Linear codes in the Hamming metric have played a central role in error correction since the 1950s and have been extensively studied. In contrast, the theory of codes in the sum-rank metric is still in its early stages, with only a few known constructions.
A cornerstone of coding theory in the Hamming metric is the family of Reed–Solomon (RS) codes, which are constructed by evaluating univariate polynomials at distinct elements of a finite field $F_{q}$ . RS codes have optimal parameters, however, their length is by definition limited by the size of $ F_{q}$. Two classical approaches to overcome this limitation, while maintaining control on the parameters, are considering multivariate polynomials, giving rise to Reed–Muller (RM) codes, and evaluating rational function at points on algebraic curves, leading to Algebraic Geometry (AG) codes.
The sum-rank analogue of RS codes is the family of linearized Reed–Solomon (LRS) codes (see U. Martínez-Peñas 2018), which also achieve optimal parameters but face a similar length restriction as RS codes. In this talk, inspired by the similarities between RS and LRS codes,we will introduce analogues of RM and AG codes in the sum-rank metric, known as linearized Reed–Muller (LRM) codes (see E. Berardini and X. Caruso 2025) and linearized Algebraic Geometry (LAG) codes (see E. Berardini and X. Caruso 2024).
We will begin by reviewing key background on sum-rank metric codes and univariate Ore polynomials. Afterwards, we will introduce the theory of multivariate Ore polynomials and their evaluation, leading to the construction of linearized Reed–Muller codes and an analysis of their parameters. Then, we will develop the theory of Riemann–Roch spaces over Ore polynomial rings with coefficients in the function field of a curve, leveraging the classical framework of divisors and Riemann–Roch spaces on curves. Using this foundation, we will construct linearized AG codes, providing lower bounds on their dimension and minimum distance. We will conclude the talk by sketching some related works in progress.[-]

Curves over finite fields of large genus with many rational points have been of interest for both theoretical reasons and for applications. In the past, various methods have been employed for the construction of such curves. One such method is by means of explicit recursive equations and will be the emphasis of this talk.The first explicit examples were found by Garcia–Stichtenoth over quadratic finite fields in 1995. Afterwards followed the discovery of good towers over cubic finite fields and finally all nonprime finite fields in 2013 (B.–Beelen–Garcia–Stichtenoth). The recursive nature of these towers makes them very special and in fact all good examples have been shown to have a modular interpretation of some sort. The questions of finding good recursive towers over prime fields resisted all attempts for several decades and lead to the common belief that such towers might not exist. In this talk I will try to give an overview of the landscape of explicit recursive towers and present a recently discovered tower over all finite fields including prime fields, except $F_{2}$ and $F_{3}$.
This is joint work with Christophe Ritzenthaler.[-]

In the field of coding theory, Goppa's construction of error-correcting codes on algebraic curves has been widely studied and applied. As noticed by M. Tsfasman and S. Vlădut¸, this construction can be generalized to any algebraic variety. This talk aims to shed light on the case of surfaces and expand the understanding of Goppa's construction beyond curves. After discussing the motivations for considering codes from higher–dimensional varieties, we will compare and contrast codes from curves and codes from surfaces, notably regarding the computation of their parameters, their local properties, and asymptotic constructions.[-]

Asymmetric cryptographic constructions used today could be attacked given a powerful enough quantum computer. Even if such a computer does not exist yet, it is important to anticipate its possible construction and to prepare a transition to cryptographic tools having a security resistant against attacks from quantum computers. I will introduce lattice-based cryptography, which is the most promising candidate to build post-quantum cryptographic constructions, and in particular, how we build efficient constructions based on structured lattice problems.[-]

Asymmetric cryptographic constructions used today could be attacked given a powerful enough quantum computer. Even if such a computer does not exist yet, it is important to anticipate its possible construction and to prepare a transition to cryptographic tools having a security resistant against attacks from quantum computers. I will introduce lattice-based cryptography, which is the most promising candidate to build post-quantum cryptographic constructions, and in particular, how we build efficient constructions based on structured lattice problems.[-]

This talk will focus on the last step of the number field sive algorithm used to compute discrete logarithms in finite fields. We consider here non-prime finite fields of very small extension degree: $1 \le n \le 6$. These cases are interesting in pairing-based cryptography: the pairing output is an element in such a finite field. The discrete logarithm in that finite field must be hard enough to prevent from attacks in a given time (e.g. $10$ years). Within the CATREL project we aim to compute DL records in finite fields of moderate size (e.g. in $GF(p^n$) of global size from $600$ to $800$ bits) to estimate more tightly the hardness of DL in fields of cryptographic size ($2048$ bits at the moment). The best algorithm known to compute discrete logarithms in large finite fields (with small $n$) is the number field sieve (NFS):

(1) polynomial selection: select two distinct polynomials $f,g$ defining two number fields, such that they share modulo $p$ an irreducible degree $n$ factor, and have additional properties to improve the next two steps.
(2) sieving: sieve over elements that satisfy relations, to build the factor basis made of prime ideals of small norm.
(3) linear algebra: compute the kernel of a large matrix computed the step before. Then the logarithm of each element in the factor basis is known.
(4) individual logarithm: for a given element $s \in GF(p^n)$, decompose it over the factor basis to finally compute its discrete logarithm.

The most time consuming steps are the second and third: sieving and linear algerbra. After the sieve and the linear algebra, the logarithms of the prime ideals of small norm are known. To finally compute the discrete logarithm of the given element $s$, we lift $s$ in one of the number fields and factor it in prime ideals as with “small” elements in the sieve step. However here, $s$ does not have a small norm (bounded by $B \ll Q$). Its norm is very large, in particular, larger than $Q$. The usual way is to test for many $s' = s \cdot g^e$ with $g$ the given generator of $GF(p^n)$ until the norm of $s'$ is smooth enough. The time spent to find a good $e$ is asymptotically less than the sieving time. In practice, another modification of $s'$ is computed to reduce its norm. In [?], the authors write $s' = a(x) / b(x)$ with $a, b$ of coefficients of size $\sim p^{1/2}$ instead of $p$. With $n = 4$ the norm of $s$ is $O(p^{11/2})$. Their method compute $a,b$ of norm $O(p^{7/2})$. One need to factor into small prime ideals two elements $a,b$ instead of one $s'$.
for our record computations of discrete logarithms in $\mathbb{F}_pn$ with $2 \leqslant n \leqslant 6$, we improve the preparation of $s$, so that its norm in the number field is less than $Q$. This improves its smoothness property. Assume that we want to compute the discrete logarithm of $s$ in the larger subgroup of prime order $\ell$ of $GF(p^n)$, with $\ell$ $|$ $\Phi_np$. We decompose $s$ in $\epsilon \cdot s'$ with $\epsilon$ in a subfield or in a subgroup of order prime to $\ell$ and $s?$ with reduced coefficient size. We still have $log_g s = log_g s'$ mod $\ell$. We use a tower representation of $GF(p^n)$ with subfields for our purpose. We reduce the norm of $s \in \mathbb{F}_{p4}$ from $O(p^{11/2})$ to $O(p^{7/2}), s \in GF(p^3)$ from $O(p^6)$ to $O(p^2)$ and $s \in \mathbb{F}_{p2}$ from $O(p^4)$ to $O(p)$. This does not change the asymptotic complexity of this last step but this improves a lot its running time for small $n$.[-]