Novel Polynomial Basis and Its Application to Reed-Solomon Erasure Codes Sian-Jheng Lin, Wei-Ho Chung Yunghsiang S. Han Research Center for Information Technology Innovation Department of Electrical Engineering Academia Sinica National Taiwan University of Science and Technology Taipei City, Taiwan Taipei City, Taiwan Email: [email protected]; [email protected] Email: [email protected] Abstract—In this paper, we present a new basis of polynomial the polynomial evaluations. The new basis possesses a re- over finite fields of characteristic two and then apply it to the cursive structure which can be exploited to compute the encoding/decoding of Reed-Solomon erasure codes. The proposed polynomial evaluations at a period of h consecutive points polynomial basis allows that h-point polynomial evaluation can in time O(h lg(h)) with small leading constant. Furthermore, be computed in O(h log2(h)) finite field operations with small leading constant. As compared with the canonical polynomial the recursive structure also works in formal derivative with basis, the proposed basis improves the arithmetic complexity time complexity O(h lg(h)). of addition, multiplication, and the determination of polynomial An application of the proposed polynomial basis is in degree from O(h log (h) log log (h)) to O(h log (h)). Based on 2 2 2 2 erasure codes, that is an error-correcting code by converting a this basis, we then develop the encoding and erasure decoding algorithms for the (n = 2r; k) Reed-Solomon codes. Thanks to message of k symbols into a codeword with n symbols such the efficiency of transform based on the polynomial basis, the that the original message can be recovered from a subset of encoding can be completed in O(n log2(k)) finite field operations, the n symbols. An (n; k) erasure code is called Maximum and the erasure decoding in O(n log2(n)) finite field operations. Distance Separable (MDS) if any k out of the n codeword To the best of our knowledge, this is the first approach supporting symbols are sufficient to reconstruct the original message. A Reed-Solomon erasure codes over characteristic-2 finite fields typical class of MDS codes is Reed-Solomon (RS) codes [1]. while achieving a complexity of O(n log2(n)), in both additive and multiplicative complexities. As the complexity leading factor Nowadays, RS codes have been applied to many applications, is small, the algorithms are advantageous in practical applica- such as RAID systems [2, 3], distributed storage codes [4, 5], tions. and data carousel [6]. Hence, the computational complexity I. INTRODUCTION of RS erasure code is considered crucial and has attracted substantial research attention. Based on the new polynomial For a positive integer r ≥ 1, let F2r denote a characteristic- r basis, this paper presents the encoding/decoding algorithms for 2 finite field containing 2 elements. A polynomial over r F2 RS erasure codes. The proposed algorithms use the structure is defined as [7] that requires evaluating a polynomial and it’s derivatives, 2 h−1 a(x) = a0 + a1x + a2x + ··· + ah−1x ; while the polynomial used in the structure is in the new polynomial basis, rather than the monomial basis. where each a 2 r . A fundamental issue is to reduce i F2 The rest of this paper is organized as follows. The proposed the computational complexities of arithmetic operations over polynomial basis is defined in Section II. Section III gives the polynomials. Many fast polynomial-related algorithms, such definition and algorithm of the transform to compute the poly- as Reed-Solomon codes, are based on fast Fourier trans- arXiv:1404.3458v2 [cs.IT] 24 Jul 2014 nomial evaluations based on the proposed polynomial basis. forms (FFT). However, it is algorithmically harder as the Section IV shows the formal derivative of polynomial. Section traditional fast Fourier transform (FFT) cannot be applied V presents the encoding and erasure decoding algorithm directly over a characteristic-2 finite fields. To the best of for Reed-Solomon codes. The discussions and comparisons our knowledge, no existing algorithm for characteristic-2 finite are placed in Section VI. SectionVII reviews some related field FFT/polynomial multiplication has provably achieved literature. Concluding remarks are provided in Section VIII. O(h lg(h)) operations1 (see Section VII for more details). In algorithmic viewpoint, FFT is a polynomial evaluations II. A NEW POLYNOMIAL BASIS OVER r at a period of consecutive points, where the polynomial is in F2 monomial basis. This viewpoint gives us the ability to design A. Finite field arithmetic fast polynomial-related algorithms. In this paper, we present a r Let 2r be an extension finite field with dimension r over 2 F r new polynomial basis in the polynomial ring F2r [x]=(x −x). 2 −1 F2. The elements of F2r are represented as a set f!igi=0 . Then a transform in the new basis is defined to compute We order those elements as follows. Assume that V be the r- 1Throughout this paper, the notation lg(x) represents the logarithm to the dimensional vector space spanned by v0; v1; : : : ; vr−1 2 F2r r base 2. over F2. For any 0 ≤ i < 2 , its binary representation is given 1 l as III. FAST TRANSFORM Ψh[•] 2 r−1 In this section, we define a h-point transformation Ψl [•] i = i0 + i1 · 2 + i2 · 2 + ··· + ir−1 · 2 ; 8ij 2 f0; 1g: (1) h that computes the evaluations of [•](x) at h successive points, Then !i is defined as for h a power of two. Given a h-element input vector Dh, the polynomial [D ](x) can be constructed accordingly. The ! = i · v + i · v + i · v + ··· + i · v : h i 0 0 1 1 2 2 r−1 r−1 transform outputs a h-element vector A polynomial f(x) defined over F2r is a polynomial whose ^ l l Dh = Ψh[Dh]; coefficients are from F2r . where B. Subspace vanishing polynomial ^ l The subspace vanishing polynomial defined in [8–10] is Dh = ([Dh](!0 + !l); [Dh](!1 + !l);:::; [Dh](!h−1 + !l)); expressed as and l denotes the amount of shift in the transform. j 2 −1 l −1 Y Oppositely, the inversion, denoted as (Ψh) [•], can convert Wj(x) = (x + !i); (2) ^ l l −1 ^ l Dh into Dh, and we have (Ψh) [Dh] = Dh. Here, we omit i=0 to provide the close form for inversion. Instead, an algorithm j l where 0 ≤ j ≤ r − 1. It can be seen that deg(Wj(x)) = 2 . for transform Ψh[•] and the inverse algorithm will be presented Next we present properties of Wj(x) without proof. later. Lemma 1 ([9]). Wj(x) is an F2-linearlized polynomial for A. Recursive structure in polynomial basis which j This subsection shows that the polynomial [Dh](x) can be X 2i 0 Wj(x) = aj;ix ; (3) formulated as a recursive function [Dh](x) = ∆0(x), where m i=0 the function ∆i (x) is defined as where each aj;i 2 2r is a constant. Furthermore, F m m Wi(x) m+2i ∆i (x) = ∆i+1(x) + ∆i+1 (x) W (! i ) (9) Wj(x + y) = Wj(x) + Wj(y); 8x; y 2 F2r : (4) i 2 ; for 0 ≤ i ≤ lg(h) − 1; C. Polynomial basis m 2r ∆lg(h)(x) = dm; for 0 ≤ m ≤ h − 1: (10) In this work, we consider the polynomial ring F2r [x]=(x − m x). A form of polynomial basis we work with is denoted as Note that m in ∆i (x) represents a lg(h)-bits binary integer X(x) = (X0(x);X1(x);:::;X2r −1(x)) over F2r . Each poly- m = m + m · 2 + ··· + m · 2i; 8m 2 f0; 1g: (11) nomial Xi(x) is defined as the product of subspace vanishing 0 1 i−1 j polynomials. For each polynomial Xi(x), i is written in binary m i By induction, it can be seen that deg(∆i (x)) ≤ h=2 − 1. representation as For example, if h = 8, we have r−1 7 i = i0 + i1 · 2 + ··· + ir−1 · 2 ; 8ij 2 f0; 1g: (5) X [D8](x) = diXi(x) i=0 The polynomial Xi(x) is then defined as W0(x) W1(x) W0(x) W1(x) =d0 + d1 + d2 + d3 r−1 ij W0(!1) W1(!2) W0(!1) W1(!2) Y Wj(x) Xi(x) = ; (6) W2(x) W0(x) W2(x) W1(x) W2(x) Wj(!2j ) + d4 + d5 + d6 j=0 W2(!4) W0(!1) W2(!4) W1(!2) W2(!4) W0(x) W1(x) W2(x) ij + d7 r Wj (x) W (! ) W (! ) W (! ) for 0 ≤ i < 2 . Notice that W (! ) = 1, if ij = 0. It can 0 1 1 2 2 4 j 2j W2(x) W1(x) W2(x) be seen that deg(Xi(x)) = i. = d0 + d4 + d2 + d6 W2(!4) W1(!2) W2(!4) Then a form of polynomial expression [•](x) is given as W0(x) W2(x) W1(x) W2(x) follows. + d1 + d5 + d3 + d7 W0(!1) W2(!4) W1(!2) W2(!4) Definition 1. A form of polynomial expression over F2r is 0 W1(x) 2 = ∆2(x) + ∆2(x) defined as W1(!2) h−1 W0(x) 1 W1(x) 3 X + ∆2(x) + ∆2(x) [Dh](x) = diXi(x); (7) W0(!1) W1(!2) i=0 0 W0(x) 1 0 =∆1(x) + ∆1(x) = ∆0(x): W0(!1) where (12) Dh = (d0; d1; : : : ; dh−1) (8) The ∆m(x) possesses the following equality that will be is an h-element vector denoting the polynomial coefficients i r utilized in the algorithm: and h ≤ 2 .