Classical locally recoverable codes (LRCs) with locality r constitute an important class of error-correcting codes for distributed storage systems, enabling the recovery of an erased symbol by accessing at most r other symbols. Recently, Golowich and Guruswami introduced a quantum analogue of classical LRCs, known as quantum locally recoverable codes (qLRCs) with locality r, motivated by their potential applications in future quantum data storage systems. In this paper, motivated by asymmetric quantum codes (AQCs), we introduce quantum locally recoverable codes with asymmetric locality (rX, rZ), which distinguish between the recovery from X-type errors and that from Z-type errors. We establish a connection between qLRCs with asymmetric locality (rX, rZ) and classical LRCs. Furthermore, for qLRCs with asymmetric locality (rX, rZ) constructed via the CSS construction, we derive a Singleton-like bound and characterize when this bound is attained. Finally, we construct several families of pure and CSS-optimal qLRCs with asymmetric locality parameters (rX, rZ) based on classical LRCs.

We study the notion of exceptional clique, a subset of a ring such that the difference of any two distinct elements of the subset is invertible. Motivated by applications in cryptography, our main focus is to determine the largest size of an exceptional clique in the ring Mat_n× n(ℤ) of square n× n matrices over the integers, for every n. We obtain several results for the question above, both in the general case and the “commutative” case where we additionally require that the elements in the clique commute with each other. As highlights, we prove that, at least for some values of n, the largest exceptional cliques in Mat_n× n(ℤ) are necessarily non-commutative; we then show that for an infinite family of n, there are non-commutative exceptional cliques of size n^2, and that for every n there are commutative exceptional cliques of size 2/3 n+O(n^θ), for a constant θ>11/20.

Code-based Distributed Matrix Multiplication (DMM) has been extensively studied in distributed computing for efficiently performing large-scale matrix multiplication using coding theoretic techniques. The communication cost and recovery threshold (i.e., the least number of successful worker nodes required to recover the product of two matrices) are two major challenges in coded DMM research. Several constructions based on Reed-Solomon (RS) codes are known, including Polynomial codes, MatDot codes, and PolyDot codes. However, these RS-based schemes are not efficient for small finite fields because the distributed order (i.e., the total number of worker nodes) is limited by the size of the underlying finite field. Algebraic geometry (AG) codes can have a code length exceeding the size of the finite field, which helps solve this problem. Some work has been done to generalize Polynomial and MatDot codes to AG codes, but the generalization of PolyDot codes to AGcodes still remains an open problem as far as we know. This is because functions of an algebraic curve do not behave as nicely as polynomials. In this work, by using local expansions of functions, we are able to generalize the three DMM schemes based on RS codes to AG codes. Specifically, we provide a construction of AG-based PolyDot codes for the first time. In addition, our AG-based Polynomial and MatDot codes achieve better recovery thresholds compared to previous AG-based DMM schemes while maintaining similar communication costs. Our constructions are based on a novel basis of the Riemann-Roch space using local expansions, which naturally generalizes the standard monomial basis of the univariate polynomial space in RS codes. In contrast, previous work used the non-gap numbers to construct a basis of the Riemann-Roch space, which can cause cancellation problems that prevent the conditions of PolyDot codes from being satisfied.

The past few years have witnessed the growing importance of pseudorandom correlation generators (PCGs) for generating correlated randomness with sublinear communication. To date, quasi-linear time PCGs for oblivious linear evaluation (OLE) over arbitrary finite fields have been constructed under either Ring-LPN or Quasi-Abelian syndrome decoding (QA-SD) assumptions, with a throughput of millions of OLEs per second demonstrated, in particular, for the binary field. However, many modern MPC protocols deal with large prime fields, in which existing PCGs suffer from a significant efficiency gap due to a quasi-linear number of multiplications involved in FFT (Fast Fourier Transform) algorithms. Moreover, FFT typically relies on FFT-friendly fields that contain large smooth multiplicative subgroups, and therefore are not well-suited to popular fields, such as Mersenne prime fields. In this work, we close the gap by leveraging the well-known Walsh-Hadamard transform (WHT) in the context of QA-SD based PCGs. Although WHT is still a quasi-linear time algorithm like normal FFTs, no multiplication is needed – addition and subtraction suffice. Since multiplications over a prime field 𝔽_p typically incur an O(logp) overhead over additions, our scheme that avoids a large number of multiplications perfectly fits the large prime field setting. Moreover, we show that with overwhelming probability, the underlying random QA code has a high relative distance, e.g., 0.268 for rate 1/4. Experimental results show that WHT is at least one magnitude faster than FFT over a 64-bit smooth prime field. Consequently, our PCG achieves 27, 000 OLE per second over a 64-bit prime field. This is the first full implementation of PCG for OLE over an arbitrary large prime field that we are aware of. We then build PCG for vector-OLE over arbitrary large prime fields from QA-SD assumptions, and fully implement it using the library. We achieve a throughput of over 5, 000, 000 vector-OLEs per second over a 64-bit prime field, roughly four times faster than state-of-the-art PCGs from either expand-accumulate (EA) codes (Boyle et al., CRYPTO 2022), or expand-convolute (EC) codes (Raghuraman et al., CRYPTO 2023).

Previously implemented zero-knowledge proof of inference (zk-PoI) frameworks all have both their discretization ring and proof soundness tight up to a fixed-size finite field, and the benchmarked efficiency depends, to a large extent, on the existence of some specific prime number (Mersenne 2^61-1 , Goldilocks 2^64-2^32+1 ). Implementing these frameworks outside that particular parameter range incurs significant slowdown and requires a total re-write of the low-level codes. To eliminate this sore spot, we put forward a tunable zk-PoI framework that allows customized independent fine-tuning of the desired size of the discretization ring and soundness without interfering with each other, and without altering the low-level design logic. Moreover, the efficiency degrades gracefully as the desired ring size or security level increases without abrupt jumps. We implement the tunable zk-PoI framework using ZK protocols over ℤ_2^k . In particular, we integrate, into the modified framework, the recent successful line of works building generic ZKP and efficient conversions over ℤ_2^k in the VOLE-based ZK protocol paradigm, which features fast proof generation and optimal memory footprint. We also provide ℤ_2^k variant of the other required sub-protocols in the zk-PoI framework not discussed in the mentioned line of works and propose new optimizations. Our implementation shows that working over ℤ_2^k not only enables fine-tuning of parameters, but also simplifies the design of verification circuits, which translates into efficiency gain. We compare the performance of our protocols against Mystique, in the same hardware/software environment and at its best performing parameter range. The experimental results show an up to 3.9 times improvement in time and 1.5 in communication over Mystique. Optimizations of verification algorithms for linear layer computation in machine learning have played an important role in the previously implemented zk-PoI frameworks. We take on the challenge of enabling similar optimizations in the tunable zk-PoI framework by studying the ℤ_2^k equivalent of these algorithms. In particular, we tackled the challenging problem of extending the Freivald’s sublinear-time algorithm for verifying matrix multiplication to work over ℤ_2^k .

In this work, we consider dishonest majority MPC protocols with (1-ϵ )n corrupted parties for some constant ϵ∈ (0,1/2) . In this setting, there exist MPC protocols with unanimous abort that achieve constant communication in both online and offline phases via a packed secret sharing scheme. Departing from their approaches, we revisit the “committee-based” approach to design an efficient MPC protocol with constant online and offline communication complexity. To balance the communication load of each party, our protocol adopts multiple committees, each of constant size. The computation of circuit C is then divided into layers, each assigned to one committee. To securely transmit messages between committees, we introduce the handoff gates, incurring only a slight communication overhead. Furthermore, we leverage circuit-dependent preprocessing and incremental checking to improve the online efficiency. Compared to other MPC protocols in the same corruption setting, our protocol achieves the smallest concrete total communication complexity. Building upon our multi-committee unanimous-abort protocol, we upgrade it to identifiable abort by adapting a technique from (Rivinius, EUROCRYPT 2025). To integrate this technique into our setting, we adjust the verification timing and introduce a king party to reduce the communication complexity of openings. This yields the first identifiable-abort MPC protocol with constant communication complexity in the sub-optimal dishonest majority setting.

Lund et al. (JACM 1992) invented the powerful Sumcheck protocol that has been extensively used in complexity theory and in designing concretely efficient (zero-knowledge) arguments. In this work, we systematically study Sumcheck in the context of secure multi-party computation (MPC). Our main result is a new unified framework for lifting semi-honest MPC protocols to maliciously secure ones, with a small constant multiplicative overhead in both computation and communication. In general, our approach applies to any semi-honest, linear secret-sharing based dishonest majority MPC secure up to additive attacks, where linear secret-sharing can be enhanced with an authentication mechanism. At a high-level, our approach has a highly distributive flavor, where the parties jointly emulate a Sumcheck prover to prove the correctness of MPC semi-honest evaluations in zero-knowledge, while simultaneously emulating a Sumcheck verifier to verify the proof themselves. Equipped with our new techniques, we design a SPDZ-style MPC protocol with 5N+O(logN) online communication per party and sublinear preprocessing based on efficient pseudorandom correlation generators (PCGs), where N is the circuit size. This substantially improves the 6N communication achieved in Le Mans (CRYPTO 2022), the state-of-the-art in the SPDZ line of works. Technically, the savings are obtained by using a Sumcheck-based mechanism to check N unverified authenticated multiplication triple relations, which requires only N+1 standard Beaver triples and O(logN) random authenticated shares, rather than N additional unverified authenticated triples needed by a “sacrifice” strategy. We also show concrete benefits for honest majority MPC protocols based on Shamir secret sharing. Compared to the best known approach in this scenario (Goyal et al. CRYPTO 2020) based on fully linear interactive oracle proofs (FLIOPs), asymptotically we achieve the same O(N) additive overhead in computation and O(logN) additive overhead in communication. However, we replace the O(logN) double sharings used there with O(logN) random sharings, and reduce the soundness error from O(N/|𝔽|) to O(logN/|𝔽|) , where 𝔽 is the underlying field.

MDS codes have garnered significant attention due to their wide applications in practice. To date, most known MDS codes are equivalent to Reed-Solomon codes. The construction of non-Reed-Solomon (non-RS) type MDS codes has emerged as an intriguing and important problem in both coding theory and finite geometry. Although some constructions of non-RS type MDS codes have been presented in the literature, the parameters of these MDS codes remain subject to strict constraints. In this paper, we introduce a general framework of constructing [n,k] MDS codes using the idea of selecting a suitable set of evaluation polynomials and a set of evaluation points such that all nonzero polynomials have at most k-1 zeros in the evaluation set. Moreover, these MDS codes can be proved to be non-Reed-Solomon by computing their Schur squares. Furthermore, several explicit constructions of non-RS MDS codes are given by converting to combinatorial problems. As a result, new families of non-RS MDS codes with much more flexible lengths can be obtained and most of them are not covered by the known results.

Modern efficient secure multi-party computation (MPC) protocols typically follow an offline-online design, where offline protocols produce a sufficient amount of correlated randomness that would be consumed during the online phases. The past decades have witnessed maturing of efficient online protocols, for computing circuits over either arbitrary finite fields or rings Z (p)k. In particular, protocols tailored for Z 2k arithmetic have achieved better concrete efficiency in most real-life applications, as it naturally captures modern CPU architectures. On the other hand, a recent paradigm of pseudorandom correlation generator (PCG) initiated by Boyle et al. (CCS'18, Crypto'19) opens a door to efficient preprocessing with sublinear communication. Since then, PCGs have been extensively studied and developed to produce various types of correlations required from online protocols. Although Li et al. (EuroCrypt'25) recently put a significant step forward and propose efficient PCGs for arbitrary finite fields, the current state of PCGs for rings is not satisfying at all. Towards the great demand for efficiently generating correlations over rings, we investigate PCGs for general Galois rings, which simultaneously unify finite fields and integer rings modulo p(k). In summary, we establish the following results: (i) We generalize the state-of-the-art PCG constructions for oblivious linear evaluations (OLE) over Galois fields to arbitrary Galois rings, basing on Galois theory and the Hensel lift. Moreover, our PCGs for Galois rings are as efficient as PCGs for fields. Concretely, for mN OLE correlations over Z (2)k, we require O(m log N) communication and O(m(2)N log N) computation, where m is an arbitrary integer >= 2. In comparison, to our best knowledge, previous approaches incur communication at least linear in N. (ii) We extend the above OLE construction to provide various types of correlations over any Galois ring. One of the fascinating applications is an efficient PCG for two-party SPDZ (2)k authenticated multiplication triples (Crypto'18). For mN SPDZ (2)k triples, our approach requires only O(m log N) communication and O(m(2)N log N) computation. Concrete evaluations show that our method significantly outperforms existing schemes based on homomorphic encryption. (iii) In addition, our PCGs for Galois rings also enable multi-party multiplication triple generation, yielding the first efficient MPC protocol for arithmetic circuits over Z (2)k with silent and sublinear preprocessing. Additional applications include circuit-dependent preprocessing and matrix multiplication triples, etc., which are of independent interest.

Modern efficient secure multi-party computation (MPC) protocols typically follow an offline-online design, where offline protocols produce a sufficient amount of correlated randomness that would be consumed during the online phases. The past decades have witnessed maturing of efficient online protocols, for computing circuits over either arbitrary finite fields or rings ℤ_p^k . In particular, protocols tailored for ℤ_2^k arithmetic have achieved better concrete efficiency in most real-life applications, as it naturally captures modern CPU architectures. On the other hand, a recent paradigm of pseudorandom correlation generator (PCG) initiated by Boyle et al. (CCS’18, Crypto’19) opens a door to efficient preprocessing with sublinear communication. Since then, PCGs have been extensively studied and developed to produce various types of correlations required from online protocols. Although Li et al. (EuroCrypt’25) recently put a significant step forward and propose efficient PCGs for arbitrary finite fields, the current state of PCGs for rings is not satisfying at all. Towards the great demand for efficiently generating correlations over rings, we investigate PCGs for general Galois rings, which simultaneously unify finite fields and integer rings modulo p^k . In summary, we establish the following results:

Dittmer, Ishai and Ostrovsky (ITC’21) proposed line-point zero-knowledge proof (LPZK), a simple “commit-and-prove” system, motivated by practical protocols for compressing correlated pseudorandomness used in secure multiparty computation (MPC). Typically, LPZK admits concretely efficient ZK protocols with a streaming, linear time prover, but a linear size proof. A natural question raised in the context is how far can we go in minimizing the proof size, while maintaining the prover efficiency. Though a recent work by Lin, Xing and Yao (ASIACRYPT’24) gives an interactive LPZK with a sublinear proof size O(n+d^2log|𝒞|) , it is still far from being succinct, where n,d,|𝒞| are referred to as input size, circuit depth, and circuit size, respectively. In this work, we beat the proof size barrier and propose succinct LPZK arguments, by distilling techniques from orthogonal studies on homomorphic secret sharing and succinct garbling. Specifically, under variants of group/lattice-based assumptions, we show the followings: i) There exist succinct LPZK arguments with common reference string (CRS) size O(n^2/3) , proof size O(n^2/3) , prover time O(n^4/3+|𝒞|) , verification time O(n+|𝒞|) , and negligible soundness error, where both the prover and the verifier executions and be run in a streaming fashion. ii) The above proof size can be further optimized to O(1), at the cost of a larger CRS size O(n), and prover time increased to O(n^2+|𝒞|) . In general, our succinct LPZK arguments pave a new way for building designated-verifier zero-knowledge succinct non-interactive arguments of knowledge (dv-zkSNARKs), and new interesting features (e.g., streaming, constant sized proof with CRS size not proportional to the circuit size) are obtained for the first time along the way.

Encoding and decoding of Reed-Muller codes have been a major research topic in coding and theoretical computer science communities. Despite of the fact that there have been numerous encoding and decoding algorithms in the literature, most of them are not quasi-linear time algorithms for arbitrary order Reed-Muller codes. Under the decoding framework proposed by Pellikaan and Wu (IEEE TIT, 2004) which regards Reed-Muller codes as subfield subcodes of Reed-Solomon codes, we propose a new decoding algorithm for Reed-Muller codes that improves previous polynomial decoding complexity to quasilinear complexity. Our new decoding algorithm includes multivariate multipoint evaluation (MPE) and interpolation under a new basis of the multivariate polynomial space as two main steps. We show that the MPE and interpolation at certain multipoint sets can be performed in quasi-linear time as well. Our approach is based on a well-known transform between univariate polynomials and multivariate polynomials. We make use of the key fact that the transformation matrix between univariate polynomials and multivariate polynomials is sparse. Due to sparsity, MPE and interpolation of multivariate polynomials and decoding of Reed-Muller codes can be reduced to MPE and interpolation of univariate polynomials and decoding of Reed-Solomon codes without extra cost respectively, i.e, the complexity of MPE and interpolation of multivariate polynomials (and, respectively, decoding of Reed-Muller codes) is dominated by that of MPE and interpolation of univariate polynomials (and, respectively, decoding of Reed-Solomon codes). As a result of this reduction, we obtain our quasi-linear time algorithms.

Succinct non-interactive arguments of knowledge (SNARKs) allow a weak verifier to delegate computation tasks to a powerful prover in a verifiable way. However, most SNARK constructions require the computation tasks to be represented as arithmetic circuits over finite fields, incurring a significant overhead when applied for delegations of modern computer programs, which typically are of Z(264) or Z(232) arithmetics. The only exception is Rinocchio (JoC 2023), which builds the first SNARK for rings and features constant proof size. Due to Z (2k) being lack of large evaluation sets for polynomial interpolations, Rinocchio resorts to Galois ring extensions of Z (2k). However, Rinocchio is designated-verifier and the concrete efficiency is unclear at the moment. Towards building publicly verifiable SNARKs for rings Z (2k), we follow the well-established framework of polynomial interactive oracle proofs (IOP)-based SNARKs, and obtain the following results: i) We systematically study the proximity gaps for Reed-Solomon codes over Galois rings. We prove that for Galois rings, the state-of-the-art (1-rho)/2 gap for finite fields given by Ben-Sasson et al. (JACM 2023) still holds. This allows to construct efficient polynomial commitment schemes for Galois rings based on Reed-Solomon codes. ii) We construct efficient polynomial IOPs for rank one constraint systems (R1CS) over Z (2k) via Galois rings. To amortize the overhead of operating on a large Galois ring extension of Z (2k), we make use of the reverse-multiplication friendly embeddings (RMFEs) techniques. iii) Combining the above two ingredients together, we put forward the first publicly verifiable SNARKs for rings Z(2k) with a transparent setup and plausibly post-quantum security. In addition, we implement and evaluate our constructions. Our evaluations indicate the concrete efficiency is promising, provided that Galois rings operations are optimized well.

Correlated randomness lies at the core of efficient modern secure multi-party computation (MPC) protocols. Costs of generating such correlated randomness required for the MPC online phase protocol often constitute a bottleneck in the overall protocol. A recent paradigm of pseudorandom correlation generator (PCG) initiated by Boyle et al. (CCS’18, Crypto’19) offers an appealing solution to this issue. In sketch, each party is given a short PCG seed, which can be locally expanded into long correlated strings, satisfying the target correlation. Among various types of correlations, there is oblivious linear evaluation (OLE), a fundamental and useful primitive for typical MPC protocols on arithmetic circuits. Towards efficient generating a great amount of OLE, and applications to MPC protocols, we establish the following results:

Fast encoding and decoding of codes have always been an important topic in coding theory as well as complexity theory. Although encoding is easier than decoding in general, designing an encoding algorithm of codes of length N with quasi-linear complexity $O(N\log N)$ is not an easy task. Despite of the fact that algebraic geometry codes (AG codes) were discovered in the early 1980s, encoding algorithms of algebraic geometry codes with quasi-linear complexity $O(N\log N)$ have not been found except for the simplest algebraic geometry codes-Reed-Solomon codes. The best-known encoding algorithm of algebraic geometry codes based on a class of plane curves has quasi-linear complexity at least $O(N\log <^>{2} N)$ (Beelen et al. IEEE Trans. Inf. Theory 2021). In this paper, we design an encoding algorithm for algebraic geometry codes with quasi-linear complexity $O(N\log N)$ . Moreover, for these fast encodable AG codes, the inverse of encoding, that is, interpolating the message function from the corresponding codeword, can be computed with the same complexity $O(N\log N)$ . Our algorithms are applicable to a large class of algebraic geometry codes based on both plane and non-plane curves, including Kummer extensions, Artin-Schreier extensions, and Hermitian field towers.

In this paper, we show that random Gabidulin codes of block length n and rate R achieve the (average-radius) list decoding capacity of radius 1 - R - epsilon in the rank metric with an order-optimal column-to-row ratio of O(epsilon). This extends the recent work of Guo, Xing, Yuan, and Zhang (FOCS 2024), improving their column-to-row ratio from O( (epsilon) (n)) to O(epsilon). For completeness, we also establish a matching lower bound on the column-to-row ratio for capacity-achieving Gabidulin codes in the rank metric. Our proof techniques build on the work of Guo and Zhang (FOCS 2023), who showed that randomly punctured Reed-Solomon codes over fields of quadratic size attain the generalized Singleton bound of Shangguan and Tamo (STOC 2020) in the Hamming metric. The proof of our lower bound follows the method of Alrabiah, Guruswami, and Li (SODA 2024) for codes in the Hamming metric.

Despite of tremendous research on decoding Reed-Solomon (RS) and algebraic geometry (AG) codes under the random and adversary substitution error models, few studies have explored these codes under the burst substitution error model. Burst errors are prevalent in many communication channels, such as wireless networks, magnetic recording systems, and flash memory. Compared to random and adversarial errors, burst errors often allow for the design of more efficient decoding algorithms. However, achieving both an optimal decoding radius and quasi-linear time complexity for burst error correction remains a significant challenge. The goal of this paper is to design (both list and probabilistic unique) decoding algorithms for RS and AG codes that achieve the Singleton bound for decoding radius while maintaining quasi-linear time complexity. Our idea is to build a one-to-one correspondence between AG codes (including RS codes) and interleaved RS codes with shorter code lengths (or even constant lengths). By decoding the interleaved RS codes with burst errors, we derive efficient decoding algorithms for RS and AG codes. For decoding interleaved RS codes with shorter code lengths, we can employ either the naive methods or existing algorithms. This one-to-one correspondence is constructed using the generalized fast Fourier transform (G-FFT) proposed by Li and Xing (SODA 2024). The G-FFT generalizes the divide-and-conquer technique from polynomials to algebraic function fields. More precisely speaking, assume that our AG code is defined over a function field E which has a sequence of subfields 𝔽_q(x)=E_r⊆ E_r-1⊆⋯⊂ E_1⊆ E_0=E such that E_i-1/E_i are Galois extensions for 1≤ i≤ r. Then the AG code based on E can be transformed into an interleaved RS code over the rational function field 𝔽_q(x).