JOACHIM VON ZUR GATHEN & IGOR E. SHPARLINSKI (2006). GCD of Ranom Linear Combinations. Algorithmica 46(1), 137 148. ISSN 0178-4617 (Print), 1432-0541 (Online). URL https://x.oi.org/10.1007/s00453-006-0072-1. ing any of these ocuments will ahere to the terms an constraints invoke by each copyright holer, an in particular use them only for noncommercial purposes. These works may not be poste elsewhere without the explicit written permission of the copyright holer. (Last upate 2017/11/29-18 :20.) are maintaine by the authors or by other copyright holers, notwithstaning that these works are poste here electronically. It is unerstoo that all persons copy- This ocument is provie as a means to ensure timely issemination of scholarly an technical work on a non-commercial basis. Copyright an all rights therein GCD of Ranom Linear Combinations Joachim von zur Gathen B-IT Computer Security Universität Bonn 53113 Bonn, Germany gathen@bit.uni-bonn.e http://www-math.upb.e/~aggathen Igor E. Shparlinski Department of Computing Macquarie University, NSW 2109, Australia igor@comp.mq.eu.au http://www.comp.mq.eu.au/~igor April 10, 2005 Abstract We show that for arbitrary positive integers a 1,...,a m, with probability 6/π 2 + o(1), the gc of two linear combinations of these integers with rather small ranom integer coefficients coincies with gc(a 1,...,a m ). This naturally leas to a probabilistic algorithm for computing the gc of several integers, with probability 6/π 2 + o(1), via just one gc of two numbers with about the same size as the initial ata (namely the above linear combinations). This algorithm can be repeate to achieve any esire confience level. 1
1 Introuction We let a = (a 1,...,a m ) N m be a vector of m 2 positive integers, x = (x 1,..., x m ),y = (y 1,..., y m ) N m be two integer vectors of the same length, where N = {1, 2,...}, an consier the linear combinations a x = a i x i an a y = a i y i. 1 i m 1 i m Then clearly gc(a 1,..., a m ) ivies gc(a x,a y), an we want to show that in fact, equality hols quite often. For a vector u = (u 1,...,u m ) R m we efine its height as h(u) = max 1 i m u i. For an integer M, we enote by ρ a (M) the probability that, for x,y chosen uniformly in N m with height at most M, gc(a 1,..., a m ) = gc(a x,a y). (1) Assuming that the linear combinations a x an a y behave as ranom integer multiples of gc(a 1,...,a m ), it is reasonable to expect that (1) hols with probability ζ(2) 1 = 6/π 2 where ζ(s) is the Riemann zeta function, an inee we show that this hols asymptotically. In particular, our result implies that one can choose M of orer ln N in the algorithm of [2] rather than of orer N as in Corollary 3 of [2], thus reucing quite ramatically the size of the operans which arise in the algorithm of [2]. The lower boun on ρ a (M) plays a crucial role in the analysis of a fast probabilistic algorithm for computing the gc of several integers which has been stuie [2]. This algorithm, for any δ > 0, requires only about 1 ln(π 2 /(π 2 6)) ln δ 1 1.06802 ln δ 1 (2) pairwise gc computations, to achieve success probability at least 1 δ (where ln z is the natural logarithm of z > 0). For comparison, it is note that the naive eterministic approach may require up to m 1 gc computations. A rawback of that algorithm is that for its proof of correctness, the arguments given to the gc computations are substantially larger than the original inputs. In [4] we give an asymptotic lower boun on ρ a (M) (of the expecte 2
orer ζ(2) 1 ) which hols starting with very small values of M. Here we present a completely explicit an slightly stronger form of that result. More importantly, we obtain an asymptotic formula for ρ a (M) which hols in a wie range of parameters. Our results now imply that one may choose the operans of the algorithm of [2] of approximately the same size as the inputs. An exact cost analysis epens on the cost of the particular gc algorithm, a variety of which can be foun in [3]. Furthermore, we emonstrate that our result is rather tight an it fails if M is chosen substantially smaller than require for our result. A well-known fact says that gc(a 1,...,a m ) = 1 with probability ζ 1 (m) for ranom integers a 1,...,a m ; see [5], Theorem 332, for a precise formulation in the case m = 2. It is important to not confuse our result which hols for arbitrary (that is, worst-case ) inputs with the average-case result which follows from this fact. 2 Main Results We show that ρ a (M) equals ζ(2) 1 asymptotically in a wie range of parameters. More precisely, we have the following. Theorem 1. Let m 3,a Z m be of height at most N, an Then M max{9m, lnn}. ρ a (M) ζ(2) 1 19 ln(m/m). Proof. As in [2], it is enough to consier only the case where gc(a 1,...,a m ) = 1. We set Q = 1 ln(m/m), an let L be the set of all pairs of integer vectors 4 x,y N m with h(x), h(y) M, where N = {1, 2,...} For an integer k 2, we enote by P(k) the largest prime ivisor of k, an set P(1) = 1. We efine the following subsets: Q = {(x,y) L : Q P(gc(a x,a y)) > 1}, R = {(x,y) L : M > P(gc(a x,a y)) > Q}, S = {(x,y) L : P(gc(a x,a y)) M}, 3
T = {(x,y) L : p gc(a x,a y) for some prime p Q}. Obviously Q T an T \ Q R S, so that #T #Q #R + #S. Therefore we have an 1 ρ a (M) = M 2m (#Q + #R + #S) M 2m (#T + #R + #S). 1 ρ a (M) = M 2m (#Q + #R + #S) M 2m #T. From the above inequalities together we erive ρ a (M) ζ(2) 1 M 2m ( #T (1 ζ(2) 1 )M 2m + #R + #S ). (3) For an integer 1, we enote by U (M) the set of all integer vectors x N m with h(x) M an a x, an put U (M) = #U (M). Because gc(a 1,..., a m ) = 1, we obviously have U p (p) = p m 1 for any prime p. Then, for any squarefree, by the Chinese Remainer Theorem, we conclue that U () = m 1, an U (K) = K m m 1 for any integer K. It is also clear that for any prime p U p (M) M/p M m 1 M m /p + M m 1. (4) By the inclusion exclusion principle we have M 2m #T = 1 P() Q µ()u (M) 2 (5) where µ is the Möbius function. We recall that µ(1) = 1, µ() = 0 if 2 is not squarefree, an µ() = ( 1) ν() otherwise, where ν() is the number of prime ivisors of, see [5], Section 16.2. Using the boun of Theorem 4 of [7] on ϑ(x) = ln p, (6) p<x we have p = exp(ϑ(q)) exp p<q ( ( Q 1 + 1 )) exp(2q) = 2 lnq ( ) 1/2 M, m since M 732m. Thus for any squarefree with P() Q, we have (M/m) 1/2. 4
For x > 0, we have (1 + x) 1/x e, an thus with y = mx we have (1 + x) m = (1 + x) y/x e y = y i i! i 0 < 1 + y + y2 y i y 2 = 1 + y + 2 2(1 y) 1 + 2y provie that 0 < x 2/(3m). Hence ) ( ) m M M U (M) U ( = m 1 ( ) m ( M + < m 1 = Mm 1 + ) m Mm M i 0 ( 1 + 2m ) M for M 3m/2. Similarly, (1 x) 1/x 1/4 for 0 < x 1/2, an thus for 0 < mx ln 4 3 we have (1 x) m e mx ln 4 = 1 mx ln 4 + i 2 ( mx ln 4) i i! 1 mx ln 4, ) ( ) m ( M M M U (M) U ( = m 1 > m 1 ( = Mm 1 ) m ( ) Mm m ln 4 1 M M for M (m ln 4)/3. We now assume that M 3m/2, an then we have U (M) Mm Mm 2m M = 2mMm 1. We can estimate the ifference of the squares as follows. U (M) 2 M2m 2 U (M) Mm 2M m + 2mM m 1 ( 2mM m 1 2mMm 1 m + ) M 4m 2 1 M 2m 1 2 m = 8m 1 M 2m 1. ) m 5
As we have seen, if is squarefree an P() Q, then (M/m) 1/2 2M/(3m), an thus the above bouns apply. A truncate ζ-prouct can be estimate as follows: ( 1 1 ) 1 1 p 2 = p>q p k p>q 1 k 1 < 2 2 k(k + 1) = 2 Q. k Q The error in the main term for our approximation to ρ can be boune in the following way. We use the harmonic estimate 1 2 lnx x for x 3 to erive #T (1 ζ(2) 1 )M 2m = 1 P() Q µ() M2m 2 1 P() Q µ()u (M) 2 ζ(2) 1 M 2m ζ(2) 1 M 2m + 1 P() Q squarefree M (1 2m 1p ) ζ(2) 1 + 8mM 2m 1 2 p Q 8mM 2m 1 2 M/m ( = ζ(2) 1 M 2m 1 1 ) 1 1 p 2 + 8mM2m 1 ln(m/m) p>q ζ(2) 1 M 2m 2Q 1 + 8mM 2m 1 ln(m/m) ( ) = M 2m 2ζ(2) 1 Q 1 8m ln(m/m) +. M 1 6
For #R, using (4) an the inequality (a + b) 2 2(a 2 + b 2 ) we get #R U p (M) 2 2 ( ) M 2m + M 2m 2 Q<p<M Q<p<M 2M ( ) 2m 1 p(p + 1) + 1 + 2M 2m 2 1 (p + 1)(p + 2) p>q p<m 2M 2m 1 k(k + 1) + 2M2m 1 k Q ( 2 = M 2m Q + 2 ). M Finally, using (4) again, we fin #S p M = M m 1 p 2 U p (M) 2 M m 1 p M U p (M) h(x) M p M p a x 1 M m 1 M mln(mmn) ln M, since a x mmn, an each such number has at most ln(mmn)/ ln M many prime factors p M. Putting everything together an using (3), we obtain ρ a (M) ζ(2) 1 2 8m ln(m/m) + + 2 ζ(2)q M Q + 2 M + ln(mmn) M ln M. It is now convenient to efine λ = M/m. Using that ln(mmn) M lnm ln(m2 N) M ln M = 2 M + lnn M ln M 2 M + 1 ln λ for M ln N, an the trivial boun 2/M 2/(3λ), we erive ρ a (M) ζ(2) 1 8ζ(2) 1 ln λ + 8 lnλ λ + 8 ln λ + 2 3λ + 2 3λ + 1 ln λ = 8ζ(2) 1 + 9 8 lnλ + 4/3 +. ln λ λ Since 8ζ(2) 1 + 9 < 13.9 an for λ = M/m 9 we have the result now follows. 8 lnλ + 4/3 λ 7 5.1 ln λ,
We now show that for a small m, M must grow logarithmically with N for reasonably large success probability. Theorem 2. For any m 3 an M, N with 4mM 2m ln M ln N, there is a vector a Z m of height at most N such that as M. ρ a (M) (1 + o(1))m 2 (ln M) 2 Proof. The hypothesis implies that 2M 2m ln N, an we may assume that N is large enough. Let P be the set of the first T = M 2m primes p with p > M 2, an enote by (x,y) p x,y an arbitrary bijection which maps each (x,y) = (x 1,..., x m, y 1,...,y m ) N m N m of height at most M to a prime p x,y P. Let U be the set of such pairs of vectors (x,y) with x 1 y 2 x 2 y 1, an let V be the set of all other pairs. If (x,y) U, then obviously 0 < x 1 y 2 x 2 y 1 < M 2 < p x,y, an we can fin a unique integer solution 0 r x,y, s x,y < p x,y to the system of congruences x 1 r x,y + x 2 s x,y + x 3 + + x m 0 mo p x,y, y 1 r x,y + y 2 s x,y + y 3 + + y m 0 mo p x,y. Using the Chinese Remainering Theorem, we now efine integers a 1, a 2 with 0 a 1, a 2 < p, (x,y) U p x,y < p P a 1 r x,y mo p x,y, a 2 s x,y mo p x,y, for each (x,y) U. We enote by q the largest prime in P. Thus q is the smallest number satisfying π(q) M 2m + π(m 2 ), an hence q 3mM 2m ln M. We set a = (a 1, a 2, 1,..., 1). Uner the hypothesis on N, we have h(a) exp(ϑ(3mm 2m lnm)) exp(4mm 2m ln M) N, 8
where ϑ(x) is efine by (6). We also see that p x,y gc(a x,a y) for all (x,y) U. Therefore ρ a (M) M 2m #V. To estimate the carinality of V, we note that if x 1 y 2 = x 2 y 1 then for each pair (x 1, y 2 ) there are at most τ(x 1 y 2 ) possible values for the pair (x 2, y 1 ), where τ(n) is the number of positive integer ivisors of n. We recall that τ(n) = p n (α p +1), where α p is the multiplicity of the prime p in n, so that τ(ab) τ(a)τ(b) for any positive integers a, b, since α+β+1 (α+1)(β+1) hols for any α, β 0. Therefore, #V M 2m 4 τ(x 1 y 2 ) M 2m 4 τ(x 1 )τ(y 2 ) = M 2m 4 ( 1 x 1 M 1 y 2 M 1 z M 1 x 1 M 1 y 2 M τ(z)) 2 = (1 + o(1))m 2m 2 (ln M) 2, as M (see [5], Theorem 320), which conclues the proof. Of course, gc(a 1,...,a m ) is trivial to etermine in the example constructe in the proof. The example only shows that one has to be careful when esigning a universally applicable algorithm. The gap between the sufficient boun M ln N (ignoring m) an the necessary boun M (ln N) 1/6 is only polynomial. For example, we see from Theorem 2 that for m = 3, we have to choose M of orer at least (lnn) 1/6 to guarantee that ρ a (M) is not too small. 3 Algorithmic Implications Theorem 1 implies that for any a 1,...,a m, one can compute gc(a 1,...,a m ) probabilistically as the gc of two integers of asymptotically the same bit lengths as the original ata, while the result of [2] only guarantees the same for two integers of bit lengths twice more. The probability of success in both cases is, asymptotically, at least ζ(2) 1 = 6/π 2 = 0.6079.... Our algorithm is an attractive alternative to the m-step (eterministic) chain of computation gc(a 1,...,a m ) = gc(gc(a 1, a 2 ), a 3,...,a m ) = gc(...(gc(gc(a 1, a 2 ), a 3 ),...,a m ). 9
For illustration, we take l-bit primes p 1,...,p m, p = p 1 p m, an a i = p/p i for i m. Then inee m 1 steps are necessary until the gc, which equals 1, is foun. After i 1 steps, the current value of the gc has about (m i)l bits, an the reuction of the (m 1)l-bit a i+1 moulo this gc takes about 2l 2 (m i)(i 1) operations in naive arithmetic; see [3], Section 2.4. This comes to a total of about l 2 m 3 /3 operations. If one gc of n-bit integers costs about cn 2 operations, for a constant c, which amounts to the total cost of about cm 3 /3 operation. Thus the overall cost is about cl 2 m 3 (1 + c)/3 operations. In our algorithm, we can choose x i an y i of log(ml) bits (where log z is the binary logarithm of z > 0). The inner proucts together cost just over 2lm 2 log(ml) operations, an the single gc about cl 2 m 2. The latter is the ominant cost, an thus our algorithm is faster by a factor of about m/3 than the stanar one. In other wors, if k < m/3, maybe k m, an confience at least 1 ζ(2) k is sufficient, then the k-fol repetition of our algorithm is faster. (In practice, one woul not just repeat, but reuce the inputs moulo the gc caniate obtaine so far, an either fin that it ivies all of them an thus is the true gc, or continue with the smaller values.) When we have m rational numbers whose enominators are positive integers p 1,..., p m, then their sum can be expresse as a fraction with enominator lcm (p 1,...,p m ) = p/ gc(a 1,..., a m ), where p = p 1 p m an a i = p/p i for i m, as above. Thus the avantage explaine above applies to this important type of computation. We can repeat our algorithm several times, aing each time the gc compute (which is expecte to be not much larger than the true gc) to the list, until the same gc is returne twice in a row. If one wants to guarantee correctness, one can then ivie all elements in the list by the guesse gc. If it ivies evenly all elements, it is the true gc. An alternative approach woul be to iteratively replace each element in the list by its remainer moulo the smallest element in the list. This will actually calculate the gc without any gc computation. Of course, the latter are hien in the repeate ivisions with remainer. This goes to show that our moel of counting gc s an ignoring all other operations is intuitively apparent in our algorithm but cannot be turne into a rigorously efine moel of computation, as long as the gc can be calculate by the other 10
computations. 4 Remarks an Open Questions The approach of [2] leas to an algorithm for the extene gc; see [3] for the backgroun on this problem. Namely, solving the the extene gc problem for a x an a y we obtain a relation c 1 a 1 +... + c n a n = for some integers c 1,...,c n, with > 0. Repeating this the appropriate number of times, given by (2), an choosing the relation with the smallest value of, we solve he extene gc problem with probability at least 1 δ. It woul be very interesting to fin the smallest possible rate of growth of M, as a function of N an m for which ρ a (M) is boune away from zero uniformly for all vectors a Z m of height at most N. In particular, it woul be important to reuce the gap between the regions of parameters in Theorems 1 an 2 apply. Finally, we recall that ranomness is an expensive algorithmic resource. So it woul be interesting to stuy gc(a x,a y) where the vectors x, y are chosen from some parametric family of vectors for a ranom value of the parameter an thus require few ranom bits for their escription that ranom inepenent vectors; see [1, 6] for concrete examples of such algorithms for other number theoretic problems. References [1] E. Bach an V. Shoup, Factoring polynomials using fewer ranom bits, J. Symbol. Comp., 9 (1990), 229 239. [2] G. Cooperman, S. Feisel, J. von zur Gathen an G. Havas, GCD of many integers, Lect. Notes in Comp. Sci., Springer-Verlag, Berlin, 1627 (1999), 310 317. [3] J. von zur Gathen an J. Gerhar, Moern computer algebra, Cambrige University Press, Cambrige, 2003. 11
[4] J. von zur Gathen an I. E. Shparlinski, GCD of ranom linear forms, Proc. 15th Annual Symposium on Algorithms an Computation, Hong Kong, 2004, Lect. Notes in Comp. Sci., Springer-Verlag, Berlin, 2004, v.3341, 455-460. [5] G. H. Hary an E. M. Wright, An introuction to the theory of numbers, Oxfor Univ. Press, Oxfor, 1979. [6] R. Peralta an V. Shoup, Primality testing with fewer ranom bits, Comp. Compl., 3 (1993), 355 367. [7] J. B. Rosser an L. Schoenfel, Approximate formulas for some functions of prime numbers, Illinois J. Math, 6 (1962), 64 94. 12