The Partial-Inverse Approach to Linearized Polynomials and Gabidulin Codes With Applications to Network Coding

This paper introduces the partial-inverse problem for linearized polynomials and develops its application to decoding Gabidulin codes and lifted Gabidulin codes in linear random network coding. The proposed approach is a natural generalization of its counterpart for ordinary polynomials, thus providing a unified perspective on Reed–Solomon codes for the Hamming metric and for the rank metric. The basic algorithm for solving the partial-inverse problem is a common parent algorithm of a Berlekamp–Massey algorithm, a Euclidean algorithm, and yet another algorithm, all of which are obtained as easy variations of the basic algorithm. Decoding Gabidulin codes can be reduced to the partial-inverse problem via a key equation with a new converse. This paper also develops new algorithms for interpolating crisscross erasures and for joint decoding of errors, erasures, and deviations in random network coding.

In this paper, we are primarily interested in Gabidulin codes and lifted Gabidulin codes with the rank metric [2], [3], [4], [7]. Many of the decoding algorithms for these codes are inspired by the ones for Reed-Solomon codes. E.g., in the pioneering work [3], a key equation for Gabidulin codes is derived, and a right Euclidean algorithm for linearized polynomials is applied to the key equation; this algorithm may be seen as a generalization of Sugiyama's algorithm [36] from the Hamming metric to the rank metric. In [37], a transformed key equation is formulated, and solved by the Euclidean algorithm; the resulting algorithm is a generalization of Shiozaki-Gao's algorithm [38], [39], see also [30]. Similar equations are also developed in [7] and [8], which can be solved by the shift-register synthesis algorithm for linearized polynomials [40], [41], [42], which in turn is a generalization of the Berlekamp-Massey algorithm [43], [44]. Yet another well-known algorithm is the polynomial-reconstruction-based decoding algorithm [45], which can be seen as the rank-metric analog of Welch-Berlekamp algorithm [46].
All of these decoding algorithms can correct errors up to half the minimum rank distance, and most of them have complexity O(n 2 ) (in terms of finite-field operations, as a function of the block length n).
For completeness, we also mention a body of work on interleaved Gabidulin codes, e.g., [30], [47], [48], [49], and [50]. However, the development of the partial-inverse approach for interleaved Gabidulin codes is not addressed in the present paper.
Throughout this prior work, both the Euclidean algorithm and the Berlekamp-Massey algorithm play key roles. However, for these algorithms, the transition from classical Reed-Solomon codes (with the Hamming metric) to Gabidulin codes (with the rank metric) is technically far from trivial since linearized polynomials form a non-commutative ring.
For classical Reed-Solomon codes (for the Hamming metric), it is well known that the Berlekamp-Massey algorithm [43], [44] and the Euclidean decoding algorithm [36], [38], [39] are related, and nontrivial translations were given in [56], [57], [58], and [59]. More recently, the partial-inverse approach [51], [52] derives (versions of) these two algorithms as specializations or easy variations of a common parent algorithm. In addition, the partial-inverse approach offers a new interface-the partial-inverse problem-between these algorithms and their applications to decoding. In this paper, we develop the generalization of the partial-inverse approach to linearized polynomials and to the decoding of Gabidulin codes. We will see that, with the proper setup, much of [51] and [52] generalizes naturally, but new arguments are nonetheless needed at many points.
The paper is structured as follows. In Section II, we establish notation and summarize the required basics of linearized polynomials. In Section III, we define the partial-inverse problem for linearized polynomials, and we propose and prove the basic partial-inverse algorithm for its solution; the proof is new and simpler than the proof in [52]. In Section IV, we specialize the partial-inverse algorithm to (a version of) the Berlekamp-Massey algorithm, to (a version of) the Euclidean algorithm, and to yet another algorithm (the quotient-saving algorithm). In Section V, we recall the evaluation transform and connect it with the rank weight. In Section VI, we recall the definition of Gabidulin codes, and propose a key equation with a new converse. It will then be clear that decoding up to half the minimum rank distance is a partial-inverse problem. We also generalize multiply-divide interpolation from [51] and [52] to Gabidulin codes. In Section VII, in preparation for Section VIII, we propose new interpolation methods for different forms of erasures, viz., erased rows, erased columns, and combinations thereof. In Section VIII, we propose new methods for joint decoding of errors, erasures, and deviations in network coding.
Some of the proofs are given in the appendices, which contain also additional material. In Appendix B, we address minimal partial inverses and further properties of the partialinverse problem. Finally, in Appendix C (using results from Appendix B), we show that every partial-inverse problem can be transformed into an equivalent partial-inverse problem with a monomial modulus, to which the Berlekamp-Massey algorithm can be applied. The proof involves new arguments since the proof of the corresponding fact in [52,Theorem 2] does not seem to generalize to linearized polynomials.

A. Basics of Linearized Polynomials
Let F q be a finite field with q elements, let L be a positive integer, and let F q L be an extension field of F q . For fixed q and L, a linearized polynomial is a polynomial of the form with a ∈ F q L , = 0, 1, . . . , n. The sum of two linearized polynomials a(x) and b(x) is a linearized polynomial, but the ordinary product a(x)b(x) is not, in general, a linearized polynomial. Instead, the composition of two linearized polynomials is always a linearized polynomial [23]. Note that, in general, Indeed, with ordinary addition and with the composition (2) as "multiplication", the set of linearized polynomials (for fixed q and L) forms a non-commutative ring with multiplicative identity x. Throughout the paper, we denote this ring by The leading coefficient of a(x) will be denoted by lcf a(x), and lcf 0 = 0.
For nonzero polynomials a( . We refer to the division as right division of a(x) by b(x), and we denote the quotient polynomial g(x) by a(x) rdiv • b(x), and the remainder polynomial • of the largest degree that right divides both a(x) and b(x) will be denoted by rgcd(a(x), b(x)), which can be found by the right Euclidean algorithm for linearized polynomials [23].
Analogously, for any nonzero a( Following a standard convention, we define the notation x [ ] = x q . The polynomial in (1) can then be written as a(x) = n =0 a x [ ] , and the composition in (2) can be expressed as −i . Finally, we note the following simple fact. and are linear over F q L .

B. Linearized Polynomials and Vector Spaces
Linearized polynomials are intimately connected to vector spaces. We will often refer to vector spaces of the form (5), where F q L is an extension field of F q and S = {β 0 , . . . , β n−1 } is a subset of F q L . Then the subspace of F q L (over F q ) spanned by S is the set of all linear F q combinations of elements in S. The dimension of (5) will be denoted by dim span(β 0 , . . . , β n−1 ). Linearized polynomials get their name from the following basic fact [43].

III. THE PARTIAL-INVERSE PROBLEM AND THE BASIC ALGORITHM
Let F [x] • denote the ring of linearized polynomials over the extension field F q L of F q as in Section II.

A. The Problem
The pivotal concept of this paper is the following problem, which is the obvious generalization of the partial-inverse problem of [52] to linearized polynomials.

Theorem 1 (Uniqueness and Degree Bound):
The partialinverse problem for linearized polynomials has a unique solution (for every d ≥ 0), up to a scale factor in F q L . Moreover, the solution Λ(x) satisfies The theorem can be proved by using the argument in [52], which turns out to apply essentially unchanged to the setting of this paper. For completeness, the proof is given in Appendix A.
Proposition 6 (Reduced Partial-Inverse Problem): In consequence, let s = 2d − deg q m(x) > 0 and define the linearized polynomialsb(x) andm(x) withb = b +s andm = m +s for ≥ 0; then the modified partial-inverse problem with b(x), m(x), and d replaced byb(x),m(x), and d = d − s, respectively, has the same solution Λ(x) as the original partial-inverse problem.
The proposition can be proved by (7) and the argument in [52, Propositions 6 and 7].

B. The Basic Partial-Inverse Algorithm
The partial-inverse problem is solved by the basic algorithm stated as Algorithm 2 (in the framed box). Lines 7 and 8 of this algorithm are explained by the following lemma.

Algorithm 2.A:
Lines 8-12 of Algorithm 2 can be implemented as follows:

C. Preparations for the Proof
In preparation for the proof of the algorithm, we restate Algorithm 2 with added assertions as Algorithm 3 (see box), cf. [52]. Note that throughout the algorithm (except at the very beginning, before the first execution of lines 9 and 13), d 1 , d 2 , κ 1 , and κ 2 are defined as in Lemma 1, i.e., and r (x) as in (8)  As for (A.5) and (A.6), we note that line 8 changes the degree of Λ (x) as follows: The following lemma refers to Δ k and Λ k (x) as defined in (E.2), as well as to and r 0 (x) = m(x).
returned by the algorithm. Then (16) is obvious from the initialization (lines 4 and 5) and from line 9 of the algorithm. The point of the lemma is (17), which follows from the initialization and (13). Finally, (18) is immediate from (A.1).

D. Completing the Proof of the Algorithm
It is clear at this point that the algorithm returns a polynomial Λ(x) that satisfies (6). It remains to prove that Λ(x) has the smallest possible degree.

E. Remarks
The proof in Section III-D is new and simpler than the proof in [52]. This new proof also works for the setting of [52].
Variations of the basic partial-inverse algorithm and a discussion of their complexity will be given in Section IV. Concerning the latter, let N it be the number of executions of line 26 in Algorithm 2. This quantity is bounded by

Algorithm 4: Reverse Berlekamp-Massey Algorithm
In two important special cases, the computation of line 26 in Algorithm 2.A simplifies as follows.
In the special case where m(x) = x [ν] , line 26 amounts to The bound (27) can be proved as in [52], and (28) follows from (7). The weaker bound (28) can also be proved directly by noting that, in every iteration, the larger of the remainder degrees is reduced by at least 1.
Additional properties of the partial-inverse problem are discussed in Appendix B.

IV. REALIZATIONS OF THE PARTIAL-INVERSE ALGORITHM
The basic partial-inverse algorithm of the previous section can be implemented or specialized in different ways, including (a version of) the Berlekamp-Massey algorithm and (a version of) the Euclidean algorithm. The generalization of the corresponding algorithms from [52] turns out to be rather obvious.

A. The (Reverse) Berlekamp-Massey Algorithm
In the special cases m( , line 26 of Algorithm 2.A can be computed as in Algorithm 4, which looks very much like, and is as efficient as, the generalized Berlekamp-Massey algorithm [40], [41], [42].
Following [52], we refer to this algorithm as the reverse Berlekamp-Massey algorithm because, in applications to decoding, it processes the syndrome in the reverse order of the Berlekamp-Massey algorithm.
As stated, the (reverse) Berlekamp-Massey algorithm applies only to the case m( It is therefore noteworthy that a partial-inverse problem with general m(x) can always be transformed into an equivalent partial-inverse problem with m(x) = x [2τ ] , as shown in Appendix C.
From (28) and line 31, the complexity of this algorithm is easily seen to

B. The Remainder-Saving Algorithm (= Euclidean Algorithm)
A variation or implementation of Algorithm 2 for general m(x) is Algorithm 5 (see box), where we store and update the remainders r (x) and r (x) in (8) and (9). In consequence, the computation of line 26 (in Algorithm 2.A) is unnecessary. All other quantities in the algorithm remain unchanged.
Algorithm 5 may be viewed as a version of the (right) Euclidean algorithm (for linearized polynomials). The latter Algorithm 5: Remainder Saving Partial-Inverse Algorithm (Linearized Euclidean Algorithm) is well known in the literature for both ordinary polynomials and linearized polynomials, see, e.g., [3], [30], [36], [37], [38], [39], [52], and [66]. In other words, the well-known Euclidean algorithm actually solves the partial-inverse problem. From (28) and line 9, the complexity of this algorithm is easily seen to be O(ν(ν − d)) with ν = deg q m(x). (The computation in line 9 may be reduced by assuming a reduced partial-inverse problem according to Proposition 6.) Asymptotically faster versions of the Euclidean algorithm have been proposed in the literature.

C. The Quotient-Saving Algorithm
By storing and updating also the quotients q (x) and q (x) defined by with r (x) and r (x) as in (8) and (9), the coefficient of of r (x) (line 26 in Algorithm 2.A) can then be computed as with τ = deg q Λ (x) and ν = deg q q (x), and where both b = 0 and m = 0 for < 0. All other quantities in the algorithm remain unchanged. We then obtain Algorithm 6 (see box), which is a new algorithm of the Berlekamp-Massey type and achieves a generalization of Algorithm 4 to Algorithm 6: Quotient Saving Partial-Inverse Algorithm

A. Rank Metric
Let F q L be an extension field of F q . The notion of rank as a metric for codes was introduced in [2], [3], and [4]. In this paper, the rank distance between vectors in (F q L ) n will be defined as follows. For a vector a = (a 0 , . . . , a n−1 ) ∈ (F q L ) n , let span(a) be the subspace of F q L (over F q ) spanned by {a 0 , . . . , a n−1 } as in (5). The rank weight of a ∈ (F q L ) n is then defined as w R (a) = dim span(a), i.e., the dimension of span(a). Note that w R (a) = 0 if and only if a = 0;
Theorem 2 (Linearized Evaluation Transform): Let β 0 , . . . , β n−1 be linearly independent elements of F q L over F q , and let V be the set of linearized polynomials in F [x] • with q-degree less than n. Then, the mapping is a linear transform over F q L , i.e., ψ is linear over F q , injective and surjective. The inverse mapping is The inverse mapping (33) can be seen as a generalized Lagarange interpolation, cf., e.g., [5] and [30]. In the special case where n = L and B is a normal basis, the transform reduces to the q-transform of [8].
Proof: Let W = span(a 0 , . . . , a n−1 ) ⊂ F q L . Note that dim U = n ≥ dim W = w R (a). We then define the mapping Φ : U → W : β → A(β). Clearly, the mapping Φ is linear over F q , cf. Proposition 2; in addition, it is surjective since a = A(β ) for every . Therefore, the dimension of the kernel of Φ is dim ker Φ = dim U − dim W .

VI. DECODING GABIDULIN CODES
We now develop the partial-inverse approach to Gabidulin codes. The generalization of the corresponding material of [52] to linearized polynomials turns out to be straightforward. However, Proposition 10 and the converse part of Theorem 3 appear to be new results for Gabidulin codes.

A. Gabidulin Codes
Let F q L be an extension field of F q , and let β 0 , . . . , β n−1 be linearly independent elements of F q L over F q . An (n, k) Gabidulin code C (with blocklength n ≤ L and dimension k) can be defined via (32) as the set It is well known that Gabidulin codes are maximum distance separable codes in the rank metric [2], [3], [4]. In terms of rank weight defined in Section V-A, the minimum rank distance of C in (34) can be defined as d R (C) = min{w R (c − c ) : c, c ∈ C, c = c }, which satisfies Equation (35) is proved in [3] and [30]; another (simple) proof is given in Appendix D.

B. Error-Span Polynomial and Interpolation
The problem of decoding Gabidulin codes can be described as follows. Let y = (y 0 , . . . , y n−1 ) be a received word, which we wish to decompose into y = c + e where c ∈ C is a codeword and e = (e 0 , . . . , e n−1 ) ∈ (F q L ) n is the error with rank weight w R (e) as small as possible. Let , and Y (x) = ψ −1 (y) with ψ as in (32). We then have with deg q C(x) < k and deg q E(x) < n. The task of decoding is to recover C(x) from Y (x). Toward this end, we wish to find an error-span polynomial: 1 Definition 1 (Error-Span Polynomial): For any vector e = (e 0 , . . . , e n−1 ) ∈ (F q L ) n , an error-span polynomial Λ e (x) is a nonzero polynomial ∈ F [x] • of the smallest degree that vanishes on the subspace of F q L (over F q ) spanned by e 0 , . . . , e n−1 .
Proposition 8: The error-span polynomial Λ e (x) is unique up to a scale factor ∈ F q L , and it satisfies deg q Λ e (x) = w R (e).
Note that deg q m(x) = n by Proposition 3 and Corollary 2.
In the special case where m(x) = x [n] −x [0] , computing (39) amounts to a kind of cyclic convolution as in line 51 of Algorithm 4.

C. A Key Equation
Following [52, Theorem 6], we have the following theorem, the converse part of which is new (for linearized polynomials): Theorem 3 (A Key Equation): If w R (e) ≤ n−k 2 , then the error-span polynomial Λ e (x) satisfies Conversely, for any y and e ∈ (F q L ) n and t ∈ R with is the nonzero linearized polynomial of the smallest degree (unique up to a scale factor) that satisfies Note that Λ e (x) from (45) is a partial-inverse problem. Theorem 3 can be proved by using a similar idea as in [52]. However, the proof of the converse requires Proposition 7.
As for the converse, assume (43), (44), and deg q Λ(x) ≤ t. Consider Under the stated assumptions, the q-degree of the left-hand side of (46) is smaller than n − t, and deg q Λ( It follows that r(x) also vanishes on M and thus deg q r( • m(x). Proposition 9 concludes the proof.
2) Solve the key equation (45) by any of the algorithms in Section IV.
(If w R (e) ≤ n−k 2 , the polynomial Λ(x) returned by the algorithm equals Λ e (x), up to a scale factor.) 3) Complete decoding by Proposition 10.

For example, if m(x) = x [n] − x [0]
, Algorithm 4 can be applied to (45). In this case, computing (39) amounts to the "cyclic convolution" . Theorem 3 is versatile; along with Proposition 10, it can also be used to prove the correctness of the Shiozaki-Gao decoder [30], [37].
We also note that in solving (45), the number of iterations N it in Algorithm 2 is upper bounded by (n − k)/2 + w R (e), cf. (27). By contrast, the (standard, not the reverse) Berlekamp-Massey algorithm requires n − k iterations, which is typically larger.
Finally, we note that the division in (38) might have a nonzero remainder (if not all assumptions are satisfied). This condition should be checked; if it is violated, an uncorrectable error should be announced.

VII. INTERPOLATION
In this section, we consider erasure decoding and develop new interpolation methods for different types of erasures. (The results of this section are independent of the partial-inverse approach.) Below, an element in F q L will be viewed as a column vector of length L over F q , and a vector a = (a 0 , . . . , a n−1 ) in (F q L ) n is viewed as a L × n matrix over F q .
1) Interpolation of Row Erasures: Consider a received word y = c + e ∈ (F q L ) n , where c is a codeword ∈ C as in Section VI-A. The error e ∈ (F q L ) n is called a row(s) erasure if e corrupts only some rows of c ∈ (F q L ) n (viewed as a matrix over F q ) and the receiver knows the indices of the rows that are corrupted. In this case, C(x) = ψ −1 (c) in (36) can be recovered as follows.
Let Z r ⊂ {1, . . . , L} be a set consisting of (known) indices of the corrupted rows, and let δ i ∈ F q L (viewed as a column vector) be the transpose of (0, . . . , 0, 1, 0, . . . , 0) where 1 ∈ F q sits at position i. Then, we define a r ∈ (F q L ) |Zr| such that the components of a r are the vectors δ i , i ∈ Z r . For example, if Z r = {2, 5}, then a r = (δ 2 , δ 5 ).
Definition 2 (Row-Span Polynomial): For given a r ∈ (F q L ) |Zr| , a row-span polynomial Λ r (x) is nonzero polynomial in F [x] • of the smallest degree that vanishes on the subspace spanned by the components of a r .
Lemma 3: For any rows-erasure e with erasure index set Z r , it holds that span(e) ⊆ span(a r ) and Λ r ( Proof: For each e i of e = (e 0 , . . . , e n−1 ) ∈ (F q L ) n , we have e i ∈ span(a r ), and thus span(e) ⊆ span(a r ). The second claim then follows from Proposition 5.
The polynomial Λ r (x) in Lemma 3 can be computed by Algorithm 1. Note that deg q Λ r (x) = |Z r |.
The proof is immediate from Lemma 3 and Proposition 10.

2) Interpolation of Column Erasures:
Let Z c be a subset of {0, 1, . . . , n − 1}. Assume that the error e = (e 0 , . . . , e n−1 ) ∈ (F q L ) n in y = c + e satisfies e = 0 ∈ F q L for / ∈ Z c and with arbitrary (not necessarily nonzero) e for ∈ Z c . Assume that Z c is known by the decoder. In this case, the polynomial C(x) = ψ −1 (c) in (36) can be recovered by Proposition 12.
Proposition 12: Let S = {0, . . . , n − 1} \ Z c , and let m S (x) be a nonzero polynomial of the smallest degree that vanishes on β for all ∈ S.
3) Interpolation of Crisscross Erasures: For given received word y = c + e in (F q L ) n , suppose that e = r + z ∈ (F q L ) n where r is a rows erasure and z is a columns erasure. For rows-erasure r, we assume that the set of erasure positions Z r ⊂ {1, . . . , L} as in Section VII-1 (or a r ∈ (F q L ) |Zr | as in Lemma 3) is known by the decoder. For columns-erasure z, we assume that the set of column positions Z c ⊂ {0, . . . , n − 1} is known by the decoder: for ∈ Z c , the symbol y is useless and can be ignored; for ∈ Z c , z = 0 and y = c + r .
In this case, the polynomial C(x) = ψ −1 (c) in (36) can be recovered by the following proposition.
Proposition 13: Let Λ r (x) be a nonzero polynomial of the smallest degree that vanishes on span(a r ), and let m S (x) be a nonzero polynomial of the smallest degree that vanishes on β for all ∈ {0, . . . , n − 1} \ Z c . If |Z r | + |Z c | ≤ n − k, then where On the other hand, we have If Z c is empty, Proposition 13 reduces to Proposition 11; if r = 0, Λ r (x) = x and Proposition 13 reduces to Proposition 12. Note that both Propositions 11 and 12 are generalizations of [52,Propositions 8 and 9], see also [53], [54], [55], [67], and [68].

VIII. JOINT DECODING OF ERRORS, DEVIATIONS, AND ERASURES
In this section, we address the problem of simultaneously correcting errors, deviations, and erasures, which appears in random network coding [7]. Joint decoding of errors and crisscrosses erasures is included as a special case.

A. Channel Model: Errors, Deviations, and Erasures
Let β 0 , . . . , β n−1 be linearly independent elements of F q L over F q , and let m(x) ∈ F [x] • be a nonzero polynomial of the smallest degree that vanishes on β 0 , . . . , β n−1 . Moreover, let C be an (n, k) Gabidulin code as in Section VI-A.
As in Section VII, a codeword c ∈ C may be viewed as a L × n matrix over F q . By mapping each c ∈ C to a matrix X of the form X = [I, c T ] where I is a n × n identity matrix, a new code is obtained [7], which is commonly referred to as a lifted Gabidulin code.
Suppose that X is injected into a network applying network coding and the network is corrupted by errors, deviations, and erasures. Then by processing the received "packets" as in [7], we obtain where e ∈ (F q L ) n is an error, r ∈ (F q L ) n is a deviation, and z ∈ (F q L ) n is a special kind of erasure. The deviation r in (49) is a vector such that where a r ∈ (F q L ) wR(r) is some vector with rank weight w R (r), and B is a w R (r) × n matrix over F q ; the vector a r is known by the receiver, but B is unknown. The erasure z in (49) is a vector such that where a z ∈ (F q L ) wR(z) is some vector with rank weight w R (z), and P is a w R (z) × n matrix over F q ; the vector a z is unknown by the receiver, but P is known. The decoding problem is to recover c from y with the side information a r and P , which is referred to as the joint errors, deviations, and erasures decoding of Gabidulin codes. In the special case where (i) r in (50) is a rows erasure with known a r as in Section VII-1 and (ii) P in (51) has only w R (z) nonzero columns, then the problem reduces to joint errors and crisscrosses-erasures decoding as in [41], [60], and [61].
Below, we develop a new (simple) algorithm for this decoding problem, which is guaranteed to work correctly (i.e., to retrieve c) if

B. Outline of the Proposed Decoding Algorithm
By turning P in (51) into a columns erasure, the decoding problem (as described above) can be solved by combining the decoding algorithm of Section VI-D with interpolation as in Section VII.
In outline, the proposed algorithm goes as follows: 1) Determine the set S according to (55) and compute m S (x) as described above Lemma 5. 2) Compute Λ r as described above (59). (59).
At this point, we have a transformed decoding problem with m(x), Y (x), C(x), n, and k as in (53) replaced by , n , and k as in (61)- (63).

C. Details and Proof of the Proposed Decoding Algorithm
The task is to recover C(x) from Y (x).
If z = 0, then from the given P in (51), let T be an invertible n × n matrix over F q such that where P is a w R (z) × n matrix over F q with only w R (z) nonzero columns. Note that T is not unique. If z = 0, then T is an identity matrix. Then, we let Z c ⊂ {0, 1, . . . , n − 1} denote the indices of nonzero columns of P with |Z c | = w R (z), and let Moreover, let with T in (54).
For given a r in (50), let Λ r (x) ∈ F [x] • be a nonzero polynomial of the smallest degree that vanishes on span(a r ). Note that deg q Λ r (x) = w R (r). If r = 0, Λ r (x) = x.
Lemma 7: For given S and {β 0 , . . . , β n−1 } in (55) and (56), let e ∈ (F q L ) |S| be a vector such that every component of e corresponds to a E (β ) for every ∈ S. Then, it holds that w R (e ) ≤ w R (e).
• be a nonzero polynomial of the smallest degree that vanishes on E (β ) for every ∈ S. Propositions 9 and 10, Theorems 3, and Corollary 3 hold with Λ e (x), E(x), m(x), Y (x), C(x), n, and k replaced by Λ e (x), E (x), m S (x), Y (x), C (x), n , and k , respectively.
The decoding algorithms proposed in [7] and [30] are based on the Berlekamp-Massey algorithm (for linearized polynomials) and the Euclidean algorithm, respectively. The algorithm proposed in this section can be implemented with any of the Algorithms in Section IV and works for general m(x).
The proposed decoding method (implemented with Algorithms 4-6) has complexity O(n 2 ) over F q L , which is practical unless n − k is large. If n − k is very large 2 , sub-quadratic decoding can be obtained by using, e.g., the asymptotically faster operations in [64] for computing Λ r (x), Y (x), and m S (x) in (59), cf. Table I of [64], together with an asymptotically faster Euclidean algorithm (cf. Section IV-B).

IX. CONCLUSION
We have generalized the partial-inverse approach from ordinary polynomials to linearized polynomials, and developed its application to Gabidulin codes and to lifted Gabidulin codes in random network coding. As with ordinary polynomials, the basic partial-inverse algorithm is a common parent algorithm of the (reverse) Berlekamp-Massey algorithm, the Euclidean algorithm, and the quotient-saving algorithm, and the partial-inverse problem is a natural common interface between these algorithms and their applications to decoding. The generalization to linearized polynomials was mostly straightforward, but new arguments were required for several key points. The basic partial-inverse algorithm itself was proved by a new and simpler proof, which also works for ordinary polynomials.
Decoding Gabidulin codes has been reduced to the partialinverse problem via a key equation with a new converse. We have also developed new algorithms for interpolating crisscross erasures and for joint decoding of errors, erasures, and deviations in random network coding.

APPENDIX A PROOF OF THEOREM 1
The following proof of Theorem 1 adapts the proof of Propositions 1-3 of [52] to linearized polynomials.
Proof of Theorem 1: We first prove uniqueness. Assume that Λ (1) (x) and Λ (2) (x) are two solutions of the problem, which implies deg q Λ (1) and consider Then Clearly, (70) implies that Λ(x) also satisfies (6). But (68) implies deg q Λ(x) < deg q Λ (1) (x), which is a contradiction unless Λ(x) = 0. Thus Λ(x) = 0, which means that Λ (1) (x) and Λ (2) (x) are equal up to a scale factor. It remains to prove existence and the degree bound. The case d = deg q m(x) is obvious, for which Λ(x) = x will do. Otherwise, let n = deg q m(x) and ν = deg q m( given by Clearly, this mapping is linear over F q L by Proposition 1, and it has a nontrivial kernel by (71). But any nonzero element in the kernel corresponds (by (72)) to a nonzero Λ(x) that satisfies (6) and (7).

APPENDIX B MORE ABOUT THE PARTIAL-INVERSE PROBLEM
This section generalizes the results in [52, Section III] to linearized polynomials.

A. Minimal Partial Inverses
Definition (Minimal Partial Inverse): In the following, we often refer to the partial-inverse problem as defined in Section III. Let Λ(x) = Λ null (x) be the solution of the partial-inverse problem for d = 0.
Proposition 14 (Minimal Partial Inverses Solve Partial-Inverse Problems): The solution Λ(x) of the partial-inverse problem is a minimal partial inverse of b(x) rmod • m(x).
Conversely, Λ(x) = Λ null (x) solves the partial-inverse problem with d = 0; every other minimal partial inverse Λ(x) of b(x) rmod • m(x) solves the partial-inverse problem with Proposition 14 corresponds to [52,Proposition 4] and can be proved in the same way.
Proposition 15 (Minimal Partial Inverses of the Same Degree Are Unique): For fixed nonzero b(x) and Proposition 15 corresponds to [52,Proposition 5] and can be proved in the same way.
In consequence, we have Proposition 16 (Chain of Minimal Partial Inverses): Let
The proof can be based on Lemma 2 or on Lemma 8. Proof of Proposition 18: First, we note that (87) holds for i = 1 since deg q Λ (1) (x) = 0 and r (0) (x) = m(x). Now, we assume that (87) holds for i = j, 1 ≤ j ≤ K − 1; we will prove that (87) holds for i = j + 1. From Proposition 17, we have where the last step follows from (87) with i = j.

C. Degree Bound With a Converse
The following Theorem 5 is an amalgam of Lemma 8 and Proposition 18. Theorem 5 will be used to prove (the converse part of) Theorem 6, which in turn will be used to prove Theorem 7.
Then by Proposition 14, Λ (x) equals Λ (i) (x) for some i ∈ {1, . . . , K} (up to a scale factor), and deg q r ( , which agrees with (78). We next note from (92) and deg q r (i) (x) < d that where the last step follows from (77) and from deg q m(x) = deg q Λ (i) (x)+ deg q r (i−1) (x) by Proposition 18. The theorem then follows from Lemma 8. Theorem 6 (Degree Bound with a Converse): and where In the special case where g(x) = 0, (99) requires Λ(x) = αx for some nonzero α ∈ F q L . Theorem 6 is a generalization of [52, Theorem 1] to linearized polynomials, which will be needed for the proof of Theorem 7. (The converse part of the proof in [52, Theorem 1] does not seem to generalize to linearized polynomials.) Proof of Theorem: 6: Let For the direct part, assume that Λ(x) is a minimal partial inverse of b(x). Then (98) is immediate from Proposition 14 and (7) of Theorem 1. As for (99), assume that lgcd Λ(x), g(x) = c(x) with deg q c(x) > 0, i.e., (101), we then have It follows that c(x) left divides r(x), i.e., for some r (x) ∈ F [x] • , and thus For the converse part, we assume that some nonzero Λ(x) satisfies (98) where Λ (x) is the solution of the partial-inverse problem with d = deg q r(x) + 1. But Λ(x) and g(x) satisfy (99), which implies a(x) = γx for some nonzero γ ∈ F q L . We therefore have Λ(x) = γΛ (x), which is a minimal partial inverse, cf. Proposition 14.

APPENDIX C MONOMIALIZED PARTIAL-INVERSE PROBLEM
Consider a partial-inverse problem with general m(x) (as stated in Section III) and d < deg q m(x). Let n = deg q m(x) and τ = n−d > 0. Further, let andb Theorem 7 (Monomialized Partial-Inverse Problem): The partial-inverse problem with general m(x) and d < deg q m(x) can be transformed into another partial-inverse problem where (6) is replaced by withb(x) defined in (109). The modified problem (110) has the same solution Λ(x) as the original problem and we have Note that w(x) in (108) can be precomputed and deg q w(x) = 2τ − 1. Note also that deg qb (x) < 2τ .
Proof of Theorem 7: Let Λ(x) be the solution of the original partial-inverse problem (which is unique up to a nonzero scale factor), and let r(x) = Λ(x)•b(x) rmod • m(x), where deg q r(x) < d. We then write for some (unique) g(x) with where the second inequality follows from Theorem 1. Note that lgcd Λ(x), g(x) = x by Theorem 6 and Proposition 14.

A. Remarks
This section generalizes most of the results in [52, Section III] to linearized polynomials and contains also some results without a counterpart in [52]. In particular, Lemma 8, Proposition 17, and Theorem 5 are new. Proposition 18, Theorem 6, and Theorem 7 generalize their counterparts in [52], but their proofs require different arguments than in [52].

APPENDIX D MINIMUM RANK DISTANCE
Let C be a code as in (34). The following fact was proved in [3].
An alternative proof was given in [30]. Yet another proof goes as follows.
Proof of Proposition 19: Eq. (121) is clear since C is a linear code. It remains to prove (122). By Proposition 7, for any nonzero c ∈ C, ψ −1 (c) vanishes on a subspace of dimension n − w R (c). It then follows (by Corollary 2) that deg q ψ −1 (c) ≥ n − w R (c). But deg q ψ −1 (c) < k, and thus w R (c) > n − k.