Julien Lavauzelle

Françoise Levy-Dit-Vehel

-Generic Constructions of PoRs from Codes and Instantiations

En premier lieu, je voudrais remercier ma directrice de thèse Françoise Levy-dit-Vehel, sans qui ce travail aurait été impossible. Françoise, merci de m'avoir introduit au monde de la recherche il y a maintenant plus de quatre ans. Merci pour ta confiance, pour ton implication et pour tes conseils précis. Merci enfin pour ce temps que je sais si précieux, et que tu m'as généreusement donné.

Je ne manquerai pas de remercier tout autant Daniel Augot, pour avoir co-encadré cette thèse. Tes remarques pertinentes (et ta relecture du manuscrit sous la chaleur de juillet !) ont sans aucun doute rendu ce travail bien meilleur qu'il n'aurait été sans ton aide. Merci pour ta bonne humeur quotidienne, et pour ton accompagnement tout au long de cette thèse.

Je remercie également Maura Paterson et Christophe Ritzenthaler d'avoir accepté d'être rapporteur(e) de ce travail. Thank you Maura, for writing a report on a PhD dissertation from someone you have probably never heard of before. I am very glad that you take part in my committee. Je te remercie également, Christophe, pour tes ultimes conseils et corrections qui ont notablement amélioré la qualité du manuscrit. J'adresse aussi un merci chaleureux à Alain Couvreur, Camilla Hollanti et Gilles Zémor pour avoir accepté de compléter le jury de cette thèse.

Un projet aussi long qu'une thèse ne peut aboutir sans un environnement de travail idéal. Il y a plus de quatre ans, j'intégrais l'équipe GRACE/Crypto pour un premier stage. La convivialité, la générosité et la compétence des personnes que j'y ai rencontrées m'ont séduit immédiatement. Je voudrais donc remercier les membres permanents de l'équipe, Alain, Ben, Daniel, François et Françoise, d'avoir su instaurer une si bonne ambiance de travail ! Je voudrais aussi remercier les assistantes d'équipes qui se sont succédées durant ces quatre années, et qui ont toutes effectué un travail remarquable. Merci donc à Evelyne et Vanessa pour le LIX, et côté Inria, à Valérie, Tien, Emmanuelle, Jessica et Agustina. J'ai été heureux de partager un premier bureau (et de belles discussions) avec Irene et Cécile. Ce premier stage a aussi été marqué par la bonne humeur communicative et la sympathie de Julia et Aurore. Je n'oublierai pas non plus Razvan, Cuong et Nicolas. Merci à David et Johan, autant pour les discussions autour de Sage que pour les quelques soirées jeux. Je pense aussi à Virgile, avec qui j'ai partagé un tennis au fin fond du Lot-et-Garonne, et qui m'a permis de reconsidérer autant le catch que la médecine chinoise. Enfin, bon courage à Matthieu pour son nouveau poste.

I would also like to thank Nick for these three years. By listening again and again your explanations on the rules of those nice Australian sports, I think I improved my English (a bit). Thank you also for reading my introduction during the last week of July. D'autres personnes ont su apporter, lors de leur passage dans l'équipe, leur contribution à cette bonne ambiance ; je pense ici à Christian, Pierre, Luca, Philippe et William, et j'espère que ceux que j'ai une nouvelle fois oubliés m'excuseront.

Chaque été a vu de nouvelles têtes rafraîchir l'équipe. Merci donc à l'ensemble des stagiaires rencontrés, notamment Christopher, Benoît, Jean et Rémi, à qui je souhaite une bonne continuation. Une pensée plus particulière pour la dernière « promotion » avec qui je crois avoir noué des liens plus précieux : Mattia que j'ai hélas trop peu vu, Lucas avec qui j'ai pu partager quelques bières, Christophe pour ses chaussettes toujours idéalement assorties, Sarah que j'ai adoré exaspérer, ainsi qu'Isabella dont je suis peut-être le pire étudiant en Italien. Et puis, bon courage à Mathilde, nouvelle venue, et merci pour ton enthousiasme débordant. Je vous souhaite sincèrement à tous une bonne continuation.

Enfin, je ne sais comment remercier Élise avec qui j'ai partagé durant trois années le bureau 2039, ainsi que d'interminables discussions mathématiques, culinaires ou cinématographiques. Le chemin fut parfois rude (surtout celui menant à Palaiseau...) mais je crois que nous en voyons le bout. Merci pour ton soutien et ton amitié.

Plus loin d'ici, je voudrais remercier les charentais Anaïs, Amandine, Audrey, Kévin, Florian, et plus particulièrement Aurélie, que je vois si peu mais dont je sais l'affection et le support. Je n'oublie pas d'autres amitiés plus récentes : merci à Amandine, Christelle et Alex, à Corentin, Édouard, Florian et Tristan. Une dernière mais non moindre pensée pour Hugo et Léa, soutiens indispensables durant ces dernières années, et à Abel, leur tout nouveau rayon de soleil.

Mes derniers mots seront pour les membres de ma famille. Non seulement vous m'avez permis et encouragé à faire ce que je souhaitais, mais vous avez aussi été une source d'inspiration et de motivation inépuisable. Je vous remercie du fond du coeur pour votre amour et votre soutien, sans quoi je n'aurais pu réussir cette thèse. Merci infiniment.

I am very grateful to Leo Storme for hosting me in Gent University for a few weeks in 2017. Our discussions on designs and finite geometries helped me a lot to clarify my ideas. Thank you also Marteen for sharing your office during these days. Finally, many thanks to Antonia Wachter-Zeh and Camilla Hollanti for inviting me last winter in Munich. I hope it will lead to fruitful collaborations in the future.

Tout au long de ma thèse j'ai eu le plaisir d'assister au groupe de travail sur la cryptographie à base de codes organisé par Jean-Pierre Tillich. Au-delà de l'intérêt scientifique, ce rendez-vous mensuel m'a permis de rencontrer nombre de chercheurs et doctorants de mon domaine ; je pense immédiatement à Kévin et à Thomas, mais aussi aux autres que je ne pourrais malheureusement pas citer de manière exhaustive. Pour rester dans l'environnement de l'équipe Secret, j'adresse aussi une pensée à Yann que j'ai rencontré au MPRI et avec qui j'ai toujours plaisir à échanger.

Pour sa disponibilité et son aide en géométrie au début de cette thèse (moi qui étais alors novice complet), je souhaite remercier une nouvelle fois Alain Couvreur.

Cette thèse a aussi été rythmée par les « retraites » du projet ANR Manta que j'ai trouvées aussi plaisantes que passionnantes. Merci notamment à Régis, Marc, Emmanuel, et une nouvelle fois à Alain et Christophe ainsi qu'à ceux que j'oublie, pour vos précieuses connaissances en géométrie. Merci aussi à Jade pour son enthousiasme lors de la recherche de

Résumé

Nous présentons ici un résumé en français de la thèse. Par souci d'intelligibilité, nous proposons quelques éléments contextuels avant d'introduire nos différentes contributions scientifiques.

Contexte applicatif de la thèse

Le stockage de données en ligne, aussi connu sous le nom de « stockage sur le cloud », a connu un essor spectaculaire ces dernières années. Les utilisateurs de ce type de service trouvent pratique de pouvoir déposer, partager ou accéder à des fichiers, et ce de manière facile et rapide. Néanmoins, des problèmes de confidentialité sont récemment apparus concernant son usage massif : par exemple, on peut citer l'utilisation commerciale de données personnelles telles que les détails d'accès à des fichiers spécifiques. C'est dans ce contexte cryptographique que se place cette thèse. En un sens, le problème soulevé paraît ardu : on désire garder un contrôle fort sur des fichiers dont le stockage a été délégué à un système distant. Néanmoins, des modèles de sécurité et des protocoles ont été déployés au cours des années, afin de proposer certaines fonctionnalités. En voici deux exemples.

Supposons qu'un système de stockage distant détienne une série de fichiers M = (M 1 , . . . , M k ).

On pourrait se demander s'il est possible de récupérer un certain fichier M i , pour i ∈ {1, . . . , k}, en ne révélant aucune information sur i au système de stockage. Ce problème est connu sous la terminologie anglaise de private information retrieval (PIR), que l'on traduira par récupération confidentielle d'information. Des protocoles efficaces ont été conçus dans le but de résoudre ce problème, bien qu'ils requièrent de borner le système de stockage d'une certaine manière (par exemple dans sa capacité de calcul, ou dans son contrôle de l'ensemble des fichiers).

Dans un autre cas d'application, supposons qu'un utilisateur veuille vérifier si le système de stockage détient véritablement les fichiers déposés. Si ces fichiers sont très volumineux, il est légitime de supposer que l'utilisateur voudrait effectuer cette vérification en utilisant peu de bande passante ; par exemple, une vérification consistant à télécharger les fichiers et en tester l'intégrité est considérée comme trop coûteuse. Des protocoles apportant une solution à cette problématique sont des preuves de récupérabilité, ou en anglais proofs of retrievability (PoR).

Les protocoles résolvant les problèmes présentés ci-dessus peuvent être qualifiés de cryptographiques, dans le sens où ils supposent un adversaire potentiellement malicieux. En effet, dans un protocole de PIR, le système de stockage voudrait obtenir de l'information sur le fichier voulu par l'utilisateur. De façon similaire, dans un protocole de PoR, le serveur aimerait diminuer ses coûts de stockage en effaçant des parties de fichier, tout en laissant croire à l'utilisateur qu'il les détient encore.

vii viii

CONTENTS

Durant l'exécution des protocoles, il est aussi intéressant d'exiger qu'une faible quantité de bits soient échangée entre le client et le serveur. Plus généralement, la complexité de communication nécessaire à la réalisation d'une tâche a été beaucoup abordée en informatique. Par exemple, en théorie des codes, la correction d'une partie d'un mot en accédant à seulement quelques symboles de celui-ci est un problème étudié depuis plus de deux décennies. Des codes correcteurs proposant une telle fonctionnalité sont qualifiés de localement corrigibles (locally correctable code, ou LCC en anglais).

Cette thèse a pour objectif d'étudier ces codes à propriétés locales ainsi que leur application à la construction de protocoles cryptographiques présentés ci-dessus.

Codes localement corrigibles

Présentation. Les codes localement décodables et corrigibles ont été formellement définis par Katz et Trevisan [START_REF] Katz | On the Efficiency of Local Decoding Procedures for Error-Correcting Codes[END_REF] au début des années 2000. Un code C ⊆ F n q est dit localement corrigible s'il existe un algorithme probabiliste LC, acceptant comme entrée un indice i ∈ [1, n] où corriger un mot bruité y ∈ F n q , et ayant les propriétés suivantes. Premièrement, l'algorithme LC doit effectuer au plus requêtes à y, où n est un paramètre appelé la localité du code. Deuxièmement, pour un certain δ > 0 fixé, lorsqu'il existe un mot c ∈ C tel que la distance de Hamming entre c et y est plus petite que δn, l'algorithme LC doit renvoyer c i avec grande probabilité. La quantité δ est appelée la fraction d'erreurs admissible.

Les codes localement corrigibles (LCC) ont été étudiés sous différents régimes de paramètres. La plupart des résultats se placent le régime à localité constante, typiquement = 2 ou 3. Étant fixée une valeur de , le but est alors de construire un LCC de localité avec un taux d'information R = dim(C)/n aussi grand que possible, ou de donner des bornes sur R. D'autres travaux se sont focalisés sur le régime à taux (d'information) constant. Dans ce cas, on cherche des familles de LCCs dont la valeur asymptotique du taux est non nulle, et le rapport /n est aussi petit que possible. Ce deuxième régime est le plus pertinent pour des applications pratiques, c'est donc celui sur lequel nous nous sommes concentrés dans cette thèse.

Les codes de Reed-Muller à bas degré représentent une famille typique de LCCs à taux constant. Rappelons que ces codes sont constitués de mots d'évaluation sur F m q de polynômes multivariés f ∈ F q [X 1 , . . . , X m ] dont le degré total est borné par un certain entier d ≥ 0. Si d < q -1, alors la restriction d'un tel polynôme f à une droite affine L de F m q définit un polynôme univarié f |L , lui aussi de degré ≤ d. On peut ensuite remarquer que l'ensemble des mots d'évaluation de polynômes univariés de degré ≤ d constitue un code que l'on sait corriger (précisément un code de Reed-Solomon). Ainsi, il est possible de définir un algorithme de correction locale pour un code de Reed-Muller de bas degré d. Il se définit informellement comme suit : (i) tirer aléatoirement et uniformément une droite affine L passant par la coordonnée i du mot à corriger ; (ii) corriger y |L , la restriction du mot bruité aux coordonnées correspondant à la droite ; (iii) renvoyer la version corrigée de y i .

Lorsque le paramètre m reste fixe et lorsque d et q croissent de manière proportionnelle (toujours sous la contrainte d < q -1), la famille de codes de Reed-Muller obtenue possède asymptotiquement un taux d'information R non nul. Néanmoins, ce taux est borné par 1/m!. Quelques travaux récents [KSY14, [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF][START_REF] Hemenway | Local Correctability of Expander Codes[END_REF] ont conduit à des LCCs à localité souslinéaire en leur longueur, et dont le taux asymptotique peut être fixé arbitrairement proche de 1. Dans cette thèse, nous nous intéressons en particulier à la seconde construction [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF], introduite par Guo, Kopparty et Sudan. CONTENTS ix L'idée de la construction de Guo et al. [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF] se base sur l'observation suivante : sous certaines contraintes arithmétiques, il existe des polynômes multivariés f ∈ F q [X] de degré strictement plus grand qu'un certain entier d, dont la restriction à n'importe quelle droite affine peut être décrite par un polynôme univarié de degré plus petit que d. En réunissant ces polynômes et ceux du code de Reed-Muller de degré d, on obtient un code C sur lequel l'algorithme de décodage local décrit ci-dessus fonctionne toujours. Le code C est précisément appelé relèvement du code de Reed-Solomon de degré d, que l'on abrégera par relèvement de code ou code relevé. Bien entendu, il contient le code de Reed-Muller de même degré, mais de manière surprenante, il atteint un taux arbitrairement grand pour certaines plages de paramètres. Une des contributions principales de la thèse réside dans la construction et l'analyse détaillée d'analogues de ces codes définis sur des espaces projectifs. Mais présentons dans un premier temps un travail concernant la construction de codes localement corrigibles à partir d'objets combinatoires appelés block designs.

Contribution : codes localement corrigibles à travers une généralisation des codes basés sur les designs. Un (block) design D est un couple (X, B) d'ensembles finis non-vides, X étant appelé l'ensemble des points, tandis que B est un ensemble de sous-ensembles ∅ = B ⊂ X appelés blocs. Si tout ensemble de points de taille t appartient à un même nombre de blocs, alors on parle de t-design. Il est bien connu que l'on peut construire un code à partir de D. Précisément, le code C ⊆ F X q fondé sur le design D = (X, B) est constitué des mots c ∈ F X q tels que pour tout B ∈ B, l'équation de parité ∑ x∈X c x = 0 est satisfaite. En d'autres termes, on impose que c |B appartienne au code de parité, pour tout B ∈ B.

Si D est un 2-design dont la taille de tous les blocs est , nous démontrons qu'un algorithme de correction locale lisse 1 de localité -1 peut être défini. Simplement, l'idée est de tirer aléatoirement un bloc B passant par x ∈ X, la position à corriger. Puis, on utilise l'équation de parité dont le support est B x afin de retrouver c x .

Néanmoins, un tel algorithme ne résiste pas à la présence d'un nombre important d'erreurs sur le mot de code, car il requiert qu'aucun des -1 symboles lus ne soient erronés. Pour pallier cet inconvénient, nous proposons la généralisation suivante des codes basés sur les designs. Soit D = (X, B) un design ; on se donne également L = (L B , B ∈ B) une famille de codes L B ⊆ F B q indexés par B ∈ B. Le code basé sur la paire (D, L) est alors défini comme :

Code q (D, L) = {c ∈ F X q | ∀B ∈ B, c |B ∈ L B } .
On peut observer que, si L contient uniquement des codes de parité, on retrouve la définition initiale d'un code basé sur un design. En revanche, si chacun des codes L B corrige une fraction constante d'erreurs, alors nous démontrons qu'il est possible d'obtenir des codes localement corrigibles admettant une grande fraction admissible d'erreurs δ.

Contribution : construction de relèvements de codes projectifs. Rappelons que les relèvement de codes de Guo et al. [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF] permettent d'obtenir une famille de codes localement corrigibles dont le taux d'information dépasse 1/2. Ils sont formellement définis ainsi :

Lift(RS q (k), m) = {ev A m ( f ) | pour tout droite affine L ⊂ A m , ev A 1 ( f |L ) ∈ RS q (k)} ,
où RS q (k) représente le code de Reed-Solomon de dimension k + 1, et ev A m est l'application d'évaluation sur l'espace affine tout entier. Dans la thèse, nous étudions l'extension de 1 c'est-à-dire, dont la répartition des requêtes est uniforme

x CONTENTS cette construction à l'espace projectif P m . Pour cela, nous définissons proprement ev P m , une application d'évaluation de polynômes homogènes sur P m , ainsi qu'une famille de plongements P 1 → P m , notée Emb P (m), qui respecte le choix de l'évaluation effectué pour ev P m . Un relèvement de code projectif peut ainsi être défini :

Lift(PRS q (k), m) := {ev P m ( f ) | ∀L ∈ Emb P (m), ev P 1 ( f • L) ∈ PRS q (k)} , où PRS q (k) désigne le code de Reed-Solomon projectif (aussi appelé code de Reed-Solomon doublement étendu) de dimension k + 1.

Nous démontrons ensuite que les relèvements de codes projectifs admettent un algorithme de décodage analogue à celui des relèvements affines. En voici une version simplifiée, étant donnés un mot corrompu y ∈ F P m q et une position de correction x ∈ P m . D'abord, un plongement L : P 1 → P m tel que x ∈ L(P 1 ) est tiré aléatoirement. Puis, on effectue les = q + 1 requêtes sur les symboles y i , i ∈ L(P 1 ). Enfin, on corrige le mot y |L(P 1 ) qui, par définition du relèvement Lift(PRS q (k), m), appartient au code PRS q (k) (ou à un code équivalant à celui-ci, et que l'on sait parfaitement expliciter). Une version formelle de cet algorithme est présentée dans le Chapitre 3, Algorithme 10.

Nous explorons ensuite les propriétés algébriques et combinatoires des relèvements de codes projectifs. Nous prouvons qu'ils admettent une base constituée d'évaluations de monômes, et nous étudions en détail la structure de l'ensemble des exposants de ces monômes, appelé ensemble des degrés. Un de nos résultats principaux réside dans la démonstration d'une relation récursive liant les ensembles des degrés de relèvements affines et projectifs. Plus précisément, si PDeg(m, k) (resp. ADeg(m, k)) représente l'ensemble des degrés de Lift(PRS q (k), m) (resp. Lift(RS q (k), m)), nous donnons une bijection explicite entre PDeg(m, k) et l'union disjointe PDeg(m -1, k) ∪ ADeg(m, k -1).

Cette caractérisation inductive est d'un intérêt premier. D'abord, elle fournit une manière pratique de calculer une base -et a fortiori la dimension -des relèvements de codes projectifs. Ensuite, elle permet d'obtenir des relations explicites entre les codes relevés (affines et projectifs) à travers les opérations de poinçonnement et de raccourcissement de code. Par exemple, le raccourcissement de Lift(PRS q (k), m) sur n'importe quel hyperplan projectif donne un code isomorphe à Lift(RS q (k -1), m). Plus généralement, on démontre l'existence de la suite exacte 0 → Lift(RS q (k -1), m) → Lift(PRS q (k), m) π -→ Lift(PRS q (k), m -1) → 0 où π est l'application de restriction sur n'importe quel hyperplan projectif de P m . Ce résultat n'est pas anodin, car des suites exactes très similaires sont connues pour les codes de Reed-Muller et pour les codes basés sur des designs géométriques.

Ainsi, en un certain sens nos résultats suggèrent que les relèvements de codes forment un lien entre des codes purement algébriques de type Reed-Muller et des codes purement combinatoires basés sur les designs. Nous appuyons cette idée en prouvant que les relèvements de codes peuvent être vus comme des codes Code q (D, L), où D est un design géométrique et L une famille de codes de Reed-Solomon (affine ou projectif selon le cas).

Nous justifions ensuite l'aspect pratique des relèvements de codes en étudiant certains de leurs grandeurs et objets caractéristiques. Notamment, nous prouvons leur caractère quasicyclique (ce qui permet de réduire les besoins de stockage de ces codes), et nous fournissons une famille d'ensembles d'information explicites de taille importante.

Pour terminer cette étude, nous proposons une analyse fine de l'ensemble des degrés d'un relèvement de code affine dans le cas m = 2, qui correspond aux codes de plus fort taux d'information. Nous soulignons l'aspect fractal d'une représentation de l'ensemble de leur Dans leur travail précurseur, Chor et al. [START_REF] Chor | Private Information Retrieval[END_REF] ont proposé une première construction de protocoles de PIR dont la complexité de communication est sous-linéaire en la taille de la base de données. Quelques années plus tard, Katz et Trevisan [START_REF] Katz | On the Efficiency of Local Decoding Procedures for Error-Correcting Codes[END_REF] ont démontré que l'algorithme de décodage d'un LCC lisse fournit un protocole de PIR dont la localité est proportionnelle à celle du code. De plus, au prix d'un précalcul de l'encodage de la base de données, les serveurs n'auront aucun calcul à effectuer durant la phase de récupération. Néanmoins, la redondance de stockage induite par l'encodage de la base de données peut être rédhibitoire, notamment lorsque le taux d'information du LCC est faible.

Dans le but de réduire les besoins de stockage de ce type de protocoles, Augot, Levy-dit-Vehel et Shikfa [START_REF] Augot | A Storage-Efficient and Robust Private Information Retrieval Scheme Allowing Few Servers[END_REF] ont suggéré un partage de l'encodage de la base de données sur les différents serveurs, qui respecte la propriété de confidentialité de la phase de récupération. Leur construction se focalise sur la famille des codes à multiplicité [START_REF] Kopparty | High-Rate Codes with Sublinear-Time Decoding[END_REF] (multiplicity codes en anglais), et a permis d'obtenir les premiers protocoles de PIR à communication sous-linéaire et redondance de stockage inférieure à 2. En réalité, l'idée d'Augot et al. peut être étendue à n'importe quel LCC dont le support peut être partitionné de telle sorte que les requêtes de l'algorithme de décodage local soient « transverses » à la partition. Dans cette thèse, nous 2 un tel protocole étant qualifié de sûr du point de vue de la théorie de l'information xii CONTENTS poursuivons cette approche en adoptant un point de vue plus général, par l'intermédiaire de designs transversaux.

Contribution : protocoles de PIR à base de designs transversaux. La plupart des constructions récentes de protocoles de PIR se concentrent sur l'obtention d'une complexité de communication optimale dans le sens serveur vers client. Cependant, la question du coût calculatoire de la réponse du serveur est souvent négligée, bien qu'elle représente un obstacle pour le déploiement effectif des protocoles de PIR. En particulier, il semble déraisonnable pour un serveur de devoir lire la base de donnée entière, lorsque la réponse à renvoyer est de la taille d'une entrée.

Dans cette thèse, nous proposons un schéma générique pour la construction de protocoles de PIR, qui prend particulièrement en compte la problématique de la complexité calculatoire. Plus précisément, les protocoles que nous construisons sont optimaux en rapport à leur complexité de communication, dans le sens où chaque serveur doit simplement lire et renvoyer une entrée de la base de données qu'il détient.

Notre construction est fondée sur des structures combinatoires appelées designs transversaux (en anglais, transversal designs). Ce sont des designs (X, B) munis d'un ensemble de groupes G qui forme une partition de X, et tel que chaque paire non ordonnée {x 1 , x 2 } ⊂ X est, ou bien contenue dans un groupe, ou bien contenue dans exactement λ blocs, pour un certain λ ≥ 1. On impose aussi que tous les blocs aient même taille , et que tous les groupes aient même taille s. Un tel design est ainsi noté TD λ ( , s). Le code C ⊆ F X q issu du design TD λ (s, ) admet donc un support X de taille s , qui peut être partitionné en groupes G 1 , . . . , G , et tel que pour toute paire d'indices {x 1 , x 2 } ⊂ X n'appartenant pas au même groupe, il existe une équation de parité pour C dont le support est de taille et contient {x 1 , x 2 }. Donnons maintenant un aperçu de notre construction de protocole de PIR. Soit (X, B, G) un design transversal TD λ ( , s), et C ⊆ F X q le code associé, de dimension k. On considère serveurs S 1 , . . . , S qui stockent un encodage c ∈ C de la base de données M à k entrées de la manière suivante : pour 1 ≤ i ≤ , le serveur S i détient c |G i . La phase de récupération de l'entrée c x , pour x ∈ X, se présente alors comme suit. D'abord, l'utilisateur choisit un bloc B ∈ B tel que x ∈ B. Décrivons maintenant la requête adressée au serveur S i , pour i ∈ [1, ]. Si x ∈ G i , alors le serveur doit renvoyer aléatoirement l'un des symboles qu'il détient. Sinon, il doit renvoyer c y i , où y i est l'unique point de G i ∩ B. À la réception des réponses des serveurs, l'utilisateur peut collecter le vecteur (c b : b ∈ B \ {x}). Grâce à l'équation de parité de C dont le support est B, il peut donc retrouver c x . Enfin, notons que la valeur de x reste confidentielle (du point de vue d'un seul serveur), car pour tout point y i ∈ X n'appartenant pas au même groupe que x, il existe un nombre constant λ de blocs contenant {x, y i }.

La construction présentée ci-dessus admet, comme escompté, une complexité de calcul optimale pour chacun des serveurs S i , 1 ≤ i ≤ . En effet, le serveur S i ne doit lire et renvoyer qu'un unique symbole parmi les données c |G i qu'il détient. Par ailleurs, la complexité de communication du protocole est égale à fois la taille de l'entrée désirée, où l'on rappelle que est la taille des blocs du design TD λ ( , s).

Pour un fixé, un objectif reste de trouver des designs TD λ ( , s) dont le code associé C admet un taux d'information dim(C)/s important. Ainsi, on pourra atténuer la redondance de stockage sur les serveurs. Dans cette optique, nous proposons plusieurs instances de designs transversaux qui fournissent des codes à haut taux d'information. Deux premières familles proviennent des relations d'incidence entre points, droites et hyperplans dans les espaces affine et projectifs. Une troisième famille provient d'une construction classique de designs transversaux à base de tableaux orthogonaux de force 2. Cela nous conduit à introduire la notion nouvelle de code d'incidences, dont les étapes de construction sont représentées en Figure 1. Par la suite, nous proposons une étude complète des codes d'incidence IC q (C 0 ) := Code q (T C 0 ) provenant de codes C 0 MDS et de dimension 2.

Finalement, une dernière famille de designs transversaux donnant des codes de grande dimension provient de codes C 0 divisibles, c'est-à-dire, dont tous les mots ont un poids de Hamming divisible par un même entier. Nous démontrons que dans ce cas, le code C = IC q (C 0 ) contient un sous-code de codimension 1 de son code dual ; son taux d'information est donc minoré approximativement par 1/2.

Pour terminer, l'utilisation de tableaux orthogonaux de force t = 2 pour la construction de protocoles de PIR nous a amené à examiner le cas des forces t > 2. Nous montrons que dans cette situation, les protocoles obtenus restent confidentiels, même si jusqu'à t -1 serveurs échangent l'information contenue dans leurs requêtes respectives. Pour clore cette partie, nous proposons et analysons les protocoles de PIR issus d'une famille de tableaux orthogonaux à force t > 2 quelconque.

Introduction Context

Informal context. Outsourced data storage, also known as cloud storage, is a service adopted by a vast majority of Internet users. People desire to upload, share or access files stored on servers in a fast and convenient manner. Quite recently, privacy issues also emerged when using such online services. For instance, numerous scandals broke concerning the commercial use of personal data, such as details on customers' access to specific files. This thesis takes place in this cryptographic context. In a sense, the problem seems hard: one wants to keep control on files whose storage has been delegated to remote systems. Still, models and protocols have been deployed to provide specific features. Let us give two examples.

Given a collection of files stored on a remote storage system, one could first question whether it is possible to download one specific file M i of a database M = (M 1 , . . . , M k ), without leaking any information about i, the index of the desired file. This problem is known as private information retrieval (PIR). Efficient protocols have been designed to tackle it, but they require the storage system to be bounded in a certain way (e.g. its computational power, or its control on the files).

Customers may also want to verify whether the remote server actually stores the files they have uploaded. Assuming files are very large, they would like to run this verification efficiently in terms of bandwidth. For instance, trying to download the entire files is considered as inefficient. Protocols proposing a solution to this problem are called proofs of retrievability (PoRs).

Both previous problems can be qualified as cryptographic, as they may involve a malicious adversary: in private information retrieval, the remote system wants to obtain some information about the requested file; in proofs of retrievability, the server wants the customer to believe that it still holds the database, while it has maliciously erased (part of) it in order to reduce its storage costs.

We have also seen that both problems require that only a few bits are exchanged between the user and the storage system. More generally speaking, the communication complexity necessary to perform a given task has been studied a lot in computer science. For instance in coding theory, correcting pieces of a codeword with only a few queries to the codeword symbols is an issue addressed for almost two decades. Codes allowing such a correction are called locally correctable codes (LCCs).

In this thesis, we study the application of LCCs (or similar codes) in the cryptographic protocols presented above. Very informally, assume uploaded files are encoded according to an LCC. Then, the requirements necessary to the local correction (e.g. the number and structure of xv xvi CONTENTS queries) allows to retrieve information on the remote file, in an efficient and (sort of) uniform way. Let us give more details in the following paragraphs.

Locally correctable codes. Locally decodable and correctable codes were formally defined by Katz and Trevisan [KT00] in the early 2000's. A code C ⊆ F n q is said to be locally correctable if there exists a probabilistic algorithm LC, taking as input i ∈ [1, n], the coordinate of the symbol to correct, with the following properties. First, LC makes at most queries to a noisy word y ∈ F n q ; the parameter is called the locality and should be thought as of being much smaller than n. Second, LC must return c i with high probability, if the Hamming distance between y and c ∈ C is smaller than δn, where δ > 0 is the admissible fraction of errors.

Locally correctable codes (LCCs) are studied under different regimes of parameters. Most works focus on the constant locality regime, typically = 2, 3. For a given locality, the goal is to build an LCC with maximum information rate R = dim(C)/n, or to give bounds on Rfor instance, we refer to [START_REF] Yekhanin | Towards 3-query Locally Decodable Codes of Subexponential Length[END_REF][START_REF] Efremenko | 3-Query Locally Decodable Codes of Subexponential Length[END_REF] for constructions and [START_REF] Kerenidis | Exponential Lower Bound for 2-query Locally Decodable Codes via a Quantum Argument[END_REF][START_REF] David | A Quadratic Lower Bound for Three-Query Linear Locally Decodable Codes over Any Field[END_REF] for bounds.

Other results appeared in the constant rate regime. In this case we look for families of LCCs whose asymptotic rate is positive, and whose ratio locality to length is as low as possible. Since it is the most interesting for practical applications, we focus on this regime in the present thesis.

Reed-Muller (RM) codes certainly define the most typical family of constant rate LCCs. They consist in the evaluation of polynomials f ∈ F q [X 1 , . . . , X m ] over F m q , where the total degree of f is bounded by some integer d ≥ 0. If d < q -1, then the restriction of every polynomial f to any affine line L defines a univariate polynomial f |L of degree ≤ d. This univariate polynomial can be corrected with a few queries to its evaluations. Thus, a local correcting algorithm for RM codes can be defined as follows: (i) pick uniformly at random a line through the position of the symbol to correct, and (ii) correct the noisy univariate polynomial along the line.

However, RM codes of length n = q m and degree d < q -1 have rate bounded by 1/m!, when their locality is n 1/m . A few recent works [KSY14, [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF][START_REF] Hemenway | Local Correctability of Expander Codes[END_REF] lead to LCCs whose asymptotic rate R can be set arbitrarily close to 1, and whose locality remains sublinear in the length. In this thesis we mostly focus on the second construction, introduced by Guo, Kopparty and Sudan, and shortly named lifted codes.

Lifted codes generalise RM codes, based on the following evidence: under some arithmetic conditions, there exists polynomials f of total degree > d, such that the restriction of f to any affine line L describes a univariate polynomial of degree ≤ d. Gathering polynomials satisfying this property and polynomials of degree less than d, we get a code on which the local correcting algorithm of RM codes still works. This code, called the lifting of the Reed-Solomon code (in short, lifted code since we mostly lift Reed-Solomon codes), contains the RM code and reaches arbitrarily high rate for a certain range of parameters. One purpose of the thesis is to provide and analyse an analogue of lifted codes over projective spaces.

Finally, one must report that when d = q -2, a lifted code can be seen as the code based on AG 1 (m, q), the design of points and lines in the affine space (also known as the classical affine geometry design of 1-flats). Hence, in some sense the lifting process generalise the construction of codes from designs.

Private information retrieval. Private information retrieval (PIR) was formally introduced in a work of Chor, Goldreich, Kushilevitz and Sudan [START_REF] Chor | Private Information Retrieval[END_REF] in 1995, that is, years before the actual deployment of cloud storage services. The authors considered the case of a database CONTENTS xvii M consisting in k files (or entries) of size 1. They proved that, when a single server stores the database, a PIR protocol leaking no information on the index i of the entry M i (such a protocol being called information-theoretically secure) must use Ω(k) bits of communication. Of course, such an expensive protocol is not affordable, and two solutions have since appeared. The first one consists in restricting the definition to computational privacy; the second one allows the use of several servers, not all of them colluding, but remains information-theoretically secure. In some ways, the first solution bounds the adversary (the remote storage system) in its computational power, while the second one bounds it in its knowledge of the queries. Hereafter we only focus on the second model that makes use of several servers.

In their seminal work, Chor et al. [START_REF] Chor | Private Information Retrieval[END_REF] proposed a first construction of PIR protocols with sublinear communication complexity, which besides decreases as the number of servers used in the protocol grows. A few years later, Katz and Trevisan [START_REF] Katz | On the Efficiency of Local Decoding Procedures for Error-Correcting Codes[END_REF] proved that so-called smooth LCCs (that is, LCCs whose queries are close to uniform) provide PIR protocols whose communication complexity is essentially the locality of the code. Moreover, if the encoding of the database M is precomputed, then each server's answer only consists in reading one entry of the codeword it holds. Therefore, the computational complexity of the protocol is low. Nevertheless, the storage overhead induced by the encoding can be prohibitive, especially if the LCC has vanishing rate.

Hence, aiming at reducing the storage needs of PIR protocols, Augot, Levy-dit-Vehel and Shikfa [START_REF] Augot | A Storage-Efficient and Robust Private Information Retrieval Scheme Allowing Few Servers[END_REF] proposed to split the encoding of the database among the servers. In this setting, servers hold different pieces of the codeword instead of copies of it, and the overall storage cost is drastically reduced. Using high-rate LCCs (the multiplicity code construction [START_REF] Kopparty | High-Rate Codes with Sublinear-Time Decoding[END_REF]), they obtained the first PIR protocols with sublinear communication and redundancy < 2. In fact, Augot et al.'s idea can be extended to any LCC whose support can be split in a way that most queries of the local correcting algorithm are transversal to the partition. In this thesis we develop this approach with a more generic perspective, making use of so-called transversal designs.

Proofs of retrievability.

Without going into the technicalities, proofs of retrievability (PoRs) can be introduced as follows. A PoR involves two entities: the owner of a file M that we name Alice, also called the client or the verifier, and Bob who stores of the file (also referred to as the server or the prover). In a first initialisation phase, Alice performs two operations: (i) she generates some secret material K and (ii) she encodes the file M into a string W according to K. Then, the string W is sent to Bob, and Alice erases M and keeps K secretly. The core of a PoR is the second phase, where Alice checks whether her file is extractable from Bob. This step consists in an interactive protocol where Alice defines a random challenge c, sends it to Bob who answers a response r according to c and to what he actually stores. Typically, the challenge can consist in some coordinates of the string W that Bob must send back. Then, based on c, r and her secret material K, Alice appraises whether she can retrieve M from Bob. Notice that it is highly desirable that this verification phase admits a low communication cost (compared to the size of M). Finally, if Alice is convinced that her file is retrievable (e.g. after several successful verification protocols), then she can run an extraction protocol whose output shall be M with high probability.

With the increasing use of decentralised storage systems, PoRs have found multiple recent applications. For instance, Storj [WBB + 16] is a practical and implemented decentralised cloud storage network which uses PoRs to maintain data integrity. Though they slightly differ from PoRs, one should also notice that other kinds of schemes proving storage have been introduced during the last decade, such as provable data possession (PDP), proofs of replication (PoRep). They also were deployed in very practical applications, such as Filecoin [com17] for proofs of However, such local correction algorithms are not resilient to many errors, since they require that absolutely no error occur on symbols supported by B. To tackle this problem, we propose to consider generalised design-based codes, defined as follows. Let D = (X, B) be a block design, and L = (L B : B ∈ B) be a family of local codes L B ⊆ F B q , indexed by blocks in B ∈ B. The code based on D and L, called generalised design-based code, is

Code q (D, L) = {c ∈ F X q | ∀B ∈ B, c |B ∈ L B } .
We see that, if L consists only in parity-check codes, we end up with the usual definition of design-based codes. But, if every code L B ∈ L corrects a constant fraction of errors, we show that we improve the error resilience of the local correcting algorithm presented above. Details are given more formally in Section 2.4.

Projective lifted codes.

As we have seen in a previous paragraph, lifted Reed-Solomon codes [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF] were initially built in order to provide an asymptotic family of LCCs achieving rate > 1/2. They can be formally defined as:

Lift(RS q (k), m) = {ev A m ( f ) | for all affine lines L ⊂ A m , ev A 1 ( f |L ) ∈ RS q (k)} ,
where RS q (k) denotes a Reed-Solomon code. In this thesis, we propose to extend this construction to the evaluation of polynomials over projective spaces. To this end, we require appropriate definitions for an evaluation map of homogeneous polynomials over projective spaces ev P m , and for a space of embeddings P 1 → P m denoted Emb P (m) -see Chapter 3 for details. Projective lifted codes can then be defined as follows:

Lift(PRS q (k), m) := {ev P m ( f ) | ∀L ∈ Emb P (m), ev P 1 ( f • L) ∈ PRS q (k)} ,
where PRS q (k) denotes a projective (or doubly-extended) Reed-Solomon code.

We then show that projective lifted codes admit a local correcting algorithm analogous to the one used for lifted codes defined over affine spaces (that we name affine lifted codes). Let us sketch how it corrects a symbol y x of a noisy codeword y, for x ∈ P m . First, one picks uniformly at random an embedding L : P 1 → P m such that x ∈ L(P 1 ). Then, one corrects the restricted word y |L(P 1 ) , since it should lie in PRS q (k). A more formal presentation is given in Algorithm 10, Chapter 3.

CONTENTS xix

We then explore properties of projective lifted codes. We first prove they admit a basis made of evaluation vectors of monomials, and we then study the set of exponents of this monomial basis, called the degree set. A main result is a recursive relation between degree sets of affine and projective lifted codes. More precisely, denoting by PDeg(m, k) (resp. ADeg(m, k)) the degree set of Lift(PRS q (k), m) (resp. Lift(RS q (k), m)), we give an explicit bijection between PDeg(m, k) and PDeg(m -1, k) ∪ ADeg(m, k -1), see Theorem 3.23.

This recursive characterisation has multiple consequences. First, it is a convenient way to compute a basis -and a fortiori the dimension -of projective lifted codes. Second, it allows us to exhibit links between lifted codes via puncturing and shortening operations: for instance, shortening Lift(PRS q (k), m) on any projective hyperplane gives a code isomorphic to Lift(RS q (k -1), m). More precisely, we prove that the following exact sequence

0 → Lift(RS q (k -1), m) → Lift(PRS q (k), m) π -→ Lift(PRS q (k), m -1) → 0
holds, where π is the restriction map on a fixed projective hyperplane of P m . In fact, a similar exact sequence was already known for Reed-Muller codes and codes based on geometric designs.

In some ways, lifted codes bridge algebraic constructions of codes such as Reed-Muller codes and combinatorial constructions based on block designs. For low degrees k ≤ q(1 -1/p) where p = char(F q ), Kaufman and Ron [START_REF] Kaufman | Testing Polynomials over General Fields[END_REF] proved that Lift(RS q (k), m) = RM q (k, m). On the opposite, if k = q -2, then Lift(RS q (k), m) is the code based on the design AG 1 (m, q). More generally, we prove that projective and affine lifted codes are generalised design-based codes.

We also study several properties of projective lifted codes that emphasize their practicality. We show they admit quasi-cyclic automorphisms that can help to reduce their storage cost. We also give a large and explicit family of information sets for these codes.

Finally, we analyse in details the degree sets of affine lifted codes in the case m = 2, which corresponds to the codes with highest rates. We highlight their fractal representation and provide a precise computation of their dimension. We notably improve upon a bound given as a claim in [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF], proving that the dimension K of Lift(RS 2 e (2 e -2 e-c -1), 2), for 1 ≤ c ≤ e -1, is exactly

K = 4 e 1 - 5 4
3 4 c + 1 4 1 4 c + 1 2 e 3 c -1 2 c+2 .
This particular setting is of main interest, since for fixed c and increasing e, it provides an asymptotically good family of locally correctable codes. More generally, in any characteristic p ≥ 2 we prove that for e → ∞, the asymptotic rate ρ

(p) ∞ (c) of the family of lifted codes Lift(RS p e (p e -p e-c -1), 2) is ρ (p) ∞ (c) = 1 -1 + 1 p + 2 1 + 1/p 2
Private information retrieval based on transversal designs. Most recent constructions of PIR protocols mainly focus on obtaining an optimal download communication complexity during the retrieval process. However, the computational cost of servers' answers is neglected even though it sometimes represents a barrier to PIR practicality. For instance, it seems unreasonable for a server to read a whole database in order to give an answer whose size is roughly the size of an entry.

xx

CONTENTS

In this thesis, we propose a new generic framework for the construction of PIR protocols which takes into account the computational complexity issue. More precisely, the protocols we give are computationally optimal with respect to the communication complexity of the protocol, in the sense that each server only needs to read one entry in the database it holds.

Our construction is based on combinatorial structures called transversal designs. They are block designs (X, B) equipped with a set of so-called groups G that forms a partition of X, and such that every pair {x 1 , x 2 } ⊂ X is either contained in a group, or in a fixed number λ of blocks.

If the block size is and the group size is s, such a transversal design is denoted TD λ ( , s).

The code C based on a TD λ ( , s) therefore admits a support X, |X| = s , that can be split into groups G 1 , . . . , G . Furthermore, for every pair of coordinates {x 1 , x 2 } that do not lie in the same group, there exists a parity-check equation for C whose support contains {x 1 , x 2 }.

Let us now give a quick overview of the construction of our -server PIR protocol -more details are given in Chapter 4. Given an encoding c ∈ C of the database, the user first uploads to the i-th server S i the restriction c |G i of c, for 1 ≤ i ≤ . Now assume the user wants to privately retrieve an entry c x for x ∈ X. Then, they pick at random a block B ∈ B such that x ∈ B. Let us now describe queries to server S i , for 1 ≤ i ≤ . If i is such that x / ∈ G i , then the user queries c y i , where y i is the only point in G i ∩ B. Otherwise, the user query c y , for some uniformly random y ∈ G i .

Upon reception of servers' answers, we see that the user collects the tuple (c b ∈ F q : b ∈ B \ {x}). Hence, the user can retrieve c x thanks to the parity-check equation having B as support. The privacy of the protocol comes from the fact that for every pair {x, y i } that do not lie in the same group, there exists a constant number of blocks B that contain {x, y i }.

The PIR construction we propose features, as expected, low computational complexity for each server S i , 1 ≤ i ≤ : it only needs to read one symbol in c |G i . The overall communication complexity is proportional to the block size . In fact, the only parameter that depends on the chosen instance of transversal design is the storage overhead of the scheme. In practice, low storage overhead are desirable, so we look for transversal designs TD λ ( , s) whose associated linear code C have dimension as large as possible compared to their length s . Therefore, we propose several instances of transversal designs that lead us to codes with large rate. The first two families come from incidences between points and lines in the affine (resp. projective) space. They are closely related to the classical geometric designs of 1-flats. The third family of instances makes use of a classical transformation of so-called orthogonal arrays of strength 2 into transversal designs. This leads us to introduce PIR protocols based on incidence codes, that arise from the steps depicted in Figure 2.

We then proceed to a thorough study of the dimension of incidence codes coming from MDS codes C 0 of dimension 2. Finally, a last family of practical instances appears when showing that divisible codes C 0 admit incidence codes of rate roughly greater than one half. However, the existence of such codes over large alphabets remains an open question.

The use of orthogonal arrays of strength t = 2 for the construction of PIR protocols leads us to examine the case of higher strengths t > 2. We prove that such orthogonal arrays allow the construction of PIR protocols which remain private, even if up to t -1 servers collude (i.e. they exchange information about their respective queries). Finally, we exhibit and analysed instances of orthogonal arrays with large strength to conclude this chapter.

Codes with locality for proofs of retrievability.

A formal definition of PoRs was proposed by Juels and Kaliski in [START_REF] Juels | PORs: Proofs of Retrievability for Large Files[END_REF], where the authors also give a first construction based on sen- Building on this framework, we propose a new construction of proofs of retrievability based on linear codes. Our idea is essentially the following. Let C ⊆ F n q be a code and H be a set of parity-check equations for C of low weight n. Alice encodes her file M into a codeword C ∈ C and encrypts C into W (using a suitable cipher and a key K). The verification phase then consists in testing random parity-check equations on W. Precisely, Alice picks at random an h ∈ H, and asks Bob to send back symbols of W supported by h. Then Alice decrypts the symbols returned by Bob, resulting in a plaintext a, and she checks whether ∑ i h i a i = 0.

In Chapter 5, we firstly define a security model for PoRs, in order to give a formal version of our construction. We then introduce verification structures for codes that generalise the use of parity-check equations that we depicted above. We then proceed to give a detailed and generic analysis of the security of our PoR schemes, using the framework of Paterson et al. [START_REF] Paterson | A Coding Theory Foundation for the Analysis of General Unconditionally Secure Proof-of-Retrievability Schemes for Cloud Storage[END_REF] which particularly suits our work. The main advantages of our construction are its generality (many different codes can be used, with various parameters) and its low computation complexity, once the initialisation is performed.

In practice, the communication complexity of our PoRs depends on the weight of the paritycheck equations that are used (or more generally, the locality parameter of the verification structure for C). Therefore, for practical reasons we look for codes with a quite elaborate and structured set of parity-check equations of small weight. This leads us to propose several instantiations of our PoR constructions, using well-known codes with locality that were introduced previously in the thesis (e.g. Reed-Muller codes or design-based codes).

Outline of the thesis

The present document is composed of two main parts. Chapters 1-3 are devoted to codes with locality, mostly locally correctable codes. Their application into two cryptographic protocols -namely private information retrieval and proofs of retrievability -are proposed, respectively in Chapters 4 and 5.

In the first chapter, we recall notions of coding and design theory that will be used throughout the thesis. This allows us to fix convenient but less common notation for codes, and to recall well-known constructions and results.

Chapter 2 is mostly devoted to a review of locally decodable and correctable codes. We first give formal definitions of these codes, and we explain some important existing constructions and bounds. We also take the opportunity to define very properly a smooth version of their local correcting algorithms. Finally, we propose in Section 2.4 a new perspective for the construction of locally correctable codes, through the generalisation of design-based codes presented earlier.

The third chapter focuses on the construction and analysis of projective lifted codes. After an introduction of the algebraic background necessary to the construction, we provide formal definitions of projective lifted codes, and we give their first properties. A local correcting algorithm is presented in Section 3.3, matching the parameters of the affine lifted codes of Guo et al. [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF]. Then we present recursive relations between affine and projective lifted codes, via shortening and puncturing. Some practical features (such as explicit information sets and automorphisms) are given in Section 3.4, and we end this chapter with a precise computation and analysis of the degree sets and the dimension of lifted codes of order m = 2.

In Chapter 4, we consider the application of codes based on transversal design in the construction of private information retrieval protocols. A quick review of existing schemes is proposed in Section 4.1, and motivates our construction given in the next section. We then suggest and analyse several families of instances that yield practical parameters, notably the ones based on geometric designs. Finally, in Section 4.4 we propose a generalisation of our construction using orthogonal arrays, in order to resist collusions between some of servers.

Finally, Chapter 5 examines the construction of proofs of retrievability using codes with locality. After referencing some important existing PoR schemes, we define a security model matching the framework due to Paterson et al. [START_REF] Paterson | A Coding Theory Foundation for the Analysis of General Unconditionally Secure Proof-of-Retrievability Schemes for Cloud Storage[END_REF]. According to this model, we present and analyse our PoR construction in Section 5.3. Its performance is described in the next section, and we propose several instantiations based on well-known codes and designs in Section 5.5.

A conclusion including further avenues of research completes the document. Overall notation. Lowercase bold characters represent tuples, codewords or vectors, while uppercase ones are used for higher-dimensional data structures (such as matrices or tensors). Sets are usually denoted in classical uppercase characters, and their elements in lowercase.

Part I

Codes with locality

We denote by [1, n] := {1, 2, . . . , n}. A k-subset of a finite set S, k ≤ |S|, is a subset of S of cardinality k. We also denote by S(S) the set of permutations on S.

For any set A, the power set A S represents the set of maps f : S → A. Since S is finite, a function f ∈ A S can also be seen as a tuple a over A indexed by S, through its evaluation tuple a = ( f (x) : x ∈ S) ∈ A S . In the tuple a ∈ A S , the symbol indexed by x ∈ S is written a x ∈ A. In our context, the correspondence between evaluation tuples and functions is very convenient and will be used regularly. In order to distinguish the two representations, recall that tuples are written in bold characters. We also identify A [1,n] with A n .

If R is a ring, the ideal generated by a finite subset U of an R-module is written Span R (U), or in short Span(U) if the base ring is implicit.

If K is a field, K × represents the non-zero elements of K. We denote by K[X] the ring of univariate polynomials over K with indeterminate X, and by K[X] = K[X 1 , . . . , X m ] the ring of polynomials with m variables over K. The subspace of polynomials of total degree bounded by d is denoted by K[X] ≤d .

The coordinate-wise product (also known as Schur, or Hadamard product) of two vectors

a, b ∈ K S is a b := (a x b x : x ∈ S) ∈ K S .
Notice it corresponds to the classical product f g of two maps f , g : S → K.

The m-dimensional affine space over K is simply K m , and it is sometimes denoted A m (K), or A m . We can also define the projective space P m (K) as the quotient K m+1 / ∼, where the relation ∼ is defined by: u ∼ u ⇐⇒ ∃λ ∈ K × , u = λu .

Given two K-vector spaces U and V, the space of linear maps U → V is denoted Hom(U, V), and the invertible ones Iso(U, V). If U = V we shortly write Hom(U) and Iso(U). The set of maps φ :

K t → K m , φ(x) = ψ(x) + b, where b ∈ K m and ψ ∈ Hom(K t , K m
) is injective, is called the set of affine transformations from K t to K m . One must discern affine transformations from generic affine maps, from the fact that we require affine transformations to be injective. We will mostly deal with affine transformations, that we denote by Aff(K t , K m ), or Aff(K t ) when t = m.

Given a set S, the notation s ← R S means that s is picked uniformly at random from the set S. We also denote by B(p) the Bernoulli distribution with parameter p, and we recall that if a random variable X follows B(p), then its mean value is E(X) = p and its variance is

D(X) := E((X -E(X)) 2 ) = p(1 -p).
Let X and Y be two discrete random variables with finite support. We say that X and Y are independent if we have

Pr(X = x, Y = y) = Pr(X = x) Pr(Y = y)
for every x, y lying in the respective support of X and Y. When X and Y are real-valued, we say that X and

Y are uncorrelated if E(XY) = E(X)E(Y). As a consequence, two uncorrelated variables X, Y satisfy D(X + Y) = D(X) + D(Y).
Two independent random variables are uncorrelated. Finally, a family of random variables {X i } i∈I is pairwise independent (resp. pairwise uncorrelated) if for all i = j ∈ I, X i and X j are independent (resp. uncorrelated).

Let us also recall that Markov's inequality states that, for a non-negative random variable X, we have for every a > 0:

Pr(X ≥ a) ≤ E(X) a .
Furthermore, the deviation from the mean value is bounded by Chebychev's inequality. This states that, for any real-valued random variable X and for every b > 0, we have:

Pr(|X -E(X)| ≥ b) ≤ D(X) b 2 .
Given two positive functions f , g :

N → R + , we say that f = O(g) if there exists α > 0 such that f (n) ≤ αg(n) for all large enough n ∈ N. We write f = O(g) if f = O(g log(g) c ) for some constant c > 0.
If for every ε > 0, f (n) ≤ εg(n) holds for large enough n ∈ N, then we write f = o(g). Finally, the notation f = Ω(g) is equivalent to g = O( f ), and we write f = Θ(g) when f = Ω(g) and f = O(g).

Elementary notions in coding theory

This section is devoted to recall basic notions related to coding theory. Here we choose to use the tuple representation for elements in Σ S since it is the most commonly used in the literature. When meaningful, we also give correspondence of the definitions and results in the functional representation. In the whole section, we refer to [START_REF] Cary | Fundamentals of Error-Correcting Codes[END_REF] for details and proofs.

ELEMENTARY NOTIONS IN CODING THEORY

Generic notions. Given an alphabet Σ and a finite set S, an error-correcting code over Σ is a subset C ⊆ Σ S . The set S is the set of coordinates of the code, and its size n = |S| is the length of the code. Elements c ∈ C are called codewords. As its name suggests, an error-correcting code is usually employed to correct errors and erasures that can occur in messages, for instance during transmission. Given a codeword c ∈ C ⊆ Σ S and a noisy version y ∈ (Σ ∪ {⊥}) S of c, where ⊥ denotes the erasure symbol, an error is a symbol y i / ∈ {c i , ⊥} for some i ∈ S, while an erasure is a symbol y j = ⊥ for some j ∈ S. If not stated otherwise, we assume in this thesis that only errors can occur in words. A well-suited metric for modelling errors is the Hamming distance, defined by d(y, z) := |{i ∈ S, y i = z i }| for any two words y, z ∈ Σ S . The distance of y ∈ Σ S to a code C is then d(y, C) := min{d(y, c), c ∈ C}, and the minimum distance of the code C is d min (C)

:= min{d(c, c ) | (c, c ) ∈ C 2 , c = c }.
It is also convenient to consider the relative distance between two words y, z ∈ Σ S , defined by δ(y, z) := d(y, z)/|S|. Similarly one can define the relative distance of a word to a code, and the relative minimum distance of a code.

A nearest-neighbour correcting algorithm for C is an algorithm which takes as input any word y ∈ Σ S , and outputs a word c ∈ C such that d(y, c) = d(y, C). Let t := d min (C)-1 2 be the packing radius of C. Clearly, if d(y, C) ≤ t, then the output is unique. Therefore, a half-distance correcting algorithm for C is an algorithm that outputs the unique c ∈ C nearest to y, provided y ∈ Σ S satisfies d(y, C) ≤ t. More generally, one can also consider T-bounded-distance correcting algorithms when d(y, C) is bounded by some integer T ≤ t.

Linear codes. We have defined codes C ⊆ Σ S with a general perspective, but they are mostly studied in the context S = [1, n] and Σ = F q , where F q is the finite field with q elements. If C has a F q -vector space structure, then C is said to be (F q -)linear. In this thesis, every code is assumed to be F q -linear with alphabet Σ = F q , except stated otherwise. Thus, linear codes over F q are referred to as codes for short. We call dimension of the code the integer k = dim F q C. The support of a word y ∈ F X q is supp(y) := {i ∈ X, y i = 0}. Its weight wt(y) := d(0, y) is also the cardinality of its support. The minimal distance of a linear code C ⊆ F X q can therefore be seen as the minimum weight wt(c) of a non-zero codeword c ∈ C.

Any injective map E : F k q → C is an encoder for C, and elements m ∈ F k q are called messages and usually written in rows m = (m 1 , . . . , m k ). Given an encoder E : F k q → C, one can define a nearest neighbour decoding algorithm for (C, E), as an algorithm which takes as input any word y ∈ Σ S , and outputs a message m ∈ F k q such that d(y, E(m)) = d(y, C). Similarly, half-distance and T-bounded-distance decoding algorithm can be defined.

If |I| = dim(C |I ) = dim(C)
holds, then we say that I is an information set for C. Given any information set I ⊆ S and any encoder E, there exists a linear map φ I :

F I q → F k q such that φ I • E = id F k q . Denote by φ I = (φ 1 , . . . , φ k ) : F I q → F k q .
If moreover, there exists a one-to-one map σ : I → [1, k] such that, φ i (x) = x σ(i) for every x ∈ F I q , then we say that E is a systematic encoder with respect to the information set I. In simple words, a systematic encoder is a linear map F k q → C such that, by selecting k coordinates {i 1 , . . . , i k } = I, one can read any message m from the coordinates indexed by I in its encoded version E(m).

Let G ∈ F [1,k]×S q be a matrix whose rows and columns are respectively indexed by [1, k] and S. The matrix G is a generator matrix for C if the map m → mG is an encoder for C. For such a matrix G, an information set I for C corresponds to a set of columns for which the minor G |[1,k]×I is invertible. Furthermore, the matrix G gives a natural systematic encoder if its submatrix G |[1,k]×I is the k × k identity matrix (up to a permutation of the columns).

Duality. We denote by x, y = ∑ i∈S x i y i the classical inner product between two elements x, y ∈ F S q . Every linear code C admits an orthogonal space with respect the classical inner product, denoted C ⊥ and historically but confusingly called the dual code of C. This is a linear space of dimension |S| -dim(C). Elements of C ⊥ are called parity-check equations for C. The dual distance of C is simply d ⊥ (C) := d min (C ⊥ ).

Any matrix H ∈ F [1,r]×S q satisfying Hc = 0 if and only if c ∈ C is called a parity-check matrix for C. Notice we do not restrict ourselves to r = |S| -dim(C). For y ∈ F S q , the vector Hy ∈ F r q is called a syndrome.

It is clear that, if G is a generator matrix for C, then we have HG = 0. Moreover, the rows of H generates the dual code C ⊥ . Therefore, rank(H) = |S| -dim(C), and a row-reduced form of H defines a generator matrix for C ⊥ .

Permutations, automorphisms. Any permutation σ ∈ S(S) induces a map F S q → F S q , defined by σ * (y) := (y σ(x) : x ∈ S). In the functional representation, this corresponds to the composition of functions, i.e.

σ * : f → f • σ. A code C ⊆ F S
q is said to be invariant by σ if σ * (C) = C. For a given C, such permutations form a group under the composition law; it is called the permutation group of C and denoted Perm(C).

More generally, the semi-direct product (F × q ) S S(S) acts on F S q by (a, σ) : y → a σ * (y) .

The group of elements (a, σ) ∈ (F × q ) S S(S) which leave a code C invariant is called the automorphism group of C and denoted Aut(C).

Isomorphisms between codes.

Given a one-to-one map φ : A → B, one can also define a map φ * : F A q → F B q by φ * (y) := (y φ(x) : x ∈ A). Then, we say that two codes C ⊆ F A q and C ⊆ F B q are permutation-equivalent if φ * (C) = C . Similarly, if there exists b ∈ (F × q ) B such that b φ * (C) = C , then C and C are isomorphic. Notice that any pair (b, φ) defines an isometry between metric spaces F A q and F B q , where the metric is the Hamming distance.

The last remark is crucial regarding correction issues. It notably implies that, if a code C admits a t-bounded-distance correcting algorithm Corr, then one can also correct any code C isomorphic to C up to t errors. Indeed, let y ∈ F B q be a noisy word, y = c + e , where c ∈ C and e is the error. We first build

(φ * ) -1 (b -1 y ) = (φ * ) -1 (b -1 c ) =c∈C +(φ * ) -1 (b -1 e ) ∈ F A q ,
and e := (φ * ) -1 (b n,a); it can be seen as the code of constant functions in the functional notation. If a = 1 := (1, . . . , 1), then Rep(n) := Rep(n, 1) is simply referred to as the repetition code. Its dual code is the so-called a-parity-check code Par(n, a), with parameters [n, n -1, 2], and it consists in words c ∈ F S q satisfying ∑ i∈S c i a i = 0. Similarly one can define Par(n) := Par(n, 1). Notice that repetition codes and parity-check codes are MDS.

Algebraic constructions of codes

A convenient way to build good and non-extreme codes C ⊆ F S q is to use subspaces of polynomial functions S → F q . Codes can be defined as such, but the correspondence between polynomials and polynomial functions is sometimes tricky: over F q , several polynomials may correspond to the same function.

Therefore, it is sometimes more convenient to see these codes as evaluation codes. That is, codewords are explicitly given as evaluation vectors of polynomials. More precisely, given a vector space of polynomials R ⊂ F q [X 1 , . . . , X m ] and a set S ⊆ F m q , we define an evaluation map

ev S : R → F S q f → ( f (x) : x ∈ S)
If ev S is injective, then the associated evaluation code C = ev S (R) has length |S| and dimension dim(R).

Reed-Solomon codes

Reed-Solomon codes [START_REF] Reed | Polynomial Codes over Certain Finite Fields[END_REF] define one of the most famous family of evaluation codes. We here provide a definition of their generalised version in both vector and functional representations.

Definition 1.1 (Reed-Solomon codes). Let S ⊆ F q and y ∈ (F × q ) S . Assume that n = |S| > 0 and let 0 ≤ k ≤ n -1. The associated generalised Reed-Solomon code (GRS code) of degree k is

GRS q (k, S, y) := {(y x f (x) : x ∈ S), f ∈ F q [X], deg f ≤ k} ⊆ F S q .
Subscript q can be omitted for convenience. The set S is the set of evaluation points, while y consists in the column multipliers. If y = 1, then the code is simply called a Reed-Solomon code and denoted RS(k, S). Furthermore, if S = F q , then we get a full-length Reed-Solomon code, denoted RS(k).

In the functional representation, if g ∈ F S q satisfies g(x) = y x for every x ∈ S, then we have

GRS q (k, S, y) = {g • f |S , f ∈ F q [X] ≤k } ⊆ F S q .
Let us also list several useful properties of GRS codes:

1. If |S| = n, then GRS(k, S, y) is an [n, k + 1, n -k] MDS code. 2. We have GRS(k, S, y) ⊥ = GRS(n -k -1, S, y ), where y x = (y x ∏ z∈S\{x} (x -z)) -1 .
3. GRS(0, S, y) is the y-repetition code, while GRS(n -1, S, y) is the y -parity-check code, where y is defined above. 4. When S = F q , we have Aff(F q ) ⊆ Aut(RS(k)).

GRS codes also admit efficient correction algorithms. Precisely, one can correct any pattern of e erasures and v errors, as long as e + 2v ≤ d -1, where d is the minimum distance of the GRS code. Also notice that, since GRS codes are MDS, a strategy could consist in (i) first correcting errors in a punctured code of length ne and (ii) recovering the e erasures by interpolation. For the sake of completeness, we give two references: [START_REF] Reed | Simplified Algorithm for Correcting both Errors and Erasures of Reed-Solomon Codes[END_REF], which is one of the first efficient error-and-erasure correcting algorithm for RS codes; and [START_REF] Gao | A New Algorithm for Decoding Reed-Solomon Codes[END_REF], one of the currently most efficient half-distance decoding algorithms for GRS codes.

Reed-Muller codes

The m-variate generalisation of Reed-Solomon codes are called Reed-Muller codes. They were first designed over the binary field, then generalised over any finite field. Definition 1.2 (Reed-Muller codes). Let m ≥ 1 and 0 ≤ r ≤ m(q -1). The q-ary Reed-Muller code (RM code) of order m and degree r is

RM q (m, r) := {( f (x) : x ∈ F m q ), f ∈ F q [X 1 , . . . , X m ], deg f ≤ r} .
Notice that RM q (m, r) = ev F m q (F q [X] ≤r ), where F q [X] ≤r denotes the space of m-variate polynomials of total degree bounded by r. Unfortunately one cannot derive parameters of Reed-Muller as easily as those of Reed-Solomon codes, since ev F m q is not injective for r larger than q.

Still, if r ≤ q -1, then ev F m q is injective over F q [X] ≤r , hence dim(RM q (m, r)) = ( m+r m ). Further- more, in that case the minimum distance of RM q (m, r) is (qr)q m-1 . In the next chapter, we will see that this low-degree setting provides Reed-Muller codes local correcting properties.

For r ≥ q, the evaluation map ev F m q is not injective anymore. Though, its kernel is generated by {X q i -X i } 1≤i≤m , which corresponds to bounding by q -1 the partial degrees of the polynomials to be evaluated. Then it can be proved

[AK92] that dim(RM q (m, r)) = r ∑ i=0 m ∑ j=0 (-1) j m j i -jq + m -1 i -jq ,
and if we write r = a(q -1) + b for 0 ≤ b < q -1, we also have d min (RM q (m, r)) = (qb)q m-1-a .

Remark 1.3. The Reed-Muller code RM q (m, r) can be seen as a subfield subcode of a Reed-Solomon code defined over the extension field F q m . Precisely, up to isomorphism, RM q (m, r)

is included into RS q m (q m -d) ∩ F F q m
q , where d = d min (RM q (m, r)). See for instance [START_REF] Kasami | New Generalizations of the Reed-Muller Codes -I: Primitive Codes[END_REF] for details on this embedding.

A non-trivial consequence of Remark 1.3 is that one can employ decoding/correcting algorithm of Reed-Solomon codes in order to decode/correct Reed-Muller codes. Marvellously, one sees that related RM codes and RS codes have the same minimum distance. As a consequence, Reed-Muller codes are efficiently correctable up to half their minimum distance. Moreover, Pellikaan and Wu [START_REF] Pellikaan | List Decoding of q-ary Reed-Muller Codes[END_REF] used this property to obtain an efficient list-decoding algorithm for Reed-Muller codes.

Hadamard codes

Hadamard codes, also known as simplex codes, have been studied for a long time for their structural properties. They can be defined as evaluation codes of linear forms over the set of non-zero elements of the binary affine space.

2 (m) = Span F 2 {ev S (X i ), 1 ≤ i ≤ m} .
The code Had 2 (m) ⊆ F S 2 has length |S| = 2 m -1, dimension m and minimum distance 2 m-1 , since every non-zero linear form vanishes on a hyperplane. We will see later that Hadamard codes are related to combinatorial constructions and satisfy nice local properties.

Notice that q-ary [ q m -1 q-1 , m, q m-1 ] Hadamard codes Had q (m) can also be defined, through the evaluation of linear forms over the q-ary projective space P m-1 (F q ).

Combinatorial constructions through block designs

In this section, we recall basic notions of design theory and how to build codes from block designs. Details can be found in the following books [START_REF] Assmus | Designs and Their Codes[END_REF][START_REF] Douglas | Combinatorial Designs -Constructions and Analysis[END_REF].

Designs

Definition 1.5 (Block design). A block design, or simply design, is a pair D = (X, B), where X is a finite set and B = ∅ is a collection of non-empty subsets of X. Elements of X and B are respectively named points and blocks.

Designs are usually considered with incidence constraints between points and blocks. For instance, we can require that each pair of points appears the same number of times in the set of blocks; we then obtain balanced incomplete block designs. We give a representation of the Fano plane in Figure 1.1. Notice that it corresponds to the incidence structure of points and lines in the projective plane P 2 (F 2 ). More generally, the projective plane P 2 (F q ) gives rise to a (q 2 + q + 1, q + 1, 1)-BIBD. Example 1.9 (classical affine and projective space designs). BIBDs can also be defined in higher dimensional ambient spaces. For instance:

-If X = A m (F q ) and B is the set of affine lines of A m (F q ), then (X, B) defines a (q m , q, 1)-BIBD. It is called the design of the classical affine space and denoted AG 1 (m, q). -Similarly, X = P m (F q ) equipped with the set B of its projective lines, defines a ((q m+1 -1)/(q -1), q + 1, 1)-BIBD called the design of the classical projective space and denoted PG 1 (m, q). -The classical affine design of s-flats AG s (m, q) can also be defined: it consists in points and subspaces of dimension s in the affine space of dimension m. It is a (q m , q s , m-1 s-1 q ) BIBD, where, for any a ≥ b, the Gaussian coefficient [ a b ] q is defined by a b q := (q a -1)(q a-1 -1) . . . (q a-b+1 -1) (q b -1)(q b-1 -1) . . . (q -1) if b = 0, and by [ a 0 ] q := 1. -Similarly, its projective analogue PG s (m, q) is the classical projective design of s-flats. It is a (θ m,q , θ s,q , m-1 s-1 q ) BIBD, where θ a,q := q a+1 -1 q-1 is the number of points in a projective space of dimension a.

Designs of higher order. BIBDs naturally generalise by requiring that each t-subset of points appears in exactly λ blocks, for some t ≥ 1. These constructions are termed t-(v, k, λ)-designs. Thus a BIBD is a 2-design. Let us report the following well-known results (see [START_REF] Douglas | Combinatorial Designs -Constructions and Analysis[END_REF] Theorem 9.4] and its corollaries for instance).

Theorem 1.10. Let D = (X, B) be a t-(v, k, λ)-design for t ≥ 1. Then, for 0 ≤ s ≤ t, each s-subset appears in exactly λ s blocks, where

λ s = λ ( v-s t-s ) ( k-s t-s )
.

As a corollary,

1. if s ≥ 1, then D is also an s-(v, k, λ s )-design, 2.
there are exactly λ( v t )/( k t ) blocks in B.

Design-based codes

In this section, we present how one can build linear codes from designs, and we discuss their properties. For this purpose, we need to introduce a data structure that stores incidences between points and blocks, namely the incidence matrix of the design. Definition 1.11 (incidence matrix). Let D = (X, B) be a design. The incidence matrix of D over F q , denoted Mat q (D), is the matrix M whose rows and columns are respectively indexed by blocks and points, and such that for all x ∈ X, B ∈ B,

M B,x = 1 if x ∈ B, 0 otherwise.
Definition 1.12 (design-based code). Let D = (X, B) be a design. The design-based code over F q associated to D, denoted Code q (D), is the F q -linear code C ⊆ F X q admitting M = Mat q (D) as a parity-check matrix.

A crucial property of design-based codes is the following. Let C = Code q (D) where D = (X, B). Then c ∈ F X q lies in C if and only if for every B ∈ B we have ∑ b∈B c b = 0.

Notice that Code q (D) ⊆ F X q has length |X| and dimension |X| -rank F q (M), where M = Mat q (D). Furthermore, if F q is an extension of F p , then Code q (D) = Span F q (Code p (D)).

Here one should emphasize that M is a {0, 1}-matrix, but its rank highly depends on the choice of the base field. To see this, let us first view M as a matrix over Z, and consider Γ ⊂ Z the multiset of elementary divisors of the matrix M, counted with multiplicity. The rank of M over F p is then the number of elements g ∈ Γ such that p g. It now clear that rank F p (M) depends on p, but one should also remark that the rank stabilizes when p → ∞.

Example 1.13 (Fano plane, continued). The Fano plane D admits the incidence matrix

M =           1 1 1 0 0 0 0 1 0 0 1 1 0 0 1 0 0 0 0 1 1 0 1 0 0 1 1 0 0 1 0 1 0 0 1 0 0 1 1 0 1 0 0 0 1 0 1 0 1          
where columns and rows are listed according to the order of points and blocks given in Example 1.8. A computation can show that the multiset of elementary divisors of M is Γ = {1 4 , 2 2 , 6 1 }, where g i means that the element g ∈ Z is counted with multiplicity i. Hence, matrix M has rank 4 over F 2 , rank 6 over F 3 , and rank 7 over any other prime finite field F p . In other words, Code p (D) is the zero code for all primes p / ∈ {2, 3}, and Code 3 (D) is the [7, 1, 7] repetition code over F 3 . Fortunately, over F 2 (and its extensions) Code 2 (D) presents more interesting properties; specifically, one can prove it is isomorphic to the binary [7, 3,4] Hadamard code Had 2 (3) (see Proposition 2.28).

On the dimension of design-based codes. Finding the rank of a single design over a fixed field -or equivalently the dimension of its associated code -is a simple task if the parameters of the design are small enough. Indeed, it only consists in computing the rank of a matrix whose size is |B| × |X|. However, deriving a formula for the rank of a family of designs appears to be much harder. Especially, little is known about families of designs with low-rank incidence matrices (equivalently, families of high-rate design-based codes).

For 2-designs, one can first report negative results. Proposition 1.14 (Hamada [Ham68]). Let D be a 2-(v, k, λ)-design, and denote by r = λ v-1 k-1 its replication number. Let also p be a prime number. Then, dim(Code

p (D)) ≥ 2 implies that p | r -λ. Precisely, 1. if p r -λ and p | r, then dim(Code p (D)) ≤ 1; 2. if p r(r -λ), then dim(Code p (D)) = 0.
Classical affine and projective designs over F p e satisfy p | rλ. Therefore it is of interest to study them over F p . It is proved that the design of points and hyperplanes in the projective space satisfies:

rank p (PG m-1 (m, p e )) = p + m -1 m e + 1 .
This result has been found independently by Smith [START_REF] Smith | On the p-rank of the incidence matrix of points and hyperplanes in a finite projective geometry[END_REF], by Goethals and Delsarte [START_REF] Goethals | On a Class of Majority-Logic Decodable Cyclic Codes[END_REF], and by MacWilliams and Mann [START_REF] Macwilliams | On the p-Rank of the Design Matrix of a Difference Set[END_REF]. Hamada generalised it for subspaces of any dimension, leading us to the famous Hamada's formula given in next theorem.

Theorem 1.15 (Hamada's formula [START_REF] Hamada | The rank of the incidence matrix of points and d-flats in finite geometries[END_REF]). The p-rank of the projective geometry design PG t (m, p e ) is given by

∑ (s 0 ,..., s e )∈S e-1 ∏ j=0 L(s j+1 ,s j ) ∑ i=0 (-1) i m + 1 i m + s j+1 p -s j -ip m (1.1)
where L(s j+1 , s j ) = s j+1 p-s j p and S is the set of tuples s = (s 0 , . . . , s e ) ∈ Z e+1 such that:

   s 0 = s e , t + 1 ≤ s j ≤ m + 1, 0 ≤ s j+1 p -s j ≤ (m + 1)(p -1) .
Notice that ranks of affine geometry designs can also be computed thanks to another result due to Hamada [START_REF] Hamada | The rank of the incidence matrix of points and d-flats in finite geometries[END_REF]:

rank p AG t (
rank p AG 1 (3, p 2 ) = p 3 - p + 1 3 2 + 2 p 2 p + 1 3 .
Finally, if we fix t and q = p e , the dimension of the code C m = Code p (PG t (m, q)) is a polynomial in m of degree less than (q - codeword c.

Assume now that one wants to retrieve only one symbol c i of c. Of course, one can use the previous algorithm which returns c entirely, and then on can extract the desired symbol c i . However, the complexity of this method is at least linear in the length of the code. Local correcting algorithms were introduced in order to reach a better computation complexity for this problem. Explicitly, they aim at retrieving a correct symbol from a damaged codeword, with high probability (w.h.p.) and in sublinear time.

In this chapter, we recall formal definitions of locally decodable and locally correctable codes. We then present algebraic constructions in the high-rate regime, which is of main interest for our applications. We also review current bounds and issues in this area. Next, we show how locally correctable codes (LCCs) can be built from block designs. Finally, after introducing generalised design-based codes, we discuss to what extent they can lead us to high-rate LCCs.

Motivation and definitions

Historical points

The notion of locality in codes appeared in computational theory in the early 1990s. It was initially raised in the scope of testing computations and self-correcting programs, see e.g. [BLR93, BFLS91, GLR + 91, GS92]. A typical question was to output w.h.p. the image f (x) of x ∈ S by a low-degree polynomial f , given a program P that computes f (y) correctly for only a constant fraction of entries y ∈ S.

Later, codes with locality also turned out to be useful to obtain short probabilistic checkable proofs (PCPs). Very informally, assume one wants to assess w.h.p. whether a long string x belongs to some language L, with the restriction that one can make only a small number of oracle queries1 to x or to another long string derived from x. Generically, if we directly access

x, the partial information we get cannot be sufficient to determine whether x ∈ L. Thus, a natural idea is to encode x into a longer proof π, so that a few oracle queries to π assert w.h.p. if π corresponds to an encoding of an element of L. This leads us to the notion of locally testable codes which were a key element for proving the well-known PCP Theorem [AS98, ALM + 98].

A few years later, Katz and Trevisan [START_REF] Katz | On the Efficiency of Local Decoding Procedures for Error-Correcting Codes[END_REF] formally introduced so-called locally decodable codes in an information theoretic perspective. This seminal work was motivated by sublineartime data recovery in large corrupted databases. The authors proved that codes equipped with a local decoding procedure must be somewhat smooth, in the sense that queries should be sufficiently balanced. They also gave first lower bounds on the number of redundancy symbols needed in the codeword, and they proposed an application to private information retrieval protocols -see Chapter 4 for more details.

Definitions

Let us formally introduce locally correctable and decodable codes, as defined in Yekhanin's survey [START_REF] Yekhanin | Locally Decodable Codes[END_REF]. In this thesis, an oracle query to a string y ∈ Σ S refers to a map y → y i for some i ∈ S. One usually considers that the computational cost of such a map is 1, and the index i is sometimes called a query. If an algorithm A is only allowed to access a string y via oracle queries, we say it has oracle access to y, and we represent it by A (y) . Notice that, if the string y ∈ Σ S is seen as a map g y : S → Σ, then an oracle query is purely the evaluation of g y at i ∈ S.

Definition 2.1 (locally correctable code, or LCC). Let C ⊆ Σ S be an F q -linear code, |S| = n. Let also 1 ≤ ≤ n, δ ∈ (0, 1) and ε < 1/2. We say that C is an ( , δ, ε)-locally correctable code (LCC) if there exists a randomised algorithm LC, taking as input i ∈ S and having oracle access to words y ∈ Σ S , which satisfies the following requirements. For every y ∈ Σ S and c ∈ C such that d(y, c) ≤ δn, and for every i ∈ S, we have:

-Pr(LC (y) (i) = c i ) ≥ 1ε, the probability being taken over the internal randomness of LC, and -LC (y) (i) queries at most symbols of y.

We refer to as the locality of the code C, and to LC as the local correcting algorithm.

In the literature, it is usually considered sufficient to have a failure probability ε ≤ 1/3. The idea is that, by repeating the local correcting algorithm LC several times on the same input i, one can attain values of ε exponentially small in the number of procedures we run.

Definition 2.2 (locally decodable code, or LDC). Let C ⊆ Σ S be an F q -linear code, |S| = n, equipped with an encoder E : F k q → C. Let also 1 ≤ ≤ k, δ ∈ (0, 1) and ε < 1/2. We say that C is an ( , δ, ε)-locally decodable code (LDC) if there exists a randomised algorithm LD, taking as input i ∈ [1, k] and having oracle access to words y ∈ Σ S , which satisfies the following requirements. For every y ∈ Σ S and m ∈ F k q such that d(y, E(m)) ≤ δn, and for every i ∈ [1, k], we have:

-Pr(LD (y) (i) = m i ) ≥ 1ε, the probability being taken over the internal randomness of LD, and -LD (y) (i) queries at most symbols of y.

Once again, is the locality of the code C, and LD is referred to as a local decoding algorithm.

Remark 2.3. Let C ⊆ Σ S be an ( , δ, ε)-LCC with ≤ k = dim(C). If we know a systematic encoder E : F k q → C, then the code C is also ( , δ, ε)-locally decodable. Indeed, any message symbol m i , 1 ≤ i ≤ k, is also a codeword symbol c j for some j ∈ S, and the local correcting algorithm C thus becomes a local decoding algorithm.

For γ ∈ (0, 1), we say that a locally correctable code C ⊆ Σ S is γ-smooth if, for all i, j ∈ S, algorithm LC(i) queries y j with probability at most γ. Moreover, C is called perfectly smooth if symbols y j are queried with equal probability. Hence, a perfectly smooth LCC is ( /n)smooth, but the converse may be false when some vectors of queries have size strictly less than . Smooth LDCs can be defined very similarly to smooth LCCs, the only difference being that i ∈ [1, k] is a message coordinate instead of a codeword coordinate.

In fact, any LCC intrinsically admits a certain smoothness, as we show in the following result inspired by [KT00, Theorem 1]. Proposition 2.4. Let C ⊆ Σ S be an ( , δ, ε)-LCC of length n. For every γ > δn , the code C is also a γ-smooth ( , δγn , ε)-LCC.

Proof. Let γ > δn and δ = δγn , and denote by LC the local correcting algorithm for C. Relying on LC, we will describe another local correcting algorithm LC γ for C, with the additional γ-smooth property.

Let y ∈ Σ S and c ∈ C such that d(y, c) ≤ δ n. On input i ∈ S, define S i := {j ∈ S | Pr(LC (y) (i) reads y j ) > γ} as the set of coordinates which are queried too often. Let us now consider a new word y ∈ Σ S , defined for all j ∈ S as follows:

y j = 0 if j ∈ S i y j otherwise.
The new algorithm LC γ is simply defined by LC (y) γ (i) := LC (y ) (i). Let us analyse its properties.

As we removed all queries that LC makes with probability larger than γ, the algorithm LC γ is γ-smooth. Moreover, we can easily check that |S i | ≤ /γ. Hence d(y , y) ≤ /γ, and d(y , c) ≤ /γ + δ n = δn follows. Therefore LC (y) γ (i) outputs c i with probability ≥ 1ε as expected.

The previous proposition may question the relevance of focusing on the smoothness of LCCs. However, we see that we cannot make any LCC perfectly smooth, since δ is strictly less than 1. Therefore, searching for perfectly smooth LCCs remains a very relevant goal.

A first example: the binary Hadamard code

The binary Hadamard code Had 2 (m) is a classical example of locally correctable code -see Subsection 1.2.3 for a definition. Since the code consists in evaluation vectors of linear forms over F m 2 , the 3 non-zero points of any plane give rise to a parity-check equation for Had 2 (m). Such equations can then be exploited to recover any symbol with only 2 queries.

For convenience we here adopt the functional representation. Formally, denote by S = F m 2 \ {0} and let f ∈ C (that is, f is a linear form over F m 2 ). For all u = v ∈ S, we see that u + v ∈ S, and the fact that f (u) + f (v) = f (u + v) leads us to the following local correcting algorithm. Query {g(u)} and output g(u).

else 6

Query {g(v), g(u + v)} and output g(u + v) -g(v).

Algorithm 1 is often presented with steps 1 and 6 only. In that case, coordinate u is never queried. We here add the tossing trick in order to make the algorithm perfectly smooth, as we can see in the following proposition. Proposition 2.5. Let δ < 1/4, and m ≥ 2. By using Algorithm 1, the Hadamard code Had 2 (m) is a perfectly smooth (2, δ, 2δ)-locally correctable code.

Proof. We first check that evaluations of g are queried with equal probability. We see that g(u) is read with probability 2/(n + 1), and g(v), v ∈ S \ {u}, is read with probability

1 - 2 n + 1 × 2 × 1 n -1 = 2 n + 1 .
Let us now prove that the output is correct with probability ≥ 1 -2δ, and denote by E = supp( fg) the support of the errors (we have |E| ≤ δn). We also define S u as the (random) support of the query made by LC (g) (u).

∩ S u = ∅ or S u .
Thus, the probability of success of LC (g) (u) is given by:

Pr(LC (g) (u) = f (u)) = 1 -Pr(|E ∩ S u | = 1) ≥ 1 -Pr(|E ∩ S u | ≥ 1) ≥ 1 -E(|E ∩ S u |) .
Furthermore, by linearity we obtain

E(|E ∩ S u |) = ∑ v∈E Pr(v ∈ S u ) = ∑ v∈E 2 n + 1 = |E| 2 n + 1 ≤ δn 2 n + 1 < 2δ .
Recall

E(m i ) = ev S (X i ) for every m ∈ F m 2 .
Therefore Had 2 (m) is also a (2, δ, 2δ)-LDC. Quantitatively, Hadamard codes define a family of binary LCCs with increasing length 2 m -1 and constant query size 2. However, the dimension m of these codes is only logarithmic in their length. In the following section, we will see that a certain class of Reed-Muller codes defines another family of LCCs, achieving constant rate provided an increase of the query size.

Some algebraic constructions of LCCs

This section is devoted to presenting families of locally correctable codes that are built by evaluating polynomials over vector spaces. In Subsection 2.2.1, we detail two smooth local correcting algorithms for Reed-Muller codes. We show how perfect smoothness can be achieved, and we depict qualitative relations between the three parameters of LCCs. Next subsections are then devoted to more evolved algebraic constructions leading to high-rate LCCs, namely multiplicity codes and lifted codes.

Reed-Muller codes

Reed-Muller codes have been defined in Subsection 1.2.2. In this subsection, we let C = RM q (m, r) for 0 ≤ r ≤ m(q -1). Informally, we see that if r is small enough, then restrictions of C to subspaces A ⊆ F m q define non-degenerate codes, which consist in the evaluation vectors of low degree polynomials over A. This key property will be used for local correcting purposes. Before going deeper into details, we state a few results which are straightforward to prove. Lemma 2.6. Let 1 ≤ t ≤ m and φ ∈ Aff(F t q , F m q ) be an injective affine map.

1. If f ∈ F q [X 1 , . . . , X m ], deg( f ) ≤ r, then there exists g ∈ F q [X 1 , . . . , X t ], deg(g) ≤ r, such that ∀u ∈ F t q , ( f • φ)(u) = g(u) . (2.1) 2. Conversely, if g ∈ F q [X 1 , . . . , X t ], deg(g) ≤ r, then there exists f ∈ F q [X 1 , . . . , X m ] with deg( f ) ≤ r, such that (2.1) holds.
In terms of codes, Lemma 2.6 implies the next corollary.

Corollary 2.7. Let C = RM q (m, r) with r ≤ t(q -1) for some t ≥ 1, and φ ∈ Aff(F t q , F m q ). Then φ * (C) = RM q (t, r). In particular, if we denote by A = im(φ) the t-dimensional affine space that φ defines, then C |A ⊆ F A q is permutation-equivalent to RM q (t, r), the permutation being given by φ : F t q → A.

A first local correcting algorithm. Corollary 2.7 induces a local correcting procedure for RM q (m, r), r < t(q -1). It consists in picking at random φ ∈ Aff(F t q , F m q ), and correcting the noisy codeword restricted to the image of φ, thanks to an efficient decoding algorithm for RM q (t, r).

Thus, we now assume to have at our disposal a correcting algorithm Corr for RM q (t, r), which corrects 1 erasure and up to w errors, where 2 + 2w = d min (RM q (t, r)). Such an algorithm can be derived from an efficient half-distance 1-erasure correcting algorithm for Reed-Solomon codes, as those we have mentioned in Subsection 1.2.2.

Algorithm 2:

A perfectly smooth local correcting algorithm of locality = q t -1 for the Reed-Muller code RM q (m, r), where r < t(q -1).

Input: a coordinate u ∈ S := F m q , and an oracle access to g ∈ F S q such that d( f , g) ≤ δn, for some f ∈ RM q (m, r), where n = |S|. Output: f (u) with high probability. /* Corr A denotes a half-distance one-erasure correcting algorithm for the code RM q (m, r) |A , isomorphic to RM q (t, r). */ 1 Pick uniformly at random φ ∈ Aff(F t q , F m q ) such that u ∈ A := im(φ).

2 Toss a random binary coin b ∈ {0, 1}, following B(p) with p := q t -1

q m . 3 if b = 1 then 4
Pick v uniformly at random in A \ {u}.

else 6

Define v ← u.

7 Define A = A \ {v} and query {g(v) : v ∈ A }. 8 Define g ∈ (F q ∪ {⊥}) A by g |A = g |A and g (v) =⊥. Run Corr A on input g . 9 if Corr A fails then 10 Abort with fail.

else 12

Denote by h ∈ F A q the output of Corr A . Output h(u).

Let us give additional notation to make the analysis of Algorithm 2 simpler. We write r = a(q -1) + b, with 0 ≤ b ≤ q -1 and a ≤ m -1, the degree of the Reed-Muller code RM q (m, r), and we recall that d min (RM q (m, r)) = (qb)q m-a-1 . We also denote by

w = d min (RM q (t, r)) -2 2 = (q -b)q t-a-1 -2 2
the number of errors that Corr can correct, and by τ := w/(q t -1) its ratio compared to the locality parameter.

Proposition 2.8. Let m ≥ 2 and r = a(q -1) + b such that a ≤ m -1 and 0 ≤ b < (q -1). Let also τ be the relative error correcting capability, defined as above. Then, for every δ < τ/2 and every a + 1 ≤ t ≤ m -1, the Reed-Muller code RM q (m, r) is a perfectly smooth (q t -1, δ, δ/τ)-locally correctable code, using Algorithm 2.

Proof. We use the same arguments as for Hadamard codes. First, we notice that Algorithm 2 is smooth: every point is chosen with probability p = (q t -1)/q m . Let us now bound its probability of success.

Denote by S = F m q , |S| = n. Let g = f + e ∈ F S q , where f ∈ RM q (m, r), e ∈ F S q with E = supp(e) and |E| ≤ δn. Let also A u represent the random queries made by LC (g) (u). We know the algorithm succeeds if |E ∩ A u | ≤ w, where 1

+ 2w = d min (RM q (t, r)) -1. Hence, Pr(LC (g) (u) = f (u)) ≥ 1 -Pr(|E ∩ A u | ≥ w + 1) ≥ 1 - E(|E ∩ A u |) w + 1 by Markov's inequality. Let us now estimate E(|E ∩ A u |).
By linearity

E(|E ∩ A u |) = ∑ v∈E Pr(v ∈ A u ) = ∑ v∈E p ≤ δq m q t -1 q m = δ(q t -1) .
Finally, we get

Pr(LC (g) (u) = f (u)) ≥ 1 - δ(q t -1) τ(q t -1) + 1 ≥ 1 - δ τ .
Many parameters are involved in Proposition 2.8. If we fix the degree r of the Reed-Muller code, there remains freedom for the choice of t. We see that t affects exponentially the locality, but its influence on τ is moderate, since we have approximately τ (qb)q -(a+1) /2. Therefore, choosing the minimum t = a + 1 appears to be the most relevant choice since the locality is a crucial parameter.

A second local correcting algorithm for RM codes. In Algorithm 2, the strategy was to use the full correcting capability of the local code C |A RM q (t, r), hoping that the number of errors on the queried symbols does not exceed the packing radius w of C |A . One can reduce the locality at the expense of an increase of the failure probability. Simply, the idea is to pick at random a map φ ∈ Iso(F t q , A) and an information set I ⊂ A for the local code C |A , and then to query the noisy codeword only on I. Hoping for no corrupted symbols on I, we get an LCC of locality = dim(C |A ) = dim(RM q (t, r)).

A minor difficulty appears if we require smoothness. Indeed we need that each individual query is uniformly distributed over the support F m q , when information sets I are picked at random. Fortunately, Reed-Muller codes admit an automorphism group which contains the doubly-transitive group Aff(F t q ) of affine transformations. Therefore, if I is a fixed information set for RM q (t, r), then every elements of its orbit under Aff(F t q ) is also an information set for RM q (t, r). Hence, it allows us to define the smooth query generator given in Algorithm 3.

Let us first explain why our choice of p = q t - q m -makes Algorithm 3 smooth.

Lemma 2.9. In Algorithm 3, for every u, v ∈ F m q and every information set I for RM q (t, r) we have:

Pr(v ∈ Query(u, I)) = q m ,
where = |I|. Input: a coordinate u ∈ F m q , an information set I for RM q (t, r). Output: an affine injective map φ ∈ Aff(F t q , F m q ) such that u ∈ im(φ) and J = φ(I) satisfies Pr(v ∈ J) = /q m for every v ∈ F m q , where = |I|. 1 Pick uniformly at random ψ ∈ Aff(F t q , F m q ) such that u ∈ im(ψ).

do 3

Pick σ ∈ Aff(F t q ) uniformly at random, and define J = (ψ • σ)(I).

4

Toss a binary coin b ∈ {0, 1}, following B(p) with p = q t - q m -. 5 while (u ∈ J and b = 0);

6 Output φ = ψ • σ.
Proof. Let β := /q t represent Pr(u ∈ J) at step 5. A quick analysis shows that

Pr(u ∈ Query(u, I)) = βp + β(1 -p) Pr(u ∈ Query(u, I)) . Thus we get Pr(u ∈ Query(u, I)) = βp/(1 -(1 -p)β). If we set p = (1 -β) (q m -)β = q t - q m - ,
then we get Pr(u ∈ Query(u, I)) = /q m which is one of our requirements. Now, it only remains to notice that, since Aff(F t q ) is doubly-transitive, any other point v = u has equal probability to lie in the image of the output φ. Hence, Pr(v ∈ Query(u, I)) = /q m for every v = u. Now that we are equipped with a smooth query generator, we can define Algorithm 4, a perfectly smooth local correcting algorithm for Reed-Muller codes with smaller locality than in Algorithm 2. We give its analysis in Proposition 2.10.

Algorithm 4:

A perfectly smooth local correcting algorithm of locality = dim RM q (t, r) for the Reed-Muller code RM q (m, r), where r < t(q -1).

Input: u ∈ S := F m q , and an oracle access to g ∈ F S q such that d( f , g) ≤ δn where f ∈ RM q (m, r), where n = |S|. Output: f (u) with high probability. /* We assume that an information set I for RM q (t, r) is given.

*/ 1 Randomly pick φ ← Query(u, I).

2 Compute w = φ -1 (u). 3 Query {(g • φ)(v), v ∈ I}. 4 Interpolate h ∈ RM q (t, r) such that h |I = (g • φ) |I . 5 Output h(w).
Proposition 2.10. Let m ≥ 2 and r = a(q -1) + b such that a ≤ m -1 and 0 ≤ b < q -1. Fix some a + 1 ≤ t ≤ m -1 and denote by t = dim RM q (t, r). Then, for every δ < 1/2 t and every a + 1 ≤ t ≤ m -1, the Reed-Muller code RM q (m, r) is a perfectly smooth ( t , δ, δ t )-locally correctable code, using Algorithm 4.

Proof. Smoothness being proved in Lemma 2.9, let us give a short explanation for the probability of failure. We use the notation of Algorithm 4. Similarly to the proofs of Propositions 2.5 and 2.8, it is sufficient to show that Pr(LC (g)

(u) = f (u)) ≥ 1 -E(|E ∩ J|), where J = φ(I)
and E is the support of errors. Furthermore, E(|E ∩ J|) = δ t holds by linearity of the mean value.

A short analysis of algorithms parameters. The setting t = 1 might be the most interesting to study, since it provides the smallest locality. So for a moment, let us focus on RM q (m, r), r ≤ q -2. Essentially, we learned that:

-Algorithm 2 equips Reed-Muller codes with an ( , δ, δ/τ)-local correcting algorithm, for = q -1 and τ 1 2 (1 -r/q); -Algorithm 4 equips Reed-Muller codes with an ( , δ, δ )-local correcting algorithm, for = r + 1.

Therefore, Algorithm 4 outperforms Algorithm

2 if k < 1/τ, that is, if k q 2 (1 -1 -8/q
). It means that Algorithm 4 should not be neglected when q is moderate and k is small. In every other case, Algorithm 2 allows us to correct much more errors for a small increase of the locality. Now let us focus on asymptotic families of Reed-Muller codes, indexed by their length n = q m . Notice that, when referring to the locality parameter, it is implicitly assumed that Algorithm 2 is used.

1. A first possible construction consists in letting m grow to infinity, all other parameters being fixed. We therefore obtain a family of LCCs with constant locality, but whose rate

R = 1 q m r + m m < 1 m! r + m q m ∼ exp(r) exp(m) q m √ 2πm = O 1 n 1-log q (exp(1))
vanishes quickly for any q ≥ 3. 2. We can then consider the case where both q and r both grow to infinity according to r = ρq, 0 < ρ < 1. In a sense, it means that we fix the local correction capability (see Proposition 2.8). If all other parameters are fixed, then we get a family of LCCs with sublinear locality ≤ n 1/m . The rate is much better than previously: we obtain

R = 1 q m r + m m ∼ 1 m! ρ m
which is a non-zero constant.

Families of codes with positive asymptotic rate are important for practical issues. They lead us to introduce a precise definition of so-called asymptotically good LCCs.

Definition 2.11. Let {C i } i be a family of codes of respective length n i , such that n i → ∞ when i → ∞. The family {C i } i is an asymptotically good family of LCCs if there exists 0 < δ, ε, R < 1 such that for every i, the code C i is ( i , δ i , ε i )-locally correctable, and if we have

δ i , ε i , dim(C i ) n i → (δ, ε, R) when i → ∞ .
From the previous discussion, we see that for ρ ∈ (0, 1), the second family of Reed-Muller codes {RM q (m, ρq)} q defined above is asymptotically good, with R = ρ m /m! and ε ≤ 2δ 1-ρ .

However, the asymptotic rate of RM codes is exponentially small in m, the parameter which quantifies the locality parameter = n 1/m . Moreover, the rate stays stuck below 1/2 for its minimum value (m = 2). In the next two sections, we will show how this barrier has been broken with algebraic constructions, namely the multiplicity codes of Kopparty et al. [START_REF] Kopparty | High-Rate Codes with Sublinear-Time Decoding[END_REF] and the lifted Reed-Solomon codes of Guo et al. [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF].

Multiplicity codes

Presentation. Multiplicity codes define the first family of asymptotically good LCCs achieving rate > 1/2. They were built by Kopparty, Saraf and Yekhanin in the early 2010's [START_REF] Kopparty | High-Rate Codes with Sublinear-Time Decoding[END_REF] and they generalise Reed-Muller codes by evaluating low-degree multivariate polynomials and their derivatives. Indeed, while Reed-Muller codes RM q (m, r) need to satisfy r < q -1 in order to remain non-trivial on lines, multiplicity codes allow higher degrees r thanks to the evaluation of the derivatives of the polynomials.

More formally, let us first introduce the Hasse derivatives of an m-variate polynomial f ∈ F q [X] as the unique collection of polynomials

{H (i) ( f )(X)} i∈N m satisfying f (X + Y) = ∑ i∈N m H (i) ( f )(X)Y i ,
where

Y i := Y i 1 1 . . . Y i m m . For instance, one can check that H (0) ( f ) = f . For s ≥ 0, we define the s-order evaluation of f ∈ F q [X 1 , . . . , X m ] at point u ∈ F m q as ev s ( f )(u) := H (i) ( f )(u) : i ∈ N m , |i| ≤ s ∈ Σ s,m := F T s,m q
where T s,m := {i ∈ N m , |i| ≤ s}. Then, the s-order evaluation vector associated to f is

ev s ( f ) := (ev s ( f )(u) : u ∈ F m s ) ∈ (Σ s,m ) F m q .
A very good point is that for every s ≥ 0 and

m ≥ 1, f → ev s ( f ) is injective as long as deg( f ) < (s + 1)(q -1).
Notation. For c ∈ (F T s,m q ) F m q , we denote by c (i)

x ∈ F q the symbol corresponding to the order of derivation i ∈ T s,m and the coordinate x ∈ F m q .

We are now able to build multiplicity codes properly.

Definition 2.12 (Multiplicity code [START_REF] Kopparty | High-Rate Codes with Sublinear-Time Decoding[END_REF]). Let m ≥ 1, and r, s ≥ 0. Define an alphabet

Σ s,m = F T s,m q , T s,m = {i ∈ N m , |i| ≤ s}.
The multiplicity code Mult q (m, r, s) is the F q -linear code defined over the alphabet Σ s,m , which consists in s-order evaluation vectors of multivariate polynomials with total degree bounded by r. Explicitly:

Mult q (m, r, s) := {ev s ( f ), f ∈ F q [X 1 , . . . , X m ], deg( f ) ≤ r} ⊆ (Σ s,m ) F m q . For m = 1, multiplicity codes Mult q (1, r, s) ⊆ Σ F q
s,1 are also known as derivative codes [START_REF] Guruswami | Linear-Algebraic List Decoding for Variants of Reed-Solomon Codes[END_REF]. They can be efficiently decoded up to half their minimum distance, thanks to an adaptation of the Berlekamp-Welch algorithm [START_REF] Kopparty | High-Rate Codes with Sublinear-Time Decoding[END_REF].

In the following, we will only consider the setting r < (s + 1)(q -1) which is of most interest for local correcting purposes. One must take care that multiplicity codes are defined over the alphabet Σ s,m , but they are F q -linear codes and have dimension dim F q (Mult q (m, r, s)) = r + m m over F q since the evaluation map ev s is injective. Therefore their rate satisfies

R = ( r+m m ) ( m+s m )q m ≥ r + 1 (s + 1)q m .
Local correction. We here give high-level ideas concerning local correction of multiplicity codes. Details are quite technical and can be found in [START_REF] Kopparty | High-Rate Codes with Sublinear-Time Decoding[END_REF][START_REF] Yekhanin | Locally Decodable Codes[END_REF]. Assume one wants to recover ev s ( f )(u). Basically, the idea is to pick at random a certain number of affine lines that pass through u (e.g. |T s,m | lines for Algorithm 5), and to use dependencies between the evaluations of the derivatives in order to recover ev s ( f )(u).

Before being more formal, let us first state a few results whose proofs are given in [START_REF] Kopparty | High-Rate Codes with Sublinear-Time Decoding[END_REF][START_REF] Yekhanin | Locally Decodable Codes[END_REF] for instance. Claim 2.13. For any u ∈ F m q and v ∈ F m q \ {0} we define φ u,v (T) = u + Tv ∈ F q [T]. Assume s ≥ 0 and r < (s + 1)(q -1), and let f ∈

F q [X] such that deg( f ) ≤ r. 1. We have ev s ( f • φ u,v ) ∈ Mult q (1
, r, s), and the following holds

( f • φ u,v )(T) = ∑ i H (i) ( f )(u)v i T |i| . 2. Let u ∈ F m q and V ⊆ F m q \ {0} of size ( m+s m ). Given the knowledge of (( f • φ u,v )(T) : v ∈ V), one can retrieve (H (i) ( f )(u) : |i| ≤ s) by solving a linear system.
Algorithm 5: Outline of a local correcting algorithm for Mult q (m, r, s).

Input: a coordinate u ∈ F m q , and an oracle access to a word y ∈ (Σ s,m ) F m q , such that d(y, c) ≤ δq m for some c ∈ Mult q (m, r, s).

Output: The Σ s,m -symbol c u . 1 Pick at random a subset V ⊆ F m q \ {0} of size ( m+s m ). 2 Query {y u+tv ∈ Σ s,m , t ∈ F q , v ∈ V}. 3 foreach v ∈ V do 4 Build g v = ((∑ |i|=j y (i) u+tv : 0 ≤ j ≤ s) : t ∈ F q ) ∈ Σ F q s,1 .

5

Correct g v with a correcting algorithm for Mult q (1, r, s).

6

Interpolate the output, giving h v (T) ∈ F q [T].

7 Retrieve and output (H (i)

( f )(u) : |i| ≤ s) from (h v (T) : v ∈ V), as in Claim 2.13.
Denote by ∆ := 1 -r/(s + 1)q; informally, ∆ is a lower bound on the relative distance of the derivative code Mult q (1, r, s). Kopparty, Saraf and Yekhanin proposed a first local correcting algorithm [START_REF] Kopparty | High-Rate Codes with Sublinear-Time Decoding[END_REF], which works if few errors occur on the codeword (small δ). This algorithm is given in Algorithm 5, and it outputs the correct symbol as long as there is no more than ∆/2 errors on every queried line. Thus, after analysis of the correction failure, the authors conclude that multiplicity codes are ( , δ, ε)-locally correctable, where

= 1 + (q -1) m + s m , δ = O(∆/ ), ε = O(1) , and their rate R satisfies R ≥ (1 -∆) m .
In order to find asymptotically good families of LCCs, it is natural to let q grow to infinity as we did for Reed-Muller codes. We see that the rate of multiplicity codes can be made arbitrarily close to 1 by choosing r close enough to (s + 1)q. However in this setting, one can check that δ vanishes when q → ∞.

Kopparty, Saraf and Yekhanin proposed to solve this issue by picking a set V of size slightly larger than ( m+s m ), and expecting that most of the queried lines are corrupted with less than ∆/2 errors. Then, step 7 is replaced by solving a so-called noisy linear system and moreover, it can be efficiently done thanks to results of Kim and Kopparty [START_REF] Kim | Decoding Reed-Muller Codes over Product Sets[END_REF]. We also refer to [START_REF] Kopparty | High-Rate Codes with Sublinear-Time Decoding[END_REF][START_REF] Yekhanin | Locally Decodable Codes[END_REF] for more details about this technical improvement; let us simply report their main theorem. Theorem 2.14 (Theorem 10 of [START_REF] Kopparty | High-Rate Codes with Sublinear-Time Decoding[END_REF]). Let q, m, r, s be such that r < (s + 1)(q -1), and let ∆ = 1 -r/(s + 1)q. If q is large enough2 , then Mult q (m, r, s) is ( , δ, ε)-locally correctable, where

≤ q (s + m) m m! , δ = ∆/10, ε ≥ 0.8 .
Therefore, if we consider a sequence of multiplicity codes Mult q (m, r, s) with increasing q and a parameter ∆ = 1 -r/(s + 1)q upper bounded by some constant 1τ, then we obtain Theorem 2.15 (Theorem 3 of [START_REF] Kopparty | High-Rate Codes with Sublinear-Time Decoding[END_REF]). Let m, s be fixed integers and τ > 0. For large enough prime powers q = Ω(m, s, 1/τ), let r q be such that τ(s + 1)q ≤ r q < (s + 1)(q -1). Then the sequence {Mult q (m, r q , s)} q defines an asymptotically good family of LCCs of length n over Σ s,m , with

= Θ(n 1/m ), δ = Θ(1 -τ), ε ≥ 0.8 and rate R ≥ τ m .
Notice that the locality parameter is sublinear in the code length, and the exponent of sublinearity 1/m can be set arbitrarily small.

Lifted codes

Presentation. Chronologically, lifted Reed-Solomon codes are the second class of high-rate LCCs that has been designed [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF]. They also generalise Reed-Muller codes, but in a very different manner. We have seen that multiplicity codes [START_REF] Kopparty | High-Rate Codes with Sublinear-Time Decoding[END_REF] solved the low dimension drawback of Reed-Muller codes by a modification of the evaluation map, taking into account formal derivatives of the polynomials.

Guo, Kopparty and Sudan [GKS13] used a different approach and considered the whole set of multivariate polynomials that interpolate into a low-degree polynomial when restricted to any affine line. Quite surprisingly, under some arithmetic conditions it appears that this set contains more polynomials than the low-degree ones evaluated in Reed-Muller codes. Example 2.16 illustrates this property with small parameters. Notice that first appearances of the lifting process can be found in [START_REF] Ben-Sasson | Symmetric LDPC Codes are not Necessarily Locally Testable[END_REF][START_REF] Ben-Sasson | Limits on the Rate of Locally Testable Affine-Invariant Codes[END_REF].

Example 2.16. Consider the Reed-Muller code RM q (m, r)

with q = 4, m = 2 and r = 2. Let f (X, Y) = X 2 Y 2 and c = ev F 2 4 ( f ) ∈ F F 2 4 4 .
One can easily check that c / ∈ RM 4 (2, 2), since f has total degree 4 > 2. Any restriction of c to an affine line of F 2 4 can be written ev F 4 (g), where

g ∈ F 4 [T] is defined by g(T) = f (aT + b, cT + d)
for some a, b, c, d ∈ F 4 , such that ac = 0. Since char(F 4 ) = 2, we then get:

g(T) = (aT + b) 2 (cT + d) 2 = a 2 c 2 • T 4 + (a 2 d 2 + b 2 c 2 ) • T 2 + b 2 d 2 .
Let us now notice that ev F 4 (T 4 ) = ev F 4 (T), hence ev F 4 (g) is actually the evaluation of a univariate polynomial of degree at most 2. To sum up, c is the evaluation of a bivariate polynomial of degree 4, such that its restriction to any affine line of F 2 4 corresponds to the evaluation of a univariate polynomial of degree at most 2.

Let us now introduce the construction of Guo, Kopparty and Sudan in its full generality, where the authors define the lifting of any affine-invariant code. An affine-invariant code is a code C ⊆ F S q , S = F t Q and F Q an extension of F q , which satisfies Aff(S) ⊆ Aut(C).

Definition 2.17 (lifting of affine-invariant codes [GKS13]

). Let C ⊆ F S q , be an affine-invariant code, where S = F t Q and F Q is an extension of F q . The lifting of order m ≥ t of C is:

Lift(C, m) = ev F m Q ( f ), f ∈ F Q [X], such that ev F t Q ( f • φ) ∈ C for every φ ∈ Aff(F t Q , F m Q ) . One can check that Lift(C, m) ⊆ F F m Q q is an F q -linear code, invariant under Aff(F m Q ).
In their work [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF], the authors give several constructions by letting different parameters vary (e.g. m, t, log q (Q), etc.). Here we will mainly focus on settings that give rise to high-rate LCCs, namely Q = q and t small, and particularly t = 1.

Full-length Reed-Solomon codes define a typical family of affine-invariant codes supported by the affine line F q . By definition, their lift consists in the evaluation of every m-variate polynomial which corresponds to a low-degree univariate polynomial when restricted to any affine line of the space F m q . We have seen previously that Reed-Muller codes satisfy this property; therefore lifted Reed-Solomon codes contain Reed-Muller codes.

Proposition 2.18. For every 0 ≤ r ≤ q -1, we have

RM q (m, r) ⊆ Lift(RS q (r), m) . Proof. Thanks to Lemma 2.6, for all c = ev F m q ( f ) ∈ RM q (m, r) and φ ∈ Aff(F t q , F m q ), there exists g ∈ F q [X 1 , . . . , X t ], such that ev F t q (g) = ev F t q ( f • φ) and deg(g) ≤ r.
Kaufman and Ron proved in a paper [START_REF] Kaufman | Testing Polynomials over General Fields[END_REF] anterior to Guo et al.'s work, that RM q (m, r) = Lift(RS q (r), m) as long as r < qq p , where p = char(F q ). But for higher degrees r, the inclusion can be strict, as we have seen in Example 2.16.

More details concerning the construction of lifted Reed-Solomon codes will be given in Chapter 3.

Here we only report one of Guo et al.'s results, asserting for any order m the existence of lifted Reed-Solomon codes of rate arbitrary close to 1 and constant relative distance. For readability we give a simplified version where m is a power of 2.

Theorem 2.19 (High-rate high-error construction of

[GKS13], simplified). Let α ≥ 1 and m = 2 µ . Define c = 2(1 + µ)m2 m α, and assume q = 2 s where s ≥ c. Finally, let C = RS q ((1 -2 -c )q -1). Then, the lifting Lift(C, m) has rate R ≥ 1 -2 -α .
Local correction. Lifted Reed-Solomon codes have the same properties as Reed-Muller codes when restricted to affine lines. Therefore, when specified with t = 1, Algorithms 2 and 4 provide perfectly smooth local correction to lifted Reed-Solomon codes. We here propose another local correcting algorithm, which (i) generalises both previous algorithms in a sense that the locality can be any integer between k and q -1 (ii) is simpler than Algorithm 4, since Reed-Solomon codes are MDS and therefore admit any k-subset of F q as an information set. This generic local correcting algorithm is given in Algorithm 6. It is analysed in Proposition 2.20. Proposition 2.20. Let k + 1 ≤ ≤ q -1, and denote by t = -(k+1) 2 . Then, using Algorithm 6, for every δ ≤ t+1 2 the code Lift(RS q (k), m) is a smooth ( , δ, δ t+1 )-locally correctable code.

Algorithm 6: A perfectly smooth local correcting algorithm of locality ∈ [k + 1, q -1] for the lifted Reed-Solomon code C = Lift(RS q (k), m).

Input: a point u ∈ S := F m q , and an oracle access to g ∈ F S q such that d( f , g) ≤ δn, for some f ∈ C, where n = |S|. Output: f (u) with high probability. /* Corr A denotes a half-distance (q -)-erasure correcting algorithm for the code C |A isomorphic to RS q (k). */ 1 Pick uniformly at random φ ∈ Aff(F t q , F m q ) such that u ∈ A := im(φ). 2 Toss a random binary coin b ∈ {0, 1} following B(p), where p := /q m . 3 if b = 0 then 4 Pick uniformly at random a subset A ⊂ A \ {u} of size .

else 6

Pick uniformly at random a subset

A ⊂ A \ {u} of size -1. 7 Add u in A . 8 Query {g(v) : v ∈ A }. 9 Define g ∈ (F q ∪ {⊥}) A by g |A = g |A and g (v) =⊥ for every v ∈ A \ A . 10 Run Corr A on input g . 11 if Corr A fails then 12 Abort.

else 14

Denote by h ∈ F A q the output of Corr A . Output h(u).

Proof. First, we can easily check that the algorithm is smooth. Concerning the extraction success, the method is similar to previous proofs. Denoting by E the support of the errors, Markov's inequality gives:

Pr(LC (g) (u) = f (u)) = 1 -Pr(|E ∩ A | ≥ t + 1) ≥ 1 - E(|E ∩ A |) t + 1 ,
and as usual we have

E(|E ∩ A |) ≤ δ .
As a corollary, when q → ∞ and the parameters t and remain linearly dependent in q, we get asymptotically good LCCs.

Corollary 2.21. Let 0 < τ, ρ < 1 and m ≥ 2 be fixed. Let also ( q ) and (k q ) be sequences of integers such that ρq ≤ k q + 1 ≤ q ≤ q -1 and t q = q -k q -1 2 satisfies t q +1 q ≥ τ. Then, the sequence of codes {Lift(RS q (k q ), m)} q defines an asymptotically good family of LCCs with ε ≤ δ/τ and rate R = dim(Lift(RS q (k q ), m))/q m . Moreover, their rate R is larger than ρ m /m!, and their locality satisfies = Θ(n 1/m ).

From Corollary 2.21, one sees that we can obtain asymptotically good high-rate LCCs if we manage to find specific sub-sequences of q and k q such that Lift(RS q (k q ), m) has large dimension. Such instances have been found by Guo, Kopparty and Sudan, as we reported in Theorem 2.19. Therefore, we get the following asymptotic result. Theorem 2.22. For fixed m = 2 µ and α ≥ 1, and choosing maximum locality = q -1, the sequence of codes indexed by q given in Theorem 2.19 is an asymptotically good family of LCCs, with

R ≥ 1 -2 -α and ε ≤ 2δ 1 1 -R 2(1+µ)m2 m .
Proof. Applying Theorem 2.19 and Corollary 2.21 leads to ε ≤ 2 c+1 δ, where c is defined in Theorem 2.19.

A short comparison between multiplicity and lifted codes

Guo proposed in [START_REF] Guo | High-Rate Locally Correctable Codes via Lifting[END_REF] a comparison between the asymptotic parameters of lifted Reed-Solomon codes and multiplicity codes. This comparison is mostly based on the bound on the rate R of Lift(RS q ((1 -2 -c )q -1), m) given in Theorem 2.19. However, this bound is far from being tight, especially for small values of m. For instance, in the case m = 2 the bound states that R ≥ 1 -((1/2) 1/32 ) c , while the actual asymptotic rate, given in Proposition 3.63 is

R ∞ = 1 - 5 4 3 4 c + 1 4 1 4 c .
For this reason, we choose to focus our comparison on codes of finite length, whose rate can be explicitly computed. In Figure 2.1, we give a few diagrams presenting high-rate multiplicity and lifted codes. Let us give a few explanations. Given two reals 0 < δ, λ < 1 -for instance δ = 1/16 and λ = 0.01 for the first subfigure -we plot all lifted codes and multiplicity codes with relative distance approximately δ and relative locality /n less than λ. Red dots represent multiplicity codes Mult q (m, r, s) for various values of s, r and m. Blue dots represent lifted codes of order 2 (in other words, the codes Lift(RS q ((1δ)q, 2)) satisfying the previous requirements). We also remove every code with rate < 0.2 for clarity.

Figure 2.1 confirms a usual observation (see [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF][START_REF] Guo | High-Rate Locally Correctable Codes via Lifting[END_REF] for instance): lifted codes attain rates above 1/2 with shorter lengths than multiplicity codes. However, multiplicity codes allow us to reach higher rates.

We end this section by reporting a construction due to Wu [START_REF] Wu | Revisiting the Multiplicity Codes: A New Class of High-Rate Locally Correctable Codes[END_REF], which crosses lifted codes and multiplicity codes. More precisely, the author considers the space of multivariate polynomials f ∈ F q [X], whose s-order evaluation vector ev (s) ( f ), when restricted to any affine line, lies in Mult q (1, r, s). Furthermore, for some range of parameters, this space strictly contains the multiplicity code Mult q (m, r, s). Notice that for s = 0, one retrieves the lifted Reed-Solomon code construction of Guo et al. [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF].

Other constructions and bounds

In this section we quickly report recent constructions and current bounds related to LDCs and LCCs. Notice that, when their dimension is small, it is not clear that LDCs and LCCs can achieve the same parameters since we require local correction of much more symbols in LCCs. Different regimes must be taken into account:

-The positive rate, or high-rate regime consists in studying families of codes whose asymptotic rate is non-zero. We then look for codes admitting the lowest possible locality as a function of the dimension k (or equivalently the length n). -In the constant locality regime, we consider families of LCCs with fixed locality , and we focus on finding codes with lowest length n compared to the dimension k. Usually, the settings = 2, = 3 and > 3 are studied separately. -The sublinear locality regime consists in seeing as a sublinear function of the dimension k (or of the length n if the code rate is non-zero). In this context we can write = k β for some constant 0 < β < 1 (that can be made arbitrary close to 0), and we try to find codes with highest possible rate, or approaching well-known bounds such as the Singleton bound.

We will sometimes use the binary L-notation to easily represent asymptotic complexities. Recall it is defined by:

L k (a, b) = 2 (b+o(1))(log k) a (log log k) 1-a .
Parameter a is the most relevant: L k (1, b) represent complexities exponential in log k, while L k (0, b) complexities polynomial in log k, with degree bounded by b.

Constructions

Matching vector codes. Matching vector codes (MVCs) define a broad class of LDCs performing well in the constant locality regime. They were introduced in a seminal paper of Yekhanin [START_REF] Yekhanin | Towards 3-query Locally Decodable Codes of Subexponential Length[END_REF], and then developed in a large series of works, notably [Efr12, DGY11, BDL14, SY11].

MVCs are based on the existence of so-called matching families. Denote by Z r = Z/rZ and fix A ⊂ Z r \ {0}. Also recall that •, • represents the usual inner product. An A-matching family of size k is a pair of ordered lists U = (u (1) , . . . , u (k) ), V = (v (1) , . . . , v (k) ) of elements in Z m r , satisfying u (i) , v (i) = 0 and u (i) , v (j) ∈ A for all 1 ≤ i, j ≤ k, i = j. Now, assume that F × q admits a multiplicative subgroup of order r, denoted D r , generated by g. For w ∈ Z m r and v an element of the list V, define a so-called multiplicative line L v,w = {g w+λv , λ ∈ Z r } , where g w+λv represents the k-tuple (g w 1 +λv m , . . . , g w k +λv m ) ∈ D m r .

Let now u be an element in the list U. Then it holds that

∀g w+λv ∈ L v,w , (g w+λv ) u = g u,w (g λ ) u,v . (2.2)
In other words, the evaluation of the multivariate monomial X u on the multiplicative line L v,w corresponds to the evaluation of the univariate monomial f (Y) = g u,w Y u,v on D r = {g λ , λ ∈ Z r }. This property will be used to define codes with a local decoding procedure.

Given (U, V) an A-matching family of size k, one can define the matching vector code as the evaluation code over D m r of polynomial functions in Span{X u , u ∈ U}. That is,

MVC(U) := k ∑ j=1 m j x u (j) : x ∈ D m r , m ∈ F k q ⊆ F D m r q . (2.3) Let now v (i) ∈ V and w ∈ Z m r . If F = ∑ k j=1 m j X u (j)
, then using (2.2) and the definition of a matching family, we see that

F(g w+λv (i) ) = k ∑ j=1 m j g u (j) ,w (g λ ) u (j) ,v (i) = m i g u (i) ,w + ∑ a∈A   ∑ u (j) ,v (i) =a m j g u (j) ,w   (g λ ) a .
In other words, if c = ev D m r (F) ∈ MVC(U), then for every g w+λv (i) ∈ L w,v (i) we have F(g

w+λv (i) ) = f i (g λ ) where f i (Y) = x i g u (i) ,w + ∑ a∈A   ∑ u (j) ,v (i) =a x j g u (j) ,w   Y a (2.4)
is a univariate polynomial composed by monomials Y a , for a ∈ A ∪ {0}. Thus, the restriction of c to multiplicative lines L w,v i admit a non-trivial structure that can be used for correction purposes. Specifically, a local decoding algorithm follows, depicted in Algorithm 7.

Algorithm 7: Outline of an local decoding algorithm for C = MVC(U) equipped with the encoder E implicit in (2.3). The pair (U, V) is an A-matching family, |A| = -1.

Input: a coordinate i ∈ [1, k],
and an oracle access to h ∈ F S q , S = D m r such that d(E(m), h) ≤ δr m , for some m ∈ F k q . Output: m i with high probability.

1 Pick uniformly at random w ∈ Z m r . 2 Define Q = {g w+λv (i) , 0 ≤ λ ≤ -1} ⊂ L w,v (i) . 3 Query {h(x), x ∈ Q}. 4 Interpolate the associated univariate polynomial f i (Y). 5 Output f (0)/g u (i) ,w .
We should clarify that step 4 of Algorithm 7 essentially consists in inverting a Vandermonde matrix. Hence, the output is correct as long as there is no error on the queries, since f i (0) = x i g u (i) ,w according to (2.4). Therefore, after analysis of the success probability, one can prove that Algorithm 7 is a perfectly smooth ( , δ, δ )-local decoding algorithm for C = MVC(U), where (U, V) is an A-matching family, |A| = -1.

As for Reed-Muller codes, another strategy consists in querying more values on the multiplicative line L w,v (i) even if we need to correct a few errors on it. This correction can be performed as long as the univariate polynomial f (Y) has low degree. Thus, for b ≥ 0 we say that (U, V) is b-bounded if for all a ∈ A, we have a ≤ b (where a ∈ Z r is seen as an integer bounded by r -1).

We obtain: Proposition 2.23. Let σ > 0. If there exists a σm-bounded A-matching family (U, V) in Z m r of size k, then the code C = MVC(U) is (m, δ, 2δ/(1σ))-locally decodable, for all δ < (1σ)/4.

MVCs with good local properties rely on the existence of A-matching families in Z m

r with small m and large k. In a series of papers (e.g. [START_REF] Grolmusz | Superpolynomial Size Set-Systems with Restricted Intersections mod 6 and Explicit Ramsey Graphs[END_REF][START_REF] Grolmusz | Constructing Set Systems with Prescribed Intersection Sizes[END_REF]), Grolmusz provides explicit constructions of such families. Some of them are based on multilinear polynomials modulo composite integers; we refer to [Gro00, Gro02] and Yekhanin's survey [START_REF] Yekhanin | Locally Decodable Codes[END_REF] for details. Let us only report the asymptotic families of LDCs they induce, which currently define some of the best families in the constant locality regime. Proposition 2.24. (based on [START_REF] Dvir | Matching Vector Codes[END_REF][START_REF] Efremenko | 3-Query Locally Decodable Codes of Subexponential Length[END_REF] and subsequent works) For large enough > 3, there exist asymptotic families of ( , δ, O(1))-locally decodable matching vector codes of dimension k, with the following parameters:

1. in the low-error regime (precisely,

δ = O(1/ ) when → ∞), the length n = 2 f (k, ) of the codes satisfies f (k, ) = L k (1/ log , 1) ; 2. in the high-error regime (precisely, δ = 1/4 -O(1/ log log ) when → ∞), the length n = 2 f (k, ) of the codes satisfies f (k, ) = L k (α , log ) , with α = O log log log .
Expander codes. Expander codes were initially introduced by Sipser and Spielman [START_REF] Sipser | Expander Codes[END_REF], and have been proven to provide an asymptotically good family of codes with efficient decoding algorithms [START_REF] Zémor | On Expander Codes[END_REF][START_REF] Barg | Distance Properties of Expander Codes[END_REF]. Shortly after the high-rate breakthroughs [KSY14, GKS13], Hemenway, Ostrovsky and Wootters [START_REF] Hemenway | Local Correctability of Expander Codes[END_REF] showed that some families of expander codes also admit sublinear local correcting algorithms from a constant fraction of errors, while preserving a rate arbitrary close to one.

Expander codes are named after expander graphs. Given a graph G = (V, E), we denote by E(v) := {{v, w} ∈ E} the edges incident to v, and the neighbourhood of a subset of vertices Denote by G = (V , E ) the double cover of G = (V, E). In other words, G is a bipartite graph where

W ⊆ V is N(W) := {v ∈ V | ∃w ∈ W, {v
V = V 0 V 1 (V 0 , V 1 being disjoint copies of V) and (u 0 , v 1 ) ∈ E if {u 0 , v 1 } ∈ E. Let C 0 ⊆ F d q be a code of relative distance δ 0 and rate r 0 . Finally, let Φ = {φ v : [1, d] → E (v)} v∈V be a collection of bijective maps indexed by v ∈ V .
Definition 2.25 (Expander code). For C 0 , G, Φ defined as above, and a given finite field F q , the associated expander code is:

Exp(C 0 , G, Φ) = {c ∈ F E q such that ∀v ∈ V , c • φ v ∈ C 0 } ⊆ F E q . Code C 0 is called the inner code of Exp(C 0 , G, Φ).
Before getting into the main result of Hemenway et al., we need a last definition. We say that (Q, R) is an (s, 0 )-smooth local reconstructing algorithm for C 0 ⊆ F d q if, for every 1 ≤ i ≤ d, 1. Q(i) outputs random subsets of [1, d] of size less than 0 ; 2. there exists S i of size s such that Q(i) is uniformly distributed over S i ; 3. R is deterministic and R(c

|Q , Q) = c i for all Q ← R Q(i) and c ∈ C 0 .
In a sense, an (s, 0 )-smooth local reconstructing algorithm can be thought as a local decoding algorithm, with specific smoothness requirements for the queries, but working only without errors on the codeword. Finally, Hemenway et al. [START_REF] Hemenway | Local Correctability of Expander Codes[END_REF] proved the following result concerning local correctability of expander codes.

Theorem 2.26 (Theorem 5 in [HOW15]

). Let C 0 , G, Φ as above, and equip C 0 ⊆ F d q with an (s, 0 )smooth local reconstructing algorithm. Denote by

0 = 0 + d -s. Let also γ < 1/2 and ζ > γ such that 8λ < γ/(e ζ 0 ) 1/γ . Then, for any δ < γ/(e ζ 0 ) 1/γ -2λ, the code Exp(C 0 , G, Φ) is an ( , δ, ε)-LCC of length n = |V|d, with = |V| α , α = 1 + ln( 0 ) + 1 ζ -γ • ln( 0 ) ln(d/4) and ε = 1 |V| 1/ ln(d/4
) . Moreover, the rate of Exp(C 0 , G, Φ) is at least 2r 0 -1, where r 0 is the rate of C 0 .

We just sketch the principle of the local correction (for details, see [START_REF] Hemenway | Local Correctability of Expander Codes[END_REF] or Wootters' PhD thesis [START_REF] Wootters | Any Errors in this Dissertation Are Probably Fixable: Topics in Probability and Error Correcting Codes[END_REF]). Assume we want to retrieve symbol c(e), e = (u, v) ∈ E . The algorithm consists in three steps.

1. Compute a subset of edges S ⊂ E which is merely independent from e. We know that the map

φ u : [1, d] → E (u) is such that c • φ u ∈ C 0 . Therefore, we can use the query generator Q to generate a set S 1 = {(u 0 = u, s (i) 1 ), 1 ≤ i ≤ 0 } satisfying R(c • φ u , φ -1
u (e)) = c(e). We name T 1 the tree with root e and leaves S 1 . It is possible that edges in S 1 are still not uniformly distributed over E (they are too close to e), so let us repeat the previous procedure on every edge in S 1 . The tree we get is called T 2 . Inductively, there will exist an L > 0 such that leafs S L of tree T L are close to uniform over E (a good point is that neither L nor S is too large since G is an expander code). At this time we define S := S L . 2. Recover all c( f ), f ∈ S, with high probability. Now S is uniformly distributed over E , hence we know that c( f ), f ∈ S, is correct with probability merely 1δ. In order to correct c( f ) w.h.p., once again we compute trees T

( f ) M of depth M. Without diving into details, by querying values c( f ), f ∈ T ( f )
M (that are possibly corrupted), and then applying in-depth majority-logic decoding, we retrieve w.h.p. each correct coordinates c( f ).

3. Retrieve c(e). Assuming we get correct values c( f ), f ∈ S, it is now easy to go back up the initial tree T L until we reach its root, and with the help of algorithm R we recover c(e). Notice this last step outputs the desired symbol c(e) as soon as all the c( f ), f ∈ S are correctly recovered.

Other algebraic constructions. Table 2.1 summarises parameters of the constructions we presented above. We only give bounds or asymptotics of these parameters when exact values are unknown or hard to interpret. supported by the Hermitian curve), or a so-called fractal decoding where a tree of local Hermitian curves to be queried is computed. Notice that the notion of degree-lifting mentioned in [BGK + 13] is different from the lifting process of Guo et al. [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF]; indeed it refers to the way of weighing monomials in order to construct the space of multivariate polynomials to be evaluated. However, codes in [BGK + 13] still have rate bounded by 1/m! while their locality is = O(n 1/m ); compared to Reed-Muller codes the quantitative improvement consists essentially in the size of the alphabet.

Construction LCC (n) k(n) ε(δ) Hadamard code Had 2 (m) yes 2 log(n) 2δ RM q (m, (1 -2τ)q) (Algo. 2) yes n 1/m ≤ (1-2τ) m m! • n δ/τ RM q (m, (1 -2τ)q) (Algo. 4) yes (1 -2τ)n 1/m ≤ 1 m! • n (n) • δ Mult q (m, τ(s + 1)q, s) yes ≥ s m m! • n 1/m ≥ τ m • n ≥ 0.8 Lift q (RS q ((1 -2 -c )q), m), yes n 1/m ≥ (1 -2 -α ) • n ≤ 2 n n-k(n) c with c = 2(1 + log(m))m2 m α Matching vector code no O 2 (log log n) log O(
(2τ -1) • n n d -Θ(1/ log d) [d, τd] local code C 0
Following his work on the affine space [GKS13], Guo [START_REF] Guo | High-Rate Locally Correctable Codes via Lifting[END_REF] proposed to increase the rate of previous codes by computing an actual lift of Hermitian codes on the Cartesian product H m . To this end, the author adopts a more generic framework where he considers the lifting process with respect to a set a maps. Formally, if C 0 ⊆ F S q and Φ is a collection of maps S m → S, the lift of C 0 with respect to Φ is

Lift Φ (C 0 ) := {c ∈ F S m q | ∀φ ∈ Φ, c • φ ∈ C 0 } . (2.5)
Of course, the definition given in (2.5) can be paired with Definition 2.17. But one also should remark formal similarities with the definition of expander codes, even though they instantiate very differently (polynomials and algebraic varieties for lifted codes vs. graphs and combinatorial structures for expander codes).

Finally, we report a recent construction of high-rate LCCs with query complexity subexponential in log n, given by Kopparty, Meir, Ron-Zewi and Saraf [START_REF] Kopparty | High-Rate Locally Correctable and Locally Testable Codes with Sub-Polynomial Query Complexity[END_REF]. They build LCCs of length n, constant rate arbitrarily close to 1, constant relative distance and locality L n (1/2, 1). Notice this is an exponential improvement compared to other high-rate LCC (multiplicity codes, lifted codes, expander codes) whose locality is L n (1, α) for arbitrary α > 0. The construction is very elaborate, and mixes multiplicity codes in a low-error regime with the Alon-Luby distance-amplification method [START_REF] Alon | A Linear Time Erasure-Resilient Code with Nearly Optimal Recovery[END_REF], by using expander graphs and concatenation of codes.

Bounds

We here report a few lower bounds on the length of LDCs and LCCs, depending on their dimension and locality. In the low-dimension regime, recall we must take care to distinguish locally decodable and locally correctable codes, since the last ones are much more constrained. Indeed, LCCs require local recovery of any codeword symbol, while in LDCs this requirement must be met only for information symbols. If k n, this difference can be crucial.

Most of current bounds on codes with locality were established for LDCs. The reason is that authors mainly focused on the constant locality regime, for which LDCs might attain higher dimensions than LCCs. In this section we quickly report some of these bounds, as well as some bounds on LCCs when they exist.

When the locality is 1, Katz and Trevisan [START_REF] Katz | On the Efficiency of Local Decoding Procedures for Error-Correcting Codes[END_REF] proved that every (1, δ, ε)-LDC which encodes binary strings (that is, a code C ⊆ Σ n equipped with an encoder E :

F k 2 → C) must have constant dimension k ≤ log(|Σ|) δ(1-H(ε)) , where H(x) = -x log x -(1 -x) log(1 -x)
is the binary entropy function. For larger but constant localities ≥ 2, they used a graph theoretic formalism to prove the following result.

Theorem 2.27 (Theorem 6 in [START_REF] Katz | On the Efficiency of Local Decoding Procedures for Error-Correcting Codes[END_REF]). Let C ⊆ Σ n , equipped with an encoder E : F k 2 → Σ n , be an ( , δ, ε)-locally decodable code. Then:

n ≥ (1/2 -ε)δ 2 1 -1 3k(1 -H(ε)) 4 log(|Σ|) 1+ 1 -1 (2.6) Asymptotically, Equation (2.6) rewrites n = Ω(( k log(|Σ|) ) 1+ 1 -1 ) when k → ∞.
Therefore, Theorem 2.27 shows that, for constant locality and alphabet size, there cannot exist asymptotically good families of LDCs. However, the gap between this bound and existing constructions is still exponential: for instance, for = 2, binary Hadamard codes satisfy n = 2 k -1.

In the early 2000's, Goldreich, Karloff, Schulman, and Trevisan proved that linear LDCs with locality 2 must have exponential length n = 2 Ω(k) [START_REF] Goldreich | Lower Bounds for Linear Locally Decodable Dodes and Private Information Retrieval[END_REF]. Kerenidis and de Wolf [START_REF] Kerenidis | Exponential Lower Bound for 2-query Locally Decodable Codes via a Quantum Argument[END_REF] generalised the result to unrestricted codes, using arguments from quantum information theory. Notice that both results were stated for finite fields of bounded size; Dvir and Shpilka then proved it for any (possibly infinite) field [START_REF] Dvir | Locally Decodable Codes with Two Queries and Polynomial Identity Testing for Depth 3 Circuits[END_REF]. Notice that this means that Hadamard codes are essentially optimal LDC for locality = 2. Concerning LCCs, it is shown in [START_REF] Bhattacharyya | Tight Lower Bounds for Linear 2-query LCCs over Finite Fields[END_REF] that 2-queries LCCs over F p must have length n = p Ω(δk) . This induces an exponential gap between the length of optimal 2-queries LDCs over F p (e.g. the p-ary Hadamard code) and lower bounds on the length of 2-queries LCCs over the same alphabet. For infinite fields, it is even proved in [BDYW11] that 2-queries LCCs must have bounded dimension k = O(1/δ 9 ) regardless of their length. For = 3, a series of papers including [START_REF] Yekhanin | Towards 3-query Locally Decodable Codes of Subexponential Length[END_REF][START_REF] Efremenko | 3-Query Locally Decodable Codes of Subexponential Length[END_REF] proved constructively that subexponential length is achievable. On the opposite, Katz and Trevisan's lower bound has been improved into a quadratic one (n = Ω(k 2 )) by Woodruff in [START_REF] David | A Quadratic Lower Bound for Three-Query Linear Locally Decodable Codes over Any Field[END_REF], slightly raised to n = Ω(k 2+α ), α > 0, for codes over reals in [START_REF] Dvir | Superquadratic Lower Bound for 3-Query Locally Correctable Codes over the Reals[END_REF]. Still, there remains an exponential gap for the length of 3-queries LDCs, between existing constructions and proven lower bounds.

For larger but constant localities > 3, only a few results are known. They are mostly based on reduction from queries to 2, and then using above bounds. This way, Woodruff [START_REF] David | New Lower Bounds for General Locally Decodable Codes[END_REF] obtained a bound n = Ω(k 1+1/( /2 -1) ) when k → ∞.

LCCs from a design theory perspective

In this section, we study the links between designs and locally correctable codes. The intuition is that, in a code C based on a well-structured design (say, a 2-design), blocks support paritycheck equations for C whose coordinate are uniformly distributed over the support of the code. Hence, regardless of quantitative parameters, a design naturally induces a locally correctable code. The converse construction is however trickier. Indeed, few assumptions are made concerning the queries and the reconstruction step of a generic LCC. Notice that the link between LCCs and designs has been studied in [START_REF] Barkol | On Locally Decodable Codes, Self-Correctable Codes, and t-Private PIR[END_REF] where the authors show that LCCs based on secret sharing schemes give rise to almost 2-designs, in the sense that the incidence requirements of 2-designs hold for almost every points and blocks.

We should emphasize that we do not claim to give new constructions of LCCs achieving specifically good parameters in this section. The incentive is to propose a generic conversion from combinatorial structures such as block designs, into linear codes admitting a probabilistic local correcting algorithm. Nevertheless, we hope that this perspective can open new tracks of research for constructions (or bounds) of locally correctable codes.

Formulating some LCCs as design-based codes

We begin by noticing that binary Hadamard codes can be seen as design-based codes. Recall that PG 1 (m, 2) denotes the classical design of points and lines in the projective space over F 2 .

Proposition 2.28. Let m ≥ 2. Denote by S = F m 2 \ {0} and by P m-1 the projective space of order (m -1) over F 2 . Then Had 2 (m) ⊂ F S 2 and Code 2 (PG 1 (m -1, 2)) ⊂ F P m-1 2 are permutationequivalent, through the canonical bijective map S → P m-1 .

Proof. We identify affine points in S and projective points in P m-1 since we are over F 2 , meaning we work up to the canonical bijection

S → P m-1 . Let ev S ( f ) ∈ Had 2 (m), where f ∈ F 2 [X 1 , . . . , X m ] is a linear form over F m 2 .
Then, for any projective line L = {u, v, u + v} of P m-1 , we have:

∑ x∈L f (x) = f (u) + f (v) + f (u + v) = 0 since f has degree 1 and 1 = -1 over F 2 . Therefore ev S ( f ) ∈ Code 2 (PG 1 (m -1, 2)). Let now c ∈ Code 2 (PG 1 (m -1, 2
)) be a non-zero codeword. Denote by e i the i-th element of the canonical basis of F m 2 . By induction on the Hamming weight of x ∈ P m-1 , one can prove that c x = ∑ i:x i =1 c e i , and thus we get

c x = f c (x) where f (X 1 , . . . , X m ) = m ∑ i=1 c e i X i
as degree 1. This proves that c ∈ Had 2 (m).

The same kind of relation lies between Lift(RS q (q -2), m) and the classical affine design AG 1 (m, q). Proposition 2.29. Let m ≥ 1. It holds:

Lift(RS q (q -2), m) = Code q (AG 1 (m, q)) . Proof. Recall that c = ev F m q ( f ) ∈ F F m q q
lies in Lift(RS q (q -2), m) if and only if for all φ ∈ Aff(F q , F m q ), we have ev F q ( f • φ) ∈ RS q (q -2). We have seen in the previous chapter that RS q (q -2) is the parity-check code, meaning that

RS q (q -2) = {a ∈ F F q q | ∑ t∈F q a t = 0} .
Since any affine line L can be written φ(F q ) for φ ∈ Aff(F q , F m q ), we get our result.

Propositions 2.28 and 2.29 imply that some designs give rise to locally correctable codes. In the following subsection we prove a more general statement.

Design-based codes for low-error LCCs

Let D = (X, B) be a design, and C = Code q (D) be the associated code over F q . The idea for correcting C locally is the following. Given c ∈ C and x ∈ X, if we want to correct symbol c x , we pick at random a block B ∈ B such that x ∈ B and we retrieve c x thanks to the the parity-check equation of the code that we know to be supported by B. As long as there is no error supported by B, the algorithm outputs the right symbol.

Informally, one sees that the distribution of blocks must be uniform over X if we want to get smooth queries. Therefore, 2-designs seems to be adapted for instantiating the above idea.

Let us formalise it in Algorithm 8.

Algorithm 8: An ( , δ, δ )-local correcting algorithm for a code C ⊆ F X q based on a 2design D = (X, B) with block size + 1.

Input: x ∈ X, and an oracle access to y ∈ F X q such that d(y, c) ≤ δn for some c ∈ C, where n = |X|. Output: c x with high probability.

1 Pick uniformly at random a block B ∈ B such that x ∈ B. 2 Toss a random binary coin b, which is 0 with probability p = /(n + -1). Proposition 2.30. Let D = (X, B) be a 2-(n, + 1, λ)-design, and C = Code q (D). Then using Algorithm 8, for every δ < 1/2 the code C is a perfectly smooth ( , δ, δ )-locally correctable code.

Proof. The proof relies on arguments that might now be redundant to readers. We first prove that individual queries are uniform on the support X. In Algorithm 8, the desired coordinate x is queried with probability p = /(n + -1). Moreover, for every a = x, there exists a constant number λ of blocks B of same size + 1, such that the pair {x, a} ⊂ B. Therefore, for every a = x, we have

Pr(a is queried) = (1 -p) Pr(a ∈ B) = 1 -n + -1 n -1 = n + -1 = p .
Then, Algorithm 8 succeeds if there is no error on the queried symbols. Therefore, denoting S x the set of queries, and E ⊂ X, |E| ≤ δn, the support of the errors, we obtain:

Pr(LC (y) (x) = c x ) ≥ 1 -E(|E ∩ S x |) ≥ 1 -∑ e∈E Pr(e ∈ S x ) ≥ 1 - δn (n + -1) > 1 -δ .
(2.7)

Since AG 1 (m, q) and PG 1 (m, 2) are 2-designs, thanks to Proposition 2.28 and 2.29 we retrieve the fact that binary Hadamard codes and lifted Reed-Solomon codes of dimension q -1 are locally correctable. Also notice that in Equation (2.7), the last inequality is tight up to a constant factor (since ≤ n), thus the correction failure ε is Θ(δ ) even if we are overcautious in bounding ε.

To sum up, we have seen that ( , δ, δ )-locally correctable codes can be built from 2-designs of block size + 1. Their local correcting algorithm is inspired by the low-error correcting algorithms of Hadamard codes or Reed-Muller codes of degree q -2. We have seen in previous subsections that a larger amount of errors can be corrected if the reconstruction step is resilient to a fraction of errors. Next subsection is devoted to pushing this idea in the world of design-based codes.

Generalised design-based codes

We introduce a generalisation of design-based codes in order to be able to correct locally a fraction of errors, similarly to the high-error local correction procedures of Reed-Muller codes. Notice that, in this subsection, elements in F X q will be preferably seen as maps X → F q . Definition 2.31 (Generalised design-based code). Let D = (X, B) be a design, and L = (L B ⊆ F B q : B ∈ B) be a family of codes indexed by blocks B ∈ B, called the local codes. The generalised design-based code with respect to L is:

Code q (D, L) := {c ∈ F X q such that ∀B ∈ B, c |B ∈ L B } ⊆ F X q .
Our terminology and notation for generalised design-based codes makes sense, since Code q (D) is actually an instance of Code(D, L), where we define L = (L B : B ∈ B) to be such that every L B is a parity-check code.

Example 2.32. Let D = AG 1 (m, q) be the classical affine design. For each affine line B ∈ B, let φ B : F q → F m q be an affine injective map such that im(φ B ) = B, and define the code L B as the code isomorphic to RS q (k) ⊆ F F q q by the action of φ B . Then, denoting L = (L B :

B ∈ B), we have Code(D, L) = Lift(RS q (k), m) .
Indeed, for every line

B ∈ B, c |B ∈ L B holds if and only if φ * B (c |B ) ∈ RS q (k). It remains to notice that φ * B (c |B ) corresponds to the evaluation of c • φ B on F q .
For a fixed design D, let us understand the impact of the family L on Code(D, L). For two families of local codes L, L indexed by B, we say that L ⊆ L if we have L B ⊆ L B for all B ∈ B.

Definition 2.33. We say that a family of codes L = (L B ⊆ F B q , B ∈ B) is (1, w)-correcting if every L B corrects at least any 1 erasure and w errors.

In the next result, we prove that the minimum distance of generalised design-based codes can be lower-bounded, depending on the minimum of the local codes ones. Proposition 2.34. Let t ≥ 2, and D = (X, B) be a t-(n, + 1, λ)-design. Let L be a family of codes indexed by B, and C = Code(D, L). Finally, define d := min{d min (L B ), B ∈ B}. Then,

d min (C) ≥ 1 + n -1 (d -1) .
Proof. We will prove the result for t = 2. Since every t-

(n, + 1, λ)-design is also a 2-(n, + 1, λ( n-(t-2) t-2
))-design (see Lemma 1.10), the proposition will be also proved for larger t ≥ 2. If C = {0}, the result trivially holds, so let us assume C = {0}. Let c ∈ C be a minimumweight codeword, wt(c) = D = 0. By definition there exists x ∈ X such that c(x) = 0. Define

B x = {B ∈ B, x ∈ B}; we know that |B x | = λ n-1 -1 . Furthermore, ∑ B∈B x wt(c |B ) = |B x | + ∑ B∈B x wt(c |B\{x} ) = |B x | + λ(D -1)
since every point of X \ {x} appears exactly λ times in the summation. Therefore, there must exist a block Proof. We use the notation of Algorithm 9. Once again, the proof is similar to other proofs for high-error resilient LCCs. We easily check the algorithm is perfectly smooth. Thanks to Markov's inequality, we also get:

B 0 ∈ B x such that wt(c |B 0 ) ≤ 1 |B x | ∑ B∈B x wt(c |B ) = 1 + λ(D -1) |B x | = 1 + (D -1)( -1) n -1 . Since c |B 0 ∈ L B 0 is non-zero,
Pr(LC (g) (x) = f (x)) ≥ 1 -Pr(|E ∩ A| ≥ τ + 1) ≥ 1 - E(|E ∩ A|) τ + 1 ,
and the average number of errors on A is bounded by

E(|E ∩ A|) = ∑ e∈E Pr(e ∈ A) = |E| n ≤ δ .
We conclude easily since δ τ +1 ≤ δ τ .

Proposition 2.36 (Case of 3-designs). Let 0 < τ < 1 and D be a 3-(n, + 1, λ)-design. Assume L is a τ -correcting family of local codes for D. Then, for every δ < τ -1/ √ 2 , the code Code(D, L)

is a perfectly smooth ( , δ, ε)-LCC where

ε = δ(1 -δ) (τ -δ) 2 • 1 . Moreover, ε = O(1/ ) when → ∞.
Proof. We use the notation of Algorithm 9 and we denote by E the support of the error. As always, we begin by checking that queries are smooth, and we notice that

Pr(LC (g) (x) = f (x)) ≥ 1 -Pr(|E ∩ A| ≥ τ + 1) .
For each query A of the algorithm, let us fix an ordering (a 1 , . . . , a ) of points in A. For 1 ≤ i ≤ , we also consider the random variable

Y i = 1 a i ∈E such that we have |E ∩ A| = ∑ i=1 Y i .
We see that, for every 1

≤ i ≤ , Y i is a Bernoulli variable of parameter |E| n ≤ δ.
Hence its mean value and variance satisfy respectively

E(Y i ) ≤ δ and D(Y i ) ≤ δ(1 -δ).
Since D is a 3-design, there exists a constant number of blocks B containing any 3-subset of X. Hence, even if we only consider the blocks that pass through x, the random variables {Y i } are pairwise independent. Therefore we get

E(|E ∩ A|) ≤ δ and D(|E ∩ A|) ≤ δ(1 -δ) .
From Chebyshev's inequality, we obtain:

Pr(|E ∩ A| ≥ τ + 1) ≤ Pr |E ∩ A| -E(|E ∩ A|) ≥ τ + 1 -E(|E ∩ A|) ≤ D(|E ∩ A|) ( τ + 1 -E(|E ∩ A|)) 2 ≤ δ(1 -δ) ( τ + 1 -δ ) 2 < δ(1 -δ) (τ -δ) 2 • 1 . It remains to notice that, if δ < τ -1/ √ 2 , then δ(1-δ) (τ-δ) 2 < 1/2.
We emphasize that Proposition 2.35 and 2.36 analyse the same local correcting algorithm, but this algorithm is applied on codes based on designs whose block structure is more or less elaborate. The difference in the result comes from the fact that blocks in 3-designs have a more refined structure than blocks in 2-designs, which allows the algorithm to succeed more frequently. Using 3-designs thus provides two improvements compared to 2-designs. First, the maximum error rate δ is now bounded by τ -O(1/ √ ) instead of τ/2. Second, the failure probability is O(1/ ) instead of O(1) when grows.

Remark 2.37. The use of highly structured set of queries can be found in other algebraic constructions of LCCs. A first occurrence might be the work of Woodruff and Yekhanin [START_REF] Woodruff | A Geometric Approach to Information-Theoretic Private Information Retrieval[END_REF] in the perspective of resisting collusions in private information retrieval protocols. Given a multiplicity code (though the terminology did not appear yet), the authors proposed to recover symbols by generating queries supported by low-degree curves. This idea was then explicitly formalised for local correcting purposes in Yekhanin's survey [START_REF] Yekhanin | Locally Decodable Codes[END_REF], where the local correcting algorithm uses degree-2 curves. If we see these curves as blocks, the design we obtain is close to be a 3-design, in the sense that most of triplets of points are contained in a unique curve of degree 2. Quite similarly, we also report the local correction algorithm on curves for lifted codes given by Chee, Wu and Xing in [START_REF] Yeow | Correcting on Curves and Highly Sound Locally Correctable Codes of High Rate[END_REF].

Remark 2.38. We have limited our study to the cases of t-designs with t ∈ {2, 3}, because larger values of t do not provide significant improvements on the local correction parameters, when applying the same proof techniques as in Propositions 2.35 and 2.36.

We complete this section by recalling that 3-designs actually exist. For instance, so-called inversive planes provide an infinite family of 3-(q 2 + 1, q + 1, 1) designs. An inversive plane can be defined as follows. Let X = F q 2 ∪ {∞} P 1 (F q 2 ). Let B 0 = (F q ∪ {∞}) ⊂ X, and B be the orbit of B 0 under PGL(2, F q 2 ), the projective linear group consisting in homographies of the projective line P 1 (F q 2 ). Then (X, B) is a 3-design.

However, first experimentations tend to show that inversive planes do not provide non-trivial codes. To see this, we report in Table 2.2 elementary divisors of the incidence matrices of inversive plane over F q , for small values of q. We observe that the associated code has dimension either 0 or 1, depending on q and the characteristic of the base field of the code. Based on the results presented in Table 2.2, we can also conjecture that the elementary divisors of the incidence matrix of the inversive plane over F q are {1 q 2 +1 } if 2 | q, and {1 q 2 , 2 1 } otherwise.

q Γ Z (M q ) dim F 2 (C) dim F p (C), p = 2 2 {1 5 } 0 0 3 {1 9 , 2 1 } 1 0 4 {1 17 } 0 0 5 {1 25 , 2 1 } 1 0 7 {1 49 , 2 1 } 1 0 8 {1 65 } 0 0 9 {1 81 , 2 1 } 1 0 11 {1 121 , 2 1 } 1 0
Table 2.2 -Elementary divisors Γ Z (M q ) of the incidence matrix M q of the inversive plane over F q .

Further perspectives

To conclude the chapter, we open a few questions regarding the link between LCCs and (generalised) design-based codes that has been exhibited in the last section.

First, we have seen that, given a generalised design-based code C = Code(D, L), the parameters of a local correcting algorithm for C can be derived from the structure of D and from the error-correction capability of the family L. Naturally, this raises the following problem: given a design D (or given a set of design parameters t, n, , λ), find families of codes L leading to the largest code C.

For instance, Example 2.32 proved that lifted codes -which are LCCs with particularly high rate -can be seen as codes based on the affine geometry design D = AG(m, q) and the family L of Reed-Solomon codes. Computations convinced us quickly that using a random family of codes L (instead of the family L of Reed-Solomon codes) lead to very poor design-based codes C = Code(D, L ). A better understanding of the very reason of this irregularity should then be of primary relevance.

Secondly, one could notice that codes are mathematical structures that can be considered without any underlying decoding algorithm. However, the definition of locally correctable codes requires to attach a local and probabilistic algorithm to the code, and the parameters of the LCC (especially δ and ε) depend on the compatibility between the algorithm and the code.

The concept of generalised design-based codes allows us to relax this requirement, and to see codes with locality as purely combinatorial structures. An avenue of research could be to develop this idea and to propose a combinatorial definition for locally correctable codes, whose parameters could then be analysed independently of an underlying decoding algorithm.

Chapter 3

Projective lifted codes In Chapter 2 was presented a family of high-rate and asymptotically good locally correctable codes called lifted Reed-Solomon codes [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF]. We recall they are built through the evaluation over the affine space of all the multivariate polynomials whose restriction to any affine line can be interpolated into a low-degree univariate polynomial. The first goal of this chapter is to give a formal definition of their analogues over projective spaces, that we name projective lifted codes. We will see they also admit perfectly smooth local correcting algorithms, whose parameters correspond quantitatively to the affine setting. As well, we exhibit interesting intertwined relations between projective and affine lifted codes, similar to those that hold for the families of Reed-Muller codes and design-based codes.

The chapter is organised as follows. A first section is devoted the introduction of the mathematical background necessary to our construction. Projective lifted codes are formally introduced in Section 3.2, where we also derive their first properties. We notably investigate their degree sets, a crucial notion introduced in Guo et al.'s work [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF]. Local correcting algorithms are proposed in Section 3.3. Last sections are devoted to further analyses of the codes. Relations with affine lifted codes via shortening and puncturing are given in Section 3.4; it allows us to produce recursive formulae for the dimension and some bases of projective lifted codes. Section 3.5 is devoted to features that are commonly studied in coding theory -such as the minimum distance, the automorphism group, or explicit information sets. This emphasizes the practicality of lifted codes. Finally, Section 3.6 is devoted to the practical computation of the dimension and bases of lifted codes.

Preliminaries

Let us here introduce the algebraic background for the definition of affine and projective lifted codes. Some notation and definitions are borrowed from the seminal work of Guo et al. [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF].

Affine and projective evaluation codes

Projective geometry. A base field F q is fixed throughout the chapter. Coordinates of a representative of a projective point a ∈ P m are denoted (a 0 : . . . : a m ). We know that each projective point admits (q -1) different representatives; we call standard representative the only one such that ∀j < i, a j = 0 and a i = 1. The projective space P m contains θ m,q := q m+1 -1 q-1 distinct points.

The hyperplane at infinity Π ∞ := {a ∈ P m , a 0 = 0} is isomorphic to P m-1 , and the bijective map (a 1 , . . . , a m ) → (1 : a 1 : . . . : a m ) embeds A m into P m . A projective line is a (q + 1)-subset of P m of the form L a,b := {xa + yb, (x : y) ∈ P 1 } , where a, b are distinct points in P m . The line L a,b is the only one containing both a and b, and there are exactly θ m-1,q = |P m-1 | = q m -1 q-1 projective lines on which a given point a ∈ P m lies.

Polynomials and degrees. Given a multivariate polynomial

f (X) = ∑ d f d X d ∈ F q [X], the set {d ∈ N m , f d = 0} is
Poly(D) := Span F q {X d , d ∈ D} ⊆ F q [X] .
For instance, f ∈ Poly(Deg(D)). We write |d| := ∑ i d i the weight of a tuple of integers d. Some subsets D are of particular interest. For instance, for v ∈ N,

(i) the 1-norm ball B m 1 (v) := {d ∈ N m , |d| ≤ v} generates the space F q [X] ≤v of multivariate polynomials of total degree bounded by v, (ii) the ∞-norm ball B m ∞ (v) := {d ∈ N m | d i ≤ v, 1 ≤ i ≤ m}
generates the space of multivariate polynomials of partial degree bounded by v, (iii) the 1-norm sphere S m+1 (v) := {d ∈ N m+1 , |d| = v} generates the space F q [X] H v of homogeneous polynomials of degree v (plus the zero polynomial).

Evaluation of homogeneous polynomials on a projective point. For any homogeneous polynomial

f ∈ F q [X] H v , it is well-known that f (λX) = λ v f (X) , ∀λ ∈ F × q .
It means that different representatives of a fixed projective point may result to different evaluations by f . In order to remove any ambiguity, we adopt the following convention. Let (x 0 : . . . : x m ) be the standard representation of a projective point x ∈ P m . Then we define the evaluation of f at x as: ev x ( f ) := f (x 0 , . . . , x m ) .

In other words, every projective point must be written in the unique standard representation when evaluated by homogeneous polynomials. Thanks to this definition, the following evaluation map can be defined without ambiguity for all v ≥ 0:

ev P m : F q [X] H v → F θ m,q q f → (ev x ( f ) : x ∈ P m )
Recall its affine analogue is:

ev A m : F q [X] → F q m q f → ( f (x) : x ∈ A m )
Clearly, ev P m and ev A m are F q -linear maps. Since x q = x for all x ∈ F q , we have

ker(ev A m ) = Span F q [X] {X q i -X i , 1 ≤ i ≤ m} . ( 3.1)
Moreover, since ev P m evaluates homogeneous polynomials, for a fixed v ∈ N we obtain ker(ev

P m ) = Span F q [X] X q i X j -X i X q j , ∀i = j ∈ {0, . . . , m} ∩ F q [X] H v . (3.2)
Proofs can be found in [START_REF] Renterìa | Reed-Muller Codes: an Ideal Theory Approach[END_REF] for instance.

Evaluation codes. We have seen in previous chapters that a common way to build linear codes is to evaluate polynomials over a list of points. Let us here formally define the family of evaluation codes we are studying.

Definition 3.1 (affine evaluation code). Let F be a linear subspace of F q [X]. The affine evaluation code associated to F is the F q -linear code of length n = |A m | = q m composed by the evaluation vectors of polynomials in F :

ev A m (F ) = {ev A m ( f ), f ∈ F } ⊆ F A m q .
Definition 3.2 (projective evaluation code). Let v ∈ N and F be a linear subspace of F q [X] H v . The projective evaluation code associated to F is the F q -linear code of length n = |P m | = θ m,q composed by the evaluation vectors of polynomials in F :

ev P m (F ) = {ev P m ( f ), f ∈ F } ⊆ F P m q .
We point out a specific class of evaluation codes, generated by evaluation vectors of monomials. As we will see later, so-called monomial codes turn out to be very convenient to describe.

Definition 3.3 (monomial code

). An affine evaluation code C = ev A m (F ) (resp. a projective evaluation code C = ev P m (F )) is said to be monomial if F = Poly(D) for some D ⊆ N m (resp. D ⊆ S m+1 (v)).

Projective Reed-Solomon and Reed-Muller codes.

Definition 3.4 (Projective Reed-Solomon code). Let 0 ≤ k ≤ q -1. The projective Reed-Solomon code of degree k over F q is the linear code of length q + 1 = |P 1 | consisting in the evaluation of bivariate homogeneous polynomials of degree k over F q :

PRS q (k)

:= {ev P 1 ( f ), f ∈ F q [X, Y] H k } .
Projective Reed-Solomon codes are [q + 1, k + 1, qk]-MDS codes over F q . In the literature, they are sometimes called extended, or doubly-extended Reed-Solomon codes. The reason is that, when puncturing PRS q (k) ⊆ F P 1 q on the point at infinity (0 : 1), we obtain the full-length Reed-Solomon code RS q (k).

Similarly, Reed-Muller codes admit analogues in projective spaces, which were firstly defined and studied by Lachaud [START_REF] Lachaud | Projective Reed-Muller Codes[END_REF][START_REF] Lachaud | The Parameters of Projective Reed-Muller Codes[END_REF] and Sørensen [START_REF] Bjaert | Projective Reed-Muller Codes[END_REF]. Definition 3.5 (Projective Reed-Muller code). Let 0 ≤ v ≤ m(q -1). The projective Reed-Muller code of order m and degree v over F q is the linear code of length |P m | = (q m+1 -1)/(q -1) consisting in evaluation vectors of (m + 1)-variate homogeneous polynomials over F q of degree v:

PRM q (m, v) := {ev P m ( f ), f ∈ F q [X] H v } .
The dimension of PRM q (m, v) has been given by Sørensen [Sør91]:

dim(PRM q (m, v)) = ∑ t∈I v m+1 ∑ j=0 (-1) j m + 1 j t -jq + m t -jq , (3.3)
where

I v = {t ∈ [1, v], t ≡ v mod q -1}.
Notice that, for small v ≤ q -1, Equation (3.3) simplifies to dim(PRM q (m, v)) = ( m+v v ). By definition, we see that PRM q (1, k) = PRS q (k) for every 0 ≤ k ≤ q -1.

Reduced degree sets

In the previous subsection, we have seen that well-known families of linear codes are defined as the image of polynomials by evaluation maps. For coding theoretic reasons (e.g. giving the dimension of the code, or computing a basis), it is interesting to find sets

D ⊆ S m+1 (v) (resp. D ⊆ B m 1 (v)
) such that the evaluation map ev P m (resp. ev A m ) is injective over Poly(D). Generally, we can group monomials according to their evaluation over the affine (resp. projective) space. Then, in each class of monomials, we can point out a specific representative X d -typically the lowest one according to a certain monomial order -and its exponent d represents its whole class of monomials. Such exponents d will be referred to as reduced tuples, or reduced degrees. Definition 3.6 (A and P-reduced tuples).

1. A tuple d ∈ N m is A-reduced if it lies in B m ∞ (q -1). 2. A tuple d = (d 0 , . . . , d m ) ∈ N m+1 is P-reduced if, for all 0 ≤ i ≤ m: d i ≥ q ⇒ d j = 0 ∀j < i , d j ≤ q -1 ∀j > i .
We see that any A-reduced tuple is also P-reduced. We also say that a set D of tuples is A-reduced (resp. P-reduced) if every tuple it contains is A-reduced (resp. P-reduced).

We denote by (e 1 , . . . , e m ) the canonical basis of N m . If d = (d 1 , . . . , d m ) ∈ N m and 1 ≤ j ≤ m is such that d j ≥ q, then we define

ρ j (d) := d -(q -1)e j .
Similarly, if d ∈ S m+1 (v) for some v > 0, and 0 ≤ i < j ≤ m are such that d j ≥ q and d i ≥ 1, we define

τ ij (d) := d + (q -1)(e i -e j ) . Remark 3.7. Let d ∈ N m . From (3.1) we see that ev A m (X ρ j (d) ) = ev A m (X d ) for every 1 ≤ j ≤ m such that d j ≥ q.
Moreover, as long as they are defined, ρ j • ρ = ρ • ρ j . Let us consider the image of d after repeatedly applying maps ρ j until we cannot apply any of them. Then, we can see that the tuple we get is A-reduced.

Similarly, let d ∈ S m+1 (v) and 0 ≤ i < j ≤ m. First notice that |τ ij (d)| = |d|, hence every map τ ij lets S m+1 (v) invariant. We also have ev P m (X τ ij (d) ) = ev P m (X d ), and as long as they are defined,

τ ij • τ k = τ k • τ ij .
So once again, if we consider the image of d after applying maps τ ij while it is possible, we get a P-reduced tuple.

The previous remark naturally leads to the upcoming definitions.

Definition 3.8. Let d ∈ N m . The A-reduction of d is the tuple d ∈ N m which is obtained by applying iteratively ρ j (for 1 ≤ j ≤ m) until the result lies in B m ∞ (q -1). It satisfies ev A m (X d ) = ev A m (X d ). The A-reduction of D ⊆ N m+1 , denoted D, consists in the A-reduction of the tuples in D.
Definition 3.9. Let d ∈ S m+1 (v) for some v ≥ 0. The P-reduction of d is the tuple d ∈ S m+1 (v) which is obtained by applying iteratively τ ij (for 0 ≤ i < j ≤ m) until the result is P-reduced. It satisfies ev P m (X d ) = ev P m (X d ). The P-reduction of D ⊆ S m+1 (v), denoted D, consists in the P-reduction of the tuples in D.

A-and P-reduction are defined in order to make the evaluation maps ev A m and ev P m injective over polynomial spaces of the form Poly(D), where D is A-or P-reduced. Next lemma details these properties. Proof.

By definition, if

D is A-reduced, then D is a subset of B m ∞ (q -1). Therefore Poly(D) ∩ Span{X q i -X i , 1 ≤ i ≤ m} = {0}.
The result follows from the fact that ev A m vanishes only on Span{X q i -X i , 1 ≤ i ≤ m}.

Recall that Equation (3.2) states that ker(ev

P m ) = Span{X q i X j -X i X q j , 0 ≤ i < j ≤ m} ∩ F q [X] H v .
We prove the statement by induction over m.

For m = 1 and v ∈ N, let D be a P-reduced subset of S 2 (v). If v ≤ q, it is clear that ker(ev P 1 ) ∩ Poly(D) = {0}. So assume v > q and let f (X, Y) ∈ Poly(D) ∩ ker(ev P 1 ).

Since D is P-reduced, we can write

f (X, Y) := f v Y v + q-1 ∑ i=0 f i X v-i Y i .
Then, we see that

f v = f (0, 1) = 0, hence the polynomial g(Y) := f (1, Y) = ∑ q-1 i=0 f i Y i lies in Poly(D ), for some set D ⊆ B 1 ∞ (q -1)
. Moreover f ∈ ker(ev P 1 ) implies that g ∈ ker(ev A 1 ). Hence, applying the first point of this lemma to subset D shows that g = 0, and f = 0 follows.

For m > 1, let v ∈ N. The proof works similarly. Let D be a P-reduced subset of S m+1 (v), and let

f (X) := f 0 (X 1 , . . . , X m ) + X 0 f 1 (X 0 , X 1 , . . . , X m ) ∈ Poly(D) ∩ ker(ev P m ) .
Since f 0 does not depend on X 0 , we can see that f 0 ∈ ker(ev P m-1 ) and f 0 ∈ Poly(D 0 ) where D 0 ⊂ S m (v). Furthermore, D 0 is P-reduced as a subset of D. Therefore, by induction f 0 = 0, and f = X 0 f 1 (X 0 , X 1 , . . . , X m ) follows. Let us define g(X 1 , . . . , X m ) := f (1, X 1 , . . . , X m ); we see that g ∈ ker(ev A m ) and g ∈ Poly(D ) where D ⊆ B m ∞ (q -1) since D is P-reduced and every tuple in D comes from a tuple d ∈ D such that d 0 = 0. Thanks again to the first point of the lemma, it follows that g = 0. Therefore, f = αX v 0 for some α ∈ F q , which necessarily implies f = 0 (evaluate f at (1 : 0 : . . . : 0)). Example 3.12. Reed-Solomon and Reed-Muller codes, as well as their projective analogues, are monomial codes. Table 3.1 presents their degree sets.

Since ev

Isomorphisms and embeddings

The original definition of affine lifted codes makes use of restriction of polynomials to lines. We here give a formalism that embrace this notion for both affine and projective spaces.

Code Degree set

Reed-Solomon code RS q (k)

B 1 1 (k) = {0, 1, . . . , k} Reed-Muller code RM q (m, v) B m 1 (v) = {e | e ∈ N m , |e| ≤ v} projective Reed-Solomon code PRS q (k) S 2 1 (k) = {(k, 0), (k -1, 1), . . . , (0, k)} projective Reed-Muller code PRM q (m, v) S m+1 1 (v) = {d | d ∈ N m+1 , |d| = v} Table 3.
1 -Degree sets of some classical monomial codes.

Isomorphisms. Each isomorphism ψ ∈ Iso(F m+1 q ) induces a permutation of P m , but ψ does not necessarily preserve the standard representation of projective points. Still, for every x ∈ P m there exists λ ψ,x ∈ F × q such that the standard representative of ψ(x) is λ ψ,x ψ(x). For every f ∈ F q [X] H v , we then have:

ev ψ(x) ( f ) = f (λ ψ,x ψ(x)) = (λ ψ,x ) v f (ψ(x)) = (λ ψ,x ) v ev x ( f • ψ) ,
and we see that (λ ψ,x ) v does not depend on f (only on its total degree). So let us denote by

w (ψ,v) := ((λ ψ,x ) -v : x ∈ P m ) ∈ (F × q ) P m .
Then, we have:

ev P m ( f • ψ) = w (ψ,v) ψ * (ev P m ( f )) ,
where we recall that ψ * denotes the permutation of tuples indexed by P m which is induced by ψ. Thus it is natural to introduce the group of isomorphisms Proj v (P m ) := {(w (ψ,v) , ψ), ψ ∈ Iso(F m+1 q

)} ⊆ F P m q × S(P m ). One notices that Proj v (P m ) ⊆ Aut(PRM q (m, v)), since for every f ∈ F q [X] H v and every ψ ∈ Iso(F m+1 q ), the polynomial f • ψ also lies in F q [X] H v .

Embeddings. Let Emb P (m) be the set of full-rank (i.e. injective) linear maps from F 2 q to F m+1 q :

Emb P (m) := {L ∈ Hom(F 2 q , F m+1 q ), rank(L) = 2} .

Each L ∈ Emb P (m) induces a projective embedding P 1 → P m sending (x : y) → L(x, y).

One can easily check that this map is well-defined over projective spaces. Moreover, the set {L(P 1 ), L ∈ Emb P (m)} describes all the projective lines of P m , although a projective line is obviously associated to many maps L in Emb P (m). Similarly, the set

Emb A (m) := {L = (L 1 , . . . , L m ) ∈ Hom(F 2 q , F m q ) | L = (L 0 , . . . , L m ) ∈ Emb P (m)} defines affine embeddings A 1 → A m by t → L (1, t). The set {L (1, A 1 ), L ∈ Emb A (m)
} is the set of affine lines of A m . Also notice that the embeddings A 1 → A m we describe here are exactly those in Aff(F q , F m q ), but we prefer the formalism given by Emb A (m) due to its similarity with the projective setting. Remark 3.13. For convenience and when the context is clear, we will improperly write L (t) instead of L (1, t). By using this notation, we want to emphasize that, for every f ∈ F q [X] and every L ∈ Emb A (m), the map t → f (L (1, t)) can be interpolated as a univariate polynomial denoted f • L ∈ F q [T].

Remark 3.14. For local correction purposes (see Section 3.3), it is important to notice the following points.

1. In the affine setting, for every L ∈ Emb A (m) and f ∈ F q [X], the word ev

A 1 ( f • L ) is the subword of ev A m ( f ) with coordinates L (A 1 ) ⊂ A m . 2.
In the projective setting, ev P 1 ( f • L) is not necessary a subword of ev P m ( f ), since nothing asserts that L preserves the standard representation of projective points. This issue is similar to the one concerning isomorphisms, and we solve it the same manner. Let

x ∈ P 1 and L ∈ Emb P (m). We know there exists λ L,x ∈ F × q such that the standard representative of L(x) is λ L,x L(x) ∈ P m . Then it holds:

∀ f ∈ F q [x] H v , ev L(x) ( f ) = f (λ L,x L(x)) = (λ L,x ) v ( f • L)(x) .
Therefore, as previously we define w (L,v) := ((λ L,x ) -v :

x ∈ P 1 ) ∈ (F × q ) P 1 . Then (w (L,v) ) -1 ev P 1 ( f • L) is the subword of ev P m ( f ) with coordinates L(P 1 ) ⊂ P m .
Let us illustrate the second point of Remark 3.14 with a simple example.

Example 3.15. For clarity, let us fix an ordering of points in P 1 (F 3 ) and P 2 (F 3 ):

P 1 (F 3 ) = (1 : 1), (1 : 2),
(1 : 0), (0 : 1) P 2 (F 3 ) = (1 : 1 : 1), (1 : 1 : 2), (1 : 1 : 0), (1 : 2 : 1), (1 : 2 : 2), (1 : 2 : 0),

(1 : 0 : 1), (1 : 0 : 2), (1 : 0 : 0), (0 : 1 : 1), (0 : 1 : 2), (0 : 1 : 0), (0 : 0 : 1)

Let f = X 1 ∈ F 3 [X 0 , X 1 , X 2 ] H 1 and L = (L 0 , L 1 , L 2 ) ∈ Emb P (2) defined by L 0 (S, T) = S + T, L 1 (S, T) = T, L 2 (S, T) = S .
Denote by c = ev P 2 ( f ) = (1, 1, 1, 2, 2, 2, 0, 0, 0, 1, 1, 1, 0) ∈ F 13 3 . On the one hand we have L(P 1 ) = ((2 : 1 : 1), (0 : 2 : 1), (1 : 0 : 1), (1 : 1 : 0))

= ((1 : 2 : 2), (0 : 1 : 2), (1 : 0 : 1), (1

: 1 : 0)) , (3.4)
hence c |L(P 1 ) = (c 5 , c 11 , c 7 , c 3 ) = (2, 1, 0, 1). On the other hand

( f • L)(S, T) = T ∈ F 3 [S, T] H
1 , and we get ev

P 1 ( f • L) = (1, 2, 0, 1). So clearly c |L(P 1 ) = ev P 1 ( f • L).
Nevertheless, w (L,1) can be obtained through the homogenisation made in (3.4):

w (L,1) = (2, 2, 1, 1) .
Therefore it gives:

ev 1) c |L(P 1 ) .

P 1 ( f • L) = (2, 1, 0, 1) = w (L,

Definition and first properties of projective lifted codes

Before introducing the construction of projective lifted codes, we recall the definition of affine lifted codes given by Guo, Kopparty and Sudan [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF]. We restrict our study to the lifting of projective Reed-Solomon codes, but we are convinced that our construction can be extrapolated to the lifting of projective Reed-Muller codes. Notice that our formalism is slightly different from the paper of [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF], since their notion of restriction f |L of a polynomial f along a line L is somewhat ambiguous.

Affine lifted codes

We recall that, for f ∈ F q [X] and L ∈ Emb A (m), the notation f • L represents the univariate polynomial f (L(1, T)). The affine lifting of order m of the Reed-Solomon code RS q (k) is

Lift(RS q (k), m) := {ev A m ( f ) | f ∈ F q [X] such that ∀L ∈ Emb A (m), ev A 1 ( f • L) ∈ RS q (k)} .
In this chapter, Lift(RS q (k), m) will be referred to as an affine lifted code for short, since we will only deal with lifted Reed-Solomon codes.

We first introduce a few additional notation. For a non-negative integer a, we denote by ∑ i a (i) p i its p-adic decomposition. One can now define a partial order ≤ p over N by:

a ≤ p b ⇐⇒ a (i) ≤ b (i) , ∀i . (3.5)
Relation ≤ p can be naturally extended to m-tuples by a ≤ p b ⇐⇒ ∀j, a j ≤ p b j . We also extend usual binomial coefficients to m-tuple entries by ( a b ) := ∏ m i=1 ( a i b i ). Guo et al. proved that every affine lifted code Lift(RS q (k), m) is a monomial code that satisfies

Lift(RS q (k), m) = Span F q ev A m (X d ) d ∈ B m ∞ (q -1), ∀e ≤ p d, |e| ≤ k , (3.6)
where p = char(F q ) and |e| = ∑ i e i . Furthermore, a careful observation of their degree sets shows that Lift(RS q (k), m) fits between two projective Reed-Muller codes:

RM q (m, k) ⊆ Lift(RS q (k), m) ⊆ RM q (m, k + (m -1)(q -1)) . (3.7)
We also recall that the main interest of affine lifted codes appears for k ≥ qq p , where the first inclusion is proper [START_REF] Kaufman | Testing Polynomials over General Fields[END_REF]. More details can be found in a previous chapter (Subsection 2.2.3), and methods for the precise computation of degree sets will be given in Section 3.6.

Projective lifted codes

We are now ready to define the projective analogues of lifted Reed-Solomon codes. One wants to define them as projective evaluation codes corresponding to a subspace of polynomials which satisfy a collection of local constraints. Recall we build evaluation codes over projective spaces by evaluating homogeneous polynomials of fixed degree v. It raises the problem of determining a meaningful expression for v. By analogy with the affine setting, Equation (3.7)

suggests to set v = v m,k := k + (m -1)(q -1). Definition 3.16 (projective lifted code). Let 0 ≤ k ≤ q, m ≥ 1 and v = k + (m -1)(q -1). The projective lifting of order m of the projective Reed-Solomon code PRS q (k) is Lift(PRS q (k), m) := {ev P m ( f ) | f ∈ F q [X] H v , ∀L ∈ Emb P (m), ev P 1 ( f • L) ∈ PRS q (k)} .
Such a code will be called a projective lifted code for short, and its length equals θ m,q = |P m | = (q m+1 -1)/(q -1).

Let us get rid of the case k = q as of now. The associated projective Reed-Solomon code PRS q (q) = F P 1 q is degenerate. Hence we get Lift(PRS q (q), m) = F P m q , which is also degenerate. Also notice that, for k ≤ q -1, it clearly holds that Lift(PRS q (k), 1) = PRS q (k).

So, from now on, if not stated otherwise we assume m ≥ 2 and 0 ≤ k ≤ q -1.

Monomiality of projective lifted codes

Similarly to the affine setting, a main issue remains to give a basis of Lift(PRS q (k), m). In this subsection, we prove that projective lifted codes are monomial, and then we compute their degree set. Precisely, we state the following new result, which proves the monomiality of a broader family of codes. Theorem 3.17. Let C = ev P m (F ) be a projective evaluation code, where F is a subspace of F q [X] H v for some m, v ≥ 1. Assume that Proj v (P m ) ⊆ Aut(C). Then C is monomial.

Before diving straight into the proof, we first observe that Proj v (P m ) contains elements (w (ψ,v) , ψ) where ψ ∈ Iso(F m+1 q ) can be:

-a diagonal isomorphism diag a for any a ∈ (F × q ) m+1 , where diag a : P m → P m (x 0 : . . . : x m ) → (a 0 x 0 : . . . : a m x m ) -an elementary transposition s i,j for any 0 ≤ i, j ≤ m, i = j, where s i,j : P m → P m (x 0 : . . . : x i : . . . : x j : . . . : x m ) → (x 0 : . . . : x j : . . . : x i : . . . : x m ) -an elementary transvection t i,j,β for any 0 ≤ i, j ≤ m, i = j, and β ∈ F q , where t i,j,β : P m → P m (x 0 : . . . : x i : . . . : x m ) → (x 0 : . . . : x i + βx j : . . . : x m )

We first need to prove a technical lemma.

Lemma 3.18. The following equality over bivariate polynomials holds:

∑ β∈F q (βX + Y) q-1 = -X q-1 .
Proof. Let F(X, Y) = ∑ β∈F q (βX + Y) q-1 + X q-1 . Since ev A 2 is injective over polynomials of partial degree bounded by q -1, it is sufficient to prove that ev A 2 (F) = 0.

Let (x, y) ∈ F 2 q . If x = 0, then F(x, y) = F(0, y) = ∑ β∈F q y q-1 = 0. Otherwise, β → βx + y is a bijection over F q , hence we have:

F(x, y) = ∑ β∈F q (βx + y) q-1 + x q-1 = ∑ γ∈F q γ q-1 + 1 = q -1 + 1 = 0 .
Proof of Theorem 3.17. Let c = ev P m ( f ) ∈ C, where f = ∑ d f d X d , and denote by D = Deg( f ) = {d, f d = 0}. Our goal is to prove that every d ∈ D satisfies ev P m (X d ) ∈ C. The proof will consist in three main parts:

(i) we show that ev P m (Q d (X)) ∈ C, where Q d (X) is a polynomial such that d ∈ Deg(Q d ),
and such that Deg(Q d ) is much smaller than Deg(C); (ii) we analyse and rewrite Deg(Q d ), which then allows us to write the polynomial Q d (X) as X d 1 1 . . . X d a a R(X 0 , X a+1 , . . . , X m ) for some (ma + 1)-variate homogeneous polynomial R;

(iii) we prove that, if there exists an (ma + 1)-variate polynomial R satisfying some prescribed properties and such that ev P m (X d 1 1 . . . X d a a R(X 0 , X a+1 , . . . , X m )) ∈ C, then we can compute an (ma)-variate polynomial R satisfying the same properties, and such that the vector ev P m (X d 1 1 . . . X d a+1 a+1 R (X 0 , X a+2 , . . . , X m )) ∈ C. Reasoning inductively on the last part will conclude the proof.

Proof of part (i). Let d ∈ D, and define

Q d (X) := (-1) m+1 ∑ a∈(F × q ) m+1 m ∏ i=0 a -d i i ( f • diag a )(X) .
Since C is linear and diag a ∈ Aut(C) for every a ∈ (F × q ) m+1 , we know that ev

P m (Q d (X)) lies in C. Let us now rewrite Q d (X): Q d (X) = (-1) m+1 ∑ a∈(F × q ) m+1 m ∏ i=0 a -d i i ∑ j f j a j 0 0 . . . a j m m X j = (-1) m+1 ∑ j f j ∑ a∈(F × q ) m+1 m ∏ i=0 a j i -d i i X j
One can notice that developping the product ∏ m i=0 (∑ a i ∈F × q a j i -d i i

) gives ∑ a∈(F × q ) m+1 ∏ m i=0 a j i -d i i
. Hence we get:

Q d (X) = (-1) m+1 ∑ j f j m ∏ i=0 ∑ a i ∈F × q a j i -d i i =0 if j i ≡d i mod (q-1), -1 otherwise X j = ∑ j∈E d f j X j , where E d = {j ∈ D, j ≡ d mod (q -1)} ⊆ D.
Proof of part (ii). The code C is invariant under the action of elementary switches of coordinates. Therefore one can assume without loss of generality that, if they exist, the only coordinates d i of d satisfying q -1 | d i all lie at the end of the tuple d. Furthermore, by P-reduction and by definition of E d , we can assume that, if d i / ∈ {0, q -1} then d i = j i , except maybe for the leftmost non-zero coordinate of j and d. To sum up, without loss of generality there exists an index a ∈ [1, m] such that every j ∈ E d satisfies the following three properties

   ∀1 ≤ i ≤ a, we have j i = d i < q -1 ∀a < i ≤ m, we have j i ∈ {0, q -1} and d i ∈ {0, q -1} j 0 = v -∑ m i=1 j i .
Therefore, Q d (X) can be written as X d 1 1 . . . X d a a R(X 0 , X a+1 , . . . , X m ), where R is an homogeneous polynomial of degree v -∑ a i=1 d i , whose monomials have partial degree either 0 or q -1, for every coordinate X i , i > a.

Proof of part (iii). Recall that we want to prove that ev P m (X d 0 0 X d 1 1 . . . X d m m ) ∈ C, and we know that ev P m (Q d (X)) ∈ C. Our strategy is to proceed inductively, from i = a to m, by proving there exists an (mi + 1)-variate polynomial R i such that d ∈ Deg(X d 1 1 . . . X d i i R i (X 0 , X i+1 , . . . , X m )) and ev P m (X d 1 1 . . . X d i i R i (X 0 , X i+1 , . . . , X m )) ∈ C. Notice that step i = a has been proved in part (ii), and that step i = m concludes the proof. Hence there remains to prove the induction step. Write R i = R i + X q-1 i+1 R i , where polynomials R i and R i do not depend on X i+1 . Let S i = X d 1 1 . . . X d i i R i (X 0 , X i+1 , . . . , X m ), and assume that ev P m (S i ) ∈ C and d ∈ Deg(S i ). If R i = 0, then the induction step is proved. Otherwise:

• 1st case: d i+1 = 0. Since ∑ β∈F q (X i+1 + βX 0 ) q-1 = -X q-1 0 (see Lemma 3.18), we get ∑ β∈F q S i (X 0 , . . . , X i+1 + βX 0 , . . . , X m )

= X d 1 1 . . . X d i i ∑ β∈F q R i (X 0 , X i+2 , . . . , X m ) + (X i+1 + βX 0 ) q-1 R i (X 0 , X i+2 , . . . , X m ) = ∑ β∈F q X d 1 1 . . . X d i i R i (X 0 , X i+2 , . . . , X m ) -X d 1 1 . . . X d i i X q-1 0 R i (X 0 , X i+2 , . . . , X m ) = -X d 1 1 . . . X d i i X q-1 0 R i (X 0 , X i+2 , . . . , X m ) .
By linearity and invariance of C under transvections, ev P m (S i ) ∈ C ensures that the word ev P m (X

d 1 1 . . . X d i i X q-1 0 R i (X 0 , X i+2 , . . . , X m )) ∈ C. We conclude by defining R i+1 = -X q-1 0 R i . • 2nd case: d i+1 = q -1. Since ∑ β∈F q (βX i+1 + X 0 ) q-1 = -X q-1 i+1 , we get ∑ β∈F q S i (X 0 , . . . , X i+1 + βX 0 , . . . , X m ) = X d 1 1 . . . X d i i ∑ β∈F q R i (X 0 , X i+2 , . . . , X m ) + (βX i+1 + X 0 ) q-1 R i (X 0 , X i+2 , . . . , X m ) = -X d 1 1 . . . X d i i X q-1 i+1 R i (X 0 , X i+2 , . . . , X m ) .
Similarly to the first case, we can conclude by defining R i+1 = -R i .

The converse of Theorem 3.17 is obviously false: for instance, if F = Span F q {XY, Y 2 }, then ev P 2 (F ) is monomial, but not invariant under Proj 2 (P 2 ).

A good point is that, similarly to PRM codes, projective lifted codes can be proved invariant under Proj v (P m ).

Lemma 3.19. Let k ≤ q -1, m ≥ 1 and C = Lift(PRS q (k), m). Then Proj v (P m ) ⊆ Aut(C). Said differently, ∀c = ev P m ( f ) ∈ C, ∀ψ ∈ Iso(F m+1 q ), ev P m ( f • ψ) ∈ C .
Proof. It is sufficient to notice that, for every L ∈ Emb P (m) and every ψ ∈ Iso(F m+1 q ), the map ψ • L also lies in Emb P (m).

As a corollary, Theorem 3.17 implies that Corollary 3.20. Every projective lifted code is monomial.

Degree sets of lifted codes

A natural question is now to determine the degree set of Lift(PRS q (k), m). Let us first recall that affine lifted codes have the following degree sets (see Equation (3.6)):

ADeg q (m, k) := Deg(Lift(RS q (k), m)) = {d ∈ B m ∞ (q -1) | ∀e ≤ p d, |e| ≤ k} .
Similarly, we define PDeg q (m, k) := Deg(Lift(PRS q (k), m)).

In this subsection, we state a few links between degree sets of affine and projective lifted codes. Propositions 3.21 and 3.22 show that every d ∈ PDeg q (m, k) can be bijectively sent either to ADeg q (m, k -1) or to PDeg q (m -1, k), according to the value of d 0 . Thus, in Theorem 3.23 we derive a recursive formula on the degree sets of affine and projective lifted codes, which translates into another recursive formula on the dimension of these codes (Corollary 3.24).

Proposition 3.21. Let v = k + (m -1)(q -1) for 1 ≤ k ≤ q -1 and m ≥ 2. Let also d = (d 0 , d * ) ∈ S m+1 (v) such that d 0 = 0. Then:

ev P m (X d 0 0 X d * ) ∈ Lift(PRS q (k), m) ⇐⇒ ev A m (X d * ) ∈ Lift(RS q (k -1), m) , or, equivalently, d = (d 0 , d * ) ∈ PDeg q (m, k) ⇐⇒ d * ∈ ADeg q (m, k -1) . Proof. (⇒). Let ev P m (X d 0 0 X d * ) ∈ Lift(PRS q (k), m) with d 0 = 0, and L ∈ Emb A (m). We need to prove that ev A 1 (X d * • L ) ∈ RS q (k -1). Let us define L = (L 0 , . . . , L m ) ∈ Hom(F 2 q , F m+1 q
) as follows:

-the last m coordinate-maps (L 1 , . . . , L m ) equal L , -the first coordinate-map L 0 is chosen to be either L 0 (S, T) = S or L 0 (S, T) = T, in order to have rank(L) = 2. Now notice that without loss of generality we can assume that L 0 (S, T) = S. Two points could be clarified here. First, if the linear map (S, L (S, T)) has rank 1, by definition of Emb A (m) the linear map (T, L (S, T)) has rank 2. Second, the particular choice L 0 (S, T) = S can be done since PRS q (k) is invariant under Proj(P 1 ).

Finally we get

ev P 1 (X d 0 0 X d * • L) = ev P 1 (X 0 X d * • L) = ev P 1 (S • (X d * • L )(S, T)) ∈ PRS q (k) (3.8)
since X d 0 0 X d * and X 0 X d * evaluate identically, and by definition of projective lifted codes. Moreover, we know that any homogeneous polynomial P(S, T) satisfies ev P 1 (S • P(S, T)) ∈ PRS q (k) ⇐⇒ ev A 1 (P(1, T)) ∈ RS q (k -1) .

(3.9)

Applying this to P(S, T) = (X d * • L )(S, T), we get our result.

(⇐). Let ev

A m (X d * ) ∈ Lift(RS q (k -1), m) and L ∈ Emb P (m). Let also d 0 = 0 such that (d 0 , d * ) ∈ S m+1 (v). We need to prove that ev P 1 (X d 0 X d * • L) ∈ PRS q (k). If L 0 = 0, then the result holds since 0 ∈ PRS q (k).
Otherwise, it is worthwhile to notice that, since PRS q (k) is invariant under Proj(P 1 ), we can assume without loss of generality that L 0 (S, T) = S. Define L = (L 1 , . . . , L m ), which lies in Emb A (m) by definition. Therefore ev A 1 (X d * • L ) ∈ RS q (k -1), and using (3.8) and (3.9), we prove the expected result.

Similarly, we have:

Proposition 3.22. Let v = k + (m -1)(q -1) for 1 ≤ k ≤ q -1 and m ≥ 2. Let also d = (d 0 , d * ) ∈ S m+1 (v)
, and assume that d 0 = 0. Then:

ev P m (X d ) ∈ Lift(PRS q (k), m) ⇐⇒ ev P m-1 (X d * ) ∈ Lift(PRS q (k), m -1) ,
or equivalently,

d = (0, d * ) ∈ PDeg q (m, k) ⇐⇒ d * ∈ PDeg q (m -1, k) .
Proof. (⇒). Let ev P m (X d ) ∈ Lift(PRS q (k), m) where d = (d 0 , d * ) and d 0 = 0. Let also L ∈ Emb P (m -1). We need to prove that ev P 1 (X d * • L ) ∈ PRS q (k). First, notice that any linear map L 0 ∈ Hom(F 2 q , F q ) extends L to L = (L 0 , L ) ∈ Emb P (m). Therefore,

ev P 1 (X d * • L ) = ev P 1 (X 0 0 X d * • L) = ev P 1 (X d • L) (3.10) lies in PRS q (k) since ev P m (X d ) ∈ Lift(PRS q (k), m).
(⇐). Let d = (d 0 , d * ) ∈ S m+1 (v) with d 0 = 0, and assume that ev P m-1 (X d * ) ∈ Lift(PRS q (k), m -1). Let also L ∈ Emb P (m). We need to prove that ev P 1 (X d • L) ∈ PRS q (k). Write L = (L 0 , L ).

If L ∈ Emb P (m -1), then the result follows using (3.10). The case rank L = 1 is a bit trickier. Since Proj k (P 1 ) lets the code PRS q (k) invariant, we can assume without loss of generality that L (S, T) can be written (λ 1 S, . . . , λ m S) with some non-zero tuple (λ 1 , . . . , λ m ) ∈ F m q . Therefore, (X d • L)(S, T) = αS |d * | with α ∈ F q , and ev P 1 (X d • L) = α ev P 1 (S |d * | ) ∈ PRS q (k) since the Preduction of (|d * |, 0) is (k, 0) which lies in Deg(PRS q (k)).

In Propositions 3.21 and 3.22 we avoided the case k = 0. Let us treat it here. PRS q (0) is the repetition code of length (q + 1) over F q . Therefore, the definition of projective lifted codes impose that their codewords correspond to polynomials that evaluate as constants on every projective line of the space. Since projective lines intersects, the constant must be the same for every line. It means that Lift(PRS q (0), m) is the repetition code of length |P m |. Now, notice that this extends Propositions 3.21 and 3.22, by using the convention RS q (-1) := {0}. This leads us to the following theorem. Theorem 3.23. For every m ≥ 2 and 0 ≤ k ≤ q -1, there is a bijection between PDeg(m, k) and

PDeg(m -1, k) ∪ ADeg(m, k -1).
Proof. According to Propositions 3.21 and 3.22, this bijection is given by:

d = (d 0 , d * ) → d * ∈ ADeg(m, k -1) if d 0 = 0 d * ∈ PDeg(m -1, k) otherwise.
A recursive formula on the dimension of lifted codes can be easily derived from the last theorem.

Corollary 3.24. Let m ≥ 2 and 0 ≤ k ≤ q -1. Then,

dim(Lift(PRS q (k), m)) = dim(Lift(PRS q (k), m -1) + dim(Lift(RS q (k -1), m)) .
Since Lift(PRS q (k), 1) = PRS q (k) and Lift(PRS q (k -1), 1) = RS q (k -1), we also get:

Corollary 3.25. Let m ≥ 1 and 0 ≤ k ≤ q -1. Then, dim(Lift(PRS q (k), m)) = m ∑ j=1 dim(Lift(RS q (k -1), j)) + 1 .
It could be interesting to make PDeg q (m, k) explicit, as it was done for affine lifted codes. To achieve this, we use iteratively the bijective map given in Theorem 3.23 and the characterisation of ADeg q (j, k -1), 1 ≤ j ≤ m, given in Equation (3.6). For d = (d 0 , . . . , d m ) ∈ S m+1 (v), define i min (d) the minimum i such that d i = 0, and η(d) = (d i min (d)+1 , . . . , d m ) ∈ S m-i min (d) (v).

We then obtain:

Corollary 3.26. Let m ≥ 2 and 0 ≤ k ≤ q -1. Denote by v = k + (m -1)(q -1). Then,

PDeg q (m, k) = d, d ∈ S m+1 (v) such that ∀e ≤ p η(d), |e| ≤ k -1 .
Notice that there exists a bijective transformation sending any degree d ∈ S m+1 (k) to a degree d lying in Deg(Lift(PRS q (k), m)), by adding (q -1)(m -1) to its leftmost non-zero coordinate. Moreover, it holds that ev P m (X d ) = ev P m (X d ), even if formally, the underlying evaluation maps are different since they take as input homogeneous polynomials of distinct degree.

Hence we obtain another corollary, being the projective analogue of Equation (3.7).

Corollary 3.27. Let 1 ≤ k ≤ q -1 and v = k + (m -1)(q -1). Then we have:

PRM q (m, k) ⊆ Lift(PRS q (k), m) ⊆ PRM q (m, v) .
Example 3.28. We give here the smallest example of a projective lifted code that is not isomorphic to a projective Reed-Muller code. This is the analogue of Example 2.16 presented in a previous chapter. Let q = 4, m = 2 and k = 3, giving v = k + (m -1)(q -1) = 6. The projective Reed-Muller code PRM q (m, k) = PRM 4 (2, 3) has length q 2 + q + 1 = 21, dimension ( m+k k ) = 10, and admits D = {(3, 0, 0), (2, 1, 0), (2, 0, 1), (1, 2, 0), (1, 1, 1), (1, 0, 2), (0, 3, 0), (0, 2, 1), (0, 1, 2), (0, 0, 3)} as a degree set. A tedious computation shows that Lift(PRS 4 (3), 2) is given by the following degree set: D L = {(6, 0, 0), (5, 1, 0), (5, 0, 1), (4, 2, 0), (4, 1, 1), (4, 0, 2), (0, 6, 0), (0, 5, 1), (0, 4, 2), (0, 0, 6), (2, 2, 2)} .

One can point out that D L = D ∪ {(2, 2, 2)}, where D is obtained by adding q -1 = 3 to the leftmost non-zero coordinate of every d ∈ D. Furthermore, the affine lifted code Lift(RS 4 (2), 2) has the following degree set:

D A = {(0, 0), ( 1
, 0), (0, 1), (2, 0), (1, 1), (0, 2), (2, 2)} .

We see that D A corresponds to the puncturing on their first coordinate of elements d ∈ D L such that d 0 = 0. We also notice that the set of remaining elements is {(0, 6, 0), (0, 5, 1), (0, 4, 2), (0, 0, 6)} .

In other words, these are elements which, punctured at first on their first coordinate, and then P-reduced, give the degree set {(3, 0), (2, 1), (1, 2), (0, 3)} of PRS 4 (3).

Finally, notice that the extra degree (2, 2, 2) which makes Lift(PRS 4 (3), 2) larger than PRM q (2, 3) corresponds to the codeword c = ev P 2 (X 2 Y 2 Z 2 ). Similarly to Example 2.16, one can then confirm that any embedding (S, T) → (a 0 S + b 0 T, a 1 S + b 1 T, a 2 S + b 2 T) sends c to a projective Reed-Solomon codeword.

Local correction

After Guo et al.'s work [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF], we know that affine lifted codes are perfectly smooth locally correctable codes -see also Subsection 2.2.3. In this section, we prove that projective lifted codes have similar local correction properties. For convenience, throughout this section we fix a projective lifted code C = Lift(PRS q (k), m). We also denote by n = θ m,q its length and by v = k + (m -1)(q -1) the degree of polynomials evaluated in C.

By definition of projective lifted codes, if c = ev P m ( f ) ∈ C, then ev P 1 ( f • L) ∈ PRS q (k) for all L ∈ Emb P (m). In Remark 3.14 we noticed that ev P 1 ( f • L) is not a subword of c. Nevertheless, there still exists w (L,v) ∈ (F × q ) q+1 such that (w (L,v) ) -1 ev P 1 ( f • L) is such a subword. Given L and the standard representation of points in P 1 , each F q -symbol in w (L,v) is expressed as the v-th power of a linear combination of O(m) other F q -symbols. Moreover, a v-th power can be computed as k-th power since every x ∈ F q satisfies x q = x. Therefore, the tuple (w (L,v) ) -1 ∈ F P 1 q can be computed in O(mq log k) operations over F q . To sum up we get: Lemma 3.29. Let c = ev P m ( f ) ∈ Lift(PRS q (k), m) and L ∈ Emb P (m). There exists a deterministic algorithm which computes ev P 1 ( f • L) from c and L, with q + 1 queries to c and O(mq log k) operations in F q .

Let us now denote by ∞ the point (0 : 1) ∈ P 1 , and for a given u ∈ P m , Emb P (m, u) := {L ∈ Emb P (m), ev ∞ (L) = u} the set of embeddings having u as image of the point at infinity.

We present in Algorithm 10 a generic local correcting algorithm for projective lifted codes. It is very similar to Algorithm 6 that locally corrects affine lifted codes. As well, this algorithm depends on a locality parameter ∈ [k + 1, q], and it informally works as follows: (i) it picks at random points on a random projective line of P m so that individual queries are uniform, (ii) it corrects the associated noisy PRS q (k) codeword, and (iii) it outputs the desired corrected symbol.

For this purpose, we assume to have at our disposal an error-and-erasure correcting algorithm for PRS q (k), which corrects q + 1 -erasures and up to t = -k-1 2 errors (we recall that PRS q (k) is an MDS code of dimension k + 1). We call Corr PRS this correcting algorithm. For instance, one can use extensions of classical correcting algorithms for Reed-Solomon codes, as presented by Dür [START_REF] Dür | The Decoding of Extended Reed-Solomon Codes[END_REF] and Jensen [START_REF] Jensen | On Decoding Doubly Extended Reed-Solomon Codes[END_REF]. Proposition 3.30. Let k + 1 ≤ ≤ q and t = -k-1 2 . For every δ ≤ t+1 2 , the code Lift(PRS q (k), m) is a perfectly smooth ( , δ, δ t+1 )-locally correctable code using Algorithm 10.

Proof. The proof is exactly the same as for Proposition 2.20.

For the sake of completeness, we exhibit the two extreme instances ( = k + 1 and = q) which correspond respectively to a low-error and high-error correction setting.

Corollary 3.31 ( = k + 1). For every δ ≤ 1 2(k+1) , the code Lift(PRS q (k), m) is a perfectly smooth (k + 1, δ, δ(k + 1))-locally correctable code.

Proof. = k + 1 implies t = 0. Corollary 3.32 ( = q). Let τ = 1 q q-k-1 2

. For every δ ≤ τ/2, the code Lift(PRS q (k), m) is a perfectly smooth (q, δ, δ/τ)-locally correctable code.

Proof. We have δ /(t + 1) ≤ δ/τ, since t = τ . Algorithm 10: A generic local correcting algorithm of locality ∈ [k + 1, q] for C = Lift(PRS q (k), m) Input: a point u ∈ P m , and an oracle access to y ∈ F P m q such that d(y, c) ≤ δn, for some c = ev P m ( f ) ∈ C, where n = |P m |. Output: ev u ( f ) with high probability /* Corr A denotes a half-distance (q + 1 -)-erasure correcting algorithm for the code C |A isomorphic to PRS q (k). */ 1 Pick uniformly at random L ∈ Emb P (m) such that u ∈ A := L(P 1 ). 2 Toss a random binary coin b ∈ {0, 1}, following B(p) with p = (q-1) q m+1 -1 . 3 if b = 0 then 4 Pick uniformly at random a subset A ⊂ A \ {u} of size .

else 6

Pick uniformly at random a subset A ⊂ A \ {u} of size -1.

7

Add u in A .

8 Query {y x : x ∈ A }. 9 Define y ∈ (F q ∪ {⊥}) A by:

y x := (w (L,v) ) x • y x if x ∈ A , ⊥ otherwise,
where we recall that w (L,v) is such that w (L,v)

c |A = ev P 1 ( f • L) ∈ PRS q (k).
10 Run Corr A on input y . 11 if Corr A fails then 12 Abort.

else 14

Denote by y ∈ F A q the output of Corr A . Output y u .

It must be noticed that, in the minimum locality setting = k + 1, we obtain an LCC with parameters of the kind ( , δ, δ ). These parameters were already obtained for the local correction of design-based codes (Proposition 2.30) and of Reed-Muller codes in the minimum locality case (Proposition 2.10). In the maximum locality setting = q, we obtain parameters of the kind ( , δ, 2δ/δ loc ), where δ loc is the relative minimum distance of the local PRS code. Once again, these parameters are similar to those of the first local correcting algorithm of Reed-Muller codes (Proposition 2.10), for instance.

Remark 3.33. In Algorithm 10, we can avoid to compute the tuple w (L,v) . Indeed, it can be proved that for every projective line A ⊂ P m and every point u ∈ A, there exists an L ∈ Emb P (m) such that L(P 1 ) = A, u ∈ {ev (1:0) (L), ev ∞ (L)} and w (L,v) = (1, . . . , 1).

Let L ∈ Hom(F 2 q , F m+1 q ) such that L(P 1 ) = A and L(∞) = u (for instance). The matrix of L in the canonical basis is then

M =     . . . . . . a u . . . . . .     .
Define i the minimum integer such that (a i , u i ) = 0, and j > i the minimum integer such that the minor a i u i a j u j is invertible.

If u i = 0, then by definition of i, it must hold that a 0 = • • • = a i-1 = 0. We then compute

M =     . . . . . . u 1 λ (a -u) . . . . . .     ,
where λ is the first non-zero coordinate of au. Let L ∈ Hom(F 2 q , F m+1 q

) with matrix M . Then L (P 1 ) = L(P 1 ) = A since P 1 is invariant under Iso(F 2 q ). Moreover, we can check that L ((1 : 0)) = u, and that L preserves the standard representation. Hence, w (L ,v) = 1.

If u i = 0, then we compute M =     . . . . . . 1 µ a u . . . . . .    
where µ is the first non-zero coordinate of a. Similarly to the previous case, L (P 1 ) = A, and points in L (P 1 ) are written in standard representation, hence w (L ,v) = 1. Finally, we see that L (∞) = u.

Intertwined relations between affine and projective lifted codes

In this section we state links between affine and projective lifted codes, notably after shortening and puncturing operations.

Motivation and similar results

The embedding of both P m-1 and A m into P m has raised relations between affine and projective Reed-Muller codes. Indeed, the hyperplane at infinity Π ∞ := {x ∈ P m , x 0 = 0} defines a restriction map π :

F P m q → F Π ∞ q y
→ y |Π ∞ , and π induces a map PRM q (m, k) → PRM q (m -1, k) by seeing Π ∞ as the projective space P m-1 . Moreover, this map is surjective since every m-variate homogeneous polynomial of degree k can be also considered as an (m + 1)-variate homogeneous polynomial of the same degree (in which the new variable, denoted X 0 , does not appear). Furthermore, the vector space K := ker PRM q (m, k)

PRM q (m -1, k) consists in evaluation vectors of homogeneous polynomials P ∈ F q [X 0 , . . . , X m ] H k such that X 0 divides P. That is,

K = {ev P m (X 0 Q(X)), Q(X) ∈ F q [X] H k-1 } .
We now remark that restricting K to coordinates in (P m \ Π ∞ ) A m gives a vector space isomorphic to RM q (m, k -1), since the monomial X 0 evaluates to 1 on every point of A m .

To sum up, we obtain the following short exact sequence:

0 → RM q (m, k -1) → PRM q (m, k) π -→ PRM q (m -1, k) → 0 .
From a coding theoretic point of view, it may be more comfortable to consider this sequence in the terminology of puncturing and shortening of codes. Indeed, up to isomorphism, the surjective map π corresponds to the puncturing of PRM q (m, k) on coordinates lying in A m ⊂ P m , while the injection RM q (m, k -1) -→ PRM q (m, k) corresponds to its shortening on P m-1 ⊂ P m .

A very similar exact sequence holds for the codes based on classical geometric designs. For instance, we have

0 → Code(AG t (m, q)) → Code(PG t (m, q)) π -→ Code(PG t (m -1, q)) → 0 .
This result is presented by Assmus and Key in [AK92, Lemma 5.7.1] for the dual of these codes, but it remains true for the codes we consider, since duality of codes preserves such short sequences.

In this section, our goal is to prove similar results for lifted codes.

Shortening and puncturing projective lifted codes

We recall that Π ∞ denotes the hyperplane of P m defined by X 0 = 0.

Theorem 3.34. Let m ≥ 1, 1 ≤ k ≤ q -1, and v = k + (m -1)(q -1). Let also C = Lift(PRS q (k), m). Then we have Short(C, Π ∞ ) = Lift(RS q (k -1), m) and Punct(C, P m \ Π ∞ ) = Lift(PRS q (k), m -1).
Proof. For short, we denote by S = Short(C, Π ∞ ) and P = Punct(C, P m \ Π ∞ ).

(i) Proof of S = Lift(RS q (k -1), m). Let c = ev A m (X d ) ∈ Lift(RS q (k -1), m) and extend it to

c = ev P m (X d 0 0 X d ), with d 0 = v -|d| > 0.
We have c ∈ Lift(PRS q (k), m) due to our previous study of degree sets (see Theorem 3.23). Thus, we simply notice that c vanishes on Π ∞ , and that c = c elsewhere, hence c ∈ S.

Conversely, let c ∈ S. There exists f ∈ F q [X] H v such that c = ev P m ( f ) satisfies c = 0 over all coordinates of Π ∞ , and c = c elsewhere. It means that the polynomial f vanishes on the whole projective hyperplane Π ∞ given by X 0 = 0. Therefore f vanishes over the affine hyperplane Π ∞ ⊆ A m+1 given by X 0 = 0.

The previous remark makes sense since we can apply the Combinatorial Nullstellensatz proved by Alon in [START_REF] Alon | Combinatorial Nullstellensatz[END_REF]. This result asserts the following. Assume that W = ∏ m i=0 W i ⊆ F m+1 q and that deg( f ) can be written as |t| = ∑ m i=0 t i , where each t i < |W i |. Then, f (W) = {0} implies that f t = 0, where f t denotes the coefficient of the monomial X t in f . In our context, let W = {0} × F m q and t satisfies t 0 = 0 and t i ≤ q -1 for all i > 0. The Combinatorial Nullstellensatz then shows that Coeff( f , X t ) = 0. Therefore every monomial in f must be divisible by X 0 . Said differently, f is a sum of monomials X d with d such that d 0 = 0, and Proposition 3.21 then shows that ev A m ( f ) ∈ Lift(RS q (k -1), m).

(ii) Proof of P = Lift(PRS q (k), m -1). First, we see that Lift(PRS q (k), m -1) ⊆ P. Indeed, a codeword c = ev P m-1 (X d ) ∈ Lift(PRS q (k), m -1) can be extended to c = ev P m (X d ) ∈ Lift(PRS q (k), m), where we define d by adding q -1 to the leftmost non-zero coordinate of d.

Conversely, let c = ev P m ( f ) ∈ Lift(PRS q (k), m) such that c |Π ∞ ∈ P \ {0}. Let X d be a monomial in f . If d 0 = 0, then ev P m (X d ) |Π ∞ = 0, hence one can assume that every monomial X d composing f satisfies d 0 = 0. Using Proposition 3.22 and linearity, we get that c |Π ∞ ∈ Lift(PRS q (k), m -1). Remark 3.35. For m = 1, we know that by definition, Lift(RS q (k -1), 1) = RS q (k -1) and Lift(PRS q (k), 1) = PRS q (k). Therefore, Theorem 3.34 rewrites the well-known result stating that the shortening at infinity of the projective Reed-Solomon code is a classical Reed-Solomon code of dimension one less. Theorem 3.34 also translates in terms of exact sequences: Corollary 3.36. The following exact sequence holds for every 1 ≤ k ≤ q -1 and m ≥ 1:

0 → Lift(RS q (k -1), m) → Lift(PRS q (k), m) π -→ Lift(PRS q (k), m -1) → 0 ,
where π is the restriction map to points at infinity.

Projective lifted codes as generalised design-based codes

We here prove that projective lifted codes are generalised design-based codes. Let D = (P m , B) = PG 1 (m, q) be the classical design of points and projective lines.

For B ∈ B, let L ∈ Emb P (m) such that L(P 1 ) = B. If 0 ≤ k ≤ q -1, we define the code L (k) B ⊆ F B
q , as the image of PRS q (k) by the action of L on its support P 1 . In other words, L

B := L * (PRS q (k)) ⊆ F B q . (k)
Finally, we define L (k) := (L (k)

B : B ∈ B). Proposition 3.37. Let L (k) defined as above. The projective lifted code Lift(PRS q (k), m) is the generalised design-based Code q (PG 1 (m, q), L (k) ).

Proof. For every projective line B ∈ B, choose L ∈ Emb P (m) such that L(P 1 ) = B and w (L,v) = 1. Such an embedding exists thanks to Remark 3.33. Define the code L B = (w (L,v) ) -1 PRS q (k) = PRS q (k). According to Remark 3.14, we know that for all c = ev P m ( f ) ∈ Lift(PRS q (k), m), we have c |B = ev P 1 ( f • L). Therefore c |B lies in PRS q (k). By definition, we then get

Lift(PRS q (k), m) = {c ∈ F P m q | ∀B ∈ B, c |B ∈ PRS q (k)} = Code q (PG 1 (m, q), L) .
In particular, if k = q -1, we see that projective lifted codes are actually codes based on the design PG 1 (m, q). Let us now recall that the rank of such designs was given in Chapter 1. Hence, we get:

Corollary 3.38. For any t ≥ 1 and any prime p, we have:

dim Lift(PRS p t (2, p t -1)) = p 2t + p t - p(p + 1) 2 t .
Remark 3.39. Very similarly, let AG 1 (m, k) = (X, B). For B ∈ B and 0 ≤ k ≤ q -2, we can define L

B := L * (RS q (k)) ⊆ F B q a code isomorphic to RS q (k), where L(A 1 ) = B. A result similar to Proposition 3.37 then holds for affine lifted codes:

Lift(RS q (k), m) = Code(AG 1 (m, k), (L (k) B : B ∈ B)) .
Of course, every u = φ(ω i β dj ) ∈ U is not necessarily represented in a standard form. Denote by x u ∈ F m+1 q its standard form. As usual we have x u = λ u u for some λ u ∈ F × q , and we can define

w (v) := ((λ u ) -v : u ∈ U) ∈ (F × q ) U .
Similarly to the definition of ev P m given previously, we can define an evaluation map over U ⊂ F m+1 q by ev U : F q [X 0 , . . . , X m ] → F U q , f → ( f (u) : u ∈ U). The proof of the following lemma is elementary. Lemma 3.43. Assume n/d and q -1 are coprime, and recall that v = k + (m -1)(q -1). Let C = Lift(PRS q (k), m), and denote by D = Deg(C). Let finally C = ev U (Poly(D)). Then, C = w (v) C , when coordinates U ⊂ F m+1 q \ {0} are seen as projective points.

Let us now introduce σ : F q m+1 → F q m+1 given by x → βx. We also denote by ψ := φ • σ • φ -1 the associated map over the vector space F m+1 q . It is clear that ψ ∈ Hom(F m+1 q , F m+1 q ), and since σ and φ are bijective maps, we get ψ ∈ Iso(F m+1 q ). For i ≥ 0, we finally denote by ψ i the i-fold composition of ψ. Notice that ψ i (x) = φ(ω i(q-1) φ -1 (x)) holds for every point x ∈ P m . Proposition 3.44. If n/d and (q -1) are coprime, then C := w (v) Lift(PRS m (k), m) is quasicyclic of index d, through the permutation ψ d ∈ S(U). The orbits of ψ d are given by the subsets U i ,

0 ≤ i ≤ d -1.
Proof. We can check that ψ d (U) = U, hence ψ d ∈ S(U). Since ψ d ∈ Iso(F m+1 q ), the polynomial space Poly(D), D = Deg(C), is invariant under ψ d . Moreover, we have C = ev U (Poly(D)) thanks to Lemma 3.43. Therefore ψ d ∈ Perm(C ).

Let us now prove that ψ d is an (n/d)-cycle. For φ(ω i β jd ) ∈ U i , we have

ψ d (φ(ω i β jd )) = φ(ω i β jd β d ) = φ(ω i β (j+1)d ) ∈ U i .
It remains to show that the order of ψ d is n/d. Since φ is one-to-one and U represents P m , for every 0 ≤ s ≤ t < n/d we have:

∀u ∈ U i , (ψ d ) s (u) = (ψ d ) t (u) ⇐⇒ ω (t-s)d(q-1) = 1 ⇐⇒ n | (t -s)d(q -1) .
Our assumption on n/d and (q -1) implies that t = s; hence ψ d has order n/d. As a corollary, when d = 1 we obtain the following result. Corollary 3.45. If n and q -1 are coprime, then for all 1 ≤ k ≤ q -1 the code

w (v) Lift(PRS q (k), m)
is a cyclic code. Remark 3.46. A very similar approach was used by Berger and de Maximy in [START_REF] Thierry | Cyclic Projective Reed-Muller Codes[END_REF], in order to prove the quasi-cyclicity of codes isomorphic to our definition of projective Reed-Muller codes.

Explicit information sets

In this section, we give explicit information sets for projective lifted codes. Among other applications, such sets are useful to extend the local correctability of lifted codes to a local decodability property (see [START_REF] Yekhanin | Locally Decodable Codes[END_REF]).

Our techniques are highly inspired by the work of Guo and Kopparty [GK16, Appendix A]. We also prove a stronger result, being that a large family of affine evaluation codes present the same information sets as affine lifted codes.

Monomiality of bounded degree affine evaluation codes.

Similarly to the previous section, let φ : F q m → F m q be an F q -isomorphism. We denote by F q [X] ∞ q-1 := Poly(B m ∞ (q -1)) the space of m-variate polynomials of partial degree bounded by q -1.

If f ∈ F q [X] ∞
q-1 is seen as a function, then the map f • φ : F q m → F q m can be interpolated uniquely as a univariate polynomial F q m [X] of degree less than q m -1. We denote by φ * this process, which also appears to be an F q -isomorphism:

φ * : F q [X] ∞ q-1 → F q m [X] q m -1 f (X) → ( f • φ)(X) .
For a nonzero a ∈ F × q m , we denote by µ a :

F q m → F q m , x → ax. It is well-known that Iso(F q m ) = {µ a , a ∈ F × q m }. Every map µ a being F q -linear, we can define M a := φ • µ a • φ -1 ∈ Iso(F m q )
. The map M a is often known as the F q -homomorphism of the multiplication by a ∈ F q m . Let F be a subspace of F q [X]. The group of automorphisms of F , denoted Aut(F ), is the group of invertible linear maps F q [X] → F q [X] which let the set F invariant. We also recall that every φ = (φ 1 , . . . , φ m ) ∈ Hom(F m q ) can be seen as a linear map F q [X] → F q [X], through the action φ * ( f ) : f (X) → f (φ 1 (X), . . . , φ m (X)).

Lemma 3.47. Let F be a subspace of F q [X] ∞ q-1 , and assume that Iso(F m q ) ⊆ Aut(F ). Then Iso(F q m ) ⊆ Aut(φ * (F )).

Proof. Let f • φ ∈ φ * (F ). For every µ a ∈ Aut(F q m ), we have f • φ • µ a = f • M a • φ by definition of the matrix of the multiplication by a. But M a ∈ Aut(F m q ), hence f • M a ∈ F and we get f • φ • µ a ∈ φ * (F ).
Let us define the subgroup of diagonal isomorphisms

Diag(F m q ) := {diag a : x → (a 1 x 1 , . . . , a m x m ), a ∈ (F × q ) m } ⊆ Iso(F m q ) .
Proposition 3.48. Let F be a subspace of m-variate polynomials of partial degree bounded by q -2,

that is F ⊆ Poly(B m ∞ (q -2)). If Diag(F m q ) ⊆ Aut(F ), then F is generated by monomials. Proof. Let f ∈ F , such that f (X) = ∑ d∈D f d X d with D = {d ∈ N m , f d = 0}. It is sufficient to prove that for all d ∈ D, X d lies in F . Let d ∈ D.
Similarly to the proof of Theorem 3.17, we define

Q d (X) := (-1) m ∑ a∈(F × q ) m m ∏ i=1 a -d i i ( f • diag a )(X)
Since F is a vector space and Diag(F m q ) ⊆ Aut(F ), we see that

Q d (X) ∈ F . Q d (X) = ∑ a∈(F × q ) m m ∏ i=1 -a -d i i ∑ j f j a j 1 1 . . . a j m m X j = ∑ j f j ∑ a∈(F × q ) m m ∏ i=1 -a j i -d i i X j = ∑ j f j m ∏ i=1 -∑ a i ∈F × q a j i -d i i =0 if d i =j i , 1 otherwise X j = f d X d .
We know that d ∈ D, hence f d = 0 and by linearity we obtain

X d = 1 f d Q d (X) ∈ F .
Notice that the last result can be seen as a reformulation of the monomial extraction lemma of Kaufman and Sudan [START_REF] Kaufman | Algebraic Property Testing: the Role of Invariance[END_REF] in the case of invariance under diagonal automorphisms of the affine space.

Information sets of some affine evaluation codes.

Lemma 3.49. Let F ⊆ Poly(B m ∞ (q -1)) and assume that S ⊆ A 1 (F q m ) is an information set for ev A 1 (φ * (F )). Then φ(S) is an information set for ev A m (F ).

Proof. This follows from the fact that φ * (F ) = { f • φ, f ∈ F } and φ is an F q -isomorphism.

In the next proposition, we give a result that improves upon the theorem given by Guo and Kopparty in [GK16, Appendix A], in the specific case of codes evaluating polynomials with partial degree bounded by q -2 (which is the case for many interesting codes). Indeed, their result holds for affine-invariant codes while here we only need codes invariant under Iso(F m q ). Proposition 3.50. Let C = ev A m (F ) be an affine evaluation code of dimension k over F q , and assume that F ⊆ Poly(B m ∞ (q -2)) and Iso(F m q ) ⊆ Aut(F ). Then, for every primitive element ω of F q m , and every isomorphism φ : F q m → F m q , the set {φ(ω), . . . , φ(ω k )} is an information set for C.

Proof. Thanks to Lemma 3.49, it is sufficient to prove that S = {ω, . . . , ω k } is an information set for C = ev A 1 (φ * (F )). Moreover, since Diag(F m q ) ⊆ Iso(F m q ), Proposition 3.48 and Lemma 3.47 ensures that C is monomial. Denote by I = Deg(C ) = {i 1 , . . . , i k }, and let g(X) = ∑ i∈I a i X i ∈ F . We need to prove that:

g = 0 =⇒ ev S (g) = 0 .
To this end, let us remark that

     ω i 1 ω i 2 . . . ω i k ω 2i 1 ω 2i 2 . . . ω 2i k . . . . . . . . . . . . ω ki 1 ω ki 2 . . . ω ki k           a 1 a 2 . . . a k      =      g(ω) g(ω 2 ) . . . g(ω k )      = ev S (g) .
Since the left-hand square matrix is a Vandermonde matrix and ω is primitive, it is invertible and the result is proved.

As a corollary we retrieve Guo and Kopparty's result, since Iso(F m q ) is a subgroup of the group of affine transformations. [START_REF] Guo | List-Decoding Algorithms for Lifted Codes[END_REF]). Let C = Lift(RS q (k), m) for k ≤ q -2. Then, for every ω primitive element of F q m , and every φ isomorphism F q m → F m q , the set {φ(ω), . . . , φ(ω dim C )} is an information set for C.

Corollary 3.51 (given in

The case of projective evaluation codes. We would like to prove a similar result for projective lifted codes. Unfortunately, it does not make sense to define an isomorphism between P 1 (F q m ) and P m (F q ) since they do not have same cardinality. To solve this issue, our idea is to decompose P m (F q ) into affine parts, and to use recursively the links between projective and affine lifted codes we stated in Section 3.2.

Let P m (F q ) = m i=0 A m,i (F q ), where A m,i (F q ) := {(0 : . . . : 0 : 1 : x 1 : . . . :

x i ), (x 1 , . . . , x i ) ∈ A i (F q )} .
Informally, A m,i (F q ) is the affine part of the i-dimensional projective subspace at infinity of P m (F q ). Theorem 3.52. Let C = Lift(RS q (k), m) for k ≤ q -1. Let us fix, for every 1 ≤ i ≤ m, a primitive element ω i of F q i and an isomorphism φ i :

F q i → A m,i (F q ). Then, the set S = m i=0 {φ i (ω i ), . . . , φ i (ω dim C i i )}
is an information set for C, where C i = Lift(RS q (k -1), i) for i > 0, and by convention, dim(C 0 ) = 1 and φ 0 (F q 0 ) := {(0 : . . . : 0 : 1)}.

Proof. We proceed by induction on m.

-Case m = 1. Since C = PRS q (k) is an MDS code of dimension k + 1, any (k + 1)-subset of P 1 is an information set for C. In particular, S = {(0 : 1)} ∪ {φ 1 (ω 1 ), . . . , φ 1 (ω k 1 )} is one of them. -Induction step. Assume the result holds for step m -1. A basis of Lift(PRS q (k), m) consists in evaluating monomials with exponents in PDeg q (m, k). Thanks to Theorem 3.23, we know that PDeg q (m, k) is in bijection with the disjoint union ADeg q (m, k -1) ∪ PDeg q (m -1, k), where the bijection is given in the proof of the theorem. Hence, there exists a generator matrix of Lift(PRS q (k), m) defined as follows:

                      G 0 0 * G 1 • • • (1 : x 1 : . . . : x m ) • • • (0 : . . . )                              A m (F q )            P m-1 (F q )          evaluation of monomials with degrees in ADeg(m, k -1)    evaluation of monomials with degrees in PDeg(m -1, k)
where G 0 and G 1 are respective generator matrices for the codes Lift(RS q (k -1), m) and Lift(PRS q (k), m -1).

Since G 0 and G 1 are full-rank, we know that the union of an information set S 0 of Lift(RS q (k -1), m) and an information set S 1 of Lift(PRS q (k), m -1) gives an information set S of Lift(PRS q (k), m). Information sets of affine lifted codes are described in Corollary 3.51 (we just need to take care about the way we represent affine points in the projective space, whence the definition of the A m,i , 1 ≤ i ≤ m). Therefore we have

S 0 = {φ m (ω m ), . . . , φ m (ω dim C m m
)} where φ m , ω m are defined as in the statement of the theorem. Moreover, the inductive step gives the information set of Lift(PRS q (k), m -1): it is exactly

S 1 = m-1 i=0 {φ i (ω i ), . . . , φ i (ω dim C i i
)}. Setting S = S 0 ∪ S 1 finally leads us to the result at step m.

Estimation of the minimum distance

We give bounds on the minimum distance of a projective lifted code, depending on the minimum distance of the underlying projective Reed-Solomon code. In this section, nz P m ( f ) denotes the number of zeroes of f ∈ F q [X 0 , . . . , X m ] H v over the set P m , and recall that θ m,q = q m+1 -1 q-1 .

Proposition 3.53 (upper bound)

. Let 1 ≤ k ≤ q -1 and PRS q (k) be the projective Reed-Solomon code of dimension k + 1 and distance d = q + 1 -k. Then the distance D of Lift(PRS q (k), m) satisfies:

D ≤ dq m-1 + θ m-2,q .
As a corollary, the respective relative distances δ and ∆ of PRS q (k) and Lift(PRS q (k), m) satisfy:

∆ ≤ (1 -b)δ + b, where 0 ≤ b ≤ q -2 .
Proof. Let c = ev P 1 (g) ∈ PRS q (k) be a minimum-weight codeword, i.e. wt(c) = d. Assume that g(X 0 , X 1 ) = ∑ k i=0 g i X i 0 X k-i 1 , and let f (X 0 , . . . , X m ) := g 0 X (q-1)(m-1)+k 1

+ k ∑ i=1 g i X (q-1)(m-1)+i 0 X k-i 1 ∈ F q [X 0 , . . . , X m ] H v
where v = (q -1)(m -1) + k. By studying the degrees of f , one can check that c := ev P m ( f ) ∈ Lift(PRS q (k), m). Moreover, for every (x 0 : x 1 ) ∈ P 1 , we have:

f (x 0 , x 1 , x 2 , . . . , x m ) = g(x 0 , x 1 ), ∀x = (x 2 , . . . , x m ) ∈ F m-1 q .
Hence c is non-zero, and:

D ≤ wt(c ) = θ m,q -nz P m ( f ) ≤ θ m,q -nz P 1 (g) q m-1 = θ m,q -q m-1 (q + 1 -d) . (3.11)
It remains to notice that θ m,q -(q + 1)q m-1 = θ m-2,q . For the bound on the relative distance, we divide both sides of Equation (3.11) by θ m,q and we use the definition d = (q + 1)δ. Then we get:

∆ ≤ 1 + (δ -1)a ,
where a = (q+1)q m-1

θ m,q = 1 -q m-1 -1 q m+1 -1 satisfies 1 -q -2 ≤ a ≤ 1. Denoting b = 1 -a concludes the proof.
Proposition 3.54 (lower bound). Let 1 ≤ k ≤ q -1 and PRS q (k) be a projective Reed-Solomon code of dimension k + 1 and distance d = q + 1 -k. Then the distance D of Lift(PRS q (k), m) satisfies:

D ≥ 1 + (d -1)θ m-1,q
where θ m-1,q = q m -1 q-1 . As a corollary, the relative distances δ of PRS q (k) and ∆ of Lift(PRS q (k), m) satisfy:

∆ ≥ (1 -b )δ -b , where 0 ≤ b ≤ q -1 .
Proof. Proposition 3.37 shows that the code Lift(PRS q (k), m) is a generalised design-based code Code(PG 1 (m, q), L). Every L B is isomorphic to a projective Reed-Solomon code PRS q (k) which has minimum distance d. Therefore the bound D ≥ 1 + (d -1)θ m-1,q comes from Proposition 2.34. Dividing both sides by θ m,q and using θ m,q = qθ m-1,q + 1, we finally get:

∆ ≥ (q + 1)θ m-1,q θ m,q δ - θ m-1,q -1 θ m,q ≥ (1 -b )δ -b , where b = θ m-1,q -1 θ m,q
= qb and b is defined in the previous proposition.

We do not have any result concerning the sharpness of the bounds presented in Propositions 3.53 and 3.54. Yet, letting q → ∞ for fixed 0 < δ < 1, we see that the family of lifted codes {Lift(PRS q ((q + 1)(1δ)), m)} q reaches the same asymptotical relative distance δ as the family of PRS codes {PRS q ((q + 1)(1δ))} q .

Rate and degree sets of lifted codes

The explicit construction of affine and projective lifted codes is not as easy as many other families of codes, since their definition is not constructive. It is still possible to build a paritycheck matrix for these codes, by listing the parity-check equations given by the constraints on the lines. Then, a basis of the code can be obtained by solving a linear system. However, this technique admits two main drawbacks. First, it does not produce a basis of the code that we really understand (for instance, we have few information about which polynomials are evaluated in the basis we obtain). Second, it can be quite inefficient: the number of equations of the linear system can be quadratic in the dimension of code we look for, since for large values of m, the number of lines in A m or P m is almost quadratic in the number of points.

The degree set of a lifted code provides a solution to the first issue: it gives a simple and understandable basis of the code, since it represents the exponents of a monomial basis. Though its definition is not constructive either, in Subsection 3.6.1 we propose an algorithm to compute it efficiently. Subsection 3.6.2 is devoted to the analysis of the degree sets of second order lifted codes (m = 2).

Notice that this section mainly focuses on affine lifted codes, since we have seen in Theorem 3.23 that degree sets of projective lifted codes can be obtained easily from those of affine lifted codes.

Computation of degree sets

Let S ⊆ [0, q -1] m . We know that (S, ≤ p ) is a partially ordered set, or poset. Assume that S = [0, k] m . A rewriting of the degree set D = Deg(Lift(RS q (k), m)) is given by

D = d ∈ S | ∀e ∈ Low S (d), |e| ≤ k . (3.12)
Using Equation (3.12), the following lemma can be easily stated.

Lemma 3.55. The degree set Deg(Lift(RS

q (k), m)) is ≤ p -closed in S = [0, k] m .
More generally, one must notice that this result can be seen as a consequence to the fact that Aff(F m q ) ⊆ Aut(Lift(RS q (k), m)).

Lemma 3.56. The degree set of every monomial affine-invariant code C is ≤ p -closed, where p is the characteristic of the base field.

Proof. Original proof of this lemma can be found in a paper of Kaufman and Sudan [START_REF] Kaufman | Algebraic Property Testing: the Role of Invariance[END_REF].

A direct consequence of Lemma 3.55 is that, if some tuple e / ∈ Deg(Lift(RS q (k), m)), then we have Up S (e) ∩ Deg(Lift(RS q (k), m)) = ∅. It naturally leads us to the design of Algorithm 12, which computes the degree set of affine lifted codes. Notice that Algorithm 12 makes use of a subroutine JoinUp given in Algorithm 11. This subroutine simply computes efficiently the union between Up S (d), for some d ∈ S = [0, k] m , and a subset C ⊆ S whose complementary set is ≤ p -closed. We also assume that: The study of degree sets is linked with the concept of defining set of cyclic codes. One must first notice that a code C invariant under Aff(F m q ) can be viewed as the extension of a cyclic code. Indeed, puncture C at 0 ∈ A m . Then C = Punct(C, {0}) is cyclic, since the group of affine transformation that fix 0 contains a cyclic subgroup.

Kasami, Lin and Peterson [START_REF] Kasami | Some Results on Cyclic Codes which Are Invariant under the Affine Group and Their Applications[END_REF] proved that, in the univariate case, every affine-invariant code C extending a primitive cyclic code can be described by a so-called defining set I ⊆ [0, q -1]. Originally, this defining set represents the exponents i of zeroes α i ∈ F q of the polynomial representation of codewords in that lie in C. In fact, it can be proved that, for such codes, I = Deg(C ⊥ ). Without going into technicalities, using the Mattson-Solomon transform, one can write extended cyclic codes as evaluation codes (arguments can be found in Wolfmann's paper [START_REF] Wolfmann | New Bounds on Cyclic Codes from Algebraic Curves[END_REF]). Then, affine-invariance proves that these codes are monomial (or trace-monomial if the alphabet is a subfield of F q ). Finally, analysing the degree sets with the help of Charpin's work [START_REF] Charpin | Codes cycliques étendus affines-invariants et antichaînes d'un ensemble partiellement ordonné[END_REF] provides the claim.

The case m = 2

In this subsection we focus particularly on the case m = 2, since it is the most simple and it gives the best code rates. More precisely, we describe the degree set of affine lifted codes Lift(RS p e (k, 2)) for prime powers p e and k ≤ p e -1.

We first need to introduce a few notation. For 0 ≤ k ≤ p e -1, we define two particular kind of subsets of [0, p e -1] 2 :

-subsets representing degree sets of affine lifted codes:

A p (e, k) := Deg(Lift(RS p e (k, 2))) ; -subsets representing degree sets of Reed-Muller codes:

R p (e, k) := {(i, j) ∈ [0, p e -1] 2 , i + j ≤ k} .
For an integer 0 ≤ d < p e , we define 2 is represented by a 4 × 4 grid. A black square at coordinates (i, j) means that (i, j) lies in the degree set. and we extend this definition to m-tuples by

∆ p (d) := {d ∈ [0, p e -1], d ≤ p d} , Figure 3.1 -Representation of degree sets R 2 (2, 4), R 2 (2, 2) and A 2 (2, 2). The square S 2 = [0, 2 2 -1]
∆ p (d) = ∆ p (d 1 ) × • • • × ∆ p (d m ).
For convenience, we denote by ψ e (d) the A-reduction of |d| := ∑ i d i when q = p e , as defined in Subsection 3.1.2. Hence we can rephrase the degree set of affine lifted codes as follows:

A p (e, k) = {d ∈ [0, p e -1] 2 , ψ e (∆ p (d)) ⊆ [0, k]} .
Finally, we denote by S e = [0, p e -1] 2 . If e ≥ 2, we partition the square S e into p 2 subsquares S (i,j) e = {(ip e-1 , jp e-1 )} + S e-1 , for 0 ≤ i, j ≤ p -1. Notice that here we denote by A + B := {a + b, a ∈ A, b ∈ B} the Minkowski sum of two subsets A and B of integer tuples.

In the m = 2 setting, we can have a visual representation of degree sets. It is illustrated in Figure 3.1. We see that degree sets R p (e, k) of Reed-Muller codes RM p e (2, k) are represented by discrete triangles if k ≤ p e , and generally by discrete polygons. Degree sets of strict affine lifted codes are more complicated to describe. This is the purpose of the following paragraphs.

Characteristic p = 2. For convenience we write ∆ := ∆ 2 . Our goal is to prove the following result.

Theorem 3.58. Let 0 ≤ k ≤ 2 e -1. The degree set A 2 (e, k) of Lift(RS 2 e (k), 2) satisfies:

A 2 (e, k) = R 2 (e -1, k) ∪ ∆((2 e , 2 e )) + A 2 (e -1, k -2 e-1 ) .
In other words, we want to prove that The lower-bottom one corresponds to the degree set R 2 (3, 14) of a Reed-Muller code, and the three others are equivalent to A 2 (3, 6), the degree set of a smaller lifted code (with the blue frame in Figure 3.2). This decomposition is recursive, as proves the red subsquares in the same figure.

A 2 (e, k) ∩ S (0,0) e = R 2 (e -1, k) A 2 (e, k) ∩ S (1,0) e = {(2 e-1 , 0)} + A 2 (e -1, k -2 e-1 ) A 2 (e, k) ∩ S (0,1) e = {(0, 2 e-1 )} + A 2 (e -1, k -2 e-1 ) A 2 (e, k) ∩ S (1,1) e = {(2 e-1 , 2 e-1 )} + A 2 (e -1, k -2 e-1 ) (3.13)
Proof of Theorem 3.58. First notice that, if k < 2 e-1 , then the theorem is proved thanks to the result of Kaufman and Ron [START_REF] Kaufman | Testing Polynomials over General Fields[END_REF] who essentially showed that Lift(RS q (k), m) = RM(m, k) when k < qq/p. So let us now assume that k ≥ 2 e-1 .

Then, we know that (i, j) ∈ A 2 (e, k) if and only if (j, i) ∈ A 2 (e, k). Hence the second and third equations in (3.13) are equivalent. We finally end our proof by stating Lemmata 3.59 and 3.61 which follow.

Lemma 3.59. Let 2 e-1 ≤ k ≤ 2 e -1. Then, A 2 (e, k) ∩ S (0,0) e = R 2 (e -1, k) Proof. If u ∈ A 2 (e, k) ∩ S (0,0) e , then in particular u 1 + u 2 = ψ e (u) ≤ k. In other words, u ∈ R 2 (e -1, k). Conversely, if u ∈ R 2 (e -1, k), then clearly u ∈ S (0,0) e
. Moreover, for any y ∈ ∆(u), we have ψ e (y) =

y 1 + y 2 ≤ u 1 + u 2 ≤ k. Hence u ∈ A 2 (e, k).
The first equality in (3.13) is therefore proved. We need a preliminary result for the three other statements. Lemma 3.60. Let 2 e-1 ≤ k ≤ 2 e -1, u ∈ S (0,0) e and d ∈ {(2 e-1 , 0), (2 e-1 , 2 e-1 )}. Then, the following assertions are equivalent:

(i) ψ e (∆(u) + ∆(d))) ⊆ [0, k], (ii) ψ e-1 (∆(u)) ⊆ [0, k -2 e-1 ]. Proof. (i) ⇒ (ii). Let v ∈ ∆(u). If v 1 + v 2 < 2 e-1 , then: ψ e-1 (v) = v 1 + v 2 = 2 e-1 + v 1 + v 2 -2 e-1 = ψ e (v + (2 e-1 , 0) ∈∆(u)+∆(d) ) -2 e-1 ≤ k -2 e-1 .
Otherwise,

ψ e-1 (v) = v 1 + v 2 -(2 e-1 -1) ≤ (2 e-1 -1) + v 2 -(2 e-1 -1) = (2 e-1 + v 2 ) -2 e-1
= ψ e ((0, v 2 ) + (2 e-1 , 0)

∈∆(u)+∆(d) ) -2 e-1 ≤ k -2 e-1 . (ii) ⇒ (i). Let v + w ∈ ∆(u) + ∆(d). If v 1 + v 2 < 2 e-1 , we first claim that ψ e (v + w) ≤ v 1 + v 2 + 2 e-1 . It is clear if w = 0. If |w| = 2 e-1 , then ψ e (v + w) = v 1 + v 2 + 2 e-1 . Finally, if |w| = 2 e , then ψ e (v + w) = v 1 + v 2 + 1 ≤ v 1 + v 2 + 2 e-1 . Hence, ψ e (v + w) ≤ v 1 + v 2 + 2 e-1 = ψ e-1 (v) + 2 e-1 ≤ k -2 e-1 + 2 e-1 ≤ k . If v 1 + v 2 ≥ 2 e-1
, then the result holds if w = 0. So assume w = 0. Then,

ψ e (v + w) = v 1 + v 2 + w 1 + w 2 -(2 e -1) ≤ v 1 + v 2 + 1 ≤ ψ e-1 (v) + 2 e-1 -1 + 1 ≤ k -2 e-1 + 2 e-1 ≤ k . Lemma 3.61. Let 2 e-1 ≤ k ≤ 2 e -1.
⊆ A 2 (e -1, k -2 e-1 ). Notice that ψ e (∆(u) + ∆(d)) ⊆ [0, k] since u + d = w ∈ A 2 (e, k). Hence Lemma 3.60 shows that ψ e-1 (∆(u)) ⊆ [0, k -2 e-1 ]
, proving the result we claim.

Since the cardinality of the degree set of a code equals its dimension, we get the following corollary. We now consider the case k = 2 e -2 e-c -1, for some 1 ≤ c ≤ e -1. In other words, it corresponds to setting the information rate of the underlying Reed-Solomon code to 2 -c . In Proposition 3.63, we state an exact formula for the dimension of the associated affine lifted code. This new result improves upon Guo et al.'s Claim 3.19 in [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF], which was only a lower bound on the dimension of the lifted code.

Proposition 3.63. For every

1 ≤ c ≤ e -1. Let k e,c = 2 e -2 e-c -1. Then, dim(Lift(RS 2 e (k e,c ), 2)) = 4 e 1 - 5 4
3 4 c + 1 4 1 4 c + 1 2 e 3 c -1 2 c+2 .
Proof. Let us fix c ≤ e. For every 0 ≤ i ≤ c, define a i := |A 2 (ei, 2 e-i -2 e-c -1)| and r i := |R 2 (e -1 -i, 2 e-i -2 e-c -1)| . Previous corollary translates into

a 0 -3a 1 = r 0 ,
and more generally we have

a i -3a i+1 = r i polygon R 2 (4, 27) polygon R 2 (3, 11) polygon R 2 (2, 3) polygon R 2 (3, 13) polygon R 2 (2, 5) polygon R 2 (1, 1) Figure 3.3 -A typical example of a triangle R 2 (e -k, 2 e-k -2 e-c -1) that can be parti- tioned into polygons of the shape R 2 (e -k -i -1, 2 e-k-i -2 e-c -1), for 0 ≤ i ≤ c -k -1.
The instances correspond to (e, c, k) = (5, 3, 0) (on the left), and (e, c, k) = (5, 4, 1) (on the right).

for every 0 ≤ i ≤ c. Notice that a c = 0 and r c = 0, and recall that we look for a closed formula for a 0 . Therefore, it is useful to notice that:

c-1 ∑ i=0 3 i r i = c-1 ∑ i=0 3 i (a i -3a i+1 ) = a 0 -3 c a c = a 0 .
We now claim that, for every 0 ≤ k ≤ c -1, we have

c-k-1 ∑ i=0 2 i r i+k = t k := 2 e-k -2 e-c + 1 2 .
This can be seen by decomposing the triangle R 2 (ek, 2 e-k -2 e-c -1) into polygons of the shape R 2 (eki -1, 2 e-k-i -2 e-c -1) (see Figure 3.3). Therefore we get c-1 Recall that a black square at coordinate (i, j) means that (i, j) lies is the degree set. For increasing e we observe that the black shape converges to a finite union of triangles.

∑ i=0 3 i r i = c-1 ∑ i=0 2 i r i + c-1 ∑ i=0 (3 i -2 i )r i = t 0 + c-1 ∑ i=1 i-1 ∑ k=0 3 k 2 i-1-k r i = t 0 + c-1 ∑ k=0 c-1 ∑ i=k+1 3 k 2 i-1-k r i = t 0 + c-1 ∑ k=0 3 k c-k-2 ∑ i=0 2 i r i+k+1 = t 0 + c-1 ∑ k=0 3 k t k+1 . (3.14) Then, 2 c-1 ∑ k=0 3 k t k+1 = c-1 ∑ k=0 3 k (2 e-k-1 -2 e-c + 1)(2 e-k-1 -2 e-c ) = c-1 ∑ k=0 3 k (4 e-k-1 + 4 e-c -2 2e-k-c + 2 e-k-1 -2 e-c ) = 4 e-1 c-1 ∑ k=0 (3/4) k + (4 e-c -2 e-c ) c-1 ∑ k=0 3 k + (2 e-1 -2 2e-c ) c-1 ∑ k=0 (3/2) k = 4 e -3 c 4 e-c + (4 e-c -2 e-c )(3 c -1) 2 + 2 e-c 3 c -2 e -2 2e-2c+1 3 c + 2 2e-c+1 .
Hence,

2a 0 = 2t 0 + 2 c-1 ∑ k=0 3 k t k+1 = (2 e -2 e-c + 1)(2 e -2 e-c ) + 2 c-1 ∑ k=0 3 k t k+1 = 4 e + 4 e-c -2 2e-c+1 + 2 e -2 e-c + 4 e -3 c 4 e-c + (4 e-c -2 e-c )(3 c -1) 2 + 2 e-c 3 c -2 e -2 2e-2c+1 3 c + 2 2e-c+1 = 4 e • (2 + 2 -1 4 -c -5 • 2 -1 3 c 4 -c ) + 2 e • (3 c 2 -c-1 -2 -c-1 ) .
Finally, ρ ∞ (c) for Lift(RS q ((1 -2 -c )q -1), 2)

a 0 = 4 e 1 - 5
ρ ∞ (c) for RM q ((1 -2 -c )q, 2)
Figure 3.5 -Asymptotic rates of Reed-Muller codes RM q ((1 -2 -c )q, 2) and affine lifted codes Lift(RS q ((1 -2 -c )q -1), 2), with comparable local correcting capabilities. We make e → ∞, where q = p e . The black curve represents the asymptotic Singleton bound for codes with relative distance 2 -c , corresponding approximately to the relative distance of both Reed-Muller and lifted codes.

of the code tends to the (finite) sum of the area of triangles that show up. To prove this, it is sufficient to see that lim

e→∞ (t k /4 e-k ) = (1 -2 k-c ) 2 /2, where t k := ( 2 e-k -2 e-c +1 2
) is defined in the proof of Proposition 3.63. Furthermore, if c is fixed, we can make e tend to infinity in the equality the asymptotic rate of the family of affine lifting of Reed-Solomon codes of rate 2 -c . Then we get

4 -e a 0 = 4 -e t 0 + c-1 ∑ k=0 3 k t k+1
ρ ∞ (c) = lim e→∞ (4 -e a 0 ) = (1 -2 -c ) 2 2 + 1 4 c-1 ∑ k=0 3 4 k (1 -2 k+1-c ) 2
2 .

An easy computation then shows that

ρ ∞ (c) = 1 - 5 4 3 4 c + 1 4 1 4 c .
In Figure 3.5 we depict the asymptotic rate of lifted codes and Reed-Muller codes, for the setting m = 2, p = 2, e → ∞. We see that lifted codes outperform Reed-Muller codes, and that their rate tends to 1 when we let their relative distance 2 -c tend to 0.

Characteristic p = 2. Odd characteristic makes recursive relations between A p (•, •) and R p (•, •) more complex, since S e = [0, p e -1] 2 must be split into more subsquares S (i,j)

e . By analogy with the even characteristic setting, we claim that A full proof of this result would be very technical to state, but very similar to the one of Theorem 3.58. Instead, we give in Figure 3.6 an overview of the structure of the degree sets for small values of p, e and k.

A p (e, k) ∩ S (i,j) e =    S (i,j) e if i + j ≤ p -3 {(ip e-1 , jp e-1 )} + R p (e -1, k -(p -2)p e-1 ) if i + j = p -2 {(ip e-1 , jp e-1 )} + A p (e -1, k -(p -1)p e-1 ) if i + j ≥ p -1 (3.
Using recursive relations given in (3.15), we get

|A p (e, k)| = p -1 2 • |S (0,0) e | + (p -1) • |R p (e -1, k -(p -2)p e-1 )| + p 2 • |A p (e -1, k -(p -1)p e-1 )|
As previously, we consider the case k = p ep e-c -1, corresponding to lifting Reed-Solomon codes of rate p -c . We also denote by a i := |A p (ei, p e-ip e-c -1)| and by r i := |R p (e -1i, 2p e-i-1 -p e-c -1)|. With arguments very similar to the proof of Proposition 3.63, one can then show that

a i - p 2 a i+1 = p -1 2 p 2(e-i-1) + (p -1)r i , 0 ≤ i ≤ c -1 .
We then obtain

a 0 = c-1 ∑ i=0 p 2 i p -1 2 p 2(e-i-1) + (p -1)r i ,
which leads us, after quite technical computations, to

|A p (e, k)| = a 0 = t 0 + p 2 c-1 ∑ k=0 p + 1 2 k t k+1 ,
where t k := ( p e-k -p e-c +1

2

).

Asymptotic analysis. Recall that lim e→∞ (t k /p 2(e-k) ) = (1 -p k-c ) 2 /2. A quite tedious computation then gives

ρ (p) ∞ (c) = lim e→∞ (a 0 /p 2e ) = 1 -1 + 1 p + 2 1 + 1/p 2 c + 1 p + 2 1 p 2 c .
One can first check that the above formula matches with the even characteristic setting. Moreover, we see that lifted codes over fields of odd characteristic also produce locally correctable codes with arbitrarily large rate.

Private information retrieval 4.1.1 PIR models

Two kinds of security models for PIR have been introduced so far. In [CGKS95, CKGS98], Chor, Goldreich, Kushilevitz and Sudan considered so-called information-theoretic PIR (IT-PIR): one requires that absolutely no information on i is leaked to the servers when querying the database. However, the authors proved that in this model, if only one server stores the database M, then one must download at least Ω(|M|) bits in order to retrieve a single entry of the database. A second security model was proposed a few years later by Chor and Gilboa [START_REF] Chor | Computationally Private Information Retrieval[END_REF], named computational PIR (CPIR). Here, one requires that it is computationally hard for the server to recover any bit of information on i. Notice that, in practice, CPIR constructions are much less efficient than IT-PIR constructions.

We situate our work in the information-theoretic PIR (IT-PIR) model. Throughout the chapter, a user U is the owner of a database M = (M 1 , . . . , M K ) composed of messages M i lying in some message space M. A system of servers S 1 , . . . , S is at his disposal, and stores possibly encoded versions of the messages. The goal of U is to retrieve some message M i , for 1 ≤ i ≤ K, without revealing any information about i to the servers.

In the first model given by Chor, Goldreich, Kushilevitz and Sudan [CGKS95, CKGS98], the user simply replicates M on the servers. Definition 4.1 (replication-based PIR protocol). We assume that every server S j , 1 ≤ j ≤ , stores a copy of the database M = (M 1 , . . . , M K ). An -server replication-based PIR protocol is a set of three algorithms (Query, Ans, Rec) running the following steps on input i ∈ [1, K]:

1. Query generation. The randomised algorithm Query generates queries (q 1 , . . . , q ) ← R Query(i) .

Query q j is sent to server S j . 2. Servers' answer: Each server S j computes an answer a j ← Ans j (q j , M) and sends it back to U. 3. Reconstruction: Denote by a = (a 1 , . . . , a ) and q = (q 1 , . . . , q ). User U computes and outputs R ← Rec(i, a, q) .

The PIR protocol is said to be:

correct if R = M i when the servers follow the protocol; t-private if, for every 1 ≤ i, i ≤ K and every T ⊆ [1, ] such that |T| ≤ t, the distributions Query(i) |T and Query(i ) |T are the same. We also say that the PIR protocol resists a collusion of t servers.

In practice, it is usual that the answer of server S j does not depend on j; in that case we simply write Ans(q j , M). We call communication complexity the total number of bits sent between the user and the servers during one iteration of the protocol. The server (resp. user) computational complexity is the maximal number of operations in the underlying field made by a server in order to compute an answer a j (resp. made by Rec to reconstruct the desired item). The storage rate of the protocol is the ratio between the size |M| of the database, and the size of what is actually stored on the servers. For replication-based protocols, it is then 1/ .

A way to reduce the storage overhead of a PIR protocol is to preprocess the database in order to distribute it smartly among the servers. From now on, we denote by C an encoded version of M, that can be split into parts C 1 , . . . , C , where C j generally lies in some set C j . One can consider that the map M → C = (C 1 , . . . , C ) is performed by the user, and the part C j is then uploaded on server S j . This leads us to the definition of distributed PIR protocols.

Definition 4.2 (coded, or distributed PIR protocol). Assume that for 1 ≤ j ≤ , server S j holds the part C j of an encoded version C of the database M = (M 1 , . . . , M K ). An -server distributed PIR protocol is a set of three algorithms (Query, Ans, Rec) running the following steps on input i ∈ [1, K]:

1. Query generation. The randomised algorithm Query generates queries (q 1 , . . . , q ) ← R Query(i) .

Query q j is sent to server S j . 2. Servers' answer. Each server S j computes an answer a j ← Ans j (q j , C j ) and sends it back to the user. 3. Reconstruction. Denote by a = (a 1 , . . . , a ) and q = (q 1 , . . . , q ). User U computes and outputs R ← R(i, a, q) .

Correctness and privacy are defined identically to Definition 4.1.

Communication and computational complexities, as well as storage rate, are defined similarly to the replication-based model. Furthermore, we see that the definition of replication-based PIR protocols is included in Definition 4.2, by means of an encoding map

M → (C 1 = M, . . . , C = M) .
There exists a basic replication-based PIR protocol that uses only = 1 server: it simply consists in downloading M entirely. This protocol will be called the trivial PIR protocol. It is clear that it is private, but it also admits a huge download complexity. Unfortunately, Chor et al. proved that, in the case = 1, this protocol is essentially optimal in terms of communication complexity [START_REF] Chor | Private Information Retrieval[END_REF]. Precisely, one cannot achieve information-theoretic privacy with only 1 server, expect by downloading Ω(|M|) bits. So from now on we assume ≥ 2.

First constructions, and links with locally decodable codes

In their seminal paper, Chor et al. [START_REF] Chor | Private Information Retrieval[END_REF] proposed a first PIR protocol involving servers with a total communication complexity O( log( )K 1/ log( ) ) bits (each message M i has size 1 bit). Their construction relies on a smart arrangement of bits in M in a log( )-dimensional binary array. Then, the user queries sum of bits supported by random Cartesian products in order to retrieve the desired bit.

A few years later, Katz and Trevisan [START_REF] Katz | On the Efficiency of Local Decoding Procedures for Error-Correcting Codes[END_REF] showed that any smooth locally decodable code C ⊆ F n q of locality gives rise to an -server PIR protocol whose communication complexity is essentially log(nq). Building on this idea, many PIR constructions (notably [BIKR02, Yek08, Efr12, DG16]) successively decreased the communication complexity, achieving O(K √ log log K/ log K ) bits with only = 2 servers.

In fact, the definition of PIR in [START_REF] Katz | On the Efficiency of Local Decoding Procedures for Error-Correcting Codes[END_REF] allows the protocol to fail with small probability ε > 0, which corresponds to the failure probability of the underlying LDCs. In this thesis we choose CHAPTER 4. PIR FROM TRANSVERSAL DESIGNS to use the most-common definition of PIR, which does not allow retrieval failure. Hence we need to replace LDCs by ( , )-local reconstructing algorithms, as defined in the paragraph about expander codes in Subsection 2.3.1.

So, let C ⊆ Σ X be a code of dimension K equipped with an ( , )-local reconstructing algorithm (Q, R), and denote by E a systematic encoder for C. Assume the database M = (M 1 , . . . , M K ) is replicated over servers. Let also x ∈ X such that M i = E(M) x (we recall that M i is the message to be retrieved privately). The PIR protocol based on (Q, R) can be described as follows:

-Query generation. User U calls the query generator Q on input x. It produces a subset Q = {q 1 , . . . , q } ⊆ X. Query q j is sent to server S j .

-Servers' answer. Each server S j computes the encoding E(M) q j and returns it to U. In other words,

Ans(q j , M) = E(M) q j .
-Reconstruction. User U collects a = (E(M) q 1 , . . . , E(M) q ), and feeds R with a and Q.

Then U outputs Rec(i, a, q) = R(a, Q).
By definition of local reconstructing algorithms, each individual query of Q(i) is uniformly distributed in X. Therefore, the servers get no information about i. Moreover, the output is correct as long as the servers' answers are correct.

Remark 4.3. Most known perfectly smooth LDCs and LCCs of locality are actually ( , )local reconstructing algorithms. This is the case for all the LCCs we presented in Chapters 2 and 3. Hence, for convenience and conformity with the literature, we will say that protocols presented above are LDC-based PIR protocols. The main drawback of LDC-based PIR protocols is their computational cost: each server must compute a new symbol of E(M) for each run of the protocol. The cost of this computation is usually Ω(|M|). Preprocessing the encoding can reduce this cost, but in this case, each server has to store the encoding E(M). Therefore the induced PIR storage rate is R C / , where R C is the rate of the code C. For small , this quantity is impractical since we have seen in Chapter 2 that constant locality LDCs have vanishing rate.

Aiming at reducing this storage overhead, Augot, Levy-dit-Vehel and Shikfa [START_REF] Augot | A Storage-Efficient and Robust Private Information Retrieval Scheme Allowing Few Servers[END_REF] proposed to benefit from a natural partition of the evaluation support of multiplicity codes defined in [START_REF] Kopparty | High-Rate Codes with Sublinear-Time Decoding[END_REF]. In a more generic setting, assume that each codeword c ∈ C can be split into disjoint parts c (1) , . . . , c ( ) , such that each coordinate q j of any possible query q = (q 1 , . . . , q ) of the PIR protocol corresponds to some symbols on the piece c (j) . Defining C j := c (j) , we obtain a distributed PIR protocol as in Definition 4.2. The PIR protocols we present in Sections 4.2 and 4.4 should be seen in the spirit of Augot et al.'s construction. Indeed we propose a generalisation of this support partition idea, which makes use of transversal designs, and achieves small storage overhead and low computational complexity for both user and servers.

To further emphasize the relevance of our work, we point out that most current PIR constructions admit a large computational complexity (see Section 4.5). In the context of a system storing a large amount of files accessed very frequently, one could question the practicality of such schemes. Especially, in a survey [START_REF] Yekhanin | Locally Decodable Codes[END_REF] Yekhanin brings attention to this issue, and claims that 'the overwhelming computational complexity of PIR schemes (...) currently presents the main bottleneck to their practical deployment'.

A 1-private protocol based on transversal designs

In the upcoming constructions, the database can be viewed as a message m ∈ F k q , and the user wants to retrieve its entry m i for 1 ≤ i ≤ k.

Transversal designs

We refer to Section 1.3 for basics on design-based codes. We also recall that 2-designs give rise to perfectly smooth locally correctable codes. Therefore it is natural to use them in the LDC-based PIR construction. In fact, since we want to use the splitting technique of Augot et al. [START_REF] Augot | A Storage-Efficient and Robust Private Information Retrieval Scheme Allowing Few Servers[END_REF], we can relax a few constraints on the incidence between points and blocks. This leads us to introduce transversal designs. Definition 4.5 (transversal design). Let s, ≥ 1 and λ ≥ 1 be integers. A transversal design, denoted TD λ ( , s), is a block design (X, B) equipped with a partition G = {G 1 , . . . , G } of X called the set of groups, such that: -|X| = s; -every group in G has size s and every block in B has size ; -every unordered pair of elements from X is contained either in exactly one group, or in exactly λ blocks.

When λ = 1, we use the simpler notation TD( , s).

Remark 4.6. In a transversal design, a block and a group intersect in a set of size at most 1, otherwise the third condition of the definition would be disproved. Moreover, since the block size equals the number of groups, any block must meet any group. Hence the following holds:

∀(B, G) ∈ B × G, |B ∩ G| = 1 .
The definition also implies that there must lie exactly λs 2 blocks in B. To prove this, let S be the set of unordered pairs {x, y} ⊆ X which are contained in a block B ∈ B. Notice that S contains exactly ( s 2 ) -( s 2 ) elements: there are ( s 2 ) unordered pairs in X, but for each group G ∈ G, we need to remove ( s 2 ) pairs contained in G. On the one hand, we have

N := ∑ {x,y}∈S ∑ B∈B 1 {x,y}⊂B = ∑ {x,y}∈S λ = λ ( s 2 ) -( s 2 ) = λs 2 ( 2 ) .
by definition of transversal designs. On the other hand,

N = ∑ {x,y}∈S ∑ B∈B 1 {x,y}⊂B = ∑ B∈B ∑ {x,y}∈S 1 {x,y}⊂B = ∑ B∈B ( 2 ) = |B|( 2 ) ,
which proves our claim.

Example 4.7. Let us define a transversal design as follows. The points X are those of the affine plane A 2 (F 3 ). Any set of three pairwise disjoint affine lines of A 2 (F 3 ) define the set of groups G. For instance, one can consider

G = { {(0, 0), (0, 1), (0, 2)}, {(1, 0), (1, 1), (1, 2)}, {(2, 0), (2, 1), (2, 2)} } .
The other 9 affine lines define the blocks B. The design T = (X, B, G) we obtain is a transversal design TD (3,3). Indeed, T is composed of s = 9 points, = 3 groups of size s = 3 and s 2 = 9 blocks of size = 3 each. Moreover, in the affine plane every unordered pair of points is contained in a single line, which is represented in T either by a group or by a block. More generally, for any prime power q, a transversal design TD(q, q) can be built with the affine plane A 2 (F q ).

Also notice that the code C = Code 3 (T ) is a linear code over F 3 , of length 9 and dimension 3.

A full-rank generator matrix of C is given by:

G =   1 1 1 1 1 1 1 1 1 0 0 0 1 1 1 2 2 2 0 1 2 0 1 2 0 1 2   ,
where the ordering of the points X we have chosen can be read in the columns of G. One can check that C is identical to Code 3 (AG 1 (2, 3)), the code based on the classical affine design, though the designs T and AG 1 [START_REF]1 Comparison of high-rate lifted and multiplicity codes[END_REF]3) are different. This property will be proved in a more generic setting in Proposition 4.13.

The protocol

In this section we present a construction of PIR protocols relying on transversal designs. The idea is that the knowledge of one point of a block of a transversal design gives (almost) no information on the other points lying on this block. This privacy property is transferred to the coordinates of words lying on the code based on a transversal design. Hence, if messages are encoded such a way, we obtain a 1-private PIR protocol. Though this protocol cannot resist collusions, we will see in Subsection 4.4.1 that a natural generalisation gives t-private PIR protocols, for t > 1.

Remark 4.8. One must notice that Barkol, Ishai and Weinreb consider in [START_REF] Barkol | On Locally Decodable Codes, Self-Correctable Codes, and t-Private PIR[END_REF] the case of LCCs arising from designs for applications to PIR. In that sense, their approach is close to ours. Nevertheless, the protocols they propose are costly in terms of storage (they use the replication-based model), and focus on small communication complexity. Moreover, they do not address the computational complexity issue.

Let T be a transversal design TD( , s) and n = |X| = s. Denote by C = Code q (T ) ⊆ F X q the associated F q -linear code, and let k = dim(C). A PIR protocol based on C is defined in Figure 4.1. We refer to this protocol as the TD-based PIR protocol. We then summarise the steps of the construction in Figure 4.2.

Theorem 4.9 states that the protocol we build in Figure 4.1 is indeed a 1-private PIR protocol.

Theorem 4.9. If there exists a transversal design TD λ ( , s) whose associated code has dimension k, then there exists a distributed -server 1-private PIR protocol for databases with k entries over F q , where:

-only one F q -symbol to read for each server, --1 field operations over F q for the user, -log(sq) bits of communication ( log s are uploaded, log q are downloaded), -a storage rate R C = k/ s.

Proof. Recall the PIR protocol we are dealing with is defined in Figure 4.1.

System parameters. T = (X, B, G) a transversal design TD λ ( , s), and C = Code q (T ) its associated code of length n = s and dimension k.

1) Initialisation step. 1. Encoding. User U computes a systematic encoding of the database m ∈ F k q , resulting in the codeword c ∈ C. We denote by x ∈ X the point such that c x = m i . 2. Distribution. Each server S j receives c |G j , for 1 ≤ j ≤ , where G j ∈ G.

2) Retrieval of symbol c x = m i . Denote by j x ∈ [1, ] the index of the unique group G j x ∈ G which contains i. Also denote by B x the subset of blocks containing x. The three steps of the distributed PIR protocol are:

1. Queries generation. User U picks uniformly at random a block B ∈ B x . For j = j x , U sends the unique index q j ∈ B ∩ G j to server S j . Server S j x receives a random query q j x uniformly picked in G j x . To sum up, Q ← R Query(i) is defined by:

B ← R B x and Q(i) j x ← R G j x where j x satisfies x ∈ G j x Q(i) j ← B ∩ G j for j = j x 2
. Servers' answer. Each server S j (including S j x ) reads a j := c q j and sends it back to the user. That is, Ans(q j , c |G j ) := c q j .

3.

Reconstruction. Denote by a = (a 1 , . . . , a ) and q = (q 1 , . . . , q ). User U outputs Rec(i, a, q) := -∑ j =j x a j x = -∑ j =j x c q j . Figure 4.1 -A 1-private distributed PIR protocol based on the F q -linear code defined by a transversal design.

Transversal design TD( , s) incidence matrix TD-based linear code Code q (TD( , s)) ⊆ F s q database encoding Distributed PIR scheme Correctness. By definition of the code C = Code q (T ), the incidence vector 1 B of any block B ∈ B belongs to the dual code C ⊥ . Hence, for any c ∈ C, the inner product 1 B , c = ∑ y∈B c y = 0. We recall that j x represents the index of the group which contains x, where x satisfies c x = m i . Since the servers S j , j = j x , receive queries corresponding to the points of a block B which contains x, we have c x = -∑ y∈B\{x} c y = -∑ j =j x c q j . Therefore, the PIR protocol is correct as long as there is no error on the symbols c q j returned by the servers.

Security (1-privacy).

We need to prove that for all 1 ≤ j ≤ , it holds that I(i ; q j ) = 0, where I(• ; •) denotes the mutual information. If j = j x , then it is clear that q j is picked independently to i, therefore I(i ; q j x ) = 0. Now assume that j = j x . By definition of a transversal design, the number of blocks containing both x and q j is exactly λ, and the total number of blocks passing through x is λs. Therefore the probability Pr(q j | i) = 1/s, and we also get I(i ; q j ) = 0.

Communication complexity. Exactly one index q j ∈ [1, s] and one symbol c q j ∈ F q are exchanged between each server and the user. So the overall communication complexity is × (log(s) + log(q)) = log(sq) bits.

Storage rate. The number of bits stored on a server is s log q, giving a storage rate of k/s = R, the code rate. Equivalently, the storage overhead is (sk) log q bits.

Computational complexity. Each server S j only needs to read the symbol defined by query q j , and the protocol does not incur any extra computational cost.

Theorem 4.9 shows that best practical parameters of the TD-based PIR protocol appear for small values of , the number of groups of the transversal design. However, one also observes that the dimension k of Code q (T ) strongly depends on and n, and tiny values of can lead us to degenerate or very small codes. This issue should be carefully taken into account, since for instance, codes of dimension k ≤ represent PIR protocols which are more expensive in terms of communication than the trivial one. Hence, it is very natural to raise the main issue of the TD-based construction.

Problem 4.10. Find codes C = Code q (T ) arising from transversal designs T = TD λ ( , s) with few groups (small ) and large dimension k = dim(C) compared to their length n = s.

A first answer comes by adapting Proposition 1.14 to transversal designs. Essentially, it shows that the characteristic of the base field F q must be chosen properly in order to have a chance to get high-rate codes.

Proposition 4.11. Let T = (X, B, G) be a TD λ ( , s). Let q = p e , p prime. If p λs, then Code q (T ) ⊆ {c ∈ F X q | ∀G ∈ G, c |G ∈ Rep(s)} , where Rep(s) represents the repetition code of length s. In particular, if p λs, then Code q (T ) has dimension at most . Proof. For x ∈ X, recall that B x = {B ∈ B, x ∈ B}, and denote by a (x) = ∑ B∈B x 1 B . We know that a (x) ∈ Code q (T ) ⊥ , since Code q (T ) ⊥ is generated by {1 B , B ∈ B}. Denote by G x ∈ G the only group that contains x. We see that:

     a (x) x = λs a (x) i = 0 for all i ∈ G x \ {x} a (x) j = λ for all j ∈ X \ G x .
Therefore a (x)a (y) = λs(1 {x} -1 {y} ) if x and y lie in the same group G. If p λs, then we get 1 {x} -

1 {y} ∈ Code q (T ) ⊥ . Let now C = Span F q {1 {x} -1 {y} , ∀{x, y} ⊂ G ∈ G} We see that C ⊥ = {c ∈ F X q | ∀G ∈ G, c |G ∈ Rep(s)}.
Therefore we obtain the expected result. Section 4.3 is devoted to the construction of transversal designs leading to codes with high rate, in the perspective of providing solutions to Problem 4.10. Collusions of servers will be addressed in Section 4.4.

Instances

From now on, we denote by (k) the number of servers involved in a given PIR protocol running on a database with k entries, and by n(k) the actual number of symbols stored by all the servers. As it is proved in Theorem 4.9, both parameters are crucial for the practicality of the TD-based PIR protocol, and they respectively correspond to the block size and the number of points of the transversal design used in the construction. In practice, we look for small values of and n as explained in Problem 4.10.

In this section, we first give two classical instances of transversal designs derived from finite geometries (Subsections 4.3.1 and 4.3.2), leading us to good PIR parameters. We then show how orthogonal arrays produce transversal designs, and we more deeply study a family of such arrays producing high-rate codes. Subsection 4.3.4 is finally devoted to another family of orthogonal arrays whose divisibility properties ensure to give an upper bound on the storage overhead of related PIR protocols.

Transversal designs from affine geometries

Transversal designs can be built with incidence properties between subspaces of an affine space. Definition 4.12 (affine transversal design). Let A m (F q ) be the affine space of dimension m over F q , and G = {G 1 , . . . , G q } be a collection of q affine hyperplanes that partition A m (F q ). We define a transversal design T A (m, q) as follows:

-the point set X consists in all the points in A m (F q ); -the set of groups G is defined as above; -the blocks in B are all the 1-dimensional affine subspaces (lines) which do not entirely lie in one of the H j , for 1 ≤ j ≤ q. We also say that such lines are secant to the hyperplanes in H.

This design is a TD(q, q m-1 ).

Let us now focus on the dimension of codes based on T A (m, q). In order to obtain a large dimension, Proposition 4.11 inclines us to choose a code whose base field characteristic divides q = p e , so let us choose F p . We see that the block set of T A (m, q) is contained in the block set of AG 1 (m, q), therefore B ∈ B (AG) contained in a group G ∈ G (T ) , it holds that 1 B ∈ Code p (T A (m, q)) ⊥ . To this end, let us first notice that Code p (T A (m, q)) ⊥ = Span{1 B , B ∈ B (T ) }.

Let now G ∈ G (T ) and B ∈ B (AG) such that B ⊆ G. Recall that G is a hyperplane of A m (F q ), and let P be a 2-dimensional affine plane of A m (F q ) such that P ∩ G = B. We claim that

1 P ∈ Span{1 B , B ∈ B (T ) }.
Indeed, P admits a partition into affine lines which are secant to every hyperplane in G, thus 1 P is the sum of the characteristic vectors of these lines. Now let x ∈ B, and B (T )

x,P := {B ∈ B (T ) , {x} ∈ B ⊂ P} ⊆ B (T ) . Define b (x) = ∑ B ∈B (T ) x,P 1 B . It is clear that b (x) ∈ Span{1 B , B ∈ B (T )
}, and we can notice that

     b (x) x = q = 0 b (x) i = 0 for all i ∈ B \ {x} b (x) j = 1 for all j ∈ P \ B .
In other words, b

(x) = 1 P -1 B , therefore 1 B ∈ Span{1 B , B ∈ B (T ) }.
Now recall that the dimension of Code p (T A (m, q)) is known thanks to Hamada's formulae (1.1) and (1.2) that we reported in Chapter 1. However, for generic values of m and q, they do not allow us to grasp how large the dimension can be. So let us focus on the case m = 2.

In this case, we get rank p (AG 1 (2, p e )) = ( p+12 ) e , hence Code p (T A (2, p e )) has dimension p 2e -(

e . Therefore we obtain the following family of PIR protocols.

Proposition 4.14. Let M be a database with k = p 2e -( p+1 2 ) e entries, p a prime, e ≥ 1. There exists a distributed 1-private PIR protocol for M with:

(k) = p e and n(k) = p 2e .

For fixed p and k → ∞, we have

(k) = √ k + Θ(k 1 2 +c p ) and n(k)/k = 1 1 -1+1/p 2 e = 1 + Θ(k c p ) → 1 , (4.1)
where c p = 1 2 log p ( 1+1/p 2 ) < 0.

Proof. The existence of the PIR protocol is a consequence of the Theorem 4.9. Let us state the asymptotics of the parameters. Recall that prime p is fixed, and let e → ∞. First we have:

n(k) k = p 2e p 2e -( p+1 2 ) e = 1 1 -1+1/p 2 e = 1 + 1 + 1/p 2 e + O 1 + 1/p 2 2e . (4.2)
Notice that

log p k = 2e + log p 1 - 1 + 1/p 2 e = 2e + O 1 + 1/p 2 e .
Hence,

1 + 1/p 2 e = 1 + 1/p 2 1 2 log p k+O 1+1/p 2 e = k 1 2 log p 1+1/p 2 × 1 + 1/p 2 O 1+1/p 2 e = Θ (k c p ) , since 1+1/p 2 O 1+1/p 2 e
→ 1 when e → ∞. Using (4.1) we obtain the asymptotics we claimed for n(k)/k.

For (k), we see that n(k) = (k) 2 . Therefore, we get

(k) = √ k n(k)/k = √ k 1 + Θ(k c p ) = √ k + Θ(k 1 2 +c p ) .
We give in Table 4.1 the dimension of codes arising from some affine transversal designs. In this table, m is not restricted to 2 but remains small. Finally, for a better understanding of the parameters we can point out two instances of PIR protocols:

-choosing m = 2 and = 4096, there exists a PIR protocol on a 2.0MB file with 6kB of communication and only 3.2% storage overhead; -for a 46GB database (m = 3, = 8192), we obtain a PIR protocol with 39kB of communication and 27.1% storage overhead. . Remind that the rate R of the code is the server storage rate of the PIR protocol, and that q = is the number of servers, which essentially corresponds to the communication complexity of the PIR protocol.

m = q n = s = q m k = dim(C) R = k/

Transversal designs from projective geometries

Projective geometries are closely related to affine geometries, but contrary to them, there is no partition of the projective space into hyperplanes, since every pair of distinct projective hyperplanes intersects in a projective space of co-dimension 2. To tackle this problem, an idea is to consider the hyperplanes H i which intersect on a fixed subspace of co-dimension 2 (call it Π ∞ ). Then, all the sets H i \ Π ∞ are disjoint, and their union gives exactly P m (F q ) \ Π ∞ , where P m (F q ). Moreover, every projective line disjoint from Π ∞ is either contained in one of the H i , or is 1-secant to all of them. It results to the following construction: Definition 4.15 (Projective transversal design). Let P m (F q ) and Π ∞ defined as above. Let us define -a point set

X = P m (F q ) \ Π ∞ ; -a group set G = {projective hyperplanes H ⊂ P m (F q ), Π ∞ ⊂ H}; -a block set B = {projective lines L ⊂ P m (F q ), L ∩ Π ∞ = ∅ and ∀H ∈ G, L ⊂ H} .
Finally, denote by T P (m, q) := (X, B, G). Then T P (m, q) is a TD(q + 1, (q + 1)q m-1 ).

The incidence matrix M T P (m,q) of T P (m, q) is a submatrix of M PG 1 (m,q) , from which we removed:

-the columns corresponding to the points in Π ∞ , -the rows corresponding to the lines not in B.

Said differently, the code associated to T P (m, q) contains (as a subcode) the Π ∞ -shortening of the code associated to PG 1 (m, q). Hence we have

dim Code(T P (m, q)) ≥ dim Code(PG 1 (m, q)) -|Π ∞ | .
Once again, Hamada's formula allows us to compute dim Code(PG 1 (m, q)) efficiently, and it gets simpler for m = 2. We obtain the following proposition.

Proposition 4.16. Let M be a database with k = p 2e + p e -( p+1 2 ) e -1 entries, p a prime and e ≥ 1.

There exists a distributed 1-private PIR protocol for M with:

(k) = p e + 1 and n(k) = p 2e + p e .

Asymptotics are the same as in Equation (4.1).

In order to emphasize that both previous constructions are asymptotically the same, in Figure 4.3 we draw the rates of the codes involved in these PIR protocols.

Orthogonal arrays and the incidence code construction

In this subsection, we first recall a way to produce transversal designs from another combinatorial construction called orthogonal array.

Definition 4.17 (orthogonal array). Let λ, s ≥ 1 and 1 ≤ t ≤ , and let A be an array with columns and λs t rows, whose entries are elements of a set S of size s. We say that A is an orthogonal array OA λ (t, , s) if, in any subarray A of A formed by t columns and all its rows, every row vector from S t appears exactly λ times in the rows of A . We call λ the index of the orthogonal array, t its strength and its degree. If t (resp. λ) is omitted, it is understood to be 2 (resp. 1). When both these parameters are omitted we simply write A = OA( , s).

= q m Rate R = k/n m = 2 m = 3 m = 4 m = 5 Figure 4.
3 -Rate of binary codes coming from T A (m, q) (in red) and T P (m, q) (in blue). For every fixed m, we let q grow. From now on, we restrict Definition 4.17 to orthogonal arrays with no repeated column and no repeated row. Next paragraph introduces a link between orthogonal arrays and transversal designs.

Construction of transversal designs from orthogonal arrays. We can build a transversal design TD( , s) from an orthogonal array OA( , s) with the following construction, given as a remark in [CD06, ch.II.2].

Construction 4.18 (Transversal designs from orthogonal arrays).

Let A be an OA( , s) of strength t = 2 and index λ = 1 with symbol set S, |S| = s. Denote by Rows(A) the set of rows of A. We define the point set X = S × [1, ]. To each row a ∈ Rows(A) we associate a block B a := {(a j , j), 1 ≤ j ≤ } , so that the block set is defined as

B := {B a , a ∈ Rows(A)} .
Finally, let G := {S × {j}, 1 ≤ j ≤ }. Then (X, B, G) is a transversal design TD( , s).

Example 4.19. A very simple example of this construction is given in Figure 4.4, where for clarity we use letters {a, b} for elements of the symbol set, while the = 3 columns are indexed by integers. On the left-hand side, A is an OA 1 (2, 3, 2) with symbol set S = {a, b}. On the right-hand side, the associated transversal design TD (3,[START_REF]1 Comparison of high-rate lifted and multiplicity codes[END_REF] is represented as a hypergraph: the nodes are the points of the design, its groups are depicted in columns, and a block consists in all nodes linked with a path of a fixed colour. One can check that every pair of nodes either belongs to the same group or is linked with one path. by t = d -1. Notice that for linear codes, the dual distance is simply the minimum distance of the dual code, but it can also be defined for non-linear codes (see [MS77, Ch.5. §5.]). More details about the link between orthogonal arrays and codes can also be found in [START_REF] Colbourn | Handbook of Combinatorial Designs[END_REF]. For example, the orthogonal array of Figure 4.4 comes from the binary parity-check code Par(3) (replacing a by 0 and b by 1). One can check that its dual distance is 3 and its associated transversal design has strength 2.

Let us state more formally the link between the dual distance of a linear code, and the strength of the orthogonal array made of its codewords.

Lemma 4.21. Let C 0 ⊆ F X q be a linear code and T ⊂ X, |T| = t where t < d ⊥ (C 0 ). For a ∈ F T q , denote by V a = {c ∈ C 0 , c |T = a}, and N a = |V a |. Then,

1. V 0 = {v ∈ F X q | v |T = 0 and v |X\T ∈ Short(C 0 , T)
} is a linear subcode of C 0 ; 2. for every non-zero a ∈ F T q , there exists a non-zero c (a) ∈ C 0 such that V a = V 0 + {c (a) } ;

3. for every a ∈ F T q , N a = q k-t where k = dim C 0 .

Proof.

1. The fact that V 0 = {v ∈ F X q | v |T = 0 and v |X\T ∈ Short(C 0 , T)} is actually the definition of the shortening of a code. 2. Let a ∈ F T q be non-zero, and let us first prove that there exists c (a) ∈ C 0 such that c (a) |T = a. If it were not the case, then we would have Punct(C 0 , X \ T) = F t q by definition, or equivalently Short(C ⊥ 0 , X \ T) = Punct(C 0 , X \ T) ⊥ = {0}. But this is impossible since C ⊥ 0 contains no non-zero codeword of weight less that t. It is then easy to check that V a = V 0 + {c (a) }.

3. First notice that V a ∩ V b = ∅ if a = b. Since C 0 = a∈F t q V a ,
we get the expected result.

Given a code C 0 , we denote by A C 0 the orthogonal array it defines and by T C 0 the transversal design built from A C 0 thanks to Construction 4.18.

As a straightforward corollary of Lemma 4.21, we get: Proposition 4.22. Let C 0 ⊆ F X q be a linear code of dimension k, and denote by t = d ⊥ (C) -1. Then, the array A C 0 whose rows are codewords of C 0 is an orthogonal array OA λ (t, |X|, q), where λ = q k-t .

Proof. It is clear that A C 0 has q k = λq t rows, since the dimension of C 0 is k. Let T ⊂ X such that |T| = t, and let a ∈ F T q . Thanks to Lemma 4.21, there exists exactly λ = s k-t rows r of A C 0 such that r |T = a. It proves that A C 0 has strength t. Example 4.23. Let S be a set of pairwise distinct elements of F q . We recall that RS q (1, S) ⊆ F S q denotes the Reed-Solomon code of length and dimension 2 over F q , with evaluation points from S. Then, RS q (1, S) has dual distance 3, so its codewords form an orthogonal array A RS q (1,S) = OA( , q) of strength 2. Columns of this array can be naturally indexed by S instead of [1, ]. Now, we use Construction 4.18 to obtain a transversal design T RS q (1,S) = TD( , q). The point set is X = F q × S, and the blocks are Reed-Solomon codewords, that is, sets of the form {(c α , α), α ∈ S} with c ∈ RS q (1, S) ⊆ F S q . The set of groups G = {G α , α ∈ S} correspond to the coordinates of the code:

G α = F q × {α}, α ∈ S.
Remark 4.24. The use of low-degree polynomials for the construction of orthogonal arrays was described as early as 1952 by Bush [START_REF] Bush | Orthogonal arrays of index unity[END_REF], that is, even before the actual formalisation of Reed-Solomon codes [START_REF] Reed | Polynomial Codes over Certain Finite Fields[END_REF].

We can finally summarise the construction by introducing the code Code q (T C 0 ) that arises from C 0 through Construction 4.18. We call Code q (T C 0 ) the incidence code of C 0 . Our motivation is that studying the structure of C 0 may lead us to properties of Code q (T C 0 ) which is used in PIR protocols. Definition 4.25 (incidence code). Let C 0 ⊆ Σ S be an unrestricted code of length |S| = over an alphabet Σ of size s. The incidence code of C 0 over F q , denoted IC q (C 0 ), is the F q -linear code of length n = s built from the transversal design T C 0 , that is:

IC q (C 0 ) := Code q (T C 0 ) .
Notice that the field F q does not need to be identical to the alphabet Σ of the code C 0 .

Incidence codes are introduced in order to design PIR protocols, as summarises Figure 4.5. From previous results, it is clear that, if C 0 has dual distance more than 3, then the induced PIR protocol is 1-private. A generalisation will be formally proved in a next section, see Using Construction 4.18, we get a transversal design T C 0 = (X, B, G) with 16 points (4 groups made of 4 points) and 16 blocks. Let us recall how we map a row of A to a word in {0, 1} 16 . For instance, consider the fifth row of A, highlighted in grey:

a := (0, 1, α, α 2 ) .
We turn a into a block B a := {(0, 1), (1, 2), (α, 3), (α, 4)} ∈ B, and we build the incidence vector 1 B a of the block B a over the point set X = {(β, i), β ∈ F 4 , i ∈ [1, 4]}. In order to see 1 B a as a word in {0, 1} 16 , we can also order elements in X, for instance as follows:

(0, 1) , (1, 1), (α, 1), (α 2 , 1), (0, 2), (1, 2) , (α, 2), (α 2 , 2), (0, 3), [START_REF]2 Outline of the construction of a distributed PIR protocol using incidence codes[END_REF]3), (α, 3) , (α 2 , 3), [START_REF]2 Outline of the construction of a distributed PIR protocol using incidence codes[END_REF]4), [START_REF]2 Outline of the construction of a distributed PIR protocol using incidence codes[END_REF]4), (α, 4), (α 2 , 4) .

Using this ordering, we get: Matrix M then defines, over any extension F 2 e of the prime field F 2 , the dual code of the incidence code IC 2 e (C 0 ). For all values of e, the incidence codes IC 2 e (C 0 ) have the same generator matrix G, being:

G =          
1001 0000 0011 1010 0101 0000 0110 0011 0011 0000 0101 0110 0000 1001 0101 1100 0000 0101 0011 0110 0000 0011 0110 0101 0000 0000 1111 1111

          .
A deeper analysis of incidence codes coming from linear MDS codes of dimension 2. Incidence codes lead to a very large family of PIR protocols -as many as there exists codes C 0 -but most of them are not practical, since the incidence codes are too small. To simplify their study, one can first remark that intuitively, the more blocks a transversal design, the larger its incidence matrix, and consequently, the lower the dimension of its associated code. Furthermore, the number of blocks of T C 0 is the cardinality of C 0 . Hence, heuristically the smaller the code C 0 , the larger IC(C 0 ).

In this paragraph we analyse the incidence codes constructed with MDS codes of dimension 2. Their interest lies in being the smallest codes with dual distance 3, which is the minimal setting for defining 1-private PIR protocols. Recall that generalised Reed-Solomon codes are MDS. The next lemma shows they are essentially the only one of dimension 2. Lemma 4.27. All [ , 2, -1] q MDS linear codes with 2 ≤ ≤ q are generalised Reed-Solomon codes.

Proof. Let C be an [ , 2, -1] q code with 2 ≤ ≤ q. Since C is MDS, it has dual distance d ⊥ (C) = 3, and we claim there exists a codeword c ∈ C with Hamming weight . To see this, let G = (g 1 , . . . , g ) be a generator matrix of C, where g i ∈ F 2 q is an affine point written in column. Notice that each point g i is non-zero (otherwise d ⊥ (C) = 1) and 0, g i , g j are not collinear for i = j (otherwise d ⊥ (C) = 2). Moreover, the g i 's are not all on the same affine line (otherwise, dim(C) ≤ 1).

An important remark is that one can see codewords in C as evaluations of linear maps µ : F 2 q → F q over (g 1 , . . . , g ):

C = {(µ(g 1 ), . . . , µ(g )), µ ∈ Hom(F 2 q , F q )} .

Since ≤ q, there exists a = (a 0 , a 1 ) ∈ F 2 q \ {0} such that a does not lie in the affine line through 0 and any of the g i 's (indeed there are q + 1 affine lines through 0). Let now µ a (X, Y) = a 1 Xa 0 Y: it is a non-zero linear form which must vanish on a line of F 2 q , and since µ a (a) = a, it vanishes on Span{a}. To sum up, for every i ∈ [1, ], we have µ a (g i ) = 0. Hence, c = (µ a (g 1 ), . . . , µ a (g )) belongs to C and has Hamming weight .

Let now d ∈ C such that {c, d} spans C. Then c = 1 c and d = c (c -1 d), where c -1 is the coordinate-wise inverse of c. Hence, the code C can be written c C where C is generated by {1, c -1 d}. These two tuples are respectively the evaluation of polynomials 1 and X over the set S of symbols in c -1 d. Hence, C = GRS q (1, S, c).

Let us understand the consequences of Lemma 4.27 in terms of transversal designs. We say a map φ : X → X is an isomorphism between transversal designs (X, B, G) and (X , B , G ) if it is one-to-one and if it preserves the incidence relation. In other words, we require that φ is invertible on the points, blocks and groups:

φ(X) = X , φ(B) = B , φ(G) = G .
Lemma 4.28. Let C, C ⊆ F q be two codes such that C = y C for some y ∈ (F × q ) . Denote by T C , T C the transversal designs they respectively define. Then, T C and T C are isomorphic.

Proof. Write T C = (X, B, G) and T C = (X , B , G ). From the definition it is clear that X = X = F q × [1, ] and G = G = {F q × {i}, 1 ≤ i ≤ }. Now consider the block sets. We see that B = {{(c i , i), 1 ≤ i ≤ }, c ∈ C} and B = {{(y i c i , i), 1 ≤ i ≤ }, c ∈ C}. Let:

φ y : F q × [1, ] → F q × [1, ] (x, i) → (y i x, i)
The vector y is -invertible, hence φ y is one-to-one on the point set X. It remains to notice that φ y maps G to itself since it only acts on the first coordinate, and that φ y (B) is exactly B by definition of C and C . Proposition 4.29. Let 2 ≤ ≤ q and C 0 be an [ , 2, -1] q MDS code. Let also F p be any finite field. The incidence code IC p (C 0 ) is permutation-equivalent to IC p (RS q (1, S)), for some S ⊆ F q , |X| = .

Proof. Lemma 4.27 shows that all [ , 2, -1] q linear codes C 0 are generalised Reed-Solomon codes GRS q (1, S, y) = y RS q (1, S) for some S ⊆ F q , |X| = . Moreover, with the previous notation φ y (T RS q (1,S) ) = T y RS q (1,S) , so we have IC p (y RS q (1, S)) = Code p (φ y (T RS q (1,S) )) . Now, let: φy :

F X p → F X p c = (c x ) x∈X → (c • φ y (x)) x∈X .
Clearly φy (IC p (RS q (1, S))) = Code p (φ y (T RS q (1,S) )) and φy acts as a permutation of coordinates. So IC p (C 0 ) is permutation-equivalent to IC p (RS q (1, S)) which proves the result.

Proposition 4.29 allows us to restrict our study to incidence codes of Reed-Solomon codes of dimension 2. Let us first consider the case of full-length Reed-Solomon codes RS q (1) ⊆ F F q q . An interesting result is that these incidence codes are equivalent to codes based on affine geometric designs.

Proposition 4.30. The following two codes are equal up to permutation:

1. C 1 = IC q (RS q (1)), the incidence code over F q of the q-ary full-length Reed-Solomon code of dimension 2; 2. C 2 , the code over F q based on the transversal design T A (2, q). Proof. It is sufficient to show that the transversal design defined by C 0 = RS q (1) is isomorphic to T A (2, q). We first recall that T C 0 = (X, B, G) where:

   X = F q × F q B = {{(c x , x), x ∈ F q }, c ∈ C 0 } G = {{(α, x), α ∈ F q }, x ∈ F q } .
Up to an affine transformation of the plane A 2 , the groups of T A (2, q) = (X , B , G ) can be set to {{(α, x), α ∈ F q }, x ∈ F q }. Hence, up to isomorphism T A (2, q) can be written as:

   X = F q × F q B = {{(ax + b, x), x ∈ F q }, (a, b) ∈ F 2 q , } G = {{(α, x), α ∈ F q }, x ∈ F q } .
It remains to notice that a codeword c ∈ C 0 is the evaluation of a polynomial of degree ≤ 1 over F q . Hence for some (a, b) ∈ F 2 q , we have c x = ax + b, ∀x ∈ F q .

We now need to study the more general case of subsets S ⊂ F q , |S| = < q. First, it worth noticing that IC q (RS q (1, S)) is a shortening of IC q (RS q (1)). Indeed, we have the following property:

Lemma 4.31. Let C 0 ⊂ F S q , S = , and Punct(C 0 , I) its puncturing on coordinates I ⊂ S. Then for every prime p, IC p (Punct(C 0 , I)) = Short(IC p (C 0 ), J)

where J = ∪ i∈I G i and G i = F q × {i} is the group indexed by i ∈ S in the transversal design T C 0 .

Proof. Let us analyse the link between T Punct(C 0 ,I) = (X , B , G ) and T C 0 = (X, B, G). We have: q , and ∑ n i=1 c i = 0. Hence, uJ = uM J T = cJ T = 0. Since = 0 in F q of characteristic p, we get uJ = 0, which also implies that uJ = 0. Therefore, c = u(M -J) ∈ A, and it follows that:

X = F q × (S \ I) ⊂ S, G = {F q × {i}, i ∈ (S \ I)} ⊂ G, B = {B ∩ X , B ∈ B} . Let C = IC p (C 0
C ⊥ ∩ Par(n) ⊆ A ⊆ C . Now, if p | , then equation (4.3) turns into M M T = 0, meaning that C ⊥ ⊆ C. Finally, the first bound on the dimension comes from dim(C) ≥ dim(C ⊥ ∩ Par(n)) ≥ dim C ⊥ -1 = n -dim C -1 ,
and the second bound is straightforward.

In terms of PIR protocols, previous result translates into the following corollary. Corollary 4.35. Let p be a prime, and assume there exists a p-divisible linear code C 0 of length 0 over F q . Then using the incidence code IC q (C 0 ), there exists k ≥ ( 0 q -1)/2 such that we can build a distributed PIR protocol for a k-entry database over F q , and whose parameters are (k) = 0 and n(k) = 0 q ≤ 2k + 1.

Divisible codes over small fields have been well-studied, and contain for instance the extended Golay codes [MS77, ch.II.6], or the famous family of MDS codes of dimension 3 and length q + 2 over F q [MS77, ch.XI.6].

Example 4.36. The extended binary Golay code is a self-dual [24, 12, 8] 2 linear code. It produces a transversal design with 24 groups, each storing 2 points. Its associated incidence code Code 2 (Golay) has length n = 24 × 2 = 48 and dimension k ≥ 24, and by computation we can show that k = 24. Remark 4.37. In the application for PIR protocols, we would like to find divisible codes C 0 defined over large alphabets (compared to the code length), but these two constraints seem to be inconsistent. For instance, the binary Golay code presented in Example 4.36 leads us to a PIR protocol with a too expensive communication cost (24 bits of communication for an original file of size... 24 bits: that is exactly the communication cost of the trivial PIR protocol where the whole database is downloaded). Nevertheless, Example 4.36 represents the worst possible case for the TD-based construction, in a sense that the rate of IC 2 (Golay 2 ) is exactly 1/2 (it attains the lower bound), and that each server stores 2 bits (which is the smallest possible). Codes with better rate and/or with larger server storage capability would then give PIR protocols with relevant communication complexity. For instance, the extended ternary Golay code gives better parameters -see Example 4.47.

To conclude this section, let us point out that to the best of our knowledge, divisible codes over large fields does not seem to have been thoroughly studied (a reason might be that codes over small alphabets are usually considered as the most practical ones). We hope that the TD-based construction of PIR protocols based on divisible codes may encourage research in this direction.

The t-private construction

When servers are colluding, the PIR protocol based on a simple transversal design does not ensure sufficient privacy, because the knowledge of two points lying on a block gives some information on it. To solve this issue, we propose to use orthogonal arrays with higher strength t > 2.

Generic construction and analysis

In the previous section, classical (t = 2) orthogonal arrays were used to build transversal designs. Considering higher values of t, we naturally generalise the latter as follows.

Definition 4.38 (t-transversal design). Let ≥ t ≥ 1 and λ ≥ 1. A t-transversal design is a block design D = (X, B) equipped with a group set G = {G 1 , . . . , G } partitioning X such that:

-|X| = s ; -any group has size s and any block has size ; -for any T = {i 1 , . . . , i t } ⊆ [1, ] with |T| = t and for any (x 1 , . . . , x t ) ∈ ∏ t j=1 G i j , there exist exactly λ distinct blocks B ∈ B such that {x 1 , . . . , x t } ⊂ B.

A t-transversal design with parameters s, , t, λ is denoted t-TD λ ( , s), or t-TD( , s) for short, when λ = 1. Lemma 4.39. Let ≥ 2 and λ ≥ 1. For every ≥ t ≥ t ≥ 2, any t-TD λ ( , s) is also a t -TD λ ( , s), where λ = λs t-t .

Proof. Let T be a t-TD λ ( , s). Let T = {i 1 , . . . , i t } ⊆ [1, ], |T| = t, and x = (x 1 , . . . , x t ) ∈ ∏ t j=1 G i j . For every y = (y t +1 , . . . , y t ) ∈ ∏ t j=t +1 G i j , we can define the tuple (x, y) ∈ ∏ t j=1 G i j . Since T is a t-TD λ ( , s), there exists exactly λ blocks B such that {x 1 , . . . x t , y t +1 , . . . , y t } ⊆ B. Since there are s t-t possible choices for y, and since each choice defines pairwise distinct blocks, we get our result. Given a t-transversal design T , we can build a (t -1)-private PIR protocol with the exactly the same steps as in Section 4.2. First, we define the design-based code C = Code q (T ) according to Definition 1.12, and then we follow the algorithm given in Figure 4.1. As we see in Lemma 4.39, for t ≥ 2 any t-transversal design is also a 2-transversal design. Hence the analysis of PIR protocols based on t-TDs is identical to the one using classical TDs. Even the security proof is very similar, as shows the following argument.

Security ((t -1)-privacy). Let T be a collusion of servers of size |T| ≤ t -1. We need to prove that I(i ; q |T ) = 0 where i ∈ X is the coordinate of the desired item, and q is the random query. For every x t ∈ G i t such that i t / ∈ T, there exist exactly λ blocks that contain the points in q |T ∪ {x t }. Hence, knowing q |T , the distribution of x t remains balanced. Thus we get I(i ; q |T ) = 0.

To sum up, the following theorem holds: Theorem 4.40. Let D be a database with k entries over F q , and T = t-TD( , s) be a t-transversal design, whose incidence matrix has rank sk over F q . Then, there exists an -server (t -1)-private PIR protocol with:

-only 1 symbol over F q to read for each server, --1 field operations for the user, -log(sq) bits of communication, -a storage rate R C = k/ s.

Instances

In this subsection we propose instances of t-transversal designs to be used in PIR protocols.

t-transversal designs from curves of degree ≤ t -1 in the affine plane. Looking for instances of t-transversal designs, it is natural to try to generalise the transversal designs given in Definition 4.12. An idea is to turn affine lines into higher degree curves. Definition 4.41. Let X be the set of points in the affine plane F 2 q , and G = {G 1 , . . . , G q } be a partition of X = F 2 q into q parallel lines. Without loss of generality we choose the following one: G i = {(α i , x), x ∈ F q } for each α i ∈ F q . Blocks in B are now defined as sets B F of the form

B F = {(F(x), x), x ∈ F q }, where F ∈ F q [T], deg F ≤ t -1.
Lemma 4.42. The design (X, B, G) given in Definition 4.41 defines a t-transversal design t-TD 1 (q, q).

Proof. The set of groups G we propose is indeed a partition of X into q groups, each of size q. It remains to check the incidence property. Let {G T 1 , . . . , G T t } be a set of t distinct groups, and let ((y T 1 , x T 1 ), . . . , (y

T t , x T t )) ∈ G T 1 × • • • × G T t .
From Lagrange interpolation theorem, we know there exists a unique polynomial F ∈ F q [T] of degree ≤ t -1 such that:

F(x T j ) = y T j ∀1 ≤ j ≤ t .
Said differently, there is a unique block B F which contains the t points {(y T j , x T j )} 1≤j≤t .

We postpone the analysis of the dimension of these codes, since it corresponds to a particular case of the generic construction we give below. Consider the map from blocks in B to rows of A given by:

ψ : B → Rows(A) B i = {(a i,j , j), 1 ≤ j ≤ } → (a i,1 , . . . , a i, )
Since we assumed that orthogonal arrays have no repeated row, the map ψ is one-to-one. Let x = (x 1 , , . . . , x t ) ∈ X t , where x u = (b u , j u ) ∈ S × [1, ]. Denote by b = (b 1 , . . . , b t ) ∈ S t the tuple formed by the first coordinates of x. From the definition of an orthogonal array of strength t and index λ, we know that elements in b appear exactly λ times in the submatrix of A defined by the columns indexed by T. Hence this defines λ preimages in B, which proves the result. Remark 4.45. As we noticed before, Construction 4.41 is a particular case of Construction 4.43. Indeed, a block B F = {(F(x), x), x ∈ F q }, with deg F ≤ t -1 is in one-to-one correspondence with a codeword c F of a Reed-Solomon code RS(t -1).

Corollary 4.46. Let C 0 be a code of length and dual distance t + 2 ≤ over a set S of size s. Then, the PIR protocol defined by IC q (C 0 ) is t-private.

Proof. Let A be the orthogonal array defined by C 0 . We know that A has strength t + 1 (see Proposition 4.22), hence from Proposition 4.44, the associated transversal design is a (t + 1)-TD( , s). Theorem 4.40 then ensures that the PIR protocol induced by this transversal design is t-private.

As in Subsection 4.3.4, when the code C 0 is divisible, we can lower bound the rate of its incidence code. We provide two examples in finite (and small) length.

Example 4.47. A first example would be to consider extended Golay codes. Indeed, they are known to be divisible by their characteristic [MS77, ch.II.6], they have large dual distance, and Proposition 4.34 then ensures their incidence codes have non-trivial rate. In Remark 4.37, we noticed that the binary Golay code does not give a practical PIR protocol due to a large communication complexity. Thus, let us instead consider the [12, 6, 6] 3 extended ternary Golay code, that we denote Golay 3 . It is self-dual, hence d ⊥ (Golay 3 ) = 6. Then, C = IC 3 e (Golay 3 ), e ≥ 1, has length 36 and Proposition 4.34 shows that dim C ≥ 18 (the bound can be proved tight by computation). Hence, the associated PIR protocol works on a raw file of 18 symbols over F 3 e , encoded into 36, and uses 12 servers (each storing 3 symbols). The upload communication complexity is cheap (only 12 symbols over F 3 ) while the download communication complexity is much more heavy (12 symbols over the extension field F 3 e . The main advantage thus remains the computation cost of the protocol and its resistance to any collusion of one third (i.e. 4) of the servers.

Example 4.48. A second example arises from the exceptional [q + 2, 3, q] q MDS codes in characteristic 2 [MS77, ch.XI.6]. For instance, for q = 4, we obtain a 2-private PIR protocol with 6 servers, each storing 4 symbols of F 2 e for some e ≥ 1. Once again, the dimension of the incidence code attains the lower bound, here k = 12. Example 4.49. Examples of incidence codes which do not attain the lower bound of Proposition 4.34 come from binary Reed-Muller codes of order 1, denoted RM 2 (m, 1). These codes are 2-divisible since they are known to be equivalent to extended Hamming codes. They also have length n = 2 m and dual distance d ⊥ (RM 2 (m, 1)) = n/2. For instance, RM 2 (3, 1) provides an incidence code of dimension k = 11 > 8, that is, a 2-private 8-server PIR protocol on a database with 11 symbols over F 2 e , where each server stores 2 symbols. For m = 4, RM 2 (4, 1) gives a 6-private 16-server PIR protocol on a database with 20 symbols over F 2 e , each server storing 2 symbols. We conjecture that IC 2 (RM 2 (m, 1)) leads us to a (2 m-1 -2)-private 2 m -server PIR protocol on a database with 2 m + m symbols, each server storing 2 symbols.

As pointed out in Subsection 4.3.3, incidence codes C = IC(C 0 ) have the best chance to have large rate if the dimension of C 0 is small, since the cardinality of C 0 is the number of rows in a (non-full-rank) parity-check matrix which defines C. Moreover, in order to define a t-private PIR protocol, we need an orthogonal array of strength t + 2, i.e. a code C 0 with dual distance t + 2. Conciliating both constraints, we are tempted to use MDS codes of dimension t + 1 for C 0 .

Once again we pick the family of Reed-Solomon codes as an easily example. Through the incidence code construction, these codes lead us to t-private PIR protocols with communication complexity approximately √ n, where n is the length of the encoded database. For C 0 = RS t+1 (F q ) and varying values of q and t, we were able to compute the rate of IC q (C 0 ). These rates are presented in Figure 4.6 and as expected, the rate of families of incidence codes decreases with t, the privacy parameter.

= q m Rate R = k/n t = 1 t = 2 t = 4 t = log(q) t =
√ q t = q/8 t = q/3 t = q -1 Figure 4.6 -Rate of incidence codes used for the construction of t-private PIR protocols.

Base codes C 0 are full-length Reed-Solomon codes of dimension t + 1 (dual distance t + 2) over F q . Associated PIR protocols then need q servers, each storing q symbols.

As a partial conclusion, the question of finding t-transversal designs with large strength t, moderate block size and low rank remains completely open.

Recent PIR constructions and bounds

In this section, we conclude the chapter by reporting some constructions of PIR protocols and some bounds on their parameters that appeared in the recent years.

PIR capacity, and capacity achieving protocols

Communication complexity is widely considered as the most crucial parameter in PIR protocols. Hence it is natural to raise the question of determining the minimum possible number of bits exchanged in a PIR protocol, all other parameters being fixed. It is commonly admitted that, theoretically, the upload communication complexity (the size of queries) is negligible compared to the download communication complexity. The usual argument is that the upload cost does not need to scale with the size of the individual message in the database [START_REF] Chan | Private Information Retrieval for Coded Storage[END_REF], and typical databases store large files. Therefore, given a fixed storage system, one would like to know what is the minimum number of bits one must download in order to retrieve privately a desired message.

For a given PIR protocol, the ratio of the number of downloaded bits to the message size is called the PIR rate. The maximum achievable PIR rate is called the PIR capacity.

The PIR capacity of replication-based 1-private PIR protocols were first analysed. Consider a system of non-communicating servers, each storing a copy of the database consisting of K messages of arbitrary large size L. In this context, Sun and Jafar [START_REF] Sun | The Capacity of Private Information Retrieval[END_REF] proved that the PIR capacity c is:

c = 1 -1/ 1 -(1/ ) K . (4.5)
One should emphasize that messages of size L ≥ K are necessary in their capacity-achieving construction. If one does not bound the number of files stored by the servers (i.e. K → ∞), we get c = 1 -1 . Notice that, in this setting, PIR capacity has been given and achieved in an earlier work by Shah, Rashmi and Ramchandran in [START_REF] Nihar | One Extra Bit of Download Ensures Perfectly Private Information Retrieval[END_REF].

If the servers store an unbounded number of messages encoded by an [ , R ]-code (each server storing one symbol of each encoded message), Chan, Ho and Yamamoto proved that c ≤ 1 -R, with equality for MDS codes. Tajeddine and El Rouayheb [START_REF] Tajeddine | Private Information Retrieval from MDS Coded Data in Distributed Storage Systems[END_REF] proposed optimal constructions for a larger range of parameters, notably by the use of file stripings. This work was finally extended by Kumar, Rosnes and Graell i Amat [START_REF] Kumar | Private Information Retrieval in Distributed Storage Systems using an Arbitrary Linear Code[END_REF] for non-MDS codes.

Recently, Banawan and Ulukus [START_REF] Banawan | The Capacity of Private Information Retrieval From Coded Databases[END_REF] showed that, when servers store K < ∞ messages encoded with an [ , R ] code, the PIR capacity is:

c = 1 -R 1 -R K ,
matching the Equation (4.5) for replication-based PIR protocols.

If servers are colluding (so-called t-private PIR, t ≥ 2) and store K replicated messages, Sun and Jafar [START_REF] Sun | The Capacity of Robust Private Information Retrieval With Colluding Databases[END_REF] proved that the PIR capacity is given by

c = 1 -t/ 1 -(t/ ) K .
For the coded case, Freij-Hollanti, Gnilke, Hollanti and Karpuk [START_REF] Freij-Hollanti | Private Information Retrieval from Coded Databases with Colluding Servers[END_REF] then proposed a construction with PIR rate 1-(t+k-1)/ 1-((t+k-1)/ ) K , and conjectured this quantity as being the PIR capacity. While the conjecture for finite K has been disproved in [START_REF] Sun | Private Information Retrieval from MDS Coded Data With Colluding Servers: Settling a Conjecture by Freij-Hollanti et al[END_REF], the techniques involved in their construction are elegant, notably by the use of star-product of codes. This way, they manage to build PIR protocols on [ , k]-coded data, whose PIR rate equals 1 -(k + t -1)/ . Note that their star-product scheme generalises to arbitrary collusion patterns [TGK + 17].

Finally, in the case we allow the storage system to depend on the parameters of the database (e.g. the number of servers depend on the size or number of messages), Shah, Rashmi and Ramchandran [START_REF] Nihar | One Extra Bit of Download Ensures Perfectly Private Information Retrieval[END_REF] proved that one can obtain 1-private retrieval with only 1 extra downloaded bit, compared to classical retrieval. However in their construction, the system requires ≥ (L + 1) K-1 servers, where L is the size of each message. Recently, Blackburn, Etzion and Paterson [START_REF] Simon | PIR Schemes with Small Download Complexity and Low Storage Requirements[END_REF] decreased this bound to ≥ L + 1 with an upload complexity Θ(KL log L). They also built -server PIR protocols with small download complexity (1 + 1 -1 )L, where -1 can be any divisor of L.

Is PIR rate the only criterion to consider?

Previous subsection mainly focused on optimal PIR protocols with respect to the download communication complexity (only). However, other parameters could be taken into account such as the storage overhead or the computational complexity, as we pointed out in the introduction of this chapter.

In [START_REF] Fazeli | Codes for Distributed PIR with Low Storage Overhead[END_REF], Fazeli, Vardy and Yaakobi gave a generic transformation of a replication-based PIR protocol into a coded PIR protocol, whose storage overhead is drastically reduced. Informally, the idea is to encode answers to user's queries in a way that preserves privacy, by the use of a so-called PIR code. Including the extended version of Fazeli et al.'s seminal paper [START_REF] Fazeli | PIR with Low Storage Overhead: Coding instead of Replication[END_REF], several works focused on studying bounds on PIR codes and optimal constructions of such codes [RV16, BE17, AY17, Ska18]. Also notice that, with very different techniques, the reduction of the storage overhead was also addressed the works of Shah et al. In most capacity-achieving PIR protocols, the answer of each server consists in computing a linear combination of all the symbols it holds. Though a few existing schemes admit a low computational complexity on the server side (e.g. [START_REF] Augot | A Storage-Efficient and Robust Private Information Retrieval Scheme Allowing Few Servers[END_REF]), this problem was not addressed for a long time. Very recently, Zhang, Yaakobi, Etzion and Schwartz [START_REF] Zhang | On the Access Complexity of PIR Schemes[END_REF] proposed to consider the access complexity -that is, the number of bits read in order to output servers' answers -as a fundamental parameter. The authors analysed trade-offs between PIR rate, storage overhead and access complexity, and gave optimal constructions for some range of parameters by the use of covering codes. The PIR constructions we proposed in this chapter were motivated by the reduction of the computational complexity on the server side. However, our strategy differs from [START_REF] Zhang | On the Access Complexity of PIR Schemes[END_REF], since we fix the access complexity to its minimum value, being the download complexity. Given this requirement, our goal was to build PIR protocols with the minimum PIR rate and maximum storage rate.

Chapter 5

Proofs of retrievability from codes with locality Contents

Introduction

Motivation

The use of cloud services, such as computing and storage, has evolved quite spectacularly over the past decade. In particular, data outsourcing allows users and companies to lighten their storage burden and maintenance cost. Though, it raises several issues: for example, how can a customer check efficiently that he can retrieve without any loss a massive file that he had uploaded on a remote server and erased from his personal system?

Proofs of retrievability (PoRs) address this specific issue. They are cryptographic protocols involving two parts: a client (or a verifier) and a server (or a prover). PoRs usually consist in the following phases. First, a key generation creates secret material related to the file, and meant to be kept by the client only. Then the file is initialised, that is, it is encoded and/or encrypted according to the secret data held by the client. Only this processed file is uploaded to the server. Then, the client can run a verification procedure, which is the core of the PoR. Finally, if the client is convinced that the server still holds his file, the client can proceed at any time to the extraction of the file.

In PoRs, several parameters must be taken into account. Plainly, the verification process has to feature a low communication complexity, since the main goal is to avoid to download a large part of the file while one only wants to check its extractability. Second, the storage overhead induced by the protocol must be low since the amount of additional data usually impacts the customer's storage fees. Similarly, the computation cost of the verification procedure must be low for the server, but also for the client which is supposed to own a small and computationally restricted device.

Previous works

Juels and Kaliski [START_REF] Juels | PORs: Proofs of Retrievability for Large Files[END_REF] gave the first formal definition of PoRs, from which our own definitions in Section 5.2 are inspired. They also proposed a seminal construction based on so-called sentinels: these are random parts of the file the client keeps secretly on his device, and whose presence will be checked during the verification step. Additionally, an erasure code ensures the soundness of the file to be extracted. Juels and Kaliski's seminal work [JK07] also raised several interesting points. On the one hand, it demonstrated that (i) the client must store some secret data to be used in the verification step, and (ii) coding is needed in order to retrieve the file without erasures or errors. On the other hand it highlighted a possible weakness for PoRs: in the scheme they propose, the verification step can only be performed a finite number of times, since sentinels cannot be reused many times.

As a consequence, Shacham and Waters proposed to build PoRs with unbounded-use [START_REF] Shacham | Compact Proofs of Retrievability[END_REF]. Precisely, two families of PoRs are built. The first one is based on linear combinations of authenticators produced via pseudo-random functions; its security is proved using cryptographic tools such as unforgeable MAC schemes, semantically secure symmetric encryption and secure PRF. The second one is a publicly verifiable scheme based on Diffie-Hellman problem in groups equipped with a bilinear map.

Bowers, Juels and Oprea [START_REF] Bowers | Proofs of Retrievability: Theory and Implementation[END_REF] modelled PoRs with so-called inner and outer codes. The encoded file which is uploaded lies in the outer code, while the inner code models the space in which the server's answers theoretically evolve. The authors then adopted this codingtheoretic approach to compare variants of the constructions given in [START_REF] Juels | PORs: Proofs of Retrievability for Large Files[END_REF][START_REF] Shacham | Compact Proofs of Retrievability[END_REF]. They focused on the practical efficiency of the schemes, and proved that, despite bounded-use, optimised variants of the construction of Juels and Kaliski are highly competitive compared to other existing schemes.

In

Our approach

As we noticed earlier, most PoR schemes rely on two techniques: (i) the client stores on his device some secret data in order to check the integrity of the file and (ii) the client encodes the file in order to repair a small number of erasures/errors that may remain unnoticed by the Verifier during the verification steps.

In this chapter, we propose to build a generic PoR scheme based on codes with local properties. When equipped with a suitable cipher, we prove that the construction fulfils both previous requirements. More precisely, our idea is the following. Given a file F, a code C and a suitable cipher E κ , the client sends to the server an encoded and encrypted version w = E κ (C(F)) of his file1 . Then, the verification step consists in checking short relations between symbols of w, that arise for instance from low-weight parity-check equations for C. Finally, if the file is considered as extractable, the code C provides the redundancy necessary to repair erasures and potential unnoticed errors.

We here develop ideas published in [START_REF] Lavauzelle | New Proofs of Retrievability using Locally Decodable Codes[END_REF], where we proposed a construction of PoRs based on lifted codes. In this chapter we provide a more generic construction, and give a sharper analysis of the security of the PoR.

The construction of PoRs we propose does not feature updatability nor public verifiability. Though, we emphasize its generality since it is based on well-studied and broad families of algebraic structures, namely codes and their parity-check equations. From a practical perspective, we highlight two main attributes of the construction. First, the client must only store the few bits corresponding to the secret material necessary to the cipher. Second, an honest server simply needs to read pieces of w during the verification step, and therefore has no computational burden compared to many other PoR schemes.

Organisation

Section 5.2 is devoted to the definition of proofs of retrievability and their security model. Despite the great disparity of models in PoR literature, we try to keep close to the definitions given in [START_REF] Juels | PORs: Proofs of Retrievability for Large Files[END_REF][START_REF] Paterson | A Coding Theory Foundation for the Analysis of General Unconditionally Secure Proof-of-Retrievability Schemes for Cloud Storage[END_REF] for the sake of uniformity. Section 5.3 presents our construction of PoR. Precisely, in Subsection 5.3.1, we introduce objects called verification structures for a code C that will be used in the definition of our PoR scheme (Subsection 5.3.2). A rigorous analysis of our scheme is the purpose of the remainder of that section. The performance of our construction are given in Section 5.4. We then provide several instances in Section 5.5, proving the practicality of our PoR schemes for some classes of codes.

Proofs of retrievability

Definition

In the context of proofs of retrievability, a user wants to estimate if a message m ∈ M can be retrieved from a encoded version w ∈ W of the message stored on a server. In all what follows, the user will be known as the Verifier (wants to verify the retrievability of the message) while the server is the Prover (aims at proving the retrievability). We also denote by K the set of secret values (or keys) kept by the Verifier, and by R the space of responses to challenges.

Definition 5.1 (Proof of retrievability). A keyed proof of retrievability (PoR) is a tuple of algorithms (KeyGen, Init, Verify, Extract) running as follows:

1. The key generation algorithm KeyGen generates uniformly at random a key κ ← R K. The key κ is secretly kept by the Verifier. 2. The initialisation algorithm Init is a deterministic algorithm which takes as input a message m ∈ M and a key κ ∈ K, and outputs a file w ∈ W. Init is run by the Verifier who initially holds the message m. After the process, the file w is sent to the Prover and the message m is erased on Verifier's side. Upon receipt of w, the Prover sets a deterministic algorithm P (w) that will be run during the verification procedure. 3. The verification algorithm Verify is a randomised algorithm initiated by the Verifier which needs a secret key κ ∈ K, and interacts with the Prover. Verify is depicted in Figure 5.1 and works as follows: (i) the Verifier runs a random query generator that outputs a challenge u ∈ Q (Q being the so-called query set); (ii) the challenge u is sent to the Prover; (iii) the Prover outputs a response r u ← P (w) (u) ∈ R;

(iv) the Verifier checks the validity of r u according to u and κ by the means of a subroutine Check(u, r u , κ), which outputs True if r u is compliant with u and κ. 4. The extraction algorithm Extract is run by the Verifier. It takes as input κ and r = (r u : u ∈ Q) ∈ R Q , and outputs either a message m ∈ M, or a failure symbol ⊥. We say that extraction succeeds if Extract(r, κ) = m.

The vector r = (r u ← P (w) (u)) u∈Q ∈ R Q is called the response word associated to P (w) .

Verifier Prover

κ w Pick u ← R Q at random r u ← P (w) (u) Output Check(u, r u , κ) u r u Figure 5.

-Definition of algorithm Verify

Note that, in assuming that response algorithms P (w) are deterministic and non-adaptive (meaning that their behaviour only depends on the value of the challenge u, and not on the success of past calls to the verification algorithm), we follow the work of Paterson et al. [START_REF] Paterson | A Coding Theory Foundation for the Analysis of General Unconditionally Secure Proof-of-Retrievability Schemes for Cloud Storage[END_REF]. The authors justify determinism of response algorithms by the fact that any probabilistic prover can be replaced by a deterministic prover whose success probability is at least as good as the probabilistic one.

In Definition 5.1, we can see that the deterministic algorithm P (w) can be represented by the vector of its outputs r = (P (w) (u), u ∈ Q), called the response word of P (w) . Therefore, we can assume that before the verification step, the Prover produces a word r ∈ R Q related to the file w he holds. In other words, we model provers as algorithms P which, given an input w, return a word r ∈ R Q .

Following [START_REF] Paterson | A Coding Theory Foundation for the Analysis of General Unconditionally Secure Proof-of-Retrievability Schemes for Cloud Storage[END_REF], we also assume in this chapter that the extraction algorithm Extract is deterministic, though in general it can be randomised. Finally, notice that proofs of retrievability aim at proving the extractability of a file. The extraction algorithm is therefore a theoretical tool for obtaining such a proof. Hence, its computational efficiency is not a crucial feature.

The following table summarises the information held by the two main entities after the initialisation step:

Verifier Prover κ w

Let us also report the inputs and outputs of the algorithms involved in a PoR:

Security models

One should first notice that, despite many efforts, proofs of retrievability lack a general agreement on the definition of their security model. For the sake of uniformity, our definitions remain very close to the ones given in the original work of Juels and Kaliski [START_REF] Juels | PORs: Proofs of Retrievability for Large Files[END_REF].

For a response word r ∈ R Q given by the Prover and a key κ ∈ K kept by the Verifier, we first define the success of r according to κ as: succ(r, κ) := Pr (Check(u, r u , κ) = True) , where the probability is taken over the internal randomness of Verify. A first security model can be defined as follows.

W → R Q we have: Pr   Extract(r, κ) = m and succ(r, κ) ≥ 1 -ε κ ← R KeyGen(1 λ ) w ← Init(m, κ) r ← P (w)   ≤ τ , ( 5.1)
the probability being taken over the internal randomness of KeyGen.

Let us propose a short scenario to illustrate this definition. The Verifier is the owner of a file m ∈ M, and uploads on a server a file w ∈ W computed according to the initialisation phase of an (ε, τ)-sound PoR. During a certain period of time, the Verifier proceeds to several verification procedures for his file. This allows him to estimate2 the value of succ(r, κ) ∈ (0, 1). Notice that the Verifier may only choose the most recent verification procedures, since we need to assume that the response word r does not change over time. Finally, if the estimate convinces the Verifier that succ(r, κ) ≥ 1ε, then he knows that he can theoretically retrieve his file from the server, with very high probability ≥ 1τ.

Regarding parameters ε and τ, in the light of the above it is highly desirable to have τ very small. For its part, the parameter ε measures the rate of unsuccessful audits which leads the Verifier to believe the extraction will fail. Therefore, one does not necessarily need to have large ε, though in practice large values of ε afford flexibility, for instance if communication errors occur between the Prover and the Verifier during the verification procedure.

    Extract(r, κ) = m and succ(r, κ) ≥ 1 -ε m ← R M, κ ← R KeyGen(1 λ ) w ← Init(m, κ) r ← P (w)     ≤ τ ,
Since we deal with values of τ very close to 0, we also say that a strongly (ε, τ)-sound PoR admits λ = -log 2 (τ) bits of security.

Informally, stating that a PoR is not weakly sound amounts to finding a deterministic algorithm P which -takes as input a file w ∈ W and outputs a response word r ∈ R Q , -makes the extraction fail with non-negligible probability (over messages m ∈ M and keys κ ∈ K such that the corresponding response words are successfully audited).

The PoR construction

Schematically, in the initialisation phase of our construction the Verifier (i) encodes his file according to a code C;

(ii) scrambles the resulting codeword using a tuple of permutations over the base field;

(iii) uploads the result to the Prover.

As we explained in the introduction, the verification step then consists in checking that the server is still able to give answers that, once decrypted, satisfy low-weight parity-check equations for C. For this purpose, we introduce objects called verification structures for codes, that will be used in the definition of our generic PoR scheme.

Verification structures for codes

Let 1 ≤ ≤ n, and u be an -subset of [1, n]. For w ∈ F n q , the word w |u ∈ F u q can be seen as a word in F q via a bijective map [1, ] → u which corresponds to an ordering of elements in the set u. Throughout the chapter will abuse this identification between F u q and F q , that we will hide behind the notation R. Definition 5.4 (Verification structure). Let 1 ≤ ≤ n and C ⊆ F n q be a code. Let also Q be a non-empty set of ordered -subsets of [1, n]. We define the collection R of restriction maps associated to Q as: R : Q × F n q → R (u, w) → w |u where R F q as we explained previously. Given an integer s ≥ 1 and a linear map V : Q × R → F s q , we say that (Q, V) is a verification structure for C if the following two constraints are fulfilled:

1. for all i ∈ [1, n], there exists u ∈ Q such that i ∈ u;

Recall that according to Construction 5.7, we define Q = B. Then, the verification map V : Q × F 3 2 → F 2 can be defined as follows:

if u = {u 1 , u 2 , u 3 } ∈ B and b ∈ F u 2 , we define V(u, b) = 3 ∑ i=1 b u i . Now, let m = (m 1 , m 2 , m 3 ) ∈ F 3 2 .
According to the previous ordering of points and blocks, the message m can be encoded into

c = (m 1 , m 2 , m 1 + m 2 , m 3 , m 1 + m 3 , m 1 + m 2 + m 3 , m 2 + m 3 ) ∈ C . Hence, the word r = R(c) ∈ (F 3
2 ) 7 is: 3 2 of r = R(c), one can now check that ∑ j b j = 0. Hence, we get V(R(c)) = 0, as expected.

r =     c 1 c 2 c 3   ,   c 1 c 4 c 5   ,   c 1 c 6 c 7   ,   c 2 c 5 c 6   ,   c 2 c 4 c 7   ,   c 3 c 4 c 6   ,   c 3 c 5 c 7     =     m 1 m 2 m 1 + m 2   ,   m 1 m 3 m 1 + m 3   ,   m 1 m 1 + m 2 + m 3 m 2 + m 3   ,   m 2 m 1 + m 3 m 1 + m 2 + m 3   ,   m 2 m 3 m 2 + m 3   ,   m 1 + m 2 m 3 m 1 + m 2 + m 3   ,   m 1 + m 2 m 1 + m 3 m 2 + m 3     For each coordinate b = r i ∈ F
From now on, we denote by N = |Q| the length of the response code R(C) of a code C equipped with a verification structure (Q, V).

A PoR scheme based on codes with locality

For pedagogical purposes, let us first present in Figure 5.2 a naive construction of PoR that unfortunately fails. It is based on a linear code C and its verification structure (Q, V). We can assume that C is public, and we denote by R = F q and W = F n q .

In short, in the tentative PoR scheme given in Figure 5.2, the client verifies parity-check equations in the codeword w that has been uploaded on the server. Hence such a PoR would admit several advantages: first, it requires no computation for the server; second, it can achieve low communication complexity if the parity-check equations have low weight; third, the storage cost for the client is zero.

However, the protocol proposed in Figure 5.2 does not define a sound proof of retrievability. Indeed, a malicious server can very easily produce a response word r (mal) which (i) always pass the verification procedure, and (ii) leads to the extraction of a file different from m. For instance, let w (mal) = w ∈ C, and define r (mal) = R(w (mal) ). Then it is clear that V(u, r

) = 0 for every challenge u ∈ Q. However, the extraction procedure outputs the message m (mal) whose encoded version is w (mal) , and we have m (mal) = m.

To tackle the attack on the protocol, we need to prevent the Prover to create other codewords than w, the original one. The solution we propose makes use of permutations, aiming at breaking the structure of C. Let us formalise this idea.

r is ε-close to (Q, V σ ) means there are at most εN challenges u ∈ Q for which we know that the coordinate r u is not authentic. This justifies that we assign erasure symbols to these coordinates. r is a β-liar for (Q, V, c) means there are at most βN other corrupted values r u , but we cannot identify them. Therefore we can assimilate these coordinates to errors.

To sum up, we see r as a corruption of R(C(m)) with at most εN erasures and at most βN errors, where N = |Q|. Since we assume that (ε + 2β)N < d, we know from the previous discussion that the decoding succeeds to retrieve m.

Bounding the extraction failure. According to Definition 5.3, our PoR scheme is weakly (ε, τ)-sound if for every algorithm P outputting a response word r (w) from a file w, we have

Pr   decoding r (w) into m fails and wt(V σ (r (w) )) ≤ εN m ← R F k q , σ ← R S(F q ) n , w = σ(C(m))   ≤ τ .
Using Proposition 5.14, the analyse of the security of our PoR scheme reduces to measuring the Prover's capability to produce a response word r which is ε-close to (Q, V σ ) and a β-liar for (Q, V σ , w), with (ε + βN) < d.

For fixed r ∈ R Q , σ ∈ S(F q ) n and w = σ(C(m)) the authentic file given to the prover, we define:

-D(r, w) := {u ∈ Q, r u = R(w) u } and D(r, w) := |D(r, w)| = wt(r -R(w)). This represents challenges u on which the response word r differs from the authentic one R(w). -E (r, σ) := {u ∈ Q, V σ (u, r u ) = 0} and E(r, σ) := |E (r, σ)| = wt(V σ (r)). These are challenges u on which the associated coordinate r u is not accepted by the verification map (it corresponds to erasures in the decoding process), -B(r, σ, w) := {u ∈ Q, r u = R(w) u and V σ (u, r u ) = 0} and B(r, σ, m) := |B(r, σ, m)|.

These are the challenges u on which the associated coordinate r u is accepted by the verification map, but differs from the authentic response (it corresponds to errors in the decoding process).

One can easily check that the sets E (r, σ) and B(r, σ, w) define a partition of D(r, w). The probability of extraction failure can thus be written:

Pr   2D(r, w) -E(r, σ) ≥ d min (R(C)) and E(r, σ) ≤ εN m ← R F k q , σ ← R S(F q ) n , w ← σ(C(m))   .
(5.2)

Given w ∈ F n q and r ∈ R Q , let us also rewrite the space of admissible permutations and messages:

Φ w := {(σ, m) ∈ S(F q ) n × F k q , w = σ(C(m))} . We also define α(r, w) := max u∈D(r,w)

Pr Φ w (V σ (u, r u ) = 0) . and α := max (r,w) α(r, w) where (r, w) are such that D(r, w) = 0. Here the notation Pr Φ w refers to the fact that σ is uniformly drawn from Φ w . Similarly we will use notation E Φ w and D Φ w .

The parameter α ∈ (0, 1) is called the bias of the verification structure (Q, V) for C. It corresponds to the maximum probability that a response is accepted but does not correspond to the original file. Lemma 5.15. For all r ∈ R Q and w ∈ F n q , we have:

E Φ w (E(r, σ)) ≥ (1 -α)D(r, w) .
Proof. A simple computation shows that:

E Φ w (E(r, σ)) = E Φ w ∑ u∈D(r,w) 1 V σ (u,r u ) =0 = ∑ u∈D(r,w) Pr Φ w (V σ (u, r u ) = 0) ≥ ∑ u∈D(r,w) (1 -α) = (1 -α)D(r, w) .
Lemma 5.15 essentially means that, if an adversary to our PoR scheme wants its response word to be (in average) ε-close to the verification structure, then he must modify at most D(r, w) ≤ εN 1-α responses. Below we take advantage of this fact and we measure the probability of an extraction failure.

First, for δ, ε ∈ (0, 1), denote by p(r, w; ε, δ) := Pr Φ w 2D(r, w) -E(r, σ) ≥ δN and E(r, σ) ≤ εN = Pr Φ w E(r, σ) ≤ min{εN, 2D(r, w) -δN} .

The probability p(r, w; ε, δ) represents the probability that the extraction fails for a response code of relative distance δ and an adversarial response word r associated to w, which is ε-close to the verification structure. Recall that D(X) represents the variance of a random variable X, and let us bound p(r, w; ε, δ). Proposition 5.16. Let δ, ε ∈ (0, 1) such that δ 1-α 1+α > ε. Let also r ∈ R Q and w ∈ F n q . Then we have: p(r, w; ε, δ) ≤ D Φ w (E(r, σ))

1+α 2 δ 1-α 1+α -ε 2 N 2 .
Proof. We distinguish three cases.

1. Case 2D(r, w) -δN < 0. The event E(r, σ) ≤ min{εN, 2D(r, w) -δN} never occurs since E(r, σ) ≥ 0. Hence p(r, w; ε, δ) = 0. 2. Case εN ≤ 2D(r, w) -δN. In that case we have p(r, w; ε, δ) = Pr Φ w (E(r, σ) ≤ εN).

Moreover, if E(r, σ) ≤ εN holds, then we also have

E(r, σ) -E Φ w (E) ≤ εN -(1 -α)D(r, w) ≤ εN -(1 -α) ε + δ 2 N ≤ - 1 + α 2 δ 1 -α 1 + α -ε N .

Performance

Efficient scrambling of the encoded file

In the PoR scheme we propose, the storage cost of an n-tuple of permutations in S(F q ) n is excessive, since it is superlinear in the original file size. In this subsection, we propose a storage-efficient way to scramble the codeword c ∈ C produced by the Verifier.

Precisely, given a codeword c ∈ C ⊆ F n q , we want to define a map σ : c → w ∈ F n q with the following requirements:

-the map σ is efficiently computable and requires a low storage, -if w = σ(c), c ∈ C , then for every i ∈ [1, n] the local inverse map w i → c i is efficiently computable, -given the knowledge of w = σ(c) and C, it is hard to produce a response word r ∈ R Q such that V σ (u, r u ) = 0 and r u = w |u for many u ∈ Q.

We here propose to use an n-tuple of pseudo-random permutations (σ 1 , . . . , σ n ) = σ derived from a suitable block cipher. Let us first give an explicit construction, so that we can discuss its subtleties afterwards.

The construction. Let IV denote a random initialisation vector for a cipher in CTR mode (IV could be a nonce concatenated with a random value). For example, we choose the AES block cipher. Vector IV is kept secret by the Verifier, as well as a randomly chosen key κ for the cipher. Let also f be a permutation polynomial over F q of degree d > 1. For instance one could choose f (x) = x d with gcd(d, q -1) = 1. Notice that polynomial f can be published.

Let s = 256 log 2 q be the number of F q -symbols one can store in a 256-bit word 3 . Up to appending a few random bits to c, we assume that s | n, and we denote by t = n/s. Let us fix a partition of [1, n] into s-tuples i = (i 1 , . . . , i s ); it can be for instance (1, . . . , s), (s + 1, . . . , 2t), . . . , ((t -1)s + 1, . . . , n). Notice that this partition does not need to be chosen at random. Given c = (c 1 , . . . , c n ) ∈ C and i an element of the above partition, we now define

b i = f (c i 1 ) | • • • | f (c i s ) ⊕ AES κ (IV ⊕ i) ∈ {0, 1} 256 .
If log 2 q 256, trailing zeroes can be added to evaluations of f . Finally, the pseudo-random permutation σ is defined by: σ(c) := (b 1 , . . . , b t ) .

Informal analysis. One could first question the necessity to use i as a part of the input of the AES cipher. Assume that we do not. Then, the local permutation σ j , 1 ≤ j ≤ n, would not depend on j. As a consequence, for certain class of codes the local verification map r u → V σ (u, r u ) would not depend on u, and a malicious Prover would then be able to produce accepted answers while storing only a small piece of the file w (e.g. w |u for only one u ∈ Q).

Second, one could wonder why a permutation polynomial f of degree d > 1 is used. Assume for instance that f = id. Then, given the knowledge of w = σ(c), it would be very easy for a malicious Prover to produce a word w = w, such that r = R(w ) is always accepted by the Verifier. Simply, the Prover defines w = w + c , where c is any non-zero codeword of C. Hence, one sees that the polynomial f must be nonlinear in order to prevent such kind of attacks.

Parameters

Let us consider a PoR built upon a code C ⊆ F n q , with verification structure (Q, V) satisfying R F q and V(R) = F s q . We also assume we use an n-tuple of pseudo-random permutations as described in the previous subsection.

Communication complexity.

At each verification step, the client sends an -subset of coordinates u ⊂ [1, n]. The server then answers with the corresponding symbols w i ∈ F q , for i ∈ u. Therefore the upload communication cost is log 2 n bits while the download communication cost is log 2 q, thus a total of (log 2 n + log 2 q) bits.

Computation complexity. During the initialisation phase, following the encryption process described above, the client essentially has:

-to compute the codeword c ∈ C associated to its message, -to make n evaluations of the permutation polynomial f over F q , and -to compute t = n log 2 q 256 AES ciphertexts to produce the word w to be sent to the server. Given a generator matrix of C, the codeword c ∈ C can be computed in O(kn) operations over F q with a matrix-vector product. Notice that quasi-linear-time encoding algorithms exist for some classes of codes. Moreover, if a monomial or a sparse permutation polynomial f is used, then the cost of each evaluation of f is O((log 2 q) 3 ). If we denote by c the bitcost of an AES encryption, we get a total bitcost of O(n 2 (log 2 q) 2 + n(log 2 q) 3 + cn log 2 q) for the initialisation phase. Recall this is a worst-case scenario in which the encoding process is inefficient.

At each verification step, an honest server only needs to read symbols from the file it stores. Hence it has no computation complexity. The client has to compute a matrix-vector product over F q , where the matrix has size s × and the vector has size , thus a computation cost of O( s) operations over F q .

Storage needs. The client only stores 2 × 256 bits for the secret material: the key κ and the initialisation vector IV used in the AES cipher. The server storage overhead exactly corresponds to the redundancy of the linear code C, that is (ndim(C)) log 2 q bits. Other features. The PoR scheme we propose in Section 5.2 is unbounded-use, since each challenge reveals nothing about the secret data held by the client. Unfortunately it does not feature dynamic updates of files. However, we must emphasize that the file w the client produces can be split among several servers, and the verification step remains possible even if the servers do not communicate with each other. Indeed, computing a response to a challenge does not require to mix distinct symbols w i of the file. Therefore, the scheme we propose is well-suited for the storage of large static distributed databases.

Client storage: 512 bits Server total storage: n log 2 q bits Communication complexity (verif.): log 2 (nq) bits Client computational complexity (verif.): decryptions, s operations over F q Server computational complexity (verif.): reads, no computation Table 5.1 -Summary of parameters of the proposed PoR construction. We assume the file has size k log(q) bits, and the underlying code C ⊆ F n q has dimension k and is equipped with a verification structure (Q, V) such that |u| = , and rank V(u, •) ≤ s for all u ∈ Q.

Instantiations

In this section we present several instantiations for the PoR protocol presented in Section 5.2. According to Theorem 5.18 and the study of parameters in the last section, we especially look for codes C with positive rate (when its length n tends to infinity), such that the response code R(C) has positive relative distance (when its length N tends to infinity).

Tensor-product codes

Let us first recall a specific construction of codes called the tensor product. For x ∈ F A q and y ∈ F B q , we denote by x ⊗ y the tuple c ∈ F A×B Next paragraph illustrates the PoR construction we propose with a simple code, though it cannot be used in practice. More practical PoR instances appear in the following paragraphs.

A simple but non-practical instance. Let n = N , and for 0 ≤ i ≤ N -1, denote by u i = {i + 1, i + 2, . . . , (i + 1) }}. We define Q = {u i , i ∈ [0, N -1]}. The set Q defines a partition of [1, n]. We define the code

C = {c ∈ F n q | ∑ j∈u c j = 0, ∀u ∈ Q} ⊆ F n q .
In other words, up to re-indexing the coordinates we have C = Par( ) ⊗ F N q , and a parity-check matrix H for C is given by:

H =       1 • • • 1 0 • • • • • • • • • • • • • • • 0 0 • • • 0 1
• • • • • • • • • • • • • • • 0 1 • • • 1       .
The verification map V : Q × F q → F q is defined by V(u, b) := ∑ j=1 b u j , for all (u, b) ∈ Q × F q . By construction (see Construction 5.6), the pair (Q, V) defines a verification structure for C. Proof. We see that the restriction map R sends the codeword (1, -1, 0, 0, . . . , 0) ∈ C to a word of weight 1. Moreover, the map R is injective so d min (R(C)) > 0.

Since δ = d min (R(C))/N = 1/N → 0 when N → ∞, according to Theorem 5.18 a tentative PoR scheme built upon C cannot be sound.

Remark 5.24. One can also see C as a design-based code. The underlying design is a 1-(n, , 1) design (X, B), also simply known as a partition. Indeed, the point set X is [1, n], and each point x i,j = i + j ∈ X, for 0 ≤ i ≤ n/ -1 and 1 ≤ j ≤ , belongs to exactly one block u i ∈ B of size .

Higher order tensor-product codes. We first state a link between tensor-product codes and generalised design-based codes. For 1 ≤ i ≤ s and x ∈ X := ∏ s j=1 X j , we need to define L i,x ⊆ X, the 'i-th axis-parallel line with basis x', as L i,x := {y ∈ X | y j = x j , ∀j = i} . Notice that the line L i,x can be seen as a translation of the axis X i , whence its designation. One should also pay attention to the fact that two distinct tuples x = x can define the same line L i,x = L i,x . Proposition 5.25. Let A i ⊆ F X i q , 1 ≤ i ≤ s, be s linear codes of length . Then, the tensor-product code C = A 1 ⊗ • • • ⊗ A s is a generalised design-based code Code(D, L), with the following parameters.

-The underlying design D = (X, B) is a 1-( s , , s) design. Its point set is X = ∏ i X i , and its block set is B = {L i,x , 1 ≤ i ≤ s, x ∈ X}. -The set of local codes L = (L B , B ∈ B) is defined by L B = A i if B = L i,x for some x ∈ X (using a one-to-one map X i → L i,x ).

Proof. Let us prove that C ⊆ Code(D, L). The code C is generated by elementary tensors of the form a (1,j 1 ) ⊗ • • • ⊗ a (s,j s ) , 1 ≤ j i ≤ dim A i , where for every 1 ≤ i ≤ s, the set {a (i,j) , 1 ≤ j ≤ dim(A i )} defines a basis of A i . So, by linearity, let us prove the result for an elementary tensor e (j) := a (1,j 1 ) ⊗ • • • ⊗ a (s,j s ) , where j = (j 1 , . . . , j s ).

We denote a (i,j i ) [x i ] the symbol of a (i,j i ) supported by x i ∈ X i . We can see that e (j) |L i,x = (a (1,j 1 ) ⊗ • • • ⊗ a (s,j s ) ) |L i,x = ∏ t =i a (t,j t ) [x t ] a (i,j i ) ∈ A i , (5.3) since a (i,j i ) is an element of the basis we have given for A i . Notice that we made here the identification between X i and L i,x . Finally, we get e (j) |L i,x ∈ A i for every L i,x ∈ B, which proves by linearity that: C ⊆ {c ∈ F X q | ∀L i,x ∈ B, c |L i ,x ∈ A i } = Code(D, L) .

The reverse inclusion can be proved very similarly. Finally, it is easy to check that D is a 1-( s , , s) design: every point x ∈ X belongs to exactly s distinct lines L i,x of cardinality .

For convenience we now consider the case where all X i = X 1 and A i = A 1 , for every 1 ≤ i ≤ s. So let A ⊆ F A q be a non-degenerate [ , k A , d A ] q -linear code, and define C = A ⊗s ⊆ F X q where X = A s , and n = |X| = s . Thanks to Proposition 5.25, it is easy to define a verification structure (Q, V) for C, see Construction 5.7. So let us analyse its response code. Proof. Let us first prove that the minimum distance of the response code is greater than s • d min (A) s-1 . Let r = R(c) ∈ R(C), and assume r = 0. Then, there exists L ∈ Q such that 0 = r L = c |L ∈ A. Therefore c x = 0 for some x ∈ L ⊂ X. Now, for some 1 ≤ i ≤ s, consider the set S i,x = {y ∈ X, y i = x i } ⊆ X .

Very informally, the set S i,x corresponds to the hyperplane passing through x and 'perpendicular' to the i-th axis. By definition of C = A ⊗s , we know that c |S i,x ∈ A ⊗(s-1) for every 1 ≤ i ≤ s. Denote by U i = supp(c |S i,x ), and t i := |U i | ≥ d min (A ⊗(s-1) ) = d min (A) s-1 . One can write U i = {u (i,1) , . . . , u (i,t i ) }. For every u (i,j) ∈ U i , the line L i,u (i,j) is such that c |L i,u (i,j) is a non-zero codeword of A. Therefore,

wt(r) = |{L ∈ Q, r L = 0}| ≥ s i=1 L i,u (i,j) , 1 ≤ j ≤ t i ≥ s ∑ i=1 t i ≥ s • d min (A) s-1 .
Let us now build a word r ∈ R allows us to apply Proposition 5.22. Furthermore, if every Φ w is sufficiently uniform, the bias α satisfies α ∈ O(q -δ +1 ). Hence 1-α 1+α = 1 + O(q -δ +1 ). Therefore we can use Theorem 5.18 and we get the desired result.

Parameters. We mainly focus on the download communication complexity in the verification step and on the server storage overhead, since they are the most crucial parameters which depend on the family of codes C we use. Moreover, we consider as more relevant to analyse the ratio of these quantities to the file size, rather than their absolute values.

For the PoR scheme based on tensor product of MDS codes analysed in Proposition 5.27, and an initial file m of size |m| = ((1δ)q + 1) s log 2 q bits, we get -a relative redundancy n log 2 q |m| = q (1-δ)q+1 s ≤ 1

(1-δ) s ; -a relative communication complexity log 2 q |m| = q ((1-δ)q+1) s ≤ 1

(1-δ) s q 1-s .

Example 5.28. We present various parameters of PoR instances based on tensor-product codes, for files of size approaching 10 4 , 10 6 and 10 9 bits. We only report instances with comparable success bound ε 0 , here 0.10 ≤ ε 0 ≤ 0.16. Formally, recall that A is a [q, (1δ)q + 1, δq] q MDS code (e.g. a Reed-Solomon code), and C = A ⊗s . 2.266 0.113 Example 5.28 shows that, if the communication rate is reasonable for the PoR instances based on tensor-product codes, their storage overhead is large. In fact, the problem lies in the fact that δq must be large in order to reach non-vanishing values of ε. In the next subsection, we will see that Reed-Muller codes, and more generally codes equipped admitting a verification structure with a richer query set, allow us to reach better PoR parameters.

q

Reed-Muller and related codes

Low-degree Reed-Muller codes are known to admit many distinct low-weight parity-check equations, whose supports corresponds to affine subspaces of the ambient space. Therefore they seem naturally adapted to our construction. Let us first consider the plane (or bivariate) Reed-Muller code case.

The plane Reed-Muller code RM q (2, q -2). Let C be the Reed-Muller code RM q (2, q -2).

Recall that C has length q 2 and dimension (q -1)(q -2)/2. Furthermore, we have seen in Chapter 2 that for every affine line L = {x = (at + b, ct + d), t ∈ F q } ⊂ F 2 q and every c ∈ C, it holds that ∑ x∈L c x = 0. Therefore, we can define Q as the set of affine lines L of F 2 q , and the verification map V by V(L, b) = ∑ j=1 b j ∈ F q for every b ∈ R. From the previous discussion we know that (Q, V) is a verification structure for C. Also, there are q(q + 1) distinct affine lines in F 2 q , hence N = q(q + 1). Lemma 5.29. Let C = RM q (2, q -2) equipped with its verification structure defined as above. Then, its response code R(C) has minimum distance q 2 + 2.

Proof. Any non-zero codeword c ∈ C consists in the evaluation of a non-zero polynomial f (X, Y) ∈ F q [X, Y] of degree at most q -2. Denote by L 1 , . . . , L a ⊂ F 2 q , the affine lines on which f vanishes; i.e. f (x) = 0 for every x ∈ L i , 1 ≤ i ≤ a. We claim that a ≤ q -2. Indeed, since f has total degree < q -1, f also vanishes on closed lines L 1 , . . . , L a , i.e. affine lines seen in the closure F q 2 , where F q denotes the algebraic closure of F q . Denote by g i ∈ F q [X, Y] the monic polynomial of degree 1 which defines L i . From Hilbert's Nullstellensatz, there exists r > 0 such that (∏ a i=1 g i )| f r . Since the g i 's have degree 1 and are distinct, we get a ≤ deg f ≤ q -2. Hence, the affine lines different from L 1 , . . . , L a correspond to non-zero coordinates of R(c). There are q(q + 1) -a ≥ q 2 + 2 such lines so d min (R(C)) ≥ q 2 + 2. Now we claim there exists a word r ∈ R(C) of weight Nq + 2 = q 2 + 2. Let L (0) and L (1) be two distinct parallel affine lines respectively defined by X = 0 and X = 1. Now consider the word c ∈ F F 2 q q such that c x = -1 for x ∈ L (0) , c y = 1 for y ∈ L (1) and c z = 0 elsewhere. One can check that c ∈ C; indeed c is the evaluation vector of ∏ α∈F q \{0,1} (α -X), of degree less than q -2. Now, if we want to compute wt(R(c)), we only need to count the number of lines which do not intersect L (0) or L (1) . There are only q -2 such lines, namely the lines of equation X = β, where β ∈ F q \ {0, 1}. Hence wt(R(c)) = q(q + 1) -(q -2) and this concludes the proof. Proposition 5.30. Let C = RM q (2, q -2), and (Q, V) its associated verification structure. If every Φ w is sufficiently uniform, then the PoR scheme associated to C and (Q, V) is (ε, τ)-sound for ε = 1 -o(1) and τ = O 1 (1-ε)q 2 , when n = q 2 → ∞. Moreover, the relative distance of R(C) is q 2 +2 q(q+1) → 1 according to Lemma 5.29. If every Φ w is sufficiently uniform, the bias α satisfies α ∈ O(1/q); hence 1-α 1+α = 1 + O(1/q). Therefore we can use Theorem 5.18 and we get the desired result.

Parameters. For the plane Reed-Muller code setting and an initial file of size |m| = 1 2 (q -1)(q -2) log 2 q bits, we get -a relative redundancy q 2 log 2 q |m| = 2

(1-1/q)(1-2/q) → 2; -a relative communication complexity q log 2 q |m| = 2 q 1

(1-1/q)(1-2/q) = O(1/q).

Storage improvements via lifted codes. The redundancy rate of Reed-Muller codes presented above stays stuck above 2. Affine lifted codes, introduced by Guo, Kopparty and Sudan [START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF], allow us to break this barrier while keeping the same verification structure. We refer to Chapters 2 and 3 for more details about these codes. Here we focus on Lift(RS q (q -2), 2), since it can be compared to RM q (2, q -2). Furthermore, by definition of lifted codes, N q = 8 q = 64 1 0.1418 0.0152 5 0.1433 0.0163 10 0.1443 0.0165 50 0.1455 0.0169 100 0.1452 0.0167 500 0.1464 0.0169 1/(q -1) 0.1429 0.01587 N q = 8 q = 64 1 0.1414 0.0158 5 0.1431 0.0162 10 0.1452 0.0166 50 0.1450 0.0168 100 0.1458 0.0168 500 0.1470 0.0168 1/(q -1) 0.1429 0.01587 Table 5.2 -Estimators ξ M (p Φ ) using Test 1 (on the left) and Test 2 (on the right) with M = 100, 000 and t = 2, for q ∈ {8, 64} and various values of N. The quantity 1/(q -1) represents an estimated upper bound on α that ξ M (p Φ ) should approximate. (p Φ ) using Test 3 with M = 1, 000, 000 and t = 2, for various values of prime powers q. The quantity 1/(q -1) represents an estimated upper bound on α that ξ M (p Φ ) should approximate. ξ M (p Φ )

q ξ M (p Φ )
t = 2
expected 1/(q-1), q=8 expected 1/(q-1), q=64 ξ M (p Φ )

t = 3
expected 1/(q-1), q=8 expected 1/(q-1), q=64

Conclusion

As a conclusion, we propose several tracks of research on topics we addressed in this thesis.

Codes with locality and designs. In Chapter 2 we proved that generalising the classical construction of codes based on designs yields good LCCs. It could be of interest to pursue this study, e.g. by providing bounds on their parameters (for instance their dimension, length or locality). New good instances of design-based LCCs which do not come from classical geometries or algebraic constructions would also be of interest, since they would highly differ from the good LCCs we currently know.

More theoretically, one could also ask whether the combinatorial version of LCCs we give (based on designs) can achieve parameters as good as general LCCs. Indeed, design-based LCCs intrinsically give rise to local reconstruction algorithms (i.e. they never fail when the codeword is not corrupted), which is not required in the definition of LCCs.

Finally, we know that, in the constant locality regime, there is a strict distinction between LDCs and LCCs in terms of parameters. Thus, the construction of locally decodable codes from designs might be worthwhile to address.

Lifted codes. At the end of Chapter 3, we proposed a thorough study of the degree set (and a fortiori the dimension) of affine lifted codes Lift(RS q (k), m = 2). An immediate and interesting project would be to extend the investigation to larger orders m ≥ 3.

A more ambitious and theoretical avenue of research would consider the generalisation of the lifting process to other kind of varieties and embeddings. The work of Guo [START_REF] Guo | High-Rate Locally Correctable Codes via Lifting[END_REF],

where Hermitian codes are lifted, can be seen as a precursor to this study. But to the author's opinion (and ours), the construction admits minor weaknesses. For instance, Guo's so-called Φ-lifting of a code C 0 ⊆ F X q leads to a longer code C which, by construction, is supported by direct products X m . The local properties of C come from embeddings X → X m , but they highly depend on the richness of the automorphism group of X, and intrinsically give nonperfectly smooth local correcting algorithms. Ideally speaking, one would like to result in codes C supported by a variety V such that a nicely structured set of embeddings X → V yields interesting local properties to C.

Private information retrieval.

First natural questions related to our construction of PIR protocols concern the existence of transversal designs yielding codes with better parameters. We would also be very curious to know if divisible codes over large alphabets can exist, given that they lead to PIR protocols with storage overhead less than two.

In the vein of recent works in PIR (see Section 4.5), one could also look for the capacity of PIR protocols with no computation on the server side. Indeed, the PIR rate we currently obtain is very far from the capacity for usual coded PIR, due to the computational constraints on servers. In that sense, it would also be of interest to relax a bit these constraints in order to obtain better PIR rates -for instance we could require constant, or sublinear computational complexity in the size of the database.

Other cryptographic applications? We proved in Chapters 4 and 5 that codes with locality allow the construction of cryptographic protocols with low communication complexity. We have also seen that a crucial point for proving the security of the underlying protocols is the richness of the structure of low-weight parity-check equations for the code. We strongly believe that the codes we presented above can be applied for the construction of other cryptographic protocols that require low communication. Hence, we complete this thesis by encouraging research in this direction.

Titre : Codes à propriétés locales : constructions et applications à des protocoles cryptographiques

Mots clés : codes correcteurs, codes localement corrigibles, stockage distant, protocoles cryptographiques, block designs Résumé : Les codes localement corrigibles ont été introduits dans le but d'extraire une partie de l'information contenue dans un mot de code bruité, en effectuant un nombre limité de requêtes à ses symboles, ce nombre étant appelé la localité du code. Ces dernières années ont vu la construction de trois familles de tels codes, dont la localité est sous-linéaire en la taille du message, et le rendement est arbitrairement grand. Ce régime de paramètres est particulièrement intéressant pour des considérations pratiques.

Dans cette thèse, nous donnons une rapide revue de littérature des codes localement corrigibles, avant d'en proposer un modèle combinatoire générique, à base de block designs. Nous définissons et étudions ensuite un analogue, dans le cas projectif, des relèvements affines de codes introduits par Guo, Kopparty et Sudan. Nous établissons par ailleurs plusieurs liens entre ces deux familles, pour finir par une analyse précise de la structure monomiale de ces codes dans le cas du relèvement plan.

Une deuxième partie de la thèse se focalise sur l'application de ces codes à deux protocoles cryptographiques. D'abord, nous proposons un protocole de récupération confidentielle d'information (private information retrieval, PIR) à partir de codes basés sur des designs transversaux, dont la taille des blocs s'apparente à la localité d'un code localement corrigible. Les protocoles ainsi construits ont l'avantage de n'exiger aucun calcul pour les serveurs, et de présenter une faible redondance de stockage ainsi qu'une complexité de communication modérée. Ensuite, nous donnons une construction générique de preuve de récupérabilité (proof of retrievability, PoR) à base de codes admettant une riche structure d'équations de parité à petit poids. Nous en donnons finalement une analyse de sécurité fine ainsi que plusieurs instanciations fondées sur des codes à propriétés locales.

Title: Codes with locality: constructions and applications to cryptographic protocols

Keywords: error-correcting codes, locally correctable codes, remote storage, cryptographic protocols, block designs Abstract: Locally correctable codes (LCCs) were introduced in order to retrieve pieces of information from a noisy codeword, by using a limited number of queries to its symbols, this number being called the locality. Three main families of LCCs reaching sublinear locality and arbitrarily high rate have been built so far. This specific range of parameters is of particular interest concerning practical applications of LCCs.

After giving a state of the art for LCCs, we study how they can be built using block designs. We then give an analogue over projective spaces of the family of affine lifted codes introduced by Guo, Kopparty and Sudan. We exhibit several links between both families, and we give a precise analysis of the monomial structure of the code in the case of the lifting of order 2.

The second part of the thesis focuses on the application of these codes to two cryptographic protocols. We first build a new private information retrieval (PIR) protocol from codes based on transversal designs, whose block size defines the locality of the code. Our construction features no computation on the server side, low storage overhead and moderate communication complexity. Then, we propose a new generic construction of proof-of-retrievability (PoR) that uses codes equipped with an elaborate structure of lowweight parity-check equations. We give a rigorous analysis of the security of our scheme, and we finally propose practical instantiations based on codes with locality.

Université Paris-Saclay Espace Technologique / Immeuble Discovery Route de l'Orme aux Merisiers RD 128 / 91190 Saint-Aubin, France

Figure 1 -

 1 Figure 1 -Résumé de la construction d'un protocole de PIR à base de codes d'incidences.

Figure 2 -

 2 Figure 2 -Outline of the construction of a distributed PIR protocol using incidence codes.

For

  y ∈ F S q and I ⊆ S, we denote by y |I = (y i : i ∈ I). This corresponds to the restriction to I in the functional representation. The code Short(C, I) := {c |S\I , c ∈ C, c |I = 0} is called the shortening of C on I. The puncturing of C on I (or its restriction on S \ I) is Punct(C, I) := C |S\I = {c |S\I , c ∈ C}. Both shortening and puncturing operations give linear codes over F q , and Short(C, I) ⊆ Punct(C, I).

Definition 1 . 4 (

 14 Hadamard code). Let m ≥ 2 and S = F m 2 \ {0}. The binary Hadamard code of order m is: Had

Figure 1 . 1 -

 11 Figure 1.1 -Fano plane.

Algorithm 1 :

 1 A smooth (2, δ, 2δ)-local correcting algorithm for Had 2 (m).

Input: a point

  u ∈ S := F m q \ {0}, and an oracle access to g ∈ F S 2 such that d(g, f ) ≤ δn for some f ∈ Had(m), where n = |S|. Output: f (u) with high probability. 1 Pick v ← R S \ {u} uniformly at random. 2 Toss a random binary coin b ∈ {0, 1}, following B 2 n+1 . 3 if b = 1 then 4

Algorithm 3 :

 3 A smooth query generator Query(u, I) for Reed-Muller codes.

λFigure 2 . 1 -

 21 Figure 2.1 -High-rate lifted and multiplicity codes correcting a constant fraction δ of errors, with relative locality at most λ. Red dots represent multiplicity codes; blue dot represents lifted codes of order 2.

3 if b = 0 then 4 Query6

 4 {y x } and output y x .5 elseQuery {y b , b ∈ B \ {x}} and output -∑ b∈B\{x} y b .

Contents 3 . 1

 31 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46 3.1.1 Affine and projective evaluation codes . . . . . . . . . . . . . . . . . . . . . . 46 3.1.2 Reduced degree sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 3.1.3 Isomorphisms and embeddings . . . . . . . . . . . . . . . . . . . . . . . . . . 50 3.2 Definition and first properties of projective lifted codes . . . . . . . . . . . . . . . . 52 3.2.1 Affine lifted codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 3.2.2 Projective lifted codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 3.2.3 Monomiality of projective lifted codes . . . . . . . . . . . . . . . . . . . . . . 54 3.2.4 Degree sets of lifted codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 3.3 Local correction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 3.4 Intertwined relations between affine and projective lifted codes . . . . . . . . . . .62 3.4.1 Motivation and similar results . . . . . . . . . . . . . . . . . . . . . . . . . . 62 3.4.2 Shortening and puncturing projective lifted codes . . . . . . . . . . . . . . . 63 3.4.3 Projective lifted codes as generalised design-based codes . . . . . . . . . . . 64 3.5 Other properties towards practicality . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 3.5.1 Automorphisms and (quasi-)cyclicity . . . . . . . . . . . . . . . . . . . . . . 65 3.5.2 Explicit information sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 3.5.3 Estimation of the minimum distance . . . . . . . . . . . . . . . . . . . . . . . 70 3.6 Rate and degree sets of lifted codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 3.6.1 Computation of degree sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 3.6.2 The case m = 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

  called the set of degrees of f and denoted Deg( f ). This terminology is borrowed from[START_REF] Guo | New Affine-Invariant Codes from Lifting[END_REF] for instance. If D ⊆ N m , we denote by Poly(D) the vector space of polynomials generated by monomials X d for d ∈ D:

Lemma 3 .

 3 10. Let m ≥ 1 and v ∈ N. The following properties hold:1. If D ⊆ N m is A-reduced, then the map ev A m is injective over Poly(D). 2. If D ⊆ S m+1 (v) is P-reduced,then the map ev P m is injective over Poly(D). 3. For every D ⊆ N m , the A-reduction D of D is the unique A-reduced subset of N m satisfying ev A m (Poly(D)) = ev A m (Poly(D)) .

4 .

 4 For every D ⊆ S m+1 (v), the P-reduction D of D is the unique P-reduced subset of S m+1 (v) satisfying ev P m (Poly(D)) = ev P m (Poly(D)) .

  A m (X d ) = ev A m (X d ) for every d ∈ N m , we have ev A m (Poly(D)) = ev A m (Poly(D)). Uniqueness comes from the injectivity of ev A m . 4. Same argument. Definition 3.11 (Degree set). Let C = ev A m (Poly(D)) be an affine (resp. let C = ev P m (Poly(D)) be a projective) monomial code. Its degree set is the unique A-reduction (resp. P-reduction) of D, and is denoted Deg(C). By definition, if C is monomial, then we have C = ev(Poly(Deg(C))) where ev ∈ {ev A m , ev P m } depending on the context. Moreover, since the evaluation map is injective over Poly(Deg(C)), it also holds that: dim(C) = | Deg(C)| .

- 3 C ← C ∪ {t} 4 CC ← C ∪ {d} 9 C

 349 A function Iterate([0, k] m ) returns an iterator on elements d ∈ [0, k] m which respects the partial order ≤ p . In other words, if d is returned before d , then it cannot hold that d ≤ p d. -A function AReduce(d) computes the A-reduction |d|. It can be done in time O(m log 2 q). -The set Cover S (d) can be computed in O(em), where q = p e . Since | Cover S (d)| ≤ em, it corresponds to say that testing membership in the set S is O(1), which is realistic using hash tables lookup. Algorithm 11: Procedure JoinUp which computes the union C ∪ Up S (d) Input: integers p, e, m, k such that k ≤ p e -1, a set C ⊆ S = [0, k] m , and a tuple d ∈ C. Output: the set C ∪ Up S (d). 1 T ← Cover S (d) 2 for t ∈ T \ C do ← JoinUp(C, t, p, e, m, k) 5 return C Thanks to (3.12), it is clear that Algorithm 12 computes correctly Deg(Lift(RS q (k), m)), since the algorithm essentially eliminates every tuple d that does not satisfy the needed requirements. Furthermore, Algorithm 12 has complexity O(emk m ) = O(n log(n)), where n is the length of Lift(RS p e (k), m), since every element d ∈ [0, k] m is queried at most O(| Cover S (d)|) = O(em) times. Algorithm 12: Algorithm computing the degree set of Lift(RS p e (k), m) Input: a prime p, and three integers e, m and k such that 0 ≤ k ≤ p e -1 Output: the degree set of Lift(RS p e (k), m) 1 D ← ∅ 2 C ← ∅ /* intended to store elements not in D */ 3 for d ← Iterate([0, k] m ) ← JoinUp(C, d, p, e, m, k) 10 return D Remark 3.57.

Figure 3 .

 3 Figure 3.2 might give an overview of this result. Given the right-hand side degree set A 2 (4, 14), we see it can be decomposed according to four 8 × 8 subsquares S (0,0) 4 , S (0,1) 4 , S (1,0) 4 , and S (1,1) 4 .The lower-bottom one corresponds to the degree set R 2 (3, 14) of a Reed-Muller code, and the three others are equivalent to A 2 (3, 6), the degree set of a smaller lifted code (with the blue frame in Figure3.2). This decomposition is recursive, as proves the red subsquares in the same figure.

Figure 3 . 2 -

 32 Figure 3.2 -Illustration of recursive patterns in degree sets. Here are represented A 2 (e, 2 e -2) = Deg(Lift(RS 2 e (2 e -2), 2)), for e = 2, 3, 4 respectively.

Corollary 3 . 62 .

 362 Let 0 ≤ k ≤ 2 e -1. The dimension |A 2 (e, k)| of Lift(RS 2 e (k), 2) satisfies the recursive relation: |A 2 (e, k)| = |R 2 (e -1, k)| + 3|A 2 (e -1, k -2 e-1 )| , where by convention, A 2 (e -1, k) = ∅ if k < 0.

Figure 3 . 4 -

 34 Figure 3.4 -Illustration of the sequence of degree sets A 2 (e, 2 e -2 e-c -1), for c = 5 and e = 5, . . . , 10.Recall that a black square at coordinate (i, j) means that (i, j) lies is the degree set. For increasing e we observe that the black shape converges to a finite union of triangles.

Remark 3 . 64 ..

 364 We know that Lift(RS 2 e (2 e -2), 2) is equivalent to Code 2 e (AG 1 (2, 2 e )). Taking c = e in the last corollary, we get the well-known result concerning the dimension of affine geometry design-based codes: for every e ≥ 2, we havedim(Lift(RS 2 e (2 e -2), 2)) = 4 e -3 e .As we said previously, it is claimed in [GKS13] that dim(Lift(RS 2 e (2 e -2 e-c -1), 2)) ≥ 4 e 1 -We can notice their lower bound corresponds to the asymptotic dimension of the family of codes Lift(RS 2 e (2 e -2 e-c -1), 2), when e → ∞ and c is fixed.Let us propose an interpretation to this observation. In Figure3.4, we represent the evolution of dim(Lift(RS 2 e (2 e -2 e-c -1), 2)) when e grows. It is reasonable to conjecture that the ratec for δ = 2 -c

  that we derive from (3.14). Formally denote by ρ ∞ (c) := lim e→∞ dim(Lift(RS 2 e (2 e -2 e-c -1), 2)) 4 e

  Figure 3.6 -Degree sets A p (e, k) of Lift(RS p e (k), 2) in odd characteristic p. On the lefthand side, (p = 3, e = 3, k = 24); on the right-hand side, (p = 5, e = 2, k = 22). In black, we plot regions S (i,j) e for i + j ≤ p -3; in red, regions of the form R p (e -1, k -(p -2)p e-1 ); in orange, regions of the form A p (e -1, k -(p -1)p e-1 ) which are defined recursively.

Remark 4 . 4 .

 44 The construction of Chor et al.[START_REF] Chor | Private Information Retrieval[END_REF] can also be seen as an LDC-based PIR protocol. The underlying LDC is the evaluation code of log( )-linear forms over the space F m 2 where m = K 1/ log( ) .

Figure 4 . 2 -

 42 Figure 4.2 -Summary of the steps leading to the construction of a transversal-designbased PIR scheme.

Remark 4 .Figure 4 . 4 -

 444 Figure 4.4 -A representation of the construction of a transversal design from an orthogonal array.

  code IC q (C 0 ) = Code q (T C 0 ) database encoding Distributed PIR protocol

Figure 4 . 5 -

 45 Figure 4.5 -Outline of the construction of a distributed PIR protocol using incidence codes.

  ) and C = IC p (Punct(C 0 , I)). For u ∈ F X p , we define an extension ext(u) ∈ F X p of u, such that ext(u) |X = u and ext(u) |X\X = 0. By definition of the shortening operation, all we need to prove is:C = {c ∈ F X p , ext(c) ∈ C}.If we assume that C 0 is p-divisible, then Lemma 4.33 translates into M M T = J mod p . (4.3) Hence, we obtain M(M -J) T = 0 mod p . (4.4) It leads us to consider the code A of length n generated over F q by the matrix M -J. Equation (4.4) ensures that A ⊆ C. Let us prove that C ⊥ ∩ Par(n) ⊆ A. Assume p and let c ∈ C ⊥ ∩ Par(n). Then c = uM for some u ∈ F |C 0 |

Figure 4 .

 4 6 also shows that Reed-Solomon-based instances cannot expect to reach at the same time constant information rate and resistance to a constant fraction of colluding servers.

  [SRR14], Augot et al. [ALS14] and Blackburn et al. [BEP17] notably.

q

  and given by c a,b = x a y b . Then, if C ⊆ F A q and C ⊆ F B q are two linear codes, their tensor productC ⊗ C ⊆ F A×B q is the F q -linear code generated by words c ⊗ c , for c ∈ C and c ∈ C . If C, C have respective parameters [n, k, d] and [n , k , d ], then C ⊗ C is [nn , kk , dd ].We also denote byC ⊗s := C ⊗ • • • ⊗ C s times ⊆ F A s qthe s-fold tensor product of C with itself.

Lemma 5 .

 5 23. Let C = Par( ) ⊗ F N q as above. Then the response code R(C) has minimum distance 1.

Lemma 5 .

 5 26. Let C = A ⊗s as above. Then, R(C) has minimum distance s • d min (A) s-1 .

1 (

 1 (C) of weight s • d min (A) s-1 . Let w ∈ A \ {0} be a minimumweight codeword of A, and denote by W := supp(w) ⊆ A. Define c = w ⊗s ∈ C; then supp(c) = W s . Let finally r = R(c). We see that r L i,x = 0 if and only if x ∈ W s . Hence we getwt(r) = |{L ∈ Q, r L = 0}| = s i=1 {L i,x , x ∈ W s } = s • d min (A) s-1 .since each line L i,x is counted d min (A) times when x runs over W s . Now denote by N = |Q| = s s-1 the length of R(C). If A is an MDS code, we summarise the parameters of a PoR scheme based on A s in the next proposition. Proposition 5.27. Let s ≥ 0, 0 < δ < 1 and A be an [ , (1δ) + 1, δ] q MDS code. Define C = A ⊗s and (Q, V) as above. If every Φ w is sufficiently uniform, then the PoR scheme associated to C and (Q, V) is (ε, τ)-sound for τ = O δ ) s s and every ε < ε 0 , where ε 0 = (1 + O(q -δ +1 ))δ s . Asymptotics are given when n = s → ∞. Proof. First, the relative distance of R(C) is δ s according to Lemma 5.26. Then, the random variables {X u } u∈D are pairwise uncorrelated because the inequality max u =v∈Q 2 |u ∩ v| = 1 < (1δ) + 2 = min u∈Q d ⊥ (C |u )

Proof.

  One can check that the random variables {X u } u∈D are pairwise uncorrelated since maxu =v∈Q 2 |u ∩ v| = 1 < (1δ) + 2 = min u∈Q d ⊥ (C |u ) .

  Reduced degree sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 3.1.3 Isomorphisms and embeddings . . . . . . . . . . . . . . . . . . . . . . . . 50 3.2 Definition and first properties of projective lifted codes . . . . . . . . . . . . . . . 52 3.2.1 Affine lifted codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 3.2.2 Projective lifted codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 3.2.3 Monomiality of projective lifted codes . . . . . . . . . . . . . . . . . . . . . 54 3.2.4 Degree sets of lifted codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 3.3 Local correction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 3.4 Intertwined relations between affine and projective lifted codes . . . . . . . . . . 62 3.4.1 Motivation and similar results . . . . . . . . . . . . . . . . . . . . . . . . . 62 3.4.2 Shortening and puncturing projective lifted codes . . . . . . . . . . . . . . 63 3.4.3 Projective lifted codes as generalised design-based codes . . . . . . . . . . 64 3.5 Other properties towards practicality . . . . . . . . . . . . . . . . . . . . . . . . . 65 3.5.1 Automorphisms and (quasi-)cyclicity . . . . . . . . . . . . . . . . . . . . . 65 3.5.2 Explicit information sets . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 3.5.3 Estimation of the minimum distance . . . . . . . . . . . . . . . . . . . . . . 70 3.6 Rate and degree sets of lifted codes . . . . . . . . . . . . . . . . . . . . . . . . . . 71 3.6.1 Computation of degree sets . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 3.6.2 The case m = 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73

		CONTENTS
	3.1.2
	Introduction	xv
	I Codes with locality
		propriétés locales
	pour ses codes.
	i

1 Chapter 1 Basics of coding and design theory Contents 1

  .1 Elementary notions in coding theory . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 1.2 Algebraic constructions of codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 1.2.1 Reed-Solomon codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

7 1.2.2 Reed-Muller codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 1.2.3 Hadamard codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.3 Combinatorial constructions through block designs . . . . . . . . . . . . . . . . . . . 9 1.3.1 Designs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 1.3.2 Design-based codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11

c . Parameters and bounds. Linear

  codes admit three significant parameters, being their length n, dimension k and minimum distance d. One usually records these parameters between brackets: [n, k, d], or [n, k] if the minimum distance is unknown. For a given length n, it is meaningful to look for codes with large dimension (i.e. large amount of data stored in a single codeword) and large minimum distance (that potentially induces a large correction capability). However, there must be a trade-off between these two quantities: informally, one can not correct many errors on codewords if they do not contain enough redundancy symbols.

	More precisely, the famous Singleton bound states that
	k + d ≤ n + 1 .
	Codes attaining the Singleton bound are called maximum distance separable (MDS). If C ⊆ F S q is MDS, then any k-subset of S is an information set for C. As well, the dual code of an MDS code is an MDS code.

-1 e ) has the same weight properties as e . Therefore, if Corr is able to recover the correct codeword c ∈ C, then we get b φ * (c) =

Codes with extreme parameters. Codes

  with minimum distance 1 or dual distance 1 are considered as degenerate, since they admit bad correction properties. The zero code {0} and the full code F S q are examples of degenerate codes. Codes of dimension and codimension 1 are more relevant. The [n, 1, n] code generated by a ∈ (F × q ) S , |S| = n, is the a-repetition code Rep(

Definition 1.6 (

  BIBD). Let λ ≥ 1, and 2 ≤ k < v. A (v, k, λ)-balanced incomplete block design (BIBD) is a design (X, B) such that:-|X| = v; -for all B ∈ B, |B| = k; -each pair of points appears in exactly λ blocks.

	Let us give some examples of BIBDs.

Example 1.7. Let

  2 ≤ k ≤ v and X a set of cardinality v. If B is the set of all k-subsets of X,

	then (X, B) defines a (v, k, ( v-2 k-2 ))-BIBD.
	Example 1.8 (Fano plane). The Fano plane is a (7, 3, 1)-BIBD. Recall it is defined as follows. If we denote its points by X = {1, 2, 3, 4, 5, 6, 7}, then its block set is:
	B = {{1, 2, 3}, {1, 4, 5}, {1, 6, 7}, {2, 5, 6}, {2, 4, 7}, {3, 4, 6}, {3, 5, 7}} .

  m, p e ) = rank p PG t (m, p e ) -rank p PG t (m -1, p e ) .If we fix m and t and let e grow, we get families of codes with increasing rate. Let us be more specific with the case t = 1 and m = 2. Hamada's formula gives:

	rank p AG 1 (2, p e ) =	p + 1 2	e	and rank p PG 1 (2, p e ) =	p + 1 2	e	+ 1 .
	Roughly, it means that when p is fixed and e → ∞, the rate of the associated codes is 1 -O(n -log p (e) ) where n = Θ(p 2e ) is the code length. It means that, in the setting (m, t) = (2, 1), codes based on geometric designs reach rates arbitrarily close to 1.
	If we fix m and e, we remark that p → rank p (AG 1 (2, p e )) is a polynomial in p of degree at most me. Hence, it can be computed by interpolation (or by expanding Equation (1.1)). For instance, in the case m = 3, e = 2 we can find:
							(1.2)
	Though Equation (1.1) is quite cumbersome, one can highlight a few important consequences.

Chapter 2 Locally decodable and correctable codes Contents 2

  1)t, as it is proved by Calkin, Key and de Resmini [CKdR99]. Since its length is exponential in m, it means that the family of codes {C m } m has vanishing rate. .1 Motivation and definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1.1 Historical points . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1.2 Definitions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1.3 A first example: the binary Hadamard code . . . . . . . . . . . . . . . . . . 2.2 Some algebraic constructions of LCCs . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.1 Reed-Muller codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.2 Multiplicity codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

	2.2.3 Lifted codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	2.2.4 A short comparison between multiplicity and lifted codes . . . . . . . . . .
	2.3 Other constructions and bounds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	2.3.1 Constructions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	2.3.2 Bounds . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	2.4 LCCs from a design theory perspective . . . . . . . . . . . . . . . . . . . . . . . . . .
	2.4.1 Formulating some LCCs as design-based codes . . . . . . . . . . . . . . . .
	2.4.2 Design-based codes for low-error LCCs . . . . . . . . . . . . . . . . . . . . .
	2.4.3 Generalised design-based codes . . . . . . . . . . . . . . . . . . . . . . . . .
	2.4.4 Further perspectives . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
	Classical correcting algorithms allow us to retrieve a codeword c from a damaged version y
	of c. They usually take as input the entire noisy word y and return, hopefully, the entire

  Notice that Pr(v ∈ S u ) = 2/(n + 1) for every v ∈ S. From Algorithm 1 we see that S u can be either {u} or {v, u + v} for some v = u. IfS u = {u}, then the local correcting algorithm LC (g) (u) outputs f (u) if and only if u / ∈ E. If S u = {v, v + u}, then LC (g) (u) = f (u) ifand only if |E ∩ S u | ∈ {0, 2}, in other words, if and only if E

  that Had 2 (m) has dimension m. Denote by {e 1 , . . . , e m } (resp. {X 1 , . . . , X m }) the canonical basis of the affine space F m 2 (resp. the space of linear forms over F m 2 ). The information set I = {e 1 , . . . , e m } ⊂ S induces a systematic encoder E : F m 2 → F S 2 for Had 2 (m), given by

  , w} ∈ E}. Recall that a d-regular expander graph has expansion parameter λ if for every subset W ⊂ V of size ≤ |V|/2, we have |N(W) \ W| ≥ λ|W|. It is important to remark that Ramanujan graphs (introduced in [LPS88]) define extremal d-regular expander graphs, i.e. they satisfy λd ≤ 2 √ d -1. From now on, we assume G is a

	Ramanujan graph.

Table 2 .

 2

	1 -A summary of constructions of locally decodable or correctable codes presen-
	ted earlier.
	Let us also report other recent constructions of high rate LCCs. First, the work of Ben-
	Sasson et al. [BGK

+ 13]

proposed to use Reed-Muller-like decoding algorithm on evaluation codes defined over other algebraic varieties than the classical affine space, namely Cartesian products H m of Hermitian curves H. The reason of this choice is that the Hermitian function field admits a large automorphism group which can be used to define structured queries that are close to uniform over H m . Several correction techniques are then proposed, including a direct analogue of the Reed-Muller local correction on lines (instead we get codewords

  As a corollary, using the same notation as in Proposition 2.34, the Singleton bound implies that dim(C) ≤ n(1 -d-1-1 ) + d-1 -1 for codes based on 2-designs. We here show how our generalisation of codes based on designs leads to locally correctable codes handling a constant fraction of errors. A generic local correcting algorithm is presented in Algorithm 9. The analysis of the fraction of errors the code can handle is given in Proposition 2.35 for the case of 2-designs, and Proposition 2.36 for the case of 3-designs. A local correcting algorithm with locality for a code C = Code(D, L) ⊆ F X q , where D = (X, B) is a design of block size + 1, and L is τ -correcting for 0 < τ < 1.Input: x ∈ X, and an oracle access to g ∈ F X q , |X| = n, such that d(g, f ) ≤ δn for some f ∈ C. Output: f (x) with high probability. /* Corr B denotes an algorithm correcting at least τ errors and 1 erasure in the code L B .*/ 1 Pick uniformly at random a block B ∈ B such that x ∈ B. 2 Toss a random binary coin b, which is 0 with probability p = /n. Define g ∈ (F q ∪ {⊥}) B by g |A = g |A and g (y) =⊥. Run Corr B on input g .

	Algorithm 9:

we have wt(c |B 0 ) ≥ d, which gives the expected result. Local correction of generalised design-based codes. 3 if b = 0 then 4 Pick y uniformly at random in B \ {x}. 5 else 6 Define y = x. 7 Define A = B \ {y}. 8 9 if Corr B fails then 10 Abort. 11 else 12 Denote by h ∈ F B q the output of Corr B . Output h(x). Proposition 2.35 (Case of 2-designs). Let 0 < τ < 1 and D be a 2-(n, + 1, λ)-design. Assume L is a τ -correcting family of local codes for D. Then, for every δ < τ/2, the code Code(D, L) is a perfectly smooth ( , δ, δ/τ)-LCC.

  The subset T is said to be ≤ p -closed in S if Low S (T) = T. We say that d is a cover of d = d in S, written d p d , if the existence of e ∈ S such that d ≤ p e ≤ p d implies that e ∈ {d, d }. We also say that d is a co-cover of d . The set of covers (resp. co-covers) of d is denoted Cover S (d) ⊆ Up S (d) (resp. Cocover S (d) ⊆ Low S (d)). Informally, covers and co-covers are nearest upper and lower bounds.

Let d, d ∈ S such that d ≤ p d . Using classical poset terminology, we say that d is a lower bound for d , and that d is an upper bound for d. The subset of S that consists in lower (resp. upper) bounds for d is denoted Low D (d) (resp. Up D (d)). Similarly, one can define lower and upper bounds for subsets T ⊆ S: Low S (T) := {d ∈ S | ∀t ∈ T, d ≤ p t} , Up S (T) := {d ∈ S | ∀t ∈ T, t ≤ p d} .

  The last three statements in (3.13) hold. Proof. Let u ∈ A 2 (e -1, k -2 e-1 ) and d ∈ {(2 e-1 , 0), (2 e-1 , 2 e-1 )}. Lemma 3.60 proves that, for every v ∈ ∆(u) + ∆(d), we have ψ e (v) ∈ [0, k]. Hence u + d ∈ A 2 (e, k).

	Let now w ∈ A 2 (e, k), and assume w / ∈ S	(0,0)

e

. Write uniquely w = u + d where u ∈ S (0,0) 2 and b ∈ ∆((2 e-1 , 2 e-1 )) \ {0}. Thanks to symmetry in the problem, without loss of generality we can assume that d ∈ {(2 e-1 , 0), (2 e-1 , 2 e-1 )}. We need to prove that ∆(u)

Table 4 .

 4

	n

1 -Dimension and rate of binary codes arising from T A (m, q)

designs from orthogonal arrays of strength

  t. Here we give a generic construction of t-transversal designs, which is actually the same as the construction of transversal designs with orthogonal arrays (Subsection 4.3.3). Let A be an orthogonal array OA λ (t, , s) define over a symbol set S. Recall that the array A is composed of rows a i = (a i,j ) 1≤j≤ for 1 ≤ i ≤ λs t . We define a design (X, B, G), where -the point set is X = S × [1, ]; -the group set is G = {S × {i}, 1 ≤ i ≤ }; -the blocks are B i = {(a i,j , j), 1 ≤ j ≤ } for all a i ∈ Rows(A). If A is an OA λ (t, , s), then the design defined with A by Construction 4.43 is a t-TD λ ( , s).Proof. It is clear that G is a partition of X and that the sets of blocks and groups both have the size we claim. Now focus on the incidence property. Let T ⊂ [1, ] with |T| = t, and let (x 1 , . . . , x t ) ∈ G T 1 × . . . × G T t . We need to prove that there are exactly λ blocks B ∈ B such that {x 1 , . . . , x t } ⊂ B.

	Construction 4.43. Proposition 4.44.

t-transversal

  5.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 5.1.1 Motivation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 Proofs of retrievability . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 5.2.1 Definition . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 5.2.2 Security models . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 5.3 The PoR construction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 Pairwise uncorrelation of variables {X u } u∈D . . . . . . . . . . . . . . . . . . 130 5.4 Performance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 5.4.1 Efficient scrambling of the encoded file . . . . . . . . . . . . . . . . . . . . . 131 5.4.2 Parameters . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 5.5 Instantiations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 5.5.1 Tensor-product codes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 5.5.2 Reed-Muller and related codes . . . . . . . . . . . . . . . . . . . . . . . . . . 136 5.5.3 Experimental estimate of the bias α . . . . . . . . . . . . . . . . . . . . . . . 139This chapter is devoted to the construction of proofs of retrievability (PoRs) which feature low computation complexity on both client and server sides, as well as small client storage (typically 512 bits). We adapt the security model initiated by Juels and Kaliski[START_REF] Juels | PORs: Proofs of Retrievability for Large Files[END_REF] and we use the framework of Paterson et al.[START_REF] Paterson | A Coding Theory Foundation for the Analysis of General Unconditionally Secure Proof-of-Retrievability Schemes for Cloud Storage[END_REF] to analyse our construction. We thus provide

5.1.2 Previous works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 5.1.3 Our approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 5.1.4 Organisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 116 5.2 5.3.1 Verification structures for codes . . . . . . . . . . . . . . . . . . . . . . . . . 119 5.3.2 A PoR scheme based on codes with locality . . . . . . . . . . . . . . . . . . 121 5.3.3 Analysis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 5.3.4 Estimation of the bias . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 5.3.5 a rigorous treatment of the security of the generic design we propose; more precisely, we sharply bound the extraction failure of our protocol according to this security model. Next, we instantiate our formal construction with tensor-product codes, Reed-Muller codes and affine lifted codes. This yields PoRs with moderate communication complexity and server storage overhead, in addition to the aforementioned features.

  Notice that proofs of data possession (PDPs) represent protocols close to what is needed in PoRs. However, in PDPs one does not require the client to be able to extract the file from the server. Instances of PDPs are given by Ateniese et al. [ABC + 11]. The earlier protocols of Lillibridge et al. [LEB + 03] and Naor and Rothblum[START_REF] Naor | The Complexity of Online Memory Checking[END_REF] are very often seen as precursors for PoRs. For instance, Naor and Rothblum consider a setting in which the client directly accesses the file stored by the server. However, the actual definition of PoRs is more restrictive, since according to Shacham and Waters[START_REF] Shacham | Compact Proofs of Retrievability[END_REF], PoRs allow the prover to be 'an arbitrary program' answering challenges 'in an arbitrary manner (...) as opposed to a simple memory layout' for the earlier schemes.

  [START_REF] Paterson | A Coding Theory Foundation for the Analysis of General Unconditionally Secure Proof-of-Retrievability Schemes for Cloud Storage[END_REF], Paterson, Stinson and Upadhyay provide a general framework for PoRs in the unconditional security model. They show how the question of the retrievability of the file can be expressed as an error-correction problem in a so-called response code. This allows them to precisely quantify the extraction success as a function of the success probability of a proving algorithm: indeed, in this setting, extraction can be naturally seen as nearest-neighbour decoding in the response code. They notably apply their framework to examine the security of a modified version of Shacham-Waters scheme. Also notice that, prior to[START_REF] Paterson | A Coding Theory Foundation for the Analysis of General Unconditionally Secure Proof-of-Retrievability Schemes for Cloud Storage[END_REF], Dodis, Vahan and Wichs[START_REF] Dodis | Proofs of Retrievability via Hardness Amplification[END_REF] proposed another coding-theoretic model for PoRs that allowed them to build efficient bounded-use and unbounded-use PoR schemes.

With practicality in mind, other features have been deployed for PoRs. For instance, Wang et al. [WWR + 11] presented a PoR construction based on Merkle hash trees, which allows efficient file updates on the server. Their scheme is provably secure under cryptographic assumptions (hardness of Diffie-Hellman in groups with bilinear maps, unforgeable signatures, etc.), and has been improved by Mo, Zhou and Chen

[START_REF] Mo | A Dynamic Proof of Retrievability (PoR) Scheme with O(log n) Complexity[END_REF]

in order to prevent unbalanced trees. More recently, other features have been proposed for PoRs, such as multi-prover PoRs (see for instance the unpublished work

[PSU18]

of Paterson, Stinson and Upadhyay), or PoRs with public verifiability (e.g. Sengupta and Ruj's construction

[START_REF] Sengupta | Efficient Proofs of Retrievability with Public Verifiability for Dynamic Cloud Storage[END_REF]

).

  Definition 5.2 (security model, strong version). Let ε, τ ∈ [0, 1]. A proof of retrievability (KeyGen, Init, Verify, Extract) is strongly (ε, τ)-sound if, for every file m ∈ M and every prover P :

  Definition 5.2 provides a strong security model, in the sense that (i) it does not require any bound on the response algorithms given by the Prover (ii) the probability in (5.1) is taken over fixed messages m (informally, it means the Prover knows m). However, keyed proofs of retrievability are usually insecure according to Definition 5.2. For instance, in[START_REF] Paterson | A Coding Theory Foundation for the Analysis of General Unconditionally Secure Proof-of-Retrievability Schemes for Cloud Storage[END_REF] Paterson et al. noticed that, given the knowledge of m and w, in the Shacham-Waters scheme[START_REF] Shacham | Compact Proofs of Retrievability[END_REF] an unbounded Prover may be able to 1. compute (or at least guess) a key κ such that Init(m, κ) = w, 2. build m = m such that Init(m , κ) = w , and 3. define a malicious response word r ← P (w ) which (i) successfully passes every audit and (ii) leads to the extraction of m = m. Definition 5.3 (security model, weak version). Let ε, τ ∈ [0, 1]. A proof of retrievability (KeyGen, Init, Verify, Extract) is weakly (ε, τ)-sound (or simply (ε, τ)-sound) if, for every prover P : W → R Q , we have:

	Pr

Hence, we choose to use a weaker but still realistic security model, where informally, the Prover only knows what he stores (that is, w) and has no information on the initial message m. Therefore, this security model is also conform with the one given by Paterson et al.

Table 5 .

 5 3 -Estimators ξ M

	1/(q -1)
	4 8 16 32 64 128 0.00791 0.007874 0.333 0.3333 0.143 0.1429 0.0665 0.06667 0.032 0.03226 0.0161 0.01587	q ξ M (p Φ ) 1/(q -1) 7 0.166 0.1667 17 0.0627 0.0625 31 0.0335 0.03333 257 0.00398 0.004000
	256 0.00382 0.003922

  Figure 5.4 -Estimators ξ M (p Φ ) for various values of M ∈ [10 3 , 10 6 ], of q ∈ {8, 64}, and of Test i, i ∈ {1, 2, 3}. Support size t = 2 is fixed. For Tests 1 and 2, the parameter N is set to 10. Black horizontal lines represent the expected value of α.

	q=8, Test 1 q=8, Test 3 q=8, Test 2 q=64, Test 1 q=64, Test 3 q=64, Test 2

  Figure 5.5 -Estimators for various values of M ∈ [10 3 , 10 6 ], of q ∈ {8, 64}, and of Test i, i ∈ {1, 2, 3}. Support size t = 3 is fixed. For Tests 1 and 2, the parameter N is set to 10. Black horizontal lines represent the expected value of α.Figure5.6 -Estimators for various values of M ∈ [10 3 , 10 6 ], of q ∈ {8, 64}, and of Test i, i ∈ {1, 2, 3}. Support size t = is fixed. For Tests 1 and 2, the parameter N is set to 10. Black horizontal lines represent the expected value of α.

			q=8, Test 1 q=8, Test 3 q=8, Test 2 q=64, Test 1 q=64, Test 3 q=64, Test 2
	ξ M (p Φ )
	10 -1
			t = expected 1/(q-1), q=8 expected 1/(q-1), q=64 q=8, Test 2 q=8, Test 3 q=8, Test 1 q=64, Test 2 q=64, Test 3 q=64, Test 1
	10 -2	10 3	10 4	10 5	M

an oracle query is a map y → y i for some index i, see Subsection

2.1.2

technically one needs q ≥ max{10m, d+6 s+1 , 5(s + 2)}

the abusive notation C(F) is used to suggest that the specific encoding map of F in C is meaningless

this can be formally done with estimation theory, as we can see for instance in[START_REF] Paterson | A Coding Theory Foundation for the Analysis of General Unconditionally Secure Proof-of-Retrievability Schemes for Cloud Storage[END_REF]

in the scheme we propose, we will always have log(q) < 256

Remerciements

Code p (AG 1 (m, q)) ⊆ Code p (T A (m, q)) .

Let us prove that equality holds. Proposition 4.13. For every q = p e and m ≥ 2, we have

Proof. Denote by B (AG) the blocks of AG 1 (m, q), and by B (T ) and G (T ) the blocks and groups of T A (m, q). Thanks to the previous discussion, we only need to show that for every block

Other properties towards practicality

We here present miscellaneous results emphasizing the practicality of projective lifted codes. In Subsection 3.5.1, we prove that the storage cost of projective lifted codes can be reduced since they admit (quasi-)cyclic automorphisms. Explicit information sets are then computed in Subsection 3.5.2. We conclude this section by estimating their minimum distance (Subsection 3.5.3).

Automorphisms and (quasi-)cyclicity

In coding theory, automorphism groups of codes, and a fortiori their permutation groups, are interesting for many reasons. For instance, they can be used for reducing the practical storage cost of the codes. Cyclic codes are known to be specifically efficient in that sense.

In this section, we address the question of (quasi-)cyclicity for projective lifted codes. We prove in Proposition 3.44 that under arithmetic conditions, the code Lift(PRS q (k), m) is quasicyclic up to a diagonal isomorphism. This result relies deeply on the fact that Lift(PRS q (k), m) is invariant under the action of Proj v (P m ), that has been proved in Lemma 3.19. But let us first define cyclicity and quasi-cyclicity. Definition 3.40 (Cyclicity, quasi-cyclicity). A code C ⊆ F X q , |X| = n, is cyclic if Perm(C) contains a cyclic permutation of order n (that is, an n-cycle). It is said to be quasi-cyclic of index d if Perm(C) contains a permutation which is the product of d different (n/d)-cycles with disjoint orbits. In particular, a cyclic code is a quasi-cyclic code of index 1. In all what follows, we fix an integer m ≥ 1, and we denote by n = θ m,q and by d = gcd(n, q -1). Let also φ : F q m+1 → F m+1 q be an isomorphism of F q -vector spaces, and ω be a primitive element of F q m+1 . We define β := ω q-1 . It is clear that β has order n in the multiplicative group F × q m+1 since (q -1)n = q m+1 -1. For every 0 ≤ i < d, we now define:

and the union U = ∪ d-1 j=0 U j .

Definition 3.41 (representation of P m ). Recall that n = |P m |. We say that an n-subset V = {v 1 , . . . , v n } ⊂ F m+1 q represents P m if the projective points that V defines fill P m entirely.

Lemma 3.42. If n/d and q -1 are coprime, then U represents P m .

Proof. We only need to prove that the elements φ(ω i β dj ) ∈ F m+1 q define distinct projective points for 0 ≤ i < d and 1 ≤ j ≤ n/d. Since φ is bijective, it reduces to prove that, for 0 ≤ i 1 , i 2 < d and 1 ≤ j 1 , j 2 ≤ n/d, if ω i 1 -i 2 β d(j 1 -j 2 ) ∈ F q , then (i 1 , j 1 ) = (i 2 , j 2 ).

Assume (ω i 1 -i 2 β d(j 1 -j 2 ) ) q-1 = 1. Then ord(ω) = (q -1)n divides (q -1) × ((i 1 -i 2 ) + d(q -1)(j 1 -j 2 )), that is, n | (i 1 -i 2 ) + d(q -1)(j 1 -j 2 ).

Since d | n, we get d | (i 1 -i 2 ) which implies i 1 = i 2 because 0 ≤ i 1 , i 2 < d. Hence n | d(q -1)(j 1 -j 2 ), and our assumption gcd(n/d, q -1) = 1 ensures that (n/d) | j 1 -j 2 . Since 1 ≤ j 1 , j 2 < n/d, we finally obtain j 1 = j 2 . A private information retrieval (PIR) protocol aims reassuring a user that he can retrieve some entry M i of a remote database M without revealing the index i to the server(s) holding the database. In this chapter, we propose a specific encoding of the database which yields PIR protocols with reasonable communication complexity, low storage overhead and optimal computational complexity for the servers. This encoding is based on incidence matrices of transversal designs, from which a natural and efficient recovering algorithm is derived (Section 4.2). We also present practical instances of the construction in Section 4.3, making use of finite geometries and orthogonal arrays. Furthermore, we give a generalisation of the construction in order to resist collusions of servers (Section 4.4). Finally, we review very recent constructions and bounds on PIR protocols to conclude the chapter.

Part II

Cryptographic applications

Let c ∈ C , and consider u = ext(c). For every B ∈ B, we have ∑ b∈B u b = ∑ b ∈B∩X c b = 0, since 1 B∩X is a parity-check matrix for C . Hence ext(c) ∈ C. The converse inclusion is similar.

Despite this result, incidence codes of Reed-Solomon codes RS q (1, S) remain hard to classify for |S| = < q. Indeed, for a given length < q, it appears that distinct subsets S may produce non-equivalent incidence codes IC(RS q (1, S)). Even their dimension can differ, as shows for instance an exhaustive search on IC 2 (RS 16 (1, S)) with pairwise distinct |S| = = 5: we observe that 48 of these codes have dimension 24 while the 4320 others have dimension 22. Further interesting research would then be to understand the subsets S which give the largest codes.

High-rate incidence codes from divisible codes

In this subsection, we prove that linear codes C 0 satisfying a divisibility condition yield incidence codes whose rate is roughly greater than 1/2. Let us first define divisible codes.

Definition 4.32 (code divisibility). Let p ≥ 2. A linear code is p-divisible if p divides the Hamming weight of any of its codewords.

When studying the incidence matrix which defines an incidence code, we exhibit the following property.

Lemma 4.33. Let C 0 ⊂ S I be an unrestricted code, |I| = , and let T be the transversal design associated to C 0 . We denote by M the incidence matrix of T , where rows of M are indexed by codewords from C 0 . Then we have:

Proof. For clarity we adopt the notation M[c, (α, i)] for the entry of M indexed by the codeword c ∈ C 0 (for the row), and (α, i) ∈ S × I (for the column). Given an assertion U , we also denote by 1 U the integer r ∈ {0, 1} such that r = 1 if and only if U is true. Now, let c, c ∈ C 0 .

Hence, if some prime p divides as well as the weight of all the codewords in C 0 , then the product M M T vanishes over any extension of F p , and M is a parity-check matrix of a code which contains its dual. A more general setting is analysed in the following proposition.

Proposition 4.34. Let C 0 be a linear code of length over S, |S| = s. Let also C = IC q (C 0 ) with char(F q ) = p. Denote the length of C by n = s, and recall that Par(n) is the parity-check code of length n over F q . If C 0 is p-divisible, then

In particular, we get dim(C) ≥ n-1 2 . Moreover, if p | , then C ⊥ ⊆ C and dim(C) ≥ n 2 .

Proof. Let M be the incidence matrix of the transversal design T C 0 . Also denote by J and J the all-one matrices of respective size |C 0 | × n and |C 0 | × |C 0 |. An easy computation shows that M J T = J .

2. for all u ∈ Q, the linear map F n q → F s q given by a → V(u, R(u, a)) is surjective and vanishes on the code C. Explicitly,

The map V is then called a verification map, and the set Q a query set for C. By convention, for w ∈ F n q and r ∈ R Q , we denote by

Finally, the code R(C) := {R(c), c ∈ C} is called the response code of C, similarly to [START_REF] Paterson | A Coding Theory Foundation for the Analysis of General Unconditionally Secure Proof-of-Retrievability Schemes for Cloud Storage[END_REF].

We recall that for convenience, if u is an ordered -subset of [1, n], the set R represents either F q or F u q which can be easily identified.

Remark 5.5. In Definition 5.4, the first constraint on (Q, V) ensures that each symbol of the file will be part of at least one query, and thus can be checked during the verification phase.

The second constraint formalises the needs to distinguish non-corrupted files from corrupted ones. On the one side, a non-corrupted file c satisfies V(u, R(u, c)) = 0; on the other side, from the surjectivity of a → V(u, R(u, a)), we hope that files a with several missing or noisy symbols can be discerned. Finally, we allow flexibility in the soundness of the verification map V, which is represented by the dimension s ≥ 1 of the codomain of V. Very informally, the larger the s, the lower the probability that a malicious server produces a response which vanishes on the verification map V.

Construction 5.6. Let C be a code, and H be a set of parity-check equations for C of Hamming weight whose supports are pairwise distinct. Define the query set Q = {supp(h), h ∈ H}, and for any u ∈ Q, denote by h (u) the unique parity-check equation in H whose support is u. Finally, we define a map V by: V

By construction, it is clear that (Q, V) is a verification structure for C. Construction 5.7 (using generalised design-based codes). Let D = (X, B) be a design whose blocks B ∈ B have constant size . Let also L = (L B ⊆ F B q : B ∈ B) be a family of local codes, each of dimensions. For every B ∈ B, we denote by H B : R F B q → F s q a linear map such that ker(H B ) = L B . Finally, let C = Code q (D, L) ⊆ F X q the generalised design-based code associated to D and L (see Subsection 2.4.3 for the definition of generalised design-based codes).

We can define a query set Q := B, and a verification map:

Once again we see that (Q, V) is a verification structure for C. Indeed by definition, if c ∈ C, then c |B ∈ L B for every B ∈ B.

Example 5.8. Let C = Had(3) ⊆ F 7 2 be the binary Hadamard code of length n = 7 and dimension k = 3. We know that C is the code based on the Fano plane, i.e. the (7, 3, 1)block-design PG 1 (2, 2) = (X, B). Hence one can use Construction 5.7 to obtain a verification structure. As in Example 1.8, we write the point set X = [START_REF]2 Outline of the construction of a distributed PIR protocol using incidence codes[END_REF]7] and the block set is therefore:

• Key generation: No key generation.

• Initialisation: The Verifier first encodes his file m ∈ F k q into a codeword w ∈ C. The word w is sent to the Prover.

• Verification: Assume the Prover produced a response word r ← P (w) .

1. The Verifier picks uniformly at random u ← R Q, where u = {u 1 , . . . , u }. Then, the Verifier sends u to the Prover, who is asked to send back R(u, w) = w |u ∈ R. 2. The Prover sends back to the Verifier the u-th coordinate r u ∈ R of r. 3. On input r u ∈ R, the Verifier checks whether V(u, r u ) = 0.

• Extraction: The Verifier first collects r = (P (w) (u) : u ∈ Q) ∈ R Q . He then defines a word r ∈ (R ∪ {⊥}) Q as follows:

Then he calls a bounded-distance error-and-erasure decoding algorithm for R(C) with input r ∈ (R ∪ {⊥}) Q . It outputs either a word m ∈ F k q , or the failure symbol ⊥. Let (Q, V) be a verification structure for C ⊆ F n q , and let σ = (σ 1 , . . . , σ n ) ∈ S(F q ) n be an n-tuple of permutations which acts on F n q by σ(x)

where σ -1 |u (y) = (σ -1 u 1 (y 1 ), . . . , σ -1 u (y )). The map V σ is designed in order to satisfy

for every (c, u) ∈ C × Q. Based on these definitions, we propose a PoR construction based on codes, given in Figure 5.3. This construction is generic in the sense that any code C equipped with a verification structure (Q, V) could be used. Notice that, in the light of Constructions 5.6 and 5.7, any code admits a verification structure, although it might be too poor to lead to PoRs with good parameters. More details concerning the required properties for these structures will be given in the next section.

Algorithm 13:

The extraction procedure Extract(r, σ).

2 On challenges u ∈ Q such that V(u, r u ) = 0, assign r u ←⊥, where ⊥ here denotes the erasure symbol.

3 Run a bounded-distance error-and-erasure decoding algorithm for R(C) with input r ∈ (R ∪ {⊥}) Q . It outputs either a word m ∈ F k q , or the failure symbol ⊥. 4 Return this output.

123

The code C and the verification structure (Q, V) for C are public parameters. We assume that C is linear, and we denote by N = |Q|. Finally, let R = F q and W = F n q .

• Key generation: The Verifier generates uniformly at random an n-tuple of permutations

• Initialisation: The Verifier first encodes his file m ∈ F k q into a codeword c ∈ C with a encoding algorithm for C. Then, the Verifier scrambles each coordinate c i using the permutation σ i :

Finally, w ∈ W is sent to the Prover, and m is erased by the Verifier. To sum up, the deterministic algorithm Init is defined by

Based on his knowledge of w and public parameters, the Prover produces a word r ← P (w) , where r ∈ R Q , corresponding to the vector of outputs of the deterministic proving algorithm P on input w.

• Verification:

1. The Verifier picks uniformly at random u ← R Q, where u = {u 1 , . . . , u }. Then, the Verifier sends u to the Prover, meaning the Prover is asked to send back R(u, w) = w |u ∈ F q to the Verifier. 2. The Prover sends back the u-th restriction r u ∈ R of his response word r to the Verifier. 3. On input r u ∈ R, the Verifier runs V σ (u, r u ) and outputs the result. Here we mean that:

False otherwise.

• Extraction: The Verifier first collects r = (P (w) (u) : u ∈ Q) ∈ R Q . Then, he runs the extraction procedure given in Algorithm 13 on inputs σ and r, and outputs his result. Preliminary results. We first give results concerning verification structures and response codes. The following two lemmata are straightforward to prove.

Lemma 5.9. Let (Q, V) be a verification structure for a code C ⊆ F n q . Then (Q, V σ ) is a verification structure for σ(C). Lemma 5.10. Let (Q, V) be a verification structure for a code C ⊆ F n q . Then its response code R(C) is an F q -linear code over the alphabet R F q .

Remark 5.11. By considering σ(C), we lose F q -linearity, but one can check that verification structures still make sense and provide the result claimed in Lemma 5.9.

CHAPTER 5. PORS FROM CODES WITH LOCALITY

The next result states that the action C → σ(C) does not modify the distance between codewords.

Lemma 5.12. Let also σ ∈ S(F q ) n , and R be the collection of restriction maps associated to a query set Q. Then the following two maps

are isometries of the respective metric spaces (F n q , d) and (R(F n q ), d), where d is the Hamming distance.

Proof. Since every σ i is one-to-one, for every c, c ∈ C we get

The proof for response codes relies on the same argument.

Hence, if C is linear, then the minimum distance of R(σ(C)) is the minimum weight of R(C), since R(C) is linear thanks to Lemma 5.10. Definition 5.13. Let ε ∈ [0, 1] and (Q, V) be a verification structure for a code C ⊆ F n q . Denote by

Finally, if r u = R(u, c) we say that r u is authentic.

Let A ⊆ F n q be any code of minimum distance d, and let a ∈ A be corrupted with b errors and e erasures, resulting in a word r ∈ (F q ∪ {⊥}) n . Then, it is well-known that, as long as 2b + e < d, it is possible to retrieve a from r thanks to a bounded-distance error-and-erasure decoding algorithm (be it efficient or not). This is precisely the decoding algorithm that we employ in Algorithm 13 on the code A = R(C).

Our framework allows us to reformulate the extraction success in terms of a probability to decode corrupted codewords. More precisely: Proposition 5.14. Let (Q, V) be a verification structure for a code C ⊆ F n q , and denote by N = |Q|. Let σ ∈ S(F q ) n , m ∈ F k q and denote by d the minimum distance of R(C). Let also r ∈ R Q and w = σ(C(m)). Finally, assume that r is ε-close to (Q, V σ ) and is also a β-liar for (Q, V σ , w), with (ε + 2β)N < d. Then, Extract(r, σ) = m, where Extract(r, σ) is defined in Algorithm 13.

Proof. Recall that r ∈ (R ∪ {⊥}) Q represents the word we get from r after step 2 of Algorithm 13. Let us now translate our assumptions on r in coding-theoretic terminology:

Finally, using Chebyshev's inequality we get

3. Case 0 ≤ 2D(r, w) -δN < εN. The argument is similar to the second case. Here, E(r, σ) ≤ 2D(r, w) -δN leads us to

Therefore, similarly to the previous case, we obtain the result we claim.

Now it remains to bound D Φ w (E(r, σ)).

For any u ∈ D(r, w), denote by X u the {0, 1}random variable

For instance, two independent random variables are uncorrelated.

Lemma 5.17. Let r ∈ R Q and w ∈ F n q . If the random variables {X u } u∈D(r,w) are pairwise uncorrelated, then:

Proof. By assumption, the random variables {X u } u∈D(r,w) are pairwise uncorrelated, hence the variables {1 -X u } u∈D(r,w) are too. Therefore we get:

The bound D Φ w (X u ) ≤ 1 then gives the result.

As a corollary of Proposition 5.16 and Lemma 5.17, under the same hypothesis and assuming

since D(r, w) ≤ N. Moreover, if lim N→∞ δ > 0 and lim N→∞ α = 0, then p(r, w; ε, δ) = O(1/N).

Therefore, we end up with the following theorem.

Theorem 5.18. Let (Q, V) be a verification structure for C with bias α. Denote by N = |Q| and δ = d min (R(C))/N the relative distance of the response code of C. Finally, assume that, for any r ∈ R Q and any w ∈ F n q the variables {X u } u∈D(r,w) are pairwise uncorrelated. Then, for any ε < δ 1-α 1+α , the PoR scheme associated to C and (Q, V) is (ε, τ)-sound, where

According to Theorem 5.18, we need to look for (sequences of) codes C and associated verification structures (Q, V) such that:

1. the response code R(C) admits a good relative distance δ = d min (R(C))/N, 2. the bias α is small, 3. random variables {X u } u∈D(r,w) are pairwise uncorrelated.

Subsections 5.3.4 and 5.3.5 characterise conditions under which the last two points are fulfilled. Then, in Section 5.5 we study some response codes in the perspective of achieving good relative distance.

Estimation of the bias

In this subsection we prove that, assuming Φ w approximates the uniform distribution over S(F q ) n in a sense we will make precise later, the bias α can be bounded according to the parameters of the verification structure.

Let us fix r ∈ R Q , w ∈ F n q and u ∈ Q. We recall that α is defined by:

where the randomness comes from

Recall that for convenience we see r u ∈ R F u q as a vector indexed by the subset u ⊂ [1, n]. Hence we can easily denote by r u [i] ∈ F q the coordinate of r u indexed by i ∈ u. We define the code K u := ker(V(u, •)) ⊆ F u q , and by definition of V we have C |u ⊆ K u . Moreover, for every σ ∈ S(F q ) n , we have V σ (u, r u ) = 0 if and only if σ -1 u (r u ) ∈ K u . Finally, we denote by

We say that Φ w is sufficiently uniform if, for every u ∈ Q, we have:

when the file size n log(q) → ∞.

In other words, Φ w is sufficiently uniform if, when we measure the probability that Y u (σ) happens, the random distribution induced by Φ w is a good approximation of the uniform distribution over n-tuples of permutations.

Lemma 5.19. Let r, w, u and Z u be defined as above. Let also

Proof. For every σ ∈ Φ w , we know that σ -1 u (R(w) u ) ∈ K u , and we recall that V σ (u, r u ) = 0 if and only if σ -1 u (r u ) ∈ K u . Since K u is linear, and up to considering σ -1 u (R(u, w)r u ) instead, let us assume without loss of generality that σ -1 u (R(w) u ) = 0. Hence, by definition of Z u , it holds that σ -1 u (r u )[i] = 0 for every i ∈ u \ Z u .

When σ is drawn uniformly in S(F q ) n , then we have

since A u counts the number of codewords in K u having Z u as support. Therefore we get

Lemma 5.20. Let S u be the F q -vector space Span F q {x ∈ K u , supp(x) = Z u } and assume that S u = {0}. We then have:

Proof. Let us prove that, if A u > q e for some integer e ≥ 0, then d min (S u ) ≤ |Z u | -e, which induces the result. If A u > q e , then dim(S u ) > e since |S u | ≥ A u . The Singleton bound then provides:

Finally, we get the following upper bound on α.

Proposition 5.21. Denote by ∆ = min{d min (K u ), u ∈ Q}. If every Φ w is sufficiently uniform (for w ∈ F n q ), then

where γ = o(1) when n log(q) → ∞.

Proof. The vector space S u := Span F q {x ∈ K u , supp(x) = Z u }, defined in the previous lemma, is a subcode of Short(K u , u \ Z u ). Hence d min (K u ) ≤ d min (S u ). Due to our assumption on Φ w , we can apply Lemmata 5.19 and 5.20 to obtain the desired bound:

where γ = max u γ u = o(1) when n log(q) → ∞.

Pairwise uncorrelation of variables {X u } u∈D

This section is devoted to proving that variables {X u } u∈D(r,w) are pairwise uncorrelated if the supports of challenges u ∈ D(r, w) have small pairwise intersection. Let us recall that for fixed r ∈ R Q , w and u ∈ D(r, w), the random variable X u represents 1 V σ (u,r u )=0 , when σ is uniformly picked in Φ w .

Proposition 5.22. If max{|u ∩ v|, u = v ∈ Q} < min{d ⊥ (C |u ), u ∈ Q}, then the random variables {X u } u∈Q are pairwise uncorrelated.

Proof. Recall that we denote by K u := ker V(u, •), and that by definition of a verification structure, we have

Denote by t = |u ∩ v| and let (a, b) ∈ (F t q ) 2 . We denote by Y(σ, a, b) the event

We first notice that {σ -1 |u∩v , σ ∈ Φ w } = S(F q ) t . We can here use an argument similar to the proof of Lemma 4.21: the constraint σ

and it follows that:

Hence, for fixed a and b, the variables ,a,b) are independent (once again we can adapt Lemma 4.21). Therefore:

Then,

and we conclude since E(X u ) = q -t ∑ a∈F t q Pr(σ

Lift(RS q (q -2), 2) admits the same verification structure as the one presented previously for RM q (2, q -2).

Lemma 5.31. The response code of Lift(RS q (q -2), 2) has minimum distance at least q 2 -q + 2.

Proof. The rationale is similar to the proof of Lemma 5.29. Let 0 = c ∈ C, where c = ( f (x)) x∈F 2 q , f ∈ F q [X, Y]. recall that we can assume deg( f ) ≤ 2q -2. Denote by L 1 , . . . , L a ⊂ F 2 q the lines on which f vanishes. The restriction of f along L i can be interpolated as a univariate polynomial f |L i (T) of degree at most q -2, since ( f (Q)) Q∈L i lies in the Reed-Solomon code RS q (q -2), by definition of lifted codes. Therefore f |L i (T) = 0, and f vanishes on L i . Using arguments in the proof of Lemma 5.29, we get a ≤ deg( f ) ≤ 2q -2, and d min (R) ≥ q 2 + q -2q + 2 = q 2 -q + 2, where R is the response code of Lift(RS q (q -2), 2)).

We believe the bound given in Lemma 5.31 is not tight, but it is sufficient to have a response code R of relative minimum distance d min (R)/N → 1 when N → ∞. Similarly to Proposition 5.32, we can then prove that practical PoRs can be constructed with the family of lifted codes Lift(RS q (q -2), 2). Proposition 5.32. Let C = Lift(RS q (q -2), 2), and (Q, V) its associated verification structure. If every Φ w is sufficiently uniform, then the PoR scheme associated to C and (Q, V) is (ε, τ)-sound for every ε < 1 and τ = O

The crucial improvement is that lifted codes potentially have much higher dimension than Reed-Muller codes. For instance, if q = 2 e , we have seen in Chapter 3 that the dimension of Lift(RS q (q -2), 2) is 4 e -3 e , which is much larger that 2 e-1 (2 e -1). 1.018

Note that the family of lifted codes has been used in the PoR proposal [START_REF] Lavauzelle | New Proofs of Retrievability using Locally Decodable Codes[END_REF].

Remark 5.34. Once again, we emphasize that the lifted codes we consider are actually designbased codes. Here, the underlying design is the classical affine geometric design AG 1 (2, q). It is a 2-(q 2 , q, 1) design.

On more generic families of codes. We have presented several families of codes producing practical instances of PoR. We also revealed their link with (generalised) design-based codes, and noticed that the PoR instances based on 2-designs give better parameters than the one relying on 1-designs. Let us quickly mention other families of designs and codes that could be interesting to consider.

First, lifted codes over evaluation support A m or P m , where m > 2, (or equivalently, codes based on AG 1 (m, q) or PG 1 (m, q)) would decrease the communication complexity of the PoR schemes we propose. Indeed, lines are smaller compared to the size of the ambient space. We must however pay attention to the storage rate which could vanish if m gets large. Indeed, we have seen previously that lifted codes and codes based on geometric designs of fixed field size q have vanishing rate when m → ∞.

In order to decrease the bound on the failure probability of the PoR schemes we propose, one could also consider lifted codes Lift(RS q (d), 2) with a lower degree d < q -2. A good point is that the communication complexity remains unchanged; however if d is too small, we could once again observe an overwhelming storage overhead.

Experimental estimate of the bias α

In this last section, we confirm our heuristic on the fact that Φ w is sufficiently uniform, by providing experimental estimates of α for finite length codes.

Setup. We consider PoR schemes using Reed-Muller codes C = RM q (2, q -2), as presented in Section 5.5.2. We also fix the word w ∈ F n q uploaded on the server during the initialisation step, and without loss of generality we assume that w = 0. Proposition 5.21 claims that in this context, α should be O(1/q) since ∆ = 2 and ≤ q. For convenience, we denote by p Φ := P Φ w (V σ (u, r u ) = 0), and we recall that α is an upper bound on p Φ (for varying u and r).

We proceed to three kinds of tests in order to estimate α:

• Test 1. We sample N challenges u, and for each sample, we fix t ∈ [2, ] and r u in {x ∈ F q , |Z u | = t}. Then, we estimate p Φ by running M trials and computing the average number of times V σ (u, r u ) = 0 occurs. We denote by ξ M (p Φ ) this estimator. We then collect the maximum value of ξ M (p Φ ) among the N samples of u. • Test 2. A challenge u is fixed, and for several values of t, we pick N responses r u randomly in {x ∈ F q , |Z u | = t}. For every r u , we estimate p Φ with M samples. We collect the maximum value of ξ M (p Φ ) among the N values of r u that have been picked. • Test 3. A challenge u is fixed, and for several values of t ∈ [2, ], we also set a response r u to this challenge which satisfies |Z u | = t. We then run M trials and collect ξ M (p Φ ).

Influence of M and the chosen test on the estimator. At the end of the document, Figures 5.4, 5.5 and 5.6 confirm that, for fixed N and q, and for any Test i we use, i ∈ {1, 2, 3}, our estimator ξ M (p Φ ) converges to a value close to 1/(q -1).

Influence of N on the estimator. Table 5.2 shows experimentally that, for M large enough and fixed q, the number N has few influence on the estimator (N being respectively the number of responses r u sampled in Test 2, and the number of challenges u sampled in Test 1).

The minor increase we can observe on ξ M (p Φ ) can be thought as a standard deviation due to the fact that the number of samples M = 100, 000 is finite.

Influence of q on the estimator. In Table 5.3, we show that estimator ξ M (p Φ ) converges to an expected value 1/(q -1), for any value of q.

List of Algorithms

A smooth (2, δ, 2δ)-local correcting algorithm for Had 2 (m). . . . . . . . . . . . . . 18 A perfectly smooth local correcting algorithm of locality = q t -1 for the Reed-Muller code RM q (m, r), where r < t(q -1). .

List of Figures

List of Tables