Improved constructions of nested code pairs

Two new constructions of linear code pairs $C_2 \subset C_1$ are given for which the codimension and the relative minimum distances $M_1(C_1,C_2)$, $M_1(C_2^\perp,C_1^\perp)$ are good. By this we mean that for any two out of the three parameters the third parameter of the constructed code pair is large. Such pairs of nested codes are indispensable for the determination of good linear ramp secret sharing schemes [35]. They can also be used to ensure reliable communication over asymmetric quantum channels [47]. The new constructions result from carefully applying the Feng-Rao bounds [18,27] to a family of codes defined from multivariate polynomials and Cartesian product point sets.


Introduction
Here w H ( c) means the Hamming weight of c. For any two out of three parameters we aim to construct code pairs such that the two parameters are equal to some prescribed values, whereas the last parameter is as large as possible. Our motivation for studying the above problem is applications in ramp secret sharing, communication over wiretap channels of type II, and asymmetric quantum coding.
We first explain the application in secret sharing. The application to wiretap channels of type II is analogue. A secret sharing scheme is a cryptographic method to encode a secret into a set of shares, later to be distributed among participants, so that only specified subsets of the participants can reconstruct the secret. The first secret sharing scheme, proposed by Shamir [52], was a perfect scheme, meaning that a set of participants unable to reconstruct the secret has no information on the secret. Later non-perfect secret sharing schemes were proposed [7,56] in which there are sets of participants that have some information about the secret, but cannot fully reconstruct it. In this paper we use the term ramp secret sharing schemes for the general class of perfect or non-perfect schemes. Secret sharing has been applied, for example, to store confidential information at multiple locations that are placed geographically apart. When we use secret sharing schemes in such a scenario, the likelihoods of both data loss and data theft are decreased. As far as we know, in many applications both perfect and non-perfect ramp secret sharing schemes are useful. In the perfect scheme the size of a share must be greater than or equal to that of the secret [11]. In contrast ramp secret sharing schemes allow shares to be smaller than the secret which for instance is useful for storing bulk data [14].
A linear ramp secret sharing scheme can be described as a coset construction C 1 /C 2 where C 2 ⊂ C 1 are linear codes [12]. More precisely, let dim C 2 = k 2 , dim C 1 = k 1 and ℓ = k 1 − k 2 . Given a basis { b 1 , . . . , b k 2 } for C 2 as a vector space over F q and a corresponding basis { b 1 , . . . , b k 2 , b k 2 +1 , . . . , b k 1 =k 2 +ℓ } for C 1 the encoding of a secret (s 1 , . . . , s ℓ ) ∈ F ℓ q is done by choosing a 1 , . . . , a k 2 ∈ F q randomly from a uniform distribution and then constructing the codeword c = a 1 b 1 + · · · + a k 2 b k 2 + s 1 b k 2 +1 + · · · + s ℓ b k 1 . The shares are the entries of c. Definition 1. Given a ramp secret sharing scheme C 1 /C 2 with ℓ = dim C 1 − dim C 2 we say that it has (t 1 , . . . , t ℓ )-privacy and (r 1 , . . . , r ℓ )-reconstruction if the positive integers t 1 , . . . , t ℓ are chosen as large as possible and the positive integers r 1 , . . . , r ℓ are chosen as small as possible such that • for 1 ≤ v ≤ ℓ, an adversary cannot obtain v log 2 (q) bits of information about s with any t v shares, • for 1 ≤ v ≤ ℓ, it is possible to recover v log 2 (q) bits of information about s with any collection of r v shares.
We shall refer to the numbers r 1 , . . . , r ℓ as reconstruction numbers and similarly call the numbers t 1 , . . . , t ℓ privacy numbers. These parameters are motivated by the fact that the amount of information which an adversary can obtain is always an integer times log 2 (q) bits and similar for the reconstruction. Of particular interest are the first privacy number t = t 1 and the last reconstruction number r = r ℓ , as t is the maximal number such that no set of this size leaks any information about the secret, and r equals the smallest number such that any set of this size can recover the entire secret. It was demonstrated in [5,55,40,30] that the above numbers can be uniquely determined from the relative generalized Hamming weights, that we shall define now. For v = 1, . . . , ℓ (and similar for the dual codes). Here, Supp U is the set of entries where some codeword in U is non-zero and # is the cardinality. In our paper we shall adopt the tradition of sometimes referring to relative generalized Hamming weights M 1 (C 1 , C 2 ) and M 1 (C ⊥ 2 , C ⊥ 1 ) simply as relative minimum distances. Note that the relative minimum distance M 1 (C 1 , C 2 ) can be lower bounded by the minimum distance of C 1 . Similarly, the relative minimum distance M 1 (C ⊥ 2 , C ⊥ 1 ) is greater than or equal to the minimum distance of C ⊥ 2 . The following theorem corresponds to [30,Theorem 3].
Theorem 2. Let C 2 ⊂ C 1 ⊆ F n q with ℓ = dim C 1 − dim C 2 and consider the corresponding ramp secret sharing scheme C 1 /C 2 . Then the reconstruction numbers and privacy numbers satisfy for v = 1, . . . , ℓ.
Hence, if for instance we want to construct a ramp secret sharing scheme over F q with n participants, secrets of length ℓ, first privacy number equal to some t, and last reconstruction number r as small as possible, what we need is exactly a pair of nested codes C 2 ⊂ C 1 ⊆ F n q of codimension ℓ with M 1 (C ⊥ 2 , C ⊥ 1 ) = t + 1, and M 1 (C 1 , C 2 ) = n − r + 1 as large as possible.
Finally we explain in brief the use of nested codes in connection with asymmetric quantum error-correcting codes, introduced in [54]. The study of good quantum codes is by now a well-established research area. Some classical and recent references are [10,8,9,4,6,3,47,39]. Recently, such theory has been extended to asymmetric quantum error-correcting codes which are useful in a model where the probabilities of qubit-flip and phase-shift errors are different [38,51,19,42,41,16,17,43,44]. This generalization is motivated by the argument that dephasing will happen more frequently than relaxation [38]. A linear q-ary asymmetric quantum error-correcting code C is a q k dimensional subspace of the Hilbert space C q n whose error basis is defined by unitary operators usually denoted by X and Z. It is customary to write the parameters of C as [[n, k, d z /d x ]] q which means that C corrects all phase-shift errors up to ⌊ dz −1 2 ⌋, and all qudit-flip errors up to ⌊ dx−1 2 ⌋. In the present paper we concentrate on the Calderbank-Shor-Steane (CSS) construction of asymmetric quantum codes from a pair of nested linear codes C 2 ⊂ C 1 ⊆ F n q . We leave it for the reader to inspect [9,39] for the actual construction. Here, we only give the following important result on the parameters of the resulting asymmetric quantum code (see [51,Lemma 3.1]).

Theorem 3. Consider linear codes
Then the asymmetric quantum code defined using the CSS construction has parameters Recall, that a stabilizer (symmetric) quantum code is the common eigenspace of a commutative subgroup of the error group associated to the error basis (see [9,39] for details). The quantum codes in Theorem 3 can be considered as stabilizer asymmetric quantum codes [51,Lemma 3.1]. Studying asymmetric quantum codes rather than only symmetric codes is an important problem. For instance, already in [38] it was identified that large ratios d z /d x are relevant -phase-flip errors occurring tens, hundreds, or even thousands times more likely than bit-flips. From Theorem 3 it is where the expressions on the right sides are the minimum distance of the classical code. There is a clear physical significance of cases where strict inequality holds in at least one of these expressions. Such (asymmetric) quantum codes are called impure (or degenerate) [1,35] and it is known that the impureness can be employed to obtain improved decoding.
As a measure for goodness of asymmetric quantum codes we shall use the Gilbert-Varshamov bound from [45,Theorem 4] which we now recall: The literature only reports few families of long asymmetric quantum codes, an exception being La Guardia's construction II in [44,Theorem 7.1] which we shall compare our codes with. In another direction Ezerman et al's works in [17,18] explain how to derive good asymmetric quantum codes with d x being very small and ℓ being moderate. As our constructions do not seem to generally compare well with these codes in the case of d x ∈ {2, 3} we omit such cases in our tables.
Having discussed both ramp secret sharing schemes and asymmetric quantum codes we include a remark relating them to each other.

Remark 5.
There exists an asymmetric quantum code based on the CSS construction with parameters [[n, ℓ, d z /d x ]] q if and only there exists a linear ramp secret sharing scheme over F q with secrets in F ℓ q , with r = r ℓ = n − d z + 1 and t = t 1 = d x − 1.
As the tradition for reporting numerical data on parameters of (asymmetric) quantum codes seems stronger than the tradition for reporting corresponding parameters of ramp secret sharing schemes, throughout this paper we shall often report our findings in the first setting. In such cases we leave it for the reader to apply Remark 5 to make the translation to secret sharing. On the other hand, higher relative weights give information on ramp secret sharing schemes, whereas no implication for asymmetric quantum codes seems to be known. Hence, when treating them we shall do it in the setting of secret sharing.
In this paper we present two new families of long nested codes high. Such codes give rise to ramp secret sharing schemes with r − t close to ℓ, and give rise to asymmetric quantum codes with d z + d x close to n − ℓ + 2. The code pairs are defined by evaluating multivariate polynomials at the points of Cartesian products of subsets of finite fields, and the above mentioned two families are found by carefully applying Feng-Rao theory [30]. Our first family is made by combining, for the first time in the literature, the Feng-Rao improved code constructions for dual and primary codes. This leads to good pairs of codes, however, it only works for relatively high codimension ℓ. The asymmetric quantum codes related to this first family of nested codes compare very favorably with known asymmetric quantum codes of similar length as well as the Gilbert-Varshamov bound. Moreover, the construction is very flexible and we can choose d z /d x very large, which as already mentioned can be desirable. Our second family is a completely new construction which produces very good parameters in the case of relatively small codimension ℓ. Again the corresponding asymmetric quantum codes compare favorably with the known codes of similar length and similarly with the Gilbert-Varshamov bound. Even more, we demonstrate a strong advantage of using our estimates on the relative minimum distances M 1 (C 1 , C 2 ) and M 1 (C ⊥ 2 , C ⊥ 1 ); rather than just using information on the minimum distances d(C 1 ) and d(C ⊥ 2 ). Actually, using only information on the minimum distances d(C 1 ) and d(C ⊥ 2 ) -which is often done in the literature -it seems in many cases impossible to establish the code parameters for asymmetric quantum codes, which we are able to obtain. These reflections are closely related to the fact that the corresponding asymmetric quantum codes of relatively small dimension are almost always impure, which as already mentioned is desirable. Again the construction is quite flexible in the sense that we can choose the ratio d z /d x very high if requested. For both families of codes we provide generator matrices, and we also describe a method for estimating higher relative weights , v = 2, . . . , ℓ, which sometimes leads to closed formula expressions. Recall, that such parameters express the information leakage and message recovery in connection with ramp secret sharing. As a result it is shown that for our second family of nested codes, the security of the related secret sharing schemes is much better than expected from studying only t = t 1 . Furthermore, for certain choices of Cartesian product point sets also parity check matrices can easily be obtained, namely for the particular cases where the considered codes satisfy the conditions for being so-called J-affine variety codes [26]. Finally, all considered codes in this paper can be decoded up to half their designed minimum distance by applying known decoding algorithms. The dual codes can furthermore be decoded up to half the designed relative minimum distance. These observations lead to decoding algorithms for the corresponding asymmetric quantum codes.
The paper is organized as follows. In Section 2 we start by recalling the Feng-Rao bounds for primary and dual linear codes and we apply them to the general class of codes derived by evaluating multivariate polynomials at Cartesian product point sets. In this section we provide all needed background on Feng-Rao theory -for basic results on multivariate polynomials and related concepts we refer the reader to [13]. The section concludes with a discussion on how to decode the related asymmetric quantum codes. Then, in Section 3, we explain how to employ the Feng-Rao improved code constructions for primary and dual codes simultaneously to obtain good families of nested codes with relatively high codimension. We then study the corresponding ramp secret sharing schemes and asymmetric quantum codes. In Section 4 we present the new good construction of nested codes with relatively small codimension and we study the corresponding ramp secret sharing schemes and asymmetric quantum codes. Section 5 gives concluding remarks on the connection to J-affine variety codes. The paper contains a number of examples, the end of which we indicate by ♦s.

Codes defined from Cartesian product point sets
In this paper we consider families of code pairs C 2 ⊂ C 1 defined by evaluating multivariate polynomials at the points of Cartesian products of subsets of finite fields. For the applications described in the previous section, we are interested in the parameters M v (C 1 , C 2 ) (the primary case) as well as M v (C ⊥ 2 , C ⊥ 1 ) (the dual case) -with a special focus on the relative minimum distances M 1 (C 1 , C 2 ) and M 1 (C ⊥ 2 , C ⊥ 1 ). To handle the primary case only it would be natural to use the language of Gröbner basis theory and to apply the so-called footprint bound [50,36,28]. However, in this language it is more difficult to treat the dual case and we therefore give a coherent description of both cases using the Feng-Rao bounds for general linear codes instead. The Feng-Rao bounds come in two versions, namely one for primary codes [2,32,31,30] and another for dual codes [20,21,22,48,37,46,30].
Our exposition follows the presentation in [30,Section IV] and is illustrated with a continued example. This continued example, at the end of the present section, leads to the introduction of a general class of code pairs for which we have a simple description of generator matrices, where we know the codimension, and where we can easily estimate the relative minimum distances and also the higher relative weights (Theorem 16). It is from this class of code pairs we, in the following sections, show how to choose optimal pairs when the codimension is relatively large (Section 3), and when it is relatively small (Section 4).
Consider a fixed basis B = { b 1 , . . . , b n } for F n q as a vector space over F q and let I = {1, . . . , n}. Definition 6. Defineρ : F n q → I ∪ {0} to be the function given as follows. For non-zero c we haveρ( c) = i where i is the unique integer such that Here we use the convention that Span ∅ = { 0}. Finally, letρ( 0) = 0.
Throughout the paper by ≺ deg we shall always mean the degree lexicographic ordering given by the rule that for two different monomials we have X i 1 1 · · · X im m ≺ deg X j 1 1 · · · X jm m if one of the following conditions holds: 1. i 1 + · · · + i m < j 1 + · · · + j m 2. i 1 + · · · + i m = j 1 + · · · + j m , but the rightmost non-zero entry of (j 1 − i 1 , . . . , j m − i m ) is positive.
In case of two variables X and Y , we shall always think of X as X 1 and Y as X 2 . In the paper we shall also need other monomial orderings ≺, however, the degree lexicographic ordering will play a particular important role.  36 7 be the vector space homomorphism given by ev(F + I) = (F (P 1 ), . . . , F (P 36 )). The set B = {ev(X i Y j + I) | 0 ≤ i, j < 6} then constitutes a basis for F 36 7 as a vector space over F 7 . To see this, we first observe that , which implies that we may, without loss of generality, assume that deg X F, deg Y F < 6. Using Lagrange interpolation it holds that ev is surjective, and as #B equals the dimension of the image F 36 7 B is indeed a basis -and consequently ev is an isomorphism. We next enumerate B according to the degree lexicographic ordering ≺ deg . The enumeration is illustrated in Figure 1.
Using this product we can now introduce the concept of one-way well-behaving pairs. Definition 7. An ordered pair (i, j) ∈ I × I is said to be one-way well-behaving which follows from the properties of a monomial ordering and those of the division algorithm. The "only if" part has to do with the special form of the ideal I coming from a variety which is a Cartesian product. If for instance, α + γ ≥ 6 then letting To formulate the Feng-Rao bound for primary codes we shall need the following set.
The following proposition, known as the Feng-Rao bound for primary codes [30,Proposition 8], therefore is operational.
Example 3. This is a continuation of the previous examples. We have b 28 = ev(X 4 Y 3 + I) and therefore In general, The situation is depicted in Figure 2. Let F (X, Y ) be a polynomial whose leading monomial with respect to ≺ deg is X α Y β for some 0 ≤ α, β < 6. Consider c = ev(F + I), then, by Proposition 9, w H ( c) ≥ (6 − α)(6 − β). In general, Figure 2 gives upper bounds on the Hamming weights of all possible words in F 36 7 . ♦ We now turn to relative generalized Hamming weights. Note that although . Nevertheless, the Feng-Rao bound for primary codes [30,Theorem 9] still gives us useful information.

Example 4. This is a continuation of the previous examples. If
However, if To treat dual codes we shall need the following definitions, where the first can be considered as the counterpart of Definition 8, and the last as the counterpart of Definition 6.
Definition 11. For l ∈ I define Definition 12. For c ∈ F n q \{ 0} define η( c) to be the smallest number l ∈ I such that c · b l = 0. Here a · b means the Euclidean inner product between a and b.
Given a v-dimensional space U, η(U\{ 0}) is of size v. The following proposition, known as the Feng-Rao bound for dual codes [30,Proposition 13], therefore is operational.
Example 5. This is a continuation of the previous examples.
Given c with η( c) = l, from Proposition 13 we obtain w H ( c) ≥ (α + 1)(β + 1). By Proposition 13, Figure 3 gives upper bounds on the Hamming weights of all possible words in F 36 7 . We next treat relative generalized Hamming weights. Note that for Nevertheless, the Feng-Rao bound for dual codes [30,Theorem 14] still gives us useful information.
Example 6. This is a continuation of the previous examples. If However, if The above theorems and examples lead us to consider the following family of codes, which have a good behavior with respect to the applications described in the introduction. Consider a Cartesian product S = S 1 ×· · ·×S m ⊆ F m q . For i = 1, . . . , m define the one-variable polynomial and consider the vanishing ideal of S, Here, we use the notation s i = #S i . As in the above examples we then obtain a vector space homomorphism ev : R → F n q defined by ev(F + I) = (F (α 1 ), . . . , F (α n )). Now let where the enumeration of the N i 's is with respect to an arbitrary (but fixed) monomial ordering ≺. For general L ⊆ ∆(s 1 , . . . , s m ) define which is clearly a code of length n. For the purpose of applying the Feng-Rao bounds to the codes C(L) and C(L) ⊥ we introduce functions D and D ⊥ .
We are now ready to describe the relative parameters of the evaluation codes introduced above.
. . , s m ) = {N 1 , . . . , N n } where the enumeration of the N i 's is with respect to an arbitrary (but fixed) monomial ordering ≺. Then the codes C(L 1 ) and C(L 2 ) are of length n and their codimension equals Proof. We start by proving that {ev(N 1 + I), . . . , ev(N n + I)} is a basis for F n q as a vector space over F q . This fact implies that the dimension of C(L i ) equals #L i , i = 1, 2, and the formula for the codimension follows. Observe that . . , X m ) + I for any polynomials A 1 , . . . , A m in the variables X 1 , . . . X m with coefficients in F q . Hence, we may assume that deg Using Lagrange-interpolation we next see that ev is surjective and, as ∆(s 1 , . . . , s m ) is of the same size as the image F n q , the considered set is indeed a basis for F n q . As in the above examples we enumerate the basis elements { b 1 = ev(N 1 + I), . . . , b n = ev(N n + I)} (meaning that we order it according to the monomial ordering ≺). Notice that, regardless of the choice of monomial ordering ≺, D(N i ) ≤ #Λ i , and that in larger (3) follows from Theorem 10. Similarly, regardless of the choice of monomial ordering ≺, Hence, (4) follows from Theorem 14.
In the next two sections we show a way to choose L 2 ⊂ L 1 such that the parameters are good. We study two separate cases. The first case, which we treat in Section 3, deals with relatively large codimension. The second case, which we treat in Section 4, concerns relatively small codimensions.
Before studying these two families of codes we briefly discuss the decoding of the related asymmetric quantum codes. Observe that the decoding algorithm for order domain codes described in [37,Section 6.3] can be applied in the more general setting of linear codes with Feng-Rao designed minimum distance. Hence, it can be applied to all codes of the present paper. This holds both for dual codes [46] and primary codes [31]. The decoding algorithm which corrects errors up to half the designed minimum distance uses O(n 3 ) operations, where n is the length of the code. In [15, Appendix A] Duursma and Park provided a similar algorithm correcting errors up to half the designed relative minimum distance. This was done at the general level of linear codes described by means of their parity check matrix. The application in connection with decoding of asymmetric quantum codes is as follows. To decode both phase-shift and qudit-flip errors up to half the designed values of d z and d x one will need two decoding algorithms, namely one which decodes up to ⌊(M 1 (C 1 , C 2 ) − 1)/2⌋ errors in connection with C 2 ⊂ C 1 , and another which corrects up to ⌊(M 1 (C ⊥ 2 , C ⊥ 1 ) − 1)/2⌋ errors in connection with C ⊥ 1 ⊂ C ⊥ 2 [10,9]. Duursma and Park's algorithm applies to the last task, but not to the first in its present form.
It is an open research problem to modify the decoding algorithm from [15] for general nested dual codes, so that it also works for nested primary codes. This probably could be done using the material in [31]. In the absence of such a translation one may instead apply the algorithm from [31] to correct only up to ⌊(d(C 1 ) − 1)/1⌋ errors in connection with the primary nested codes.

Relatively large codimension
One of the nice features of the Feng-Rao bounds is that they come with improved code constructions. In the setting of the codes in the previous section, by applying the improved construction for primary codes [2], we obtain a code C(L 1 ) of designed distance δ and maximal dimension if we choose Similarly, by applying the improved construction for dual codes [21,22] we obtain a code C(L 2 ) ⊥ of designed distance δ ⊥ and maximal dimension if we choose Our first proposal for constructing good pairs of nested codes is to choose L 1 and L 2 as in (5) and (6) with L 2 ⊂ L 1 . We then obtain The codimension ℓ = #L 1 −#L 2 is the largest possible with these designed parameters as, by Proposition 9 and Proposition 13, L 1 is as large as possible and L 2 is as small as possible, such that (7) and (8) hold. Observe that (7) and (8) are independent of the choice of monomial ordering ≺ in Theorem 16, as the integers u and u ′ from that theorem play no role here. Note that D(X i 1 1 · · · X im m ) = δ is a concave function on the domain under consideration, while D ⊥ (X i 1 1 · · · X im m ) = δ ⊥ is a convex function. Therefore the necessary condition that L 2 ⊂ L 1 creates a restriction on how small a codimension can be for each fixed value of δ (low codimensions require another method which we describe in the next section). The following theorem summarizes the method described.
Theorem 17. With the above notation, fix two positive integers δ and δ ⊥ such that the monomial sets L 1 and L 2 described in (5) and (6), respectively, satisfy that L 2 ⊂ L 1 . Then the evaluation codes C(L 2 ) ⊂ C(L 1 ) are of codimension ℓ = #L 1 − #L 2 , and the relative minimum distances satisfy M 1 (C(L 1 ), C(L 2 )) ≥ δ and Remark 18. The case δ = δ ⊥ and S = F m q is studied in [25,27] in connection with symmetric quantum codes. There it is characterized when the corresponding sets L 1 and L 2 satisfy the inclusion L 2 ⊂ L 1 .

Remark 19.
It is possible to show that d(C(L 1 )) = M 1 (C(L 1 ), C(L 2 )), but for general Cartesian product point sets it is unsettled if leaving it undecided if the related asymmetric quantum codes are pure or not.
Below we analyze the parameters of the nested code pairs in Theorem 17 when the sets S 1 , . . . , S m are all of the same size, but first we illustrate the theorem with an example.
Example 7. This is a continuation of the examples in Section 2 where we considered S = F * 7 * F * 7 . From Figure 2 we see that for δ = 12 the set L 1 in (5) becomes Hence, #L 1 = 17. According to Figure 3, δ ⊥ = 6 is the highest possible value of δ ⊥ such that all X α Y β ∈ ∆(6, 6) with D ⊥ (X α Y β ) < δ ⊥ also belong to L 1 . The corresponding set L 2 in (6) then becomes which is of size 10. Hence, the codimension between C(L 1 ) and C(L 2 ) is 7, and M 1 (C(L 1 ), C(L 2 )) ≥ 12 and M 1 (C(L 2 ) ⊥ , C(L 1 ) ⊥ ) ≥ 6. In a similar fashion we obtain the remaining parameters in Table 1. Note that if we have a code pair C( Table 1 we only list parameters with δ ≥ δ ⊥ . We also exclude cases with δ ⊥ = 1 (corresponding to C 2 = { 0}). ♦ In the following we find closed formula expressions for the parameters of the coset construction in Theorem 17 when S 1 , . . . , S m are all of the same size. We start with a lemma explaining for which choices of δ and δ ⊥ the theorem works.   The next step in our analysis is to establish an estimate from below on the dimension of the code C(L 1 ) and C(L 2 ) ⊥ when L 1 is as in (5), L 2 is as in (6) and s = s 1 = · · · = s m . In [29, Theorem 1] a bound was given for the special case S 1 = · · · = S m = F q and q m−1 ≤ δ, δ ⊥ ≤ q m . With the last mentioned condition we do not obtain L 2 ⊂ L 1 and we therefore now generalize the result from [29] to arbitrary 1 ≤ δ ⊥ , δ ≤ s m and s = s 1 = · · · = s m . We start with a technical lemma, whose proof we give in Appendix A.
From this lemma we obtain information on the dimensions of the codes as follows.
Proof. By symmetry is is enough to prove the result for C(L 1 ). The dimension of C(L 1 ), i.e. the number of integer tupples (i 1 , . . . , i m ) ∈ {0, . . . , s − 1} m with (s − i 1 ) · · · (s − i m ) ≥ τ , is at least that of the volume of which corresponds to the integral in Lemma 21 when i is chosen to be equal to 1. This proves (11). Next, assume 1 ≤ τ < s. The above mentioned set of integer tupples can be divided into two sets, the first set consisting of those tupples satisfying 0 ≤ i v < s − τ for some v ∈ {1, . . . , m}, and the second set consisting of those tupples satisfying s − τ ≤ i v for v = 1, . . . , m. The number of elements in the first set equals s m − τ m . The cardinality of the second set is estimated from below by the volume of The last part of the theorem now follows by applying Lemma 21 with i = 1 and s = τ .
Remark 23. From Theorem 22 one obtains for each choice of m closed formula lower bounds on the rate k/n as a function of the relative minimum distance 3 d/n. Such estimates are independent of the actual value of s. From the proof it is clear that these estimates become more and more precise as s increases. Computer experiments reveal that with m = 2 and m = 3 already for s = 32 the true values of the rate is almost the same as the estimated.
Using the constructions described in Section 1 we get by applying Lemma 20 in combination with (11) from Theorem 22 the following result on the existence of ramp secret sharing schemes and asymmetric quantum codes.
the first privacy number satisfying t = t 1 ≥ δ ⊥ − 1 and the last reconstruction number satisfying r = r ℓ ≤ s m − δ + 1. Similarly, we obtain asymmetric quantum codes with parameters Remark 25. The lower bound on ℓ in Theorem 24 can be improved in the case 1 ≤ δ < s or 1 ≤ δ ⊥ < s by applying (12) instead of (11).
Recall from Remark 5 that studying asymmetric quantum codes derived from the CSS construction is equivalent to studying linear ramp secret sharing schemes. Therefore, the following discussion on asymmetric quantum codes imposed by Theorem 17 can be directly translated into results on ramp secret sharing schemes. We leave the details for the reader.
Observe that the bound d z ≥ m 2 − k + 1 in Theorem 26 suggests that to obtain the widest variety of code parameters for a given code length one should choose m 1 smallest possible and m 2 largest possible, such that the conditions in the theorem are satisfied. The surprising consequence -which we illustrate in the following example -is that sometimes one obtains better parameters from Theorem 26 by considering a shorter code length. Adding 0s to the code words of the shorter code, we then obtain bounds on codes of the right length.
Example 8. We first consider asymmetric quantum codes with q = 7 and of length 49. Applying Theorem 26 directly to the case of n = 49 we obtain six different sets of parameters. However, we can actually derive better information on codes of length 49 by applying Theorem 26 to codes of length n = 48. In Table 2    We next consider asymmetric quantum codes with q = 8 and of length 64. Our theorem treats many more constellations of d z /d x with d z ≥ d x than does Theorem 26. For instance, the highest value of d z treated by Theorem 26 is d z = 31, whereas Theorem 17 describes 35 different nested code pairs with d z ≥ 32. In most cases the code parameters guaranteed by Theorem 17 are much better than the parameters described in Theorem 26. However, there are also cases where the situation is the opposite. From the huge amount of obtainable values d z /d x we display in Table 3 some representative examples that illustrate the situation. Again all listed codes coming from Theorem 17 strictly exceed the Gilbert-Varshamov bound. ♦ Example 9. In this example we consider S 1 , S 2 ⊆ F 7 with #S 1 = 6 and #S 2 = 7 and apply Theorem 17 and Theorem 26 to construct asymmetric quantum codes of length n = 42. In most cases Theorem 17 is much better than Theorem 26, however, there also exists a number of cases where the latter is the best.  We conclude this section with an example illustrating how to derive relative generalized Hamming weights of the considered codes. Recall from Section 1 that such information directly translates into information on the privacy numbers and the reconstruction numbers of the corresponding ramp secret sharing schemes.
Example 11. In this example we apply Theorem 16 to estimate the parameters M v (C(L 1 ), C(L 2 )), M v (C(L 2 ) ⊥ , C(L 1 ) ⊥ ), v = 1, . . . , #L 1 − #L 2 = 7 where L 1 and L 2 are as in (9) and (10), respectively. See Figure 4. Recall that the monomial ordering, that we use in this example, is the degree lexicographic ordering ≺ deg . We therefore obtain u = min{i | N i ∈ L 1 \L 2 } = 8 and u ⊥ = max{i | N i ∈ L 1 } = 19.    Table 6: Privacy numbers and reconstruction numbers of the ramp secret sharing scheme described in Example 11.

and (4) becomes
Going through all possible combinations we obtain the information in Table 5. Hence, we can construct a ramp secret sharing scheme over F 7 with n = 36 participants, with the secrets belonging to F 7 7 and with the privacy numbers being as in Table 6. ♦

Relatively small codimension
In the former section we demonstrated how to construct good pairs of nested codes having relatively large codimension. We now show how to obtain good pairs of nested codes with relatively small codimension. To explain the idea behind our method, we start with an example which leads to a formal statement in Theorem 27 below.
Example 12. This is a continuation of the series of examples where we consider codes over F * 7 × F * 7 , and where we use the degree lexicographic ordering ≺ deg . Consider The situation is described in Figure 5 The codimension is 3 and the values of u and u ⊥ in Theorem 16 become u = min{i | N i ∈ L 1 \L 2 } = 12 (corresponding to N u = X 3 Y ), and u ⊥ = max{i | N i ∈ L 1 } = 14 (corresponding to N u ⊥ = XY 3 ). By inspection we see that, due to the particular choice of L 1 and L 2 , in (3) and (4)   The circled and the boxed monomials correspond to for v = 1, 2, 3. From this we easily obtain the parameters in Table 7.
In a similar way we have in (3) and (4) only monomials from L 1 \L 2 , if in (13) and . However, due to symmetry, we only need to consider the first five cases (in addition to the case that we have already considered). For instance from (X 4 Y 4 , X 4 Y 4 ) we derive the same estimates for M v (C(L 1 ), C(L 2 )) and M v (C(L 2 ) ⊥ , C(L 1 ) ⊥ ), respectively, as we would derive from (XY, XY ) for M v (C(L 2 ) ⊥ , C(L 1 ) ⊥ ) and M v (C(L 1 ), C(L 2 )), respectively (the order of parameters being reversed). In Table 8 we list our estimates of relative minimum distances and these are compared to the estimates of minimum distances to demonstrate the advantage of the proposed code construction. In this example we did in (13) and (14), not consider replacing XY 3 and X 3 Y , respectively, with Y a and X a , respectively. The arguments of the example surely would apply also in this case, however, the corresponding nested codes are of Reed-Muller type, and such codes do not have impressive parameters. ♦ The method of Example 12 can be applied to any point set S 1 ×S 2 with s = #S 1 = #S 2 . The idea is to consider the intersection of a line with slope −1 and the lattice ∆(s, s). From either direction, both values D(X i Y j ) and D ⊥ (X i Y j ) strictly increase, while moving on the line segment toward its middle. Hence, choosing L 2 ⊂ L 1 in such ℓ = #L 1 − #L 2 1 2 3 1 4 2 M 1 (C(L 1 ), C(L 2 )) ≥ 25 20 15 16 10 12 d(C(L 1 )) ≥ 24 18 12 12 6 6 M 1 (C(L 2 ) ⊥ , C(L 1 )) ⊥ ≥ 4 6 8 9 10 12 d(C(L 2 ) ⊥ ) ≥ 3 4 5 5 6 6 a way that L 1 \L 2 is equal to a center part of a line segment of slope −1 produces good relative minimum distances.
where F 1 and F 2 are as in (2). Consider X i Y j ∈ ∆(s, s) with i ≤ j and let The codes C(L 1 ) and C(L 2 ) are of length n = s 2 and their codimension equals ℓ = j − i + 1. The relative minimum distances satisfy and for v = 2, . . . , ℓ Proof. We first establish the bounds We do this by applying Theorem 16 with ≺ deg as the chosen monomial ordering. In particular ∆(s, s) = {N 1 , . . . , N s 2 } where the enumeration of the N i s is with respect to ≺ deg . Consider u = min{i | N i ∈ L 1 \L 2 } and u ⊥ = max{i | N i ∈ L 1 }. The uth element of ∆(s, s) now is N u = X j Y i and the u ⊥ th element is N u ⊥ = X i Y j . By (3) and (4) the right-hand sides of (21) and (22) therefore serve as lower bounds on their respective left-hand sides. We next prove (17) and (18). From (21) we have (equality of the convex function is attained for v = 0 and v = ℓ − 1). This proves that the right-hand side of (17) is larger than or equal to the left-hand side. In a similar fashion we establish the inequality (18). To establish equality in (17) we only need to find a codeword in C(L 1 )\C(L 2 ) with (s − i)(s − j) non-zeros. To this end, write S 1 = {α 1 , . . . , α s } and S 2 = {β 1 , . . . , β s } and consider which has exactly the prescribed number of non-zeros in S 1 × S 2 . The codeword c = ev(F (X, Y ) + I) clearly belongs to C(L 1 )\C(L 2 ) and therefore we have established equality in (17). In a similar way we can show that equality actually holds in (21). This is done by considering for each possible set K ⊆ {X j Y i , X j−1 Y i+1 , . . . , X i Y j } the corresponding set of #K polynomials as above. The number of elements in S 1 × S 2 , that are non-zeros of at least one of these polynomials, equals D(K). It remains to show that the right-hand side of (21) equals the right-hand side of (19), and that the right-hand side of (22) equals the right-hand side of (20). For convenience, we will explain the case in (19) for v = 2. The cases v ≥ 3 can be proved with the same reasoning by using the principle of inclusion and exclusion. A similar and straightforward reasoning, where one should replace (s − i)(s − j) with (i + 1)(j + 1) gives the corresponding formula for the case in (20). Indeed, we are considering sets Then D(K) equals the cardinality of the set of monomials which are divisible by either X j−x Y i+x or X j−y Y i+y . So, we have to compute the sum of the cardinalities of the set of monomials divisible by X j−x Y i+x plus that of the set of monomials divisible by X j−y Y i+y minus that of the set of monomials divisible by both of them. Therefore, We are looking for the minimum of that function within the above mentioned region. Derivatives show that the minimum will appear on the boundary. As a consequence we find it for the values x = 0 and y = 1 which give the value (s −i)(s −j) + (s −i−1) in the statement. This concludes the proof.
Proof. We only prove (23), (24) and (25). The other results follow by symmetry. Choose 0 ≤ i ≤ j < s with i + j = σ < s and ℓ = j − i + 1. Then i = σ−ℓ+1 Corollary 29. Consider integers 1 < s ≤ q, where q is a prime power and let σ ∈ {0, . . . , s − 1}. Then for any ℓ ≤ σ + 1 such that ℓ is even if and only if σ is odd we obtain from Proposition 28 ramp secret sharing schemes over F q with n = s 2 participants, shares in F ℓ q and either

Similarly we obtain asymmetric quantum codes with parameters
where d z equals the right hand side of (23) and d x is greater than or equal to the right hand side of (24) (and similarly with (26) and (27)). If ℓ ≤ σ −1 then the asymmetric quantum codes are impure. Example 13. In this example we consider asymmetric quantum codes as in Corollary 29 with d z = δ being equal to the right hand side of (23) and d x being greater than or equal to δ ⊥ which we define as the right hand side of (24). We treat the cases n = q 2 , where q = 3, 4, 5, 7, 8, 9. In the literature e.g. [42,17,44] one can find extensive tables of quantum stabilizer code parameters derived by applying Theorem 3, however, they only use the bound are the minimum distances of concrete code pairs with C 2 ⊂ C 1 . The present example illustrates the huge advantage of using instead the relative minimum distances (which is what is behind the bounds in Corollary 29). This is done by investigating for each ℓ and δ what is the highest value g(ℓ, δ) such that the tables of best known linear codes in [34] guarantee the existence of linear code pairs A, B ⊥ satisfying dim A − dim B = ℓ, d(A) ≥ δ, and d(B ⊥ ) ≥ g(ℓ, δ) (this is in the spirit of [18,Theorem 2]). Observe, that we make no assumption whatsoever that B ⊂ A. Actually, such inclusion is very unlikely to hold when one chooses two codes A and B ⊥ which are optimal with respect to the tables of best known linear codes in [34]. In Table 9 we list values of (ℓ, δ, δ ⊥ , g(ℓ, δ)). The many cases where δ ⊥ is close to g(ℓ, δ) illustrate the huge advantage of using the construction in Theorem 27 and taking into account the relative minimum distances. Note that, there are even two cases where δ ⊥ exceeds the corresponding g(ℓ, δ), namely for q = 7 and (ℓ, δ, δ ⊥ , g(ℓ, δ)) equal to (3,15,15,14) or (2,30,6,5). All displayed code parameters coming from Theorem 27 strictly exceed the Gilbert-Varshamov bound (Theorem 4). ♦ It is not straightforward to generalize Theorem 27 to point ensembles S 1 ×S 2 with #S 1 not necessarily equal to #S 2 . The problem lies in the choice of monomial ordering (and the corresponding definition of L 1 and L 2 ). More concretely, for #S 1 = #S 2 there simply is no monomial ordering which simultaneously optimizes the relative minimum distance of the corresponding primary codes and the relative minimum distance of the corresponding dual codes. However, our method can still be applied as the following example illustrates. q (ℓ, δ, δ ⊥ , g(ℓ, δ)) 3 (1,4,4,4) 4 (2,6,6,6) (1,9,4,4) 5 (3,8,9,9) (1,9,9,9) Table 9: Corresponding values of (ℓ, δ, δ ⊥ , g(ℓ, δ)) from Example 13. The many cases with δ ⊥ close to g(ℓ, δ) (and even two cases with δ ⊥ > g(ℓ, δ)) demonstrate the advantage of the construction in Theorem 27 and of using relative minimum distances. In this example we consider S 1 , S 2 ⊆ F q with s 1 = #S 1 = 8, s 2 = #S 2 = 5 and consider codes defined from S 1 × S 2 . Here q is any prime power greater than or equal to 8. In Figure 6 we depict on the left D(∆(s 1 , s 2 )) and on the right D ⊥ (∆(s 1 , s 2 )).
Concentrating first on the lower left corner of ∆(s 1 , s 2 ) we see that on a line segment of slope −1 the values D ⊥ (X i Y j ) indeed still increase when moving from either direction toward the middle of the segment. This, however, does not at all hold for D(X i Y j ). For instance if we choose (3) and (4) of Theorem 16 we only need to consider monomials in L 1 \L 2 = {X 2 Y, XY 2 }. Hence, we obtain the estimates M 1 (C(L 1 ), C(L 2 )) ≥ min{21, 24} = 21 and M 1 (C(L 2 ) ⊥ , C(L 1 ) ⊥ ) ≥ 6. But this seems somewhat not a perfect choice of L 2 ⊂ L 1 as now min{D(M) | M ∈ L 1 } = min{D(M) | M ∈ L 1 \L 2 }. Hence, we optimized the relative minimum distance of the dual codes, but did not obtain any improvement for the primary codes. Turning to the right upper corner of ∆(s 1 , s 2 ) the situation is similar, however, with the role of the primary and dual codes interchanged. We finally consider the remaining middle part of ∆(s 1 , s 2 ). We first choose as monomial ordering the weighted degree lexicographic ordering ≺ w defined by the rule that X i 1 Y i 2 ≺ w X j 1 Y j 2 if either i 1 + 2i 2 < j 1 + 2j 2 , or i 1 + 2i 2 = j 1 + 2j 2 with i 2 < j 2 . Then define Again this renders the nice property that in (3) and (4) we only need to consider the monomials of L 1 \L 2 , which in this case becomes {X 4 Y, X 2 Y 2 }. We obtain M 1 (C(L 1 ), C(L 2 )) ≥ min{16, 18} = 16, Choosing on the other hand the degree lexicographic ordering and defining we only need to consider monomials in L 1 \L 2 = {X 3 Y, X 2 Y 2 }, from which we obtain M 1 (C(L 1 ), C(L 2 )) ≥ min{18, 20} = 18 and M 1 (C(L 2 ) ⊥ , C(L 1 ) ⊥ ) ≥ min{8, 9} = 8. As a consequence, there seems to be no general rule for which (weighted) degree lexicographic ordering to choose. ♦ We now return to the case of the point set being a Cartesian product of subsets S i ⊆ F q of the same size. Theorem 27 treated the two-dimensional case, the theorem below treats higher dimensions.
Theorem 31. Consider S 1 , . . . , S m ⊆ F q with s = #S 1 = · · · = #S m and let . . F m are as in (2). Consider X i 1 1 X i 2 2 · · · X im m ∈ ∆(s, . . . , s) with i 1 ≤ i 2 and let The codes C(L 1 ) and C(L 2 ) are of length n = s m and their codimension equals ℓ = i 2 − i 1 + 1. The relative minimum distances satisfy Proof. The proof is similar to that of Theorem 27. The details are left for the reader.
We next return to the two-dimensional case, comparing in an example asymmetric quantum codes from Corollary 29 with La Guardia's Construction II of asymmetric quantum generalized Reed-Solomon codes (Theorem 26). Recall from Remark 5 that parameters of asymmetric quantum codes based on the CSS construction can be directly translated into parameters of ramp secret sharing schemes.
Example 15. We first consider the case of asymmetric quantum codes with q = 7 and of length 49. The parameters produced by Theorem 26 for the code length 49 all satisfy that d z , d x ≤ 6. To produce higher values of d z (as usual we shall assume d z ≥ d x ), we can instead apply Theorem 26 to codes of length 48 and thereby derive information on codes of length 49. We then compare these values with what is produced from Theorem 27 in combination with Theorem 3 for codes of length 49. As is seen in Table 10, most often Theorem 27 produces the best results. All displayed codes coming from Theorem 27 strictly exceed the Gilbert-Varshamov bound (Theorem 4). We next consider asymmetric quantum codes with q = 8 and of length 64. In Table 11 we compare representative examples of what can be derived from Theorem 26 with what can be obtained from Theorem 27 in combination with Theorem 3. Again the advantage of our method is distinct in most cases, however, with a clear exception when d z = 14. For d z > 31, Theorem 26 does not produce any information, which in Table 11 is marked with "--". All displayed codes coming from Theorem 27 strictly exceed the Gilbert-Varshamov bound (Theorem 4).

♦
We conclude this section with discussing higher weights and their use in secret sharing.
Remark 32. Inspecting (19) and (20) it is clear that the (v+1)th relative weights are typically much larger than the vth relative weights, for v ∈ {1, . . . , ℓ−1}. In particular the second relative weights are often much larger than the first relative weights. The consequence for the related ramp secret sharing schemes is that the security is much better than what is reflected only by the parameter t = t 1 , in that t v+1 is much larger than t v for v ∈ {1, . . . , ℓ − 1}. Hence, if a small amount of information leakage can be accepted, then one can tolerate many more leaked symbols. In the other direction, reconstruction corresponds to solving a system of linear equations. Hence, the fact that r v is much smaller than r v+1 for v ∈ {1, . . . , ℓ − 1}, and in particular that r ℓ−1 is much smaller than r = r ℓ , means that if one is willing to guess some of the indeterminates of the system then one needs much fewer shares to reconstruct the secret.   We illustrate Remark 32 with an example.
Example 16. This is a continuation of Example 12. Applying Theorem 27 we obtain ramp secret sharing schemes with n = 36 participants, with secrets in F ℓ q where ℓ and the privacy and reconstruction numbers are as in Table 12. ♦

Concluding remarks
In a series of works [26,24,27,25,23] the authors of the present paper investigated linear codes over F q defined by evaluating multivariate polynomials at Cartesian prod-ucts S 1 × · · · × S m , where for i = 1, . . . , m, S i is the set of roots of Here N i > 1 satisfies that N i − 1 divides q − 1. Such codes were then used in [26,24,27,25,23] for the construction of symmetric quantum codes. In the terminology used in these papers a set J ⊆ {1, . . . , m} indicates for which indices the second case in (28) occurs -and the corresponding codes are called J-affine variety codes, and if N i − 1 = q − 1, J = {1, . . . , m} generalized toric codes [49]. One of the advantages of such codes is that they come with an efficient method for finding parity check matrices. More precisely, when each row in the generator matrix is made by evaluating a monomial at the points of the point set, then [27, Proposition 1] provides a description of a corresponding parity check matrix. The codes of the present paper clearly are J-affine variety codes when S i , i = 1, . . . , m is of the form (28). This is in particular the case in all the examples we have given, implying that for these codes we can easily establish parity check matrices. Another advantage of J-affine variety codes is that they are suited for the construction of subfield subcodes. It is an interesting topic of future research to investigate if the method from the present paper can be successfully combined with such subfield subcode construction.
For q an even power of a prime, Theorem 3 is also true if one replaces the Euclidean duality with the Hermitian duality [19,Theorem 4.5]. It is also an interesting research problem to investigate if this product can be successfully combined with the methods of the present paper. which is indeed true. Next let 1 ≤ i < m and assume that the formula in the lemma holds when i is substituted with i + 1. We must show that it also holds for i. The left hand side becomes We continue with the last term, which after the substitution, Shifting the index by 1 in the last sum and collecting terms in (29) prove the lemma.