Computing the power residue symbol

Transcription

1 Radboud University Master Thesis Coputing the power residue sybol Koen de Boer supervised by dr. W. Bosa dr. H.W. Lenstra Jr. August 28, 2016

2 ii

3 Foreword Introduction In ( this thesis, an algorith is proposed to copute the power residue sybol b in arbitrary nuber rings containing a priitive -th root of unity. The algorith consists of three parts: principalization, reduction and evaluation, where the reduction part is optional. The evaluation part is a probabilistic algorith of which the expected running tie ight be polynoially bounded by the input size, a presuption ade plausible by prie density results fro analytic nuber theory and tiing experients. The principalization part is also probabilistic, but it is not tested in this thesis. The reduction algorith is deterinistic, but ight not be a polynoialtie algorith in its present for. Despite the fact that this reduction part is apparently not effective, it speeds up the overall process significantly in practice, which is the reason why it is incorporated in the ain algorith. When I started writing this thesis, I only had the reduction algorith; the two other parts, principalization and evaluation, were invented uch later. This is the ain reason why this thesis concentrates priarily on the reduction algorith by covering subjects like lattices and lattice reduction. Results about the density of prie nubers and other topics fro analytic nuber theory, on which the presued effectiveness of the principalization and evaluation algorith is based, are not as extensively treated as I would have liked to. Since, in the beginning, I only had the reduction algorith, I tried hard to prove that its running tie is polynoially bounded. When I did not succeed, I attepted to pose soe assuptions I thought to be plausible, in order to deduce fro it that the reduction algorith is effective. I did not succeed in aking the assuptions plausible nor in deducing the effectiveness of the reduction algorith. The short research about these assuptions is placed in the appendix (see section B.2.

4 Acknowledgeents I would like to thank y supervisor, dr. Wieb Bosa of the FNWI at the Radboud University, for his unstoppable faith and enthusias. The large aount of freedo and independence that characterizes his supervision ight be overwheling for others, but for e, it was exactly what I needed. His ability to see the big picture in difficult atheatical subjects has often saved e fro losing yself in the details. Besides y advisor, I would like to thank dr. H.W. Lenstra of the Matheatisch Instituut at the Universiteit Leiden, for being an outstanding teacher and for inspiring e with any very good ideas, including two-sided reduction and principalization. With his expertise and eye for detail, he has pointed out any areas of iproveent in y thesis. My sincere thanks also go to dr. J. Bouw of the Matheatisch Instituut at the Universiteit Leiden, for allowing e to read his PhD thesis before the publication, so that I could ipleent his algorith that coputes Hilbert sybols. This heavily otivated e to think about an effective algorith to copute power residue sybols. I have good eories of y visit to Leiden, when we verified each other s coputations. I would also like to acknowledge dr. M. Kosters of the departent of Matheatics at the University of California (Irvine, for sending e a suary of Bouw s algorith that focusses on the algorithic aspect, which has been very useful for e. Furtherore, I would like to thank dr. D. Micciancio of the Coputer Science & Engineering departent at the University of California (San Diego, for giving a coprehensive answer to y question about q-ary lattices. My thesis would be full of textual istakes without the proofreaders: Elke de Boer, Els de Jong, Kris Roufs and Janneke de Wit. Many thanks for your effort. Also, any thanks to Djordy Tierans, who designed the beautiful cover of this thesis. Finally, I ust express y gratitude to y parents, to y brothers and sister, and to y partner Kris Roufs for supporting e spiritually throughout writing this thesis and y life in general. This accoplishent would not have been possible without the. Thank you. iv

5 Contents Foreword Introduction Acknowledgeents ii iii iv 1 Nuber fields and copletions Introduction Nuber fields Finite degree field extensions Nuber rings Ideal arithetic Discriinant and singular pries Local Fields and Copletions Introduction Absolute values p-adic copletions p-adic local fields Ideals and lattices Introduction Lattices Ideals as lattices Basis atrix of a lattice The Herite noral for Coputing the HNF HNF and operations on ideals Lattice reduction: LLL Introduction Reduced bases Eleent reduction odulo an ideal q-ary lattices Introduction q-ary lattices in the reduction algorith

6 2.6.3 Different inner products Power residue sybols and Hilbert sybols Introduction Power residue sybols Definition Power residue sybols in nuber rings Hilbert sybols Exploitable properties of power residue sybols Bouw s algorith Introduction Roots of unity and the weakly distinguished unit Find the Hilbert sybol fro exponential representation 48 4 Heuristic algorith for the power residue sybol Introduction Squirrel s algorith General power residue sybol Principal power residue sybol Preliinaries Notation Two-sided reduction Near-prie ideals Description of the ain algorith Outline Principalization Reduction Evaluation The correctness of the algorith Principalization correctness Reduction correctness Evaluation correctness Analysis Introduction Reduction analysis Evaluation analysis Principalization analysis Possible iproveents Coputational Results Introduction Method Reduction ethod Evaluation ethod Results Conclusion Evaluation Reduction Discussion vi

7 Appendices 75 A Data 77 B Notes 81 B.1 Introduction B.2 The QSDL-conjecture B.3 Other attepts to copute the power residue sybol C Explanation of the picture on the front cover 87 vii

8 viii

9 CHAPTER 1 Nuber fields and copletions 1.1 Introduction The ain subjects of this thesis are the power residue sybol and, to a lesser extent, the related Hilbert sybol. In order to obtain a clear understanding of these sybols, one has to be acquainted with algebraic nuber theory and its notions: nuber fields, ideals, orders, integral eleents, copletions, etcetera. This chapter will give a quick, incoplete and subjective overview of the algebraic nuber theory topics needed. For professional and coplete studies of nuber fields, I would like to recoend [Jan96] and [CF67]. Another goal of this chapter is introducing notation, to avoid isunderstandings in the reainder of this thesis. We denote the integers by Z, and the rational nubers by Q. We denote rounding to the closest integer by, and the group of invertible atrices with entries in Z by GL n (Z. 1.2 Nuber fields Finite degree field extensions Definition 1.1 (Algebraic nuber field. A nuber field is a finite degree field extension of the rational nubers Q. In this thesis, a nuber field is often denoted by the capital letter K (fro the Geran word Körper with degree n [K : Q] over the rational nubers. Also, towers of finite extensions will occur. In that case, the field above K will be called L. The extension L : K is called a relative extension, in contrast to K : Q, to which is referred as an absolute extension. In a coputational context, a nuber field L is defined by an irreducible polynoial f over its ground field K. Via the isoorphis L K[x]/f(x, any

10 2 Chapter 1. Nuber fields and copletions eleent of L can be uniquely represented by a vector (k 1,..., k n K n, with n deg f. Definition 1.2 (Galois extension. Suppose K L are both nuber fields. The finite degree field extension L : K is called a Galois extension if it is a noral extension; i.e., if for every irreducible polynoial f(x K[x] holds f(x has a root in L f(x splits in linear factors over L. Reark 1.3. Equivalently, a Galois extension L : K is a splitting field of soe polynoial f(x K[x], see [Lan05, V 3, i.p. Th. 3.3]. Every Galois extension has a Galois group G Gal(L : K associated with it, which is a subgroup of the perutation group on the zeroes of the defining polynoial. Definition 1.4 (Abelian and cyclic extensions. Suppose K L are both nuber fields. The extension L : K is called an abelian extension if it is a Galois extension with an abelian Galois group. Siilarly, an extension L : K is called cyclic when the Galois group is cyclic Nuber rings With a nuber field K one can associate a special subring of K, the ring of integers. Integers of K, also called integral eleents, are recognizable by the for of their iniu polynoial over Q [SD01, 1, Th. 1]. Definition 1.5 (Integral eleents. Let K be a nuber field. An eleent K is called integral iff there exists a onic polynoial f Z[x] such that f( 0. Definition 1.6 (Ring of integers. The ring of integers of a nuber field K is now defined as the set of integral eleents in K: O K : { K is integral }. Reark 1.7. It is not iediately clear that the above set is a ring. By exaining equivalent notions of being integral one can indeed see that the set O K is a ring containing Z, see for exaple [Jan96, Th. 2.3]. The following definition is a slight odification of the definition of an order 1 in [BS66, p. 88]. An alternative definition can be found in [Coh93, 4.6, Def ]. Definition 1.8 (Nuber ring. Let K be a nuber field of degree n [K : Q]. Then, a ring R K is called a nuber ring, if: (i R is a free Z-odule with rank n; (ii R O K. Lea 1.9. The ring O K is a nuber ring of K. A proof of this lea can be found at [Cas86, 10.3], for exaple. 1 Order is inforally a synony of nuber ring here, although any authors treat these two notions differently.

11 1.2. Nuber fields 3 Notation For a nuber ring R of a nuber field K, we define the degree of R to be the degree n [K : Q] of K. Reark In practice, a nuber ring is usually of the for R Z[θ 1,..., θ s ], with θ i O K. In this case, part (ii of Definition 1.8 is already fulfilled. Also, often one of the θ i has the property that [Q(θ i : Q] n, iplying that Z[θ i ] R is already a free, rank n Z-odule. Then, R O K is sandwiched between two free rank n odules, and is therefore [Lan05, Th. I.7.3] a free rank n Z-odule itself. In a coputational context one often uses the property that nuber rings R always have a so-called integral basis. Definition Let R be a nuber ring in K, a nuber field of degree n. An integral basis of R is an n-tuple (θ 1,..., θ n R n such that every eleent R can be written uniquely as n a i θ i with a i Z. i1 Exaple The ring Z[i] is the ring of integers of Q(i, and is therefore a nuber ring. The integers Z[i] are called the Gaussian integers. Another exaple: The ring Z[ζ 3 ] is the ring of integers of Q(ζ 3, but it contains for exaple the ring Z[ 3], since ζ As 3 has degree 2 over Q, the ring Z[ 3] ust have rank 2 over Z, and therefore Z[ 3] is a nuber ring too (but not the ring of integers of Q(ζ 3. One can straightforwardly see that (1, i is an integral basis for Z[i], (1, ζ 3 is an integral basis for Z[ζ 3 ] and (1, 3 is an integral basis for Z[ 3]. Reark Note that for a nuber ring R with quotient field K, a Z-basis (θ 1,..., θ n of R is autoatically a Q-basis of K. So, every eleent K can be written uniquely as n i1 q iθ i, with q i Q. Definition 1.15 (Multiplication atrix. Suppose R is a nuber ring in a nuber field K of degree n, and R has given integral basis (θ 1,..., θ n. Then, given K, one can construct the ultiplication atrix M M n n (Q of. Write θ i in the integral basis of R, for every 1 i n: n θ i q ij θ j. j1 One then defines the ultiplication atrix as M : (q ij n i,j1. Reark Seeing K as an n-diensional Q-vector space via the given integral basis (θ 1,..., θ n, above atrix M can be associated with the linear ap induced by ultiplication with on the vector space K. Note that M M n n (Z when R. Also, observe that M heavily depends on the given integral basis of R. Definition 1.17 (Nor and trace. Suppose K is a degree n nuber field and R is a nuber ring with given integral basis B (θ 1,..., θ n. Then, for K, we have the following fundaental invariants, called the nor and the trace of, respectively. N( : det M ; Tr( : Tr M.

12 4 Chapter 1. Nuber fields and copletions Reark The nor of an eleent K does not depend on the given nuber ring in K nor the basis choice, since change of basis (even to another nuber ring corresponds to (group-theoretic conjugation of M with a transition atrix. This does not alter the value of the deterinant, as it is a ultiplicative hooorphis fro M n n (Q to Q. The trace, however, ight depend on the chosen basis and given nuber ring. Definition 1.19 (Discriinant. Suppose K is a degree n nuber field and R is a nuber ring with given integral basis (θ 1,..., θ n. Then we define the discriinant of R by (R : det Tr(θ i θ j ij. I.e., the deterinant of the atrix with as ij-th entry the value of the trace of θ i θ j (which is in Z. Reark The discriinant is independent of the chosen basis of R, but it does depend on the nuber ring. See for exaple [Cas86, 10.3, Lea 3.2]. Notation We will denote the discriinant of the ring of integers of K by (K : (O K. Lea For a nuber field K with ring of integers O K and with a nuber ring R, we have the following identity: (R [O K : R] 2 (O K Here, [O K : R] is the index of R in O K as additive groups. Proof. This lea is a special case of [Neu99, Ch. 1, Prop. 2.12] Ideal arithetic Unique factorization Lea The ring of integers O K of a nuber field K is a Dedekind ring, i.e. it is Noetherian, integrally closed, and every nonzero prie ideal p of O K is a axial ideal. Proof. See for exaple [Neu99, I.3, Th 3.1] Reark In a Dedekind ring, every fractional ideal is invertible [AM69, Ch. 9, Th. 9.8], and every ideal factors essentially uniquely as a product of prie ideals [AM69, Ch. 9, Cor. 9.4]. Definition For a nuber field K, we denote by I K the group of (nonzero fractional ideals of O K. Reark The set I K is indeed a group, under the following ultiplication: a b : a b a a, b b i.e., ab is the ideal generated by products of eleents in a and b. The group I K has unit ideal O K (1. This is the ultiplication which is eant when one factorizes an ideal. Note that the unique factorization property has as a direct consequence that the group I K is a free Z-odule of countably infinite rank, with the prie ideals as its generators.

13 1.2. Nuber fields 5 Definition 1.27 (Valuation. Given a prie ideal p of O K, one can define the valuation v p : (I K, (Z, +, a group hooorphis. The p-valuation is defined on prie ideals 2 (the generators of I K as follows: { 1 if p q v p (q 0 if p q Reark The unique factorization property of fractional ideals in O K can now be stated as follows. Every fractional ideal f I K factors uniquely (up to order as f p p vp(f. (1.1 Factorization of (p For a prie nuber p, the ideal (p does not have to be a prie ideal in O K. In fact, in ost cases it is not, and it factorizes as a product of prie ideals: (p g i1 p ei i. (1.2 Via the inclusion Z O K, we have Z/pZ O K /p i for every factor p i in (1.2. Since both Z/pZ and O K /p i are fields, one can see this as a field extension. This leads to the following definition. Definition Let p i be a factor in the factorization of (p in the ring of integers O K of a nuber field K, as in (1.2. Then, we denote: e K/Q (p i : e i v pi (p and f K/Q (p i : [O K /p i : Z/pZ]. Reark When there is no chance of confusion, one often drops the subscript K/Q. Also, one calls e(p the raification index of p, and f(p the residue class degree. A prie ideal that occurs in the factorization of a prie nuber (p, is called a prie (ideal above p. So, in the case of (1.2, p i is a prie above p. Lea Let K/Q be a Galois extension. Then, for all p, the factorization of (p into prie ideals always has a particular for. (p g p e i, i1 and f K/Q (p i f, a fixed integer for all 1 i g. Proof. See for exaple [Neu99, Ch. 1, 9, Prop. 9.1]. Exaple Note that above lea does not ean that every prie nuber has the sae factorization properties, as the following exaple shows. Consider 2 By ultiplicative continuation, v p defines a group hooorphis I K Z.

14 6 Chapter 1. Nuber fields and copletions the nuber field K Q(ζ 5, a Galois extension of Q. It has ring of integers 3 Z[ζ 5 ]. We factorize (11 and (19 in Z[ζ 5 ], with use of [Coh93, 4.8.2]. To obtain a factorization as in (1.2, one has to factorize Φ 5 (x x 4 + x 3 + x 2 + x + 1 (the 5-th cyclotoic polynoial in F 11 [x]. We have x 4 + x 3 + x 2 + x + 1 (x + 2(x + 6(x + 7(x + 8 od 11. Therefore, (11 4 i1 p i, where p 1 (11, ζ 5 + 2, p 2 (11, ζ 5 + 6, p 3 (11, ζ 5 + 7, and p 4 (11, ζ Note that all of these prie ideals p i have the sae raification index and residue class degree. In F 19 [x], one obtains: x 4 + x 3 + x 2 + x + 1 (x 2 + 5x + 1(x x + 1 od 19. Therefore, (19 q 1 q 2, with q 1 (19, ζ ζ and q 2 (19, ζ ζ One sees that all prie ideals above the sae prie nuber p have the sae raification index and residue class degree, as in Lea Prie ideals above different prie nubers, however, do not need to have coon properties. Exaple This exaple is about a non-galois extension Q( 3 2 of Q, having ring of integers Z[ρ] with ρ 3 2 (for a proof, see [AW03, Ex , p. 153]. The factorization of prie nubers in Z[ρ] is not as in Lea The polynoial x 3 2 factors in the ring F 5 [x] as x 3 2 (x + 2(x 2 + 3x + 4 od 5 and therefore (5 p 1 p 2, with p 1 (5, ρ + 2 and p 2 (5, ρ 2 + 3ρ + 4. The first prie ideal has residue class degree 1, whereas the second has residue class degree 2. The following definition is taken fro [Coh93, Prop ]. Definition 1.34 (Nor of ideals. The nor as in Definition 1.17 can be generalized to ideals of a nuber ring R. The nor of an ideal a of R is defined as the cardinality of R/a, N(a : #(R/a. (1.3 Reark If a ( is a principal ideal (i.e., an ideal generated by one eleent, then the ideal nor coincides with the absolute value of the regular (eleent nor, as in Definition Exaple Consider the quadratic nuber field Q( 3; it has ring of integers Z[ 3]. The ideal a (2, is generated by two eleents. Clearly we have N(a 2, since a + b 3 a b odulo a, for a, b Z. Reark One can always effectively copute the nor of an ideal, since #(R/a det M a, where M a is the basis atrix of a in Herite noral for, see subsection Lea 1.38 (Properties of the nor. The nor function of a nuber ring R has the following properties: (i N( N(N(, for eleents, R; 3 Every cyclotoic field Q(ζ has Z[ζ ] as its ring of integers [Jan96, Ch. 1, Th. 10.4].

15 1.2. Nuber fields 7 (ii If R O K is the ring of integers, then N(ab N(aN(b, for any two ideals a, b of O K ; (iii If R O K is the ring of integers, and p is a prie of R, we have N(p p f, with f the residue class degree of p. Proof. See [Jan96, p , Prop. 8.1, 8.2, 8.4]. Greatest coon divisor of ideals The group I K has, besides ideal ultiplication, any other operations and one is of particular iportance in this thesis. Definition 1.39 (Greatest coon divisor of ideals. There is a greatest coon divisor operation on I K, which is denoted by +. It is defined as follows: a + b : {a + b a a, b b}. Reark As expected, this operation is fully consistent with the unique ideal factorization; if one has a p pvp(a and b p pvp(b, then a + b p p in(vp(a,vp(b, just as in Z. Note that the unique factorization of ideals is just a nuber field version of the fundaental theore of arithetic Discriinant and singular pries In practice, one obtains a nuber ring in the sense of Reark 1.11, without knowing if it is equal to the ring of integers. Finding the ring of integers of a given nuber field K is hard 4, and even the decision proble whether a given nuber ring R equals the ring of integers or not, is well-known to be hard in the worst case [Chi89]. On the other hand, finding the ring of integers in nuber fields with a defining polynoial having sall coefficients and sall degree is not that hard, in practice. Also, for larger nuber fields, effective approxiation algoriths are known [JB94]. In the ain algoriths of this thesis (Algorith 9 and Algorith 10, one does not need the full ring of integers. In the tests and the tiings of the algorith, I only used cyclotoic fields Q(ζ, where the ring of integers is known to be Z[ζ ]. In the case when one does not know if the given ring R is the ring of integers, one has to take care of the so-called singular pries. Singular prie ideals The following definition is obtained fro [Ste08, p. 13] in cobination with [Ste08, Prop. 5.4], and requires localization (see [AM69, Ch. 3]. Denote by S a ultiplicatively closed set, and by S 1 R the ring of fractions of R at the set S (see [AM69, p. 37]. Soeties, S 1 R is called the localization of R at S, despite the fact that S 1 R does not have to be a local ring at all. 4 In the article [JB94, Th. 1.3] it is proven that finding the ring of integers of a nuber field K is equally as hard as finding the largest squarefree divisor of a nuber d of which the size equals the size of K.

16 8 Chapter 1. Nuber fields and copletions Definition 1.41 (Singular prie ideals. Let K be a nuber field with O K as ring of integers, and let R be a nuber ring inside K. Let p be a prie ideal of R and let S R\p. One calls p a singular prie when the inclusion R O K induces a strict inclusion when localized at S, i.e. S 1 R S 1 O K. Definition 1.42 (Regular pries. A prie ideal p in R is called regular when it is not singular, i.e., when S 1 R S 1 O K. Reark Since p is a prie ideal inside R, S 1 R is a local ring; it is denoted by R p. On the other hand, S 1 O K does not need to be local, since it is well possible that there are ultiple prie ideals in O K that do not touch the set S (see [AM69, Prop. 3.11(iv]. Lea Suppose R is a nuber field in K with regular prie p. Then R p (O K p for soe unique prie ideal p of O K, with p R p. Proof. The going-up theore [AM69, Th. 5.10] shows the existence of such a prie p, yielding R p (O K p. As R p S 1 R S 1 O K is a Noetherian local ring of diension 1 that is integrally closed 5, it is a valuation ring inside K [AM69, Prop. 9.2]. Valuation rings are axial, and therefore R p (O K p. Reark In Lea 1.44, the prie ideal p po K suffices, when p is regular. This result can be obtained by localizing at every prie of O K ; the localization of p of R at any ideal q p of O K vanishes. Lea Suppose K is a nuber field and R be a nuber ring in K. Suppose p is a regular prie ideal in R, satisfying p R p for a prie ideal p of O K (see Lea Then the inclusion R O K induces a isoorphis R/p O K /p. (1.4 Proof. A short application of a local-global principle will do the job, see for exaple [AM69, Prop. 3.9]. Reark that the inclusion induces a ap f : R/p O K /p. Seeing those two rings as O K -odules, it is enough to show that after localization at any prie the induced ap of f is bijective. For any prie ideal q other than p, both R/p and O K /p becoe the zero ring after localization with q, and the localized ap f is trivially bijective. Localizing at p induces a bijection by the fact that p is regular, and therefore R p (O K p. Reark Note that Lea 1.46 iplies that N OK (p N R (p, as in Definition Exaple Note that for the ring of integers O K, every prie p is regular. For an exaple of a singular prie, consider p (2, in the ring R Z[ 3], a nuber ring in the nuber field K Q( 3. The ring of integers of K is O K Z[ρ] with ρ Take the prie ideal p (2 inside O K, and note that the ap R O K /p is not surjective, since the (reduction 5 Those properties are preserved under localization by a ultiplicatively closed set S [AM69, Prop. 7.3], [AM69, Prop. 5.12].

17 1.2. Nuber fields 9 of the eleent ρ is not in the iage; every eleent of Z[ 3] is of the for a + b 3 (a b + 2bρ with a, b Z. This aps under R O K /p to a b od 2. So, R/p O K /p is not surjective, and thus, by Lea 1.46, p is singular. Lea Let K be a nuber field with ring of integers O K and let R O K be a nuber ring. Suppose p, a prie above p, is singular in R. Then p [O K : R], and therefore p 2 (R. Proof. Take the ultiplicative closed set T Z\(p, and apply localization to the exact sequence 0 R O K O K /R 0, (1.5 yielding the exact sequence [AM69, Prop. 3.3] 0 T 1 R f T 1 O K T 1 (O K /R 0. (1.6 For S R\p, we have T S, and therefore S 1 (T 1 R S 1 R and S 1 (T 1 O K S 1 O K. Since S 1 R S 1 O K, we ust have T 1 R T 1 O K as well, eaning that f in (1.6 is not surjective, and in particular, T 1 (O K /R is non-trivial. Now, seeing the rings in (1.5 as Z-odules, and rearking that O K /R is then a finite Z-odule, one obtains that T 1 (O K /R is a finite Z p -odule. By the structure theore for finitely generated odules of a principal ideal doain (see for exaple [Hun03, pp. L. IV.6.11], one has: O K /R r Z/q i, where q i are powers of prie nubers. Since localizing at (p akes all Z/q i vanish when p q i, one has i1 T 1 (O K /R Z/(p ki. Together with the fact that T 1 (O K /R is non-trivial, one necessarily has p #(O K /R. The rest of the clai follows fro Lea Lea Suppose K is a nuber field with nuber ring R, that has a set of singular prie ideals S. Suppose a 0 is an ideal in R with p + a R for all p S (i.e., no singular prie divides a. Then a can uniquely be decoposed as a product of regular prie ideals: r i0 a p/ S p np (1.7 Proof. According to [AM69, Prop. 9.1], each nonzero ideal of R can uniquely be expressed as a product of priary ideals, whose radicals are all distinct. a n q i. i1

18 10 Chapter 1. Nuber fields and copletions Suppose q i is a p-radical ideal. Since p is an ideal above a regular prie p, the ring R p is a discrete valuation ring [CF67, p. 6, Prop. 1]. In such rings, every ideal is a power of pr p. So, (q i R p (pr p j, for soe j > 0. At all other localizations, both q i and p vanish. Using the global-local property [AM69, Prop. 3.8], we have q i p j, see also [AM69, Th. 9.3]. Applying this reasoning to each priary ideal, we obtain a factorization of a in prie ideals, which is unique by the sae reasoning as in Dedekind rings, see [Neu99, Th. 3.3, p. 18]. Reark Note that Lea 1.49 does not yield a procedure to find singular pries, other than factoring the discriinant (R, but is very useful when one wants to avoid singular pries, which indeed is needed in Algorith 8 and Algorith 10 of this thesis. For an eleent R, one can calculate d gcd(n(, (R. There are two cases. (i d 1, which eans that does not have a singular prie in its factorization. Therefore, the ideal ( has unique factorization into prie ideals, aking it suitable for the naive coputation of the power residue sybol, see Definition 3.4. (ii d 1, which eans that one has likely a partial factorization of (R. This is coputationally profitable, since this brings us closer to finding the ring of integers, or proving that R is the ring of integers of K. Also, one can calculate d gcd(n( 2, (R, and copute c : d /d. (a If c 1, then none of the singular pries divide N(, which eans that has also unique factorization into prie ideals. (b If c 1, it is possible that does not have unique prie ideal factorization in R, aking unsuitable to calculate with, since the power residue sybol above is then undefined (see Definition Note that factorization of c gives possibly singular pries, which allows us to enlarge the ring R, eaning that it will becoe closer to O K. 1.3 Local Fields and Copletions Introduction In this thesis, one needs the definition of the Hilbert sybol. This sybol is defined over local fields, which arise naturally as copletions of nuber fields. A short outline about copletions, local fields, and their relation with nuber fields will be treated in this section. Also, soe coputational issues in local fields will be discussed. For a thorough treatent, I would like to recoend [Cas86], [Jan96] or [Wei98] Absolute values Just as one obtains R fro Q by copletion, one also can ake a copletion of a nuber field, in a siilar way. As copletion is a topological construct, one

19 1.3. Local Fields and Copletions 11 first needs a topology on the nuber field K in this case, a etric topology. The following definition is obtained fro [Chi07, p. 9, p. 64]. Definition 1.52 (Absolute value. Suppose K is a nuber field. A function : K [0, is called an absolute value if (i 0 if and only if 0; (ii for all, K; (iii There is a constant C R 1 such that 1 + C when 1. An absolute value as above induces a etric topology on K with neighbourhoods of the for { K < ɛ} for ɛ R +. Definition 1.53 (Equivalent absolute values. Two absolute values 1, 2 : K [0, are called equivalent when 1 c 2 for soe c R\{0}. Reark Equivalent absolute values induce the sae topology on K. In this thesis, we exclude the trivial absolute value, that has value 1 everywhere. Note that for every absolute value 1 on K, there exists c R\{0} such that 2 : c 1 satisfies the triangle identity: Definition 1.55 (Places. A place of K is an equivalence class of absolute values, with equivalence as in Definition 1.52 denoted by. We define the set of places of K as { } V K : is an absolute value on K /. Theore 1.56 (Ostrowski. All places of a nuber field fall into one of the following categories: (i The p-adic places. They contain an absolute value defined by p : N(p vp(, with v p the p-adic valuation as in Definition 1.27, and the nor N of an ideal as in Definition These are also called the non- Archiedean, finite or discrete places of K. (ii The infinite real places. They contain an absolute value defined by a real ebedding σ : K R, with: σ : σ( R, where R is the standard real absolute value of R. (iii The infinite coplex places. They contain an absolute value defined by a pair of conjugate coplex ebeddings σ, σ : K C. The absolute value is then σ σ σ( 2 C, with a + bi 2 C a2 + b 2, the standard etric on C. Proof. A proof can be found in [ZH80, Ch. 13]. Reark If we speak about the places above, we will always associate the standard absolute value with it. These are the absolute values as described in Theore 1.56.

20 12 Chapter 1. Nuber fields and copletions p-adic copletions A nuber field is not topologically coplete. In order to ake the nuber field K coplete with respect to an absolute value, one can construct the copletion of K. Definition 1.58 (Cauchy and null sequences. A sequence ( i i0 is called a Cauchy sequence with respect to if we have: For all ɛ > 0 there exists N N such that for all n, N holds n < ɛ. A sequence ( i i0 is called a null sequence with respect to if we have: For all ɛ > 0 there exists N N such that for all n N holds n < ɛ. Definition 1.59 (Copletion. Suppose K is a nuber field and an absolute value on K. We define the following abelian additive group (under row-wise addition C : {( i i0 ( i i0 is a Cauchy sequence w.r.t. } and the following subgroup N : {( 1 i0 i i0 is a null-sequence w.r.t. }. Then the copletion K of K with respect to the absolute value is defined as the following quotient group: K : C/N. Lea The group K is a coplete field with ultiplication defined row wise, and has K as a subfield. Proof. See for exaple [Jan96, Ch. 2, Th. 2.1]. Reark One denotes K p for the copletion of a nuber field with respect to the p-adic etric. Also one uses the notation K σ for the copletion with respect to the absolute value defined by the ebedding σ (inside the real- or the coplex nubers. Note that K σ R when σ is a real ebedding and K σ C if σ is a coplex ebedding. The above abstract construction ight not appeal to one s ind intuitively, and is in fact very rarely used in a coputational context. In the next section, we will explain how one copes with such fields in an algorithic context. The following theore, of which a generalization is stated in [Jan96, Ch. 2, Th. 2.2], already gives an idea how a copletion looks like. Lea 1.62 (Extension of Q p. Suppose K is a nuber field and p is a prie ideal of O K above a prie nuber p. Then, K p is a finite extension of Q p, the p-adic nubers. Reark Lea 1.62 also works the other way around; every finite extension of the p-adic field Q p is isoorphic as a topological field to a copletion of a nuber field [Koc97, p.55 56]. So, in soe sense, there is no difference between copletions of nuber fields and finite extensions of the p-adic rationals.

21 1.3. Local Fields and Copletions p-adic local fields Definition 1.64 (p-adic local fields. A p-adic local field is a copletion of a nuber field with respect to the p-adic absolute value. Reark A p-adic local field K p has a valuation ring with unique axial ideal R : { K p p 1}, : { K p p < 1}. Moreover, this axial ideal (π is a principal ideal in R, and π is called a uniforizer of. It can be obtained by taking an eleent K with p\p 2, and taking the iage of under the inclusion K K p [Jan96, Prop. 2.4]. Lea Given a syste of representatives S (with 0 S of R/, every eleent K p has a unique (possibly infinite expression as a power series with s i S, s 0 0 and r Z. π r i0 s i π i, Proof. See, for exaple [Jan96, Prop. II.2.8] or [Koc97, Prop. 1.70]. Notation In the reainder of this thesis, F denotes a local field that is a finite extension of Q p. We will denote by O F the ring of integers and by F (π F the unique axial ideal. Also, we denote F F O F / F. Soeties, we will denote the F -valuation of an eleent in F by v F : F Z. Of course, the subscript F will be dropped when there is no confusion about the local field. Definition Let E : F : Q p be a tower of finite extensions, then we define f(e/f [F E : F F ] [O E / E : O F / F ], e(e/f v E (p F, for the residue class degree and the raification index, respectively. Reark For a copletion K p of a nuber field K, we have e(k p /Q p e(p and f(k p : Q p f(p [Jan96, Th. II.3.8], with f(p and e(p as in Definition Therefore, the fact that those invariants have the sae nae will not lead to conflicts. Lea Suppose K is a nuber field and p a is prie in O K. Then the extension K p : Q p has degree e(p f(p. K p e(pf(p K Q p Q n

22 14 Chapter 1. Nuber fields and copletions Proof. See for exaple [Jan96, II, Th.3.8]. Reark Also for an arbitrary extension F : Q p, i.e., if F is the copletion of soe unknown nuber field, the equality [F : Q p ] e(f/q p f(f/q p is still valid. Notation For a tower of finite extensions E : F : Q p, the extension E : F is called unraified when f(e/f [E : F ] and it is called totally raified when e(e/f [E : F ]. An extension is not necessarily either unraified or totally raified, it can be soe ixture of these two. Definition 1.73 (Raified representation. A finite extension F : Q p is given in a raified representation if one has a subfield E F, such that F : E is totally raified and E : Q p is unraified. F e E f Q p Lea 1.74 (Raified Representation. Every finite extension F : Q p has a raified representation F : E : Q p. Proof. We follow [Wei98, Th ] in cobination with [Wei98, Th ]. We can choose a generator of the extension [F F : F Qp ], and denote it γ. Calculate its iniu polynoial over F Qp F p, with linear algebra techniques. Then lift this polynoial to Z[X], and denote it f(x. This will be the defining polynoial for E : Q p. With Newton approxiation [Wei98, 3-1], one can find an eleent γ F such that f(γ 0. So, E Q p (γ F. Now, take π F F, a generator of the axiu ideal F. Seeing F as an E-vectorspace, one can obtain the iniu polynoial g(z E[z] of π F over E, which is an Eisenstein polynoial [Wei98, Th ]. Reark The inclusion K K p is generally given by the power series expression of Lea Taking the representative set S Z + Zγ + + Zγ f 1, and taking an eleent π K that lies in p\p 2, one can write, for every K, π r i0 s i π i. This can be done in the following way. First assue r 0, otherwise divide by an appropriate power of π. Then, find an eleent s S such that s p, and divide s by π, etcetera, until a suitable precision is reached.

23 1.3. Local Fields and Copletions 15 Definition 1.76 (Teichüller ap. Any extension F : Q p with residue class degree f, has a priitive p f 1-th root of unity [Jan96, Th. II.3.9], which is in fact a Newtonian lift of a generator of the residue field F F. Writing µ for the -th roots of unity, we have µ p f 1 F. We denote by ω : F F µ p f 1 F the Teichüller ap, which takes the Newton lift of the eleents in the residue field. Definition 1.77 (Tae and wild raifications. Let F : Q p be a finite extension. We call F : Q p taely raified (or tae when p e(f/q p. On the other hand, we call F : Q p wildly raified when p e(f/q p. Lea Suppose R is a nuber ring in a nuber field K, or a ring of integers of an extension F : Q p. Suppose ζ R. Then, for any prie ideal p of R with p, we have an injection: ζ µ R/p Proof. Suppose ad absurdu that ζ j ζ k 0 odulo p for soe j k. Multiplying with an appropriate power of ζ gives 1 ζ i 0 odulo p, for soe i 0. That is, p 1 ζ. i Using f(x x x + 1 i1 (x ζi, we can conclude that p f(1, contradiction. Therefore, the reduction ap µ R/p is injective. Reark In particular, µ (R/p is a ultiplicative subgroup of (R/p, and therefore #(R/p 1 N(p 1.

24 16 Chapter 1. Nuber fields and copletions

25 CHAPTER 2 Ideals and lattices 2.1 Introduction The ain coponent of the heuristic reduction Algorith 9 in this thesis is Lenstra-Lenstra-Lovász lattice reduction, often called LLL-reduction. This polynoial tie reduction algorith [LLL82] gives a relatively good solution to the shortest vector proble (SVP, which is an NP-hard proble [EB81], [Ajt98]. The heuristic algoriths 9 and 10 in this thesis use the greatest coon divisor of ideals, which is calculated by applying the Herite noral for to the basis atrices of those ideals [Coh93, p. 67]. In order to explain those crucial ingredients, I need soe notation and definitions. 2.2 Lattices Although there are any different ways to define lattices [CS99, p. 3, p. 42], I will use the following fro [Coh93, p ], which is preferable because of its siplicity and conciseness. Definition 2.1 (Bilinear for. Let V be an F -vector space, with F Q or R. Then the ap b : V V F is called a positive-definite (syetric bilinear for if: (a b(, v 0 : V F is a linear ap, for fixed v 0 V ; (b b(v, w b(w, v; (c b(v, v > 0 for all v V \{0} (positive definite. Definition 2.2 (Lattice. A lattice L is a free Z-odule of finite rank, together with a positive definite bilinear for on the R-vector space L Z R.

26 18 Chapter 2. Ideals and lattices Notation 2.3. If we replace R by Q in Definition 2.2, then we call L a Q-lattice. Notation 2.4. For L a lattice with bilinear for b, we will denote v b b(v, v for the b-length of the vector v L. When one has a basis B of L, one can enrich L with the Euclidean nor. One then writes v 2 for the Euclidean vector length, which equals v v2 n, where (v 1,..., v n is v written on the basis B of L. Definition 2.5. An n-diensional lattice L is called an integral lattice if a basis is given by the rows of a atrix M M n n (Z. Definition 2.2 could be considered as quite abstract, since a lattice is often just represented by an integer-valued atrix together with the standard inner product as the bilinear for. In this thesis, it is not uch different; the following exaple gives you an idea how lattices will be treated here. Exaple 2.6. Let L be the lattice Z-generated by the rows of the following atrix, together with the standard inner product on L Z R: M The group L is a Z-odule, and it is free of rank 4, because it can be sandwiched between two free odules of rank 4: L 5 M L 1, where L 5 is the lattice generated by 5 I, and L 1 the lattice generated by I. Here, I is the unit atrix with diension 4. In fact, any lattice can be viewed as an integer-valued atrix together with an inner product [Coh93, p. 80]: since L is free Z-odule of finite rank, it has a finite Z-basis, say: {b 1,..., b n }. Then, one can write every eleent x L as a Z-linear cobination of those basis eleents: x n v i b i with v i Z. i1 Therefore, such an x can be represented by v (v 1,..., v n Z n. Note that this representation heavily relies on the choice of the basis. Taking y L, represented by w (w 1,..., w n, the bilinear for b on L satisfies: n n b(x, y b v i b i, w j b j i1 j1 n i1 j1 n v i w j q ij where q ij b(b i, b j,

27 2.2. Lattices 19 which equals w 1 [ ] w 2 v1 v 2... v n Q. with Q (q ij. w n The atrix Q gives rise to an iportant invariant of the lattice L. Definition 2.7 (Deterinant of a lattice. Let L be a lattice, with a bilinear for b. Choose a basis {b 1,..., b n } of L and set Q (b(b i, b j. Then, the deterinant of the lattice is the following real invariant: (L det(q. The definition of (L is independent of base change; a change of basis fro (c 1,..., c n to (b 1,..., b n coincides with ultiplying the vectors v Z n with a transition atrix M c b GL n (Z. So, if v represents the eleent x L with respect to the chosen basis (c 1,..., c n, then the vector M c b v represents the sae eleent x L but now with respect to the other basis (b 1,..., b n. Let Q be the sae atrix as in the description above, then: b(x, y (M c b v T Q (M c b w v T M T c bqm c b w v T Q w with Q M T c b QM c b. Since M c b is in GL n (Z, and those atrices have deterinant ±1, we conclude that det Q det Q. Also, Q is necessarily a positive definite atrix, by definition, and therefore det Q has to be positive, aking det Q a real nuber. So, in short, the deterinant of a lattice is well defined. Note that the deterinant of the lattice clearly depends on the chosen bilinear for on L. Exaple 2.8. Using the sae lattice as in Exaple 2.6, one sees that B (b 1,..., b 4 ((4, 3, 2, 1, (4, 2, 1, 1, (5, 0, 0, 0, (0, 5, 0, 0 is a basis for L, because 5(b 1 b 2 b 4 (0, 0, 5, 0, and 5b 1 4b 3 3b 4 2(0, 0, 5, 0 (0, 0, 0, 5. Calculating inner products yields the following atrix Q (q ij : Q with deterinant , so the lattice L has deterinant det L The invariant (L also has a ore intuitive geoetrical interpretation; it is the volue of the parallelepiped solid inside L R, spanned by a basis of L: S : {r 1 b r n b n 0 r i < 1}. This parallelepiped is often referred to as the covolue of the lattice and is denoted by V/L, where V L R. Now, we will end this section with a useful lea, that helps us calculate the deterinant of an integral lattice in an easier way.

28 20 Chapter 2. Ideals and lattices Lea 2.9. For a full rank lattice L generated by an integral atrix M, together with the standard inner product, we have (L #(Z n /L. Proof. See [Cas97, p. 14, L. 1] or [PZ89, 3.2, L. 3.6]. 2.3 Ideals as lattices Basis atrix of a lattice Suppose we have a nuber field K of degree n, with soe nuber ring R K. Since R is a Q-lattice inside K, it has a Z-basis, (b 1,..., b n. After the choice of this basis, we have Zb Zb n R, as Z-odules. So, in this particular way, R is identifiable with the lattice generated by I n (the unit atrix in diension n. An ideal a of R is a sublattice of the lattice of R, and can therefore be expressed in a basis of its own: (c 1,..., c n. Since each of those basis eleents c i are in R, one can write the as a linear cobination of the basis (b 1,..., b n : c i n t ij b j, j1 eaning: c 1. c n T b 1. b n with T (t ij an integer valued atrix. So, in fact, the atrix T expresses the basis of a on the basis of R. Definition A atrix T a that expresses a Z-basis of the lattice a in the chosen Z-basis of the lattice R, is called a basis atrix of a. In a coputer algebra syste like Maga or Sage, ideals are often represented by a basis atrix, after a fixed basis choice of R. The disadvantage of the above definition is that a basis atrix is not unique, since it clearly depends on the basis of a. Also, such a atrix T can have large entries, aking it unpleasant to calculate with. Lea Let b be an ideal of O K, and let L b be the ideal lattice generated by the basis atrix of b, with respect to soe integral basis of O K. Then one has detl b N(b. Proof. Let n [K : Q]. The group Z n /L b is then canonically isoorphic to O K /b. According to Lea 2.9, we have detl b #(Z n /L b #(O K /b N(b.

29 2.3. Ideals as lattices The Herite noral for To ensure uniqueness of the basis atrix and to obtain good atrix properties, ost coputer algebra systes use the Herite noral for, abbreviated the HNF. The following definition is adapted 1 fro [Coh93, p. 67]. Definition 2.12 (Herite noral for. An n integer valued atrix M ( ij is in Herite noral for if there exists an r and a strictly increasing ap f : {1,..., r} {1,..., n} satisfying the following properties. (a The last r rows of M are equal to zero; (b i,f(i > 0 for 1 i < r; (c i,j 0 when j < f(i; (d 0 j,f(i < i,f(i for j < i. The above definition is quite foralistic and does not really appeal to one s iagination. In the case that M is a full rank n n integer valued atrix, Definition 2.12 siplifies drastically. Lea 2.13 (Herite noral for for full rank square atrices. A full rank integer valued n n atrix M ( ij is in Herite noral for if (i M is upper-triangular; (ii The diagonal entries of M are strictly positive; (iii For i < j we have 0 ij < jj, i.e., every upper-diagonal entry is (strictly saller than the diagonal entry in its colun. Proof. Following Definition 2.12, we have n in this case. Therefore r 0 and f id, since f is strictly increasing. Then the upper-triangle for of M follows fro part (c of Definition 2.12, positiveness of the diagonal entries fro part (b and property (iii is a direct translation of part (d of Definition Figure 2.1: A atrix plot of a atrix in Herite noral for. More red eans a larger nuber (in absolute value. Also full rank n-atrices with n in Herite noral for have a shape that is easy to describe. 1 In the literature, ost authors differentiate between row-hnf and colun-hnf. Cohen uses colun-hnf, whereas I prefer row-hnf, so I altered the definition soewhat.

30 22 Chapter 2. Ideals and lattices Lea 2.14 (Herite noral for for full rank atrices. A full-rank integer valued n atrix M ( ij with n is in HNF if (i The last n rows are zero; (ii The first n rows for a square atrix in HNF (as in Lea Proof. The rank of M is equal to n, so M has at least n nonzero rows, so r n, with r as in Definition Because f is strictly increasing, it is in particular injective. Therefore, r n, which is equivalent to n r. So, we can conclude r n, which proves (i. Note that this directly iplies that f id and, thus, with the sae arguents as in Lea 2.13, the upper square subatrix of M is in Herite noral for. Exaple The following atrices are in HNF: , and The left atrix clearly satisfies the requireents of Lea 2.13, and the iddle atrix satisfies Definition 2.12 with r 1, f(1 1, f(2 3, f(3 5. Note that this atrix is not a full rank one. The right atrix is clearly in HNF as in Lea Coputing the HNF The proof of the following theore about the Herite noral for partially consists of an algorith, which is adapted fro [Coh93, p. 67]. The theore is stated in its full for, whereas only a short outline of the HNF-algorith is given, for sake of brevity. Theore Let M be an n integer-valued atrix, then there exists a unique n atrix H in Herite noral for such that H UA, with U GL (Z. Proof. Algorith 1 ensures the existence of such an Herite noral for; and since every row operation used is representable by a GL (Z-atrix, one can conclude that H UA for soe U GL (Z, where U is just the product of these row operations. Suppose H UA and H U A, then H U U 1 UA U U 1 H. Writing U U U 1, one sees: For uniqueness it is sufficient to prove that H UH for soe U GL (Z iplies H H. Both H and H are in Herite noral for; we denote the corresponding strictly increasing functions with f respectively f and the aount of zero-rows at the botto with r respectively r. The row rank of the atrices H and H are r, r respectively. Since a atrix U GL (Z does not alter the row rank, we iediately conclude r r. So, f and f have the sae doain and codoain. The strictly increasing property of f and f iplies that U ust be a upper triangular atrix and with the fact that U GL (Z and that the