We obtain a new bound of certain double multiplicative character sums. We use
this bound together with some other previously obtained results to obtain new
algorithms for finding roots of polynomials modulo a prime $p$

E. Shparlinski

Igor

Jean Bourgain

Sergei V. Konyagin

Mathematics of Computation

English

arXiv

Bourgain, J.

Konyagin, S.

Shparlinski, I.

MPG.PuRe

arXiv:1308.4803v2  [math.NT]  10 Mar 2014CHARACTER SUMS AND DETERMINISTICPOLYNOMIAL ROOT FINDING IN FINITE FIELDSJEAN BOURGAIN, SERGEI V. KONYAGIN, AND IGOR E. SHPARLINSKIAbstract. We obtain a new bound of certain double multiplica-tive character sums. We use this bound together with some otherpreviously obtained results to obtain new algorithms for findingroots of polynomials modulo a prime p.1. IntroductionLet Fq be a finite field of q elements of characteristic p. The classicalalgorithm of Berlekamp [1] reduces the problem of factoring polynomi-als of degree n over Fq to the problem of factoring squarefree polyno-mials of degree n over Fp that fully split in Fp, see also [8, Chapter 14].Shoup [15, Theorem 3.1] has given a deterministic algorithm that fullyfactors any polynomial of degree n over Fp in O(n2+o(1)p1/2(log p)2)arithmetic operations over Fp; in particular it runs in time n2p1/2+o(1).Furthermore, Shoup [15, Remark 3.5] has also announced an algorithmof complexity O(n3/2+o(1)p1/2(log p)2) for factoring arbitrary univariatepolynomials of degree n over Fp.We remark, that although the efficiency of deterministic polynomialfactorisation algorithms falls far behind the fastest probabilistic algo-rithms, see, for example, [9, 11, 12], the question is of great theoreticinterest.Here we address a special case of the polynomial factorisation prob-lem when the polynomial f fully splits over Fp (as we have noticedthere is a polynomial time reduction between factoring general polyno-mials and polynomials that split over Fp). That is, here we deal withthe root finding problem. We also note that in order to find a root(or all roots) of a polynomial f ∈ Fp[X ], it is enough to do the samefor the polynomial gcd (f(X), Xp−1 − 1) which is squarefree fully splitsover Fp.We consider two variants of the root finding problem:2010 Mathematics Subject Classification. 11L40, 11T06, 11Y16, 68Q25.Key words and phrases. finite field, root finding, character sums, multiplicativeenergy.12 JEAN BOURGAIN, SERGEI V. KONYAGIN, AND IGOR E. SHPARLINSKI• Given a polynomial f ∈ Fp[X ], find all roots of f in Fp.• Given a polynomial f ∈ Fp[X ], find at least one root of f in Fp.For the case of finding all roots we show that essentially the initialapproach of Shoup [15] together with the fast factor refinement proce-dure of Bernstein [2] lead to an algorithm of complexity np1/2+o(1). Infact this result is already implicit in [15] but here we record it againwith a very short proof. We use this as a benchmark for our algorithmfor the second problem.We remark that a natural example of the situation when one hasto find a root of a polynomial of large degree arises in the problemof constructing elliptic curves over Fp with prescribed number of Fp-rational points. In this case one has to find a root of the Hilbert classpolynomial , we refer to [17, 18] for more detail on this and underlyingproblems.In the case of finding just one root, we obtain a faster algorithm,which is based on bounds of double multiplicative character sumsTχ(I,S) =∑u∈I∣∣∣∣∣∑s∈Sχ(u+ s)∣∣∣∣∣2,where I = {1, . . . , h} is an interval of h consecutive integers, S ⊆ Fpis an arbitrary set and χ is a multiplicative character of F∗p. Moreprecisely, here we use a new bound on Tχ(I,S) to improve the boundnp1/2+o(1) in the case when n is large enough, namely if it grows as apower of p. We believe that our new bound of the sums Tχ(I,S) aswell as several auxiliary results (based on some methods from additivecombinatorics) are of independent interest as well.Throughout the paper, any implied constants in symbols O and ≪may depend on two real positive parameters ε and δ and are absoluteotherwise. We recall that the notations U = O(V ) and U ≪ V are allequivalent to the statement that |U | ≤ cV holds with some constantc > 0. We also use U ≍ V to denote that U ≪ V ≪ U .2. Bounds on The Number Solutions to Some Equationsand Character Sums2.1. Uniform distribution and exponential sums. The followingresult is well-known and can be found, for example, in [13, Chapter 1,Theorem 1] (which is a more precise form of the celebrated Erdo˝s–Tura´n inequality).Lemma 1. Let ξ1, . . . , ξM be a sequence of M points of the unit interval[0, 1]. Then for any integer K ≥ 1, and an interval [0, ρ] ⊆ [0, 1], weCHARACTER SUMS AND ROOT FINDING 3have#{m = 1, . . . ,M : ξm ∈ [0, ρ]} − ρM≪MK+K∑k=1(1K+min{ρ, 1/k}) ∣∣∣∣∣M∑m=1exp(2πikξm)∣∣∣∣∣ .2.2. Preliminary bounds. Throughout this section we fix some setS ⊆ Fp of and interval I = {1, . . . , h} of h ≤ p1/2 consecutive integers.We say that a set D ⊆ Fp is ∆-spaced if no elements d1, d2 ∈ D andpositive integer k ≤ ∆ satisfy the equality d1 + k = d2.Here we always assume that the set S is h-spaced.Finally, we also fix some L and denote by L the set of primes of theinterval [L, 2L].We denoteW ={(u1, u2, ℓ1, ℓ2, s1, s2) ∈ I2 × L2 × S2 :u1 + s1ℓ1≡u2 + s2ℓ2(mod p)}.The following result is based on some ideas of Shao [14].Lemma 2. If L < h and 2hL < p then#W ≪ (#ShL)2p−1 +#ShLpo(1).Proof. Clearly(1) #W = #W∗ +O(#ShL),whereW∗ = {(u1, u2, ℓ1, ℓ2, s1, s2) ∈ W : ℓ1 6= ℓ2}.DenoteS = S + I = {u+ s : (u, v) ∈ I × S}, I = {−h, . . . , h}.ClearlyW∗ ≪ h−2{(u1, u2, ℓ1, ℓ2, s1, s2) ∈ I2× L2 × S2: ℓ1 6= ℓ2,u1 + s1ℓ1≡u2 + s2ℓ2(mod p)}.Note that for fixed ℓ1, ℓ2 ∈ L, ℓ1 6= ℓ2 and integer x, |x| ≤ 2hL thecongruenceu1ℓ2 − u2ℓ1 ≡ x (mod p)is equivalent to the equation u1ℓ2− u1ℓ2 = x (since 2hL < p) and thushas O (h/L) solutions. We rewriteu1 + s1ℓ1≡u2 + s2ℓ2(mod p)4 JEAN BOURGAIN, SERGEI V. KONYAGIN, AND IGOR E. SHPARLINSKIass1ℓ2 − s2ℓ1 ≡ x ≡ u1ℓ2 − u2ℓ1 (mod p).One can consider that x ≥ 0. We now bound the cardinality ofU ={(x, ℓ1, ℓ2, s1, s2) ∈ [0, 2hL]× L2 × S2:s1ℓ2 − s2ℓ1 ≡ x (mod p)}.The above argument shows thatW∗ ≤ h−2(h/L)#U = h−1L−1#U .(2)We now apply Lemma 1 to the sequence of fractional parts{s1ℓ2 − s2ℓ1p}, (ℓ1, ℓ2, s1, s2) ∈ L2 × S2,with M = (#L)2(#S)2, ρ = 2hLp−1 and K = ⌈ρ−1⌉. This yields thebound#U ≪ (#L)2(#S)2ρ+ ρK∑k=1∣∣∣∣∣∣∑(ℓ1,ℓ2,s1,s2)∈L2×S2exp (2πik (s1ℓ2 − s2ℓ1) /p)∣∣∣∣∣∣= (#L)2(#S)2ρ+ ρK∑k=1∣∣∣∣∣∣∑(ℓ,s)∈L×Sexp (2πiksℓ/p)∣∣∣∣∣∣2.Using the Cauchy inequality, denoting r = kℓ and then using the clas-sical bound on the divisor function, we derive#U ≪ (#L)2(#S)2ρ+ ρ#LK∑k=1∑ℓ∈L∣∣∣∣∣∣∑s∈Sexp (2πiksℓ/p)∣∣∣∣∣∣2≪ (#L)2(#S)2ρ+ po(1)ρ#Lp−1∑r=0∣∣∣∣∣∣∑s∈Sexp (2πirs/p)∣∣∣∣∣∣2,since r ∈ [1, 2KL] ⊆ [0, p−1] provided that p is sufficiently large. Thus,using the Parseval inequality and recalling the values of our parameters,we obtain#U ≪ hL3(#S)2p−1 + hL2#Spo(1).Using the trivial bound #S ≪ #Sh, we obtain#U ≪ h3L3(#S)2p−1 + h2L2#Spo(1).Thus, recalling (1) and (2) we conclude the proof. ⊓⊔CHARACTER SUMS AND ROOT FINDING 5DenoteW (x, y)= #{(u, ℓ, s, t) ∈ I × L × S2 :u+ sℓ= x,u+ tℓ= y}.(3)Lemma 3. We have∑x,y∈FpW (x, y)2 ≪ (#S)3(hL)2p−1 + (#S)2hLpo(1).Proof. Clearly∑x,y∈FpW (x, y)2= #{(u1, u2, ℓ1, ℓ2, s1, t1, s2, t2) ∈ I2 ×L2 × S4 :u1 + s1ℓ1=u2 + s2ℓ2,u1 + t1ℓ1=u2 + t2ℓ2}.For each (u1, u2, ℓ1, ℓ2, s1, s2) ∈ W and t1 ∈ S there is only one possiblevalues for t2. The result now follows from Lemma 2. ⊓⊔2.3. Character sum estimates. First we recall the following specialcase of the Weil bound of character sums (see [10, Theorem 11.23]).Lemma 4. For any polynomial F (X) ∈ Fp[X ] with N distinct zeros inthe algebraic closure of Fp and which is not a perfect dth power in thering of polynomials over Fp, and a nonprincipal multiplicative characterχ of F∗p of order d, we have∣∣∣∣∣∣∑x∈Fpχ (F (x))∣∣∣∣∣∣ ≤ Np1/2.The following estimate improves and generalises [4, Lemma 14] andalso [7, Theorem 8]. It proof is based on the classical “amplification”argument of Burgess [5, 6].Lemma 5. For any positive δ > 0 there is some η > 0 such that foran interval I = {1, . . . , h} of h ≤ p1/2 consecutive integers and anyh-spaced set S ⊆ Fp with#Sh > p1/2+δ,for any nontrivial multiplicative character χ of F∗p we haveTχ(I,S)≪ (#S)2hp−η.6 JEAN BOURGAIN, SERGEI V. KONYAGIN, AND IGOR E. SHPARLINSKIProof. We choose a sufficiently small ε and defineL =⌊hp−2ε⌋and T = ⌊pε⌋ .As in Section 2.2, we denote by L the set of primes of the interval[L, 2L]. Note that(#S)2 TL≪ (#S)2hp−ε.ThenTχ(I,S) =1(T + 1)#Lσ +O((#S)2 TL)=1(T + 1)#Lσ +O((#S)2hp−ε),(4)whereσ=∑ℓ∈LT∑t=0∑u∈I˜∑s1,s2∈Sχ(u+ s1 + tℓ)χ(u+ s2 + tℓ)=∑u∈I˜∑ℓ∈L∑s1,s2∈ST∑t=0χ(u+ s1ℓ+ t)χ(u+ s2ℓ+ t).Furthermore,σ =∑x,y∈FpW (x, y)T∑t=0χ (x+ t)χ (y + t) ,where W (x, y) is defined by (3).Therefore, for any integer ν ≥ 1 by the Ho¨lder inequality, we haveσ2ν ≤∑x,y∈FpW (x, y)2 ∑x,y∈FpW (x, y)2ν−2∑x,y∈Fp∣∣∣∣∣T∑t=0χ (x+ t)χ (y + t)∣∣∣∣∣2ν.(5)Clearly(6)∑x,y∈FpW (x, y)≪ #I#L (#S)2 ≪ (#S)2hL.CHARACTER SUMS AND ROOT FINDING 7We also have∑x,y∈Fp∣∣∣∣∣T∑t=0χ (x+ t)χ (y + t)∣∣∣∣∣2ν=T∑t1,...,t2ν=0∣∣∣∣∣∣∑x∈Fpν∏i=1χ (x+ ti)2ν∏i=ν+1χ (x+ ti)∣∣∣∣∣∣2.Using the Weil bound in the form of Lemma 4 if (t1, . . . , tν) is nota permutation of (tν+1, . . . , t2ν), and the trivial bound otherwise, wederive∑x,y∈Fp∣∣∣∣∣T∑t=0χ (x+ t)χ (y + t)∣∣∣∣∣2ν≪ T 2νp+ T νp2(see also [10, Lemma 12.8] that underlies the Burgess method). Takingν to be large enough so that T 2νp > T νp2 we obtain(7)∑x,y∈Fp∣∣∣∣∣T∑t=0χ (x+ t)χ (y + t)∣∣∣∣∣2ν≪ T 2νp.Substituting (6) and (7) in (5) we obtainσ2ν ≪ T 2νp((#S)2hL)2ν−2 ∑x,y∈FpW (x, y)2.We now apply Lemma 3 to deriveσ2ν ≪ T 2νp((#S)2hL)2ν−2 ((#S)3(hL)2p−1 + (#S)2hLpo(1))≪ T 2νp1+o(1)((#S)2hL)2ν ((#S)−1p−1 + (#S)−2h−1L−1).(8)Taking a sufficiently small ε > 0, we obtain(#S)2hL > p1+δwhich together with (4) concludes the proof. ⊓⊔3. Root Finding Algorithms3.1. Finding all roots. Here we address the question of finding allroots of a polynomial f ∈ Fp[X ].We refer to [8] for description of efficient (in particular, polynomialtime) algorithms of polynomial arithmetic over finite fields such asmultiplication, division with remainder and computing the greatestcommon divisor.8 JEAN BOURGAIN, SERGEI V. KONYAGIN, AND IGOR E. SHPARLINSKITheorem 6. There is a deterministic algorithm that, given a squarefreepolynomial f ∈ Fp[X ] of degree n that fully splits over Fp, finds all rootsof f in time np1/2+o(1).Proof. We seth =⌊p1/2(log p)2⌋.We now compute the polynomials(9) gu(X) = gcd(f(X), (X + u)(p−1)/2 − 1), u = 0, . . . , h.We remark that to compute the greatest common divisor in (9) we firstuse repeated squaring to compute the residueHu(X) ≡ (X + u)(p−1)/2 (mod f(X)), degHu < nand then computegu(X) = gcd (f(X), Hu(X)) .If a ∈ Fp is a root of f then (X − a) | gu(X) if and only if a+ u 6= 0and a + u is a quadratic residue in Fp.We now note that the Weil bound on incomplete character sumsimplies that for any two roots a, b ∈ Fp of f there is u ∈ [0, h] suchthat(10) (X − a) | gu(X) and (X − b) ∤ gu(X).Note that the argument of [16, Theorem 1.1] shows that one can takeh =⌊Cp1/2⌋for some absolute constant C > 0 just getting some minorspeed up of this and the original algorithm of Shoup [15].We now recall the factor refinement algorithm of Bernstein [2], that,in particular, for any set of N polynomial G1, . . . , GN ∈ Fp[X ] of degreen over Fp in time O(nNpo(1)) finds a set of relatively prime polynomialsH1, . . . , HM ∈ Fp[X ] such that any polynomial Gi, i = 1, . . . , N , is aproduct of powers of the polynomials H1, . . . , HM . Applying this algo-rithm to the family of polynomials gu, u = 0, . . . , h, and recalling (10),we see that it outputs the set of polynomials with{H1, . . . , HM} = {X − a : f(a) = 0},which concludes the proof. ⊓⊔3.2. Finding one root. Here we give an algorithm that finds one rootof a polynomial over Fp. It is easy to see that up to a logarithmic factorthis problem is equivalent to a problem of finding any nontrivial factorof a polynomial.CHARACTER SUMS AND ROOT FINDING 9Lemma 7. There is a deterministic algorithm that, given a squarefreepolynomial f ∈ Fp[X ] of degree n > 1 that fully splits over Fp, finds intime (n + p1/2)po(1) a factor g | f of degree 1 ≤ deg g < n.Proof. It suffices to prove that for any δ > 0 there is a desirable algo-rithm with running time at most (n + p1/2)pδ+o(1). If n ≤ pδ then theresult follows from Theorem 6. Now assume that δ is small and n > pδ.Leth =⌊(1 + n−1p1/2)pδ/2⌋.We start with computing the polynomials(11) gcd (f(X), f(X + u)) , u = 1, . . . , h,see [8] for fast greatest common divisor algorithms. Clearly, if f has twodistinct roots a and b with |a− b| ≤ h then one of the polynomials (11)gives a nontrivial factor of f . It is also easy to see that the complexityof this step is at most nhpo(1).If this step does not produce any nontrivial factor of f then we notethat the set S of the roots of f is h-spaced. We now again computethe polynomials gu(X), given by (9), for every u ∈ I.So, we see that for the above choice of h the condition of Lemma 5holds and implies that there is u ∈ I with∣∣∣∣∣∑s∈S(s+ up)∣∣∣∣∣≪ #Sp−η = np−η.for some η > 0 that depends only on δ, and thus the sequence ofLegendre symbols ((s + u)/p), s ∈ S, cannot be constant.Therefore, at least one of the polynomials (9) gives a nontrivial factorof f . As in [15], we see that the complexity of this algorithm is againO(nh(log p)O(1)). Since δ > 0 is an arbitrary, we obtain the desiredresult. ⊓⊔Theorem 8. There is a deterministic algorithm that, given a squarefreepolynomial f ∈ Fp[X ] of degree n that fully splits over Fp, finds in time(n+ p1/2)po(1) a root of f .Proof. We use Lemma 7 to find a polynomial factor g1 of f with 1 ≤deg g ≤ 0.5 deg f . Next, we find a polynimial factor g2 of g1 with 1 ≤deg g2 ≤ 0.5 deg g1, and so on. The number of iterations is O(logn),and the complexity of each iteration, by Lemma 7, does not exceed(n+ p1/2)po(1). This completes the proof. ⊓⊔10 JEAN BOURGAIN, SERGEI V. KONYAGIN, AND IGOR E. SHPARLINSKI4. CommentsIt is certainly natural to expect that the condition of Lemma 5 canbe relaxed, however proving such a result seems to be presently outof reach (even under the standard number theoretic conjectures). Fur-thermore, such an improvement does not immediately propagate intoimprovements of Theorems 6 and 8. It seems that within the methodof Shoup [15] the only plausible way to reduce the complexity belowp1/2 is to obtain nontrivial bounds of single sums of Legendre sympbols∣∣∣∣∣H∑x=1((x+ s1)(x+ s2)p)∣∣∣∣∣ ≤ Hp−ηfor intervals of length H ≥ pα with some fixed α < 1/2, uniformlyover s1, s2 ∈ Fp, s1 6= s2. It seems that even the Generalised RiemannHypothesis (GRH) does not immediately imply such a statement. Infact, even in the case of linear polynomials, it is not known how touse the GRH to get an improvement of the Burgess bound [5, 6] (forintervals away from the origin).AcknowledgementThe authors are grateful to Andrew Sutherland for patient explana-tions of several issues related to Hilbert class polynomials.The research of J. B. was partially supported by National ScienceFoundation, Grant DMS-0808042, that of S. V. K. by Russian Fundfor Basic Research Grant N. 14-01-00332, and Program SupportingLeading Scientific Schools, Grant Nsh-3082.2014.1, and that of I. E. S.by Australian Research Council, Grant DP130100237.References[1] E. R. Berlekamp, ‘Factoring polynomials over large finite fields’, Math. Comp.,24 (1970), 713–735.[2] D. J. Bernstein, ‘Factoring into coprimes in essentially linear time’, J. Algo-rithms , 54 (2005), 1–30.[3] J. Bourgain, ‘Sum-product theorems and applications’, Additive Number The-ory, Springer-Verlag, Berlin, 2010, 9–38.[4] J. Bourgain, M. Z. Garaev, S. V. Konyagin and I. E. Shparlinski, ‘On thehidden shifted power problem’, SIAM J. Comp., 41 (2012), 1524–1557.[5] D. A. Burgess, ‘The distribution of quadratic residues and non-residues’,Math-ematika, 4 (1957), 106–112.[6] D. A. Burgess, ‘On character sums and primitive roots’, Proc. Lond. Math.Soc., 12 (1962), 179–192.[7] M.-C. Chang, ‘On a question of Davenport and Lewis and new character sumbounds in finite fields’, Duke Math. J., 145 (2008), 409–442.CHARACTER SUMS AND ROOT FINDING 11[8] J. von zur Gathen and J. Gerhard, Modern computer algebra, Cambridge Uni-versity Press, Cambridge, 2013.[9] J. von zur Gathen and V. Shoup, ‘Computing Frobenius maps and factoringpolynomials’, Comput. Complexity, 2 (1992), 187–224.[10] H. Iwaniec and E. Kowalski, Analytic number theory, Amer. Math. Soc., Prov-idence, RI, 2004.[11] E. Kaltofen and V. Shoup, ‘Subquadratic-time factoring of polynomials overfinite fields’, Math. Comp., 67 (1998), 1179–1197.[12] K. S. Kedlaya and C. Umans, ‘Fast polynomial factorization and modularcomposition’, SIAM J. Comp., 40 (2011), 1767–1802.[13] H. L. Montgomery, Ten lectures on the interface between analytic number the-ory and harmonic analysis, Amer. Math. Soc., Providence, RI, 1994.[14] X. Shao, ‘Character sums over unions of intervals’, Preprint , 2013 (availablefrom http://arxiv.org/abs/1302.0348).[15] V. Shoup, ‘On the determenistic complexity of factoring polynomials over finitefields’, Inform. Proc. Letters , 33 (1990), 261–267.[16] I. E. Shparlinski, Finite fields: Theory and computation, Kluwer Acad. Publ.,Dordrecht, 1999.[17] A. V. Sutherland, ‘Computing Hilbert class polynomials with the Chinese Re-mainder Theorem’, Math. Comp., 80 (2011), 501-538.[18] A. V. Sutherland, ‘Accelerating the CM method’, LMS J. Comp. Math., 15(2012), 172–204.Institute for Advanced Study, Princeton, NJ 08540, USAE-mail address : bourgain@ias.eduSteklov Mathematical Institute, 8, Gubkin Street, Moscow, 119991,RussiaE-mail address : konyagin@mi.ras.ruDepartment of Pure Mathematics, University of New South Wales,Sydney, NSW 2052, AustraliaE-mail address : igor.shparlinski@unsw.edu.au

Character sums and deterministic polynomial root finding in finite fields

Igor E. Shparlinski

CiteSeerX

We obtain a new bound of certain double multiplicative character sums. We use this bound together with some other previously obtained results to obtain new algorithms for finding roots of polynomials modulo a prime p.9 page(s

Character Sums and Deterministic Polynomial Root Finding in Finite Fields

Abstract

Similar works

Full text

Available Versions

MPG.PuRe

CiteSeerX

Macquarie University ResearchOnline