Journal of Symbolic Computation

Transcription

1 Journal of Symbolic Computation 50 (013) 55 Contents lists available at SciVerse ScienceDirect Journal of Symbolic Computation On the evaluation of multivariate polynomials over finite fields E. Ballico a,m.elia b,m.sala a a Dipartimento di Matematica, Università degli Studi di Trento, Via Sommarive 14, 3813 Trento, Italy b Dipartimento di Elettronica, Politecnico di Torino, Corso Duca degli Abruzzi 4, 1019 Torino, Italy article info abstract Article history: Received 5 April 01 Accepted 1 July 01 Available online 1 August 01 A method to evaluate multivariate polynomials over a finite field is described and its multiplicative complexity is discussed. 01 Elsevier B.V. All rights reserved. Keywords: Multiplicative complexity Complexity Multivariate polynomials Finite field Computational algebra 1. Introduction Many applications require the evaluation of multivariate polynomials over finite fields. For instance, the so-called affine-variety codes (also called evaluation or functional or algebraic geometry codes) are obtained by evaluating a finite-dimensional linear subspace of F q [x 1,...,x r ] at a finite set S Fq r. See for example Borodin and Munro (195, Section.1), Geil (008), Hansen (001), Little (008), Winograd (1980). When the degree n of the polynomials is small, and/or the number r of variables is also small, the direct computation is efficient; however, as n, orr, or both become large, evaluation becomes an issue. The case of univariate polynomials has been extensively considered, see e.g. Paterson and Stockmeyer (193), Pan (19) and some recent papers (Elia et al. 011, in press). In Pan (19) and Winograd (1980) there are sharp lower bounds for the complexity over any infinite field K. At a first approximation, each coefficient of the polynomial a i may be seen as an indeterminate, and the objective is to find the minimal number of multiplications involving the a i s. These contributions show that each coefficient must be counted, except the constant one: the proof scheme (over an infinite field K) is so powerful that this lower bound is also an upper bound, even when addresses: edoardo.ballico@unitn.it (E. Ballico), elia@polito.it (M. Elia), maxsalacodes@gmail.com (M. Sala) /$ see front matter 01 Elsevier B.V. All rights reserved.

2 5 E. Ballico et al. / Journal of Symbolic Computation 50 (013) 55 the other multiplications, i.e. the operations involving the coordinates of the point P at which we evaluate the polynomial are taken into account. Fix an integer r 1. Over an infinite field K the complexity of the evaluation of a degree n polynomial in x 1,...,x r is O(n r ), even counting the multiplication by the coefficients of the polynomial (Carnicer and Gasca, 1990; de Boor and Ros, 199; Schumaker and Volk, 198; Lodha and Goldman, 199). The problem addressed here is different: multiplications by 0 and 1 are not counted in the computational model; instead the number of multiplications needed to evaluate the powers of the variables is counted. Hence, if the coefficients are in F, the multiplications by the coefficients are not counted, while the powers of the variables, possibly in an extension F m, are evaluated, and their computation, to be performed in this field extension, is the only contribution to the total number (hopefully the minimum number) of multiplications. The same model is applied to evaluate f F q [x 1,...,x r ] at P F q m. It is emphasized that this model is applicable only to finite field extensions. An evaluation method for multivariate polynomials is proposed which significantly reduces the multiplicative complexity (in this model) and hence the computational burden. Let p(x 1,...,x r ) be a polynomial of degree n in r variables with coefficients in a finite field F p s ; its number of terms is denoted by M r (n) = ( ) n+r r. Consider the evaluation of p(x1,...,x r ) at a point a = (α 1,...,α r ) F r p m, where m is divisible by s. A direct evaluation of p(α 1,...,α r ) is obtained from the evaluation of the M r (n) distinct monomials, a task requiring M r (n) r 1 multiplications. M r (n) 1 multiplications, and a total number A r (n) = M r (n) 1 of additions, are thus performed. The total number of multiplications required is P r (n) = M r (n) r = nr r! + r + 1 (r 1)! nr r. However, different computing strategies can require a significantly smaller number of multiplications. With the aim of developing some of these strategies, the polynomial p(x 1,...,x r ) is written as a sum s 1 p(x 1,...,x r ) = β i q i (x 1,...,x r ) (1) i=0 of s polynomials, where each q i (x 1,...,x r ) is a polynomial of degree n in r variables with coefficients in the prime field F p.thevaluep(a) can be obtained from the s values q i (α 1,...,α r ),s multiplications, and s additions in F p m. In these computations, β is represented as an element of F p m. Therefore, the analysis may be restricted to the evaluation at a point a F r p m of a polynomial q(x 1,...,x r ),inr variables, of degree n over F p. As pointed out in Elia et al. (in press,.1), the prime is particularly interesting, because of its occurrence in many practical applications, for example in error correction coding. Furthermore, in F multiplications are trivial. A description of the method in the easiest case, that is, over F and with two variables, is given. In Section 4, the description is generalized to any setting.. The computational model Two kinds of multiplications are involved in the computations: field multiplications in the coefficient field F p s and in the extension F p m. Cost 1 is assigned to all of these, except for the multiplications by 0 or 1, which are assigned cost 0. Remark 1. Some multiplications may cost much less, such as squares in characteristic, but they will be treated as cost 1. As customary, cost 0 is assigned to any data reading. Field sums could be counted separately, but the aim is to minimize the number of field multiplications, and so the value M r (n) is used as implicit upper bound for sums, that is, twice the sum of all monomials.

3 E. Ballico et al. / Journal of Symbolic Computation 50 (013) 55 5 An ordering on monomials is chosen, for example the degree lexicographical ordering (see Mora, 009b), so that input data can be modeled as an F p s string, any entry corresponding to a polynomial coefficient. Remark. A well-established method to evaluate all monomials up to degree n at a given point is to start from degree-1 monomials and then iterate from degree-r monomials to degree-r + 1 monomials, since the computations of any degree-r + 1 monomial requires only one multiplication, once all degree-r monomials are memorized. It is remarked here that the algorithm accepts as input any polynomial of a given total degree, and so the estimates are worst-case complexity, which translates into considering dense polynomials. Clearly, other faster methods could be derived for special classes of polynomials, such as sparse polynomials or polynomials with a predetermined algebraic structure. The memory requirement of the methods will not be discussed, but it can easily be seen from an inspection of the following algorithms that it is negligible compared to the computational effort. 3. The case r =, p = A polynomial P(x, y) of degree n in variables over the binary field may be decomposed into a sum of 4 polynomials, as ( P(x, y) = P 0,0 x, y ) ( + xp 1,0 x, y ) ( + yp 0,1 x, y ) ( + xyp 1,1 x, y ) = P 0,0 (x, y) + xp 1,0 (x, y) + yp 0,1 (x, y) + xyp 1,1 (x, y), () where P i, j (x, y) are polynomials of degree n i j. Therefore the value of P(x, y) in the point a = (α 1, α ) F m can be obtained by computing the four numbers P i, j (α 1, α ), the monomial α 1 α, performing three products α 1 P 1,0 (α 1, α ), α P 0,1 (α 1, α ),andα 1 α P 1,1 (α 1, α ), and finally performing three additions. Observe that all P i, j s have the same possible monomials, i.e. all monomials of degree up to n. It is not necessary to store separately P 0,0, P 0,1, P 1,0, P 1,1, because the selection of any of these is obtained by a trivial indexing rule. The polynomials P i, j (α 1, α ) can be evaluated as sums of such monomials, which can be evaluated once for all. Therefore, P(α 1, α ) is obtained performing (see Remark ) atotalnumberof P r (n) = ( n +)( n +1) 3 n 8 multiplications, a figure considerably less than n as required by direct computation. However, the mechanism can be iterated, and the point is to find the number of steps yielding the maximum gain, that is to find the most convenient degree of the polynomials that should be directly evaluated. We have the following: Theorem 1. Let P(x, y) be a polynomial of degree n over F, its evaluation at a point (α 1, α ) F m performed by iterating the decomposition (), requires a number G (n,, L opt ) of products which asymptotically is G (n,, L opt ) c n, c < 5, where L opt, the number of iterations yielding the minimum of G (n,, L), is an integer included in the interval ( 1 ) ( ) + log 4 n + ɛ < L op < log 4 n + ɛ, where ɛ and ɛ are less than 1 and O( 1 n ).

4 58 E. Ballico et al. / Journal of Symbolic Computation 50 (013) 55 Proof. The polynomial P(x, y) is decomposed into the sum of 4 polynomials that are perfect squares over F, each of which is similarly decomposed. Let P (L,h) i, j (x, y) denote the polynomials at the L-step of this iterative process, with h varying from 1 to 4 L 1. The number of polynomials after L steps is 4 L, while their degrees are not greater than n.thevaluep(α L 1, α ) is obtained performing in reverse, the reconstruction process obtaining at each step the values P (l 1,h) i, (α j 1, α ) from the values P (l,h) i, (α j 1, α ), whereas the 4 L numbers P (L,h) i, (α j 1, α ), i, j {0, 1} and h = 0,...,4 L 1, are computed from the direct evaluation of M ( n ) monomials using M L ( n ) 3 multiplications. L Therefore the total number of multiplications necessary to obtain P(α 1, α ) is a sum of M ( n ) 3plus L the number of squares 4 ( 4 L ) 1 = [ 4 L + 4 L L L+1] ; 3 the number of multiplications of kind x i y j P i, j (α 1, α ) 4 L 1 = 3 [ 4 L L + +4 L L]. Thus the total number is: G (n,, L) = ( 4 L ) 1 + ( n +1)( n +) L L 3. 3 The number of products required to evaluate P(α 1, α ) is thus a function of L, and the values of L that correspond to local minima are specified by the conditions G (n,, L) G (n,, L 1) and G (n,, L) G (n,, L + 1), from which, it is straightforward to obtain the conditions 4 L 3 n 5 4 > n ( { }) ({ } { })( 3 n n n 3 L L 14 + L L L ({ } { }) n n ), 14 L L 4 L n 4 < 4n ( { } { }) 3 n n L L + L ({ } { } ) n n + ({ } { }) n n L L L L L where {x} denotes the fractional part of x. These inequalities show that there is only one minimum that corresponds to a value of L such that 1 + log 4 ( ) ( ) n + ɛ < L op < log 4 n + ɛ, where ɛ and ɛ are O( 1 n ). Therefore, the minimum value of G (n,, L) is asymptotically G (n,, L op ) c n where c is a constant less than 5. Remark 3. In computing the bounds, essentially each monomial is computed separately. Hence the approach appears very efficient for computing several polynomials at the same point. This is exploited in the computation of the required number of multiplications when the polynomial coefficients are in F s. An application of Eq. (1) and Theorem 1 would give the asymptotic estimate

5 E. Ballico et al. / Journal of Symbolic Computation 50 (013) G s(n,, L op ) c ns, since the evaluation of any q i would cost c n. However, the polynomials q i(x, y) can be evaluated contemporarily. Therefore, computing the power necessary to evaluate the polynomial at step L only once, this leads to a total number of required multiplications G s(n,, L) = s ( 4 L ) 1 + ( n +1)( n +) L L 3 3 because only the reconstruction operations need to be repeated s times. By repeating the argument outlined in the proof of Theorem 1, it is concluded that the optimal value of L depends also on s, and asymptotically the required value of multiplications is G s(n,, L op ) c n s. 4. The case r, p A polynomial P(x 1,...,x r ) of degree n, inr variables over the field F p, is simply decomposed into asumofp r polynomials, as P(x 1,...,x r ) = x i ( xi r r P p ) i 1,...,i r x 1,...,xp r i 1,...,i r {0,1,...,p 1} = x i ( xi r r P i1,...,i r (x 1,...,x r ) ) p (3) i 1,...,i r {0,1,...,p 1} where P i1,...,i r (x 1,...,x r ) is a polynomial of degree n i j. Therefore the polynomial P(x p 1,...,x r ) evaluated at the point a = (α 1,...,α r ) F r p m can be obtained from the evaluation of all polynomials P i1,...,i r (x 1,...,x r ) at a, by evaluating the p r monomials α i αi r r (which require p r r 1multiplications), performing p r computations of p-powers, combining these factors with p r multiplications, and finally summing all results. The minimum number of steps is obtained in the following theorem. Theorem. Let L opt be the number of steps of this method yielding the minimum number of products, G p (n, r, L op ), required to evaluate a polynomial of degree n in r variables, with coefficients in F p.thenl opt is an integer that asymptotically is included in the interval 1 + B + log p n L op 1 + B + log p n where B = 1 r log (p 1)(p r 1) p r!( p r 1), that is, L op is the integer closest to B + log p n. Asymptotically the minimum G p (n, r, L op ) is included in the interval: (p 1) pr 1 1 p r p r 1 r! n r < G p (n, r, L op )< p r (p 1) pr 1 1 p r 1 r! n r. Proof. Using Eq. (3) the polynomial P(x 1,...,x r ) evaluated at the point a = (α 1,...,α r ) F r p m be obtained from the evaluation of all P i1,...,i r (x 1,...,x r ) at a, byevaluatingp r monomials α i αi r r (which requires p r r 1 multiplications), computing p r p-powers, combining these factors with p r 1 multiplications, and finally performing the required additions. This procedure can be iterated: at each step the number of polynomials is multiplied by p r and their degrees are at least divided by p. Therefore, after L steps the number of polynomials is p rl and can

6 0 E. Ballico et al. / Journal of Symbolic Computation 50 (013) 55 their degrees are not greater than n. Once the p r numbers P p L i1,...,i r (α 1,...,α r ) are known, the total number of p-powers is p rl + p r(l 1) + + p r(l L+1) = pr ( p rl ) p r 1 1 and the number of products necessary to obtain P(α) is ( p r 1 )[ p r(l 1) + p r(l ) + + p r(l L)] = p rl 1, hence the total number of required multiplications is p r 1 ( p rl ) p r 1. 1 The total number of multiplications required to compute all the monomials in all polynomials arising at step L is M r ( n p L ) r 1, and further ( ) ) (p ) (M npl r r 1 products are necessary to provide every possible term occurring in the polynomials at step L. Asa consequence, the total number of multiplications G p (n, r, L) necessary to evaluate P(a) is G p (n, r, L) = pr 1 ( p rl ) ( ) ) p r 1 + (p 1) (M npl r r 1. 1 The optimal value L op giving the minimum G p (n, r, L op ) is now sought, and should be chosen from among the local optima given by the values of L such that G p (n, r, L) G p (n, r, L 1) and G p (n, r, L) G p (n, r, L + 1). Since ( ) n M r = 1 ( { n n p L r! p L p L }) r r ( 1 + j=1 j n p L { n p L } ), then M r ( n ) is an expression which is 1 p L r! ( n ) r + O( pl ) asymptotically in n; consequently the p L n asymptotic expression G p (n, r, L) = pr+1 1 p r 1 prl + 1 ( ) r n r! p L shows that L op is asymptotically identified by the chain of inequalities 1 (p 1)(p r 1)n r p r r!(p r p rl (p 1)(p op r 1)n r p r 1) r!(p r 1) which, written in the form 1 + B + log p n L op 1 + B + log p n, shows that the unique optimal value is the integer closest to B + log p n, where B = 1 r log (p 1)(p r 1) p r!(p r 1). The minimum number of multiplications is asymptotically included in the interval p r (p 1) pr 1 p r 1 1 r! n r < G p (n, r, L op )< p r (p 1) pr 1 p r 1 1 r! n r.

7 E. Ballico et al. / Journal of Symbolic Computation 50 (013) 55 1 Remark 4. The proofs begin by evaluating certain monomials. Hence they may be extended to other finite-dimensional linear subspaces ( of F p [x 1,...,x r ], simply by taking their dimension α as vector ) n+r space instead of the integer r. For a suitable linear space V in Theorem 3, a bound of order c3 α with c 3 p r+1 might be obtained. For instance, let V (r,n) be the linear subspace of F p [x 1,...,x r ] formed by all polynomials whose degree in each variable is at most n. Wehavedim(V (n, r)) = (n + 1) r. In this case, iterating this procedure produces, at each step, a vector space V ( n/p L, r). Taking L such that p rl p dim(v ( n/p L, r)), i.e. taking L log p n/ + B with B 1 r log p(p)/ 1 r 1 r log p, we get an upper bound of order p r+1 n r/. 5. Further remarks The complexity of polynomial evaluation is crucial in determining the complexity of several computational algebra methods, such as the Buchberger Moeller algorithm (Möller and Buchberger, 198; Mora, 009a), other commutative algebra methods (Mora, 009b), and the Berlekamp Massey Sakata algorithm (Sakata 1988, 009a). In turn, these algorithms are the main tools used in algebraic coding theory (and in cryptography). This justifies special interest in the finite field case. For example, the above algorithms can be adapted naturally to achieve iterative decoding of algebraic codes and algebraic geometry codes, see e.g. Sakata (009b), Guerrini and Rimoldi (009). Other versions can decode and construct more general geometric codes, see e.g. Geil (008). Acknowledgements The authors would like to thank C. Fontanari for valuable discussions. The first author would like to thank MIUR and GNSAGA of INDAM. The third author would like to thank MIUR for the program Rientro dei cervelli. Part of the work was done while the second author was Visiting Professor at the University of Trento, funded by CIRM. References Borodin, A., Munro, I., 195. The Computational Complexity of Algebraic Numeric Problems. Elsevier, New York. Carnicer, J., Gasca, M., Evaluation of multivariate polynomials and their derivatives. Math. Comp. 54 (189), de Boor, C., Ros, A., 199. Computational aspects of polynomial interpolation in several variables. Math. Comp. 58 (198), 05. Elia, M., Rosenthal, J., Schipani, D., 011. Efficient evaluations of polynomials over finite fields. In: Australian Communications Theory Workshop, Melbourne, Australia, 31 gennaio febbraio, pp Elia, M., Rosenthal, J., Schipani, D., in press. Polynomial evaluation over finite fields: new algorithms and complexity bounds. Appl. Algebra Engrg. Comm. Comput., Geil, O., 008. Evaluation codes from an affine variety code perspective. In: Advances in Algebraic Geometry Codes. In: Ser. Coding Theory Cryptol., vol. 5. World Sci. Publ., Hackensack, NJ, pp Guerrini, E., Rimoldi, A., 009. FGLM-like decoding: from Fitzpatrick s approach to recent developments. In: Sala, M., et al. (Eds.), Gröbner Bases, Coding and Cryptography. In: RISC Book Ser., Springer, pp Hansen, S.H., 001. Error-correcting codes from higher-dimensional varieties. Finite Fields Appl. (4), Little, J.B., 008. Algebraic geometry codes from higher dimensional varieties. In: Advances in Algebraic Geometry Codes. In: Ser. Coding Theory Cryptol., vol. 5. World Sci. Publ., Hackensack, NJ, pp Lodha, S.K., Goldman, R., 199. A unified approach to evaluation algorithms for multivariate polynomials. Math. Comp. (0), Möller, H.M., Buchberger, B., 198. The construction of multivariate polynomials with preassigned zeros. Lecture Notes in Comput. Sci. 144, Mora, T., 009a. The FGLM problem and Moeller s algorithm on zero-dimensional ideals. In: Sala, M., et al. (Eds.), Gröbner Bases, Coding and Cryptography. In: RISC Book Ser., Springer, pp. 45. Mora, T., 009b. Gröbner technology. In: Sala, M., et al. (Eds.), Gröbner Bases, Coding and Cryptography. In: RISC Book Ser., Springer, pp Pan, V.J., 19. On means of calculating values of polynomials. Uspehi Mat. Nauk 1 (1 (1)), (in Russian). Paterson, M., Stockmeyer, L., 193. On the number of nonscalar multiplications necessary to evaluate polynomials. SIAM J. Comput. (1), 0. Sakata, S., Finding a minimal set of linear recurring relations capable of generating a given finite two-dimensional array. J. Symbolic Comput. 5 (3),

8 E. Ballico et al. / Journal of Symbolic Computation 50 (013) 55 Sakata, S., 009a. The BMS algorithm. In: Sala, M., et al. (Eds.), Gröbner Bases, Coding and Cryptography. In: RISC Book Ser., Springer, pp Sakata, S., 009b. The BMS algorithm and decoding of AG codes. In: Sala, M., et al. (Eds.), Gröbner Bases, Coding and Cryptography. In: RISC Book Ser., Springer, pp Schumaker, L.L., Volk, W., 198. Efficient evaluation of multivariate polynomials. Comput. Aided Geom. Design, Winograd, S., Arithmetic Complexity of Computations. SIAM, Pennsylvania.