Fast Kötter–Nielsen–Høholdt interpolation over skew polynomial rings and its application in coding theory

Abstract

Skew polynomials are a class of non-commutative polynomials that have several applications in computer science, coding theory and cryptography. In particular, skew polynomials can be used to construct and decode evaluation codes in several metrics, like e.g. the Hamming, rank, sum-rank and skew metric. We propose a fast divide-and-conquer variant of Kötter–Nielsen–Høholdt (KNH) interpolation algorithm: it inputs a list of linear functionals on skew polynomial vectors, and outputs a reduced Gröbner basis of their kernel intersection. We show, that the proposed KNH interpolation can be used to solve the interpolation step of interpolation-based decoding of interleaved Gabidulin codes in the rank-metric, linearized Reed–Solomon codes in the sum-rank metric and skew Reed–Solomon codes in the skew metric requiring at most ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$, where n is the length of the code, $s$ the interleaving order, ${\mathfrak {M}}(n)$ the complexity for multiplying two skew polynomials of degree at most n, $\omega$ the matrix multiplication exponent and ${\widetilde{O}}\left( \cdot \right)$ the soft-O notation which neglects log factors. This matches the previous best speeds for these tasks, which were obtained by top–down minimal approximant bases techniques, and complements the theory of efficient interpolation over free skew polynomial modules by the bottom-up KNH approach. In contrast to the top–down approach the bottom-up KNH algorithm has no requirements on the interpolation points and thus does not require any pre-processing.

1 Introduction

Skew polynomials are a class of non-commutative polynomials, that were introduced by Ore in 1933 [53] and that have a variety of applications in computer science, coding theory and cryptography. The non-commutativity stems from the multiplication rule, which involves both, a field automorphism $\sigma$ and a field derivation $\delta$. Unlike ordinary polynomials, there exist several ways to evaluate skew polynomials. General results regarding the so-called remainder evaluation of skew polynomials were derived in [27, 29] whereas the generalized operator evaluation was considered in [31]. Depending on the choice of the automorphism $\sigma$ and the derivation $\delta$, skew polynomial rings (denoted by ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$) include several interesting special cases, such as the ordinary polynomial ring as well as the linearized polynomial ring [52, 53]. This property along with the different ways to evaluate skew polynomials make them a very versatile tool with many different applications.

One important application of skew polynomials is the construction of evaluation codes, that have distance properties in several decoding metrics, including the Hamming, rank, sum-rank, skew and other related metrics such as the (sum-)subspace metric [14, 15, 39, 43].

Many evaluation codes allow for decoding via efficient interpolation-based decoding algorithms, like e.g. the Welch–Berlekamp [64] and Sudan [61] algorithms for decoding Reed–Solomon codes. In [26] Kötter presented a bivariate interpolation algorithm for Sudan-like decoding of Reed–Solomon codes [26] (over ordinary polynomial rings) that since then is often referred to as the Kötter interpolation. The Kötter interpolation as it is known today was first stated by Nielsen and Høholdt [50] as a generalization of Kötter’s algorithm [26] which is able to handle multiplicities. To acknowledge the contribution by Nielsen and Høholdt we refer to the algorithm as Kötter–Nielsen–Høholdt (KNH) interpolation. A fast divide-and-conquer variant of the KNH interpolation for the Guruswami–Sudan algorithm for decoding Reed–Solomon codes was presented in [49]. Rosenkilde’s algorithm [49] is a bottom-up KNH-like algorithm whose complexity is only slightly larger compared to the currently fastest approach [24, Sect. 2.5].

A multivariate generalization of the KNH interpolation for free modules over ordinary polynomial rings was proposed in [63]. This approach was generalized to free modules over linearized polynomial rings in [65]. A generalization of the multivariate KNH interpolation to free modules over skew polynomial rings was proposed in [33], which contains the variants over ordinary polynomial rings [63] and linearized polynomial rings [65] as a special case.

The evaluation and interpolation of multivariate skew polynomials was also considered in [42]; here with the main motivation to construct Reed-Muller-like codes (see also [4, 21, 41]).

1.1 Main contribution

In this paper, we propose a fast divide-and-conquer (D &C) variant of the KNH interpolation in skew polynomial rings [33], that uses ideas from [49]. The main idea of the proposed algorithm (Algorithm 3) is, that the interpolation problem is divided into smaller sub-problems, that can be solved and merged efficiently. In particular, the update operations in each loop of the KNH interpolation are “recorded” and then applied to a degree-reduced basis in the merge step rather than to a non-reduced basis. This allows to control the degree of the polynomials during the interpolation procedure which in turn results in a lower computational complexity.

We state the interpolation problem and the algorithm in a general way using linear functionals over skew polynomials rings with arbitrary automorphisms and derivations. We show how the fast KNH interpolation can be applied to interpolation-based decoding of (interleaved) Gabidulin codes [35, 54], interleaved linearized Reed–Solomon codes [5, 6, 15, 39] and (interleaved) skew Reed–Solomon codes [5, 6, 14].

We consider skew polynomials over finite fields only. However, the results (except for the complexity statements) also hold for skew polynomials over arbitrary finite Galois extensions ${\mathbb {L}}/{\mathbb {K}}$ instead of ${\mathbb {F}}_{q^m}/{\mathbb {F}}_{q}$ and automorphisms $\sigma \in \textrm{Gal}({\mathbb {L}}/{\mathbb {K}})$ with ${\mathbb {K}} = {\mathbb {L}}^\sigma$ and derivations $\delta :{\mathbb {K}}\mapsto {\mathbb {K}}$ satisfying (2) for all $a,b\in {\mathbb {K}}$.

For the above mentioned applications using generalized operator and remainder evaluation maps over skew polynomial rings with arbitrary field automorphisms we discuss the asymptotic complexity for zero derivations ($\delta =0$). The asymptotic complexity for solving the interpolation step with the proposed approach is ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$, where n is the length of the code, $s$ a decoding parameter (e.g. interpolation order, usually $s\ll n$), ${\mathfrak {M}}(n)\in {\widetilde{O}}\left( n^{1.635}\right)$ the complexity for multiplying two skew polynomials of degree at most n, $\omega$ the matrix multiplication exponent (currently $\omega < 2.37286$) and ${\widetilde{O}}\left( \cdot \right)$ denotes the soft-O notation which neglects log factors.

The original skew KNH interpolation from [33] has an asymptotic complexity of $O\left( s^2n^2\right)$ operations in ${\mathbb {F}}_{q^m}$, which is larger compared to the proposed approach for most practical cases where we usually have $s\ll n$.

The interpolation step of the above mentioned coding applications can also be solved using the skew minimal approximant bases methods from [11] requiring at most ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$. This approach can be seen as a top–down approach: first construct a module that contains all solutions to the interpolation problem, and then find the minimal solution in that module. The KNH family of algorithms are bottom-up: Gradually build up a minimal basis solving the interpolation constraints one by one. Developing both approaches in tandem has been very fruitful for the analogous family of algorithms for ordinary polynomial rings.

Due to the top–down nature, the minimal approximant bases method [11, Algorithm 6] requires an additional step if the first entries of the interpolation points (related to the generalized operator evaluation maps) are not linearly independent (see [11, Theorem 22]), which is not required in the proposed KNH-like algorithm.

A comparison between the proposed fast KNH interpolation algorithm and existing interpolation methods for ordinary and skew polynomial rings, including the computational complexity for the zero-derivation case ($\delta =0$), is given in Table 1. Note that for ordinary polynomial rings we have that ${\mathfrak {M}}(n)\in {\widetilde{O}}\left( n\right)$. Additionally, in the ordinary polynomial ring case we have the notion of multiplicities of roots; a concept which is not yet generalized to the skew polynomial setting and therefore omitted.

Although the proposed interpolation algorithm achieves the best known complexity over skew polynomial rings, Table 1 shows that the best computational complexity of ${\widetilde{O}}\left( s^{\omega -1}{\mathfrak {M}}(n)\right)$ for ordinary polynomial rings [24] is not yet reached for the skew polynomial case. Closing this gap is a potential topic for future work.

Table 1 Overview of the computational complexity of the proposed fast KNH interpolation approach compared to existing methods for the case of zero derivations ($\delta =0$)

1.2 Outline of the paper

Section 2 gives definitions and notations related to skew polynomials as well as a definition of the skew KNH interpolation algorithm from [33]. Section 3 presents a fast general D &C framework for the skew KNH interpolation. Section 4 considers the application of the fast skew KNH interpolation for decoding (interleaved) Gabidulin, linearized Reed–Solomon and Skew Reed–Solomon codes. The complexity analysis shows that we obtain the currently fastest known decoders for the considered codes. Section 5 concludes the paper.

2 Preliminaries

2.1 Sets, vectors and matrices over finite fields

Let ${\mathbb {F}}_{q}$ be a finite field and denote by ${\mathbb {F}}_{q^m}$ the extension field of degree m. Sets are denoted by $\mathcal {A}=\{a_0,a_1,\dots ,a_{n-1}\}$. The cardinality of a set $\mathcal {A}$ is denoted by $|\mathcal {A}|$.

Vectors and matrices over ${\mathbb {F}}_{q^m}$ are denoted by bold lower-case and upper-case letters such as $\textbf{a}$ and $\textbf{A}$, respectively, and the elements are indexed beginning from zero. The $r\times c$ zero matrix is denoted by $\textbf{0}_{r\times c}$ and the $r\times r$ identity matrix is denoted by $\textbf{I}_r$. The i-th row of a matrix $\textbf{A}$ is denoted by $\textbf{a}_i$. Let ${\mathbb {F}}_{q^m}^N$ denote the set of all row vectors of length N over ${\mathbb {F}}_{q^m}$ and let ${\mathbb {F}}_{q^m}^{M\times N}$ denote the set of all $M\times N$ matrices over ${\mathbb {F}}_{q^m}$. The rank of a matrix $\textbf{A}\in {\mathbb {F}}_{q}^{M\times N}$ is denoted by ${{\,\textrm{rk}\,}}_q(\textbf{A})$. Under a fixed basis of ${\mathbb {F}}_{q^m}$ over ${\mathbb {F}}_{q}$, there is a bijection between ${\mathbb {F}}_{q^m}^n$ and ${\mathbb {F}}_{q}^{m\times n}$. This allows us to define the ${\mathbb {F}}_{q}$-rank of a vector ${\textbf{a}}\in {\mathbb {F}}_{q^m}^N$ as ${{\,\textrm{rk}\,}}_q(\textbf{a}){:}{=}{{\,\textrm{rk}\,}}(\textbf{A})$ where $\textbf{A}$ is the corresponding matrix of $\textbf{a}$ over ${\mathbb {F}}_{q}$. Note that the ${\mathbb {F}}_{q}$-rank ${{\,\textrm{rk}\,}}_q({\textbf{a}})$ is independent of the choice of the basis of ${\mathbb {F}}_{q^m}$ over ${\mathbb {F}}_{q}$ and can be equivalently seen as the maximum number of ${\mathbb {F}}_{q}$-linearly independent entries of ${\textbf{a}}$. The Hamming weight of a vector $\textbf{a}\in {\mathbb {F}}_{q^m}^N$ is defined as

$$\begin{aligned} {{\,\textrm{wt}\,}}_{H}(\textbf{a})=|\{i \in \{1,\dots , N\}:a_i\ne 0\}|. \end{aligned}$$

(1)

Let $\sigma :{\mathbb {F}}_{q^m}\mapsto {\mathbb {F}}_{q^m}$ be a field automorphism of ${\mathbb {F}}_{q^m}$ and let $\delta :{\mathbb {F}}_{q^m}\mapsto {\mathbb {F}}_{q^m}$ be a $\sigma$-derivation such that

$$\begin{aligned} \delta (a+b)=\delta (a)+\delta (b) \quad \text {and}\quad \delta (ab)=\delta (a)b+\sigma (a)\delta (b). \end{aligned}$$

(2)

Over a finite field, all $\sigma$-derivations are of the form (see e.g. [33, Proposition 1])

$$\begin{aligned} \delta (a)=b(\sigma (a)-a) \qquad \text {for } b\in {\mathbb {F}}_{q^m}. \end{aligned}$$

(3)

From (3) we see that we get the zero derivation ($\delta =0$) if the automorphism is the identity ($\sigma =\textsf {Id}$).

For any two elements $a\in {\mathbb {F}}_{q^m}$ and $c\in {\mathbb {F}}_{q^m}^*={\mathbb {F}}_{q^m}\setminus \{0\}$ define

$$\begin{aligned} a^c{:}{=}\sigma (c)ac^{-1}+\delta (c)c^{-1} \end{aligned}$$

(4)

where term $\delta (c)c^{-1}$ is called the logarithmic derivative of c. Two elements $a,b\in {\mathbb {F}}_{q^m}$ are called $(\sigma ,\delta )$-conjugates, if there exists an element $c\in {\mathbb {F}}_{q^m}^*$ such that $b=a^c$. Otherwise, a and b are called $(\sigma ,\delta )$-distinct. The notion of $(\sigma ,\delta )$-conjugacy defines an equivalence relation on ${\mathbb {F}}_{q^m}$ and thus a partition of ${\mathbb {F}}_{q^m}$ into conjugacy classes (see [29]).

Definition 1

(Conjugacy Class [29]) The set

$$\begin{aligned} \mathcal {C}(a){:}{=}\left\{ a^c:c\in {\mathbb {F}}_{q^m}^*\right\} \end{aligned}$$

(5)

is called conjugacy class of a.

2.2 Skew polynomials

Skew polynomials are non-commutative polynomials that were introduced by Ore [53]. The set of all polynomials of the form

$$\begin{aligned} f(x)=\sum _{i}f_ix^i \quad \text {with} \quad f_i\in {\mathbb {F}}_{q^m}\end{aligned}$$

(6)

together with the ordinary polynomial addition and the multiplication rule

$$\begin{aligned} xa=\sigma (a)x+\delta (a) \end{aligned}$$

(7)

forms the non-commutative ring of skew polynomials that is denoted by ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$. The degree of a skew polynomial $f\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ is defined as $\deg (f){:}{=}\max _i\{i:f_i\ne 0\}$ for $f\ne 0$ and $-\infty$ else. Further, by ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]_{<n}$ we denote the set of skew polynomials from ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ of degree less than n.

For $\delta$ being an inner derivation (3), which is always the case for finite fields, there is a ring isomorphism between ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ and ${\mathbb {F}}_{q^m}[x;\sigma ]$ that is given by the mapping (see [39, Proposition 40] and [32, Proposition 2.1.8])

$$\begin{aligned} {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]&\rightarrow {\mathbb {F}}_{q^m}[x;\sigma ]\\ \sum _{i}f_ix^i&\mapsto \sum _{i}f_i(x+b)^i. \end{aligned}$$

The monic least common left multiple (LCLM) of some polynomials $p_0,p_1,\dots ,p_{n-1}\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ is denoted by

$$\begin{aligned} \text {lclm}\left( p_i\right) _{0\le i\le n-1}{:}{=}\text {lclm}\left( p_0,p_1,\dots ,p_{n-1}\right) _{}. \end{aligned}$$

(8)

The skew polynomial ring ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ is a left and right Euclidean domain, i.e., for any $f \in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ and any nonzero $g \in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ there exist unique polynomials $q_L,r_L,q_R,r_R\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ such that

$$\begin{aligned} f(x)=q_R(x)g(x)+r_R(x)=g(x)q_L(x)+r_L(x) \end{aligned}$$

(9)

where $\deg (r_R),\deg (r_L)<\deg (g)$ (see [53]). Efficient Euclidean-like algorithms for performing left/right skew polynomial division exist [16, 17, 55]. For two skew polynomials $f,g\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$, denote by $f\; \textrm{mod}_{\textrm{r}} \;g$ the remainder of the right division of f by g.

Example 1

Applying the multiplication rule in (7) to $x^2a$ we get

$$\begin{aligned} x^2a&= x(\sigma (a)x+\delta (a)) = x\sigma (a)x+x\delta (a)\\&= (\sigma ^2(a)x+\delta (\sigma (a)))x+\sigma (\delta (a))x+\delta ^2(a)\\&=\sigma ^2(a)x^2+(\delta (\sigma (a))+\sigma (\delta (a)))x+\delta ^2(a). \end{aligned}$$

There are several interesting cases where skew polynomial rings coincide with other polynomial rings:

• For $\sigma$ being the identity we have that $\delta$ is the zero derivation (see (3)) which implies that ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ is equivalent to the ordinary polynomial ring ${\mathbb {F}}_{q^m}[x]$.

• For $\delta$ being the zero derivation we get the twisted polynomial ring ${\mathbb {F}}_{q^m}[x;\sigma ]$.

• For $\sigma _\text {Frob}$ being the Frobenius automorphism of ${\mathbb {F}}_{q^m}$ (i.e. $\sigma _\text {Frob}(\cdot )=\cdot ^q$) and $\delta$ being the zero derivation we have that ${\mathbb {F}}_{q^m}[x;\sigma _\text {Frob}]$ is isomorphic to the linearized polynomial ring ${\mathbb {L}}_{q^m}\![x]$ [52, 53].

There exist two variants of skew polynomial evaluation: the (generalized) operator evaluation and the remainder evaluation.

2.2.1 Generalized operator evaluation

The generalized operator evaluation defined in [31] allows to ${\mathbb {F}}_{q}$-linearize the skew polynomial evaluation and therefore establishes the link between the skew polynomial ring and the linearized polynomial ring [52, 53].

Given an ${\mathbb {F}}_{q^m}$ automorphism $\sigma$, a $\sigma$-derivation $\delta$ and an element $a\in {\mathbb {F}}_{q^m}$, the $(\sigma ,\delta )$ operator ${\mathcal {D}}_{a}^{\sigma ,\delta }(b):{\mathbb {F}}_{q^m}\mapsto {\mathbb {F}}_{q^m}$ is defined as

$$\begin{aligned} {\mathcal {D}}_{a}^{\sigma ,\delta }(b){:}{=}\sigma (b)a+\delta (b),\qquad \forall b\in {\mathbb {F}}_{q^m}. \end{aligned}$$

(10)

We use the notation ${\mathcal {D}}_{a}(b)$ whenever $\sigma$ and $\delta$ are clear from the context. For an integer $i\ge 0$, we define ${\mathcal {D}}_{a}^{i+1}(b)={\mathcal {D}}_{a}({\mathcal {D}}_{a}^{i}(b))$ and ${\mathcal {D}}_{a}^{0}(b)=b$.

Definition 2

(Generalized Operator Evaluation [39]) For a skew polynomial $f\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ the generalized operator evaluation ${f}(b)_{a}$ of f at an element $b\in {\mathbb {F}}_{q^m}$ w.r.t. the evaluation parameter $a\in {\mathbb {F}}_{q^m}$ is defined as

$$\begin{aligned} {f}(b)_{a}{:}{=}\sum _{i}f_i{\mathcal {D}}_{a}^{i}(b). \end{aligned}$$

(11)

The definition of the generalized operator evaluation includes the operator evaluation ${f}(b)_{1}$ as a special case ($a=1$).

The generalized operator evaluation is an ${\mathbb {F}}_{q}$-linear map, i.e. for any $f\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$, $\lambda _1,\lambda _2\in {\mathbb {F}}_{q}$ and $a, b_1,b_2\in {\mathbb {F}}_{q^m}$ we have that (see [39, Lemma 23] and [30])

$$\begin{aligned} {f}(\lambda _1b_1+\lambda _2b_2)_{a}=\lambda _1{f}(b_1)_{a}+\lambda _2{f}(b_2)_{a}. \end{aligned}$$

(12)

For a vector $\textbf{b}=(b_0,b_1,\dots ,b_{n-1})\in {\mathbb {F}}_{q^m}^n$ we define the generalized multipoint operator evaluation of a skew polynomial $f\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ w.r.t. an $a\in {\mathbb {F}}_{q^m}$ as

$$\begin{aligned} {f}(\textbf{b})_{a}{:}{=}\left( {f}(b_0)_{a},{f}(b_1)_{a},\dots ,{f}(b_{n-1})_{a}\right) . \end{aligned}$$

(13)

For a tuple $\mathcal {B}=(b_0,b_1,\dots ,b_{n-1})\in {\mathbb {F}}_{q^m}^n$ and a vector $\textbf{a}=(a_0,a_1,\dots ,a_{n-1})\in {\mathbb {F}}_{q^m}^n$ the minimal skew polynomial that vanishes on all elements in $\mathcal {B}$ w.r.t. the evaluation parameters in $\textbf{a}$ is defined as (see e.g. [15])

(14)

The degree of $M^\text {op}_{\mathcal {B}}(x)_{\textbf{a}}$ satisfies

$$\begin{aligned} \deg (M^\text {op}_{\mathcal {B}}(x)_{\textbf{a}})\le n \end{aligned}$$

(15)

where equality holds if the sequence of elements $b_i$ that have the same evaluation parameter $a_i$ are ${\mathbb {F}}_{q}$-linearly independent and the distinct evaluation parameters $a_i$ are from different conjugacy classes (see [15]).

Example 2

Consider the tuple $\mathcal {B}=(b_0,b_1,b_2,b_3)\in {\mathbb {F}}_{q^m}^4$ and a vector ${\textbf{a}}=(a_0,a_1,a_2,a_3)\in {\mathbb {F}}_{q^m}^4$, where $a_0 = a_1$ and $a_2 = a_3$ are representatives from different conjugacy classes. Then we have $\deg (M^\text {op}_{\mathcal {B}}(x)_{\textbf{a}})= n$ if and only if $b_0$ and $b_1$ are ${\mathbb {F}}_{q}$-linearly independent and $b_2$ and $b_3$ are ${\mathbb {F}}_{q}$-linearly independent.

Similar to ordinary polynomials, we get the following result for the generalized operator evaluation of a polynomial modulo a particular minimal polynomial.

Lemma 1

For any $f\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$, $\mathcal {B}=(b_0,b_1,\dots ,b_{n-1})\in {\mathbb {F}}_{q^m}^n$ and ${\textbf{a}}=(a_0,a_1,\dots ,a_{n-1})\in {\mathbb {F}}_{q^m}^n$ we have that

$$\begin{aligned} {f}(b_i)_{a_i}={\left( f(x)\; \textrm{mod}_{\textrm{r}} \;M^\text {op}_{\mathcal {B}}(x)_{{\textbf{a}}}\right) }(b_i)_{a_i}, \quad \forall i=0,\dots ,n-1. \end{aligned}$$

(16)

Proof

Since ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ is a left/right Euclidean domain, there exist two unique polynomials $q,r\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ with $\deg (r(x)) < \deg (M^\text {op}_{\mathcal {B}}(x)_{{\textbf{a}}})$ such that

$$\begin{aligned} f(x)=q(x)M^\text {op}_{\mathcal {B}}(x)_{{\textbf{a}}}+r(x) \quad \Longleftrightarrow \quad r(x)=f(x)\; \textrm{mod}_{\textrm{r}} \;M^\text {op}_{\mathcal {B}}(x)_{{\textbf{a}}}. \end{aligned}$$

(17)

Since $M^\text {op}_{\mathcal {B}}(x)_{{\textbf{a}}}$ vanishes on all $b_i$ w.r.t. $a_i$ for all $i=0,\dots ,n-1$ we have that

$$\begin{aligned} {f}(b_i)_{a_i}={r}(b_i)_{a_i}, \quad \forall i=0,\dots ,n-1, \end{aligned}$$

(18)

and the result follows. $\square$

2.2.2 Remainder evaluation

Another variant of skew polynomial evaluation is the remainder evaluation defined in [27, 29], which generalizes the concept of polynomial evaluation by means of (right) division.

Definition 3

(Remainder Evaluation [27, 29]) For a skew polynomial $f\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ the remainder evaluation ${f}\!\left[ b\right]$ of f at an element $b\in {\mathbb {F}}_{q^m}$ is defined as the unique remainder of the right division of f(x) by $(x-b)$ such that

$$\begin{aligned} f(x)=g(x)(x-b)+{f}\!\left[ b\right] \quad \Longleftrightarrow \quad {f}\!\left[ b\right] = f(x) \; \textrm{mod}_{\textrm{r}} \;(x-b). \end{aligned}$$

(19)

For a vector $\textbf{b}=(b_0,b_1,\dots ,b_{n-1})\in {\mathbb {F}}_{q^m}^n$ we define the multipoint remainder evaluation of a skew polynomial $f\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ as

$$\begin{aligned} {f}\!\left[ \textbf{b}\right] {:}{=}\left( {f}\!\left[ b_0\right] ,{f}\!\left[ b_1\right] ,\dots ,{f}\!\left[ b_{n-1}\right] \right) . \end{aligned}$$

(20)

In the following we recall important properties of the concept of P-independence (or polynomial independence) from [27, 28, 39]. Given a set $\mathcal {F}\subseteq {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ we define its zero set $\mathcal {Z}(\mathcal {F})\subseteq {\mathbb {F}}_{q^m}$ as

$$\begin{aligned} \mathcal {Z}(\mathcal {F}){:}{=}\{a\in {\mathbb {F}}_{q^m}:{f}\!\left[ a\right] =0,\forall f\in \mathcal {F}\}. \end{aligned}$$

(21)

For a set $\mathcal {B}=\{b_0,b_1,\dots ,b_{n-1}\}\subseteq {\mathbb {F}}_{q^m}$ we define its associated ideal as (see [39])

$$\begin{aligned} I(\mathcal {B})=\{f\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]:{f}\!\left[ b\right] =0,\forall b\in \mathcal {B}\}. \end{aligned}$$

(22)

For a set $\mathcal {B}=\{b_0,b_1,\dots ,b_{n-1}\}\subseteq {\mathbb {F}}_{q^m}$ the unique minimal skew polynomial that vanishes on all elements in $\mathcal {B}$ w.r.t. the remainder evaluation is defined as (see e.g. [14])

$$\begin{aligned} M^\text {rem}_{\mathcal {B}}(x)=\text {lclm}\left( x-b_i\right) _{0\le i\le n-1}. \end{aligned}$$

(23)

Since $M^\text {rem}_{\mathcal {B}}(x)$ has the minimal degree among all polynomials in ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ that vanish on $\mathcal {B}$ it generates the left ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$-ideal $I(\mathcal {B})$. The degree of $M^\text {rem}_{\mathcal {B}}(x)$ satisfies

$$\begin{aligned} \deg (M^\text {rem}_{\mathcal {B}}(x))\le n \end{aligned}$$

(24)

where the elements $b_0,b_1,\dots ,b_{n-1}$ are called P-independent (or polynomially independent) if and only if $\deg (M^\text {rem}_{\mathcal {B}}(x))=n$.

The closure of a set $\mathcal {B}\subseteq {\mathbb {F}}_{q^m}$ is defined as the zero set of its minimal polynomial, i.e. as

$$\begin{aligned} \overline{\mathcal {B}}{:}{=}\mathcal {Z}(I(\mathcal {B}))=\mathcal {Z}(M^\text {rem}_{\mathcal {B}}(x)) \end{aligned}$$

(25)

where $\mathcal {B}$ is called P-closed if and only if $\overline{\mathcal {B}}=\mathcal {B}$. For a P-closed set $\mathcal {B}$ it can be shown that any root of $M^\text {rem}_{\mathcal {B}}(x)$ is an $(\sigma ,\delta )$-conjugate of an element in $\mathcal {B}$ (see [28]).

Similar to the result w.r.t. to the generalized operator evaluation in Lemma 1, we obtain the following result w.r.t. the remainder evaluation.

Lemma 2

For any $p\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ and $\mathcal {B}=\{b_0,b_1,\dots ,b_{n-1}\}\subseteq {\mathbb {F}}_{q^m}$ we have that

$$\begin{aligned} {p}\!\left[ b_i\right] ={\left( p(x)\; \textrm{mod}_{\textrm{r}} \;M^\text {rem}_{\mathcal {B}}(x)\right) }\!\left[ b_i\right] , \quad \forall i=0,\dots ,n-1. \end{aligned}$$

(26)

Proof

Since ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ is a left/right Euclidean domain, there exist two unique polynomials $q,r\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ with $\deg (r(x)) < \deg (M^\text {rem}_{\mathcal {B}}(x))$ such that

$$\begin{aligned} p(x)=q(x)M^\text {rem}_{\mathcal {B}}(x)+r(x) \quad \Longleftrightarrow \quad r(x)=p(x)\; \textrm{mod}_{\textrm{r}} \;M^\text {rem}_{\mathcal {B}}(x). \end{aligned}$$

(27)

Since $M^\text {rem}_{\mathcal {B}}(x)$ vanishes on all $b_i\in \mathcal {B}$ we have that ${p}\!\left[ b_i\right] ={r}\!\left[ b_i\right]$ for all $i=0,\dots ,n-1$ and the result follows. $\square$

The following result from [31] (see also [39]) shows the relation between the generalized operator and the remainder evaluation.

Lemma 3

(Connection between Evaluation Types [31, 39]) For any $a\in {\mathbb {F}}_{q^m}$, $b\in {\mathbb {F}}_{q^m}^*$ and $f\in {\mathbb {F}}_{q^m}[x;\sigma ]$ we have that

$$\begin{aligned} {f}\!\left[ {\mathcal {D}}_{a}(b)b^{-1}\right] b={f}(b)_{a}. \end{aligned}$$

(28)

2.2.3 Skew polynomial vectors and matrices

To be consistent with the conventional notation in coding theory we denote both, vectors and matrices, by bold letters. The dimensions are clear from the context.

For two vectors $\textbf{a},\textbf{b}\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^n$ we denote the element-wise right modulo operation by

$$\begin{aligned} \textbf{a}\; \textrm{mod}_{\textrm{r}} \;\textbf{b}{:}{=}\left( a_0\; \textrm{mod}_{\textrm{r}} \;b_0,a_1\; \textrm{mod}_{\textrm{r}} \;b_1,\dots ,a_{n-1}\; \textrm{mod}_{\textrm{r}} \;b_{n-1}\right) . \end{aligned}$$

(29)

For two vectors $\textbf{a},\textbf{b}\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^n$ we define the element-wise LCLM as

$$\begin{aligned} \text {lclm}\left( \textbf{a},\textbf{b}\right) _{}{:}{=}\left( \text {lclm}\left( a_0,b_0\right) _{},\text {lclm}\left( a_1,b_1\right) _{},\dots ,\text {lclm}\left( a_{n-1},b_{n-1}\right) _{}\right) . \end{aligned}$$

(30)

For a vector $\textbf{a}=\left( a_0,a_1,\dots ,a_{n-1}\right) \in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^n$ and a vector $\textbf{w}=(w_0,w_1,\dots ,w_{n-1})\in {\mathbb {Z}}_+^n$ we define its $\textbf{w}$-weighted degree as

$$\begin{aligned} \deg _\textbf{w}(\textbf{a}){:}{=}\max _{0 \le j \le n-1}\{\deg (a_j)+w_j\}. \end{aligned}$$

(31)

Further, we define the $\textbf{w}$-weighted monomial ordering $\prec _{\textbf{w}}$ on ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^n$ such that we have

$$\begin{aligned} b_\ell x^\ell \textbf{e}_j\prec _{\textbf{w}}b_{\ell '} x^{\ell '} \textbf{e}_{j'} \end{aligned}$$

(32)

for $b_\ell ,b_{\ell '} \in {\mathbb {F}}_{q^m}\setminus \{0\}$ if $\ell +w_j<\ell '+w_{j'}$ or if $\ell +w_j=\ell '+w_{j'}$ and $j<j'$, where $\textbf{e}_j$ denotes the j-th unit vector over ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$. The definition of $\prec _{\textbf{w}}$ coincides with the $\textbf{w}$-weighted term-over-position (TOP) ordering as defined in [1].

For a vector $\textbf{a} \in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{n} \setminus \{{\textbf{0}}\}$ and weighting vector $\textbf{w} = (w_0,\dots ,w_{n-1}) \in {\mathbb {Z}}_+^n$, we define the $\textbf{w}$-pivot index $\text {Ind}_{\mathbf {{\textbf{w}}}}({\textbf{a}})$ of $\textbf{a}$ to be the largest index j with $0 \le j \le n-1$ such that $\deg (a_j) + w_j = \deg _{\textbf{w}}(\textbf{a})$.

For a nonzero vector $\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{n}$ we identify the leading term $\text {LT}({\textbf{a}})$ of ${\textbf{a}}$ as the maximum term $a_{i,j}x^j$ under $\prec _{\textbf{w}}$. Note that in this case j coincides with the $\textbf{w}$-pivot index of $\textbf{a}$.

A matrix $\textbf{A}\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{a\times b}$ with $a \le b$ is in (row) $\textbf{w}$-ordered weak Popov form if the $\textbf{w}$-pivot indices of its rows are strictly increasing in the row index [46].

A free ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$-module is a module that has a basis that consists of ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$-linearly independent elements. The rank of this module equals the cardinality of that basis.

In the following we consider particular bases for (left) ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$-modules.

Definition 4

($\textbf{w}$-ordered weak-Popov Basis [11]) Consider a left ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$-submodule $\mathcal {M}$ of ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^b$. For $\textbf{w} \in {\mathbb {Z}}^a$, a left $\textbf{w}$-ordered weak-Popov basis for $\mathcal {M}$ is a full-rank matrix $\textbf{A}\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{a \times b}$ s.t.

• 1. $\textbf{A}$ is in $\textbf{w}$-ordered weak Popov form.

• 2. The rows of $\textbf{A}$ are a basis of $\mathcal {M}$.

We will now establish a connection between $\textbf{w}$-ordered weak-Popov Bases and Gröbner bases w.r.t. $\prec _{\textbf{w}}$ for left ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$-submodules. This connection is well-known for ordinary commutative polynomial rings (see e.g. [2, 19, 25, 47, 48]). For skew polynomial rings this relation was derived in [45, Chapter 6] and also used in [11].

For a short introduction to Gröbner bases the reader is referred to [60]. An extensive study of Gröbner bases can be found in [18].

Definition 5

(Gröbner Basis [18]) Let $\mathcal {M}$ be a left ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$-submodule. A subset $\mathcal {B}=\{{\textbf{b}}_0,{\textbf{b}}_1,\dots ,{\textbf{b}}_{\nu -1}\}\subset \mathcal {M}$ is called a Gröbner basis for $\mathcal {M}$ under $\prec _{\textbf{w}}$ if the leading terms of $\mathcal {B}$ span a left module that contains all leading terms in $\mathcal {M}$, i.e. if $\langle \text {LT}(b_0),\dots ,\text {LT}(b_{\nu -1})\rangle =\langle \text {LT}(\mathcal {M})\rangle$.

A Gröbner basis for a ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$-submodule $\mathcal {M}$ is not necessarily a minimal generating set for $\mathcal {M}$ since any subset of $\mathcal {M}$ that contains a Gröbner basis is also a Gröbner basis (see [18, 60]). The following definition imposes a minimality requirement on the cardinality of Gröbner bases for an ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$-submodule under $\prec _{\textbf{w}}$.

Definition 6

(Minimal Gröbner Basis [18]) Given a monomial ordering $\prec _{\textbf{w}}$, a Gröbner basis $\mathcal {B}$ for a left ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$-submodule $\mathcal {M}$ is called minimal if for all ${\textbf{p}}\in \mathcal {B}$ the leading term $\text {LT}({\textbf{p}})$ is not contained in the module $\langle \text {LT}(\mathcal {B}\setminus \{{\textbf{p}}\})\rangle$, i.e. if $\text {LT}({\textbf{p}})\notin \langle \text {LT}(\mathcal {B}\setminus \{{\textbf{p}}\})\rangle$.

A minimal Gröbner basis $\mathcal {B}$ w.r.t. to $\prec _{\textbf{w}}$ is called reduced Gröbner basis if all leading terms are normalized and no monomial of ${\textbf{p}}\in \mathcal {B}$ is in $\langle \text {LT}(\mathcal {B}\setminus \{{\textbf{p}}\})\rangle$.

Although [45, Theorem 6.29] establishes the connection between the stronger ${\textbf{w}}$-ordered Popov form and the corresponding reduced Gröbner basis w.r.t. $\prec _{\textbf{w}}$, the arguments also hold for the relation between the ${\textbf{w}}$-ordered weak-Popov form and the minimal Gröbner basis w.r.t. $\prec _{\textbf{w}}$.

Note that given a module monomial order $\prec$ and a basis $\mathcal {B} \subset {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^n$ of a submodule $\mathcal {M}$ there exist an efficient method to determine a weighting vector $\textbf{w}$ and a column permutation P such that the weak Popov form under $\prec _{\textbf{w}}$ of $P({\mathcal {M}})$ equals the P-permuted minimal Gröbner basis of $\mathcal {M}$ under $\prec$ (see [47, Chapter 1.3.4]).

2.2.4 Cost model for skew polynomial operations

For deriving the computational complexity we consider only skew polynomials with zero derivations since in this case explicit results are available in literature. Note, that the isomorphism between ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ and ${\mathbb {F}}_{q^m}[x;\sigma ]$ (see Sect. 2.2 and [32, 39]) can be used to obtain complexity bounds for the nonzero derivation case.

We use the big-O notation $O\left( \cdot \right)$ to state asymptotic costs of algorithms. Further, we use shorthand ${\widetilde{O}}\left( \cdot \right)$ for $f(n) \in {\widetilde{O}}\left( g(n)\right) \Leftrightarrow \exists k: f(n) \in O\left( g(n)\log ^k g(n)\right)$ which is equivalent to the $O\left( \cdot \right)$ notation, ignoring logarithmic factors in the input parameter. We denote by $\omega$ the matrix multiplication exponent, i.e. the infimum of values $\omega _0 \in [2; 3]$ such that there is an algorithm for multiplying $n \times n$ matrices over ${\mathbb {F}}_{q^m}$ in $O(n^{\omega _0})$ operations in ${\mathbb {F}}_{q^m}$. The currently best known cost bound in operations in ${\mathbb {F}}_{q^m}$ is $\omega < 2.37286$ (see [3]).

By ${\mathfrak {M}}(n)$ we denote the cost of multiplying two skew polynomials from ${\mathbb {F}}_{q^m}[x;\sigma ]$ of degree n. The currently best known cost bound for ${\mathfrak {M}}(n)$ in operations in ${\mathbb {F}}_{q^m}$ is (see [55])

$$\begin{aligned} {\mathfrak {M}}(n) \in O\left( n^{\min \left\{ \frac{\omega +1}{2},1.635\right\} }\right) . \end{aligned}$$

and (see [16, 17])

$$\begin{aligned} {\mathfrak {M}}(n) \in {\widetilde{O}}\left( \min \!\left\{ n^{\omega -2} m^2, \, n m^{\omega -1} \right\} \right) \end{aligned}$$

in operations in ${\mathbb {F}}_{q}$. Hence, the following skew polynomial operations in ${\mathbb {F}}_{q^m}[x;\sigma ]$ can be performed in ${\widetilde{O}}\left( {\mathfrak {M}}(n)\right)$:

• Left/right division of two skew polynomials of degree at most n

• Generalized operator / remainder evaluation of a skew polynomial of degree at most n at n elements from ${\mathbb {F}}_{q^m}$

• Computation of the minimal polynomials $M^\text {rem}_{\mathcal {B}}(x)$ and $M^\text {op}_{\mathcal {B}}(x)_{\textbf{a}}$ for $|\mathcal {B}|\le n$ w.r.t. the remainder and generalized operator evaluation, respectively

• Computation of the LCLM (see [17, Theorem 3.2.7])

2.3 Skew Kötter–Nielsen–Høholdt interpolation

We now consider the skew KNH interpolation from [33], which is the skew polynomial analogue of the KNH interpolation over ordinary polynomial rings in [63]. Note that due to the isomorphism between ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ and the ring of linearized polynomials for $\sigma$ being the Frobenius automorphism and $\delta =0$ (zero derivations), the KNH variant over linearized polynomial rings in [65] can be seen as a special case of [33].

As input to our problem, we consider the n ${\mathbb {F}}_{q^m}$-linear skew vector evaluation maps¹${\mathscr {E}}_{i}$:

$$\begin{aligned} {\mathscr {E}}_{i}: {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{s+1} \rightarrow {\mathbb {F}}_{q^m}\end{aligned}$$

where n is the number of interpolation constraints and $s$ is an interpolation parameter.

Later on, we will specify particular mappings ${\mathscr {E}}_{i}$ w.r.t. the generalized operator and the remainder evaluation (see Sect. 4). For each skew vector evaluation map ${\mathscr {E}}_{i}$ we define the kernels

$$\begin{aligned} \mathcal {K}_i{:}{=}\{\textbf{Q}\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{s+1}:{\mathscr {E}}_{i}(\textbf{Q})=0\},\quad \forall i=0,\dots ,n-1. \end{aligned}$$

(33)

For $0\le i\le n-1$ the intersection $\overline{\mathcal {K}}_i{:}{=}\mathcal {K}_0\,\cap \,\mathcal {K}_1\,\cap \,\dots \,\cap \,\mathcal {K}_i$ contains all vectors from ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{s+1}$ that are mapped to zero under ${\mathscr {E}}_{0},{\mathscr {E}}_{1},\dots ,{\mathscr {E}}_{i}$, i.e.

$$\begin{aligned} \overline{\mathcal {K}}_i=\{\textbf{Q}\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{s+1}:{\mathscr {E}}_{j}(\textbf{Q})=0,\forall j=0,\dots ,i\}. \end{aligned}$$

(34)

Under the assumption that the $\overline{\mathcal {K}}_i$ are left ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$-submodules for all $i=0,\dots ,n-1$ (see [33]) we can state the general skew polynomial vector interpolation problem.

Problem 1

(General Vector Interpolation Problem) Given the integer $s\in {\mathbb {Z}}_+$, a set of ${\mathbb {F}}_{q^m}$-linear vector evaluation maps $\mathcal {E}=\{{\mathscr {E}}_{0},\dots ,{\mathscr {E}}_{n-1}\}$ and a vector $\textbf{w}\in {\mathbb {Z}}_+^{s+1}$ compute a $\textbf{w}$-ordered weak-Popov Basis for the left ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$-module

$$\begin{aligned} \overline{\mathcal {K}}_{n-1}=\{\textbf{b}\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{s+1}:{\mathscr {E}}_{i}(\textbf{b})=0,\forall i=0,\dots ,n-1\}. \end{aligned}$$

(35)

Problem 1 can be solved using a slightly modified variant of the multivariate skew KNH interpolation from [33]. Since the solution of Problem 1 is a ${\textbf{w}}$-ordered weak Popov basis for the interpolation module $\overline{\mathcal {K}}_{n-1}$ instead of a single minimal polynomial vector, we modified the output of [33, Algorithm 1] such that it returns a whole basis for the interpolation module $\overline{\mathcal {K}}_{n-1}$. A similar approach was used in [8] to construct a basis for the interpolation module over linearized polynomial rings.

The modified multivariate skew KNH interpolation is summarized in Algorithm 1.

Algorithm 1

Modified Skew KNH Interpolation

Note that $\min _{j\in \mathcal {J}}\{\arg \min _{j\in \mathcal {J}}\{\deg _\textbf{w}(\textbf{b}_{j})\}\}$ in Line 7 returns the smallest index $j\in \mathcal {J}$ to break ties, i.e. the index j of the minimal vector ${\textbf{b}}_j$ w.r.t. $\prec _{\textbf{w}}$ for which ${\varDelta }_j \ne 0$ (see (32)).

In each iteration of Algorithm 1 (and so [33, Algorithm 1]) there are three possible update steps:

• 1. No update: The vector ${\textbf{b}}_j$ is not updated if ${\textbf{b}}_j$ is in the kernel $\overline{\mathcal {K}}_i$ already, i.e. if ${\varDelta }_j={\mathscr {E}}_{i}(\textbf{b}_j)=0$.

• 2. Cross-evaluation (or order-preserving [33]) update: For any ${\textbf{b}}_j$ that is not minimal w.r.t. $\prec _{\textbf{w}}$ (i.e. $j\ne j^*$) the cross-evaluation update (Line 13) is performed such that

  $$\begin{aligned} {\mathscr {E}}_{i}\left( \textbf{b}_{j} - \frac{{\varDelta }_{j}}{{\varDelta }_{j^{*}}}\textbf{b}^{*}\right) ={\mathscr {E}}_{i}(\textbf{b}_{j}) - \frac{{\mathscr {E}}_{i}(\textbf{b}_{j})}{{\mathscr {E}}_{i}(\textbf{b}_{j^*})}{\mathscr {E}}_{i}(\textbf{b}_{j^*}) =0. \end{aligned}$$

  Note that the (${\textbf{w}}$-weighted) degree of ${\textbf{b}}_j$ is not increased by this update.

• 3. Degree-increasing (or order-increasing [33]) update: For the minimal vector ${\textbf{b}}_{j^*}{:}{=}{\textbf{b}}^*$ w.r.t. $\prec _{\textbf{w}}$ the degree-increasing update (Line 11) is performed such that

  $$\begin{aligned} {\mathscr {E}}_{i}\left( \left( x-\frac{{\mathscr {E}}_{i}(x \textbf{b}^{*})}{{\varDelta }_{j^{*}}}\right) \textbf{b}^{*}\right) ={\mathscr {E}}_{i}(x{\textbf{b}}^{*})-\frac{{\mathscr {E}}_{i}(x \textbf{b}^{*})}{{\mathscr {E}}_{i}(\textbf{b}^{*})}{\mathscr {E}}_{i}( \textbf{b}^{*}) =0. \end{aligned}$$

  The (${\textbf{w}}$-weighted) degree of ${\textbf{b}}^*$ is increased by one in this case.

The different update steps are illustrated in [33, Figure 1]. Define the sets

$$\begin{aligned} \mathcal {S}_j {:}{=}\{{\textbf{Q}}\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{s+1}:\text {Ind}_{\mathbf {{\textbf{w}}}}({\textbf{Q}})=j\}\cup \{{\textbf{0}}\} \end{aligned}$$

(36)

and

$$\begin{aligned} \mathcal {T}_{i,j} {:}{=}\overline{\mathcal {K}}_i\cap \mathcal {S}_j \end{aligned}$$

(37)

for all $i=0,\dots ,n-1$ and $j=0,\dots ,s$. Note that $\mathcal {S}_j\cap \mathcal {S}_{j'}=\{{\textbf{0}}\}$ for all $0\le j,j'\le s$.

The following result from [33] is fundamental for proving the correctness of Algorithm 1.

Theorem 1

([33, Theorem 5]) Assume that $\overline{\mathcal {K}}_i$ are left ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$-submodules for all $i=0,\dots ,n-1$. Then after each iteration i of Algorithm 1, the updated ${\textbf{b}}_j$ is a minimum w.r.t. $\prec _{\textbf{w}}$ in $\mathcal {T}_{i,j} = \overline{\mathcal {K}}_i\cap \mathcal {S}_j$ for all $j=0,\dots ,s$.

In other words, after the i-th iteration each ${\textbf{b}}_j$ has $\text {Ind}_{\mathbf {{\textbf{w}}}}({\textbf{b}})=j$ and the minimal ${\textbf{w}}$-weighted degree among all vectors in $\mathcal {T}_{i,j}$. Therefore, after the i-th iteration, the matrix ${\textbf{B}}$ is a ${\textbf{w}}$-ordered weak Popov basis for $\overline{\mathcal {K}}_i$.

Lemma 4

(Correctness of Algorithm 1) Algorithm 1 is correct and provides a solution to the general vector interpolation problem in Problem 1.

Proof

The update steps of Algorithm 1 and [33, Algorithm 1] are equivalent and therefore we have by [33, Theorem 5] that after the i-th iteration each ${\textbf{b}}_j\in \overline{\mathcal {K}}_i$. We now will show that after the i-th iteration of Algorithm 1 the matrix ${\textbf{B}}$ is a ${\textbf{w}}$-ordered weak Popov basis for $\overline{\mathcal {K}}_i$. By Theorem 1 ([33, Theorem 5]) each ${\textbf{b}}_j$ has the minimal ${\textbf{w}}$-weighted degree among all polynomials in $\mathcal {T}_{i,j}$, which implies that the ${\textbf{w}}$-pivot indices of ${\textbf{b}}_0,\dots ,{\textbf{b}}_s$ are increasing and distinct. Now assume that there exists a vector ${\textbf{p}}\in \overline{\mathcal {K}}_i$ that can not be represented by a ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$-linear combination of the form

$$\begin{aligned} {\textbf{p}}=\sum _{j=0}^{s}a_j{\textbf{b}}_j \end{aligned}$$

for some $a_j\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$. Then we must have that ${\textbf{p}}$ can be written as

$$\begin{aligned} {\textbf{p}}={\textbf{r}}+ \sum _{j=0}^{s}a_j{\textbf{b}}_j \end{aligned}$$

(38)

where $\deg _{\textbf{w}}({\textbf{r}})<\min _j\{\deg _{\textbf{w}}({\textbf{b}}_j)\}$. This contradicts that ${\textbf{b}}_j$ is a minimum w.r.t. $\prec _{\textbf{w}}$ in $\mathcal {T}_{i,j}$ since $\text {Ind}_{\mathbf {{\textbf{w}}}}({\textbf{r}})\in \{0,\dots ,s\}$. Therefore we conclude that after the i-th iteration ${\textbf{B}}$ is a ${\textbf{w}}$-ordered weak Popov basis for $\overline{\mathcal {K}}_i$. $\square$

Proposition 1

(Computational Complexity of Algorithm 1) The complexity of Algorithm 1 is dominated by the complexity of:

• ${\mathcal {O}}({sn})$ evaluation maps ${\mathscr {E}}_{i}$ applied to a vector from ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{s+1}_{\le n}$,

• n multiplications of a monic degree-1 skew polynomial with a vector from ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{s+1}_{\le n}$ (degree-increasing step),

• ${\mathcal {O}}({sn})$ multiplications of an element from ${\mathbb {F}}_{q^m}$ with a vector from ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{s+1}_{\le n}$ (cross-evaluation step).

Proof

In each of the n iterations we have:

• $s+2$ evaluation maps ${\mathscr {E}}_{i}$ applied to a vector from ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{s+1}_{\le n}$ (Line 4),

• one product of a skew polynomial of degree 1 with a vector from ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{s+1}_{\le n}$ (degree-increasing step in Line 11),

• $s$ multiplications of an element from ${\mathbb {F}}_{q^m}$ with a vector from ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{s+1}_{\le n}$ (cross-evaluation step in Line 14),

• $s+1$ inversions/divisions in ${\mathbb {F}}_{q^m}$. $\square$

3 Fast Kötter–Nielsen–Høholdt interpolation over skew polynomial rings

In [49] a fast D &C variant of the Kötter interpolation for the Guruswami–Sudan decoder for Reed–Solomon codes was presented. We now use ideas from [49] to speed up the skew KNH interpolation from [33]. The main idea is to sub-divide Problem 1 into a tree of successively smaller problems. Each leaf is identified with a linear functional, and the updates done here are represented as skew polynomial matrices. The inner-nodes of the tree combine updates using matrix multiplication. The entire cost of the algorithm hinges on the fact that at any node of the tree, we need only know the intermediate basis up to its image on the linear functionals of the subtree of that node.

In the following, we describe the general framework for the fast skew KNH interpolation algorithm which we will then discuss in Sect. 4 w.r.t. to particular operator and remainder vector evaluation maps.

The operations performed on the basis $\textbf{B}$ in the inner loop of the i-th iteration of Algorithm 1 can be represented by the matrix

$$\begin{aligned} \textbf{U}= \left( \begin{array}{ccc|c|ccc} 1 &{} &{} &{} -\frac{{\varDelta }_0}{{\varDelta }_{j^{*}}} &{} &{} &{} \\ &{} \ddots &{} &{} \vdots &{} &{} &{} \\ &{} &{} 1 &{} -\frac{{\varDelta }_{j^{*}-1}}{{\varDelta }_{j^{*}}} &{} &{} &{} \\ &{} &{} &{} \left( x-\frac{{\mathscr {E}}_{i}(x \textbf{b}_{j^{*}})}{{\varDelta }_{j^{*}}}\right) &{} &{} &{} \\ &{} &{} &{} -\frac{{\varDelta }_{j^{*}+1}}{{\varDelta }_{j^{*}}} &{} 1 &{} &{} \\ &{} &{} &{} \vdots &{} &{} \ddots &{} \\ &{} &{} &{} -\frac{{\varDelta }_{s}}{{\varDelta }_{j^{*}}} &{} &{} &{} 1 \end{array} \right) \end{aligned}$$

(39)

such that after the i-th iteration we obtain the basis $\textbf{U}\textbf{B}$ for $\overline{\mathcal {K}}_i$. Note that if ${\varDelta }_j=0$ no update on the row $\textbf{b}_j$ is performed since ${\varDelta }_j/{\varDelta }_{j^{*}}=0$.

3.1 Divide-and-Conquer Skew Kötter interpolation

To describe the following algorithms we introduce some notations. $\textbf{M}_{[i,j]} \in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{s+1}$ denotes a polynomial vector that is dependent on the index set $\{i,i+1,\ldots ,j-1,j\}$ with $j\ge i$ and $\textbf{M}_{[i,i]} = \textbf{M}_i$. The (ordered) set ${\mathcal {M}}$ is globally available for all algorithms and is defined as

$$\begin{aligned} \mathcal {M}=(\textbf{M}_{[0,n-1]},\textbf{M}_{[0,\lfloor n/2\rfloor -1]},\textbf{M}_{[\lfloor n/2\rfloor ,n-1]},\ldots ,\textbf{M}_{0},\textbf{M}_{1},\ldots ,\textbf{M}_{n-1})\subseteq {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{s+1}\nonumber \\ \end{aligned}$$

(40)

for an integer $n\in {\mathbb {Z}}_{+}$. For an ordered set (or tuple) of evaluation maps $\mathcal {E} = ({\mathscr {E}}_{0},\ldots ,{\mathscr {E}}_{n-1})$ we use a similar notation to access an ordered subset of $\mathcal {E}$ as follows

$$\begin{aligned} \mathcal {E}_{[i,j]}=({\mathscr {E}}_{i},\dots ,{\mathscr {E}}_{j}). \end{aligned}$$

(41)

Depending on the considered interpolation problem, we will later on define the polynomial vectors $\textbf{M}_{[i,j]}$ to contain minimal polynomials that depend on the interpolation points corresponding to the vector evaluation maps in $\mathcal {E}_{[i,j]}$. In the general interpolation problem (Problem 1) we only consider sets of evaluation maps whereas here we consider ordered sets since we need the notation within the D &C algorithm to build up the tree.

In order to describe a general framework for the fast skew KNH interpolation, we need the following assumption. In Sect. 4 we show that this assumption holds for specific coding applications.

Assumption 1

Let $\mathcal {E}=\{{\mathscr {E}}_{0},\ldots ,{\mathscr {E}}_{n-1}\}$ be a set of linear functionals as defined in (33) and let $\mathcal {E}_{[i,j]}=\{{\mathscr {E}}_{i},\ldots ,{\mathscr {E}}_{j}\}\subseteq \mathcal {E}$. We assume that for all ${\textbf{Q}}\in {\mathbb {F}}_{q^m}[x;\sigma ,\delta ]^{s+1}$ and $0\le i\le j\le n-1$ the skew polynomial vector ${\textbf{M}}_{[i,j]}\in \mathcal {M}$ (which contains minimal skew polynomials that depend on $\mathcal {E}_{[i,j]}$) satisfies

$$\begin{aligned} {\mathscr {E}}_{l}(\textbf{Q})={\mathscr {E}}_{l}(\textbf{Q}\; \textrm{mod}_{\textrm{r}} \;{\textbf{M}}_{[i,j]}), \quad \forall l=i,\dots ,j. \end{aligned}$$

(42)

Algorithm 2

SkewInterpolatePoint

Lemma 5

(Correctness of Algorithm 2) SkewInterpolatePoint in Algorithm 2 is correct.

Proof

The columns of ${\textbf{U}}$ except for the $j^*$-th column correspond to the non-minimal rows of $\textbf{B}$. The cross-evaluation step of the j-th non-minimal row of ${\textbf{B}}$ in Line 13 of Algorithm 1 is performed by the entries in the j-th row and $j^{*}$-th column of $\textbf{U}$. The entry in the $j^{*}$-th row and the $j^{*}$-th column of $\textbf{U}$ corresponds to the degree-increasing step in Line 11 in Algorithm 1. Hence, the algorithm outputs a matrix $\textbf{T}$ such that all rows of $\textbf{T}\textbf{B}$ are mapped to zero under ${\mathscr {E}}_{i}$. $\square$

Equipped with the routine SkewInterpolatePoint in Algorithm 2 to solve the basic step we can now derive a D &C variant of the skew KNH interpolation in Algorithm 1.

Algorithm 3

SkewInterpolateTree

Lemma 6

(Correctness of Algorithm 3) Under Assumption 1, SkewInterpolateTree in Algorithm 3 is correct.

Proof

The correctness of Algorithm 3 follows directly from the definition of the matrix $\textbf{U}$ in (39) and Assumption 1. $\square$

3.2 Precomputing minimal polynomial vectors

We now present a generic procedure to pre-compute the set $\mathcal {M}$ containing the minimal polynomial vectors ${\textbf{M}}_{[i,j]}$ required in Algorithm 3 efficiently. We consider minimal polynomials such as the generalized operator and the remainder evaluation which can be constructed by means of the LCLM of polynomial sequences (see (14) and (23)) we use the ideas from [17, Theorem 3.2.7] to obtain the efficient procedure described in Algorithm 4. The D &C structure of the algorithm is illustrated in Fig. 1 for an example of $\kappa =4$. The initial minimal polynomial vectors ${\textbf{M}}_{0},{\textbf{M}}_{1},\ldots ,{\textbf{M}}_{\kappa -1}$ from which all other minimal polynomials are computed via the LCLM, are computed depending on the application. In Sect. 4 two cases are given, for the general operator evaluation as in (55) and for the remainder evaluation as in (86).

Algorithm 4

PreComputeMinVectorsTree

Lemma 7

(Correctness of Algorithm 4) Algorithm 4 is correct.

Proof

The correctness of Algorithm 4 follows directly from [17, Theorem 3.2.7]. The algorithm proceeds in a recursive manner and splits the size of the set of considered minimal polynomials in half. When sets consist only of one element, ${\textbf{M}}_{[a,a]}$ are computed, using the generalized operator or remainder evaluation (see (14) and (23)). The sets of minimal polynomials of larger size are then obtained by merging the smaller sets of minimal polynomials using the relation ${\textbf{M}}_{[a,b]} = \text {lclm}\left( {\textbf{M}}_{[a,a+\delta -1]},{\textbf{M}}_{[a+\delta ,b]}\right) _{}$ with $\delta = \lfloor \frac{b-a+1}{2} \rfloor$, also illustrated in Fig. 1. $\square$

Fig. 1

Illustration of the computation tree of Algorithm 4 to precompute all minimal polynomial vectors in the set ${\mathcal {M}}$ for $\kappa =4$

4 Application to coding problems

In this section we apply the fast skew KNH interpolation described in Sect. 3 to coding problems in the rank, sum-rank and skew metric. For simplicity, we consider evaluation codes constructed over ${\mathbb {F}}_{q^m}[x;\sigma ]$, i.e. skew polynomial rings with zero derivations, only. The results can be generalized to the ${\mathbb {F}}_{q^m}[x;\sigma ,\delta ]$ case where the complexity analysis can be performed using the ring isomorphism to ${\mathbb {F}}_{q^m}[x;\sigma ]$ (see Sect. 2.2).

First we consider the application to interpolation-based decoding of interleaved Gabidulin codes in the rank metric. As interleaved Gabidulin codes are a special case of interleaved linearized Reed–Solomon (ILRS) codes, the decoder derived in Sect. 4.1 is a special case of the decoder for interleaved linearized Reed–Solomon (LRS) codes derived in Sect. 4.2. Nevertheless, we state the application for decoding interleaved Gabidulin codes in the rank metric separately to make it more accessible to readers that are familiar only with the rank metric.

In Sect. 4.3 we show how to apply the fast KNH interpolation algorithm to decoding interleaved skew Reed–Solomon (ISRS) codes in the skew metric. In contrast to the decoding approaches the rank and the sum-rank metric, the decoder performs the interpolation step with respect to the remainder evaluation and thus does not require the isometry between the sum-rank and the skew metric from [39].

4.1 Interpolation-based decoding of interleaved Gabidulin codes

Interleaved Gabidulin codes are rank-metric codes that are obtained by the Cartesian product of ordinary Gabidulin codes [20] and which allow for decoding beyond half the minimum rank distance (see [35, 54]). In [35], a probabilistic unique decoder that is able to correct errors beyond the unique decoding radius with high probability, was presented. A Berlekamp–Massey-like decoding algorithm for interleaved Gabidulin codes was presented in [57, 59].

A Welch–Berlekamp-like interpolation-based decoding scheme, that can be either used as a (not necessarily polynomial-time) list decoding algorithm or as a probabilistic unique decoding algorithm was presented by Wachter-Zeh and Zeh in [62]. The algorithm consists of an interpolation step and a root-finding step. The list size (and so the probability of obtaining a unique solution) can be optimized by using a minimal Gröbner basis for the left module containing the solutions of the interpolation problem rather than a single solution of the interpolation problem for the root-finding step (see [8, 9]).

The interpolation step (including the computation of the minimal Gröbner basis) can be solved by the linearized or skew variants of the multivariate KNH interpolation [33, 65] in $O\left( s^2n^2\right)$ operations in ${\mathbb {F}}_{q^m}$, where $s$ is the interleaving order and n is the length of the code. The overall computational complexity of the algorithm in [62] is then in the order of $O\left( s^2n^2\right)$ operations in ${\mathbb {F}}_{q^m}$.

Recently, efficient algorithms for solving the interpolation step and the root-finding step that are based on the computation of minimal approximant bases over skew polynomial rings were presented in [11]. The algorithms reduce the overall decoding complexity of the Wachter-Zeh and Zeh decoder [62] to ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n)\right) \subseteq {\widetilde{O}}\left( s^\omega n^{1.635}\right)$.

In this section we show how the fast skew KNH interpolation algorithm from Sect. 3 can be used to accomplish the interpolation step in the Wachter-Zeh and Zeh decoder in ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n)\right) \subseteq {\widetilde{O}}\left( s^\omega n^{1.635}\right)$ operations in ${\mathbb {F}}_{q^m}$. The obtained improved computational complexity coincides with the computational complexity of the minimal approximant bases variant from [11]. The results can be also used to speed up the interpolation-based decoder for interleaved subspace codes in [9].

4.1.1 Codes in the rank metric

The rank weight of a vector $\textbf{x}\in {\mathbb {F}}_{q^m}^n$ is defined as (see [20])

$$\begin{aligned} {{\,\textrm{wt}\,}}_{R}(\textbf{x}){:}{=}{{\,\textrm{rk}\,}}_q(\textbf{x})={{\,\textrm{rk}\,}}_q(\textbf{X}) \end{aligned}$$

(43)

where $\textbf{X}\in {\mathbb {F}}_{q}^{m\times n}$ is the corresponding expanded matrix of $\textbf{x}$ over ${\mathbb {F}}_{q}$. Notice, that in general we have that ${{\,\textrm{wt}\,}}_{R}(\textbf{x})\le {{\,\textrm{wt}\,}}_{H}(\textbf{x})$ for any $\textbf{x}\in {\mathbb {F}}_{q^m}^n$ (see [38]). The rank distance between two vectors $\textbf{x},\textbf{y}\in {\mathbb {F}}_{q^m}^n$ is then defined as the rank of their difference, i.e. as

$$\begin{aligned} d_R(\textbf{x},\textbf{y}){:}{=}{{\,\textrm{wt}\,}}_{R}(\textbf{x}-\textbf{y}). \end{aligned}$$

(44)

The rank weight of a matrix $\textbf{X}\in {\mathbb {F}}_{q^m}^{s\times n}$ is defined as the ${\mathbb {F}}_{q}$-rank of the matrix ${\textbf{X}}_q \in {\mathbb {F}}_{q}^{sm \times n}$ that is obtained by expanding each row of ${\textbf{X}}$ with respect to a fixed basis of ${\mathbb {F}}_{q^m}$ over ${\mathbb {F}}_{q}$. Note that the ${\mathbb {F}}_{q}$-rank ${{\,\textrm{wt}\,}}_{R}\left( \textbf{X}\right)$ can be equivalently seen as the maximum number of ${\mathbb {F}}_{q}$-linearly independent columns of ${\textbf{X}}$.

As a channel model we consider the rank error channel

$$\begin{aligned} \textbf{R}=\textbf{C}+\textbf{E} \end{aligned}$$

(45)

where the error matrix ${\textbf{E}}$ is chosen uniformly at random from all matrices in ${\mathbb {F}}_{q^m}^{s\times n}$ with ${{\,\textrm{wt}\,}}_{R}(\textbf{E})=t$.

Definition 7

(Interleaved Gabidulin Code [35, 54]) Let $\sigma$ be the Frobenius automorphism $\sigma (\cdot )=\cdot ^q$ of ${\mathbb {F}}_{q^m}$. Let $\varvec{\beta }=(\beta _0,\beta _1,\dots ,\beta _{n-1})\in {\mathbb {F}}_{q^m}^{n}$ contain ${\mathbb {F}}_{q}$-linearly independent elements from ${\mathbb {F}}_{q^m}$. An $s$-interleaved Gabidulin code of length $n\le m$ and dimension k is defined as

$$\begin{aligned} \textrm{IGab}[\varvec{\beta },s;n,k] =\left\{ \begin{pmatrix} {f^{(1)}}(\varvec{\beta })_{1} \\ {f^{(2)}}(\varvec{\beta })_{1} \\ \vdots \\ {f^{(s)}}(\varvec{\beta })_{1} \end{pmatrix}: f^{(j)}\in {\mathbb {F}}_{q^m}[x;\sigma ]_{<k},\forall j\in [1,s] \right\} . \end{aligned}$$

(46)

Interleaved Gabidulin codes fulfill the Singleton-like bound in the rank metric with equality, i.e. we have that $d_R(\textrm{IGab}[\varvec{\beta },s;n,k])=n-k+1$, and thus are maximum rank distance (MRD) codes.

Suppose we transmit a codeword

$$\begin{aligned} \textbf{C}= \begin{pmatrix} {f^{(1)}}(\varvec{\beta })_{1} \\ {f^{(2)}}(\varvec{\beta })_{1} \\ \vdots \\ {f^{(s)}}(\varvec{\beta })_{1} \end{pmatrix}\in \textrm{IGab}[\varvec{\beta },s;n,k] \end{aligned}$$

(47)

and receive

$$\begin{aligned} \textbf{R}=\textbf{C}+\textbf{E} \end{aligned}$$

(48)

where ${{\,\textrm{wt}\,}}_{R}(\textbf{E})=t$.

Definition 8

(Generalized Operator Vector Evaluation Map) Given an interpolation point set $\mathcal {P}=\{(p_{i,0},p_{i,1},\dots ,p_{i,s}):i=0,\dots ,n-1\}\subseteq {\mathbb {F}}_{q^m}^{s+1}$, a vector ${\textbf{Q}}\in {\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}$, and a vector $\textbf{a}\in {\mathbb {F}}_{q^m}^{n}$ containing the generalized operator evaluation parameters, we define the generalized vector evaluation maps as

$$\begin{aligned} {\mathscr {E}}_{i}^{op}(\textbf{Q})_{a_i}{:}{=}\sum _{j=0}^{s}{Q_j}(p_{i,j})_{a_i}, \quad \forall i=0,\dots ,n-1. \end{aligned}$$

(49)

For interleaved Gabidulin codes, the interpolation point set is

$$\begin{aligned} \mathcal {P}=\{(\beta _i,r_{0,i},\dots ,r_{s-1,i}):i=0,\dots ,n-1\}\subset {\mathbb {F}}_{q^m}^{s+1} \end{aligned}$$

(50)

with $\textbf{a}=(1,1,\dots ,1)\in {\mathbb {F}}_{q^m}^n$ being a vector containing the corresponding generalized operator evaluation parameters. Equipped with these definitions the interpolation problem [62, Problem 1] for decoding interleaved Gabidulin codes can be stated as follows.

Problem 2

(Vector Interpolation Problem) Given the integer $s\in {\mathbb {Z}}_+$, a degree constraint $D\in {\mathbb {Z}}_+$, a set of ${\mathbb {F}}_{q^m}$-linear vector evaluation maps $\mathcal {E}^{op}=\{{\mathscr {E}}_{0}^{op},\dots ,{\mathscr {E}}_{n-1}^{op}\}$ as defined in (49), the vector ${\textbf{a}}=(1,1,\dots ,1)\in {\mathbb {F}}_{q^m}^n$ and a vector $\textbf{w}=(0,k-1,\dots ,k-1)\in {\mathbb {Z}}_+^{s+1}$ compute a vector $\textbf{b}\in {\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}$ that satisfies:

• ${\mathscr {E}}_{i}^{op}(\textbf{b})_{1}=0,$ $\forall i=0,\dots ,n-1$,

• $\deg _{\textbf{w}}({\textbf{b}}) < D$.

A nonzero solution of Problem 2 exists if the degree constraint satisfies (see [62])

(51)

Proposition 2

Problem 2 can be solved by Algorithm 1 in $O\left( s^2n^2\right)$ operations in ${\mathbb {F}}_{q^m}$.

Proof

Problem 2 corresponds to finding a vector in the interpolation module

$$\begin{aligned} \overline{\mathcal {K}}_{n-1}=\{\textbf{b}\in {\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}:{\mathscr {E}}_{i}^{op}(\textbf{b})_{1}=0,\,\forall i=0,\dots ,n-1\} \end{aligned}$$

(52)

of minimal ${\textbf{w}}$-weighted degree. Hence, Problem 2 can be solved by computing a $\textbf{w}$-ordered weak-Popov basis for the left ${\mathbb {F}}_{q^m}[x;\sigma ]$-module $\overline{\mathcal {K}}_{n-1}$ and returning a row with ${\textbf{w}}$-weighted degree less than $D$. The problem of finding a $\textbf{w}$-ordered weak-Popov basis for $\overline{\mathcal {K}}_{n-1}$ is an instance of the general vector interpolation problem (Problem 1) which can be solved by Algorithm 1 (see Lemma 4). By Proposition 1, Algorithm 1 requires $O\left( sn\right)$ evaluation maps ${\mathscr {E}}_{i}^{op}$ of a vector in ${\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}_{\le n}$, which requires $O\left( sn\right)$ operations in ${\mathbb {F}}_{q^m}$ each. Overall, the computation of the evaluation maps requires $O\left( s^2 n^2\right)$ operations in ${\mathbb {F}}_{q^m}$. The computation of the n multiplications of a monic degree-1 skew polynomial with a vector from ${\mathbb {F}}_{q^m}[x;\sigma ]$ (Line 11) requires $O\left( sn^2\right)$ operations in ${\mathbb {F}}_{q^m}$ in total. The $O\left( sn\right)$ multiplications of an element from ${\mathbb {F}}_{q^m}$ and a vector from ${\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}_{\le n}$ require at most $O\left( s^2 n^2\right)$ operations in ${\mathbb {F}}_{q^m}$. Therefore we conclude that Algorithm 1 can solve Problem 2 requiring at most $O\left( s^2n^2\right)$ operations in ${\mathbb {F}}_{q^m}$. $\square$

If the error weight $t={{\,\textrm{wt}\,}}_{R}(\textbf{E})$ satisfies

$$\begin{aligned} t<\frac{s}{s+1}(n-k+1) \end{aligned}$$

(53)

it can be shown that (see [62, Theorem 1])

$$\begin{aligned} {P(x){:}{=}}Q_0(x)+\sum _{j=1}^{s}Q_j(x)f^{(j)}(x)=0. \end{aligned}$$

(54)

The root-finding step consists of finding all polynomials $f^{(1)},\dots ,f^{(s)}\in {\mathbb {F}}_{q^m}[x;\sigma ]_{<k}$ that satisfy (54). This task can be accomplished by the minimal approximant basis methods in [10, 11] requiring at most ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$.

4.1.2 Solving the interpolation step via the fast KNH interpolation

For an interpolation point set $\mathcal {P}=\{\textbf{p}_0,\textbf{p}_1,\dots ,\textbf{p}_{n-1}\}\subseteq {\mathbb {F}}_{q^m}^{s+1}$ define the vectors of minimal polynomials with respect to the generalized operator evaluation for $0\le i,j\le n-1$ and $i\le j$ as

$$\begin{aligned} \textbf{M}^\text {op}_{[i,j]}(x)_{a_i}{:}{=}\left( M^\text {op}_{\{p_{i,0},\dots ,p_{j,0}\}}(x)_{a_i},M^\text {op}_{\{p_{i,1},\dots ,p_{j,1}\}}(x)_{a_i},\dots ,M^\text {op}_{\{p_{i,s},\dots ,p_{j,s}\}}(x)_{a_i}\right) . \end{aligned}$$

(55)

Lemma 8

Let $\mathcal {E}^{op}=({\mathscr {E}}_{0}^{op},\ldots ,{\mathscr {E}}_{n-1}^{op})$ be an ordered set of skew vector evaluation maps as defined in (49) and let $\mathcal {E}_{[i,j]}^{op}=({\mathscr {E}}_{i}^{op},\ldots ,{\mathscr {E}}_{j}^{op})\subseteq \mathcal {E}^{op}$. Then for any $\textbf{Q}\in {\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}$ we have that

$$\begin{aligned} {\mathscr {E}}_{l}^{op}(\textbf{Q})_{a_l}={\mathscr {E}}_{l}^{op}(\textbf{Q}\; \textrm{mod}_{\textrm{r}} \;\textbf{M}^\text {op}_{[i,j]}(x)_{\textbf{a}})_{a_l},\quad \forall l=i,\dots ,j \end{aligned}$$

(56)

where $\textbf{a}=(a_i,\dots ,a_j)$ contains the corresponding general operator evaluation parameters.

Proof

The lemma follows directly by applying the result from Lemma 1 to the elementary evaluations in the skew vector operator evaluation maps defined in (49). $\square$

An important consequence of Lemma 8 is, that the generalized operator vector evaluation maps from Definition 8 and the minimal polynomial vectors in (55) fulfill Assumption 1. Hence, we can solve Problem 2 by calling Algorithm 3 with $\mathcal {E}^{op}$, basis $\textbf{I}_{s+1}$ and initial degrees $(0, k-1, \dots , k-1)$.

4.1.3 Complexity analysis

We now perform a complexity analysis of Algorithm 4 for the generalized operator evaluation maps defined in (49) (${\mathbb {F}}_{q^m}[x;\sigma ]$-case).

Lemma 9

(Complexity of Computing Minimal Polynomial Vectors) Algorithm 4 constructs the (ordered) set $\mathcal {M}^{\text {op}}\subset {\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}$ containing the minimal polynomial vectors defined as

$$\begin{aligned} \mathcal {M}^{\text {op}}{:}{=}\left( \textbf{M}^\text {op}_{[0,n-1]}(x)_{\textbf{a}},\textbf{M}^\text {op}_{[0,\lfloor n/2\rfloor -1]}(x)_{\textbf{a}},\textbf{M}^\text {op}_{[\lfloor n/2\rfloor ,n-1]}(x)_{\textbf{a}},\dots ,\textbf{M}^\text {op}_{[n-1,n-1]}(x)_{\textbf{a}}\right) \end{aligned}$$

(57)

in ${\widetilde{O}}\left( s{\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$.

Proof

Algorithm 4 is a generalization of the procedure in [17, Theorem 3.2.7] to construct a single minimal polynomial, which requires ${\widetilde{O}}\left( {\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$. Hence, the overall complexity of Algorithm 4 is in the order of ${\widetilde{O}}\left( s{\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$. $\square$

Theorem 2

(Computational Complexity) Algorithm 3 solves Problem 2 over ${\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}$ in ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$.

Proof

Let C(n) denote the complexity on n input points without the cost of the routine $\textsf {SkewInterpolatePoint}$ (see Algorithm 2). We have that $\deg (\textbf{T}_1), \deg (\textbf{T}_2)\le n/2$ and thus the product of $\textbf{T}_2\textbf{T}_1$ in Line 9 requires ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n/2)\right) \in {\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$. By the master theorem we have $C(n)=2C(n/2)+{\widetilde{O}}\left( s^\omega n/2\right)$ implying that $C(n)\in {\widetilde{O}}\left( s^\omega n\right)$. The complexity of $\textsf {SkewInterpolatePoint}$ is dominated by $s+1$ univariate skew polynomials of degree less than 1, which requires $O\left( s^2\right)$ operations in ${\mathbb {F}}_{q^m}$.

The routine $\textsf {SkewInterpolatePoint}$ is called n times yielding $O\left( s^2n\right)$ operations in total. By Lemma 9 all minimal polynomial vectors required in Lines 5 and 7 of Algorithm 3 can be pre-computed in ${\widetilde{O}}\left( s{\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$. One (right) modulo operation in ${\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}$ requires $O\left( s{\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$. Therefore, Lines 5 and 7 require ${\widetilde{O}}\left( s^2{\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$ each. $\square$

Remark 1

(Practical Consideration) Note that in the ${\mathbb {F}}_{q^m}[x;\sigma ]$-case the i-th generalized operator vector evaluation map ${\mathscr {E}}_{i}^{op}(x\mathbf {{\textbf{Q}}})_{a_i}$ of $x{\textbf{Q}}$ can be computed efficiently from ${\mathscr {E}}_{i}^{op}(\mathbf {{\textbf{Q}}})_{a_i}$ requiring only one application of the automorphism $\sigma$ and one multiplication since by the product rule [40] we have that

$$\begin{aligned} {\mathscr {E}}_{i}^{op}(x\mathbf {{\textbf{Q}}})_{a_i}=\sigma \left( {\mathscr {E}}_{i}^{op}(\mathbf {{\textbf{Q}}})_{a_i}\right) a_i, \quad \forall i=0,\dots ,n-1. \end{aligned}$$

(58)

4.2 Interpolation-based decoding of interleaved linearized Reed–Solomon codes

Linearized Reed–Solomon (LRS) codes are codes that have distance properties with respect to the sum-rank metric and were introduced in [39] and also considered in [15]. Recently, codes in the sum-rank metric gained attraction since they generalize several code families in the Hamming metric and the rank metric, such as Reed–Solomon codes and Gabidulin codes, and have potential applications in code-based quantum-resistant cryptosystems [56]. Further applications include the construction of space-time codes [36], locally repairable codes with maximal recoverability [44] (also known as partial MDS codes) and error control for multishot network coding [43]. Interpolation-based decoding of $s$-interleaved LRS codes, which allows for correcting errors beyond the unique decoding radius (up to $\frac{s}{s+1}(n-k+1)$) in the sum-rank metric, was recently considered in [6].

In the following we show, how Algorithm 3 can be used to solve the interpolation step in the interpolation-based decoder for ILRS from [6] efficiently.

The sum-rank weight of a vector $\textbf{x}=\left( \textbf{x}^{(1)}\mid \textbf{x}^{(2)}\mid \dots \mid \textbf{x}^{(\ell )}\right) \in {\mathbb {F}}_{q^m}^n$, where $\textbf{x}^{(\lambda )}\in {\mathbb {F}}_{q^m}^{n_\lambda }$ for all $\lambda =1,\dots ,\ell$, is defined as (see [36, 51])

$$\begin{aligned} {{\,\textrm{wt}\,}}_{{\varSigma } R}(\textbf{x}){:}{=}\sum _{\lambda =1}^{\ell }{{\,\textrm{rk}\,}}_q\left( \textbf{x}^{(\lambda )}\right) . \end{aligned}$$

(59)

For any $\textbf{x}\in {\mathbb {F}}_{q^m}^n$ we have that ${{\,\textrm{wt}\,}}_{{\varSigma } R}(\textbf{x})\le {{\,\textrm{wt}\,}}_{H}(\textbf{x})$ (see [38, 39]). The sum-rank distance between two vectors $\textbf{x},\textbf{y}\in {\mathbb {F}}_{q^m}^n$ is then

$$\begin{aligned} d_{{\varSigma }R}(\textbf{x},\textbf{y}){:}{=}{{\,\textrm{wt}\,}}_{{\varSigma } R}(\textbf{x}-\textbf{y})=\sum _{i=\lambda }^{\ell }{{\,\textrm{rk}\,}}_q\left( \textbf{x}^{(\lambda )}-\textbf{y}^{(\lambda )}\right) . \end{aligned}$$

(60)

The sum-rank weight of a matrix $\textbf{X}=(\textbf{X}^{(1)} \mid \textbf{X}^{(2)} \mid \dots \mid \textbf{X}^{(\ell )})\in {\mathbb {F}}_{q^m}^{s\times n}$ is defined as

$$\begin{aligned} {{\,\textrm{wt}\,}}_{{\varSigma } R}(\textbf{X}){:}{=}\sum _{\lambda =1}^{\ell }{{\,\textrm{rk}\,}}_q\left( \textbf{X}^{(\lambda )}\right) , \end{aligned}$$

(61)

where $\textbf{X}^{(\lambda )}\in {\mathbb {F}}_{q^m}^{s\times n_\lambda }$ for all $\lambda =1,\dots ,\ell$. The sum-rank distance between two matrices $\textbf{X},\textbf{Y}\in {\mathbb {F}}_{q^m}^{s\times n}$ is then defined as

$$\begin{aligned} d_{{\varSigma }R}(\textbf{X},\textbf{Y}){:}{=}{{\,\textrm{wt}\,}}_{{\varSigma } R}(\textbf{X}-\textbf{Y}) =\sum _{\lambda =1}^{\ell }{{\,\textrm{rk}\,}}_q\left( \textbf{X}^{(\lambda )}-\textbf{Y}^{(\lambda )}\right) . \end{aligned}$$

(62)

As channel model we consider the sum-rank channel

$$\begin{aligned} \textbf{R}=\textbf{C}+\textbf{E} \end{aligned}$$

(63)

where the error matrix

$$\begin{aligned} \textbf{E}=(\textbf{E}^{(1)}\mid \textbf{E}^{(2)}\mid \dots \mid \textbf{E}^{(\ell )}) \end{aligned}$$

(64)

is chosen uniformly at random from all matrices in ${\mathbb {F}}_{q^m}^{s\times n}$ with sum-rank weight ${{\,\textrm{wt}\,}}_{{\varSigma } R}(\textbf{e})=t$.

Definition 9

(Interleaved Linearized Reed–Solomon Code) Let $\sigma$ be the Frobenius automorphism of ${\mathbb {F}}_{q^m}$ defined as $\sigma (\cdot )=\cdot ^q$. Let $\varvec{\xi }=(\xi _0,\xi _1,\dots ,\xi _{\ell -1})\in {\mathbb {F}}_{q^m}^\ell$ be a vector containing representatives from different conjugacy classes of ${\mathbb {F}}_{q^m}$. Let the vectors $\varvec{\beta }^{(\lambda )}=\Big (\beta _0^{(\lambda )},\dots ,\beta _{n_\lambda -1}^{(\lambda )}\Big )\in {\mathbb {F}}_{q^m}^{n_\lambda }$ contain ${\mathbb {F}}_{q}$-linearly independent elements from ${\mathbb {F}}_{q^m}$ for all $\lambda =1,\dots ,\ell$ and define the vector $\varvec{\beta }=\left( \varvec{\beta }^{(1)},\varvec{\beta }^{(2)},\dots ,\varvec{\beta }^{(\ell )}\right) \in {\mathbb {F}}_{q^m}^n$. An $s$-interleaved linearized Reed–Solomon (ILRS) code of length $n=n_1+n_2+\dots +n_\ell$ and dimension k is defined as

$$\begin{aligned} \textrm{ILRS}[\varvec{\beta },\ell ,s;n,k]=\left\{ \left( \begin{array}{c|c|c} {f^{(1)}}(\varvec{\beta }^{(1)})_{\xi _0} \, &{} \quad \dots \quad &{} \, {f^{(1)}}(\varvec{\beta }^{(\ell )})_{\xi _{\ell -1}}\\ {f^{(2)}}(\varvec{\beta }^{(1)})_{\xi _0} &{} \dots &{} {f^{(2)}}(\varvec{\beta }^{(\ell )})_{\xi _{\ell -1}}\\ \vdots &{} \ddots &{} \vdots \\ {f^{(s)}}(\varvec{\beta }^{(1)})_{\xi _0} &{} \dots &{} {f^{(s)}}(\varvec{\beta }^{(\ell )})_{\xi _{\ell -1}} \end{array}\right) : \begin{array}{c}f^{(j)}\in {\mathbb {F}}_{q^m}[x;\sigma ]_{<k},\\ \forall j\in [1,s]\end{array}\right\} .\nonumber \\ \end{aligned}$$

(65)

The code rate and the minimum sum-rank distance of ILRS codes is $R=\frac{k}{n}$ and $d=n-k+1$ (see [6]), respectively. ILRS codes fulfill the Singleton-like bound in the sum-rank metric with equality and thus are maximum sum-rank distance (MSRD) codes [39].

Suppose we transmit a codeword

$$\begin{aligned} \textbf{C}= \left( \begin{array}{c|c|c} {f^{(1)}}(\varvec{\beta }^{(1)})_{\xi _0} \, &{} \quad \dots \quad &{} \, {f^{(1)}}(\varvec{\beta }^{(\ell )})_{\xi _{\ell -1}} \\ {f^{(2)}}(\varvec{\beta }^{(1)})_{\xi _0} &{} \dots &{} {f^{(2)}}(\varvec{\beta }^{(\ell )})_{\xi _{\ell -1}} \\ \vdots &{} \ddots &{} \vdots \\ {f^{(s)}}(\varvec{\beta }^{(1)})_{\xi _0} &{} \dots &{} {f^{(s)}}(\varvec{\beta }^{(\ell )})_{\xi _{\ell -1}} \end{array} \right) \in \textrm{ILRS}[\varvec{\beta },\ell ,s;n,k] \end{aligned}$$

(66)

and receive a matrix

$$\begin{aligned} \textbf{R}=\left( \textbf{R}^{(1)}\mid \textbf{R}^{(2)}\mid \dots \mid \textbf{R}^{(\ell )}\right) =\textbf{C}+\textbf{E} \end{aligned}$$

(67)

with ${\textbf{R}}^{(\lambda )}\in {\mathbb {F}}_{q^m}^{s\times n_\lambda }$ for all $\lambda =1,\dots ,\ell$ where the error matrix ${\textbf{E}}=\left( {\textbf{E}}^{(1)}\mid {\textbf{E}}^{(2)}\mid \dots \mid {\textbf{E}}^{(\ell )}\right)$ has sum-rank weight ${{\,\textrm{wt}\,}}_{{\varSigma } R}(\textbf{E})=t$. In order to simplify the notation we index the entries in $\textbf{R}$ as $r_{j,i}$ for $j=0,\dots ,s-1$ and $i=0,\dots ,n-1$.

Further, we define the vector

$$\begin{aligned} \textbf{a}=(\textbf{a}^{(1)},\textbf{a}^{(2)},\dots ,\textbf{a}^{(\ell )})\in {\mathbb {F}}_{q^m}^n \end{aligned}$$

(68)

where $\textbf{a}^{(\lambda )}=(\xi _{\lambda -1},\dots ,\xi _{\lambda -1})\in {\mathbb {F}}_{q^m}^{n_\lambda }$ for all $\lambda =1,\dots ,\ell$.

For interleaved linearized Reed–Solomon codes, the interpolation point set is

$$\begin{aligned} \mathcal {P}=\{(\beta _i,r_{0,i},\dots ,r_{s-1,i}):i=0,\dots ,n-1\}\subset {\mathbb {F}}_{q^m}^{s+1}. \end{aligned}$$

(69)

Problem 3

(Vector Interpolation Problem) Given the integer $s\in {\mathbb {Z}}_+$, a degree constraint $D\in {\mathbb {Z}}_+$, a set of ${\mathbb {F}}_{q^m}$-linear vector evaluation maps $\mathcal {E}^{op}=\{{\mathscr {E}}_{0}^{op},\dots ,{\mathscr {E}}_{n-1}^{op}\}$ as defined in (49), a vector ${\textbf{a}}=(a_0,a_1,\dots ,a_{n-1})\in {\mathbb {F}}_{q^m}^n$ as defined in (68) and a vector $\textbf{w}=(0,k-1,\dots ,k-1)\in {\mathbb {Z}}_+^{s+1}$ compute a vector $\textbf{b}\in {\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}$ that satisfies:

• ${\mathscr {E}}_{i}^{op}(\textbf{b})_{a_i}=0,$ $\forall i=0,\dots ,n-1$,

• $\deg _{\textbf{w}}({\textbf{b}}) < D$.

A nonzero solution of Problem 3 exists if the degree constraint satisfies

(70)

By following the ideas in Proposition 2 for general evaluation parameters we see that Problem 3 can be solved by Algorithm 1 in $O\left( s^2n^2\right)$ operations in ${\mathbb {F}}_{q^m}$.

If the sum-rank weight of the error $t={{\,\textrm{wt}\,}}_{{\varSigma } R}(\textbf{E})$ satisfies

$$\begin{aligned} t<\frac{s}{s+1}(n-k+1) \end{aligned}$$

(71)

we have that (see [6, Theorem 2])

$$\begin{aligned} P(x)=Q_0(x)+\sum _{j=1}^{s}Q_j(x)f^{(j)}(x)=0. \end{aligned}$$

(72)

The root-finding problem consists of finding all polynomials $f^{(1)},\dots ,f^{(s)}\in {\mathbb {F}}_{q^m}[x;\sigma ]_{<k}$ that satisfy (72). The root-finding problem can be solved efficiently by the minimal approximant basis methods in [10, 11] requiring at most ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$.

4.2.1 Solving the interpolation step via the fast KNH interpolation

Since Lemma 8 holds for arbitrary evaluation parameters $\textbf{a}$ we have that the minimal polynomial vectors in (55) fulfill Assumption 1. Consequently, we can solve Problem 3 by calling Algorithm 3 with $\mathcal {E}^{op}$ as defined in (49), the basis $\textbf{I}_{s+1}$ and initial degrees $(0,k-1,\dots ,k-1)$.

4.2.2 Complexity analysis

Note that Problem 2 is an instance of Problem 3 with particular evaluation parameters. Therefore, the complexity follows directly from Theorem 2.

Corollary 1

(Computational Complexity) Algorithm 3 solves Problem 3 over ${\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}$ in ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$.

4.3 Interpolation-based decoding of interleaved skew Reed–Solomon codes

In this section we consider decoding of Skew Reed–Solomon (SRS) codes with respect to the skew metric, which was introduced in [39]. Decoding schemes for SRS codes that allow for correcting error of skew weight up to $\lfloor \frac{n-k}{2}\rfloor$ were presented in [11, 13, 34, 39]. Interpolation-based decoding of interleaved SRS ISRS codes that allows for decoding errors of skew weight up to $\frac{s}{s+1}(n-k+1)$, where $s$ is the interleaving order, was considered in [6]. The interpolation scheme can be either used as a list decoder or as a probabilistic-unique decoder.

In this work we consider the definition of the skew weight from [13, Proposition 1]. Let the vector $\textbf{b}\in {\mathbb {F}}_{q^m}^n$ contain P-independent elements and let $\mathcal {B}$ be the P-closed set generated by the elements in ${\textbf{b}}$. Then, the skew weight of a vector $\textbf{x}\in {\mathbb {F}}_{q^m}^n$ with respect to $\mathcal {B}$ is defined as

(73)

where ${b_i}^{x_i} {:}{=}\sigma (x_i) b_i x_i^{-1} + \delta (x_i) x_i^{-1}$ (see (3).) For simplicity we omit the dependence on $\mathcal {B}$ in the definition of ${{\,\textrm{wt}\,}}_{skew}(\cdot )$ as it will be clear from the context. Similar to the rank and the sum-rank weight we have that ${{\,\textrm{wt}\,}}_{skew}(\textbf{x})\le {{\,\textrm{wt}\,}}_{H}(\textbf{x})$ for all $\textbf{x}\in {\mathbb {F}}_{q^m}^n$ (see [39]). The skew distance between two vectors $\textbf{x},\textbf{y}\in {\mathbb {F}}_{q^m}^n$ is defined as

$$\begin{aligned} d_{skew}(\textbf{x},\textbf{y}){:}{=}{{\,\textrm{wt}\,}}_{skew}(\textbf{x}-\textbf{y}). \end{aligned}$$

(74)

As a channel model we consider the skew metric channel

$$\begin{aligned} \textbf{r}=\textbf{c}+\textbf{e} \end{aligned}$$

(75)

where the error vector $\textbf{e}$ has skew weight ${{\,\textrm{wt}\,}}_{skew}(\textbf{e})=t$.

We define (vertically) interleaved skew Reed–Solomon (ISRS) codes as follows.

Definition 10

(Interleaved Skew Reed–Solomon Code) Let $\textbf{b}=(b_0,b_1,\dots ,b_{n-1})\in {\mathbb {F}}_{q^m}^n$ contain P-independent elements from ${\mathbb {F}}_{q^m}$. For a fixed integer $k\le n$, a vertically $s$-interleaved skew Reed–Solomon (ISRS) code of length n and dimension k is defined as

$$\begin{aligned} \textrm{ISRS}[\textbf{b},s;n,k] =\left\{ \begin{pmatrix} {f^{(1)}}\!\left[ \textbf{b}\right] \\ {f^{(2)}}\!\left[ \textbf{b}\right] \\ \vdots \\ {f^{(s)}}\!\left[ \textbf{b}\right] \end{pmatrix}:f^{(j)}\in {\mathbb {F}}_{q^m}[x;\sigma ]_{<k},\forall j\in [1,s] \right\} . \end{aligned}$$

(76)

ISRS codes are maximum skew distance (MSD) codes, i.e. we have that

$$\begin{aligned} d_{skew}(\textrm{ISRS}[\textbf{b},s;n,k])=n-k+1. \end{aligned}$$

(77)

Under a fixed basis of ${\mathbb {F}}_{q^{ms}}$ over ${\mathbb {F}}_{q^m}$ there is a bijection between a matrix $\textbf{C}\in {\mathbb {F}}_{q^m}^{s\times n}$ and a vector $\textbf{c}\in {\mathbb {F}}_{q^{ms}}^n$. Hence, we can represent each codeword $\textbf{C}\in \textrm{ISRS}[\textbf{b},s;n,k]$ as a vector $\textbf{c}=f(\textbf{b})\in {\mathbb {F}}_{q^{ms}}^n$ where $f\in {\mathbb {F}}_{q^{ms}}[{\textbf{x}};\sigma ]$ is the the polynomial obtained by considering the coefficients of $f^{(1)},\dots ,f^{(s)}$ over ${\mathbb {F}}_{q^{ms}}$. This relation between $s$-interleaved evaluation codes over ${\mathbb {F}}_{q^m}$ and punctured evaluation codes over the bigger field ${\mathbb {F}}_{q^{ms}}$ is well-known from Reed–Solomon and Gabidulin codes (see e.g. [8, 58]).

Suppose we transmit a vector $\textbf{c}=f(\textbf{b})\in \textrm{ISRS}[\textbf{b},s;n,k]$ and receive a vector

$$\begin{aligned} \textbf{r}=\textbf{c}+\textbf{e}\in {\mathbb {F}}_{q^{ms}}^n \end{aligned}$$

(78)

where ${{\,\textrm{wt}\,}}_{skew}(\textbf{e})=t$. Let $\textbf{R}\in {\mathbb {F}}_{q^m}^{s\times n}$ denote the expanded matrix of $\textbf{r}\in {\mathbb {F}}_{q^{ms}}^n$ over ${\mathbb {F}}_{q^m}$.

Definition 11

(Remainder Vector Evaluation Map) Given an interpolation point set $\mathcal {P}=\{(p_{i,0},p_{i,1},\dots ,p_{i,s}):i=0,\dots ,n-1\}\subseteq {\mathbb {F}}_{q^m}^{s+1}$ and a vector ${\textbf{Q}}\in {\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}$ we define the remainder vector evaluation maps as

$$\begin{aligned} {\mathscr {E}}_{i}^{rem}(\textbf{Q}){:}{=}{Q_0}\!\left[ p_{i,0}\right] + \sum _{j=1}^{s}{Q_j}\!\left[ {p_{i,0}}^{p_{i,j}}\right] p_{i,j}, \quad \forall i=0,\dots ,n-1. \end{aligned}$$

(79)

Remark 2

Note that ${p_{i,0}}^{p_{i,j}}$ is not defined whenever $p_{i,j}=0$. Similar to [43] we define ${Q_j}\!\left[ {p_{i,0}}^{p_{i,j}}\right] p_{i,j}=0$ for all $p_{i,j}=0$. This definition is very natural in view of the correspondence to the generalized operator evaluation (see Lemma 3) and the product rule (see [29, Theorem 2.7]).

For interleaved skew Reed–Solomon codes, the interpolation point set is

$$\begin{aligned} \mathcal {P}=\{(\beta _i,r_{0,i},\dots ,r_{s-1,i}):i=0,\dots ,n-1\}\subset {\mathbb {F}}_{q^m}^{s+1}. \end{aligned}$$

(80)

Problem 4

(Vector Interpolation Problem) Given the integer $s\in {\mathbb {Z}}_+$, a degree constraint $D\in {\mathbb {Z}}_+$, a set of ${\mathbb {F}}_{q^m}$-linear vector evaluation maps $\mathcal {E}^{rem}=\{{\mathscr {E}}_{0}^{rem},\dots ,{\mathscr {E}}_{n-1}^{rem}\}$ as defined in (79) and a vector $\textbf{w}=(0,k-1,\dots ,k-1)\in {\mathbb {Z}}_+^{s+1}$ compute a vector $\textbf{b}\in {\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}$ that satisfies:

• ${\mathscr {E}}_{i}^{rem}(\textbf{b})=0$, $\forall i=0,\dots ,n-1$,

• $\deg _{\textbf{w}}({\textbf{b}}) < D$.

A nonzero solution of Problem 4 exists if the degree constraint satisfies (see [6])

(81)

Proposition 3

Problem 4 can be solved by Algorithm 1 in $O\left( s^2n^2\right)$ operations in ${\mathbb {F}}_{q^m}$.

Proof

Problem 4 corresponds to finding a vector in the interpolation module

$$\begin{aligned} \overline{\mathcal {K}}_{n-1}=\{\textbf{b}\in {\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}:{\mathscr {E}}_{i}^{rem}(\textbf{b})=0,\,\forall i=0,\dots ,n-1\} \end{aligned}$$

(82)

of minimal ${\textbf{w}}$-weighted degree. Hence, Problem 4 can be solved by computing a $\textbf{w}$-ordered weak-Popov basis for the left ${\mathbb {F}}_{q^m}[x;\sigma ]$-module $\overline{\mathcal {K}}_{n-1}$ and returning a row with ${\textbf{w}}$-weighted degree less than $D$. The problem of finding a $\textbf{w}$-ordered weak-Popov basis for $\overline{\mathcal {K}}_{n-1}$ is an instance of the general vector interpolation problem (Problem 1) which can be solved by Algorithm 1 (see Lemma 4).

By Proposition 1, Algorithm 1 requires the computation of $O\left( sn\right)$ evaluation maps ${\mathscr {E}}_{i}^{rem}$ of a vector in ${\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}_{\le n}$, which requires $O\left( sn\right)$ operations in ${\mathbb {F}}_{q^m}$ each. Overall, the computation of the evaluation maps requires $O\left( s^2 n^2\right)$ operations in ${\mathbb {F}}_{q^m}$. The computation of the n multiplications of a monic degree-1 skew polynomial with a vector from ${\mathbb {F}}_{q^m}[x;\sigma ]$ (Line 11) requires $O\left( sn^2\right)$ operations in ${\mathbb {F}}_{q^m}$ in total. The $O\left( sn\right)$ multiplications of an element from ${\mathbb {F}}_{q^m}$ and a vector from ${\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}_{\le n}$ require at most $O\left( s^2 n^2\right)$ operations in ${\mathbb {F}}_{q^m}$. Therefore we conclude that Algorithm 1 can solve Problem 2 requiring at most $O\left( s^2n^2\right)$ operations in ${\mathbb {F}}_{q^m}$. $\square$

If the skew weight of the error $t={{\,\textrm{wt}\,}}_{skew}(\textbf{e})$ satisfies

$$\begin{aligned} t<\frac{s}{s+1}(n-k+1) \end{aligned}$$

(83)

it can be shown that (see [6])

$$\begin{aligned} P(x)=Q_0(x)+\sum _{j=1}^{s}Q_j(x)f^{(j)}(x)=0. \end{aligned}$$

(84)

The root-finding step consists of finding all polynomials $f^{(1)},\dots ,f^{(s)}\in {\mathbb {F}}_{q^m}[x;\sigma ]_{<k}$ that satisfy (84). The root-finding problem can be solved efficiently by the minimal approximant basis methods in [10, 11] requiring at most ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$.

4.3.1 Solving the interpolation step via the fast KNH interpolation

Define the sets

$$\begin{aligned} \mathcal {P}_{[i,j]}^{(r)}{:}{=}\left\{ {p_{l,0}}^{p_{l,r}}:p_{l,r}\ne 0, \forall l=i,\dots ,j\right\} \end{aligned}$$

(85)

for all $0\le i,j\le n-1$ and $r=1,\dots ,s$. Then the vectors of minimal polynomials with respect to the generalized operator evaluation are defined as

$$\begin{aligned} \textbf{M}^\text {rem}_{[i,j]}(x){:}{=}\left( M^\text {rem}_{\{p_{i,0},\dots ,p_{j,0}\}}(x),M^\text {rem}_{\mathcal {P}_{[i,j]}^{(1)}}(x),\dots ,M^\text {rem}_{\mathcal {P}_{[i,j]}^{(s)}}(x)\right) . \end{aligned}$$

(86)

Lemma 10

Let $\mathcal {E}^{rem}=({\mathscr {E}}_{0}^{rem},\dots ,{\mathscr {E}}_{n-1}^{rem})$ be an ordered set of skew vector evaluation maps as defined in (79) and let $\mathcal {E}_{[i,j]}^{rem}=({\mathscr {E}}_{i}^{rem},\ldots ,{\mathscr {E}}_{j}^{rem})\subseteq \mathcal {E}^{rem}$. Then for any $\textbf{Q}\in {\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}$ we have that

$$\begin{aligned} {\mathscr {E}}_{l}^{rem}(\textbf{Q})={\mathscr {E}}_{l}^{rem}(\textbf{Q}\; \textrm{mod}_{\textrm{r}} \;\textbf{M}^\text {rem}_{[i,j]}(x)), \quad \forall l=i,\dots ,j. \end{aligned}$$

(87)

Proof

For the case where the interpolation point $\textbf{p}_i$ (corresponding to ${\mathscr {E}}_{i}^{rem}$) contains only nonzero elements, the lemma follows directly by applying the result from Lemma 2 to the elementary evaluations in the skew vector remainder evaluation maps defined in (79). Since by definition of the sets in (85) all conjugates ${p_{i,0}}^{p_{i,r}}$ where $p_{i,r}=0$ are excluded, and by definition the evaluation of each ${Q_r}\!\left[ {p_{i,0}}^{p_{i,r}}\right] p_{i,r}=0$ for all $p_{i,r}=0$ (see Remark 2), we have that the statement also holds in this case. $\square$

An important consequence of Lemma 10 is, that the vector remainder evaluation maps from Definition 11 and the minimal polynomial vectors in (86) fulfill Assumption 1. Hence, we can solve Problem 4 by calling Algorithm 3 with $\textsf {SkewInterpolateTree}(\mathcal {E}^{rem}, \textbf{I}_{s+1}, (0,k-1,\dots ,k-1))$.

4.3.2 Complexity analysis

Lemma 11

(Complexity of Computing Minimal Polynomial Vectors) Algorithm 4 constructs the (ordered) set containing the minimal polynomial vectors

$$\begin{aligned} \mathcal {M}^{\text {rem}}{} & {} {:}{=}\left( \textbf{M}^\text {rem}_{[0,n-1]}(x),\textbf{M}^\text {rem}_{[0,\lfloor n/2\rfloor -1]}(x),\textbf{M}^\text {rem}_{[\lfloor n/2\rfloor ,n-1]}(x)\dots ,\textbf{M}^\text {rem}_{[n-1,n-1]}(x)\right) \nonumber \\{} & {} \quad \subset {\mathbb {F}}_{q^m}[x;\sigma ]^{s+1} \end{aligned}$$

(88)

as defined in (86) in ${\widetilde{O}}\left( s{\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$.

Proof

Algorithm 4 is a generalization of the procedure in [17, Theorem 3.2.7] to construct a single minimal polynomial, which requires ${\widetilde{O}}\left( {\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$. Hence, the overall complexity of Algorithm 4 is in the order of ${\widetilde{O}}\left( s{\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$. $\square$

Theorem 3

(Computational Complexity) Algorithm 3 solves Problem 4 over ${\mathbb {F}}_{q^m}[x;\sigma ]^{s+1}$ in ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$.

Proof

Follows the ideas of the proof of Theorem 2. $\square$

Remark 3

(Practical Consideration) Note that in the ${\mathbb {F}}_{q^m}[x;\sigma ]$-case the i-th remainder vector evaluation map ${\mathscr {E}}_{i}^{rem}(x\mathbf {{\textbf{Q}}})$ of $x{\textbf{Q}}$ can be computed efficiently from ${\mathscr {E}}_{i}^{rem}(\mathbf {{\textbf{Q}}})$ requiring only one application of the automorphism $\sigma$ and one multiplication since by the product rule [29] we have that

$$\begin{aligned} {\mathscr {E}}_{i}^{rem}(x\mathbf {{\textbf{Q}}})=\sigma \left( {\mathscr {E}}_{i}^{rem}(\mathbf {{\textbf{Q}}})\right) p_{i,0}, \quad \forall i=0,\dots ,n-1. \end{aligned}$$

(89)

4.4 Applications to other related coding problems

Algorithm 3 with generalized operator vector evaluation maps of the form as defined in Definition 8 can be used to solve the interpolation step in other related interpolation-based decoding problems efficiently. The corresponding interpolation problems are instances of Problem 1 where the minimal polynomial vectors in (55) fulfill Assumption 1.

In particular, the interpolation step in decoding of lifted $s$-interleaved Gabidulin codes in the subspace metric [8, 9] can be performed requiring at most ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n_r)\right)$ operations in ${\mathbb {F}}_{q^m}$, where $n_r$ denotes the dimension of the received subspace. Further, the interpolation step in decoding $h$-folded Gabidulin codes [8, 37] and lifted $h$-folded Gabidulin codes [7] can be performed in at most ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n)\right)$ and ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n_r)\right)$ operations in ${\mathbb {F}}_{q^m}$, respectively, where $s\le h$ denotes an interpolation parameter.

Algorithm 3 can also be used to solve the interpolation step for decoding lifted $s$-interleaved LRS codes in the sum-subspace metric [5] requiring at most ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n_r)\right)$ operations in ${\mathbb {F}}_{q^m}$, where $n_r$ denotes the sum of the dimensions of the received subspaces over all shots.

Algorithm 3 can also solve the interpolation step for interpolation-based decoding of $h$-folded lLRS codes [23] requiring at most ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$, where $s\le h$ is a decoding parameter and n is the length of the unfolded code.

Since, unlike the minimal approximant basis approach in [6, 11], Algorithm 3 has no requirements on the interpolation points (related to the evaluation maps), it can be applied in a straight-forward manner to decoding problems of lifted Gabidulin and LRS code variants in the (sum-)subspace metric.

5 Conclusion

We proposed a fast divide-and conquer variant of the Kötter–Nielsen–Høholdt (KNH) interpolation over free modules over skew polynomial rings. We showed how the proposed KNH interpolation can be used to solve the interpolation step of interpolation-based decoding of interleaved Gabidulin, linearized Reed–Solomon and skew Reed–Solomon codes and variants thereof efficiently requiring at most ${\widetilde{O}}\left( s^\omega {\mathfrak {M}}(n)\right)$ operations in ${\mathbb {F}}_{q^m}$, where n is the length of the code, $s$ the interleaving order, ${\mathfrak {M}}(n)$ the complexity for multiplying two skew polynomials of degree at most n, $\omega$ the matrix multiplication exponent and ${\widetilde{O}}\left( \cdot \right)$ the soft-O notation which neglects log factors. The computational complexity of the proposed fast KNH variant coincides with the complexity of the currently fastest interpolation algorithms for skew polynomial rings, where the proposed variant relies on the well-known (bottom-up) KNH interpolation algorithm instead of quite involved (top–down) minimal approximant bases techniques. The proposed results also hold for codes defined over general skew polynomials rings (with derivations), except for the complexity analysis. Due to the bottom-up nature of the proposed KNH interpolation there are no requirements on the interpolation points and thus no pre-processing of the interpolation points, which may be required for the top–down minimal approximant bases approaches, is necessary.