Interpolation-Based Decoding of Folded Variants of Linearized and Skew Reed–Solomon Codes

. The sum-rank metric is a hybrid between the Hamming metric and the rank metric and suitable for error correction in multishot network coding and distributed storage as well as for the design of quantum-resistant cryptosystems. In this work, we consider the construction and decoding of folded linearized Reed– Solomon (FLRS) codes, which are shown to be maximum sum-rank distance (MSRD) for appropriate parameter choices. We derive an eﬃcient interpolation-based decoding algorithm for FLRS codes that can be used as a list decoder or as a probabilistic unique decoder. The proposed decoding scheme can correct sum-rank errors beyond the unique decoding radius with a computational complexity that is quadratic in the length of the unfolded code. We show how the error-correction capability can be optimized for high-rate codes by an alternative choice of interpolation points. We derive a heuristic upper bound on the decoding failure probability of the probabilistic unique decoder and verify its tightness by Monte Carlo simulations. Further, we study the construction and decoding of folded skew Reed–Solomon codes in the skew metric. Up to our knowledge, FLRS codes are the ﬁrst MSRD codes with diﬀerent block sizes that come along with an eﬃcient decoding algorithm.


Introduction
The sum-rank metric was first considered in [28] in the context of space-time coding and covers the Hamming metric as well as the rank metric as special cases.Alternative decoding metrics as the sum-rank metric are of great interest to the field of code-based cryptography (see e.g.[35]).Other applications range from error control in multishot network coding as described in [31] and [33] to the construction of locally repairable codes [32].
Martínez-Peñas introduced linearized Reed-Solomon (LRS) codes, which generalize the well-studied families of Reed-Solomon (RS) and Gabidulin codes, in [30].LRS codes are maximum sum-rank distance (MSRD) codes, that is their minimum distance achieves the Singleton-like bound with equality.
While codewords of sum-rank-metric codes are commonly defined as tuples containing matrices of arbitrary sizes, most known constructions use the same number of rows for every matrix in the tuple.Some examples of MSRD codes with different numbers of rows for the matrices can be found in [11,12].Another construction for MSRD codes with this property is given in [14,15].However, no efficient decoding algorithm has been developed for such codes up to our knowledge.We address this by presenting the family of folded linearized Reed-Solomon (FLRS) codes along with an efficient interpolationbased decoding algorithm that can be used for list and probabilistic unique decoding.
We further apply our results to the skew-metric regime where we fold skew Reed-Solomon (SRS) codes.SRS codes were introduced and studied in [9,27] with respect to Hamming metric and rank metric.The work [30] defined the skew metric and analyzed SRS codes in this new context.In fact, it was shown that the sum-rank metric and LRS codes are the linearized version of the skew metric and SRS codes, respectively.
The idea of folding constructions in coding evolved in the Hamming-metric context with Parvaresh-Vardy codes [34] and folded Reed-Solomon codes [10,19].Folded Gabidulin codes and their efficient decoding in the rank metric were studied in [2,3,6].
Contributions Note that parts of this work were presented at WCC 2022: The Twelfth International Workshop on Coding and Cryptography (see [20]).
We define the family of FLRS codes and derive an interpolation-based decoding framework for these codes.In contrast to [20], we allow different block sizes in the underlying unfolded code as well as the usage of different folding parameters.This yields codes whose codewords are matrix tuples consisting of matrices having not the same size.We further lift the restriction to skew polynomials with zero derivation and also deal with nonzero derivations.
As in [20], we show how the decoding scheme can be used for list and probabilistic unique decoding and give bounds on the list size and the failure probability, respectively.We have performed several Monte Carlo simulations that verify the heuristic upper bound on the failure probability empirically.Moreover, new simulations show the reasonability of an assumption which is needed to obtain the heuristic bound.
A Justesen-like approach, which yields an improved interpolation-based decoding scheme for high-rate FLRS codes, and the discussion of implications for the skew metric are completely new topics in this work.More precisely, we introduce folded skew Reed-Solomon (FSRS) codes in the skew metric in a similar fashion as FLRS codes and show how the proposed FLRS decoding scheme can be applied.
Outline We start by giving some preliminaries in Section 2 before defining FLRS codes and studying their minimum distance in Section 3.
The main part of this paper is Section 4 in which we present and investigate an interpolation-based decoding scheme for FLRS codes.The decoder consists of an interpolation step and a root-finding step which are explained in detail in Section 4.1 and Section 4.2, respectively.Section 4.3 shows how the presented scheme can be used for list and probabilistic unique decoding.In particular, we derive an upper bound on the list size in the first case and on the failure probability in the latter.Section 4.4 introduces a variant of the decoding scheme that is tailored to high-rate codes by using a different set of interpolation points.Since the bound on the failure probability for probabilistic unique decoding from Section 4.3 is heuristic, we empirically verify its validity by simulations in SageMath in Section 4.5.
Section 5 deals with the implications of our results for the skew-metric setting.We give some background on the remainder evaluation of skew polynomials and the skew metric in Section 5.1 and introduce FSRS codes in Section 5.2.Section 5.3 shows how the presented decoder for FLRS codes in the sum-rank metric can be applied to FSRS codes in the skew metric.
Finally, Section 6 concludes the paper by summarizing our work and giving open problems and directions for further research.

Preliminaries
Let q be a prime power and let F q be a finite field of order q.For any m ∈ N * , let F q m ⊇ F q denote an extension field with q m elements.We call α ∈ F q m primitive in F q m if it generates the multiplicative group F * q m := F q m \ {0}.An (integer) composition of n ∈ N * into ℓ ∈ N * parts, which is also called an ℓcomposition for short, is a vector n = (n 1 , . . ., n ℓ ) ∈ N ℓ with n i > 0 for all 1 ≤ i ≤ ℓ that satisfies n = ℓ i=1 n i .We use the notation F n q := F n1 q × • • • × F n ℓ q to describe the space of F n q -vectors that are divided into ℓ blocks with respect to a given ℓ-composition n of n.Similarly, we write F o×n q := F o1×n1 q × • • • × F o ℓ ×n ℓ q for ℓ-compositions o of o and n of n.In the following, we always assume o ≤ n with respect to the product order on N ℓ , that is o i ≤ n i holds for each i = 1, . . ., ℓ.
The sum-rank metric d ΣR is defined as for two elements X, Y ∈ F o×n q .
A linear sum-rank-metric code C is an F q -linear subspace of the metric space (F o×n q , d ΣR ).Its minimum (sum-rank) distance is If o = (m, . . ., m) for some m ∈ N * , we sometimes write codewords as (m × n)matrices over F q instead of matrix tuples from F o×n q .Moreover, a code C in this ambient space has a vector-code representation C vec := {ext −1 γ (C) : C ∈ C} ⊆ F n q m over F q m .Here, the map ext −1 γ is the inverse of the extension map ext γ that extends a vector a ∈ F n q m to a matrix A ∈ F m×n q with respect to a fixed ordered F q -basis γ = (γ 1 , . . ., γ m ) of F q m .Namely, Note that we omit the index γ if the particular choice of the basis is irrelevant.The Frobenius automorphism of the field extension F q m /F q is the map θ : F q m → F q m with θ(x) = x q for all x ∈ F q m .It is F q -linear, fixes F q elementwise, and generates the group of all F q -linear automorphisms on F q m with respect to function composition.We focus on an arbitrary F q -linear automorphism σ on F q m in the following.In particular, σ = θ u holds for a u ∈ {0, . . ., m − 1}.A σ-derivation is a map δ : Since we work over finite fields, any σ-derivation is an inner derivation which means that δ = z(Id −σ) for a z ∈ F q m and the identity Id (see [30,Prop. 44]).
Two elements a, b ∈ F q m are called (σ, δ)-conjugate if there is a c ∈ F * q m such that a c := σ(c)ac −1 +δ(c)c −1 = b.This is an equivalence relation and F q m is hence partitioned into conjugacy classes C(a) := a c : c ∈ F * q m for a ∈ F q m (see e.g.[21,22]).A counting argument shows that there are q gcd(u,m) distinct conjugacy classes and all except C(z) are called nontrivial.If δ = 0 (i.e., z = 0) and σ = θ, the powers 1, α, . . ., α q−2 of a primitive element α ∈ F * q m are representatives of all q gcd(1,m) − 1 = q − 1 distinct nontrivial conjugacy classes.
The skew polynomial ring F q m [x; σ, δ] is defined as the set of polynomials i f i x i with finitely many nonzero coefficients f i ∈ F q m .It forms a non-commutative ring with respect to ordinary polynomial addition and multiplication determined by the rule for the set of skew polynomials of degree less than k ≥ 0.
We further introduce the operator D a (b) := σ(b)a + δ(b) for any a, b ∈ F q m and we write D i a (b) := D a (D i−1 a (b)) for its i-th power with i ∈ N * .Let n = (n 1 , . . ., n ℓ ) ∈ N ℓ be an ℓ-composition of n ∈ N * .For a vector x = x (1) , . . ., x (ℓ) ∈ F n q m , a vector a = (a 1 , . . ., a ℓ ) ∈ F ℓ q m , and a parameter d ∈ N * the generalized Moore matrix M d (x) a is defined as where and d := (d, . . ., d) ∈ N ℓ .If a contains representatives of pairwise distinct nontrivial conjugacy classes of F q m and rk q x (i) = n i for all 1 ≤ i ≤ ℓ, we have by [30,Thm. 2] and [22,Thm 4.5] that rk q m (M d (x) a ) = min(d, n).
The generalized operator evaluation of a skew polynomial f ∈ F q m [x; σ, δ] at b ∈ F q m with respect to the evaluation parameter a ∈ F q m is defined as f (b) a = i f i D i a (b) and can be written in vector-matrix form using the generalized Moore matrix from (1).For a = (a 1 , . . ., a ℓ ) ∈ F ℓ q m and x = (x (1) , . . ., x (ℓ) ) ∈ F n q m we use the shorthand notation Let a 1 , . . ., a ℓ be representatives of distinct nontrivial conjugacy classes of F q m and consider n i F q -linearly independent elements and all 1 ≤ i ≤ ℓ has degree at least ℓ i=1 n i (see e.g.[13]).
Definition 2 (Linearized Reed-Solomon Codes [30,Def. 31]).Let a = (a 1 , . . ., a ℓ ) ∈ F ℓ q m contain representatives of pairwise distinct nontrivial conjugacy classes of F q m and consider an ℓ-composition n := (n 1 , . . ., n ℓ ) ∈ N ℓ of n ∈ N. Let the vectors q m contain F q -linearly independent elements for all i = 1, . . ., ℓ and define β := (β (1) , . . ., β (ℓ) ) ∈ F n q m .A linearized Reed-Solomon code of length n and dimension k ≤ n is defined as Observe that the parameter restrictions in Definition 2 also imply restrictions on the length that LRS codes can achieve.Since the evaluation parameters a 1 , . . ., a ℓ have to belong to distinct nontrivial conjugacy classes, the number of blocks ℓ is upper bounded by the number of these classes.As we know from Section 2, F q m has q gcd(u,m) −1 distinct nontrivial conjugacy classes, where u ∈ {0, . . ., m − 1} is defined by the equality σ = θ u for the Frobenius automorphism θ of F q m /F q .Thus, ℓ ≤ q gcd(u,m) − 1 has to apply.At the same time, the code locators β (i) of the i-th block have to contain F q -linearly independent elements for all i = 1, . . ., ℓ which implies n i ≤ m.This means that the length n of an LRS code is always bounded by n ≤ (q gcd(u,m) − 1) • m.
The next lemma is taken from [11, Lemma III.12] and lays the foundation for a Singleton-like bound for sum-rank-metric codes with different block sizes.
for each z ∈ {0, . . ., n}.If we denote by j ∈ {1, . . ., ℓ} and λ ∈ {0, . . ., n j − 1} the unique integers that satisfy We can think about this result in the context of a matrix tuple from F m×n q where we are allowed to mark z columns.Our goal is then to maximize the number of marked entries which is given as ℓ i=1 o i z i .Since the matrices are sorted descendingly with respect to their number of rows, the logical strategy is to mark the first z columns.The index j then corresponds to the first block for which we cannot mark every column anymore.

Folded Linearized Reed-Solomon Codes
Code classes obtained by a folding construction have been considered starting from RS and Gabidulin codes in [19] and [3,6], respectively.Let us describe the folding process for a codeword c of length n and a folding parameter h that divides n.We obtain the folded codeword by subdividing c into n h pieces of length h and using them as columns of a matrix of size h× n h .The folded code is simply the collection of all folded codewords.
The folding operation can be expressed by means of the folding operator where n, N ∈ N * denote the length of the unfolded and folded vector, respectively, and where the folding parameter h ∈ N * divides n with N = n h .Its inverse allows to unfold a matrix and is denoted by F −1 h .This paper focuses on folding LRS codes which are a generalization of both RS and Gabidulin codes.Since LRS codes are naturally equipped with a block structure, we apply the described folding mechanism blockwise to obtain FLRS codes.Observe that since the length of the blocks may vary, we may choose a different folding parameter for each block.This produces sum-rank-metric codes whose codeword tuples consist of matrices with different numbers of rows and columns.A visual representation of the folding construction for a particular block of an LRS codeword is given in Figure 1.A formal description is the following generalization of the above discussed folding operator: x (1) , . . ., x (ℓ) → F h1 (x (1) ), . . ., F h ℓ (x (ℓ) ) .
Here, vectors of length n are divided into ℓ blocks according to the ℓ-composition n and the vector h = (h 1 , . . ., h ℓ ) contains the different folding parameters for the blocks.The corresponding inverse map, i.e. the blockwise unfolding operation, is denoted by F −1 h .
Definition 3 (Folded Linearized Reed-Solomon Codes).Consider an LRS code C := LRS[β, a; n, k] with β (i) := (1, α, . . ., α ni−1 ) ∈ F ni q m for a primitive element α of F q m and all i = 1, . . ., ℓ. Choose a vector h = (h 1 , . . ., h ℓ ) ∈ N ℓ of folding parameters satisfying h i | n i and N i := ni hi ≤ h i for all 1 ≤ i ≤ ℓ and write N := (N 1 , . . ., N ℓ ).The h-folded variant of C is the h-folded linearized Reed-Solomon code FLRS[α, a, h; N, k] of length N := ℓ i=1 N i and dimension k defined as The ambient space of this code is F h×N q m and we can interpret the folded code as vector code of length N over the field F q d with extension degree d := m • lcm(h 1 , . . ., h ℓ ) over F q .However, linearity is only guaranteed with respect to the subfield F q m and due to the F q m -linearity of the unfolded LRS code.
To make the above definition more explicit, note that there is a message polynomial for all i ∈ {1, . . ., ℓ}.
We can further draw conclusions about the maximum length of FLRS codes, similar to the LRS case.Let us therefore assume that the parameters of the unfolded code are maximal.In other words, choose an LRS code C in Definition 3 with ℓ = q gcd(u,m) − 1 same-sized blocks of length m and resulting overall code length n = (q gcd(u,m) − 1) • m (see Section 2 for the definition of u and the derivation of this statement).Since we want to maximize the length of the folded code, we choose h i for each i = 1, . . ., ℓ as small as possible such that h i | n i and N i := ni hi ≤ h i hold.As all blocks have the same length, we select the same folding parameter h for each block and it has to satisfy h | m and m ≤ h 2 .We cannot get any better than h = √ m and thus obtain the upper bound N ≤ (q gcd(u,m) − 1) • √ m on the total length N of FLRS codes.
Remark 1.Note that we only consider a subclass of LRS codes for folding.Namely, we choose the code locators as powers of a primitive element α ∈ F * q m .This turns out to be crucial for the interpolation-based decoder that we present in Section 4.
The blue line illustrates the terminology "folding".
Theorem 2 (Minimum Distance).Let C := FLRS[α, a, h; N, k] be an FLRS code and assume without loss of generality that where j ∈ {1, . . ., ℓ} is the unique choice that satisfies In particular, C achieves the Singleton-like bound (2) with equality if and only if h j divides both k and h i N i for all i = j + 1, . . ., ℓ.
Proof.Let C = (C (1) , . . ., C (ℓ) ) ∈ C be the nonzero codeword corresponding to the message polynomial f ∈ F q m [x; σ, δ] <k .Then there are z, z 1 , . . ., z ℓ ≥ 0 with z = ℓ i=1 z i such that wt ΣR (C) = N − z and rk q (C (i) ) = N i − z i for i = 1, . . ., ℓ.Let us denote by RCEF(C) ∈ F h×N q m the blockwise-reduced column-echelon form of C which is obtained by bringing each block C (i) independently in its reduced column-echelon form with respect to F q as follows: first obtain a matrix C (i) q ∈ F mhi×ni q by replacing each row of the block C (i) with its extended matrix that is obtained via ext γ for an arbitrary F q -basis γ of q in reduced column-echelon form (e.g. by Gaussian elimination) and finally apply the inverse operation ext −1 γ to the matrix blocks and get back a (h i × n i )matrix over F q m .Since ext −1 γ preserves the zero columns and rk q (C (i) ) = N i − z i , the number of nonzero columns in the i-th block of RCEF(C) is N i − z i .Thus, the overall number of nonzero entries is certainly upper-bounded by ℓ i=1 h i (N i − z i ).We further obtain an upper bound on the last result by finding the vector z = (z 1 , . . ., z ℓ ) that realizes for a fixed z.With Lemma 1, the maximum equals When we shift the focus to the zero entries of RCEF(C), we naturally obtain the lower bound ℓ i=y h i N i − h y ε with y and ε as before, since the number of zero and nonzero entries adds up to ℓ i=1 h i N i .Note that the F q m -semilinearity of the generalized operator evaluation ensures that for each 1 ≤ i ≤ ℓ the entries of the i-th block of RCEF(C) are still F q -linearly independent and can be expressed as evaluations of f with respect to the evaluation parameter a i .Since the number of F q -linearly independent roots of f with respect to evaluation parameters from distinct nontrivial conjugacy classes is bounded by its degree and deg(f On the other hand, the Singleton-like bound for F q -linear sum-rank-metric codes (see Theorem 1) yields As we can choose a minimum-weight codeword C in the above reasoning, we can replace N − z by d ΣR (C) in (4).But then there are only two possibilities for the relationship between the indices y and j and the parameters ε and λ.Namely, Let us focus on the first case.We get by substituting ε for the equality condition in (4).We then shift the first summand h y N y of the first sum into the second sum, do some transformations, and finally use the integrality of the left-hand side as well as the fact ⌊x⌋ = ⌈x − 1⌉ for any real number x to obtain Similarly, substituting λ for the equality condition in (5) yields As j = y holds, the right-hand side of ( 7) is less than or equal to the left-hand side of (8).But since the left-hand side of ( 7) and the right-hand side of ( 8) are equal, all inequalities in the chain must be equalities and we get where j ∈ {1, . . ., ℓ} is unique with 0 Let us move on to the second case and recall that ε = 0. Therefore, we can replace the factor 6) with h y−1 .Similar transformations as above and again the integrality of the left-hand side yield Since we have j = y − 1 in this case, the right-hand side of ( 10) is less than or equal to the left-hand side of (8).But, as in the first case, the left-hand side of ( 10) and the right-hand side of (8) are equal.Hence, the inequalities are in fact equalities and we obtain (9).The Singleton-like bound is met if and only if h y divides k − ℓ i=y+1 h i N i , which is equivalent to h y dividing k as well as h i N i for each i = 1, . . ., ℓ.This concludes the proof.
Remark 2. Theorem 2 needs an FLRS code to satisfy h 1 ≥ • • • ≥ h ℓ for technical reasons.However, this is not a restriction since we can simply reorder the blocks of a sumrank-metric code without changing its weight distribution or its minimum distance.Formally speaking, we choose a permutation π from the symmetric group S ℓ for which

Interpolation-Based Decoding of Folded Linearized Reed-Solomon Codes
In this section we derive an interpolation-based decoder for FLRS codes that is based on the Guruswami-Rudra decoder for folded Reed-Solomon (FRS) codes [19] and the Mahdavifahr-Vardy decoder for folded Gabidulin codes [29].As channel model we consider an additive sum-rank channel that relates the input is performed componentwise.We denote the sum-rank weight of the error E = (E (1) , . . ., E (ℓ) ) ∈ F h×N q m by wt ΣR (E) = t and its weight decomposition by t = (t 1 , . . ., t ℓ ) with t i = rk q (E (i) ) for all i = 1, . . ., ℓ. E is chosen uniformly at random from the set of all tuples in F h×N q m having a fixed weight t as well as a weight decomposition belonging to a prescribed set of decompositions.
Note that the decodability of a specific error will in general depend on its weight decomposition and not only on the chosen code, the error weight t, and the decoder's parameters (see Theorem 3).When we consider codes using the same folding parameter h ∈ N * for all blocks, only the error weight t decides if an error is decodable for the chosen code and decoder.
As is typical for interpolation-based decoding, our decoder consists of two steps that we will describe in the following: interpolation and root finding.In the first phase, we construct interpolation points from the received word R and obtain a multivariate skew polynomial Q that satisfies certain conditions.In the second phase, we use the interpolation polynomial Q to find candidates for the message polynomial and hence for the transmitted codeword.

Interpolation Step
We first choose an interpolation parameter s ∈ N * satisfying s ≤ min i∈{1,...,ℓ} where the constraint arises from the selection method of the interpolation points.The latter are elements of F s+1 q m whose last s entries are obtained from the received word R using a sliding-window approach.Namely, we place a window of size s × 1 on the top left corner of R and slide it down one position at a time as long as each position of the window covers an entry of R. Then the window is moved to the next column, starting the same process again from the top.The first entry of an interpolation point obtained in this way is the code locator corresponding to the window's starting position, that is a power of the primitive element α.
Formally speaking, we consider for each i = 1, . . ., ℓ the two sets and w+1 , . . ., r where P i contains all interpolation points corresponding to the i-th block R (i) of R.
The index set W i consists of all eligible starting positions for the sliding window within R (i) and each interpolation point can be naturally identified with a tuple (w, i) with w ∈ W i and i ∈ {1, . . ., ℓ}.Note that, by construction, the set of all interpolation points P := Example 1.Consider an FLRS code with folding parameters h = (3, 2) and folded block lengths N = (2, 2).Choose s = 2 and denote R according to (11), i.e.
We wish to find a multivariate skew interpolation polynomial Q that satisfies certain interpolation constraints and has the form where Q r (x) ∈ F q m [x; σ, δ] for all r ∈ {0, . . ., s}.The generalized operator evaluation of such a polynomial Q ∈ F q m [x, y 1 , . . ., y s ; σ, δ] at a given interpolation point p = (p 0 , . . ., p s ) ∈ F s+1 q m with respect to an evaluation parameter a ∈ F q m is defined as Problem 1 (Interpolation Problem).Let a parameter D ∈ N * , a set P = ℓ i=1 P i of interpolation points and evaluation parameters a 1 , . . ., a ℓ be given.Find a nonzero (s + 1)-variate skew polynomial Q of the form ( 14) satisfying 1. E Q (p) ai = 0 for all p ∈ P i and i ∈ {1, . . ., ℓ} as well as 2. deg(Q 0 ) < D and deg(Q r ) < D − k + 1 for all r ∈ {1, . . ., s}.
Note that the evaluation parameters a 1 , . . ., a ℓ are the entries of a of the considered FLRS code FLRS[α, a, h; N, k].
Problem 1 can be solved using skew Kötter interpolation from [26] (similar as in [7, Sec.V]) requiring at most O(sn 2 ) operations in F q m in the zero-derivation case.There exist fast interpolation algorithms [4,5] that can solve Problem 1 requiring at most O(s ω M(n)) operations in F q m in the zero-derivation case, where O(•) denotes the soft -O notation (which neglects log factors), M(n) ∈ O(n 1.635 ) is the cost of multiplying two skew-polynomials of degree at most n and ω < 2.37286 is the matrix multiplication exponent [24].
Since the second condition of the interpolation problem allows us to write with all coefficients from F q m , we can also solve Problem 1 by solving a system of F q m -linear equations whose coefficient matrix describes the first condition of the interpolation problem.We collect all interpolation points from P i as rows in a matrix for each 1 ≤ i ≤ ℓ and denote its columns by p i,0 , . . ., p i,s .Define further Then, Problem 1 can be written as Example 2. Let us continue Example 1 with k = 2 and derive the corresponding interpolation matrix for the choice D = 3.As we will see shortly in Lemma 2, this choice guarantees the existence of a nonzero solution of ( 16).We get (1) 3 (1) 5 (1) 6 (2) 4 and hence the interpolation matrix S is given by (1) 2 ) 2 ) r (1) 3 ) 5 D a1 (r 5 D a1 (r 6 D a1 (r 2 ) 3 ) r (2) ) Proof.A nontrivial solution of ( 16) exists if less equations than unknowns are involved.
The number of equations corresponds to the number of interpolation points and hence the condition on the existence of a nonzero solution reads as follows: Since D is integral, the statement follows.
If the same folding parameter is used for each block, that is if there is a h ∈ N * such that h = h i holds for all 1 ≤ i ≤ ℓ, this reduces to which coincides with [20, Lemma 2].Note that this is still true for different numbers of columns N 1 , . . ., N ℓ .
Lemma 3 (Roots of Polynomial).Define the univariate skew polynomial and write t i := rk q (E (i) ) for 1 ≤ i ≤ ℓ.Then there exist F q -linearly independent elements Proof.Since rk q (E (i) ) = t i , there exists a nonsingular matrix T i ∈ F Ni×Ni q such that E (i) T i has only t i nonzero columns for every i ∈ {1, . . ., ℓ}.Without loss of generality assume that these columns are the last ones of E (i) T i and define containing the code locators 1, . . ., α ni−1 (cp.( 3)).Note that the first noncorrupted interpolation points according to (13).Now, for each 1 ≤ i ≤ ℓ, the first entries of the (N i − t i )(h i − s + 1) noncorrupted interpolation points (i.e. the top left submatrix of size (N i − t i ) × (h i − s + 1) of ζ (i) ) are by construction both F q -linearly independent and roots of P (x).
Theorem 3 (Decoding Radius).Let Q(x, y 1 , . . ., y s ) be a nonzero solution of Problem 1.If the error-weight decomposition t = (t 1 , . . ., t ℓ ) satisfies Proof.By Lemma 3, there exist elements (Ni−ti)(hi−s+1) in F q m that are F qlinearly independent for each i ∈ {1, . . ., ℓ} such that P (ζ P (x) exceeds the degree bound from [13, Prop.1.3.7]which is possible only if P (x) = 0. Together with inequality (18), we get Note that the left-hand side equals the number of erroneous interpolation points.Intuitively speaking, a rank error in a block with many rows is worse than one in a block with a small folding parameter because it creates more corrupted interpolation points.This is due to the fact that we can interpret a rank error in the i-th block as a symbol error over the extension field F q h i corresponding to h i F q -errors.
Even though Theorem 3 describes the admissible decoding radius, the derived condition does not only depend on the sum-rank weight t of the error but also on its weight decomposition t = (t 1 , . . ., t ℓ ).If we focus on the simpler special case of using the same folding parameter h ∈ N * for all blocks, formula (20) simplifies to the same inequality as in [20, Thm.1] that only depends on the error weight t.Namely, This yields the desirable property that we can characterize all decodable errors simply as the ones lying in a sum-rank ball.
In this case, we derive the normalized decoding radius τ := t N from (23) as where R := k hN denotes the code rate.In the more general case, we can imagine the set of decodable error patterns as a sum-rank ball with some additional bulges.We can derive from ( 24) that all errors with sum-rank weight t satisfying for h max := max i∈{1,...,ℓ} h i can be decoded for sure.This corresponds to the ball.On the other hand, the buldges represent specific decodable error-weight decompositions having larger sum-rank weight.However, the worst-case bound with h min := min i∈{1,...,ℓ} h i shows that the code can definitely not correct error patterns of weight t exceeding its right-hand side.Table 1 contains some examples for codes and the error patterns they can decode.
Condition (21) is equivalent to all coefficients of the polynomial on the left-hand side of (21) being zero.Multiple application of σ −1 to the equations resulting from the coefficients allows to express Problem 2 as an F q m -linear system of equations in the unknown As e.g. in [6,37], we use a basis of the interpolation problem's solution space instead of choosing only one solution Q of system (16).This improvement is justified by the following result.
Lemma 4 (Number of Interpolation Solutions).For d I := dim q m (ker(S)) with S defined in (16), it holds Proof.The first D columns of S are given as (M D (p 0 ) a ) ⊤ .Since the ℓ blocks of p 0 consist of pairwise distinct powers of α, the elements of a single block are F q -linearly independent.Hence rk q m (M D (p 0 ) a ) = min(D, ℓ i=1 N i (h i − s + 1)) = D, where the last equality follows from equation (22).In the absence of an error, the remaining columns consist of linear combinations of the first D ones and do not increase the rank.If an error E with wt ΣR (E) = t is introduced, at most ℓ i=1 t i (h i − s + 1) interpolation points are corrupted according to Lemma 3. As a consequence, these columns can increase the rank of S by at most ℓ i=1 t i (h i − s + 1).Thus, rk q m (S) ≤ D + ℓ i=1 t i (h i − s + 1) and the rank-nullity theorem directly yields Again we get a simpler bound when we consider the same folding parameter h ∈ N * for each block (cp.[20,Lemma 4]): Let now Q (1) , . . ., Q (dI ) ∈ F q m [x, y 1 , . . ., y s ; σ, δ] form a basis of the solution space of Problem 1 and denote the coefficients of Q (u) by q (u) i,j for all 1 ≤ u ≤ d I (cp.( 15)).In other words, we write for all u ∈ {1, . . ., d I } s,j x j y s .(σ a (α))
The root-finding system (28) can be solved by back substitution in at most O(k 2 ) operations in F q m since we can focus on (at most) k nontrivial equations from different blocks of d I rows.Observe that the transmitted message polynomial f ∈ F q m [x; σ, δ] <k is always a solution of (28) as long as t = (t 1 , . . ., t ℓ ) satisfies the decoding radius in (20).
Example 3. Let us set up the root-finding problem for the FLRS code considered in Example 1 and Example 2. We obtain P (x) = q 0,0 + q 0,1 x + q 0,2 x 2 Q0(x) Now we define B j (x) := q 1,j + q 2,j x ∈ F q m [x] for j ∈ {0, 1, 2} and write the coefficients of P (x) = p 0 + p 1 x + p 2 x 2 as follows: p 0 = q 0,0 + f 0 (q 1,0 + q 2,0 α) = q 0,0 + f 0 B 0 (α) Because p i = 0 for all i ∈ {0, 1, 2}, application of σ −i to the equation belonging to p i does not change the solution space of the above system of equations.Hence, we can equivalently solve the root-finding system

List and Probabilistic Unique Decoding
The interpolation-based scheme from above is summarized in Algorithm 1 and can be used for list decoding or as a probabilistic unique decoder.In the first case, all solutions of (28) are returned as a list of candidate message polynomials.Note that this list contains all message polynomials corresponding to codewords having sum-rank distance less than the decoding radius from the actually sent codeword.However, there may also be some candidates in the list that lie outside of the sum-rank ball around the sent codeword.In the second case, the decoder returns the unique solution of (28) or declares a decoding failure if there are multiple candidates.Let us investigate the usage of our decoding scheme as list decoder and bound its output size as follows: Algorithm 1: Interpolation-Based Decoding of FLRS Codes 1: Choose s ≤ min i∈{1,...,ℓ} hi and D according to (17) 2: Compute the sets P1, . . ., P ℓ of interpolation points according to (13) 3: Find a basis (Q (1) , . . ., Q (d I ) ) of the solution space of Problem 1 4: Find a basis (f (1) , . . ., f (d RF ) ) of the solution space of Problem 2 with respect to all skew polynomials Q (1) , . . ., Q (d I ) Lemma 5 (Worst-Case List Size).The list size is upper bounded by q m(s−1) .
Proof.With d RF := dim q m (ker(B)), the list size equals q m•dRF and d RF = k − rk q m (B) due to the rank-nullity theorem.Let B △ denote the lower triangular matrix consisting of the first d I k rows of B. Then, rk q m (B) ≥ rk q m (B △ ) and the latter is lower bounded by the number of nonzero vectors on its diagonal.These vectors are b 0,0 , . . ., b 0,k−1 and we focus on their first components while neglecting application of σ.Observe that each of them is given as the evaluation of B (1) 0 at another conjugate of α.Since B 0 can have at most s − 1 roots, it follows that at most s − 1 of the vectors on the diagonal can be zero.Thus, rk q m (B) ≥ k − s + 1 and, as a consequence, d RF ≤ s − 1.
Note that, despite the exponential worst-case list size, an F q m -basis of the list can be found in polynomial time.Theorem 4 summarizes the results for list decoding of FLRS codes.
Theorem 4 (List Decoding).Consider an FLRS code FLRS[α, a, h; N, k] and a codeword C that is transmitted over a sum-rank channel.Assume that the error has weight t and that its weight decomposition t = (t 1 , . . ., t ℓ ) satisfies for an interpolation parameter 1 ≤ s ≤ min i∈{1,...,ℓ} h i .Then, a basis of an at most (s − 1)-dimensional F q m -vector space that contains candidate message polynomials satisfying (21) can be obtained in at most O(sn 2 ) operations in F q m .Recall that the decoding radius can be described by (23) if the same folding parameter h is used for all blocks.
A different concept is probabilistic unique decoding where the decoder either returns a unique solution or declares a failure.In our setting, a failure occurs exactly when the root-finding matrix B is rank-deficient.Similar to [6], we now derive a heuristic upper bound on the probability P (rk q m (B) < k).
Lemma 6 (Decoding Failure Probability).Assume that the coefficients of the polynomials B (u) 0 (x) ∈ F q m [x] from (27) for u ∈ {1, . . ., d I } are independent and have a uniform distribution among F q m .Then it holds that where indicates that the bound is a heuristic approximation.
Proof.Let B △ denote the matrix consisting of the first d I k rows of B as in the proof of Lemma 5. Note that (σ a (α)) ⊤ for a ∈ {0, . . ., k − 1} because application of σ can be neglected.Following ideas from [6, Lemma 8], we can now interpret the vector consisting of the u-th entries of b0,0 , . . ., b0,k−1 for each 1 ≤ u ≤ d I as a codeword of a Reed-Solomon code C RS of length k and dimension s.These d I codewords have a uniform distribution with respect to the codebook of C RS due to our assumption on the distribution of the polynomial coefficients.Thanks to [16, eq. ( 1)], we can approximate the probability that a random codeword has full weight k as Let us fix an a ∈ {0, . . ., k−1} and consider b0,a .Then, any full-weight codeword induces a nonzero entry in b0,a and conversely, the probability that one entry of b0,a is zero is upper bounded by where the estimation uses the binomial theorem.Due to our independence assumption for the coefficients of B (u) 0 (x) for u ∈ {1, . . ., d I }, the entries of b0,a are also independent and the probability that the whole vector is zero for a fixed a is bounded by the d I -th power of the right-hand side of (29).Finally, the union bound deals with the probability that at least one vector is zero and yields Section 4.5 presents results that empirically verify the heuristic upper bound by Monte Carlo simulations.Moreover, further simulations show that the assumption that the coefficients of B We incorporate this threshold into the results we have shown so far and obtain Theorem 5 which provides a summary for probabilistic unique decoding of FLRS codes.
Theorem 5 (Probabilistic Unique Decoding).For an interpolation parameter 1 ≤ s ≤ min i∈{1,...,ℓ} h i and a dimension threshold µ ∈ N * , transmit a codeword C of an FLRS code FLRS[α, a, h; N, k] over a sum-rank channel.Assume that the error weight t has a weight decomposition t = (t 1 , . . ., t ℓ ) satisfying and that the coefficients of the polynomials B (u) 0 (x) for u ∈ {1, . . ., µ} are independent and uniformly distributed among F q m .Then, C can be uniquely recovered with complexity O(sn 2 ) in F q m and with an approximate probability of at least Proof.The decoding radius follows when inequality ( 18) is replaced by in the proof of Theorem 3. Since the degree constraint (30) enforces d I ≥ µ, the heuristic upper bound on the failure probability from Lemma 6 attains the worst-case value for d I = µ.The success probability of decoding is hence at least 1 The total complexity of O(sn 2 ) follows since at most O(sn 2 ) F q m -operations are needed to solve the interpolation problem and the solution of the root-finding problem can be computed in O(k 2 ) operations.
For the same folding parameter h for each block, we get the simplified degree constraint and, as in [20,Thm. 3], the description of the decoding radius reads as .

Improved Decoding of High-Rate Codes
The normalized decoding radius τ := t N of the interpolation-based decoder for codes using the same folding parameter for all blocks, which is given in (24), is positive only for code rates R < h−s+1 h .This is our motivation to now consider an interpolationbased decoder for FLRS codes that allows to correct sum-rank errors beyond the unique decoding radius for any code rate R > 0. The main idea behind this decoder is inspired by Justesen's decoder for FRS codes [19, Sec.III-B], [10] and the Justesen-like decoder for high-rate folded Gabidulin codes [2,3,6].Compared to the Guruswami-Rudra-like decoder from Section 4, the proposed Justesen-like decoder uses additional interpolation points to improve the decoding performance for higher code rates.In particular, we allow the sliding window of size s + 1 to wrap around to the neighboring symbols (except for the last symbol in each block).
As before we choose an interpolation parameter s ∈ N * satisfying (12).Then for each i = 1, . . ., ℓ we get the index set W HR i and the corresponding interpolation-point set P HR i as w+1 , . . ., r Remark 3. The additional interpolation points for each block i = 1, . . ., ℓ compared to the Guruswami-Rudra-like decoder can be easily deduced by the equality Example 4. When we consider the code from Example 1, the interpolation points for the high-rate decoder are 3 , r 4 ) and 2 , r 3 ) .
Problem 3 (High-Rate Interpolation Problem).Solve Problem 1 with the input sets P HR 1 , . . ., P HR ℓ , where the i-th set is associated to evaluation parameter a i .
Since the interpolation point set P HR := interpolation points, we get the following condition for the existence of a nonzero solution of the high-rate interpolation problem: Proof.Problem 3 forms a homogeneous linear system of ℓ i=1 (N i h i − (s − 1)) equations in D(s + 1) − s(k − 1) unknowns, which has a nontrivial solution if less equations than unknowns are involved.This is satisfied for (33).
The new choice P HR of interpolation points yields at least as many uncorrupted interpolation points as P. Hence, we also get at least as many F q -linearly independent zeros of the corresponding univariate polynomial P .
Lemma 8 (Roots of Polynomial).Define the univariate skew polynomial and write t i := rk q (E (i) ) for 1 ≤ i ≤ ℓ.Then there exist F q -linearly independent elements Nihi−(s−1)−ti(hi+s−1) ∈ F q m for each i ∈ {1, . . ., ℓ} such that P (ζ Proof.Since rk q (E (i) ) = t i , there exists a nonsingular matrix T i ∈ F Ni×Ni q such that E (i) T i has only t i nonzero columns for every i ∈ {1, . . ., ℓ}.Without loss of generality assume that these columns are the last ones of E (i) T i and define noncorrupted interpolation points according to (32).Now, for each 1 ≤ i ≤ ℓ, the first entries of the ) are by construction both F q -linearly independent and roots of P (x).This results in a different decoding radius, which is shown below.
Theorem 6 (Decoding Radius).Let Q(x, y 1 , . . ., y s ) be a nonzero solution of Problem 3. If the error-weight decomposition t = (t 1 , . . ., t ℓ ) satisfies Proof.By Lemma 8, there exist elements Nihi−(s−1)−ti(hi+s−1) in F q m that are F q -linearly independent for each i ∈ {1, . . ., ℓ} such that P (ζ P (x) exceeds the degree bound from [13, Prop.1.3.7]which is possible only if P (x) = 0.By combining (36) with (33) we get For the same folding parameter h ∈ N * for all blocks the decoding radius in (34) simplifies to which for ℓ = 1 coincides with the result for high-rate folded Gabidulin codes [2,3,6].Similar to (24), we also derive the normalized decoding radius τ := t N for codes with the same folding parameter h for each block from (37) and obtain for the code rate R := k hN .Theorem 6 shows that if the weight decomposition t of the error satisfies (34), a list containing the message polynomial f ∈ F q m [x; σ, δ] <k can be obtained by finding all solutions of (35).This coincides with the root-finding problem from Section 4.2 and we can hence summarize the list decoder for high-rate FLRS codes as follows: Theorem 7 (List Decoding).Consider an FLRS code FLRS[α, a, h; N, k] and a codeword C that is transmitted over a sum-rank channel such that the error has weight t and its weight decomposition t = (t 1 , . . ., t ℓ ) satisfies for an interpolation parameter 1 ≤ s ≤ min i∈{1,...,ℓ} h i .Then, a basis of an at most (s − 1)-dimensional F q m -vector space that contains candidate message polynomials satisfying (35) can be obtained in at most O(sn 2 ) operations in F q m .By following the ideas of Lemma 4 we observe that the dimension of the F q m -linear solution space of the interpolation system for the Justesen-like decoder satisfies Imposing the threshold d I ≥ µ yields to the degree constraint which lets us provide a summary for probabilistic unique decoding of FLRS codes in Theorem 8.
Theorem 8 (Probabilistic Unique Decoding).For an interpolation parameter 1 ≤ s ≤ min i∈{1,...,ℓ} h i and a dimension threshold µ ∈ N * , transmit a codeword C of an FLRS code FLRS[α, a, h; N, k] over a sum-rank channel.If the coefficients of the polynomials B (u) 0 (x) for u ∈ {1, . . ., µ} are independent and uniformly distributed among F q m and the error-weight decomposition t = (t 1 , . . ., t ℓ ) satisfies C can be uniquely recovered with complexity O(sn 2 ) in F q m with an approximate probability of at least For the same folding parameter h for each block, we get the decoding radius which for ℓ = 1 coincides with the probabilistic unique decoding radius for folded Gabidulin codes (cf.[6,Thm. 3]).
Figure 2 illustrates the normalized decoding radii of the presented Guruswami-Rudra-and Justesen-like decoders for FLRS codes.In particular, the significant improvement upon unique decoding is shown.

Simulation Results
We ran simulations1 in SageMath [36] to empirically verify the heuristic upper bound for probabilistic unique decoding that we derived in Theorem 5. We designed the parameter sets to obtain experimentally observable failure probabilities.Therefore, we considered codes with parameters and with two different vectors h ∈ {(3, 3), (3, 2)} of folding parameters.The code using h = (3, 3) has minimum distance 4 which implies a unique-decoding radius of 1.5.In contrast, the proposed probabilistic unique decoder with s = 2 allows to correct errors of weight t = 2 for µ ∈ {1, 2}.Namely, the bound (31) yields t ≤ 2.17 for µ = 1 and t ≤ 2 for µ = 2.We investigated the case µ = 1 by means of a Monte Carlo simulation and collected 100 decoding failures within about 4.23 • 10 7 transmissions with randomly chosen error patterns of fixed sum-rank weight t = 2.This gives an observed failure probability of about 2.36 • 10 −6 , while the heuristic yields an upper bound of 5.49 • 10 −3 .For h = (3, 2), the code has the higher minimum distance 5 and a unique-decoding radius of 2. Its decodable error-weight decompositions with respect to the probabilistic unique decoder with s = 2 and µ ∈ {1, 2, 3} are  -(0, 1) and (1, 0), i.e. all possible patterns for weight t = 1, -(0, 2) and (1, 1), i.e. two out of three possible patterns for weight t = 2, -and (0, 3), i.e. one out of three possible patterns for weight t = 3.
Note that the error patterns are not equally likely.For example, being able to correct one out of two error-weight decompositions for a given weight does not necessarily mean that half of all errors of the given sum-rank weight can be corrected.We ran two Monte Carlo simulations for t = 2 and t = 3 and collected in both cases 100 failures for µ = 1.The errors were chosen uniformly at random from the set of all vectors having the prescribed sum-rank weight as well as a decodable weight decomposition.The observed failure probability was 1.11 • 10 −3 for t = 2 (100 failures in about 9.03 • 10 4 runs) and 2.11 • 10 −5 for t = 3 (100 failures in 4.73 • 10 6 runs).In both scenarios, the heuristic upper bound is 5.49 • 10 −3 as for the first code.
Similar to results in [6,37], our heuristic upper bound is based on the assumption that the coefficients of the polynomials (27) are uniformly distributed among F 729 .Unfortunately, this assumption was not backed by evidence in former work.We thus decided to investigate experimentally observed distributions and compare them with the uniform distribution by means of the Kullback-Leibler (KL) divergence.The KL divergence (or relative entropy, see [17,Sec. 2.3]) is a tool to measure the distance between two probability distributions, that is often used in coding and information theory.Note that it is not a metric in the mathematical sense but provides sufficient insights for our purpose.In particular, it is an upper bound for other widely used statistical distance measures as e.g. the total variation distance [18].
The KL divergence of two probability mass functions u(x) and v(x), that are defined over a finite alphabet A, is defined as We understand 0 • log( 0 q ) := 0 for any q and p • log( p 0 ) := ∞ for any nonzero p by convention.We follow the common approach and consider the logarithm with base 2 and thus measure the Kullback-Leibler divergence in bits.Note that the divergence is always nonnegative and it equals zero if and only if the two considered probability mass functions are equal (see e.g.[17, Thm.2.6.3])).
Denote the observed probability mass function of the coefficients of the polynomials B This shows that the measured distribution is in all cases remarkably close to the uniform distribution, which justifies the assumption in Theorem 5.The results are illustrated in more detail in Figure 3, where the subfigures (a)-(c) show the probability mass functions χ of the coefficients that were observed within 10 6 transmissions for h = (3, 3) with error weight t = 2 and for h = (3, 2) with error weight t = 2 and t = 3, respectively.The red line marks the (in fact discrete) probability mass function unif F729 of the uniform distribution for reference.Subfigure (d) shows the evolution of the Kullback-Leibler divergence D KL (χ || unif F729 ) over the 10 6 runs for all investigated scenarios.

Implications for Folded Skew Reed-Solomon Codes
Motivated by the relation between LRS codes and SRS codes from [30], we now derive FSRS codes for the skew metric from FLRS codes.The skew metric is related to skew evaluation codes and was introduced in [30].Decoding schemes for SRS codes that allow for correcting errors of skew weight up to the unique-decoding radius ⌊ n−k 2 ⌋ were presented in [1,8,27,30].
In this section we consider decoding of FSRS codes with respect to the (burst) skew metric, which was introduced for interleaved skew Reed-Solomon (ISRS) codes in [5].
In the following, we restrict ourselves to evaluation codes constructed by F q m [x; σ], i.e. to the zero-derivation case.

Preliminaries on Remainder Evaluation
Apart from the (generalized) operator evaluation (see Section 2) there exists the socalled remainder evaluation for skew polynomials, which can be seen as an analog of the classical polynomial evaluation via polynomial division.
For a skew polynomial f ∈ F q m [x; σ] the remainder evaluation f [b] of f at an element b ∈ F q m is defined as the unique remainder of the right division of f (x) by (x − b) such that (see [21,22]) We denote the evaluation of f at all entries of a vector b For any a ∈ F q m , b ∈ F * q m and f ∈ F q m [x; σ] the generalized operator evaluation of f at b with respect to a is related to the remainder evaluation by (see [25,30]) (39)   (1) 0 (x) after 10 6 probabilistic unique decodings with s = 2 and µ = 1 for codes with q = 3, m = 6, k = 2, n = (6, 6) and either h = (3, 3) and t = 2 or h = (3, 2) and t ∈ {2, 3} and evolution of its divergence with respect to the uniform distribution.
The following notions were introduced in [21][22][23], and we use the notation of [31].Let A ⊆ F q m [x; σ], Ω ⊆ F q m , and a ∈ F q m .The zero set of A is defined as denotes the associated ideal of Ω.The P-closure (or polynomial closure) of Ω is defined by Ω := Z(I(Ω)), and Ω is called P-closed if Ω = Ω.Note that a P-closure is always P-closed.All elements of F q m \ Ω are said to be P-independent from Ω.A set B ⊆ F q m is said to be P-independent if any b ∈ B is P-independent from B\{b}.If B is P-independent and Ω := B ⊆ F q m , we say that B is a P-basis of Ω.
For any x = (x 1 , . . ., x n ) ∈ F n q m and any P-basis B = {b 1 , b 2 , . . ., b n }, there is a unique skew polynomial I rem B,x ∈ F q m [x; σ] of degree less than n such that We call this the remainder interpolation polynomial of x on B. The skew weight of a vector x ∈ F n q m with respect to a P-closed set Ω = B with P-basis B = {b 1 , b 2 , . . ., b n }2 is defined as (see [8]) .
The skew weight of a vector depends on Ω but is independent from the particular Pbasis B (see [30,Prop. 13]) of Ω.In order to simplify the notation for the skew weights of vectors, we indicate the dependence on Ω by a particular P-basis for Ω and use the notation wt skew (•) whenever B is clear from the context.Similar to the rank and the sum-rank weight we have that wt skew (x) ≤ wt H (x) for all x ∈ F n q m (see [30]).The skew distance between two vectors x, y ∈ F n q m is defined as d skew (x, y) := wt skew (x − y).

Skew Metric for Folded Matrices
By fixing a basis of F q mh over F q m we can consider a matrix X ∈ F h×N q m as a vector x = (x 1 , x 2 , . . ., x N ) ∈ F N q mh .Similarly, we consider a tuple X ∈ F h×N q m as a matrix in whenever the folding parameter h is the same for each block, i.e. if h = (h, . . ., h).Similar as for ISRS codes we define the skew weight of a matrix X ∈ F h×N q m (or a tuple X ∈ F h×N q m ) with respect to B as the skew weight of the vector x = ext −1 γ (X) ∈ F N q mh , i.e. as (see [5]) where the polynomial lclm (x − b i xi ) 1≤i≤N x i =0 is now from F q mh [σ; x] since we have that x i ∈ F q mh for all i = 1, . . ., N .Lemma 9. Define N i (a) := i−1 k=0 σ k (a) for any i ∈ N and a ∈ F q m , let c ∈ F q m and consider a skew polynomial f ∈ F q m [x; σ].Then for any b ∈ F q m and j ∈ N we have that The following result shows that each matrix can be represented as the remainder evaluation of a single skew polynomial over the large field F q mh at evaluation points from the small field F q m .Lemma 10.Let α be a primitive element of F q m , define ω := σ(α)/α, let the folding parameter h divide n ≤ m and define N := n h .Consider an evaluation parameter a ∈ F * q m and define the vector Then any matrix X ∈ F h×N q m can be represented as for some f, f (1) , . . ., f (h) ∈ F q m [x; σ] <n .Further, we have that ext for some F ∈ F q mh [x; σ] <n .
Proof.Let x = F −1 h (X) be the vector obtained by unfolding X and define Since α is a primitive element of F q m we have that the entries in b are P-independent.Let f := I rem b,x ∈ F q m [x; σ] <n be the unique interpolation polynomial satisfying I rem b,x b j = x j ∀j = 1, . . ., hN.
Due to the structure of the evaluation points in b we can write X as where ( * ) follows by Lemma 9.By fixing a basis γ of F q mh over F q m we can represent X over F q mh as ext where i , f i , . . ., f i ) ⊤ for all i = 1, . . ., n−1.
Theorem 9 shows that applying the elementwise F q m -linear transformation from [30,Thm. 3] to unfolded matrices yields an isometry between the skew metric and the sumrank metric for matrices obtained from folded vectors.Theorem 9. Let α be a primitive element of F q m and consider ℓ ∈ N * .Let 1 ≤ n i ≤ m for all i = 1, . . ., ℓ and let a = (a 1 , . . ., a ℓ ) ∈ F ℓ q m contain representatives from different conjugacy classes.Let the folding parameter h divide n i for all i = 1, . . ., ℓ, define the ℓ-composition N = (N 1 , N 2 , . . ., N ℓ ) with N i = ni h for all i = 1, . . ., ℓ and define h = (h, . . ., h) ∈ Z ℓ ≥0 .Let diag(β −1 ) denote the diagonal matrix of the vector and define the map Then for any X ∈ F h×N q m we have that the mapping ϕ α is an isometry between the skew metric and the sum-rank metric, i.e. we have that where B = {D ai (α jh )/α jh : j = 0, . . .n i − 1, i = 1, . . ., ℓ}.
Proof.The vectors α (i) := (1, α h , . . ., α (Ni−1)h ) contain F q -linearly independent elements from F q m since α is a primitive element of F q m and n i = N i h ≤ m for all i = 1, . . ., ℓ.Thus, by [22,Thm. 4.5] we have that the vectors contain P-independent elements for all i = 1, . . ., ℓ.Since a 1 , . . ., a ℓ are representatives of different conjugacy classes of F q m , we also have that the entries in b ) are P-independent which implies that B is a P-independent set (cf. [31, Thm.9] and [21,22]).By using the relation between the generalized operator evaluation and the remainder evaluation in (39) and the result of Lemma 10, we can write the blocks of the transformed tuple X := ϕ α (X) = F h F −1 h (X) • diag(β −1 ) in terms of the remainder evaluation as f ωb (i)  . . .
Example 5. Consider a matrix X = (X (1) | X (2) ) ∈ F h×N q m where h = 3 and N = (2, 3).Then the operator ϕ α applied to X gives ϕ α (X) =     Skew Reed-Solomon codes were proposed by Boucher and Ulmer in [9] and further investigated in [27,30].corresponding to a message polynomial f ∈ F q m [x; σ] <k has the form where for all i ∈ {1, . . ., ℓ}.where the code FLRS[α, a, h; N, k] with h = (h, . . ., h) is considered as subset of F h×N q m .Proof.The result follows directly by using the relation between the generalized operator evaluation and the remainder evaluation in (39).By using the isometry between the sum-rank metric and the skew metric from Theorem 9, we obtain the following corollary from Theorem 2.

Interpolation-Based Decoding of Folded Skew Reed-Solomon Codes
We now consider interpolation-based decoding of FSRS codes with respect to the skew metric.As a channel model we consider the skew error channel with input and output alphabet F h×N q m , where the input C is related to the output R by and E with wt skew (E) = t is chosen uniformly at random from all matrices from F h×N q m with skew weight t.Suppose we transmit a codeword C ∈ FSRS[b, h; N, k] over a skew error channel (40) and receive a matrix R = (R (1) | R (2) α denote the inverse map of ϕ α .By using the isometry between the sum-rank metric and the relation between FLRS codes and FSRS codes, we can transform the received matrix R to where ϕ −1 α (C) is in the corresponding FLRS code FLRS[α, a, h; N, k] (see Proposition 1) and ϕ −1 α (E) has sum-rank weight t (see Theorem 9).Hence, the decoding problem for FSRS codes with respect to the skew metric is mapped to an equivalent decoding problem for FLRS codes in the sum-rank metric.
Therefore, we can use the interpolation-based decoding schemes for FLRS codes from Section 4 to decode FSRS codes in the skew metric as follows: 1. Compute R := ϕ −1 α (R), which requires O(n) operations in F q m .2. Apply a decoder for FLRS codes in the sum-rank metric (e.g.Algorithm 1) to R.

Conclusion
We introduced the family of folded linearized Reed-Solomon (FLRS) codes whose members are maximum sum-rank distance (MSRD) codes for appropriate parameter choices.We further described an efficient decoding scheme to correct sum-rank errors in the context of list and probabilistic unique decoding with quadratic complexity in the length of the unfolded code.Up to our knowledge, this is the first explicit MSRD code construction that allows different block sizes and has an explicit efficient decoding algorithm.We analyzed the decoder and gave upper bounds on both list size and failure probability.Monte Carlo simulations verified that the observed failure probability is indeed below the derived bound and further experiments show that the assumption under which the upper bound was derived is reasonable.Since the proposed decoding scheme has a rate restriction, we investigated a Justesen-like improvement tailored to high-rate FLRS codes.
The focus of the second part of the paper was the skew metric for which we introduced folded skew Reed-Solomon (FSRS) codes in the zero-derivation setting.Moreover, we explained how the decoding scheme for FLRS codes in the sum-rank metric can be applied to the presented skew-metric codes.
Goals for further research could be the extension of FSRS codes to the nonzeroderivation case or to more general parameters as e.g.code locators.Moreover, it is tempting to study if there are other useful ways of folding codes in different metrics.

Fig. 2 :
Fig.2: Normalized decoding radius τ := t N vs. code rate R := k N h for an FLRS code with the same folding parameter h = 25 for each block and optimal decoding parameter s ≤ h for each code rate.

Fig. 3 :
Fig. 3: Observed probability mass function of the coefficients of B

Corollary 1 (
Minimum Skew Distance).The minimum skew distance of an FSRS code C := FSRS[b, h; N, k] of length N = ℓ i=1 N i as defined in Definition 5 is d skew (C) = N − k h + 1.

Table 1 :
Decodable error-weight decompositions for codes of dimension k = 2 and decoder parameter s = 2. (23) for codes with the same folding parameter for all blocks, (25) | (26) in all other cases. *