Chapter IV: Constructing number fields
4.4 Other techniques of constructing number fields
Theorem 4.3([Evd92]). Under GRH, there exists a deterministic polynomial-time algorithm that, given a polynomial f(X) ∈ Fp[X]satisfying Condition 3.1 and a lifted polynomial f˜(X) ∈ Z[X] of f whose Galois group Gal( ˜f /Q) is solvable, computes the complete factorization off overFp.
The proof relies on the following bound for the orders of primitive solvable permu- tation groups, proved by Pálfy [Pál82].
Theorem 4.4([Pál82]). LetGbe a primitive solvable permutation group on a set of cardinalityn ∈N+. Then|G| ≤24−1/3ncfor a constantc= 3.24399. . .. Proof of Theorem 4.3. As in Section 6, we factorize f˜into its irreducible factors f1(X), . . . , fk(X)∈Z[X]overQin polynomial time using the factoring algorithm in [LLL82]. The Galois groupsGal( ˜fi(X)/Q)are quotient groups ofGal( ˜f /Q), and hence are solvable as well. By replacing f(X)˜ with f˜i(X) and f(X) with fi(X) := ˜fi(X) modp ∈ Fp[X]for each i ∈ [k], we reduce to the case that f˜is irreducible overQ.
Let L be the splitting field of f˜over Q. When Gal( ˜f /Q) acts primitively on the set of roots of f˜in L, its order is bounded by a polynomial in deg(f) by Theorem 4.4. Then by Theorem 4.9, we can constructF in polynomial time such thatQ[X]/( ˜f(X))∈ F and all strongly antisymmetricP-schemes are discrete on H, whereP is the subgroup system overGal( ˜f /Q) associated withF andH is a subgroup inP satisfying LH ∼= Q[X]/( ˜f(X)). By Theorem 4.2, we also have a polynomial-time algorithm of constructing suchF in the general case. The theorem then follows from Theorem 3.9.
In Chapter 5, we prove a generalization of Theorem 4.3 (see Theorem 5.13), which implies the main result of [Evd92] in its general form. In particular, the assumption thatf˜satisfies Condition 3.1 is no longer required.
Taking the compositum of number fields. Note that the fields computed in the two algorithmsSplittingField and Stabilizersin Section 4.2 are (up to isomorphism overK0) compositums of conjugates of the fieldK0[X]/(g(X)). The general problem of constructing the compositum of (relative) number fields is solved by the following lemma.
Lemma 4.13. There exists a polynomial-time algorithm that given a number field K0 and relative number fieldsK, LoverK0, constructs all the compositumsK0L0 up to isomorphism over K0 where K0 (resp. L0) ranges over the conjugates of K (resp. L) overK0 in the algebraic closureK¯0 ofK0.6
Proof. Take the irreducible polynomialg(X)∈K0[X]that encodesL, i.e.,L∼=K0
K0[X]/(g(X)). Factorize g(X) into irreducible polynomials g1(X), . . . , gk(X) overK. Then compute and output the fieldsK[X]/(g1(X)), . . . , K[X]/(gk(X)). To see that this gives the desired output, note that we may fix K = K0 as fields are constructed only up to isomorphism over K0. Letα1, . . . , αn be the roots ofg in K¯0, wheren = deg(g). Then the conjugates ofLin K¯0 overK0 are precisely K0(α1), . . . , K0(αn). Fori∈[n], there exists a uniqueji ∈[k]such thatαiis the root ofgji, and the compositum ofKandK0(αi)is justK(αi)∼=K0 K[X]/(gji(X)). Taking the intersection of number fields. The intersection of two number fields can be computed efficiently, as shown in [LM85].
Theorem 4.5([LM85]). There exists a polynomial-time algorithm that given
• number fieldsK = Q(α), K0 = Q(β)encoded by the minimal polynomials of primitive elementsα ∈K andβ∈K0overQrespectively, and
• the minimal polynomialh0(X)∈K[X]ofβ overK,7 computes the number fieldK∩K0 up to isomorphism.
The algorithm in [LM85] also extends to relative number fields. We omit the details.
6HereK andL are embedded inK¯0 via someK0-linear embeddings. The choices of these embeddings do not matter as we constructK0L0for all the conjugatesK0andL0overK0.
7The polynomialh0is needed for the problem to be well defined.
Adjoining a square root of the discriminant. SupposeK is a relative number field over K0 encoded by the minimal polynomial h(X) ∈ K0[X] of a primitive element α ∈ K over K0. Let L be the Galois closure of K/K0 and let G = Gal(L/K0). ThenGacts on the setSof roots ofhinLand hence can be identified with a subgroup ofSym(S).
SupposeS ={α1, . . . , αn}. Define thediscriminantofhto be
∆h := Y
1≤i<j≤n
(αi−αj)2.
We haveg∆h = ∆h for allg ∈G. So∆h ∈LG=K0. Now consider the subfieldK00 :=K0(√
∆h)ofL, where√
∆h :=Q
1≤i<j≤n(αi−αj) is a square root of∆hinL. A permutationg ∈Gfixes√
∆hprecisely whengis an even permutation ofS, which implies
Gal(L/K00) =G∩Alt(S).
With this observation, we have
Lemma 4.14. There exists a polynomial-time algorithm that given a number field K0 and a relative number fieldK over K0 encoded by h(X) ∈ K0[X], computes LG∩Alt(S) up to isomorphism over K0, where L is the Galois closure of K/K0, G= Gal(L/K0), andSis the set of roots ofhinL.
Proof. We haveLG∩Alt(S) = K0(√
∆h)by the above discussion. Letn = deg(h). Then discriminant∆h satisfies the identity
∆h = (−1)n(n−1)/2Res(h, h0),
where Res(h, h0) denotes the resultant of hand its derivative h0. and is given by the determinant of the Sylvester matrix associated with h and h0 [Lan02]. Thus we can compute ∆h in polynomial time. Then we test if ∆h is a square in K0 by factoringX2 −∆h overK0. If∆h is a square, we have K0(√
∆h) = K0 and correspondinglyG⊆Alt(S). In this case we just outputK0. Otherwise we output K0[X]/(X2−∆h).
Remark. The technique above was used in [Lan84] for the determination of the Galois groups of number field extensions. It is not clear, however, if it helps for the problem of polynomial factoring over finite fields. We note that replacing K0
withK0 =K0( ∆h)andK withK0Khas the effect of reducing the Galois group G toG∩Alt(S), but the order of Gis reduced by at most a factor of two. This does not help in the case that G = Sym(S) and P is a system of stabilizers of depth m ≤ |S| −2 (with respect to the natural action of G): As both Sym(S) andAlt(S)arek-transitive for k =|S| −2,P-schemes forSym(S)and those for Alt(S)both correspond tom-schemes onS(see Theorem 2.1), and hence they are the equivalent.
Computing the fixed field of the automorphism group. The following lemma gives a characterization of the fixed field of an automorphism subgroup.
Lemma 4.15. SupposeK/K0is a field extension andαis a primitive element ofK overK0. For a subgroupU ⊆Aut(K/K0), the fieldKUis generated by elementary symmetric polynomials in the elementsgα(indexed byg ∈U) overK0.
Proof. LetK0be the subfield ofKgenerated by elementary symmetric polynomials ingα,g ∈U overK0. We obviously haveK0 ⊆KU. By Galois theory, it holds that [K : KU] = |U|(see, e.g., [Lan02, Section VI.1, Theorem 1.8]). So it suffices to prove[K :K0]≤ |U|.
Consider the polynomial φ(X) = Q
g∈U(X −gα). The coefficients of φ(X) are, up to sign, given by elementary symmetric polynomials in gα, g ∈ U and hence φ(X)∈K0[X]. Asφ(α) = 0, the minimal polynomial ofαoverK0 dividesφ(X), and its degree is at mostdeg(φ) =|U|. So we have[K0(α) :K0]≤ |U|. The claim follows by noting thatK0(α) =K.
Lemma 4.15 provides a method of computing the fixed field of the automorphism groupAut(K/K0):
Theorem 4.6. There exists a polynomial-time algorithm that given a number field K0and a relative number fieldKoverK0, computes the fixed fieldKAut(K/K0)⊆K. Proof. SupposeK is encoded by the minimal polynomial of a primitive elementα overK0. We compute all the automorphisms ofKinAut(K/K0)using Lemma 4.7.
Then we adjoining to K0 the first k elementary symmetric functions in gα, g ∈ Aut(K/K0)wherek =|Aut(K/K0)|. The resulting field is exactlyKAut(K/K0)by Lemma 4.15.
More generally, givenK0, K and a subgroupU ⊆ Aut(K/K0)of automorphisms ofK, the same proof shows thatKU can be constructed in polynomial time.
Now supposeLis a Galois extension ofK0 that containsK. LetG= Gal(L/K0) andH = Gal(L/K). ThenAut(K/K0)is identified withNG(H)/H, and we have KAut(K/K0) = KNG(H)/H = LNG(H). So Theorem 4.6 states that LNG(H) can be constructed in polynomial time givenK =LHandK0. In the context of polynomial factoring using theP-scheme algorithm, this means that we can efficiently enlarge a subgroup systemP by including the normalizersNG(H)ofH ∈ P.
A natural question arising from this observation is whether adding the normalizers (or more generally subgroups betweenNG(H)andH) to the subgroup system helps a P-scheme algorithm obtain the complete factorization (resp. a proper factorization).
By Theorem 3.9, this reduces to the question whether it helps for proving all strongly antisymmetric P-schemes are discrete (resp. inhomogeneous) on a distinguished subgroupH ∈ P.
For discreteness of strongly antisymmetricP-schemes, we give an affirmative an- swer in general: we show that for some subgroup system P and H ∈ P, there exist strongly antisymmetric P-schemes that are not discrete on H, but adding normalizers to the subgroup system rules out their existence.
Example4.1. Choose a finite groupGand a subgroupH ⊆Gsuch thatNG(H)is a proper normal subgroup ofG.8 ChooseP ={gHg−1 :g ∈G}which is a subgroup system overG. Define aP-collectionC ={CH0 :H0 ∈ P}as follows: the group NG(H)acts on H\Gby left translation gHh = HghandH\Gis partitioned into NG(H)-orbits. Choose a complete set of representativesB ⊆H\Gfor these orbits.
DefineCH ={gB : g ∈NG(H)}. For any other subgroupH0 inP, chooseg ∈G such that H0 = gHg−1, and define CH0 = {cH,g(B) : B ∈ CH}. It is easy to see that C is a well defined strongly antisymmetric P-scheme. Moreover, it is not discrete onHsinceNG(H)does not act transitively onH\G.
Now defineP0 =P ∪ {NG(H)}which is also a subgroup system overG. We claim that any antisymmetricP0-schemes C0 must be discrete on any subgroup inP0. To see this, note thatC0 is discrete onNG(H)∈ P0sinceNG(H)is normal inG. Then C0is also discrete on all the other subgroupsH0 ∈ P0by compatibility, and the claim follows. In particular, it is impossible to extendC to an antisymmetricP0-scheme.
8For example, we may chooseGto be the semidirect product(K×K)oC2, where Kis a nontrivial finite group andC2permutes the two direct factors ofK×K. LetH =K× {e}. Then NG(H) =K×KEG.
Despite the example above, adding normalizers to the subgroup system seems not helpful for attacking the most difficult cases in polynomial factoring: for a subgroup systemP over a finite groupG, define
P+={U :H ⊆U ⊆NG(H), H ∈ P},
which is also a subgroup system over G. For several important families of per- mutation groups, we show that if P is the corresponding system of stabilizers of certain depth m(wherem is not too large), anyP-scheme C can be extended to a P+-schemeC0with antisymmetry and strong antisymmetry preserved. In particular, ifC is not discrete or inhomogeneous on some subgroupH ∈ P, then neither isC0. Lemma 4.16. LetS be a finite set and letGbeSym(S)orAlt(S)acting naturally onS. LetPbe the system of stabilizers of depthmoverGwith respect to this action wherem < |S|/2. Then anyP-schemeC can be extended to aP+-schemeC0 such thatC0is antisymmetric (resp. strongly antisymmetric) if so isC.
Lemma 4.17. LetV be a finite dimensional vector space over a finite field and letG beGL(V)acting naturally onS :=V − {0}. Let P be the system of stabilizers of depthmoverGwith respect to this action wherem <dimF V. Then anyP-scheme C can be extended to aP+-scheme C0 such thatC0 is antisymmetric (resp. strongly antisymmetric) if so isC.
We defer the proofs of Lemma 4.16 and Lemma 4.17 to Section 6.4 . There we define theclosurePcl of a subgroup systemP, and then show that P-schemes can always be extended to Pcl-schemes with antisymmetry and strong antisymmetry preserved. Lemma 4.16 and Lemma 4.17 then follow immediately once we verify thatPcl =P+in these cases.
C h a p t e r 5
THE GENERALIZED P -SCHEME ALGORITHM
In Chapter 3, we developed the P-scheme algorithm that factorizes polynomials satisfying Condition 3.1, i.e., they are defined over a prime fieldFp, square-free, and completely reducible overFp. In this chapter, we extend this algorithm to factorize general polynomials f(X) ∈ Fq[X] over a finite fieldFq of characteristic p. The generality is reflected in the following three aspects: (1) Fq may be a non-prime field, (2) the degrees of the irreducible factors off may be greater than one, and (3) the multiplicities of the irreducible factors off may be greater than one.
Motivation. Techniques like Berlekamp’s reduction [Ber70], square-free factor- ization [Yun76; Knu98] and distinct-degree factorization [CZ81] were commonly used in literature to reduce the problem to the special case that the input polynomial satisfies Condition 3.1. However, these reductions do not preserve the information of the lifted polynomial f˜employed by the P-scheme algorithm. Therefore, it is desirable to avoid these reductions and extend theP-scheme algorithm to the general setting instead.
As a concrete example, consider the following polynomialf(X)˜ ∈Z[X]irreducible overQ, taken from [KM00]:
f˜(X) =X14+ 28X11+ 28X10−28X9+ 140X8+ 360X7 + 147X6 + 196X5+ 336X4−546X3−532X2+ 896X+ 823.
Forp= 43, the reduced polynomialf(X) = ˜f(X) mod phas seven distinct linear factors and one irreducible factor of degree 7 overFp:
f(X) =(X+ 2)(X+ 4)(X+ 9)(X+ 19)(X+ 23)(X+ 30)(X+ 42) (X7+ 14X4+ 15X3+ 31X2+ 15X+ 38).
The standard way of factoringfoverFpis first applying distinct-degree factorization [CZ81] to obtain a partial factorizationf =f0f1, where
f0(X) = (X+ 2)(X+ 4)(X+ 9)(X+ 19)(X+ 23)(X+ 30)(X+ 42) is the product of the linear factors and satisfies Condition 3.1. Then we factorize f0 over Fp. To achieve this goal deterministically, we pick a lifted polynomial
f˜0(X)∈Z[X]off, which we may assume to be irreducible, and run theP-scheme algorithm in Chapter 3. Suppose the (Q,f)˜-subfield system in the algorithm is constructed by Lemma 3.21 and the associated subgroup systemP is the system of stabilizers of depth m, where m ∈ N+ is sufficiently large. In the worst case, the action ofGal( ˜f0/Q)on the set of roots off˜is permutation isomorphic to the natural action of the symmetric group Sym(7) on[7]. Then we need m ≥ 3to obtain a proper factorization of f, since by Theorem 2.1 and Lemma 2.19, there exists a strongly antisymmetricP-scheme homogeneous on a stabilizer ifm≤2.1
On the other hand, the action of the Galois group of f˜on the set of roots of f˜is permutation isomorphic to the action of the wreath product2 C7 oC2 on[7]×[2], where C7 permutes [7] cyclically and C2 permutes the two copies of [7]. This action has a base of size two, which suggests that choosing m = 2 is sufficient for completely factoringf, provided that we have a generalization of Theorem 3.2 that employs the polynomial f˜. The goal of this chapter is to establish such a generalization.
The example above generalizes to an infinite family of instances: for everyk ∈N+, there existsf˜(X)∈Z[X]irreducible overQof degree2ksuch that the action of the Galois group on the set of roots off˜is permutation isomorphic to the action ofCkoC2 on [k]×[2].3 And for such f˜, there exists infinitely many prime numberspsuch thatf(X) = ˜f(X) modphaskdistinct linear factors and one irreducible factor of degree k.4 Using the generalized P-scheme algorithm developed in this chapter, it is sufficient to choosem = 2in order to completely factorizef˜modp, leading to a polynomial-time factoring algorithm for such instances (f,f)˜. On the other hand, using distinct-degree factorization and theP-scheme algorithm in Chapter 3, the best known general upper bound formisO(logk)(see Theorem 3.12), and the resulting algorithm takes superpolynomial time.
Lifted polynomial. To formulate the main result of this chapter, we first need to generalize the notion of lifted polynomials (see Definition 1.1). Recall that a lifted polynomial of f(X) ∈ Fp[X] is a polynomial f(X)˜ ∈ Z[X] of degree
1For the same reason, one needs to choosem≥3if them-scheme algorithm [IKS09] is used.
2For the definition of the wreath product of groups, see Definition 6.11.
3Shafarevich’s theorem on solvable Galois groups [Sha54; ILF97] implies that the existence of integral polynomials realizing the family of groupsCk oC2 as Galois groups. For an algorithm explicitly computing such a polynomial, see [KM00].
4This follows from Chebotarëv’s density theorem. See, e.g., [Neu99].
deg(f) satisfying f˜(X) modp = f(X). For the general case Fq = Fpd, we fix the following notations: assumeFq is encoded by a monic irreducible polynomial h(Y) ∈ Fp[Y] of degreed, i.e., it is identified with Fp[Y]/(h(Y))via an isomor- phism ψ0 : Fp[Y]/(h(Y)) → Fq which we can efficiently compute. Lift h to a monic polynomial ˜h(Y) ∈ Z[Y]of degree d which is necessarily irreducible over Q. DefineA0 :=Z[Y]/(˜h(Y))andK0 :=Q[Y]/(˜h(Y)). Composing ψ0 with the natural projectionA0 →Fp[Y]/(h(Y))sendingx toxmodp, we obtain a surjec- tive ring homomorphism ψ˜0 : A0 → Fq. Finally extend ψ˜0 to the ring A0[X] by applying it to each coefficient:
ψ˜0 :A0[X]→Fq[X].
With these notations, we generalize the definition of lifted polynomials as follows.
Definition 5.1 (lifted polynomial). Suppose f(X) ∈ Fq[X] is a polynomial of degreen ∈N+. Alifted polynomialoff (with respect to˜handψ0) is a polynomial f˜(X) ∈A0[X]of degreensatisfyingψ˜0( ˜f) =f. Anirreducible lifted polynomial off is a lifted polynomial off that is irreducible overK0.
Givenf(X)∈Fq[X], we can choose a lifted polynomialf˜offefficiently. Further- more, we argue that f˜can be assumed to be irreducible overK0. To see this, we need the following lemma.
Lemma 5.1. There exists a polynomial-time algorithm that given p and a poly- nomial f(X)˜ ∈ A0[X] satisfying ψ˜0( ˜f) 6= 0, computes an integer D satisfying D ≡ 1 (mod p)and a factorization of D·f˜into irreducible factorsf˜i overK0. Furthermore all of the factorsf˜i(X)are inA0[X].
The proof can be found in Appendix C. ComputeDandfi using the lemma above.
We haveψ˜0(D·f) = ˜˜ ψ0( ˜f) =f sinceD≡1 (mod p). So the polynomialsψ˜0( ˜fi) are factors off, and we have reduced the problem to factoring eachψ˜0( ˜fi)∈Fq[X]
using its irreducible lifted polynomialf˜i.
The discussion above justifies the assumption that an irreducible lifted polynomial f˜off is given, with respect toh˜andψ0. The notations˜h,ψ0,A0, andK0are fixed throughout this chapter.
Main result. The main result of this chapter is a generalization of Theorem 3.2:
Theorem 5.1(informal). Suppose there exists a deterministic algorithm that given a polynomialg(X)∈A0[X]irreducible overK0, constructs in timeT(g)a collection F of subfields of the splitting fieldLofg overK0 such that
• F =K0[X]/(g(X))is inF, and
• all strongly antisymmetricP-schemes are discrete onGal(L/F)∈ P, where P is the subgroup system associated withF.
Then under GRH, there exists a deterministic algorithm that givenf(X)∈ Fq[X]
and an irreducible lifted polynomial f˜(X) ∈ A0[X] of f, outputs the complete factorization off overFq in time polynomial inT( ˜f)and the size of the input.
See Theorem 5.9 for the formal statement. For simplicity, here we only state the result for computing the complete factorization off. The results for computing a proper factorization are slightly more complicated to state, and we refer the reader to Section 5.10 for details.
Overview of the generalizedP-scheme algorithm
Recall that aP-scheme algorithm in Chapter 3 consists of three parts: (1) a reduction to the problem of computing an idempotent decomposition of the ringO¯F, where F = Q[X]/( ˜f(X)), (2) computing idempotent decompositions for a collection of number fields, and (3) constructing the collection of number fields used in the previous part. The factoring algorithm in this chapter has the same structure but with some differences: we generalize the reduction in Part (1), whereF now denotes the number fieldK0[X]/( ˜f(X)). And in Part (3), we construct a collection of relative number fields overK0 instead of ordinary number fields. The main difference is in Part (2), which we now explain.
P-schemes of double cosets. In Chapter 3, we proved that for a subfieldK of the splitting fieldLoff˜,Gthe Galois group off˜, andH= Gal(L/K), an idempotent decomposition of the ring O¯K corresponds to a partition of the right coset space H\G. The crucial condition for this claim to hold is thatpsplits completelyin the splitting field Lof f˜, which in turn relies on the assumption thatf is square-free and completely reducible over the field of definition. In general, one can prove that an idempotent decomposition ofO¯K corresponds to a partition of thedouble coset spaceH\G/DQ0 instead of the right coset spaceH\G, whereDQ0 ⊆ Gis known
as the decomposition group (of a fixed prime ideal Q0 of OL over K0). For the special case studied in Chapter 3, the decomposition groupDQ0 is trivial, and hence the double coset spaceH\G/DQ0 coincides with the right coset spaceH\G. To address the general case, we define the notion ofP-collections (resp. P-schemes) of double cosets, generalizing (ordinary)P-collections (resp. P-schemes). Various properties including (strong) antisymmetry, discreteness and homogeneity can be extended to P-schemes of double cosets. In addition, as the rings O¯K are not necessarily semisimple in general, we replace them with the ringsRK, defined by
RK :=
x∈O¯K/Rad( ¯OK) :xp =x ,
where Rad( ¯OK) denotes the radical of O¯K. These rings have the advantage of being finite products ofFp, so that we can directly use the results in Chapter 3. Then we generalize the algorithm in Chapter 3 to compute a collection of idempotent decompositions of the ringsRK so that they correspond to a strongly antisymmetric P-schemes of double cosets.
In addition, we introduce the following notations concerning partitions of double coset spaces: for every double coset HgDQ0 ∈ H\G/DQ0 where H ⊆ G, we associate two positive integersf(HgDQ0)ande(HgDQ0), called theinertia degree and the ramification indexofHgDQ0 respectively.5 Then we say a partitionP of H\G/DQ0 has locally constant inertia degrees (resp. ramification indices) if for every blockB inP, all the double cosets inB have the same inertia degree (resp.
ramification index). We design efficient algorithms that force the partitions in aP- collection of double cosets to have locally constant inertia degrees and ramification indices. These algorithms may be regarded as the analogues of distinct-degree factorization [CZ81] and square-free factorization [Yun76; Knu98] that factorize a polynomial according to the degrees and the multiplicities of the irreducible factors.
The discussion above is summarized by the following theorem, which generalizes Theorem 3.1 in Chapter 3.
Theorem 5.2 (informal). Under GRH, there exists a deterministic algorithm that given a poset P] of number fields between K0 and L corresponding to a poset P of subgroups of G, outputs idempotent decompositions of RK for K ∈ P]
5These names come from the fact thatf(HgDQ0) (resp. e(HgDQ0)) is the inertia degree (resp. ramification index) of the prime ideal ofOLH lying overpcorresponding toHgDQ0. See Definition 5.2 for details.