On the NP-Hardness of Bounded Distance Decoding of Reed-Solomon Codes

Transcription

1 On the NP-Hardness of Bounded Distance Decoding of Reed-Solomon Codes Venkata Gandikota Purdue Universit Badih Ghazi MIT Elena Grigorescu Purdue Universit Abstract Guruswami and Vard (IEEE Trans. Inf. Theor, 005) show that given a Reed-Solomon code over a finite field F, of length n and dimension t, and given a target vector v F n, it is NP-hard to decide if there is a codeword that disagrees with v on at most n t 1 coordinates. Understanding the complexit of this Bounded Distance Decoding problem as the amount of error in the target decreases is an important open problem in the stud of Reed-Solomon codes. In this work, we extend the result of Guruswami and Vard b proving that it is NP-hard to decide the existence of a codeword that disagrees with v on n t, and on n t 3 coordinates. No other NP-hardness results were known before for an amount of error < n t 1. The core of our proofs is showing the NP-hardness of a parameterized generalization of the Subset-Sum problem to higher degrees (called Moments Subset-Sum) that ma be of independent interest. I. INTRODUCTION A linear error-correcting code of length n and dimension t, over a finite field alphabet F, is a vector space C F n of dimension t. The Hamming distance between x, F n is δ(x, ) := {i [n] : x i i }, and the minimum distance of C is λ(c) := min x C δ(x, ). In the Bounded Distance Decoding problem with parameter d, we are given a code C F n and a target vector v F n, and we are asked to decide whether there exists a codeword c C such that the Hamming distance δ(v, c) e(d, λ(c)), where e(d, ) is an error-weight function of interest. This is a fundamental question in the stud of general error-correcting codes, and its complexit is not full understood even for wellstudied codes such as Reed-Solomon (RS) codes. More precisel, RS codes still exhibit a wide gap between the setting of small error-weight, where the problem is solvable in polnomial-time [Sud97], [GS99], and the setting of large error-weight, where the problem is known to be NP-hard [GV05]. In this work, we improve this gap b generalizing the decade-old NP-hardness results of [GV05] to smaller error parameters. A Reed-Solomon code of length n, dimension t, defined over a finite field F, and specified b an evaluation set D = {x 1, x,..., x n } F is the set RS D,t = { f(x 1 ),..., f(x n ) : x 1,..., x n D, f(x) F[x], deg(f(x)) t 1}. Its minimum distance is λ = n t + 1. We are interested in the Bounded Distance Decoding problem for RS codes with parameter d (denoted RS-BDD d ) corresponding to the error-weight function e(d, λ) = λ d 1 = n t d. When e n nt (i.e., the Johnson radius ), the list-decoding algorithms of [Sud97], [GS99] can solve RS-BDD nt t in polnomial time. At the other end of the spectrum, if e = n t one can easil interpolate a degree t 1 polnomial that agrees with the target on a set of t arbitrar entries. The famous result of [GV05] shows that right below this value, i.e., when e = n t 1, RS-BDD 1 is NP-hard. Their proof is via a reduction from the 3D-matching problem, and it does not impl an hardness results for smaller values of the error-weight parameter. In the range where e < n t 1, the onl known hardness result is due to [CW10] who show a reduction from the Discrete Log problem, when the evaluation set is D = F q, for e 3 (n t + 1). Note that the hardness of Discrete Log is a stronger complexit-theoretic assumption than P NP. In particular, the Discrete Log problem over finite fields is not believed to be NP-hard and [Sho97] gives a polnomial-time quantum algorithm solving it. In this work, we prove that for ever d {, 3}, the RS-BDD d problem is NP-hard. We note that, as is the case of [GV05], our reductions require that n be pollogarithmic in F. Our proof starts with the observation that an extension of the Subset-Sum problem up to d moments (called Moments Subset-Sum with parameter d) is polnomial-time reducible to RS-BDD d. The crux of our proof is showing the NP-hardness of the Moments Subset-Sum problem, formall defined next. Definition 1 (Moments Subset-Sum: MSS d ). Given a set A = {a 1, a,..., a n } F n, integer k, and m 1, m,..., m d F, decide if there exists a subset S A of size k, satisfing s S si = m i for all i [d]. Note that MSS 1 is the usual Subset-Sum problem, which is in fact used b [CM07] to show an alternate

2 proof of [GV05]. The NP-hardness of Subset-Sum can be shown b a well-known reduction from 3-SAT. Surprisingl, it turns out to be much more difficult to prove NP-hardness for MSS d for values of d. Intuitivel, this is because the reduction from 3-SAT to Subset-Sum encodes satisfiabilit of a 3-SAT formula in the decimal representation of the integers of the Subset- Sum instance, and it becomes more difficult to control the decimal representations when constraints involving squares and higher powers are introduced. In fact, the current barrier to extending our proof approach to show the NP-hardness of MSS d for larger values of d (and thereb obtain the NP-hardness of RS- BDD d for larger values of d) is the following intriguing algebraic question. Question 1. Given a finite field F, a, b F, and d N, does there exist t = t(d) and explicit x 1, x,..., x t, 1,,..., t F satisfing x 1 + x + t t...+x t = t and a i + x i j = b i + for ever i {,..., d}? 1 j=1 j=1 For d {, 3}, we are able to answer this question in the affirmative and to provide explicit constructions over domains that are either finite fields of large characteristic, the rational numbers or the ring of integers. These constructions form the starting point of our NP-hardness proofs. II. REDUCTION FROM MOMENTS SUBSET SUM We start b reformulating the RS-BDD problem as a polnomial reconstruction question as follows. Definition (RS-BDD d ). Given a set of n distinct points in F, D = {(x 1, 1 ), (x, ),..., (x n, n )}, and an integer t < n, decide if there exists a polnomial f(x) F[x] of degree at most t 1 passing through at least t + d points in D. Here, the set of evaluation points of the code is D = {x 1,... x n } and the target vector is = ( 1,..., n ) F n. Note that if a polnomial f(x) passes through at least t+d points in D, then the corresponding codeword f(x 1 ),..., f(x n ) is at a Hamming distance of at most e = n t d from. We will reduce from the following problem which can be easil seen to be equivalent to MSS d over large prime finite fields F using Newton s identities [Sta99]. We note that this connection has been previousl made (e.g. [LW08]). Definition 3 (Smmetric Subset-Sum (SSS d )). Given a set of n distinct elements of F, A = {a 1, a,..., a n }, 1 We note that the same question is also of interest when a, b, x 1, x,..., x t, 1,,..., t are rational numbers or integers. i j integer k, and B 1, B,... B d F, decide if there exists a subset S of A of size k, such that for ever i [d] the elementar smmetric sums of the elements of S = {s 1,..., s k } satisf E i (S) = 1 j s 1<j < <j i k j 1... s ji = B i. We defer the proof of the reduction from SSS d (and hence from MSS d ) to RS-BDD d to Lemma 6 in Appendix A. III. NP-HARDNESS OF MSS Theorem 4. MSS is NP-hard. Proof: We present the proof for the case where the domain is the ring of integers, and then observe that the proof easil extends to an sufficientl large prime field (see the end of the proof for the details). We give a polnomial-time reduction from the 1-in-3- SAT problem in which we are given a 3-SAT formula φ on n variables and m clauses and are asked to determine if there exists an assignment x {0, 1} n satisfing exactl one literal in each clause. It is known that this problem is NP-hard even for m = O(n) [Sch78]. We start b recalling the reduction from 1-in-3-SAT to Subset-Sum which will be used in our reduction to MSS. In that reduction, each variable (x i, x i ) is mapped to integers a i (corresponding to x i ) and b i (corresponding to x i ). The integers a i and b i and the target B are defined in terms of their length-(n + m) Σ-ar representation (for some sufficientl large even constant, sa Σ = 4) as follows: The Σ-ar representatios of a i and b i consist of parts: a variable region consisting of the leftmost n digits and a clause region consisting of the (remaining) rightmost m digits. In the variable region, a i and b i have a 1 at the ith digit and 0 s at the other digits. In the clause region, for ever j [m], a i (resp. b i ) has a 1 at the jth location if x i (resp. x i ) appears in clause j, and a 0 otherwise. The target B is set to the integer whose Σ-ar representation is the all 1 s. Those Σ-ar representations are illustrated in Figure 1. n Σ-ar digits variable region m Σ-ar digits clause region Target: B = Fig. 1. Σ-ar representations in the original reduction from 1-in-3- SAT to Subset-Sum.

3 This reduction to Subset-Sum can be seen to be complete and sound. We now use it to give a reduction to MSS. In this reduction, each variable (x i, x i ) is mapped to 6 integers a i,1, a i,, a (corresponding to x i ) and b i,1, b i,, b (corresponding to x i ). Let {a i, b i : i [n]} be the integers produced b the above reduction to Subset-Sum. We denote b a v i (resp. a c i ) the Σ-ar representation of the variable (resp. clause) region of a i. For an Σ-ar representation x of a natural number, let (x) Σ be the natural number whose Σ -representation is x. For example, if x is the Σ-ar number (10011), then (x) Σ = Σ 4 +Σ +1. Denote b 1 l the concatenation of l ones. Let ν and h be natural numbers to be specified later on. The integers a i,1, a i,, a, b i,1, b i,, b and the targets B 1 and B are defined as follows: a i,1 = Σ ν+m+h 1 (a v i ) Σ + h Σν (a c i ) Σ b i,1 = Σ ν+m+h 1 (b v i ) Σ + h Σν (b c i ) Σ a i, = a i,1 b i,1 4Σ Σi i and a = a i,. b i, = a i,1 b i,1 4Σ + Σi i and b = b i,. B 1 = Σ ν+m+h 1 (1 n ) Σ h + Σ ν (1 m ) Σ n B = a i,1 + a i, + a. Note that a i,1 (resp. a i, ) defined above can be seen as obtained b inserting h 1 consecutive 0 s in the variable region of the Σ-ar representation of a i (resp. b i ), and then inserting ν zeros at the right. Those Σ-ar representations are illustrated in Figure. Moreover, observe that a i,, a, b i,, b are defined above in such a wa that a i, + a = b i, + b = 0 and a i,1 + a i, + a = b i,1 + b i, + b. Note that this reduction runs in time polnomial in n, m, h and ν. We next prove the correctness of the reduction. a) Completeness: Assume that the starting 3-SAT formula has a satisfing 1-in-3-SAT assignment x. Consider the subset S = :x{a i,1, a i,, a } :xi=0{b i,1, b i,, b } of size k = 3n. We now check that the first moments of S equal B 1 and B. = a i,1 + a i, + a + b i,1 + b i, + b S : x i =1 = = + = Σ ν+m+h 1 ( a i,1 + : x i =0 b i,1 Σ ν+m+h 1 (a v i ) Σ h + Σ ν (a c i) Σ Σ ν+m+h 1 (b v i ) Σ h + Σ ν (b c i) Σ a v i + b v i ) Σ h + Σ ν ( a c i + b c i) Σ = Σ ν+m+h 1 (1 n ) Σ h + Σ ν (1 m ) Σ = B 1 Furthermore, = S + a i,1 + a i, + a b i,1 + b i, + b = a i,1 + a i, + a = B where we used the fact that a i,1 + a i, + a = b i,1 + b i, + b for ever i [n]. b) Soundness: Assume that S is a satisfing subset of the MSS instance. We will use S in order to construct a 1-in-3-SAT satisfing assignment to the starting 3-SAT instance φ. Let s first sketch the high-level intuition of the proof. First, we argue that S should contain the same number of positive and negative integers from the set {a 1,, b 1,, a 1,3, b 1,3 }. This is because these four integers have roughl the same absolute value, which turns out to be much larger than B 1 and than an other possible integer in S. Thus, unless S contains the same number of positive and negative elements from {a 1,, b 1,, a 1,3, b 1,3 }, the integers in S cannot add up to B 1. Then, we show using an inductive argument that for each i [n], S contains the same number of positive and negative elements from {a i,, b i,, a, b } (i.e., Lemma 1). We next prove that, in fact, the elements of S from the set n {a i,, b i,, a, b } exactl cancel each other out, i.e., the add up to 0. Hence, we obtain that the integers of S from n {a i,1, b i,1 } add up to B 1, at which point we can run the soundness analsis of the original reduction from 1-in-3-SAT to Subset Sum in order to construct an assignment satisfing exactl one litteral in each clause. We now give the formal proof, which starts with the following lemma whose proof appears in Appendix B. We assume henceforth that ν 10(m + nh) and h 10m. Lemma 1. For ever i [n], S {a i,, b i, } = S {a, b }. Lemma 1 implies that for ever i [n], = r i Σ i for some r i S {a i,,b i,,a,b } { 1, 0, 1}. The next lemma, whose proof appears in Appendix B, argues that in fact each r i equals 0. Lemma. For ever i [n], r i = 0. 3

4 nh Σ-ar digits m Σ-ar digits ν Σ-ar digits large components region variable region clause region shift region 1st moment: B 1 = Fig.. Σ-ar representations in the reduction from 1-in-3-SAT to MSS. In this figure, h = 3. The large components region onl contains zeros in {a i,1, b i,1 : i [n]} but contains non-zeros in { a i,, b i, : i [n]}. Lemma implies that = 0 S n {ai,,bi,,a,b} and hence that = B 1. We can S n {ai,1,bi,1} now carr out the soundness analsis of the original reduction from 1-in-3-SAT to Subset Sum in order to construct an assignmnent that satisfies exactl one litteral in each clause of the given 3-SAT formula. This concludes the soundness analsis of our reduction. To sum up, setting h = 10m, ν = 10(m + nh) and Σ to be a sufficientl large even constant (sa 4) ields a polnomial-time reduction from 1-in-3-SAT to MSS. Hence, MSS is NP-hard. We now extend the proof to an sufficientl large prime field. Let p cn be a prime number with c some absolute constant. This ensures that the magnitudes of all integers appearing in the above proof are < p/. Performing the above computations modulo p, we can carr out all the arguments as in the case of the integers, and hence the proof holds over F p. IV. NP-HARDNESS OF MSS 3 Theorem 5. MSS 3 is NP-hard. Proof: We present the proof over the field of rational numbers, and then observe that the proof easil extends to an sufficientl large prime field (see the end of the proof for the details). We give a polnomial-time reduction from the 1- in-3-sat problem in which we are given a 3-SAT formula φ on n variables and m clauses and are asked to determine whether there exists an assignment x {0, 1} n that satisfies exactl one literal in each clause. It is known that this problem is NP-hard even for m = O(n) [Sch78]. Recall the known reduction from 1-in-3-SAT to Subset-Sum that is described at the beginning of the proof of Theorem 4. Let a i and b i be the positive integers corresponding to variable (x i, x i ) and let B be the target positive integer in that reduction. As before the Σ-ar representations of the a i s, the b i s and B are illustrated in Figure 1. We now use this reduction to reduce 1-in-3-SAT to MSS 3. In the new reduction, each variable (x i, x i ) is mapped to 6 rational numbers a i,1, a i,, a (corresponding to x i ) and b i,1, b i,, b (corresponding to x i ). The smbols a v i, a c i and (x) Σ are defined as in the proof of Theroem 4. Let ν and h be natural numbers to be specified later on. The rational numbers a i,1, a i,, a, b i,1, b i,, b and the targets B 1, B and B 3 are defined as follows: a i,1 = Σ ν+m+h 1 (a v i ) Σ h + Σν (a c i ) Σ b i,1 = Σ ν+m+h 1 (b v i ) Σ h + Σν (b c i ) Σ Define β i := Σ i, γ i := a i,1 b i,1 β i and α i := a 3 i,1 b 3 i,1 6β iγ i. a i, = α i + γi βi... βi. a = α i γi + βi b i, = α i + γi + βi b = α i γi B 1 = Σ ν+m+h 1 (1 n ) Σ h + Σ ν (1 m ) Σ + n a i, + a. B = B 3 = n n a i,1 + a. a 3 i,1 + a 3 i, + a 3. Note that a i,1 and b i,1 are positive integers defined as in the proof of Theroem 4 and, in particular, their Σ-ar representations are identical to those illustrated in Figure for the reduction from 1-in-3-SAT to MSS. Note that this reduction runs in time polnomial in n, m, h and ν. We next prove the correctness of the reduction. c) Completeness: The completeness analsis uses the next proposition whose proof appears in Appendix C. Proposition 1. For ever i [n], the quantities a i,, a, b i,, b defined above satisf a i, + a = b i, + b a i,1 + a = b i,1 + b i, + b a 3 i,1 + a 3 i, + a 3 = b 3 i,1 + b 3 i, + b 3 Assume that the starting 3 SAT formula has a satisfing 1-in-3-SAT assignment x. Consider the subset S = :x{a i,1, a i,, a } :xi=0{b i,1, b i,, b } of size k = 3n. In Appendix C, we use Proposition 1 to check that the first 3 moments of S equal B 1, B and B 3 respectivel. 4

5 d) Soundness: Assume that S is a satisfing subset of the MSS 3 instance. We will use S in order to construct a 1-in-3-SAT satisfing assignment to the starting 3- SAT formula φ. Let s first sketch the high-level intuition of the proof. First, we prove using an inductive argument (i.e., Lemma 3) that, for each i [n], S should contain the same number of positive and negative rational numbers from the set {a i,, b i,, a, b }. This is because these four numbers have roughl the same absolute value, which turns out to be much larger than B 1 and than an other possible number in S. Thus, unless S contains the same number of positive and negative elements from {a i,, b i,, a, b }, the elements of S cannot add up to B 1. Next, we show using another inductive argument (i.e., Lemma 4) that, for ever i [n], S should contain exactl two elements from the set {a i,, b i,, a, b }. This is because otherwise, the sum of squares of the elements in S {a i,, b i,, a, b } would be ver far from a i, +a, which would impl that the sum of squares of the elements in S is ver far from B. We then show (in Lemma 5) that, in fact, the elements of S {a i,, b i,, a, b } exactl add up to α i ; namel, the β i and γ i terms cancel each other out. Hence, we obtain that the elements of S from n {a i,1, b i,1} add up to B 1 α i = Σ ν+m+h 1 (1 n ) Σ h+σ ν (1 m ) Σ, at which point we can run the soundness analsis of the original reduction from 1-in-3-SAT to Subset Sum in order to construct an assignment satisfing exactl one literal in each clause. We now give the formal proof which uses the following lemmas whose proofs appear in Appendix C. We set ν = 10(m + nh) and h = 10m. Lemma 3. i [n], S {a i,, b i,} = S {a, b }. Lemma 4. i [n], S {a i,, b i,, a, b } =. n Lemma 5. = α i. S n {a i,,b i,,a,b } Lemmas 3, 4 and 5 impl that S n {a i,1,b i,1} = Σ ν+m+h 1 (1 n ) Σ h + Σ ν (1 m ) Σ. We now carr out the soundness analsis of the original reduction from 1-in- 3-SAT to Subset Sum to construct an assignmnent that satisfies exactl one literal in each clause of the given 3-SAT formula. This concludes our soundness analsis. Thus, setting Σ to be a sufficientl large even constant (sa 4) ields a polnomial-time reduction from 1-in-3- SAT to MSS 3. Hence, MSS 3 is NP-hard. The proof also holds over the ring of integers b first multipling the numbers {a i,j, b i,j }, B 1, B, B 3 b the least common multiple of the denominators of {α i, γ i /, α i /}. This preserves the moment constraints since the are homogeneous equations. Let c = O(1) and p > cn3 be a prime number such that all integers appearing in this proof are < p/. The proof extends to F p b performing all computations modulo p. V. CONCLUSION In this work, we proved that RS-BDD and RS-BDD 3 are NP-hard. The main open problem raised b our work is to understand the limits of our approach. In particular, can one design explicit constructions satisfing the properties in Question 1, and use them to prove the NPhardness of RS-BDD d for larger values of d? Finall, we remark that a positive answer to Question 1 could ield to a better understanding of the structure of BCH codes over large fields, and to their the local testabilit properties (e.g., [GK1].) ACKNOWLEDGMENT The authors would like to thank Amir Abboud, Swastik Koppart, Madhu Sudan and Andrew Sutherland for ver helpful discussions and pointers. [CM07] REFERENCES Qi Cheng and Elizabeth Murra. On deciding deep holes of Reed-Solomon codes. In TAMC 007, Shanghai, China, pages , 007. [CW10] Qi Cheng and Daqing Wan. Complexit of decoding positive-rate primitive Reed-Solomon codes. IEEE Transactions on Information Theor, 56(10):517 5, 010. [GK1] Elena Grigorescu and Tali Kaufman. Explicit low-weight bases for BCH codes. IEEE Transactions on Information Theor, 58(1):78 81, 01. [GS99] Venkatesan Guruswami and Madhu Sudan. Improved decoding of reed-solomon and algebraic-geometr codes. IEEE Transactions on Information Theor, 45(6): , [GV05] Venkatesan Guruswami and Alexander Vard. Maximumlikelihood decoding of Reed-Solomon codes is NP-hard. IEEE Transactions on Information Theor, 51(7):49 56, 005. [LW08] Jiou Li and Daqing Wan. On the subset sum problem over finite fields. Finite Fields and Their Applications, 14(4):911 99, 008. [Sch78] [Sho97] [Sta99] [Sud97] Thomas J Schaefer. The complexit of satisfiabilit problems. In Proceedings of the tenth annual ACM smposium on Theor of computing, pages ACM, Peter W Shor. Polnomial-time algorithms for prime factorization and discrete logarithms on a quantum computer. SIAM Journal on Computing, 6(5): , R P Stanle. Enumerative Combinatorics, vol.. Cambridge Universit Press, Madhu Sudan. Decoding of Reed Solomon codes beond the error-correction bound. J. Complexit, 13(1): ,

6 A. Proofs from Section II APPENDIX Lemma 6. SSS d is polnomial-time reducible to RS- BDD d. Proof: Henceforth, let q := F. Given an instance A, k, B 1, B,..., B d of SSS d, we construct an instance D, t of RS-BDD d such that there exists a polnomial f(x) F q [X] of degree at most t 1 which agrees with at least t + d points of D if and onl if there is a solution to the given instance of SSS d. Here, A = {a 1, a,..., a n } is a set of distinct, nonzero elements of F q, B 1, B,..., B d F q and k Z. Let t = k d + 1. Define the degree d polnomial p(x) := x d B 1 x d ( 1) d 1 B d 1 x. For each a i of A, define an element of F q as i = p(a i ) The set D is then given b D = {(a 1 i, i ) for all a i A} {(0, ( 1) d B d )}. Note that D, t is an instance of RS-BDD d which can be constructed in polnomial time given the instance A, k, B 1,..., B d of SSS d. Let S be the solution to SSS d. We now show that there exists a polnomial of degree at most k d which agrees with D in at least k + 1 points. Define the following degree k polnomial, g(x) := (x a i ) = c 0 + c 1 x + + c k 1 x k 1 + x k a i S The coefficients of this polnomial are the smmetric sums of the roots of g(x). Therefore, c k d = ( 1) d B d,..., c k = B, and c k 1 = B 1. Now define, f(x) = (x k g(1/x) x d p(1/x))/x d = c 0 x k d + c 1 x k d c k d and note that f(x) has degree k d = t 1. Also, the constant term of this polnomial is c k d = ( 1) d B d. Hence, f(0) = ( 1) d B d and since g(a i ) = 0, for all a i S, it follows that f(a 1 i ) = p(a i ) = i for all a i S. Therefore, f(x) agrees with k + 1 = t + d points in D. Conversel, we now show that if there is a polnomial f(x) of degree at most t 1 which agrees with t + d points in D, then there is a solution to SSS d. We first observe that if a degree t 1 polnomial passes through t + d points of D, then it has to pass through (0, ( 1) d B d ). To show this, assume f(x) agrees with t + d points of the form (a 1 i, i ) D. Let g(x) be a t + d 1 degree polnomial defined as, g(x) = x t 1 (f(1/x) + p(x)) Therefore, if f(x) = c 0 + c 1 x + + c t 1 x t 1, g(x) can be written as g(x) = x t+d 1 + B 1 x t+d + + ( 1) d 1 B d 1 x t + c 0 x t 1 + c 1 x t + + c t 1 Since, we know that f(a 1 i ) = i = p(a i ) for t + d points, we have b defintion that g(a i ) = 0 for these t + d a is. This is a contradiction since g(x) has degree at most t+d 1 and it cannot have t+d roots. Therefore, f(0) = c 0 = ( 1) d B d. Also, g(x) has t + d 1 = k roots which have their first d smmetric sums equal to B 1, B,..., B d respectivel. Hence, there exists a solution to the given instance of SSS d. B. Proofs from Section III We now prove Lemma 1. To do so, we need the following lemma whose proof is deferred to the end of the section. Lemma 7. Let j 1 be an integer and assume that S {a j,, b j, } = S {a j,3, b j,3 }. Furthermore, assume that if j, then S {a i,, b i, } = S {a, b } for all i < j. Then, we have the following two inequalities: (i) Ω(Σν n ). (ii) S {a j,,b j,,a j,3,b j,3} S {a j,,b j,,a j,3,b j,3} S\{a j,,b j,,a j,3,b j,3} We are now read to prove Lemma 1. ΣΩ(min(ν,h)). Proof of Lemma 1: We proceed b induction on i [n]. At the jth step of the induction (with j ), we assume that S {a i,, b i, } = S {a, b } for all i < j and we need to show that S {a j,, b j, } = S {a j,3, b j,3 }. Assume for the sake of contradiction that S {a j,, b j, } S {a j,3, b j,3 }. Then, Lemma 7 and the fact that for an a, b R, a b max( a, b ) min( a, b ) impl that S = + S {a j,,b j,,a j,3,b j,3} S\{a j,,b j,,a j,3,b j,3} S {a j,,b j,,a j,3,b j,3} S\{a j,,b j,,a j,3,b j,3} 6

7 1 (1 Σ ) Ω(min(ν,h)) = Ω(Σ ν n ) S {a j,,b j,,a j,3,b j,3} On the other hand, we have that B 1 = B 1 Σ nh+m+ν. Hence, we get a contradiction since ν 10(m + nh). The base case of the induction corresponds to setting j = 1 and it follows along the same lines as above except that we invoke Lemma 7 with j = 1. This concludes the proof of Lemma 1. We now prove Lemma. Proof of Lemma : To see this, assume for the sake of contradiction that there exists i [n] s.t. r i { 1, 1} and let i [n] be the smallest such i. Since the Σ-ar representations of each of B 1 and {a i,1, b i,1 : i [n]} have zeros in the rightmost ν digits, the first moment constraint = B 1 is equivalent S to l i=i +1 c i Σ i + r i Σ i = 0 for some l N and c i { 1, 0, 1, } for all i {i + 1,..., l}. Dividing l b Σ i, we get that c i Σ i i = r i. Since Σ is i=i +1 assumed to be an even integer and since r i { 1, 1}, the left-hand side is an even integer whereas the righthand side is an odd integer; a contradiction. The onl remaining part is to prove Lemma 7. Proof of Lemma 7: We first derive in the next proposition some inequalities that are satisfied b the integers {a i,1, a i,, a, b i,1, b i,, b : i [n]} and that will be used to prove Lemma 7. Proposition. Let j [n]. 1) a j,1 b j,1 Σ ν. ) If ν 10(m + nh), then i [n] : a j, a i,1 Σ Ω(ν) and a j, b i,1 3) If h 10m and j < n, then Σ Ω(ν) i {j + 1,..., n} : a j, a i, ΣΩ(h) and a j, b i, ΣΩ(h) The same inequalities also hold if we replace a j, b b j,. Proof of Proposition : The first part of the proposition follows from the assumption (which can be made without loss of generalit) that for each j [n], there exists a SAT clause that contains exactl one of x j and x j. We next prove the second part of the proposition. Fix j, i [n]. Without loss of generalit, assume that a j,1 > b j,1. Then, the first part of the proposition ields that a j,1 b j,1 Σ ν. Then, we have that a j, = a j,1 b j,1 Σj = (a j,1 b j,1 )(a j,1 + b j,1 ) Σν Σ ν Σj Σ ν 3n Σj On the other hand, we have that a i,1 Σ ν+m+nh and b i,1 Σ ν+m+nh. Using the assumption that ν 10(m + nh), we conclude that aj, a i,1 Σ Ω(ν) and a j, b i,1 Σ Ω(ν). We now prove the third part of the proposition. Fix j < n and i {j+1,..., n}. Without loss of generalit, assume that a j,1 > b j,1 and a i,1 > b i,1. Then, we have that a j, = (a j,1 b j,1 )(a j,1 + b j,1 ) Σν Σ (n j)h+m+ν Σ ν+(n j)h+m j On the other hand, we have that Therefore, a i, = (a i,1 b i,1 )(a i,1 + b i,1 ) 4Σ i Σj Σj Σi Σν+m Σ (n i)h+m+ν+1 4Σ i = Σ ν+m+(n i)h i+1 a j, a i, 1 Σ(i j)h m+(i j) 1 1 Σh m = Σ Ω(h) where the last equalit above follows from the assumption that h 10m. The proof that a j, b i, Σ Ω(h) follows along the same lines. Observe that for an j 1, if S {a j,, b j, } S {a j,3, b j,3 }, then S {a j,, b j,, a j,3, b j,3 } is one of the following possible sets: {a j, }, {b j, }, {a j,3 }, {b j,3 }, {a j,, b j,, a j,3 }, {a j,, b j,, b j,3 }, {a j,, a j,3, b j,3 }, {b j,, a j,3, b j,3 } 7

8 In each of these cases, the following inequalit is satisfied min( a j,, b j, ) Σ j (1) S {a j,,b j,,a j,3,b j,3} We now prove the first part of Lemma 7. Since S {a j,, b j, } = S {a j,3, b j,3 } and assuming that a j,1 > b j,1 without loss of generalit, Eq. (1) gives that (a j,1 b j,1)(a j,1 + b j,1) S {a j,,b j,,a j,3,b j,3} 3Σj Σν Σ ν+m+(n j)h 3Σj = Ω(Σ ν n ) We now prove the second part of Lemma 7, which we first show for the case where j and S {a i,, b i, } = S {a, b } for all i < j. These equalities impl that Σ O(n) and hence min( a j,, b j, ) Σ ν 3n Σ Ω(ν) S j 1 {ai,,bi,,a,b} S j 1 {ai,,bi,,a,b} () Using Equation (1) and Proposition, we then have that min( a j,, b j, ) Σ j S {a j,,b j,,a j,3,b j,3} Θ(n) 1 Θ(n) 1 ( Θ(n) j=1 min( a j,, b j, ) Σ j Σ Ω(ν) S n {ai,1,bi,1} + Σ Ω(h) S n i=j+1 {ai,,bi,,a,b} + Σ Ω(ν) S j 1 {ai,,bi,,a,b} ) Σ j Σ Ω(min(ν,h)) S\{a j,,b j,,a j,3,b j,3} where the last inequalit above follows from the triangle inequalit. The proof for the case where j = 1 follows along the same lines as above except that the quantit is replaced b 0 and Equation () is not S j 1 {ai,,bi,,a,b} needed. C. Proofs from Section IV Proof of Proposition 1: For the first identit, we have that a i, + a = α i = b i, + b. For the second identit, we have that a i,1 + a (b i,1 + b i, + b ) = a i,1 b i,1 + (a i, b i,)(a i, + b i,) + (a b )(a + b ) = a i,1 b i,1 β i (α i + γ i ) + β i (α i γ i ) = a i,1 b i,1 β i γ i = 0 For the third identit, we have that a 3 i,1 + a 3 i, + a 3 (b 3 i,1 + b 3 i, + b 3 ) i,1 + (a i, b i,)(a i, + a i,b i, + b i,) + (a b )(a + a b + b ) i,1 β i (a i, + a i,b i, + b i,) + β i (a + a b + b ) i,1 β i ((a i, a )(a i, + a ) + a i,b i, a b + (b i, b )(b i, + b ) i,1 β i ((γ i β i )α i + a i,b i, a b + (γ i + β i )α i ) i,1 4α i β i γ i β i (a i,b i, a b ) i,1 6α i β i γ i = 0 where the penultimate equalit uses the fact that a i,b i, a b = α i γ i. We now use Proposition 1 in order to check that the first 3 moments of S are equal to B 1, B and ) 8

9 B 3 respectivel, and thereb finish the completeness analsis of Theorem 5. = a i,1 + a i, + a S + = + = b i,1 + b i, + b a i,1 + a i, + a + a i,1 + + a i, + a = + + a i, + a = Σ ν+m+h 1 ( + Σ ν ( b i,1 b i,1 b i, + b Σ ν+m+h 1 (a v i ) Σ h + Σ ν (a c i) Σ Σ ν+m+h 1 (b v i ) Σ h + Σ ν (b c i) Σ a c i + + a i, + a a v i + b c i) Σ = Σ ν+m+h 1 (1 n ) Σ h + Σ ν (1 m ) Σ + a i, + a = B 1 Furthermore, = Finall, S 3 = S + = = B + a i,1 + a b i,1 + b i, + b a i,1 + a a 3 i,1 + a 3 i, + a 3 b 3 i,1 + b 3 i, + b 3 b v i ) Σ h = = B 3 a 3 i,1 + a 3 i, + a 3 We now turn to the proofs of Lemmas 3, 4 and 5. We will use the following proposition whose proof is similar to that of Proposition (because of the fact that a i,l = Θ( a i,l ) and b i,l = Θ( b i,l ) for ever i [n] and l [3]). Proposition 3. Let j [n]. 1) a j,1 b j,1 Σ ν. ) If ν 10(m + nh), then a j, i [n] : a Σ Ω(ν) and a j, i,1 b i,1 3) If h 10m and j < n, then i {j + 1,..., n} : a j, a i, ΣΩ(h) Σ Ω(ν) 4) If ν 10(m + nh), j, i < j and S {a i,, b i,, a, b } =, then a j,/σ Ω(ν) is at least a S {a i,,b i,,a,b } The same inequalities also hold if we replace a j, b one of {b j,, a j,3, b j,3} or if we replace a i, b one of {b i,, a, b } Proof of Lemma 3: Follows along the same lines as the proof of Lemma 1 but using Proposition 3 instead of Proposition. The proof of Lemma 4 uses the following lemma. Lemma 8. Let j 1 be an integer. Furthermore, assume that if j, then S {a i,, b i,, a, b } = for all i < j. Then, min {a j,,b j,,a j,3,b j,3 } is lower bounded b: ( n (i) Σ Ω(min(ν,h)) a i,1 + n i=j+1 j 1 (a a ) + S {a i,,b i,,a,b } (ii) Σ( Ω(min(ν,h)) + S n i=j+1 {a i,,b i,,a,b } S n {a i,1,b i,1} ) ) 9

10 Proof of Lemma 8: Similar to that of Lemma 7 but uses Proposition 3 instead of Proposition. Proof of Lemma 4: We proceed b induction on i [n]. At the jth step of the induction (with j ), we assume that S {a i,, b i,, a, b } = for all i < j and we need to show that S {a j,, b j,, a j,3, b j,3} =. Assume for the sake of contradiction that S {a j,, b j,, a j,3, b j,3}. We have that B S j {a i,,b i,,a,b } where q 1 := (a j, +a j,3) and j 1 ( q := n S {a i,,b i,,a,b } a i,1 n i=j+1 (a = q 1 q S {a j,,b j,,a j,3,b j,3} a i, a ) ) Then, Lemma 8 and the fact that for an a, b R, a b max( a, b ) min( a, b ) impl that B j, + a + (a ( j 1 S j {a i,,b i,,a,b } a n Ω( a i,1 + j,3) n i=j+1 min q 1 q ) S {a j,,b j,,a j,3,b j,3} (a S {a i,,b i,,a,b } {a j,,b j,,a j,3,b j,3 } ) ) 1 min Σ Ω(min(ν,h)) {a j,,b j,,a j,3,b j,3 } = Ω( min {a j,,b j,,a j,3,b j,3 } ) Lemma 8 impl that B = + S j {a i,,b i,,a,b } S n i=j+1 {a i,,b i,,a,b } S n {a i,1,b i,1} 1 min Σ Ω(min(ν,h)) {a j,,b j,,a j,3,b j,3 } which ields a contradiction. Proof of Lemma 5: Lemmas 3 and 4 impl that for ever i [n], = α i +r i Σ i S {a i,,b i,,a,b } for some r i { 1, 0, 1}. The next lemma argues that, in fact, all r i s are equal to 0. Lemma 9. For ever i [n], r i = 0. Proof of Lemma 9: To see this, assume for the sake of contradiction that there exists i [n] s.t. r i { 1, 1} and let i [n] be the smallest such i. Note that the first moment constraint = S B 1 is equivalent to S n {a i,1,b i,1} + n r i Σ i = Σ ν+m+h 1 (1 n ) Σ h + Σ ν (1 m ) Σ. Since the Σ- ar representations of each of the positive integers Σ ν+m+h 1 (1 n ) Σ h + Σ ν (1 m ) Σ and {a i,1, b i,1 : i [n]} have zeros in the rightmost ν digits, this constraint l is also equivalent to c i Σ i + r i Σ i = 0 for some i=i +1 l N and c i { 1, 0, 1, } for all i {i + 1,..., l}. l Dividing b Σ i, we get that c i Σ i i = r i. i=i +1 Since Σ is assumed to be an even integer and since r i { 1, 1}, the left-hand side is an even integer whereas the right-hand side is an odd integer; a contradiction. This completes the proof of Lemma 5. On the other hand, the fact that = B and S 10