24.7 Cyclic Codes – Introduction to Cryptography with Coding Theory, 3rd Edition

24.7 Cyclic Codes

Cyclic codes are a very important class of codes. In the next two sections, we’ll meet two of the most useful examples of these codes. In this section, we describe the general framework.

A code C is called cyclic if

(c1, c2, , cn)C implies (cn, c1, c2, , cn1)C.

For example, if (1, 1, 0, 1) is in a cyclic code, then so is (1, 1, 1, 0). Applying the definition two more times, we see that (0, 1, 1, 1) and (1, 0, 1, 1) are also codewords, so all cyclic permutations of the codeword are codewords. This might seem to be a strange condition for a code to satisfy. After all, it would seem to be rather irrelevant that, for a given codeword, all of its cyclic shifts are still codewords. The point is that cyclic codes have a lot of structure, which makes them easier to study. In the case of BCH codes (see Section 24.8), this structure yields an efficient decoding algorithm.

Let’s start with an example. Consider the binary matrix


The rows of G generate a three-dimensional subspace of seven-dimensional binary space. In fact, in this case, the cyclic shifts of the first row give all the nonzero codewords:

G={(0, 0, 0, 0, 0, 0, 0), (1, 0, 1, 1, 1, 0, 0), (0, 1, 0, 1, 1, 1, 0), (0, 0, 1, 0, 1, 1, 1), (1, 0, 0, 1, 0, 1, 1), (1, 1, 0, 0, 1, 0, 1), (1, 1, 1, 0, 0, 1, 0), (0, 1, 1, 1, 0, 0, 1)}.

Clearly the minimum weight is 4, so we have a cyclic [7, 3, 4] code.

We now show an algebraic way to obtain this code. Let Z2[X] denote polynomials in X with coefficients mod 2, and let Z2[X]/(X71) denote these polynomials mod (X71). For a detailed description of what this means, see Section 3.11. For the present, it suffices to say that working mod X71 means we are working with polynomials of degree less than 7. Whenever we have a polynomial of degree 7 or higher, we divide by X71 and take the remainder.

Let g(X)=1+X2+X3+X4. Consider all products


with f(X) of degree 2. Write the coefficients of the product as a vector (a0, , a6). For example, g(X)1 yields (1, 0, 1, 1, 1, 0, 0), which is the top row of G. Similarly, g(X)X yields the second row of G and g(X)X2 yields the third row of G. Also, g(X)(1+X2) yields (1, 0, 0, 1, 0, 1, 1), which is the sum of the first and third rows of G. In this way, we obtain all the codewords of our code.

We obtained this code by considering products g(X)f(X) with deg(f)2. We could also work with f(X) of arbitrary degree and obtain the same code, as long as we work mod (X71). Note that g(X)(X3+X2+1)=X71(mod 2). Divide X3+X2+1 into f(X):


with deg(f1)2. Then


Therefore, g(X)f1(X) gives the same codeword as g(X)f(X), so we may restrict to working with polynomials of degree at most two, as claimed.

Why is the code cyclic? Start with the vector for g(X). The vectors for g(X)X and g(X)X2 are cyclic shifts of the one for g(X) by one place and by two places, respectively. What happens if we multiply by X3? We obtain a polynomial of degree 7, so we divide by X71 and take the remainder:


The remainder yields the vector (1, 0, 0, 1, 0, 1, 1). This is the cyclic shift by three places of the vector for g(X).

A similar calculation for j=4, 5, 6 shows that the vector for g(X)Xj yields the shift by j places of the vector for g(X). In fact, this is a general phenomenon. If q(X)=a0+a1X++a6X6 is a polynomial, then


The remainder is a6+a0X+a1X2++a5X6, which corresponds to the vector (a6, a0, , a5). Therefore, multiplying by X and reducing mod X71 corresponds to a cyclic shift by one place of the corresponding vector. Repeating this j times shows that multiplying by Xj corresponds to shifting by j places.

We now describe the general situation. Let F be a finite field. For a treatment of finite fields, see Section 3.11. For the present purposes, you may think of F as being the integers mod p, where p is a prime number, since this is an example of a finite field. For example, you could take F=Z2={0, 1}, the integers mod 2. Let F[X] denote polynomials in X with coefficients in F. Choose a positive integer n. We’ll work in F[X]/(Xn1), which denotes the elements of F[X] mod (Xn1). This means we’re working with polynomials of degree less than n. Whenever we encounter a polynomial of degree n, we divide by Xn1 and take the remainder. Let g(X) be a polynomial in F[X]. Consider the set of polynomials


where f(X) runs through all polynomials in F[X] (we only need to consider f(X) with degree less than n, since higher-degree polynomials can be reduced mod Xn1). Write


The coefficients give us the n-dimensional vector (a0, , an1). The set of all such coefficients forms a subspace C of n-dimensional space Fn. Then C is a code.

If m(X)=g(X)f(X)mod(Xn1) is any such polynomial, and s(X) is another polynomial, then m(X)s(X)=g(X)f(X)s(X)mod(Xn1) is the multiple of g(X) by the polynomial f(X)s(X). Therefore, it yields an element of the code C. In particular, multiplication by X and reducing mod Xn1 corresponds to a codeword that is a cyclic shift of the original codeword, as above. Therefore, C is cyclic.

The following theorem gives the general description of cyclic codes.


Let C be a cyclic code of length n over a finite field F. To each codeword (a0, , an1)C, associate the polynomial a0+a1X++an1Xn1 in F[X]. Among all the nonzero polynomials obtained from C in this way, let g(X) have the smallest degree. By dividing by its highest coefficient, we may assume that the highest nonzero coefficient of g(X) is 1. The polynomial g(X) is called the generating polynomial for C. Then

  1. g(X) is uniquely determined by C.

  2. g(X) is a divisor of Xn1.

  3. C is exactly the set of coefficients of the polynomials of the form g(X)f(X) with deg(f)n1deg(g).

  4. Write Xn1=g(X)h(X). Then m(X)F[X]/(Xn1) corresponds to an element of C if and only if h(X)m(X)0mod(Xn1).


  1. If g1(X) is another such polynomial, then g(X) and g1(X) have the same degree and have highest nonzero coefficient equal to 1. Therefore, g(X)g1(X) has lower degree and still corresponds to a codeword, since C is closed under subtraction. Since g(X) had the smallest degree among nonzero polynomials corresponding to codewords, g(X)g1(X) must be 0, which means that g1(X)=g(X). Therefore, g(X) is unique.

  2. Divide g(X) into Xn1:


    for some polynomials h(X) and r(X), with deg(r)tdeg(g). This means that


    As explained previously, multiplying g(X) by powers of X corresponds to cyclic shifts of the codeword associated to g(X). Since C is assumed to be cyclic, the polynomials g(X)Xjmod(Xn1) for j=0, 1, 2,  therefore correspond to codewords; call them c0, c1, c2, . Write h(X)=b0+b1X++bkXk. Then g(X)h(X) corresponds to the linear combination


    Since each bi is in F and each ci is in C, we have a linear combination of elements of C. But C is a vector subspace of n-dimensional space Fn. Therefore, this linear combination is in C. This means that r(X), which is g(X)h(X)mod(Xn1), corresponds to a codeword. But deg(r)tdeg(g), which is the minimal degree of a polynomial corresponding to a nonzero codeword in C. Therefore, r(X)=0. Consequently Xn1=g(X)h(X), so g(X) is a divisor of Xn1.

  3. Let m(X) correspond to an element of C. Divide g(X) into m(X):


    with deg(r1(X))<deg(g(X)). As before, g(X)f(X)mod(Xn1) corresponds to a codeword. Also, m(X) corresponds to a codeword, by assumption. Therefore, m(X)g(X)f(X)mod(Xn1) corresponds to the difference of these codewords, which is a codeword. But this polynomial is just r1(X)=r1(X)mod(Xn1). As before, this polynomial has degree less than deg(g(X)), so r1(X)=0. Therefore, m(X)=g(X)f(X). Since deg(m)n1, we must have deg((f)n1deg(g). Conversely, as explained in the proof of (2), since C is cyclic, any such polynomial of the form g(X)f(X) yields a codeword. Therefore, these polynomials yield exactly the elements of C.

  4. Write Xn1=g(X)h(X), which can be done by (2). Suppose m(X) corresponds to an element of C. Then m(X)=g(X)f(X), by (3), so


    Conversely, suppose m(X) is a polynomial such that h(X)m(X)0 mod(Xn1). Write h(X)m(X)=(Xn1)q(X)=h(X)g(X)q(X), for some polynomial q(X). Dividing by h(X) yields m(X)=g(X)q(X), which is a multiple of g(X), and hence corresponds to a codeword. This completes the proof of the theorem.

Let g(X)=a0+a1X++ak1Xk1+Xk be as in the theorem. By part (3) of the theorem, every element of C corresponds to a polynomial of the form g(X)f(X), with deg(f(X))n1k. This means that each such f(X) is a linear combination of the monomials 1, X, X2, , Xn1k. It follows that the codewords of C are linear combinations of the codewords corresponding to the polynomials

g(X),  g(X)X,  g(X)X2, ,  g(X)Xn1k.

But these are the vectors

a0, , ak, 0, 0, ), (0, a0, , ak, 0, ), , (0, , 0, a0, , ak).

Therefore, a generating matrix for C can be given by


We can use part (4) of the theorem to obtain a parity check matrix for C. Let h(X)=b0+b1X++blXl be as in the theorem (where l=nk). We’ll prove that the k×n matrix


is a parity check matrix for C. Note that the order of the coefficients of h(X) is reversed. Recall that H is a parity check matrix for C means that HcT=0 if and only if cC.


H is a parity check matrix for C.

Proof. First observe that since g(X) has 1 as its highest nonzero coefficient, and since g(X)h(X)=Xn1, the highest nonzero coefficient bl of h(X) must also be 1. Therefore, H is in row echelon form and consequently its rows are linearly independent. Since H has k rows, it has rank k. The right null space of H therefore has dimension nk.

Let m(X)=c0+c1X++cn1Xn1. We know from part (4) that (c0, c1, , cn1)C if and only if h(X)m(X)0mod(Xn1).

Choose j with ljn1 and look at the coefficient of Xj in the product h(X)m(X). It equals


There is a technical point to mention: Since we are looking at h(X)m(X)mod(Xn1), we need to worry about a contribution from the term Xn+j (since Xn+jXnXj1Xj, the monomial Xn+j reduces to Xj). However, the highest-degree term in the product h(X)m(X) before reducing mod Xn1 is cn1Xl+n1. Since lj, we have l+n1tj+n. Therefore, there is no term with Xn+j to worry about.

When we multiply H times (c0, c1, , cn1)T, we obtain a vector whose first entry is


More generally, the ith entry (where 1ik) is


This is the coefficient of Xl+i1 in the product h(X)m(X)mod(Xn1).

If (c0, c1, , cn1) is in C, then h(X)m(X)0mod(Xn1), so all these coefficients are 0. Therefore, H times (c0, c1, , cn1)T is the 0 vector, so the transposes of the vectors of C are contained in the right null space of H. Since both C and the null space have dimension k, we must have equality. This proves that cC if and only if HcT=0, which means that H is a parity check matrix for C.


In the example at the beginning of this section, we had n=7 and g(X)=X4+X3+X2+1. We have g(X)(X3+X2+1)=X71, so h(X)=X3+X2+1. The parity check matrix is


The parity check matrix gives a way of detecting errors, but correcting errors for general cyclic codes is generally quite difficult. In the next section, we describe a class of cyclic codes for which a good decoding algorithm exists.