This paper presents two repair schemes for low-rate Reed-Solomon (RS) codes over prime fields that can repair any node by downloading a constant number of bits from each surviving node. The total bandwidth resulting from these schemes is greater than that incurred during trivial repair; however, this is particularly relevant in the context of leakage-resilient secret sharing. In that framework, our results provide attacks showing that k-out-of-n Shamir’s Secret Sharing over prime fields for small k is not leakage-resilient, even when the parties leak only a constant number of bits. To the best of our knowledge, these are the first such attacks. Our results are derived from a novel connection between exponential sums and the repair of RS codes. Specifically, we establish that non-trivial bounds on certain exponential sums imply the existence of explicit nonlinear repair schemes for RS codes over prime fields.

This paper presents several repair schemes for lowrate Reed Solomon (RS) codes over prime fields that can repair any node by downloading a constant number of bits from each surviving node. The resulting total bandwidth is higher than the bandwidth incurred during the trivial repair; however, this is still interesting in the context of leakage-resilient secret sharing. In that language, our results give attacks that show that k-out-of-n Shamir’s Secret Sharing over prime fields for small k is not leakage resilient, even if the parties only leak a constant number of bits. To the best of our knowledge, these are the first such attacks.As another application, we provide decoding schemes for RS codes over prime fields, where the entire RS codeword is recovered by transmitting a constant number of bits from each node.Our results follow from a novel connection between exponential sums and repair of RS codes. In particular, we show that nontrivial bounds on certain exponential sums imply the existence of efficient nonlinear repair schemes for RS codes over prime fields.

We study the problem of efficiently computing on encoded data. More specifically, we study the question of low-bandwidth computation of functions $F:\mathbb{F}^k \to \mathbb{F}$ of some data $x \in \mathbb{F}^k$, given access to an encoding $c \in \mathbb{F}^n$ of $x$ under an error correcting code. In our model -- relevant in distributed storage, distributed computation and secret sharing -- each symbol of $c$ is held by a different party, and we aim to minimize the total amount of information downloaded from each party in order to compute $F(x)$. Special cases of this problem have arisen in several domains, and we believe that it is fruitful to study this problem in generality. Our main result is a low-bandwidth scheme to compute linear functions for Reed-Solomon codes, even in the presence of erasures. More precisely, let $ε> 0$ and let $\mathcal{C}: \mathbb{F}^k \to \mathbb{F}^n$ be a full-length Reed-Solomon code of rate $1 - ε$ over a field $\mathbb{F}$ with constant characteristic. For any $γ\in [0, ε)$, our scheme can compute any linear function $F(x)$ given access to any $(1 - γ)$-fraction of the symbols of $\mathcal{C}(x)$, with download bandwidth $O(n/(ε- γ))$ bits. In contrast, the naive scheme that involves reconstructing the data $x$ and then computing $F(x)$ uses $Θ(n \log n)$ bits. Our scheme has applications in distributed storage, coded computation, and homomorphic secret sharing.

It has long been known that the existence of certain superquantum nonlocal correlations would cause communication complexity to collapse. The absurdity of a world in which any function could be evaluated by two players with a constant amount of communication in turn provides a tantalizing way to distinguish quantum mechanics from incorrect theories of physics; the statement “communication complexity is nontrivial” has even been conjectured to be a concise information-theoretic axiom for characterizing quantum mechanics. We directly address the viability of that perspective with two results. First, we exhibit a nonlocal game such that communication complexity collapses in any physical theory whose maximal winning probability exceeds the quantum value. Second, we consider the venerable CHSH game that initiated this line of inquiry. In that case, the quantum value is about 0.85 but it is known that a winning probability of approximately 0.91 would collapse communication complexity. We show that the 0.91 result is the best possible using a large class of proof strategies, suggesting that the communication complexity axiom is insufficient for characterizing CHSH correlations. Both results build on new insights about reliable classical computation. The first exploits our formalization of an equivalence between amplification and reliable computation, while the second follows from a rigorous determination of the threshold for reliable computation with formulas of noise-free XOR gates and noisy AND gates.