Complexity of Decoding Positive-Rate Primitive Reed-Solomon Codes

Transcription

1 1 Complexity of Decoding Positive-Rate Primitive Reed-Solomon Codes Qi Ceng and Daqing Wan Abstract It as been proved tat te maximum likeliood decoding problem of Reed-Solomon codes is NP-ard. However, te lengt of te code in te proof is at most polylogaritmic in te size of te alpabet. For te complexity of maximum likeliood decoding of te primitive Reed-Solomon code, wose lengt is one less tan te size of alpabet, te only known result states tat it is at least as ard as te discrete logaritm in some cases were te information rate unfortunately goes to zero. In tis paper, it is proved under a well known cryptograpy ardness assumption tat 1) Tere does not exist a randomized polynomial time maximum likeliood decoder for te Reed-Solomon code family [q, k(q)] q, were k(x) is any function in Z + Z + computable in time x O(1) satisfying x k(x) x x. 2) Tere does not exist a randomized polynomial time bounded-distance decoder for primitive Reed-Solomon codes at distance 2 + ɛ of te minimum distance for any 3 constant 0 < ɛ < 1. 3 In particular, tis rules out te possibility of a polynomial time algoritm for maximum likeliood decoding problem of primitive Reed-Solomon codes of any rate under te assumption. Index Terms Computational complexity, Maximum likeliood decoding, Reed-Solomon codes. I. INTRODUCTION Let F q be a finite field of q elements and of caracteristic p. A linear error-correcting [n, k] q code is defined to be a linear subspace of dimension k in F n q. Let D = {x 1,, x n } F q be a subset of cardinality D = n > 0. For 1 k n, let f run over all polynomials in F q [x] of degree at most k 1. Te vectors of te form (f(x 1 ),, f(x n )) F n q constitute a linear error-correcting [n, k] q code, wic is called a Reed-Solomon code. If D = F q, it is famously known as a primitive Reed-Solomon code. If D = F q, it is known as an extended primitive Reed-Solomon code. We denote tem by RS q [q 1, k] and RS q [q, k] respectively. A generalized Reed-Solomon code [n, k] q is defined to be {(y 1 f(x 1 ),, y n f(x n )) f F q [x], deg(f) < k}, were y 1, y 2,, y n are nonzero elements in F q. Te preliminary version of tis paper appeared in te Proceedings of te 35t International Colloquium on Automata, Languages and Programming (ICALP), volume 5125 of Lecture Notes in Computer Science, Springer- Verlag, Qi Ceng is wit Scool of Computer Science, University of Oklaoma, Norman, OK73019, qceng@cs.ou.edu. His researc is partially supported by NSF grant CCF and CCF Daqing Wan is wit Department of Matematics, University of California, Irvine, CA , dwan@mat.uci.edu. His researc is partially supported by NSF. Te minimal distance of a generalized Reed-Solomon [n, k] q code is n k + 1 because a non-zero polynomial of degree at most k 1 as at most k 1 zeroes. Te ultimate decoding problem for an error-correcting [n, k] q code is te maximum likeliood decoding: given a received word u F n q, find a codeword v suc tat te Hamming distance d(u, v) is minimal. Wen te number of errors is reasonably small, say, smaller tan n nk, ten te list decoding algoritms of Guruswami-Sudan [6] gives a polynomial time algoritm to find all te codewords. Wen te number of errors increases beyond n nk, it is not known weter tere exists a polynomial time decoding algoritm. Te maximum likeliood decoding of a Reed- Solomon [n, k] q code is known to be NP-complete [4]. Te proof explores te combinatorial complication of te subset D, tus requires tat n is at most polylogaritmic in q. In fact, tere is a straigtforward way to reduce te subset sum problem in D to te deep ole problem of a Reed-Solomon code, wic can ten be reduced to te maximum likeliood decoding problem [2]. Note tat te subset sum problem for D F q is ard only if D is muc smaller tan q. See [8] for an in-dept discussion of te subset sum problem wen D is close to q. In practical applications, one rarely uses te case of arbitrary subset D. Te most widely used case is wen D = F q, were te ric algebraic structure of te field facilitates a concise representation of alpabet and a fast encoding algoritm. Tis case is essentially equivalent to te case D = F q. For simplicity, we focus on te extended primitive Reed-Solomon code RS q [q, k] in tis paper, all our results can be applied to te Reed-Solomon code RS q [q 1, k] wit little modification. Te maximum likeliood decoding problem of RS q [q, k] is considered to be ard, but te attempts to prove its NPcompleteness ave failed so far. Te metods in [4][2] can not be specialized to RS q [q, k] because we ave lost te freedom to select D. Te only known complexity result [3] in tis direction says Proposition 1: Let > 0 be a constant. Let q be a prime power. Suppose and k are positive integers satisfying k 4 q k, q and Te discrete logaritm in F q can be solved in randomized time q O(1) wit oracle access to a maximum likeliood decoder of RS q [q, k]. Te main weakness of tis result is tat for te discrete logaritm over F q to be ard, q as to be greater tan k, wic implies tat te information rate k/q goes to zero. But

2 2 in te real world, we tend to use te primitive Reed-Solomon codes of ig rates. II. OUR RESULTS ON HARDNESS OF DECODING Our main result of tis paper is to remove te restriction on rate. Te starting point of our results is te following lemma wic we proved in [3]. Let 2 be a positive integer. Let (x) be a monic irreducible polynomial in F q [x] of degree. Let α be a root of (x) in an extension field of F q. Ten, F q [α] = F q is a finite field of q element. We ave Lemma 1: If every element of F q can be written as a product of exactly g distinct linear factors of te form α + a wit a F q, ten te discrete logaritm over F q can be efficiently solved in random time q O(1) wit oracle access to eiter a bounded distance decoder of RS q [q, g ] at distance q g, or a maximum likeliood decoder of RS q [q, g ]. Two simple observations are crucial for us to obtain te new results in tis paper. If every element of F q can be written as a product of exactly g distinct elements in α +F q, ten every element of F q can be written as a product of exactly q g distinct elements in α + F q. Let α be an element in F q m suc tat F q [α] = F q m. If every element in F q can be written as a product m of g 1 many distinct elements in α + F q, ten for any nonnegative integer g 2 q m q, every element in F q m can be written as a product of g 1 + g 2 many distinct elements in α + F q m. Our main teorem states: Teorem 1: Let > 0 be a constant. Let q be a prime power. Let m > 1 be an integer. Suppose and k are positive integers satisfying and q 1 2+ m + 1 m, q k q m q. q m( 4 + 2) 1 m Te discrete logaritm in F q can be solved in randomized m time (q m ) O(1) wit oracle access to a maximum likeliood decoder of RS q m[q m, k]. Te discrete logaritm problem over finite fields is well studied in computational number teory. It is not believed to ave a polynomial time algoritm. Many cryptograpic protocols base teir security on tis assumption. Te fastest general purpose algoritm [7] solves te discrete logaritm problem over finite field F q in conjectured time exp(o((log q ) 1/3 (log log q ) 2/3 )). Tus, in te above teorem, it is best to take as large as possible in order for te discrete logaritm to be ard. If = q Θ(1), tis complexity is superpolynomial on q. Te above teorem rules out a polynomial time algoritm for te maximum likeliood decoding problem of Reed-Solomon code of any rate under a cryptograpic ardness assumption. Interestingly our computational lower bound for decoding Reed-Solomon codes is not sensitive to teir dimensions. To obtain some intuition from te teorem, we set m = 2 and = 0.1 and conclude: Corollary 1: Assume tat tere is no randomized algoritm solving in time q O(1) te discrete logaritm over F q for all 2 q 0.4. Let k(x) be a function in Z + Z + computable in time polynomial in x O(1) and x k(x) x x. Ten tere is no polynomial time maximum likeliood decoder for te code family RS q [q, k(q)]. In oter words, no polynomial algoritm exists to solve te maximum likeliood decoding of RS q [q, k(q)] if q k(q) q q, under well-studied cryptograpic ardness assumption. In particular, under te assumption, for any constant 0 < c < 1, tere is no polynomial time maximum likeliood decoder for RS q [q, cq ]. Furtermore, no algoritm is known wic can solve te discrete logaritm over F q for infinitely 2 many q and all q 0.4 in time q O(1). Under te reasonable assumption tat suc algoritm does not exist, tere does not exist a polynomial time algoritm to solve te maximum likeliood decoding of RS q 2[q 2, k(q 2 )] for infinitely many q. It is well known tat Reed-Solomon codes possess a polynomial time unique decoder, wic is a bounded-distance decoder at distance 1 2 of te minimum distance. We prove owever under a cryptograpic ardness assumption tat tere does not exist an efficient bounded-distance decoder for primitive Reed-Solomon codes at distance ɛ of te minimum distance. Teorem 2: Let ɛ be a positive constant less tan 1/3. Tere does not exist a randomized polynomial time bounded-distance decoder at distance (2/3 + ɛ)d for te Reed-Solomon code RS q [q, k], were d = q k + 1 is te minimum distance, unless te discrete logaritm problem over F q can be solved in randomized time q O(1) for any q 0.8ɛ. We comment tat te above teorem does not contradict to te efficient list decoding algoritm in [6], since te code in our proof as rate approacing one. In [4], te autors asked weter one can establis NPardness of maximum-likeliood decoding for a nontrivial family of binary codes. Toug we do not solve te problem, we can establis cryptograpic ardness of maximumlikeliood decoding of binary codes, obtained from concatenation of Reed-Solomon codes RS 2 m(2 m, k) wit (2 m, m)- Hadamard codes, denoted by RSH 2 (m2 m, k). Corollary 2: Let ɛ be a positive constant less tan 1/3. Tere does not exist a randomized polynomial time boundeddistance decoder at distance (2/3 + ɛ)d for RSH 2 [m2 m, k], were d = 2 m 1 (2 m k + 1) is te minimum distance, unless tat te discrete logaritm in F 2 m can be solved in randomized time (2 m ) O(1) for any 2 0.8ɛm. A. Our results on finding Hamming balls wit many codewords By a direct counting argument, for any positive integer r < q k, tere exists a Hamming ball of radius r containing at least ( q r) /q q r k many codewords in Reed-Solomon code RS q [q, k]. Tus, if k = cq for a constant 0 < c < 1, we

3 3 set r = q k q 1/4 and te number of codewords in te Hamming ball will be exponential in q. However, finding suc a Hamming ball deterministically is an open problem. Tere is some progress on te problem [5][1], but all te results are for codes of diminising rates. Our contribution to tis problem is to remove te rate restriction. Teorem 3: Let 0 < c 1 < c 2 < 1 be two real numbers. Tere exists a deterministic algoritm tat given a prime power q and an integer k satisfying c 1 q 2 k c 2 q 2, runs in time q O(1), outputs a vector v F q2 q suc tat te Hamming ball 2 centered at v and of radius q 2 k q 0.4 contains exp(ω(q 2 )) many codewords in RS q 2[q 2, k]. Our construction allows te information rate to be positive. On te oter and, te ratio between te Hamming ball radius q 2 k q 0.4 and te minimum distance q 2 k+1 is approacing 1, as is in [5][1]. Te following result sows tat we can decrease te radius of Hamming ball so tat it is smaller tan te minimum distance by a constant factor less tan 1 if we work wit codes wit information rates going to one. Teorem 4: For any real number ρ (2/3, 1), tere is a deterministic algoritm tat, given a prime power q, outputs a positive integer k = q o( q) and a vector v F q q suc tat te Hamming ball centered at v and of radius ρ(q k + 1) contains at least exp(q 0.8(ρ 2/3) ) many codewords in RS q [q, k]. Te algoritm as time complexity q O(1). Note tat te information rate is 1 o(1). It would be interesting for future researc to extend te result to all ρ (1/2, 1) and to prove a similar result wit bot positive information rate and te ratio between te Hamming ball radius and minimum distance less tan 1. III. PROOF OF LEMMA 1 For readers convenience, in tis section, we sketc te main ideas in our earlier paper [3]. Tis will be te starting point of our new results in te present paper. In [3], te result was stated only for weaker bounded distance decoding. See tat paper for a full proof. Proof of Lemma 1. Let (x) be a monic irreducible polynomial of degree > 1 in F q [x]. We sall identify te extension field F q wit te residue field F q [x]/((x)). Let α be te class of x in F q [x]/((x)). Ten, F q [α] = F q. Consider te Reed-Solomon code RS q [q, g ]. For a polynomial f(x) F q [x] of degree at most 1, let u f be te received word u f = ( f(a) (a) + ag ) a Fq. By assumption, we can write f(α) = (α + a i ), i=1 were a i F q are distinct. It follows tat as polynomials, we ave te identity (x + a i ) = f(x) + t(x)(x), i=1 were t(x) F q [x] is some monic polynomial of degree g. Tus, g f(x) (x) + xg + (t(x) x g i=1 ) = (x + a i), (x) were t(x) x g F q [x] is a polynomial of degree at most g 1 and tus corresponds to a codeword. Tis equation implies tat te distance of te received word u f to te code RS q [q, g ] is at most q g. If te distance is smaller tan q g, ten one gets a monic polynomial of degree g wit more tan g distinct roots. Tus, te distance of u f to te code is exactly q g. Let C f be te set of codewords in RS q [q, g ] tat ave distance exactly q g to te received word u f. Te cardinality of C f is ten equal to 1 g! times te number of ordered ways tat f(α) can be written as a product of exactly g distinct linear factors of te form α + a wit a F q. For error radius q g, te maximum likeliood decoding of te received word u f is te same as finding a solution to te equation f(α) = (α + a i ), i=1 were a i F q being distinct. To sow tat te discrete logaritm in F q can be reduced to te decoding of te words of te type u f, we apply te index calculus algoritm. Let b(α) be a primitive element of F q. Taking f(α) = b(α) i for a random 0 i q 2, te maximum likeliood decoding of te word u f gives a relation b(α) i = (α + a j (i)), were a j (i) F q are distinct for 1 j g. Tis gives te congruence equation g i log b(α) (α + a j (i)) (mod q 1). Repeating te decoding and let i vary, tis would give enoug linear equations in te q variables log b(α) (α + a) (a F q )). Solving te linear system modulo q 1, one finds te values of log b(α) (α + a) for all a F q. To compute te discrete logaritm of an element v(α) F q wit respect to te base b(α), one applies te decoding to te element v(α) and finds a relation v(α) = (α + b j ), were te b j F q are distinct. Ten, g log b(α) v(α) log b(α) (α + b j ) (mod q 1). In tis way, te discrete logaritm of v(α) is computed. Te detailed analysis can be found in [3]. In order to use te above teorem, one needs to get good information on te integer g satisfying te assumption of te teorem. Tis is a difficult teoretical problem in general. It can be done in some cases, wit te elp of Weil s caracter

4 4 sum estimate togeter wit a simple sieving. In particular, te following result was proved in [3]. Teorem 5: Let < g be positive integers. Let N(g, ) = 1 g! ( q g ( g 2 ) q g 1 q (1 + 1 ( g 2 ))( 1) g q g/2 ) Ten every element in F q can be written in at least N(g, ) ways as a product of exactly g distinct linear factors of te form α + a wit a F q. If for some constant > 0, we ave ten q max(g 2, ( 1) 2+ ), g ( 4 + 2)( + 1), N(g, ) q g/2 /g! > 0. Te main draw back of te above teorem is te condition q g 2, wic translates to te condition tat te information rate (g )/q goes to zero in applications. IV. THE PROOF OF THEOREM 2 AND THEOREM 4 To prove Teorem 2, we start wit a lemma. Lemma 2: Let g, be positive integers suc tat for some constant > 0, we ave q max(g 2, ( 1) 2+ ), g ( 4 + 2)( + 1). 1) Every element in F q can be written in at least N(g, ) ways as a product of exactly q g distinct linear factors of te form α + a wit a F q. 2) Let (x) be an irreducible polynomial of degree over F q and let f(x) be a nonzero polynomial of degree less tan over F q. Ten in Reed-Solomon code RS q [q, q g ], te Hamming ball centered at ( f(a) (a) + aq g ) a Fq of radius g contains at least qg/2 g! many codewords. To prove tis lemma, we observe tat te map tat sends β F q to a F q (α+a)/β is one-to-one from F q to itself. Proof: Note tat a F q (α + a) 0. Given an element β F q, from Teorem 5, we ave tat a F q (α + a)/β can be written in at least N(g, ) ways as a product of exactly g distinct linear factors of te form α + a wit a F q, ence β can be written in at least N(g, ) ways as a product of exactly q g distinct linear factors of te form α + a wit a F q. To prove te second assertion, we follow an argument similar to te proof of Lemma 1. Observe tat te number of codewords in te Hamming ball centered at ( f(a) (a) + aq g ) a Fq of radius g is exactly 1 g! times te number of ordered ways tat f(α) can be written as a product of exactly q g distinct linear factors of te form α + a wit a F q, wic is at least N(g, ) > q g/2 /g!. Now we are ready to prove Teorem 2:. Proof of Teorem 2: Set = 1 2ɛ can verify tat 2+3ɛ and g = 1 3ɛ ( + 1). We q max(g 2, ( 1) 2+ ), g ( 4 + 2)( + 1) old for q big enoug, since q 0.8ɛ. Tus it follows from Lemma 1 tat te bounded distance decoding of RS q [q, q g ] at distance q (q g) = g = (2/3 + ɛ)(g + + 1) = (2/3 + ɛ)d is at least as ard as te discrete logaritm over te finite field F q. Note tat te rate (q g )/q approaces 1 as q increases. Proof of Teorem 4: We set ɛ = ρ 2/3, = q 0.8ɛ, = ɛ, and g = ( + 1). 2ɛ 1 3ɛ One can verify tat q max(g 2, ( 1) 2+ ), g ( 4 + 2)( + 1) old for q big enoug. We find an irreducible polynomial (x) of degree over F q using te algoritm in [9]. It follows from te second assertion in te above lemma tat te number of codewords in te Hamming ball centered at of radius g = (2/3 + ɛ)d is q g/2 g! 1 v = ( (a) + aq g ) a Fq > ( q/g) g > exp() = exp(q 0.8ɛ ). V. THE PROOF OF THEOREM 1 AND THEOREM 3 We now consider te case were te rate is positive less tan one. Te main new idea for tis case is to exploit te role of subfields. For tis purpose, we take a positive integer m 2. Let α be an element in F q m wit F q [α] = F q m. Since F q [α] F q m[α] F q m, we also ave F q m = F q m[α]. Teorem 6: Let g 1 and g 2 be non-negative integers wit g 2 q m q. Let ( q N m ) q (g 1, g 2,, m) = N(g 1, m). Ten, every element in F q can be written in at least m N (g 1, g 2,, m) ways as a product of exactly g 1 + g 2 distinct linear factors of te form α + a wit a F q m. If for some constant > 0, we ave ten q max(g1, 2 (m 1) 2+ ), g 1 ( 4 + 2)(m + 1) N (g 1, g 2,, m) qg1/2 g 1! g 2 ( q m ) q > 0. Proof. Since g 2 q m q, we can coose g 2 distinct elements b 1,, b g2 from te set F q m F q. Tere are ( ) q m q g 2 g 2

5 5 many coices. For any element β F q m, since F q [α] = F q m, we can apply Teorem 5 to deduce tat β (α + b 1 ) (α + b g2 ) = (α + a 1) (α + a g1 ), were te a i F q are distinct. Te number of suc sets {a 1, a 2, a 3,, a g1 } F q is greater tan N(g 1, m). Since F q and its complement F q m F q are disjoint, it follows tat β = (α + b 1 ) (α + b g2 )(α + a 1 ) (α + a g1 ) is a product of exactly g 1 + g 2 distinct linear factors of te form α + a wit a F q m. Teorem 7: Let m 2 and 2 be two positive integers. Let q be a prime power and k be an integer satisfying q m < k < q m q m. Assume tat q max((m 1) 2+, ( 4 + 2)2 (m + 1) 2 ) for some constant > 0. 1) Every element in F q can be written as a product of m exactly k + distinct linear factors of te form α + a wit a F q m. 2) Let (x) be an irreducible polynomial of degree over F q m wose root α satisfies tat F q [α] = F q m. Let f(x) be a nonzero polynomial over F q m of degree less tan. Ten in te Reed-Solomon code RS q m[q m, k], te Hamming ball centered at ( f(a) (a) + ak ) a Fq m of radius q m k contains at least q q /2 q! ( q m q k + q many codewords. Proof: Take g 1 = q 1/2 and we ave Te conditions g 1 ( 4 + 2)(m + 1) and q g2 1. q max(g1, 2 (m 1) 2+ ), g 1 ( 4 + 2)(m + 1) old. Furtermore we ave 0 k g 1 + q m q. Now take g 2 = k g 1 +. According to Teorem 6, every element in F q m can be written in at least N (g 1, g 2,, m) ways as a product of exactly g 1 + g 2 = k + distinct linear factors of te form α + a wit a F q m. And in te Reed-Solomon code RS q m[q m, k], te Hamming ball centered at ( f(a) (a) + ak ) a Fq m of radius q m k contains at least N (g 1, g 2,, m) many codewords. Finally q /2 ( N (g 1, g 2,, m) q q m ) q q! k + > 0 q Proof of Teorem 1 and Teorem 3. Teorem 1 follows directly from te above teorem and Lemma 1 by setting m = 2. ) Set m = 2, = q 0.4, k = q 2 /2 and = 0.1 in te above teorem. We can verify tat te conditions are satisfied. Hence te number of codewords in te Hamming ball centered at 1 v = ( (a) + ak ) a Fq 2 of radius q 2 k contains at least q ( q /2 q 2 ) q q! k + = exp(ω(q 2 )) q many codewords in RS q 2[q 2, k]. It remains to find an irreducible polynomial of degree over F q 2, wose root α satisfies tat F q [α] = F q 2. Let p be te caracteristic of F q. We can use α suc tat F p [α] = F q 2. We need to find an irreducible polynomial of degree log p (q 2 ) over F p. It can be done in time polynomial in p and te degree [9]. Ten we factor te polynomial over F q 2, wic can be done in deterministic time q O(1), and take any factor to be (x). VI. CONCLUSION AND FUTURE RESEARCH In tis paper, we sow tat te maximum likeliood decoding of te primitive Reed-Solomon code is at least as ard as te discrete logaritm over finite fields for any given information rate. We also prove a ardness result for te bounded-distance decoding of primitive Reed-Solomon codes at radius 2/3 + ɛ of te minimum distance. It is a very interesting problem weter 2/3 + ɛ can be improved to 1/2 + ɛ. We feel tat substantially new ideas are required. Some codes in our proof are defined over finite fields of composite cardinalities. Wile tis is not a problem in practical applications, e.g. q = 256 is quite popular, it would be interesting to remove tis restriction, tat is, allowing prime finite fields as well. Many important questions about decoding Reed-Solomon codes remain open. For example, does tere exist a Hamming ball of radius less tan te minimum distance by a constant factor smaller tan one tat contains superpolynomially many codewords in Reed-Solomon codes of rate less tan one? Anoter interesting problem is weter te primitive Reed- Solomon maximum likeliood decoding problem is equivalent to te discrete logaritm problem over finite fields. In oter words, if we ave oracle access to a discrete logaritm solver over finite fields, can we solve te maximum likeliood decoding problem for primitive Reed-Solomon codes? If so, tis would imply tat te problem is unlikely to be NP-ard, since discrete logaritm over finite fields are not believed to be NP-ard. REFERENCES [1] Eli Ben-Sasson, Swastik Kopparty, and Jaikumar Radakrisnan. Subspace polynomials and list decoding of Reed-Solomon codes. In 47t Annual IEEE Symposium on Foundations of Computer Science (FOCS), pages , [2] Qi Ceng and Elizabet Murray. On deciding deep oles of Reed- Solomon codes. In Proceedings of Annual Conference on Teory and Applications of Models of Computation(TAMC), volume 4484 of Lecture Notes in Computer Science, pages Springer-Verlag, [3] Qi Ceng and Daqing Wan. On te list and bounded distance decodability of Reed-Solomon codes. SIAM Journal on Computing, 37(1): , Special Issue on FOCS 2004.

6 6 [4] V. Guruswami and A. Vardy. Maximum-likeliood decoding of Reed- Solomon codes is NP-ard. IEEE Transactions on Information Teory, 51(7): , [5] Venkatesan Guruswami and Atri Rudra. Limits to list decoding Reed- Solomon codes. IEEE Transactions on Information Teory, 52(8): , [6] Venkatesan Guruswami and Madu Sudan. Improved decoding of Reed-Solomon and algebraic-geometry codes. IEEE Transactions on Information Teory, 45(6): , [7] Antoine Joux, Reynald Lercier, Nigel Smart, and Frederik Vercauteren. Te number field sieve in te medium prime case. In Advances in Cryptology - CRYPTO 2006, volume 4117 of Lecture Notes in Computer Science, pages Springer-Verlag, [8] Jiyou Li and Daqing Wan. On te subset sum problem over finite fields. Finite Fields and Applications, 14(4): , [9] Victor Soup. New algoritms for finding irreducible polynomials over finite fields. Matematics of Computation, 54: , 1990.