On the Modulus in Matching Vector Codes

Classical error-correcting codes allow one to encode any $n$-bit message $x$ as an $N$-bit codeword $C(x)$ such that $x$ can still be recovered, even if a constant fraction of $C(x)$ have been corrupted. The disadvantage of such codes is that one has to read all or most of the codeword to recover any information about $x$. As a better solution for decoding particular bits of the message, a $(k,\delta,\epsilon)$-locally decodable code (LDC) [1] encodes any $n$-bit message $x$ to an $N$-bit codeword, such that any message bit $x_{i}$ can be recovered with probability $\geq 1-\epsilon$, by a randomized decoding procedure that makes at most $k$ queries, even if $\delta N$ bits of $C(x)$ have been corrupted. Such codes have interesting applications [2, 3] in cryptography and complexity theory. For an efficient LDC, both the code length $N$ and the query complexity $k$ should be as small as possible, as functions of $n$.

Following [1, 4, 5], Gasarch [2] and Goldreich [4] conjectured that for any constant $k$, the length $N$ of a $k$-query LDC should be $\exp(n^{\Omega(1)})$. Yekhanin [6] disproved this conjecture with a 3-query LDC of length $\exp(\exp(O(\log n/\log\log n)))$, assuming that there are infinitely many Mersenne primes. For any $r\geq 2$, Efremenko [7] provided a construction of $2^{r}$-query LDCs of length $N_{r}=\exp(\exp(O((\log n)^{1-1/r}(\log\log n)^{1/r})))$ under no assumptions, and in particular a 3-query LDC when $r=2$. Such codes have been reformulated and called matching vector codes (MVCs) in [8].

The MVCs in [7] are based on two ingredients: $S$-matching family and $S$-decoding polynomial. For $r\geq 2$, let $\mathcal{M}_{r}$ be the set of integers of the form $m=p_{1}^{\alpha_{1}}p_{2}^{\alpha_{2}}\cdots p_{r}^{\alpha_{r}}$, where $p_{1},p_{2},\ldots,p_{r}>2$ are distinct primes and $\alpha_{1},\alpha_{2},\ldots,\alpha_{r}>0$. The existence of both ingredients in MVCs depends on a modulus $m\in{\cal M}_{r}$. In particular, the query complexity $k$ of the MVC is equal to the number of monomials in the $S$-decoding polynomial, and is at most $2^{r}$ for all $m\in{\cal M}_{r}$. A number $m\in{\cal M}_{r}$ has been called good if an $S$-decoding polynomial with $k<2^{r}$ monomials exists when $m$ is used to construct MVC. For example, the 3-query LDC of [7] was constructed with the good number $m=7\times 73$. Itoh and Suzuki [9] showed that one can reduce the query complexity of MVCs via a composition theorem. In particular, by using the good numbers 511 and 2047, they were able to obtain $9\cdot 2^{r-4}$-query LDC of length $N_{r}$ for all $r>5$. Chee et al. [10] showed that if there exist primes $t,p_{1},p_{2}$ such that $m=2^{t}-1=p_{1}p_{2}$, then $m$ must be good. They determined 50 new good numbers of the above form and then significantly reduced the query complexity of MVCs.

Since [7, 9, 10], the work of finding good numbers has become interesting. However, the study of [7, 9, 10] was limited to good numbers of the form $m=p_{1}p_{2}\in{\cal M}_{2}$. When $\max\{\alpha_{1},\alpha_{2}\}>1$, it is not known how to decide a number of the form $m=p_{1}^{\alpha_{1}}p_{2}^{\alpha_{2}}\in{\cal M}_{2}$ is good except using the very expensive computer search. In this paper, we shall provide two methods for obtaining new good numbers in ${\cal M}_{2}$:

• •

  If $m_{1}=p_{1}^{\alpha_{1}}p_{2}^{\alpha_{2}}\in{\cal M}_{2}$ is good and $m_{2}=p_{1}^{\beta_{1}}p_{2}^{\beta_{2}}\in{\cal M}_{2}$ is a multiple of $m_{1}$, then $m_{2}$ must be good as well;

• •

  If $m_{2}=p_{1}^{\beta_{1}}p_{2}^{\beta_{2}}\in{\cal M}_{2}$ is good, and there is an $S$-decoding polynomial of the form $P(X)=X^{u}+aX^{v}+b$ for $m_{2}$ such that $\gcd(u,v,m_{2})=p_{1}^{\omega_{1}}p_{2}^{\omega_{2}}$, then $m_{1}=m_{2}/(p_{1}^{\omega_{1}}p_{2}^{\omega_{2}})$ must be good as well.

We denote by $\mathbb{Z}$ and $\mathbb{Z}^{+}$ the set of integers and positive integers, respectively. For any $n\in\mathbb{Z}^{+}$, we denote $[n]=\{1,2,\ldots,n\}$. For any $m\in\mathbb{Z}^{+}$, we denote by $\mathbb{Z}_{m}$ the set of integers modulo $m$ and denote by $\mathbb{Z}_{m}^{*}$ the multiplicative group of integers modulo $m$. When $m$ is odd, we have that $2\in\mathbb{Z}_{m}^{*}$ and denote by ${\rm ord}_{m}(2)$ the multiplicative order of $2$ in $\mathbb{Z}_{m}^{*}$. For a prime power $q$, we denote by $\mathbb{F}_{q}$ the finite field of $q$ elements and denote by $\mathbb{F}_{q}^{*}$ the multiplicative group of $\mathbb{F}_{q}$. For any $z\in\mathbb{F}_{q}^{*}$, we denote by ${\rm ord}_{q}(z)$ the multiplicative order of $z$. For any two vectors $x=(x_{1},\ldots,x_{n}),y=(y_{1},\ldots,y_{n})$, we denote by $d_{H}(x,y)=\{i:i\in[n],x_{i}\neq y_{i}\}$ the Hamming distance between $x$ and $y$. For any $x,y\in\mathbb{Z}_{m}^{h}$, we denote by $\langle x,y\rangle_{m}=\sum_{i=1}^{n}x_{i}y_{i}\bmod m$ the dot product of $x$ and $y$. If the components of a vector $y$ are labeled by a set $V$, then for every $v\in V$ we denote by $y[v]$ the $v$th component of $y$.

The numbers $k$ and $N$ are called the query complexity and the length of $C$, respectively. They are usually considered as functions of $n$, the message length, and measure the efficiency of $C$. Ideally, we would like $k$ and $N$ to be as small as possible.

Efremenko [7] proposed a construction of LDCs, which is based on two fundamental building blocks: $S$-matching family and $S$-decoding polynomial.

Given an $S$-matching family ${\cal U}=\{u_{i}\}_{i=1}^{n}\subseteq\mathbb{Z}_{m}^{h}$ and an $S$-decoding polynomial $P(X)=a_{0}+a_{1}X^{b_{1}}+\cdots+a_{k-1}X^{b_{k-1}}\in\mathbb{F}_{2^{t}}[X]$, Efremenko’s LDC can be described by Figure. 1.

Figure 1. Efremenko’s Construction

Efremenko’s construction gives a linear $(k,\delta,k\delta)$-LDC that encodes messages of length $n$ to codewords of length $N=m^{h}$. When $N$ is fixed, the larger the $n$ is, the more efficient the $C$ is. Efremenko [7] and several later works [9, 10] choose $S$ as the canonical set in $\mathbb{Z}_{m}$. For any $m=p_{1}^{\alpha_{1}}p_{2}^{\alpha_{2}}\cdots p_{r}^{\alpha_{r}}\in{\cal M}_{r}$, the canonical set in $\mathbb{Z}_{m}$ is defined as

For example, $S_{15}=\{1,6,10\}$. Efremenko [7] observed that Grolmusz’s set system [11] gives a direct construction of $S_{m}$-matching families.

In particular, the $n$ takes the form of $\ell^{\ell}$ for an integer $\ell>0$ and $h$ is determined by both $m$, $\ell$, and the weak representation of the function ${\sf OR}_{\ell}$ [11]. Efremenko [7] also observed that the polynomial $P(X)=\prod_{s\in S_{m}}(X-\gamma^{s})/(1-\gamma^{s})$ is an $S_{m}$-decoding polynomial with $k\leq 2^{r}$ monomials.

Lemmas 2.4 and 2.5 yield LDCs of subexponential length.

For every integer $r\geq 2$, Theorem 2.6 gives an infinite family of LDCs, each based on a number $m\in{\cal M}_{r}$. Different $m\in{\cal M}_{r}$ may give LDCs of different query complexity. For example, $m=7\times 73$ gives a code of query complexity 3 [7], while $m=3\times 5$ is only able to give a code of query complexity 4 [9]. A number of the form $m=p_{1}p_{2}$ has been called good in [9, 10] if it is able to result in an LDC of query complexity $<4$. By using the good numbers $511$ and $2047$, Itoh and Suzuki [9] concluded that for any $r>5$, the query complexity $2^{r}$ of the LDCs in Theorem 2.6 can be reduced to $9\cdot 2^{r-4}$. On the other hand, for $r=2,3,4$ and $5$, the best decoding algorithms to date for the LDCs in Theorem 2.6 have query complexity 3, 8, 9, and 24, respectively. Chee et al. [10] showed Mersenne numbers of the form $p_{1}p_{2}$ are good. With infinitely many such good numbers, Chee et al. [10] can further reduce the query complexity to $3^{r/2}$.

Let $m=p_{1}^{\alpha_{1}}p_{2}^{\alpha_{2}}\in\mathcal{M}_{2}$. Let $t={\rm ord}_{m}(2)$ and let $\gamma\in\mathbb{F}_{2^{t}}^{*}$ be a primitive $m{\rm th}$ root of unity. Lemma 2.5 shows that there is an $S_{m}$-decoding polynomial $P(X)$ with $k\leq 4$ monomials. In this section, we will establish several sufficient and necessary conditions for a number $m$ to be good.

Let $\mathbb{M}_{2}$ be the set of good numbers in ${\cal M}_{2}$. The following lemmas characterize $\mathbb{M}_{2}$.

Let $\rho(z_{1},z_{2})=\tau(z_{1},z_{2})-1=(1+z_{2}^{-1})(1+z_{1}^{-1})^{-1}.$ Then Lemma 3.7 gives the following theorem.

Theorem 3.9 gives a characterization of the good numbers in ${\cal M}_{2}$. We say that $(u,v)\in E^{2}$ form a collision for $m$ if

• •

  $\rho(\gamma^{s_{10}u},\gamma^{s_{01}u})=\rho(\gamma^{s_{10}v},\gamma^{s_{01}v})$, and

• •

  $u\not\equiv v(\bmod~{}m)$.

The proof of Lemma 3.7 shows that $m\in\mathbb{M}_{2}$ if and only if there is a collision $(u,v)\in E^{2}$ for $m$.

In this section, we show the implications between good numbers in ${\cal M}_{2}$, which allows us to construct new good numbers from old.