Root finding over finite fields using Graeffe transforms

(1)

Root finding over finite fields using Graeffe transforms

Bruno Grenet LIRMM U. Montpellier

Joris van der Hoeven & Grégoire Lecerf CNRS – LIX

École polytechnique

(2)

Statement of the problem

Root finding over finite fields

Given f∈Fq[X], compute its roots, that is {α∈Fq:f(α) =0}.

• Building block for many algorithms in computer algebra: root finding over Z, factorization, sparse interpolation, …

• Applications in cryptography, error correcting codes, …

• Derandomization

• Sparse interpolation: bottleneck in practice

[van der Hoeven & Lecerf, 2014]

1/21

(3)

Statement of the problem

Root finding over finite fields

Given f∈Fq[X], compute its roots, that is {α∈Fq:f(α) =0}.

• Building block for many algorithms in computer algebra: root finding over Z, factorization, sparse interpolation, …

• Applications in cryptography, error correcting codes, …

• Derandomization

• Sparse interpolation: bottleneck in practice

[van der Hoeven & Lecerf, 2014]

(4)

A first algorithm

Theorem

The roots off∈Fq[X]can be computed in deterministic time poly(q,d), whered =deg(f).

• Algo: Test eachα∈Fq, sequentially.

B Input size (1+d)logq: exponential time!

• Randomization: expected time (1−_d+1¹ )q.

2/21

(5)

Theorem

(6)

Theorem

2/21

(7)

State of the art

• No deterministic polytime algorithm is known

• √

S(p−1)(dlogp)^O(1) under ERH [Shoup (1991a)]

• √p(dlogp)^O(1) unconditionally [Shoup (1991b)]

• Both require the factorization of(p−1)

• ERH useless if a primitive element is given

• Root finding ⇐⇒ primitive element [von zur Gathen (1987)]

• Randomized algorithm in expected time O(d˜ log²q)

[Legendre (1785), Berlekamp (1970), Rabin (1980)]

• Factorization algorithms ⇝no improvement for root finding

[Cantor-Zassenhaus (1981), Kaltofen-Shoup (1998), Kedlaya-Umans (2011)]

• Better complexity bounds when q−1 issmooth

[Moenck (1977), von zur Gathen (1987), Mignotte-Schnorr (1988), Rónyai (1989), Shoup (1992), Źrałek (2010), …]

(8)

• √

3/21

(9)

• √

(10)

• √

3/21

(11)

• √

(12)

• √

3/21

(13)

• √

(14)

• √

3/21

(15)

• √

(16)

Settings

Goal

Obtainfastalgorithms for polynomial root finding in finite fields.

• Deterministic, probabilistic, heuristic; in practice or in theory.

• Assumption: fis monic,separable,splits overFq,f(0)̸=0: f(X) =

∏d i=1

(X−α_i), α_i ∈Fq^∗, α_i̸=α_j (A)

(easy reduction: f←gcd(f,X^q⁻¹−1))

• Extra input: A primitive elementζ of Fq^∗

• FFT finite field: Fp with p=M·2^m+1 and M=O(logp)

• Old algorithms revisited

• New technique based onGraeffe transforms

• Fast implementations

4/21

(17)

Settings

Goal

• Assumption: fis monic,separable,splits overFq,f(0)̸=0:

f(X) =

∏d i=1

(X−α_i), α_i∈Fq^∗, α_i̸=α_j (A) (easy reduction: f←gcd(f,X^q⁻¹−1))

(18)

Settings

Goal

f(X) =

∏d i=1

(X−α_i), α_i∈Fq^∗, α_i̸=α_j (A)

4/21

(19)

Settings

Goal

f(X) =

∏d i=1

(X−α_i), α_i∈Fq^∗, α_i̸=α_j (A)

(20)

Multiplicative structure of finite fields

F ₁₇ ^∗

1 9

13

15

16

8

4 2 2 3

10

5

11

14

7 12 6

3

4

2 is a primitive root of unity of order 8

3 is a primitive element of F₁₇^∗:

F17^∗ ={3ⁱ:0≤i<16} X^q⁻¹−1= ∏

α∈Fq^∗

(X−α)

5/21

(21)

F ₁₇ ^∗

1 9

13

15

16

8

4 2 2 3

10

5

11

14

7 12 6

3

4

F17^∗ ={3ⁱ:0≤i<16} X^q⁻¹−1= ∏

α∈Fq^∗

(X−α)

(22)

F ₁₇ ^∗

1 9

13

15

16

8

4 2 2 3

10

5

11

14

7 12 6

3

4

F17^∗ ={3ⁱ:0≤i<16}

X^q⁻¹−1= ∏

α∈Fq^∗

(X−α)

5/21

(23)

F ₁₇ ^∗

1 9

13

15

16

8

4 2 2 3

10

5

11

14

7 12 6

3

4

F17^∗ ={3ⁱ:0≤i<16} X^q⁻¹−1= ∏

α∈Fq^∗

(X−α)

(24)

Old algorithms revisited

(25)

Goal

• Many known randomized algorithms

• for the general case

• for special cases such as smooth(q−1)

• Idea: Adapt these algorithms for FFT finite fields

• Algorithms:

• Rabin’s algorithm (general case)

• Mignotte-Schnorr’s algorithm (smooth case)

• Moenck’s algorithm (FFT finite fields)

(26)

Goal

• Algorithms:

6/21

(27)

Goal

• Algorithms:

(28)

Goal

• Algorithms:

• Rabin’s algorithm(general case)

6/21

(29)

Rabin’s algorithm

• ∏

α∈Fp^∗

(X−α) =X^p⁻¹−1

=(X^p⁻²¹ −1)(X^p⁻²¹ +1)

α^p−1² =1

α^p⁻²¹ =−1 (α+τ)^p−1²

=1

(α+τ)^p⁻²¹

=−1

• With some luck, gcd(f,X^p⁻²¹−1)∈ {/ 1,f}.

• Push your luck: gcd(f,(X+τ)^p⁻²¹ −1)for somerandom τ ∈Fp

deg(

gcd(f,(X+τ)^p⁻²¹ −1))

≃d/2 Randomized algorithm

The roots off∈Fp[X]can be computed in expected time O(d˜ log²p).

(30)

• ∏

α∈Fp^∗

(X−α) =X^p⁻¹−1=(X^p⁻²¹ −1)(X^p⁻²¹ +1)

α^p−1² =1

α^p⁻²¹ =−1 (α+τ)^p−1²

=1

(α+τ)^p⁻²¹

=−1

deg(

gcd(f,(X+τ)^p⁻²¹ −1))

7/21

(31)

• ∏

α∈Fp^∗

(X−α) =X^p⁻¹−1=(X^p⁻²¹ −1)(X^p⁻²¹ +1)

α^p−1² =1

α^p⁻²¹ =−1 (α+τ)^p−1²

=1

(α+τ)^p⁻²¹

=−1

deg(

gcd(f,(X+τ)^p⁻²¹ −1))

(32)

• ∏

α∈Fp^∗

(X−α) =X^p⁻¹−1=(X^p⁻²¹ −1)(X^p⁻²¹ +1)

α^p−1² =1

α^p⁻²¹ =−1 (α+τ)^p−1²

=1

(α+τ)^p⁻²¹

=−1

deg(

gcd(f,(X+τ)^p⁻²¹ −1))

7/21

(33)

• ∏

α∈Fp^∗

(X−α) =X^p⁻¹−1=(X^p⁻²¹ −1)(X^p⁻²¹ +1)

α^p−1² =1

α^p⁻²¹ =−1 (α+τ)^p−1²

=1

(α+τ)^p⁻²¹

=−1

deg(

gcd(f,(X+τ)^p⁻²¹ −1))

(34)

• ∏

α∈Fp^∗

(X−α) =X^p⁻¹−1=(X^p⁻²¹ −1)(X^p⁻²¹ +1)

α^p−1² =1

α^p⁻²¹ =−1 (α+τ)^p−1²

=1

(α+τ)^p⁻²¹

=−1

deg(

gcd(f,(X+τ)^p⁻²¹ −1))

≃d/2

Randomized algorithm

7/21

(35)

• ∏

α∈Fp^∗

(X−α) =X^p⁻¹−1=(X^p⁻²¹ −1)(X^p⁻²¹ +1)

α^p−1² =1

α^p⁻²¹ =−1 (α+τ)^p−1²

=1

(α+τ)^p⁻²¹

=−1

deg(

gcd(f,(X+τ)^p⁻²¹ −1))

(36)

Modified Rabin’s algorithm (for FFT finite fields)

X^p⁻¹−1=

2∏^ℓ−1

i=0

(X^M2^m⁻^ℓ−ξⁱ), whereξ is primitive of order 2^ℓ.

ξ⁰ ξ¹

ξ² ξ³

gcd(f,(X+τ)^M2^m⁻^ℓ−ξ⁰) gcd(f,(X+τ)^M2^m⁻^ℓ−ξ¹)

gcd(f,(X+τ)^M2^m⁻^ℓ−ξ²) gcd(f,(X+τ)^M2^m⁻^ℓ−ξ³)

degrees

≃d/2^ℓ

Worthwhile in practice forsmall ℓ=2,3, . . .

8/21

(37)

X^p⁻¹−1=

2∏^ℓ−1

i=0

ξ⁰ ξ¹

ξ² ξ³

degrees

≃d/2^ℓ

(38)

X^p⁻¹−1=

2∏^ℓ−1

i=0

ξ⁰ ξ¹

ξ² ξ³

degrees

≃d/2^ℓ

8/21

(39)

X^p⁻¹−1=

2∏^ℓ−1

i=0

ξ⁰ ξ¹

ξ² ξ³

degrees

≃d/2^ℓ

(40)

New technique: Graeffe transform

(41)

The Graeffe transform Letf(X) =∏

i(X−αi)

f(X)f(−X) =∏

i

(X−αi)(−X−αi) = (−1)^d∏

i

(X²−α²_i)

Definition G₂(f)(X) =∏

i(X−α_i²)is the Graeffe transformof f. G_ρ(f)(X) =∏

i(X−α^ρ_i) is theGraeffe transform of order ρof f.

Remarks:

• G_ρ₁_ρ₂ =G_ρ₁◦G_ρ₂

• G_q₋₁(f)(X) =∏

i(X−α^q_i⁻¹) = (X−1)^d

(42)

i(X−αi)

f(X)f(−X) =∏

i

(X−αi)(−X−αi) = (−1)^d∏

i

(X²−α²_i)

i(X−α_i²)is the Graeffe transformof f.

G_ρ(f)(X) =∏

Remarks:

• G_ρ₁_ρ₂ =G_ρ₁◦G_ρ₂

• G_q₋₁(f)(X) =∏

i(X−α^q_i⁻¹) = (X−1)^d

9/21

(43)

i(X−αi)

f(X)f(−X) =∏

i

(X−αi)(−X−αi) = (−1)^d∏

i

(X²−α²_i)

G_ρ(f)(X) =∏

Remarks:

• G_ρ₁_ρ₂ =G_ρ₁◦G_ρ₂

• G_q₋₁(f)(X) =∏

i(X−α^q_i⁻¹) = (X−1)^d

(44)

i(X−αi)

f(X)f(−X) =∏

i

(X−αi)(−X−αi) = (−1)^d∏

i

(X²−α²_i)

G_ρ(f)(X) =∏

Remarks:

• G_ρ₁_ρ₂=G_ρ₁◦G_ρ₂

• G_q₋₁(f)(X) =∏

i(X−α^q_i⁻¹) = (X−1)^d

9/21

(45)

Computing Graeffe transforms

Lemma

Let ξ be a primitive root of unity of order π. Then G_π(f)(X^π) =f(X)f(ξX)· · ·f(ξ^π⁻¹X).

⇝Given ξ,G_π(f)can be computed in time O(πd˜ logq)

Theorem

Let f∈Fq[X]andq−1=π₁· · ·π_m. The Graeffe transforms G_π₁(f),G_π₁_π₂(f), …,G_π₁_···_π_m₋₁(f) can be computed in time (dlog²q)^1+δ for all δ >0.

Based on modular composition[Kedlaya-Umans (2011)].

(46)

Computing Graeffe transforms

Lemma

Let ξ be a primitive root of unity of order π. Then G_π(f)(X^π) =f(X)f(ξX)· · ·f(ξ^π⁻¹X).

⇝Given ξ,G_π(f)can be computed in time O(πd˜ logq) Theorem

Let f∈Fq[X]andq−1=π₁· · ·π_m. The Graeffe transforms G_π₁(f),G_π₁_π₂(f), …, G_π₁_···_π_m₋₁(f) can be computed in time (dlog²q)^1+δ for all δ >0.

Based on modular composition[Kedlaya-Umans (2011)].

10/21

(47)

Using Graeffe transforms

f g₁ g₂ … g_m₋₁ g_m

Z(f) Z₁ Z₂ … Z_m₋₁ {1}

G_π₁ G_π₂ G_π₃ G_π_m₋₁ G_π_m

• Z_m₋₁ ⊆{ξⁱ :0≤i< πm} (ξ: primitive root of order πm)

={ζ^(q⁻^1)i/π^m:0≤i< πm} (ζ: primitive element ofFq^∗)

• If β ∈Z_k, there exists α∈Z_k₋₁ s.t. α^π^k =β

• If β =ζ^e,α∈ {

ζ

e+(q−1)i

πk :0≤i< π_k }

(48)

f g₁ g₂ … g_m₋₁ g_m

Z(f) Z₁ Z₂ … Z_m₋₁ {1}

• If β =ζ^e,α∈ {

ζ

e+(q−1)i

πk :0≤i< π_k }

11/21

(49)

f g₁ g₂ … g_m₋₁ g_m

Z(f) Z₁ Z₂ … Z_m₋₁ {1}

• If β =ζ^e,α∈ {

ζ

e+(q−1)i

πk :0≤i< π_k }

(50)

f g₁ g₂ … g_m₋₁ g_m

Z(f) Z₁ Z₂ … Z_m₋₁ {1}

• If β =ζ^e,α∈ {

ζ

e+(q−1)i

πk :0≤i< π_k }

11/21

(51)

f g₁ g₂ … g_m₋₁ g_m

Z(f) Z₁ Z₂ … Z_m₋₁ {1}

• If β =ζ^e,α∈ {

ζ

e+(q−1)i

πk :0≤i< π_k }

(52)

A deterministic algorithm

× Z_m={ζ⁰}

×

{ζ

(q−1)i

πm :0≤i< π_m} g_m₋₁(ζ^e) =0

× ×

×

{ζ

e+(q−1)i

πm−1 :0≤i< πm−1} g_m₋₂(ζ^e) =0

…

Theorem

If max_iπ_i=O(logq), the algorithm runs in time O(d˜ log³q).

12/21

(53)

× Z_m={ζ⁰}

×

{ζ

(q−1)i

πm :0≤i< π_m} g_m₋₁(ζ^e) =0

× ×

×

{ζ

e+(q−1)i

πm−1 :0≤i< πm−1} g_m₋₂(ζ^e) =0

…

Theorem

(54)

× Z_m={ζ⁰}

×

{ζ

(q−1)i

πm :0≤i< π_m} g_m₋₁(ζ^e) =0

× ×

×

{ζ

e+(q−1)i

πm−1 :0≤i< πm−1} g_m₋₂(ζ^e) =0

…

Theorem

12/21

Root finding over finite fields using Graeffe transforms