Modular composition modulo triangular sets and applications

Transcription

1 Moular composition moulo triangular sets an applications Arien Poteaux Éric Schost : Computer Science Department, The University of Western Ontario, Lonon, ON, Canaa : UPMC, Univ Paris 06, INRIA, Paris-Rocquencourt center, SALSA Project, LIP6/CNRS UMR 7606 France October 27, 2010 Abstract We generalize Kelaya an Umans moular composition algorithm to the multivariate case. As a main application, we give fast algorithms for many operations involving triangular sets (over a finite fiel), such as moular multiplication, inversion, or change of orer. For the first time, we are able to exhibit running times for these operations that are almost linear, without any overhea exponential in the number of variables. As a further application, we show that, from the complexity viewpoint, Charlap, Coley an Robbins approach to elliptic curve point counting can be competitive with the better known approach ue to Elkies. Keywors Triangular set, moular composition, power projection, finite fiels, complexity 1 Introuction Our purpose in this paper is to give complexity results for operations involving triangular sets. We start by recalling the efinition. Triangular sets. Let F be our base fiel, an let Y = Y 1,..., Y s be ineterminates over F; we orer them as Y 1 < < Y s. A (monic) triangular set T = (T 1,..., T s ), for the given variable orering, is a family of polynomials in F[Y] with the following triangular structure: T s (Y 1,..., Y s ) T. T 1 (Y 1 ), 1

2 such that for all i, T i is monic in Y i, an T i is reuce moulo T 1,..., T i 1. Note that T is a zero-imensional lexicographic Gröbner basis for the orer Y 1 < < Y s, with a triangular structure. Such representations can be use to solve systems of equations, whereby the solution set is escribe by one, or several, triangular set(s) as above (or generalizations thereof, calle regular chains, that are well suite to situations of positive imensions). There exists a vast literature eicate to algorithms with triangular sets, regular chains, an applications: without being exhaustive, we refer the reaer to [25, 5, 33, 24, 40]. In this paper, we will be concerne with some basic subroutines at the heart of these algorithms: multiplication, inversion, norm computation moulo a triangular set, as well as change of orer on the variables. It is easy to show examples, involving very few variables, where these operations are useful. The following is taken from [35]: suppose that we wish to fin a factor of the selfreciprocal polynomial T 1 = Y 6 5Y 5 + 6Y 4 9Y 3 + 6Y 2 5Y + 1. The set of roots of T 1 is globally invariant uner the map α 1, so the function α α + 1 is invariant for this α α action. Hence, it is natural to introuce the bivariate triangular set T T 2 = Y 2 (Y Y 1 ) mo T 1 = Y 2 (Y 5 1 5Y Y 3 1 9Y Y 1 5) T 1 (Y 1 ) = Y 6 1 5Y Y 4 1 9Y Y 2 1 5Y Now, change the orer of Y 1, Y 2 in T; we obtain another triangular set that generates the same ieal: Y1 2 Y 2 Y Y2 3 5Y Y We factor the last polynomial as Y2 3 5Y Y = (Y2 2 4Y 2 1)(Y 2 1), an keep for instance the factor Y2 2 4Y 2 1. Then, we restore the initial orer in the system. This yiels Y 2 + Y1 3 4Y1 2 4 Y1 4 4Y1 3 + Y1 2 4Y 1 + 1, where we can rea off a factor of the initial polynomial T 1. Hence, through change of orer, we were able to halve the egree of the polynomial to factor. The last section of this paper will present a less trivial application of this iea to elliptic curve point counting. Complexity issues. Despite a growing literature, the complexity of the former operations remains imperfectly unerstoo. For instance, in the previous example, it is not clear a priori that the cost of change of orer woul not offset the gains obtaine by reucing the egree in the factorization. To measure costs, we will write i = eg(t i, Y i ), an = ( 1,..., s ) will be calle the multiegree of T. Then, δ = 1 s is the natural complexity measure associate to computations moulo T, as it represents the imension of F[Y]/ T. The objective of our work is to give algorithms with a running time linear in δ, up to logarithmic factors. The simplest non-trivial question is multiplying two polynomials A, B moulo T, assuming A an B are initially reuce moulo T. As of now, there is no known algorithm 2

3 with a quasi-linear cost. For instance, the moular multiplication algorithm of [31] starts by expaning the prouct AB, then reuces it moulo T. As a result, an overhea exponential in the imension appears: after expansion, the prouct AB has δ = (2 1 1) (2 s 1) monomials; we always have δ 2 s δ an in the extreme case 1 = = s = 2 we have. Presently, the best generalist algorithm is that of [31], with a cost of 4 s δ base fiel operations, up to polylogarithmic factors; see also [9] for some particular cases. The next question is that of inversion moulo T, when possible. The best previous known result for this question [15] also has a cost of the form K s δ, up to polylogarithmic terms, for some (large) constant K. It shoul be pointe out that this algorithm oes more than inversion: it allows one to hanle zero-ivisors moulo T, by splitting T when neee. Next, we consier norm computation: by analogy with the case of fiel extensions, the norm of an element A in F[Y]/ T is the eterminant of the enomorphism of multiplication by A moulo T ; it coincies with the iterate resultant res Y1 ( (res Ys (A, T s )... ), T 1 ), which is use for instance in algorithms for parametric systems [45]. We o not know of a publishe complexity estimate for this question; the techniques of [15] coul possibly be applie an yiel a result of the form K s δ (up to the usual polylogarithmic factors). The former algorithms run in quasi-linear time when s is fixe: the challenge is to remove the exponential overhea in s. For our last question, change of orer, the situation is much worse. On input T, this problem consists in fining a triangular set T for a new variable orer, that generates the same ieal as T (provie such a T exists). As of now, there is no quasi-linear algorithm for this task, even when the number of variables is kept constant (actually, even for s = 2). δ = δ log 2 (3) Moular composition an power projection. A main ingreient for the algorithms to follow are operations calle moular composition an power projection. These operations are well-known for univariate polynomials [11, 43], in which case they respectively rea as follows: moular composition: given polynomials G, H in F[Y ], with eg(g) < an eg(h) =, an F in F[X], with eg(f ) < e, compute F (G) mo H power projection: given polynomials G, H in F[Y ], with eg(g) < an eg(h) =, an F-linear form τ : F[Y ]/H F, an a boun e, compute τ(g i mo H) for all i < e. Over an abstract fiel (in an algebraic complexity moel), no quasi-linear algorithm is known for these operations: the most well-known results are ue to Brent-Kung [11] an Shoup [43], with a cost of O( (ω+1)/2 ) for e =, where ω is a feasible exponent for matrix multiplication (here we assume ω > 2, otherwise logarithmic factors appear). For the best known value of ω = 2.37 [14], we get an exponent of about Huang an Pan showe that using rectangular matrix multiplication, one can reuce the exponent to 1.67 [23]. The starting point for this work is a recent result by Kelaya an Umans [29]: when F is a finite fiel, they came up with quasi-linear time algorithms for these problems, in a boolean RAM moel (where bit operations, not fiel operations, are counte). They actually o more, by consiering an m-uple (G 1,..., G m ) of polynomials instea of G, an 3

4 computing respectively F (G 1,..., G m ) mo H, for some multivariate F, or values of the form τ(g a 1 1 G am m ). Part of our tasks will be to exten these results to multivariate situations. Inee, it has been known for long that moular composition an power projection are important for algorithms involving triangular sets: this is in essence in [43] for some particular cases, an etaile in [35]. To state the multivariate versions, we nee the following notation: for = ( 1,..., s ) in N s, F[Y] enotes the F-vector space of polynomials F F[Y] with eg(f, Y i ) < i for all i s. If T is a triangular set of multiegree in F[Y], R T will represent the resiue class ring F[Y]/ T. Remark that R T F[Y] as a vector space; as a consequence, in all our algorithms, elements of R T are represente on the monomial basis {Y a 1 1 Ys as 0 a i < i for all i}. Then, multivariate moular composition, with parameter e = (e 1,..., e m ) N m, is the following problem: multivariate moular composition: given T, F in F[X 1,..., X m ] e an (G 1,..., G m ) in R m T, compute F (G 1,..., G m ) R T. Remark that the classical version of this question has m = s = 1, an Kelaya-Umans result has m arbitrary an s = 1 (uner some restrictions on e). Remark also that in the particular case m = 1 an F = X1, 2 moular composition boils own to squaring moulo T, so it is alreay non-trivial. To iscuss power projection, we let RT = Hom F(R T, F) be the ual of R T over F; naturally, the elements of RT will be given on the ual basis of the monomial basis seen before. Then, the multivariate version of power projection, with parameter e as above, reas as follows: multivariate power projection: given T, (G 1,..., G m ) in RT m an τ in R T, compute the values τ(g a 1 1 G am m ), for 0 a i < e i, i = 1,..., m. Moular composition is F-linear in the coefficients of F ; the transpose map is precisely power projection (this was note in [43] in the univariate case). Inee, the former problem amounts to multiplying the δ δ e matrix M whose columns are the coefficients of the polynomials G a 1 1 G am m mo T, for 0 a 1 < e 1,..., 0 a m < e m, by the δ e 1 column vector of coefficients of F. Then, the ual problem amounts to multiplying the matrix M on the left by a 1 δ vector, which we see as the coefficient vector of a linear form τ RT. Main results. We will revisit the questions for triangular sets iscusse previously, an provie new estimates, uner the aitional assumptions that (i) the base fiel is a finite fiel F q an (ii) T is a raical ieal, in which case we say that T is squarefree. The following notation is in use: if S is a set an g is a real-value function on S, plog(g) enotes a real-value function h on S for which there exists α, β > 0 such that h(s) α log 2 (max(g(s), 2)) β hols for all s in S (so using this notation allows us to omit big-os). If we o not inicate otherwise, the constant α implie in a plog( ) is universal; if 4

5 it oes epen on some parameters (typically a parameter ε), we inicate them in subscript. The constant β will always be universal (it won t epen on any parameter such as ε). Our algorithms crucially rely on Kelaya an Umans results cite previously [29]. As a consequence, the complexity results are expresse in a similar manner: typically, for any ε > 0, one can obtain a running time of the form δ 1+ε log(q) plog ε (log q), with a (large) constant hien in the term plog ε (log q). As in [29], these results are expresse in a boolean RAM moel (we may e.g. use the logarithmic cost moel [2]). To be complete, we must precise how the elements of F q are encoe: elements of F p, for p prime, are represente as integers in {0,..., p 1}; for q = p n, F q is assume to be given as F p [T ]/ P, with P irreucible, so elements of F q are represente as polynomials over F p of egree less than n. With this representation, arithmetic operations in F q can be one in time log(q) plog(log(q)) in our RAM moel (isregaring the cost inuce by fetching an storing ata, which epens on the ata location in memory). The algorithms are Las Vegas (we give expecte running time, but results are always correct), as we rely on the ranom selection of fiel elements. Thus, we assume that our RAM can prouce a ranom integer uniformly istribute in the range {0,..., p 1} in time log(p) plog(log(p)). Finally, for moular composition an power projection, we a the constraint that e be of the form e = (e 1, e 2 ), that is, we take m = 2: this covers the most useful applications. Theorem 1. Fix ε > 0. Given a triangular set T of multiegree = ( 1,..., s ) in F q [Y 1,..., Y s ], one can o the following using an expecte s 2 δ 1+ε log(q) plog ε (log q) bit operations: test whether T is squarefree, if T is squarefree, multiplication, invertibility test an inversion, norm computation in R T. With notation as above, for e = (e 1, e 2 ) in N 2, one can o the following using an expecte s 2 (δ + δ e ) 1+ε log(q) plog ε (log q) bit operations: if T is squarefree, moular composition an power projection moulo T, with parameter e. We continue the presentation of our results with change of orer. For this question, we will nee a stronger assumption than before: the characteristic of F q must be large enough. Theorem 2. Fix ε > 0. Given a squarefree triangular set T of multiegree = ( 1,..., s ) in F q [Y 1,..., Y s ], one can o the following using an expecte s 2 δ 1+ε log(q) plog ε (log q) bit operations, provie the characteristic of F q is greater than δ : given a target orer Y σ(1) < < Y σ(s) on the variables, etermine whether the ieal T is generate by a triangular set T for this orer; if so: 5

6 compute T ; given A in R T, compute its image in R T ; given A in R T, compute its image in R T. Comments an relation to previous work. For most items above, except moular composition an power projection, the input an output bit sizes are essentially δ log(q); for moular composition an power projection, the input an output have bit size (δ + δ e ) log(q). Thus, our cost estimates of respectively s 2 δ 1+ε log(q) plog ε (log q) an s 2 (δ + δ e ) 1+ε log(q) plog ε (log q) are close to linear. The term s 2 is rather inconsequential. In many cases, we can make the assumption that i 2 for all i. Inee, if i = 1, T i has the form Y i r i (Y 1,..., Y i 1 ) so if they are not essential to the problem at han, Y i an T i can be ismisse altogether. Uner this assumption, s becomes logarithmic in δ. For a fixe ε, recall that the constant factor in the term plog ε (log q) is fixe as well. Thus, for multiplication an inversion, our results complement former ones: in a fixe number of variables, previous results of the form K s δ plog(δ ) operations in F are marginally better, as they o not involve the factor δ ε ; our results get better when s grows large with respect to δ, for instance when i = 2 for all i. In this case, our results are of the form δ 1+ε (forgetting about the epenency in q), whereas no previous result i better than δ log 2 (3). For moular composition an power projection, our results exten those of [29], which hol only for s = 1 (those results actually cover ifferent cases for e than we o: they have e = (e,..., e)). Other results known for s > 1 are in [43] an [27], which have m = 1 an s = 2, an [35], which iscusses m = 2 an s = 2. These last works are base on Brent an Kung s iea, so the best cost they can obtain has the form δ (ω+1)/2, for δ e δ. For change of orer, the situation is similar: no previous algorithm achieve a quasilinear running time, even in the simplest case s = 2. Some previous approaches are base on resultant an gc computations [10], but it is unknown how to obtain a subquaratic cost in δ with such techniques: on examples such as the one given at the beginning of this introuction, even using a fast resultant algorithm, known techniques (either evaluation / interpolation or irect approaches [37]) take quaratic time. The algorithms in [35] (which are limite to s = 2) use moular composition an power projection as we o; however, they rely on the techniques inspire by Brent an Kung s algorithm iscusse above, with a cost of orer δ (ω+1)/2. Main ieas an practical aspects. For both Theorems 1 an 2, the iea is to introuce a primitive element moulo T (that is, a generator of R T ), which allows us to replace multivariate operations by univariate ones. The elicate point is the conversion between the multivariate an univariate representations. The basic iea, using trace formulas, is well-known. The key problem is how to compute the require traces efficiently: this is an instance of power projection, which we will solve using Kelaya an Umans iea. There is a subtle point here: a irect generalization of 6

7 Kelaya an Umans algorithm gives a cost of the form K s δ 1+ε, for some constant K (when δ e δ ). This is alreay better than previous results (as this is almost linear in δ for fixe s), but it turns out that one can remove the exponential overhea K s altogether. This is one by using this algorithm only for bivariate triangular sets (with s = 2), since then a term of the form K s becomes irrelevant, an o the conversion from multivariate to univariate representations by hanling one variable after the other, using only bivariate algorithms. All algorithms are completely explicit, but it remains a challenge to make them competitive in practice. The central issue is to obtain an efficient implementation of our multivariate versions of Kelaya an Umans algorithms for moular composition an power projection. Just as with their original version, the constants hien in the complexity estimates make a irect implementation of these algorithms slower than the classical solutions base on Brent an Kung s iea for inputs of realistic size. Further work is neee to solve this issue. We also want to point out that the higher-level algorithms we buil on top of moular composition an power projection (such as multiplication, inversion, change of orer, etc) have an interest on their own; they are simple to unerstan an easy to implement. All they require is a subroutine for bivariate moular composition an power projection. For instance, they coul also be implemente on top of the algorithms for moular composition an power projection given in [35], at the cost however of a worse theoretical complexity. Contents 1 Introuction 1 2 Preliminaries 8 3 Moular composition an power projection Useful facts The case e = (e,..., e) The case e = (e 1, e 2 ) Representations of zero-imensional ieals Primitive representations Mixe representations Trace formulas Proof of Theorem A worke example The bivariate case The general case Proof of Theorem Proof of Theorem A worke example

8 6.2 The bivariate case The general case Proof of Theorem An illustration from elliptic curve point counting 34 2 Preliminaries This section recalls a few known algorithmic an complexity results involving triangular sets an finite fiels. These results will be use all along this paper. Algebraic complexity an bit complexity. Our first remark concerns the two moels of computation that will be use in the paper. Both are RAM moels: the algebraic RAM [26] an the boolean one. We will often use implicitly the following principle: given a algorithm written for an algebraic RAM over an abstract ring R, oing T operations in R, we will euce an algorithm in the boolean moel that solves the same problem over F q in time T log(q) plog(t ) plog(log(q)); the plog(t ) term allows us to take into account the logarithmic cost inuce by fetching an storing ata. This assumes that the cost of inex manipulations, loop control, etc, is negligible, an that all ata is store in the first T O(1) memory locations; this will be the case in our examples. The transposition principle. Let r, s 1 an let M be an r s matrix with entries in a fiel F. The transposition principle [12, Theorem 13.20] states that the existence of an algebraic circuit for the matrix-vector prouct b Mb implies the existence of a circuit with the same size, up to O(r + s), to perform the transpose matrix-vector prouct c M t c. We will rely on the same iea, but in an algebraic RAM moel; we will not offer a general proof, but rather inicate case-by-case how to o the transposition. Note that for boolean moels, there is no such transposition result; as a consequence, extra care must be taken when iscussing transpose algorithms in this context (as alreay pointe out in [29]). Arithmetic moulo triangular sets. We continue by escribing basic algorithms for triangular sets. Let T be a triangular set of multiegree = ( 1,..., s ) in F[Y]. We are concerne here with the cost of multiplication an reuction moulo T. Theorem 1 in [31] shows the following: (F 1 ) given A an B in F[Y], one can compute the prouct AB mo T in 4 s δ plog(δ ) operations in F. (F 2 ) given = ( 1,..., m), with i i for all i, an A in F[Y], the remainer A mo T can be compute in 4 s δ plog(δ ) operations in F. 8

9 Finite fiel embeings. Given a finite fiel F q, an a positive integer t, we are intereste in the cost of fining an embeing F q F q, with q = q t. Following our convention, we suppose that F q is given as F p [T ]/ P, with eg(p ) = r, an we will look for F q as F p [T ]/Q, with eg(q) = rt. Then, the key results we will use are the following. (F 3 ) One can construct in p plog(q ) operations in F p two polynomials Q an V in F p [T ] such that ι : F p [T ]/ P F p [T ]/Q efine by T V is an embeing F q F q. Given Q an V, one can compute ι(x) for x in F q, an ι 1 (y) for y in ι(f q ), in plog(q ) operations in F p. Let us justify this claim. First, we compute an irreucible polynomial Q of egree rt in F p [T ] using p plog(q ) operations in F p [41]. Then, we factor Q in F q [T ] for a similar cost [42]. Take a factor ψ of Q in F q [T ] an lift it canonically to F p [T, T ]. We then consier the system ψ(t, T ) P (T ) an change the orer of the variables. Since this system generates a maximal ieal, the change of orer results in a set of two equations of the form T V (T ) Q(T ). The map ι : F p [T ]/ P F p [T ]/Q efine by T V (T ) realizes the requeste embeing F q F q. The polynomial V can be compute using a number of F p -operations polynomial in rt, thus in plog(q ), e.g. by plain linear algebra; once V is known, computing ι(x), for x F q, takes a similar time, by moular composition. Finally, given y F q in the range of ι, one can recover its preimage in time plog(q ), by linear algebra again. 3 Moular composition an power projection In this section, we give our first algorithms for multivariate moular composition an power projection; we work moulo a triangular set T of multiegree N s, an we take a parameter e N m. The cases we will nee in the further sections have m, s 2; for convenience, the following theorem emphasizes this special case. Theorem 3. Fix ε > 0 an positive integers m, s in {1, 2}. Given a triangular set T in F q [Y] of multiegree N s, one can solve the problems of multivariate moular composition an multivariate power projection moulo T, with parameter e N m, using (δ + δ e ) 1+ε log(q) plog ε (log(q)) bit operations. We will actually have to prove slightly more: first, we stuy the case where m is arbitrary an e = (e,..., e) N m, then the case m = 2 an e arbitrary (the former case is neee to eal with the latter). In our notation, Kelaya an Umans ealt with the case s = 1 an e = (e,..., e). 9

10 In the complexity analysis, we will assume that s is arbitrary, an fixe: the cost estimates will actually hie factors exponential in s. This will however inuce no harm later on, since, as we sai above, these results will be employe with s 2 in the next sections. 3.1 Useful facts We start with some known results about topics such as multivariate polynomial evaluation. These results will be use in this section only. Multivariate evaluation. We consier the problem of evaluating a multivariate polynomial at a set of points, as well as its transpose. The following is (up to a minor moification) the quasi-linear result of [29, Corollary 4.3 an Theorem 7.6]. One ifference is that we write the epenency in q as log(q) plog(log(q)) rather than log(q) 1+o(1) ; this is possible by slightly moifying the proof given in that reference (by augmenting by 1 the value of a parameter t use in the proof). The other ifference is that we fix the number of variables m (the original statement ha the conition m = e o(1) ), which allows us to ispense with the original conition that e be large enough. The result we quote hols in a boolean moel, so we take F q as a base fiel. Given e in N m an a set B F m q of carinality N, we efine the transpose map is Eval t B : F N q F q [X] e. Eval B : F q [X] e F N q F [F (b) b B]; (F 4 ) Fix ε > 0 an a positive integer m. Given e N m of the form e = (e,..., e), a set B F m q of carinality N an F F q [X] e, one can compute Eval B (F ) in (δ e + N) 1+ε log(q) plog ε,m (log(q)) bit operations. (F 5 ) Fix ε > 0 an a positive integer m. Given e N m of the form e = (e,..., e), a set B F m q of carinality N an u F N q, one can compute Eval t B(u) in (δ e + N) 1+ε log(q) plog ε,m (log(q)) bit operations. Fact F 5 is from [29, Theorem 7.6]. That reference has the extra assumption that N = δ e ; we briefly iscuss how to lift this assumption. If N δ e, the input of Eval t B has larger carinality than the output. Then, we o as in [29, Theorem 7.7], by solving N/δ e instances of size δ e an aing the results. If N δ e, we o not have enough points, so we a δ e N ummy points an pa the input vector with zeros. In both cases, the cost fits into our claime boun. Structure evaluation an interpolation. Next, we iscuss multivariate evaluation an interpolation at special sets of points. The following results hol over an abstract fiel F. Let e = (e 1,..., e m ) be in N m, an consier a subset of F m of the form B = B 1 B m, with B i of carinality e i (thus, B is an m-imensional gri). For input polynomials with support in F[X] e, evaluation an interpolation at such a gri are simple problems. 10

11 (F 6 ) given F F[X] e an B as above, one can compute Eval B (F ) in δ e plog(δ e ) operations in F. (F 7 ) given values v = [v b b B] an B as above, there exists a unique polynomial F F[X] e such that Eval B (F ) = v; one can compute F in δ e plog(δ e ) operations in F. The multivariate algorithms simply consists in applying the classical univariate algorithms, variable by variable; see for instance [34]. Reformating a polynomial. One of the main ieas use in [29], an before it in Umans algorithm [44], is to simultaneously increase the number of variables an ecrease the egrees of a polynomial. Our efinition slightly extens the one use there, by allowing arbitrary partial egrees. In what follows, as in the previous paragraph, our polynomials will have coefficients in an abstract fiel F. Given e = (e 1,..., e m ) N m, we will be intereste in mapping polynomials in F[X 1,..., X m ] e to polynomials in more variables, with lower egree. Let (l 1,..., l m ) be positive integers; to each variable X i we will associate l i new variables X i,0,..., X i,li 1, so that the total number of new variables is m = l l m. Consier a vector e = (e 1,..., e 1,..., e m,..., e m) N m, such that each e i is repeate l i times. This will be our new egree vector, so that we put the constraint e i il e i. Then, we can efine the F-linear map Λ e,e by Λ e,e : F[X 1,..., X m ] e F[X 1,0,..., X m,lm 1] e X a 1 1 X am m X a 1,0 1,0 X a 1,l 1 1 1,l 1 1 Xa m,0 m,0 X a m,lm 1 m,l m 1, where a i,0,..., a i,l 1 are the coefficients of the expansion of a i in base e i. Next, given an F-algebra R, we efine the map Λ e,e as Λ e,e : Rm R m G = (G 1,..., G m ) (G i, G e i i,..., l i 1 Ge i i ) i=1,...,m. The key equality is then the following: for F in F[X 1,..., X m ] e an G in R m, we have F (G) = Λ e,e (F ) ( Λ e,e (G)). Computing Λ e,e (F ) an Λ e,e (G) inuces a cost, which we summarize here: (F 8 ) Given F in F[X 1,..., X m ] e, one can compute Λ e,e (F ) in O(δ e ) operations in F. Given G in R m, one can compute Λ e,e (G) using O(log(δ e )) multiplications in R. The first point is obvious, as we simply fill an array of size δ e. For the secon point, for a fixe l i 1 i m, we must compute G i, G e i i,..., Ge i i. This is one using l i exponentiations by e i, that is, O(l i log(e i)) multiplications in R. The total is thus O(log(e 1l1 e m ml )) = O(log(δ e )). 11

12 3.2 The case e = (e,..., e) We can now turn to moular composition an power projection, starting with the case where e = (e,..., e). This situation is very close to [29, Theorem 3.1], as the only (conceptually trivial) ifference is that we work moulo a triangular set, instea of a single polynomial. The proof we give follows the one given in that reference: the key iea evelope in [29], an previously in [44], is to reuce the problem to multipoint evaluation. In the following theorem, s an m are fixe, so the cost estimate hies the epenency in these parameters. The epenency in m coul easily be controlle, by requiring m = e o(1), as in [29, Theorem 3.1]. With respect to s, however, the cost woul turn out to involve a factor of the form 4 s, ue to the application of facts F 1 an F 2 ; as sai before, this is not harmful since we will use this result with s 2. Theorem 4. Fix ε > 0 an positive integers m, s. Given a triangular set T in F q [Y] of multiegree N s, one can solve the problem of multivariate moular composition moulo T, with parameter e = (e,..., e) N m, using (δ + δ e ) 1+ε log(q) plog ε,s,m (log(q)) bit operations. Proof. Without loss of generality, we may assume that ε 1. Given a triangular set T F q [Y 1,..., Y s ] of multiegree = ( 1,..., s ), (G 1,..., G m ) in R m T an F in F q[x 1,..., X m ] e, we will show how to compute F (G 1,..., G m ) R T. The algorithm follows that of [29, Theorem 3.1], up to hanling reuction moulo multivariate polynomials. In all that follows, remember that we have fixe ε, s, m, so they shoul be seen as constants. The iea is to procee by evaluation an interpolation. To enable this, we will replace (m,, e, q) by better suite parameters (m,, e, q ). First, we efine l = 2s/(mε), m = lm an e = e 1/l. Remark that l an m are boune from above by a constant. On the other han, we have the lower boun m 2s/ε: m will our new number of variables; it is large enough, but not too large. Let next e be the vector (e,..., e ) of length m. Finally, let = max( 1,..., s ), an efine = ( 1,..., s), with i = m e i. Before going further, we establish the following inequalities: There exists a constant c 1 epening on (ε, m, s) such that δ e c 1 δe 1+ε. Inee, we have δ e = e 1/l lm. We euce the inequalities δ e (e 1/l + 1) lm an thus δ e δ e (1 + e 1/l ) lm. There exists c 0 epening on (ε, m, s) such that (1 + e 1/l ) l amits the upper boun c 0 e ε for all e, an the conclusion follows by raising to the power m an taking c 1 = c m 0. For ε 1, there exists a constant c 2 epening on (ε, m, s) such that δ c 2 δeδ ε. Inee, we have δ = (m e ) s δ. The equality e = δ 1/m e implies m e = m δ 1/m e, so that (m e ) s = m s δ s/m e. Recall that m 2s/ε; then, the former equality give (m e ) s m s δ ε/2 e. The upper bouns δ e c 1 δe 1+ε c 1 δe 2 enable us to conclue, by taking c 2 = m s c ε/

13 We will nee to ensure that the base fiel contains at least m e elements. The final correction we o is thus to change q into q, efine below; in what follows, in any case, our base fiel will be F q. If q m e, we o nothing an we let q = q. Else, we fin an irreucible polynomial of egree n = log q (m e ) over F q an an embeing ι : F q F q, with now q = q n. By fact F 3, this can be one in p plog(q ) operations in F p. Remark that q qm e (m e ) 2, so that a quantity polylogarithmic in q is polylogarithmic in m e, an thus in δ + δ e. Since p q, an q m e, p is O( δ δ e ), with a constant epening on ε, s, m, so the time for builing F q is (δ + δ e ) plog ε,s,m (δ + δ e ) operations in F p. Fact F 3 also shows that applying an inverting ι on its image, can be one in plog(q ) operations in F p. In view of what was sai before, this is plog ε,s,m (δ + δ e ) operations. As a consequence, the sum of all costs relate to ι an ι 1 will as well be (δ + δ e ) plog ε,s,m (δ + δ e ) operations in F p. We can now explain the algorithm. To compute F (G 1,..., G m ) mo T, we will actually compute F (G 1,..., G m ) mo T, with F = Λ e,e (F ) an (G 1,..., G m ) = Λ e,e (G 1,..., G m ) mo T. We saw (Section 3.1, fact F 8 ) that computing F an (G 1,..., G m ) takes O(δ e ) operations in F q an O(log(δ e )) multiplications moulo T. Fact F 1 shows that the cost of one multiplication moulo T is 4 s δ plog(δ ) operations in F q, so the total is (4 s δ + δ e ) plog(δ + δ e ) operations in F q, which we may rewrite as (δ + δ e ) plog s (δ + δ e ). To compute F (G 1,..., G m ) mo T, we will first compute ϕ = F (G 1,..., G m ), then reuce it moulo T. The reuction will raise no ifficulty; the elicate step is the computation of ϕ. This will be one by evaluation an interpolation. Remark that ϕ lies in F q [Y]. Thus, we choose subsets B 1,..., B s of F q of carinalities 1,..., s; this is possible by assumption on q. We first compute all values g b = (G 1(b),..., G m (b)) Fm q for b B 1 B s, then all values f b = F (g b ); we finally compute ϕ by interpolating the values f b at B 1 B s. Let us postpone the cost of the evaluation of F at the points g b, an estimate all other costs first. To compute all g b, we evaluate each G i at B 1 B s, for i m. By fact F 6, each evaluation takes δ plog(δ ) operations in F q, for a total of m δ plog(δ ) operations in F q. Since m is boune by a constant, this is δ plog ε,s,m (δ ). By fact F 7, this also controls the cost of interpolation. Finally, since s is constant, Fact F 2 implies a cost of 4 s δ plog(δ ) = δ plog s (δ ) operations in F q for the reuction of ϕ moulo T. The total cost for all previous steps is boune from above by (δ +δ e ) plog ε,s,m (δ +δ e ) operations in F q. We finish by estimating the cost of computing all f b. Since m is boune by a constant, we can apply fact F 4 with parameters e an N = δ, to get a cost of (δ + 13

14 δ e ) 1+ε log(q ) plog ε,s,m (log(q )) bit operations. In view of the claim of the previous paragraph, the total time fits into this boun as well. Using the bouns given previously on δ e an δ, an a quick simplification, this becomes (δ + δ e ) 1+3ε log(q ) plog ε,s,m (log(q )) for ε 1. Remember that q qm e, so that log(q ) is at most log(q) + plog ε,s,m (δ e δ ). The polylogarithmic terms in δ e δ amit as well an upper boun of the form c(ε, m, s)(δ + δ e ) ε, an the conclusion follows, up to replacing ε by ε/4. We continue with a escription of the transposition of this algorithm, that eals with power projection. The reasoning follows the one of [29, section 7.2]. Theorem 5. Fix ε > 0 an positive integers m, s. Given a triangular set T in F q [Y] of multiegree N s, one can solve the problem of multivariate power projection moulo T, with parameter e = (e,..., e) N m, using (δ + δ e ) 1+ε log(q) plog ε,s,m (log(q)) bit operations. Proof. We will show how to transpose the algorithm given in the proof of the previous theorem. Seen as a linear map in F, the former algorithm replaces F by F = Λ e,e (F ), performs a multipoint evaluation of F, then a multivariate interpolation at a gri, an finally a reuction moulo T. We explain here how to transpose these four steps in reverse orer (the other steps, which are non-linear, are unchange). The last step is a moular reuction. Its transpose is escribe in [8] in the case s = 1 an in [35] for s = 2; in general, it suffices to transpose step-by-step the reuction algorithm of [31], an the cost remains unchange. The thir step is a multivariate interpolation at a gri of imension s, which is one by interpolating one variable after the other. The transpose algorithm thus requires to perform s transpose univariate interpolations; we refer to [28, 8] for such an algorithm. Again, the cost remains unchange. The secon step is a multiimensional multipoint evaluation, with monomial support e, at N = δ points; its transpose is hanle by invoking fact F 5 (instea of fact F 4 for the forwar irection). Finally, the first step is an injection, whose transpose is a projection, an takes linear time. The costs of all transpose steps are thus the same as the ones for the forwar irection, an as a consequence, the overall running time amits the same boun. 3.3 The case e = (e 1, e 2 ) The results of the previous subsection assume that e N m has the special form (e,..., e). What we will actually nee in the sequel are the cases m = 1 (which is thus covere) an m = 2, but in this case with e = (e 1, e 2 ) arbitrary. This subsection shows how to hanle this case using the former theorems. Again, the number of variables s in our triangular set is fixe. Theorem 6. Fix ε > 0 an a positive integer s. Given a triangular set T in F q [Y] of multiegree N s, one can solve the problem of multivariate moular composition moulo T, with parameter e = (e 1, e 2 ) N 2, using (δ + δ e ) 1+ε log(q) plog ε,s (log(q)) bit operations. 14

15 Proof. Given a triangular set T F q [Y 1,..., Y s ] of multiegree, (G 1, G 2 ) in R T an F in F q [X 1, X 2 ] (e1,e 2 ), we will show how to compute F (G 1, G 2 ) R T. Since the orer of the variables X 1 an X 2 is irrelevant, we may assume that e 1 e 2. We will istinguish two cases, epening on whether e 2 e 1/ε 1 or not. Suppose first that e 2 e 1/ε 1 hols. Let 1 l 1 =, l 2 = ε 1 ε log e 1 (e 2 ) an e = e ε 1 ; as a consequence of our assumption on e 1, e 2, both l 1 an l 2 are boune by constants (since ε is fixe). Define the vector e = (e,..., e) in N l 1+l 2, an let further F = Λ e,e (F ) an (G 1,1,..., G 1,l 1, G 2,1,..., G 2,l 2 ) = Λ e,e (G 1, G 2 ) mo T, so that we have F (G 1, G 2 ) mo T = F (G 1,1,..., G 1,l 1, G 2,1,..., G 2,l 2 ) mo T. We saw in fact F 8 that F an all G i,j can be compute in O(δ e ) operations in F q an O(log(δ e )) multiplications moulo T. This will be negligible compare to what follows. Knowing the G i,j, we are left with an instance of moular composition moulo T with parameter e. Because l 1 + l 2 is boune by a constant, we can apply Theorem 4, giving a running time of (δ + δ e ) 1+ε log(q) plog ε,s (log(q)) bit operations. Next, using all equalities written before, we obtain the upper boun δ e = e l 1+l 2 (2 e ε 1) 1 ε + 1 ε log e 1 (e 2 ) ε + 1 ε 2 +2 δ 1+ε e using the upper boun e 2 e ε 1 an, for the exponents, x x + 1. Thus, (δ + δ e ) 1+ε amits the upper boun 2 1 ε + 1 ε 2 +2 (δ + δ e ) 1+3ε for ε 1. This finishes the proof in this case (up to replacing ε by say ε/3). Next, we consier the case e 2 e 1/ε 1 ; in particular, we have e 1 δe. ε Write F (X 1, X 2 ) = e1 1 i=0 F i(x 2 )X1, i with eg(f i ) < e 2 for all i, an recall that we want to compute We procee as follows: F (G 1, G 2 ) mo T = e 1 1 i=0 F i (G 2 )G i 1 mo T. 1. We first compute F i (G 2 ) mo T, for 0 i e 1 1. Each of these computations is an instance of moular composition moulo T with parameter (e 2 ) N 1, that is, with m = 1. By Theorem 4, the cost of this step is e 1 (δ + e 2 ) 1+ε log(q) plog ε,s (log(q)) bit operations. Since e 1 δ ε e, this is at most (δ + δ e ) 1+2ε log(q) plog ε,s (log(q)). 2. Then, we use these values in a Horner scheme to get the result in e 1 multiplications an aitions in R T ; this gives us a cost of e 1 δ plog s (δ ) operations in F q. Using again the boun e 1 δe, ε this is (δ + δ e ) 1+ε plog(δ ) operations in F q, an thus (δ + δ e ) 1+ε plog s (δ + δ e ) log(q) plog(log(q)) bit operations. The latter cost amits the upper boun (δ + δ e ) 1+2ε log(q) plog ε,s (log(q)). 15

16 Replacing ε by ε/2 conclues the proof. We conclue this section with the transpose version of the former algorithm. Theorem 7. Fix ε > 0 an a positive integer s. Given a triangular set T in F q [Y] of multiegree N s, one can solve the problem of multivariate power projection moulo T, with parameter e = (e 1, e 2 ) N 2, using (δ + δ e ) 1+ε log(q) plog ε,s (log(q)) bit operations. Proof. As in the proof of the previous theorem, we assume that e 1 e 2 an we consier the two cases e 2 e 1/ε 1 or e 2 e 1/ε 1. In the forwar irection, both cases involve moular composition (which was hanle using Theorem 4), so the transposes with rely on power projection. In the first case, the linear part of the algorithm amounts to replacing F by F an solving an instance of moular composition moulo T, with parameter e ; we use Theorem 5 to o the transpose operation, power projection, in the same amount of time as in the forwar irection. In the secon case, the first step consists in solving e 1 instances of moular composition moulo T, with parameter (e 2 ); their transposes are all hanle by Theorem 5. The secon step is simply Horner s rule moulo T, an can be transpose without ifficulty (see e.g. [7]). In both cases, the costs of all transpose steps are the same as the ones for the forwar irection, so the overall running time amits the same boun. 4 Representations of zero-imensional ieals In this section, we change our focus: we iscuss representations of zero-imensional algebraic sets using either univariate polynomials, triangular sets, or an intermeiate ata structure. For our iscussion, we consier a zero-imensional ieal I in F[Y] = F[Y 1,..., Y s ], where F is a perfect fiel; we o not necessarily assume that I is efine by a triangular set for any orer. Finally, we let R = F[Y]/I be the resiue class ring moulo I, an let δ be the imension of the F-vector space R. To A R, we associate the multiplication-by-a enomorphisms of R, written M A. The minimal polynomial an the characteristic polynomial of A, respectively written m A F[Y ] an χ A F[Y ], are then efine as those of M A. Let V be the zero-set of I in F s, where F is an algebraic closure of F. Then, when I is raical, because of our perfectness assumption, we have the factorization (over F) χ A = y V (Y A(y)) (1) an m A is the squarefree part of χ A. Finally, the trace tr(a) is, by efinition, the trace of the enomorphism M A ; note that the trace is an F-linear form. 16

17 4.1 Primitive representations Primitive representations will allow us to work moulo I using only univariate polynomials. To start with, we say that A R is a primitive element if the powers of A generate R. This is the case if an only if χ A = m A ; when I is raical, this is the case if an only if χ A has no multiple root. In all that follows, we will be concerne only with primitive elements of the form A = i s l iy i (as in many previous works, such as [20, 3, 21, 38, 22]). The following well-known result gives a conition on such an A to be a primitive element. Lemma 8. If I is raical, there exists a non-zero homogeneous polynomial in F[L 1,..., L s ] of egree less than δ 2 /2 such that if (l 1,..., l s ) 0, A = l 1 Y l s Y s is a primitive element. Proof. The argument is well-known: A = l 1 Y l s Y s is a primitive element if an only if the form (y 1,..., y s ) l 1 y l 1 y s separates the zeros of I, that is, if l 1 (y 1 y 1) + + l s (y s y s) is non-zero for all y an y istinct zeros of I. Thus, it suffices to take for the prouct of the linear forms L 1 (y 1 y 1) + + L s (y s y s), for all pairs (y, y ); has coefficient in F, as it is the square root of the iscriminant of y V (T L 1y 1 L s y s ), which has coefficients in F. There are at most δ(δ 1)/2 such pairs (y, y ), an the conclusion follows. When A = i s l iy i is a primitive element, R an F[Y ]/ P are isomorphic, with P = m A ; then, eg(p ) = δ. In this case, a primitive representation P = (P, V, l) contains the information necessary to encoe this isomorphism: it consists of polynomials P an V = (V 1,..., V s ) in F[Y ], an l = (l 1,..., l s ) in F s, with eg(v i ) < δ for all i, such that the mappings ψ P : R F[Y ]/ P Y 1,..., Y s V 1,..., V s an ϕ P : F[Y ]/ P R Y i s l iy i are isomorphisms, inverses of one another. In particular, Y = i s l iv i. 4.2 Mixe representations We continue our iscussion, with the purpose of introucing an intermeiate ata structure, between triangular sets an primitive representations. We start with a variation on the notion of primitive element. For j s, let I j be the ieal I F[Y 1,..., Y j ] an let R j be the resiue class ring F[Y 1,..., Y j ]/I j. We say that A R is a primitive element of level j if A is in R j, an if the powers of A generate R j. The following lemma will be helpful to quantify linear forms that are primitive elements of level j; the proof is the same as that of Lemma 8. Lemma 9. Suppose that I is raical. Then for j s, there exists a non-zero homogeneous polynomial j in F[L 1,..., L j ] of egree less than δ 2 /2 such that if j (l 1,..., l j ) 0, A = l 1 Y l j Y j is a primitive element of level j. 17

18 A mixe representation M = (P, V, l) of I of format (j, s j +1) consists in a triangular set P = (P, P j+1,..., P s ) in F[Y, Y j+1,..., Y s ], for the orer Y < Y j+1 < < Y s, some polynomials V = (V 1,..., V j ) in F[Y ] an l = (l 1,..., l j ) in F j, such that we have mutually inverse isomorphisms Ψ M : R R P Y 1,..., Y j V 1,..., V j Y j+1,..., Y s Y j+1,..., Y s. an Φ M : R P R Y i j l iy i Y j+1,..., Y s Y j+1,..., Y s. In particular, i j l iv i = Y. Also, in this case, i j l iy i is a primitive element of level j, R j is isomorphic to F[Y ]/ P, an R j is isomorphic to F[Y, Y j+1,..., Y j ]/ P, P j+1,..., P j for j > j. In other wors, a mixe representation provies us with a primitive representation for the first j variables, an has a triangular shape for the last variables. The format (j, s j + 1) provies a quick way to know how many elements are in V an l (here, j), an in P (here, s j + 1). When j = s, a mixe representation is thus the same thing as a primitive representation. When j = 1, if we aitionally suppose that l 1 = 1, we have V 1 = Y, so up to renaming Y as Y 1, Ψ M maps Y 1,..., Y s to themselves, an P is a triangular set that generates I. The following technical lemma will be useful in Section 6. Lemma 10. Suppose that I is raical an that F δ 2. Then for j s, the following are equivalent: the ieal I amits a mixe representation of format (j, s j + 1) for i = j,..., s 1, there exists a positive integer i+1 such that R i+1 is a free R i -moule with basis 1, Y i+1,..., Y i+1 1 i+1. Proof. Suppose that I amits a mixe representation M = (P, V, l) of format (j, s j + 1), with polynomials P = (P, P j+1,..., P s ) in variables Y, Y j+1,..., Y s. Through Ψ M, we see that for i = j,..., s 1, R i+1 has the form R i [Y i+1 ]/ P i+1 ; the secon assertion in the lemma follows. Conversely, we always have that R i+1 = R i [Y i+1 ]/I i+1. Suppose R i+1 is a free R i -moule with basis 1, Y i+1,..., Y i+1 1 i+1. Then, there exists a polynomial P i+1 in R i [Y i+1 ], monic of egree i+1 in Y i+1, that belongs to I i+1 (this is the characteristic polynomial of the multiplication by Y i+1 ); one verifies that P i+1 actually generates I i+1 in R i [Y i+1 ]. As a consequence, we get that R = R j [Y j+1,..., Y s ]/ P j+1,..., P s. Using our assumption on the carinality of F, Lemma 9 ensures the existence of a primitive element of level j of the form l 1 Y l j Y j (since F is large enough, there must be a point in F j where j oes not vanish); this allows us to write R j F[Y ]/ P, an the conclusion follows. 18

19 4.3 Trace formulas Finally, we escribe how using trace formulas enables one to perform various conversions. The following claims are classical: see e.g. [43] for similar results using another linear form an [38] for a more general case, where I is not suppose to be raical. Lemma 11. Suppose that I is raical an let A an B be in R. Then, one can o the following in δ plog(δ) operations in F: given (tr(a j )) j<2δ, ecie whether A is a primitive element, an if so, compute its minimal polynomial m A ; given m A an (tr(ba j )) j<δ, compute a polynomial V F[Y ] of egree less than δ, such that if B can be expresse as a polynomial in A, then B = V (A) in R. Remark that in the secon item, we o not suppose that A is a primitive element, so that B may not be expressible in the form V (A); the point is that if it is the case, we can fin V. We o not inclue the cost of the verification that B = V (A), since this woul involve moular composition, which we o not know how to o in time δ plog(δ). Proof. We start from the following classical formula (which is essentially a generating series version of Newton-Girar s ientities) tr(a j+1 )Y j 1 F[[Y ]] = rev δ (χ A ) j 0 rev δ (χ A ), (2) Y where we write rev (P ) = Y P (1/Y ) for any P F[Y ] an 0. To recover χ A using this equality, algorithms using Newton s formula (such as Rouillier s [38]) require ivisions by integers 2,..., δ, which may not be possible in small characteristic. Instea, we will use the Berlekamp-Massey algorithm; it allows us to compute the minimal polynomial µ A of the sequence (tr(a j+1 )) from the values (tr(a j )) j<2δ. Since I is raical, A is a primitive element if an only if χ A has no multiple root, or equivalently if rev δ (χ A ) has no multiple root, or equivalently if the rational function in Equation (2) is reuce. This is the case if an only if µ A has egree δ; when this is the case, we have µ A = m A = χ A. This proves the first point, since Berlekamp-Massey s algorithm runs in time δ plog(δ). The secon point is in [43, Theorem 5], up to an inconsequential ifference (that result is prove using another linear form than the trace). The previous lemma allows one to compute a primitive representation by means of trace computations. We now iscuss how to compute a triangular representation. While the iea of using trace formulas remains, the computations are more involve. For this reason, we consier only bivariate situations. The following result is from [35, Section 3]; it requires a stronger assumption on the characteristic than the previous lemma (as we use a bivariate version of Newton s ientities). This assumption may most likely be lifte, but we leave this generalization to future work. 19