Alexey Frolov

Pavel Rybin

Konstantin Kondrashov

Antonia Wachter-Zeh

In Rennes, some people made my stays really enjoyable. Thanks to Matthieu Legeay for letting me join his o ce, his great humor and listening to my improvable French. Thank you also for guiding Alex and me around in the beauty of the Bretagne and enjoying several crêpes together. Thanks to all the other PhD students in Rennes for taking me to lunch many times. I would further like to thank Delphine Boucher, who always helped

Plusieurs constructions de codes et des propriétés de base de la métrique rang possèdent de fortes similarités avec les codes en métrique de Hamming. Super ciellement, un code de Gabidulin relevé est un code de sous-espaces spécial où chaque mot de code est l'espace des lignes d'une matrice I C T , où I désigne la matrice identité et C est un mot de code (en représentation matricielle) d'un code de Gabidulin xé.

Cette thèse traite des codes en bloc et des codes convolutifs en métrique rang avec l'objectif de développer et d'étudier des algorithmes de décodage e caces pour ces deux classes de codes. Cette thèse est structurée comme suit.

Le chapitre 1 donne une brève motivation pour l'utilisation des codes en métriques rang dans le cadre de l'application au codage réseau linéaire aléatoire et présente un aperçu de cette thèse.

Le chapitre 2 fournit une introduction rapide aux codes en métrique rang et leurs propriétés. Après avoir introduit des notations pour les corps nis et les bases normales, nous indiquons les dé nitions des codes en bloc et codes convolutifs en général. On donne quelques propriétés élémentaires et le principe de base du décodage des codes en bloc. Les codes de Gabidulin peuvent être dé nis comme des codes d'évaluation de polynômes linéarisés, pour cette raison, nous dé nissons cette classe des polynômes et montrons comment on peut e ectuer les opérations mathématiques de base sur ces polynômes.

La dernière section du chapitre 2 couvre les codes en métriques rang. On dé nit d'abord la métrique rang et on donne des propriétés de base pour les codes en métrique rang (par exemple, les équivalents des bornes de Singleton et de Gilbert-Varshamov). Ensuite, on dé nit les codes de Gabidulin, on montre qu'ils atteignent la borne supérieure de Singleton pour la cardinalité et on donne leur matrices génératrice et de contrôle. Nous généralisons par la suite leur dé nition aux codes de Gabidulin entrelacés et on montre explicitement comment les codes de Gabidulin relevés constituent un code de sous-espaces.

Dans le chapitre 3, on considère des approches e caces pour décoder les codes de Gabidulin. La première partie de ce chapitre traite des algorithmes rapides pour les opérations sur les polynômes linéarisés. Dans ce contexte, on analyse la complexité des approches connues pour les opérations dans un corps nis avec des bases normales ainsi que pour les opérations mathématiques avec des polynômes linéarisés. Ensuite, nous présentons de nouveaux algorithmes en temps sous-quadratique pour accomplir e cacement la composition linéarisé et l'algorithme d'Euclide linéarisé.

La deuxième partie de ce chapitre résume tout d'abord les techniques connues pour le décodage jusqu'à la moitié de la distance rang minimale (bounded minimum distance decoding) des codes de Gabidulin, qui sont basées sur les syndromes et sur la résolution d'une équation clé. Ensuite, nous présentons et nous prouvons un nouvel algorithme e cace pour le décodage jusqu'à la moitié de la distance minimale des codes de Gabidulin. Cet algorithme peut être considéré comme un équivalent de l'algorithme de Gao pour le décodage des codes de Reed-Solomon. Nous montrons comment l'algorithme d'Euclide linéarisé peut être utilisé dans ce contexte pour obtenir directement le polynôme de degré restreint d'évaluation du mot de code estimé. De plus, nous étendons cet algorithme de décodage a n de corriger non seulement des erreurs, mais aussi deux types d'e acements en métrique rang: e acements de lignes et de colonnes.

Le codage réseau linéaire aléatoire peut directement pro ter d'un tel algorithme de décodage e cace pour les codes Gabidulin, car il accélère immédiatement la reconstruction des paquets transmis et donc il réduit le délai nécessaire. L'extension de notre algorithme de décodage aux combinaisons d'erreurs et d'e acements est cruciale pour gérer les pertes de paquets dans le codage réseau linéaire aléatoire.

Le chapitre 4 est consacré aux codes de Gabidulin entrelacés et à leur décodage au-delà de la moitié de la distance rang minimale. Un mot de code d'un code de Gabidulin entrelacé peut être considéré comme s mots de code parallèles de s codes de Gabidulin normaux (pas nécessairement di érents). Ces s mots de code sont corrompus par s matrices d'erreur. Lorsque ces s matrices d'erreur additives ont un espace de lignes ou de colonnes en commun, il est possible de décoder les codes de Gabidulin entrelacés au-delà de la moitié de la distance rang minimale avec une grande probabilité. Jusqu'à présent, deux approches probabilistes pour le décodage unique sont connues pour ces codes.

La première borne montre que la taille de la liste pour un code de Gabidulin de longueur n et de distance rang minimale d peut devenir exponentielle quand τ est au moins le rayon de Johnson nn(nd). Cela implique qu'il ne peut pas exister un algorithme de décodage en liste en temps polynomial pour les codes de Gabidulin au-delà du rayon de Johnson. Il est intéressant de noter qu'on ne sait pas ce qui se passe pour les codes de Reed-Solomon si τ est légèrement supérieur au rayon de Johnson.

Notre deuxième borne est une borne supérieure sur la taille de la liste de tous les code en métrique rang, qui est prouvé par des liens entre les codes de rang constant (constant-rank codes) et les codes de dimension constante (constant-dimension codes).

Ce sont précisément ces liens qui nous permettent de dériver la troisième borne. Avec cette borne, nous pouvons prouver qu'il existe un code en métrique rang dans F q m de longueur n ≤ m tel que la taille de la liste peut devenir exponentielle pour tout τ supérieur à la moitié de la distance rang minimale. Cela implique d'une part qu'il n'y a pas de borne supérieure polynômiale, semblable à la borne de Johnson en métrique de Hamming, et d'autre part que notre borne supérieure est presque optimale.

La pertinence d'une algorithme de décodage en liste pour le codage réseau linéaire aléatoire est évidente, car un tel décodeur pourrait tolérer plus de paquets erronés qu'un décodeur de distance minimale bornée pour les codes de Gabidulin relevés.

En n, dans le chapitre 6, on introduit des codes convolutifs en métrique rang. Ce qui nous motive à considérer ces codes est le codage réseau linéaire aléatoire multi-shot, où le réseau inconnu varie avec le temps et est utilisé plusieurs fois. Les codes convolutifs créent des dépendances entre les utilisations di érentes du réseau a n de se adapter aux canaux di ciles.

Nous proposons des mesures de la distance pour les codes convolutifs en métrique rang par analogie avec la métrique de Hamming, à savoir la distance rang libre (free rank distance), la distance rang active des lignes (active row rank distance) et la pente (slope) de la distance rang active des lignes, et on prouve des bornes supérieures pour ces mesures. Basé sur des codes en bloc en métrique rang (en particulier les codes de Gabidulin), nous donnons deux constructions explicites des codes convolutifs en métrique rang : une construction à haut taux basée sur la matrice de contrôle et une construction à faible taux basée sur la matrice génératrice. Les deux dé nissent des codes (partial) unit memory et atteignent la borne supérieure de la distance rang libre.

Les codes en bloc sous-jacents nous permettent de développer un algorithme de décodage des erreurs et des e acements e cace pour la deuxième construction, qui garantit de corriger toutes les séquences d'erreurs de poids rang jusqu'à la moitié de la distance rang active des lignes. La complexité de l'algorithme de décodage est cubique en la longueur de la séquence transmise. Nous prouvons sa justesse et décrivons explicitement comment nos codes convolutifs en métrique rang peuvent être appliqués au codage réseau linéaire aléatoire multi-shot.

Notations Finite Fields q

Power of a prime [i] = q i q-power for some integer i F q Finite eld of order q F q m Extension eld of F q of degree m F s×n q Set of all s × n matrices over

F q F n q m = F 1×n q m
Set of all row vectors of length n over F q m B = {β 0 , β 1 , . . . , β m-1 } Basis of F q m over F q B ⊥ = {β ⊥ 0 , β ⊥ 1 , . . . , β ⊥ m-1 } Dual basis (to B) of F q m over F q B N = {β [0] , β [1] , . . . , β [m-1] } Normal basis of F q m over F q with normal element β

B ⊥ N = {β ⊥[0] , β ⊥[1] , . . . , β ⊥[m-1] } Dual normal basis (to B N ) with dual normal element β ⊥ β = (β 0 β 1 . . . β m-1 )
Ordered basis of F q m over F q Tr(a) = m-1 i=0 a [i] Trace function of a ∈ F q m T m ∈ F m×m q Multiplication table for a given normal basis comp(T m ) Number of non-zero elements of T m

Sets and Vector Spaces

[i, j] Short form for {i, i + 1, . . . , j} dim(V) Dimension of a vector space V P q (n)

Projective space = set of all subspaces of F n q G q (n, r) Grassmannian = set of all subspaces of F n q of dimension r n r q-binomial = cardinality of G q (n, r)

Matrices A = A i,j i∈[0,m-1] j∈[0,n-1]
m × n matrix a = (a 0 a 1 . . . a n-1 ) (Row) vector of length n (a T ) ↑i , (a T ) ↓i Cyclic up/down shift of a column vector a T

rk(A) Rank of matrix A ker(A)

Right kernel (= nullspace) of matrix A im(A) = C q (A)

Image of A = column space of A (over F q ) R q (A)

Row space of A (over F q ) I s s × s identity matrix qvan s ((a 0 a 1 . . . a n-1 ))

s × n q-Vandermonde matrix for vector (a 0 a 1 . . . a n-1 )

xi C Linearized Polynomials L q m [x]
Linearized polynomial ring in F q m with indeterminate x L q m [x, y 1 , . . . , y s ] Multivariate linearized polynomial ring in F q m with indeterminates x, y 1 , . . . , y s deg q a(x) q-degree of linearized polynomial a(x) a(x)

Full q-reciprocal of a(x), de ned by a i = a

[i]

-i = a [i] m-i a(x)
q-transform of a(x) a(b) = (a(b 0 ) a(b 1 ) . . . a(b n-1 ))

CHAPTER 1

Motivation and Overview E have their origin in Shannon's seminal publication from 1948 [START_REF] Shannon | A Mathematical Theory of Communication[END_REF], where he proved that nearly error-free discrete data transmission is possible over any noisy channel when the code rate is less than the channel capacity. This statement is nowadays called the (noisy) channel coding theorem. The channel capacity depends on the physical properties of the channel and it is an active research area to determine the capacity of non-trivial communication channels. However, the proof of the channel coding theorem is non-constructive and therefore it is not clear how to construct error-correcting codes which actually achieve the Shannon limit. A steady stream of publications and textbooks about code constructions, their properties and decoding methods has emerged with Hamming's class of codes [START_REF] Hamming | Error-Detecting and Error-Correcting Codes[END_REF] and has not yet come to an end. For most data transmission and data storage systems, the Hamming metric is the "proper" metric and codes de ned in this metric practically perform quite well.

Quite recently, random linear network coding (RLNC) attracts a lot of attention. It is a powerful means for spreading information in networks from sources to sinks (see e.g., [ACLY00, HKM + 03, HMK + 06]). The operator channel was introduced by Kötter and Kschischang [KK08] as an abstraction of noncoherent RLNC. In this model, the packets are assumed to be vectors over a nite eld while the internal structure of the network is unknown. Each node of the network forwards random linear combinations of all packets received so far. Due to these linear combinations, one single erroneous packet can propagate widely throughout the whole network and can render the whole transmission useless. This strong error propagation makes error-correcting codes in RLNC essential in order to reconstruct transmitted packets.

When the transmitted packets are considered as rows of a matrix, then the linear combinations of the nodes are nothing but elementary row operations on this matrix. During an error-and erasure-free transmission over the operator channel, the row space of the transmitted matrix is therefore preserved. Based on this observation, Kötter and Kschischang [KK08] used subspace codes for error control in RLNC. A subspace code is a non-empty set of subspaces of the vector space of dimension n over a nite eld and each codeword is a subspace itself. The so-called subspace distance is used as a distance measure for subspace codes, compare e.g., [WXS03, KK08, XF09, ES09, Ska10, EV11, Sil11, BVP13].

Silva, Kschischang and Kötter [START_REF] Silva | A Rank-Metric Approach to Error Control in Random Network Coding[END_REF] showed that lifted Gabidulin codes result in almost optimal subspace codes for RLNC. Gabidulin codes are the rank-metric analogs of Reed-Solomon codes and were introduced by Delsarte, Gabidulin and Roth [START_REF] Delsarte | Bilinear Forms over a Finite Field with Applications to Coding Theory[END_REF]Gab85,[START_REF] Roth | Maximum-Rank Array Codes and their Application to Crisscross Error Correction[END_REF]. Codes in rank metric, in particular Gabidulin codes, can be seen as a set of matrices over a nite eld. The rank of the di erence of two matrices is called their rank distance, which is induces a metric for matrix codes, the rank metric.

Informally speaken, a lifted Gabidulin code is a special subspace code, where each codeword is the row space of a matrix I C T , I denotes the identity matrix and C is a codeword (in matrix representation) of a xed Gabidulin code.

So far, no polynomial-time list decoding algorithm for Gabidulin codes is known and it is not even clear if it is possible at all. Therefore, Chapter 5 deals with bounds on list decoding block codes in rank metric in general and Gabidulin codes in particular. We rst recall known bounds on list decoding of codes in Hamming metric and then derive three bounds on list decoding codes in rank metric. Surprisingly, the rank-metric bounds are all signi cantly di erent from the known bounds in Hamming metric. In particular, we prove that in rank metric there exists no polynomial upper bound on the list size similar to the Johnson bound in Hamming metric. Further, one of our bounds shows that the list size can become exponential directly beyond the Johnson radius when decoding Gabidulin codes. Remarkably, it is not known if this property holds for Reed-Solomon codes. The relevance of a list decoding algorithm for RLNC is obvious, since such a decoder could tolerate more erroneous packets than a BMD decoder for the (lifted) Gabidulin code.

Finally, Chapter 6 introduces convolutional codes in rank metric. The motivation of considering such codes lies in multi-shot RLNC, where the unknown and time variant network is used several times. Convolutional network codes create dependencies between the di erent shots in order to cope with di cult channels. First, we de ne distance measures for convolutional codes in rank metric and prove upper bounds on them. Then, we construct a special class of convolutional codes-partial unit memory (PUM) codes-based on rank metric block codes in two di erent ways. We present an algorithm which e ciently decodes these PUM codes when both, errors and erasures occur and prove its correctness. The decoding complexity of this decoding algorithm is cubic in the length of a transmitted block. Further, it is explicitly described how lifting of these codes can be applied for error correction in multi-shot RLNC.

Chapter 7 concludes this dissertation.

CHAPTER 2 Introduction to Codes in Rank Metric

C

of length n ≤ m can be considered as a set of m × n matrices over a nite eld F q or equivalently as a set of vectors of length n over the extension eld F q m . The rank weight of such a "word" is simply the rank of its matrix representation and the rank distance between two words is the rank of their di erence. These de nitions rely on the fact that the rank metric is indeed a metric. Several code constructions and basic properties of the rank metric show strong similarities to codes in Hamming metric.

Error-correcting codes in rank metric were rst considered by Delsarte in 1978 [START_REF] Delsarte | Bilinear Forms over a Finite Field with Applications to Coding Theory[END_REF], who proved a Singleton-like upper bound on the cardinality and constructed a class of codes achieving this bound. This class of codes was reintroduced in 1985 by Gabidulin in his fundamental paper [Gab85], where in addition several properties of codes in rank metric and an e cient decoding algorithm were shown. Since Gabidulin's publication contributed signi cantly to the development of error-correcting codes in rank metric, the most famous class of codes in rank metric-the equivalents of Reed-Solomon codes-are nowadays called Gabidulin codes. These codes can be de ned by evaluating non-commutative linearized polynomials, proposed by Ore [START_REF] Ore | On a Special Class of Polynomials[END_REF][START_REF] Ore | Theory of Non-Commutative Polynomials[END_REF]. Independently of the previous work, Roth discovered in 1991 codes in rank metric in order to apply them for correcting crisscross error patterns [START_REF] Roth | Maximum-Rank Array Codes and their Application to Crisscross Error Correction[END_REF].

This chapter gives a brief introduction to the theory of error-correcting codes in rank metric. Section 2.1 provides de nitions and notations used in this thesis for codes in nite elds. Section 2.2 introduces linearized polynomials and their main properties. Finally, Section 2.3 deals with general properties and explicit constructions of codes in the rank metric.

Codes over Finite Fields

Throughout this thesis, we consider algebraic codes over nite elds and hence, this section introduces notations and basic properties of nite elds (Subsection 2.1.1) and codes over them. In Subsection 2.1.2, we show properties of normal bases since they enable us to accomplish calculations in nite elds quite e ciently. We clarify our notations for block codes and explain well-known decoding principles for block codes in Subsection 2.1.3: bounded minimum distance decoding, nearest codeword decoding and list decoding. Further, we introduce notations and basic properties of convolutional codes in Subsection 2.1.4.

Notations for Finite Fields

This subsection provides notations concerning nite elds, without going into detail about their theory. An extensive study of nite elds, their properties and applications can be found in standard literature about nite elds, e.g., [LN96, MBG + 93], and also in books about coding theory, e.g., [START_REF] Berlekamp | Algebraic Coding Theory[END_REF][START_REF] Blahut | Algebraic Codes for Data Transmission[END_REF][START_REF] Roth | Introduction to Coding Theory[END_REF][START_REF] Hu Man | Fundamentals of Error-Correcting Codes[END_REF].

Let p be a prime, then F p = {0, 1, . . . , p -1} denotes the prime eld of order p. Let q be a power of 2 I C R M the prime p, then we denote by F q the nite eld of order q. This nite eld F q contains q elements and p is called its characteristic. An extension eld (of extension degree m) of F q is denoted by F q m . This extension eld F q m can be constructed from F q and a polynomial p(x) of degree m, which is irreducible in F q and whose coe cients are in F q . For any m there is at least one such irreducible polynomial of degree m [LN96, Corollary 2.11]. Since all elds of the same size are isomorphic [LN96, Theorem 1.78], the eld F q m does not depend on the explicit choice of p(x) and is isomorphic to the polynomial ring over F q modulo p(x): F q m ∼ = F q / p(x) .

Thus, di erent irreducible polynomials give di erent representations of the same extension eld F q m over F q . The construction of F q m can be done by using a root of p(x) in F q m . A primitive element α of F q m is an element such that it generates the multiplicative group F * q m by its powers, i.e.,

F * q m def = F q m \ {0} = α i , ∀i ∈ [0, q m -2] ,
and α q m -1 = 1. A primitive element exists in any nite eld [START_REF] Lidl | Finite Fields, ser. Encyclopedia of Mathematics and its Applications[END_REF]p. 51]. If the irreducible polynomial p(x) has a primitive element as root, i.e., if p(α) = 0, then p(x) is called a primitive polynomial. If we use a primitive polynomial for the construction of the extension eld, we can take advantage of the fact that F * q m is a cyclic group [MS88, Chapter 4, Theorem 1]. The extension eld F q m can be represented as a vector space over F q , using a basis B = {β 0 , β 1 , . . . , β m-1 } of F q m over F q . If the order of the basis elements is important, we denote the ordered basis by β = (β 0 β 1 . . . β m-1 ). In Section 2.1.2, we will explain a type of basis which is of special interest for e cient computations in nite elds, the so-called normal basis.

Remark 2.1 (Properties).

The following further properties/notations concerning nite elds are used in this thesis:

• For any integer i, we denote the q-power by [i] def = q i . • For any a ∈ F q m : a [m] = a and for any a ∈ F q m and integer i, the q-power is calculated modulo m: a [i] = a [i mod m] . • For any A ∈ F q and any integer i: A [i] = A.

• For any a, b in F q m and any integer i: (a + b) [i] = a [i] + b [i] [LN96, Theorem 1.46].

The set of all subspaces of F n q is called the projective space and denoted by P q (n). A Grassmannian of dimension r is the set of all subspaces of F n q of dimension r ≤ n and denoted by G q (n, r). Clearly, the projective space is P q (n) = n r=0 G q (n, r). The cardinality of G q (n, r) is given by the q-binomial (also called Gaussian binomial coe cient) as follows.

Lemma 2.1 (Number of Subspaces [START_REF] Berlekamp | Algebraic Coding Theory[END_REF]Theorem 11.52]). The number of r-dimensional subspaces of F n q over F q is n r

def = |G q (n, r)| = r-1 i=0
q nq i q rq i .

The q-binomial has the following upper and lower bounds (see e.g., [KK08, Lemma 4]):

q r(n-r) ≤ n r ≤ 4q r(n-r) .

(2.1)

In this thesis, we use F s×n q to denote the set of all s × n matrices over F q and F n q m = F 1×n q m for the set 2.1 C F F of all row vectors of length n over F q m . For a given basis B of F q m over F q , there exists a one-to-one mapping for each vector a ∈ F n q m on a matrix A ∈ F m×n q . This mapping is formally de ned as follows.

De nition 2.1 (Mapping to Ground Field). Let B = {β 0 , β 1 , . . . , β m-1 } denote a basis of F q m over F q . Fix an order of this basis β = (β 0 β 1 . . . β m-1 ) and let a be a vector in F n q m . The extension of a over the ground eld is given by the following bijective map:

ext β : F n q m → F m×n q a = (a 0 a 1 . . . a n-1 ) → A =      A 0,0 A 0,1 . . . A 0,n-1 A 1,0 A 1,1 . . . A 1,n-1 . . . . . . . . . . . . A m-1,0 A m-1,1 . . . A m-1,n-1      ,
where A ∈ F m×n q is de ned such that

a j = m-1 i=0 A i,j β i , ∀j ∈ [0, n -1].
Therefore, a = β • A. If we apply ext β to a single element a ∈ F q m , it is mapped to a column vector ext β (a) ∈ F m×1 q . Throughout this thesis, we will therefore use the following notations to switch between the two representations:

A = ext β (a) , a = ext -1 β (A) .
Further, let rk(a) denote the (usual) rank of A = ext β (a) over F q and let R q (A) and C q (A) denote the row and column space of A in F n q and F m q , respectively. The right kernel of a matrix is denoted by ker(A) and as a notation, ker(a) = ker(ext β (a)) = ker(A).

For any m × n matrix, the rank nullity theorem states that dim ker(a) + rk(a) = n. We use the notation as a vector a ∈ F n q m or matrix A ∈ F m×n q equivalently, whatever is more convenient.

Normal Bases

Normal bases facilitate calculations in nite elds and can therefore be used to reduce the computational complexity. This fact is crucial for our e cient decoding algorithm for Gabidulin codes in Subsection 3.2.4. We shortly sum up the main properties of normal bases here; however, for further theory, the interested reader is referred to the literature, e.g., [Gao93, LN96, MBG + 93].

A basis B = {β 0 , β 1 , . . . , β m-1 } of F q m over F q is a normal basis if β i = β [i] for all i and we denote it by B N = {β [0] , β [1] , . . . , β [m-1] } in the following. We call β ∈ F q m a normal element. Lemma 2.2 shows that choosing a normal basis is not restricted to certain extension elds.

Lemma 2.2 (Existence of Normal Basis [LN96, Theorem 2.35]).

There is a normal basis for any nite extension eld F q m over F q , i.e., for any prime power q and any positive integer m.

The following lemma about the existence of normal bases is even stronger.

I C R M

Lemma 2.3 (Existence of Normal Basis [START_REF] Blessenohl | Eine Verschärfung des Satzes von der Normalbasis[END_REF]).

In a nite extension eld F q m over F q , there is a normal basis of F q s over F q for every positive divisor s of m. For the normal element of this basis β [s] = β holds.

The so-called dual basis B ⊥ of a basis B is needed in order to switch between a polynomial and its q-transform (compare De nition 2.12). To de ne the dual basis for a given basis B, we need the trace function of F q m over F q for an element a ∈ F q m :

Tr : F q m → F q a → Tr(a) def = m-1 i=0 a [i] .
The trace function is an F q -linear map from F q m to F q and hence, Tr(a) ∈ F q [LN96, Chapter 2.3]. A basis B ⊥ = {β ⊥ 0 , β ⊥ 1 , . . . , β ⊥ m-1 } of F q m over F q is called a dual basis to B = {β 0 , β 1 , . . . , β m-1 } if:

Tr(β i β ⊥ j ) =
1 for i = j, 0 else.

(2.2)

Lemma 2.4 (Dual of a (Normal) Basis [MBG + 93, Theorem 1.1 and Corollary 1.4]).

For any given basis B of F q m over F q , there exists a unique dual basis B ⊥ . The dual basis of a normal basis is also a normal basis.

If a basis is dual to itself, i.e., if B = B ⊥ , we call it a self-dual basis and if it is additionally normal, we call it a self-dual normal basis B N = B ⊥ N . A self-dual basis of F q m over F q exists if and only if either q is even or both q and m are odd [MBG + 93, Theorem 1.9]. Self-dual normal bases of F q m over F q exist if m is odd or if q is even and m ≡ 2 mod 4 [MBG + 93, Theorem 1.14].

We explain now basic mathematical operations on two elements a, b ∈ F q m using a normal basis B N = {β [0] , β [1] , . . . , β [m-1] } of F q m over F q . Apply the mapping ext β from De nition 2.1 in order to represent these two elements as vectors in F q :

(A 0 A 1 . . . A m-1 ) T def = ext β (a) ∈ F m×1 q , (B 0 B 1 . . . B m-1 ) T def = ext β (b) ∈ F m×1 q .
An important observation is that in a normal basis representation, the q-power of an element a in F q m corresponds to a cyclic shift of the corresponding vector ext β (a) over F q :

ext β a [j] = (A m-j A m-j+1 . . . A 0 A 1 . . . A m-j-1 ) T def = ext β (a) ↓j ∈ F m×1 q , (2.3)
where the down arrow denotes a cyclic shift of the vector by j positions to the bottom. The e ciency of calculations with normal bases stems exactly from this property and from the application of a so-called multiplication table (compare [Gao93, MBG + 93]). ).

De nition 2.2 (Multiplication Table

Let B N = {β [0] , β [1] , . . . , β [m-1] } be a normal basis of F q m over F q . The multiplication table of B N is a matrix T m ∈ F m×m q
such that:

β [0] • β [0] β [1] . . . β [m-1] T = T m • β [0] β [1] . . . β [m-1] T . 2.1 C F F
The number of non-zero entries in T m is called the complexity of T m of B N and is denoted by comp(T m ).

The addition a + b in F q m can be done component-wise by the addition ext β (a) + ext β (b) ∈ F m×1 q and is therefore easy to implement. By means of the multiplication table, the product of a • b ∈ F q m can be calculated over the ground eld

F q : For a, b ∈ F q m : ext β (a • b) = m-1 i=0 B i T T m • ext β (a) ↑i ↓i ∈ F m×1 q , (2.4)
where the up/down arrows denote cyclic shifts of the vector by i positions to the top/bottom. If one of the elements is a basis element, i.e., b = β [j] , then the vector ext β (b) is non-zero only in the j-th row and (2.4) becomes

For a, β ∈ F q m , β ∈ B N : ext β a • β [j] = T T m • ext β (a) ↑j ↓j ∈ F m×1 q .
(2.5)

It becomes clear from (2.4) and (2.5) that the number of operations in F q in order to determine ext β (a • b) directly depends on the number on non-zero entries of T m , i.e., on its complexity comp(T m ). Therefore, it is desirable that T m is sparse. This complexity is lower bounded by comp(T m ) ≥ 2m -1 [MBG + 93, Theorem 5.1]. A normal basis with comp(T m ) = 2m -1 is an optimal normal basis. We call normal bases with complexity in the order of O(m) low-complexity normal bases. Optimal normal bases exist for several values1 , but for our applications low-complexity (but not necessarily optimal) normal bases are su cient. Low-complexity normal bases with O(comp(T m )) = O(m) of F q m over F q exist in many cases, e.g. for q = 2 s if gcd(m, s) = 1 and 8 ∤ m. For q = 2 s and odd m, all these low-complexity normal bases are self-dual (see also [START_REF] Gao | Normal Bases over Finite Fields[END_REF]Chapter 5]).

The complexity of the mentioned operations will be analyzed in detail in Subsection 3.1.1.

Basics of Block Codes and Decoding Principles

This subsection gives basic notations and properties of block codes. A deeper investigation of code classes, constructions and properties can be found in books on algebraic coding theory, e.g., [START_REF] Peterson | Error-Correcting Codes[END_REF][START_REF] Blahut | Theory and Practice of Error Control Codes[END_REF][START_REF] Berlekamp | Algebraic Coding Theory[END_REF][START_REF] Macwilliams | The Theory of Error-Correcting Codes[END_REF][START_REF] Van Lint | Introduction to Coding Theory[END_REF]Bos98,[START_REF] Justesen | A Course in Error-Correcting Codes[END_REF][START_REF] Roth | Introduction to Coding Theory[END_REF]. In the following, we show the de nition of a metric, give the notations of a (linear) block code and explain encoding and decoding principles.

De nition and Basic Properties of Block Codes

Assume, a set A (e.g., of vectors or matrices) is given. In order to de ne error-correcting codes, we need a measurement of distance between the elements in this set. A distance measure on this set A is called a metric if it ful lls the following conditions.

De nition 2.3 (Metric).

Let A be a set (e.g., of vectors or matrices). A distance measure d A (a, b) on any two elements a, b in this set A is a metric if it satis es for all a, b, c ∈ A:

• positive de niteness:

d A (a, b) ≥ 0, where d A (a, b) = 0 if and only if a = b, • symmetry: d A (a, b) = d A (a, b), • triangle inequality: d A (a, b) + d A (b, c) ≥ d A (a, c). 2 I C R M
Classical error-correcting codes are de ned in Hamming metric and they have been subject of a large number of publications. Among codes in Hamming metric, the well-known classes of Hamming codes [START_REF] Hamming | Error-Detecting and Error-Correcting Codes[END_REF], Reed-Muller codes [Ree54, Mul54], Reed-Solomon codes [START_REF] Reed | Polynomial Codes Over Certain Finite Fields[END_REF], cyclic codes (also called BCH codes) [START_REF] Hocquenghem | Codes Correcteurs d'Erreurs[END_REF][START_REF] Bose | On a Class of Error Correcting Binary Group Codes[END_REF] and many others can be found. In this thesis, we consider codes in rank metric. This metric will be given in Subsection 2.3, De nition 2.13, for block codes in F q m . From a practical point of view, a block code of length n is a code, where each "block" of length n can be decoded independently from the other blocks. Based on a given metric, a block code can be de ned as follows.

De nition 2.4 (Block Code).

Let a metric in F n q be given, ful lling the requirements of De nition 2.3. An (n, M, d) block code C over F q is a set of vectors in F n q of cardinality M , where the minimum distance (in the given metric) between any two vectors of this code is d.

A block code C over F q is called linear if it is a k-dimensional subspace of F n q over F q and its parameters are denoted by [n, k, d]. The parameter k is called the dimension of C.

The fraction

R def = (log q M )/n is called the code rate of C. If C is linear, then R = k/n.
We call all vectors in F k q information words. The vectors in F n q in an (n, M, d) code are called codewords. The cardinality of a linear [n, k, d] block code C over F q is therefore M = q k and since C is a subspace of F n q , for any codewords c (1) , c (2) ∈ C and any elements a, b ∈ F q , the linear combination ac (1) + bc (2) is also a codeword of C.

A linear code can be de ned by its generator matrix using a basis of the k-dimensional subspace.

De nition 2.5 (Generator Matrix).

Let C be a linear [n, k, d] code over F q , i.e., it is a k-dimensional subspace of F n q over F q . A k × n generator matrix G of C is a matrix whose rows are a basis of this k-dimensional vector space over F q .

The generator matrix can be used to encode the information words in F k q into codewords in F n q . Thus, a codeword of an [n, k, d] code is any vector in F n q which can be obtained by u • G, for some u ∈ F k q . Encoding de nes the bijective map of the information vectors in F k q to the codewords in F n q :

enc :

F k q → F n q u = (u 0 u 1 . . . u k-1 ) → c = (c 0 c 1 . . . c n-1 ).
Notice that there is more than one generator matrix for a given [n, k, d] code C, since we can use any basis of the k-dimensional subspace C over F q in an arbitrary order.

De nition 2.6 (Dual Code).

For two vectors a, b ∈ F n q , let a, b def = n-1 i=0 a i b i de ne the inner product and let C be a linear [n, k, d] code over F q . Then, the set of vectors

C ⊥ def = c ⊥ ∈ F n q : c ⊥ , c = 0, ∀ c ∈ C is called the dual code to C.
The dual code of an [n, k, d] code over F q is also a linear code over F q and has dimension k ⊥ = nk and length n. Its minimum distance is denoted by d ⊥ , but its value is not necessarily determined by

2.1 C F F the parameters of the [n, k, d] code 2 . Therefore, the dual code C ⊥ is an [n, n -k, d ⊥ ] code, i.e.
, an (nk)-dimensional subspace of F n q , which can be used to de ne the parity-check matrix of C.

De nition 2.7 (Parity-Check Matrix

).

An (n -k) × n matrix H over F q is called a parity-check matrix of an [n, k, d] code C over F q if and only if it is a generator matrix of the [n, n -k, d ⊥ ] dual code C ⊥ over F q .
Thus, for any c ∈ C, the multiplication with the parity-check matrix gives c • H T = 0 and G • H T = 0.

A parity-check matrix is therefore a matrix whose right kernel is the code C.

De nition 2.8 (Syndrome).

For any a ∈ F n q and a parity-check matrix

H of an [n, k, d] code C, the vector s = a • H T ∈ F n-k q is called the syndrome of a.
If and only if a ∈ C, then the syndrome is s = 0.

Decoding Principles of Block Codes

After introducing these basic notations, let us now proceed to basic decoding principles.

Lemma 2.5 (Unique Decoding Capability [MS88]).

Let C be an (n, M, d) block code over F q with minimum distance d in a given metric d A (•, •) (see De nition 2.3) and let r be a word in F n q . Then, there is at most one

codeword c ∈ C such that d A (r, c) ≤ τ 0 def = ⌊ (d-1) /2⌋. Further, if there is a codeword c ∈ C such that 0 < d A (r, c) ≤ d -1, then r / ∈ C.
The process of reconstructing the codeword from a received word is called decoding and we use the expression "number of errors" throughout this thesis for d A (r, c) (in the corresponding metric). Lemma 2.5 shows that we can always decode uniquely up to τ 0 = ⌊ (d-1) /2⌋ errors and detect up to d -1 errors.

In this dissertation, we distinguish three decoding principles for an (n, M, d) code C over F q , which are illustrated in Figure 2.1 and explained in the following. For each of them, we assume that a received word r ∈ F n q is given and denote by B (e) (r) a ball in the given metric around r of radius e.

Nearest codeword decoding (see Figure 2.1a). A nearest codeword decoder maps the received word r to the closest codeword, i.e., the codeword with the smallest distance to r. If there is more than one codeword in smallest distance to r, we can either output all of them or choose one randomly. For a given metric d A (•, •), the decoding result is hence3 :

c ′ = arg min c∈C d A (r, c) ⊆ C.
The output of a nearest codeword decoder is therefore always at least one codeword; a decoding failure is never declared. If we assume that a smaller error weight (in the corresponding metric) is more likely than a greater error weight, then nearest codeword decoding is equivalent to maximum likelihood (ML) decoding. For codes in Hamming metric, ML decoding of general linear block codes is NP complete [START_REF] Berlekamp | On the Inherent Intractability of Certain Coding Problems[END_REF], and for codes in rank metric this is also conjectured. In any case, nearest codeword and ML decoders are hardly feasible due to their high computational complexity.

2I C R M r c (2) c (1) c (3) d-1 2 (a) Nearest codeword decoding r c (2) c (1) c (3) d-1 2 r c (1) (b) BMD decoding r c (2) c (1) c (3) d-1 2 r c (1) (c) List decoding
Bounded minimum distance decoding (see Figure 2.1b). A bounded minimum distance (BMD) decoder guarantees to nd all codewords in radius at most τ 0 = ⌊ (d-1) /2⌋ from the received word. Due to Lemma 2.5, there is at most one such codeword and the decoding result is

c ′ = C ∩B (τ 0 ) (r) ∈ C ∪{} .
Therefore, we obtain either a unique codeword or the empty set, in which case we can declare a decoding failure. For several algebraic code classes as Reed-Solomon or Gabidulin codes, there are e cient BMD decoding algorithms in the corresponding metric.

List decoding (see Figure 2.1c). The concept of list decoding can be seen as a generalization of BMD decoding and was introduced by Elias [Eli57] and Wozencraft [START_REF] Wozencraft | List Decoding[END_REF]. A list decoder guarantees to nd all codewords around r up to a certain radius τ . Hence, the decoder outputs a list of codewords:

L = c (1) , c (2) ,...,c (ℓ) = C ∩B (τ ) (r) ⊆ C ∪{} .
If the output is the empty set, a decoding failure is declared. Such a list decoder makes sense from a practical point of view, if either the probability that the list size is greater than one is very small or if we can use the whole list in the further decoding process, e.g. in concatenated coding schemes or in iterative decoding. The design of e cient list decoding algorithms (with τ>⌊ (d-1) /2⌋) is a widely investigated topic for some classes of codes and the existence of such a polynomial-time algorithm for codes in rank metric is investigated in Chapter 5.

For explicit decoding algorithms there are two important properties: its performance and its complexity. The performance measures the fraction of correctable errors and directly depends on the minimum distance of the code. The complexity measures the feasibility of an algorithm by counting the number of calculations in the corresponding nite eld.

F F

Basics of Convolutional Codes

In contrast to block codes, convolutional codes create a dependency between the di erent transmitted blocks of length n. For certain channels (e.g., when the number of errors in di erent blocks uctuates a lot), their use might be superior to using block codes. In this subsection, we will shortly give basic notations of convolutional codes, mostly based on [START_REF] Piret | Convolutional Codes: An Algebraic Approach[END_REF][START_REF] Mceliece | The Algebraic Theory of Convolutional Codes[END_REF]Bos98,[START_REF] Johannesson | Fundamentals of Convolutional Coding[END_REF]. We also introduce notations for (partial) unit memory ((P)UM) codes and prove rate restrictions on them. Distance measures, constructions and decoding of convolutional codes in rank metric are established in Chapter 6.

De nition and Basic Properties of Convolutional Codes

The algebraic theory and description of convolutional codes was investigated by Forney [START_REF] Forney | Convolutional Codes I: Algebraic Structure[END_REF][START_REF] Forney | Structural Analysis of Convolutional Codes via Dual Codes[END_REF],

showing that a q-ary convolutional code of rate R = k/n is a k-dimensional subspace of the ndimensional vector space F q [D] k over the eld of q-ary causal Laurent series (see McEliece's chapter in the handbook of coding theory [START_REF] Mceliece | The Algebraic Theory of Convolutional Codes[END_REF] for a detailed description of Laurent series), where D is also called the delay operator. Thus, encoding of convolutional codes is given by the following map:

enc-conv : F q [D] k → F q [D] n (2.6) u(D) = u (0) + u (1) D + u (2) D 2 + . . . → c(D) = u(D) • G(D) = c (0) + c (1) D + c (2) D 2 + . . . ,
where

u (i) = (u (i) 0 u (i) 1 . . . u (i) k-1 ) and c (i) = (c (i) 0 c (i) 1 . . . c (i)
n-1 ), for all integers i. This map shows how to encode the semi-in nite information sequence u(D) into a semi-in nite code sequence c(D).

We call the vectors u (i) and c (i) of lengths k and n, respectively, information and code blocks. The important observation is that c (i) is a function of not only u (i) , but also of u (i-1) , u (i-2) , . . . , where the length of this in uence is determined by the memory of the convolutional encoder. Further, we consider only causal sequences, i.e., u (i) = 0 and c (i) = 0 for all i < 0. For short-hand notation, we also denote the semi-in nite sequences by u = (u (0) u (1) u (2) . . . ) and c = (c (0) c (1) c (2) . . . ).

The matrix G(D) ∈ F q [D] k×n is called generator matrix and de nes a convolutional code as follows.

De nition 2.9 (Convolutional Code).

A linear convolutional code C over F q of rate R = k/n is de ned by its k × n generator matrix of rank k:

G(D) = g i,j (D) i∈[0,k-1] j∈[0,n-1] ,
where

g i,j (D) = g (0) i,j +g (1) i,j D+• • •+g (µ) i,j D µ and g (l) i,j ∈ F q , ∀l ∈ [0, µ], ∀i ∈ [0, k-1] and ∀j ∈ [0, n-1]. The parameter µ denotes the memory of G(D) (see De nition 2.10). In general, g i,j (D) is a rational function, ∀i ∈ [0, k -1], j ∈ [0, n -1]. If g i,j (D) is a polynomial in D,
for all i, j, then G(D) is called polynomial generator matrix and it can be realized by a nite impulse response lter, see [START_REF] Johannesson | Fundamentals of Convolutional Coding[END_REF]Bos98]. We restrict ourselves to such generator matrices in the following.

We strictly distinguish the terms "convolutional code", "generator matrix" and "convolutional encoder". A convolutional code is a set of in nite cardinality, which contains all sequences, de ned by the mapping enc-conv (2.6). The generator matrix G(D) explicitly de nes the mapping between information and code sequences and therefore, there are several generator matrices G(D) for one code. The encoder is a linear sequential circuit, which realizes G(D), and for one generator matrix, there are several encoders.

The memory and constraint length are properties of the generator matrix. In the literature, there are di erent notations for them; we follow Forney's notations [START_REF] Forney | Convolutional Codes I: Algebraic Structure[END_REF].

2 I C R M

De nition 2.10 (Constraint Length and Memory).

The i-th constraint length of a polynomial generator matrix G(D) is

ν i def = max j∈[0,n-1] deg g i,j (D) , ∀i ∈ [0, k -1].
The memory is µ def = max i∈[0,k-1] {ν i }, and the overall constraint length is

ν def = k-1 i=0 ν i .
The following remark shows several further properties of the generator matrix, most of them are due to Forney [START_REF] Forney | Convolutional Codes I: Algebraic Structure[END_REF] and Johannesson and Zigangirov [START_REF] Johannesson | Fundamentals of Convolutional Coding[END_REF].

Remark 2.2 (Further De nitions and Properties).

• Two convolutional generator matrices are called equivalent, if they generate the same code.

• A convolutional generator matrix is catastrophic if there is an information sequence u(D) with in nitely many non-zero elements that results in a code sequence with nitely many non-zero elements. • A convolutional generator matrix is delay-free if at least one of its entries g

(0) i,j is non-zero. • A convolutional generator matrix G(D) is called basic if it is polynomial and has a polynomial right inverse G -1 (D) such that I k = G(D) • G -1 (D)
, where I k is the k × k identity matrix. • A convolutional generator matrix G(D) is an encoding matrix if G(0) has full rank. An encoding matrix is delay-free. A basic encoding matrix is non-catastrophic. • A convolutional encoder is called obvious realization of G(D) if it has k shift registers and the length of the i-th register is ν i . • A basic convolutional generator matrix G(D) is called minimal if its overall constraint length ν in the obvious realization is equal to the maximum degree of its k × k subdeterminants.

A polynomial parity-check matrix H(D) ∈ F q [D] (n-k)×n of C has full rank and is de ned such that for every codeword c(D) ∈ C:

c(D) • H T (D) = 0.
We denote the entries of the parity-check matrix by

H(D) = h i,j (D) i∈[0,n-k-1] j∈[0,n-1] , where h i,j (D) = h (0) i,j +h (1) i,j D +h (2) i,j D 2 +• • •+h (µ H ) i,j D µ H and h (l) i,j ∈ F q , ∀l ∈ [0, µ H ] and i ∈ [0, n-k -1], j ∈ [0, n-1].
The value µ H denotes the memory of the dual code, shortly called dual memory.

We can rewrite 1) . . .

G(D) = G (0) + G (1) D + G (2) D 2 + • • • + G (µ) D µ and H(D) = H (0) + H (1) D + H (2) D 2 + • • • + H (µ H ) D µ H and represent both as semi-in nite matrices over F q : G =    G (0) G (1) . . . G (µ) G (0) G (1) . . . G (µ) . . . . . . . . . . . .    , H =             H (0) H (1) H (0) . . . H (
H (µ H ) . . . . . . H (µ H ) . . . . . .             , (2.7)
where

G (i) ∈ F k×n q and H (j) ∈ F (n-k)×n q , ∀i ∈ [0, µ], j ∈ [0, µ H ]. These matrices are de ned such that c = (c (0) c (1) c (2) . . . ) = u • G = (u (0) u (1) u (2) . . . ) • G and c • H T = (0 0 . . . ).
In general, the memories are not equal, i.e., µ = µ H . If both G and H are in minimal basic encoding form, the overall constraint length ν is the same in both representations [For70, Theorem 7].

C F F

In practical realizations, it does not make sense to consider (semi-)in nite sequences and therefore, throughout this thesis, we consider only linear zero-forced terminated convolutional codes. Such a code C is de ned by the following N k × (n(N + µ)) terminated generator matrix G term over F q , for some integer N :

G term =      G (0) G (1) . . . G (µ) G (0) G (1) . . . G (µ) . . . . . . . . . . . . G (0) G (1) . . . G (µ)      , (2.8)
i.e., we cut the matrix G from (2.7) after N rows. Each codeword of C is a sequence of N + µ blocks of length n over F q , i.e., c = (c (0) c (1) . . . c (N +µ-1) ). Convolutional codes can be described by a (minimal) code trellis and ML decoding is possible with the Viterbi algorithm [START_REF] Viterbi | Error Bounds for Convolutional Codes and an Asymptotically Optimum Decoding Algorithm[END_REF]. However, we do not explain this here and refer to the literature [START_REF] Mceliece | The Algebraic Theory of Convolutional Codes[END_REF]Bos98,[START_REF] Johannesson | Fundamentals of Convolutional Coding[END_REF].

(Partial) Unit Memory Codes (P)UM codes are a special class of convolutional codes of memory µ = 1, introduced by Lee and Lauer [START_REF] Lee | Short Unit-Memory Byte-Oriented Binary Convolutional Codes Having Maximal Free Distance[END_REF][START_REF] Lauer | Some Optimal Partial-Unit Memory Codes[END_REF]. The semi-in nite generator matrix consists therefore of two k × n submatrices G (0) and G (1) . These matrices both have full rank k if we construct a UM(n, k) unit memory code.

For a PUM(n, k|k (1) ) partial unit memory code over F q , rk(G (0) ) = k and rk(G (1) ) = k (1) < k has to hold. W.l.o.g., for PUM codes, we assume that the lowermost kk (1) rows of G (1) are zero and we denote:

G (0) = G (00) G (01) , G (1) = G (10) 0 , (2.9)
where G (00) and G (10) are k (1) × n matrices and G (01) is a (kk (1) ) × n-matrix over F q . The encoding rule for each code block of a (P)UM code is given by

c (i) = u (i) • G (0) + u (i-1) • G (1) , ∀i = 0, 1, . . . , (2.10)
where u (i) and u (i-1) ∈ F k q for all i. The memory of (P)UM codes is µ = 1, the overall constraint length of UM codes is ν = k and of PUM codes ν = k (1) due to De nition 2.10.

In the following, we derive restrictions on the code rate of (P)UM codes when a certain number of full-rank submatrices of H, denoted by H (i) as in (2.7), should exist. This full-rank condition, rk(

H (i) ) = n -k, ∀i ∈ [0, µ H ],
is used in one of our constructions of PUM codes based on Gabidulin codes (see Subsection 6.2.1).

Lemma 2.6 (Rate Restriction for Unit Memory Codes).

Let the parity-check matrix H of a UM(n, k) code be in minimal basic encoding form and let it consist of µ H + 1 full-rank submatrices H (i) , see (2.7), for µ H ≥ 1. Then, the UM(n, k) unit memory code with overall constraint length ν = k has code rate

R = µ H µ H + 1 .
Proof. The overall constraint length ν is the same for the generator matrix G and the paritycheck matrix H if both are in minimal basic encoding form [START_REF] Forney | Convolutional Codes I: Algebraic Structure[END_REF]. Since rk(H

(i) ) = n -k, ∀i ∈ [1, µ H ], we obtain ν = µ H • (n -k).
On the other hand, the UM code is de ned by a generator matrix G with ν = k, hence, k = µ H • (nk) and the statement follows.

C R M

In a similar way, we can establish a rate restriction for PUM codes.

Lemma 2.7 (Rate Restriction for Partial Unit Memory Codes).

Let the parity-check matrix H of a PUM(n, k|k (1) ) code be in minimal basic encoding form and let it consist of µ H + 1 full-rank submatrices H (i) , see (2.7), for µ H ≥ 1. Then, the partial unit memory code PUM(n, k|k (1) ) with ν = k (1) < k has code rate

R = k n > µ H µ H + 1 .
Proof. As before, ν is the same for G and H in minimal basic encoding form, [START_REF] Forney | Convolutional Codes I: Algebraic Structure[END_REF]. Since rk(

H (i) ) = n -k for all i, we have ν = µ H • (n -k). For a PUM code ν = k (1) < k, hence, µ H • (n -k) < k.
The following theorem guarantees that for any parity-check matrix of certain rate, there is always a corresponding generator matrix having memory µ = 1 and thus, de nes a (P)UM code. This fact is useful in order to construct (P)UM codes based on a parity-check matrix.

Theorem 2.1 ((P)UM Code from Parity-Check Matrix). Let H be a semi-in nite parity-check matrix as in (2.7) in minimal basic encoding form of a convolutional code C, where

H (i) ∈ F (n-k)×n q has full rank, ∀i ∈ [0, µ H ], and let R = k/n ≥ µ H /(µ H + 1) with µ H ≥ 1.
Then, there is a generator matrix G of C such that C is a (partial) unit memory code.

Proof. The constraint length of

H is ν = µ H (n -k). Since n ≤ k(µ H + 1)/µ H , we obtain: ν = µ H (n -k) ≤ k(µ H + 1) -kµ H = k.
Due to [START_REF] Forney | Convolutional Codes I: Algebraic Structure[END_REF], the overall constraint length ν of dual minimal encoders is equal and thus, of G and H if both are in minimal form. We choose G to be in minimal basic encoding form (which is always possible). Since it is in encoding form, rk(G (0) ) = k. Since ν > 0, the memory is µ ≥ 1. Corollary 2 and the corresponding remark in [START_REF] Forney | Structural Analysis of Convolutional Codes via Dual Codes[END_REF] imply that G can be chosen such that µ is equal to ⌈ν/k⌉ ≤ ⌈k/k⌉ = 1 (in [For73, Corollary 2] the roles of G and H are interchanged). Hence, we can choose G such that µ = 1.

Since rk(G (0) ) = k and µ = 1, the generator matrix G de nes a (partial) unit memory code.

Linearized Polynomials

Linearized polynomials constitute a non-commutative ring and will later provide the de nition of Gabidulin codes. Apart from their application to coding theory, linearized polynomials are used e.g. in root-nding of usual polynomials and as permutation polynomials in cryptography. They are also called q-polynomials and were introduced in 1933 by Ore [START_REF] Ore | On a Special Class of Polynomials[END_REF] as a special case of skew polynomials [START_REF] Ore | Theory of Non-Commutative Polynomials[END_REF]. The theory of skew polynomials is quite rich and widely investigated [START_REF] Ore | Theory of Non-Commutative Polynomials[END_REF][START_REF] Jacobson | The Theory of Rings[END_REF][START_REF] Giesbrecht | Factoring in Skew-polynomial Rings over Finite Fields[END_REF][START_REF] Jacobson | Finite-Dimensional Division Algebras over Fields[END_REF] and it is even possible to construct error-correcting codes based on skew polynomials [START_REF] Boucher | Skew Cyclic Codes[END_REF][START_REF] Boucher | Coding with Skew Polynomial Rings[END_REF][START_REF] Boucher | Codes as Modules over Skew Polynomial Rings[END_REF][START_REF] Chaussade | Skew Codes of Prescribed Distance or Rank[END_REF][START_REF] Boucher | Linear Codes Using Skew Polynomials with Automorphisms and Derivations[END_REF]. Skew polynomials become linearized polynomials when the derivation is zero and the Frobenius automorphism is used, i.e., when we consider only F qlinear maps. Gabidulin codes are based on linearized polynomials and therefore, we restrict ourselves to their description without going into detail about the theory of skew polynomials.

L P

After basic de nitions and properties (Subsection 2.2.1), we brie y show how operations with linearized polynomials work (Subsection 2.2.2), give their connection to linear maps (Subsection 2.2.3) and de ne the q-transform and its inverse (Subsection 2.2.4). In Chapter 3, the q-transform turns out to be a useful tool when establishing an e cient decoding algorithm for Gabidulin codes.

De nition and Properties

De nition 2.11 (Linearized Polynomial). A polynomial a(x) is a linearized polynomial if it has the form

a(x) = da i=0 a i x [i] , a i ∈ F q m , ∀i ∈ [0, d a ].
The non-commutative univariate linearized polynomial ring with indeterminate x, consisting of all such polynomials over F q m , is denoted by

L q m [x].
If the coe cient a da is non-zero, we call deg q a(x) def = d a the q-degree of a(x). Recall that for any B ∈ F q , B [i] = B holds for any integer i. This provides the following lemma about evaluating linearized polynomials.

Lemma 2.8 (Evaluation of a Linearized Polynomial [Ber84, Theorem 11.12]). Let B = {β 0 , β 1 , . . . , β m-1 } be a basis of F q m over F q , let a(x) be a linearized polynomial as in De nition 2.11 and let b ∈

F q m . Denote ext β (b) = (B 0 B 1 . . . B m-1 ) T ∈ F m×1 q as in De nition 2.1. Then, a(b) = m-1 i=0 B i a β i .
Lemma 2.8 establishes the origin of the name linearized polynomials: for all A 1 , A 2 ∈ F q and all b 1 , b 2 ∈ F q m and a(x) ∈ L q m [x], the following holds:

a A 1 b 1 + A 2 b 2 = A 1 a b 1 + A 2 a b 2 .
Hence, any F q -linear combination of roots of a linearized polynomial a(x) is also a root of a(x).

Theorem 2.2 (Roots of a Linearized Polynomial [START_REF] Berlekamp | Algebraic Coding Theory[END_REF]Theorem 11.31]). Let a(x) ∈ L q m [x] be a linearized polynomial and let the extension eld F q s of F q m contain all roots of a(x). Then, its roots form a linear space over F q (a subspace of F q s ) and each root has the same multiplicity, which is a power of q.

The roots of a(x) form a linear space of dimension d r ≤ d a . Let {β 0 , β 1 , . . . , β dr-1 } be a basis of this d r -dimensional root space. Then, each distinct root r ∈ F q s of a(x) can be expressed uniquely as r = dr-1 i=0 R i β i , where R i ∈ F q , ∀i. Conversely, the following lemma shows that the unique minimal subspace polynomial is always a linearized polynomial.

Lemma 2.9 (Minimal Subspace Polynomial [LN96, Theorem 3.52]). Let U be a linear subspace of F m q , considered as a vector space over F q . Let u 0 , u 1 , . . . , u dim(U )-1 ∈ F q m be a basis of this subspace. Then, the minimal subspace polynomial

M u 0 ,u 1 ,...,u dim(U )-1 (x) def = u∈U x -ext -1 β (u) , 2 I C R M
is a linearized polynomial over F q m of q-degree dim(U ).

The q-Vandermonde matrix was introduced by Moore in [START_REF] Moore | A two-fold Generalization of Fermat's Theorem[END_REF] and plays an important role in linearized interpolation, evaluation and the q-transform. For a vector a = (a 0 a 1 . . . a n-1 ) ∈ F n q m , we obtain the s × n q-Vandermonde matrix by the following map:

qvan s : F n q m → F s×n q m a = (a 0 a 1 . . . a n-1 ) → qvan s (a) def =       a 0 a 1 . . . a n-1 a [1] 0 a [1] 1 . . . a [1] n-1 . . . . . . . . . . . . a [s-1] 0 a [s-1] 1 . . . a [s-1] n-1       .
(2.11)

Lemma 2.10 (Determinant of q-Vandermonde Matrix [LN96, Lemma 3.15]).

Let a = (a 0 a 1 . . . a n-1 ) ∈ F n q m . Then, the determinant of the square n × n q-Vandermonde matrix, de ned as in (2.11), is

det qvan n (a) = a 0 n-2 j=0 B 0 ,...,B j ∈Fq a j+1 - j h=0 B h a h .
Hence, det (qvan n (a)) = 0 if and only if a 0 , a 1 , . . . , a n-1 are linearly independent over F q . If a 0 , a 1 , . . . , a n-1 are linearly independent over F q , then qvan s (a) has rank min{s, n}.

Basic Operations

The usual multiplication of two linearized polynomials a(x) and b(x) is not necessarily a linearized polynomial. However, the (usual) addition and the composition a(b(x)) convert the set of linearized polynomials into a non-commutative ring with identity element x [0] = x. The linearized composition is often called symbolic product and will be denoted by a(x) • b(x) = a(b(x)). It is associative and distributive, but in general for a(x), b(x) ∈ L q m [x], it is non-commutative4 , i.e., a(b(x)) = b(a(x)).

Let d a and d b denote the q-degrees of a(x) and b(x), respectively. Then, the linearized composition c(x) = da+d b j=0 c j x [j] = a(b(x)) has q-degree at most d a + d b and its coe cients are:

c j = a(b(x)) j = j i=0 a i b [i] j-i , ∀j ∈ [0, d a + d b ],
(2.12) with a i = 0 for i > d a and b i = 0 for i > d b . When we consider the linearized composition modulo

(x [m] -x), i.e., c(x) = m-1 j=0 c j x [j] = a(b(x)) mod (x [m] -x) for d a , d b < m
, then its coe cients can be calculated by:

c j = a(b(x)) mod (x [m] -x) j = m-1 i=0 a i b [i] j-i = m-1 h=0 a j-h b [j-h] h , ∀j ∈ [0, m -1],
(2.13) with a i = 0 for i > d a and b i = 0 for i > d b and all indices are calculated modulo m. In Subsection 3.1.3, we will show that the composition of two linearized polynomials modulo (x [m]x) is equivalent to multiplying their associated evaluation matrices, which provides an e cient algorithm for calculating the linearized composition.

2.2 L P Ore showed in [Ore33a, Theorem 1] that for any two linearized polynomials a(x) and b(x) in L q m [x] with d a ≥ d b , there exist unique polynomials q R (x), r R (x) and q L (x), r L (x) such that a(x) = q R b(x) + r R (x) and a(x) = b q L (x) + r L (x),

(2.14)

where deg q r R (x), deg q r L (x) < d b . Determining q R (x) and r R (x) is called right linearized (or symbolic) division, where q R (x) is the right (linearized) quotient and r R (x) the right (linearized) remainder. Equivalently, nding q L (x) and r L (x) is called left linearized division. The right/left linearized division can be done by a recursive procedure (compare [Ore33a, p. 561]). Throughout this thesis, we denote the algorithmic calculation of this right/left linearized division by

q R (x); r R (x) ← R D a(x); b(x) and q L (x); r L (x) ← L D a(x); b(x) .
The right and left divisions are shown in the following two algorithms (compare [Ore33a, p. 561]), where the subscripts "R" and "L" for "right" and "left" are omitted.

Algorithm 2.1. q(x); r(x) ← R D a(x); b(x)

Input: a(x); b(x) = 0 ∈ L q m [x] with deg q a(x) ≥ deg q b(x) Initialize: i ← 1, a (1) (x) ← a(x) d b def = deg q b(x) 1 while d i ← deg q a (i) (x) ≥ d b do 2 q (i) (x) ← a (i) d i b [d i -d b ] d b • x [d i -d b ] 3 a (i+1) (x) ← a (i) (x) -q (i) (b(x)) 4 i ← i + 1 5 q(x) ← i-1 j=1 q (i) (x) 6 r(x) ← a (i) (x) Output: q(x); r(x)
Algorithm 2.2. q(x); r(x) ← L D a(x); b(x)

Input: a(x); b(x) = 0 ∈ L q m [x] with deg q a(x) ≥ deg q b(x) Initialize: i ← 1, a (1) (x) ← a(x) d b def = deg q b(x) 1 while d i ← deg q a (i) (x) ≥ d b do 2 q (i) (x) ← a (i) d i b d b [-d b ] • x [d i -d b ] 3 a (i+1) (x) ← a (i) (x) -b(q (i) (x)) 4 i ← i + 1 5 q(x) ← i-1 j=1 q (i) (x) 6 r(x) ← a (i) (x) Output: q(x); r(x)
Both algorithms terminate such that deg q r(x) < deg q b(x).

Since unique right/left linearized quotients and remainders always exist in F q m such that (2.14) holds (compare [Ore33a, Theorem 1]), there is a right and left linearized extended Euclidean algorithm (LEEA) in the non-commutative ring of linearized polynomials L q m [x]. Throughout this thesis, we consider only the right LEEA, which is given in Algorithm 2.3. The subscript "R" for quotients and remainders is omitted when there is no ambiguity.

Let r (-1) (x) = a(x) and r (0) (x) = b(x) be two linearized polynomials with deg q a(x) ≥ deg q b(x). The right LEEA with a stopping degree d stop > 0 calculates a linearized quotient q (i) (x) and linearized remainder r (i) (x) in each step i > 0 such that

r (i) (x) = r (i-2) (x) -q (i) r (i-1) (x) ,
(2.15) while deg q r (i-1) (x) ≥ d stop . In each of its steps, the q-degree of the remainders decreases, i.e., deg q r (i) (x) < deg q r (i-1) (x). If d stop = 1, the last non-zero remainder r (i-1) (x) = 0 is the right

i ← i + 1 Output: r out (x) ← r (i-1) (x); u out (x) ← u (i-1) (x); v out (x) ← v (i-1) (x)
The matrix-matrix multiplication for two matrices A = a i,j (x)

i∈[0,m-1] j∈[0,n-1] ∈ L q m [x] m×n and B = b i,j (x) i∈[0,n-1] j∈[0,l-1] ∈ L q m [x] n×l is a matrix C = A • B = c i,j (x) i∈[0,m-1] j∈[0,l-1] ∈ L q m [x] m×l with elements: c i,j (x) = n-1 h=0 a i,h b h,j (x) , ∀i ∈ [0, m -1], j ∈ [0, l -1].
In order to use matrix-matrix multiplication in the description of the LEEA, de ne the following matrices:

Q (i) def = 0 x [0] x [0] -q (i) (x) , Q (i,j) def = Q (i) • Q (i-1) • • • • • Q (j) , ∀i ≥ j ≥ 1. (2.16) Hence, Q (i,i) = Q (i)
. The recursion (2.15) of the LEEA can then be rewritten by:

r (i-1) (x) r (i) (x) = Q (i) • r (i-2) (x) r (i-1) (x) = Q (i,j) • r (j-2) (x) r (j-1) (x) = Q (i,1) • r (-1) (x) r (0) (x) .
(2.17) Further, we introduce auxiliary polynomials, needed for decoding Gabidulin codes. Let u (-1) (x) = 0,

u (0) (x) = x [0] and v (-1) (x) = x [0]
, v (0) (x) = 0 (see also Algorithm 2.3). Then, we calculate u (i) (x) and v (i) (x), for i > 0, recursively, similar to the remainders:

u (i-1) (x) u (i) (x) = Q (i) • u (i-2) (x) u (i-1) (x) , v (i-1) (x) v (i) (x) = Q (i) • v (i-2) (x) v (i-1) (x)
.

By means of these auxiliary polynomials u (i) (x), v (i) (x), each remainder can be rewritten as follows [Gab85, Equation (28)]:

r (i) (x) = v (i) a(x) + u (i) b(x) , ∀i ≥ 0.
(2.18)

2.2 L P Similar to (2.17), we obtain

u (i-1) (x) u (i) (x) = Q (i,1) • 0 x [0] , v (i-1) (x) v (i) (x) = Q (i,1) • x [0] 0 . (2.19)
Thus, it is su cient to calculate Q (j,1) if we want to determine r (j) (x), u (j) (x) and v (j) (x).

Connection to Linear Maps

Recall that Lemma 2.8 implies for any a(x)

∈ L q m [x] that a(A 1 b 1 + A 2 b 2 ) = A 1 a(b 1 ) + A 2 a(b 2
) holds for all A 1 , A 2 ∈ F q and for all b 1 , b 2 ∈ F q m . Hence, the linearized polynomial a(x) ∈ L q m [x] of q-degree d a < m induces an F q -linear map a from F q m to itself. The kernel of this map a is equivalent to the root space of a(x), i.e., ker(a) = {b ∈ F q m : a(b) = 0}, and can also be seen as the right kernel of an associated matrix A. This associated matrix can be obtained by evaluating a(x) at a basis B = {β 0 , β 1 , . . . , β m-1 } of F q m over F q and representing the result over F q , i.e.:

A def = ext β (a(β 0 ) a(β 1 ) . . . a(β m-1 )) ∈ F m×m q .
We call this matrix associated evaluation matrix in the following. The kernel of the map a, denoted by ker(a), is equivalent to the right kernel of A, denoted by ker(A). The rank nullity theorem relates the dimensions of the (right) kernel and the image (column space) of this matrix, respectively of this map:

dim(ker(a)) + dim(im(a)) = m.
Moreover, dim(im(a)) = rk(A).

The following lemma shows the connection between roots of a(x) and the rank of the associated matrix.

Lemma 2.11 (Root Space and Rank).

Let a(x) ∈ L q m [x] be a non-zero linearized polynomial of q-degree d a < m. Then, the rank of the associated evaluation matrix is rk(A) ≥ md a .

Proof. Since deg q a(x) = d a , it has at most q da roots in F q m and the dimension of the root space is at most d a . This root space is equivalent to the right kernel of A, hence, dim ker(A) ≤ d a . Due to the rank nullity theorem and since dim im(a) = rk(A), the statement follows.

The kernel of the map a is therefore the root space of a(x), represented as a vector space over F q . Consider now a second linearized polynomial b(x), then the composition b(a(x)) mod (x [m]x) is a linear map b(a), whose kernel includes the kernel of a. This is formally stated in the following lemma, which we use when decoding (interleaved) Gabidulin codes.

Lemma 2.12 (Row Space of Composition). Let a(x) and b(x) denote two linearized polynomials in L q m [x] with deg q a(x), deg q b(x) < m. Let c(x) = b(a(x)) and let B = {β 0 , β 1 , . . . , β m-1 } be a basis of F q m over F q . Let A = ext β (a(β 0 ) a(β 1 ) . . . a(β m-1 )) , C = ext β (c(β 0 ) c(β 1 ) . . . c(β m-1 )) .

C R M

Then, for the row spaces the following holds: R q (C) ⊆ R q (A) .

Proof. Consider the linearized polynomials as linear maps over F q m . Then, the kernel of the map a is equivalent to the roots of a(x) in F q m , considered as a vector space over F q . Since the roots of a(x) are also roots of c(x) = b(a(x)), the kernels are connected by ker(a) ⊆ ker(c). Hence, for the right kernels ker(A) ⊆ ker(C) holds, and the row spaces are related by R q (C) ⊆ R q (A).

The (Inverse) q-Transform

Gabidulin codes can be de ned either by means of evaluation and interpolation of linearized polynomials or by means of the q-transform. This subsection shows basic properties of the (inverse) q-transform. Lemma 2.3 guarantees that for any s dividing m, there is a normal basis in F q m of F q s over F q . For such a normal basis B N , the q-transform of a linearized polynomial a(x) is de ned as follows.

De nition 2.12 (q-Transform). Let a linearized polynomial a(x) = s-1 i=0 a i x [i] ∈ L q m [x] (or a vector a = (a 0 a 1 . . . a s-1 ) ∈ F s q m ) be given, where s | m, and let

B N = {β [0] , β [1] , . . . , β [s-1] }, for β ∈ F q m ,
be a normal basis of F q s over F q .

Then, the q-transform of a(x) with respect to B N is the linearized polynomial a(x) = s-1 j=0 a j x [j] (or the vector ( a 0 a 1 . . . a s-1 ) ∈ F s q m ), given by

a j = a β [j] = s-1 i=0 a i β [i+j] , ∀j ∈ [0, s -1].
(2.20)

Let ext β (a j ) def = (A 0,j A 1,j . . . A m-1,j ) T , with A i,j ∈ F q for i ∈ [0, m -1], denote the vector representation of a j ∈ F q m over F q according to De nition 2.1 using a basis of F q m over F q . As done in Subsection 2.1.2 for the multiplication of two elements, we can use the multiplication table T m ∈ F m×m q (compare De nition 2.2) to calculate the elements of the q-transform over the ground eld

F q . ext β ( a j ) = ext β a(β [j] ) = da i=0 ext β a i β [i+j] = da i=0 T T m • ext β (a i ) ↑i+j ↓i+j , (2.21)
where d a = deg q a(x) < s, i.e., a i = 0 for i > d a and a j can then be obtained by ext -1 β (ext β ( a j )). In order to switch between the polynomial and its transformed polynomial, we need an inverse mapping, called the inverse q-transform. The following theorem shows that we actually retrieve the original polynomial from its transform. In [START_REF] Silva | Fast Encoding and Decoding of Gabidulin Codes[END_REF] this was proved for the special case s = m.

Theorem 2.3 (Inverse q-Transform). Let a(x) = s-1 j=0 a j x [j] ∈ L q m [x] denote the q-transform of a(x) = s-1 i=0 a i x [i] ∈ L q m [x]
as in De nition 2.12, where s divides m, and

B N = {β [0] , β [1] , . . . , β [s-1] } is a normal basis in F q m of F q s 2.3 C R M over F q . Further, let B ⊥ N = {β ⊥ [0] , β ⊥ [1] , . . . , β ⊥ [s-1]
} be a normal basis, which is dual to B N . Then,

a i = a β ⊥ [i] = m-1 j=0 a j β ⊥ [j+i] , ∀i ∈ [0, s -1]. (2.22)
We call this the inverse q-transform of a(x) with respect to B ⊥ N .

Proof. The condition s | m guarantees that there exists a dual normal basis B ⊥ N (see Lemma 2.3). Let us denote the following two matrices:

B =      β [0] β [1] . . . β [s-1] β [1] β [2] . . . β [0]
. . . . . . . . . . . .

β [s-1] β [0] . . . β [s-2]      , B ⊥ =       β ⊥ [0] β ⊥ [1] . . . β ⊥ [s-1] β ⊥ [1] β ⊥ [2] . . . β ⊥ [0] . . . . . . . . . . . . β ⊥ [s-1] β ⊥ [0] . . . β ⊥ [s-2]       . ( 2
a ′ = (a ′ 0 a ′ 1 . . . a ′ s-1 ) = ( a 0 a 1 . . . a s-1 ) • B ⊥ = (a 0 a 1 . . . a n-1 ) • B • B ⊥ = a • B • B ⊥ .
Moreover, due to the de nition of the dual basis (compare (2.2)) and since Tr(

β [i] β ⊥[i] ) = Tr(ββ ⊥ ) [i] = Tr(ββ ⊥ ), we obtain: B • B ⊥ =       Tr(ββ ⊥ ) Tr(ββ ⊥ [1] ) . . . Tr(ββ ⊥ [s-1] ) Tr(β [1] β ⊥ ) Tr(β [1] β ⊥ [1] ) . . . Tr(β [1] β ⊥ [s-1] ) . . . . . . . . . . . . Tr(β [s-1] β ⊥ ) Tr(β [s-1] β ⊥ [1] ) . . . Tr(β [s-1] β ⊥ [s-1] )       =      1 1 . . . 1      .
Hence, a ′ = a, which proves the statement.

Recalling Subsection 2.2.3 shows that the q-transform and its inverse transform provide an e cient tool for switching between the map and its associated evaluated matrix. In terms of interpolation and evaluation, the inverse q-transform can be seen as the evaluation of a(x) at the dual normal basis. Equivalently, the determination of a(x) out of a(x) can be seen as the unique linearized univariate interpolation polynomial of q-degree less than s. In Subsection 3.2.2, we explain how to calculate this unique interpolation polynomial based on linearized Lagrange basis polynomials.

Codes in Rank Metric

Gabidulin codes, introduced by Delsarte [Del78], Gabidulin [Gab85] and Roth [START_REF] Roth | Maximum-Rank Array Codes and their Application to Crisscross Error Correction[END_REF], are so-called maximum rank distance (MRD) codes since they attain the Singleton-like upper bound with equality. Further, they are also maximum distance separable codes when considered as codes in Hamming metric.

In Subsection 2.3.1, we introduce the rank metric and show fundamental bounds as the Singleton-like and the Gilbert-Varshamov-like bound. We introduce the notation of MRD codes, de ne Gabidulin codes as the evaluation of degree-restricted linearized polynomials in Subsection 2.3.2, derive their minimum rank distance and show how generator and parity-check matrices can be constructed.

Interleaved Gabidulin codes are de ned in Subsection 2.3.3 and their minimum rank distance is proven. Finally, we brie y give basic notations of lifted Gabidulin codes, which constitute a special class of constant-dimension codes (Subsection 2.3.4).

C

R M

Rank Metric and its Properties

The mapping from De nition 2.1 plays a fundamental role in the context of rank-metric codes. It shows that for a given basis B of F q m over F q , there exists a bijective mapping for each vector a ∈ F n q m on a matrix A ∈ F m×n q . Based on this mapping, the rank weight and rank distance are de ned as follows. denote the matrix representations with respect to a basis B of F q m over F q according to De nition 2.1. The rank weight of a is the rank of its matrix representation over F q , i.e., wt R (a

) def = rk(a) = rk(A).
The rank distance between a and b is the rank of the di erence of the two matrix representations:

d R (a, b) def = rk(a -b) = rk(A -B).
Lemma 2.13 (Rank Distance is a Metric).

The rank distance as given in De nition 2.13 is a metric, ful lling the requirements from De nition 2.3. A sphere in rank metric of radius τ around a word a ∈ F n q m is the set of all words in rank distance exactly τ from a and a ball is the set of all words in rank distance at most τ from a. Such a sphere will be denoted by S can obviously be obtained by summing up the cardinalities of the spheres around a of radius from zero up to τ . The number of matrices of a certain rank is given for example in [START_REF] Migler | Weight and Rank of Matrices over Finite Fields[END_REF]. Therefore,

Proof. For any matrices

|S (τ ) R (a)| = m τ τ -1 j=0 (q n -q j ), |B (τ ) R (a)| = τ i=0 |S (i) R (a)| = τ i=0 m i i-1 j=0 (q n -q j ).
Note that the cardinalities of B Recall from De nition 2.4 that a block code over F q m of length n is a set of vectors in F n q m . The size of this set is the cardinality of the block code. A linear block code can be seen as a k-dimensional subspace of F n q m and its cardinality is M = q mk , where k denotes the dimension of the code. Analog to De nition 2.4, we denote a code in rank metric (not necessarily linear) over F q m of length n, cardinality M and minimum rank distance d by (n, M, d) R . A linear code in rank metric of length n, dimension k and minimum rank distance d is a special case of the aforementioned and is denoted by [n, k, d] R . The codewords of both can be seen as vectors in F n q m or equivalently as matrices in F m×n q . The minimum rank distance of a block code is de ned as follows.

C R M

De nition 2.14 (Minimum Rank Distance).

For a given (n, M, d) R block code C over F q m , the minimum rank distance is de ned by

d def = min c (1) ,c (2) ∈C c (1) =c (2) d R (c (1) , c (2) ) = rk(c (1) -c (2) ) .
Corollary 2.1 (Minimum Rank Distance of a Linear Code).

For a linear [n, k, d] R block code C, the minimum rank distance is the minimum rank weight:

d = min c∈C c =0 wt R (c) = rk(c) .
The following theorem shows how the minimum rank distance of a linear block code can be determined based on its parity-check matrix.

Theorem 2.4 (Minimum Rank Distance from Parity-Check Matrix [Gab85, Theorem 1]). Let the (nk) × n matrix H over F q m denote the parity-check matrix of a linear [n, k, d] R block code C over F q m . If and only if for any matrix A ∈ F (δ-1)×n q of rank δ -1 the following holds:

rk(AH T ) = δ -1,
and if there exists a matrix B ∈ F δ×n q of rank δ such that rk(BH T ) < δ, then C has minimum rank distance d = δ.

The maximum cardinality of a code of length n and minimum rank distance d over F q m is denoted by A R q m (n, d). On the one hand, A R q m (n, d) is an upper bound on the cardinality of any (n, M, d) R code over F q m , i.e., M ≤ A R q m (n, d). On the other hand, the de nition of the maximum cardinality A R q m (n, d) implies that an (n, M, d) R code of cardinality M = A R q m (n, d) exists. The following theorem states analogs of the sphere packing (Hamming) and Gilbert-Varshamov bound in rank metric, which can be proved similar to Hamming metric [GY06, Loi08, GY08b, Loi12].

Theorem 2.5 (Sphere Packing and Gilbert-Varshamov Bound in Rank Metric [START_REF] Gadouleau | Properties of Codes with the Rank Metric[END_REF]). Let A R q m (n, d) denote the maximum cardinality of an (n, M, d) R block code over F q m of length n and minimum rank distance d and let τ 0 = ⌊ (d-1) /2⌋. Then,

q mn |B (d-1) R (0)| ≤ A R q m (n, d) ≤ q mn |B (τ 0 ) R (0)| . (2.24)
The LHS of (2.24) is the Gilbert-Varshamov bound in rank metric and the RHS of (2.24) is the sphere packing bound in rank metric. The rank-metric Gilbert-Varshamov bound from [Loi08, Proposition 3] is slightly di erent from the one stated in [START_REF] Gadouleau | Properties of Codes with the Rank Metric[END_REF] and in Theorem 2.5. Note moreover that |B

(τ 0 ) R (0)| and |B (d-1) R (0)| are independent of their centers.
A code is called perfect in rank metric if it ful lls the RHS of (2.24) with equality. For a perfect code, the balls of radius τ 0 = ⌊ (d-1) /2⌋ around all codewords cover the whole space. However, in contrast to The Singleton bound in rank metric is given in the following theorem.

Theorem 2.6 (Singleton Bound in Rank Metric [Del78, Theorem 5.4]).

Let C be an (n, M, d) R code over F q m of length n, cardinality M and minimum rank distance d. The cardinality M of C is restricted by: M ≤ q min{n(m-d+1), m(n-d+1)} = q max{n,m}(min{n,m}-d+1) .

(2.25)

If the cardinality of a code ful lls (2.25) with equality, the code is called maximum rank distance (MRD) code. We denote an MRD (not necessarily linear) code over F q m of length n, cardinality M = q max{n,m}(min{n,m}-d+1) and minimum rank distance d by MRD(n, M ).

For linear codes of length n ≤ m and dimension k, Theorem 2.6 implies that d ≤ nk + 1, see also [Gab85, Corollary, p. 2]. A linear MRD code over F q m of length n ≤ m, dimension k and minimum rank distance d = nk + 1 is therefore denoted by MRD[n, k] and has cardinality M = q mk . If n > m, we simply transpose all matrices and apply the previous considerations. The complete (rank) weight distribution of MRD codes was derived in [Del78, Theorem 5.6] and [Gab85, Section 3].

A special class of rank-metric codes are q-cyclic codes, which can be seen as the analogs to cyclic codes in Hamming metric.

De nition 2.15 (q-Cyclic Code). Let C be an (n, M, d) R code over F q m of length n, cardinality M and minimum rank distance d. Then, this code is called q-cyclic if

(c [j] n-j c [j] n-j+1 . . . c [j] 0 c [j] 1 . . . c [j] n-j-1 ) ∈ C,
for any integer j and any codeword (c 0 c 1 . . . c n-1 ) ∈ C.

As we will see later, q-cyclic Gabidulin codes are a subclass of Gabidulin codes.

In order to introduce the notation, we also mention shortly constant-rank codes. A constant-rank code is a rank-metric code, where all codewords have the same rank. Such a constant-rank code over F q m of length n, minimum rank distance d, cardinality M and rank r is denoted by CR q m (n, M, d, r).

Gabidulin Codes

Gabidulin codes [Del78, Gab85, Rot91] are a special class of linear MRD codes and are often considered as the analogs of Reed-Solomon codes in rank metric. They are the main class of block codes in rank metric considered in this thesis.

In the following, we de ne Gabidulin codes as evaluation codes of degree-restricted linearized polynomials, prove that they are MRD codes and give their generator and parity-check matrices.

De nition 2.16 (Linear Gabidulin Code).

A linear Gabidulin code Gab[n, k] over F q m of length n ≤ m and dimension k ≤ n is the set of all words, which are the evaluation of a q-degree-restricted linearized polynomial f (x) ∈ L q m [x]:

Gab[n, k] def = (f (g 0 ) f (g 1 ) . . . f (g n-1 )) = f (g) : deg q f (x) < k ,
where the xed elements g 0 , g 1 , . . . , g n-1 ∈ F q m are linearly independent over F q .

C R M

Alternatively, we can de ne the codewords of Gab[n, k] as the inverse q-transform (see Theorem 2.3) of the evaluation polynomials f (x) of q-degree less than k. In order to do so, we need a normal basis5

B ⊥ N = {β ⊥ [0] , β ⊥ [1] , . . . , β ⊥ [n-1] } of F q n over F q .
Recall from Lemma 2.3 that such a normal basis exists in F q m if n divides m and clearly for n = m. The coe cients of the codewords can then be given by the inverse q-transform of f (x) as in Theorem 2.3:

c i = f β ⊥ [i] = n-1 j=0 f j β ⊥ [j+i] , ∀i ∈ [0, n -1].
(2.26)

De nition 2.16 and Equation (2.26) agree if we choose

g i = β ⊥ [i]
. However, the calculation of (2.26) is only possible if there is a normal basis in F q m of F q n over F q , which imposes a restriction on the length of the code. On the other hand, De nition 2.16-and also the de nitions based on generator/parity-check matrix, see (2.27) and (2.28)-is valid for any n ≤ m.

Clearly, a more general de nition of the (inverse) q-transform by using an arbitrary basis and its dual is the same as the evaluation/interpolation of a linearized polynomial. However, we use the name "q-transform" only together with a normal basis in order to indicate that this transform can be done with low complexity (see Subection 3.1.1).

Theorem 2.7 (Minimum Rank Distance of a Gabidulin Code). The minimum rank distance of a

Gab[n, k] Gabidulin code over F q m with n ≤ m is d = n -k + 1.
Proof. The evaluation polynomials f (x) have q-degree less than k and therefore the dimension of their root spaces over

F q m is at most k -1. Let C = ext β (c) ∈ F m×n q denote the representation of c ∈ Gab[n, k]
as in De nition 2.1. Since the evaluation of a linearized polynomial at a basis is an F q -linear map, it follows with Lemma 2.11 that the dimension of the right kernel of C ∈ F m×n q is equal to the dimension of the root space of the corresponding evaluation polynomial f (x). Therefore,

dim ker(c) ≤ k -1, ∀c ∈ Gab[n, k].
There is a codeword c in Gab[n, k] of rank d and due to the rank nullity theorem, for this codeword dim ker(c) = nd holds. Hence,

dim ker(c) = n -d ≤ k -1 ⇐⇒ d ≥ n -k + 1.
However, the Singleton-like bound (2.25) implies that d ≤ nk + 1 and hence, d = nk + 1.

Thus, Gabidulin codes are MRD codes.

Based on De nition 2.16, we can give the generator matrix of a Gabidulin code using the elements g 0 , g 1 , . . . , g n-1 ∈ F q m , which are linearly independent over F q .

G = qvan k ((g 0 g 1 . . . g n-1 )) =       g [0] 0 g [0] 1 . . . g [0] n-1 g [1] 0 g [1] 1 . . . g [1] n-1 . . . . . . . . . . . . g [k-1] 0 g [k-1] 1 . . . g [k-1] n-1       , (2.27)
since the evaluation of a linearized polynomial of q-degree less than k is the same as multiplying its coe cients with the aforementioned q-Vandermonde matrix. Let G be a generator matrix of a Gab[n, k] code as in (2.27), where g 0 , g 1 , . . . , g n-1 ∈ F q m are linearly independent over F q . Let h 0 , h 1 , . . . , h n-1 be a non-zero solution for the following n -1 linear equations:

n-1 i=0 g [j] i h i = 0, ∀j ∈ [-n + k + 1, k -1].
(2.28)

Then, the (n -k) × n matrix H = qvan n-k ((h 0 h 1 . . . h n-1 )) =       h [0] 0 h [0] 1 . . . h [0] n-1 h [1] 0 h [1] 1 . . . h [1] n-1 . . . . . . . . . . . . h [n-k-1] 0 h [n-k-1] 1 . . . h [n-k-1] n-1       , is a parity-check matrix of the Gab[n, k] code. Proof. Since the dual of a Gab[n, k] code is a Gab[n, n -k] code [Gab85, Theorem 3],
we have to prove that H is a generator matrix of this dual code, i.e., G • H T = 0 has to hold, which is equivalent to the following n -1 linear equations:

n-1 i=0 g [l] i h [j] i = 0, ∀l ∈ [0, k -1], j ∈ [0, n -k -1], ⇐⇒ n-1 i=0 g [j] i h i = 0, ∀j ∈ [-n + k + 1, k -1].
Therefore, if h 0 , h 1 , . . . , h n-1 are linearly independent over F q , H is a generator matrix of the dual code Gab[n, nk]. To prove this, denote g = (g

[-n+k+1] 0 g [-n+k+1] 1 . . . g [-n+k+1] n-1
). Then, (2.28) is equivalent to

qvan n-1 ( g) • (h 0 h 1 . . . h n-1 ) T = 0.
(2.29)

The matrix qvan n-1 ( g) is a parity-check matrix of a Gab[n, 1] code, since g

[-n+k+1] 0 , g [-n+k+1] 1 , . . . , g [-n+k+1] n-1
∈ F q m are linearly independent over F q . Hence, the vector

(h 0 h 1 . . . h n-1 ) is a codeword of the Gab[n, 1] code. This Gab[n, 1] code has minimum rank distance d = n-1+1 = n and therefore rk((h 0 h 1 . . . h n-1 )) = n. Thus, H is a generator matrix of the dual Gab[n, n -k]
code and therefore a parity-check matrix of the Gab[n, k] code.

The following lemma investigates q-cyclic Gabidulin codes.

Lemma 2.15 (q-cyclic Gabidulin Code).

Let g = (g 0 g 1 . . . g n-1 ) = (β ⊥[0] β ⊥[1] . . . β ⊥[n-1]
) be an ordered normal basis of F q n over F q and let Gab[n, k] be a Gabidulin code over F q m as in De nition 2.16.

Then, Gab[n, k] is q-cyclic as in De nition 2.15.

Proof. We have to show that for any integer j and any codeword c

= (c 0 c 1 . . . c n-1 ) ∈ Gab[n, k], the q-cyclic shift c = ( c 0 c 1 . . . c n-1 ) def = (c [j] n-j c [j] n-j+1 . . . c [j] 0 c [j] 1 . . . c [j] n-j-1 ) 2.3 C R M is also a codeword of Gab[n, k].
The coe cients of c (indices calculated modulo n) are given by:

c i = c [j] i-j = f (β ⊥[i-j] ) [j] = x [j] • f (x) x=β ⊥[i-j] = x [j] • f (x) • x [-j] x=β ⊥[i] , ∀i ∈ [0, n -1]. Therefore, for f (x) = k-1 i=0 f i x [i]
, we obtain:

f (x) def = x [j] • f (x) • x [-j] = f [j] 0 x [0] + f [j] 1 x [1] + • • • + f [j] k-1 x [k-1] , and deg q f (x) = deg q f (x) < k. Thus, c = ( c 0 c 1 . . . c n-1 ) = f (g) = f (β ⊥[0] ) f (β ⊥[1] ) . . . f (β ⊥[n-1] ) is a codeword of Gab[n, k].
Lemma 2.3 provides directly the following corollary.

Corollary 2.2 (Existence of q-cyclic Gabidulin Code).

A q-cyclic Gabidulin code Gab[n, k] of length n ≤ m and dimension k ≤ n over F q m as in Lemma 2.15 exists for any n dividing m.

Thus, when we recall (2.26), we see that de ning Gabidulin codes by the (inverse) q-transform yields q-cyclic Gabidulin codes. This property allows to reduce the complexity of encoding and decoding (see Section 3.2.4).

Lemma 2.16 (Parity Check Matrix of q-cyclic Gabidulin Code). Let Gab[n, k] be a q-cyclic Gabidulin code over F q m as in Lemma 2.15, where g = (β

⊥[0] β ⊥[1] . . . β ⊥[n-1] ) is an ordered normal basis of F q n over F q , n | m, and (β [0] β [1] . . . β [n-1] ) is a dual normal basis to g. Then, for h def = (β [k] β [k+1] . . . β [k+n-1] ), the (n -k) × n matrix H = qvan n-k (h) =      β [k] β [k+1] . . . β [k-1] β [k+1] β [k+2] . . . β [k] . . . . . . . . . . . . β [n-1] β [0] . . . β [n-2]      , is a parity-check matrix of the Gab[n, k] code.
Proof. The proof follows from the proof of Theorem 2.3: Let H consist of the last nk rows of B (de ned as in (2.23) with s = n) and let G T be the n × k submatrix of B ⊥ (de ned as in (2.23) with s = n), consisting of the rst k columns of B ⊥ . Then, G is exactly the generator matrix from (2.27) and

H • G T = 0 as shown in the proof of Theorem 2.3. Since h = (β [k] β [k+1] . . . β [k+n-1]
) consists of n linearly independent elements, H is a paritycheck matrix of this Gab[n, k] code.

Interleaved Gabidulin Codes

Interleaved Gabidulin codes can be seen as s horizontally or vertically arranged codewords of (not necessarily di erent) Gabidulin codes. We consider vertically interleaved Gabidulin codes in this thesis. However, if an application requires matrices with the dimensions of a horizontally interleaved Gabidulin code, we can simply transpose the codewords of the vertically interleaved code. Known decoding approaches and a new interpolationbased decoding approach for interleaved Gabidulin codes are considered in Chapter 4.

De nition 2.17 (Interleaved Gabidulin Code).

Let g = (g 0 g 1 . . . g n-1 ), where g 0 , g 1 , . . . , g n-1 ∈ F q m are linearly independent over F q . A linear (vertically) interleaved Gabidulin code IGab[s; n, k (1) , . . . , k (s) ] over F q m of length n ≤ m, elementary dimensions k (1) , . . . , k (s) ≤ n and interleaving order s is de ned by

IGab[s; n, k (1) , . . . , k (s) ] def =               c (1) c (2)
. . .

c (s)      =      f (1) (g) f (2) (g) . . . f (s) (g)      : deg q f (i) (x) < k (i) ≤ n, ∀i ∈ [1, s]          . For s = 1, this de nes a usual Gabidulin code Gab[n, k] = IGab[1; n, k].
Using the map ext β from De nition 2.1, we can either represent the codewords of the interleaved code as a vector in F n q ms , a matrix in F s×n q m or over the ground eld as a matrix in F sm×n q . Throughout this thesis, we will use any representation, whatever is more convenient and indicate which one is meant if there are ambiguities. This is illustrated in Figure 2.2.

Analog to interleaved Reed-Solomon codes, we call an interleaved Gabidulin code homogeneous if all elementary dimensions are equal, i.e., if

k (i) = k, ∀i ∈ [1, s].
Lemma 2.17 (Homogeneous Interleaved Gabidulin Codes are MRD). Let IGab[s; n, k, . . . , k] be a linear interleaved Gabidulin code over F q m as in De nition 2.17 with

k (i) = k, ∀i ∈ [1, s]. Its minimum distance is d = n -k + 1 and it is an MRD code.
Proof. On the one hand, any non-zero codeword of IGab[s; n, k, . . . , k] contains at least one non-zero codeword of a Gabidulin code Gab[n, k] and therefore, d ≥ nk + 1. On the other hand,

     c (1) 0 . . . 0      ∈ IGab[s; n, k, . . . , k]. We can choose c (1) ∈ Gab[n, k] such that rk(c (1) ) = n -k + 1 and therefore the minimum distance of IGab[s; n, k, . . . , k] is exactly d = n -k + 1 and it is an MRD code.
For arbitrary elementary dimensions, we can use the same reasoning and the minimum distance of

IGab[s; n, k (1) , . . . , k (s) ] is d = n -max i {k (i) } + 1. Notice that this is no MRD code.
Known decoding approaches and a new interpolation-based decoding approach for interleaved Gabidulin codes is described in Chapter 4.

2.3 C R M c ∈ F n q ms → c (1) c (2) . . . c (s) ∈ F s×n q m → C (2) C (1)
. . .

C (s) ∈ F sm×n q Figure 2.2.
Representations of codewords of an interleaved Gabidulin code of length n and interleaving order s.

Lifted Gabidulin Codes

This subsection will give a brief de nition of a special class of constant-dimension codes, constructed by lifted Gabidulin codes. These constant-dimension codes are used in Chapter 5 to establish bounds on list decoding block rank-metric codes. Constant-dimension codes and, more general, codes in the projective space were thoroughly investigated e.g. in [WXS03, KK08, XF09, ES09, Ska10, EV11, Sil11, BVP13, ES13]. As de ned in Subsection 2.1.1, let F n q denote the vector space of dimension n over the nite eld F q , P q (n) the projective space and G q (n, r) the Grassmannian of dimension r.

A distance measure for codes in the projective space is the so-called subspace distance. For two subspaces U , V in P q (n), we denote by U + V the smallest subspace containing the union of U and V. The subspace distance between U , V in P q (n) is de ned by

d s (U , V) = dim(U + V) -dim(U ∩ V) = 2 dim(U + V) -dim(U ) -dim(V).
(2.30)

It can be shown that the subspace distance is indeed a metric (see e.g., [KK08, Lemma 1]) and it is connected to the so-called injection distance d i as follows (see [SK09b, Equation (28)]):

d i (U , V) = 1 2 d s (U , V) + 1 2 dim(U ) -dim(V) . (2.31)
Throughout this thesis, we will use the subspace distance as a distance measure between subspaces.

A code in the projective space (also called subspace code) is a non-empty collection of subspaces of P q (n), i.e., each codeword is a subspace. A constant-dimension code (also called Grassmannian code) is a special subspace code, where each codeword has the same dimension. Let CD q (n, M, d s , r) denote a constant-dimension code in G q (n, r) with cardinality M and minimum subspace distance d s . This code is therefore a subset of the Grassmannian G q (n, r).

For constant-dimension codes, (2.31) shows that the minimum injection distance is half the minimum subspace distance. Further details can be found e.g., in [START_REF] Khaleghi | Subspace Codes[END_REF], which provides a survey (up to the year 2009) on codes in the projective space and constant-dimension codes.

The lifting of a block code de nes a constant-dimension code as follows.

2 I C R M

De nition 2.18 (Lifting of a Matrix or a Code).

Consider the mapping

lift : F r×(n-r) q → G q (n, r) X → R q ([I r X]) ,
where I r denotes the r × r identity matrix. The subspace lift(X) = R q ([I r X]) is called lifting of the matrix X. If we apply this map on all codewords (in matrix representation) of a block code C, then the constant-dimension code lift(C) is called lifting of C.

The following lemma shows the properties of a lifted linear MRD code.

Lemma 2.18 (Lifted MRD Code). Let a linear MRD[r, k] code C over F q n-r of length r ≤ n -r, minimum rank distance d = r -k + 1 and cardinality M R = q (n-r)k be given.
Then, the lifting of the transposed codewords, i.e.

lift(C T ) def = lift(C T ) = R q [I r C T ] : C ∈ C is a CD q (n, M s , d s , r) constant-dimension code of cardinality M s = M R = q (n-r)k , minimum subspace distance d s = 2d
and lies in the Grassmannian G q (n, r).

Proof. Let C i ∈ F (n-r)×r q , ∀i ∈ [1, M R ], denote the codewords of C in matrix representation. The dimension of each subspace lift(C T i ) is r since rk([I r C T i ]) = r, for all i ∈ [1, M R ].
The cardinality of this constant-dimension code is the same as the cardinality of the MRD code, which is M R = q (n-r)k . The subspace distance of the constant-dimension code is two times the rank distance of the MRD code (see [SKK08, Proposition 4]) since for any two C 1 , C 2 ∈ C with (2.30):

d s (lift(C T 1 ), lift(C T 2 )) = 2 dim lift(C T 1 ) + lift(C T 2 ) -dim lift(C T 1 ) -dim lift(C T 2 ) = 2 rk I r C T 1 I r C T 2 -2r = 2 rk I r C T 1 0 C T 2 -C T 1 -2r = 2 rk(I r ) + rk(C T 2 -C T 1 ) -2r = 2 rk(C 2 -C 1 ) = 2d R (C 1 , C 2 ).
CHAPTER 3

Decoding Approaches for Gabidulin Codes D G mostly rely on the similarities to Reed-Solomon codes and are therefore equivalents of well-known decoding algorithms in Hamming metric. The rst bounded minimum distance (BMD) decoding algorithm by Gabidulin [Gab85] is based on solving a key equation with the linearized extended Euclidean algorithm (LEEA) and can be seen as an equivalent of the Sugiyama-Kasahara-Hirasawa-Namekawa decoding algorithm for Reed-Solomon and Goppa codes [START_REF] Sugiyama | A Method for Solving Key Equation for Decoding Goppa Codes[END_REF]. The oldest decoding principle for Reed-Solomon codes is the Peterson-Gorenstein-Zierler approach [START_REF] Peterson | Encoding and Error-Correction Procedures for the Bose-Chaudhuri Codes[END_REF][START_REF] Gorenstein | A Class of Error-Correcting Codes in p m[END_REF]. A similar algorithm for Gabidulin codes was introduced in 1991 by Roth [START_REF] Roth | Maximum-Rank Array Codes and their Application to Crisscross Error Correction[END_REF] and independently also by Gabidulin in 1992 [START_REF] Gabidulin | A Fast Matrix Decoding Algorithm for Rank-Error-Correcting Codes[END_REF]. In this approach, the solution to the key equation is found by solving a linear system of equations based on the syndrome coe cients.

Due to its e cient use of shift-register synthesis, the Berlekamp-Massey algorithm [Ber68, Mas69] is probably the most established decoding algorithm for Reed-Solomon and cyclic codes. A linearized equivalent of it was given by Paramonov and Tretjakov [START_REF] Paramonov | An Analogue of Berlekamp-Massey Algorithm for Decoding Codes in Rank Metric[END_REF] and Richter and Plass [START_REF] Richter | Error and Erasure Decoding of Rank-Codes with a Modied Berlekamp-Massey Algorithm[END_REF][START_REF] Richter | Fast Decoding of Rank-Codes with Rank Errors and Column Erasures[END_REF]. The proof of this algorithm was given later by Sidorenko, Richter and Bossert in [START_REF] Sidorenko | Linearized Shift-Register Synthesis[END_REF].

While the previously mentioned approaches solve a key equation and return an error-span polynomial, interpolation-based decoders directly output the evaluation polynomial of a codeword. A Welch-Berlekamp-like decoder [START_REF] Welch | Error Correction for Algebraic Block Codes[END_REF] for interpolation-based BMD decoding of Gabidulin codes was presented by Loidreau in 2006 [START_REF] Loidreau | A Welch-Berlekamp Like Algorithm for Decoding Gabidulin Codes[END_REF][START_REF] Loidreau | Mémoire d'habilitation à diriger des recherches[END_REF].

Apart from increasing the decoding radius of Gabidulin codes (which is considered in some sense in Chapters 4 and 5), the research interest lies in accelerating BMD decoding algorithms [SK09a, HS10, SB12, WAS13, SWC12] and in error-erasure decoding [START_REF] Silva | A Rank-Metric Approach to Error Control in Random Network Coding[END_REF][START_REF] Silva | Error Control for Network Coding[END_REF][START_REF] Gabidulin | Error and Erasure Correcting Algorithms for Rank Codes[END_REF][START_REF] Li | On Transform-Domain Decoding of Gabidulin Codes[END_REF].

This chapter deals with e cient decoding of Gabidulin codes. First, in Section 3.1, we present new methods to accomplish e cient calculations with linearized polynomials. Second, Section 3.2 brie y explains known decoding approaches for Gabidulin codes and presents a new BMD decoding algorithm, which is based on solving a transformed key equation with the LEEA and directly outputs the evaluation polynomial of the estimated codeword. Finally, we establish how this algorithm can be accelerated and generalize it for error-erasure decoding.

The results of Subsections 3.1.2 and 3.1.4 were partly published in [START_REF] Wachter | A Fast Linearized Euclidean Algorithm for Decoding Gabidulin Codes[END_REF] and the results from Subsections 3.1.3, 3.2.2 and 3.2.4 in [WAS11, WAS13].

Fast Algorithms for Linearized Polynomials

E cient implementations of operations with linearized polynomials are essential in order to develop fast decoding algorithms for codes in rank metric, in particular for (interleaved) Gabidulin codes. Throughout this thesis, the computational complexity is considered as operations (multiplications and additions) in F q m or in F q , where the corresponding eld will be indicated.

D

A

G C Subsection 3.1.1 explains the complexity of known approaches and states some problems, which are treated in the subsequent subsections. In Subsections 3.1.2 and 3.1.3, we present fast algorithms for calculating the linearized composition and in Subsection 3.1.4, we give a fast equivalent of the LEEA based on the Divide & Conquer strategy.

Complexity of Known Approaches and Overview of New Approaches

A summary of e cient calculations in nite elds using normal bases is given in Table 3.1. Further, Table 3.2 provides an overview of the complexity of standard implementations for operations with linearized polynomials. As a last part of this subsection, we state some problems concerning e cient operations of linearized polynomials, which are picked up in the following subsections.

Operations with Normal Bases

Throughout this thesis, we assume that we can switch between the representation of a vector in F q m and a matrix in F q (i.e., the map from De nition 2.1) without any cost. Recall Section 2.1.2 about normal bases, where we showed in (2.3) that a q-power of an element a ∈ F q m corresponds to a cyclic shift of ext β (a) ∈ F m×1 q , when a normal basis is used. Hence, the complexity of q-powers is negligible whenever we consider a normal basis representation.

The addition a + b of a, b ∈ F q m can be implemented by ext

β (a) + ext β (b) ∈ F m×1 q in O(m) operations over F q .
The product a • b of any two elements a, b ∈ F q m can be calculated as in (2.4), showing that ext β (a • b) ∈ F m×1 q can be obtained by m multiplications of a vector in F m×1 q with the multiplication table T m and summing these m resulting vectors up (times a scalar in F q ). Since T m has comp(T m ) non-zero entries, the multiplication of T m with a vector costs comp(T m ) operations over F q and the whole calculation of ext β (a

• b) costs O(m comp(T m )) ≥ O(m 2 ) operations in the ground eld F q .
If one of the two multiplied elements is a basis element, e.g. b = β [j] , and we want to compute a • β [j] , then (2.5) shows that the summation step from (2.4) disappears and the complexity is reduced to O(comp(T m )) operations over F q .

For the calculation of the (inverse) q-transform of a linearized polynomial a(x) ∈ L q m [x] of q-degree Table 3.1. Complexity of operations in nite elds using normal bases.

Operation Notation Method Complexity

q-power of a ∈ F q m a [i] Eq. (2.3), p. 8 negligible Addition of a, b ∈ F q m a + b ext β (a) + ext β (b) O(m) in F q Multiplication of a, b ∈ F q m a • b Eq. (2.4), p. 9 O(m comp(T m )) in F q Multiplication of a, β [j] ∈ F q m , where β [j] ∈ B N a • β [j]
Eq. (2.5), p. 9

O(comp(T m )) in F q q-transform of a(x) ∈ L q m [x] with deg q a(x) = d a < s, s | m a(x) Eq. (2.21), p. 22 O(d a d a comp(T m )) ≤ O(s 2 comp(T m )) in F q Inv. q-transform of a(x) ∈ L q m [x] with deg q a(x) = d a < s, s | m a(x) analog to Eq. (2.21), p. 22 O(d a d a comp(T m )) ≤ O(s 2 comp(T m )) in F q 3.1 F A L P d a < s (see De nition 2.
12 and Theorem 2.3) recall (2.21), which shows how to obtain the coe cients of the transformed polynomial a(x) = d a j=0 a j x [i] , represented as vectors over F q . For each coe cient a j , we calculate d a + 1 ≤ s times the product of an element a i ∈ F q m and a basis element β [i+j] as in (2.5). Hence, the calculation a j for j ∈ [0,

d a ] requires O(d a d a comp(T m )) ≤ O(s 2 comp(T m ))
operations over F q . The calculation of the inverse q-transform can be done analogously to (2.21). To our knowledge, this e cient calculation of the (inverse) q-transform was rst observed in [START_REF] Silva | Fast Encoding and Decoding of Gabidulin Codes[END_REF].

Table 3.1 summarizes the complexity of the mentioned operations using normal bases.

Operations with Linearized Polynomials

Let M(d a , d b ) denote the complexity of calculating the composition of two linearized polynomials, i.e.,

a(b(x)) ∈ L q m [x] with d a = deg q a(x) and d b = deg q b(x).
The straight-forward calculation of the coe cients of a(b(x)) can be done as in (2.12), where the calculation of all coe cients requires

da+d b j=0 (j + 1) = da+d b +1 j=1 j = (d a + d b + 1)(d a + d b + 2) 2 ∼ O (d a + d b ) 2
additions and multiplications over F q m , when we assume again that q-powers are negligible. The complexity of calculating the linearized composition modulo (x [m]x) as in (2.13) requires therefore at most O(m 2 ) operations in F q m and is denoted by

M m (m) = O(m 2 ) over F q m .
The right/left linearized division can be calculated as in Algorithm 2.1 and 2.2, respectively, and its complexity for two linearized polynomials a

(x), b(x) ∈ L q m [x] is denoted by D(d a , d b ). The standard implementations from Algorithm 2.1 and 2.2, for d a ≥ d b , terminate after at most d a -d b + 1 iterations.
The complexity of each iteration is dominated by the linearized composition in Line 3. Since q (i) (x) has only one non-zero coe cient, Line 3 can be computed with d b + 1 multiplications of elements in F q m . Hence, the complexity of the linearized division is

D(d a , d b ) = O((d a -d b )d b ) operations in F q m .
The standard implementation of the LEEA from Algorithm 2.3 for two input polynomials a

(x), b(x) ∈ L q m [x] with d a ≥ d b requires O(d 2
a ) operations over F q m (see [START_REF] Gadouleau | Complexity of Decoding Gabidulin Codes[END_REF]). In detail, this complexity also depends on the stopping degree d stop , but the order of the complexity is independent of d stop , and therefore we do not analyze this dependency in detail here.

Table 3.2 shows an overview of these standard implementations for linearized polynomials.

(x), b(x) ∈ L q m [x] a(b(x)) Eq. (2.12), p. 18 M(d a , d b ) = O((d a + d b ) 2 ) in F q m Linearized composition modulo (x [m] -x) a(b(x)) mod (x [m] -x) Eq. (2.13), p. 18 M m (m) = O(m 2 ) in F q m Linearized division of a(x), b(x) ∈ L q m [x] with d a ≥ d b R D a(x); b(x) L D a(x); b(x) Algo. 2.1, p. 19 Algo. 2.2, p. 19 D(d a , d b ) = O((d a -d b )d b )in F q m LEEA of a(x), b(x) ∈ L q m [x] with d a ≥ d b R LEEA a(x); b(x); d stop Algo. 2.3, p. 20 O EA (d a , d b ) = O(d 2 a ) in F q m 3 D A G C

Problem Statement and Overview of New Approaches

The following subproblems provide the starting point of the remainder of this section.

Problem 3.1 (Fast Linearized Operations). Let a(x), b(x) ∈ L q m [x] with d a = deg q a(x) and d b = deg q b(x) be given. (a) Fast Linearized Composition. Let n = max{d a , d b } + 1. Find a linearized polynomial c(x) = a(x) • b(x) = a(b(x)), see also (2.12), with complexity M(d a , d b ) < O(n 2 ) operations in F q m . (b) Fast Linearized Composition modulo (x [m] -x). Let d a < m, d b < m. Find a linearized polynomial c(x) ≡ a(x) • b(x) = a(b(x)) mod (x [m] -x), see also (2.13), with complexity M m (m) < O(m 2 ) operations in F q m . (c) Fast Linearized Multi-Point Evaluation. Let d a < m and let the s points b 0 , b 1 , . . . , b s-1 ∈ F q m , where s | m, be given. Find the s evaluation values a(b 0 ), a(b 1 ), . . . , a(b s-1 ) with complexity less than O(m 2 ) operations in F q m . (d) Fast Linearized Euclidean Algorithm. Let d a ≥ d b . Find the output of R LEEA a(x); b(x); d stop , Algorithm 2.3, for some d a > d stop ≥ d a /2, with complexity O EA (d a , d b ) < O(d 2 a ) operations in F q m .
As a preview, Table 3.3 provides an overview of our new algorithms which give solutions to the aforementioned problems and are explained and proven in detail in the following subsections.

In order to compare the di erent algorithms, recall Table 3.1 to compare operations in F q m with operations in F q . An addition of two elements in F q m costs O(m) operations in F q and a multiplication of two elements in F q m can be realized with O(m comp(T m )) operations in F q . If there exists a low-complexity normal basis of F q m over F q , this multiplication can be done with O(m 2 ) operations in F q and therefore, any operation in F q m can be implemented with at most O(m 2 ) operations in F q .

Hence, Algorithm 3.1 for calculating a(b(x)) mod (x [m]x) costs at most O(m 1.69 ) operations over F q m and can be realized in O(m 3.69 ) operations over F q .

If we want to compare Algorithm 3.1 and Algorithm 3.3 for calculating the linearized composition, we rst have to remark that Algorithm 3.1 can also calculate the linearized composition without modulo. However, when we use low-complexity normal bases, Algorithm 3.3 is more e cient for calculating the linearized composition modulo (x [m]x). Moreover, the complexity improvement is achieved also for small polynomials whereas the complexity of Algorithm 3.1 is only valid for large polynomials since the fast matrix multiplication (by the Coppersmith-Winograd algorithm) is only e cient for large matrices.

Notice that there are also asymptotically faster algorithms for realizing one operation over F q m in F q and therefore, it depends on the concrete implementation, which algorithm for the linearized composition is faster.

F

A L P

(x), b(x) ∈ L q m [x] a(b(x)) Algo. 3.1, p. 39, Subsec. 3.1.2 M(d a , d b ) = O((max{d a , d b }) 1.69 ) in F q m Linearized composition of a(x), b(x) ∈ L q m [x] modulo (x [m] -x) a(b(x)) mod (x [m] -x) Algo. 3.1, p. 39, Subsec. 3.1.2 M m (m) = O(m • (max{d a , d b }) 0.69 ) ≤ O(m 1.69 ) in F q m Algo. 3.3, p. 42, Subsec. 3.1.3 M m (m) = O(max{d a , s}m comp(T m )) ≤ O(m 2 comp(T m )) in F q Linearized multi-point evaluation of a(x) ∈ L q m [x] at b 0 , b 1 , . . . , b s-1 ∈ F q m , where s | m a(b 0 ), . . . , a(b s-1 ) Algo. 3.2, p. 41, Subsec. 3.1.3 O(max{d a , s}m comp(T m )) ≤ O(m 2 comp(T m )) in F q First half of LEEA of a(x), b(x) ∈ L q m [x] with d a > d b F H LEEA a(x); b(x); d stop Algo. 3.4, p. 45, Subsec. 3.1.4 O EA (d a , d b ) = O max{D(d a , d b ), M(d a , d b )} log d a in F q m 3.1.

Fast Linearized Composition Using Fragmented Polynomials

In this subsection, we present a fast algorithm that calculates the linearized composition a(b(x))

with complexity M(d a , d b ) = O(max{d a , d b } 1.69 ) operations in F q m instead of O((d a + d b ) 2
) as in (2.12). The approach is based on splitting a(x) into smaller linearized polynomials and on fast matrix multiplication. A similar fragmentation was used in [BK78, Algorithm 2.1] for calculating the composition of power series. We explain the idea of the fast composition in the following, summarize it in Algorithm 3.1 and prove its complexity. Our algorithm provides a solution to Problem 3.1 (a) of calculating the linearized composition e ciently. A solution to Problem 3.1 (b) follows directly and is stated in Corollary 3.1.

Let the assumptions of Problem 3.1 (a) be satis ed and let

n * def = ⌈ √ n ⌉ = max{d a , d b } + 1 . We fragment a(x) = da j=0 a j x [j]
into n * smaller polynomials a (i) (x) of q-degree less than n * :

a (i) (x) = n * -1 j=0 a in * +j x [in * +j] , ∀i ∈ [0, n * -1], (3.1) with a h = 0 if h > d a . Therefore, a(x) = n * -1 i=0 a (i) (x) = n * -1 i=0 n * -1 j=0 a in * +j x [in * +j] .
The following lemma shows how a(b(x)) can be calculated by one (fast) matrix multiplication.

3 D A G C Lemma 3.1 (Calculation by Matrix Multiplication). Let two linearized polynomials a(x) = da i=0 a i x [i] , b(x) = d b i=0 b i x [i] ∈ L q m [x] be given and let n * = max{d a , d b } + 1 . Denote c(x) = a(b(x))
and let a (i) (x) be de ned as in (3.1). Let c (i) (x) = a (i) (b(x)), for all i ∈ [0, n * -1], and denote the coe cients of c (i) (x) by

c (i) (x) = d b +n * -1 j=0 c (i) j x [in * +j] . Then, c(x) = n * -1 i=0 c (i) (x)
and the coe cients of (c

(i) (x)) [-in * ]
, for all i ∈ [0, n * -1], are given by the following matrix multiplication:

       c (0) 0 c (0) 1 . . . c (0) d b +n * -1 c (1)[-n * ] 0 c (1)[-n * ] 1 . . . c (1)[-n * ] d b +n * -1 . . . . . . . . . . . . c (n * )[-(n * -1)n * ] 0 c (n * )[-(n * -1)n * ] 1 . . . c (n * )[-(n * -1)n * ] d b +n * -1        = A • B def = (3.2)       a 0 a 1 . . . a n * -1 a [-n * ] n * a [-n * ] n * +1 . . . a [-n * ] 2n * -1 . . . . . . . . . . . . a [-n * (n * -1)] (n * -1)n * a [-n * (n * -1)] (n * -1)n * +1 . . . a [-n * (n * -1)] n * n * -1       •        b [0] 0 b [0] 1 . . . b [0] d b b [1] 0 b [1] 1 . . . b [1] d b . . . . . . . . . b [n * -1] 0 . . . b [n * -1] d b        . Proof. Since a(x) = n * -1 i=0 a (i) (x), we immediately obtain c(x) = n * -1 i=0 c (i) (x)
and it remains to prove the calculation of the coe cients of c(x) as in (3.2). Note that (a(x)

) [h] = a [h] (x) = da i=0 a [h]
i x [h+i] for any a(x) ∈ L q m [x] and any integer h. Hence, with (3.1), we obtain ∀i ∈ [0, n * -1]:

c (i) (x) [-in * ] = a (i)[-in * ] (b(x)) = n * -1 j=0 a [-in * ] in * +j •b [in * +j-in * ] (x) = n * -1 j=0 a [-in * ] in * +j • d b h=0 b [j] h x [j+h] .
The important observation is that the expression in the sum over h does not depend on i. The coe cients of (c (i) (x)) [-in * ] are therefore:

(c

(i)[-in * ] 0 c (i)[-in * ] 1 . . . c (i)[-in * ] d b +n * -1 ) = (a [-in * ] in * a [-in * ] in * +1 . . . a [-in * ] in * +n * -1 ) • B, ∀i ∈ [0, n * -1],
where the n * × (d b + n * ) matrix B is de ned as in (3.2). Since B is independent of i, we can write the calculations for all i as matrix multiplication and the statement follows.

Hence, we obtain the coe cients of (c (i) (x)) [-in * ] by the matrix multiplication from (3.2) and the coe cients of c (i) (x) from (c (i) (x)) [-in * ] by a simple q-power. Finally, we sum up over i to obtain the linearized composition c

(x) = a(b(x)) = n * -1 i=0 c (i) (x)
. This principle is summarized in Algorithm 3.1 and the complexity is analyzed in Theorem 3.1.

Theorem 3.1 (Linearized Composition with Algorithm 3.1). Let two linearized polynomials a

(x) = da i=0 a i x [i] , b(x) = d b i=0 b i x [i] ∈ L q m [x] be given. Then, Algorithm 3.1 calculates c(x) = a(b(x)) with complexity M(d a , d b ) = O((max{d a , d b }) 1.69 ) operations in F q m and
is therefore a solution to Problem 3.1 (a).

F A L P

Proof. Lemma 3.1 proves that Algorithm 3.1 correctly calculates c(x) = a(b(x)). The complexity of Algorithm 3.1 is analyzed in the following, where we denote again n = max{d a , d b } + 1.

• Line 1: The complexity of this step is negligible since it only splits the polynomial a(x).

• Line 2: The complexity of q-powers is negligible (see Section 3.1.1).

• Line 3: This step dominates the overall complexity of Algorithm 3.1 and can be accomplished by a fast matrix multiplication as follows.

We split the

n * × (d b + n * ) matrix B into ⌈(d b + n * )/n * ⌉ ≤ ⌈ √ n + 1⌉ ≤ √ n + 2 ≤ max{d a , d b } + 3
( √ n N (n * )) = O( √ n N ( √ n)) = O(n 0.5 (n 0.5 ) 2.376 ) = O(n 1.69 ) operations in F q m .
• Line 4: The q-powers are again negligible.

• Line 5: Since consecutive c (i) (x) overlap at most in d b coe cients, the overall sum requires at most n * • d b ≤ n * • n = n 1.5 additions over F q m , i.e., this step has complexity O(n 1.5 ) in F q m . The overall complexity of Algorithm 3.1 is therefore dominated by the matrix multiplication and is

M(n) = O(n 1.69 ) = O((max{d a , d b }) 1.69 ) operations in F q m . Algorithm 3.1. c(x) ← F L C a(x); b(x) Input: a(x); b(x) ∈ L q m [x] with deg q a(x) = d a , deg q b(x) = d b Initialize: n * ← max{d a , d b } + 1 1 Fragmentation (see (3.1)): a (i) (x) ← n * -1 j=0 a in * +j x [in * +j] , for all i ∈ [0, n * -1] 2 Calculate q-powers: a [-n * i] j , for all j ∈ [0, d a ] and i ∈ [1, n * -1] b [i] j , for all j ∈ [0, d b ] and i ∈ [0, n * -1] 3 Set up matrices A and B as in (3.2) and calculate A • B 4 Calculate q-powers: obtain c (i) (x) out of (c (i) (x)) [-in * ] , for all i ∈ [0, n * -1] 5 Summation: c(x) = n * -1 i=0 c (i) (x) Output: c(x) = a(b(x)) ∈ L q m [x] with deg q c(x) = d a + d b
In order to apply Algorithm 3.1 to Problem 3.1 (b), we replace B by a q-circulant matrix.

Corollary 3.1 (Linearized Composition modulo (x [m] -x) with Algorithm 3.1). Let two linearized polynomials a(x) = da i=0 a i x [i] , b(x) = d b i=0 b i x [i] ∈ L q m [x] with d a , d b < m be given. Replace the n * × (d b + n * ) matrix B in Line 3 of Algorithm 3.1 by the following n * × m matrix B m =        b [0] 0 b [0] 1 b [0] 2 . . . b [0] m-1 b [1] m-1 b [1] 0 b [1] 1 . . . b [1] m-2 . . . . . . . . . . . . . . . b [n * -1] m-n * +1 b [n * -1] m-n * +2 b [n * -1] m-n * +3 . . . b [n * -1] m-n *        , with b i def = 0 for i > d b . 3 D A G C Then, Algorithm 3.1 calculates c(x) = a(b(x)) mod (x [m] ] -x) with complexity M m (m) = O(m(max{d a , d b }) 0.69 ) ≤ O(m 1.69 ) operations in F q m and
is therefore a solution to Problem 3.1 (b).

The complexity of Algorithm 3.1 might be further reduced when we use a fast matrix multiplication algorithm which takes advantage of the fact that B and B m are highly structured matrices.

Fast Linearized Composition Using Fast Multi-Point Evaluation

This subsection provides an algorithm for e ciently calculating the linearized multi-point evaluation as well as an algorithm for fast linearized composition modulo (x [m]x). The complexity of both algorithms is in the order of O(m 3 ) over the ground eld F q .

The following theorem provides the basis of the algorithms presented in this subsection and can be seen as an equivalent of the convolutional theorem for linearized polynomials1 .

Theorem 3.2 (Transformed Values of Composition). Let two linearized polynomials a(x) = da i=0 a i x [i] , b(x) = d b i=0 b i x [i] ∈ L q m [x] be given. If possible, let s be an integer such that d a + d b < s and s divides m. If such an integer does not exist, let s = m. Let b(x) = s-1 i=0 b i x [i] denote the q-transform of b(x) with respect to an ordered normal basis β = (β [0] β [1] . . . β [s-1] ) in F q m of
F q s over F q according to De nition 2.12. Moreover, let

c(x) ≡ a(b(x)) mod (x [m] -x),
and let c(x) = s-1 i=0 c i x [i] denote its q-transform with respect to β. Then,

c i = a b i , ∀i ∈ [0, s -1].
Proof. If an integer s exists which divides m and additionally,

d a + d b < s, we obtain c(x) = a(b(x)) mod (x [m] -x) = a(b(x)) mod (x [s] -x).
Clearly, this holds also if s = m. Since s | m, there is a normal basis in F q m of F q s over F q (Lemma 2.3). Due to De nition 2.12, the transformed coe cients are c i = c(β [i] ) and b i = b(β [i] ) for all i ∈ [0, s -1]. For d a + d b < s, the modulo operation is useless and for s = m, we know that β [m] = β holds and the modulo operation is implicitly included. Hence,

c i = c(β [i] ) = a(b(β [i] )) = a b i .
Theorem 3.2 indicates that a fast linearized composition can be realized by fast linearized multi-point evaluation. Hence, nding a solution to Problem 3.1 (c) is considered as the rst task on the way to fast linearized composition. An algorithm for fast linearized multi-point evaluation is of general interest, e.g. for encoding Gabidulin codes with g i = β [i] . The following lemma shows how we can use a matrix multiplication over the ground eld F q to accomplish this multi-point evaluation.

Lemma 3.2 (Multi-Point Evaluation with Matrices). Let a linearized polynomial a(x) ∈ L q m [x] with d a = deg q a(x) < m and s points b 0 , b 1 , . . . , b s-1 ∈ F q m be given, for some s dividing m. Let a(x) = m-1 i=0 a i x [i] denote the q-transform of a(x) with respect to an ordered normal basis β = (β [0] β [1] . . . β [m-1] ) of F q m over F q . Denote ext β ( a i ) = ( A 0,i A 1,i . . . A m-1,i ) T , ∀i ∈ [0, m -1], ext β ( b i ) = ( B 0,i B 1,i . . . B m-1,i ) T , ∀i ∈ [0, s -1]. 3.1 F A L P
Then, for A ∈ F m×m q and B ∈ F m×s q , the extension of the multi-point evaluation is given by:

ext β (a( b 0 ) a( b 1 ) . . . a( b s-1 )) = A • B def =      A 0,0 A 0,1 . . . A 0,m-1 A 1,0 A 1,1 . . . A 1,m-1 . . . . . . . . . . . . A m-1,0 A m-1,1 . . . A m-1,m-1      •      B 0,0 B 0,1 . . . B 0,s-1 B 1,0 B 1,1 . . . B 1,s-1 . . . . . . . . . . . . B m-1,0 B m-1,1 . . . B m-1,s-1      . (3.3) Proof. Since B [i] = B
for any B ∈ F q and all i, we can rewrite the evaluation values by:

a( b i ) = a m-1 j=0 B j,i • β [j] = m-1 j=0 B j,i • a β [j] , ∀i ∈ [0, s -1].
Hence, all s evaluation values can be calculated by the following vector-matrix multiplication:

a( b 0 ) a( b 1 ) . . . a( b s-1 ) = a(β [0] ) a(β [1] ) . . . a(β [m-1] ) • B.
Due to the de nition of the q-transform,

a(β [i] ) = a i = m-1 j=0 A j,i • β [j] , ∀i ∈ [0, m -1].
Therefore, the evaluation values are (a

( b 0 ) a( b 1 ) . . . a( b s-1 )) = β • A • B.
When the number of evaluation points s does not divide m, we pad with zeros until the number of points divides m. Lemma 3.2 is connected to considering a(x) as an F q -linear map as in Subection 2.2.3 and looking at its associated matrix. Similar transform-based ideas were used in [START_REF] Gabidulin | Kodirovanie v Radioelektronike (Coding in Radio Electronics)[END_REF]. Thus, Problem 3.1 (c) of linearized multi-point-evaluation can be solved e ciently by the following Algorithm 3.2.

It is important to remark that the q-transform in Line 1 of Algorithm 3.2 is done with regard to a basis of F q m over F q (and not of F q s over F q ), even if d a < s, since this is required by the proof of Lemma 3.2. Proof. Due to Theorem 3.2 and Lemma 3.2, Algorithm 3.2 returns the correct result. For the complexity, let us analyze the steps of Algorithm 3.2 in detail.

Algorithm 3.2. (a( b 0 ) a( b 1 ) . . . a( b s-1 )) ←F L M E a(x); { b 0 , b 1 , . . . , b s-1 }; β Input: a(x) ∈ L q m [x] with deg q a(x) = d a < m; b 0 , b 1 , . . . , b s-1 ∈ F q m ; normal basis β = (β [0] β [1] . . . β [m-1] ) of F q m over F q 1 Calculate q-transform of a(x) w.r.t. to β: obtain a i = a(β [i] ), i = [0, m -1] as in (2.21) 2 Calculate ext β ( a i ) and ext β ( b j ) for all i ∈ [0, m -1], j ∈ [0, s -1] 3 Set up matrices A and B as in (3.3) and calculate a ← β • A • B Output: a = (a( b 0 ) a( b 1 ) . . . a( b s-1 )) ∈ F s q m 3 D A G C Lemma 3.3 (Linearized Multi-Point Evaluation with Algorithm 3.2). Let a linearized polynomial a(x) ∈ L q m [x] with d a = deg q a(x) < m and the s points b 0 , b 1 , . . . , b s-1 ∈ F q m ,
• Line 1: The q-transform of length m for a polynomial of q-degree d a costs O(md a comp(T m )) operations in F q (compare Table 3.1). • Line 2: The mapping ext β (De nition 2.1) requires no cost.

• Line 3: A is an m × m matrix and B is an m × s matrix over F q and therefore with straightforward matrix multiplication, this step costs O(sm 2 ) operations in F q . Thus, Algorithm 3.2 requires overall complexity O(max{d a , s}m comp(T m )) in F q .

Based on Theorem 3.2 and Algorithm 3.2, we can calculate the linearized composition e ciently. This is shown in Algorithm 3.3, which computes the composition c(x) = a(b(x)) mod (x [m]x) in three main steps. It relies on the fact that c i = a( b i ) as proven in Theorem 3.2.

Algorithm 3.3. c(x) ← F L C T a(x); b(x); β Input: a(x); b(x) ∈ L q m [x] with deg q a(x) = d a , deg q b(x) = d b ; normal basis β = (β [0] β [1] . . . β [m-1] ) of F q m over F q
Initialize: De ne transform length:

if ∃i : i | m and d a + d b < i then s ← i else s ← m Find normal basis β s = (β [0] s β [1] s . . . β [s-1] s
) of F q s over F q and its dual basis β ⊥ s 1 Calculate the q-transform of b(x) w.r.t. to β s : obtain b i = b(β [i] ), for all i ∈ [0, s -1], as in (2.21)

2 Multi-point evaluation:

( c 0 c 1 . . . c s-1 ) ← F L M E a(x); { b 0 , b 1 , . . . , b s-1 }; β with Algorithm 3.2 3 De ne linearized polynomial c(x) = s-1 i=0 c i x [i] 4 Calculate inverse q-transform of c(x) w.r.t. to β ⊥ s : c i = c(β ⊥ s [i] ), for all i ∈ [0, s -1], as in (2.22) Output: c(x) = a(b(x)) mod (x [m] -x) ∈ L q m [x] with deg q c(x) ≤ min{d a + d b , m -1}
We assume in the following that the ordered normal bases β and β s are known and therefore, nding these bases requires no additional complexity. Proof. The correctness of the result of Algorithm 3.3 follows from Theorem 3.2 and Lemma 3.2.

Lemma 3.4 (Linearized Composition modulo (x [m] -x) with Algorithm 3.3). Let a(x) = da i=0 a i x [i] and b(x) = d b i=0 b i x [i] with d a ,
For the complexity, we analyze the steps of Algorithm 3.3 in the following.

• Line 1: The rst step is a q-transform of length s and requires therefore O(sd b comp(T m )) operations in F q (compare Table 3.1). • Line 2: The call of Algorithm 3.2 costs O(max{d a , s}m comp(T m )) operations in F q (Lemma 3.3).

• Line 3: This step has negligible complexity.

• Line 4: The last step is an inverse q-transform of length s and costs at most O(s 2 comp(T m ))

operations in F q , since deg q c(x) < s (compare Table 3.1). Hence, the overall complexity of Algorithm 3.3 is in the order of O( max{d a , s}m comp(T m )) ≤ O(m 2 comp(T m )) operations in F q . Algorithm 3.3 establishes a connection between the linearized composition and matrix multiplication. This relation can also be used vice versa: assume, two matrices A, B ∈ F m×m q are given; represent them as vectors in F n q m , calculate their inverse q-transforms and compute the composition of the corresponding linearized polynomials. The q-transform of this result is the matrix multiplication A • B. Thus, provided that (inverse) q-transforms are e cient, matrix multiplication and the linearized composition are equivalent. Linearized composition faster than matrix multiplication would imply a major breakthrough in matrix multiplication. Therefore, it is quite unlikely to nd an algorithm for the linearized composition faster than Algorithm 3.3 (up to using a faster matrix multiplication algorithm).

Fast Linearized (Extended) Euclidean Algorithm

In the following, we derive an e cient LEEA (see Algorithm 2.3 for the standard algorithm), which is a generalization of the fast extended Euclidean algorithm for usual polynomials by Aho and Hopcroft [START_REF] Aho | The Design and Analysis of Computer Algorithms[END_REF] and Blahut [START_REF] Blahut | Fast Algorithms for Digital Signal Processing[END_REF]. Our fast LEEA is based on the so-called Divide & Conquer strategy, which splits a problem of "size" n into two halves, each of "size" n/2. The structure of these halves should be the same as the original problem. The calculation can be accelerated if there exist fast solutions for the halved problems and if they can be combined with low complexity [START_REF] Aho | The Design and Analysis of Computer Algorithms[END_REF][START_REF] Blahut | Fast Algorithms for Digital Signal Processing[END_REF][START_REF] Gathen | Modern Computer Algebra[END_REF].

In order to break the LEEA into two halves, recall from (2.16) that we can write

Q (i,1) = Q (i,h+1) • Q (h,1) , for any integer 1 ≤ h ≤ i -1. Calculating Q (i,i) = Q (i)
is equivalent to one step of the LEEA as in (2.15). The rst half of the splitted LEEA hence consists of the rst h iterations and outputs Q (h,1) . The second uses Q (h,1) as input and considers the problem of calculating Q (i,h+1) . To reduce the complexity, Q (i,h+1) and Q (h,1) have to be calculated e ciently. For that purpose, we use the fact that the rst calculations of the LEEA only depend on some leading coe cients of the input polynomials.

Theorem 3.3 (Upper Coe cients of the Input Polynomials of the LEEA).

Let a(x), b(x) ∈ L q m [x], with q-degrees d a ≥ d b be given. Split these polynomials into two parts:

a(x) = a ′ x [h] + a ′′ (x), b(x) = b ′ x [h] + b ′′ (x), (3.4) 3 D A G C for some h, satisfying 0 ≤ h ≤ 2d b -d a . Let q(x), r(x) and q ′ (x), r ′ (x) ∈ L q m [x] with deg q r(x) < d b and deg q r ′ (x) < deg q b ′ (x) be de ned such that a(x) = q b(x) + r(x), a ′ (x) = q ′ b ′ (x) + r ′ (x). (3.5) Then, q(x) = q ′ (x), r(x) = r ′ x [h] + r ′′ (x), for some r ′′ (x) ∈ L q m [x] with deg q r ′′ (x) < h + d a -d b .
Proof. The proof can be found in Appendix A.1.

Therefore, Theorem 3.3 shows that if h ≤ 2d bd a , the quotient polynomial q(x) does not depend on the h lower coe cients of a(x) and b(x). Further, these h lower coe cients in uence only the h + d ad b lowest coe cients of the remainder r(x). The following lemma shows that about half of the iterations of the LEEA can be calculated correctly without knowing r ′′ (x).

Lemma 3.5 (Quotients in the Iterations of the LEEA). Let a(x), b(x) ∈ L q m [x], with q-degrees d a ≥ d b be given and let them be fragmented into smaller polynomials as in

(3.4) with 0 ≤ h ≤ 2d b -d a . Let Q (i) and Q ′(i) denote the matrices as in (2.16) in step i of R LEEA a(x); b(x); d stop and R LEEA a ′ (x); b ′ (x); d ′ stop , respectively. Then,
Q (i) = Q ′(i) (3.6)
for each i where

deg q r ′(i) (x) ≥ (d a -h)/2 and r ′(i) (x) is the remainder in step i of R LEEA a ′ (x); b ′ (x); d ′ stop .
Proof. The proof is similar to the proof of [Bla85, Theorem 10.7.3].

A fast realization of the whole LEEA can be given based on Lemma 3.5 and consists of two parts as in [START_REF] Blahut | Fast Algorithms for Digital Signal Processing[END_REF]. However, for decoding, we only need the rst steps of the LEEA-sometimes even less than half of the iterations. The acceleration of the rst steps of the LEEA is given in Algorithm 3. Recall from (2.17) and (2.19) that when we know Q (h,1) , we can immediately calculate r (h) (x), u (h) (x) and v (h) (x). For this reason, Algorithm 3.4 outputs only Q (h,1) .

As typical for Divide & Conquer algorithms, Algorithm 3.4 consists of two halves (Lines 1-9 and Lines 10-21). Each of these two halves implies a recursive call. The rst recursive call is done in Line 8 with truncated polynomials. Then in Line 11, one linearized division is done, which is necessary to obtain the quotients in the recursions. In Lines 17-18, the polynomials are again truncated and the second recursive call follows in Line 20.

Assume, Q is the output of Algorithm 3.4, then we can calculate as in (2.17):

r (j-1) (x) r (j) (x) = Q • a(x) b(x) . (3.7)
These polynomials r (j-1) (x), r (j) (x) satisfy the following lemma.

3.1 F A L P Lemma 3.6 (Degree of Output of Algorithm 3.4).

Let Q ← F H LEEA a(x); b(x); d stop be the output of Algorithm 3.4 for some d a > d stop ≥ d a /2, where d a = deg q a(x) ≥ deg q b(x). Let r (j-1) (x) and r (j) (x) ∈ L q m [x] be as in (3.7). Then, deg q r (j-1) (x) ≥ d stop and deg q r (j) (x) ≤ d stop .

(3.8)

Proof. The proof can be found in Appendix A.1.

Algorithm 3.4. Q ← F H LEEA a(x); b(x); d stop Input: a(x); b(x) ∈ L q m [x] with d a = deg q a(x) ≥ d b = deg q b(x); stopping degree d stop , where d a > d stop ≥ d a /2 1 if d b ≤ d stop then 2 Q ← x 0 0 x 3 else 4 h ← ⌊d a /2⌋ 5 a (1) (x) ← a(x) -(a(x) mod x [h] ) ⊗ x [-h] 6 b (1) (x) ← b(x) -(b(x) mod x [h] ) ⊗ x [-h] 7 d (1) stop ← dstop da • deg q a (1) (x) 8 Recursive Call: Q (1) ← F H LEEA a (1) (x); b (1) (x); d (1) stop 9 a(x) b(x) ← Q (1) ⊗ a(x) b(x) 10 if deg q b(x) > dstop da • deg q a(x) then 11 q(x); r(x) ← R D a(x); b(x) with Algorithm 2.1 12 Q ← 0 x x -q(x) 13 a(x) b(x) ← Q ⊗ a(x) b(x) 14 Q ← Q ⊗ Q (1) 15 if deg q b(x) > dstop da • deg q a(x) then 16 h ← dstop(da-deg q a(x)) da-dstop 17 a (1) (x) ← (a(x) -(a(x) mod x [h] )) ⊗ x [-h] 18 b (1) (x) ← (b(x) -(b(x) mod x [h] )) ⊗ x [-h] 19 d (1) stop ← dstop da • deg q a (1) (x) 20 Recursive Call: Q (1) ← F H LEEA a (1) (x); b (1) (x); d (1) stop 21 Q ← Q (1) ⊗ Q Output: Q ∈ L q m [x] 2×2
Hence, Algorithm 3.4 outputs the matrix Q, which provides the last remainder of q-degree at least the stopping degree d stop . The degree constraints in Lines 10 and 15 of Algorithm 3.4 correspond

3 D A G C
to improvements from [START_REF] Gustavson | Fast Algorithms for Rational Hermite Approximation and Solution of Toeplitz Systems[END_REF][START_REF] Brent | Fast Solution of Toeplitz Systems of Equations and Computation of Padé Approximants[END_REF]. They remarked that without these degree constraints, the algorithms by Aho and Hopcroft [START_REF] Aho | The Design and Analysis of Computer Algorithms[END_REF] and Blahut [START_REF] Blahut | Fast Algorithms for Digital Signal Processing[END_REF] do not work properly. Our Algorithm 3.4 is a generalization of the algorithms by [START_REF] Aho | The Design and Analysis of Computer Algorithms[END_REF][START_REF] Blahut | Fast Algorithms for Digital Signal Processing[END_REF], considering the improvements from [START_REF] Gustavson | Fast Algorithms for Rational Hermite Approximation and Solution of Toeplitz Systems[END_REF][START_REF] Brent | Fast Solution of Toeplitz Systems of Equations and Computation of Padé Approximants[END_REF].

It is equivalent to their algorithms if the stopping degree is d stop = d a /2 and if m = 1, i.e., if we consider the eld F q , since then A [i] = A for all elements A ∈ F q .

Lemma 3.7 (Complexity of Algorithm 3.4).

O EA (d a , d b ) ≤ 2 • O EA (d a /2, d b /2) + M(d a , d b ) + D(d a , d b ).
It is known from the master theorem for linear recurrence relations (see e.g. [START_REF] Gathen | Modern Computer Algebra[END_REF]) that this inequality implies

O EA (d a , d b ) ≤ O(max{M(d a , d b ), D(d a , d b )} log d a ).
Using fast linearized composition, this results in the following corollary. Corollary 3.2 shows therefore that a fast linearized division would immediately provide a fast LEEA.

Decoding of Gabidulin Codes

Decoding of Gabidulin codes can generally be accomplished by two di erent principles: syndromebased decoding (which relies on solving a key equation) as in [Gab85, Rot91, PT91, Gab92, RP04a] and interpolation-based decoding as in [START_REF] Loidreau | A Welch-Berlekamp Like Algorithm for Decoding Gabidulin Codes[END_REF].

In the course of this section, we rst describe a known syndrome-based decoding principle of Gabidulin codes (Subsection 3.2.1) and second, we derive a new decoding algorithm in Subsection 3.2.2, which can be seen as the rank-metric equivalent of Gao's algorithm for decoding Reed-Solomon codes [START_REF] Gao | A New Algorithm for Decoding Reed-Solomon Codes[END_REF]. Further, we show in Subsection 3.2.3 how this algorithm can be extended to error-erasure decoding of Gabidulin codes and how it can be accelerated based on the q-transform (Subsection 3.2.4). The results of Subsections 3.2.2 and 3.2.4 were partly published in [WAS11, WAS13].

Known Syndrome-Based Decoding Approaches

Following the descriptions of [Gab85, Rot91, Gab92], we explain the idea of syndrome-based BMD decoding (as de ned in Section 2.1.3), without going into detail about the di erent algorithmic possibilities.

Let r = c + e ∈ F n q m be the received word, where c ∈ Gab[n, k]. The goal of decoding is now to reconstruct c, given only r and the code parameters. Clearly, this is possible only if the rank of the

3.2 D G C
error e is not too big. Syndrome-based BMD decoding of Gabidulin codes follows similar steps as syndrome-based BMD decoding of Reed-Solomon codes. For Reed-Solomon codes, the two main steps are determining the "error locations" and nding the "error values", where the second step is considered to be much easier. Algebraic BMD decoding of Gabidulin codes also consists of two steps; however, the second one is not necessarily the easier one. The starting point of decoding Gabidulin codes is to decompose the error, based on the well-known rank decomposition of a matrix.

Lemma 3.8 (Rank Decomposition [MS74, Theorem 1]).

For any matrix X ∈ F m×n q of rank r there exist full rank matrices Y ∈ F m×r q and Z ∈ F r×n q such that X = YZ. Moreover, the column space of X is C q (X) = C q (Y) ∈ G q (m, r) and the row space is R q (X) = R q (Z) ∈ G q (n, r).

Therefore, we can rewrite the matrix representation of e with rk(e) = t by:

E = ext β (e) = A • B, with A ∈ F m×t q , B ∈ F t×n q ,
and if we de ne

a def = ext -1 β (A) ∈ F t q m : e = ext -1 β (E) = ext -1 β (A) • B = a • B = (a 0 a 1 . . . a t-1 ) • B. (3.9)
This decomposition is clearly not unique, but any of them is good for decoding. The two main steps of decoding Gabidulin codes are therefore: rst, determine "a basis of the column space" of the error, i.e., nd the vector a of a possible decomposition, and second, nd the corresponding matrix B, which xes the row space2 . Both steps are based on the syndrome, which can be calculated out of the received word (see De nition 2.8) by

s = (s 0 s 1 . . . s n-k-1 ) = r • H T = e • H T , (3.10)
where H is a parity-check matrix of the Gab[n, k] code (see (2.14)). We denote the associated syndrome polynomial by s(x)

= n-k-1 i=0 s i x [i] ∈ L q m [x]
. Its coe cients are:

s i = n-1 j=0 e j h [i] j = n-1 j=0 t-1 l=0 a l B l,j h [i] j def = t-1 l=0 a l d [i] l , ∀i ∈ [0, n -k -1], (3.11)
with

d l def = n-1 j=0 B l,j h j .
(3.12)

We de ne the error span polynomial as the minimal subspace polynomial of the vector a:

Λ(x) def = M a 0 ,a 1 ,...,a t-1 (x) = q-1 B 0 =0 • • • q-1 B t-1 =0 x - t-1 i=0 B i a i . (3.13)
Hence, due to Lemma 2.9, the error span polynomial Λ(x) is a linearized polynomial of q-degree t and any F q -linear combination of roots of Λ(x) is also a root of Λ(x).

The rst part of the decoding process is to determine Λ(x), given the syndrome polynomial s(x), and it is strongly based on the following theorem, the key equation for decoding Gabidulin codes. Let r = c + e ∈ F n q m be given, where c ∈ Gab[n, k] over F q m and rk(e) = t < nk. Denote by s = (s 0 s 1 . . . s n-k-1 ) = r • H T ∈ F n-k q m the syndrome as in (3.10) and by s(x) = n-k-1 i=0 s i x [i] its associated polynomial.

Let the error span polynomial Λ(x) with deg q Λ(x) = t be de ned as in (3.13), where a = (a 0 a 1 . . . a t-1 ) is a basis of the column space of e. Then,

Ω(x) ≡ Λ(s(x)) = Λ(x) • s(x) mod x [n-k] ,
(3.14)

for some Ω(x) ∈ L q m [x] with deg q Ω(x) < t.
Proof. With (2.12) and (3.11), the i-th coe cient of Λ(s(x)) can be calculated by

Ω i def = Λ(s(x)) i = i j=0 Λ j s [j] i-j = i j=0 Λ j t-1 l=0 a l d [i-j] l [j] = t-1 l=0 d [i] l i j=0 Λ j • a [j]
l .

(3.15)

For any i ≥ t this gives:

Ω i = t-1 l=0 d [i] l Λ a l = 0, ∀i ∈ [t, n -k -1 -1], (3.16) since Λ(x) has a i , ∀i ∈ [0, t -1],
as roots, see (3.13), and therefore deg q Ω(x) < deg q Λ(x) = t.

Alternatively, we can derive a key equation for the row space of the error word (compare e.g. [START_REF] Silva | Fast Encoding and Decoding of Gabidulin Codes[END_REF]).

Theorem 3.5 (Row Space Key Equation for Decoding Gabidulin Codes).

Let r = c + e ∈ F n q m be given, where c ∈ Gab[n, k] over F q m and rk(e) = t < nk. Denote by s = (s 0 s 1 . . . s n-k-1 ) = r • H T ∈ F n-k q m the syndrome as in (3.10) and by s(x) = n-k-1 i=0 s i x [i] its associated polynomial.

Let the row error span polynomial be Γ(x) = M d 0 ,d 1 ,...,d t-1 (x) with deg q Γ(x) = t, where d i is de ned as in (3.12), ∀i ∈ [0, t -1]. Further, let

s i = s [i-n+k+1] n-k-1-i , ∀i ∈ [0, n -k -1]
(3.17)

and s(x) = n-k-1 i=0 s i x [i] . Then, Φ(x) ≡ Γ( s(x)) mod x [n-k] , (3.18
)

for some Φ(x) ∈ L q m [x] with deg q Φ(x) < t.
Proof. From (2.12) and (3.12), we obtain

s i = t-1 l=0 a [i-n+k+1] l d l . (3.19)
The i-th coe cient of the linearized composition Γ( s(x)) can then be calculated by

Φ i def = Γ( s(x)) i = i j=0 Γ j s [j] i-j = i j=0 Γ j t-1 l=0 a [i-j-n+k+1] l d l [j] = t-1 l=0 a [i-n+k+1] l i j=0 Γ j • d [j]
l .

D G C

For any i ≥ t this gives:

Φ i = t-1 l=0 a [i-n+k+1] l Γ d l = 0, ∀i[t, n -k -1 -1],
since Γ(x) has all d i , ∀i ∈ [0, t -1], as roots and therefore deg q Φ(x) < deg q Γ(x) = t.

Based on the key equation from Theorem 3.4, we explain the di erent steps of the standard decoding process of Gabidulin codes in the following and summarize them in Algorithm 3.5. Similar steps have to be accomplished when we solve the row space key equation instead of the column space key equation.

Syndrome Calculation

As mentioned before, the rst step of decoding Gabidulin codes is calculating the syndrome based on a parity-check matrix H ∈ F (n-k)×n q m and the received word r ∈ F n q m :

s = (s 0 s 1 . . . s n-k-1 ) = r • H T = e • H T ∈ F (n-k) q m .

Solving the Key Equation

The direct way to nd Λ(x) is to solve a linear system of equations based on the key equation (3.14). Due to (3.15) and (3.16):

Ω i = i j=0 Λ j s [j] i-j = t j=0 Λ j s [j] i-j = 0, ∀i[t, n -k -1 -1].
This is equivalent to the following homogeneous linear system of equations:

     Ω t Ω t+1 . . . Ω n-k-1      =       s [0] t s [1] t-1 . . . s [t] 0 s [0] t+1 s [1] t . . . s [t] 1 . . . . . . . . . . . . s [0] n-k-1 s [1] n-k-2 . . . s [t] n-k-1-t       •      Λ 0 Λ 1 . . . Λ t      = 0. (3.20)
If the dimension of the solution space of (3.20) is one, then any solution of (3.20) provides the coe cients of the error span polynomial Λ(x), de ned as in (3.13), except for a scalar factor. This scalar factor does not pose a problem, since it does not change the root space. The following lemma provides a criterion to obtain the actual number of errors out of the syndrome matrix, see [Gab92, Lemma, p. 132].

Lemma 3.9 (Rank of Syndrome Matrix).

Let r = c+e ∈ F n q m , where c ∈ Gab[n, k] and rk(e) = t ≤ ⌊ (n-k) /2⌋ and let (s 0 s 1 . . . s n-k-1 ) ∈ F n-k q m
denote the corresponding syndrome. Then, for any u ≥ t, the u × (u + 1) matrix

S (u) def =       s [0] u s [1] u-1 . . . s [u] 0 s [0] u+1 s [1] u . . . s [u] 1 . . . . . . . . . . . . s [0] 2u-1 s [1] 2u-2 . . . s [u] u-1       (3.21) 3 D A G C
has full rank u if and only if u = t, where the i-th row of S (u) is de ned to be all-

zero if i + u > n -k -1, ∀i = [0, u -1].
Proof. Since there are nk non-zero syndrome coe cients, we can provide only nku non-zero rows of S (u) . Therefore, for u > ⌊ (n-k) /2⌋, the matrix S (u) has only nku < u non-zero rows and therefore rank less than u. Let a i , d i = 0 for i ≥ t. For u ≤ ⌊ (n-k) /2⌋, we can decompose S (u) with (3.11) as follows:

S (u) =       d [u] 0 d [u] 1 . . . d [u] u-1 d [u+1] 0 d [u+1] 1 . . . d [u+1] u-1 . . . . . . . . . . . . d [2u-1] 0 d [2u-1] 1 . . . d [2u-1] u-1       •       a [0] 0 a [1] 0 . . . a [u] 0 a [0] 1 a [1] 1 . . . a [u] 1 . . . . . . . . . . . . a [0] u-1 a [1] u-1 . . . a [u] u-1       .
Both matrices are q-Vandermonde matrices and due to Lemma 2.10, they both have full rank if and only if d 0 , d 1 , . . . , d u-1 and a 0 , a 1 , . . . , a u-1 are sets of elements which are linearly independent over F q . If u > t, this is not true, since a i , d i = 0 for i ≥ t. If u = t this is true and the left matrix is a square matrix of rank u and the right is a u × (u + 1) matrix of rank u. Since the rst u columns of the right matrix constitute a matrix of rank u, the statement follows.

Thus, Lemma 3.9 proves that for t ≤ ⌊ (d-1) /2⌋ = ⌊ (n-k) /2⌋, S (t) has full rank and the dimension of the solution space of (3.20) is one. For the algorithmic realization, we can set up S (u) for u = ⌊ (d-1) /2⌋ and check its rank. If the rank is not full, we decrease u by one, control the rank, and so on, until we nd u such that the rank is full. Since we have to solve several linear systems of equations over F q m , the complexity of this step is in the order of at least O(t 3 ) ≤ O(n 3 ) operations in F q m with Gaussian elimination (see [START_REF] Roth | Maximum-Rank Array Codes and their Application to Crisscross Error Correction[END_REF][START_REF] Gabidulin | A Fast Matrix Decoding Algorithm for Rank-Error-Correcting Codes[END_REF]).

However, the matrix S (u) is highly structured, it is a q-circulant matrix. The algorithm based on the LEEA from [Gab85] and the Berlekamp-Massey-like algorithms from [PT91, RP04a, RP04b, SRB11] take advantage of this structure and can therefore solve the key equation with complexity O(n 2 ) operations in F q m .

Finding the Root Space of Λ(x)

After solving the key equation (3.20) for the coe cients of Λ(x), we have to nd a basis of the root space of Λ(x). This basis corresponds to one possible a = (a 0 a 1 . . . a t-1 ) in the decomposition of (3.9). Finding a basis of the root space of a linearized polynomial is relatively easy due to the structure of their roots. Recall Subsection 2.2.3, where it is shown that we can nd the root space of Λ(x) by nding the right kernel of its associated evaluated matrix, i.e., for some basis B = {β 0 , β 1 , . . . , β m-1 } of F q m over F q , we have to determine:

ker ext β (Λ(β 0 ) Λ(β 1 ) . . . Λ(β m-1 )) .
The kernel of this matrix is equivalent to ext β (a) of one possible a. Thus, nding the root space of Λ(x) involves solving a linear system of equations of size m over F q , which has complexity at most O(m 3 ) over F q . This root-nding procedure was explained in detail in [START_REF] Lidl | Finite Fields, ser. Encyclopedia of Mathematics and its Applications[END_REF][START_REF] Berlekamp | Algebraic Coding Theory[END_REF].

Determining the Error

Knowing a possible vector a ∈ F t q m , we have to nd the corresponding matrix B ∈ F t×n q such that e = a • B as in (3.9). This is basically done in two substeps. Based on (3.11), we can set up the following

     a [0] 0 a [0] 1 . . . a [0] t-1 a [-1] 0 a [-1] 1 . . . a [-1] t-1 . . . . . . . . . . . . a [-(n-k-1)] 0 a [-(n-k-1)] 1 . . . a [-(n-k-1)] t-1       •      d 0 d 1 . . . d t-1      =       s [0] 0 s [-1] 1 . . . s [-(n-k-1)] n-k-1       . (3.22)
Solving this system of equations with Gaussian elimination requires complexity O(n3 ) operations over F q m , whereas the recursive algorithm from [Gab85] requires complexity O(n 2 ) over F q m by using the q-Vandermonde structure of the involved matrix.

After having found d, we determine the matrix B out of

d l = n-1 i=0 B l,i h i for all l ∈ [0, t -1]
. The complexity of this calculation is negligible, since (h 0 h 1 . . . h n-1 ) has rank n and we are looking for the representation of d over F q using these linearly independent elements.

Finally, we calculate e = a • B and can reconstruct c = re. A summary of this decoding procedure is given in Algorithm 3.5. Notice that the decoding procedure most probably fails when t > ⌊ (d-1) /2⌋. Algorithm 3.5. c or "decoding failure" ←D G r; H complexity remains in the order of O(n 2 ) over F q m . Algorithm 3.6 in the next subsection shows how we can directly obtain the q-degree-restricted evaluation polynomial of the codeword by the LEEA and therefore, we do not have to solve (3.22).

Input: r = (r 0 r 1 . . . r n-1 ) ∈ F n q m with n ≤ m; parity-check matrix H = qvan n-k ((h 0 h 1 . . . h n-1 )) of Gab[n, k] 1 Syndrome calculation: s ← r • H T ∈ F n-k q m 2 if s = 0 then 3 Estimated codeword: c ← r 4 else 5 Set up S (t) as in (3.21) for t = ⌊(n -k)/2⌋ while rk(S (t) ) < t do 6 t ← t -1 7 Set up S (t) as in (3.21) 8 Solve S (t) • Λ T = 0 for Λ = (Λ 0 Λ 1 . . . Λ t ) ∈ F t+1 q m 9 Find basis (a 0 a 1 . . . a ε-1 ) ∈ F ε q m of the root space of Λ(x) = t i=0 Λ i x [i] over F q m 10 if ε = t then 11 Find d = (d 0 d 1 . . . d t-1 ) ∈ F t q m by solving (3.22) 12 Find B = B i,j i∈[0,t-1] j∈[0,n-1] ∈ F t×n q such that d i = n-1 j=0 B i,j h j 13 Estimated codeword: c ← r -a • B

A Gao-like Decoding Algorithm

In contrast to the two-step procedure of the previous subsection, Loidreau's Welch-Berlekamp-like interpolation based decoding algorithm [START_REF] Loidreau | A Welch-Berlekamp Like Algorithm for Decoding Gabidulin Codes[END_REF] directly outputs the evaluation polynomial of the estimated codeword and therefore, the second step of nding d and B is not necessary.

In this subsection, we present a new approach, where the LEEA directly provides the q-degree restricted evaluation polynomial of the estimated codeword. This algorithm is an equivalent of Gao's algorithm for decoding Reed-Solomon codes [START_REF] Gao | A New Algorithm for Decoding Reed-Solomon Codes[END_REF][START_REF] Fedorenko | A Simple Algorithm for Decoding Reed-Solomon Codes and its Relation to the Welch-Berlekamp Algorithm[END_REF]. The advantage compared to [START_REF] Loidreau | A Welch-Berlekamp Like Algorithm for Decoding Gabidulin Codes[END_REF] is that we can accelerate our decoding algorithm based on the fast LEEA from Subsection 3.1.4 for q-cyclic Gabidulin codes. Compared to solving directly the key equation from Theorem 3.4 with the LEEA as in [Gab85], our advantage is that we do not need the (computationally intensive) step of nding B.

Let r = c + e, where c ∈ Gab[n, k] and t = rk(e), denote the received word and r(x) = n-1 i=0 r i x [i] its associated linearized polynomial. Let G = {g 0 , g 1 , . . . , g n-1 } consist of n elements from F q m , which are linearly independent over F q and which are used as evaluation points of the Gab[n, k] code as in De nition 2.16. Let r(x) ∈ L q m [x] denote the unique linearized polynomial of q-degree less than n such that r(g i ) = r i , ∀i ∈ [0, n -1], holds. This polynomial can be calculated as follows:

r(x) = n-1 i=0 r i • L i (x) L i (g i ) , (3.23)
where L i (x) denotes the i-th linearized Lagrange basis polynomial of q-degree n -1, see also [START_REF] Silva | Rank-Metric Codes for Priority Encoding Transmission with Network Coding[END_REF], which is de ned as the minimal subspace polynomial of G \ g i = {g 0 , . . . , g i-1 , g i+1 , . . . , g n-1 }, i.e.:

L i (x) = M G\g i (x) = q-1 B 0 =0 • • • q-1 B i-1 =0 • q-1 B i+1 =0 • • • q-1 B n-1 =0 x - n-1 j=0,j =i B j g j . (3.24) Therefore, L i (g j ) L i (g i ) = 1 if i = j, 0 else.
It is important to remark that for the case of n | m and when G is a normal basis of F q n over F q , then r(x) is the q-transform of r(x) as in De nition 2.12. This fact is used in Subsection 3.2.4 to accelerate our decoding algorithm for q-cyclic Gabidulin codes. Here, we describe the decoding algorithm in general for any Gab[n, k] code by using linearized Lagrange interpolation and a transformed key equation.

Theorem 3.6 (Transformed Key Equation).

Let r = (r 0 r 1 . . . r n-1 ) be given and let r(x) be de ned as in (3.23), where G = {g 0 , g 1 , . . . , g n-1 } is a set of n elements, which are linearly independent over F q . Let a = (a 0 a 1 . . . a t-1 ) denote a basis of the column space of r -(f (g 0 ) f (g 1 ) . . . f (g n-1 )), for some f (x) ∈ L q m [x] with deg q f (x) < k.

Then, the linearized error span polynomial Λ(x), de ned as in (3.13), satis es the transformed key equation:

Λ r(x) -f (x) ≡ 0 mod M G (x). (3.25) 3.2 D G C
Proof. Due to the de nition of Λ(x) in (3.13) and the de nition of the linearized Lagrange basis polynomial (3.24):

Λ r(g i ) -f (g i ) = Λ r i -c i = t-1 j=0 B j,i Λ a j = 0, ∀i ∈ [0, n -1],
where B i,j ∈ F q for all i, j and c = (c

0 c 1 . . . c n-1 ) ∈ Gab[n, k]. Hence, for any G 0 , G 1 , . . . , G n-1 ∈ F q : Λ r(x) -f (x) x= n-1 i=0 G i g i = n-1 i=0 G i Λ r i -c i = 0, ∀G 0 , G 1 , . . . , G n-1 ∈ F q . Therefore, x-n-1 i=0 G i g i divides (in the usual sense) Λ r(x)-f (x) for any G 0 , G 1 , . . . , G n-1 ∈ F q . This implies that Λ r(x) -f (x) ≡ 0 mod M G (x).
For n = m, the minimal subspace polynomial is M G (x) = (x [m]x) and due to Theorem 3.6, Λ r(x)f (x) ≡ 0 mod (x [m]x). This special case was also proven by Silva and Kschischang in [SK09a, Sil09, Theorem 5] using properties of the q-transform. Moreover, for n | m, we can choose G = {g 0 , g 1 , . . . , g n-1 } such that it is a basis in F q m of F q n over F q and then, M G (x) = (x [n]x), since then the unique sub eld F q n of F q m consists precisely of the roots of (x

[n] -x) [LN96, p. 50].
The problem of solving the transformed key equation can be stated as follows.

Problem 3.2 (Solving Transformed Key Equation).

Let r(x) ∈ L q m [x] as in (3.23) for G = {g 0 , g 1 , . . . , g n-1 } with rk(g 0 g 1 . . . g n-1 ) = n be given, where r ∈ F n q m denotes the received word.

Let d R (r, c) = rk(r -c) ≤ ⌊ (n-k) /2⌋ for some codeword c = f (g) ∈ Gab[n, k].
Find Λ(x) ∈ L q m [x] of q-degree t ≤ ⌊ (n-k) /2⌋ and f (x) of q-degree less than k such that Λ(x) = M A (x) for some set A = {a 0 , a 1 , . . . , a t-1 } with rk(a 0 a 1 . . . a t-1 ) = t and such that Λ r(x)f (x) ≡ 0 mod M G (x).

(3.26)

We solve Problem 3.2 with a generalization of Gao's algorithm [START_REF] Gao | A New Algorithm for Decoding Reed-Solomon Codes[END_REF] for linearized polynomials, given in Algorithm 3.6. The transformed key equation (3.25), Theorem 3.6, can be rewritten with a polynomial Ω(x)

∈ L q m [x]: Λ r(x) -f (x) = -Ω M G (x) ≡ 0 mod M G (x),
and thus,

Λ f (x) = Ω M G (x)) + Λ r(x) . (3.27)
Recall that R LEEA a(x); b(x); d stop with deg q a(x) ≥ deg q b(x) (Algorithm 2.3) returns unique linearized polynomials r out (x), u out (x) and v out (x) such that deg q r out (x) < d stop and

r out (x) = v out a(x) + u out b(x) .
(3.28)

If we compare (3.27) and (3.28), we obtain the idea for Algorithm 3.6: we run the LEEA with the input polynomials a(x) ← M G (x) and b(x) ← r(x) and the stopping degree

d stop ← ⌊ (n-k) /2⌋ + k = 3 D A G C ⌊ (n+k) /2⌋.
If there exists a codeword c ∈ Gab[n, k] such that rk(rc) ≤ ⌊ (n-k) /2⌋, Theorem 3.7 proves that the remainder r out (x) is equal to a • Λ f (x) and the auxiliary polynomials are v out (x) = a • Ω(x) and u out (x) = a • Λ(x) for some scalar a ∈ F q m . Hence, we can nd f (x) by a left linearized division of r out (x) by u out (x). If no such codeword exists, the remainder of this linearized division is unequal to zero, and we declare a decoding failure. This idea is given in pseudo-code in Algorithm 3.6 and its correctness is proven in Theorem 3.7. Our proof does not use the same strategy as in [START_REF] Gao | A New Algorithm for Decoding Reed-Solomon Codes[END_REF], since Gao's proof does not work directly for linearized polynomials, instead we use some properties of the transformed key equation.

Theorem 3.7 (Correctness of Algorithm 3.6). Let r ∈ F n q m and g = (g 0 g 1 . . . g n-1 ) with rk(g) = n be given.

If t = rk(r -c) ≤ ⌊ (n-k) /2⌋ for a codeword c = f g ∈ Gab[n, k], then Algorithm 3.6 solves Problem 3.2. Hence, it returns f (x) of deg q f (x) < k and Λ(x) = M A (x), where A = {a 0 , a 1 , . . . , a t-1 } ∈ F q m , such that (r -c) = (a 0 a 1 . . . a t-1 ) • B as in (3.9).
If there is no such codeword, Algorithm 3.6 returns "decoding failure".

Algorithm 3.6. f (x); Λ(x) or "decoding failure" ← D G G r; g 0 , g 1 , . . . , g n-1

Input: r = (r 0 r 1 . . . r n-1 ) ∈ F n q m with n ≤ m; g 0 , g 1 , . . . , g n-1 ∈ F q m , linearly independent over F q Proof. First, we show that, given r(x) and M G (x), the transformed key equation (3.26) has a unique solution for Λ(x) of minimal q-degree and f (x) of q-degree less than k. Second, we show that Algorithm 3.6 nds this solution. Third, we prove if the rank distance of r to any codeword c is greater than ⌊ (n-k) /2⌋, there is no f (x) of degree less than k, ful lling the transformed key equation.

1 Calculate r(x) ← n-1 i=0 r i • L i (x) L i (g i ) as in (3.23) 2 r out (x); u out (x); v out (x) ← R LEEA M G (x); r(x); d stop = ⌊ (n+k) /2⌋
1.) We assume that there is a codeword c ∈ Gab[n, k] such that t = rk(rc) ≤ ⌊ (n-k) /2⌋ and we prove that there is a unique solution of (3.26) (except for a constant factor), where deg q f (x) < k and deg q Λ(x) = t. This follows either from reducing the transformed key equation (3.26) to the "classical" key equation (3.14) (which has a unique solution due to Lemma 3.9) or directly from [Loi06, Proposition 2]. 2.) Now, we show that the result of the LEEA is a solution of the transformed key equation. Due to (3.28), the R LEEA M G (x); r(x); d stop = ⌊ (n+k) /2⌋ outputs unique polynomials such that:

r out (x) = u out r(x) mod M G (x). (3.29) 3.2 D G C
On the one hand, r out (x) = r (i-1) (x) is the rst remainder in the iterations of the LEEA of qdegree less than ⌊ (n+k) /2⌋ and u out (x) is such that deg q u out (x) = deg q a(x)deg q r (i-2) (x) ≤ ⌊ (n-k) /2⌋. On the other hand, the transformed key equation can be rewritten as

Λ f (x) ≡ Λ r(x) mod M G (x), (3.30)
with deg q Λ(x) = t ≤ ⌊ (n-k) /2⌋ and deg q f (x) < k. In [Loi06, Propositions 1 and 2] it was shown that for t ≤ ⌊ (n-k) /2⌋, the polynomials Λ(x) and f (x) provide a solution to (3.30) if and only if Λ(x) and some Φ(x) of q-degree less than ⌊ (n+k) /2⌋ provide a solution to

Φ(x) ≡ Λ r(x) mod M G (x). (3.31)
If we compare (3.29) and (3.31), it becomes clear that the output of the LEEA is such a solution, including the degree constraints. [Loi06, Proposition 2] shows that there exists only one pair of polynomials Φ(x), Λ(x) such that (3.31) is ful lled with the required degree constraints. Hence, there is also only one pair of polynomials Λ(x), f (x) such that (3.30) and its degree constraints are ful lled and we nd exactly this solution by the LEEA. 3.) Let t > ⌊ (n-k) /2⌋, and assume nonetheless that Algorithm 3.6 returns f ′ (x) with deg q f ′ (x) < k. The following holds for the output of the LEEA:

u out r(x) ≡ u out f ′ (x) mod M G (x),
and hence also

u out r(g j ) -f ′ (g j ) = u out r j -c ′ j = 0, ∀j ∈ [0, n -1].
Due to the stopping condition, deg q u out (x) ≤ ⌊ (n-k) /2⌋ and hence, the dimension of the root space of u out (x) is at most ⌊ (n-k) /2⌋. Therefore, for j ∈ [0, n -1], there exists a c ′ such that there are at most ⌊ (n-k) /2⌋ linearly independent r jc ′ j and thus, rk(rc ′ ) ≤ ⌊ (n-k) /2⌋. This is a contradiction to the assumption and thus, Algorithm 3.6 fails when the rank distance of r is greater than ⌊ (n-k) /2⌋ to any codeword.

With straight-forward implementation, Algorithm 3.6 has complexity O(n 2 ) operations in F q m .

Error-Erasure Decoding

Applications like random linear network coding might provide additional information about the occurred error. Such information can be used to declare erasures and thus, to increase decoding performance. In comparison to classical erasure decoders in Hamming metric, we distinguish two types of erasures in rank metric: row erasures and column erasures.

We thereby consider the most general form of such row and column erasures as in [SKK08, GP08] and show how the additional information can be incorporated into our decoding algorithm from Subsection 3.2.2. We consider only the case n = m in this subsection. On the one hand this helps to simplify the notations, but on the other hand this is since Lemma 3.10 only holds for n = m and it is not clear how to extend it for arbitrary n < m.

We apply the q-transform in this subsection, but all considerations except Lemma 3.10 hold straightforward for linearized Lagrange interpolation polynomials as in the previous section. The presented error-erasure decoder is able to reconstruct a codeword of a Gab[n, k] code over F q m for n = m with asymptotic complexity O(n 2 ) operations over

F q m if 2t + ̺ + γ ≤ d -1 = n -k, (3.32) 3 D A G C
where t denotes the rank of the error, ̺ the rank of the row erasures and γ the rank of the column erasures. Compared to the approaches from [GP08, SKK08, LSC13], again the advantage of our approach is that the acceleration of the LEEA (Algorithm 3.4) can be used.

In the following, we explain our notations of row/column erasures, derive a generalization of the transformed key equation and show how our decoder can be modi ed to incorporate also erasures.

Row and Column Erasures and Generalized Transformed Key Equation

Consider a Gab[n, k] code over F q m with n = m, de ned in its q-cyclic form as in Lemma 2.15 with g = (g 0 g 1 . . . g n-1 ) = (β

⊥ [0] β ⊥ [1] . . . β ⊥ [n-1]
) and the corresponding parity-check matrix with

h = (β [k] β [k+1] . . . β [k+n-1] ) from Lemma 2.16.
The additional side information of the channel is assumed to be given in form of:

• ̺ row erasures (in [START_REF] Silva | A Rank-Metric Approach to Error Control in Random Network Coding[END_REF] called "deviations") and • γ column erasures (in [START_REF] Silva | A Rank-Metric Approach to Error Control in Random Network Coding[END_REF] called "erasures"), such that the received matrix can be rewritten in accordance to (3.9) by

ext β (r) = ext β (c) + A (R) B (R) + A (C) B (C) + A (E) B (E) def = E ∈ F m×n q , (3.33)
where

A (R) ∈ F m×̺ q , B (R) ∈ F ̺×n q , A (C) ∈ F m×γ q , B (C) ∈ F γ×n q , A (E) ∈ F m×t q , B (
E) ∈ F t×n q , and A (R) and B (C) are known to the receiver. Further, t denotes the number of errors without side information. This decomposition is also shown in Figure 3.1. Similar to (3.9), we can represent the error word as a vector as follows:

E m n = A (R) m ̺ • B (R) ̺ n + A (C) m γ • B (C) γ n + A (E) m t • B (E) t n
e = r -c = a (R) B (R) + a (C) B (C) + a (E) B (E) def = e (R) + e (C) + e (E) ∈ F n q m , (3.34)
where a (R) ∈ F ̺ q m , a (C) ∈ F γ q m and a (E) ∈ F t q m and let e (R) (x), e (C) (x) and e (E) (x) ∈ L q m [x] denote the linearized polynomials associated to e (R) , e (C) and e (E) .

Figure 3.2 illustrates the simplest case of row erasures, where the known matrix A (R) has only ̺ non-zero elements. This case was considered in earlier publications as [START_REF] Gabidulin | Rank Errors and Rank Erasures Correction[END_REF][START_REF] Gabidulin | A New Method of Erasure Correction by Rank Codes[END_REF][START_REF] Richter | Fast Decoding of Rank-Codes with Rank Errors and Column Erasures[END_REF], but in the general model (introduced in [GP08, SKK08]), A (R) can be any arbitrary matrix of rank ̺ over F q . The notation of (generalized) row erasures and codes correcting such erasures were also shown in [START_REF] Roth | Location-Correcting Codes[END_REF] using a di erent terminology.

Similar to Subsection 3.2.1, we use the known matrix B (C) in order to calculate:

d (C) i = n-1 j=0 B (C) i,j g ⊥ j = n-1 j=0 B (C) i,j β [j] , ∀i ∈ [0, γ -1]. (3.35) 56 3.2 D G C
However, it is important to note that this de nition di ers from (3.12) by using g ⊥ i = β [i] here and h i = β [k+i] in (3.12).

B (R) 1 B (R) 0 m n = E (R) = A (R) • B (R) m 1 1 ̺ • B (R) 1 B (R) 0 ̺ n Figure 3.2.
Illustration of the simplest case of row erasures, where ̺ = 2 and the known matrix A (R) has only two non-zero entries.

As before, we de ne error span polynomials, but now three di erent types. In particular, we de ne Γ (C) (x), Λ (R) (x) and Λ (E) (x) as the linearized polynomials of smallest q-degree such that:

Γ (C) d (C) i = 0, ∀i ∈ [0, γ -1], Λ (R) a (R) i = 0, ∀i ∈ [0, ̺ -1],
(3.36)

Λ (E) Λ (R) (a (E) i ) = 0, ∀i ∈ [0, t -1]. Therefore, Γ (C) (x) = M d (C) 0 ,d (C) 1 ,...,d (C) γ-1 (x) and Λ (R) (x) = M a (R) 0 ,a (R) 1 ,...,a (R) ̺-1
(x) can be calculated at the beginning of the decoding process since B (C) and a (R) are known. Let p(x) = m-1 i=0 p i x [i] denote the full q-reverse linearized polynomial of p(x) ∈ L q m [x], de ned by the coe cients p i = p

[i]

-i mod m as in [START_REF] Silva | Fast Encoding and Decoding of Gabidulin Codes[END_REF][START_REF] Silva | Error Control for Network Coding[END_REF]. The following lemma shows that for n = m, the full q-reverse is related to the transpose of the associated evaluated matrix of p(x) (see Subsection 2.2.3).

Lemma 3.10 (Evaluated Matrix of q-Reverse [Sil09, Lemma 6.3]). Let p(x) ∈ L q m [x] with deg q p(x) < m and its full q-reverse p(x) with the coe cients p i = p

[i]

-i mod m , for i ∈ [0, m -1], be given. Let A = {α 0 , α 1 , . . . , α m-1 } and B = {β 0 , β 1 , . . . , β m-1 } be bases of F q m over F q and let A

⊥ = {α ⊥ 0 , α ⊥ 1 , . . . , α ⊥ m-1 } and B ⊥ = {β ⊥ 0 , β ⊥ 1 , . . . , β ⊥ m-1 } denote their dual bases. Let (p(α 0 ) p(α 1 ) . . . p(α m-1 )) = (β 0 β 1 . . . β m-1 ) • P,
where P ∈ F m×m q . Then,

p(β ⊥ 0 ) p(β ⊥ 1 ) . . . p(β ⊥ m-1 ) = (α ⊥ 0 α ⊥ 1 . . . α ⊥ m-1 ) • P T .
Based on the previous lemma, we can establish the generalized transformed key equation, incorporating errors and row/column erasures.

Theorem 3.8 (Generalized Transformed Key Equation).

Let r = c + e, for c ∈ Gab[n, k] over F q m with n = m, be the given received word and let r(x) = f (x) + e(x) be its q-transform as in De nition 2.12. Let Γ (C) (x), Λ (R) (x) and Λ (E) (x) be de ned as in (3.36).

D A G C

Then, these polynomials satisfy the generalized transformed key equation:

Λ (E) Λ (R) e(Γ (C) (x)) ≡ 0 mod (x [m] -x).
(3.37)

Proof. The proof can be found in Appendix A.2.

Error-Erasure Decoding with Gao-like Algorithm

The idea of our error-erasure decoding algorithm is to modify the transformed received word in the beginning of the decoding process as follows:

y(x) def = Λ (R) r(Γ (C) (x [γ] )) mod (x [m] -x),
which can immediately be calculated since all polynomials on the RHS are known from the channel. This modi ed transformed received word can be rewritten as

y(x) = Λ (R) f (Γ (C) (x [γ]
))

deg q <k+γ+̺ +Λ (R) e(Γ (C) (x [γ] )) mod (x [m] -x), (3.38)
where f (x) with deg q f (x) < k is the evaluation polynomial of the transmitted codeword such that

c = f (g) ∈ Gab[n, k].
The idea is now to pass the modi ed transformed received word y(x) from (3.38) (instead of r(x)) to Algorithm 3.6. The polynomial Λ (R) f (Γ (C) (x [γ] )) on the RHS of (3.38) has q-degree less than k + ̺ + γ and can therefore be seen as the evaluation polynomial of a Gab[n, k + ̺ + γ] codeword. The polynomial Λ (R) e(Γ (C) (x [γ] )) is called modi ed transformed error in the following and it is shown in Lemma 3.11 that its evaluation has rank at most t. Therefore, error-erasure decoding of a Gab[n, k] is reduced to errors-only decoding of a Gab[n, k + ̺ + γ] code. In principle, any error decoding algorithm for Gabidulin codes can now be applied.

Lemma 3.11 (Rank of Modi ed Error Word).

Let e (RC) (x) (respectively e (RC) ∈ F n q m ) with n = m denote the inverse q-transform of the modi ed transformed error word Λ (R) e(Γ (C) (x [γ] )) . Further, let e (E) be de ned as in (3.34) with rk(e (E) ) = t. Then, rk e (RC) ≤ rk e (E) = t.

Proof. Due to the proof of Theorem 3.8,

Λ (R) ( e (R) (x) + e (C) (x)) • Γ (C) (x)) ≡ 0 mod (x [m] - x) holds and therefore also Λ (R) ( e (R) (x) + e (C) (x)) • Γ (C) (x [γ] )) ≡ 0 mod (x [m] -x) holds
and we obtain

Λ (R) e(Γ (C) (x [γ] )) ≡ Λ (R) e (E) (Γ (C) (x [γ] )) mod (x [m] -x). Let G = G i,j i∈[0,m-1] j∈[0,m-1] ∈ F m×m q be such that Γ (C) (g [γ] j ) = m-1 i=0 G i,j g i and thus, ∀j ∈ [0, m -1]: e (RC) j = Λ (R) e(Γ (C) (g [γ] j )) = Λ (R) e (E) (Γ (C) (g [γ] j )) = m-1 i=0 G i,j Λ (R) e (E) (g i ) .
Hence, e (RC) = Λ (R) e (E) (g 0 ) Λ (R) e (E) (g 1 ) . . . Λ (R) e (E) (g m-1 ) • G.

D G C

Due to Lemma 2.12, Λ (R) ( e (E) (g 0 )) Λ (R) ( e (E) (g 1 )) . . . Λ (R) ( e (E) (g m-1 )) lies in the same row space as e (E) = e (E) (g 0 ) e (E) (g 1 ) . . . e (E) (g m-1 ) and hence, has rank at most t. The multiplication with G does not increase the rank.

Since

deg q Λ (R) f (Γ (C) (x [γ]
)) < k + ̺ + γ and since rk(e (RC) ) ≤ t, we can call Algorithm 3.6 by D G G y(x); g and have to skip Step 1. This outputs Λ (R) f (Γ (C) (x [γ] )) and

Λ (E) (x) if rk e (RC) ≤ t ≤ n -deg q Λ (R) (f (Γ (C) (x [γ] ))) + 1 2 = n -k -̺ -γ 2 = d -1 -̺ -γ 2 .
This follows directly from Theorem 3.7. After calling Algorithm 3.6, we have to divide the output

Λ (R) f (Γ (C) (x [γ]
)) from the left/right by the known error span polynomials Λ (R) (x) and Γ (C) (x [γ] ) in order to obtain f (x). Thus, with these modi cations, we can use Algorithm 3.6 for error-erasure decoding. This error-erasure decoding principle is shown in Algorithm 3.7 in the next section together with an acceleration based on the q-transform.

Fast Error-Erasure Decoding of q-cyclic Gabidulin Codes

For q-cyclic Gabidulin codes, linearized Lagrange interpolation (see e.g. (3.23)) coincides with the q-transform (see De nition 2.12). A q-cyclic Gab[n, k] Gabidulin code over F q m exists for any n dividing m as shown in Corollary 2.2. In this section, we show how to accelerate the error-erasure approach from the previous section for n = m using the q-transform. As before, the idea is based on the comparison of the output of R LEEA x [m]x; y(x); d stop , which is:

r out (x) ≡ u out y(x) mod (x [m] -x),
where y(x) = Λ (R) ( r(Γ (C) (x [γ] ))), and the generalized transformed key equation, shifted by γ (compare Theorem 3.8):

Λ (E) Λ (R) (f (Γ (C) (x [γ] ))) ≡ Λ (E) Λ (R) ( r(Γ (C) (x [γ] ))) = Λ (E) y(x) mod (x [m] -x),
where the q-degree of the LHS is less than t + ̺ + k + γ. Similar to Subsection 3.2.2, the decoding algorithm follows from this comparison and is given in Algorithm 3.7.

Theorem 3.9 (Correctness and Complexity of Algorithm 3.7). Let r ∈ F n q m , a low-complexity normal basis

β = (β [0] β [1] . . . β [m-1]
) of F q m over F q with comp(T m ) ∼ O(m), the vector a (R) ∈ F ̺ q m and the matrix B (C) ∈ F γ×n q as in (3.34) be given. If a codeword c = f g ∈ Gab[n, k] and the corresponding decomposition of rc from (3.34) satisfy 2t + ̺ + γ ≤ nk, then Algorithm 3.7 returns f (x) of deg q f (x) < k. If there is no such codeword, Algorithm 3.7 returns "decoding failure".

If there is a fast (right and left) linearized division such that D(m) = M m (m), then error-only decoding can be accomplished with complexity O(m 3 log m) operations over F q and if, in addition, there is also a method to calculate the minimal subspace polynomial with complexity M m (m), then error-erasure decoding can be accomplished by Algorithm 3.7 with complexity O(m 3 log m) operations over F q .

Else, the overall complexity is O(m 2 ) operations over

F q m . A G C Algorithm 3.7. f (x) or "decoding failure" ← F D G G r(x); a (R) ; B (C) ; β Input: r(x) ∈ L q m [x] with deg q r(x) < n = m; a (R) = (a (R) 0 a (R) 1 . . . a (R) ̺-1 ) ∈ F ̺ q m ; B (C) = B i,j i∈[0,γ-1] j∈[0,n-1] ∈ F γ×n q ; Ordered normal basis β = (β [0] β [1] . . . β [m-1] ) of F q m over F q 1 Calculate d (C) i ← n-1 j=0 B (C) i,j β [j] , ∀i ∈ [0, γ -1], as in (3.35)
2 Calculate minimal subspace polynomials:

Γ (C) (x) ← M d (C) 0 ,d (C) 1 ,...,d (C) γ-1 (x) Λ (R) (x) ← M a (R) 0 ,a (R) 1 ,...,a (R) ̺-1 (x) 3 Caculate q-reverse Γ (C) (x) with Γ (C) i = Γ (C)[i] -i mod m , ∀i ∈ [0, m -1]
4 Calculate r(x) by q-transform: r i ← r β [i] , ∀i ∈ [0, m -1] as in De nition 2.12

5 Calculate y(x) ← Λ (R) r(Γ (C) (x [γ] )) mod (x [m] -x) 6 r out (x), u out (x), v out (x) ← F H LEEA x [m] -x; y(x); d stop = n+k+̺+γ 2 with Algorithm 3.4 7 f ′ (x); r ′ (x) ← L D r out (x); u out (Λ (R) (x)) with Algorithm 2.2 8 f (x); r(x) ← R D f ′ (x); Γ (C) (x [γ] ) mod (x [m] -x) with Algorithm 2.1 9 if r(x) = 0 and r ′ (x) = 0 then Output: Estimated evaluation polynomial f (x) with deg q f (x) < k 10 else Output: "Decoding failure"
Proof. The correctness follows directly from Theorem 3.7 and Theorem 3.8. The complexity can be analyzed as follows, where the complexity of not-mentioned steps is negligible.

• Line 2: The minimal subspace polynomials can be calculated recursively with complexity O(γ 2 ) and O(̺ 2 ) over F q m with the recursive procedure described in [SKK08, pp. 3961-3962]. • Line 4: The q-transform can be accomplished with O(n 2 comp(T m )) ∼ O(n 2 m) operations in F q as shown in Table 3.1. • Line 5: The linearized composition modulo (x [m]x) can be done with M m (m) ≤ O(m 1.69 ) operations in F q m if we use Algorithm 3.1 or with M m (m) ≤ O(m 2 comp(T m )) ∼ O(m 3 ) operations over F q if we use Algorithm 3.3. • Line 6: The call of the LEEA can be accomplished by using the fast LEEA from Algorithm 3.4 with complexity O(max{D(m), M(m)} log m). It is important to remark that both of our algorithms for calculating the linearized composition, Algorithms 3.1 and 3.3, depend on the degree of the involved polynomials and not only on m. This is necessary, since the polynomials in the recursions of the fast LEEA have degree much smaller than m and the whole algorithm can only be accelerated if the complexity of each step depends on this degree and not on m. • Lines 7 and 8: The left and right division require complexity D(m).

Hence, Theorem 3.9 shows that as soon as an e cient way to calculate the linearized division and the minimal subspace polynomial is found, we obtain a fast error-erasure decoding algorithm for Gabidulin codes with complexity O(m 3 log m) over the ground eld F q . The complexity of known decoding approaches are all in the order O(n 2 ) over F q m , with some improvements of sub-steps. An overview of A.1 in Appendix A.3.

S O decoding approaches is given in Table

Summary and Outlook

The rst part of this chapter deals with e cient algorithms for operations with linearized polynomials. We have analyzed the complexity of operations in nite elds using normal bases and of standard implementations for operations with linearized polynomials. Then, we have shown two methods for reducing the complexity of the linearized composition, one based on a fragmentation of the involved polynomials and one using linearized multi-point evaluation in the transform domain. In this context, also an e cient algorithm for calculating the linearized multi-point evaluation was given. Based on the Divide & Conquer principle, a fast linearized Euclidean algorithm was presented.

The second part of this chapter covers decoding approaches for Gabidulin codes. First, we have brie y summarized a well-known syndrome-based decoding approach by deriving two types of key equations and showing how to reconstruct the transmitted codeword if the rank of the additive error is at most half the minimum rank distance. Second, we have presented a new BMD decoding approach, which solves a transformed key equation by means of the linearized Euclidean algorithm and directly outputs the evaluation polynomial of the estimated codeword. This algorithm can be seen as the rankmetric equivalent to Gao's algorithm. Finally, we have shown how this algorithm can be extended to correct not only errors, but also row and column erasures simultaneously and how it can be accelerated by means of the fast linearized Euclidean algorithm.

In future, a fast linearized division and a fast calculation of the minimal subspace polynomial should be found. This will immediately speed up our decoding algorithm. Further, polynomial-time decoding of Gabidulin codes beyond half the minimum rank distance is a challenging open problem. An investigation of the possibilities of list decoding Gabidulin codes will be given in Chapter 5.

3 D A G C CHAPTER 4
Decoding Approaches for Interleaved Gabidulin Codes I G were introduced in Subsection 2.3.3 and can be seen as s parallel codewords of Gabidulin codes. When applied to random linear network coding, they can be advantageous compared to usual Gabidulin codes since only one identity matrix is appended to s Gabidulin codewords in order to construct constant-dimension codes. Therefore, the relative "overhead" is reduced. Independently from this application, for certain types of errors, the decoding capability of interleaved Gabidulin codes is higher than the usual BMD decoding capability.

This chapter is devoted to decoding interleaved Gabidulin codes. First, in Section 4.1, we explain two known decoding approaches [START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF][START_REF] Sidorenko | Decoding Interleaved Gabidulin Codes and Multisequence Linearized Shift-Register Synthesis[END_REF] and prove a connection between them. In the subsequent sections, a new interpolation-based approach for decoding interleaved Gabidulin codes of length n, interleaving order s and elementary dimensions k (i) , ∀i ∈ [1, s], is presented. Our decoding principle relies on constructing a multi-variate linearized polynomial by interpolating the received words. We prove that the evaluation polynomials (of q-degree less than k (i) ) of any interleaved Gabidulin codeword in rank distance less than (sn -s i=1 k (i) + s)/(s + 1) are roots of this multi-variate polynomial. Our decoding approach uses similar principles as Guruswami and Wang for folded/derivative Reed-Solomon codes [Gur11, GW13] and Mahdavifar and Vardy for folded Gabidulin codes [START_REF] Mahdavifar | List-Decoding of Subspace Codes and Rank-Metric Codes up to Singleton Bound[END_REF].

Section 4.2 explains the basic principle of this decoder and shows how the two main stepsinterpolation and root-nding-can each be accomplished by solving a linear systems of equations. Our decoder is rst interpreted as a (not necessarily polynomial-time) list decoding algorithm in Subsection 4.3.1 and second, as a unique decoding algorithm with a certain failure probability in Subsection 4.3.2. To our knowledge, it is the rst list decoding algorithm for interleaved Gabidulin codes. For the unique decoder, we derive a connection to the known unique decoding approaches from [START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF][START_REF] Sidorenko | Decoding Interleaved Gabidulin Codes and Multisequence Linearized Shift-Register Synthesis[END_REF], which provides an upper bound on the failure probability. Finally, in Section 4.4, we show how our algorithm can be generalized to error-erasure decoding.

Parts of the results in Sections 4.2 and 4.3 were published in [START_REF] Wachter-Zeh | Interpolation-Based Decoding of Interleaved Gabidulin Codes[END_REF].

Known Decoding Approaches

So far, there exist two approaches for decoding interleaved Gabidulin codes: one based on solving a system of equations constructed by the received words by Loidreau and Overbeck [START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF] and one based on the syndromes by Sidorenko and Bossert [START_REF] Sidorenko | Decoding Interleaved Gabidulin Codes and Multisequence Linearized Shift-Register Synthesis[END_REF]. Both are unique probabilistic decoding algorithms and correct with high probability up to the radius τ = ⌊ s(n-k) /(s+1)⌋ when k

(i) = k for all i ∈ [1, s].
In the following, we shortly summarize the two principles and prove a relation between them. It is important to remark that the approach from [START_REF] Sidorenko | Decoding Interleaved Gabidulin Codes and Multisequence Linearized Shift-Register Synthesis[END_REF] was originally shown for horizontally interleaved

4 D A I G C
Gabidulin codes, i.e., where an interleaved codeword is de ned by (f (1) (g) f (2) (g) . . . f (s) (g)).

However, in the following, we describe it for vertically interleaved Gabidulin codes as in De nition 2.17. Let r (i) = (r

(i) 0 r (i) 1 . . . r (i)
n-1 ), ∀i ∈ [1, s], denote the s elementary received words, i.e., r (i) = c (i) + e (i) and c (i) ∈ Gab[n, k (i) ] as in De nition 2.17. Further, let t (i) = rk(e (i) ) and let t def = rk(e (1)T e (2)T . . . e (s)T ). We assume throughout this chapter that every interleaved error matrix (e (1)T e (2)T . . . e (s)T ) T ∈ F s×n q m of rank t is equi-probable. With a usual BMD decoder, we could correct up to the radius (n-k (i) ) /2 , ∀i ∈ [1, s], with each elementary Gab[n, k (i) ] code. However, if the row spaces of the error words are connected, interleaved Gabidulin codes can correct more errors with high probability.

For the explanation of the two decoding principles, we assume that we know the actual rank of the error t, which enables us to directly set up the corresponding system of equations in the appropriate size. A straight-forward algorithmic realization would therefore solve this system of equations for every t, where ⌊ (d-1) /2⌋ + 1 ≤ t ≤ τ , but this principle can easily be improved.

A Decoding Approach based on the Received Word

In [START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF], Loidreau and Overbeck established an approach for unique decoding of interleaved Gabidulin codes with k (i) = k, ∀i ∈ [1, s], up to the radius τ = ⌊ s(n-k) /(s+1)⌋ with high probability. Clearly, their algorithm also works when the k (i) are di erent. We show the main properties of this general case in the following; for details the reader is referred to [START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF][START_REF] Overbeck | Public Key Cryptography based on Coding Theory[END_REF][START_REF] Overbeck | Structural Attacks for Public Key Cryptosystems based on Gabidulin Codes[END_REF]. For some t ≤ τ , the main step of their decoding algorithm is to solve a linear system of equations

R R • λ T = 0, (4.1)
for λ = (λ 0 λ 1 . . . λ n-1 ), where the (nt -1 + s(nt) -s i=1 k (i) ) × n matrix R R depends on g = (g 0 g 1 . . . g n-1 ) and the received words:

R R =         G R R (1) R R (2) R . . . R (s) R         def =        qvan n-t-1 (g) qvan n-k (1) -t (r (1) ) qvan n-k (2) -t (r (2) ) . . . qvan n-k (s) -t (r (s) )        . (4.2)
If the right kernel of R R has dimension one, the nearest interleaved codeword can be reconstructed since any vector λ in this right kernel has rank weight nt and reveals the error pattern, see [START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF] and [Ove07, Algorithm 3.2.1]. However, when R R has rank less than n -1, the codeword cannot be reconstructed in most cases. Thus, the probability that rk(R R ) is less than n -1, upper bounds the probability of a decoding failure (or equivalently, the fraction of non-correctable errors of rank t).

The rst k (i) rows of G R , for i ∈ [1, s], constitute the generator matrix of the Gab[n, k (i) ] code, which is the i-th elementary code of the IGab[s; n, k (1) , . . . , k (s) ] code. This is due to the fact that t ≤ τ ≤ nmax i {k (i) } -1, and hence, k (i) ≤ nt -1, ∀i ∈ [1, s]. Therefore, the right kernel of R R can also be expressed in terms of the elementary error words:

ker R R = ker        qvan n-t-1 (g) qvan n-k (1) -t (e (1) ) qvan n-k (2) -t (e (2) ) . . . qvan n-k (s) -t (e (s) )        def = ker (E R ) . (4.3) D A
The rank of G R is nt -1 (compare Lemma 2.10) and the overall rank of the lower s submatrices of E R is t ≤ τ . Hence, the overall rank is rk(R R ) = rk(E R ) ≤ n -1. For s ≤ t, the probability that rk(R R ) < n -1 was upper bounded by [LO06, Equation (6)], [Ove07, Equation (12)] as follows:

P rk(R R ) < n -1 ≤ 1 -1 - 4 q m 1 -q m(s-t) s . ( 4

.4)

A Syndrome-Based Decoding Approach

The Sidorenko-Bossert approach [SB10, SJB11] considers unique decoding of interleaved Gabidulin codes of arbitrary dimensions k (i) and is to some extent a generalization of the key equation-based decoding approach for Gabidulin codes (see Subsection 3.2.1). Here, we will use the row space key equation from Theorem 3.5, but the principle was originally described for the "usual" column space key equation (Theorem 3.4). Denote the s syndrome vectors of length nk (i) by:

s (i) = r (i) • H (i)T = e (i) • H (i)T = (s (i) 0 s (i) 1 . . . s (i) n-k (i) -1 ), ∀i ∈ [1, s],
where

H (i) is a parity-check matrix of Gab[n, k (i) ].
Further, de ne the coe cients of the s modi ed syndromes as in (3.17) by:

s (i) j = s (i)[j-n+k (i) +1] n-k (i) -1-j , ∀i ∈ [1, s], ∀j ∈ [0, n -k (i) -1],
and denote the s corresponding (modi ed) syndrome polynomials by s (i) (x). Then, we obtain a row space key equation for each of the s modi ed syndromes as in (3.18):

Γ (i) s (i) (x) ≡ Φ (i) (x) mod x [n-k (i) ] , ∀i ∈ [1, s],
where deg q Γ (i) (x) = t (i) = rk(e (i) ) and deg q Φ (i) (x) < deg q Γ (i) (x).

Since we assume that t = rk e (1)T e (2)T . . . e (s)T , for the row space of the elementary errors R q e (i) ⊆ R q (B) holds for some B ∈ F t×n q of rank t ≤ τ and i ∈ [1, s]. Hence, we can search for one common (row) error span polynomial Γ(x) for all s key equations:

Γ s (i) (x) ≡ Φ (i) (x) mod x [n-k (i) ] , ∀i ∈ [1, s],
where

Γ(x) = t i=0 Γ i x [i] = M D (x)
, where D is a basis of the overall row space, i.e., of R q e (1) + R q e (2) + • • • + R q e (s) , of dimension t ≤ τ .

Setting up these s key equations as a system of equations with the coe cients of Γ(x) as unknowns (similar to (3.14)) provides the following linear system of equations (see also [START_REF] Gabidulin | A Fast Matrix Decoding Algorithm for Rank-Error-Correcting Codes[END_REF]Equation (16)]):

S • Γ T =        S (1)
S (2) . . .

S (s)        • Γ T = 0, (4.5) A I G C
where Γ = (Γ 0 Γ 1 . . . Γ t ) and

S (i) =         s (i)[0] t s (i)[1] t-1 . . . s (i)[t] 0 s (i)[0] t+1 s (i)[1] t . . . s (i)[t] 1 . . . . . . . . . . . . s (i)[0] n-k (i) -1 s (i)[1] n-k (i) -2 . . . s (i)[t] n-k (i) -1-t         =        s (i)[t-n+k (i) +1] n-k (i) -1-t s (i)[t-n+k (i) +1] n-k (i) -t . . . s (i)[t-n+k (i) +1] n-k (i) -1 s (i)[t-n+k (i) +2] n-k (i) -2-t s (i)[t-n+k (i) +2] n-k (i) -t-1 . . . s (i)[t-n+k (i) +2] n-k (i) -2 . . . . . . . . . . . . s (i)[0] 0 s (i)[0] 1 . . . s (i)[0] t        . (4.6)
Thus, if rk(S) = t, we obtain a unique solution of Γ(x) (except for a scalar factor) and we continue with nding the error vectors for each elementary Gabidulin code separately as in Subsection 3.2.1. The matrix S from (4.5) provides at most s i=1 (nk (i)t) linearly independent equations. In order to obtain rk(S) = t, the parameters have to satisfy

s i=1 (n -k (i) -t) ≥ t. When k (i) = k, ∀i ∈ [1, s]
, the maximum decoding radius, which can be achieved by solving the linear system of equations from (4.5), is then τ = ⌊ s(n-k) /(s+1)⌋.

For the approach from [START_REF] Sidorenko | Decoding Interleaved Gabidulin Codes and Multisequence Linearized Shift-Register Synthesis[END_REF], the probability of failure can be upper bounded by the probability that S from (4.5) has rank less than t, which is bounded in [SB10, Theorem 5] for s ≤ τ as follows:

P rk(S) < t ≤ 3.5 q -m (s+1)(τ -t)+1 < 4 q m .
This bound improves the bound from [START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF] and in general we can use P f < 4/q m as simpli ed upper bound on the failure probability of both cases. Moreover, in [START_REF] Sidorenko | Decoding Interleaved Gabidulin Codes and Multisequence Linearized Shift-Register Synthesis[END_REF][START_REF] Sidorenko | Skew-Feedback Shift-Register Synthesis and Decoding Interleaved Gabidulin Codes[END_REF] an e cient algorithm based on linearized multi-sequence shift-register synthesis for decoding interleaved Gabidulin codes was developed, which implicitly nds the real value of t and solves (4.5). However, for analyzing the connection to [START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF] and to our approach, the interpretation as a linear system of equations is more convenient.

Connection Between the two Known Approaches

In the following lemma, we derive a connection between the two approaches from [START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF] and from [START_REF] Sidorenko | Decoding Interleaved Gabidulin Codes and Multisequence Linearized Shift-Register Synthesis[END_REF] when decoding interleaved Gabidulin codes with

k (i) = k, ∀i ∈ [1, s]. Lemma 4.1 (Relation Between Ranks of Decoding Interleaved Gabidulin Codes). Let k (i) = k, ∀i ∈ [1, s], let t ≤ τ = ⌊ s(n-k) /(
s+1)⌋ and let R R and S be de ned as in (4.2) and (4.5), (4.6). Then, rk(S) < t if and only if rk(R R ) < n -1.

Proof. First recall the matrix R R from (4.2). The submatrix G R is a generator matrix of a Gab[n, nt -1] code. Let h = (h 0 h 1 . . . h n-1 ) de ne an (nk) × n parity-check matrix H (0) of the elementary Gab[n, k] code (which de nes the IGab[s; n, k, . . . , k] code) as in Lemma 2.14.

P I B D

Then, H = qvan t+1 ((h

[n-k-t-1] 0 h [n-k-t-1] 1 . . . h [n-k-t-1] n-1
)) is a (t + 1) × n parity check matrix of a Gab[n, nt -1] code and is a (t + 1) × n submatrix of H (0) , consisting of the lowermost t + 1 rows of H (0) . Multiplying R R by H T and comparing the result to (4.6) gives:

R R • H T =           qvan n-t-1 (g) qvan n-k-t (r (1) ) qvan n-k-t (r (2) ) . . . qvan n-k-t (r (s) )           • H T =           qvan n-t-1 (g) qvan n-k-t (e (1)
)

qvan n-k-t (e (2) ) . . . qvan n-k-t (e (s) )           • H T =           0 S (1)[n-k-t-1] S (2)[n-k-t-1] . . . S (s)[n-k-t-1]           . (4.7)
For any integer i, rk(A) = rk(A [i] ), where A [i] means that every entry is taken to the q-power i.

Based on (4.7), we rst prove the if part. Calculate by Gaussian elimination of R R the matrix

E = G R E R such that rk(R R ) = rk( E) = rk(G R ) + rk( E R ) = n -t -1 + rk( E R ) (i.
e., such that the ranks sum up). Notice that E R does not necessarily consist of the s lower submatrices of E R from (4.3). These elementary row operations do not change the rank and we obtain from (4.7)

rk S = rk S [n-k-t-1] = rk R R • H T = rk E • H T = rk E R • H T . Now, if rk(R R ) < n -1, then rk( E R ) < t since rk(G R ) = n -t -1.
Then, also rk E R • H T < t and therefore rk(S) < t.

Second, let us prove the only if part. Due to Sylvester's rank inequality

rk R R + rk H T -n ≤ rk R R • H T = rk S [n-k-t-1] = rk S .
Clearly, rk(H

) = t + 1. Hence, if rk(S) < t, then rk R R ≤ n -t -1 + rk S < n -1.
Thus, we proved that both approaches fail for exactly the same error matrices and clearly also have the same fraction of correctable error matrices when

k (i) = k, ∀i ∈ [1, s].
This means that the tighter bound on the failure probability from [START_REF] Sidorenko | Decoding Interleaved Gabidulin Codes and Multisequence Linearized Shift-Register Synthesis[END_REF] can also be used to bound the failure probability of [START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF]. However, for arbitrary k (i) = k, it is not clear if the matrix on the RHS of (4.7) has the same rank as S since the q-powers of each submatrix di er.

Principle of Interpolation-Based Decoding

Sudan [START_REF] Sudan | Decoding of Reed-Solomon Codes beyond the Error-Correction Bound[END_REF] and Guruswami and Sudan [START_REF] Guruswami | Improved Decoding of Reed-Solomon and Algebraic-Geometry Codes[END_REF] introduced polynomial-time list decoding of Reed-Solomon and Algebraic Geometry codes based on interpolating bivariate (usual) polynomials. For linearized polynomials, however, it is not clear how to de ne mixed terms (i.e., monomials containing more than one indeterminate) and how to design a list decoding algorithm for Gabidulin codes similar to [START_REF] Sudan | Decoding of Reed-Solomon Codes beyond the Error-Correction Bound[END_REF][START_REF] Guruswami | Improved Decoding of Reed-Solomon and Algebraic-Geometry Codes[END_REF]. When we de ne bivariate linearized polynomials without mixed terms, it is possible to decode a Gab[n, k] code up to the BMD radius ⌊ (n-k) /2⌋, which was done in [START_REF] Loidreau | A Welch-Berlekamp Like Algorithm for Decoding Gabidulin Codes[END_REF].

4 D A I G C
Our decoding approach for interleaved Gabidulin codes relies on interpolating a multi-variate linearized polynomials without mixed terms. The principle consists of an interpolation and a rootnding step. First, we give interpolation constraints for a multi-variate linearized interpolation polynomial Q(x, y 1 , . . . , y s ) = Q 0 (x) + s i=1 Q i (y i ) and prove that the q-degree-restricted evaluation polynomials f (1) (x), . . . , f (s) (x) of the interleaved Gabidulin codeword are roots of Q(x, y 1 , . . . , y s ) up to a certain radius τ . Second, we show how the root nding step can be accomplished by solving a linear system of equations.

Interpolation Step

The conditions on our multi-variate linearized interpolation polynomial are as follows.

Problem 4.1 (Interpolation Step for Decoding Interleaved Gabidulin Codes).

Let

r (i) (x) = n-1 j=0 r (i) j x [j] ∈ L q m [x], ∀i ∈ [1, s],
and g 0 , g 1 , . . . , g n-1 ∈ F q m , which are linearly independent over F q , be given.

Find an (s + 1)-variate linearized polynomial of the form

Q(x, y 1 , . . . , y s ) = Q 0 (x) + Q 1 (y 1 ) + • • • + Q s (y s ),
which satis es for given integers n, τ, k (1) , . . . , k (s) :

• Q(g j , r

(1) j , . . . , r

j ) = 0, ∀j ∈ [0, n -1], • deg q Q 0 (x) < n -τ , • deg q Q i (y i ) < n -τ -(k (i) -1), ∀i ∈ [1, s]. (s)
Let us denote the coe cients of the univariate polynomials by

Q 0 (x) = n-τ -1 j=0 q 0,j x [j] , Q i (y i ) = n-τ -k (i) j=0 q i,j y [j] i , ∀i ∈ [1, s].
A solution to Problem 4.1 can be found by solving a linear system of equations, which is denoted by R • q T = 0, where g = (g 0 g 1 . . . g n-1 ) and R is an n × (nτ + s i=1 (nτk (i) + 1)) matrix as follows: R = qvan n-τ (g) T qvan n-τ -k (1) +1 (r (1) ) T . . . qvan n-τ -k (s) +1 (r (s) ) T , (4.8) and q = (q 0,0 . . . q 0,n-τ -1 | q 1,0 . . . q 1,n-τ -k (1) | . . . | q s,0 . . . q s,n-τ -k (s) ).

Lemma 4.2 (Maximum Radius).

There exists a non-zero Q(x, y 1 , . . . , y s ), ful lling the conditions of Problem 4.1 if

τ < sn -s i=1 k (i) + s s + 1 . (4.9)
Proof. The number of linearly independent equations is given by the interpolation constraints (i.e., the number of rows of R in (4.8)), which is is at most n and has to be less than the number of unknowns (given by the length of q) in order to guarantee that there is a non-zero solution. Hence:

n < n -τ + s i=1 n -τ -k (i) + 1 ⇐⇒ τ (s + 1) < sn + s - s i=1 k (i) .

P I B D

For the special case k (i) = k, ∀i ∈ [1, s], this gives τ < s(nk + 1)/(s + 1).

The unique decoding approaches from [LO06, SB10] (see Section 4.1) have maximum decoding radius τ u = (sn -s i=1 k (i) )/(s + 1). A comparison to the maximum value of τ given by Lemma 4.2 provides the following corollary, showing that our decoding radius is at least the same as τ u .

Corollary 4.1 (Decoding Radii for Interpolation-Based and Joint Decoding). Let τ be the greatest integer ful lling (4.9) and let τ u = (sn -s i=1 k (i) )/(s + 1) . Then, 1 ≥ ττ u ≥ 0.

The following theorem shows that the evaluation words of the interleaved Gabidulin code are a root of any interpolation polynomial, which ful lls Problem 4.1.

Theorem 4.1 (Roots of Interpolation Polynomial).

Let c (i) = f (i) (g), where deg q f (i) (x) < k (i) , and let r (i) = c (i) + e (i) , ∀i ∈ [1, s]. Assume, t = rk e (1)T e (2)T . . . e (s)T ≤ τ , where τ satis es (4.9). Let a non-zero Q(x, y 1 , . . . , y s ) be given, ful lling the interpolation constraints from Problem 4.1. Then,

F (x) def = Q x, f (1) (x), . . . , f (s) (x) = 0.
(4.10)

Proof. De ne r (i) (x) and e (i) (x) such that r (i) (g j ) = r (i)
j and e (i) (g j ) = e (i)

j = r (i) j -c (i) j , ∀j ∈ [0, n -1] and ∀i ∈ [1, s] using linearized Lagrange interpolation as in (3.23), (3.24). Further, denote R(x) def = Q x, r (1) (x), . . . , r (s) (x) . Since all polynomials are linearized, R(x) -F (x) = Q 0, e (1) (x), . . . , e (s) (x) = Q 1 e (1) (x) + Q 2 e (2) (x) + • • • + Q s e (s) (x) . Then, R g -F g = s i=1 Q i e (i) (g) = s i=1 Q i e (i) = s i=1 Q i (e (i) 0 ) s i=1 Q i (e (i) 1 ) . . . s i=1 Q i (e (i) n-1 ) .
Lemma 2.12 shows that the row spaces ful ll

R q s i=1 Q i e (i)
⊆ R q (e (1)T e (2)T . . . e (s)T ) T .

Because of the interpolation constraints, R(g) = 0 and hence rk (F (g)) = rk( s i=1 Q i (e (i) )) ≤ rk(e (1)T e (2)T . . . e (s)T ) = t ≤ τ . If rk(F (g)) ≤ τ , then the dimension of the root space of F (x) in F q m has to be at least nτ , which is only possible if its q-degree is at least nτ . However, deg q F (x) ≤ nτ -1 due to the interpolation constraints and therefore F (x) = 0.

The interpolation step can be accomplished by solving the linear system of equations based on the matrix R from (4.8), which requires cubic complexity in F q m when using Gaussian elimination. Instead of this, the e cient interpolation from [START_REF] Xie | General Linearized Polynomial Interpolation and Its Applications[END_REF] can be used and the complexity of the interpolation step is reduced to O(s 2 n(nτ )) operations over F q m (in their notation L = s, C = n and D = nτ -1 and the complexity of their algorithm is O(L 2 CD)).

A I G C

Root-Finding Step

Similar to Guruswami and Wang in [START_REF] Guruswami | Linear-Algebraic List Decoding of Folded Reed-Solomon Codes[END_REF][START_REF] Guruswami | Linear-Algebraic List Decoding for Variants of Reed-Solomon Codes[END_REF] for folded/derivative Reed-Solomon codes and to Mahdavifar and Vardy in [START_REF] Mahdavifar | List-Decoding of Subspace Codes and Rank-Metric Codes up to Singleton Bound[END_REF] for folded Gabidulin codes, the root-nding step of our approach results in solving a linear system of equations. Assume, Q(x, y 1 , . . . , y s ) is given, ful lling the interpolation constraints from Problem 4.1. Then, the task of the root-nding step is to nd all tuples of polynomials f (1) (x), f (2) (x), . . . , f (s) (x) such that

F (x) = Q 0 (x) + Q 1 f (1) (x) + Q 2 f (2) (x) + • • • + Q s f (s) (x) = 0.
The important observation is that this is a linear system of equations over F q m in the coe cients of f (1) (x), f (2) (x), . . . , f (s) (x). Recall for this purpose that (a + b) [i] = a [i] + b [i] for any a, b ∈ F q m and any integer i and let us demonstrate the root-nding step with an example.

Example 4.1 (Root-Finding). Let s = 2, n = m = 7, k (1) = k (2) = 2 and τ = 3. Find all pairs f (1) (x), f (2) (x) with deg q f (1) (x) = deg q f (2) (x) < 2 such that F (x) = F 0 x [0] + F 1 x [1] + • • • + F n-τ -1 x [n-τ -1] = 0. Due to the constraints of Problem 4.1, deg q F (x) ≤ n -τ -1 = 3. Thus, F 0 = 0 = q 0,0 + q 1,0 f (1) 0 + q 2,0 f (2) 0 , F 1 = 0 = q 0,1 + q 1,1 f (1)[1] 0 + q 1,0 f (1) 1 + q 2,1 f (2)[1] 0 + q 2,0 f (2) 1 , F 2 = 0 = q 0,2 + q 1,2 f (1)[2] 0 + q 1,1 f (1)[1] 1 + q 2,2 f (2)[2] 0 + q 2,1 f (2)[1] 1 , F 3 = 0 = q 0,3 + q 1,2 f (1)[2] 1 + q 2,2 f (2)[2] 1 .
Therefore, given Q(x, y 1 , y 2 ), we can calculate the coe cients of all possible pairs f (1) (x), f (2) (x) of q-degree less than two by the following linear system of equations:

     q 1,0 q 2,0 q [-1] 1,1 q [-1] 2,1 q [-1] 1,0 q [-1] 2,0 q [-2] 1,2 q [-2] 2,2 q [-2] 1,1 q [-2] 2,1 q [-3] 1,2 q [-3] 2,2      •      f (1) 0 f (2) 0 f (1)[-1] 1 f (2)[-1] 1      =      -q 0,0 -q [-1] 0,1 -q [-2] 0,2 -q [-3] 0,3      . (4.11)
In order to set up (4.11) in general, we can use more than one Q(x, y 1 , . . . , y s ). Namely, we can use all polynomials corresponding to di erent basis vectors of the solution space of the interpolation step. This also decreases the probability that the system of equations for the root-nding step does not have full rank (see also Subsection 4.3.2). In order to calculate the dimension of the solution space of the interpolation step, denoted by d I , we need the rank of the interpolation matrix.

Lemma 4.3 (Rank of Interpolation Matrix).

Let rk e (1)T e (2)T . . . e (s)T = t ≤ τ , where τ satis es (4.9). Then, for the interpolation matrix from (4.8), rk(R) ≤ nτ + t holds.

Proof. The rst k (i) columns of R contain the (transposed) generator matrices of the Gabidulin codes Gab[n, k (i) ]. Hence, for calculating the rank of R, we can subtract the codewords and their q-powers from the s right submatrices such that these submatrices only depend on the error. Hence, the rank of R depends on rk(qvan n-τ (g)), which is nτ , and on the rank of the error matrix, which is t. Hence, rk(R) ≤ nτ + t.

P I B D

The dimension of the solution space of the interpolation step is therefore:

d I def = dim ker(R) ≥ (s + 1)(n -τ ) - s i=1 (k (i) -1) -(n -τ + t) = s(n -τ + 1) - s i=1 k (i) -t, (4.12)
and for

k (i) = k for all i ∈ [1, s], we obtain d I ≥ s(n -τ -k + 1) -t.
In the following, let Q (h) (x, y 1 , . . . , y s ), ∀h ∈ [1, d I ], denote the interpolation polynomials corresponding to di erent basis vectors of the solution space of the interpolation step. Let us denote the following matrices:

Q [i] j def =       q (1)[i] 1,j q (1)[i] 2,j . . . q (1)[i] s,j q (2)[i] 1,j q (2)[i] 2,j . . . q (2)[i] s,j . . . . . . . . . . . . q (d I )[i] 1,j q (d I )[i] 2,j
. . . q

(d I )[i] s,j       , f [i] j def =       f (1)[i] j f (2)[i] j . . . f (s)[i] j       , q [i] 0,j def =       q (1)[i] 0,j q (2)[i] 0,j . . . q (d I )[i] 0,j       . (4.13)
For k = max i {k (i) }, the linear system of equations for nding the roots of Q(x, y 1 , . . . , y s ) is:

Q (h) x, f (1) (x), . . . , f (s) (x) = Q (h) 0 (x) + Q (h) 1 (f (1) (x)) + • • • + Q (h) s (f (s) (x)) = 0, ∀h ∈ [1, d I ] ⇐⇒                    Q [0] 0 Q [-1] 1 Q [-1] 0 Q [-2] 2 Q [-2] 1 Q [-2] 0 . . . . . . . . . . . . . . . . . . Q [-(n-τ -3)] n-τ -k Q [-(n-τ -3)] n-τ -k-1 Q [-(n-τ -3)] n-τ -k-2 Q [-(n-τ -2)] n-τ -k Q [-(n-τ -2)] n-τ -k-1 Q [-(n-τ -1)] n-τ -k                    •         f 0 f [-1] 1 . . . f [-(k-1)] k-1         =         -q 0,0 -q [-1] 0,1 . . . -q [-(n-τ -1)] 0,n-τ -1         , (4.14) Q • f = q 0
where Q is a ((nτ )d I ) × sk matrix and where we assume that f

(i) j = 0 if j ≥ k (i) and q i,j = 0 when j ≥ n -τ -k (i) , ∀i ∈ [1, s].

Lemma 4.4 (Complexity of the Root-Finding Step).

Let Q (h) (x, y 1 , . . . , y s ), ∀h ∈ [1, d I ], be given, satisfying the interpolation constraints from Problem 4.1. Then, the basis of the subspace, which contains the coe cients of all tuples f (1) (x), . . . , f (s) (x) such that

F (x) = Q x, f (1) (x), . . . , f (s) (x) = Q 0 (x) + Q 1 (f (1) (x)) + • • • + Q s (f (s) (x)) = 0,
can be found recursively with complexity at most O(s 3 k 2 ) operations over

F q m . 4 D A I G C
Proof. The complexity of calculating q-powers is negligible (compare Table 3.1). The solution of (4.14) can be found by the following recursive procedure. First, solve the linear system of equations Q

[0] 0 • f 0 = -q 0,0 of size d I × s for f 0 with complexity at most O(s 3 ) when using Gaussian elimination. Afterwards, calculate Q

[-1] 1
• f 0 with sd I ≈ s 2 multiplications over F q m and solve the system Q

[-1] 1 • f 0 + Q [-1] 0 • f [-1] 1 = -q [-1]
0,1 for f 1 with complexity at most O(s 3 ) operations. We continue this until we obtain all coe cients of f (1) (x), . . . , f (s) (x), where for f j , we rst have to calculate (j -1) • s • d I multiplications over F q m and solve a d I × s linear system of equations. Hence, the overall complexity for the root-nding step is upper bounded by

k j=1 (j -1) • s • d I + s 3 ≤ O(s 2 k 2 + s 3 k) ≤ O(s 3 k 2 ) operations over F q m .

Interpolation-Based Decoding Approaches

The decoding principle from the previous section can either be used as a list decoding algorithm, which returns all codewords of the interleaved Gabidulin code in rank distance at most τ from the received word, where τ satis es (4.9) (described in Subsection 4.3.1), or as a probabilistic unique decoding algorithm (described in Subsection 4.3.2). For the probabilistic algorithm, we derive a relation to the known unique decoding algorithms and bound the failure probability.

A List Decoding Approach

Our decoding approach for interleaved Gabidulin codes can be seen as a list decoding algorithm, consisting of solving two linear systems of equations. Except for pruning the solution space of the root-nding step, we nd the solution(s) with complexity at most O(s 3 n 2 ) operations in F q m . However, our algorithm is not a polynomial-time list decoding algorithm (with respect to n) for interleaved Gabidulin codes since the list size can become exponential in n as shown in the following lemma.

Lemma 4.5 (Maximum List Size). Let r (i) , ∀i ∈ [1, s], be given and let τ satisfy (4.9). Then, the list size ℓ I , i.e., the number of codewords from IGab[s; n, k (1) , . . . , k (s) ] in rank distance at most τ to r = (r (1)T r (2)T . . . r (s)T ) T , is

ℓ I def = max r∈F s×n q m IGab[s; n, k (1) , . . . , k (s) ] ∩ B (τ ) R (r) ≤ q m( s i=1 k (i) -min i {k (i) }) .
Proof. The list size can be upper bounded by the maximum number of solutions for the rootnding step (4.14). There exists an integer

i ∈ [1, s] such that Q i (x) = 0, since Q(x, y 1 , . . . , y s ) = 0. Note that Q 0 (x) = 0 and Q i (x) = 0 , ∀i ∈ [1, s], is not possible since (qvan n-τ (g)) T is a full-rank matrix.
Hence, let i ∈ [1, s] be such that Q i (x) = 0 and let j be the smallest integer such that q i,j = 0. Consider the submatrix of Q, which consists of the columns corresponding to the coe cients of f (i) (x). For some h ∈ [1, s], this submatrix contains at least one k (i) × k (i) lower triangular matrix with q

(h)[-j] i,j , q (h)[-(j+1)] i,j , . . . , q (h)[-(j+k (i) -1)] i,j
on the diagonal. Therefore, rk(Q) ≥ min i {k (i) } and the dimension of the solution space is at most ( s i=1 k (i)min i {k (i) }). It is not clear whether the list size ℓ I can really be that great. Moreover, nding the actual list of codewords out of the solution space of (4.14) further reduces the list size.

I B D A

When ℓ I > 1, the system of equations for the root-nding step (4.14) cannot have full rank. The following lemma estimates the average list size. For most parameters, this value is almost one (see Example 4.2). The proof proceeds similar to McEliece's proof for the average list size in the Guruswami-Sudan algorithm [START_REF] Mceliece | On the Average List Size for the Guruswami-Sudan Decoder[END_REF].

Lemma 4.6 (Average List Size). Let c (i) = f (i) (g), ∀i ∈ [1, s]
, where deg q f (i) (x) < k (i) and let r (i) = c (i) + e (i) . Let rk(e (1)T e (2)T . . . e (s)T ) = t ≤ τ and let τ satisfy (4.9). Then, the average list size, i.e., the average number of codewords (c (1)T c (2)T . . . c (s)T ) T ∈ IGab[s; n, k (1) , . . . , k (s) ] such that

rk (r (1)T r (2)T . . . r (s)T ) -(c (1)T c (2)T . . . c (s)T ) ≤ τ, is upper bounded by ℓ I < 1 + 4 q m s i=1 k (i) -1 q (sm+n)τ -τ 2 -smn .
Proof. Let R be a random variable, uniformly distributed over all matrices in F s×n q m and let r be a realization of R, i.e., the s elementary received words written as rows of a matrix. Let c ∈ IGab[s; n, k (1) , . . . , k (s) ] be the xed transmitted codeword. Then, P (rk(rc) ≤ τ ) = P (rk(r) ≤ τ ), which is the probability that a random sm × n matrix over F q has rank at most τ . Let IGab * [s; n, k (1) , . . . , k (s) ] be the code IGab[s; n, k (1) , . . . , k (s) ] without the transmitted codeword. Let us further consider another random variable X, which depends on R:

X(R) = IGab * ∩ B (τ ) R (r) ,
where r ∈ F s×n q m . Denote by 1(..) the indicator function, then the expectation of X is given by:

E[X] = r∈F s×n q m P (R = r)X(R) = c∈IGab * r∈F s×n q m 1(rk(r -c) ≤ τ )P (R = r) = c∈IGab * E 1(rk(r -c) ≤ τ ) = c∈IGab * P (rk(r -c) ≤ τ ) = c∈IGab * P (rk(r) ≤ τ ).
Therefore

E[X] = IGab * • R ∈ F sm×n q : rk(R) ≤ τ q smn < (q m ) s i=1 k (i) -1 4q (sm+n)τ -τ 2 q smn .
The average list size is ℓ I = E[X] + 1, since we have to add the transmitted codeword.

4 D A I G C
Unfortunately, it is not clear if it is possible that ℓ I = 1 and nonetheless, the system of equations for the root-nding step (4.14) does not have full rank. Thus, Lemma 4.6 does not bound the probability that the rank of Q is not full; this will be done in Lemma 4.9. Theorem 4.2 summarizes the properties of our list decoding algorithm.

Theorem 4.2 (List Decoding of Interleaved Gabidulin Codes).

Let the interleaved Gabidulin code IGab[s; n, k (1) , . . . , k (s) ] over F q m consist of the elementary codewords c (i) = f (i) (g), where deg q f (i) (x) < k (i) and let the elementary received words r (i) , ∀i ∈ [1, s], be given. Then, we can nd a basis of the subspace, containing all tuples of polynomials f (1) (x), . . . , f (s) (x), such that their evaluation at g is in rank distance

τ < sn -s i=1 k (i) + s s + 1
to (r (1)T r (2)T . . . r (s)T ) T with overall complexity at most O(s 3 n 2 ).

The complexity of nding the basis of the list is quadratic in n, but the worst-case complexity for nding explicitly the whole list can be exponential in n. Therefore, this is not a polynomial-time list decoder, although in most cases the list size is one and in then, the complexity of nding the unique solution is quadratic in the length of the code.

A Probabilistic Unique Decoding Approach

In this section, we consider our decoding approach as a probabilistic unique decoding algorithm. Since the list size might be greater than one, there is not always a unique solution. We accomplish the interpolation step as before and declare a decoding failure as soon as the rank of the root-nding matrix Q (see (4.14)) is not full. We upper bound this probability and call it failure probability. Moreover, we show a relation to the unique decoding approaches from [START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF][START_REF] Sidorenko | Decoding Interleaved Gabidulin Codes and Multisequence Linearized Shift-Register Synthesis[END_REF]. The upper bound as well as simulation results show that the failure probability is quite small. Therefore, we can use our decoder as probabilistic unique decoder which basically consists of solving two structured linear systems of equations and has overall complexity at most O(s 3 n 2 ), where s ≪ n is usually a small xed integer.

It is important to observe that we always set up the system of equations for the interpolation step (Problem 4.1) with maximum possible τ , but-in contrast to solving the systems of equations from (4.1) and (4.5) -we also nd the unique solution (if it exists) if t < τ without decreasing the size of the matrix, since the rank of the matrix R from (4.8) is not important.

Recall the matrix notations from (4.13) and denote additionally the d I × (s + 1) matrix

Q 0 def =     q (1) 0,0 q (1) 1,0 . . . q (1) s,0 . . . . . . . . . . . . q (d I ) 0,0 q (d I ) 1,0 . . . q (d I ) s,0     . (4.15)
The rank of any matrix A ∈ F l×n q m satis es rk(A [i] ) = rk(A) for any integer i since the q-power on the whole matrix is a linear operation. The matrix Q of the root nding step (4.14) contains a lower block triangular matrix, providing the following lemma.

Lemma 4.7 (Rank of Root-Finding Matrix).

Let Q be de ned as in (4.14) and Q

[0] 0 as in (4.13). If rk(Q [0] 0 ) = s, then rk(Q) = sk.

I B D A

Proof. This holds since Q contains a lower block triangular matrix with

Q [0] 0 , . . . , Q [k-1] 0
on the diagonal of the rst k blocks and since rk(Q

[0] 0 ) = rk(Q [i] 0 ). The d I × s matrix Q [0]
0 can have rank s only if d I ≥ s, which is guaranteed for t = τ if (compare (4.12)):

d I = dim ker(R) ≥ s(n -τ + 1) - s i=1 k (i) -t ≥ s ⇐⇒ t ≤ sn -s i=1 k (i) (s + 1) . (4.16)
This is equivalent to the decoding radius of joint decoding and slightly di erent to (4.9), which is the maximum decoding radius when we consider our algorithm as a list decoder (see Section 4.3.1).

In the following, we will show a connection between the probability that Q does not have full rank and that the matrix R R from [START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF], see (4.2), does not have full rank.

Lemma 4.8 (Connection Between Matrices of Di erent Approaches).

Let Q 0 be de ned as in (4.15) and R R as in (4.2)

for t = τ = (sn -s i=1 k (i) )/(s + 1) . If rk(Q 0 ) < s, then rk(R R ) < n -1.
Proof. If rk(Q 0 ) < s, then by linearly combining the d I ≥ s dimensional basis of the solution space of the interpolation step, there exists a non-zero interpolation polynomial Q(x, y 1 , . . . , y s ), which ful lls Problem 4.1 and has the coe cients q 0,0 = q 1,0 = • • • = q s,0 = 0. Since Q(x, y 1 , . . . , y s ) = 0 (Lemma 4.2), the interpolation matrix without the rst column of each submatrix (i.e., the columns corresponding to q 0,0 , q 1,0 , . . . , q s,0 ), denoted by R, does not have full rank. Moreover R

[1] R = R T and hence, rk(R R ) = rk( R) < s i=0 deg q Q i (x) = (s + 1)(n -τ ) - s i=1 k (i) -1. For τ = sn-s i=1 k (i) (s+1)
, this gives rk(R R ) < n -1.

Combining the last two lemmas, we obtain the following theorem.

Theorem 4.3 (Connection Between Failure Probabilities of Di erent Approaches). Assume that r (i) ,∀i ∈ [1, s], consists of random elements uniformly distributed over F q m . Let R R be as in (4.2) and S as in (4.5) for t = τ = (sn -s i=1 k (i) )/(s + 1) . Then, for k = max i {k (i) }:

P rk(Q) < sk ≤ P rk(Q 0 ) < s ≤ P rk(R R ) < n -1 . (4.17)
Therefore, for τ ≥ s:

P rk(Q) < sk ≤ 1 -1 - 4 q m 1 -q m(s-τ ) s . If k (i) = k, ∀i ∈ [1, s], additionally P rk(Q) < sk ≤ P rk(S) < τ holds.
Proof. Since τ = (sn -s i=1 k (i) )/(s + 1) , we obtain d I = s and rk(Q 0 ) = rk(Q

[0]
0 ). The rst inequality of (4.17) follows from Lemma 4.7 and the second from Lemma 4.8. Hence, we can bound P rk(Q) < sk) by the failure probability from [START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF]. Due to Lemma 4.1, the failure probability from [START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF] is the same as the failure probability of [START_REF] Sidorenko | Decoding Interleaved Gabidulin Codes and Multisequence Linearized Shift-Register Synthesis[END_REF] for

k (i) = k, ∀i ∈ [1, s]. A I G C
The assumption of random received vectors and the restriction τ ≥ s follow from [Ove07, Theorem 3.11]. We conjecture that τ ≥ s is only a technical restriction and that the results hold equivalently for τ < s. Alternatively, we can bound the failure probability as follows. Assume, the matrix

Q [0]
0 consists of random values over F q m . This assumption seems to be reasonable, since in [START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF] and [START_REF] Sidorenko | Decoding Interleaved Gabidulin Codes and Multisequence Linearized Shift-Register Synthesis[END_REF] it is assumed that r (1) , . . . , r (s) are random vectors in F n q m . In our approach, the values of Q

[0] 0 are obtained from a linear system of equations, where each q i,0 is multiplied with the coe cients of a di erent r (i) . Lemma 4.9 (Alternative Calculation of Failure Probability).

Let rk e (1)T e (2)T . . . e (s)T = t ≤ τ , where τ = (sn -s i=1 k (i) )/(s + 1) , let k = max i {k (i) }, let Q be de ned as in (4.14) and let q (j) 1,0 , q (j) 2,0 , . . . , q (j) s,0 for j = 1, . . . , d I be random elements uniformly distributed over F q m . Then,

P rk(Q) < sk ≤ 4 q (m(d I +1-s)) = 4q -m(s(n-τ )-s i=1 k (i) -t+1) .
Proof. Due to d I ≥ s and Lemma 4.7, if rk(Q

[0] 0 ) = s, then rk(Q) = sk. Hence, P (rk(Q) < sk) ≤ P (rk(Q [0] 0 ) < s). When q (j)
1,0 , . . . , q (j) s,0 for j = [1, d I ] are random elements from F q m , we bound P (rk(Q [0] 0 ) < s) by the probability that a random (d I × s)-matrix over F q m has rank less than s:

P rk(Q) < sk ≤ P rk(Q [0] 0 ) < s ≤ s-1 j=0 j-1 h=0 q d I -q h q j -q h j-1 i=0 (q s -q i ) q msd I < 4q m((d I +s)(s-1)-(s-1) 2 ) q msd I = 4 q m(d I -s+1) = 4q -m(s(n-τ )-s i=1 k (i) -t+1) .
Lemma 4.9 does not have the technical restriction τ ≥ s as Theorem 4.3 and the bounds from [START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF][START_REF] Sidorenko | Decoding Interleaved Gabidulin Codes and Multisequence Linearized Shift-Register Synthesis[END_REF]. The following theorem summarizes our results.

Theorem 4.4 (Unique Decoding of Interleaved Gabidulin Codes).

Let the interleaved Gabidulin code IGab[s; n, k (1) , . . . , k (s) ] over F q m consist of the elementary codewords

c (i) = f (i) (g), where deg q f (i) (x) < k (i) , ∀i ∈ [1, s],
and let the given elementary received words r (i) , ∀i ∈ [1, s], consist of random elements uniformly distributed over F q m . Then, with probability at least

1 -4q -m(s(n-τ )-s i=1 k (i) -t+1) ,
we can nd a unique solution f (1) (x), . . . , f (s) (x) such that its evaluation at g is in rank distance

t ≤ τ = sn -s i=1 k (i) s + 1
to (r (1)T r (2)T . . . r (s)T ) T with overall complexity at most O(s 3 n 2 ).

E E D

Example 4.2 (Failure Probabilities).

Consider the IGab[s = 2; n = 7, k (1) = 2, k (2) = 2] code over F 2 7 . The maximum decoding radius for unique as well as for list decoding according to (4.9) and (4.16) is τ = 3 whereas a BMD decoder guarantees to correct all errors of rank at most τ 0 = 2. In order to estimate the failure probability, we simulated 10 7 random error matrices (e (1)T e (2)T . . . e (s)T ) T ∈ F s×n q m , uniformly distributed over all matrices of rank t = τ = 3. The following simulated probabilities occurred:

P rk(Q) < sk = P rk(S) < τ = P rk(R R ) < n -1 = 6.12 • 10 -5 .
As a comparison, the average list size calculated with Lemma 4.6 is ℓ I < 1 + 6.104 • 10 -5 , the upper bound from Theorem 4.3 (and therefore the upper bound from (4.4), [START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF]) gives

P rk(Q) < sk ≤ P rk(R R ) < n -1 ≤ 0.04632,
and the bound from Lemma 4.9 gives

P rk(Q) < sk ≤ 4q -m(s(n-k-τ )-τ +1) = 2.44 • 10 -4 .
Due to the simulation results, we conjecture that if and only if rk(Q) < sk, then rk(S) < τ and rk(R R ) < n -1. Hence, we believe that Lemma 4.8 holds in both directions.

Error-Erasure Decoding

This section is in some sense a generalization of Subsection 3.2.3 and outlines brie y how interpolationbased error-erasure decoding of interleaved Gabidulin codes over F q m with n = m can be done. We assume that γ column erasures and ̺ (i) row erasures, ∀i ∈ [1, s], occurred. This notation is based on the following decomposition of the interleaved error, which generalizes (3.34):

     e (1)
e (2) . . .

e (s)      =      a (1,R) • B (1,R) a (2,R) • B (2,R) . . . a (s,R) • B (s,R)      +      a (1,C) a (2,C) . . . a (s,C)      • B (C) +      a (1,E) a (2,E) . . . a (s,E)      • B (E) ∈ F s×n q m , (4.18)
where anda (1,R) , a (2,R) , . . . , a (s,R) and B (C) are known on the receiver side. Lemma 4.10 shows later why the a (i,R) and B (i,R) can be di erent whereas B (C) has to be common for all i ∈ [1, s]. Moreover, this model of errors and erasures is slightly more general than the one in [LSC13, Equation (19)], since there the a (i,R) are assumed to be equal.

a (i,R) ∈ F ̺ (i) q m , B (i,R) ∈ F ̺ (i) ×n q , a (i,C) ∈ F γ q m , B (C) ∈ F γ×n q , a (i,E) ∈ F t q m , B (E) ∈ F t×n q for all i ∈ [1, s],
Based on the known matrix B (C) and as in (3.35), we can calculate the following basis of the row space of the column erasures prior to the decoding process:

d (C) i = n-1 j=0 B (C) i,j g ⊥ j = n-1 j=0 B (C) i,j β [j] , ∀i ∈ [0, γ -1]. (4.19)
As in (3.36), we de ne Γ (C) (x) and Λ (i,R) (x), ∀i ∈ [1, s], as linearized polynomials of smallest q-degree such that:

Γ (C) d (C) j = 0, ∀j ∈ [0, γ -1], Λ (i,R) a (i,R) j = 0, ∀j ∈ [0, ̺ (i) -1], i ∈ [1, s]. (4.20) A I G C Let r (i) (x) denote the q-transform of r (i) (x), ∀i ∈ [1, s],
as in De nition 2.12, then we de ne s modi ed transformed received words (similar to Subsection 3.2.3) by:

y (i) (x) def = Λ (i,R) r (i) (Γ (C) (x [γ] )) mod (x [m] -x), ∀i ∈ [1, s],
where Γ (C) (x) is the full q-reverse of Γ (C) (x) as in Lemma A.1.

Lemma 4.10 (Rank of Modi ed Interleaved Error).

Let n = m and let e (i,RC) = Λ (i,R) e (i) (Γ (C) (g [γ] )) RC) . . .

∈ F n q m , ∀i ∈ [1, s]. Further, let e (i,E) = a (i,E) • B (E) , ∀i ∈ [1, s], as in (4.18) with rk e (1,E)T e (2,E)T . . . e (s,E)T = t. Then, rk      e (1,RC) e (2,
e (s,RC)      ≤ rk      e (1,E) e (2,E) . . . e (s,E)      = t.
Proof. The proof is a straight-forward generalization of the proof of Lemma 3.11 and we obtain:

     e (1,RC) e (2,RC) . . . e (s,RC)      =      Λ (1,R) e (1,E) (g 0 ) Λ (1,R) e (1,E) (g 1 ) . . . Λ (1,R) e (1,E) (g m-1 ) Λ (2,R) e (2,E) (g 0 ) Λ (2,R) e (2,E) (g 1 ) . . . Λ (2,R) e (2,E) (g m-1 ) . . . . . . . . . . . . Λ (s,R) e (s,E) (g 0 ) Λ (s,R) e (s,E) (g 1 ) . . . Λ (s,R) e (s,E) (g m-1 )      • G, where G = G i,j i∈[0,m-1] j∈[0,m-1] ∈ F m×m q is de ned such that Γ (C) (g j ) =
m-1 i=0 G i,j g i and the statement follows as in Lemma 3.11. Lemma 4.10 requires that Γ (C) (x) is common for all i ∈ [1, s], whereas Λ (i,R) (x) can be di erent. This clari es why B (C) has to be independent of i.

Hence, similar to error-erasure decoding of Gabidulin codes in Subsection 3.2.3, we use y (i) (g), ∀i ∈ [1, s], as the input of interpolation-based decoding and treat y (i) (g) in the same way as the transform of a codeword of an interleaved Gabidulin code of elementary dimensions k (i) + ̺ (i) + γ, which is corrupted by an error of overall rank t.

As in Problem 4.1, we look for an (s + 1)-variate linearized polynomial Q(x, y 1 , . . . ,

y s ) = Q 0 (x) + Q 1 (y 1 ) + • • • + Q s (y s ), which satis es for given integers n, τ , k (i) , ̺ (i) , γ, ∀i ∈ [1, s]: • Q(g j , y (1) (g j ), y (2) (g j ), . . . , y (s) (g j )) = 0, ∀j ∈ [0, n -1], • deg q Q 0 (x) < n -τ , • deg q Q i (y i ) < n -τ -(k (i) -γ -̺ (i) -1), ∀i ∈ [1, s].
Similar to Lemma 4.2, a non-zero interpolation polynomial Q(x, y 1 , . . . , y s ), which satis es the above mentioned conditions, exists if

τ < sn -s i=1 (k (i) + ̺ (i) + γ) + s s + 1 . If k (i) = k, and
̺ (i) = ̺, ∀i ∈ [1, s], we obtain τ < s(n -k + 1 -̺ -γ)/(s + 1).
The interpolation and root-nding procedure is straight forward to the errors-only approach from Section 4.2 and returns Λ (i,R) f (i) (Γ (C) (x [γ] )) , ∀i ∈ [1, s], in rank distance at most τ . In order to 4.5 S O obtain f (i) (x), we have to divide from the left and right by Λ (i,R) (x) and Γ (C) (x [γ] ), respectively, ∀i ∈ [1, s], as in Subsection 3.2.3.

With this principle, our interpolation-based decoding algorithm can be applied to (unique or list) error-erasure decoding of interleaved Gabidulin codes.

For interpolation-based error-erasure decoding in Hamming metric it is more common to puncture the code at the erased positions and interpolate an (interleaved) code of smaller length and same dimension(s) as the original code, whereas we interpolate a code, which has the same length as the original code, but higher dimension(s).

Summary and Outlook

This chapter considers decoding approaches for interleaved Gabidulin codes. First, two known decoding principles are described and a relation between them is proven. Second, we have presented a new approach for decoding interleaved Gabidulin codes based on interpolating a multi-variate linearized polynomial. The procedure consists of two steps: an interpolation step and a root-nding step, where both can be accomplished by solving a linear system of equations. This new decoder for interleaved Gabidulin codes can be used as a list decoder as well as a unique decoder with a certain failure probability. The complexity of the unique decoder as well as nding a basis of all solutions of the list decoder is quadratic in the length of the code. The output of both decoders is a unique decoding result with high probability. Further, we have derived a connection to the two known approaches for decoding interleaved Gabidulin codes. This relation provides an upper bound on the failure probability of our unique decoder.

For future work, the big challenge is to increase the decoding radius (for Gabidulin as well as interleaved Gabidulin codes). Nearby goals are to apply re-encoding in order to reduce the complexity and to use subspace evasive subsets for the elimination of the valid solutions in the list decoder as Guruswami and Wang did in [START_REF] Guruswami | Linear-Algebraic List Decoding for Variants of Reed-Solomon Codes[END_REF].

4 D A I G C CHAPTER 5
Bounds on List Decoding of Block Codes in Rank Metric T was introduced by Elias [Eli57] and Wozencraft [START_REF] Wozencraft | List Decoding[END_REF] stating that a list decoder returns the list of all codewords in distance at most τ from any given word. The Johnson bound in Hamming metric [START_REF] Johnson | A new Upper Bound for Error-Correcting Codes[END_REF][START_REF] Bassalygo | New Upper Bounds for Error Correcting Codes[END_REF][START_REF] Guruswami | List Decoding of Error-Correcting Codes[END_REF] shows that for any code of length n and minimum Hamming distance d H , the size of this list is polynomial in n for any τ less than the Johnson radius, i.e., τ < τ J = nn(nd H ). Although this fact has been known since the 1960s, a polynomial-time list decoding algorithm for Reed-Solomon codes up to the Johnson radius was found not earlier than 1999 by Guruswami and Sudan [START_REF] Guruswami | Improved Decoding of Reed-Solomon and Algebraic-Geometry Codes[END_REF] as a generalization of the Sudan algorithm [START_REF] Sudan | Decoding of Reed-Solomon Codes beyond the Error-Correction Bound[END_REF]. Moreover, in Hamming metric, it can be shown that there exists a code such that the list size becomes exponential in n beyond the Johnson radius [GRS00], [Gur99, Chapter 4]. It is not known whether such an exponential list beyond the Johnson radius also exists for Reed-Solomon codes. Several publications show an exponential behavior of the list size for Reed-Solomon codes only for a radius rather greater than τ J (see e.g. Justesen and Høholdt [START_REF] Justesen | Bounds on List Decoding of MDS Codes[END_REF] and Ben-Sasson, Kopparty and Radhakrishnan [START_REF] Ben-Sasson | Subspace Polynomials and Limits to List Decoding of Reed-Solomon Codes[END_REF]).

However, for Gabidulin codes, so far there exists no polynomial-time list decoding algorithm (beyond half the minimum distance) and it is not even known whether it can exist or not. The contributions by Mahdavifar and Vardy [START_REF] Mahdavifar | Algebraic List-Decoding on the Operator Channel[END_REF][START_REF] Mahdavifar | List-Decoding of Subspace Codes and Rank-Metric Codes up to Singleton Bound[END_REF] and by Guruswami and Xing [START_REF] Guruswami | List Decoding Reed-Solomon, Algebraic-Geometric, and Gabidulin Subcodes up to the Singleton Bound[END_REF] provide list decoding algorithms for special classes of Gabidulin codes and subcodes of Gabidulin codes.

In this chapter, we investigate bounds on list decoding rank-metric codes in general and Gabidulin codes in particular in order to understand if polynomial-time list decoding algorithms can exist or not. We derive three bounds on the maximum list size when decoding rank-metric codes. In spite of the numerous similarities between Hamming metric and rank metric and even more between Reed-Solomon and Gabidulin codes, all three bounds reveal a strongly di erent behavior compared to Hamming metric.

On the one hand, a lower bound on the maximum list size, which is exponential in the length n of the code, rules out the possibility of polynomial-time list decoding since already writing down the list has exponential complexity. On the other hand, a polynomial upper bound-similar to the Johnson bound for Hamming metric-shows that a polynomial-time list decoding algorithm might exist.

In Section 5.1, we state (partly informally) known bounds on list decoding in Hamming metric. In Section 5.2, we explain connections between constant-dimension codes, constant-rank codes and the list of codewords and state the problem. We derive a lower bound (Bound I) for Gabidulin codes of length n and minimum rank distance d in Section 5.3. It proves that the list size can become exponential if the radius is at least the Johnson radius τ J = nn(nd). The second bound (Bound II, Section 5.4) is an exponential upper bound for any rank-metric code, which provides no conclusion about polynomialtime list decodability. Finally, in Section 5.5, the third bound (Bound III) shows that there exists a rank-metric code over F q m of length n ≤ m such that the list size is exponential in the length n when

L D B C R M
the decoding radius is greater than half the minimum distance. An interpretation of our bounds and a comparison to bounds on list decoding in Hamming metric is shown in Section 5.6. The bound presented in Section 5.3 was published in [Wac12] and the bounds from Sections 5.4 and 5.5 in [Wac13b]. The journal paper [Wac13a] contains a detailed description of all three bounds.

Known Bounds on the List Size for Codes in Hamming Metric

Without going into depth, we want to state some of the bounds on list decoding of codes in Hamming metric, in particular Reed-Solomon codes.

De nition 5.1 (Hamming Weight and Hamming Distance).

The Hamming weight of a = (a 0 a 1 . . . a n-1 ) ∈ F n q is de ned as

wt H (a) def = | supp(a)| def = |a i = 0, i ∈ [0, n -1]|,
and the Hamming distance between a and b ∈ F n q is the Hamming weight of the di erence:

d H (a, b) def = wt H (a -b) = | supp(a -b)|.
In conformance with the notations for codes in rank metric, an (n, M, d) H code C over F q is a code of length n, cardinality M and minimum Hamming distance d.

The q-ary and the alphabet-independent Johnson bounds in Hamming metric (stated in the following) show that from a combinatorial point of view, list decoding of any (not necessarily linear) code in Hamming metric is feasible up to the Johnson radius. A thorough discussion of the Johnson bound and related combinatorial aspects can be found in Guruswami's books [Gur07, Chapter 3] and [Gur99, Chapter 3].

Theorem 5.1 (q-ary Johnson Bound in Hamming Metric [START_REF] Johnson | A new Upper Bound for Error-Correcting Codes[END_REF][START_REF] Johnson | Improved Asymptotic Bounds for Error-Correcting Codes[END_REF][START_REF] Bassalygo | New Upper Bounds for Error Correcting Codes[END_REF]). For any (n, M, d) H code C over F q of length n and minimum Hamming distance d and any integer τ such that τ 2 > (1 -1 /q) (2τd)n, the list size ℓ H is upper bounded by

ℓ H def = max r∈F n q C ∩ B (τ ) H (r) ≤ (1 -1 /q) nd τ 2 -(1 -1 /q) (2τ -d)n , (5.1) where B (τ )
H (r) denotes a ball around r of radius τ in Hamming metric.

The alphabet-independent (or generic) Johnson bound (5.2) follows from upper bounding (5.1) for any q > 1. Clearly, when q is large, then (1 -1 /q) → 1 and the two bounds are equivalent. However, for small q (especially for binary codes), it can be much better to take into account the alphabet size and to use (5.1).

Corollary 5.1 (Johnson Bound in Hamming Metric).

For any (n, M, d) H code C over F q of length n and minimum Hamming distance d and any integer

τ < τ J def = n -n(n -d), the list size ℓ H is upper bounded by ℓ H def = max r∈F n q C ∩ B (τ ) H (r) ≤ nd τ 2 -(2τ -d)n = nd (n -τ ) 2 -n(n -d) .
(5.2)

5.1 K B L S C H M
The restriction τ <τ J holds since the denominator has to be greater than zero. An improvement of the numerator of (5.2) from nd to n(d -τ ) was shown by Cassuto and Bruck in [START_REF] Cassuto | A Combinatorial Bound on the List Size[END_REF]. Thus, the Johnson bound proves that any ball in Hamming metric of radius less than the Johnson radius τ J = n -n(n -d) always contains a polynomial number of codewords of any code in Hamming metric of length n and minimum Hamming distance d.

From a combinatorial point of view, the Johnson bound is tight as a relation between list decodability and the minimum Hamming distance since it can be shown that there exist codes in Hamming metric such that the list size becomes exponential in n if the radius is slightly greater than the Johnson radius. For general (not necessarily linear) codes this was shown by Goldreich, Rubinfeld and Sudan [START_REF] Goldreich | Learning Polynomials with Queries: the Highly Noisy Case[END_REF]. Guruswami extended this result to linear codes, stating that there exists a linear code in Hamming metric such that the size of the list grows super-polynomially in n when the radius of the ball is at least the Johnson radius [Gur99, Chapter 4]. However, he proved this only using a widely-accepted number theoretic conjecture [Gur99, Theorem 4.7]. These results do not imply that the Johnson bound is tight for any code in Hamming metric-it rather means that there are some codes for which it is tight.

In particular, it is not known whether such an exponential list slightly beyond the Johnson radius also exists for Reed-Solomon codes. Justesen and Høholdt [START_REF] Justesen | Bounds on List Decoding of MDS Codes[END_REF] and Ben-Sasson, Kopparty and Radhakrishnan [START_REF] Ben-Sasson | Subspace Polynomials and Limits to List Decoding of Reed-Solomon Codes[END_REF] showed an exponential behavior of the list size for Reed-Solomon codes only for a radius rather greater than τ J . However, Guruswami and Rudra's limits to list recovery (which is a more general scenario) of Reed-Solomon codes indicate that the Johnson bound might be tight also for Reed-Solomon codes [START_REF] Guruswami | Limits to List Decoding Reed-Solomon Codes[END_REF].

Codes Connected to the List of Decoding and Problem Statement

This section shows relations between constant-dimension and constant-rank codes, states the problem and shows a connection between constant-rank codes and the resulting list when list decoding codes in rank metric. These relations are used for our bounds in Sections 5.4 and 5.5.

Connection between Constant-Dimension and Constant-Rank Codes

This section recalls and generalizes some of the connections between constant-dimension and constantrank codes by Gadouleau and Yan [START_REF] Gadouleau | Constant-Rank Codes and Their Connection to Constant-Dimension Codes[END_REF]. The rst lemma shows a connection between the subspace distance and the rank distance and is a special case of [GY10, Theorem 1].

Lemma 5.1 (Connection between Subspace and Rank Distance [GY10, Theorem 1]). Let X, Y ∈ F m×n q with rk(X) = rk(Y). Then:

1 2 d s R q (X) , R q (Y) + 1 2 d s C q (X) , C q (Y) ≤ d R (X, Y) ≤ min 1 2 d s R q (X) , R q (Y) , 1 2 d s C q (X) , C q (Y) + rk(X).
Proof. Let us denote r def = rk(X) = rk(Y). As in Lemma 3.8, we decompose X = C T R and Y = D T S, where C, D ∈ F r×m q and R, S ∈ F r×n q and all four matrices have full rank. Hence,

X -Y = (C T | -D T ) • (R T |S T ) T .
In general, it is well-known that rk(AB) ≤ min{rk(A), rk(B)} and rk(AB) ≥ rk(A) + rk(B)n when A has n columns and B has n rows. Therefore,

rk(C T | -D T ) + rk(R T |S T ) -2r ≤ rk(X -Y) = rk (C T | -D T ) • (R T |S T ) T (5.3) ≤ min rk(C T | -D T ), rk(R T |S T ) .
Let C q C T + C q D T denote the smallest subspace containing both column spaces. Then,

rk(C T | -D T ) = dim(C q C T + C q D T ) = dim(C q C T + C q D T ) - 1 2 dim(C q C T ) + dim(C q D T ) + 1 2 dim(C q C T ) + dim(C q D T ) = 1 2 d s (C q C T , C q D T ) + r = 1 2 d s (C q (X) , C q (Y)) + r,
and in the same way

rk(R T |S T ) = 1 2 d s (R q (X) , R q (Y)) + r.
Inserting this into (5.3), the statement follows.

Lemma 5.1 can equivalently be derived using [MS74, Equation (4.3)], which also results in (5.3) and then we can use the same reformulations for the subspace distance.

For the proof of the upper bound in Theorem 5.3 (see Section 5.4), the following upper bound on the maximum cardinality of a constant-rank code is applied. It shows a relation between the maximum cardinalities of a (not necessarily linear) constant-rank and a constant-dimension code. For all q and 1 ≤ δ ≤ r ≤ n ≤ m, the maximum cardinality of a CR q m (n, M, d R = δ + r, r) constantrank code over F q m is upper bounded by the maximum cardinality of a constant-dimension code as follows:

A R q m (n, d R = δ + r, r) ≤ A S q (n, d s = 2δ, r) .
However, the connections between constant-dimension and constant-rank codes are even more far-reaching. The following proposition shows explicitly how to construct constant-rank codes out of constant-dimension codes and is a generalization of [GY10, Proposition 3] to arbitrary cardinalities.

Proposition 5.2 (Construction of a Constant-Rank Code).

Let M be a CD q (m, |M|, d s,M , r) and N be a CD q (n, |N|, d s,N , r) constant-dimension code with r ≤ min{n, m} and cardinalities |M| and |N|. Then, there exists a

CR q m (n, M R , d R , r) constant-rank code C of cardinality M R = min{|M|, |N|} with C q (C) ⊆ M and R q (C) ⊆ N. Further, the minimum rank distance d R of C is d R ≥ 1 2 d s,M + 1 2 d s,N ,
and if |M| = |N| additionally:

d R ≤ 1 2 min d s,M , d s,N + r. Proof. Let G i ∈ F r×m q and H i ∈ F r×n q , ∀i ∈ [1, min{|M|, |N|}],
be full-rank matrices, whose row spaces are min{|M|, |N|} codewords (which are subspaces themselves) of M and N, respectively. Let C be a CR q m (n, M R , d R , r R ) constant-rank code, de ned by the set of codewords

A i = G T i H i , ∀i ∈ [1, min{|M|, |N|}].
All such codewords A i are distinct, since the row spaces of all G i , respectively H i , are di erent. These codewords A i are m × n matrices of rank exactly r R = r since G i ∈ F r×m q and H i ∈ F r×n q have rank r. The cardinality is |C| = M R = min{|M|, |N|} and C q (C) ⊆ M and R q (C) ⊆ N by Lemma 3.8. The lower bound on the minimum rank distance follows from Lemma 5.1 for di erent A i , A j :

d R ≥ 1 2 d s (R q (A i ) , R q (A j )) + 1 2 d s (C q (A i ) , C q (A j )) ≥ 1 2 d s,N + 1 2 d s,M .
If |M| = |N|, there exist two matrices A i , A j such that d s (R q (A i ) , R q (A j )) = d s,N . Then, Lemma 5.1 gives d R ≤ d s,N + r. If we choose A i and A j such that d s (C q (A i ) , C q (A j )) = d s,M , then d R ≤ d s,M + r and the upper bound on the rank distance follows.

Problem Statement

We analyze the question of polynomial-time list decodability of rank-metric codes. Thus, we want to bound the maximum number of codewords in a ball of radius τ around a received word r. This number will be called the maximum list size ℓ in the following. The worst-case complexity of a possible list decoding algorithm directly depends on ℓ. Whenever the parameters m, n, d, τ are clear from the context, we will use the short-hand notation ℓ for the maximum list size. For an upper bound on ℓ, we have to show that the bound holds for any received word r, whereas for a lower bound on ℓ it is su cient to show that there exists (at least) one r for which this bound on the list size is valid. W.l.o.g. we assume throughout this chapter that n ≤ m. If this is not the case, we consider the transpose of all matrices such that also n ≤ m holds. We call n the length of such a block code in rank metric over F q m . Moreover, if we restrict ourselves to Gabidulin codes rather than arbitrary rank-metric codes, the task becomes more di cult due to the additional imposed structure of the code.

Let us denote the list of all codewords of an (n, M, d) R code C in the ball of rank radius τ around a given word r by:

L C, r def = C ∩ B (τ ) R (r) = c (1) , c (2) , . . . , c (|L|) : c (i) ∈ C and rk(r -c (i) ) ≤ τ, ∀i .
(5.4)

Clearly, the cardinality is |L C, r | ≤ ℓ.

Connection between Constant-Rank Codes and the List of Decoding

Before proving our bounds, let us explain the connection between the list size for decoding a certain rank-metric code and the cardinality of a certain constant-rank code. As in (5.4), denote the list of codewords for an (n, M, d R = d) R code C and for τ < d by

L C, r = c (1) , c (2) , . . . , c (|L|) = C ∩ B (τ ) R (r) = τ i=0 C ∩ S (i) R (r) ,
for some (received) word r ∈ F n q m . If we consider only the codewords with rank distance exactly τ from the received word, i.e., on the sphere S (τ ) R (r):

c (1) , c (2) , . . . , c (ℓ) def = C ∩ S (τ ) R (r),
we obtain a lower bound on the maximum list size:

ℓ ≥ ℓ = |C ∩ S (τ )
R (r)|. Now, consider a translate of all codewords on the sphere of radius τ as follows:

L C, r def = r -c (1) , r -c (2) , . . . , r -c (ℓ) . This set L C, r is a CR q m (n, M R , d R ≥ d, τ ) constant-rank code over F q m since rk(r -c (i) ) = τ , ∀i ∈ [1, ℓ],
and its minimum rank distance is at least d, since

rk(r -c (i) -r + c (j) ) = rk(c (i) -c (j) ) ≥ d, ∀i, j ∈ [1, ℓ], i = j.
The cardinality of this constant-rank code is M R = ℓ. For τ < d, this constant-rank code is non-linear (or a translate of a linear code if C is linear), since the rank of its codewords is τ , but its minimum distance is at least d.

Hence, a translate of the list of all codewords of rank distance exactly τ from the received word can be interpreted as a constant-rank code. This interpretation makes it possible to use bounds on the cardinality of a constant-rank codes to obtain bounds on the list size ℓ for decoding rank-metric codes. This is also illustrated in Figure 5.2.

A Lower Bound on the List Size for Gabidulin Codes

In this section, we provide a lower bound on the list size when decoding Gabidulin codes. The proof is based on the evaluation of linearized polynomials and is inspired by Justesen and Høholdt's [START_REF] Justesen | Bounds on List Decoding of MDS Codes[END_REF] and Ben-Sasson, Kopparty, and Radhakrishnan's [START_REF] Ben-Sasson | Subspace Polynomials and Limits to List Decoding of Reed-Solomon Codes[END_REF] approaches for bounding the list size of Reed-Solomon codes.

Theorem 5.2 (Bound I: Lower Bound on the List Size).

Let the linear Gabidulin code Gab[n, k] over F q m with n ≤ m and d R = d = nk + 1 be given. Let τ < d. Then, there exists a word r ∈ F n q m such that the maximum list size ℓ satis es

ℓ = ℓ m, n, d, τ ≥ Gab[n, k] ∩ S (τ ) R (r) ≥ n n-τ (q m ) n-τ -k
≥ q m q τ (m+n)-τ 2 -md , (5.5)

and for the special case of n = m: ℓ ≥ q n q 2nτ -τ 2 -nd .

Proof. Since we assume τ < d = nk + 1, also k -1 < nτ holds. Let us consider all monic linearized polynomials of q-degree exactly nτ whose root spaces have dimension nτ and all roots lie in F q n . There are exactly (see e.g. [Ber84, Theorem 11.52]) n n-τ such polynomials. Now, let us consider a subset of these polynomials, denoted by P: all polynomials where the q-monomials of q-degree greater than or equal to k have the same coe cients. Due to the pigeonhole principle, there exist coe cients such that the number of such polynomials is

|P| ≥ n n-τ (q m ) n-τ -k ,
since there are (q m ) n-τ -k possibilities to choose the highest nτ -(k -1) coe cients of a monic linearized polynomial with coe cients F q m . Note that the di erence of any two polynomials in P is a linearized polynomial of q-degree strictly less than k and therefore the evaluation polynomial of a codeword of Gab[n, k].

5.4 A U B L S R M C
The rank weight distribution of MRD codes was given in [Gab85, Section 3] and therefore the number of codewords of rank τ in C ⊕ B is

W τ (C ⊕ B) = n τ (q m -1).
The cardinality of the code B is |B| = q m(d-τ ) and therefore, with the pigeonhole principle, there exists a vector b ∈ B such that the number of codewords in the translated code C ⊕ b is lower bounded by

W τ (C ⊕ b) ≥ n τ (q m -1) q m(d-τ ) .
(5.7)

Hence, the number of codewords of C in rank distance τ from b is W τ (C ⊕ b) and (5.7) yields the same lower bound on ℓ as Theorem 5.2.

Example 5.1 (List Decoding of Gab[12, 6] Code).

For the Gabidulin code Gab[12, 6] over F 2 12 with d = 7, the BMD decoding radius is τ 0 = ⌊ (d-1) /2⌋ = 3. The radius from (5.6) with ǫ = 0.9 is τ J = ⌈3.58⌉ = 4. Hence, for this code of rate k/n = 1/2, no polynomial time list-decoding beyond τ 0 is possible.

An Upper Bound on the List Size for Rank-Metric Codes

In this section, we will derive an upper bound on the list size when decoding rank-metric codes. This upper bound holds for any rank-metric code and any received word.

Theorem 5.3 (Bound II: Upper Bound on the List Size).

Let ⌊ (d-1) /2⌋ ≤ τ < d ≤ n ≤ m. Then, for any (n, M, d) R code C in rank metric, the maximum list size is upper bounded as follows:

ℓ = ℓ m, n, d, τ = max r∈F n q m C ∩ B (τ ) R (r) ≤ 1 + τ t=⌊ d-1 2 ⌋+1 n 2t+1-d t 2t+1-d ≤ 1 + 4 τ t=⌊ d-1 2 ⌋+1 q (2t-d+1)(n-t) ≤ 1 + 4 • τ -d-1 2 • q (2τ -d+1)(n-⌊ (d-1) /2⌋-1) .
(5.8)

Proof. Let {c (1) , c (2) , . . . , c (ℓ) } denote the intersection of the sphere S (t) R (r) in rank metric around r and the code C. As explained in Section 5.2.3, L C, r = rc (1) , rc (2) , . . . , rc (ℓ) can be seen as a CR q m (n, M R , d R ≥ d, t) constant-rank code over F q m for a word r ∈ F n q m . Therefore, for any word r ∈ F n q m , the cardinality of L C, r can be upper bounded by the maximum cardinality of a constant-rank code with the corresponding parameters:

|L C, r | = C ∩ S (t) R (r) ≤ A R q m (n, d R ≥ d, t) ≤ A R q m (n, d, t) . L D B C R M
We can upper bound this maximum cardinality by Proposition 5.1 with δ = dt and r = t by the maximum cardinality of a constant-dimension code:

A R q m (n, d, t) ≤ A S q (n, d s = 2(d -t), t) .
For upper bounding the cardinality of such a constant-dimension code, we use the Wang-Xing-Safavi-Naini bound [START_REF] Wang | Linear Authentication Codes: Bounds and Constructions[END_REF] (often also called anticode bound) and obtain:

A S q (n, d s = 2(d -t), t) ≤ n t-(d-t)+1 t t-(d-t)+1
.

(5.9)

In the ball of radius ⌊ (d-1) /2⌋ around r, there can be at most one codeword of C and therefore, the contribution to the list size is at most one. For higher t, we sum up (5.9) from t = ⌊ (d-1) /2⌋ + 1 to τ , use the upper bound on the q-binomial (2.1) and upper bound the sum.

In [Wac12, Theorem 2], we showed an alternative proof of Theorem 5.3 based on the intersection of subspaces, but implicitly it re-derives the Wang-Xing-Safavi-Naini bound [START_REF] Wang | Linear Authentication Codes: Bounds and Constructions[END_REF].

The bound can slightly be improved if we use better upper bounds on the maximum cardinality of constant-dimension codes instead of (5.9) in the derivation, for example the iterated Johnson bound for constant-dimension codes [XF09, Corollary 3]. In this case, we obtain:

ℓ = ℓ m, n, d, τ ≤ 1 + τ t=⌊ d-1 2 ⌋+1 q n -1 q t -1 q n-1 -1 q t-1 -1 . . . q n+d-2t -1 q d-t -1 . . . .
However, the Wang-Xing-Safavi-Naini bound provides a nice closed-form expression and is asymptotically tight. Therefore, using better upper bounds for constant-dimension codes does not change the asymptotic behavior of our upper bound. Unfortunately, our upper bound on the list size of rank-metric codes is exponential in the length of the code and not polynomial as the Johnson bound for Hamming metric. However, the lower bound in Section 5.5 will show that any upper bound depending only on the length n ≤ m and the minimum rank distance d will be exponential in (τ -⌊ (d-1) /2⌋)(nτ ), since there exists a rank-metric code with such a list size.

A Lower Bound on the List Size for Rank-Metric Codes

The bound presented in this section shows the most signi cant di erence to bounds for codes in Hamming metric. We show the existence of a rank-metric code with exponential list size for any decoding radius greater than half the minimum distance. First, we prove the existence of a certain constant-rank code in the following theorem.

Theorem 5.4 (Constant-Rank Code). Let ⌊ (d-1) /2⌋ + 1 ≤ τ < d ≤ n ≤ m and τ ≤ n -τ . Then, there exists a CR q m (n, M R , d R ≥ d, τ ) constant-rank code over F q m of cardinality M R = q (n-τ )(τ -⌊ (d-1) /2⌋) .
Proof. First, assume d is even. Let us construct a CD q (m, |M |, d, τ ) constant-dimension code M and a CD q (n, |N |, d, τ ) code N by lifting an MRD[τ, τd /2 + 1] code over F q m-τ of minimum rank distance d/2 and an MRD[τ, τd /2 + 1] code over F q n-τ of minimum rank distance d/2 as in Lemma 2.18. Then, with Lemma 2.18:

|N| = q (n-τ )(τ -d /2+1) ≤ |M| = q (m-τ )(τ -d /2+1) . 5.5 A L B L S R M C
From Proposition 5.2, we know therefore there exists a CR q m (n, M R , d R , τ ) code of cardinality

M R = min |N|, |M| = q (n-τ )(τ -d/2+1) = q (n-τ )(τ -⌊ (d-1) /2⌋) .
For its rank distance by Proposition 5.2, the following holds:

d R ≥ 1 2 d S,M + 1 2 d S,N = d.
Second, assume d is odd. Let M be a CD q (m, |M |, d -1, τ ) code constructed by the lifting of an MRD[τ, τ -(d-1) /2 + 1] code over F q m-τ and let N be a CD q (n, |N |, d + 1, τ ) code, constructed by lifting an MRD[τ, τ -(d+1) /2 + 1] code over F q n-τ code as in Lemma 2.18. Then,

|N| = q (n-τ )(τ -(d+1) /2+1) ≤ |M| = q (m-τ )(τ -(d-1) /2+1) .
From Proposition 5.2, we know that there exists a CR q m (n, M R , d R , τ ) code of cardinality

M R = min |N|, |M| = |N| = q (n-τ )(τ -(d-1) /2) = q (n-τ )(τ -⌊ (d-1) /2⌋) .
With Proposition 5.2, the rank distance d R is lower bounded by:

d R ≥ 1 2 d S,M + 1 2 d S,N = 1 2 (d -1) + 1 2 (d + 1) = d.
This constant-rank code can now directly be used to show the existence of a rank-metric code with exponential list size.

Theorem 5.5 (Bound III: Lower Bound on the List Size). Let ⌊ (d-1) /2⌋ + 1 ≤ τ < d ≤ n and τ ≤ nτ . Then, there exists an (n, M, d R ≥ d) R code C over F q m of length n ≤ m and minimum rank distance d R ≥ d, and a word r ∈ F n q m such that

ℓ = ℓ m, n, d, τ ≥ C ∩ B (τ ) R (r) ≥ q (n-τ )(τ -⌊ (d-1) /2⌋) .
(5.10)

Proof. Let the CR q m (n, M R , d R ≥ d, τ ) constant-rank code from Theorem 5.4 consist of the codewords: a (1) , a (2) , . . . , a (|N|) .

This code has cardinality M R = |N| = q (n-τ )(τ -⌊ (d-1) /2⌋) (see Theorem 5.4). Choose r = 0, and hence, rk(ra (i) ) = rk(a (i) ) = τ , ∀i ∈ [1, |N|] since the a (i) are codewords of a constant-rank code of rank τ . Moreover, d R (a (i) , a (i) ) = rk(a (i)a (j) ) ≥ d since the constant-rank code has minimum rank distance at least d. Therefore, a (1) , a (2) , . . . , a (|N|) are codewords of an (n, M, d R ≥ d) R code C over F q m in rank metric, which all lie on the sphere of rank radius τ around r = 0 (which is not a codeword of C).

Hence, there exists an

(n, M, d R ≥ d) R code C over F q m of length n ≤ m such that ℓ ≥ |C ∩ B (τ ) R (r)| ≥ |C ∩ S (τ ) R (r)| = |N| = q (n-τ )(τ -⌊ (d-1) /2⌋
) . Notice that this (n, M, d R ≥ d) R code in rank metric is non-linear since it has codewords of weight τ < d, but minimum rank distance at least d.

L D B C R M
For constant code rate R = k/n and constant relative decoding radius τ /n, where τ > ⌊ (d-1) /2⌋, (5.10) gives

ℓ ≥ q n 2 (1-τ /n)(τ /n-(1-R)/2) = q n 2 •const .
Therefore, the lower bound for this (n, M, d R ≥ d) R code is exponential in n ≤ m for any τ > ⌊ (d-1) /2⌋. Hence, Theorem 5.5 shows that there exist rank-metric codes, where the number of codewords in a rank-metric ball around the all-zero word is exponential in n, thereby prohibiting a polynomial-time list decoding algorithm. However, this does not mean that this holds for any rank metric code. In particular, the theorem does not provide a conclusion if there exists a linear code or even a Gabidulin code with this list size.

Remark 5.1 (Non-Zero Received Word). The rank-metric code C shown in Theorem 5.5 is clearly not linear. Instead of choosing r = 0, we can choose for example r = a (1) . The codewords of the CR q m (n, M R , d R ≥ d, τ ) constant-rank code from Theorem 5.4 of cardinality M R = |N| = q (n-τ )(τ -⌊ (d-1) /2⌋) are denoted by: a (1) , a (2) , . . . , a (|N|) .

Then, the following set of words c (1) , c (2) , . . . , c (|N|) def = 0, a (1)a (2) , a (1)a (3) , . . . , a (1)a (|N|) consists of codewords of an j) are codewords of the constantrank code of minimum rank distance d R . Moreover, all codewords c (i) have rank distance exactly τ from r since rk(rc (i) ) = rk(a (i) ) = τ and the same bound on the list size of C follows as in Theorem 5.5. This (n, M, d R ≥ d) R rank-metric code over F q m is not necessarily linear, but also not necessarily not linear.

(n, M, d R ≥ d) R code C over F q m since d R (c (i) , c (j) ) = rk(c (i) -c (j) ) = rk(a (1) -a (i) -a (1) + a (j) ) = rk(a (j) -a (i) ) ≥ d for i = j since a (i) , a (
The next corollary shows that the restriction τ ≤ nτ does not limit the code rate for which Theorem 5.5 shows an exponential behavior of the list size. For the special case of τ = ⌊ (d-1) /2⌋ + 1, the condition τ ≤ nτ is always ful lled for even minimum distance since d ≤ n. For odd minimum d -1 ≤ n has to hold. Notice that d = n is a trivial code.

Corollary 5.2 (Special Case τ = ⌊ (d-1) /2⌋ + 1). Let n ≤ m, τ = ⌊ (d-1) /2⌋ + 1 and d ≤ n -1 be odd. Then, there exists an

(n, M, d R ≥ d) R code C and a word r ∈ F n q m such that |C ∩ B (τ ) R (r)| ≥ q (n-τ ) .
This corollary hence shows that for any n ≤ m and any code rate there exists a rank-metric code of rank distance at least d whose list size can be exponential in n.

For the special case when d is even, τ = d/2 and n = m, the minimum rank distance of C is exactly d since the lower and upper bound on d R in Proposition 5.2 coincide.

R (r)| ≥ q (n-τ ) .
Corollaries 5.2 and 5.3 show that the condition τ ≤ nτ does not restrict lists of exponential size to a certain code rate. However, the following remark shows anyway what happens if we assume τ > nτ . Let ⌊ (d-1) /2⌋ + 1 ≤ τ < d ≤ n ≤ m and τ > nτ . Here, we can apply the same strategy as before: construct a constant-dimension code and show the existence of a constant-rank code of certain cardinality. For simplicity, let us consider only the case when d is even, the case of odd minimum distance follows straight-forward. Consider the lifting of a linear MRD[n-τ, n-τ -d/2+1] code C over F q τ of minimum rank distance d/2. The lifting is denoted by lift(C), i.e., we consider

[I τ C i ] with C i ∈ F τ ×(n-τ ) q
for all i = 1, . . . , |C|. In contrast to Lemma 2.18, we do not transpose the codewords of the MRD code here. The subspaces de ned by this lifting are a CD q (n, |N |, d s = d, τ ) constant-dimension code of cardinality q τ (n-τ -d/2+1) .

Then, with the same method as in Theorems 5.4 and 5.5 and a CD q (m, |M |, d, τ ) code M and a CD q (n, |N |, d, τ ) code N, there exists an

(n, M R , d R ≥ d) R code C in rank metric and a word r ∈ F n q m such that C ∩ B (τ ) R (r) ≥ q τ (n-τ -d/2+1
) . However, the interpretation of this value is not so easy, since it depends on the concrete values of τ, d and n if the exponent is positive and if this bound is exponential in n or not. Moreover, as mention before, we do not need this investigation for polynomial-time list decodability as we recall that Theorem 5.5 shows that the list size is lower bounded by q (n-τ ) if we choose τ = ⌊ (d-1) /2⌋ + 1 for codes of any rate, since then τ ≤ nτ is ful lled.

The following lemma shows an improvement in the exponent of the lower bound of Theorem 5.5 for the case τ = d/2 or when m is quite large compared to n. R (r) ≥ q (n-τ )(2τ -d+1) .

(5.11)

Proof. We use [GY10, Theorem 2], which shows that for 2r ≤ n ≤ m and 1 ≤ δ ≤ r there exists a constant-rank code of cardinality

A R q m (n, δ + r, r) = A S q (n, d s = 2δ, r) if either δ = r or m ≥ (n -r)(r -d + 1) + r + 1.
Thus, similar to the proof of Theorem 5.3, we choose r = τ and δ = dτ . Hence, there exists a

CR q m (n, M R , d, τ ) constant-rank code of cardinality M R = A S q (n, d s = 2(d -τ ), τ ) ≥ q (n-τ )(τ -(d-τ )+1) = q (n-τ )(2τ -d+1) ,
where we used the cardinality of a constant-dimension code based on a lifted MRD code (see Lemma 2.18) as lower bound. Analog to Theorem 5.5, we can use this constant-rank code to bound the list size.

For the case τ = d/2, this results in Corollary 5.3. Hence, for the cases of Lemma 5.2, the lower bound on the list size (5.11) and the upper bound (5.8) show the same asymptotic behavior and the upper bound is therefore asymptotically tight.

5B

L D B C R M

Summary, Comparison to Hamming Metric and Outlook

Let us interpret the results from the previous sections and compare them to known bounds on list decoding in Hamming metric (see e.g. [Gur99, Chapters 4 and 6]). Theorem 5.5 (Bound III) shows that there is a code over F q m of length n ≤ m of rank distance at least d such that there is a ball of any radius τ>⌊ (d-1) /2⌋, containing a number of codewords that grows exponentially in the length n. For this rank-metric code, no polynomial-time list decoding algorithm beyond half the minimum distance exists. This bound is tight as a function of d and n, since below we can clearly always decode uniquely. It does not mean that there is no code in rank metric with a polynomial list size for a decoding radius greater than half the minimum distance, but in order to nd a polynomial upper bound, it will be necessary to use further properties of the code in the derivation of such bounds (linearity or the explicit code structure).

In particular, for Gabidulin codes, there is still an unknown region between half the minimum distance and the Johnson radius. With Bound I, we have proven that the list size can become exponential if the radius is at least the Johnson radius (see Theorem 5.2). These decoding regions are shown in Figure 5.3, depending on the relative normalized minimum rank distance δ = d/n. Further, our lower bound from Theorem 5.5 (Bound III) shows that there does not exist a polynomial upper bound depending only on n and d similar to the Johnson bound for Hamming metric. Hence, our upper bound from Theorem 5.3 is relatively tight (except for a factor of two in the exponent), since it has the same asymptotic behavior as the lower bound from Theorem 5.5.

These results show a surprising di erence to codes in Hamming metric. Any ball in Hamming metric of radius less than the Johnson radius τ J = n -n(n -d) always contains a polynomial number of codewords of any code of length n and minimum Hamming distance d (compare Section 5.1). Moreover, it can be shown that there exist codes in Hamming metric with an exponential number of codewords if the radius is at least the Johnson radius [START_REF] Goldreich | Learning Polynomials with Queries: the Highly Noisy Case[END_REF][START_REF] Guruswami | List Decoding of Error-Correcting Codes[END_REF]. However, it is not known whether this bound is also tight for special classes of codes, e.g. Reed-Solomon codes. This points out another di erence between Gabidulin and Reed-Solomon codes: For Reed-Solomon codes, the minimum radius for which an exponential list size is proven is much higher [START_REF] Justesen | Bounds on List Decoding of MDS Codes[END_REF][START_REF] Ben-Sasson | Subspace Polynomials and Limits to List Decoding of Reed-Solomon Codes[END_REF] Nevertheless, it is often believed that the Johnson bound is tight not only for codes in Hamming metric in general, but also for Reed-Solomon codes. Drawing a parallel conclusion for Gabidulin codes would mean that the maximum list size of Gabidulin codes could become exponential directly beyond half the minimum distance-but this requires additional research.

For future research, it is challenging to nd a bound for the unknown region when list decoding Gabidulin codes. However, this seems to be quite di cult since the gap between the Johnson radius and the known lower exponential bounds for Reed-Solomon codes seems to translate into the gap between half the minimum distance and the Johnson radius for Gabidulin codes. Despite numerous publications on this topic, nobody could close the gap for Reed-Solomon codes so far. As a rst step towards revealing the gap for Gabidulin codes, it might be possible to prove something like Theorem 5.5 for linear codes in rank metric.

L D B C R M CHAPTER 6
Convolutional Codes in Rank Metric P PUM are convolutional codes with memory one (compare Subsection 2.1.4). All convolutional codes can be written as (P)UM codes when we join several blocks into one block as in [Bos98,Theorem 8.28]. Further, they can be constructed based on block codes, e.g., Reed-Solomon [ZS94, [START_REF] Pollara | Finite-State Codes[END_REF][START_REF] Justesen | Bounded Distance Decoding of Unit Memory Codes[END_REF] or cyclic codes [START_REF] Dettmar | New Optimal Partial Unit Memory Codes based on Extended BCH Codes[END_REF][START_REF] Dettmar | New Optimal Partial Unit Memory Codes[END_REF]. The underlying block codes make an algebraic description of the convolutional code possible, enable us to estimate the distance properties and allow us to take into account existing e cient block decoders in order to decode the convolutional code.

A convolutional code in Hamming metric can be characterized by its active row distance, which in turn is basically determined by the free distance and the slope. These distance measures determine the error-correcting capability of the convolutional code. In [Lee76, Lau79, TJ83, PMA88], upper bounds on the free (Hamming) distance and the slope of (P)UM codes are derived.

In the context of network coding, dependencies between di erent blocks transmitted over a network can be created by convolutional codes. In multi-shot network coding, the network is used several times to transmit several blocks. In such a scenario, dependencies between the di erent shots can help to correct more errors than the classical approach based on rank-metric block codes.

In this chapter, we introduce (P)UM codes in (sum) rank metric. The sum rank metric is motivated by multi-shot network coding [START_REF] Nóbrega | Multishot Codes for Network Coding Using Rank-Metric Codes[END_REF] and we use it to de ne the free rank distance and the active row rank distance in Subsection 6.1.1. In Subsection 6.1.2, we derive upper bounds on the free rank distance and the slope of the active row rank distance of (P)UM codes. Section 6.2 provides two explicit constructions of UM and PUM codes based on Gabidulin codes. The construction in Subsection 6.2.1 is based on the parity-check matrix and we give a lower bound on its distance parameters for dual memory µ H = 1. In Subsection 6.2.2, we construct PUM codes based on the generator matrix of Gabidulin codes and calculate their distance properties. Section 6.3 provides an e cient decoding algorithm based on rank-metric block decoders, which is able to handle errors and row/column erasures. This decoding algorithm can be seen as a generalization of the Dettmar-Sorger algorithm [START_REF] Dettmar | Bounded Minimum Distance Decoding of Unit Memory Codes[END_REF]. Finally, in Section 6.4, we show-similar to [SKK08]-how lifted PUM codes can be applied in random linear network coding (RLNC) and how decoding in RLNC reduces to error-erasure decoding of PUM codes based on Gabidulin codes.

The results presented in Section 6.1 and Subsection 6.2.1 were partly published in [START_REF] Wachter | On (Partial) Unit Memory Codes Based on Gabidulin Codes[END_REF][START_REF] Wachter | Partial Unit Memory Codes Based on Gabidulin Codes[END_REF] and the results from Subsection 6.2.2 and Sections 6.3 and 6.4 in [START_REF] Wachter-Zeh | Rank Metric Convolutional Codes for Random Linear Network Coding[END_REF].

Distance Measures for Convolutional Codes in Rank Metric

In this section, we de ne distance measures for convolutional codes based on a special rank metric and prove upper bounds on them. This special rank metric-the sum rank metric-was proposed by Nóbrega and Uchôa-Filho under the name "extended rank metric" in [START_REF] Nóbrega | Multishot Codes for Network Coding Using Rank-Metric Codes[END_REF] for multi-shot transmissions in a 6 C C R M network. Furthermore, they modi ed the lifting construction such that it suits the sum rank metric.

De nition of Distance Parameters

In [START_REF] Nóbrega | Multishot Codes for Network Coding Using Rank-Metric Codes[END_REF], it is shown that the sum rank distance and the subspace distance of the modi ed lifting construction are related in the same way as the rank distance and the subspace distance of the lifting construction, see [START_REF] Silva | A Rank-Metric Approach to Error Control in Random Network Coding[END_REF] and Lemma 2.18. Hence, the use of the sum rank metric for multi-shot network coding can be seen as the analog to using the rank metric for single-shot network coding. The sum rank weight and distance are de ned as follows.

De nition 6.1 (Sum Rank Weight and Sum Rank Distance).

Let two vectors a, b ∈ F nN q m be given and let them be decomposed into N subvectors of length n such that:

a = (a (0) a (1) . . . a (N -1) ), b = (b (0) b (1) . . . b (N -1) ), with a (i) , b (i) ∈ F n q m , ∀i ∈ [0, N -1].
The sum rank weight of a is the sum of the ranks of the subvectors:

wt Σ,R (a) def = N -1 i=0 wt R (a (i) ) = N -1 i=0 rk(a (i) ). (6.1)
The sum rank distance between a and b is the sum rank weight of the di erence of the vectors:

d Σ,R (a, b) def = wt Σ,R (a -b) = N -1 i=0 rk(a (i) -b (i) ). (6.2)
Since the rank distance is a metric (see Lemma 2.13), the sum rank distance is also a metric. An important measure for convolutional codes in Hamming metric is the free distance, and consequently, we de ne the free rank distance in a similar way in the sum rank metric.

De nition 6.2 (Free Rank Distance).

The free rank distance of a convolutional code C is the minimum sum rank distance (6.2) between any two di erent codewords a, b ∈ C:

d f,R def = min a,b∈C, a =b d Σ,R (a, b) = min a,b∈C, a =b ∞ i=0 rk(a (i) -b (i) ) .
For a linear convolutional code d f,R = min a∈C,a =0 wt Σ,R (a) holds. Throughout this chapter, we consider only linear convolutional codes.

Any convolutional code can be described by a minimal code trellis, which has a certain number of states and the input/output blocks are associated to the edges of the trellis. The current state in the trellis of a (P)UM code over F q can be associated with the vector s (i) = u (i-1) G (1) , see e.g., [START_REF] Justesen | Bounded Distance Decoding of Unit Memory Codes[END_REF], and therefore there are q k (1) possible states. We call the current state zero state if s (i) = 0. A code sequence of a (P)UM code with N non-zero consecutive blocks can therefore be considered as a path in the trellis, which starts in the zero state and, after N edges (with non-zero output blocks), ends in the zero state.

The error-correcting capability of convolutional codes is determined by active distances-a fact that will become obvious in view of our decoding algorithm in Section 6.3. In the following, we

6.1 D M C C R M
de ne the active row/column/reverse column rank distances analog to active distances in Hamming metric [TJ83, HJZZ99, JZ99]. In the literature, there are di erent de nitions of active distances in Hamming metric. Informally stated, for a j-th order active distance of C, we simply look at all sequences of length j, including conditions on the passed states in the minimal code trellis of C. Let C

(r) j denote the set of all codewords in a convolutional code C, corresponding to paths in the minimal code trellis which diverge from the zero state at depth zero and return to the zero state for the rst time after j branches at depth j. W.l.o.g., we assume that we start at depth zero, as we only consider time-invariant convolutional codes. This set is illustrated in Figure 6

j : it consists of all codewords of C having paths in the minimal code trellis which diverge from the zero state at depth 0 and return to the zero state for the rst time at depth j.

De nition 6.3 (Active Row Rank Distance).

The active row rank distance of order j of a linear convolutional code is de ned as

d (r) j,R def = min c∈C (r) j wt Σ,R (c) , ∀j ≥ 1.
Clearly, for non-catastrophic encoders, the minimum of the active row rank distances of di erent orders is the same as the free rank distance, see De nition (6.2):

d f,R = min j d (r) j,R .
The slope of the active row rank distance is de ned as follows.

De nition 6.4 (Slope of Active Row Rank Distance).

The average linear increase (slope) of the active row rank distance (De nition 6.3) is

σ R def = lim j→∞ d (r) j,R j .
As in Hamming metric [JPZ04, Theorem 1], [Jor02, Theorem 2.7], the active row rank distance of order j can be lower bounded by a linear function d

(r) j,R ≥ max{j • σ R + β, d f,R } for some maximum β ≤ d f,R .
Similar to Hamming metric, we can introduce an active column rank distance and an active reverse column rank distance. Let C (c) j denote the set of all codewords leaving the zero state at depth zero and ending in any state at depth j and let C (rc) j denote the set of all codewords starting in any state at C R M depth zero and ending in the zero state in depth j, both without zero states in between (see Figure 6.2). The active column rank distance and the active reverse column rank distance are then de ned by: , where no zero states between depths 0 and j are allowed.

d (c) j,R def = min c∈C (c) j wt Σ,R (c) , d (rc) j,R def = min c∈C (rc) j wt Σ,R (c) , ∀j ≥ 1. (6.3) States 0 1 2 . . . j (

Upper Bounds on Distances of (Partial) Unit Memory Codes

In this section, we derive upper bounds on the free rank distance d f,R (De nition 6.2) and the slope σ R (De nition 6.4) for UM and PUM codes based on the sum rank metric (6.1), (6.2). The derivation of the bounds uses known bounds for (P)UM codes in Hamming metric [Lee76, Lau79, PMA88].

d f,R ≤ d f,H , d (r) j,R ≤ d (r) j,H , ∀j ≥ 1.
Proof. The rank and Hamming weight of a vector a ∈ F n q m are rk(a) ≤ wt H (a). Hence:

wt Σ,R (a) = N -1 i=0 rk(a (i) ) ≤ wt H (a (0) a (1) . . . a (N -1) ).
and the statement follows with (6.1) and De nitions 6.2, 6.3.

Thus, the upper bounds for the free Hamming distance and the slope of (P)UM codes from [TJ83, PMA88] also hold for (P)UM codes in sum rank metric.

Corollary 6.1 (Upper Bounds).

For a UM(n, k) code, where ν = k, the free rank distance is upper bounded by:

d f,R ≤ 2n -k + 1. (6.4) 6.2 C C C R M
For a PUM(n, k|k (1) ) code, where ν = k (1) < k, the free rank distance is upper bounded by:

d f,R ≤ n -k + ν + 1. (6.5)
For both, UM and PUM codes, the average linear increase (slope) is upper bounded by: σ R ≤ nk. (6.6)

Constructions of Convolutional Codes in Rank Metric

This section provides two constructions of (P)UM codes based on Gabidulin codes. One of them uses the parity-check matrix (Subsection 6.2.1) and the other one the generator matrix (Subsection 6.2.2) of the convolutional code for the de nition.

PUM Codes Based on the Parity-Check Matrix of Gabidulin Codes

The construction in this subsection is similar to the construction of (P)UM codes based on Reed-Solomon codes from [START_REF] Zyablov | On Periodic (Partial) Unit Memory Codes with Maximum Free Distance, ser[END_REF]. Theorem 6.2 shows su cient conditions that the parity-check matrix (based on Gabidulin codes) de nes a (P)UM code.

Theorem 6.2 ((P)UM Code Based on Gabidulin Codes).

Let µ H ≥ 1 and let H be the semi-in nite parity-check matrix of a convolutional code C over F q m as in (2.7) with code rate R = k/n ≥ µ H /(µ H + 1). Let each submatrix H (i) be the parity-check matrix of a Gab[n, k] code, i.e.:

H (i) = qvan n-k (h (i) ) = qvan n-k ((h (i) 0 h (i) 1 . . . h (i) n-1 )), ∀i ∈ [0, µ H ],
where h

(i) 0 , h (i) 1 , . . . , h (i)
n-1 ∈ F q m are linearly independent over F q . Additionally, let

H (c) def =      H (0) H (1)
. . .

H (µ H )      de ne a Gab[n, n -(µ H + 1)(n -k)] code, (6.7)
and let

H (r(i)) def = H (i) H (i-1) . . . H (0) de ne a Gab[(i + 1)n, in + k] code, ∀i ∈ [1, µ H ]. Then, H is the parity-check matrix of a rate R ≥ µ H /(µ H + 1) (partial) unit memory code over F q m .
Proof. The proof follows from Theorem 2.1 (since the rate restriction is ful lled and all H (i) have full rank) and from Lemma 6.2, which shows that H is in minimal basic encoding form.

Hence, not only each submatrix H (i) de nes a Gabidulin code, but also speci ed blocks of submatrices. The latter one is not necessary to guarantee that it is a (P)UM code, but it results in good distance properties (see Theorem 6.3). Lemma 6.1 gives an explicit construction, satisfying all requirements of Theorem 6.2.

In order to ful ll (6.7), H (c) has to be a q-Vandermonde matrix:

H (c) = qvan (µ H +1)(n-k) (h (0) ) = qvan (µ H +1)(n-k) ((h (0) 0 h (0) 1 . . . h (0)
n-1 )). (6.8)

6.2 C C C R M if H(D)
(D)) = µ H for all i ∈ [0, n -k -1], j ∈ [0, n -1]. Thus, deg[det(H ℓ (D))] ≤ µ H (n -k). The coe cient of D µ H (n-k) of det(H ℓ (D)) is exactly det(H (µ H ) ℓ
), where

H (µ H ) ℓ is a (n -k) × (n -k)-submatrix of H (µ H ) . Since H (µ H ) ℓ is an (n -k) × (n -k) q-Vandermonde matrix, det(H (µ H ) ℓ ) = 0 and deg[det(H ℓ (D))] = µ H (n -k), ∀ℓ = 0, 1, .
. . . This is equal to the constraint length in obvious realization ν = µ H (nk) and hence, H(D) is in minimal basic encoding form.

Alternatively, we could use [JZ99, Theorem 2.22, (iii)] to prove that H is in basic form. Since we consider non-binary convolutional codes, notice that the corresponding matrix [H(D)] h (in the notation of [START_REF] Johannesson | Fundamentals of Convolutional Coding[END_REF]) is a matrix in F q m with the highest coe cient of h i,j (D) at entry (i, j) and with the entry 0 if h i,j (D) = 0. For our construction, [H(D)] h = H (µ H ) , which has full rank and therefore, due to [JZ99, Theorem 2.22, (iii)], H is a basic encoding matrix. Let us construct a PUM(6, 4|2) code C with µ H = 1 and code rate R = 2/3 ≥ µ H /(µ H + 1) = 1/2. Due to (6.10), the eld size is m ≥ 12 and we de ne the code over F q m = F 2 12 . Let B N = {β [0] , β [1] , . . . , β [11] } be a normal basis of F 2 12 over F 2 .

With (6.11) and (6.9), we obtain

h (0) = β [0] β [1] | β [4] β [5] | β [8] β [9] , h (1) = β [2] β [3] | β [6] β [7] | β [10] β [11] .
The semi-in nite parity-check matrix H is then given by

H =               β [0] β [1] β [4] β [5] β [8] β [9] β [1] β [2] β [5] β [6] β [9] β [10] β [2] β [3] β [6] β [7] β [10] β [11] β [0] β [1] β [4] β [5] β [8] β [9] β [3] β [4] β [7] β [8] β [11] β [12] β [1] β [2] β [5] β [6] β [9] β [10] β [2] β [3] β [6] β [7] β [10] β [11] . . . β [3] β [4] β [7] β [8] β [11] β [12] . . .               .
As required by Theorem 6.2, the matrices H (0) , H (1) , (H (0) H (1) ) and H (0) H (1) de ne Gabidulin codes. Theorem 6.2 guarantees that there is a generator matrix of C with memory µ = 1, consisting of two (4 × 6)-submatrices G (0) and G (1) . The submatrices G (00) , G (01) , G (10) are all (2 × 6)-matrices, since k (1) = ν = µ H (nk) = 2. Hence, H de nes a rate R = 2/3 PUM code based on Gabidulin codes.

Let us now calculate the active row rank distance of the construction of Theorem 6.2 with dual memory µ H = 1. Implicitly, this calculation provides the free rank distance d f,R and the slope σ R . Denote the minimum rank distances of the codes de ned by the parity-check matrices H (0) , H (1) and H (1) H (0) by d 0 , d 1 and d 10 , respectively. They are

d 0 = d 1 = d 10 = n -k + 1. C R M Theorem
(r) 1,R = 2(n -k) + 1, d (r) j,R ≥ j + 1 2 • (n -k + 1), j ≥ 2. (6.12)
Proof. The derivation of the active row rank distances for µ H = 1 is similar to the analysis by Zyablov and Sidorenko [START_REF] Zyablov | On Periodic (Partial) Unit Memory Codes with Maximum Free Distance, ser[END_REF]. In order to estimate the active row rank distance d (r) j,R from De nition 6.3, consider all paths in the set C (r) j (compare Figure 6.1) for j ≥ 1.

• For the active row rank distance of order one, we have to consider only code sequences of the form (c (0) 0 0 . . . ). Using the 2(nk) × n parity-check matrix H = (H (0)T H (1)T ) T , the codewords have to satisfy H • c (0)T = 0. Since H de nes a Gabidulin code of minimum rank distance 2(nk) + 1, we obtain d (r)

1,R = 2(nk) + 1. • For j = 2, we have to investigate all code sequences of the form c (0) c (1) 0 . . . . These code sequences are de ned by the 3(nk) × 2n parity-check matrix

H =   H (0) H (1) H (0) H (1)
  .

i.e., H • c (0) c (1) T = 0. Hence, amongst others, the following equations must be ful lled:

H (0) • c (0)T = 0, H (1) • c (1)T = 0.
Due to the de nition of the sum rank distance, d

2,R ≥ d 0 + d 1 = 2(nk + 1). • For j = 3 and code sequences of the form c (0) c (1) c (2) 0 . . . , the same two equations have to hold and therefore, d

3,R ≥ d 0 + d 1 = 2(nk + 1). • For j = 4 and code sequences c (0) c (1) c (2) c (3) 0 . . . , we have to consider the 5(nk) × 4n parity-check matrix H, for which H • c (0) c (1) c (2) c (3) T = 0 and in particular:

H (0) • c (0)T = 0, H (1) • c (1)T + H (0) • c (2) = 0, H (1) • c (3)T = 0, and therefore, d (r) 4,R ≥ d 0 + d 10 + d 1 = 3(n -k + 1). Similarly, d (r) 5,R ≥ d 0 + d 10 + d 1 = 3(n -k + 1) and d (r) 6,R ≥ d 0 + d 10 + d 10 + d 1 = 4(n -k + 1).
In general, by continuing this strategy, we obtain the statement.

The following theorem shows that our construction achieves the upper bound on the free rank distance for PUM codes (6.5) and half the optimal slope (6.6). 

    g [k] 0 g [k] 1 . . . g [k] n-1 g [k+1] 0 g [k+1] 1 . . . g [k+1] n-1 . . . . . . . . . . . . g [k+k (1) -1] 0 g [k+k (1) -1] 1 . . . g [k+k (1) -1] n-1 0            . ( 6
G (0) C 0 Gab[n, k] d 0 = n -k + 1 BMD(C 0 ) G (01) G (10) C 1 Gab[n, k] d 1 = n -k + 1 BMD(C 1 ) G (00) C 00 Gab[n, k (1) ] d 00 = n -k (1) + 1 not needed G (01) C 01 Gab[n, k -k (1) ] d 01 = n -k + k (1) + 1 BMD(C 01 ) G (10) C 10 Gab[n, k (1) ] d 10 = n -k (1) + 1 not needed G σ = G (00) G (01) G (10) C σ Gab[n, k + k (1) ] d σ = n -k -k (1) + 1 BMD(C σ ) Lemma 6.3 (Construction is in Minimal Basic Encoding Form).
Let a (P)UM code based on Gabidulin codes be de ned by its generator matrix G as in De nition 6.5. Then, G is in minimal basic encoding form.

Proof. The proof is straight-forward to the proof of Lemma 6.2.

6.2 C C C R M
In the following, we calculate the active row rank distance (De nition 6.3) by cutting the semi-in nite generator matrix of the PUM code from De nition 6.5 into parts. Pay attention that each code block of length n can be seen as a codeword of C σ . Theorem 6.5 (Lower Bound on Active Distances). Let k + k (1) ≤ n ≤ m, where k (1) ≤ k. Let C be a UM(n, k), respectively PUM(n, k|k (1) ), code over F q m as in De nition 6.5. The active row, column and reverse column rank distances d

(r) 1,R ≥ δ (r) 1,R = d 01 , d (r) j,R ≥ δ (r) j,R = d 0 + (j -2) • d σ + d 1 , ∀j ≥ 2, d (c) j,R ≥ δ (c) j,R = d 0 + (j -1) • d σ , ∀j ≥ 1, d (rc) j,R ≥ δ (rc) j,R = (j -1) • d σ + d 1 , ∀j ≥ 1, where d 01 = n -k + k (1) + 1 for k (1) < k and d 01 = ∞ for k (1) = k; d 0 = d 1 = n -k + 1 and d σ = n -k -k (1) + 1.
Proof. For the estimation of the active row rank distance, the encoder starts in the zero state hence, u (-1) = 0. For the rst order active row distance d (r) 1,R , we look at all code sequences of the form (. . . 0 c (0) 0 . . . ), which is only possible if u

(0) = (0 . . . 0 u (0) k (1) . . . u (0)
k-1 ) and u (i) = 0, ∀i ≥ 1. In this case, c (0) ∈ C 01 and the encoder returns immediately to the zero state. For the UM case, also u (0) = 0 and the only codeword in C (r) 0 is the all-zero codeword and thus, d

1,R = ∞. For higher orders of d (r) j,R , we have to consider all code sequences, starting with c (0) ∈ C 0 (since u (-1) = 0), followed by j -2 codewords of C σ and one nal code block, resulting from u (j-1) = (0 . . . 0 u (j-1) k (1) . . . u (j-1) k-1 ) and for the UM case u (j-1) = 0. For the UM and the PUM case, the block u (j-2) is arbitrary, therefore c (j-1) = u (j-1) • G (0) + u (j-2) • G (1) ∈ C 1 . For the estimation of d (c) j,R , the encoder starts in the zero state but ends in any state. Thus, c (0) ∈ C 0 is followed by j -1 arbitrary information blocks resulting in codewords from C σ . For the active reverse column rank distances, we start in any, hence, all rst j -1 blocks are from C σ . The last block is from C 1 in order to end in the zero state.

We call the lower bounds of d

(r) j,R , d (c) j,R , d (rc) j,R designed active distances δ (r) j,R , δ (c) j,R , δ (rc) j,R in the following.
Corollary 6.2 (Free Rank Distance and Slope of our Construction). Let k + k (1) ≤ n ≤ m, where k (1) ≤ k. Let C be a UM(n, k), respectively PUM(n, k|k (1) ), code over F q m as in De nition 6.5. The free rank distance d f,R for k

(1) = k is d f,R ≥ min j δ (r) j,R = d 0 + d 1 = 2(n -k + 1),
and for k (1) < k:

d f,R = min j δ (r) j,R = d 01 = n -k + k (1) + 1 = n -k + ν + 1. C R M
The slope σ R of C for both cases is:

σ R ≥ lim j→∞ δ (r) j,R j = d σ = n -k -k (1) + 1.
Thus, for any k (1) < k, the construction achieves the upper bound on the free rank distance of PUM codes (6.5). When k (1) = k = 1, we meet the upper bound on the free rank distance of UM codes (6.4). For k (1) = 1 ≤ k, the upper bound on the slope is attained.

If we compare this to the construction from Subsection 6.2.1,-with free rank distance and slope as in Theorem 6.4-we see that they both attain the upper bound on the free rank distance for k < k (1) . It depends on the concrete parameters n, k, k (1) , which slope is higher.

The construction based on the parity-matrix (Theorem 6.2) requires that R = k/n ≥ µ H /(µ H + 1) and provides therefore a high-rate code, whereas the construction based on the generator matrix (De nition 6.5) results in a low-rate code since k + k (1) ≤ n has to hold.

Error-Erasure Decoding of PUM Gabidulin Codes

This section provides an e cient error-erasure decoding algorithm for (P)UM codes as in De nition 6.5, using the block rank-metric decoders of the underlying Gabidulin codes of Table 6.1.

Bounded Row Distance Condition and Decoding Idea

We consider the terminated generator matrix of a (P)UM code as in (2.8) and therefore we look at blocks of length N + µ = N + 1. Let the received sequence r = (r (0) r (1) . . . r (N ) ) ∈ F n(N +1) q m be given and let the matrix sequence R = (R (0) R (1) . . . R (N ) ) ∈ F m×n(N +1) q denote the matrix representation of r according to the mapping from De nition 2.1. Let r (i) = c (i) + e (i) , for all i ∈ [0, N ]. The matrix representation R (i) ∈ F m×n q can be decomposed as in (3.33), including t (i) errors, ̺ (i) row erasures and γ (i) column erasures in rank metric, for all i ∈ [0, N ].

Analog to Justesen's de nition in Hamming metric [START_REF] Justesen | Bounded Distance Decoding of Unit Memory Codes[END_REF], we de ne a bounded (row rank) distance decoder for convolutional codes in rank metric, incorporating additionally erasures.

De nition 6.6 (Bounded Row Distance Error-Erasure Decoder in Rank Metric). Given a received sequence r = c + e ∈ F n(N +1) q m , a bounded row distance (BRD) error-erasure decoder in rank metric for a convolutional code C guarantees to nd the code sequence

c ∈ C if i+j-1 h=i 2 • t (h) + ̺ (h) + γ (h) < δ (r) j,R ≤ d (r) j,R , ∀i ∈ [0, N ], j ∈ [0, N -i + 1], (6.15)
where t (h) , ̺ (h) , γ (h) denote the number of errors, row and column erasures in block e (h) ∈ F n q m as in (3.34).

In Algorithm 6.1, we present such a BRD rank-metric error-erasure decoder for (P)UM codes constructed as in De nition 6.5. It is a generalization of the Dettmar-Sorger algorithm [START_REF] Dettmar | Bounded Minimum Distance Decoding of Unit Memory Codes[END_REF] to rank metric and to error-erasure correction. The generalization to error-erasure decoding can be done in a similar way in Hamming metric.

In the course of this subsection, we explain the idea and the di erent steps of Algorithm 6.1 in detail. i+4) . . . Given:

6 C C R M r (0) . . . r (i) r (i+1) r (i+2) r (i+3) r (
Step 1:

BMD(C σ ) c (0) . . . BMD(C0) c (i+2) c (i+4) . . . Step 2: BMD(C 0 ), BMD(C 1 ) c (0) . . . c (i+2) c (i+4) c (i+1) c (i+3) . . . . . . . . . Step 3: BMD(C 01 ) c (0) . . . c (i+2) c (i+3) c (i+1) c (i+4) c (i) . . . . . .
Step 4: Viterbi

For

Step 3 and some i ∈ [0, N -1], assume we know (u

(i+1) 0 u (i+1) 1 . . . u (i+1)
k (1) -1 ) and u (i) from Step 1 or 2, then as in (6.17), we can calculate

r (i+1) -(u (i+1) 0 u (i+1) 1 . . . u (i+1) k (1) -1 ) • G (00) -(u (i) 0 u (i) 1 . . . u (i) k (1) -1 ) • G (10) = (u (i+1) k (1) u (i+1) k (1) +1 . . . u (i+1) k-1 ) • G (01) + e (i+1)
, which shows that we can use BMD(C 01 ) to close a remaining gap in block i + 1.

After Step 3, assign as metric to each edge

m (i) =            rk(r (i) -c (i)′ ), if BMD(C 0 ), BMD(C 1 ) or BMD(C 01 ) is successful, d 01 + 1 + ̺ (i) + γ (i) 2 , else, ∀i ∈ [0, N ], (6.20)
where c (i)′ denotes the result of a successful decoding. For one received block r (i) , there can be several decoding results c (i)′ from the di erent BMD decoders. Thus, there can be more than one edge in the reduced trellis at depth i. Each edge is labeled with regard to (6.20) using its corresponding code block. Finally, we use the Viterbi algorithm to nd the path with the smallest sum rank weight in this reduced trellis. As in [START_REF] Dettmar | Bounded Minimum Distance Decoding of Unit Memory Codes[END_REF], we use m (i) , for all i ∈ [0, N ], as edge metric and the sum over di erent

6.3 E E D PUM G C
edges as path metric. The di erent steps of our decoding algorithm are roughly summarized in Algorithm 6.1, the details can be found in the preceding description and Figure 6.3 illustrates our decoding algorithm. In Section 6.3.2, we prove that if (6.15) is ful lled, then after the three block decoders, all gaps are closed and the Viterbi algorithm nds the path with the smallest sum rank weight.

Proof of Correctness of the Error-Erasure Decoding Algorithm

In the following, we prove that decoding with Algorithm 6.1 is successful if the BRD condition (6.15) is ful lled. The proof follows the proof of Dettmar and Sorger [START_REF] Dettmar | Partial Unit Memory Codes[END_REF][START_REF] Dettmar | Bounded Minimum Distance Decoding of Unit Memory Codes[END_REF]. Lemma 6.4 shows that the gaps between two correct results of Step 1 are not too big and Lemmas 6.5 and 6.6 show that the gap size after Steps 1 and 2 is at most one if the BRD condition (6.15) is ful lled. Theorem 6.6 shows that these gaps can be closed with BMD(C 01 ) and the Viterbi algorithm nds the correct path. , where

L (i) f = min j j   j h=1 d σ -m (i+h) ≥ δ (r) j,R -j h=1 (̺ (i+h) + γ (i+h) ) 2 , L (i) b = min j j   j h=1 d σ -m (i-h) ≥ δ (r)
j,R -j h=1 (̺ (i-h) + γ (i-h) ) 2 .

Proof. Decoding of a block r (i) in Step 1 fails or outputs a wrong result if there are at least (d σ -̺ (i) -γ (i) )/2 errors in rank metric. In such a case, the metric m (i) = ⌊(d σ +1+̺ (i) +γ (i) )/2⌋ is assigned.

C R M

In order to prove the statement, assume there is a gap of at least L (i) f blocks after Step 1. Then,

L (i) f h=1 t (i+h) ≥ L (i) f h=1 d σ -̺ (i+h) -γ (i+h) 2 ≥ L (i) f h=1 d σ -m (i+h) ≥ δ (r) L (i) f ,R - L (i) f h=1 ̺ (i+h) + γ (i+h)
2 , which follows from the de nition of the metric (6.16) and from the de nition of L (i)

f . This contradicts the BRD condition (6.15). Similarly, we can prove this for L blocks in backward direction starting in c (i+j) (see also (6.18), (6.19)).

Then, the correct path is in the reduced trellis if the BRD condition (6.15) is satis ed and if in each block less than min (d 0 -̺ (i)γ (i) )/2, (d 1 -̺ (i)γ (i) )/2 rank errors occurred.

Proof. If there are less than min (d 0 -̺ (i)γ (i) )/2, (d 1 -̺ (i)γ (i) )/2 errors in a block, BMD(C 0 ) and BMD(C 1 ) always yield the correct decision. Due to the de nition of ℓ (i) f , see (6.18), the forward decoding with BMD(C 0 ) terminates as soon as

ℓ (i) f h=1 t (i+h) ≥ ℓ (i) f h=1 d σ -̺ (i+h) -γ (i+h) 2 ≥ ℓ (i) f h=1 d σ -m (i+h) ≥ δ (c) ℓ (i) f ,R - ℓ (i) f h=1 ̺ (i+h) + γ (i+h) 2 = d 0 2 + ℓ (i) f -1 d σ 2 - ℓ (i) f h=1 ̺ (i+h) + γ (i+h) 2 ,
where the rst inequality holds since the decoding result could not be found in Step 1 and the second and third hold due to the de nition of the metric (6.16) and the de nition of ℓ (i)

f . Similarly, the backward decoding with BMD(C 1 ) terminates if

ℓ (i+j) b h=1 t (i+j-h) ≥ d 1 2 + ℓ (i+j) b -1 d σ 2 - ℓ (i+j) b h=1 ̺ (i+j-h) + γ (i+j-h) 2 .
The correct path is in the reduced trellis if ℓ

(i) f + ℓ (i+j) b
≥ j -1, since the gap is then closed.

Assume now on the contrary that ℓ < j -1. Since Step 1 was not successful for the blocks in the gap, at least (d σ -̺ (h)γ (h) )/2 rank errors occured in every block r (h) , ∀h ∈ [i + ℓ

(i) f + 1, i + j -ℓ (i+j) b
-1], i.e, in the blocks in the gap between the forward and the backward path. d σ -̺ (i+h) + γ (i+h) 2

≥ d 0 2 + ℓ (i) f -1 d σ 2 - ℓ (i) f h=1 (̺ (i+h) + γ (i+h) ) 2 + d 1 2 + ℓ (i+j) b -1 d σ 2 - ℓ (i+j) b h=1 ̺ (i+j-h) + γ (i+j-h) 2 + j -1 -ℓ (i) f -ℓ (i+j) b 2 d σ - j-1-ℓ (i+j) b h=ℓ (i) f +1 ̺ (i+h) + γ (i+h) 2 ≥ d 0 2 + d 1 2 + (j -3) 2 d σ - j-1 h=1 ̺ (i+h) + γ (i+h) 2 = δ (r) j-1,R -j-1 h=1 ̺ (i+h) + γ (i+h) 2 ,
which is a contradiction to the bounded row distance condition (6.15) and the statement follows.

Lemma 6.6 (Gap Size is at Most One After Steps 1 and 2). Let c (i) and c (i+j) be decoded correctly in Step 1 of Algorithm 6.1 (with no other correct decisions in between) and let the BRD condition (6.15) be ful lled. Let d 0 = d 1 .

Then, there is at most one error block e (h) , h ∈ [i + 1, i + j -1], of rank at least (d 0 -̺ (i)γ (i) )/2.

Proof. To fail in Step 1, there have to be at least (d σ -̺ (i)γ (i) )/2 errors in r (i) , ∀i ∈ [i + 1, i + j -1]. If two error blocks in this gap have rank at least (d 0 -̺ (i)γ (i) )/2, then

j-1 h=1 t (i+h) ≥ 2 • d 0 2 + (j -3) • d σ 2 - j-1 h=1 ̺ (i+h) + γ (i+h) 2 ≥ δ (r) j-1,R 2 - j-1 h=1 ̺ (i+h) + γ (i+h) 2 ,
which contradicts (6.15). Lemmas 6.5 and 6.6 show that if the BRD condition is satis ed, then the correct path is in the reduced trellis after Steps 1 and 2, except for at most one block.

Theorem 6.6 (Correct Path is in Reduced Trellis after Steps 1-3).

If the BRD condition (6.15) is satis ed, then the correct path is in the reduced trellis after Steps 1-3 of Algorithm 6.1.

Proof. Lemma 6.6 guarantees that after Step 2, at most one block is missing from the correct path. This gap can be closed in Step 3 with BMD(C 01 ), which is able to nd the correct solution since d 01 ≥ δ (r)

1,R = d f,R . The complexity is determined by the complexity of the BMD rank block error-erasure decoders from Table 6.1 (realized e.g., as in [SKK08, GPB10] and Subsection 3.2.3), which are all in the order O(n 2 ) C R M operations in F q m . Hence, the calculation of the complexity is straight-forward to [DS95, Theorem 3] and we can give the following bound on the complexity without proof.

Theorem 6.7 (Bounded Row Distance Decoding with Algorithm 6.1).

Let k + k (1) ≤ n ≤ m, where k (1) ≤ k. Let C be a zero-forced terminated UM(n, k) or PUM(n, k|k (1) )

code over F q m as in De nition 6.5. Let a received sequence r = (r (0) r (1) . . . r (N ) ) ∈ F n(N +1) q m be given.

Then, Algorithm 6.1 nds the code sequence c = (c (0) c (1) . . . c (N ) ) ∈ F n(N +1) q m with smallest sum rank distance to r if the BRD condition is satis ed (6.15). The complexity of decoding one block of length n is upper bounded by O(d σ n 2 ) ≤ O(n 3 ).

The analysis of what happens if too many errors occur or if the BRD condition (6.15) is not ful lled in one or several blocks, is analog to [START_REF] Dettmar | Bounded Minimum Distance Decoding of Unit Memory Codes[END_REF]. We can give a condition similar to (6.15) for a single block and see that the algorithm returns to the correct path relatively fast.

Application to Random Linear Network Coding

The motivation for considering convolutional codes in rank metric is to apply them in multi-shot random linear network coding (RLNC). In this section, we rst explain the model of multi-shot network coding and show how to de ne lifted (P)UM code in rank metric. Afterwards, we show how decoding of these lifted (P)UM codes reduces to error-erasure decoding of (P)UM codes in rank metric.

There are other contributions devoted to convolutional network codes (see e.g. [EF04, LY06, PR10, GCSM11]). However, none of these code constructions is based on rank metric and deals with the transmission over the operator channel as ours. Our contribution can be seen as an equivalent for convolutional codes to the block code construction from [START_REF] Silva | A Rank-Metric Approach to Error Control in Random Network Coding[END_REF].

Multi-Shot Transmission of Lifted PUM Codes

As network channel model we assume a multi-shot transmission over the so-called operator channel. The operator channel was de ned by Kötter and Kschischang in [KK08] and the concept of multi-shot transmission over the operator channel was rst considered by Nóbrega and Uchôa-Filho [START_REF] Nóbrega | Multishot Codes for Network Coding Using Rank-Metric Codes[END_REF].

In this network model, a source transmits packets (which are vectors over a nite eld) to a sink. The network has several directed links between the source, some internal nodes and the sink. The source and sink apply coding techniques for error control, but have no knowledge about the structure of the network. This means, we consider non-coherent RLNC. In a multi-shot transmission, we use the network several times and the internal structure may change in every time instance. In detail, we assume that we use it N + 1 times. In the following, we shortly give basic notations for this network channel model. The notations are similar to [START_REF] Silva | A Rank-Metric Approach to Error Control in Random Network Coding[END_REF], but we include additionally the time dependency.

Let X (i) ∈ F n×(n+m) q

, ∀i ∈ [0, N ]. The rows represent the transmitted packets X

n (i) -1 ∈ F m+n q . Notice that n and n (i) do not have to be equal since packets can be erased and/or additional error packets might be inserted.

The term random linear network coding originates from the behavior of the internal nodes: they create random linear combinations of the packets received so far in the current shot i, ∀i ∈ [0, N ]. Additionally, erroneous packets might be inserted into the network and transmitted packets might be Let the links in the network be indexed from 0 to ℓ -1, then, as in [START_REF] Silva | A Rank-Metric Approach to Error Control in Random Network Coding[END_REF], let the rows of a matrix Z (i) ∈ F ℓ×(n+m) q contain the error packets Z (i) 0 , Z (i) 1 , . . . , Z (i) ℓ-1 inserted at the links 0 to ℓ -1 at shot i. If Z (i) j = 0, j ∈ [0, ℓ -1], then no corrupt packet was inserted at link j ∈ [0, ℓ -1] and time i. Due to the linearity of the network, the output can be written as:

Y (i) = A (i) X (i) + B (i) Z (i) , (6.21)
where A (i) ∈ F n (i) ×m q and B (i) ∈ F n (i) ×ℓ q are the (unknown) channel transfer matrices at time i. When there are no errors or erasures in the network, the row space of Y (i) is the same as the row space of X (i) . In [KK08, SKK08] it was shown that subspace codes constructed by lifted MRD codes (as in Lemma 2.18) provide an almost optimal solution to error control in the operator channel. Such lifted MRD codes are a special class of constant-dimension codes (see Subsection 2.3.4). In the following, we de ne lifted PUM codes based on Gabidulin codes in order to use these constant-dimension codes for error correction in multi-shot network coding.

De nition 6.7 (Lifted (Partial) Unit Memory Code). Let C be a zero-forced terminated PUM(n, k|k (1) ) code over F q m as in De nition 6.5. Represent each code block c (i) ∈ F n q m , ∀i ∈ [0, N ], as matrix C (i) ∈ F m×n q according to De nition 2.1. Then, the lifting of C is de ned by the following set of subspace sequences:

lift(C) = R q [I n C (0)T ] R q [I n C (1)T ] . . . R q [I n C (N )T ] : ext -1 β (C (0) ) ext -1 β (C (1) ) . . . ext -1 β (C (N ) ) ∈ C .
As in De nition 2.18, we denote lift(C (i)T ) = R q [I n C (i)T ] , ∀i ∈ [0, N ]. We transmit this sequence of subspaces over the operator channel such that each transmitted matrix is a lifted block of a codeword of the rank-metric PUM code, i.e., X (j) = [I n C (i)T ], ∀i ∈ [0, N ]. Of course, any other basis of the row space can also be chosen as transmitted matrix. By means of this lifted PUM code, we create dependencies between the di erent shots in the network. Since each code block of length n is a codeword of the block code C σ , each transmitted subspace is a codeword of a CD q (n + m, d s = 2d σ , n) constant-dimension code, lying in G q (n + m, n), see [SKK08, Proposition 4] and Lemma 2.18.

However, the lifted (P)UM code contains additionally dependencies between the di erent blocks and for decoding, we obtain therefore a better performance than simply lifting the block code C σ as in Lemma 2.18. Since the PUM code transmits k information symbols per shot, a comparison with a lifted block code of rate k/n is much fairer than comparing it with C σ (see Example 6.2).

Decoding of Lifted PUM Codes in the Operator Channel

In this section, we will show how the decoding problem in the operator channel reduces to error-erasure decoding of PUM codes based on Gabidulin codes-analog to [START_REF] Silva | A Rank-Metric Approach to Error Control in Random Network Coding[END_REF], where it reduces to error-erasure decoding of Gabidulin codes. Since each code block of length n of a PUM(n, k|k (1) ) code is a codeword of the block code C σ , we can directly use the reformulations of Silva, Kschischang and Kötter [START_REF] Silva | A Rank-Metric Approach to Error Control in Random Network Coding[END_REF].

Let the transmitted matrix at time instance i be X (i) = [I n C (i)T ] and denote by Y (i) = [ A (i) Y (i) ] ∈ F n (i) ×(n+m) q the received matrix after the multi-shot transmission over the operator channel as in (6.21).

C C R M

The channel transfer matrices A (i) and B (i) can be time-variant. Moreover, assume rk(Y (i) ) = n (i) , since linearly dependent received packets are directly discarded. Then, as in [START_REF] Silva | A Rank-Metric Approach to Error Control in Random Network Coding[END_REF], we denote the column and row de ciency of A (i) by: γ (i) def = nrk( A (i) ), ̺ (i) def = n (i)rk( A (i) ), ∀i ∈ [0, N ].

If we calculate the reduced row echelon (RRE) form of Y (i) (and ll it up with zero rows, if necessary), we obtain the following matrix in F (n+̺ (i) )×(n+m) q

(similar to [SKK08, Proposition 7], but in our notation):

RRE 0 Y (i) = I n + B (i,C)T I T U (i)
R (i)T 0 A (i,R)T , (6.22) for a set U (i) ⊆ {1, 2, . . . , n} with |U (i) | = γ (i) such that I T U (i) R (i)T = 0 and I T U (i) B (i,C)T = -I γ (i) , and I U (i) denotes the submatrix of I n consisting of the columns indexed by U (i) . Moreover, B (i,C)T ∈ F n×γ (i) q and A (i,R)T ∈ F ̺ (i) ×n q . Furthermore, it was shown in [START_REF] Silva | A Rank-Metric Approach to Error Control in Random Network Coding[END_REF] that R (i) can be decomposed into R (i) = C (i) + A (i,R) B (i,R) + A (i,C) B (i,C) + A (i,E) B (i,E) , ∀i ∈ [0, N ],

where ext -1 β (C (0) ) ext -1 β (C (1) ) . . . ext -1 β (C (N ) ) ∈ C and A (i,R) and B (i,C) are known to the receiver, since the matrix from (6.22) can be calculated from the channel output. Comparing this equation to (3.33) makes clear that the problem of decoding lifted PUM codes in the operator channel reduces to error-erasure decoding of the PUM code in rank metric. For this purpose, we can use our decoding algorithm from Section 6.3, which is based on rank-metric error-erasure block decoders. Now, let the received matrix sequence Y = (Y (0) Y (1) . . . Y (N ) ) as output of the operator channel be given, then we show in Algorithm 6.2 how to reconstruct the transmitted information sequence. where Y (i) ∈ F n (i) ×(n+m) q

, ∀i ∈ [0, N ] 1 γ (i) ← nrk( A (i) ), ∀i ∈ [0, N ] 2 ̺ (i) ← n (i)rk( A (i) ), ∀i ∈ [0, N ]

3 Calculate RRE 0 (Y (i) ) and therefore R (i) as in (6.22), ∀i ∈ [0, N ] 4 r = (r (0) r (1) . . . r (N ) ) ← ext -1 β (R (0) ) ext -1 β (R (1) ) . . . ext -1 β (R (N ) )

5 c = (c (0) c (1) . . . c (N ) ) ← B R D D PUM r with Algorithm 6.1

6 Reconstruct u = (u (0) u (1) . . . , u (N -1) )

Output: Information sequence u = (u (0) u (1) . . . , u (N -1) ) ∈ F kN q m

The asymptotic complexity of Algorithm 6.2 for decoding one matrix Y (i) of size n (i) × (n + m) scales cubic in n, since calculating the RRE is at most cubic in n if we use Gaussian elimination. Also, Algorithm 6.1 has asymptotic complexity O(n 3 ). The reconstruction of the information sequence out of the code sequence is negligible. 6.1). Let C be a PUM(n, k|k (1) ) code as in De nition 6.5. Construct the lifting of C as in De nition 6.7. Assume, Y = (Y (0) Y (1) . . . Y (6) ) is given as output of the operator channel and apply Algorithm 6.2.

After calculating the RRE (and lling the matrix up with zero rows as in (6.22)), let the number of errors, row erasures and column erasures in each block be as in Table 6.2. The results of the di erent decoding steps of Algorithm 6.1 for error-erasure decoding of PUM codes are also shown. In this example the BRD condition (6.15) is ful lled and correct decoding is therefore guaranteed due to Theorem 6.6.

The code rate of C is 1/2 and as a comparison with the (lifted) Gabidulin codes from [START_REF] Silva | A Rank-Metric Approach to Error Control in Random Network Coding[END_REF], the last line in Table 6.2 shows the decoding of a block Gabidulin code of rate 1/2 and minimum rank distance d = 5. For fairness, the last block is also decoded with a Gab[8, 2] code. The block decoder fails in Shots 1 and 5.

However, similar to the ongoing discussion whether block or convolutional codes are better, it depends on the distribution of the errors and erasures, i.e., on the channel, whether the construction from [START_REF] Silva | A Rank-Metric Approach to Error Control in Random Network Coding[END_REF] or ours performs better.

Block code

Decoding with Gab[8, 4] × ×

Summary and Outlook

The topic of this chapter are convolutional codes in rank metric, their decoding and their application to random linear network coding. First, we have de ned general distance measures for convolutional codes based on a modi ed rank metric-the sum rank metric-and have derived upper bounds on the free rank distance and the slope of (P)UM codes based on the sum rank metric.

Second, we have given two explicit constructions of (partial) unit memory codes based on Gabidulin codes and have calculated their free rank distances and slopes. The rst (high-rate) construction is based on the parity-check matrix and the second (low-rate) construction on the generator matrix. Both constructions achieve the upper bound on the free rank distance and it depends on the concrete parameters whose slope is higher.

Third, we have presented an e cient error-erasure decoding algorithm for the (P)UM construction based on the generator matrix. The algorithm guarantees to correct up to half the active row rank C R M distance and its complexity is cubic in the length. Finally, we have shown how constant-dimension codes, which were constructed by lifting the (P)UM code, can be applied for error control in random linear network coding.

As an outlook, it will be interesting to prove Conjecture 6.1 and, more far reaching, to nd new codes for error control in network coding, e.g. low-density-parity-check codes in rank metric. R radius. This implies that there cannot be a polynomial-time list decoding algorithm of Gabidulin codes beyond the Johnson radius. Interesting enough, it is not known for Reed-Solomon codes what happens if τ is slightly greater than the Johnson radius. Our second bound is an upper bound on the list size of any code in rank metric, which we have proven by connections between constant-rank and constant-dimension codes. Exactly these connections helped us to derive the third bound. This bound proves that there exists a code in rank metric over F q m of length n ≤ m such that the list size can become exponential for any τ greater than half the minimum distance. This implies on the one hand that there is no polynomial upper bound similar to the Johnson bound in Hamming metric and on the other hand, it also shows that our upper bound is almost tight.

Finally, Chapter 6 deals with convolutional codes in rank metric. We have proposed distance measures for convolutional codes in rank metric analog to Hamming metric, namely, the free rank distance, the active row rank distance and the slope and we have derived upper bounds on them. Based on rank-metric block codes (Gabidulin codes), we have given two explicit constructions of convolutional codes in rank metric, one high-rate construction based on the parity-check and one low-rate construction based on the generator matrix. Both de ne so-called (partial) unit memory codes and achieve the upper bound on the free rank distance. The underlying block codes have enabled us to design an e cient error-erasure decoding algorithm for the second construction, which guarantees to correct all error sequences of rank weight up to half the active row rank distance. We have proven its correctness and have outlined how our convolutional rank-metric codes can be applied to multi-shot random linear network coding. Future research directions have been given in a short outlook at the end of each chapter. recursive call in Line 20 is done with polynomials having at most half the q-degree of the original input polynomials.

• Line 20: For the derivation of the q-degree, let us de ne again r (1)(j-1) (x) r (1)(j) (x) = Q (1) ⊗ a (1) (x) b (1) (x) ,

where Q (1) is the output of the recursive call. Then, deg q r (1)(j-1) (x) ≥ d

(1)

stop and deg q r (1)(j) (x) ≤ d

(1) stop = deg q a (1) (x)d stop /d a ≤ d stop /2. • Output: We de ne r (j-1) (x) and r (j) (x) as in (3.7) and therefore, deg q r (j-1) (x) = deg q r (1)(j-1) (x) + h ≥ d i.e., deg q r (j-1) (x) ≥ d stop and deg q r (j) (x) = deg q r (1)(j) (x) + h ≤ d

A.2 Proof of the Generalized Transformed Key Equation

First, the following lemma is needed.

Lemma A.1 (Transformed Key Equation for Column Erasures).

Let Γ (C) (x) be the full q-reverse of Γ (C) (x), which is de ned as in (3.36) and let e (C) (x) denote the q-transform of e (C) (x). Then, e (C) Γ (C) (x) ≡ 0 mod (x [m]x).

Proof. The statement holds if and only if e (C) (Γ (C) (x)) ≡ 0 mod (x [m] -x). The i-th coe cient of a linearized polynomial a(x) is denoted by [a(x)] i in the following. Hence, the i-th coe cient of the aforementioned q-reverse polynomial is (the indices are calculated modulo m): where the d (C) j are de ned as in (3.35) and similar to the proof of Theorem 3.6, the statement follows.

Based on this, we can now give the proof of the generalized transformed key equation (Theorem 3.8).

Proof of Theorem 3.8. Let us split the transformed error into three parts, which correspond to row erasures, column erasures and (full) errors: e(x) = e (R) + e (C) + e (E) . 1.) First, consider only column erasures. Due to Lemma A.1, e (C) (Γ (C) (x)) = 0 mod (x [m]x) and therefore also Λ (E) Λ (R) e (C) (Γ (C) (x)) ≡ 0 mod (x [m]x). 2.) Second, consider the row erasures. Since any element in F q m can be represented as a linear combination of the elements g i with coe cients from F q , we can rewrite Γ (C) (g i ) = m-1 j=0 G i,j g j , where G i,j ∈ F q . Moreover, e (R) (g j ) = e (R) j

= ̺-1 h=0 B (R) h,j a (R) h with B (R)
h,j ∈ F q . Hence, for all i ∈ [0, m -1]: = 0, due to the de nition of Λ (R) (x). Hence, Λ (E) Λ (R) ( e (R) (Γ (C) (g i ))) = 0 for all i ∈ [0, m -1] and thus, Λ (E) Λ (R) ( e (R) (Γ (C) (x))) ≡ 0 mod (x [m]x).

Λ (R) e (R) Γ (C) (g i ) = Λ (R) e (R)
3.) Third, consider the errors. We denote again Γ (C) (g i ) = m-1 j=0 G i,j g j , where G i,j ∈ F q and e (E) (g j ) = t-1 h=0 B

(E) h,j a (E) h with B (E) h,j ∈ F q . Hence, for all i ∈ [0, m -1]:

Λ (R) e (E) Γ (C) (g i ) = Λ (R) e (E) m-1 j=0 G i,j g j = m-1 j=0 G i,j Λ (R) e (E) (g j ) = m-1 j=0 G i,j Λ (R) t-1 h=0 B (E) h,j a (E) h = m-1 j=0 G i,j t-1 h=0 B (E) h,j Λ (R) a (E) h
, and thus,

Λ (E) Λ (R) e (E) (Γ (C) (g i )) = m-1 j=0 G i,j t-1 h=0 B (E) h,j Λ (E) Λ (R) a (E) h = 0,
due to the de nition of Λ (E) (x) and similar to the proof of Theorem 3.6, it follows that Λ (E) Λ (R) e (E) (Γ (C) (x)) ≡ 0 mod (x [m]x).

The sum of the three parts gives exactly the LHS of (3.37) and the statement follows.

  Ball of radius e in rank metric around a ∈ F Sphere of radius e in rank metric around a ∈ F n q m

Figure 2 . 1 .

 21 Figure 2.1. Illustration of explained decoding principles, where the arrows show on which codeword(s) the received word is mapped. The dashed balls have radius ⌊ (d-1) /2⌋ and the gray balls have radius τ 0 and τ , respectively.

  De nition 2.13 (Rank Weight and Rank Distance). Let a = (a 0 a 1 . . . a n-1 ), b = (b 0 b 1 . . . b n-1 ) ∈ F n q m and let A = ext β (a) , B = ext β (b) ∈ F m×n q

  A, B, C ∈ F m×n q : • rk(A -B) ≥ 0 with equality if and only if A = B, proving positive de niteness; • rk(A -B) = rk(B -A), proving symmetry; • the known fact rk(A + B) ≤ rk(A) + (B) shows that the triangle inequality is ful lled, since rk(A -C) = rk(A -B + B -C) ≤ rk(A -B) + rk(B -C).

R

  (a) are independent of the choice of their center.

  there are no perfect codes in rank metric [Loi08, Proposition 2].

  14 (Parity-Check Matrix of Gabidulin Code).

  where s | m, be given. Then, Algorithm 3.2 nds the s evaluation values a( b 0 ), a( b 1 ), . . . , a( b s-1 )with complexity O(max{d a , s}m comp(T m )) ≤ O(m 2 comp(T m )) operations in F q and is therefore a solution to Problem 3.1 (c).

  d b < m be given. If existing, let s be an integer such that d a + d b < s and s divides m. If such an integer does not exist, let s = m.

  3.3 calculates c(x) = a(b(x)) mod (x [m]x)with complexity M m (m) = O(max{d a , s}m comp(T m )) ≤ O(m 2 comp(T m )) operations in F q and is therefore a solution to Problem 3.1 (b).

  4, called F H LEEA. If we choose d stop = d a /2, then Algorithm 3.4 is the linearized equivalent of Blahut's H E A [Bla85, Figure 10.8].

  Algorithm 3.4 requires complexity O EA (d a , d b ) = O(max{D(d a , d b ), M(d a , d b )} log d a ) operations if d a = deg q a(x) ≥ d b = deg q b(x). Proof. The complexity of the splitting operations in Lines 5, 6, 17, 18 and the value assignments are negligible. The linearized compositions from Lines 9, 13, 14, 21 cost in the order of M(d a , d b ) operations. The linearized division in Line 11 requires in the order of D(d a , d b ) operations. Recall from the proof of Lemma 3.6 that both recursive calls are done with polynomials of degree at most d a /2. Hence, O EA (d a , d b ) is upper bounded by:

Corollary 3. 2 (

 2 Fast LEEA Using Fast Composition). If we use Algorithm 3.1 from Subsection 3.1.2 for the linearized composition, then Algorithm 3.4 has complexity O(max{D(d a , d b ), max{d a , d b } 1.69 } log d a ) operations in F q m . If d a , d b < m and we use Algorithm 3.3 (Subsection 3.1.3) for the linearized composition, then Algorithm 3.4 has complexity O(max{D(d a , d b ), d a m comp(T m )} log d a ) operations in F q .

  4 (Key Equation for Decoding Gabidulin Codes [Gab85, Lemma 4]).

  ,3 which we have to solve for d = (d 0 d 1 . . . d t-1 ): 

  Estimated codeword c ∈ F n q m or "decoding failure"We can use the fast LEEA from Subsection 3.1.4 in order to reduce the complexity of the algorithm from [Gab85]. However, this only accelerates the step of solving the key equation, whereas the

  with Algorithm 2.3 3 f (x); r(x) ← L D r out (x); u out (x) with Algorithm 2.2 4 if r(x) = 0 then Output: Estimated evaluation polynomial f (x) with deg q f (x) < k; Estimated error span polynomial Λ(x) ← u out (x) 5 else Output: "Decoding failure"

Figure 3 . 1 .

 31 Figure 3.1. Illustration of row erasures, column erasures and (full) errors in rank metric. The known matrices (given by the channel) are lled with gray.

Figure 5 . 1 .

 51 Figure 5.1. Decoding regions of codes in Hamming metric

Problem 5. 1 (

 1 Maximum List Size).Let C be an (n, M, d) R code over F q m of length n ≤ m, cardinality M and minimum rank distance d R = d. Let τ < d. Find lower and upper bounds on the maximum number of codewords ℓ in a ball of radius τ around a word r = (r 0 r 1 . . . r n-1 ) ∈ F n q m . Hence, nd bounds on

Figure 5 . 2 .

 52 Figure 5.2. Interpretation of the decoding list as a constant-rank code, where all codewords (gray and black) constitute the decoding list and the black codewords constitute a constant-rank code.

  Corollary 5.3 (Special Case τ = d/2). Let n = m, d be even and τ = d/2. Then, there exists an (n, M, d R = d) R code C in rank metric and a word r ∈ F n q m such that |C ∩ B (τ )

  Case τ > n -τ ).

  Lemma 5.2 (Bound of Theorem 5.5 for τ = d/2 or Large Extension Degree m). Let ⌊ (d-1) /2⌋ < τ < d < n and τ ≤ nτ . If either τ = d/2 or m ≥ (nτ )(2τd + 1) + τ + 1, then there exists an (n, M, d R = d) R code C over F q m of length n ≤ m and minimum rank distance d, and a word r ∈ F n q m such that ℓ = ℓ m, n, d, τ ≥ C ∩ B (τ )

Figure 5 . 3 .

 53 Figure 5.3. Decoding regions of codes in rank metric

  than for Gabidulin codes (see Bound I,

Figure 6 . 1 .

 61 Figure 6.1. Illustration of the set C

:

  a) C (c) j : all codewords of C diverging from the zero state at depth 0. all codewords of C ending in the zero state at depth j.

Figure 6 . 2 .

 62 Figure 6.2. Illustration of the sets C (c) j and C (rc) j

  Theorem 6.1 (Connection between Distances in Hamming and Sum Rank Metric). Let the free rank distance be de ned as in De nition 6.2 and the active row rank distance as in De nition 6.3. The active row Hamming distance d (r) j,H and the free Hamming distance d f,H are de ned by replacing the sum rank weight/distance in De nitions 6.2 and 6.3 by the Hamming weight/distance. Then,

  Example 6.1 (Construction of PUM Code based on Parity-Check Matrix).

  .14) Table6.1 denotes the Gabidulin codes, de ned by submatrices of the generator matrix, their minimum rank distances and their block rank-metric error-erasure bounded minimum distance (BMD) decodersrealized e.g. by the decoder from Subsection 3.2.3. These BMD decoders decode correctly if (3.32) is ful lled for the corresponding minimum rank distance. If we consider unit memory codes with k = k (1) , then d 00 = d 10 = nk + 1, d σ = n -2k + 1 and d 01 = ∞, since G (01) does not exist.

(

  De nition 6.3 and Equation (6.3)) of C are lower bounded by d

Figure 6 . 3 .

 63 Figure 6.3. Illustration of the di erent steps of Algorithm 6.1: The received sequence (r (0) r (1) . . . r (N ) ) is given and the di erent steps and their decoding results are shown. Dashed blocks/edges illustrate that they were found in a previous step.

1234

  Received sequence r = (r (0) r (1) . . . r(N ) ) ∈ F n(N +1) q m Step 1: Decode block r (0) with BMD(C 0 ) Decode block r (i) with BMD(C σ ), for all i ∈ [1, N -1] Decode block r (N ) with BMD(C 01 )Assign metric m (i) as in (6.16), for all i ∈ [0, N ]5Step 2: For all found blocks c (i) : decode ℓ (i) f steps forward with BMD(C 0 ), 6 decode ℓ (i) b steps backward with BMD(C 1 ) 7 Step 3: For all found blocks c (i) : decode r (i+1) with BMD(C 01 ) 8 Assign metric m (i) as in (6.20), for all i ∈ [0, N ] 9 Step 4: Find complete path with smallest sum rank metric using the Viterbi algorithm Output: Codeword sequence c = (c (0) c (1) . . . c (N ) ) ∈ F n(N +1) q m

  Lemma 6.4 (Gap Between two Correct Results of Step 1). If the BRD condition (6.15) is satis ed, then the length of any gap between two correct decisions in Step 1 of Algorithm 6.1, denoted by c (i) , c (i+j) is less than min L

.

  Lemma 6.5 (Correct Path for Few Errors). Let c (i) and c (i+j) be decoded correctly in Step 1 of Algorithm 6.1. Let Step 2 of Algorithm 6.1 decode ℓ (i) f blocks in forward direction starting in c (i) and ℓ (i+j) b

  (shot) i. Similarly, let Y (i) ∈ F n (i) ×(n+m) qbe a matrix whose n (i) rows correspond to the received packets Y

  Algorithm 6.2. u = (u (0) u (1) . . . , u (N -1) ) ← N PUMD Y Input: Received sequence Y = (Y (0) Y (1) . . . , Y (N ) ),

  2 (Lifted PUM Code for Network Coding). Let N + 1 = 7, n = 8 ≤ m, k = 4, k (1) = 2 and therefore d 0 = d 1 = 5, d 01 = 7 and d σ = 3 (Table

  stop + h = dstop da • (deg q a(x)h) + h ≥ h 1 -dstop da + dstop da (deg q a(x) -1) = d stop -dstop da deg q a(x) + dstop da (deg q a(x) -1) > d stop -1,

  stop + h ≤ d stop .The same holds inductively within the recursions and the statement follows.

eΓ

  (C) Γ (C) (x) i = e (C) Γ (C) (x) C) e (C) (x) i , ∀i ∈ [0, m-1]. Let g = β ⊥ (and g ⊥ = β) and e (C) (g) = e (C) (β ⊥ ) = β • ext β e (C) = β • E (C) . Then, Lemma 3.10 states that e (C) (β ⊥ ) = e (C) (g) = g ⊥ • E (C)T = β • E (C)T . Thus, Γ (C) e (C) (β ⊥ ) = Γ (C) e (C) (g) = Γ (C) β • ext β e (C) T = Γ (C) β • B (C)T • A (C)T . (C) e (C) (g i ) = Γ (C) ∀i ∈ [0, m -1],

  Vertically interleaved Gabidulin codes were introduced by Loidreau and Overbeck in[START_REF] Loidreau | Decoding Rank Errors Beyond the Error Correcting Capability[END_REF][START_REF] Overbeck | Public Key Cryptography based on Coding Theory[END_REF] and rediscovered by Silva, Kschischang and Kötter[START_REF] Silva | A Rank-Metric Approach to Error Control in Random Network Coding[END_REF][START_REF] Silva | Error Control for Network Coding[END_REF] as the Cartesian product of s transposed codewords of Gabidulin codes. Later, Sidorenko and Bossert introduced horizontally interleaved Gabidulin codes[START_REF] Sidorenko | Decoding Interleaved Gabidulin Codes and Multisequence Linearized Shift-Register Synthesis[END_REF][START_REF] Sidorenko | Skew-Feedback Shift-Register Synthesis and Decoding Interleaved Gabidulin Codes[END_REF].

	C	R	M

They are the analog of interleaved Reed-Solomon codes in Hamming metric, see [KL97, KL98, BKY07, Kra03, BMS04, JTH04, SSB09, WZB12].

Table 3

 3

	Operation	Notation	Method	Complexity
	Linearized composition
	of a

.2. Complexity of standard implementations for linearized polynomials.

Table 3 .

 3 3. Complexity of new algorithms for operations with linearized polynomials.

	Operation	Notation	Method	Complexity
	Linearized composition
	of a

  matrices of size n * × n * and multiply each of these matrices from the left by A. Calculating A • B is then equivalent to multiplying at most √ n + 2 times a n * × n * matrix.Let N (n) denote the complexity of multiplying two n×n matrices. The Coppersmith-Winograd algorithm has complexity N (n) = O(n 2.376 ), see e.g.[START_REF] Gathen | Modern Computer Algebra[END_REF]. Thus, Line 3 can be computed with O

  is non-catastrophic and hence if the slope is σ R > 0 [Det94, Theorem A.4]. We will calculate the slope in Theorem 6.4, proving that σ R > 0. Third, we show that H(D) is in minimal form by analyzing the degree of the determinants of all (nk) × (nk) submatrices of H(D). Denote these submatrices by H ℓ (D) for ℓ = 0, 1, . . . . Clearly, deg(h ij

  6.3 (Active Row Rank Distance of our Construction).Let a PUM(n, k|k (1) ) code of rate R ≥ 1/2 with µ H = 1 be given, where the submatrices of H de ne Gabidulin codes as in Theorem 6.2. Then, the active row rank distance d

	(r) j,R (De nition 6.3) is bounded by
	d

Table 6 .

 6 1. Submatrices of (P)UM code from De nition 6.5 and their block codes.

	Generator	De ned	Code	Minimum rank	BMD
	matrix	code	parameters	distance	decoder

Table 6 .

 6 2. Example for error-erasure decoding of lifted (partial) unit memory codes based on Gabidulin codes.

		Shot i	0	1	2	3	4	5	6
		̺ (i) + γ (i)	0	1	3	1	1	0	2
		t (i)	2	2	0	1	0	3	2
	PUM code	Decoding with C σ , block 0 with C 0 ,		×	×	×		×
		block N with C 10
		Decoding with C 0 , C 1 Decoding with C 01		×				×

Dans ce chapitre, nous décrivons d'abord les deux approches connues pour le décodage unique et nous tirons une relation entre eux et leurs probabilités de défaillance. Ensuite, nous présentons un nouvel algorithme de décodage des codes de Gabidulin entrelacés basé sur l'interpolation des polynômes linéarisés. Nous prouvons la justesse de ses deux étapes principales -l'interpolation et la recherche des racines -et montrons que chacune d'elles peut être e ectuée en résolvant un système d'équations linéaires.On peut utiliser l'algorithme comme algorithme de décodage en liste des codes de Gabidulin entrelacés, qui garantit de trouver tous les mots de code dans un certain rayon. Cependant, la taille de la liste, et donc aussi au pire la complexité d'algorithme du décodage en liste, peut devenir exponentielle en la longueur du code. On peut également utiliser notre décodeur comme un décodeur probabiliste unique, en temps quadratique, avec le même rayon de décodage et la même borne supérieure de la probabilité de défaillance que les décodeurs connus. En clair, pour n'importe quel décodeur unique, au-delà de la moitié de la distance rang minimale il y aura toujours une probabilité de défaillance car il n'existe pas toujours une solution unique. Nous généralisons notre décodeur pour décoder en même temps des erreurs et des e acements de lignes et de colonnes.Dans le codage réseau linéaire aléatoire, un code de Gabidulin relevé entrelacé contient les espaces des lignes de I C (0)T C (1)T . . . C (s)T , où les C (i) , pour tout i ∈ [1, s], sont des mots de code des codes de Gabidulin sous-jacents. Ainsi, par rapport aux codes de Gabidulin relevés, le relèvement (lifting) des codes entrelacés de Gabidulin réduit relativement les frais généraux, qui sont causés par la matrice d'identité jointe.Jusqu'à présent, aucun algorithme de décodage en liste en temps polynomial pour les codes de Gabidulin n'est connu et en fait il n'est même pas clair que cela soit possible. Cela nous a motivé à étudier, dans le chapitre 5, les possibilités du décodage en liste en temps polynomial des codes en métrique rang. Cette analyse est e ectuée par le calcul de bornes sur la taille de la liste des codes en métriques rang en général et des codes de Gabidulin en particulier.On rappelle d'abord les bornes connues sur le décodage en liste des codes en métrique de Hamming, puis on déduit des bornes sur la taille de la liste des codes en métrique rang. Nous considérons en fait le nombre maximal de mots de code dans une boule en métrique rang de rayon τ , qui est appelé la taille (maximale) de la liste. Étonnamment, ces trois nouvelles bornes révèlent toutes un comportement des codes en métrique rang qui est complètement di érent de celui des codes en métrique de Hamming.

See [MBG + 93, Table5.1] for all values of m ≤

with an optimal normal basis of Fqm over Fq.

However, for some classes of codes, there is a direct connection, e.g. for maximum distance separable and maximum rank distance (MRD) codes.

We have to de ne arg minx f (x) either such that it returns the set of all values for which f (x) attains its minimum or such that it chooses one randomly.

When all coe cients of a(x) and b(x) lie in the ground eld Fq, the linearized composition is commutative.

For consistency with Theorem 2.3, we denote this normal basis by B ⊥ N as dual basis to BN .

The convolutional theorem for (usual) polynomials over nite elds states that polynomial multiplication modulo (x n -1) is equivalent to element-wise multiplication of the coe cients in the transform domain, see e.g. [Bla03, Theorem 6.1.3],[Bos98, Theorem 3.6].

Note that it is possible to change the order of these two steps and search for a basis of the row space rst and then nd a corresponding matrix A. This is a big di erence to Reed-Solomon codes, where we cannot interchange the two main steps.

Notice that this system of equations from (3.22) can be used for row-erasure-only correction, i.e., when a is known in advance due to the channel (compare Subsection 3.2.3).

Let r be the evaluation of p(x) ∈ P at a basis A = {α 0 , α 1 , . . . , α n-1 } of F q n over F q : r = (r 0 r 1 . . . r n-1 ) = p(α 0 ) p(α 1 ) . . . p(α n-1 ) .

Further, let also q(x) ∈ P, then p(x)q(x) has q-degree less than k. Let c denote the evaluation of p(x)q(x) at A. Then, rc is the evaluation of p(x)p(x) + q(x) = q(x) ∈ P, whose root space has dimension nτ and all roots lie in F q n . Thus, dim ker(rc) = nτ and dim C q (rc) = rk(rc) = τ . Therefore, for any q(x) ∈ P, the evaluation of p(x)q(x) is a codeword of Gab[n, k] and has rank distance τ from r. Hence,

Using (2.1), this provides the following lower bound on the maximum list size:

ℓ ≥ |P| ≥ q (n-τ )τ (q m ) n-τ -k ≥ q m q τ (m+n)-τ 2 -md , and for n = m the special case follows. This lower bound is valid for any τ < d, but we want to know, which is the smallest value for τ such that this expression grows exponentially in n.

For arbitrary n ≤ m, we can rewrite (5.5) by

where the rst part is exponential in n ≤ m for any 0 ≤ ǫ < 1. The second exponent is positive for

For n = m, this simpli es to

(5.6) Therefore, our lower bound (5.5) shows that the maximum list size is exponential in n for any τ ≥ τ * J . For n = m, the value τ J is basically the Johnson radius for codes in Hamming metric.

Faure obtained a similar result in [START_REF] Faure | Average Number of Gabidulin Codewords within a Sphere[END_REF][START_REF] Faure | Etudes de Systèmes Cryptographiques construits à l'aide de Codes Correcteurs[END_REF] by using probabilistic arguments. This reveals a di erence between the known limits to list decoding of Gabidulin and Reed-Solomon codes. For Reed-Solomon codes, polynomial-time list decoding up to the Johnson radius can be accomplished by the Guruswami-Sudan algorithm. However, it is not proven that the Johnson radius is tight for Reed-Solomon codes, i.e., it is not known if the list size is polynomial in n between the Johnson radius and the known exponential lower bounds (see e.g. [START_REF] Justesen | Bounds on List Decoding of MDS Codes[END_REF][START_REF] Ben-Sasson | Subspace Polynomials and Limits to List Decoding of Reed-Solomon Codes[END_REF]).

The result of Theorem 5.2 can also be obtained by interpreting the decoding list as a constant-rank code as in Subsection 5.2.3. For this purpose, we can use [GY10, Lemma 2] as follows.

Let C be a Gab[n, nd + 1] code of minimum rank distance d and B be a Gab[n, dτ ] code of minimum rank distance nd + τ + 1. Let C be de ned as in De nition 2.16 with the elements g 0 , g 1 , . . . , g n-1 ∈ F q m , which are linearly independent over F q , and let B be de ned with

. The corresponding generator matrices according to (2.27) are denoted by G C and G B .

Then, the direct sum code C ⊕ B has the generator matrix

To satisfy also the conditions on H (r(i)) , ∀i ∈ [1, µ H ], we have to ensure that all elements in the set

n-1 , h

(1) 0 , . . . , h

n-1 , . . . , h

n-1 , h

n-1 (6.9) of cardinality |H| = (µ H + 1) • n, are in F q m and are linearly independent over F q .

Therefore, if the elements of H (6.9) are linearly independent and

is a q-Vandermonde matrix as in (6.8), all requirements of Theorem 6.2 are ful lled.

The following lemma shows explicitly how to choose the set H using a normal basis of F q m over F q (see also Subsection 2.1.2) in order to construct a (P)UM code based on Gabidulin codes. Lemma 6.1 (Explicit Construction with Normal Basis). Let µ H ≥ 1, the code rate R = k/n ≥ µ H /(µ H + 1) and B N = {β [0] , β [1] , . . . , β [m-1] } be a normal basis of F q m over F q , where the eld size satis es

Let H (c) be de ned by (6.8) using h (0) . Let the semi-in nite parity-check matrix H as in (2.7) be de ned with the set H from (6.9).

Then, H consists of µ H + 1 submatrices H (i) and satis es all requirements of Theorem 6.2.

Proof. To prove that H (r(i)) de nes a Gabidulin code, ∀i ∈ [1, µ H ], with the parameters as in Theorem 6.2, it is su cient that all elements in H are linearly independent (6.9). There are at most m linearly independent elements in F q m . If (nk) divides n, then h (0) can be divided into subvectors, each of length (nk) as in (6.11), and the eld size has to be m ≥ (µ H + 1) • n. In general, the last subvector in h (0) might be shorter than nk and the linear independence within H (6.9) is guaranteed if (6.10) is ful lled. Therefore, h

as in (6.8) and the elements in H (6.9) are linearly independent. Hence, H (c) and H (r(i)) de ne Gabidulin codes with the parameters required in Theorem 6.2.

The following lemma shows that the parity-check matrix constructed in such a way is in minimal basic encoding form. Lemma 6.2 (Construction is in Minimal Basic Encoding Form). Let a (P)UM code based on Gabidulin codes be de ned by its parity-check matrix H as in Theorem 6.2, explicitly written e.g. as in Lemma 6.1. Then, H is in minimal basic encoding form.

Proof. Let us denote the corresponding polynomial parity-check matrix by

and compare Remark 2.2 for the required properties. First, H is in encoding form since H (0) is a q-Vandermonde matrix and therefore has full rank. Second, we show that H is in basic form. According to [For70, De nition 4], H(D) is basic if it is polynomial and if there exists a polynomial right inverse

. By de nition, H(D) is polynomial. A polynomial right inverse exists if and only

Theorem 6.4 (Free Rank Distance and Slope of our Construction for µ H = 1).

For R > 1/2, the PUM(n, k|k (1) ) code based on Gabidulin codes as in Theorem 6.2 with µ H = 1 achieves the upper bound on the free rank distance (6.5) and half the optimal slope (6.6):

Proof. The overall constraint length is ν = nk. Hence,

The slope is calculated as in De nition 6.4:

However, it is not clear what happens when µ H > 1. Based on simulations, we conjecture the following.

Conjecture 6.1 (Free Rank Distance and Slope of our Construction for Arbitrary µ H ).

For R > µ H /(µ H + 1), the PUM(n, k|k (1) ) code based on Gabidulin codes as in Theorem 6.2 with µ H ≥ 1 achieves

The lower bound on the slope can actually be proven similar to Theorem 6.3, but for the free rank distance it is not clear if

1,R is the minimum of the active row rank distances. This conjecture implies that the free rank distance increases with higher µ H and the slope decreases. Hence,-if the conjecture is true-a trade-o between the free rank distance and the slope is possible. A similar behavior was observed by Jordan, Pavlushkov and Zyablov [START_REF] Jordan | Maximum Slope Convolutional Codes[END_REF] in Hamming metric, since they showed that for general convolutional codes, the upper and lower bounds on the free distance increase with increasing memory whereas the upper and lower bounds for the slope decrease.

PUM Codes Based on the Generator Matrix of Gabidulin Codes

In the previous subsection, (P)UM codes were constructed such that the submatrices of the parity-check matrix de ne Gabidulin codes. In this subsection, we construct such codes based on the generator matrix. Our construction is an adaptation of the construction from [START_REF] Dettmar | Bounded Minimum Distance Decoding of Unit Memory Codes[END_REF] to rank metric.

De nition 6.5 ((P)UM Code based on Generator Matrices of Gabidulin Codes).

Let k + k (1) ≤ n ≤ m, where k (1) ≤ k, and let g 0 , g 1 , . . . , g n-1 ∈ F q m be linearly independent over F q . For k (1) = k we de ne a UM(n, k) code and for k (1) < k a PUM(n, k|k (1) ) code over F q m by a zero-forced terminated generator matrix G term as in (2.8) with µ = 1 and the k × n submatrices

and G (1) :

In Subsection 6.3.2, we prove that the algorithm is actually a BRD error-erasure rank-metric decoder as in De nition 6.6 and we show that its complexity is cubic with the length n of a code block.

The main idea of Algorithm 6.1 is to take advantage of the algebraic structure of the underlying block codes and their e cient decoders (see Table 6.1). We use the outputs of these block decoders to build a reduced trellis. As a nal step of our decoder, the usual Viterbi algorithm is applied to this reduced trellis, which has only very few states and therefore the Viterbi algorithm has low complexity.

The rst step of Algorithm 6.1 is to decode

Because of the termination, the rst and the last block can be decoded in the codes C 0 and C 01 , respectively, which have a higher minimum rank distance than C σ . Let c (i)′ , for all i ∈ [0, N ], denote the result of decoding r (i) if it is successful.

For all i ∈ [0, N ], we draw an edge in a reduced trellis with the following metric:

The metric for the successful case is always smaller than the metric for the non-successful case since

If the block error-erasure decoder BMD(C σ ) decodes correctly, the result is (10) . Since the minimum distance d σ ≥ 1, we can reconstruct the whole information vector u (i) = (u

k-1 ) and the mentioned part of the previous information (u

k (1) -1 ). Assume, we reconstructed u (i) and (u

k (1) -1 ) in Step 1, then with (2.9) and the encoding rule (2.10), we can calculate:

(6.17)

Hence, Step 2 uses the information from block i to decode ℓ

f blocks forward with BMD(C 0 ) and ℓ

blocks backward with BMD(C 1 ) from any node found in Step 1. This closes (most of) the gaps between two blocks correctly decoded by BMD(C σ ) (of course, it is not known, which are decoded correctly).

The values ℓ

b are de ned as follows.

These de nitions are chosen such that we can guarantee correct decoding if the BRD condition (6.15) is ful lled (see Section 6.3.2).

CHAPTER 7

Concluding Remarks

W

, decoding of block and convolutional codes in rank metric has been considered. Since the invention of codes in rank metric by Delsarte, Gabidulin and Roth, several authors have investigated the properties of such codes. A couple of e cient decoding algorithms for a class of maximum rank distance codes-nowadays called Gabidulin codes-were presented within the last years, most of them similar to renown decoding algorithms for Reed-Solomon codes.

In the course of this dissertation, we have developed a new e cient bounded minimum distance decoding algorithm for Gabidulin codes and an interpolation-based decoding procedure for interleaved Gabidulin codes. Further, we have derived bounds on the list decoding radius of rank-metric codes, and introduced and decoded a class of convolutional codes in rank metric. The main results of this dissertation are summarized in the following.

Chapter 3 is dedicated to decoding of Gabidulin codes. First, we have shown e cient algorithms for calculations with linearized polynomials, including two algorithms for calculating the linearized composition with sub-quadratic complexity. Second, we have presented a bounded minimum distance decoding algorithm for Gabidulin codes, similar to Gao's decoding algorithm for Reed-Solomon codes. We have proven how the linearized Euclidean algorithm can be used in this context to output directly the q-degree-restricted linearized evaluation polynomial of the estimated codeword. Moreover, we have extended this decoding algorithm in order to incorporate not only errors, but also two types of erasures in rank metric: row and column erasures.

Chapter 4 covers interleaved Gabidulin codes and their decoding beyond half the minimum distance. So far, two probabilistic unique decoding approaches have been known for these codes, which both fail with a certain probability since there might be more than one codeword within the decoding radius. We have presented an interpolation-based decoding approach, which relies on solving two linear systems of equations, one for the interpolation step and one for the root-nding step. It can be used as a list decoding algorithm for interleaved Gabidulin codes and guarantees to nd all codewords within a certain radius. However, the list size and therefore also the worst-case complexity of the list decoder can become exponential in the length of the code. Alternatively, our decoder can be used as a probabilistic unique decoder, with the same decoding radius and the same upper bound on the failure probability as the known decoders. We have further generalized our decoder to error-erasure decoding.

Up to now, there exists no algorithm which decodes Gabidulin codes beyond half the minimum distance. This motivated us to investigate in Chapter 5 the possibilities of polynomial-time list decoding of rank-metric codes in general and Gabidulin codes in particular. We have derived three bounds on the list size, i.e., on the maximum number of codewords in a ball of radius τ . All three bounds reveal a behavior which is completely di erent from the one of codes in Hamming metric. The rst bound shows that the list size for Gabidulin codes can become exponential when τ is at least the Johnson

De ne r ′′ (x) def = a ′′ (x)q ′ (b ′′ (x)) and therefore a(x) = q ′ (b(x)) + r ′ (x [h] ) + r ′′ (x). If deg q r ′ (x [h] ) + r ′′ (x) < d b , then q ′ (x) = q(x) since the linearized division is unique [Ore33a, Theorem 1]. We verify this degree constraint by showing that it holds for each of the terms:

Proof of Lemma 3.6. We can prove this lemma by induction, assuming that for the outputs of the recursions Equation (3.8) holds with the corresponding stopping degrees. We analyze the degrees of the polynomials in the di erent lines of Algorithm 3.4 in the following.

• Lines 5-6: deg q a (1) (x) = d ah and deg q b (1) (x) = d bh < d a /2. • Line 8: For the explanation, let us de ne r (1)(j-1) (x)

where Q (1) is the output of the recursive call. Due to the induction assumption, the degrees of these remainders are restricted by: deg q r (1)(j-1) (x) ≥ d

(1) stop = dstop da • deg q a (1) (x) and deg q r (1)(j) (x) ≤ d

(1) stop .

• Line 9: After the linearized matrix-multiplication with Q (1) , we obtain deg q a(x) =

, where the "-1" comes from the oor operation in cases where d a is odd. Moreover,

Note that these values lie in the middle between d a and d stop , i.e., we have already accomplished the rst half of the degree reduction.

• Line 13: After the linearized division in Line 11, a(x) becomes the previous b(x) from Line 9 and therefore, deg q a(x) ≤ 1 2 (d a + d stop ). Moreover, the q-degree of b(x) reduces by at least one, i.e., deg q b(x) < 1 2 (d a + d stop ). • Line 16: We obtain h ≥ d stop /2 due to the q-degree restriction of a(x) from Line 13. • Lines 17-18: The truncation results in polynomials with the following q-degrees:

A.3 Comparison of Decoding Approaches for Gabidulin Codes

Let us compare the complexity of our decoding approach from Subsection 3.2.4 to the complexity of known approaches for decoding Gabidulin codes in Table A.1, where the degree of all input polynomials is in the order of n and we do not consider constant factors (which would result in a slight di erence between the decoding algorithms from [Gab85, [START_REF] Paramonov | An Analogue of Berlekamp-Massey Algorithm for Decoding Codes in Rank Metric[END_REF][START_REF] Richter | Fast Decoding of Rank-Codes with Rank Errors and Column Erasures[END_REF][START_REF] Loidreau | A Welch-Berlekamp Like Algorithm for Decoding Gabidulin Codes[END_REF]).

If we assume that each operation in F q m costs O(m 2 ) operations over F q (see Table 3.1), then O(m 3 log m) operations over F q is smaller than O(n 2 ) operations over F q . O(n 2 m 2 ) over F q Syndrome calculation with O(m 3 ) in F q , Calculating the root space of the error span polynomial: O(m 3 ) over F q as in [START_REF] Berlekamp | Algebraic Coding Theory[END_REF]. Publications Containing Parts of this Thesis