A polynomial $f$ over a finite ring $R$ is called a
\textit{permutation polynomial}  if the mapping $R\rightarrow R$
defined by $f$ is one-to-one. In this paper we consider the
problem of characterizing permutation polynomials; that is, we
seek conditions on the coefficients of a polynomial which are
necessary and sufficient for it to represent a permutation. We
also present a new class of permutation binomials over finite
field of prime order

Rajesh P Singh

Soumen Maity

Cryptology ePrint Archive

Permutation Polynomials modulo pnRajesh P Singh ∗ Soumen Maity †AbstractA polynomial f over a finite ring R is called a permutation polynomial if the mappingR → R defined by f is one-to-one. In this paper we consider the problem of characterizingpermutation polynomials; that is, we seek conditions on the coefficients of a polynomialwhich are necessary and sufficient for it to represent a permutation. We also present a newclass of permutation binomials over finite field of prime order.Keywords: Permutation polynomials, Finite rings, Combinatorial problem, Cryptography1 IntroductionA polynomial f(x) = a0 + a1x + a2x2 + · · · + adxd with integral coefficients is said to be apermutation polynomial over a finite ring R if f permutes the elements of R. That is, f isa one-to-one map of R onto itself. A natural question to ask is: given a polynomial f(x) =a0 + a1x + a2x2 + · · · + adxd, what are necessary and sufficient conditions on the coefficientsa0, a1, . . . , ad for f to be permutation? Permutation polynomials have been extensively studied;see Lidl and Niederreiter [7] Chapter 7 for a survey. Permutation polynomials have been usedin Cryptography and Coding [4, 8, 10]. Most studies have assumed that R is a finite field.See, for example, the survey of Lidl and Mullen [5, 6]. It is well-known that many problems onpermutation polynomials over finite fields are still open [5, 6]. Similarly there are a few workon permutation polynomials modulo integers [2]. Rivest [11] considered the case where R isthe ring (Zm,+, ·) where m is a power of 2: m = 2n. Such permutation polynomials have alsobeen used in Cryptography recently, such as in RC6 block cipher [13], a simple permutationpolynomials f(x) = 2x2 +x modulo 2d is used, where d is the word size of the machine. In thispaper, we consider the case that R is the ring (Zm,+, .) where m is a prime power: m = pn andgive an exact characterization of permutation polynomials modulo pn, for p = 2, 3, 5, in termsof their coefficients. Although permutation polynomials over finite fields have been a subjectof study for over 140 years, only a handful of specific families of permutation polynomials offinite fields are known so far. The construction of special types of permutation polynomialsbecomes interesting research problem. Here we present a new class of permutation binomialsover finite field of prime order.∗Department of Mathematics, Indian Institute of Technology Guwahati, Guwahati 781 039, Assam, INDIA.Email addresses: r.pratap@iitg.ernet.in†Department of Mathematics Indian Institute of Technology Kharagpur, Kharagpur, West Bengal, INDIA.Email addresses: sm@maths.iitkgp.ernet.in12 Congruences to a prime-power modulusIn this section we recall some results from [2] that we need to formally present our results.Consider the congruencesf(x) ≡ 0 mod pa (1)andf(x) ≡ 0 mod pa−1 (2)where f(x) is any integral polynomial, p is prime and a > 1. Then Theorem 123 of [2] statesthatTheorem 2.1 (Hardy & Wright [2]) The number of solutions of (1) corresponding to a solu-tion ξ of (2) is(a) none, if f ′(ξ) ≡ 0 mod p and ξ is not a solution of (1);(b) one, if f ′(ξ) 6≡ 0 mod p;(c) p, if f ′(ξ) ≡ 0 mod p and ξ is a solution of (1).The solutions of (1) corresponding to ξ may be derived from ξ, in case (b) by the solution of alinear congruence, in case (c) by adding any multiple of pa−1 to ξ.As a consequence of this theorem we obtain the following result. If p is a prime, then Zpdenotes the finite field with p elements.Corollary 2.1 Let p be a prime. Then f(x) permutes the elements of Zpn, n > 1, if and onlyif it permutes the elements of Zp and f ′(a) 6≡ 0 mod p for every integer a ∈ Zp.Proof: Suppose f(x) permutes the elements of Zpn , n > 1. That is f(x) is a one-to-one mapof Zpn onto itself. Thus the congruencef(x) ≡ 0 mod pn (3)has exactly one root, say x. Then x satisfiesf(x) ≡ 0 mod p (4)and is of the form ξ + sp, (0 ≤ s < pn−1), where ξ is the root of (4) for which 0 ≤ ξ < p.Next, suppose that ξ is the root of (4) satisfying 0 ≤ ξ < p and f ′(ξ) 6≡ 0 mod p. Then,according to Theorem 3.1, f(x) ≡ 0 mod p2 has exactly one root corresponding to the solution ξof (4). Repeating the argument we obtain f(x) ≡ 0 mod pn has exactly one root correspondingto the solution ξ of (4) for every n > 1.23 Permutation polynomials modulo a prime-powerIn this section we give necessary and sufficient conditions on the coefficients a0, a1, . . . , ad forf(x) = a0 +a1x+a2x2 + · · ·+adxd to be permutation polynomial modulo pn, for p = 2, 3, 5. Acharacterization of permutation polynomials modulo 2n was given in [11]. Rivest [11] provedthat f(x) is a permutation polynomial if and only if a1 is odd, (a2 + a4 + a6 + . . .) is even,and (a3 + a5 + a7 + . . .) is even. We first give a very short and simple proof of the abovecharacterization. We also give new characterization of permutation polynomials modulo pn forp = 3, 5, and n > 1.3.1 Characterizing permutation polynomials modulo 2nA simple characterization of permutation polynomial modulo 2n, n > 1, is presented in thissection. We need the following lemma in the proof of Theorem 3.1Lemma 3.1 A polynomial f(x) = a0 + a1x + a2x2 + · · ·+ adxd with integral coefficients is apermutation polynomial modulo 2 if and only if (a1 + a2 + . . . + ad) is odd.Proof: Since 0i = 0 and 1i = 1 modulo 2 for i ≥ 1, we can write f(x) = a0 + (a1 +a2 + · · · + ad)x mod 2. Clearly f(x) is a permutation polynomial modulo 2 if and only if(a1 + a2 + · · ·+ ad) 6≡ 0 mod 2, that is, (a1 + a2 + · · ·+ ad) is odd.Theorem 3.1 (Rivest [11]) A polynomial f(x) = a0 + a1x + a2x2 + · · · + adxd with integralcoefficients is a permutation polynomial modulo 2n, n > 1, if and only if a1 is odd, (a2 + a4 +a6 + . . .) is even, and (a3 + a5 + a7 + . . .) is even.Proof: The proof given here is different from that of Rivest [11] and is relevant to the proof oftheorems to follow. The theorem is proved by making use of Corollary 2.1 and Lemma 3.1. ByCorollary 2.1, f(x) is a permutation polynomial modulo 2n if and only if it is a permutationpolynomial modulo 2 and f ′(x) 6≡ 0 mod 2 for every integer x ∈ Z2 . By Lemma 3.1, f(x) is apermutation polynomial modulo 2 if and only if (a1 + a2 + . . . + ad) is odd. It is easy to cheekthat f ′(x) = a1 + (a3 + a5 + . . .)x mod 2. The condition f ′(x) 6≡ 0 mod 2 with x = 0 gives a1is odd. The condition f ′(x) 6≡ 0 mod 2 with x = 1 gives (a1 + a3 + a5 + . . .) is odd. Hence thetheorem follows.Example 3.1 The following are all permutation polynomials modulo 22 of degree atmost 3and the coefficients are from Z4: x, 3x, x + 2x2, 3x + 2x2, x + x3, 3x + 2x3, x + 2x + 2x3 and3x + 2x2 + 2x3.3.2 Characterizing permutation polynomials modulo 3nThis section starts with a proposition regarding permutations of Zp that is needed later on.Proposition 3.1 [7] If d > 1 is a divisor of p−1, then there exists no permutation polynomialof Zp of degree d.The proof of Proposition 3.1 is given in [7]. As an easy consequence of this proposition we get,if p is an odd prime, no permutation over Zp can have degree p− 1.3Lemma 3.2 A polynomial f(x) = a0 + a1x + a2x2 + · · ·+ adxd with integral coefficients is apermutation polynomial modulo 3 if and only if (a1 +a3 + . . .) 6≡ 0 mod 3 and (a2 +a4 + . . .) ≡0 mod 3.Proof: Since x2k+1 = x mod 3 and x2k = x2 mod 3 for k ≥ 1, we can write f(x) = a0 +(a1 + a3 + . . .)x + (a2 + a4 + . . .)x2 mod 3. Letting A = (a1 + a3 + . . .) mod 3 and B =(a2 + a4 + . . .) mod 3, we can write f(x) more compactly as f(x) = a0 + Ax + Bx2. Since, forodd prime p, no permutation polynomial over Zp can have degree p−1, we have B ≡ 0 mod 3.Thus f(x) is a permutation polynomial modulo 3 if and only if (a1 + a3 + . . .) 6≡ 0 mod 3 and(a2 + a4 + . . .) ≡ 0 mod 3.Theorem 3.2 A polynomial f(x) = a0 + a1x + a2x2 + · · ·+ adxd with integral coefficients isa permutation polynomial modulo 3n, n > 1, if and only if(a) a1 6≡ 0 mod 3,(b) (a1 + a3 + . . .) 6≡ 0 mod 3,(c) (a2 + a4 + . . .) ≡ 0 mod 3,(d) (a1 + a4 + a7 + a10 + . . .) + 2(a2 + a5 + a8 + a11 + . . .) 6≡ 0 mod 3, and(e) (a1 + a2 + a7 + a8 + . . .) + 2(a4 + a5 + a10 + a11 + . . .) 6≡ 0 mod 3.Proof: By Corollary 2.1, f(x) is a permutation polynomial modulo 3n if and only if it is apermutation polynomial modulo 3 and f ′(x) 6≡ 0 mod 3 for every integer x ∈ Z3. It is easy toverify that f ′(x) = a1 + (2a2 + a4 + 2a8 + a10 + 2a14 + a16 + . . .)x + (2a5 + a7 + 2a11 + a13 +2a17 +a19 + . . .)x2 mod 3. The condition f ′(x) 6≡ 0 mod 3 with x = 0 gives a1 6≡ 0 mod 3. Thecondition f ′(x) 6≡ 0 mod 3 with x = 1 gives a1+(2a2+a4+2a8+a10+2a14+a16+ . . .)+(2a5+a7 +2a11 + a13 +2a17 + a19 + . . .) 6≡ 0 mod 3. The condition f ′(x) 6≡ 0 mod 3 with x = 2 givesa1+(a2+2a4+a8+2a10+a14+2a16+ . . .)+(2a5+a7+2a11+a13+2a17+a19+ . . .) 6≡ 0 mod 3.Now the theorem directly follows by combining above conditions and Lemma 3.2.Example 3.2 The following are some permutation polynomials modulo 9 of degree 5 and thecoefficients are from Z9: 7x + x3 + 8x5, x + x2 + 8x3 + 8x4 + 7x5, 7x + 6x2 + 8x3 + 8x5 andx + 7x2 + 8x3 + 8x4 + 7x5. There are total 3888 permutation polynomials modulo 9 of degreeatmost 5 and the coefficients are from Z9.3.3 Characterizing permutation polynomials modulo 5nLet p be a prime and Fp = GF (p) be the Galois field of p elements. The following result isfrom [9].4Theorem 3.3 (Mollin & Small [9]) Let GF (p) have characteristic different from 3. Thenf(x) = ax3 + bx2 + cx + d (a 6= 0) permutes GF (p) if and only if b2 = 3ac and p ≡ 2 mod 3.We need the following lemma in the proof of Theorem 3.4.Lemma 3.3 A polynomial f(x) = a0 + a1x + a2x2 + · · ·+ adxd with integral coefficients is apermutation polynomial modulo 5 if and only if (a4 + a8 + a12 . . .) ≡ 0 mod 5 and (a2 + a6 +a10 + . . .)2 ≡ 3(a1 + a5 + a9 + . . .)(a3 + a7 + a11 + . . .) mod 5.Proof: Since x4k+1 = x mod 5, x4k+2 = x2 mod 5, x4k+3 = x3 mod 5, and x4k = x4 mod 5for k ≥ 1, we can write f(x) = a0 + (a1 + a5 + . . .)x + (a2 + a6 + . . .)x2 + (a3 + a7 + . . .)x3 +(a4 + a8 + . . .)x4 mod 5. Letting A = (a1 + a5 + . . .), B = (a2 + a6 + . . .), C = (a3 + a7 + . . .)and D = (a4 + a8 + . . .) we can write f(x) = a0 + Ax + Bx2 + Cx3 + Dx4 mod 5. Since nopolynomial of degree 4 can be a permutation polynomial modulo 5, we have D ≡ 0 mod 5.Now f(x) = a0 + Ax + Bx2 + Cx3 mod 5 and we are in the situation of Theorem 3.3. Hence,f is a permutation if and only if B2 = 3AC.Example 3.3 The permutation binomials modulo 5 of degree atmost 3 are: x, x3, 2x+x2+x3,3x + 2x2 + x3, 3x + 3x2 + x3, and 2x + 4x2 + x3.Theorem 3.4 A polynomial f(x) = a0 + a1x + a2x2 + · · ·+ adxd with integral coefficients isa permutation polynomial modulo 5n if and only if(a) a1 6≡ 0 mod 5,(b) (a4 + a8 + a12 . . .) ≡ 0 mod 5,(c) (a2 + a6 + a10 + . . .)2 ≡ 3(a1 + a5 + a9 + . . .)(a3 + a7 + a11 + . . .) mod 5,(d) (a1 +a6 +a11 + . . .)+2(a2 +a7 +a12 + . . .)+3(a3 +a8 +a13 + . . .)+4(a4 +a9 +a14 + . . .) 6≡0 mod 5,(e) (a1 + 2a6 + 4a11 + 3a16 + a21 + . . .) + 2(2a2 + 4a7 + 3a12 + a17 + 2a22 + . . .) +3(4a3 +3a8 + a13 + 2a18 + 4a23 + . . .) + 4(3a4 + a9 + 2a14 + 4a19 + 3a24 + . . .) 6≡ 0 mod 5,(f) (a1 + 3a6 + 4a11 + 2a16 + a21 + . . .) + 2(3a2 + 4a7 + 2a12 + a17 + 3a22 + . . .) +3(4a3 +2a8 + a13 + 3a18 + 4a23 + . . .) + 4(2a4 + a9 + 3a14 + 4a19 + 2a24 + . . .) 6≡ 0 mod 5, and(g) (a1 + 4a6 + a11 + 4a16 + a21 + . . .) + 2(4a2 + a7 + 4a12 + a17 + 4a22 + . . .) +3(a3 + 4a8 +a13 + 4a18 + a23 + . . .) + 4(4a4 + a9 + 4a14 + a19 + 4a24 + . . .) 6≡ 0 mod 5.5Proof: By Corollary 2.1, f(x) is a permutation polynomial modulo 5n if and only if it is apermutation polynomial modulo 5 and f ′(x) 6≡ 0 mod 5 for every integer x ∈ Z5. We obtainf ′(x) = a1 +∑k(4k + 2)a4k+2x +∑k(4k + 3)a4k+3x2 +∑k(4k)a4kx3+∑k(4k + 1)a4k+1x4≡ a1 + (2a2 + a6 + 4a14 + 3a18 + 2a22 + . . .)x+(3a3 + 2a7 + a11 + 4a19 + 3a23 + . . .)x2+(4a4 + 3a8 + 2a12 + a16 + 4a24 + . . .)x3+(4a9 + 3a13 + 2a17 + a21 + 4a29 + . . .)x4 mod 5Observe that f ′(0) 6≡ 0 mod 5 means a1 6≡ 0 mod 5;f ′(1) 6≡ 0 mod 5 means (a1 + a6 + a11 + . . .) + 2(a2 + a7 + a12 + . . .) + 3(a3 + a8 + a13 + . . .) +4(a4 + a9 + a14 + . . .) 6≡ 0 mod 5;f ′(2) 6≡ 0 mod 5 means (a1+2a6+4a11+3a16+a21+ . . .)+2(2a2+4a7+3a12+a17+2a22+ . . .)+3(4a3 + 3a8 + a13 + 2a18 + 4a23 + . . .) + 4(3a4 + a9 + 2a14 + 4a19 + 3a24 + . . .) 6≡ 0 mod 5;f ′(3) 6≡ 0 mod 5 means (a1+3a6+4a11+2a16+a21+ . . .)+2(3a2+4a7+2a12+a17+3a22+ . . .)+3(4a3 +2a8 + a13 +3a18 +4a23 + . . .)+ 4(2a4 + a9 +3a14 +4a19 +2a24 + . . .) 6≡ 0 mod 5; andf ′(4) 6≡ 0 mod 5 means (a1 +4a6 +a11 +4a16 +a21 + . . .)+2(4a2 +a7 +4a12 +a17 +4a22 + . . .)+3(a3 + 4a8 + a13 + 4a18 + a23 + . . .) + 4(4a4 + a9 + 4a14 + a19 + 4a24 + . . .) 6≡ 0 mod 5. Nowthe theorem directly follows by combining above conditions and Lemma 3.3. However thesituation becomes complicated for p = 7, 11, 13, . . . Thus, in the following section we considerthe problem of characterizing only permutation binomials modulo prime p.4 A new class of permutation binomials over finite field FpLet p be a prime and Fp = GF (p) be the Galois field of p elements. In [5], the open problemP2 states: Find new classes of permutation polynomials of Fq, q = pn, n is a positive integer.Recently some classes of permutation binomials are presented in [1, 3]. Here we present a newclass of permutation binomials of Fp. We now recall the definition and some properties ofquadratic residue.Definition 4.1 Suppose p is an odd prime and a is an integer. a is defined to be a quadraticresidue modulo p if a 6≡ 0 (mod p) and the congruence y2 ≡ a (mod p) has a solution y ∈ Fp.a is defined to be a quadratic non-residue modulo p if a 6≡ 0 (mod p) and a is not a quadraticresidue modulo p.Euler’s Criteria states that a is a quadratic residue modulo p if and only if ap−12 ≡ 1 mod pand a is a quadratic non-residue modulo p if and only if ap−12 ≡ −1 mod p.Theorem 4.1 Let p be a prime and f(x) = xu(xp−12 + a) where u is an integer such that(u, p − 1) = 1 and a is a non-zero element in Fp. Then f(x) is a permutation binomial overFp if and only if (a2 − 1)p−12 = 1 mod p.6Proof: It is known that the monomial xu is a permutation polynomial of Fp if and only ifgcd(u, p− 1) = 1. Using Euler’s criteria we can rewritef(x) =0, if x = 0;xu(a + 1), if x is quadratic residue;xu(a− 1), if x is quadratic non-residue.There are 12(p − 1) residues and12(p − 1) non-residues of an odd prime p. The product oftwo residues, or of two non-residues, is a residue, while the product of a residue and a non-residue is a non-residue. Since u is odd, xu is residue (resp. non-residue) if x is residue (resp.non-residue). If both a + 1 and a − 1 are residues, then f(x) maps residues to residues andnon-residues to non-residues and if both a + 1 and a − 1 are non-residues, then f(x) mapsresidues to non-residues and non-residues to residues. On the other hand, if a + 1 is residueand a − 1 is non-residue then f(x) maps all the non-zero elements to residues and if a + 1is non-residue and a − 1 is residue then f(x) maps all the non-zero elements to non-residues.Since xu is a permutation polynomial, therefore f(x) is a permutation polynomial if and onlyif both a+1 and a− 1 are either quadratic residues or quadratic non residues. In other words,f(x) is a permutation polynomial over Fp if and only if (a2 − 1)p−12 = 1 mod p. In Theorem4.1, if the degree u + p−12 of binomial f(x) is greater than p− 1 for some values of u then thepolynomial is reduced modulo xp − x. In the following, as an application of Theorem 4.1, wegive some examples of permutation binomials of Fp.Example 4.1 Let p = 7. Then u = 1, 5. Thus x(x3 + a) and x5(x3 + a) mod x7 − x arepermutation binomials over F7 if and only if (a2 − 1)3 ≡ 1 mod 7. That is, x(x3 + a) andx5(x3 + a) are permutation binomials over F7 for a = 3, 4. We can write x5(x3 + a) ≡x2 +ax5 ≡ ax2(x3 +a−1) mod x7−x . Hence the permutation binomials over F7 are x(x3 +3),x(x3 + 4), x2(x3 + 2), and x2(x3 + 5).Example 4.2 Let p = 11. Then xu(x5 + a) is a permutation binomial of F11 for u = 1, 3, 7, 9and a = 2, 4, 7, 9. Therefore x(x5 + 2), x(x5 + 4), x(x5 + 7), x(x5 + 9), x3(x5 + 2), x3(x5 + 4),x3(x5 + 7), x3(x5 + 9), x2(x5 + 3), x2(x5 + 5), x2(x5 + 6), x2(x5 + 8), x4(x5 + 3), x4(x5 + 5),x4(x5 + 6), x4(x5 + 8) are permutation binomials of F11.References[1] A. Akbary and Q. Wang. A generalized Lucas sequence and permutation binomials.Proceeding of the American Mathematical Socity, 134(1), 15-22, 2005.[2] G. H. Hardy and E. M. Wright. An Introduction to the Theory of Numbers, Oxford SciencePublications, 5th ed., 1979.[3] L. Wang. On permutation polynomials. Finite Fields and Their Applications, 8, 311-322,2002.[4] R. Lidl, On cryptosystems based on permutation polynomials and finite fields, In Advancein Cryptology-EuroCrypt 1984, Lecture Notes in Computer Science, Vol. 209, 10-15, 1985.7[5] R. Lidl and G. L. Mullen. When does a polynomial over a finite field permute the elementsof the field? The American Math. Monthly, 95(3), 243-246, 1988.[6] R. Lidl and G. L. Mullen. When does a polynomial over a finite field permute the elementsof the field? II The American Math. Monthly, 100(1), 71-74, 1993.[7] R. Lidl and H. Niederreiter. Finite Fields. Addision-Wesley, 1983.[8] R. Lidl and W. B. Muller. Permutation polynomials in RSA-ctyptosystems. In Proc.CRYPTO 83, 293-301, 1948, New York, Plenum Press.[9] R. A. Mollin and C. Small. On permutation polynomials over finite fields. Internat. J.Math. & Math. Sci., 10 (3), 1987, 535-544.[10] Gary L. Mullen, Permutation polynomials and nonsingular feedback shift registers overfinite fields. IEEE Trans. Information Theory, 35 (4), 1989, 900-902.[11] R. L. Rivest, Permutation polynomials modulo 2w. Finite Fields and Their Applications,7, 287-292, 2001.[12] R. L. Rivest, Adi Shamir, and L. M. Adleman. A method for obtaining digital signaturesand public-key cryptosystems. Communications of the ACM, 21(2), 120-126, 1978.[13] R. L. Rivest, M. J. B. Robshaw, R. Sidney, and Y.L. Yin, The RC6 block cipher. Seehttp://theory.lcs.mit.edu/ rivest/rc6.pdf or http://csrc.nist.gov/encryption/aes/.8

Permutation Polynomials modulo $p^n$ }

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive

Permutation Polynomials modulo pnp^npn}

Abstract

Similar works

Full text

Available Versions

Cryptology ePrint Archive

Permutation Polynomials modulo $p^n$ }