EFFICIENT COMPUTATION OF TERMS OF LINEAR RECURRENCE SEQUENCES OF ANY ORDER

Transcription

1 #A39 INTEGERS 8 (28) EFFIIENT OMPUTATION OF TERMS OF LINEAR REURRENE SEQUENES OF ANY ORDER Dmitry I. Khomovsky Lomonosov Moscow State University, Moscow, Russia khomovskij@physics.msu.ru Received: /2/6, Accepted: 4/5/8, Published: 4/2/8 Abstract In this paper we give e cient algorithms for computing second-, third-, and fourthorder linear recurrences. We also present an algorithm scheme for computing terms with the indices N,..., N +n of an nth-order linear recurrence. Unlike Fiduccia s algorithm, our approach uses certain formulas for modular polynomial squarings.. Introduction Let {W k (a,..., a n ; p... p n )} be an nth-order linear recurrence defined by the relation f k+n = p f k+n + p f k+n p n f k, () with the initial values W i = a i ( apple i apple n ). The characteristic polynomial is g(x) = x n (p x n + p x n p n ). (2) Widely known particular cases are the Lucas sequences {U k (P, Q)} and {V k (P, Q)}. They are defined recursively by f k+2 = P f k+ Qf k, (3) with the initial values U =, U =, V = 2, V = P. The characteristic polynomial in this case is x 2 P x + Q. omputation of linear recurrences has been studied by many authors [5, 8, 2]. The most e ective algorithm was proposed by Fiduccia in 985. To obtain the Nth term of an nth-order linear recurrence using this method, we need to compute r(x) = x N mod g(x), where g(x) = x n P n i= p ix n i. Then we compute r(),

2 INTEGERS: 8 (28) 2 where is the n n companion matrix of the linear recurrence: p n p n 2 = p n 3. (4) A p Finally, we multiply the row vector of initial values (a,..., a n ) by the first column of r() and obtain the N th term. The computational complexity of this algorithm is O(µ(n) log N + n 3 ). Here, µ(n) is the total number of operations required to multiply two polynomials of degree n in the polynomial ring. Fiduccia actually manages to exploit the structure of the matrix in order to decrease the complexity to O(µ(n) log N), see Theorem 3. and Proposition 3.2 in [5]. 2. omputation of Second-order Linear Recurrences Let the second-order linear recurrence sequence {W k } be defined by the relation W k+2 = P W k+ QW k, with W = A, W = B. It was intensively studied by Horadam [9, ]. For the Lucas sequences we have the following matrix formula: Uk+ V k+ Uk V = M k P Q, where M =. (5) U k V k U k V k Then Uk+ V k+ = M U k V k P. (6) k 2 Lemma. For the sequence {W k (A, B; P, Q)} the following holds: Proof. We have: Wk+ = M W k B = BM k A k BUk+ AQU = k. BU k AQU k W k = BU k AQU k, (7) W k = (B AP )U k + AU k+. (8) + AM k Uk+ = B + AM U k Q k From this we get (7). By the definition of the Lucas sequence QU k = P U k U k+. Using this, we obtain (8). For recurrences of order greater than 2 we will use the relation ().

3 INTEGERS: 8 (28) 3 The obtained result is known (for example, see [9]). We see that the computation of remote terms of {W k (A, B; P, Q)} can be done by the Lucas sequence {U k (P, Q)}. In a sense, {U k } is a basis. We note that the result given in the following theorem is known, moreover, there is a generalization [6]. But we still give the proof, since we will use a similar approach for higher-order linear recurrences. Theorem. Let {U k (P, Q)} be the Lucas sequence. Then Umk+ U mk = Proof. We use the notations S = Uk+ m QU k Uk+. (9) U k U k+ P U k U k P 2, S = P/2. () /2 We have Umk+ = M U mk = (M mk k SS ) m Uk+. () U k By (6) and (), M k SS = Uk+ ( P U k+ + V k+ )/2. (2) U k ( P U k + V k )/2 By Lemma we can get the classical identity V k = P U k 2QU k, with the help of which we eliminate V k, V k+ from (2). Then M k SS Uk+ QU = k. U k QU k (3) Since QU k = U k+ P U k, we get M k SS = Finally, we can modify () into (9). Uk+ If m = 2 in (9), then we obtain the following identities: If we replace k by k + in (5) and use U k+2 = P U k+ QU k. (4) U k U k+ P U k U 2k = U k (2U k+ P U k ), (5) U 2k+ = U 2 k+ QU 2 k. (6) QU k, then we obtain U 2k+2 = U k+ (P U k+ 2QU k ). (7)

4 INTEGERS: 8 (28) 4 Now using (5), (6), and (7) we can present an algorithm for computing two terms of {U k (P, Q)} with the indices N and N +. We need four temporary memories: u, u 2, U, U 2. In fact, the number of temporary memories can be reduced by eliminating u 2. Algorithm omputing the Lucas sequence {U k (P, Q)} Input: N = P m i= b i2 i, (b m = ) P, Q Output: U N, U N+ : U ; U 2 P 2: for j from m 2 to by do 3: u U ; u 2 U 2 4: if b j = then 5: U u 2 2 Qu 2 ; U 2 u 2 (P u 2 2Qu ) 6: else if 7: U u (2u 2 P u ); U 2 u 2 2 Qu 2 8: end if 9: end for : return U, U 2 Such a computational method was discussed by Reiter in [4]. Previously [4], it was proposed for the Fibonacci numbers. Suppose we have computed U N, U N+ by Algorithm, then with the help of (8) we get W N. Using W N+ = BU N+ AQU N we get W N+. Thus, in the general case, to compute the terms U N, U N+ and W N, W N+ we need 3m multiplications 2, where m = blog 2 Nc +. But when Q = or more generally Q = a 2, we can slightly transform Algorithm so that we need only 2m multiplications. Indeed, when Q =, we replace the expression u 2 2 u 2 by (u 2 u )(u 2 + u ) at steps 5, 7. When Q = a 2, we use the formula u 2 2 Qu 2 = (u 2 au )(u 2 + au ). 2.. omparison With Other Existing Algorithms urrently, the main algorithm [] for quick computation of the Lucas sequence terms U N, V N uses the following properties: V 2k+ = V k+ V k P Q k, V 2k = V 2 k 2Q k, U 2k+ = U k+ V k Q k, U 2k = U k V k. (8) When Q = ±, the computation of U N and V N requires 3m multiplications in the worst case (N is odd), and 2m in the best case (N is a power of two). When Q 6= ± and without any assumption about N, this algorithm needs less than 4m multiplications but not less than 3m. We see that Algorithm is more e cient 2 We imply that P, Q are not large. So multiplications that involve them are similar to additions.

5 INTEGERS: 8 (28) 5 in most cases, but there is an important case when the algorithm o ered in [] is better. This is so when we need to compute the term V N (P, ) or V N (P, ). For N = 2 s (2d + ) the computation of V N (P, ) by the algorithm in [] requires 2blog 2 (2d + )c + s multiplications while Algorithm needs 2blog 2 (2d + )c + 2s. So in applications such as Lucas-based cryptosystem [2] and Lucas-Lehmer-Risel primality test [5], it is preferable to use the algorithm o ered in []. Now we compare Algorithm with Fiduccia s algorithm. The characteristic polynomial is g(x) = x 2 P x + Q. To compute x N mod g(x), Fiduccia s algorithm uses the classical method of repeating squaring. For an arbitrary linear polynomial h(x) = u x + u 2, we have h 2 (x) mod g(x) = u (2u 2 P u )x + u 2 2 Qu 2. As is seen above, we can use formulas (5) and (6) for modular polynomial squarings. Therefore, Algorithm, together with the formula (8), is one way of implementing Fiduccia s algorithm for second-order linear recurrences, where the explicit formulas for modular polynomial squarings are used. 3. omputation of Third-order Linear Recurrences We will follow the notation for third-order linear recurrences according to [3]. The sequences {X k (p, q, r)}, {Y k (p, q, r)}, and {Z k (p, q, r)} are defined recursively by f k+3 = pf k+2 + qf k+ + rf k, (9) with the initial values X =, X =, X 2 =, Y =, Y =, Y 2 =, Z =, Z =, Z 2 =. Similar to (6), we X k+2 Y k+2 Z k+2 X k+ Y k+ Z k+ A = M k S, where M p q r A, S A. X k Y k Z k (2) Lemma 2. Let the sequence {W k (a, a, a 2 ; p, q, r)} be defined by the relation W k+3 = pw k+2 + qw k+ + rw k, (2) with the initial values W = a, W = a, W 2 = a 2. Then W k = a 2 X k + (a q + a r)x k + a rx k 2, (22) W k = (a 2 a p a q)x k + (a a p)x k+ + a X k+2. (23)

6 INTEGERS: 8 (28) 6 Proof. We W k+2 W k+ A = M a 2 a A = a 2 M A + a M A + a M A W k a = a X k+2 X k+ A + a M q A + a M r A X k = a X k+2 X k+ A + (a q + a X k+ X k A + a M k r A X k X k a 2X k+2 + (a q + a r)x k+ + a rx k a 2 X k+ + (a q + a r)x k + a rx k A. (24) a 2 X k + (a q + a r)x k + a rx k 2 So we obtain (22). With the help of X k 2 = (X k+ px k qx k )/r and X k = (X k+2 px k+ qx k )/r we get (23). By Lemma 2 we get the following: Y k = qx k + rx k 2, (25) Z k = rx k, (26) Y k = X k+ px k, (27) Z k = X k+2 px k+ qx k. (28) Theorem 2. Let {X k (p, q, r)} be the third-order linear recurrence sequence with the initial values X =, X =, X 2 =. X mk+2 X mk+ A X m k+2 qx k+ + rx k rx k+ X k+ X k+2 px k+ rx k X k+2 X k+ A. X mk X k X k+ px k X k+2 px k+ qx k X k (29) Proof. According to (2), we X mk+2 X mk+ A = M A = M k X k+2 X k+ A. (3) X mk Using (25) (28) we eliminate Y k, Y k+, Y k+2, Z k, Z k+, Z k+2 from M k. This may be done in such a way that M k will contain only X k, X k+, X k+2. We obtain M k X k+2 qx k+ + rx k rx k+ X k+ X k+2 px k+ rx k A. (3) X k X k+ px k X k+2 px k+ qx k Finally, we can modify (3) into (29). X k

7 INTEGERS: 8 (28) 7 If we put m = 2 in (29), then we get the following formulas: X 2k+2 =X 2 k+2 + X k+ (qx k+ + 2rX k ), (32) X 2k+ =rx 2 k + X k+ (2X k+2 px k+ ), (33) X 2k =X 2 k+ + X k (2X k+2 2pX k+ qx k ). (34) Remark. It is clear that X k+ (P, Q, ) = U k (P, Q). Therefore, if we put r = and q = Q in these formulas and subtract from all indices, then up to the substitution of U for X we obtain the identities for second-order recurrences. Remark. If we calculate the remainder (c x 2 + c 2 x + c 3 ) 2 mod x 3 px 2 qx r, (35) then we obtain the formulas similar to (but not the same as) (32) (34) for squaring of quadratic polynomials modulo g(x) = x 3 px 2 qx r. They can be used in Fiduccia s algorithm for computing third-order recurrences. To get an algorithm for computing X N, X N+, X N+2 similar to the binary exponentiation we need to be able to compute X 2k, X 2k+, X 2k+2, X 2k+3 using X k, X k+, X k+2. So we need another formula that helps us to compute X 2k+3. It can be obtained from (33) if we replace k by k + and use X k+3 = px k+2 + qx k+ + rx k. It is as follows: X 2k+3 = rx 2 k+ + X k+2 (px k+2 + 2qX k+ + 2rX k ). (36) Now we present an algorithm based on the formulas (32) use six temporary memories. (34), (36). We need to Algorithm 2 omputing the third-order linear recurrence {X k (p, q, r)} Input: N = P m i= b i2 i, (b m = ) p, q, r Output: X N, X N+, X N+2 : X ; X 2 ; X 3 p 2: for j from m 2 to by do 3: x X ; x 2 X 2 ; x 3 X 3 4: if b j = then 5: X rx 2 + x 2 (2x 3 px 2 ); X 2 x x 2 (qx 2 + 2rx ); X 3 rx x 3 (px 3 + 2qx 2 + 2rx ) 6: else if 7: X x x (2x 3 2px 2 qx ); X 2 rx 2 + x 2 (2x 3 px 2 ); X 3 x x 2 (qx 2 + 2rx ) 8: end if 9: end for : return X, X 2, X 3

8 INTEGERS: 8 (28) 8 We will imply that multiplications by p, q, r can be simulated by additions. Then algorithm 2 needs 3m multiplications and 3m squarings. At the end of this section, we refer to some applications that use computation of remote terms of third-order linear recurrence sequences; see [, 3, 6, 7]. 4. omputation of Fourth-order Linear Recurrences Since this section is similar to the previous one, we give only the main formulas and the final algorithm. The fourth-order linear recurrence {W k (a, a, a 2, a 3 ; p, p, p 2, p 3 )} is defined recursively by f k+4 = p f k+3 + p f k+2 + p 2 f k+ + p 3 f k, (37) with the initial values W = a, W = a, W 2 = a 2, W 3 = a 3. Denote the sequence {W k (,,, ; p, p, p 2, p 3 )} by {X k (p, p, p 2, p 3 )}. The formulas, which can be obtained by the matrix method, are: W k =a 3 X k + (a p 3 + a p 2 + a 2 p )X k + (a p 3 + a 2 p 2 )X k 2 + a 2 p 3 X k 3, (38) W k =(a 3 a 2 p a p a p 2 )X k + (a 2 a p a p )X k+ + (a a p )X k+2 + a X k+3. (39) We will use W k (a, a, a 2, a 3 ) instead of W k (a, a, a 2, a 3 ; p, p, p 2, p 3 ). By (38), (39), and (37) we obtain the following W k (,,, ) = p X k + p 2 X k 2 + p 3 X k 3, (4) W k (,,, ) = p 2 X k + p 3 X k 2, (4) W k (,,, ) = p 3 X k, (42) W k (,,, ) = p X k + X k+, (43) W k (,,, ) = p X k p X k+ + X k+2, (44) W k (,,, ) = p 2 X k p X k+ p X k+2 + X k+3. (45) For convenience, we use the notation i W k for W k (a, a, a 2, a 3 ) with only one nonzero a i =. Then by the matrix method we get X mk+3 X mk+2 X mk+ X mk X 2 k+3 W k+3 W k+3 W k+3 A = BX 2 k+2 W k+2 W k+2 W X 2 k+ W k+ W k+ W k+ A X 2 k W k W k W k m X k+3 BX X k+ X k A. (46)

9 INTEGERS: 8 (28) 9 With the help of (4) (45) we transform the matrix in (46) and obtain X k+3 p X k+2 + p 2 X k+ + p 3 X k p 2 X k+2 + p 3 X k+ p 3 X k+2 BX k+2 X k+3 p X k+2 p 2 X k+ + p 3 X k p 3 X X k+ X k+2 p X k+ X k+3 p X k+2 p X k+ p 3 X k A. X k X k+ p X k X k+2 p X k+ p X k R 4,4 (47) Here, R 4,4 = X k+3 p X k+2 p X k+ p 2 X k. If we put m = 2 in (46), then after simplification we get the following formulas: X 2k+3 =X 2 k+3 + X k+2 (p X k+2 + 2p 2 X k+ + 2p 3 X k ) + p 3 X 2 k+, (48) X 2k+2 =X k+2 (2X k+3 p X k+2 ) + X k+ (p 2 X k+ + 2p 3 X k ), (49) X 2k+ =X 2 k+2 + X k+ (2X k+3 2p X k+2 p X k+ ) + p 3 X 2 k, (5) X 2k =X k+ (2X k+2 p X k+ ) + X k (2X k+3 2p X k+2 2p X k+ p 2 X k ). (5) We also need the formula for X 2k+4. It can be obtained from (49) if we replace k by k + and use (37) for X k+4. It is as follows: X 2k+4 = X k+3 (p X k+3 +2p X k+2 +2p 2 X k+ +2p 3 X k )+X k+2 (p 2 X k+2 +2p 3 X k+ ). (52) Algorithm 3 omputing the fourth-order linear recurrence {X k (p, p, p 2, p 3 )} Input: N = P m i= b i2 i, (b m = ) p, p, p 2, p 3 Output: X N, X N+, X N+2, X N+3 : X ; X 2 ; X 3 ; X 4 p 2: for j from m 2 to by do 3: x X ; x 2 X 2 ; x 3 X 3 ; x 4 X 4 4: if b j = then 5: X x x 2 (2x 4 2p x 3 p x 2 ) + p 3 x 2 ; X 2 x 3 (2x 4 p x 3 ) + x 2 (p 2 x 2 + 2p 3 x ); X 3 x x 3 (p x 3 + 2p 2 x 2 + 2p 3 x ) + p 3 x 2 2; X 4 x 4 (p x 4 + 2p x 3 + 2p 2 x 2 + 2p 3 x ) + x 3 (p 2 x 3 + 2p 3 x 2 ) 6: else if 7: X x 2 (2x 3 p x 2 ) + x (2x 4 2p x 3 2p x 2 p 2 x ); X 2 x x 2 (2x 4 2p x 3 p x 2 ) + p 3 x 2 ; X 3 x 3 (2x 4 p x 3 ) + x 2 (p 2 x 2 + 2p 3 x ); X 4 x x 3 (p x 3 + 2p 2 x 2 + 2p 3 x ) + p 3 x 2 2 8: end if 9: end for : return X, X 2, X 3, X 4

10 INTEGERS: 8 (28) As is seen from the algorithm, we need 6m multiplications and 4m squarings to compute the terms X N, X N+, X N+2, X N+3. Here, as in the previous section, we count only big multiplications. 5. omputation of Linear Recurrence Sequences of Any Order Let {W k (a,..., a n ; p... p n )} be an nth-order linear recurrence defined by the relation f k+n = P n i= p if k+n i, with the initial values W i = a i ( apple i apple n ). Let {X k (p,..., p n )} be the sequence that is derived from {W k } if a n = and the other a i =. Using the matrix method as in Lemma 2 and by mathematical induction we get the following formulas! nx Xj W k = a n X k + p j a n 2 i X k j+i, (53) W k = nx j= j= i= nxj 2 a n j i= a n j 2 i p i! X k+j. (54) If we put n = 4 in these formulas, then we obtain (38) and (39). Repeating the arguments of the previous section we get the matrix formula n X 2k+n X 2 n k+n W 3 k+n W k+n... W k+n X k+n X 2k+ A = B n X 2 n k+ W 3 k+ W k+... W k+ X k+ A. n X 2k X 2 n k W 3 k W k... W k X k (55) Here, as above, i W k denotes W k (a,..., a n ) with only one nonzero a i =. Let R = (r i,j ) be the matrix from (55). It has a special form, see (29) and (47). Note that if we know two rows of the matrix R which have numbers of di erent parity, then we can get the other rows. For example, we assume we know a formula which relates X 2k+` to X k+i ( apple i apple n ), in other words we know the (n `)th row. If we replace k by k + and use X k+n = P n i= p ix k+n i, then we get the formula for X 2k+`+2 that corresponds to the (n ` 2)th row. Repeating this procedure we obtain all rows with numbers of the same parity as the parity of the (n `)th row. Thus, to get all formulas that will be used in the algorithm, we need to know formulas for X 2k, X 2k+. For the elements of R using (53), (54) we obtain ( P j 2 X k+n (i j) l= r i,j = p lx k+n 2 l (i j), if i j, P n l=j p (56) lx k+n 2 l (i j), if i < j.

11 INTEGERS: 8 (28) Also, from the two last rows in (55) we obtain the formulas which relate X 2k, X 2k+ to X k+i ( apple i apple n ). These formulas are of the same form as (5), (5). X 2k = exk+(n 2 )/2 + bvc k+dve++i p 2i+e X k+bvc i 2 i= X k+bvc i 2iX+e j= p j X k+dve+i j A, (57) X 2k+ = p n Xk 2 + ( e)xk+n/2 2 + dve X 2i Xe X k+dve k+bvc+2+i p 2i+ e X k+dve i 2 p j X k+bvc++i i= j= j A. (58) Here, e = n mod 2 and v = n/2. The scheme for computing the terms of {W k (a,..., a n ; p,..., p n )} is: (i) Using X k+n = P n i= p ix k+n i and repeating the replacement of k by k + in (57), (58) without removing brackets, we obtain the formulas for X 2k+i ( apple i apple n). These formulas determine the rules of transition from the terms X k+i ( apple i apple n ) to X 2k+i ( apple i apple n ) and also to X 2k++i ( apple i apple n ). (ii) By using these formulas we obtain an algorithm for computing {X k } that is similar to Algorithm 3. (iii) To get the value W N, we need to use (54) after we have computed X N+i ( apple i apple n ) by the algorithm in (ii). (iv) In order to obtain W N+ we use the recurrence relation to get X N+n from X N+i ( apple i apple n ) and use (54). Remark. To compute the N th term of an nth-order linear recurrence we need n(n + )/2 log 2 N multiplications 3. Indeed, when n is even, the formulas for X 2k+2i ( apple i apple n/2) contain n/2 multiplications, 4 and for X 2k+2i+ ( apple i apple n/2 ) contain n/2 + multiplications. It is easy to see that each step of the algorithm needs n/2 formulas of the first type and n/2 formulas of the second type. Then, to compute X 2k+i ( apple i apple n ) or X 2k++i ( apple i apple n ) using X k+i ( apple i apple n ) we need n(n + )/2 multiplications. Thus, computing X N+i ( apple i apple n ) needs n(n+)/2 log 2 N multiplications. Since (54) does not contain big multiplications, the above statement is proved for even n. The proof for odd n by analogous. We implemented the above scheme in Wolfram Mathematica. An implementation is available at The main function AnyOrderRecurrence[a, p, N] returns W N (a,..., a n ; p,..., p n ), where N is a positive integer and a, p are strings of length n. 3 We use such a complexity model that multiplications involving p i are similar to additions. 4 Since they were derived from (57) without removing brackets.

12 INTEGERS: 8 (28) 2 Acknowledgments. The author is very grateful to A. Bostan for pointing to the reference [5] and for the evidence that our algorithm is one particular way of implementing Fiduccia s algorithm, where modular polynomial squarings are hardcoded. References [] W.W. Adams, haracterizing pseudoprimes for third-order linear recurrences, Math. omp (987), -5. [2] D. Bleichenbacher, W. Bosma, A.K. Lenstra, Some remarks on Lucas-based cryptosystems, in: Annual International ryptology onference, Springer, Berlin, Heidelberg, 995, [3] G.H. ho, N. Koo, E. Ha, S. Kwon, New cube root algorithm based on the third order linear recurrence relations in finite fields, Des. odes ryptogr (25), [4] E.W. Dijkstra, In honour of Fibonacci, in: Program onstruction. Lecture Notes in omputer Science 69, ed. F.L. Bauer et al., Springer, Berlin, Heidelberg, 979, [5].M. Fiduccia, An e cient formula for linear recurrences, SIAM J. omput. 4. (985), 6-2. [6] G. Gong, A. Hassan, H. Wu, and A. Yousse, An E cient Algorithm for Exponentiation in DH key Exchange and DSA in ubic Extension Fields, Faculty of Mathematics, University of Waterloo, 22. [7] G. Gong, and L. Harn, Public-key cryptosystems based on cubic finite field extensions, IEEE Trans. Inform. Theory 45.7 (999), [8] D. Gries, G. Levin, omputing Fibonacci numbers (and similarly defined functions) in log time, Inform. Process. Lett..2 (98), [9] A.F. Horadam, Basic properties of a certain generalized sequence of numbers, Fibonacci Quart. (965) 3.3, [] A.F. Horadam, Special properties of the sequence W n(a, b; p, q), Fibonacci Quart. 5.4 (967), [] M. Joye and J.-J. Quisquater, E cient computation of full Lucas sequences, Electronics Letters 32.6 (996), [2] J..P. Miller, D.S. Brown, An algorithm for evaluation of remote terms in a linear recurrence sequence, omput. J. 9.2 (966), [3] S. Rabinowitz, Algorithmic manipulation of third-order linear recurrences, Fibonacci Quart. 34 (996), [4].A. Reiter, Exact Horadam numbers with a hebyshevish accent, Vector 6 (999), [5] E.L. Roettger, H.. Williams, and R.K. Guy, Some primality tests that eluded Lucas, Des. odes ryptogr (25), [6] Z.H. Sun, Linear recursive sequences and the powers of matrices, Fibonacci Quart (2),