The Frobenius FFT

HAL Id: hal-01453269

https://hal.archives-ouvertes.fr/hal-01453269v2

Preprint submitted on 27 Apr 2017

HAL is a multi-disciplinary open access archive for the deposit and dissemination of sci- entific research documents, whether they are pub- lished or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.

L’archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d’enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

The Frobenius FFT

Joris van der Hoeven, Robin Larrieu

To cite this version:

Joris van der Hoeven, Robin Larrieu. The Frobenius FFT. 2017. �hal-01453269v2�

The Frobenius FFT

Joris van der Hoeven

, Robin Larrieu

CNRS, Laboratoire d'informatique École polytechnique 91128 Palaiseau Cedex

France

a. Email: [email protected] b. Email: [email protected]

April 26, 2017

ABSTRACT

Let Fq be the finite field with q elements and let ! be a primitiven-th root of unity in an extension eldFq^dofFq. Given a polynomial P 2 Fq[x] of degree less than n, we will show that its discrete Fourier transform(P(1); P(!); :::;

P(!^n¡1))2Fqn^d can be computed essentiallydtimes faster than the discrete Fourier transform of a polynomial Q 2 Fq^d[x] of degree less than n, in many cases. This result is achieved by exploiting the symmetries provided by the Frobenius automorphism ofFq^d overFq.

Keywords

FFT; finite field; complexity bound; Frobenius automor- phism

A.C.M. subject classification: G.1.0 Computer-arith- metic, F.2.1 Number-theoretic computations

A.M.S. subject classification: 68W30,68Q17,68W40

1. INTRODUCTION

Letn= 2^`and let!= e^2pi/nbe a primitiven-th root of unity in C. The traditional algorithm for computing dis- crete Fourier transforms [7] takes a polynomial P2C[x]of degree<non input and returns the vector(P(1); P(!); :::;

P(!^n¡1)). If P actually admits real coecients, then we haveP(!^¡i) =P(!ⁱ)for alli, so roughlyn/2of the output values are superuous. Because of this symmetry, it is well known that such real FFTs can be computed roughly twice as fast as their complex counterparts [3,25].

More generally, there exists an abundant literature on the computation of FFTs of polynomials with various types of symmetry. Crystallographic FFT algorithms date back to [26], with contributions as recent as [20], but are dedi- cated to crystallographic symmetries. So calledlattice FFTs have been studied in a series of papers initiated by [11]

and continued in [27, 4]. A more general framework due to [1] was recently revisited from the point of view of high- performance code generation [18]. Further symmetric FFT algorithms and their truncated versions were developed in [16].

In this paper, we focus on discrete Fourier transforms of polynomials P 2 Fq[x] with coecients in the nite eld withqelements. In general, primitiven-th roots of unity! only exist in extension elds of Fq, say!2Fq^d. This puts us in a similar situation as in the case of real FFTs: our primitive root of unity ! lies in an extension eld of the coecient eld of the polynomial. This time, the degree of the extension is d= [Fq^d:Fq] instead of2 = [C:R]. As in the case of real FFTs, it is natural to search for algorithms that allow us to compute the DFT of a polynomial inFq[x]

approximatelydtimes faster than the DFT of a polynomial inFq^d[x].

The main purpose of this paper is to show that such a speed-up by an approximate factor of d can indeed be achieved. The idea is to use the Frobenius automorphism q: Fq^d !Fq^d; x 7! x^q as the analogue of complex con- jugation. If P 2Fq[x], then we will exploit the fact that P(kq(!ⁱ)) = qk(P(!ⁱ)) for all 0 6i < n and 06k < d.

This means that it suces to evaluatePat only one element of each orbit for the action of the Frobenius automorphism on the cyclic group h!i generated by !. We will give an ecient algorithm for doing this, called theFrobenius FFT. Our main motivation behind the Frobenius FFT is the development of faster practical algorithms for polyno- mial multiplication over nite elds of small characteristic.

In [12], we have shown how to reduce multiplication inF2[x]

to multiplication in F2⁶⁰[x], while exploiting the fact that ecient DFTs are available over F2⁶⁰. Unfortunately, this reduction involves an overhead of a factor2for zero padding.

The Frobenius FFT can be thought of as a more direct way to use evaluation-interpolation strategies overF2⁶⁰for poly- nomial multiplication overF2. We have not yet implemented the algorithms in the present paper, but the ultimate hope is to make such multiplications twice as ecient as in [12].

Let us briey detail the structure of this paper. In sec- tion2, we rst recall some standard complexity results for nite eld arithmetic. We pursue with a quick survey of the fast Fourier transform (FFT) in section3. The modern formulation of this algorithm is due to Cooley and Tukey [7], but the algorithm was already known to Gauÿ [9].

In section4, we introduce thediscrete Frobenius Fourier transform (DFFT) and describe several basic algorithms to compute DFFTs of prime order. There are essentially two efficient ways to deal with composite orders. Both approaches are reminiscent of analogue strategies for real FFTs [25], but the technical details are more complicated.

The rst strategy is to reduce the computation of d dis- crete Fourier transforms of polynomialsP0; :::; Pd¡12Fq[x]

of degree<nto a single discrete Fourier transform of a poly- nomialP 2Fq^d[x]of degree <n. This elegant reduction is the subject of section5, but it is only applicable if we need to compute many transforms. Furthermore, at best, it only leads to the gain of a factord/logd instead of d, due to numerous applications of the Frobenius automorphism q.

The second strategy, to be detailed in section 6, is to carefully exploit the symmetries in the usual CooleyTukey FFT; we call the resulting algorithm the Frobenius FFT (FFFT). The complexity analysis is more intricate than for the algorithm from section 5 and the complete factor d is only regained under certain conditions. Fortu- nately, these conditions are satised for the most interesting applications to polynomial multiplication inF2[x]or whenn becomes very large with respect tod.

In this paper, we focus on direct DFFTs and FFFTs.

Inverse FFFTs can be computed in a straightforward way by reversing the main algorithm from section6. Inverting the various algorithms from section 4for DFFTs of prime orders requires a bit more eort, but should not raise any serious diculties. The same holds for the algorithms to compute multiple DFFTs from section5.

Besides inverse transforms, it is possible to consider trun- cated Frobenius FFTs, following [14,15,21], but this goes beyond the scope of this paper. It might also be worth inves- tigating the use of Good's algorithm [10] as an alternative to the CooleyTukey FFT, since the ordernusually admits many distinct prime divisors in our setting.

2. FINITE FIELD ARITHMETIC

Throughout this paper and unless stated otherwise, we will assume the bit complexity model for Turing machines with a nite number of tapes [23]. Given a eldK, we will writeK[x]<nfor the set of polynomials inK[x]of degree<n.

Let us write q=p for some prime number pand>1.

Elements in the nite eld Fq are usually represented as elements ofFp[x] / ((x)), where 2Fp[x]is a monic irre- ducible polynomial of degree . We will denote by Mq(n) the cost to multiply two polynomials in Fq[x]<n. Multi- plications in Fq can be reduced to a constant number of multiplications of polynomials in Fp[x]< via the precom- putation of a pre-inverse of . The multiplication of two polynomials inFq[x]<ncan be reduced to the multiplication of two polynomials inFp[x]<2nusing Kronecker substitu- tion [8, Corollary 8.27]. In other words, we haveMq(n) = O(Mp( n)).

The best currently known bound for Mq(n) was estab- lished in [13]. It was shown there that

Mq(n) =O(nlogqlog(nlogq) 8^log(nlogq)); (2.1) uniformly in q, where

logx := minfk2N:log^kx61g; (2.2) log^k := log

klog:

Sometimes, we rather need to perform t multiplications P1Q; :::; PtQwithP1; :::; Pt; Q2Fq[x]<n. The complexity of this operation will be denoted byMq(n; t). Throughout this paper, it will be convenient to assume thatMq(n; t) / (n log q) is increasing in both n and q. In other words, Mp(n; t)/(n )is increasing in bothnand.

The computation of the Frobenius automorphism q

in Fq^d requires O(log q) multiplications in Fq^d when using binary powering, so this operation has complexity O(Mq(d)logq). This cost can be lowered by representing elements inFq^dwith respect to so-called normal bases [5].

However, multiplication inFq^dbecomes more expensive for this representation.

The discrete Frobenius Fourier transform potentially involves computations in all intermediate elds Fq^e where edividesd. The necessary minimal polynomialsfor these elds and the corresponding pre-inverses can be kept in a ta- ble. The bitsize of this table is bounded by2dlog2qeP

ejdd.

It is known [22] that (d) :=P

ejdd=O(dlog logd). Con- sequently, the bitsize of the table requiresO(dlog logdlogq) storage.

Another important operation in nite elds is modular composition: givenP ; Q2Fq[x]<nand a monic polynomial R2Fq[x]of degreen, the aim is to compute the remainder (P Q) remR of the euclidean division of P Q by R.

If R is the minimal polynomial of the nite eld Fqⁿ Fq[x] / (R(x)), then this operation also corresponds to the evaluation of the polynomialP2Fq[x]<nat a point inFqⁿ. If RandR⁰are two distinct monic irreducible polynomials in Fq[x] of degreen, then the conversion of an element in Fq[x] / (R(x)) to an element in Fq[x] / (R⁰(x)) also boils down to one modular composition of degreenoverFq.

We will denote byCq(n)the cost of a modular composi- tion as above. Theoretically speaking, Kedlaya and Umans proved that Cq(n) = (nlogq)^1+o(1) [19]. From a practical point of view, one rather has Cq(n) =O(n²logq). If nis smooth and one needs to compute several modular composi- tions for the same modulus, then algorithms of quasi-linear complexity do exist [17].

Given primitive elements2Fq^dand 2Fq^e withejd, the paper [17] also contains efficient algorithms for con- versions betweenFq[]andFq[][]. Using modular compo- sition, we notice that this problem reduces in timeCq(d) + (d/e) Cq(e) + Cq^e(d/e) to the case where we are free to choose primitive elements and that suit us. We let Vq(d; e) be a cost function for conversions between Fq[]

andFq[][]and denoteVq(d) =maxeje⁰jd(d/e⁰)Vq(e⁰; e).

3. FAST FOURIER TRANSFORMS 3.1 The discrete Fourier transform

LetKbe any eld and let!2Kbe a primitiven-th root of unity for somen >0. Now consider a polynomialP2K[x]<n, where

K[x]<n := fP2K[x]:degP < ng:

Thediscrete Fourier transformDFT!(P)ofP with respect to!is the vector

DFT!(P) = (P(1); P(!); :::; P(!^n¡1))2Kⁿ: If nis a small number, then DFT!(P)can be computed by evaluatingP(!ⁱ)directly fori= 0; :::; n¡1, using Horner's method for instance. Ifnis a prime number, then Rader and Bluestein have given ecient methods for the computation of discrete Fourier transforms of order n; see [24, 6] and subsection3.2below.

In subsection3.4, we are interested in the case whennis composite. In that case, one may compute DFT!(P) using thefast Fourier transform (or FFT). The modern formula- tion of this algorithm is due to Cooley and Tukey [7], but the algorithm was already known to Gauÿ [9]. The output (P(!^{))i<nof the FFT uses a mirrored indexation{that we will introduce in subsection3.3below.

We will denote byFq^d(n)the cost of computing a FFT in the eldFq^d.

3.2 Rader reduction

Assume that we wish to compute a DFT of large prime length n. The multiplicative group Fn is cyclic, of order n ¡ 1. Let g 2 f1; :::; n ¡ 1g be such that g mod n is a generator of this cyclic group. Given a polynomialP = p0++pn¡1x^n¡1 andj2 f1; :::; n¡1gwith j=g^lremn, we have

DFT!(P)g^lremn = p0+X

i=1 n¡1

pi!^i(glremn)

= p0+X

k=0 n¡2

pg^¡kremn!^{(g¡kremn)(glremn)}

= p0+X

k=0 n¡2

pg^¡kremn!^gl¡kremn:

Setting

uk = pg^¡kremn U = u0++un¡2y^n¡2 vl = !^glremn V = v0++v_n¡2y^n¡2 wl = DFT!(P)g^lremn¡p0 W = w0++wn¡2y^n¡2; it follows thatW =U V, when regardingU, V and W as elements of

K[y]_n¡1 := K[y]/(y^n¡1¡1):

In other words, we have essentially reduced the computation of a discrete Fourier transform of length n to a so-called cyclic convolution of lengthn¡1.

3.3 Generalized bitwise mirrors

Let n be a positive integer with a factorization n = m0m`¡1 such thatmj>1 for each j. Then any index i < ncan uniquely be written in the form

i = i0m1m`¡1++i`¡2m`¡1+i`¡1; whereij< mjfor allj < `. We calli0; :::; i`¡1thedigitsof i when written in themixed base v= (m0; :::; m`¡1). We also dene thev-mirror of iby

[i]v = i0+i1m0+i2m0m1++i`¡1m0m`¡2: Whenever v is clear from the context, we simply write { instead of[i]v.

If v= (m0)has length one, then we notice that [i](m0) = i:

Settingv^ = (m`¡1; :::; m0), we also have [[i]v]v^ = i:

Finally, given h6d, letv^]= (m0; :::; mh¡1),v^[= (mh; :::;

m`¡1), n<sup>]</sup>= m0 mh¡1 and n<sup>[</sup>= mh m`¡1, so that v= (v^]; v^[)andn=n^]n^[. Then it is not hard to see that for alli^]< n^]andi^[< n^[, we have

[i^]n^[+i^[]v^];v^[ = [i^[]v^[n^]+ [i^]]v^]:

3.4 The Cooley–Tukey FFT

We are now in a position to recall how the FFT works.

Letv^]= (m0; :::; m_h¡1),v^[= (mh; :::; m<sub>`¡1</sub>),n<sup>]</sup>=m0m<sub>h¡1</sub> andn<sup>[</sup>=mhm`¡1be as at the end of the previous subsec- tion. We denote !^]=!^n[and notice that!^]is a primitive n^]-th root of unity. Similarly,!^[:=!^n]is a primitiven^[-th root of unity. Recall that{[i]vfori < n. For anyi < nand j < n, we have

!^j{ = !^{(i[n]+i])(j]n[+j[)} = !^i]j[(!^[)^i[j[(!^])^i]j]; so that

P(!^{) = X

j^[<n^[

"

!^j[i] X

j^]<n^]

Pj^]n^[+j^[(!^])^j]i]

#

(!^[)^j[i[: (3.1) In this formula, one recognizes two polynomial evaluations of ordersn^]andn^[. More precisely, we may decompose the polynomialP as

P = P0]

(x^]) +P1]

(x^])x++P_n[¡1

] (x^])x^n[¡1; wherex^]=x^n[andP₀^]; :::; P_n[¡1

] 2K[x^]]<n^]. This allows us to rewrite (3.1) as

P(!^{) = X

j^[<n^[

(!^j[i]P_j[

]((!^])^i])) (!^[)^j[i[: (3.2) For each i^]< n^], we may next introduce the polynomial P_i^[]2K[x]<n^[by

P_i[](x) = P₀^]((!^])^i]) ++P_n[¡1

] ((!^])^i])x^n[¡1

The relation (3.2) now further simplies into

P(!^{) = P_i[](!^i](!^[)^i[): (3.3) This leads to the following recursive algorithm for the com- putation of discrete Fourier transforms.

Algorithm FFT!(P) Input:P2K[x]<n

Output:(P(!^{))i<n.

if `= 1then compute the answer using a direct algo- rithm and return it

Take0< h < `,n<sup>]</sup>=m0mh¡1andn<sup>[</sup>=mhm`¡1

Let!^]:=!^n[,!^[:=!^n],x^]:=x^n[ DecomposeP(x) =P₀^](x^]) ++P_n[¡1

] (x^])x^n[¡1 fori^[< n^[do

Compute(P_i[

]((!^])^i]))i^]<n^]:=FFT_!^](P_i[

]) fori^]< n^]do

LetP_i^[](x) :=P₀^]((!^])^i]) ++P_n[¡1

] ((!^])^i])x^n[¡1 LetP~_i^[_](x) :=P_i[](!^i]x)

Compute(P_i[](!^i](!^[)^i[))i^[<n^[:=FFT!^[

¡P~

i^] ] return (P(!^{))i<n= (P_i[](!^i](!^[)^i[))i=i^]n^[+i^[<n

If the mi are all bounded, then this algorithm requires O(nlogn)operations inK. For practical purposes it is best though to pickhsuch thatn^[andn^]are as close topn as possible. This approach is most cache friendly in the sense that it keeps data as close as possible in memory [2].

4. FROBENIUS FOURIER TRANSFORMS 4.1 The discrete Frobenius Fourier transform

Let Fq Fq^d be an extension of nite elds. Let q: Fq^d!Fq^d;x7!x^qdenote the Frobenius automorphism of Fq^doverFq. We recall that the grouphqigenerated byq

has sizedand that it coincides with the Galois group ofFq^d

overFq.

Let!2Fq^dbe a primitiven-th root of unity withFq^d= Fq[!]. Recall that njq^d¡1 and gcd(n; q) = 1. We will write h!i for the cyclic group of size n generated by !.

The Frobenius automorphismqnaturally acts onh!iand we denote byrq(!ⁱ) the order of an element!ⁱunder this action. Notice that rq(!ⁱ) jd. A subset S h!i is called a cross section if for every !^j 2 h!i, there exists exactly one!ⁱ2 S such that!ⁱ=qk(!^j) for somek2N. We will denote this element!ⁱ by_S(!^j). We will also denote the corresponding set of indices byI=fi < n:!ⁱ2 S g.

Now consider a polynomial P2Fq[x]<n. Recall that its discrete Fourier transform with respect to!is dened to be the vector

DFT!(P) = (P(1); P(!); :::; P(!^n¡1)):

SinceP admits coecients inFq, we have P(qk(!^j)) = kq(P(!^j))

for allj; k2N. For any!^j2 h!i, this means that we may retrieveP(!^j)fromP(_S(!^j)). Indeed, setting!ⁱ=_S(!^j) with!ⁱ=qk(!^j), we obtainP(!^j) =q¡k

(P(!ⁱ)). We call DFFT!;S(P) = (P(!ⁱ))i2I

thediscrete Frobenius Fourier transformof P with respect to!and the sectionS.

Let !ⁱ2 S and r=rq(!ⁱ). Then rq leaves!ⁱ invariant, whence qr(P(!ⁱ)) =P(rq(!ⁱ)) =P(!ⁱ). Since Fq^r is the subeld ofFq^dthat is xed under the action ofrq, this yields

P(!ⁱ) 2 F_qrq(!i):

It follows that the number of coecients inFq needed to represent DFFT!;S(P)is given by

X

i2I

rq(!ⁱ) = n: (4.1)

In particular, the output and input size n of the discrete Frobenius Fourier transform coincide.

4.2 Twiddled transforms

In the CooleyTukey algorithm from section 3.4, the second wave of FFTs operates on twiddled polynomials P~_i[](x) :=P_i[](!^i]x) instead of the polynomials P_i[](x). An alternative point of view is to directly consider the eval- uation of P_i[]at the points (!^[)^i[withi^[< n^[and where =!^i]. We will call this operation a twiddled DFT.

The twiddled DFFT is dened in a similar manner. More precisely, assume that we are given an s-th root of unity 2Fq^d such that the set h!i is stable under the action of q. Assume also that we have a cross sectionS of h!i under this action and the corresponding set of indicesI= fi < n: !ⁱ2 S g f0; :::; n¡1g. Then thetwiddled DFFT computes the family

DFFT;!;S(P) := (P( !ⁱ))i2I: Again, we notice that

X

i2I

rq( !ⁱ) = n: (4.2)

We will denote by Fq;d(n) the complexity of computing a twiddled DFFT of this kind.

4.3 The naive strategy

Ifnis a small number, then we recall from section3.1that it is most ecient to compute ordinary DFTs of ordernin a naive fashion, by evaluatingP(!ⁱ)fori < nusing Horner's method. From an implementation point of view, one may do this using specialized codelets for various smalln.

The same naive strategy can also be used for the compu- tation of DFFTs and twiddled DFFTs. Given a cross section S h!i and the corresponding set of indicesI=fi < n:

!ⁱ2 S g, it suces to evaluateP( !ⁱ)separately for each i2 I. Letri=rq( !ⁱ)jdbe the order of!ⁱunder the action of q. Then !ⁱactually belongs toFq^ri, so the evaluation of P( !ⁱ) can be done in time nMq^ri(1) +O(n rilogq).

With the customary assumption thatMqⁿ(1) /nis increasing as a function of n, it follows using (4.2) that the complete twiddled DFFT can be computed in time

Fq;d(n) 6 nX

i2I

Mq^ri(1) +O(n²logq) 6 n²

d Mq^d(1) +O(n²logq):

Assuming that full DFTs of ordernoverFq^dare also com- puted using the naive strategy, this yields

Fq;d(n) 6 ¹_dFq^d(n) (1 +o(1)): (4.3) In other words, for small n, we have achieved our goal to gain a factord.

4.4 Full Frobenius action

The next interesting case for study is whennis prime and the action of q on h!i is either transitive, or has only two orbits and one of them is trivial. If 2 h!i, then!⁰= 1 always forms an orbit of its own in h!i, but we can have jS j= 2. If 2/h!i, then it can happen thatS is a singleton.

This happens for instance for a9-th primitive root of unity 2F2⁶, for!=³2F4, andn= 3.

IfS is a singleton, sayS=fg, then we necessarily have rq() =n=dand the DFFT reduces to a single evaluation P() with P 2Fq[x]<nand 2Fqⁿ. This is precisely the problem of modular composition that we encountered in sec- tion2, whenceFq;d(n) =Cq(n). The speed-upFqⁿ(n)/Cq(n) with respect to a full DFT is comprised between1 and n, depending on the eciency of our algorithm for modular composition. Theoretically speaking, we recall thatCq(n) = (nlogq)^1+o(1), which allows us to gain a factorn/(nlogq) for any >0.

In a similar way, if 2 h!i and jS j= 2, then the com- putation of one DFFT reduces to n additions (in order to compute P(1)) and one composition modulo a polynomial of degreen¡1(instead of n).

Remark 4.1. Assume thatnis prime,2 h!iandjS j= 2.

If we are free to choose the representation of elements inFq^d, then the DFFT becomes particularly efficient if we take Fq^d = Fq[!]. In other words, if 2 Fq[x] is the monic minimal polynomial of ! over Fq (so that deg = d = n¡1), then we represent elements of Fq^d as polynomials in Fq[x]modulo . Given P 2Fq[x]<n, just writing down P(!) = (P ¡ Pd )(!) then yields the evaluation of P at!, whenceFq;d(n) =Mq(1; n) +O(nlogq).

4.5 Rader reduction

For large prime ordersnand2 h!i, let us now show how to adapt Rader reduction to the computation of DFFTs in favourable cases. With the notations from section 3.2, we have

(!^{g`remn</sup>)<sup>q</sup> = !<sup>(g`q)remn} = !^g`+remn

for all`, where < n¡1is such thatg=q. The action ofq

therefore induces an action q:`7!`+on Z/((n¡1)Z).

Let us assume for simplicity that the orderof the addi- tive subgroup generated byinZ/ ((n¡1)Z)is comprime with:= (n¡1)/. Then there exists an element < n¡1 of orderinZ/ ((n¡1)Z) andZ/((n¡1)Z) = hi hi. Consequently,

Fq[y]n¡1 = Fq[y][y]:

We may thus regard the product W =U V as a bivariate polynomial iny and y. Let W~2Fq[y] be the constant term in yof this bivariate polynomial. From W~, we can recoverP(!<sup>g`remn</sup>)for every`2 hi. By construction, the

!<sup>g`remn</sup>with `2 hi actually form a section ofh!i n f1g under the action of q. This reduces the computation of a DFFT for the sectionS:=f!^g`remn:l2 hig [ f1gto the computation ofW~.

As to the computation of W~, assume for simplicity that Fqcontains a primitive(n¡1)-th root of unity. Recall that Uhas coecients inFqwhereasV admits coecients inFq. Notice also thatV does not depend on the inputP, whence it can be precomputed. We compute W~ as follows in the FFT-model with respect toy. We rst transformU andV into two vectorsU^2(Fq[y])andV^2(Fq[y]). The computation of V^may again be regarded as a precompu- tation. The computation of the Fourier transformW~^2Fq

now comes down tomodular compositions of degreeover Fq. We nally transform the result back intoW~. Altogether, this yields

Fq;(n) 6 2Fq() +Cq() +O(nlogq):

It is instructive to compare this with the cost of a full DFT of lengthnoverFq^n¡1using Rader's algorithm:

F_q^n¡1(n) 6 2F_q^n¡1() + 2F_q^n¡1() +O(n²logq):

Depending on the eciency of modular composition, the speed-up for DFFTs therefore varies between n/ and n. Notice that the algorithm from the previous subsection becomes a special case with parameters=n¡1and= 1.

5. MULTIPLE FOURIER TRANSFORMS 5.1 Parallel lifting

Let Fq^d be an extension of Fq and assume that its ele- ments are represented as polynomials in a primitive element 2 Fq^d of degree d. Given d polynomials P0; :::; Pd¡1 2 Fq[x]<n, we may then form the polynomial

P = P0+P1++Pd¡1^d¡1 2 Fq^d[x]:

Ifnjq¡1and!is a primitiven-th root of unity in the base eldFq, then we notice that

DFT!(P) = DFT!(P0) ++DFT!(Pd¡1)^d¡1: (5.1) In other words, the discrete Fourier transform operates coef- cientwise with respect to the basis1; ; :::; ^d¡1ofFq^d.

Recall that Fq(n; t) stands for the cost of computing t Fourier transforms of lengthn over Fq. The maps(P0; :::;

Pd¡1)7!P0++Pd¡1^d¡1and its inverse boil down to matrix transpositions in memory. On a Turing machine, they can therefore be computed in time O(n dlogdlogq).

From (5.1), it follows that

Fq(n; d) 6 Fq^d(n) +O(n dlogdlogq): (5.2) This relation does not give us anything really new, since we made the assumption in section2thatMq(n; t)/(nlogq)is increasing in bothnandq. Nevertheless, it provides us with an elegant and explicit algorithm in a special case.

5.2 Symmetric multiplexing

Let us next consider ans-th root of unityand a primi- tiven-th root of unity !2Fq^d. Givenu= !ⁱ, we have for allk,

kq(P(q¡k

(u))) = P0(u)kq(1) ++Pd¡1(u)qk(^d¡1):

AbbreviatingP ;k(u) :=kq(P(_q^¡k(u)))and setting

B= 0 B@

1 ^d¡1

_q^d¡1(1) _q^d¡1(^d¡1) 1 CA

P(u) = 0

@ P ;0(u) _{P ;d¡1} (u)

1

A VP(u) = 0

@ P0(u) P_d¡1(u)

1 A

it follows that

P(u) = B VP(u):

Now given the twiddled discrete Fourier transform DFT;!(P) := (P( !ⁱ))i<nof P, we in particular know the valuesP(u); :::; P(qd¡1(u)). Letting the Frobenius automor- phism qact on these values, we obtain the vector P(u).

Using one matrix-vector product VP(u) =B^¡1 P(u), we may then retrieve the values of the individual twiddled transforms DFT;!(Pi) at u. Doing this for each u 2 S in a cross section of h!i under the action of q, this yields a way to retrieve the twiddled DFFTs of P0; :::; P_d¡1 from the twiddled DFT of P.

Recall that Fq;d(n; t) denotes the complexity of com- puting the DFFTs oftelements ofFq[x]<noverFq^d. Since B is a Vandermonde matrix, the matrix-vector product B^¡1P(u) can be computed in timeO(Mq(d)logd) using polynomial interpolation [8, Chapter 10]. Given DFT;!(P), we may compute each individual vector P(u) in time O(dMq(d)log(d q))using the Frobenius automorphism q. Since there are jS j orbits in h!i under the action of q, we may thus retrieve the DFFT;!(Pi) from DFT;!(P) in timeO(jS jdMq(d)logq^d). In other words,

Fq;d(n; d) 6 Fq^d(n) +O(jS jdMq(d)logq^d): (5.3)

5.3 Multiplexing over an intermediate field

In the extreme case when ; !2Fq, every !ⁱ2 h!i has order one under the action of qand jS j=n. In that case, the bound (5.3) is not very sharp, but (5.2) already provides us with a good alternative bound for this special case. Forr2/f1; dgwithrjd, let us now consider the case when u= !ⁱhas order at most r under the action of q

for alli, so thatu2Fq^r. Let2Fq^rbe a primitive element inFq^roverFq, so thatFq^r=Fq[]andFq^d=Fq^r[]. Given ourdpolynomialsP0; :::; P_d¡12Fq[x]<n, we may form

P[i] = Pir++P_ir+r¡1^r¡1 2 Fq^r[x]<n (i < d/r) P = P[0]+P[1]++P[d/r¡1]^d/r¡1 2 Fq^d[x]<n: Then we have

DFT;!(P)

= DFT;!(P[0]) ++DFT;!(P[d/r¡1])^d/r¡1: Moreover, we may compute (DFFT;!(Pir+j))j <r from DFT;!(P[i]) for each i < d/r, using the algorithm from the previous subsection, but with the additional property that at least oneu2h!ihas maximal orderr= [Fq^r:Fq] under the action of q.

Ifnis prime and2 h!i, then the above discussion shows that, without loss of generality, we may assume that!has order d under the action of q. This means that !ⁱ has maximal orderdfor everyi2 f1; :::; n¡1g, whereas!⁰= 1 has order one. Hence,jS j= (n¡1) /d+ 1. Similarly, if n is prime and 2/ h!i, then we obtain a reduction to the case when !ⁱhas maximal orderdfor alli2 f0; :::; n¡1g, whencejS j=n/d. In both cases, we obtain the following:

Proposition 5.1. If nis prime, then

Fq;d(n; d) = Fq^d(n) +O(nMq(d)logq^d):

Remark 5.2. We recall thatn6q^d¡1, whence logn6 logq^d. When using the best known bound (2.1) forMq(n) andFq^d(n)Mq^d(n), it follows for some constantC >0that

Fq;d(n; d)

Fq^d(n) > 1 +Cdlogqlog(dlogq) 8^log(dlogq) log(n dlogq) 8^log(ndlogq)

> 1 + 8Clogqlog(dlogq):

In other words, we cannot hope to gain more than an asymp- totic factor of d/logdwith respect to a full DFT.

Ifnis not necessarily prime, then the technique from this section can still be used for every individual u. However, the rewritings of elements inFq^das elements in Fq^r[]and Fq[][]have to be done individually for eachuusing mod- ular compositions. Denoting byrithe order of !ⁱunderq, it follows that

Fq;d(n; d)

= Fq^d(n) +X

i2I

Vq(d; ri) +X

i2I

O(riMq^ri(d/ri)logq^d) 6 Fq^d(n) +nVq(d) +O(nMq(d)logq^d):

Notice that conversions of the same type correspond to mod- ular compositions with the same modulus. If n is smooth, then it follows that we may use the algorithms from [17] and keep the cost of the conversions quasi-linear.

6. THE FROBENIUS FFT

Let n =m1 m` and v = (m1; :::; m`) be as in sec- tion3.3and let !2Fq^d be a primitive n-th root of unity.

In this section we present an analogue of the FFT from sec- tion3.4: theFrobenius FFT (or FFFT). This algorithm uses the same mirrored indexation as the CooleyTukey FFT:

givenP2Fq[x]<n, it thus returns the family(P(!^{))_i2I. We start with the description of the index setI=fi < n:!^{2 S g that corresponds to the so-called privileged cross sectionS ofh!i.

6.1 Privileged cross sections

Giveni < n, consider the orbitOq(!^{) :=hqi(!^{)of !^{ under the action ofhqi. We dene

q;v(!^{) := !^|

j := minf06j < n:!^|2 Oq(!^{)g:

ThenS:=imq;v is a cross section ofh!iunder the action of q; we call it the privileged cross section forq(and v).

Now leth6d,v^]= (m0; :::; m_h¡1),v^[= (mh; :::; m<sub>`¡1</sub>), n<sup>]</sup>=m0mh¡1 and n<sup>[</sup>=mhm`¡1 be as above. Then

!^]:=!^n[is a primitiven^]-th root of unity. LetS^]:=imq;v^]

be the corresponding privileged cross section ofh!^]i. Proposition6.1. We have

S^] = S^n[ := fu^n[:u2 S g:

Proof. Leti=i^]n^[+i^[andj=j^]n^[+j^[withi^]; j^]< n^] andi^[; j^[< n^[be such that!^|=kq(!^{)for somek. Since

(!^{)^n[= (!^i[n]+i])^n[= (!^i])^n[= (!^])^i];

and similarly (!^|)^n[ = (!^])^j], it follows that (!^])^j] = kq((!^])^i]).

Inversely, givenj^]< n^]with(!^])^j]=qk((!^])^i])for somek, we claim that there exists a j^[< n^[such that!^j=qk(!^{) for j = j^] n^[ + j^[. Indeed, (!^])^j] = qk((!^])^i]) implies that (!^j])^n[= (kq(!^{))^n[, whence !^j]/qk(!^{) is an n^[-th root of unity. This means that there exists a j^[< n^[with

!^j]/qk(!^{) = (!^n])^¡j[, i.e.!^|=!^j]+j[n]=qk(!^{).

Now assume that j is minimal with !^| = qk(!^{) for some k. Given ^]< n^]such that (!^])^]2 O^q((!^])^i]), the above claim shows that there exists a ^[ < n^[ such that

! 2 Oq(!^{) for =^]n^[+^[. But then j 6, whence j^]6^]. This shows that!^|2 S implies(!^|)^n[= (!^])^j]2 S^].