Design and Performance Analysis of a Localized Maximum-Likelihood Decoder for Binary Goppa Codes over AWGN and Rayleigh Fading Channels

1. Introduction

Goppa codes were first introduced by V.D Goppa in 1970 [1]. They are subfield subcodes of Generalized Reed-Solomon (GRS) codes and a special case of alternant codes [2,3,4]. In the same publication [1], Goppa suggested four powerful subclasses of Goppa codes according to the form of Goppa polynomial: $\Gamma (L,G)-$code is referred to as cyclic when $G\left(x\right)=x^f,$ a separable code when $G\left(x\right)$ is a separable polynomial, an irreducible code when $G\left(x\right)$ is an irreducible polynomial, and a cumulative Goppa code if $G\left(x\right)={(x-\beta )}^f,\beta \in {\mathbb{F}}_q.$ In [3], the four classes are defined as the most important class of alternant codes. Furthermore, some irreducible $\Gamma (L,G)-$codes reach the Gilbert–Varshamov bound and also many binary $\Gamma (L,G)-$codes are placed in the table of best known codes [5]. From the original construction of Goppa codes, numerous extensions and variations of Goppa codes have been constructed with the aim of improving the error correcting capability of Goppa codes. In 2009, Bezzateev et al investigated a subclass of non-binary cumulative Goppa codes characterized by reducible polynomials of a specific form and derived improved bounds on both the minimum distance and the code dimension for this class [6]. In [7], the authors described a new type of $\Gamma (L,G)-$codes known as cumulative-separable Goppa codes and showed that this type of codes has some subclasses with improved estimates on the minimum distance and code dimension, along with the existence of codes within these subclasses whose parameters outperform those listed in the tables of best known codes [5]. As a continuation of the work in [6,7], Bezzateev et al proposed a special class of cumulative separable $\Gamma (L,G)-$codes referred to as totally decomposed cumulative Goppa (TDCG) codes [8]. They demonstrated that TDCG codes contain subclasses with improved bounds on both the minimum distance and the code dimension. Moreover, they established the existence of quasi-cyclic codes within these subclasses whose parameters are comparable to those of the best known codes. Daniel et al in [9] constructed induced-cyclic TDCG codes $\Gamma (L,G,f)$ of length $n=q^2+q+1$ and applied them in a coded-cooperative diversity scheme.

In recent decades, Goppa codes have received extensive attention in the field of coding theory and communication systems. While Goppa codes gained prominence in post-quantum cryptography through the Classic McEliece cryptosystem [10], their fundamental algebraic structure and efficient encoding and decoding algorithms have also found important applications in wireless communication systems, including cooperative diversity networks [9], coded Orthogonal Frequency Division Multiplexing (OFDM) transmission [11], and next-generation cellular systems [12]. In [13], the authors designed an optimized Goppa coded-cooperative (GCC) diversity scheme for a single relay setting and compared its performance to that of extended BCH (EBCH) coded cooperative scheme. Both schemes had same performance for EBCH codes of larger free distance. Moreover, Daniel et al in [14] applied the induced cyclic TDCG codes in a multi-relay Coded-Cooperative (CC) framework integrating Hybrid Automatic Repeat Request (HARQ) with Coded Cooperative communication strategies.

Consequently, due to the sustained and active research in Goppa codes, there is need to revisit and improve their algebraic decoding techniques. While Patterson’s algorithm [15,16] corrects upto the full $w=\mathrm{deg}G\left(x\right)$ errors guaranteed by the minimum distance, it requires the Goppa polynomial $G\left(x\right)$ to be separable. Decoding via the Extended Euclidean Algorithm (EEA) applies to any Goppa polynomial, but is limited to correcting atmost $\lfloor w/2\rfloor$ erros, and beyond this radius can return error values that are not binary, so that the estimated codeword $\widehat{\mathbf{c}}$ is not a valid decoded codeword. As a result, improving and extending these algebraic decoding techniques is essential to ensure that the benefits of recent developments in Goppa codes can be effectively realized in practical applications. Under the binary setting, whenever the number of errors does not exceed $\lfloor w/2\rfloor ,$ error patterns are modeled as bit flips, since all nonzero error components are provably equal to 1 in this regime. Consequently, the decoding process focuses solely on determining the error locations, and explicit computation of error values is deemed unnecessary. However, when the number of channel-induced errors exceeds $\lfloor w/2\rfloor$, the EEA-based decoding process may no longer yield a valid binary codeword. In this case, the tentative decoded vector may contain non-binary symbols, which are not admissible in a binary Goppa codeword. Therefore, an additional decision mechanism is required to resolve these non-binary components and obtain a valid binary estimate of the transmitted codeword.

Motivated by this limitation, this work extends the EEA-based decoding framework by introducing a refinement stage for cases in which the tentative decoding output contains non-binary components. In the proposed approach, the EEA step first produces an intermediate estimate $\widehat{\mathbf{c}}$, which may not necessarily lie in ${\mathbb{F}}_2^n$ when the error pattern exceeds the conventional correction capability. The non-binary coordinates in $\widehat{\mathbf{c}}$ are then treated as ambiguous positions requiring further resolution, rather than being replaced by a fixed binary value. A localized maximum-likelihood (LML) decision rule is applied over these positions to obtain a final binary estimate $\overline{\mathbf{c}}\in {\mathbb{F}}_2^n$. In this way, the proposed method provides an extension of the classical EEA decoder for binary Goppa codes [15], with the aim of improving decoding performance in cases where the standard hard-decision algebraic procedure does not directly yield a valid binary codeword. More specifically,

• To design an Extended Euclidean Algorithm (EEA)-based decoding approach for binary Goppa codes, referred to as the EEA-LML decoder. The proposed method extends the conventional algebraic decoding algorithm by incorporating a localized maximum-likelihood (LML) decision step to refine the decoding output when non-binary intermediate values arise.
• To examine the computational complexity of the proposed EEA-LML decoding method. This includes identifying the main operations contributing to the decoding cost and discussing how the additional LML refinement step affects the overall complexity relative to standard EEA-based decoding.
• To compare the bit error rate (BER) performance of the proposed EEA-LML decoder with relevant decoding benchmarks for binary Goppa codes, which include the locator-only EEA decoder, maximum-likelihood decoding (MLD), and Patterson decoding. This comparison provides a broader evaluation of the proposed method relative to established algebraic decoding approaches and optimal or near optimal decoding approaches.

The remainder of this paper is organized as follows: Section 2 provides an overview of the fundamentals of Goppa codes, highlighting their definition, construction, and examples. Section 3 describes the algebraic decoding of Goppa codes. Section 4 presents the proposed decoding method, complexity analysis of the proposed method and a design example to demonstrate the method. In Section 5, experimental results and performance evaluations are presented, validating the effectiveness of the proposed decoder. Finally, a conclusion of the manuscript is presented in Section 6.

2. Preliminaries

In this section, we review the fundamental theory of Goppa codes and its properties as presented in [3,17].

2.1. Definition and Parity check Matrix of Goppa Codes

Let ${\mathbb{F}}_q$ be a finite field with q elements where $q=p^m$ is a prime power with $m\in \mathbb{N}.$ We have the following definition of a Goppa code:

Definition 1. 

Let $L=\{{\beta }_i:0\le i\le n-1\}\subseteq {\mathbb{F}}_q,{\beta }_i\ne {\beta }_j\forall i\ne j$ and $G\left(x\right)\in {\mathbb{F}}_q\left[x\right],$ with $\mathrm{deg}\left(G\right(x\left)\right)=w$ such that $G\left({\beta }_i\right)\ne 0\forall {\beta }_i\in L.$ The Goppa code $\Gamma (L,G)$ is defined as

$$\Gamma (L,G):=\left\{c\in {\mathbb{F}}_p^n:{\displaystyle \sum _{i=0}^{n-1}}{\displaystyle \frac{c_i}{x-{\beta }_i}}\equiv 0\left(\mathrm{mod}G\left(x\right)\right)\right\}$$

(1)

If $p=2,$ then $\Gamma (L,G)-$code is a binary goppa code. In this manuscript, we consider only binary Goppa codes.

The set L is known as the locator set and the length n of $\Gamma (L,G)-$code is $n=\left|L\right|.$ The polynomial $G\left(x\right)$ is called the Goppa polynomial. A Goppa code is characterized by its parity check matrix. From Eq. 1, if the left hand side of ${\sum }_{i=1}^n{\displaystyle \frac{c_i}{x-{\beta }_i}}\equiv 0\left(\mathrm{mod}G\left(x\right)\right)$ is expanded as a power series in $xmodG\left(x\right)$ and its coefficients equated to zero, $w=\mathrm{deg}\left(G\right)$ linear equations over ${\mathbb{F}}_q$ are obtained. It’s these equations that define the parity check matrix $H_{\Gamma (L,G)}$ over ${\mathbb{F}}_q,$ with entries:

$$h_{ij}={\displaystyle \frac{{\beta }_i^j}{G\left({\beta }_j\right)}},j=0,1,\dots ,w-1;i=0,1,\dots ,n-1.$$

(2)

Each element $h_{ij}\in {\mathbb{F}}_q$ is then represented as an $m-$bit binary column, hence expanding $H_{\Gamma (L,G)}$ to a binary $mw\times n$ parity check matrix ${\tilde{H}}_{\Gamma (L,G)}.$ The matrix $H_{\Gamma (L,G)}$ is as follows:

$$H_{\Gamma (L,G)}=\left[\begin{array}{cccc}{\displaystyle \frac{1}{G\left({\beta }_0\right)}}& {\displaystyle \frac{1}{G\left({\beta }_1\right)}}& \dots & {\displaystyle \frac{1}{G\left({\beta }_{n-1}\right)}}\\ {\displaystyle \frac{{\beta }_0}{G\left({\beta }_0\right)}}& {\displaystyle \frac{{\beta }_1}{G\left({\beta }_1\right)}}& \dots & {\displaystyle \frac{{\beta }_{n-1}}{G\left({\beta }_{n-1}\right)}}\\ ⋮& ⋮& \ddots & ⋮\\ {\displaystyle \frac{{\beta }_0^{w-1}}{G\left({\beta }_0\right)}}& {\displaystyle \frac{{\beta }_1^{w-1}}{G\left({\beta }_1\right)}}& \dots & {\displaystyle \frac{{\beta }_{n-1}^{w-1}}{G\left({\beta }_{n-1}\right)}}\end{array}\right]$$

(3)

Furthermore, it follows that the redundancy of the code with Goppa polynomial $G\left(x\right)$ is at most $w=\mathrm{deg}\left(G\right).$ Therefore, $\Gamma (L,G)-$ code has dimension $k\ge n-mw$ and the true minimal distance $d_{free}$ satisfy $d_{free}\ge 2w+1,$ called the Goppa bound.

2.2. Example of a Goppa Code

Consider the Goppa polynomial $G\left(x\right)=x^2+\beta x+1$ and the set $L={\mathbb{F}}_8=\{0,1,\beta ,\dots ,{\beta }^6\},$ where $\beta$ is a primitive element of ${\mathbb{F}}_8$ and $G\left({\beta }_i\right)\ne 0,\forall i=0,1,\dots ,7.$ The Goppa code is of length $n=\left|L\right|=8,$ dimension $k\ge 8-2.3=2$ and minimum distance $d\ge 2.2+1=5.$ Its parity check matrix is

$$\begin{array}{cc}\hfill H_{\Gamma (L,G)}=& \left[\begin{array}{cccc}{\displaystyle \frac{1}{G\left({\beta }_0\right)}}& {\displaystyle \frac{1}{G\left({\beta }_1\right)}}& \dots & {\displaystyle \frac{1}{G\left({\beta }_{n-1}\right)}}\\ {\displaystyle \frac{{\beta }_0}{G\left({\beta }_0\right)}}& {\displaystyle \frac{{\beta }_1}{G\left({\beta }_1\right)}}& \dots & {\displaystyle \frac{{\beta }_{n-1}}{G\left({\beta }_{n-1}\right)}}\end{array}\right]\hfill \\ \hfill =& \left[\begin{array}{cccccccc}1& {\beta }^6& 1& {\beta }^5& {\beta }^6& {\beta }^5& {\beta }^2& {\beta }^2\\ 0& {\beta }^6& \beta & 1& {\beta }^2& {\beta }^2& 1& \beta \end{array}\right]\hfill \end{array}$$

(4)

Hence, the $H_{\Gamma (L,G)}$ over ${\mathbb{F}}_2$ is

$${\tilde{H}}_{\Gamma (L,G)}=\left[\begin{array}{cccccccc}1& 1& 1& 1& 1& 1& 0& 0\\ 0& 0& 0& 1& 0& 1& 0& 0\\ 0& 1& 0& 1& 1& 1& 1& 1\\ 0& 1& 0& 1& 0& 0& 1& 0\\ 0& 0& 1& 0& 0& 0& 0& 1\\ 0& 1& 0& 0& 1& 1& 0& 0\end{array}\right].$$

(5)

The systematic generator matrix $\mathcal{G}=\left[I_k\right|P]$ can be derived from H through gaussian elimination. For the $(8,2,5)$ Goppa code, this yields:

$$\mathcal{G}=\left[\begin{array}{cccccccc}1& 0& 0& 1& 1& 1& 1& 0\\ 0& 1& 1& 1& 0& 1& 0& 1\end{array}\right]$$

(6)

3. Algebraic Decoding of Goppa Codes

In this section, we review the standard algebraic decoding of binary Goppa codes [15], which forms the foundation of our proposed EEA - localized maximum likelihood decoding technique as presented in section IV. The decoding of Goppa codes constitutes the solving of the key equation where the key equation is the algebraic relation that links the syndrome polynomial, the error locator polynomial and the error evaluator polynomial.

Suppose that $\mathbf{c}\in \Gamma (L,G)$ is the transmitted codeword and $\mathbf{r}$ is the received vector such that $\mathbf{r}=\mathbf{c}+\mathbf{e},$ where $\mathbf{e}$ is the error vector. The syndrome polynomial is as follows:

$$\begin{array}{cc}\hfill S\left(x\right)\triangleq & {\displaystyle \sum _{i=0}^{n-1}}{\displaystyle \frac{r_i}{x-{\beta }_i}}modG\left(x\right)\hfill \\ \hfill =& {\displaystyle \sum _{i=0}^{n-1}}{\displaystyle \frac{c_i}{x-{\beta }_i}}+{\displaystyle \sum _{i=0}^{n-1}}{\displaystyle \frac{e_i}{x-{\beta }_i}}modG\left(x\right)\hfill \end{array}$$

(7)

Since $c\in \Gamma (L,G)$ the first summation on the right hand side of Eq. 7 vanishes $modG\left(x\right),$ reducing to,

$${\displaystyle \sum _{i=0}^{n-1}}{\displaystyle \frac{r_i}{x-{\beta }_i}}\equiv {\displaystyle \sum _{i=0}^{n-1}}{\displaystyle \frac{e_i}{x-{\beta }_i}}modG\left(x\right).$$

(8)

From Eqs. 7 and 8, it follows that, the syndrome polynomial $S\left(x\right)$ is defined as the polynomial of degree less than $\mathrm{deg}\left(G\right(x\left)\right)$ such that

$$S\left(x\right)\equiv {\displaystyle \sum _{i=0}^{n-1}}{\displaystyle \frac{e_i}{x-{\beta }_i}}modG\left(x\right).$$

(9)

Furthermore, let $J=\{i\in \mathbb{N}|e_i\ne 0\}\subset \{0,1,\dots ,n-1\}.$ Then,

$$S\left(x\right)\equiv \sum _{j\in J}{\displaystyle \frac{e_j}{x-{\beta }_j}}modG\left(x\right).$$

(10)

Therefore, Eq. 10 is the required syndrome polynomial. The next polynomial is the error locator polynomial which is a polynomial whose roots are the locations of the errors. The error locator polynomial $\Lambda \left(x\right)$ is defined as follows;

$$\Lambda \left(x\right):=\prod _{j\in J}(x-{\beta }_j).$$

(11)

Now, we define the variant of the error-evaluator polynomial $\Omega \left(x\right)$ as follows;

$$\Omega \left(x\right):=\sum _{j\in J}{e}_j\prod _{m\in J\setminus \left\{j\right\}}(x-{\beta }_m).$$

(12)

The polynomial $\Omega \left(x\right)$ is called the error-evaluator polynomial. Furthermore, from Eqs. 10, 11 and 12,

$$S\left(x\right)={\displaystyle \frac{{\sum }_{j\in J}{e}_j{\prod }_{m\in J\setminus \left\{j\right\}}(x-{\beta }_m)}{{\prod }_{j\in J}(x-{\beta }_j)}}={\displaystyle \frac{\Omega \left(x\right)}{\Lambda \left(x\right)}}modG\left(x\right).$$

(13)

Hence from Eq.13, we have

$$\Omega \left(x\right)\equiv \Lambda \left(x\right)S\left(x\right)modG\left(x\right).$$

(14)

Eqn. 14 is called the Goppa key equation. Therefore, algebraic decoding of Goppa codes reduces to solving Eq. 14. In this manuscript, Eq. 14 is solved using the Extended Euclidean Algorithm(EEA) [18,19].

It is well known that the polynomials $\Lambda \left(x\right)$ and $\Omega \left(x\right)$ are relatively prime [2,3] , which guarantees the uniqueness of the solution to Eq. 14. To compute the error values, we first find the formal derivative of $\Lambda \left(x\right).$ Therefore,

$${\Lambda }^{\prime }\left(x\right)=\sum _{j\in J}\prod _{m\in J\setminus \left\{j\right\}}(x-{\beta }_m).$$

(15)

Hence,

$${\Lambda }^{\prime }\left({\beta }_j\right)=\prod _{m\in J\setminus \left\{j\right\}}({\beta }_j-{\beta }_m).$$

(16)

From Eq. 12,

$$\Omega \left({\beta }_j\right)=e_j\prod _{m\in J\setminus \left\{j\right\}}({\beta }_j-{\beta }_m).$$

(17)

Moreover, from Eqs. 15 and 16, we have

$$\Omega \left({\beta }_j\right)=e_j{\Lambda }^{\prime }\left({\beta }_j\right),$$

(18)

so that,

$$e_j={\displaystyle \frac{\Omega \left({\beta }_j\right)}{{\Lambda }^{\prime }\left({\beta }_j\right)}}$$

(19)

The summary of the EEA based decoding of binary Goppa codes is presented in Algorithm Section 3.

Algorithm 1 (EEA-based decoding algorithm of Goppa codes) Input: Goppa code $\Gamma (L,G)$, received vector $\mathbf{r}\in {\mathbb{F}}_2^n$

Output: Estimated decoded codeword $\widehat{\mathbf{c}}$

1.

Calculate the syndrome polynomial by $S\left(x\right)={\sum }_{i=0}^{n-1}{\displaystyle \frac{r_i}{x-{\beta }_i}}modG\left(x\right)$.

2.

$\Omega \left(x\right),\Lambda \left(x\right)\leftarrow \mathrm{EEA}\left(G\right(x),S(x\left)\right)$ with $\mathrm{deg}\Omega \left(x\right)<\mathrm{deg}\Lambda \left(x\right)\le \mathrm{deg}G\left(x\right)/2$. (Refer to [18], Sec. 6.4 for the EEA.)

3.

$J\leftarrow \{j:\Lambda \left({\beta }_j\right)=0\}$.

4.

$e_j\leftarrow 1$ if $\Lambda \left({\beta }_j\right)=0$; otherwise $e_j\leftarrow 0$.

5.

return$\widehat{\mathbf{c}}\leftarrow \mathbf{r}-\mathbf{e}$.

4. Proposed Extended Euclidean Algorithm(EEA) - Based Decoding of Binary Goppa Codes via Localized Maximum Likelihood(LML)

In this section, we present the proposed decoding technique, provide a design example and analyze the computational complexity of the method.

4.1. Extended Euclidean Algorithm(EEA) - Based Decoding of Binary Goppa Codes via Localized Maximum Likelihood(LML)

Under bounded-distance decoding, whenever the number of errors does not exceed $\lfloor w/2\rfloor$, the error-evaluator and error-locator polynomials satisfy $\Omega \left(x\right)={\Lambda }^{\prime }\left(x\right)$, so every recovered error value $e_j$ equals 1 and the decoded word $\widehat{\mathbf{c}}$ is automatically binary. However, when the number of errors exceeds this bound, the EEA can still terminate with a valid pair $\left(\Lambda \right(x),\Omega (x\left)\right)$ satisfying the key equation, but the corresponding error values $e_j=\Omega \left({\beta }_j\right)/{\Lambda }^{\prime }\left({\beta }_j\right)$ need not equal 1. In this case, $\widehat{\mathbf{c}}$ contains symbols in $\mathrm{GF}\left(2^m\right)\setminus \{0,1\}$, which cannot belong to a binary codeword. The classical decoder (Algorithm Section 3) sidesteps this issue by using only the error locations and flipping the corresponding bits, discarding the error values entirely. This discards useful information and degrades performance of the code. The proposed EEA-LML decoder instead exploits these non-binary symbols rather than discarding them. Each non-binary position is treated as an unresolved bit, and both possible binary values are tested by direct syndrome verification: a substitution is retained only if it yields a valid codeword. If exactly one substitution passes this test, it is adopted as the correction. If none passes, a small, exhaustive, syndrome-verified search restricted to the handful of suspect positions, rather than an arbitrary bit assignment is induced.

Formally, let $\mathbf{r}\in {\mathbb{F}}_2^n$ be the received vector and let $\widehat{\mathbf{c}}$ be the estimate obtained from the EEA decoder with error values (Steps 1–5 of Algorithm Section 4.1), so that $\widehat{\mathbf{c}}=\mathbf{r}-\mathbf{e}$ with $e_j=\Omega \left({\beta }_j\right)/{\Lambda }^{\prime }\left({\beta }_j\right)$. Some entries of $\widehat{\mathbf{c}}$ may lie in ${\mathbb{F}}_{2^m}\setminus \{0,1\}$. We denote by ${\widehat{\mathbf{c}}}_t$ the tentative decoded vector $\widehat{\mathbf{c}}$ containing $\mathbf{t}$ non-binary symbols in $\widehat{\mathbf{c}}$. Let

$$T=\{j_1<j_2<\dots <j_t\}=\{j:{\widehat{c}}_j\notin {\mathbb{F}}_2\},$$

(20)

be the positions of the non-binary symbols in ${\widehat{\mathbf{c}}}_t$, so that ${\widehat{c}}_i\notin {\mathbb{F}}_2$ if and only if $i\in T$, with $1\le t\le n$. Each non-binary symbol is an m-bit vector, ${\widehat{c}}_{j_{\ell }}=({\widehat{c}}_{j_{\ell },0},\dots ,{\widehat{c}}_{j_{\ell },m-1})\in {\mathbb{F}}_2^m$, and we define the binary reference vector

$${\widehat{\mathbf{b}}}_t=({\widehat{c}}_{j_1,0},{\widehat{c}}_{j_2,0},\dots ,{\widehat{c}}_{j_t,0})\in {\mathbb{F}}_2^t.$$

(21)

Since the code is binary, every non-binary symbol must be replaced by a bit. Let ${\tilde{\mathbf{c}}}_t$ be the vector obtained from ${\widehat{\mathbf{c}}}_t$ by replacing each ${\widehat{\mathbf{c}}}_{{\mathbf{j}}_{\ell }}$ with a binary symbol ${\tilde{\mathbf{c}}}_{{\mathbf{j}}_{\ell }}\in {\mathbb{F}}_2$, $\ell =1,\dots ,t$, that is,

$${\tilde{\mathbf{c}}}_t=({\widehat{c}}_0,{\widehat{c}}_1,\dots ,{\tilde{c}}_{j_1},\dots ,{\tilde{c}}_{j_2},\dots ,{\tilde{c}}_{j_t},\dots ,{\widehat{c}}_{n-1}),$$

(22)

and denote the replaced part by

$${\tilde{\mathbf{d}}}_t=({\tilde{c}}_{j_1},{\tilde{c}}_{j_2},\dots ,{\tilde{c}}_{j_t})\in {\mathbb{F}}_2^t.$$

(23)

There are ${\mathbf{2}}^{\mathbf{t}}$ possible choices of ${\tilde{\mathbf{d}}}_t$, and hence $2^t$ possible vectors ${\tilde{\mathbf{c}}}_t$. Among these, we keep only those that produce a zero syndrome vector. The set of valid candidates is therefore

$$\mathcal{D}=\{{\tilde{\mathbf{c}}}_t:H_{\Gamma (L,G)}^e{\tilde{\mathbf{c}}}_t^T=\mathbf{0}\},0\le \left|\mathcal{D}\right|\le 2^t.$$

(24)

The final decision $(s_{j_1},s_{j_2},\dots ,s_{j_t})$ is obtained according to the size of $\mathcal{D}$.

1.

If $\left|\mathcal{D}\right|=0$, then $\mathcal{D}$ is an empty set and we have:

$$(s_{j_1},s_{j_2},\dots ,s_{j_t})=\arg \underset{{\tilde{\mathbf{d}}}_t\in {\mathbb{F}}_2^t}{\min }{d}_H({\tilde{\mathbf{d}}}_t,{\widehat{\mathbf{b}}}_t).$$

(25)

2.

If $\left|\mathcal{D}\right|=1$, the decision is read directly from the unique element ${\tilde{\mathbf{c}}}_t\in \mathcal{D}$:

$$(s_{j_1},s_{j_2},\dots ,s_{j_t})=({\tilde{c}}_{j_1},{\tilde{c}}_{j_2},\dots ,{\tilde{c}}_{j_t}).$$

(26)

3.

If $2\le \left|\mathcal{D}\right|\le 2^t$, the candidate whose binary part is closest to the reference is chosen:

$$(s_{j_1},s_{j_2},\dots ,s_{j_t})=\arg \underset{{\tilde{\mathbf{c}}}_t\in \mathcal{D}}{\min }{d}_H({\tilde{\mathbf{d}}}_t,{\widehat{\mathbf{b}}}_t).$$

(27)

The final decoded codeword is

$$\overline{\mathbf{c}}=({\widehat{c}}_0,{\widehat{c}}_1,\dots ,s_{j_1},\dots ,s_{j_2},\dots ,s_{j_t},\dots ,{\widehat{c}}_{n-1}),$$

(28)

that is, $\overline{\mathbf{c}}$ equals ${\widehat{\mathbf{c}}}_t$ except that ${\overline{c}}_{j_{\ell }}=s_{j_{\ell }}$ for $\ell =1,\dots ,t$. The EEA-LML decoder is summarized in Algorithm Section 4.1.

Algorithm 2 (EEA-LML decoding for binary Goppa codes) Input: Goppa code $\Gamma (L,G)$, received vector $\mathbf{r}\in {\mathbb{F}}_2^n$, parity-check matrix $H_{\Gamma (L,G)}$

Output: Estimated codeword $\overline{\mathbf{c}}\in {\mathbb{F}}_2^n$

1.

Calculate the syndrome polynomial: $S\left(x\right)\leftarrow {\sum }_{i=0}^{n-1}{\displaystyle \frac{r_i}{x-{\beta }_i}}(modG\left(x\right))$.

2.

$\Omega \left(x\right),\Lambda \left(x\right)\leftarrow \mathrm{EEA}\left(G\right(x),S(x\left)\right)$ with $\mathrm{deg}\Omega \left(x\right)<\mathrm{deg}\Lambda \left(x\right)\le \mathrm{deg}G\left(x\right)/2$.

3.

$J\leftarrow \{j:\Lambda \left({\beta }_j\right)=0\}$.

4.

$e_j\leftarrow \Omega \left({\beta }_j\right)/{\Lambda }^{\prime }\left({\beta }_j\right)$ if $j\in J$; otherwise $e_j\leftarrow 0$.

5.

${\widehat{\mathbf{c}}}_t\leftarrow \mathbf{r}-\mathbf{e}$.

6.

$T=\{j_1<j_2<\dots <j_t\}\leftarrow \{j:{\widehat{c}}_j\in {\mathbb{F}}_2^m\setminus \{0,1\}\}$.

7.

if$T=\varnothing$then

(a)

return${\widehat{\mathbf{c}}}_t$.

8.

for$\ell =1$totdo

(a)

${\widehat{c}}_{j_{\ell },0}\leftarrow$ first bit of ${\widehat{c}}_{j_{\ell }}$.

9.

${\widehat{\mathbf{b}}}_t\leftarrow ({\widehat{c}}_{j_1,0},{\widehat{c}}_{j_2,0},\dots ,{\widehat{c}}_{j_t,0})\in {\mathbb{F}}_2^t$.

10.

Define ${\tilde{\mathbf{c}}}_t$ where each ${\widehat{c}}_{j_{\ell }}$ is replaced by binary ${\tilde{c}}_{j_{\ell }}\in {\mathbb{F}}_2$.

11.

${\tilde{\mathbf{d}}}_t\leftarrow ({\tilde{c}}_{j_1},{\tilde{c}}_{j_2},\dots ,{\tilde{c}}_{j_t})\in \mathrm{GF}{\left(2\right)}^t$.

12.

$\mathcal{D}\leftarrow \{{\tilde{\mathbf{c}}}_t:H_{\Gamma (L,G)}^e{\tilde{\mathbf{c}}}_t^T=0\}$.

13.

if$\left|\mathcal{D}\right|=0$then

(a)

$(s_{j_1},\dots ,s_{j_t})\leftarrow \arg {\min }_{{\tilde{\mathbf{d}}}_t\in {\mathbb{F}}_2^t}{d}_H({\tilde{\mathbf{d}}}_t,{\widehat{\mathbf{b}}}_t)$.

14.

else if$\left|\mathcal{D}\right|=1$then

(a)

${\tilde{\mathbf{c}}}_t^{*}\leftarrow$ the unique element in $\mathcal{D}$.

(b)

Extract $(s_{j_1},\dots ,s_{j_t})\leftarrow$ the replaced part of ${\tilde{\mathbf{c}}}_t^{*}$.

15.

else

(a)

${\tilde{\mathbf{c}}}_t^{*}\leftarrow \arg {\min }_{{\tilde{\mathbf{c}}}_t\in \mathcal{D}}{d}_H({\tilde{\mathbf{d}}}_t,{\widehat{\mathbf{b}}}_t)$.

(b)

Extract $(s_{j_1},\dots ,s_{j_t})\leftarrow$ the replaced part of ${\tilde{\mathbf{c}}}_t^{*}$.

16.

$\overline{\mathbf{c}}\leftarrow ({\widehat{c}}_0,\dots ,s_{j_1},\dots ,s_{j_2},\dots ,s_{j_t},\dots ,{\widehat{c}}_{n-1})$.

17.

return$\overline{\mathbf{c}}$.

Table 1, Table 2 and Table 3 shows different syndrome patterns for $t=1$ non-binary symbol, $t=2$ non-binary symbols and $3\le t\le \lfloor {\displaystyle \frac{d-1}{2}}\rfloor$ non-binary symbols respectively. we shall denote a non zero syndrome vector as $\Sigma .$i.e., $\mathbf{H}{\tilde{c}}_t^T\triangleq \Sigma \mathrm{if}\mathbf{H}{\tilde{c}}_t^T\ne 0.$

4.2. Decoding Example

Consider the Goppa polynomial $G\left(x\right)=x^2+x+1\in {\mathbb{F}}_{2^3}\left[x\right]$ and the Goppa set $L={\mathbb{F}}_8=\{0,1,\dots ,{\beta }^6\}$ where $\beta$ is a primitive element of ${\mathbb{F}}_8$ and $G\left({\beta }_i\right)\ne 0$$\forall i=0,1,\dots ,{\beta }^6.$ The Goppa $\Gamma (L,G)-$code is of length $n=8$ and $k\ge 8-3·2=2.$ It has a parity check matrix

$$\begin{array}{cc}\hfill H_{\Gamma (L,G)}=& \left[\begin{array}{ccccc}{\displaystyle \frac{1}{G\left(0\right)}}& {\displaystyle \frac{1}{G\left(1\right)}}& {\displaystyle \frac{1}{G\left(\beta \right)}}& \dots & {\displaystyle \frac{1}{G\left({\beta }^6\right)}}\\ {\displaystyle \frac{0}{G\left(0\right)}}& {\displaystyle \frac{1}{G\left(1\right)}}& {\displaystyle \frac{\beta }{G\left(\beta \right)}}& \dots & {\displaystyle \frac{{\beta }^6}{G\left({\beta }^6\right)}}\end{array}\right]\hfill \\ \hfill =& \left[\begin{array}{cccccccc}1& 1& {\beta }^2& {\beta }^4& {\beta }^2& \beta & \beta & {\beta }^4\\ 0& 1& {\beta }^3& {\beta }^6& {\beta }^5& {\beta }^5& {\beta }^6& {\beta }^3\end{array}\right]\hfill \end{array}$$

(29)

and

$${\tilde{H}}_{\Gamma (L,G)}=\left[\begin{array}{cccccccc}1& 1& 0& 0& 0& 0& 0& 0\\ 0& 0& 0& 1& 0& 1& 1& 1\\ 0& 0& 1& 1& 1& 0& 0& 1\\ 0& 1& 1& 1& 1& 1& 1& 1\\ 0& 0& 1& 0& 1& 1& 0& 1\\ 0& 0& 0& 1& 1& 1& 1& 0\end{array}\right]$$

(30)

Suppose $\mathbf{c}=\left(00000000\right)\in {\mathbb{F}}_2^8$ was the transmitted codeword and $\mathbf{r}=\left(01000100\right)\in {\mathbb{F}}_2^8$ the received vector.

Step 1

Decode $\mathbf{r}$ to obtain the estimated codeword $\widehat{\mathbf{c}}=\left(000\beta 00{\beta }^{2}0\right).$ The set $J=\{j_1,j_2\}=\{3,6\}$ and

$$\{{\widehat{c}}_3,{\widehat{c}}_6\}=\{\beta ,{\beta }^2\}=\{\left(010\right),\left(001\right)\}$$

(31)

Step 2

Extract binary reference vector:

$$\widehat{b}=(0,0)\in {\mathbb{F}}_2^2$$

Step 3

Generate candidate set: replace $\beta ,{\beta }^2$ in $\widehat{\mathbf{c}}$ with both 0 and $1.$ The following 4 updated vectors are obtained;

$$\left\{\begin{array}{cc}& \left(000\mathbf{0}00\mathbf{0}0\right),\left(000\mathbf{0}00\mathbf{1}0\right),\hfill \\ & \left(000\mathbf{1}00\mathbf{0}0\right),\left(000\mathbf{1}00\mathbf{1}0\right)\hfill \end{array}\right\}$$

Moreover, the syndromes of the above 4 vectors are shown in Table 4.

From Table 4,

$$\mathcal{D}=\left\{{\tilde{c}}_t\right|{\tilde{H}}_{\Gamma (L,G)}{\tilde{c}}_t^T=0\}=\left\{\left(000\mathbf{0}00\mathbf{0}0\right)\right\}$$

Step 4

Select optimal correction: since $\left|\mathcal{D}\right|=1,$$(s_3,s_6)=(0,0).$

Step 5

Construct final codeword:

$$\overline{\mathbf{c}}=\left(00000000\right).$$

Evidently, the final estimated codeword $\overline{\mathbf{c}}=\mathbf{c}$ which was the transmitted codeword. Therefore, correct decoding has occured.

4.3. Complexity Analysis of the Proposed Decoding Method

For a received vector $r\in {\mathbb{F}}_2^n,$ an estimated vector $\widehat{\mathbf{c}}$ (see Eqn. (20)) is computed using the Extended Euclidean decoding algorithm, where t non-binary symbols are identified for further refinement. This involves: syndrome computations, requiring $O\left(nt\right)$ operations, solving the key equation via EEA, $O\left(t^2\right)$ operations, and Chien search, $O\left(nt\right)$ operations. Hence, at this stage, the complexity is $O(nt+t^2).$ Constructing $\mathcal{D}$ requires $O(2^t·nt)$ operations. Selection via minimum distance requires $0\left(\right|\mathcal{D}|·t)$ operations with the worst case being $O(2^t·t).$ Therefore, the overall computational complexity of the EEA-LML decoding algorithm is $O(nt+t^2)+O(2^t·nt)+O(2^t·t)$ with $O(2^t·nt)=O(2^t·nt).$ Although the worst-case complexity is $O(2^t·nt),$ the cardinality of the candidate set $\mathcal{D}$ is typically very small in practice. In particular, when the restricted parity-check matrix has full rank, the solution is unique, and the complexity reduces to polynomial complexity.

5. Numerical Analysis and Simulation Results

To evaluate the effectiveness of the proposed decoding method EEA-LML, Monte Carlo simulations are conducted over the additive white Gaussian noise (AWGN) channel and flat Rayleigh fading channel, where each fading coefficient is an independent and identically distributed (i.i.d) complex Gaussian random variable following $CN(0,1)$ in the flat Rayleigh fading channel. The Binary Phase Shift Keying (BPSK) modulation is employed, where the encoded binary symbols are mapped onto $\{+1,-1\}$ and transmitted over the noisy channel. The proposed EEA-LML method is compared with the existing classical EEA for binary Goppa codes and the EEA with any non-binary symbol(s) in the estimated codeword $\widehat{c}$ substituted with bit 1. The finite fields ${\mathbb{F}}_8,{\mathbb{F}}_{16}$ and ${\mathbb{F}}_{32}$ are constructed using the polynomials $1+x+x^2,1+x+x^4,$ and $1+x^2+x^5$ with $\gamma ,\beta$ and $\alpha$ being the roots of $1+x+x^2,1+x+x^4,$ and $1+x^2+x^5,$ respectively. The specific simulated codes are listed in Table 5.

5.1. BER Performance Comparison of the Proposed Decoding Algorithm (EEA-LML) with the Classical EEA for Binary Goppa Codes

This subsection presents the bit-error-rate (BER) performance of the proposed EEA-LML decoding scheme (Algorithm Section 4.1) in comparison with the classical EEA-based decoder for binary Goppa codes (Algorithm Section 3) and with uncoded transmission, across the four codes in Table 5. As shown in Figure 1, Figure 2, Figure 3 and Figure 4, the proposed decoder consistently outperforms the classical EEA decoder, uncoded and theoretical simulations over the entire range of signal-to-noise ratios examined, confirming that the additional post-processing introduced in Algorithm Section 4.1 contributes a tangible and measurable coding gain rather.

The coding gain is attributed to how the two decoders treat the intermediate estimate produced by the Extended Euclidean Algorithm. The classical EEA decoder locates the error positions from the roots of the error-locator polynomial $\Lambda \left(x\right)$ and corrects the received word by simply flipping the bits at these positions, implicitly assuming that every detected error is binary, i.e., each error value equals one. This assumption holds only when the number of errors is within the guaranteed correction radius $\lfloor w/2\rfloor$ of the code; beyond this radius, the computed error values $e_j=\Omega \left({\beta }_j\right)/{\Lambda }^{\prime }\left({\beta }_j\right)$ are no longer restricted to $\{0,1\}$ and may instead take on other values in $\mathrm{GF}\left(2^m\right)$. Since the classical decoder disregards this information and performs a blind bit flip regardless of the true error value, it necessarily mis-corrects the received word whenever a non-binary symbol arises, propagating rather than removing the error. The proposed EEA-LML decoder, by contrast, explicitly computes these error values and identifies the positions at which the intermediate estimate $\widehat{\mathbf{c}}$ contains a non-binary symbol. Rather than discarding this information, it resolves each such position through a localized, syndrome-consistent search that returns the most likely binary completion of the codeword, thereby converting a decoding failure of the classical approach into a correct, or at least closer-to-correct, output. This distinction is precisely what separates the two curves in Figure 1, Figure 2, Figure 3 and Figure 4 at moderate-to-high SNR, where the error weight begins to exceed the EEA’s correction radius with non-negligible probability and the handling of non-binary symbols becomes decisive.

5.2. BER Performance Comparisson of the Proposed Decoding Algorithm with Maximum-Likelihood Decoding (MLD)

Inorder to establish the performance gap between the proposed low complexity proposed decoder and optimal decoding, we compare the EEA-LML against the exhaustive maximum-likelihood decoding (MLD) which is feasible here for the Goppa codes $[8,2,5]$ and $[16,8,5].$ MLD correlates the received signal against all $2^k$ codewords and is optimal in the sense of maximizing frame error probability. It serves as a performance bound rather than a practical decoder, since its $\mathcal{O}\left(2^{k}n\right)$ complexity is infeasible for codes of practical length. Both the $[8,2,5]$ and $[16,8,5]$ are simulated under both AWGN channel and a flat Rayleigh fading channel with coherent detection and perfect channel state information at the receiver, giving four scenarios in total.

Figure 5, Figure 6, Figure 7 and Figure 8 compare the BER performance of the proposed EEA-LML decoder with maximum-likelihood decoding (MLD) for the binary Goppa codes $[8,2,5]$ and $[16,8,5]$ over flat Rayleigh fading and AWGN channels. As expected, MLD provides better BER performance than the proposed EEA-LML decoder across the considered SNR range. This is because MLD performs an exhaustive search over the entire codebook and selects the codeword that maximizes the likelihood of the received vector. Therefore, it represents the optimal decoding rule in terms of error probability for the given channel observations. In contrast, the proposed EEA-LML decoder relies on an algebraic EEA-based decoding stage followed by a localized likelihood-based refinement over the ambiguous non-binary positions. Although this approach does not achieve the full optimality of MLD, it avoids the prohibitive complexity of exhaustive codeword search and still provides improved BER performance through the localized decision step. Hence, the comparison with MLD serves as a useful benchmark for assessing how closely the proposed EEA-LML decoder approaches optimal decoding performance while maintaining a more practical decoding structure.

5.3. BER Performance Comparison of the Proposed Decoder with Patterson’s Decoder

Patterson’s algorithm [16] is a classical algebraic decoder for binary Goppa codes. It is generally applicable in separable Goppa codes where it can correct up to the designed error-correction capability of the code, namely up to $\mathrm{deg}\left(G\right(x\left)\right)$ errors for a binary Goppa code defined by a Goppa polynomial $G\left(x\right)$. Thus, it a useful reference decoder when assessing the performance of the proposed EEA-LML decoder. The proposed EEA-LML decoder is motivated by the limitations of the locator-only EEA decoder (Algorithm Section 3), whose direct error-locator approach corrects up to approximately $\lfloor \mathrm{deg}\left(G\right)/2\rfloor$ errors. In the case where the EEA output $\widehat{\mathbf{c}}$ contains non-binary error values, the LML step is triggered to select the most likely binary correction vector from the admissible candidates. On the other hand, the Patterson’s decoder uses the special algebraic structure of separable binary Goppa codes to achieve a larger correction radius. However, it is important to note that Patterson decoding is not used here as a universal replacement for the proposed method. This is due to the fact that its standard form requires the Goppa polynomial to be separable, equivalently $\gcd (G\left(x\right),G^{\prime }\left(x\right))=1.$ Thus, it is directly applicable only to the cases where the Goppa codes are separable. Therefore, Patterson decoder provides a meaningful classical benchmark for the separable setting, while the proposed EEA-LML decoder remains relevant in the broader context where the same separability assumption may not hold.

Figure 9, Figure 10 and Figure 11 presents the BER performance of Patterson’s algorithm and the proposed EEA-LML decoder for the $[8,2,5],[16,8,5]$ and $[31,11,9]$ binary Goppa codes, respectively, under BPSK modulation over a flat Rayleigh fading channel. In the three cases, Patterson’s decoder consistently outperforms EEA-LML, with a coding-gain gap of approximately $0.9$dB $1.0$dB and $1.2$dB at $\mathrm{BER}={10}^{-4},$ respectively. This performance difference can be explained by the fundamental structural difference between the two decoders rather than by any deficiency in the proposed post-processing step. Patterson’s algorithm exploits the fact that, for a separable Goppa polynomial $G\left(x\right)$, the code $\Gamma (L,G)$ is also equal to the code defined by $G{\left(x\right)}^2$, which has degree $2w$. This lets Patterson’s decoder solve a modified key equation that uses the full minimum distance of the code, correcting up to w errors exactly. The classical EEA, by contrast, solves the ordinary key equation with respect to $G\left(x\right)$ itself, and is therefore only guaranteed to correct up to $\lfloor w/2\rfloor$ errors; beyond this radius it returns a valid-looking but incorrect $(\Lambda ,\Omega )$ pair, which is precisely the mechanism that produces the non-binary intermediate symbols resolved by the proposed LML post-processing step (Section 4). EEA-LML therefore operates in a strictly harder regime than Patterson’s algorithm: it is recovering information that Patterson’s decoder never loses in the first place, using only local, syndrome-consistency arguments around the positions flagged as non-binary, rather than a globally valid algebraic correction. It is thus expected, and consistent with Figure 9 and Figure 10, that Patterson’s decoder achieves a small but consistent SNR advantage over EEA-LML at equal target BER.

However, this does not diminish the practical relevance of the proposed EEA-LML decoder. Patterson’s algorithm requires $G\left(x\right)$ to be separable, i.e. $\gcd (G,G^{\prime })=1$; while this condition holds for the codes considered in this paper (Table 5), it is not guaranteed in general, particularly for Goppa polynomials chosen for other design criteria, in which case Patterson’s algorithm is not applicable at all and the classical EEA, augmented with the proposed LML post-processing, remains a viable decoder. Moreover, EEA-LML requires no modification to the key equation or the parity-check construction, and its additional cost over the classical EEA is confined to the post-processing of the non-binary positions which are typically few, making it an attractive low-complexity option when the modest SNR penalty observed here is acceptable.

6. Conclusion

This paper proposes an extended decoding framework for binary Goppa codes based on a modification of the conventional Extended Euclidean Algorithm (EEA) decoder. The proposed EEA-LML decoder enhances the standard algebraic decoding process by introducing a likelihood-motivated decision refinement step for cases in which the initial estimated decoded codeword extends beyond the conventional binary setting. Numerical simulations were carried out over AWGN and flat Rayleigh fading channels using BPSK modulation. The proposed EEA-LML decoder was evaluated against the locator-only EEA decoder, maximum-likelihood decoding (MLD), and Patterson decoding. The obtained BER results show that the proposed decoder consistently outperforms the locator-only EEA decoder. Moreover, the proposed method achieves performance close to MLD while avoiding the high computational complexity of exhaustive maximum-likelihood search. The comparison with Patterson decoding further confirms the effectiveness of the proposed likelihood-based refinement in improving the decoding performance of binary Goppa codes.