NOTICE: this is the author's version of a work that was accepted for publication in Indagationes Mathematicae. Changes resulting from the publishing process, such as peer review, editing, corrections, structural formatting, and other quality control mechanisms may not be reflected in this document. Changes may have been made to this work since it was submitted for publication. A definitive version was subsequently published in Indagationes Mathematicae, Volume 12, Issue 3, (2001), Pages 303-315. doi:10.1016/S0019-3577(01)80012-4. http://www.elsevier.com/locate/indagLet IFp be the finite field with p elements, and let F(X) ∈ IFp[X] be a square-free polynomial. We show that in the ring R = IFp[X]/F(X), the inverses of polynomials of small height are uniformly distributed.
We also show that for any set L ⊂ R of very small cardinality, for almost all G ∈ R the set of inverses {(G+f)−1 | f ∈ L} are uniformly
distributed. These questions are motivated by applications to the NTRU cryptosystem

Banks, William David, 1964-

Shparlinski, Igor E.

University of Missouri: MOspace

Distribution of Inverses in Polynomial RingsWilliam D. BanksDepartment of Mathematics, University of MissouriColumbia, MO 65211, USAbbanks@math.missouri.eduandIgor E. Shparlinski∗Department of Computing, Macquarie UniversitySydney, NSW 2109, Australiaigor@ics.mq.edu.auAbstractLet IFp be the finite field with p elements, and let F (X) ∈ IFp[X] bea square-free polynomial. We show that in the ringR = IFp[X]/F (X),the inverses of polynomials of small height are uniformly distributed.We also show that for any set L ⊂ R of very small cardinality, foralmost all G ∈ R the set of inverses {(G+ f)−1 | f ∈ L} are uniformlydistributed. These questions are motivated by applications to theNTRU cryptosystem.∗Corresponding author11 IntroductionLet p ≥ 3 be a prime number, and let IFp be the finite field with p elements,which we represent by the set {0,±1, . . . ,±(p− 1)/2}.Let F (X) ∈ IFp[X] be a fixed square-free polynomial of degree n.Denote byR the polynomial ring IFp[X]/F (X). For any integer h in the range0 ≤ h ≤ (p− 1)/2, let R(h) be the subset of R consisting of polynomials ofthe formf(X) = f0 + f1X + . . .+ fn−1Xn−1, |fν | ≤ h, ν = 0, . . . , n− 1.For a given set L ⊆ R and a polynomial G ∈ R, we denote by LG the set of“shifted” polynomials {G+ f | f ∈ L}.For an arbitrary set S ⊂ R, we denote by S∗ the subset of invertible poly-nomials in S. In particular, R∗, R(h)∗ and L∗G denotes the set of invertiblepolynomials in R, R(h) and LG, respectively.For a polynomial f ∈ R∗, we denote by f ∗ its inverse in the ring R, that is,f ∗ is the unique polynomial of degree at most n−1 such that f(X)f ∗(X) ≡ 1(mod F (X)).Recall that the cardinality ofR∗ is given by an analogue of the Euler function|R∗| = pnr∏j=1(1− p−nj), (1)where n1, . . . , nr are the degrees of the r ≥ 1 irreducible divisors of F (X). Inthe special case F (X) = Xn−1, more explicit expressions for nj , j = 1, . . . , r(hence also for |R∗|) are given in [6]; see also Section 6.5 of [1] and Section 7.5of [5].In this paper, we show that the inverses of polynomials in R(h)∗ are uni-formly distributed provided that h ≥ p1/2+ε. We also show that for almostall G ∈ R, the inverses of polynomials in L∗G are uniformly distributed, evenfor sets L of very small cardinality. These questions are motivated by ap-plications to the recently discovered NTRU cryptosystem [2], whose publickeys are related to inverses of polynomials from certain very special sets.In particular, it is important to show that these inverses look and behavelike “random” polynomials from R, since the message concealing propertiesof NTRU rely on this assumption. Unfortunately, the sets of polynomials2involved in NTRU seem to be too “thin” to be covered by the techniquespresented here. Nevertheless, we hope that our results may give some insightinto this problem. Moreover, the original scheme of NTRU can easily bemodified to work with sets of polynomials for which our results do apply in adirect way. We remark that the aforementioned property of NTRU polyno-mials has never been doubted in practice, but obtaining rigorous theoreticalresults remains a very challenging problem.Our main tools are bounds of character sums in the ring R. We reduce theproblem of estimating these sums to bounds for Kloosterman sums [3] andfor more general sums with rational functions over finite fields [4].Acknowledgement. We thank Jeff Hoffstein, Dan Lieman and Joe Sil-verman for attracting our interest in this problem and for many fruitfuldiscussions.Work supported in part, for W. B. by NSF grant DMS-0070628 and for I. S.by ARC grant A69700294.2 Character SumsLet F (X) = F1(X) . . . Fr(X) be the complete factorization of F (X) intoirreducible factors. Since F (X) is square-free, all of these factors are pairwisedistinct.Recall that IFp[X]/G(X) ∼= IFpm for any irreducible polynomial G(X) ∈IFp[X] of degree degG = m. For each j = 1, . . . , r, we fix a root αj of Fj(X),and denoteIKj = IFpnj = IFp(αj) ∼= IFp[X]/Fj(X), (2)where nj = degFj . For each j, letTrj(z) =nj−1∑k=0zpkbe the trace of z ∈ IKj to IFp.For each Fj , there are at most (2h + 1)n−1 polynomials f ∈ R which aredivisible by Fj (indeed, given the n−1 highest coefficients of f , the constantterm is uniquely determined since Fj |f). Consequently, we obtain that(2h+ 1)n − n(2h+ 1)n−1 ≤ |R(h)∗| ≤ (2h+ 1)n. (3)3We also denote by A the direct product of fieldsA = IK1 × . . .× IKr.Then we have natural isomorphismsR ∼= IK1 × . . .× IKr = A, R∗ ∼= IK∗1 × . . .× IK∗r = A∗, (4)given by the map that sends f ∈ R to af = (f(α1), . . . , f(αr)) ∈ A. Inparticular, the relation (1) follows immediately from (4).Given a vector a = (a1, . . . , ar) ∈ A, we define the character χa of R byχa(f) =r∏j=1e (Trj (ajf (αj))) , f ∈ R,wheree(z) = exp(2piiz/p).It is easy to see that {χa | a ∈ A} is the complete group of additive charactersof R. In particular, for any polynomial f ∈ R, we have∑a∈Aχa(f) ={0 if f 6= 0,pn if f = 0.(5)Our main results rely on upper bounds for the character sumsSa(h) =∑f∈R(h)∗χa(f∗) and Wa(L) =∑G∈R∣∣∣∣∣∣∑f∈L∗Gχa(f∗)∣∣∣∣∣∣ .To estimate these sums we need the identity (see Exercise 11.a in Chapter 3of [7])p−1∑c=0e(cu) ={0 if u 6≡ 0 (mod p),p if u ≡ 0 (mod p),(6)which holds for any integer u, and the inequality (see Exercise 11.b in Chap-ter 3 of [7])p−1∑c=0∣∣∣∣∣∣h∑u=−he (cu)∣∣∣∣∣∣ ≤ p(1 + ln p), (7)which holds for any integer h in the range 0 ≤ h ≤ (p− 1)/2.We also need the following simple statement.4Lemma 1 For any vector (c0, . . . , cn−1) ∈ IFnp , there exists a unique vectorb = (b1, . . . , br) ∈ A such thatn−1∑ν=0cνfν =r∑j=1Trj (bjf (αj))for all polynomialsf(X) = f0 + f1X + . . .+ fn−1Xn−1 ∈ R.Proof. Because the trace is a linear mapping, the identity of the theorem isequivalent to the system of equationsr∑j=1Trj(bjανj)= cν , ν = 0, . . . , n− 1.Thus for every vector b = (b1, . . . , br) ∈ A, there exists a unique vector(c0, . . . , cn−1) ∈ IFnp . Because F (X) is square-free the elementsαpkj , k = 0, . . . , nj − 1, j = 1, . . . , r,are pairwise distinct. From the property of the Vandermonde matrix wesee that for every (c0, . . . , cn−1) ∈ IFnp , there is at most one vector b =(b1, . . . , br) ∈ A. Taking into account the fact that |A| = pn = |IFnp |, weobtain the desired statement. uunionsqNow we are prepared to bound the sums Sa(h) and Wa(L).Lemma 2 Let a = (a1, . . . , ar) ∈ A and let J ⊆ {1, . . . , r} be the set of jwith aj 6= 0. Then for any integer h, 0 ≤ h ≤ (p− 1)/2 the bound|Sa(h)| ≤ 2|J |pn/2(1 + ln p)n∏j 6∈Jpnj/2holds.Proof. From the identity (6) we deriveSa(h) =1pn∑f∈R∗χa(f∗)∑c0,...,cn−1∈IFph∑u0,...,un−1=−he(n−1∑ν=0cν (fν − uν))=1pn∑c0,...,cn−1∈IFph∑u0,...,un−1=−he(−n−1∑ν=0cνuν)×∑f∈R∗χa(f∗)e(n−1∑ν=0cνfν)5where f(X) = f0 + f1X + . . . + fn−1Xn−1. From Lemma 1 we see that forany vector (c0, . . . , cn−1) ∈ IFnp there exist a vector b = (b1, . . . , br) ∈ A suchthat∑f∈R∗χa(f∗)e(n−1∑ν=0cνfν)=∑f∈R∗χa(f∗)χb(f)=∑f∈R∗r∏j=1e (Trj (ajf∗ (αj) + bjf (αj))) .From the isomorphism (4) it follows that as f runs over the set R∗, the vector(f (α1) , . . . , f (αr)) runs over IK∗1 × . . . × IK∗r . Since f∗ (αj) = (f (αj))−1,j = 1, . . . , r, we have∑f∈R∗χa(f∗)e(n−1∑ν=0cνfν)=∑x1∈IK∗1. . .∑xr∈IK∗rr∏j=1e(Trj(ajx−1j + bjxj))=r∏j=1∑xj∈IK∗je(Trj(ajx−1j + bjxj)).Sums with j 6∈ J we estimate trivially as pnj , and for sums with j ∈ J weuse the Kloosterman bound (see Theorem 5.45 of [3])∣∣∣∣∣∣∣∑xj∈IK∗je(Trj(ajx−1j + bjxj))∣∣∣∣∣∣∣ ≤ 2pnj/2.Thus∣∣∣∣∣∣∑f∈R∗χa(f∗)e(n−1∑ν=0cνfν)∣∣∣∣∣∣ ≤ 2|J |∏j 6∈Jpnj∏j∈Jpnj/2 = 2|J |pn/2∏j 6∈Jpnj/2.Applying the inequality (7), we obtain the desired result. uunionsqLemma 3 Let a = (a1, . . . , ar) ∈ A and let J ⊆ {1, . . . , r} be the set of jwith aj 6= 0. Then the boundWa(L) ≤ 2n1/23|J |/2pn|L|3/4∏j 6∈Jpnj/4holds.6Proof. From the Cauchy inequality we deriveWa(L)2 ≤ pn∑G∈R∣∣∣∣∣∣∑f∈L∗Gχa(f∗)∣∣∣∣∣∣2= pn∑G∈R∑f1,f2∈L∗Gχa(f∗1 − f∗2 )≤ pnpn|L|+ ∑G∈R∑f1,f2∈L∗Gf1 6=f2χa(f∗1 − f∗2 )= pnpn|L|+ ∑f1,f2∈Lf1 6=f2∑G∈R∗ χa((G+ f1)∗ − (G+ f2)∗) ,where Σ∗ means that the sum is taken over all polynomials G ∈ R for whichboth G + f1 and G + f2 are invertible. From the isomorphism (4) it followsthat as G runs over this set, the vector (G (α1) , . . . , G (αr)) runs over theset Af1,f2 of elements (x1, . . . , xr) in IK1 × . . .× IKr such that xj 6= −f1(αj)and xj 6= −f2(αj), j = 1, . . . , r. Again, we remark that f∗ (αj) = (f (αj))−1,j = 1, . . . , r, for any f ∈ R∗. Thus we obtain∑G∈R∗ χa((G+ f1)∗ − (G+ f2)∗))=∑G∈R∗r∏j=1e(Trj(aj (G(αj) + f1(αj))−1 − aj (G(αj) + f2(αj))−1))=∑(x1,...,xr)∈Af1,f2r∏j=1e(Trj(ajf2(αj)− f1(αj)(xj + f1(αj))(xj + f2(αj))))=r∏j=1∑xj∈IKj\{−f1(αj ),−f2(αj)}e(Trj(ajf2(αj)− f1(αj)(xj + f1(αj))(xj + f2(αj)))).For j 6∈ J , we bound the inner sum trivially by pnj . Let Jf1,f2 ⊆ J be theset of j ∈ J for which f1(αj) 6= f2(αj). For j ∈ J \Jf1,f2, we can againbound the inner sum by pnj . Thus we have the estimate∣∣∣∣∣∑G∈R∗ χa((G+ f1)∗ − (G+ f2)∗)∣∣∣∣∣7≤∏j∈Jf1,f2∣∣∣∣∣∣∑xj∈IKj\{−f1(αj),−f2(αj)}e(Trj(ajf2(αj)− f1(αj)(xj + f1(αj))(xj + f2(αj))))∣∣∣∣∣∣×∏j 6∈Jf1,f2pnj .For sums with j ∈ Jf1,f2 we use the Weil bound (in the form given in [4])which yields∣∣∣∣∣∣∑xj∈IKj\{−f1(αj),−f2(αj)}e(Trj(ajf2(αj)− f1(αj)(xj + f1(αj))(xj + f2(αj))))∣∣∣∣∣∣ ≤ 3pnj/2,thus∣∣∣∣∣∑G∈R∗ χa ((G+ f1)∗ − (G+ f2)∗)∣∣∣∣∣ ≤ 3|Jf1,f2 |∏j∈Jf1,f2pnj/2∏j 6∈Jf1,f2pnj≤ 3|J |pn/2∏j 6∈Jf1,f2pnj/2= 3|J |pn/2∏j 6∈Jpnj/2∏j∈J\Jf1,f2pnj/2.Now let T (m) be the number of pairs (f1, f2) ∈ L2, f1 6= f2, such that∑j∈J\Jf1,f2nj = m. (8)Collecting together the previous estimates, we obtainWa(L)2 ≤ pnpn|L|+ 3|J |pn/2 ∏j 6∈Jpnj/2n∑m=0T (m)pm/2 .It is obvious that for any pair (f1, f2) ∈ L2, f1 6= f2, we have∏j∈J\Jf1,f2Fj∣∣∣∣ f1 − f2.Thus for each f1 ∈ L there are at most pn−m polynomials f2 ∈ L satisfy-ing (8). Hence T (m) ≤ pn−m|L|. Using this inequality for pm ≥ pn|L|−1 andthe trivial estimate T (m) ≤ |L|2 otherwise, we see thatT (m)pm/2 ≤ pn/2|L|3/2, m = 0, . . . , n.8HenceWa(L)2 ≤ pnpn|L|+ (n+ 1)3|J |pn|L|3/2 ∏j 6∈Jpnj/2 .Taking into account that the first term never dominates, we obtain the desiredresult. uunionsqClearly, for special sets L that admit stronger bounds for T (m), one can ob-tain better results. For example, let us denote byRk the set of pk polynomialsf ∈ R of degree deg f < k.Lemma 4 Let a = (a1, . . . , ar) ∈ A and let J ⊆ {1, . . . , r} be the set of jwith aj 6= 0. Then the boundWa(Rk) ≤ pk+np−k + 3|J |+1p−n/2 ∏j 6∈Jpnj/21/2holds.Proof. It is obvious that if m < k then for each f1 ∈ Rk there are at mostpk−m polynomials f2 ∈ Rk, f1 6= f2, that satisfy (8). Hence T (m) ≤ p2k−m,and as in the proof of Lemma 3, we deriveWa(Rk)2 ≤ pnpk+n + 3|J |p2k+n/2 ∏j 6∈Jpnj/2k−1∑m=0p−m/2≤ pnpk+n + 11− p−1/23|J |p2k+n/2∏j 6∈Jpnj/2≤ pnpk+n + 11− 3−1/23|J |p2k+n/2∏j 6∈Jpnj/2≤ pnpk+n + 3|J |+1p2k+n/2 ∏j 6∈Jpnj/2 .The result follows. uunionsq93 Distribution of InversesGiven a polynomial g ∈ R and an integer d, we denote by N(g, d, h) thenumber of polynomials f ∈ R(h)∗ such that deg(g − f ∗) < d.Theorem 5 The bound∣∣∣∣∣N(g, d, h)− |R(h)∗|pn−d∣∣∣∣∣ ≤ 5npn/2(ln p)nholds.Proof. Obviously, N(g, d, h) = p−dT (g, d, h), where T (g, d, h) is number ofrepresentations f ∗ = g+ψ−ϕ with f ∈ R(h)∗ and polynomials ϕ, ψ ∈ R ofdegree at most d− 1. From the identity (5) we deriveT (g, d, h) =1pn∑f∈R(h)∗∑ϕ,ψ∈Rdegϕ,degψ≤d−1∑a∈Aχa(f∗ − g + ϕ− ψ)=1pn∑a∈Aχa(−g)∑f∈R(h)∗χa(f∗)∑ϕ,ψ∈Rdegϕ,degψ≤d−1χa(ϕ− ψ)=1pn∑a∈Aχa(−g)∑f∈R(h)∗χa(f∗)∣∣∣∣∣∣∣∑ϕ∈Rdegϕ≤d−1χa(ϕ)∣∣∣∣∣∣∣2.The term corresponding to a = 0 is equal to p2d−n|R(h)∗|. For any nonemptyset J ⊆ {1, . . . , r}, let AJ be the subset of A consisting of all a = (a1, . . . , ar)with aj = 0 for all j 6∈ J . From Lemma 2 it follows that∣∣∣∣∣T (g, d, h)− |R(h)∗|pn−2d∣∣∣∣∣≤1pn∑J⊆{1,...,r}J 6=∅∑a∈AJa 6=0∣∣∣∣∣∣∑f∈R(h)∗χa(f∗)∣∣∣∣∣∣∣∣∣∣∣∣∣∑ϕ∈Rdegϕ≤d−1χa(ϕ)∣∣∣∣∣∣∣2≤(1 + ln p)npn/2∑J⊆{1,...,r}J 6=∅2|J |∏j 6∈Jpnj/2∑a∈AJa 6=0∣∣∣∣∣∣∣∑ϕ∈Rdegϕ≤d−1χa(ϕ)∣∣∣∣∣∣∣2.10It is easy to see that∑a∈AJa 6=0∣∣∣∣∣∣∣∑ϕ∈Rdegϕ≤d−1χa(ϕ)∣∣∣∣∣∣∣2= −p2d +∑a∈AJ∣∣∣∣∣∣∣∑ϕ∈Rdegϕ≤d−1χa(ϕ)∣∣∣∣∣∣∣2= −p2d +∑ϕ,ψ∈Rdegϕ,degψ≤d−1∑a∈AJχa(ϕ− ψ)= −p2d +∑ϕ,ψ∈Rdegϕ,degψ≤d−1∑a∈AJ∏j∈Je (Trj (aj (ϕ (αj)− ψ (αj))))= −p2d + U∏j∈Jpnj ,where U is the number of pairs ϕ, ψ ∈ R with degϕ, degψ ≤ d − 1 (that is,ϕ, ψ ∈ Rd) and such that ϕ (αj) = ψ (αj) for all j ∈ J . Since this conditionis equivalent to the polynomial congruenceϕ(X) ≡ ψ(X) (mod∏j∈JFj(X)),we derive thatU =p2d∏j∈Jp−nj , if d ≥∑j∈Jnj ,pd, otherwise.Hence, in either case0 ≤ −p2d + U∏j∈Jpnj ≤ pd∏j∈Jpnj ,and we derive the inequality∑a∈AJa 6=0∣∣∣∣∣∣∣∑ϕ∈Rdegϕ≤d−1χa(ϕ)∣∣∣∣∣∣∣2≤ pd∏j∈Jpnj . (9)11Thus∣∣∣∣∣T (g, d, h)− |R(h)∗|pn−2d∣∣∣∣∣ ≤ (1 + ln p)npdpn/2∑J⊆{1,...,r}J 6=∅2|J |∏j 6∈Jpnj/2∏j∈Jpnj= (1 + ln p)npd∑J⊆{1,...,r}J 6=∅2|J |∏j∈Jpnj/2= (1 + ln p)npd r∏j=1(1 + 2pnj/2)− 1≤ 2n(1 + ln p)npd+n/2r∏j=1(1 +12pnj/2)≤ 2n(1 + ln p)npd+n/2(1 +12p1/2)n.Therefore∣∣∣∣∣N(g, d, h)− |R(h)∗|pn−d∣∣∣∣∣ = 1pd∣∣∣∣∣T (g, d, h)− |R(h)∗|pn−2d∣∣∣∣∣≤ 2n(1 + ln p)n(1 +12p1/2)npn/2.One easily verifies that2(1 + ln p)(1 +12p1/2)< 5 ln pfor p ≥ 3 and the theorem follows (if p ≥ 5, we can replace 5 by 4 in thepreceding inequality). uunionsqIn particular, we see from (3) and Theorem 5 that for any ε > 0, there existsa constant p0(ε) such that for p ≥ p0(ε) and h ≥ max{n1+ε , p1/2+ε}, theasymptotic formula N(g, d, h) ∼ (2h+1)n/pn−d holds for any d ≤ (1−3ε)n/2.Given polynomials g,G ∈ R, a set L ⊆ R and an integer d we denote byN(g, d, G,L) the number of polynomials f ∈ L∗G such that deg(g − f∗) < d.Theorem 6 The bound1pn∑G∈R∣∣∣∣∣N(g, d, G,L)− |L∗G|pn−d∣∣∣∣∣ ≤ 2n1/23n|L|3/4holds.12Proof. As in the proof of Theorem 5, N(g, d, G,L) = p−dT (g, d, G,L), whereT (g, d, G,L) is number of representations f ∗ = g + ψ − ϕ with f ∈ L∗G andpolynomials ϕ, ψ ∈ R of degree at most d− 1. Again we have∣∣∣∣∣T (g, d, G,L)− |L∗G|pn−2d∣∣∣∣∣≤1pn∑J⊆{1,...,r}J 6=∅∑a∈AJa 6=0∣∣∣∣∣∣∑f∈L∗Gχa(f∗)∣∣∣∣∣∣∣∣∣∣∣∣∣∑ϕ∈Rdegϕ≤d−1χa(ϕ)∣∣∣∣∣∣∣2.Thus, from Lemma 3 and the inequality (9), we derive∑G∈R∣∣∣∣∣T (g, d, G,L)− |L∗G|pn−2d∣∣∣∣∣≤ 2n1/2|L|3/4∑J⊆{1,...,r}J 6=∅3|J |/2∏j 6∈Jpnj/4∑a∈AJa 6=0∣∣∣∣∣∣∣∑ϕ∈Rdegϕ≤d−1χa(ϕ)∣∣∣∣∣∣∣2≤ 2n1/2|L|3/4pd+n/4∑J⊆{1,...,r}J 6=∅3|J |/2∏j∈Jp3nj/4= 2n1/2|L|3/4pd+n/4 r∏j=1(1 + 31/2p3nj/4)− 1≤ 2n1/23n/2|L|3/4pd+nr∏j=1(1 + 3−1/2p−3nj/4)≤ 2n1/23n/2|L|3/4pd+n(1 + 3−1/2p−3/4)n.From the inequality31/2(1 + 3−5/4)< 3 (10)the theorem follows. uunionsqFinally, we use Lemma 4 to obtain a similar statement for sets Rk.Theorem 7 The bound1pn∑G∈R∣∣∣∣∣N(g, d, G,Rk)− |R∗k,G|pn−d∣∣∣∣∣ ≤(43)npk/2 + 31/23npk−n/4holds.13Proof. Using the inequality (x+ y)1/2 ≤ x1/2 + y1/2 and applying Lemma 4,we derive as in the proofs of Theorems 5 and 61pn∑G∈R∣∣∣∣∣N(g, d, G,Rk)− |R∗k,G|pn−d∣∣∣∣∣≤ pk−np−k/2 ∑J⊆{1,...,r}J 6=∅∏j∈Jpnj + 31/2∑J⊆{1,...,r}J 6=∅3|J |/2∏j∈Jp3nj/4≤ pk−np−k/2 r∏j=1(1 + pnj ) + 31/2r∏j=1(1 + 31/2p3nj/4)≤ pk−npn−k/2 r∏j=1(1 + p−nj)+ 3(n+1)/2p3n/4r∏j=1(1 + 3−1/2p−3nj/4)≤ pk−n((1 + p−1)npn−k/2 + 3(n+1)/2(1 + 3−1/2p−3/4)np3n/4)≤(1 + p−1)npk/2 + 3(n+1)/2(1 + 3−1/2p−3/4)npk−n/4.From the inequality (10) the theorem follows. uunionsq4 RemarksIt is easy to see that for larger values of p the constants in the above estimatescan be slightly improved. For example, if p ≥ 5 the bound of Theorem 5holds with 5n replaced by 4n. If p ≥ 7, the bounds of Theorems 6 and 7 holdwith 3n replaced by 2n and with (4/3)n replaced by (8/7)n (in Theorem 7).Moreover for any ε > 0 there exists p0(ε) such that for p > p0(ε) one can take(2 + ε)n instead of 5n in Theorem 5, (31/2 + ε)n instead of 3n in Theorems 6and 7, and (1 + ε)n instead of (4/3)n in Theorem 7.As we have mentioned, it would be very important to obtain results aboutthe distribution of inverses f ∗, f ∈ R(h)∗, for smaller values of h. The caseF (X) = Xn − 1 is of primary interest.It would also be interesting to estimate the number of f ∈ R(h)∗ such thatf ∗ ∈ R(H) for the smallest possible values of h and H . The techniques ofthe present paper can be used to derive such results in the case where F (X)is an irreducible polynomial (and h·H ≥ p3/2+ε), but it is not clear how14to approach a more general class of polynomials, including the polynomialF (X) = Xn − 1.Finally, it would be of interest to study residue rings modulo arbitrary poly-nomials F (X) that are not necessarily square-free.References[1] E. R. Berlekamp, Algebraic coding theory , McGraw-Hill, New York,1968.[2] J. Hoffstein, J. Pipher and J. H. Silverman, ‘NTRU: A ring basedpublic key cryptosystem’, Lect. Notes in Comp. Sci., Springer-Verlag,Berlin, 1433 (1998), 267–288.[3] R. Lidl and H. Niederreiter, Finite fields , Cambridge University Press,Cambridge, 1997.[4] C. J. Moreno and O. Moreno, ‘Exponential sums and Goppa codes,1’, Proc. Amer. Math. Soc., 111 (1991), 523–531.[5] F. J. MacWilliams and N. J. A. Sloane, The theory of error-correctingcodes , North-Holland, Amsterdam, 1977.[6] J. H. Silverman, ‘Invertibility in truncated polynomial rings’, NTRUCryptosystem Tech. Report 9 , 1998, 1–8.[7] I. M. Vinogradov, Elements of number theory , Dover Publ., New York,1954.15

Distribution of Inverses in Polynomial Rings

Abstract

Similar works

Full text

Available Versions

University of Missouri: MOspace