, where $c ∈ C$ and $e$ is the error vector. The syndrome is
$s = y H = e H ,$
and we denote
$s ( i ) = y H ( i ) = e H ( i ) , 0 ≤ i ≤ ν − 1 .$
Our decoding framework computes $e$ from H and $s$ by means of an iterative process. Let us introduce notation for the corresponding m-adic expansions:
$e = ∑ l = 0 ν − 1 ϵ l ( ξ l ) m l , s ( i ) = ∑ j = i ν − 1 ϵ j ( σ j ( i ) ) m j , 0 ≤ i ≤ ν − 1 .$
We have taken into account that $s ( i ) ∈ m i$. Observe that, for each $0 ≤ i ≤ ν − 1$,
$e H ( i ) = ∑ l 0 = 0 ν − 1 ϵ l 0 ( ξ l 0 ) m l 0 ∑ j 0 = i ν − 1 ϵ j 0 ( Θ j 0 ( i ) ) m j 0 = ∑ j 0 = i ν − 1 ∑ l 0 = 0 ν − 1 ϵ l 0 ( ξ l 0 ) ϵ j 0 ( Θ j 0 ( i ) ) m j 0 + l 0 = ∑ j = i ν − 1 ∑ l = 0 j − i ϵ l ( ξ l ) ϵ j − l ( Θ j − l ( i ) ) m j ,$
where we use that $m ν = 0$ and we performed the change of variable $j = j 0 + l 0$. Hence,
$∑ j = i ν − 1 ϵ j ( σ j ( i ) ) m j = ∑ j = i ν − 1 ∑ l = 0 j − i ϵ l ( ξ l ) ϵ j − l ( Θ j − l ( i ) ) m j$
for each $0 ≤ i ≤ ν − 1$. The right hand side of (12) needs not to be an m-adic decomposition, so we cannot infer from (12) any equality of the corresponding coefficients of each $m j$.
Let us describe the iterative decoding framework.

#### 3.1. First Step: Computing $ξ 0$

Equation (12), when $i = ν − 1$, gives
$ϵ ν − 1 ( σ ν − 1 ( ν − 1 ) ) m ν − 1 = ϵ 0 ( ξ 0 ) ϵ ν − 1 ( Θ ν − 1 ( ν − 1 ) ) m ν − 1 .$
By (8),
$ϵ 0 ( ξ 0 ) ϵ ν − 1 ( Θ ν − 1 ( ν − 1 ) ) − ϵ ν − 1 ( ξ 0 Θ ν − 1 ( ν − 1 ) ) ∈ m ,$
hence
$ϵ 0 ( ξ 0 ) ϵ ν − 1 ( Θ ν − 1 ( ν − 1 ) ) m ν − 1 = ϵ ν − 1 ( ξ 0 Θ ν − 1 ( ν − 1 ) ) m ν − 1 .$
By Proposition 1,
$σ ν − 1 ( ν − 1 ) = ξ 0 Θ ν − 1 ( ν − 1 ) .$
Proposition 2.
Let $d ν − 1$ be a decoding algorithm for the linear code $ker ( Θ ν − 1 ( ν − 1 ) )$. If the weight of $ξ 0$ is below the correction capability of $d ν − 1$, then $ξ 0 = d ν − 1 ( σ ν − 1 ( ν − 1 ) )$.
Proof.
Just observe that $ξ 0$ is the only one solution of (13) whose weight is below the correction capability of $ker ( Θ ν − 1 ( ν − 1 ) )$.    □

#### 3.2. Second Step: Computing $ξ 1$

We include this second step to help the reader to follow the framework. At this step, $ξ 0$ is known. If we put $i = ν − 2$ in (12), we have
$ϵ ν − 2 ( σ ν − 2 ( ν − 2 ) ) m ν − 2 + ϵ ν − 1 ( σ ν − 1 ( ν − 2 ) ) m ν − 1 = ϵ 0 ( ξ 0 ) ϵ ν − 2 ( Θ ν − 2 ( ν − 2 ) ) m ν − 2 + ϵ 0 ( ξ 0 ) ϵ ν − 1 ( Θ ν − 1 ( ν − 2 ) ) m ν − 1 + ϵ 1 ( ξ 1 ) ϵ ν − 2 ( Θ ν − 2 ( ν − 2 ) ) m ν − 1 .$
Since the vector $ξ 0$ is assumed to be known, the element
$ϵ ν − 2 ( σ ν − 2 ( ν − 2 ) ) m ν − 2 + ϵ ν − 1 ( σ ν − 1 ( ν − 2 ) ) m ν − 1 − ϵ 0 ( ξ 0 ) ϵ ν − 2 ( Θ ν − 2 ( ν − 2 ) ) m ν − 2 − ϵ 0 ( ξ 0 ) ϵ ν − 1 ( Θ ν − 1 ( ν − 2 ) ) m ν − 1 ∈ m ν − 1$
can be computed. Hence, by Proposition 1, there exists $δ ∈ F n$ such that
$ϵ ν − 2 ( σ ν − 2 ( ν − 2 ) ) m ν − 2 + ϵ ν − 1 ( σ ν − 1 ( ν − 2 ) ) m ν − 1 − ϵ 0 ( ξ 0 ) ϵ ν − 2 ( Θ ν − 2 ( ν − 2 ) ) m ν − 2 − ϵ 0 ( ξ 0 ) ϵ ν − 1 ( Θ ν − 1 ( ν − 2 ) ) m ν − 1 = ϵ ν − 1 ( δ ) m ν − 1 ,$
which can be computed since all elements appearing in its definition are known. Equations (14) and (15) imply
$ϵ ν − 1 ( δ ) m ν − 1 = ϵ 1 ( ξ 1 ) ϵ ν − 2 ( Θ ν − 2 ( ν − 2 ) ) m ν − 1 .$
By (8),
$ϵ 1 ( ξ 1 ) ϵ ν − 2 ( Θ ν − 2 ( ν − 2 ) ) − ϵ ν − 1 ( ξ 1 Θ ν − 2 ( ν − 2 ) ) ∈ m ,$
hence
$ϵ 1 ( ξ 1 ) ϵ ν − 2 ( Θ ν − 2 ( ν − 2 ) ) m ν − 1 = ϵ ν − 1 ( ξ 1 Θ ν − 2 ( ν − 2 ) ) m ν − 1 .$
By Proposition 1, it follows that
$δ = ξ 1 Θ ν − 2 ( ν − 2 ) .$
Proposition 3.
Let $d ν − 2$ be a decoding algorithm for the linear code $ker ( Θ ν − 2 ( ν − 2 ) )$. If the weight of $ξ 1$ is below the correction capability of $d ν − 2$, then $ξ 1 = d ν − 2 ( δ )$.
Proof.
Same proof that Proposition 2, $ξ 1$ is the only one solution of (16) whose weight is below the correction capability of $ker ( Θ ν − 2 ( ν − 2 ) )$.    □

#### 3.3. General Step: Computing $ξ l$

We assume that $ξ 0 , ⋯ , ξ l − 1$ have been computed. Proceeding as in the previous cases, Equation (12) for $i = ν − 1 − l$ provides
$∑ j = ν − 1 − l ν − 1 ϵ j ( σ j ( ν − 1 − l ) ) m j = ∑ j = ν − 1 − l ν − 1 ∑ i = 0 j − ν + 1 + l ϵ i ( ξ i ) ϵ j − i ( Θ j − i ( ν − 1 − l ) ) m j = ∑ j = ν − 1 − l ν − 2 ∑ i = 0 j − ν + 1 + l ϵ i ( ξ i ) ϵ j − i ( Θ j − i ( ν − 1 − l ) ) m j + ∑ i = 0 l ϵ i ( ξ i ) ϵ ν − 1 − i ( Θ ν − 1 − i ( ν − 1 − l ) ) m ν − 1 = ∑ j = ν − 1 − l ν − 2 ∑ i = 0 j − ν + 1 + l ϵ i ( ξ i ) ϵ j − i ( Θ j − i ( ν − 1 − l ) ) m j + ∑ i = 0 l − 1 ϵ i ( ξ i ) ϵ ν − 1 − i ( Θ ν − 1 − i ( ν − 1 − l ) ) m ν − 1 + ϵ l ( ξ l ) ϵ ν − 1 − l ( Θ ν − 1 − l ( ν − 1 − l ) ) m ν − 1 .$
By Proposition 1, there exists $δ ∈ F n$ such that
$∑ j = ν − 1 − l ν − 1 ϵ j ( σ j ( ν − 1 − i ) ) m j − ∑ j = ν − 1 − l ν − 2 ∑ i = 0 j − ν + 1 + l ϵ i ( ξ i ) ϵ j − i ( Θ j − i ( ν − 1 − l ) ) m j − ∑ i = 0 l − 1 ϵ i ( ξ i ) ϵ ν − 1 − i ( Θ ν − 1 − i ( ν − 1 − l ) ) m ν − 1 = ϵ ν − 1 ( δ ) m ν − 1 ∈ m ν − 1 .$
The left hand side of the equality in (18) is known because $i < l$ in all summands. So vector $δ$ can be computed. By (8),
$ϵ l ( ξ l ) ϵ ν − 1 − l ( Θ ν − 1 − l ( ν − 1 − l ) ) − ϵ ν − 1 ( ξ l Θ ν − 1 − l ( ν − 1 − l ) ) ∈ m ,$
hence
$ϵ l ( ξ l ) ϵ ν − 1 − l ( Θ ν − 1 − l ( ν − 1 − l ) ) m ν − 1 = ϵ ν − 1 ( ξ l Θ ν − 1 − l ( ν − 1 − l ) ) m ν − 1 .$
Therefore, Equations (17)–(19) imply
$ϵ ν − 1 ( δ ) m ν − 1 = ϵ ν − 1 ( ξ l Θ ν − 1 − l ( ν − 1 − l ) ) m ν − 1 .$
It follows, by Proposition 1 again, that
$δ = ξ l Θ ν − 1 − l ( ν − 1 − l ) .$
Proposition 4.
Let $d ν − 1 − l$ be a decoding algorithm for the linear code $ker ( Θ ν − 1 − l ( ν − 1 − l ) )$. If the weight of $ξ l$ is below the correction capability of $d ν − 1 − l$, then $ξ l = d ν − 1 − l ( δ )$.
Proof.
As we observed before in Propositions 2 and 3, $ξ l$ is the unique solution of (20) whose weight is below the correction capability of $ker ( Θ ν − 1 − l ( ν − 1 − l ) )$.    □
The decoding framework is summarized in Algorithm 1.
 Algorithm 1: Syndrome decoding. ParametersH given as in (11), and decoding algorithms $d 0 , d 1 , ⋯ , d ν − 1$  Input$s = ( s ( 0 ) , s ( 1 ) , ⋯ , s ( ν − 1 ) ) ∈ R q$  OutputThe error vector $e = ∑ l = 0 ν − 1 ϵ l ( ξ l ) m l$.  Assumption  For each $0 ≤ l ≤ ν − 1$, the Hamming weight of $ξ l$ is below the correction capability of $d l$.   1:For each $0 ≤ i ≤ ν − 1$, compute the m-adic expansion of $s ( i )$ in (10)   2:for$0 ≤ l ≤ ν − 1$do   3:Compute $δ$ from (18)   4:$ξ l = d l ( δ )$   5:end for   6:return$∑ l = 0 ν − 1 ϵ l ( ξ l ) m l$.
Theorem 1.
Let $y ∈ R n$ and $s ( i ) = y H ( i )$ for each $0 ≤ i ≤ ν − 1$. If there exists $e = ∑ l = 0 ν − 1 ϵ l ( ξ l ) m l ∈ R n$ such that $( y − e ) H = 0$ and the weight of $ξ l$ is below the correction capability of $d l$ for each $0 ≤ l ≤ ν − 1$, then Algorithm 1 correctly computes it.
Proof.
Follows directly from Propositions 2–4.    □
Example 3.
In order to explain how this decoding framework works, we are going to develop a step by step example. Let $R = G R ( 4 , 2 )$, so $F = F 4 = F 2 [ a ] / 〈 a 2 + a + 1 〉$. Let $C = ker ( H )$, where
The splitting structure is $( 2 , ϵ 0 , ϵ 1 )$, where
 0 1 a $a + 1$ $ϵ 0$ 0 $2 a + 1$ $3 a + 2$ $a + 3$ $ϵ 1$ 0 3 $3 a$ $3 a + 1$
According to this splitting structure, we have
and
Observe that $Θ 0 ( 0 )$ and $Θ 1 ( 1 )$ are the parity check matrices of a Hamming code of length 5 and dimension 3, which corrects one single error. It can be checked that
Although the error vector
has Hamming weight 2, its $( 2 , ϵ 0 , ϵ 1 )$-adic decomposition is
so our framework should be able to decode the received word
The syndrome of the received word is
whose $( 2 , ϵ 0 , ϵ 1 )$-decompositions are
Algorithm 1 can now be applied. In the first round, $i = 0$, we have , which is a times the fourth row of $Θ 1 ( 1 )$. So .
In the second round, $i = 1$, we need to compute the $( 2 , ϵ 0 , ϵ 1 )$-adic decomposition of
which is
So, , the first row of $Θ 0 ( 0 )$ multiplied by $a + 1$. Therefore, . It follows
as expected.
Unlike the former case, if we make use of a different splitting structure to decode, the framework could not work. For instance, consider the splitting structure $( 2 , ϵ 0 ′ , ϵ 1 ′ )$, where
 0 1 a $a + 1$ $ϵ 0 ′$ 0 $2 a + 3$ $3 a$ $a + 1$ $ϵ 1 ′$ 0 $2 a + 1$ $a + 2$ $3 a + 1$
The $( 2 , ϵ 0 ′ , ϵ 1 ′ )$-decomposition of the error vector is
which provides a vector of Hamming weight 2 in degree 1, so Algorithm 1 does not apply.
Remark 4.
Our parity check decoding framework could be used to design a McEliece like cryptosystem following the proposal in [10]. However, by Remark 2, given H as in (9), the matrices $Θ 0 ( 0 ) , ⋯ , Θ ν − 1 ( ν − 1 )$ do not depend on the splitting structure, so an eavesdropper could use any structure to compute the parity check matrices of the linear codes over F. Therefore, the security of this possible cryptosystem would be equivalent to ν consecutive linear codes over the residue field F.
Remark 5.
The time complexity of Algorithm 1 is bounded by the theoretical efficiency of the chosen decoding algorithms $d 0 , … , d ν − 1$ (Line 4), and the intermediate calculations are described in Lines 1 and 3. Indeed, with respect to the number of elementary operations (additions, multiplications, and map images) over the residue field, let us assume that $d i$ belongs to $O ( f i )$ for $i = 0 , … , ν − 1$ with respect to the length of the code. Moreover, for simplicity, assume that $f i ∈ O ( f )$ for all i.
According to (7), an m-adic expansion can be computed by $2 ν$ operations, so that Line 1 belongs to $O ( ν 2 )$. Now, the calculation of δ in Line 4 is obtained by solving a linear system over the residue field F. This can be computed by Gaussian elimination, which can be done in $O ( t ω )$, where ω is the matrix multiplication exponent and t is the dimension of the matrix. We may consider the classical algorithm and set $ω = 3$, so that Line 3 in each iteration of the loop belongs to $O ( n 3 + f ( n ) )$, where n is the length of the code. Thus Algorithm 1 can be executed in $O ( ν 2 + ν n 3 + ν f ( n ) )$. In general, since $ν ≪ n$, we may say that the complexity belongs to $O ( max ( n 3 , f ( n ) ) )$.

## 4. Parity Check and Encoders

There are known interesting applications of linear codes over finite chain rings as those mentioned in [4,5]. So, even though the decoding framework is based on the syndrome decoding by means of parity check matrices, it is needed to provide an encoding process. So we need to build a generating matrix from the parity check matrix H which defines our code. This task may be performed by using the Smith normal form. Recall that a $k × n$ matrix M over an arbitrary ring has a Smith normal form if there exist invertible $k × k$ and $n × n$ matrices $P , Q$ and a diagonal (non necessarily square) matrix D, where $d 1 , ⋯ , d min ( k , n )$ are the elements in the main diagonal, such that $P M Q = D$ and $d i ∣ d i + 1$.
Any matrix over a commutative principal ideal ring has a Smith normal form (Chapter 15 in [11]). In the particular case of a chain ring, Algorithm 2 gives a way to compute this normal form which simplifies the general procedure in [11].
We may assume $k ≤ n$, otherwise we can compute it for its transpose $M T$, and if $P M T Q = D$ we have $Q T M P T = D T$.
 Algorithm 2: Smith normal form for finite chain rings. InputA matrix $M ∈ R k × n$ over a finite chain ring R with nilpotency index $ν$, such that $k ≤ n$.  Output$D , P , Q$ such that D is a Smith normal form, P and Q are invertible, and $D = P M Q$.   1:if$k = 1$then   2:  $Q ← I n × n$.   3:  Find $m 1 , j$ of lowest degree in M.   4:  Swap columns 1 and j in M and Q   5:  for $2 ≤ j ≤ n$ do   6:   Compute $t ∈ R$ such that $m 1 , j = t m 1 , 1$   7:   In M and Q, replace column j with column j minus t times column 1.   8:  end for   9:  return $D = ( m 1 , 1 , 0 , ⋯ , 0 )$, $P = 1$, Q.   10:else   11:  $S , T ← I k × k , I n × n$   12:  Find $m i , j$ of lowest degree in M   13:  Swap row 1 and row i in M and S   14:  Swap column 1 and column j in M and T   15:  for $2 ≤ i ≤ k$ do   16:   Compute $t ∈ R$ such that $m i , 1 = t m 1 , 1$   17:   In M and S, replace row i with row i minus t times row 1.   18:  end for   19:  for $2 ≤ j ≤ n$ do   20:   Compute $t ∈ R$ such that $m 1 , j = t m 1 , 1$   21:   In M and T, replace column j with column j minus t times column 1.   22:  end for   23:  Set $M ′ ∈ R ( k − 1 ) × ( n − 1 )$ the matrix obtained from M deleting its first row and column.   24:  Apply Algorithm 2 to $M ′$ and compute $D ′ , P ′ , Q ′$ such that $D ′$ is a Smith normal form for $M ′$ and $D ′ = P ′ M ′ Q ′$.   25:  return $m 1 , 1 D ′$, $1 P ′ S$ and $T 1 Q ′$   26:end if
Remark 6.
Observe that, once a generator m has been fixed for the maximal ideal $m$ of R, it is easy to check that $deg ( r ) = d$ if and only if $r = u m d$ where $u ∈ R \ m$, the set of units of R. Therefore, $deg ( r ) = d$ and $m d = R r$ are equivalent conditions on r. Since $deg ( r ) ≤ deg ( s )$ implies $s ∈ m deg ( r )$, we get
$deg ( r ) ≤ deg ( s ) if and only if s = t r for some t ∈ R .$
Since $deg ( r + s ) , deg ( r s ) ≥ min { deg ( r ) , deg ( s ) }$ for all $r , s ∈ R$, once $m 1 , 1$ is an element of lowest degree, any operation involving sums and products cannot decrease the degree, so, by (21), we can compute $t ∈ R$ in lines 6, 16 and 20, and all entries of $M ′$ have degree greater or equal than the degree of $m 1 , 1$. Since S and T are built to obtain
it follows
so the output of Algorithm 2 is correct.
Once the Smith normal form of the parity check matrix has been found, we may compute a generating matrix. Indeed, assume $H ∈ R n × q$ and let $D , P , Q$ matrices such that D is a Smith normal form for H and $D = P H Q$. Since Q is invertible, it follows that $c ∈ ker ( H )$ if and only if $c ∈ ker ( H Q )$. Moreover, $x ∈ ker ( D )$ if and only if $x P ∈ ker ( H Q )$, so, if $ker ( D ) = im ( E )$ we get $ker ( H ) = im ( E P )$. Now, recall D is diagonal with $d 1 ∣ d 2 ∣ ⋯ ∣ d min { n , q }$ which, by (21), is equivalent to say that $deg ( d 1 ) ≤ deg ( d 2 ) ≤ ⋯ ≤ deg ( d min { n , q } ) .$ It follows that E can be taken as an $n × n$ diagonal matrix whose diagonal elements are ${ m ν − deg ( d 1 ) , m ν − deg ( d 2 ) , ⋯ , m ν − deg ( d min { n , q } ) , 1 , ⋯ , 1 }$. We may summarize these ideas in Algorithm 3.
 Algorithm 3: Generating matrix computation from a parity check matrix. InputA parity check matrix $H ∈ R n × q$.  OutputA matrix G such that $ker ( H ) = im ( G )$.   1:Compute $D , P , Q$ by means of Algorithm 2 applied to H.   2:Compute E as the $n × n$ diagonal matrix with elements $m ν − deg ( d 1 ) , m ν − deg ( d 2 ) , ⋯ , m ν − deg ( d min { n , q } ) , 1 , ⋯ , 1$ in its main diagonal.   3:return$E P$.

## Author Contributions

All authors equally contributed to every aspect of this work. All authors have read and agreed to the published version of the manuscript.

## Funding

This research was funded by AEI (https://doi.org/10.13039/501100011033 (accessed on 6 August 2021)), grant number PID2019-110525GB-I00.

Not applicable.

Not applicable.

Not applicable.

## Conflicts of Interest

The authors declare no conflict of interest.

## Appendix A. Decoding via Encoders

In this appendix we show that the decoding framework for linear codes over Galois rings presented in [6] is still valid for the broader class of chain rings. In addition, we amend a subtle gap in [6].
A splitting structure $( m , ϵ 0 , ⋯ , ϵ ν − 1 )$ is fixed for a chain ring R with maximal ideal $m$ and nilpotency index $ν$. As we pointed out in Section 3, we may assume $C = im ( G )$, where
and, for each $0 ≤ i ≤ ν − 1$, $G ( i )$ is a $k i × n$ matrix whose m-adic decomposition is
$G ( i ) = ϵ i ( Γ i ( i ) ) m i + ϵ i + 1 ( Γ i + 1 ( i ) ) m i + 1 + ⋯ + ϵ ν − 1 ( Γ ν − 1 ( i ) ) m ν − 1 ,$
with matrices $Γ j ( i )$ whose entries are in F, and $Γ i ( i )$ is full rank.
Information is presented as vectors
where the m-adic expansion of $u ( i )$ is
$u ( i ) = ϵ 0 ( υ 0 ( i ) ) + ϵ 1 ( υ 1 ( i ) ) m + ⋯ + ϵ ν − 1 − i ( υ ν − 1 − i ( i ) ) m ν − 1 − i$
with $υ j ( i ) ∈ F k i$. Observe that $υ j ( i ) = 0 , if ν − 1 − i < j .$ The reason for this restriction is that terms of higher degree are annihilated in the encoding process. Indeed, let $c = u G$. Then
This is not necessarily the m-adic decomposition of $c$, since we do not know if the coefficients of each $m l$ belong to $im ( ϵ l )$. Actually, this is the inaccuracy in Equation (11) in [6]. However, we may fix this issue, since the knowledge of $υ j ( i )$, for $0 ≤ i ≤ ν − 1$ and $0 ≤ j ≤ ν − 1 − i$, allows one to recover the codeword.
Let $y = c + e$ with m-adic expansions
$c = ∑ l = 0 ν − 1 ϵ l ( ζ l ) m l , y = ∑ l = 0 ν − 1 ϵ l ( γ l ) m l , e = ∑ l = 0 ν − 1 ϵ l ( ξ l ) m l .$
For each $0 ≤ l ≤ ν − 1$ it follows that
$∑ i = 0 l ϵ i ( γ i ) m i − ∑ i = 0 l ϵ i ( ξ i ) m i − ∑ i = 0 l ϵ i ( ζ i ) m i ∈ m l + 1$
and, by (A1),
Hence, for each $0 ≤ l ≤ ν − 1$,
We use (A2) to describe the decoding framework. We start by computing $ξ 0$ and $υ 0 ( 0 )$. Let $C ( 0 ) = im ( Γ 0 ( 0 ) )$. By (A2) with $l = 0$,
$ϵ 0 ( γ 0 ) − ϵ 0 ( ξ 0 ) − ϵ 0 ( υ 0 ( 0 ) ) ϵ 0 ( Γ 0 ( 0 ) ) ∈ m .$
By (8),
$ϵ 0 ( γ 0 − ξ 0 − υ 0 ( 0 ) Γ 0 ( 0 ) ) − ϵ 0 ( γ 0 ) + ϵ 0 ( ξ 0 ) + ϵ 0 ( υ 0 ( 0 ) Γ 0 ( 0 ) ) ∈ m .$
These last two equations imply that
$ϵ 0 ( γ 0 − ξ 0 − υ 0 ( 0 ) Γ 0 ( 0 ) ) ∈ m ,$
i.e.,
$γ 0 − ξ 0 − υ 0 ( 0 ) Γ 0 ( 0 ) = 0 .$
Observe that $υ 0 ( 0 ) Γ 0 ( 0 )$ is a codeword in $C ( 0 )$ and $γ 0$ is a received word with error $ξ 0$. If we can decode $γ 0$, then we can compute $ξ 0$ and $υ 0 ( 0 )$. It follows from (8) that $ζ 0 = γ 0 − ξ 0 = υ 0 ( 0 ) Γ 0 ( 0 ) .$
For the general recursive step, assume that $ξ i$ for $0 ≤ i ≤ l − 1$ and for $0 ≤ j ≤ l − 1$ are known. Let us describe how to compute $ξ l$ and . Equation (A2) implies
Equation (A2) also implies
so, by Proposition 1, there exists $δ l ∈ F n$ such that
Combining (A3) and (A4), we get
Equation (8) implies
Equations (A5) and (A6) imply
so, by Proposition 1,
which is an equation in F. Let . We decode the known word to compute $ξ l$ and .

## Appendix B. SageMath Code

Here we provide the SageMath [12] code we have implemented to check our algorithms and to produce examples. We have tested our implementation on the Galois rings $R = G R ( 4 , 3 ) , G R ( 2 , 5 ) , G R ( 3 , 3 )$ (see Example 1). As far as we have checked, code inside the boxes can be cut and pasted from a PDF file opened with Adobe Acrobat Reader in a Sagemath notebook running under Jupyter. The character ␣ represents a white space. Although the code inside the boxes is uglier using this character, it is needed to obtain the correct indentation when pasting the code into Jupyter.
• p,nu,r␣=␣2,3,2
• #p,nu,r␣=␣2,5,1
• #p,nu,r␣=␣3,3,1
• if␣r␣==␣1:
• ␣␣␣␣F␣=␣GF(p)
• ␣␣␣␣R␣=␣IntegerModRing(p^nu)
• else:
• ␣␣␣␣F.<a>␣=␣GF(p^r)
• ␣␣␣␣R.<a>␣=␣IntegerModRing(p^nu).extension(F.modulus())
The splitting structure is introduced as a list of lists, each one having the images of the elements of the residue field F. The last element is a generator for the maximal ideal.
• #␣p,nu,r␣=␣2,3,2
• splitting_structure␣=␣[[R(0),R(5*a+4),R(3*a+7),R(4*a+3)],
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣[R(0),R(3*a+6),R(1*a+5),R(2*a+7)],
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣[R(0),R(5*a+6),R(5*a+1),R(6*a+1)]]␣+␣[p]
• #␣p,nu,r␣=␣2,5,1
• #splitting_structure␣=␣[[R(0),R(7)],
• #␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣[R(0),R(5)],
• #␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣[R(0),R(3)],
• #␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣[R(0),R(1)],
• #␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣[R(0),R(3)]]␣+␣[p]
• #␣p,nu,r␣=␣3,3,1
• #splitting_structure␣=␣[[R(0),R(7),R(8)],
• #␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣[R(0),R(25),R(17)],
• #␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣[R(0),R(19),R(11)]]␣+␣[p]
• mm␣=␣splitting_structure[nu]
The canonical projection $π : R → F$, splitting maps, m-adic expansion, and its inverse are defined as follows.
• def␣proj(rr):
• ␣␣␣␣if␣r␣==␣1:
• ␣␣␣␣␣␣␣␣return(F(rr))
• ␣␣␣␣else:
• ␣␣␣␣␣␣␣␣return␣F(rr.list())
•
• def␣splitting(ff,splitting_list␣=␣[R(ele)␣for␣ele␣in␣F.list()]):
• ␣␣␣␣if␣ff.parent()␣==␣F:
• ␣␣␣␣␣␣␣␣if␣(len(splitting_list)␣!=
• ␣␣␣␣␣␣␣␣␣␣␣␣F.cardinality())␣or␣([proj(r_)
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣for␣r_␣in␣splitting_list]␣!=
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣F.list()):
• ␣␣␣␣␣␣␣␣␣␣␣␣return␣’Incorrect␣splitting’
• ␣␣␣␣␣␣␣␣return␣splitting_list[F.list().index(ff)]
• ␣␣␣␣elif␣isinstance(ff,sage.modules.free_module_element.FreeModuleElement):
• ␣␣␣␣␣␣␣␣ff_␣=␣ff.list()
• ␣␣␣␣␣␣␣␣aux␣=␣[splitting(ele,␣splitting_list)␣for␣ele␣in␣ff_]
• ␣␣␣␣␣␣␣␣output␣=␣vector(R,aux)
• ␣␣␣␣␣␣␣␣return␣output
• ␣␣␣␣elif␣isinstance(ff,sage.matrix.matrix0.Matrix):
• ␣␣␣␣␣␣␣␣n_rows␣=␣ff.nrows()
• ␣␣␣␣␣␣␣␣ff_␣=␣ff.list()
• ␣␣␣␣␣␣␣␣aux␣=␣[splitting(ele,␣splitting_list)␣for␣ele␣in␣ff_]
• ␣␣␣␣␣␣␣␣output␣=␣matrix(R,n_rows,aux)
• ␣␣␣␣␣␣␣␣return␣output
• ␣␣␣␣else:
• ␣␣␣␣␣␣␣␣return␣’Type␣non␣supported’
•
• ␣␣␣␣mm_␣=␣splitting_structure[nu]
• ␣␣␣␣if␣rr.parent()␣==␣R:
• ␣␣␣␣␣␣␣␣rr_␣=␣rr
• ␣␣␣␣␣␣␣␣output␣=␣[]
• ␣␣␣␣␣␣␣␣for␣ii␣in␣range(nu):
• ␣␣␣␣␣␣␣␣␣␣␣␣if␣r␣==␣1:
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣output␣+=␣[proj(R(ZZ(rr_)//mm^ii))]
• ␣␣␣␣␣␣␣␣␣␣␣␣else:
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣output␣+=␣[proj(R([ZZ(ele)//mm_^ii
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣for␣ele␣in␣(rr_).list()]))]
• ␣␣␣␣␣␣␣␣␣␣␣␣rr_␣=␣rr_␣-␣mm_^ii*splitting(output[-1],
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣splitting_structure[ii])
• ␣␣␣␣␣␣␣␣return␣output
• ␣␣␣␣elif␣isinstance(rr,
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣sage.modules.free_module_element.FreeModuleElement):
• ␣␣␣␣␣␣␣␣rr_␣=␣rr.list()
• ␣␣␣␣␣␣␣␣output␣=␣[vector(F,[aux[jj][ii]
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣for␣jj␣in␣range(len(rr_))])
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣for␣ii␣in␣range(nu)]
• ␣␣␣␣␣␣␣␣return␣output
• ␣␣␣␣elif␣isinstance(rr,
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣sage.matrix.matrix0.Matrix):
• ␣␣␣␣␣␣␣␣n_rows␣=␣rr.nrows()
• ␣␣␣␣␣␣␣␣rr_␣=␣rr.list()
• ␣␣␣␣␣␣␣␣output␣=␣[matrix(F,n_rows,[aux[jj][ii]
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣for␣jj␣in␣range(len(rr_))])
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣for␣ii␣in␣range(nu)]
• ␣␣␣␣␣␣␣␣return␣output
• ␣␣␣␣else:
• ␣␣␣␣␣␣␣␣return␣’Type␣non␣supported’
•
• ␣␣␣␣mm_␣=␣splitting_structure[nu]
• ␣␣␣␣return␣sum(splitting(rr[ii],splitting_structure[ii])*mm_^ii
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣for␣ii␣in␣range(nu))
In our experiments we have used Goppa codes as efficiently decodable codes over the residue field. The current implementation of Goppa codes in [12] works only for prime fields. Since some of our tests need Goppa codes over $F 4$, we have implemented their construction and decoding by means of the Sugiyama algorithm.
• from␣sage.rings.finite_rings.hom_finite_field␣import␣FiniteFieldHomomorphism_generic
•
• def␣GoppaCodeConstructor(n_,t_,F_):
• ␣␣␣␣m_␣=␣ceil(n_.log(F_.cardinality()))
• ␣␣␣␣k_␣=␣n␣-␣2*m_*t_
• ␣␣␣␣L_␣=␣GF(F_.cardinality()^m_)
• ␣␣␣␣embFL_␣=␣FiniteFieldHomomorphism_generic(Hom(F_,L_))
• ␣␣␣␣secLF_␣=␣embFL_.section()
• ␣␣␣␣V_,␣from_V_,␣to_V_␣=␣L_.vector_space(embFL_,␣map=True)
• ␣␣␣␣R_.<x>␣=␣PolynomialRing(L_)
• ␣␣␣␣tg␣=␣cputime()
• ␣␣␣␣print(’Starting␣generation’)
• ␣␣␣␣tt␣=␣cputime()
• ␣␣␣␣g_␣=␣R_(x^(2*t_))␣+␣R_.random_element(2*t_-1)
• ␣␣␣␣while␣not(g_.is_irreducible()):
• ␣␣␣␣␣␣␣␣g_␣=␣R_(x^(2*t_))␣+␣R_.random_element(2*t_-1)
• ␣␣␣␣print(’Goppa␣polynomial’,cputime(tt))
• ␣␣␣␣#␣Goppa␣points
• ␣␣␣␣tt␣=␣cputime()
• ␣␣␣␣pts_␣=␣[]
• ␣␣␣␣aux␣=␣L_.list()
• ␣␣␣␣for␣ii␣in␣range(n_):
• ␣␣␣␣␣␣␣␣ind␣=␣ZZ.random_element(len(aux))
• ␣␣␣␣␣␣␣␣pts_␣+=␣[aux[ind]]
• ␣␣␣␣␣␣␣␣aux.remove(aux[ind])
• ␣␣␣␣print(’Points’,cputime(tt))
• ␣␣␣␣tt␣=␣cputime()
• ␣␣␣␣Htilde␣=␣matrix.vandermonde(pts_).transpose()[0:2*t_]
• ␣␣␣␣Htilde␣*=␣diagonal_matrix([g_(ele)^(-1)␣for␣ele␣in␣pts_])
• ␣␣␣␣print(cputime(tt))
• ␣␣␣␣tt␣=␣cputime()
• ␣␣␣␣aux␣=␣[]
• ␣␣␣␣for␣cc␣in␣range(Htilde.nrows()):
• ␣␣␣␣␣␣␣␣aux2␣=␣Htilde[cc]
• ␣␣␣␣␣␣␣␣aux3␣=␣[]
• ␣␣␣␣␣␣␣␣for␣ele␣in␣aux2:
• ␣␣␣␣␣␣␣␣␣␣␣␣aux3␣+=␣[to_V_(ele).list()]
• ␣␣␣␣␣␣␣␣aux␣+=␣(matrix(aux3).transpose()).list()
• ␣␣␣␣Hhat␣=␣matrix(F_,len(aux)/n_,aux).rref()
• ␣␣␣␣Paux␣=␣random_matrix(F,n_-k_)
• ␣␣␣␣while␣Paux.is_singular()␣==␣True:
• ␣␣␣␣␣␣␣␣Paux␣=␣random_matrix(F,n_-k_)
• ␣␣␣␣H_␣=␣Hhat.transpose()*Paux
• ␣␣␣␣print(’Parity␣check␣matrix’,␣cputime(tt))
• ␣␣␣␣print(’Generation␣success’,␣cputime(tg))
• ␣␣␣␣return␣H_,[L_,␣g_,␣pts_,␣embFL_,␣secLF_]
•
•
• ␣␣␣␣t_␣=␣floor(g_.degree()/2)
• ␣␣␣␣R_.<x>␣=␣PolynomialRing(L_)
• ␣␣␣␣remainders␣=␣[g_,synd_poly]
• ␣␣␣␣coefs␣=␣[R_(0),R_(1)]
• ␣␣␣␣while␣remainders[-1].degree()␣>=␣t_:
• ␣␣␣␣␣␣␣␣cociente,resto␣=␣remainders[-2].quo_rem(remainders[-1])
• ␣␣␣␣␣␣␣␣remainders␣+=␣[resto]
• ␣␣␣␣␣␣␣␣coefs␣+=␣[coefs[-2]␣-␣coefs[-1]*cociente]
• ␣␣␣␣locator␣=␣coefs[-1]
• ␣␣␣␣evaluator␣=␣remainders[-1]
• ␣␣␣␣error_␣=␣[]
• ␣␣␣␣for␣ii␣in␣range(len(pts_)):
• ␣␣␣␣␣␣␣␣root_␣=␣pts_[ii]
• ␣␣␣␣␣␣␣␣if␣locator(root_)␣==␣0:
• ␣␣␣␣␣␣␣␣␣␣␣␣error_␣+=␣[evaluator(root_)/locator.derivative()(root_)]
• ␣␣␣␣␣␣␣␣else:
• ␣␣␣␣␣␣␣␣␣␣␣␣error_␣+=␣[L_(0)]
• ␣␣␣␣return␣vector(error_)
The parity check matrix H, as described in (9), is built as follows.
• length,␣correction_capability␣=␣60,␣3
• #length,␣correction_capability␣=␣256,␣7
• #length,␣correction_capability␣=␣20,␣2
• n,t␣=␣length,␣correction_capability
•
• Decoding_info␣=␣[]
• blocks␣=␣[]
• for␣ii␣in␣range(nu):
• ␣␣␣␣parity_check,decoding_data␣=␣GoppaCodeConstructor(n,t,F)
• ␣␣␣␣blocks␣+=␣[mm^ii*splitting(parity_check,
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣splitting_structure[ii])
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣+␣sum(mm^jj*splitting(random_matrix(F,
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣parity_check.nrows(),
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣parity_check.ncols()),
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣splitting_structure[jj])
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣for␣jj␣in␣range(ii+1,nu))]
• ␣␣␣␣Decoding_info␣+=␣[decoding_data]
• H␣=␣block_matrix(1,blocks)
The error vector is built taking random words of bounded Hamming weight at each degree. We assume the codeword is the zero word.
• error␣=␣zero_vector(R,n)
• for␣ll␣in␣range(nu):
• ␣␣␣␣xi␣=␣zero_vector(F,n)
• ␣␣␣␣while␣xi.hamming_weight()␣<␣t:
• ␣␣␣␣␣␣␣␣xi␣=␣xi.list()
• ␣␣␣␣␣␣␣␣jj␣=␣floor(n*random())
• ␣␣␣␣␣␣␣␣xi[jj]␣=␣F.random_element()
• ␣␣␣␣␣␣␣␣xi␣=␣vector(xi)
• ␣␣␣␣error␣+=␣splitting(xi,
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣splitting_structure[ll])*mm^ll
• error,␣error.hamming_weight()
The decoding algorithm (Algorithm 1) is the last piece of code.
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣splitting_structure)␣for␣ii␣in␣range(nu)]
• xi␣=␣[]
• for␣ii␣in␣range(nu):
• ␣␣␣␣␣␣␣␣sum(splitting(sigma[nu-1-ii][jj],
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣splitting_structure[jj])*mm^jj
• ␣␣␣␣␣␣␣␣␣␣␣␣for␣jj␣in␣range(nu-1-ii,nu))
• ␣␣␣␣␣␣␣␣-␣sum(sum(splitting(xi[ll],
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣splitting_structure[ll])*
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣splitting(Theta[nu-1-ii][jj-ll],
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣splitting_structure[jj-ll])*mm^jj
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣for␣ll␣in␣range(jj-nu+ii+2))
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣for␣jj␣in␣range(nu-1-ii,nu-1))
• ␣␣␣␣␣␣␣␣-␣sum(splitting(xi[ll],␣splitting_structure[ll])*
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣splitting(Theta[nu-1-ii][nu-1-ll],
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣splitting_structure[nu-1-ll])*mm^(nu-1)
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣for␣ll␣in␣range(ii)),␣splitting_structure)[nu-1]
• ␣␣␣␣rec_aux␣=␣Theta[nu-1-ii][nu-1-ii].solve_left(delta)
• ␣␣␣␣error_L␣=␣GoppaCodeDecoder([Decoding_info[nu-1-ii][3](ele)
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣for␣ele␣in␣rec_aux],
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣Decoding_info[nu-1-ii])
• ␣␣␣␣xi␣+=␣[vector([Decoding_info[nu-1-ii][4](ele)
• ␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣␣for␣ele␣in␣error_L.list()])]

## References

1. Hammons, A.R.; Kumar, P.V.; Calderbank, A.R.; Sloane, N.J.; Sole, P. The ℤ4-linearity of kerdock, preparata, goethals, and related codes. IEEE Trans. Inf. Theory 1994, 40, 301–319. [Google Scholar] [CrossRef]
2. Wood, J.A. Duality for modules over finite rings and applications to coding theory. Am. J. Math. 1999, 121, 555–575. [Google Scholar] [CrossRef] [Green Version]
3. Gómez-Torrecillas, J.; Hieta-Aho, E.; Lobillo, F.J.; López-Permouth, S.; Navarro, G. Some remarks on non projective Frobenius algebras and linear codes. Des. Codes Cryptogr. 2020, 88, 1–15. [Google Scholar] [CrossRef] [Green Version]
4. Feng, C.; Nóbrega, R.W.; Kschischang, F.R.; Silva, D. Communication over finite-ring matrix channels. In Proceedings of the 2013 IEEE International Symposium on Information Theory, Istanbul, Turkey, 7–12 July 2013; pp. 2890–2894. [Google Scholar]
5. Feng, C.; Nóbrega, R.W.; Kschischang, F.R.; Silva, D. Communication over finite-chain-ring matrix channels. IEEE Trans. Inf. Theory 2014, 60, 5899–5917. [Google Scholar] [CrossRef] [Green Version]
6. Babu, N.S.; Zimmermann, K.-H. Decoding of linear codes over Galois rings. IEEE Trans. Inf. Theory 2001, 47, 1599–1603. [Google Scholar] [CrossRef]
7. Greferath, M.; Vellbinger, U. Efficient decoding of ℤpk-linear codes. IEEE Trans. Inf. Theory 1998, 44, 1288–1291. [Google Scholar] [CrossRef]
8. Dinh, H.Q.; Lopez-Permouth, S.R. Cyclic and negacyclic codes over finite chain rings. IEEE Trans. Inf. Theory 2004, 50, 1728–1744. [Google Scholar] [CrossRef]
9. McDonald, B.R. Finite Rings with Identity; Marcel Dekker: New York, NY, USA, 1974. [Google Scholar]
10. Albrecht, M.R.; Bernstein, D.J.; Chou, T.; Cid, C.; Gilcher, J.; Lange, T.; Maram, V.; von Maurich, I.; Misoczki, R.; Niederhagen, R.; et al. Classic McEliece: Conservative Code-Based Cryptography; Technical Report; NIST’s Post-Quantum Cryptography Standardization Project: Gaithersburg, MD, USA, 2020. [Google Scholar]
11. Brown, W.C. Matrices over Commutative Rings; Number 169 in Monographs and Textbooks in Pure and Applied Mathematics; Marcel Dekker, Inc.: New York, NY, USA, 1993. [Google Scholar]
12. The Sage Developers. SageMath, the Sage Mathematics Software System (Version 9.1). 2020. Available online: https://www.sagemath.org (accessed on 6 August 2021).
 Publisher’s Note: MDPI stays neutral with regard to jurisdictional claims in published maps and institutional affiliations.

## Share and Cite

MDPI and ACS Style

Gómez-Torrecillas, J.; Lobillo, F.J.; Navarro, G. Decoding Linear Codes over Chain Rings Given by Parity Check Matrices. Mathematics 2021, 9, 1878. https://doi.org/10.3390/math9161878

AMA Style

Gómez-Torrecillas J, Lobillo FJ, Navarro G. Decoding Linear Codes over Chain Rings Given by Parity Check Matrices. Mathematics. 2021; 9(16):1878. https://doi.org/10.3390/math9161878

Chicago/Turabian Style

Gómez-Torrecillas, José, F. J. Lobillo, and Gabriel Navarro. 2021. "Decoding Linear Codes over Chain Rings Given by Parity Check Matrices" Mathematics 9, no. 16: 1878. https://doi.org/10.3390/math9161878

Note that from the first issue of 2016, this journal uses article numbers instead of page numbers. See further details here.