arXiv subjects

Nicolas Resch

Publications and source records attributed to Nicolas Resch.

17 recordsLinked to original sources

arXiv2026

Discrepancy for Random Linear Codes

We prove that random linear codes have nearly optimal discrepancy properties in a broad range of regimes. Our main results are two general theorems: one controlling all translates of a fixed test, and another controlling large families of Fourier-pseudorandom tests. Two motivating applications follow. First, random linear codes match unstructured random codes for list-decoding from errors above capacity. If $C\subseteq\mathbb F_q^n$ is a random linear code of rate $1-\frac1n\log_q |B_\rho|+\epsilon$, where $B_\rho$ is a radius-$\rho$ Hamming ball, then with high probability $$ |C\cap B|=(1\pm o(1))\frac{|C||B|}{q^n} $$ simultaneously for all radius-$\rho$ Hamming balls $B\subseteq\mathbb F_q^n$. This extends the classical result that such codes have covering radius at most $\rho n$ whp (Blinovsky, 1987). Second, over prime fields, random linear codes match unstructured random codes for zero-error list-recovery above capacity. For prime $q>2$ and $2\le \ell\le q-1$, a random linear code of rate $1-\log_q\ell+\epsilon$ satisfies, with high probability, $$ |C\cap S|=(1\pm o(1))\frac{|C|\ell^n}{q^n} $$ simultaneously for all rectangles $S=S_1\times\cdots\times S_n$ with $|S_i|=\ell$. As a consequence, there are abundant $n$-party linear ramp secret sharing schemes over $\mathbb F_q$ with privacy threshold about $n/(2\log q)$ and reconstruction threshold about $5n/(2\log q)$, resilient to balanced local leakage; prior existence results required thresholds above $n/2$ even in this case. The translate result, hence the list-decoding application, holds over arbitrary finite fields, even growing with $n$. The list-recovery and leakage applications hold over prime fields under moderate growth, e.g. $q\le n^{1/5-o(1)}$. The proofs use a refined second-moment analysis tracking intersection sizes as random generators are added to $C$.

cs.IT↗

arXiv2026

Fast Bounded-Independence Functions and Their Duals

We continue the study of {\em fast} functions, computable by linear-size circuits, that share useful properties of random functions. Motivated by cryptographic applications, we generalize and improve on previous results in this area, obtaining the following results: - For any constant $t$, we construct a fast $t$-wise independent hash function with algebraic degree $\log_2 t$ (over $\mathbb F_2$), simultaneously optimizing both asymptotic circuit size and degree. - We simplify and improve a recent construction (ITCS 2026) of a family of fast codes with fast duals, both meeting the Gilbert-Varshamov bound. Unlike the previous construction, our construction has negligible failure probability, can accommodate general fields and rates, supports a systematic encoding, and admits fast universal encoders. - We strengthen the above to support stronger random-like properties, such as optimal combinatorial list-decoding. This is achieved by constructing, for any constant $t$, a family of fast linear functions that map any $t$ linearly independent inputs to uniform and statistically independent outputs. Prior to our work, this was only known for $t=1$. We demonstrate the usefulness of the above results to cryptography. This includes the first nontrivial protocols for perfectly secure multiparty computation whose circuit complexity scales linearly with the number of parties, as well as protocols for computing encrypted matrix-vector products with optimal asymptotic circuit complexity.

cs.CR↗

arXiv2025

List Recoverable Codes: The Good, the Bad, and the Unknown (hopefully not Ugly)

List recovery is a fundamental task for error-correcting codes, vastly generalizing unique decoding from worst-case errors and list decoding. Briefly, one is given ''soft information'' in the form of input lists S_1,...,S_n of bounded size, and one argues that there are not too many codewords that agree a lot with this soft information. This general problem appears in many guises, both within coding theory and in theoretical computer science more broadly. In this article we survey recent results on list recovery codes, introducing both the ''good'' (i.e., possibility results, showing that codes with certain list recoverability exist), the ''bad'' (impossibility results), and the ''unknown''. We additionally demonstrate that, while list recoverable codes were initially introduced as a component in list decoding concatenated codes, they have since found myriad applications to and connections with other topics in theoretical computer science.

cs.IT↗

arXiv2025

Linear time encodable binary code achieving GV bound with linear time encodable dual achieving GV bound

We initiate the study of what we term ``fast good codes'' with ``fast good duals.'' Specifically, we consider the task of constructing a rate 1/2 binary linear code such that both it and its dual are asymptotically good (in fact, have rate-distance tradeoff approaching the GV bound), and are encodable in linear time. While we believe such codes should find applications more broadly, as motivation we describe how such codes can be used the secure computation task of encrypted matrix-vector product. Our main contribution is a construction of such a fast good code with fast good dual. Our construction is inspired by the repeat multiple accumulate (RMA) code. To create the rate 1/2 code, after repeating each message coordinate, we perform accumulation steps -- where first a uniform coordinate permutation is applied, and afterwards the prefix-sum mod 2 is applied -- which are alternated with discrete derivative steps -- where again a uniform coordinate permutation is applied, and afterwards the previous two coordinates are summed mod 2. Importantly, these two operations are inverse of each other. In particular, the dual of the code is very similar, with the accumulation and discrete derivative steps reversed. Our analysis is inspired by a prior analysis of RMA: we bound the expected number of codewords of weight below the GV bound. We face new challenges in controlling the behaviour of the discrete derivative operation (which can significantly drop the weight of a vector), which we overcome by careful case analysis.

cs.IT↗

arXiv2025

List-Recovery of Random Linear Codes over Small Fields

We study list-recoverability of random linear codes over small fields, both from errors and from erasures. We consider codes of rate $\epsilon$-close to capacity, and aim to bound the dependence of the output list size $L$ on $\epsilon$, the input list size $\ell$, and the alphabet size $q$. Prior to our work, the best upper bound was $L = q^{O(\ell/\epsilon)}$ (Zyablov and Pinsker, Prob. Per. Inf. 1981). Previous work has identified cases in which linear codes provably perform worse than non-linear codes with respect to list-recovery. While there exist non-linear codes that achieve $L=O(\ell/\epsilon)$, we know that $L \ge \ell^{\Omega(1/\epsilon)}$ is necessary for list recovery from erasures over fields of small characteristic, and for list recovery from errors over large alphabets. We show that in other relevant regimes there is no significant price to pay for linearity, in the sense that we get the correct dependence on the gap-to-capacity $\epsilon$ and go beyond the Zyablov-Pinsker bound for the first time. Specifically, when $q$ is constant and $\epsilon$ approaches zero: - For list-recovery from erasures over prime fields, we show that $L \leq C_1/\epsilon$. By prior work, such a result cannot be obtained for low-characteristic fields. - For list-recovery from errors over arbitrary fields, we prove that $L \leq C_2/\epsilon$. Above, $C_1$ and $C_2$ depend on the decoding radius, input list size, and field size. We provide concrete bounds on the constants above, and the upper bounds on $L$ improve upon the Zyablov-Pinsker bound whenever $q\leq 2^{(1/\epsilon)^c}$ for some small universal constant $c>0$.

cs.IT↗

arXiv2025

On the Independence Assumption in Quasi-Cyclic Code-Based Cryptography

Cryptography based on the presumed hardness of decoding codes -- i.e., code-based cryptography -- has recently seen increased interest due to its plausible security against quantum attackers. Notably, of the four proposals for the NIST post-quantum standardization process that were advanced to their fourth round for further review, two were code-based. The most efficient proposals -- including HQC and BIKE, the NIST submissions alluded to above -- in fact rely on the presumed hardness of decoding structured codes. Of particular relevance to our work, HQC is based on quasi-cyclic codes, which are codes generated by matrices consisting of two cyclic blocks. In particular, the security analysis of HQC requires a precise understanding of the Decryption Failure Rate (DFR), whose analysis relies on the following heuristic: given random ``sparse'' vectors $e_1,e_2$ (say, each coordinate is i.i.d. Bernoulli) multiplied by fixed ``sparse'' quasi-cyclic matrices $A_1,A_2$, the weight of resulting vector $e_1A_1+e_2A_2$ is very concentrated around its expectation. In the documentation, the authors model the distribution of $e_1A_1+e_2A_2$ as a vector with independent coordinates (and correct marginal distribution). However, we uncover cases where this modeling fails. While this does not invalidate the (empirically verified) heuristic that the weight of $e_1A_1+e_2A_2$ is concentrated, it does suggest that the behavior of the noise is a bit more subtle than previously predicted. Lastly, we also discuss implications of our result for potential worst-case to average-case reductions for quasi-cyclic codes.

cs.IT↗

arXiv2024

Interactive Coding with Small Memory and Improved Rate

In this work, we study two-party interactive coding for adversarial noise, when both parties have limited memory. We show how to convert any adaptive protocol $\Pi$ into a protocol $\Pi'$ that is robust to an $\epsilon$-fraction of adversarial corruptions, not too much longer than $\Pi$, and which uses small space. More precisely, if $\Pi$ requires space $\log(s)$ and has $|\Pi|$ rounds of communication, then $\Pi'$ requires $O_\epsilon(\log s \log |\Pi|)$ memory, and has $$|\Pi'| = |\Pi|\cdot\left( 1 + O\left( \sqrt{ \epsilon \log \log 1/\epsilon } \right)\right)$$ rounds of communication. The above matches the best known communication rate, even for protocols with no space restrictions.

cs.IT↗

arXiv2024

Randomness-Efficient Constructions of Capacity-Achieving List-Decodable Codes

We wish to generate list-decodable codes over small alphabets using as little randomness as possible. Specifically, we hope to generate codes achieving what we term the Elias bound, which means that they are $(\rho,L)$-list-decodable with rate $R \geq 1-h(\rho)-O(1/L)$. A long line of work shows that uniformly random linear codes (RLCs) achieve the Elias bound: hence, we know $O(n^2)$ random bits suffice. Prior works demonstrate that just $O(Ln)$ random bits suffice, via puncturing of low-bias codes. These recent constructions are combinatorial. We provide two new constructions, which are algebraic. Compared to prior works, our constructions are simpler and more direct. Furthermore, our codes are designed in such a way that their duals are also quite easy to analyze. Our first construction -- which can be seen as a generalization of the Wozencraft ensemble -- achieves the Elias bound and consumes $Ln$ random bits. Additionally, its dual code achieves the GV-bound with high probability, and both the primal and dual admit quasilinear-time encoding algorithms. The second construction consumes $2nL$ random bits and yields a code where both it and its dual achieve the Elias bound. As we discuss, properties of a dual code are often crucial for applications in cryptography. In all of the above cases -- including the prior works achieving randomness complexity $O(Ln)$ -- the codes are designed to "approximate" RLCs. Namely, for a given locality parameter $L$ we construct codes achieving the same $L$-local properties as RLCs. This allows one to appeal to known list-decodability results for RLCs and thereby conclude that the code approximating an RLC also achieves the Elias bound. As a final contribution, we indicate that such a proof strategy is inherently unable to generate list-decodable codes of rate $R$ over $\mathbb F_q$ with less than $L(1-R)n\log_2(q)$ bits of randomness.

cs.IT↗

arXiv2023

Tight Bounds on List-Decodable and List-Recoverable Zero-Rate Codes

In this work, we consider the list-decodability and list-recoverability of codes in the zero-rate regime. Briefly, a code $\mathcal{C} \subseteq [q]^n$ is $(p,\ell,L)$-list-recoverable if for all tuples of input lists $(Y_1,\dots,Y_n)$ with each $Y_i \subseteq [q]$ and $|Y_i|=\ell$ the number of codewords $c \in \mathcal{C}$ such that $c_i \notin Y_i$ for at most $pn$ choices of $i \in [n]$ is less than $L$; list-decoding is the special case of $\ell=1$. In recent work by Resch, Yuan and Zhang~(ICALP~2023) the zero-rate threshold for list-recovery was determined for all parameters: that is, the work explicitly computes $p_*:=p_*(q,\ell,L)$ with the property that for all $\epsilon>0$ (a) there exist infinite families positive-rate $(p_*-\epsilon,\ell,L)$-list-recoverable codes, and (b) any $(p_*+\epsilon,\ell,L)$-list-recoverable code has rate $0$. In fact, in the latter case the code has constant size, independent on $n$. However, the constant size in their work is quite large in $1/\epsilon$, at least $|\mathcal{C}|\geq (\frac{1}{\epsilon})^{O(q^L)}$. Our contribution in this work is to show that for all choices of $q,\ell$ and $L$ with $q \geq 3$, any $(p_*+\epsilon,\ell,L)$-list-recoverable code must have size $O_{q,\ell,L}(1/\epsilon)$, and furthermore this upper bound is complemented by a matching lower bound $\Omega_{q,\ell,L}(1/\epsilon)$. This greatly generalizes work by Alon, Bukh and Polyanskiy~(IEEE Trans.\ Inf.\ Theory~2018) which focused only on the case of binary alphabet (and thus necessarily only list-decoding). We remark that we can in fact recover the same result for $q=2$ and even $L$, as obtained by Alon, Bukh and Polyanskiy: we thus strictly generalize their work.

cs.IT↗

arXiv2022

Zero-Rate Thresholds and New Capacity Bounds for List-Decoding and List-Recovery

In this work we consider the list-decodability and list-recoverability of arbitrary $q$-ary codes, for all integer values of $q\geq 2$. A code is called $(p,L)_q$-list-decodable if every radius $pn$ Hamming ball contains less than $L$ codewords; $(p,\ell,L)_q$-list-recoverability is a generalization where we place radius $pn$ Hamming balls on every point of a combinatorial rectangle with side length $\ell$ and again stipulate that there be less than $L$ codewords. Our main contribution is to precisely calculate the maximum value of $p$ for which there exist infinite families of positive rate $(p,\ell,L)_q$-list-recoverable codes, the quantity we call the zero-rate threshold. Denoting this value by $p_*$, we in fact show that codes correcting a $p_*+\varepsilon$ fraction of errors must have size $O_{\varepsilon}(1)$, i.e., independent of $n$. Such a result is typically referred to as a ``Plotkin bound.'' To complement this, a standard random code with expurgation construction shows that there exist positive rate codes correcting a $p_*-\varepsilon$ fraction of errors. We also follow a classical proof template (typically attributed to Elias and Bassalygo) to derive from the zero-rate threshold other tradeoffs between rate and decoding radius for list-decoding and list-recovery. Technically, proving the Plotkin bound boils down to demonstrating the Schur convexity of a certain function defined on the $q$-simplex as well as the convexity of a univariate function derived from it. We remark that an earlier argument claimed similar results for $q$-ary list-decoding; however, we point out that this earlier proof is flawed.

cs.IT↗

arXiv2022

Smoothing Codes and Lattices: Systematic Study and New Bounds

In this article we revisit smoothing bounds in parallel between lattices $and$ codes. Initially introduced by Micciancio and Regev, these bounds were instantiated with Gaussian distributions and were crucial for arguing the security of many lattice-based cryptosystems. Unencumbered by direct application concerns, we provide a systematic study of how these bounds are obtained for both lattices $and$ codes, transferring techniques between both areas. We also consider multiple choices of spherically symmetric noise distribution. We found that the best strategy for a worst-case bound combines Parseval's Identity, the Cauchy-Schwarz inequality, and the second linear programming bound, and this holds for both codes and lattices and all noise distributions at hand. For an average-case analysis, the linear programming bound can be replaced by a tight average count. This alone gives optimal results for spherically uniform noise over random codes and random lattices. This also improves previous Gaussian smoothing bound for worst-case lattices, but surprisingly this provides even better results with uniform ball noise than for Gaussian (or Bernoulli noise for codes). This counter-intuitive situation can be resolved by adequate decomposition and truncation of Gaussian and Bernoulli distributions into a superposition of uniform noise, giving further improvement for those cases, and putting them on par with the uniform cases.

cs.IT↗

arXiv2022

Threshold Rates of Codes Ensembles: Linear is Best

In this work, we prove new results concerning the combinatorial properties of random linear codes. Firstly, we prove a lower bound on the list-size required for random linear codes over $\mathbb F_q$ $\varepsilon$-close to capacity to list-recover with error radius $\rho$ and input lists of size $\ell$. We show that the list-size $L$ must be at least $\frac{\log_q\binom{q}{\ell}-R}{\varepsilon}$, where $R$ is the rate of the random linear code. As a comparison, we also pin down the list size of random codes which is $\frac{\log_q\binom{q}{\ell}}{\varepsilon}$. This leaves open the possibility (that we consider likely) that random linear codes perform better than random codes for list-recoverability, which is in contrast to a recent gap shown for the case of list-recovery from erasures (Guruswami et al., IEEE TIT 2021B). Next, we consider list-decoding with constant list-sizes. Specifically, we obtain new lower bounds on the rate required for list-of-$3$ decodability of random linear codes over $\mathbb F_2$; and list-of-$2$ decodability of random linear codes over $\mathbb F_q$ (for any $q$). This expands upon Guruswami et al. (IEEE TIT 2021A) which only studied list-of-$2$ decodability of random linear codes over $\mathbb F_2$. Further, in both cases we are able to show that the rate is larger than that which is possible for uniformly random codes.

cs.IT↗

arXiv2020

Threshold rates for properties of random codes

Suppose that $P$ is a property that may be satisfied by a random code $C \subset \Sigma^n$. For example, for some $p \in (0,1)$, ${P}$ might be the property that there exist three elements of $C$ that lie in some Hamming ball of radius $pn$. We say that $R^*$ is the threshold rate for ${P}$ if a random code of rate $R^* + \epsilon$ is very likely to satisfy ${P}$, while a random code of rate $R^* - \epsilon$ is very unlikely to satisfy ${P}$. While random codes are well-studied in coding theory, even the threshold rates for relatively simple properties like the one above are not well understood. We characterize threshold rates for a rich class of properties. These properties, like the example above, are defined by the inclusion of specific sets of codewords which are also suitably "symmetric". For properties in this class, we show that the threshold rate is in fact equal to the lower bound that a simple first-moment calculation obtains. Our techniques not only pin down the threshold rate for the property ${P}$ above, they give sharp bounds on the threshold rate for list-recovery in several parameter regimes, as well as an efficient algorithm for estimating the threshold rates for list-recovery in general.

cs.IT↗

arXiv2020

Bounds for list-decoding and list-recovery of random linear codes

A family of error-correcting codes is list-decodable from error fraction $p$ if, for every code in the family, the number of codewords in any Hamming ball of fractional radius $p$ is less than some integer $L$ that is independent of the code length. It is said to be list-recoverable for input list size $\ell$ if for every sufficiently large subset of codewords (of size $L$ or more), there is a coordinate where the codewords take more than $\ell$ values. The parameter $L$ is said to be the "list size" in either case. The capacity, i.e., the largest possible rate for these notions as the list size $L \to \infty$, is known to be $1-h_q(p)$ for list-decoding, and $1-\log_q \ell$ for list-recovery, where $q$ is the alphabet size of the code family. In this work, we study the list size of random linear codes for both list-decoding and list-recovery as the rate approaches capacity. We show the following claims hold with high probability over the choice of the code (below, $\epsilon > 0$ is the gap to capacity). (1) A random linear code of rate $1 - \log_q(\ell) - \epsilon$ requires list size $L \ge \ell^{\Omega(1/\epsilon)}$ for list-recovery from input list size $\ell$. This is surprisingly in contrast to completely random codes, where $L = O(\ell/\epsilon)$ suffices w.h.p. (2) A random linear code of rate $1 - h_q(p) - \epsilon$ requires list size $L \ge \lfloor h_q(p)/\epsilon+0.99 \rfloor$ for list-decoding from error fraction $p$, when $\epsilon$ is sufficiently small. (3) A random binary linear code of rate $1 - h_2(p) - \epsilon$ is list-decodable from average error fraction $p$ with list size with $L \leq \lfloor h_2(p)/\epsilon \rfloor + 2$. The second and third results together precisely pin down the list sizes for binary random linear codes for both list-decoding and average-radius list-decoding to three possible values.

cs.IT↗

arXiv2019

LDPC Codes Achieve List Decoding Capacity

We show that Gallager's ensemble of Low-Density Parity Check (LDPC) codes achieves list-decoding capacity with high probability. These are the first graph-based codes shown to have this property. This result opens up a potential avenue towards truly linear-time list-decodable codes that achieve list-decoding capacity. Our result on list decoding follows from a much more general result: any $\textit{local}$ property satisfied with high probability by a random linear code is also satisfied with high probability by a random LDPC code from Gallager's distribution. Local properties are properties characterized by the exclusion of small sets of codewords, and include list-decodability, list-recoverability and average-radius list-decodability. In order to prove our results on LDPC codes, we establish sharp thresholds for when local properties are satisfied by a random linear code. More precisely, we show that for any local property $\mathcal{P}$, there is some $R^*$ so that random linear codes of rate slightly less than $R^*$ satisfy $\mathcal{P}$ with high probability, while random linear codes of rate slightly more than $R^*$, with high probability, do not. We also give a characterization of the threshold rate $R^*$.

cs.IT↗

arXiv2018

Coding for Interactive Communication with Small Memory and Applications to Robust Circuits

Classically, coding theory has been concerned with the problem of transmitting a single message in a format which is robust to noise. Recently, researchers have turned their attention to designing coding schemes to make two-way conversations robust to noise. That is, given an interactive communication protocol $\Pi$, an \emph{interactive coding scheme} converts $\Pi$ into another communication protocol $\Pi'$ such that, even if errors are introduced during the execution of $\Pi'$, the parties are able to determine what the outcome of running $\Pi$ would be in a noise-free setting. We consider the problem of designing interactive coding schemes which allow the parties to simulate the original protocol using little memory. Specifically, given any communication protocol $\Pi$ we construct robust simulating protocols which tolerate a constant noise rate and require the parties to use only $O(\log d \log s)$ memory, where $d$ is the depth of $\Pi$ and $s$ is a measure of the size of $\Pi$. Prior to this work, all known coding schemes required the parties to use at least $\Omega(d)$ memory, as the parties were required to remember the transcript of the conversation thus far. Moreover, our coding scheme achieves a communication rate of $1-O(\sqrt{\varepsilon})$ over oblivious channels and $1-O(\sqrt{\varepsilon\log\log\tfrac{1}{\varepsilon}})$ over adaptive adversarial channels, matching the conjecturally optimal rates. Lastly, we point to connections between fault-tolerant circuits and coding for interactive communication with small memory.

cs.DS↗

arXiv2017

On the List-Decodability of Random Linear Rank-Metric Codes

The list-decodability of random linear rank-metric codes is shown to match that of random rank-metric codes. Specifically, an $\mathbb{F}_q$-linear rank-metric code over $\mathbb{F}_q^{m \times n}$ of rate $R = (1-\rho)(1-\frac{n}{m}\rho)-\varepsilon$ is shown to be (with high probability) list-decodable up to fractional radius $\rho \in (0,1)$ with lists of size at most $\frac{C_{\rho,q}}{\varepsilon}$, where $C_{\rho,q}$ is a constant depending only on $\rho$ and $q$. This matches the bound for random rank-metric codes (up to constant factors). The proof adapts the approach of Guruswami, H\aa stad, Kopparty (STOC 2010), who established a similar result for the Hamming metric case, to the rank-metric setting.

cs.CC↗