Modern communication engineerings, such as elliptic curve cryptographies, often requires algebra on finite extension field defined by modulus arithmetic with an irreducible polynomial. This paper provides a new method to detemine the minimal (irreducible) polynomial of a given proper element in finite extension field. In the conventional determination method, as we have to solve the simultaneous equations, the computation is very involved. In this paper, the well known "trace" is extended to higher degree traces. Using the new traces, we yield the coefficient formula of the desired minimal polynomial. The new method becomes very simple without solving the simultaneous equations, and about twice faster than the conventional method in computation speed

Morikawa, Yoshitaka

Nogami, Yasuyuki

English

Okayama University Digital Information Repository

Determining Minimal Polynomial of Proper Element by Using Higher Degree Traces

Okayama University Scientific Achievement Repository

Memoirs of the Faculty of Engineering, Okayama University, Vol.35, Nos.1&2, pp.197-205, March 2001Determining Minimal Polynomial of ProperElement by Using Higher Degree TracesY.NOGAMI* and Y.MORIKAWA*(Received December 22, 2000)Abstract Modern communication engineerings, such as elliptic curvecryptographies, often requires algebra on finite extension field de-fined by modulus arithmetic with an irreducible polynomial. Thispaper provides a new method to detennine the minimal (irre-ducible) polynomial of a given proper element in finite extensionfield. In the conventional determination method, as we have tosolve the simultaneous equations, the computation is very involved.In this paper, the well known "trace" is extended to higher degreetraces. Using the new traces, we yield the coefficient formula of thedesired minimal polynomial. The new method becomes very sim-ple without solving the simultaneous equations, and about twicefa.'Ster than the conventional method in computation speed.Key words finite field, minimal polynomiaL irreducible polynomial,higher degree trace, trace, cryptography1 INTRODUCTIONFinite field theory has been successfully applied to modern communication engineeringssuch as error correcting codes[l], elliptic curve cryptographies[2] ,[3] or spread spectrumcommunications[4]. In the elliptic curve cryptsystem, for example, elliptic curves E : y'2 =f(x) are defined by using polynomial f(x) of degree 3 over GF(P), and f(x) is required tobe irreducible in order to make security[5]. However, even if f(x) is irreducible, a class ofcurves called anomalous is recently pointed out to be easily deciphered in polynomial time.Thus the test of whether the arbitrarily given curve is anomalous or not is important. Theauthors have previously proposed a method to test it by inspection of f (x )[5]; that is toexamine the constant term of the minimal polynomial of wP - w, where w is a zero of f(x)and P is characteristic. This paper deals with determination Inethod of 111iniil1al polynomial.To determine the minimal polynomial of (Y E GF(pm ) by conventional method[6], weat first compute polynomial basis representations of (Yi (0 :s: i :s: rn). Then we solve thesimultaneous equations in respect to the coefficients of the minimal polynomial. The formerand the latter approximately requires rn:3 and m.:3/3 modulo-P multiplications, respectively.Thus, for large m, the conventional method becomes time consuming computation steps.*Department of Communication Network Engineering197198 Y.NOGAMI and Y.MORIKAWAIn this paper, the well known "trace" is extended to higher degree traces. Using the newtraces, we yield the coefficient formula of the desired minimal polynomial. In our method,while the polynomial basis representaions of a i is also necessary likely as in the conventionalone, we need not to solve the simultaneous equations, but use the formula. Thus, our methodis twice faster than the conventional one in computation speed.In this paper, the terminology "a proper element a of GF(prn )" is used to imply thata belongs to GF(prn) but does not to GF(pn), where n I m and n #- m. Note also that allpolynomials are monic.2 PRELIMINARYIn this section, basic mathematics of polynomial algebra is reviewed, and the well known"trace" is extended to higher degree traces. Then we relate higher degree traces to coeffi-cients of irreducible polynomial, and express minimal polynomial by higher degree traces.2.1 Minimal polynomialsConstruction of extension field GF (prn ), which is also a vector space of dimension rn overGF(P), requires an irreducible polynomial f(x) of degree mover GF(P) as modulus, andf(x) is called "modulus polynomial of GF(prn)". Let W be a zero of f(x). Thenbecomes a basis of GF(prn), which is called "polynomial basis". Note that declarationof GF(pm) implies the existances of modulus polynomial as well as the polynomial basis.Throughout this manuscript, we exclusively use f(x) and w as the modulus polynomialand its zero for GF(prn), respectively. Using the polynomial basis, an arbitrary elementa E GF(prn) can be uniquely represented as_ 0 1. 2 rn-l GF(P) (. )a - al,OW + al,lw + al,2w + ... + al,m-1W al,i E J O::S; i ::s; rn - 1 , (1)which is called "polynomial basis representation of a". If a is a proper element of GF (prn),a P ' (0 ::s; i ::s; m - 1) are different from each other and called "conjugates of a with respectto GF(P)". The polynomial Ma(x) defined byP . p 2 . pm-l(x-a)(x-a )(x-a )···(x-a )rn + A m-l A 2 A 1 Ax m-1X + ... + 2X + lX + uA E GF(P) (O::S; i ::s; m - 1)(2)is called "minimal polynomial of a over GF(P)" or simply "minimal polynomial of a", and.l\1a(x) is irreducible over GF(P). Therefore, to determine the minimal polynomial Ma(x)is to obtain the coefficients A corresponding to a.To determine Ma(x) by conventional method[6] , we at first compute the polynomial basisrepresentations of a i (O::S; i::S; m) by using Eq.(l) and f(w) = o.Determining Minimal Polynomial of Proper Element by Using Higher Degree TracesaU,m-lal,m-l'(3)199Since a is a zero of Ma(x),am -1, U, am -1,1 ,arn ,u, arn ,1 ,arn-l,rn-larn,m.-iA +A l+A 2+ +A rn-l+ 11~a la 2 a ... m~la aaUa i= 0. (4)By substituting Eq.(3) for [aO,a l , .. . am-l,am]T in Eq.(4), the following relations are ob-tained.TAm - l1au,O, aO,l, aO,m-l w Ual,O, al,l, al,m-l w l=0 (5)am-l,O, am-l,1 , am-l,m-l wm-2am,o, am,i, am,m-i w m - lSince {wO, wi"", wm - 2 , w m - l } in Eq.(5) is a polynomial basis and linearly independent,TAu ao,o, aU,l, aU,m-iA l ai,O, al,l, al,m-l= [0,0"" ,0,0].A m - l am-l,O, am-l,i, am-l,m-l1 am,o, am,i, am ,111-1By solving the above relations as simultaneous equations m respect to the coefficientsAi (0 :S i :S m - 1), Ma(x) is determined. Thus in the conventional method, computingpolynomial basis representations requires m 2 (m ~ 1) modulo-P multiplications, and solvingthe simultaneous equations requires m(m - 1)(2m. - 1)/6 + (m + 1)(m - 1) - 1 modulo-P multiplications. And for large m, the conventional method becomes time consummgcomputation.2.2 Higher degree traces and minimal polynOlnialThe trace in finite field theory is defined as follows [6].Definition 1 Let f3 E GF(pm ). Then the trace of f3 with Tespect to GF(P), denotedTrpmIP(f3), is defined by200 Y.NOGAMI and Y.MORIKAWAIn other words, TrpmIP(,8) is the sum of conjugates of (3 with respect to GF(P). When(3 is a zero w of modulus polynomial f (x),where fm-1 is the coefficient of xm- 1 in f(x).Now, we present higher degree traces as an extension of the trace.Definition 2 Let us consider the following set ofm conjugates of (3 E GF(pm) with respectto GF(P);Then the higher degree traces of (3 are defined by(6)and the lowest degree trace Tt~L'P((3) by 1, where 0 :S n :S TTl.. We call Tr~L'IP((3) the nthtrace of(3.Tt~L,P(.) is abbreviated to Tt[n] (-) throughout this paper; From the relations betweenzeros and coeffisients of polynomial, higher degree traces of a zero w of modulus polynomialf(x) are given by(7)where fm-n is the coefficient of xm- n in f(x). Similarly, Ma(x) defined by Eq.(2) can berewritten with higher degree traces of 0: asmMa(x) = I)-I)i . Tr[i] (0:) . £n-i.i=ONote that the 1st trace is equal to the conventional one and is linear.(8)3 THE 1ST TRACE OF EACH ELEMENT OF A POLYNOMIAL BASISIn this section, for (3 E GF(pm), we formulate a relation between higher degree traces of (3and the 1st traces of (3i (0 :S i :S m). In derivation of the formula, the following notationsare used.Notations: In Eq.(6), Tt[n]((3) (1 :S n :S m) is defined as sum of men terms in the forml' (3PS1 (3PS2 (3ps n hO "d .o . . . , were :S Sl < S2 < ... < Sn :S m - 1. We IVI e the sum mtotwo sums; one consists of terms which includes f3PI as a factor and the other excludes(3pj, where 0 :S j :S m - 1. More specifically,o ~ t 1 < ... < tn_l s; m. - 1t; ,,::i (1:S':S n - 1),Determining Minimal Polynomial of Proper Element by Using Higher Degree Tracesand201o ::; t 1 <. . < in ::; m - 1ii ;to j (1::;'::; n)•Then, following properties are induced.Property 1 :(1 :s; n :s; Tn, O:S; j :s; m -1).•Property 2 :s;n1(f3) = (3pj . S;n-11* ((3)Note that we suppose S;ol* (,8) = 1.(1 :s; n :s; m, O:S; j:S; m - 1).•Using these properties, a relation between higher degree traces of (3 and 1st traces of(3i (O:S; i :s; m) can be formulated.Theorem 1 Let (3 be a proper element ofGF(pm). Then the 1st trace Tr[11((3S) for 0 :s;s :s; m can be expressed as follows.For s =0,For s = 1,For 2 :s; s :s; m,s-lTr[l l ((3S) =I)_1)i+1 . Tr[i1((3) . Tr[11((3s-i) - (-1)S . S • Tr[sl ((3). (10)i=lProof" In the cases of s = 0 and s = 1, it is obvious.Let us consider for 2 :s; s :s; m. The sum term of the right-hand side in Eq.(10) ismodified as follows by using Eq.(6), Property 1 and Property 2.s-lI)-1 )i+1 . Tr[i1 ((3) . TrUl ((3s-i)i=ls-l m-1L L(-1)i+1 . Tr[i1((3) . (3(s-i)PJi=l j=Os-l m-1L L (_1)i+1 . [SY1((3) + SY1*((3)]. (3(S-i)pji=l j=Os-l m-1L L (_1)i+1 . [(3pj SY-1l*((3) + SY1*((3)]. (3(S-i)pji=l j=Os-l m-1L L (_l)i+l . [(3(s-(i-1))pj SY-11*((3) + (3(s-i)pj SYJ*((3)].i=l j=O202 Y.NOGAMI and Y.MORIKAWAExchanging the order of Land L' and carrying out the summation L'i j im-l m-l=L f3 s.pj s)O]* (13) + (_l)S L f3Pi Sy-l]*(f3).j=O j=OFrom Property 2, the first sum in Eq.(11) becomesm-lL f3spj s)O]* (13) = Tr[l] (f3S),j=Oand the second sum becomesm-l m-l(-1)s L f3pj SY-l]*(f3) = (_l)S L SY](f3)·j=O j=O(11 )(12)L SY](f3) in Eq.(12) consists of combinatorial products in the form of f3 pt l f3 pt 2 ••• f3 pt s (0 ::St 1 < t 2 < ... < t s ::S m - 1). If we denote the number of f3ptl f3 pt 2 ••• f3 pt s 's for particular[ ] t' t' ,string {t 1 , t2l ... ,ts } in L S/ (13) be A, we see that the nUluber of j3P 1 j3P 2 ..• f3pl s 's foranother string {t~ 1 t~, ... ,t~} is also A. When m = 4 and 8 = 2, for an example, A = 2 3.0'3follows.3L S)2] (13)j=O+(f3p 2 f3p 3 + f3p 2 f3P O+ f3p 2 f3p l ) + (f3 P"lf3PO+ f3p 3 f3p l + f3p 3 f3p 2 )2f3POf3p l + 2f3p of3p 2 + 2f3PO f3p 3 + 2f3P l f3p 2 + 2f3p l f3p 3 + 2f3P 2 f3p 3 •Therefore, we can express L S)s] (13) asm-lL SY](f3)j=OATr[s] (13) .Since the number of combinatorial products in S)s] (13) is m-l Cs - 1 , that in L sy] (13) ISm ·m-1Cs-l and that in Tr[s] (13) is mCs 1 .A = m· m-1Cs-lmCs(m-1)!xm 8!x(m-8)!-------'----'--------- x - 8(8 - I)! . (m - 1 - (8 - I))! m! -.Consequently, the second sum in Eq.(11) iswhich concludes the proof.•Theorem 1 says that the 1st trace of f3s (0 ::S 8 ::S m) is determined with Tr.[i] (13) (0 ::S i ::S8). When we apply Theorem 1 to the zero of modulus polynomial, the following relationsare established from Eq.(7).Determining Minimal Polynomial of Proper Element by Using Higher Degree Traces 203Tr[l](wO)Tr[1] (wi )Tr[1](w 2 )Tr[1](w3 )m,-fm-l,f~-l - 2fm-2,- fm-l . UJo-l - 2fm-2) + fm-2 . fm-l - 3fm-3,Thus, the first traces of each element of a polynomial basis are determined with coeffi-cients of modulus polynomial by (m + 2)(m - 1)/2 modulo-P multiplications. On the otherhand, for an arbitrary element 0: E GF(pm ) and o:i (O:S i :S m) in Eq.(3), Tr[l] (o:i) is givenby using linearity property,and can be computed by m(m - 1) modulo-P multiplications.4 DETERMINING MINIMAL POLYNOMIAL IN THE CASE OF m < PSince the 1st trace Tr[l] (o:i) of o:i can be determined by Eq. (13), we here express the higherdegree trace Tr[s](o:) by using Tr[l](o:i) (1 :S i :S 8) and Tr[j](o:) (1 :S j :S 8 - 1), whichdetermine the minimal polynomial.First of all, for 8 = 1,(14)Note that the right-hand side is given by Eq.(13) with i = 1.For 8 =2, ... m, setting f3 in Eq.(lO) to a given proper element 0: and solving it in respectto Tr[S] (0:),s-lTr[s](o:) = (_1)S . 8- 1 . {_Tr[l](o:S) + I)-1)i+l . Tr[i] (0:) . Tr[l](o:s-i)}. (15)i=lIf we have computed ai,j in Eq.(3) and Tr[l](o:i) by using Eq.(13) in advance, Tr[s](o:) canbe successively determined for 1 :S 8 :S m by using Eq.(14) and (15). Consequently, fromEq.(8), (m-8)th coefficient of the minimal polynomial of 0: is determined by (m+2)(m-1)/2modulo-P multiplications. The new method concludes in the following procedure.INITIALIZATION: Input an irreducible polynomial f(x) of degree mover GF(P)' andsuppose w its zero. Compute the 1st traces of wi (0 :S i :S m) by using Theorem 1 andEq.(7) for initialization.STEP 1: For a given proper element 0: E GF(pm ), compute polynomial basis represen-taions of o:i (O:S i:S m) by f(w) = O. Specifically, compute O:i,j in Eq.(3).STEP 2: Compute the 1st traces of o:i (O:S i :S m) by using Eq.(13).STEP 3: Compute higher degree traces of 0: by using Eq.(14) and Eq.(15). Then theminimal polynomial of 0: is determined by using Eq.(8).204 Y.NOGAMI and Y.MORIKAWAThus, our method can determine minimal polynomial about twice faster then the conven-tional one. However it does not work in the case of Tn 2: P, because p-I does not existwhen s = P in Eq.(15).Example3: For modulus polynomial f(x) = x4+5x2+5x+5 over GF(7), let {wO, wI, w2,w:3}be .polynomial basis in GF (74 ). Let us determine the minimal polynomial of w2 de-noted MW2(X).INITIALIZATION : The 1st traces of each element of a polynomial basis and w4are computed.Tr[I](WO)Tr[I](w l )Tr[l](w2)Tr[I] (w3 )Tr[I] (w4 )4,0,Tr[l](w)2 - 2Tr[2](w) = 4,Tr[I] (w)Tr[I](w2) - Tr[2] (w)Tr[l] (w) + 3Tr[:3](w) = 6,Tr[I](w)Tr[I](w:3) - Tr[2](w)Tr[I](w2) + Tr[:3] (w)Tr[I](w) - 4Tr[4](w) = 2.STEPl : The polynomial basis representations of (w 2 )i (0 :s; i :s; 4) are computed.(w2)O(w2)1(w2)2(w2)3(w2)4°w2W2w2+ 2wI + 2wo2w:3+ 6w2+ 4w I + 4wow3 +6w2+ 2wI + 5woSTEP2 : The 1st traces of (w 2 )i (0 :s; i:S; 4) are computed.Tr[l]((w2)O)Tr[I]((w2)1)Tr[I]((w2)2)Tr[I] ((W2)3)Tr[I]((w2)4)Tr[I](WO) = 4Tr[I](w2) = 42Tr[I](w2) + 2Tr[I](w l ) + 2Tr[I] (wO) = 22Tr[I](w:3) + 6Tr[I](w2) +4Tr[I] (wI) + 4Tr[I](wO) = 3Tr[I] (w3) + 6Tr[I] (w2) + 2Tr[1](w l ) + 5Tr[l] (wO) = 1STEP3 : The higher degree traces of w2 are computed.Tr[I](w2)Tr[2](w2)Tr[3] (w 2 )Tr[4] (w 2 )4,T I (_Tr[I](w4) + Tr[I](w2)2) = 0,_3- 1 (_Tr[I](w 6 ) + Tr[I](w2)Tr[I](w4 ) - Tr[2](w2 )Tr[I](w2)) = 3,4- 1 (_Tr[1](w8 ) + Tr[I](w2 )Tr[I](w6 ) _ Tr[2] (w2)Tr[I] (w4 )+Tr[3](w2)Tr[I](w2)) = 4.Determining Minimal Polynomial of Proper Element by Using Higher Degree Traces5 CONCLUSIONSIn this paper, higher degree traces has been defined as an extension of the well-known trace.The relations between higher degree traces and coefficients of a modulus polynomial havebeen derived, and then we have proposed a ne"v method to determine minimal polynomialof an arbitrary proper element by using higher degree traces in the case of m < P, wherern is the· degree of the minimal polynomial and P is the characteristic. The new methodcan determine minimal polynomial without solving the simultaneous equations, which isof great advantage comparing to the conventional method, resulting twice faster than theconventional method. For further considerations, by using higher degree traces, a methodto determine minimal polynomial in the case of m > P or to determine that of arbitraryelement will be deviced.References[1] P. Veron, "Goppa Codes and Trace Codes", IEEE Trans. Inform. Theory, vo1.44, no.l,1998, pp.290-294.[2] A. Miyaji, "Method ofImplementing Elliptic Curve Cryptosystems in Digital Signaturesor Verification and Privacy Communication", US PATENT, no.5497423, 199fL[3] A. J. Menezes, "Elliptic Curve Public Key Cryptsystems" , Kluwer Academic Publishers,1993.[4] R. Gold, "Optimal Binary Sequences for Spread Spectrum Multiplexing" , IEEE Trans.Inform. Theory, v01.13, 1967, pp.619-621.[5] T. Hiramoto, T. Yano, Y. Nogami and Y. Morikawa, "Testing Anomalous EllipticCurves Depending on Irreducible Polynomials over GF(P)", Proc. The 22th Symposiumon Information Theory and Its Applications, 1999, pp.1l7-120.[6] R. Lidl and H. Niederreiter, "Finite Field" , Encyclopedia of Mathematics and Its Ap-plications 20, Cambridge University Press, 1997.205

Elliptic Curve Public Key Cryptsystems&quot;

Finite Field&quot;

Goppa Codes and Trace Codes&quot;,

Method ofImplementing Elliptic Curve Cryptosystems

Optimal Binary Sequences for Spread Spectrum Multiplexing&quot;

Testing Anomalous Elliptic Curves Depending on Irreducible Polynomials over GF(P)&quot;,

Determining Minimal Polynomial of Proper Element by Using Higher Degree Traces

Abstract

Similar works

Full text

Available Versions

Okayama University Digital Information Repository

Okayama University Scientific Achievement Repository