A Probabilistic Algorithm for Computation of Polynomial Greatest Common with Smaller Factors

Page 1

A PROBABILISTIC A

OMPUTATION

OMMON

Zhang

SMALLER

FOR

GREATEST

ABSTRACT

Qidi You1,2 , Xuan Zhou1,2 , Xiyong Zhang

Xin Qian

Yang Wang

In the earlier work, Knuth present an algorithm to decrease the coefficient growth in the Euclidean algorithm of polynomials called subresultant algorithm. However, the output polynomials may have a small factor which can be removed. Then later, Brown of Bell Telephone Laboratories showed the subresultant in another way by adding a variant called �� and gave a way to compute the variant. Nevertheless, the way failed to determine every�� correctly.

In this paper, we will give a probabilistic algorithm to determine the variant �� correctly in most cases by adding a few steps instead of computing ��(��) when given ��(��) and��(��)∈ℤ[��], where ��(��) satisfies that ��(��)��(��)+��(��)��(��)=��(��), here ��(��),��(��) ∈ℤ[��]

KEYWORDS

1. INTRODUCTION

The Euclidean algorithm and the extended Euclidean algorithm of polynomials is an important research object in polynomial computer algebra. Using this algorithm, one can get the g c d. of two polynomials (denoted as gcd(��,��) when given polynomials ��(��) and ��(��)) and decides whether these polynomials are coprime or not. Specifically, if the degree of gcd(��,��) is larger than 0, ��(��) and ��(��) are not coprime, otherwise, ��(��) and ��(��) are coprime. Being coprime between two polynomials means there exist common roots between these two polynomials.

To quantify the indicator whether there exists a common root between ��(��) and ��(��), Sylvester gave a matrix in 1840 called Sylvester matrix with entries simply being the coefficients of ��(��) and ��(��). The determinant of Sylvester matrix is called resultant. Whether the resultant of ��(��) and ��(��) is nonzero corresponds to the case where ��(��) and ��(��) are coprime or not respectively. Moreover, Sylvester generalized his definition and introduced the concept of subresultant. They are nonzero if and only if the corresponding degree appears as a degree of a remainder of the Euclidean algorithm.

However, the early Euclidean algorithm of polynomials works for polynomials in��[��], here �� is a field. In 1836 Jacobi introduced pseudo division over polynomials and extended the Euclidean

Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022 DOI : 10.5121/mathsj.2022.9301 1
LGORITHM
C
OF POLYNOMIAL
C
WITH
FACTORS Yang
1,2 ,
1, 2 ,
1, 2 and
1, 2 1Space star technology co., LTD 2State Key Laboratory of Space Ground Integrated Information Technology
Euclidean Algorithm, Subresultant, Primitive Remainder Sequences,

Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022

algorithm of polynomials in field to a domain by multiplying ��(��) with a certain power of the leading coefficient of ��(��) before starting the division.

Using pseudo division, there are a lot of results about polynomials even the ideal lattice used in cryptography. From 1960, researchers built early computer algebra systems and G.C.D. computations were an important test problem. Nevertheless, using pseudo division in Euclidean algorithm causes exponential coefficients growth. In 1967, Collins [1] explained that the �� th intermediate coefficients are approximately longer by a factor of (1+√2)�� than the input coefficients. There are many ways to decrease the size of coefficients, most of them are quite inefficient, however. In this paper, we mainly focus on the subresultant algorithm and its variant. In [2], Knuth present the early subresultant algorithm and gave an elegant proof of its correctness. In [3], Brown showed the variant of subresultant algorithm and gave a way to remove the small factor of each remainder. However, the method he present didn't work always.

Recently, in [4], they show an algorithm to triangularize the basis of an ideal lattice which is often used to construct ideal lattice based cryptosystems. In their algorithm, they need to compute all the PPRSoL (the definition given in Sec.2.4) of ��(��) and ��(��). However, to obtain the PPRSoL, we need to compute each content of ����(��) satisfying ����(��)��(��)+����(��)��(��) =����(��) to remove the extra factor in each original remaindes ����(��). However, in this paper, we find a new way to obtain PPRSoL without computing ����(��) by applying the variant of subresultant algorithm.

In this paper, we give some results about the extended Euclidean algorithm. Using these results, we propose a new algorithm that outputting the PPRSoL of ��(��) and ��(��) which works for most cases.

2. PRELIMINARIES

2.1. Notations

In this paper, a matrix is denoted as uppercase bold letter and a vector is denoted as lowercase bold letter. For a matrix��∈ℝ��×��, the element in the �� th row and the �� th column of �� is expressed as ����,��. For a polynomial ��(��) with degree ��, we use ����(��) to present the leading coefficient of ��(��) and use������(��) to present the degree. The degree of a constant polynomial is defined as 0 and the degree of a zero polynomial is defined as ∞. The greatest common divisor is abbreviated to g.c.d.. Let ��[��] denote the domain of polynomials in x with coefficients in �� Unless otherwise specified, we only consider the polynomials in ℤ[��]

2.2. Some Definitions

Definition 1: [Hermite Normal Form]

a square matrix ��∈ℤ

. Then �� is Hermite Normal Form(HNF)

definition given above

only one way to define HNF. According to row or column

upper

lower

there

other different definitions

2
Given
����
if and only if it satisfies: 1) ℎ��,�� ≥1, for1 ≤�� ≤��; 2) ℎ��,�� =0, for 1≤ �� ≤ �� ≤ ��; 3) ℎ��,�� <ℎ��,��, for 1≤ �� < �� ≤ �� We need to emphasize that the
is
transformation and
or
triangularization,
are
of HNF.

Definition 2: [Primitive Polynomial] A polynomial ��(��)∈ℤ[��]

for any integer |��|>1

called a primitive polynomial

Definition 3: [Content] For a polynomial

denoted

Definition 3: [Resultant]

two

∈ℤ[��]

the content of ��(��)

��(��)

��+��

Sylvester matrix of ��(��)

��(��)

Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022 3
is
if
, ��(��)/�� ∉ℤ[��].
��(��)=�������� + +��1��+��0
,
,
as��������(��(��)), is the g.c.d of (����, ⋯,��1,��0).
Let
=�������� +⋯+��1��+��0, ��(��)=�������� +⋯+��1
0 be
polynomials with degree �� and �� respectively. Define the
and
as ��������(��,��)= [ ���� 1��(��) ���� 2��(��) ⋮ ��(��) ���� 1��(��) ���� 2��(��) ⋮ ��(��) ] = [ ���� ���� 1 ⋯ ��0 ���� ���� 1 ⋯ ��0 ⋱ ⋱ ���� ���� 1 ��0 ���� ���� 1 ⋯ ��1 ��0 ���� ���� 1 ⋯ ��1 ��0 ⋱ ⋱ ���� ���� 1 ��1 ��0](��+��)×(��+��) Then the resultant of ��(��) and ��(��) , denoted as Res(��(��),��(��)) , is the determinant of ��������(��,��) Definition 3: [Subresultant] Let ��(��) =�������� +⋯+��1��+��0, ��(��)=�������� +⋯+��1��+��0 be two polynomials with degree �� and �� respectively.For 0≤ �� <��, the �� th subresultant of ��(��) and ��(��) is the determinant of ����(��,��) defines as ����(��,��)= [ ���� ���� 1 ⋯ ���� ��+��+1 ⋯ ����+1 ⋯ ��2�� ��+1 ���� ���� ��+��+2 ����+2 ��2�� ��+2 ⋱ ⋮ ⋮ ⋮ ���� ⋯ ���� ⋯ ���� ���� ���� 1 ⋯ ����+1 ⋯ ���� ��+��+1 ⋯ ��2�� ��+1 ���� ⋮ ⋮ ⋮ ⋱ ⋮ ⋮ ⋮ ���� ⋮ ⋮ ⋱ ⋮ ⋮ ���� ���� ](��+�� 2��)×(��+�� 2��)

Mathematics

Sciences:

International Journal (MathSJ) Vol.9, No.2/3, September 2022

Remark 1. From the structure of ����(��,��) and ��������(��,��), we can tell that indeed if we delete the last 2�� columns and the last �� rows of ��(��) and ��(��) respectively in ��������(��,��), we obtain ����(��,��). Expecially, ��0(��,��)=��������(��,��)

Next we will give the conception of ideal lattice which takes an important role in the lattice based cryptography, and we mainly focus on the cases in which an ideal lattice can be derived from ��(��) and ��(��).

Ideal Lattice We define ideal lattice over a ring �� =ℤ[��]/〈��(��)〉, where ��(��) ∈ℤ[��] is a monic and irreducible polynomial of degree �� and 〈��(��)〉 is the ideal generated by ��(��) ∈ℤ[��]

the coefficient embedding

∑��

From [5], we know that the ideal generated by ��(��) forms a lattice under �� and we call it the ideal lattice ℒ generated by ��(��)

Moreover, ��(��)mod��(��) , ����(��)mod��(��) , , ��

��(��)mod��(��) form a basis of ℒ. As we can see, the basis is closely related to the Sylvester matrix of ��(��) and ��(��). When ��(��) and ��(��)

coprime over ℚ[��], the ideal lattice is full rank.

we present a lemma in [5]

Lemma 1. Let ℒ be the ideal lattice generated by ��(��)∈�� =ℤ[��]/〈��(��)〉, where ��(��) is a monic polynomial of degree

and

relatively prime to ��(��). Then the Hermite Normal Form of a basis of

The Classical Euclidean Algorithm of Polynomials overAField

Given a field ��. Let ��(��) and ��(��) ∈��[��] with ������(��)>������(��). Then the division of ��(��) and ��(��) yields a unique quotient ��(��) and remainder ��(��) such that ��(��)=��(��)��(��)+��(��) here ������(��)>������(��)

If we repeat the step for each divisor polynomial and remainder, we will obtain a sequence of remainders with decreasing degrees. Formally, a detailed procedure of the Euclidean algorithm of polynomials over a field is present as following:

Applied
and
An
4
Consider
��:�� ↦ ℤ��
������ �� 1 ��=0 ↦ (���� 1,���� 2, ⋯,��0)
.
�� 1
are
Then
that we will use later.
��
is
ℒ �� = [ ℎ1,1 ℎ1,2 ⋯ ℎ1,�� ℎ2,2 ⋯ ℎ2,�� ⋱ ⋮ ℎ��,��] satisfies ℎ��,��|ℎ��,��, for 1≤ �� ≤ �� ≤ �� ≤ ��. 2.3.
, ������(��)=������(��) ������(��).

Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022

��(��) = ��1(��)��(��)+��1(��)

��(��) = ��2(��)��1(��)+��2(��) ⋮

���� 2(��) = ����(��)���� 1(��)+����(��)

{

���� 1(��) = ����+1(��)����(��)

where������(��)>������(��1)>⋯>������(����) and all the coefficients are in the given field. Note that if deg(����)=0, it shows that ��(��) and ��(��) are coprime in ��[��], which means the resultant of ��(��) and ��(��) is nonzero.

2.4. Polynomial Remainder Sequence

The procedure of the Euclidean algorithm of polynomials over a unique factorization domain (UFD) is similar to the one over a field. The difference exits because the division between two polynomials requires exact divisibility in the given domain, which is usually impossible to realize. To solve the problem, the procedure of pseudo division is proposed, which yields a unique pseudo quotient ��(��) and pseudo remainder ��(��) such that

(lc(��))��+1��(��) =��(��)��(��)+��(��)

here ������(��)>������(��), �� =������(��) ������(��), ��(��) is equivalent with prem(��,��). Moreover, the coefficients of ��(��) and ��(��) are in the given domain.

For nonzero polynomials ��(��),��(��)∈��[��], we say ��(��) is similar to ��(��)(��(��)~��(��)) if there exist ��1, ��2 ∈�� such that ��1��(��) =��2��(��). So if we choose ��′(��) that is similar to ��(��), we can do the same step as above for ��(��) and ��′(��). Thus, we can rewrite the procedure of pseudo division: ����(��)=��(��)��(��)+����(��)

Then the detailed procedure of pseudo division is present as following:

{

��1��(��) = ��1(��)��(��)+��1��1(��) ��2��(��) = ��2(��)��1(��)+��2��2(��) ⋮ �������� 2(��) = ����(��)���� 1(��)+��������(��) ����+1���� 1(��) = ����+1

given domain.

Generally, we denote

then

))

1 , where ���� = ������(����) ������(����+1). Note that now prem(��

)=��

(��). Then

1(��)

(��),

,

��(��) form a sequence called polynomial remainder

From [5], if a remainder ��(��) =��(��)��(��)+��(��)��(��) can derive a basis of ideal lattice, ��(��) must be primitive. In this paper, we also want to obtain such remainders and we call these remainders as primitive PRS of lattice (PPRSoL). Next, we give a result about ����(��) and ����(��)

5
(��)����(��) here ������(��)>������(��1)>⋯>������(����) and all the���� and ���� are in the
��(��)=�� 1(��) and ��(��) =��0(��),
���� =(����(r�� 1
���� 2
�� 2,���� 1
������
��
, ��0
��
sequence(PRS).

Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022

2. Let ��(��)

be two polynomials with degree �� and �� respectively, where

>�� .

(��),��

)=��

(��)=(��

we represent

(��),⋯,��

(��)

(��)

(��)��(��)+��

the

in procedure of pseudo division. If ������(��

(��)��(��)

(��))/��

(��)=

)<��

(��)

for

(��)��

)<�� and:

(��))/��

Applied
6 Lemma
, ��(��)∈ℤ[��]
��
Let �� 1
0
��
be
remainders
��
��, then ����(��)=����
��
satisfies ������(����
, ������(����
1) ����
������ 2
����(��)���� 1
��,����
(�������� 2
����
�� 1
�� 2) ������(����)=�� ������(���� 1),������(����)=�� ������(���� 1) If
����(��)=����(��)��(��)+����(��)��(��) under the embedding σ,
�� = 1,0,⋯,��, then we can denote ����(��) as a sequence of vectors and we use a matrix �� to represent ����(��) as following: [ ���� ���� ��+1 ���� �� ��0 ⋱ ⋱ ���� ���� 1 ���� 1 ���� 2 ��1 ��0 ��0,��0 ⋯ ��0,0 ⋱ ⋮ ��0,��0 ⋯ ��0,0 ��1,��0 ⋯ ��1,0 �� ⋱ ��1,��1 ��1,0 ⋱ ⋮ ����,���� ⋱ ����,����](��+��)×(��+��) Also, we use �� and �� to represent the matrice denoting ����(��) and ����(��) respectively. ��= [ 1 ⋱ 1 ��1,�� ��0 ⋯ ��1,0 ⋱ ⋱ ��1,�� ��0 ��1,0 ⋱ ����,�� ���� 1 ⋯ ����,0 ⋱ ⋱ ����,�� ���� 1 ����,0] ��×��

determinant

Also according to lemma

actually an upper triangular matrix, thus the determinant of

turns out that after appropriate

the following part, we introduce some typical

differs from each other by choosing different ����

2.4.1. Euclidean Polynomial Remainder Sequences

When choosing ���� =1 for all �� in PRS, we obtain Euclidean PRS. This is a generalization of the Euclidean algorithm over integers. However, the algorithm is quite inefficient because with the proceeding of the sequence, the coefficients of the remainders grow exponentially. To be specific, we need to calculate each ����(��) and cont(����(��)) to get a eligible PPRSoL, which costs too much. So we need to determine certain ���� to ensure the efficiency.

Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022 7 ��= [ 0 ⋱ 0 ��1,�� ��0 ⋯ ��1,0 ⋱ ⋱ ��1,�� ��0 ⋯ ��1,0 ⋱ ����,�� ���� 1 ⋯ ����,0 ⋱ ⋱ ����,�� ���� 1 ⋯ ����,0] ��×�� So if we give a matrix named ����, then procedure of pseudo division can be represent as a matrix multiplication. ����=[1 ⋱ �� 1 �� ��](��+��)×(��+��) ����∙��������(��,��)=�� Here we need to show that by elementary row transformation, ���� can be transformed into ����=[1 ⋱ �� 1 �� ��](��+��)×(��+��) which means that the
of ���� equals to the determinant of ��.
2, it
row switching, �� is
�� is |∏ lc(����)���� 1 ������ ��=0 |. In
PRSs which
.

2.4.2. Primitive Polynomial Remainder Sequences

When choosing ���� =cont(prem(��

for all

in PRS, we obtain primitive PRS. Although the algorithm stops the coefficients growing exponentially in every step of the pseudo division, however, when proceeding primitive PRS, the coefficients of

(��) may be not in the given domain, which means that the

and

we obtain is not PPRSoL. So primitive PRS doesn't satisfy our requirement.

2.4.3. Subresultant Polynomial Remainder Sequences

When ���� is related to the subresultant, we obtain subresultant PRS. The equation set as following depicts the procedure of the subresultant

algorithm in [2]

Intuitively, the intact subresultant algorithm can be present in Algorithm 1. We point out that because we want to get PPRSoL, the input of every PRS algorithm in the paper contains a monic and irreducible polynomial.

Algorithm 1 Subresultant PRS Algorithm

Input: two polynomials ��(��),��(��) ∈ℤ[��] with degree �� and �� respectively and ��(��) is monic and irreducible

Output: Subresultant PRS, �� ′ 0(��),��′1(��),

1.[Initialize] �� ← ℎ ← 1, �� ′ 0(��)=��(��),�� ← 1

2.[Pseudo division]

2.1 Set δ=������(��) ������(��)

2.2 Calculate ��(��) such that ��(��)=��(��)��(��)+��(��)��(��)

3.[Adjust remainder]

3.1 ��(��)← ��(��), �� ′ ��(��)← ��(��)← ��(��)/��ℎ��

3.2 �� ← ����(��),ℎ←ℎ1 ������ 3.3 If ������(��)=0, go to Step 4

3.4 �� ← ��+1, go to Step 2

4.[Return] �� ′ 0(��),��′1(��),

Notice that for �� ′ ��(��)=��′��(��)��(��)+��′��(��)��(��) , ��′��(��) maybe not primitive in the given domain, which means that we can still decrease the coefficients of �� ′ ��(��) by removing a factor.

In [6], the author shows that the ℎ�� is indeed the ���� 1 th subresultant of ��(��) and ��(��), that is ℎ�� =������ 1(��,��). Also, in [3], the author shows that every ℎ�� is an integer and �� ′ ��(��)∈ℤ[��] and gives an elegant proof.

Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022 8
�� 2,���� 1))
��
����(��)
����
PRS
PRS
{ �� ′ 1��(��)=��′1(��)��(��)+��′1�� ′ 1(��) �� ′ 2��(��)=��′2(��)��1(��)+��′2�� ′ 2(��) ⋮ �� ′ ���� ′ �� 2(��)=��′��(��)���� 1(��)+��′���� ′ ��(��) where �� 1(��)=��(��), ��0(��) =��(��), ���� =������(��′��), ���� =���� ����+1 , �� ′ �� =(lc(��′�� 1))���� 2+1 , ��′�� =lc(��′�� 2)ℎ�� ���� 2 , ℎ1 =1, ℎ�� =(����(��′�� 2))���� 3ℎ�� 1 1 ���� 3, for 2≤�� ≤��+1.

This

Improvements of Subresultant Polynomial Remainder Sequences

another expression of

(��)=��′

stated

for the output of Algorithm 1,

might exist a divisor

author

the

In [3], the author

doesn't work

Clearly,

the method to choose

Comparing the two subresultant algorithms, we need to emphasis that all the ℎ��s are equal in the two algorithms.

3. SOME PROPERTIES OF THE SUB RESULTANT POLYNOMIAL REMAINDER SEQUENCE

Before presenting our algorithm, we give some results about the subresultant PRS.

Proposition 1. Given two polynomials ��(��)=������

+ +��1��+��0 and ��(��)=�������� + + ��1��+��0 ∈ℤ[��], where �� >��. Write ���� �� ��+1��(��) =��(��)��(��)+��(��).

Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022 9 2.4.4.
is
subresultant PRS. As
above,
�� ′ ��
��(��)��(��)+��′��(��)��(��), ��′��(��) maybe not primitive and there
���� such that ����(��)=��′��(��)/���� is primitive. So in the improvement version, the
transforms
procedure of the subresultant PRS algorithm as following, { ��1��(��)=��1(��)��(��)+��1��1(��) ��2��(��)=��2(��)��1(��)+��2��2(��) ⋮ �������� 2(��)=����(��)���� 1(��)+��������(��) where �� 1(��)=��(��) , ��0(��) =��(��) , ℎ1 =1 , ���� =������(����) , ���� =���� ����+1 , ���� = (����(���� 1))���� 2+1 , ���� =����(���� 2)ℎ�� ���� 2���� 1 ���� 2 1����, ℎ�� =(���� 2����(���� 2))���� 3ℎ�� 1 1 ���� 3 , for 2≤ �� ≤��+1 ���� is an integer such that ��′��(��)/����is a primitive polynomial.
��0 =1.
chose ���� =lc(���� 1) if lc(���� 1)|��′��(��), otherwise ���� =1. However,
����
for every ����.
��
Define the matrix If the determinant of the matrix ���� is denoted as ∆��, where ���� is the ��×�� submatrix of �� obtained by deleting the last (�� ��+2 ��) rows and the last (��+1 ��) columns from ��, �� = 0, ,�� ��+1 . Then ��(��)=∑ ∆�� ��+1 ������ �� �� ���� �� ��=0 . Moreover, we have (��������(��(��))��������(��(��))�� ��)|��(��) Proof. We first give the detail of the pseudo division procedure, { ������(��)=�������� ����(��)+��1(��) ������1(��)= ����(��1)���� �� 1��(��)+��2(��) ⋮ �������� �� 1(��)=����(���� �� 1)����(��)+���� ��(��) �������� ��(��)=����(���� ��)����(��)+��(��)

We denote

claim that

Then we explain the claim by induction on

��+1

Proposition 2. Let ��1(��),⋯,����(��)

the remainders

����(��)=����(��)��(��)+����(��)��(��), for

in improved subresultant algorithm.

��+1

=1,⋯,��. Then we have ����(����)=

Proof. According to Lemma 2, ����(��)

1 ���� (��

���� 2(��)

(��)���� 1(��)) and ������(����)=�� ���� 1 Also ������(����)=���� 2 , so ������(����)=��

�� 3 <������(�������� 1)=�� ���� 1 . Then ����(����)= 1 ���� ����(��

Because

Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022 10
��0(��) =��(��) and ���� ��+1(��) =��(��), then we
����(��) =∑ ∆��,���� ���� �� ��=0 , where ∆��,�� is the determinant of the (��+1)×(��+1) matrix ����,�� obtained by deleting the last (�� ��+1 ��) rows and the last (��+1 ��) columns except column (��+1 ��) from ��, ��= 0,…,�� ��+1,�� =0,…,�� ��. Clearly, ∆��+1=∆��,�� ��
��, ��=0, ,��
For �� =0, we have ��0(��)=��(��) and it's obvious that ���� =∆0,�� for �� =0, ,�� Next we assume that the claim holds for �� =�� 1. Then we denote �������� 1(��) and ��(��) as following, [����∆�� 1,��+1 �� ����∆�� 1,�� �� ⋯ ����∆�� 1,�� ��+1 �� ⋯ ⋯ ����∆�� 1,1 ����∆�� 1,0 ���� ���� 1 ⋯ ��0 0 ⋯ 0 0 ] Then the coefficient of ���� ��+1 �� in ����(��) is ����∆�� 1,��+1 �� �� ���� ��∆�� 1,��+1 �� if 1≤�� ≤�� and ����∆�� 1,��+1 �� �� otherwise. According to the structure of �� we know that the coefficient of ���� ��+1 �� is exactly ∆��,�� ��+1 ��. So the claim holds. From the claim we have ����(����)=∆��,�� ��=∆��+1 , so ��(��)=∑ ����(���� �� ��)���� �� �� ���� �� ��=0 = ∑ ∆�� ��+1 ������ �� �� ���� �� ��=0 . Then from the structure of ���� , we know (��������(��(��))��������(��(��))�� �� ��)|∆�� ��+1 �� . So (��������(��(��))��������(��(��))�� ��)|∆�� ��+1 ������ �� , which means (��������(��(��))��������(��(��))�� ��)|��(��).
be
obtained
Present
��
���� .
=
��
����
��
��)����(���� 1), so ����(����)= ����(���� 2) ����(���� 1)����. Then ����(����)= ����(���� 2)���� ����(���� 1)���� ����(���� 1)= ��1 ���� ��1 ��������(���� 1).
���� =(����(���� 1))���� 2+1 , ���� =����(���� 1)ℎ�� ���� 2���� 1 ���� 2 1����, then we have ����(����)= 1 ����(���� 1) (���� 1����(���� 1))���� 2+1 ����(���� 2)ℎ�� ���� 2���� (���� 2����(���� 2))���� 3+1 ����(���� 3)ℎ�� 1 ���� 3���� 1 … (��0����(��0))�� 1+1 ����(�� 1)ℎ1 �� 1��1 = 1 ���� (���� 1 ����(���� 1))���� 2 ℎ�� ���� 2 (���� 2 ����(���� 2))���� 3 ℎ�� 1 ���� 3 … (��0����(��0))�� 1 ℎ1 �� 1 = 1 ���� (���� 1 ����(���� 1))���� 2 ℎ�� ���� 2 (���� 2 ����(���� 2))���� 3 ℎ�� 1 ���� 3 … (��0 ����(��1))��0 ℎ1 �� 1 ℎ2 = = ℎ��+1 ���� Remark 2. If we do similar steps for �� ′ 0(��),��′1(��),⋯,��′��(��) in Algorithm 1 and present each �� ′ ��(��)=��′��(��)��(��)+��′��(��)��(��), then we obtain ����(��′��)=ℎ��+1 Before giving next lemmas, we first present a useful algorithm from [5]. We use the same symbols in [5], {�� ���� 1 +1,⋯,�� ����} =����, then {1,2,⋯,��} =⋃ ���� �� ��+1

Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022

Algorithm 2 A Useful Algorithm

Input:��0(��),��1(��),⋯,����(��)from improved subresultant algorithm

Output: ��0(��),��1(��),⋯,����(��)

1.When�� ∈����, �� ′ ��(��)=����(��)���� �� ,�� ← �� 1

2.When �� ∈����

2.1 Set Compute �� and ��, such that ������(����)+������(����+1)=gcd(����(����),����(����+1))

2.2 Set ����(��)=������(��)+������+1(��)������

2.3 If ����(���� ����)=1, set ����(��)=���� ����(��)���� ���� �� , �� =1,⋯,�� ����, go to Step 3; otherwise ����(��)=���� ����(��)���� ���� �� , �� ← �� 1

2.4If �� > 0, go to Step 2, otherwise go to Step 3 4.Return��0(��),��1(��),⋯,����(��)

We need to explain that Algorithm 2 is equivalent to the corresponding algorithm in [4] and we just use polynomials to express the output instead of a matrix in [4].

Then we will present some results of ��������(����(��))and ����(����).

Lemma 3. Let ��1(��),⋯,����(��) be the polynomial remainder sequence obtained in improved subresultant algorithm. Then ��������(����(��))|��������(���� 1(��)) for 0≤�� ≤�� 1

Proof. We prove this lemma by induction on ��, ��=0,…,�� 1

Suppose that �� is the Hermite Normal Form over the ideal lattice ℒ generated by ��(��)∈ ℤ[��]/〈��(��)〉, and ����(��) belongs to ℒ. When �� =0, because ��0(��) generates the ideal lattice ℒ , then all the vectors in ℒ can be divided exactly by ��������(��0(��))

Next we suppose that when ��≤�� 1, ��������(���� 1(��))|��������(����(��)), then we need to show that ��������(����(��))|��������(����+1(��))

Consider the (��+1) th equation in improved subresultant algorithm, ����+1���� 1(��) =����+1(��)����(��)+����+1(��)����+1(��),

then we know ��������(���� 1(��))��������(����(��))���� 1+1 |����+1����+1(��). Because ����+1(��) =(����+1���� 1(��) ����+1(��)����(��)) ����+1⁄ , ����+1

11
must contain a factor as the content of ����+1���� 1(��) ����+1(��)����(��) . Also ����+1 = ����(����)���� 1+1 , (��������(���� 1(��))��������(����(��))���� 1)|����+1(��) due to Proposition 1. Based on the assumption(��������(���� 1(��))|��������(����(��)), so (��������(���� 1(��))��������(����(��))���� 1)|����+1 If (��������(����(��)) ∤��������(����+1(��)), then there exists a prime �� such that ��|��������(����(��)) and (��∙��������(���� 1(��))��������(����(��))���� 1)|����+1. We give 2 cases as following: 1) �� ��������(���� 1(��))∤��������(����(��)) , which means that ��∤��������(���� 1(��)) and �� ∤ ��������(����(��)) ��������(���� 1(��)). According to Proposition 1, we know ����+1(��) =∑ ∆���� 1,�� ���� ����+1⁄���� 1 ��=0 , here

Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022

∆���� 1,�� is the determinant of the (���� 1 +2)×(���� 1 +2) matrix obtained by deleting the last ���� columns except column ���� 1 +1 �� from �� , �� =0,…,���� 1 . Because ��∤ ���� 1(��) ��������(���� 1(��)), there exits a �� >1 such that ��|����(��), which means ��| ����(����) ��������(����(��)). Thus we obtan (�� ��������(���� 1(��))��������(����(��))���� 1)|����+1 . According to equation ����+1(��)= (����+1���� 1(��) ����+1(��)����(��)) ����+1⁄ ,we have that (��∙��������(���� 1(��))��������(����(��))���� 1)|����+1(��).

(��∙��������(���� 1(��))��������(����(��))���� 1)|����+1����+1(��), which means we have get ��������(����(��))|��������(����+1(��)).

2) ��∙��������(���� 1(��))|��������(����(��)). Because ����+1 =����(����)���� 1+1, then we have result that ��������(����(��))���� 1+1|����+1 , thus (�� ��������(���� 1(��))��������(����(��))���� 1)|����+1 . As the same step in case 1, we still get ��������(����(��))|��������(����+1(��)).

So in conclusion we obtain ��������(����(��))|��������(����+1(��)) The proof is completed.

Lemma 4. Let ��1(��),⋯,����(��) be the polynomial remainder sequence obtained in improved resultant algorithm and ��1(��),⋯,����(��) be the output of Algorithm 2. If gcd(����(����),��������(����+1(��)))=��������(����(��)) for �� ≤�� 1 , then ����(����)=��������(����(��)) . Moreover, ����(����)|����(��)

Proof. We notice that from Algorithm 2, ����(��)=������(��)+������+1(��)������ , where �� and �� satisfy ������(����)+������(����+1)=gcd(����(����),����(����+1))=����(����) . If we already have gcd(����(����),��������(����+1(��)))=��������(����(��)) and ��������(����+1(��))=����(����+1), then we have ����(����)= ��������(����(��)).

When �� =��, this is a trivial result because ����(����)=����(��)=��������(����(��)). So we know ����(���� 1)= ��������(���� 1(��)),����(���� 2)=��������(���� 2(��)), ,, and so on. Thus, if gcd(����(����),��������(����+1(��)))= ��������(����(��)) for �� ≤�� 1, then ����(����)=��������(����(��))

For the second part, according to the assumption, gcd(����(����),��������(����+1(��)))=��������(����(��)), then ��������(����(��))|��������(����+1(��)). Also ����(��)=������(��)+������+1(��)������ , so ��������(����(��))|����(��). Due to ����(����)=��������(����(��)), we know that ����(����)=��������(����(��))|����(��), for 0≤ ��≤��

Lemma 5. Let ��1(��),⋯,����(��) be the polynomial remainder sequence obtained in improved resultant algorithm. Then gcd(����(����),��������(����+1(��)))=��������(����(��)) Proof. We prove this lemma by induction on ��, ��=1,…,�� 1.

First, suppose that �� is the Hermite Normal Form of the ideal lattice ℒ generated by ��(��)∈ ℤ[��]/〈��(��)〉, and ����(��) belongs to ℒ. Denote ����(����) ����(���� ����) as ���� and ���� =�� ����, here ����(��) is the corresponding polynomial of the �� th row, then ����(��)=����������(��)+∑ ����,��(��)�� ��=��+1 ������(��), where deg(����,��)<���� ����

12

Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022

From Lemma 4, ����(������)|������(��), for �� ≤�� ≤��. So ����(������)|��������(����(��)). Because ����(��)= ����(��)��(��)��������(��) belongs to ℒ and ����(��) is primitive, then gcd(����,����,��+1(��),…,����,��(��))=1,

thus there exists some �� <�� ≤�� , ��������( ����(��) ����(������))=gcd(����, ����(������) ����(������)) , which means that ��������(����(��))=gcd(����(����),����(������)). So every content of ����(��) must be a factor of ����. Specially, we have ��������(���� 1(��))=����(���� 1), which shows that the result holds for �� =�� 1.

Now assume that for �� ≥��, we have gcd(����(����),��������(����+1(��))=��������(����(��)). Then from Lemma 3, we have ����(����)=��������(����(��))

Next we consider �� 1, from the Algorithm 2, gcd(����(���� 1),����(����))=����(���� 1). Then because ����(����)=��������(����(��)) for �� ≥��, gcd(����(���� 1),��������(����(��)))=����(���� 1). So we need to show ����(���� 1)=��������(���� 1(��))

First, ��������(���� 1(��))|����(���� 1) and according to the Lemma 3, ��������(���� 1(��))|��������(����(��)), so ��������(���� 1(��))|gcd(����(���� 1),��������(����(��)))=����(���� 1) . We suppose ����(���� 1)=��∙ ��������(���� 1(��)) for a prime ��. According to Lemma 4, ����(����)=��������(����(��))=��������(����(��)) for �� ≥�� , so we have ��������(���� 1(��))|��������(���� 1(��)) . Also the step diminishes the leading coefficient and ����(���� 1)|����(���� 1), then ��������(���� 1(��))≤��������(���� 1(��)). So ��������(���� 1(��))= ��������(���� 1(��))

Consider the�� th equation in improved subresultant algorithm, �������� 2(��) =����(��)���� 1(��)+��������(��) here ���� =����(���� 1)���� 2+1 . Because ��∙��������(���� 1(��))|����(���� 1) and ��∙ ��������(���� 1(��))|��������(����(��)) , we know that ��∙(��������(���� 1(��)))���� 2+1 |���� and ��∙ ��������(���� 1(��))|����(��) , which means, if we divide the equation above by �� =��∙ (��������(���� 1(��)))���� 2+1 ��������(���� 2(��)), then �������� 2(��) �� and ��������(��) �� both belong to ℤ[��], while ����(��)���� 1(��) �� doesn't. This is a contradiction. So the proof is completed.

Using the results above, we realize that ����(����) is related to ���� which is the unknown. We tried some equations and found the following equation,

gcd(����(����),����(���� 1))=������(����(���� 1) ����(���� 1),����(���� 1))

for �� =0,1,2, ,��.Also in our experiments, the conjecture hold with extremely high probability.

4. A NEW ALGORITHM FOR COMPUTATION OF POLYNOMIAL GREATEST COMMON

In this section, we give a probabilistic subresultant algorithm by applying the results in the last section. We need to emphasis that the algorithm is not deterministic yet. The detail of the algorithm is present as following.

13

Applied Mathematics

Sciences:

International Journal (MathSJ) Vol.9, No.2/3, September

Algorithm 3 Probabilistic Subresultant Algorithm

Input: two polynomials

Output: Probabilistic

1.[Initialize]

2.Compute

3.

4.When

4.2

degree

and

and ��(��)

monic and irreducible

5. CONCLUSIONS

In this paper, we give some results about the contents and small factors of remainders during Euclidean algorithm of polynomials. By applying these results, we proposed a probabilistic subresultant which can output correct remainders with high probability.

Due to the case of failure, the next research will be focus on the exact expression of each ���� and relation between ����(����) and cont(����(��)) to obtain a determinisitic improved subresultant algorithm.

REFERENCES

[1] G.E. Collins. Subresultants and reduced polynomial remainder sequences. J. ACM, 14(1): 128 142 (1967)

[2] D.E. Knuth. The art of computer programming. Seminumerical Algorithms. vol. 2, 3rd Edition, 1998 (1st Edition, 1969)

[3] W.S. Brown. The subresultant PRS algorithm. ACM Trans. Math. Software, 4(3):237 249 (1978)

[4] Y. Zhang, R.Z. Liu, D.D. Lin. Fast Triangularization of Ideal Latttice Basis. Journal of Electronics and Information Technology, 42(1): 98 104 (2020)

[5] Y. Zhang, R.Z. Liu, D.D. Lin. Improved Key Generation Algorithm for Gentry's Fully Homomorphic Encryption Scheme. ICISC: 97 111 (2018)

[6] J Gathen, T Lücking. Subresultants Revisited. Latin American Symposium on Theoretical Informatics, LNCS 1776: 318 342

and
An
2022 14
��(��), ��(��)∈ℤ[��] with
��
�� respectively
is
subresultant PRS, ��0(��),��1(��),
�� ← ℎ ← 1, ��1(��)← ��(��),��2(��)← ��(��),�� ← 1
����(��2)��+1��1(��) ��(��)��2(��)=��(��), here ������(��)<������(��2), �� =������(��1) ������(��2)
��(��)← ��1(��), ��1(��)←��2(��), ��2(��)←��(��)
������(��2)≠0, 4.1 �� ←����(��2), ℎ← ����ℎ1 ��
��← gcd(ℎ,��������(��2(��))), ��′← gcd(����(��)/��������(��(��)),��������(��(��))) 4.3 ��←/��′, ����(��)←��(��)/(��ℎ����) 4.4 �� =������(��1) ������(��2) 4.5 Compute ����(��2)��+1��1(��) ��(��)��2(��)=��(��), ������(��)<������(��2), �� =������(��1) ������(��2) 4.6 ��(��)← ��1(��), ��1(��)←��2(��), ��2(��)←��(��)/(��ℎ�� ) 4.7 �� ←��+ 1 5.[Return] ��0(��),��1(��),⋯ For the often used polynomials in ideal lattice based cryptography ���� +1 and ���� �� 1, here �� is a power of 2, we give the experiment results. For each polynomial, we sample 10000 examples randomly with coefficients in the range [ 20,20] and the correctness is present below. Polynomial ���� +1 ���� �� 1 Correctness 97.88% 99.73%

Turn static files into dynamic content formats.

Create a flipbook
Issuu converts static files into: digital portfolios, online yearbooks, online catalogs, digital photo albums and more. Sign up and create your flipbook.