Preliminaries

Chapter V: The generalized P -scheme algorithm

5.1 Preliminaries

For a number field K, denote by O¯_K the quotient ring O_K/pO_K. For K₀ = Q[Y]/(˜h(Y)), we have

Lemma 5.2. The idealpO_K0 is a prime ideal ofO_K0. AndO¯_K0 ∼=Fq.

Proof. Let Y¯ := Y + (˜h(Y)) ∈ O_K0. Consider the ring homomorphism i : Fp[Y]/(h(Y))→O¯_K0 sendingY+ (h(Y))toY¯+pO_K0. Clearlyiis a nonzero map sincei(1) = 1. AsFp[Y]/(h(Y))is a field, the mapiis injective. AsFp[Y]/(h(Y)) and O¯K0 both have dimension deg(h) over F^p, the map i is an isomorphism. So O¯K0 ∼=F^p[Y]/(h(Y))∼=F^qandpOK0 is prime.

In the following, we give some notations and facts from algebraic number theory.

The proofs can be found in standard references like [Neu99].

Splitting of prime ideals. LetKbe a finite extension ofK₀. The idealpO_Ksplits in the unique way into a product of prime ideals ofO_K, up to the ordering:

pO_K =

k

Y

i=1

P^e(P_i ⁱ⁾=

k

\

i=1

P^e(P_i ⁱ⁾,

whereP₁, . . . ,P_kare distinct ande(P_i) ∈N⁺. We sayP₁, . . . ,P_kare the prime ideals ofO_K lying overp. Fori∈[k], defineκ_Pi :=O_K/P_iwhich is a finite field, called theresidue fieldofPi. The inclusionOK0 ,→ OK induces an embedding of O¯K0 ∼=F^qinκPi, makingκPi an extension field ofO¯K0. Letf(Pi) := [κPi : ¯OK0]. We calle(P_i)andf(P_i)theramification indexand theinertia degreeofP_i (over pO_K0) respectively. It holds that

k

X

i=1

e(Pi)f(Pi) = [K :K0].

Vector spacesPⁱ/Pⁱ⁺¹. We also use the following facts implicitly:

For a number fieldK,i∈Nand a nonzero prime idealPofOK, the abelian group Pⁱ/Pⁱ⁺¹is an one-dimensional vector space over the fieldκ_P=O_K/P, where the scalar multiplication is defined by

(u+P)·(v +Pⁱ⁺¹) = uv+Pⁱ⁺¹ foru∈ O_K, v ∈Pⁱ. Fori, j ∈Nandu∈Pⁱ−Pⁱ⁺¹, the map

x+P^j+1 7→ux+P^i+j+1

is an isomorphism fromP^j/P^j+1 toP^i+j/P^i+j+1, both regarded as vector spaces overκ_P. In particular, fori, j ∈Nandu∈Pⁱ−Pⁱ⁺¹, we haveu^j ∈P^ij −P^ij+1. Now supposeK, K⁰ are finite extensions ofK₀ andK ⊆K⁰. AndP,Qare prime ideals of O_K and O_K⁰ respectively, both lying over p, such that Q∩ O_K = P. Then e(P) divides e(Q) and f(P) divides f(Q). And for i ∈ N, the inclusion OK ,→ OK⁰ induces an inclusionPⁱ/Pⁱ⁺¹ ,→Qⁱ⁰/Qⁱ⁰⁺¹wherei⁰ =i·e(Q)/e(P). The decomposition group and the inertia group. LetL/K₀be a Galois extension of number fields with the Galois groupG= Gal(L/K₀). LetPbe a prime ideal of O_Llying overp. The group

DP :={g ∈G:^gP=P} ⊆G is called thedecomposition groupofPoverK₀. And the group

I_P :={g ∈G:^gx≡x (mod P)for allx∈ O_L}

is a normal subgroup ofDP, called theinertia groupofPoverK0. Each automor- phismg ∈ DP ofLrestricts to an automorphism ofOLfixingOK0 and satisfying

gP=P, and hence induces an automorphism¯gof the residue fieldκ_PfixingO¯_K0, defined by

¯

g(x+P) =^gx+P.

The mapπ:g 7→g¯is a surjective group homomorphism fromD_PtoGal(κ_P/O¯_K0) whose kernel is preciselyI_P, i.e, we have a short exact sequence

1→ I_P→ D_P −→^π Gal(κ_P/O¯_K0)→1.

The Galois group Gal(κ_P/O¯_K0) is cyclic and is generated by theFrobenius auto- morphismx7→x^q ofκPoverO¯K0 ∼=F^q.

The wild inertia group. LetL,GandPbe as above. The group W_P :={g ∈G:^gx≡x (mod P²)for allx∈ O_L}.

is a normal subgroup ofI_P, called thewild inertia groupofPoverK₀.

Chooseπ_L∈P−P². We have a group homomorphismI_P →κ^×_Psendingg ∈ I_P to the unique elementc_g ∈ κ^×_P satisfying^gπ_L+P² = c_g(π_L+P²). This map is independent of the choice of πL, and its kernel is precisely W_P. It is also known thatWPis ap-group. See [Neu99, Section II.10].

In our factoring algorithm, the group G is a subgroup of Sym(n) where n is the degree of the input polynomial f(X) ∈ Fq[X]. We can always assume p > n, since the case p ≤ n is solved in polynomial time by Berlekamp’s algorithm in [Ber70]. Under this assumption, thep-subgroupW_PofGis trivial, and hence the mapI_P →κ^×_Pabove is injective. In particular, the inertia groupI_Pis cyclic.

Prime ideals vs. double cosets. We have the following generalization of Theo- rem 3.4, which gives a one-to-one correspondence between prime ideals lying over pand double cosets. See [Neu99] for its proof.

Theorem 5.3. Let L/K₀ be a Galois extension of number fields and let G = Gal(L/K₀). Fix a prime idealQ₀ofO_Llying overp. For any subgroupH ⊆Gand its fixed fieldK =L^H, the mapHgD_Q0 7→^gQ₀∩O_Kis a one-to-one correspondence between the double cosets inH\G/DQ0 and the prime ideals ofOK lying overp.6 Moreover, forg ∈Gand the prime idealP=^gQ0∩ O_Kcorresponding toHgD_Q0, define

n(P) := |{Hh∈H\G:HhD_Q0 =HgD_Q0}|.

Then

e(P) =|{Hh∈H\G:HhI_Q0 =HgI_Q0}| and f(P) = n(P) e(P).

Motivated by Theorem 5.3, we define the ramification index and the inertia degree of a double coset:

6Note that this map is well defined: for another representativehgh⁰ ∈ Gof HgD_Q0, where h∈H andh⁰∈ DQ0, we have^hgh0Q0∩ OK =^hgQ0∩ OK =^h(^gQ0∩ OK) =^gQ0∩ OKsince

h⁰

Q0=Q0andOKis fixed byH.

Definition 5.2. Let G be a finite group, H,D subgroups of G, and I a normal subgroup of D. Define the ramification index of a double coset HgD ∈ H\G/D with respect to(D,I)to be

e(HgD) :=|{Hh∈H\G:HhI =HgI}|,

which is well defined.7 And define theinertia degreeofHgDwith respect to(D,I) to be

f(HgD) := |{Hh∈H\G:HhD=HgD}|

e(HgD) .

SupposeL/K₀is a Galois extension of number fields with the Galois groupG. Fix a prime ideal Q0 of OL lying over p. Let H be a subgroup of G and K = L^H. Then by Theorem 5.3, the ramification index (resp. inertia degree) of a double coset HgD_Q0 ∈H\G/D_Q0 with respect to(D_Q0,I_Q0)is precisely the ramification index (resp. inertia degree) of the corresponding prime ideal^gQ₀∩ O_KofO_K.

We also introduce the following notations concerning partitions of a double coset space.

Definition 5.3. Let G, H,D,I be as in Definition 5.2. We say a partition P of H\G/D has locally constant ramification indices (resp. inertia degrees) with respect to (D,I) if for every B ∈ P, all the double cosets in B have the same ramification index (resp. inertia degree) with respect to(D,I). For such a partition P and anyB ∈P, denote bye(B)(resp. f(B)) the ramification index (resp. inertia degree) of any double coset inB.

Radicals of rings and polynomials. LetAbe a (commutative) ring. An element x ∈ A isnilpotent if x^k = 0for some k ∈ N⁺. The radical(or nilradical) of A, denoted byRad(A), is the ideal consisting of the nilpotent elements ofA. It equals the intersection of all the prime ideals ofA(see [AM69]).

Letg(X)∈Fq[X]be a non-constant polynomial with the following factorization

g(X) = c·

k

Y

i=1

(g_i(X))^mi

7To see thate(HgD)is well defined, consider two representativesg andg⁰ of HgD. Then g⁰=sgtfor somes∈Handt∈ D. Note thatHhtI=HhItfor allh∈G. It follows that the map Hh7→Hhtis a bijection from{Hh∈H\G:HhI=HgI}to{Hh∈H\G:HhI=Hg⁰I}.

overF^q, wherec∈F^qis the leading coefficient ofgandg₁, . . . , g_kare distinct monic irreducible polynomials over F^q. Define theradical Rad(g)of g to be the monic polynomialQk

i=1g_i(X)∈Fq[X]. ForA=Fq[X]/(g(X)), the ideal ofAgenerated byRad(g) + (g(X))∈Ais preciselyRad(A).

The ring R_K. Suppose K is a finite extension of K₀ and pO_K splits into the product of prime ideals

pO_K =

k

Y

i=1

P^e(P_i ⁱ⁾,

whereP₁, . . . ,P_k are distinct. The radical ofO¯_K is given by Rad( ¯O_K) =

k

\

i=1

P_i/pO_K =

k

\

i=1

P_i

!

/pO_K.

By the Chinese remainder theorem, we have the isomorphism O¯_K/Rad( ¯O_K)→

k

Y

i=1

O_K/P_i =

k

Y

i=1

κ_Pi,

sending x+ Rad( ¯OK) ∈ O¯K/Rad( ¯OK) to (˜xmodP1, . . . ,x˜modPk), where

˜

x∈ OKis an arbitrary element liftingx∈O¯K. In particular, the ringO¯K/Rad( ¯OK) is semisimple.

DefineRK to be the subring ofO¯K/Rad( ¯OK)consisting of elements fixed by the Frobenius automorphismx7→x^poverF^p, i.e.,

R_K :=

x∈O¯_K/Rad( ¯O_K) :x^p =x . The isomorphismO¯_K/Rad( ¯O_K)→Qk

i=1κ_Piabove identifiesR_Kwith the subring Qk

i=1Fp ofQk

i=1κ_Pi. SoR_K is a finite product of copies ofFp and in particular is semisimple.

Observe that the map m 7→ (m/Rad( ¯O_K))∩R_K is a one-to-one correspondence between the maximal ideals of O¯_K and those of R_K. Combining this fact with Theorem 5.3, we obtain

Lemma 5.3. LetL,G,Q₀ be as in Theorem 5.3. For any subgroupH⊆Gand its fixed fieldK =L^H, the map

HgD_Q0 7→ (^gQ₀∩ O_K)/pO_K Rad( ¯O_K) ∩R_K

is a one-to-one correspondence between the double cosets in H\G/D_Q0 and the maximal ideals ofRK.

Idempotent decompositions vs. partitions of a double coset space. In the following, we establish a one-to-one correspondence between the idempotent de- compositions ofR_K and the partitions of a certain double coset space.

For a number field extension L/K, the inclusionO_K ,→ O_L induces an inclusion O¯_K ,→O¯_L. So we may regardO¯_Kas a subring ofO¯_L. Note thatRad( ¯O_L)∩O¯_K = Rad( ¯O_K). Passing to the quotient rings yields an inclusion O¯_K/Rad( ¯O_K) ,→ O¯_L/Rad( ¯O_L). Restricting to the subringR_K, we obtain an inclusion

i_K,L :R_K ,→R_L.

Also note that ifL/K₀ is a Galois extension with the Galois groupG, the action of GonO_Linduces an action onR_Lthat permutes the maximal ideals ofR_L.

Fix the following notations: letLbe a Galois extension ofK₀with the Galois group G= Gal(L/K₀). For a (nonzero) prime idealQofO_Llying overp, define

Q¯ := Q/pO_L

Rad( ¯O_L) ∩R_L,

which is a maximal ideal of RL, and let δQ¯ be the primitive idempotent of O¯L

satisfyingδQ¯ ≡ 1 (mod ¯Q)andδQ¯ ≡ 0 (mod ¯Q⁰)for all maximal ideal Q¯⁰ 6= ¯Q ofO¯_L. Finally, fix a prime idealQ₀ofO_Llying overp.

Definition 5.4. SupposeHis a subgroup ofGandK =L^H. Then

• for an idempotent decompositionI ofR_K, defineP(I)to be the partition of H\G/D_Q0 whereHgD_Q0, Hg⁰D_Q0 are in the same block iff^g−1(i_K,L(δ)) ≡

g⁰⁻¹

(iK,L(δ)) (mod ¯Q0)holds for allδ ∈I, and

• for a partitionP ofH\G/D_Q0, defineI(P)to be the idempotent decomposi- tion ofR_K consisting of the idempotents

δ_B :=i⁻¹_K,L





X

gD_Q

0∈G/D_Q

0:HgD_Q

0∈B gδQ¯0



,

whereBranges over the blocks inP.

We have the following two lemmas that generalize Lemma 3.5 and Lemma 3.6 respectively. In particular, Lemma 5.5 establishes a one-to-one correspondence between the idempotent decompositions ofR_K and the partitions ofH\G/D_Q0.

Lemma 5.4. The partitionsP(I)and the idempotent decompositionsI(P)are well defined. And for any idempotent decomposition I of O¯_K, the idempotents δ ∈ I correspond one-to-one to the blocks ofP(I)via the map

δ 7→B_δ :={HgD_Q0 ∈H\G/D_Q0 :^g−1(i_K,L(δ))≡1 (mod ¯Q₀)}

with the inverse mapB 7→δ_B.

Lemma 5.5. The map I 7→ P(I) is a one-to-one correspondence between the idempotent decompositions ofRK and the partitions ofH\G/DQ0, with the inverse mapP 7→I(P).

Their proofs are similar to those of Lemma 3.5 and Lemma 3.6, and can be found in Appendix C.

P-collections and P-schemes of double cosets. Let G be a finite group and D ⊆ G a subgroup. We generalize projections and conjugations introduced in Chapter 2 so that they are defined between double coset spaces:

• (projection) for H ⊆ H⁰ ⊆ G, define the projection π_H,H^D 0 : H\G/D → H⁰\G/Dto be the map sendingHgD ∈ H\G/DtoH⁰gD ∈H⁰\G/D, and

• (conjugation) forH ⊆Gandg ∈G, define theconjugationc^D_H,g :H\G/D → gHg⁻¹\G/D to be the map sending HhD ∈ H\G/D to (gHg⁻¹)ghD ∈ gHg⁻¹\G/D.

Next we defineP-collections andP-schemes of double cosets.

Definition 5.5. Let P be a subgroup system over a finite group G. Then a P- collection of double cosetswith respect to a subgroupDofGis a familyC ={C_H : H ∈ P} indexed byP where eachC_H is a partition ofH\G/D. Moreover,C is a P-scheme of double cosetswith respect toDif it has the following properties:

• (compatibility) forH, H⁰ ∈ P withH ⊆H⁰ andx, x⁰ ∈H\G/Din the same block ofC_H, the imagesπ_H,H^D 0(x)andπ_H,H^D 0(x⁰)are in the same block ofC_H⁰.

• (invariance) forH ∈ P andg ∈G, the mapc^D_H,g :H\G/D →gHg⁻¹\G/D maps any block ofC_H to a block ofC_gHg⁻¹.

• (regularity) forH, H ∈ P withH ⊆H,B ∈C_H,B ∈C_H⁰, the number of x∈Bsatisfyingπ_H,H^D 0(x) = yis a constant whenyranges over the elements ofB⁰.

We also define the following optional properties for aP-scheme of double cosetsC with respect toD:

• (homogeneity and discreteness)CishomogeneousonH ∈ PifCH = 0H\G/D, and otherwiseinhomogeneous onH. It isdiscreteonH ifC_H = ∞_H\G/D, and otherwisenon-discreteonH.

• (antisymmetry)C is antisymmetricif forH ∈ P, g ∈ NG(H),B ∈ CH and HgD ∈B, eitherc^D_H,g(HgD) =HgDorc^D_H,g(HgD)6∈B.

• (strong antisymmetry) C is strongly antisymmetric if for any sequence of subgroupsH₀, . . . , H_k ∈ P,B₀ ∈C_H0, . . . , B_k ∈C_Hk, and mapsσ₁, . . . , σ_k satisfying

– σ_iis a bijective map fromBi−1 toB_i, – σ_iis of the formc^D_Hi−1,g|_Bi−1,π_H^D_i−1,H

i|_Bi−1, or(π_H^D

i,Hi−1|_Bi)⁻¹, – H₀ =H_k andB₀ =B_k,

the compositionσk◦ · · · ◦σ1is the identity map onB0 =Bk.

The notions ofP-collections andP-schemes introduced in Chapter 2 correspond to the special case thatDis trivial.

Extension of scalars ofO¯K/Rad( ¯OK). In Section 5.7–5.8, we need a family of ringsA_K,i that are obtained fromO¯_K/Rad( ¯O_K)via “extension of scalars”, whose definitions are given below.

Let K be a finite extension of K₀. The inclusion A₀ ⊆ O_K0 ,→ O_K induces an embedding of Fq ∼= A₀/pA₀ in O¯_K/Rad( ¯O_K), endowing O¯_K/Rad( ¯O_K) the structure of anFq-algebra. Fori∈N⁺, we define the tensor product

A_K,i := ( ¯O_K/Rad( ¯O_K))⊗_Fq Fqⁱ,

which is an Fqⁱ-algebra and is spanned by tensors a ⊗ b over F^q where a ∈ O¯_K/Rad( ¯O_K) and b ∈ Fqⁱ (see [AM69] for the definition of tensor products of

rings). Intuitively, the ring A_K,iis obtained from O¯_K/Rad( ¯O_K)by extending the scalars fromF^qtoFqⁱ. AndO¯_K/Rad( ¯O_K)is naturally identified with a subring of A_K,iviaa 7→a⊗1. AsO¯_K/Rad( ¯O_K)is semisimple, so isA_K,i.8 The Frobenius automorphismx7→x^qofO¯_K/Rad( ¯O_K)overFqinduces an automorphism ofA_K,i overFqⁱ sendinga⊗btoa^q⊗b. We denote this automorphism byσ_K,i.

The following lemma is also needed, whose proof is deferred to Appendix C.

Lemma 5.6. For any maximal idealmofO¯_K/Rad( ¯O_K), the grouphσ_K,iigenerated byσ_K,iacts transitively on the set of the maximal ideal ofA_K,icontainingm.

SupposeK, K⁰are extensions ofK₀ andK ⊆K⁰. Then the inclusionO_K ,→ O_K⁰ induces an embeddingι : ¯O_K/Rad( ¯O_K),→O¯_K⁰/Rad( ¯O_K⁰), which in turn induces a ring homomorphism ι⁰ : A_K,i ,→ A_K⁰_,i sending a⊗b to ι(a)⊗b. The map ι⁰ is injective since Fqⁱ is a flat Fq-module (see, e.g., [AM69, Proposition 2.19 and Exercise 2.4]). This allows us to regard A_K,i as a subring of A_K⁰_,i. Note that ι⁰◦σK,i =σK⁰,i◦ι⁰.

Finally, suppose L/K₀ is a finite Galois extension with the Galois group G. The action of G on L induces an action on O¯_L/Rad( ¯O_L), which in turn induces an action onA_L,i via^g(a⊗b) :=^ga⊗b. This action commutes withσ_L,i.9