On arithmetic

and the discrete logarithm problem in class groups of curves

Der Fakultät für Mathematik und Informatik der Universität Leipzig

eingereichte

Habilitationsschrift

zur Erlangung des akademischen Grades

doctor rerum naturalium habilitatus

(Dr. rer. nat. habil.) vorgelegt von Dr. Claus Diem

geboren am 24.10.1972 in München Leipzig, den 7.5.2008

Hiermit erkläre ich, die vorliegende Habilitationsschrift selbständig und ohne unzulässige fremde Hilfe angefertigt zu haben. Ich habe keine anderen als die angeführten Quellen und Hilfsmittel benutzt und sämtliche Teststellen, die wörtlich oder sinngemäß aus veröffentlichten oder unveröffentlichten Schriften entnommen wurden, und alle Angaben, die auf mündlichen Auskünften beruhen, als solche kenntlich gemacht. Ebenfalls sind alle von anderen Personen bereitgestellten Materialien oder erbrachten Dienstleistungen als solche gekennzeichnet.

On arithmetic

and the discrete logarithm problem in class groups of curves

Claus Diem

Contents

Introduction v

1 Computational problems, computational models, and complexity 1 1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1.2 Computational problems . . . . . . . . . . . . . . . . . . . . . 2

1.2.1 Representations . . . . . . . . . . . . . . . . . . . . . . 2 1.2.2 A formalism for computational problems . . . . . . . . 6

1.3 The O-notation . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1.4 Bit-complexity . . . . . . . . . . . . . . . . . . . . . . . . . . 13

1.4.1 Some comments on bit-complexity . . . . . . . . . . . 13 1.4.2 Bit oriented Random Access Machines . . . . . . . . . 14 1.4.3 Randomization . . . . . . . . . . . . . . . . . . . . . . 19

1.5 The use of the word “algorithm” . . . . . . . . . . . . . . . . 20 1.6 Algebraic complexity . . . . . . . . . . . . . . . . . . . . . . . 21

1.6.1 Terminology . . . . . . . . . . . . . . . . . . . . . . . 21 1.6.2 Computation trees . . . . . . . . . . . . . . . . . . . . 22 1.6.3 R-RAMs . . . . . . . . . . . . . . . . . . . . . . . . . 22 1.6.4 Generic field RAMs . . . . . . . . . . . . . . . . . . . 25 1.6.5 Algebraic computational problems . . . . . . . . . . . 28 1.6.6 Algebraic complexity and bit-complexity over finite

fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

1.7 Algebraic complexity and finite algebras . . . . . . . . . . . . 30 1.7.1 Computing in finite algebras . . . . . . . . . . . . . . 31 1.7.2 Factoring finite commutative algebras and polynomials 33 1.7.3 Computational problems and finite field extensions . . 36

2 Representations and basic computations 39 2.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 2.2 Terminology and notation . . . . . . . . . . . . . . . . . . . . 40 2.3 Representing finite separable field extensions . . . . . . . . . 43 2.4 Representing curves . . . . . . . . . . . . . . . . . . . . . . . 48 2.5 Representing points and divisors and related computational

problems . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 2.5.1 Overview . . . . . . . . . . . . . . . . . . . . . . . . . 50 2.5.2 The coordinate representation . . . . . . . . . . . . . . 52 2.5.3 Reduced matrices and Hermite normal forms . . . . . 54

2.5.3.1 Degree-reduced matrices . . . . . . . . . . . 54 2.5.3.2 Monomial orders . . . . . . . . . . . . . . . . 59 2.5.3.3 Hermite normal forms . . . . . . . . . . . . . 63 2.5.3.4 Modules over extension fields . . . . . . . . . 66

2.5.4 The ideal representation . . . . . . . . . . . . . . . . . 68 2.5.4.1 The idea and some notation . . . . . . . . . 68 2.5.4.2 On the maximal orders . . . . . . . . . . . . 70 2.5.4.3 Ideal arithmetic . . . . . . . . . . . . . . . . 72 2.5.4.4 Divisor arithmetic . . . . . . . . . . . . . . . 76 2.5.4.5 Curves over extension fields . . . . . . . . . . 79 2.5.4.6 Changing representations . . . . . . . . . . . 81 2.5.4.7 Computing Riemann-Roch spaces . . . . . . 84 2.5.4.8 Heß’ algorithm and non-archimedean lattices 88

2.5.5 The global representation . . . . . . . . . . . . . . . . 95 2.6 Representing divisor classes and computations in the class

group . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 2.7 Appendix: Computing the maximal order . . . . . . . . . . . 104

3 Computing discrete logarithms 113 3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 3.2 The index calculus method . . . . . . . . . . . . . . . . . . . 114

3.2.1 The setting . . . . . . . . . . . . . . . . . . . . . . . . 114 3.2.2 Sparse linear algebra . . . . . . . . . . . . . . . . . . . 117 3.2.3 The general algorithm . . . . . . . . . . . . . . . . . . 119 3.2.4 Analysis of general algorithm . . . . . . . . . . . . . . 123 3.2.5 Some historical remarks . . . . . . . . . . . . . . . . . 125 3.2.6 Large prime variation and double large prime variation 127

3.2.6.1 Large prime variation . . . . . . . . . . . . . 128 3.2.6.2 Double large prime variation . . . . . . . . . 129

3.3 Index calculus with double large prime variation for curves of fixed genus . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 3.3.1 Introduction and results . . . . . . . . . . . . . . . . . 132 3.3.2 The index calculus algorithm . . . . . . . . . . . . . . 134 3.3.3 Analysis of the index calculus algorithm . . . . . . . . 138 3.3.4 On the number of special divisors . . . . . . . . . . . . 143 3.3.5 Finding a generating system . . . . . . . . . . . . . . . 146

3.4 Index calculus for curves of lower-bounded genus . . . . . . . 152 3.4.1 Introduction and results . . . . . . . . . . . . . . . . . 152 3.4.2 The algorithm . . . . . . . . . . . . . . . . . . . . . . 154

3.5 Index calculus for elliptic curves over extension fields . . . . . 157 3.5.1 Introduction and results . . . . . . . . . . . . . . . . . 157 3.5.2 The algorithms . . . . . . . . . . . . . . . . . . . . . . 163

3.5.2.1 The decomposition algorithm . . . . . . . . . 163 3.5.2.2 The algorithm for Theorem 4 . . . . . . . . . 167 3.5.2.3 The algorithm for Theorem 5 . . . . . . . . . 170

3.5.3 Computing a suitable covering . . . . . . . . . . . . . 173 3.5.3.1 Even characteristic . . . . . . . . . . . . . . . 173 3.5.3.2 Odd characteristic . . . . . . . . . . . . . . . 173

3.5.4 Some results on multihomogeneous polynomials …. 174 3.5.4.1 Intersection theory in (ℙ_{k}^{1})^{n} . . . . . . . . . . 174 3.5.4.2 Multigraded resultants . . . . . . . . . . . . 176 3.5.4.3 Computing resultants and solving systems . 179 3.5.4.4 Interpolation . . . . . . . . . . . . . . . . . . 184

3.5.5 The summation polynomials . . . . . . . . . . . . . . 185 3.5.6 Geometric background on the algorithm and analysis . 189

3.5.6.1 Weil restrictions . . . . . . . . . . . . . . . . 189 3.5.6.2 Background on the factor base . . . . . . . . 192 3.5.6.3 Study of the factor base . . . . . . . . . . . . 192 3.5.6.4 The role of the summation polynomials … 197 3.5.6.5 Determination of non-zero-dimensional fibers 202

Bibliography 209

Deutsche Zusammenfassung 217

Introduction

In this work computational problems related to divisors and divisor classes on curves are studied from a complexity theoretic point of view. Particular emphasis lies on the complexity of the discrete logarithm problem in degree 0 divisor class groups of curves over finite fields. Here we study the following general question: What interesting results on expected running times can one obtain if one imposes conditions on the genera and the ground fields but no further conditions on the curves and one bounds the expected running times in terms of either q^{g}, where q is the cardinality of the ground field and g the genus of the curve, or in terms of the cardinality of the degree 0 class group?

Note here that if E is an elliptic curve over a field K, the group of rational points E(K) of E is canonically isomorphic to Cl^{0}(E), the degree 0 class group of E over K. We consider therefore in particular the discrete logarithm problem in the groups of rational points of elliptic curves over finite fields.

Additionally, the work contains a contribution on the foundations of algorithmic mathematics.

The main results

The main results are the following five new theorems on the discrete logarithm problem in degree 0 class groups of curves. The underlying complexity model is always a randomized random access machine model with logarithmic cost function. Of course, Theorem 4 also holds for a randomized Turing machine model.

Theorem 1 Let some natural number g ≥ 2 be fixed. Then the discrete logarithm problem in the degree 0 class groups of curves of genus g over finite fields can be solved in an expected time of

Õ(q^{2− \frac{2}{g}}) ,

where 𝔽_{q} is the ground field of the curve.

Theorem 2 Let some natural number g_{0} ≥ 2 be fixed. Then the discrete logarithm problem in the degree 0 class groups of curves of genus ≥ g_{0} over finite fields can be solved in an expected time of

Õ((q^{g})^{\frac{2}{g_{0}} (1− \frac{1}{g_{0}} )}) ,

where 𝔽_{q} is the ground field and g the genus of the curve.

Theorem 3 Let some natural number g_{0} ≥ 2 be fixed. Then the discrete logarithm problem in the degree 0 class groups of curves C/𝔽_{q} of genus ≥ g_{0} over finite fields can be solved in an expected time of

Õ((# Cl^{0}(C))^{\frac{2}{g_{0}} (1− \frac{1}{g_{0}} )}) .

In the following two theorems, q is always a prime power and n a natural number.

Theorem 4 Let ϵ > 0. Then the discrete logarithm problem in the groups of rational points of elliptic curves over finite fields 𝔽_{q^{n}} with (2 + ϵ) · n^{2} ≤ log_{2}(q) can be solved in an expected time which is polynomially bounded in q.

Theorem 5 Let some natural number n ≥ 2 be fixed. Then the discrete logarithm problem in the groups of rational points of elliptic curves over finite fields 𝔽_{q^{n}} can be solved in an expected time of

Õ(q^{2− \frac{2}{n}}) .

All these theorems can be found in Chapter 3 with the same numbering. More precisely, the locations of the theorems are respectively: Theorem 1: Section 3.3, Theorem 2 and Theorem 3: Section 3.4, Theorem 4 and Theorem 5: Section 3.5.

As a corollary to Theorem 4 one obtains easily:

Let again ϵ > 0, and let a > 2 + ϵ. Then the discrete logarithm problem in the groups of rational points of elliptic curves over finite fields 𝔽_{q^{n}} with (2 + ϵ) · n^{2} ≤ log_{2}(q) ≤ a · n^{2}, where q is a prime power and n a natural number, can be solved in an expected time of

e^{O(1)·(log(q^{n}))^{2/3}} .

Indeed, we obtain an expected running time which is polynomially bounded in

q = 2^{log_{2}(q)} = 2^{(log_{2}(q))^{(1+1/2)·2/3}} ≤ 2^{(\sqrt{a}·n log_{2}(q))^{2/3}} .

This result establishes for the first time that there exists a sequence of finite fields of increasing size such that the elliptic curve discrete logarithm over these fields can be solved in an an expected time which is subexponential in the input length.

As a special case of Theorem 3 we obtain:

One can solve the discrete logarithm problem in the degree 0 class groups of curves C/𝔽_{q} of genus at least 3 in an expected time of

Õ((# Cl^{0}(C))^{\frac{4}{9}} ) .

In contrast, for any sequence of curves over finite fields such that the group order is divisible by a prime of size Θ(# Cl^{0}(C)), “generic methods” have an expected running time of Ω(# Cl^{0}(C)^{\frac{1}{2}} ).

Theorem 2 is a variant of Theorem 3, and clearly both Theorem 2 and Theorem 3 imply Theorem 1. Theorem 5 can be seen as an analog of Theorem 1 by substituting the genus g by the extension degree n. From a theoretical point of view, the analogy goes deeper: In both cases, the group under consideration is in a natural way isomorphic to the group of rational points in an abelian variety over 𝔽_{q}. In the former case it is the Jacobian variety of the curve, and in the latter case it is the Weil restriction of the elliptic curve with respect to the extension 𝔽_{q^{n}}|𝔽_{q}. The dimensions of these abelian varieties are g and n respectively. Even though Theorem 1 and Theorem 5 are analogous, we are not able to prove an analog of Theorems 2 or 3 for elliptic curves over extension fields.

Related results

Concering the general question on the discrete logarithm problem in degree 0 class groups of curves over finite fields posed at the beginning, besides the new results mentioned above, we are aware of the following results:

With the baby-step-giant-step algorithm and the results on arithmetic in class groups presented in Section 2.6, the discrete logarithm problem can be solved in a time of Õ(# Cl^{0}(C)^{\frac{1}{2}} ). By the bound # Cl^{0}(C) ≤ (\sqrt{q} + 1)^{2g} one can also obtain results in terms of q^{g} instead of # Cl^{0}(C).

Besides these results, there is only one additional (proven) result we are aware of: It is the result on “high genus curves” by F. Heß which can be found in [Heß05]. Let us in order to formulate the result introduce the standard complexity function

L_{N}[α, c] := e^{c·log(N)^{α}·(log log(N))^{1−α}}

for parameters α ∈ (0, 1) and c > 0. Then the result is:

Let us consider a class of curves over finite fields such that log(q) ∈ o(g log(g)), where as usual q is the cardinality of the ground field and g is the genus. Then the discrete logarithm problem in the degree 0 class groups of such curves can be solved in an expected time of

L_{q^{g}}[\frac{1}{2}, 32^{\frac{1}{2}} + ϵ]

for any ϵ > 0.

Similarly to the previous result, one can also obtain corresponding results in terms of # Cl^{0}(C) via the bound (\sqrt{q} − 1)^{2g} ≤ # Cl^{0}(C).

By reading the work [Heß05] in conjunction with the present work, the reader obtains an up-to-date account on the complexity of the discrete logarithm problem for classes of curves defined by imposing conditions on the genera and the ground fields.

We note that by considering certain “transfers” to “easier” groups one can obtain further classes of curves for which interesting statements on the complexity of the discrete logarithm problem hold. We mention here the supersingular elliptic curves; the discrete logarithm problem for these curves can be solved in an expected time of L_{q}[\frac{1}{2}, 12^{\frac{1}{2}} + o(1)] via a transfer to the multiplicative group of an extension of degree at most 6 of the ground field.

In this work we do not consider any kind of “transfer”. Neither do we apply advanced changes of the representation of the curves under consideration, contrary to the suggestion put forward in [Die06]. We note that one might argue that for Theorems 4 and 5 we pass from the 𝔽_{q^{n}}-rational points of an elliptic curve E over 𝔽_{q^{n}} to the 𝔽_{q}-rational points of the Weil restriction of E with respect to 𝔽_{q^{n}}|𝔽_{q}. The important aspect is here nonetheless that no computation is performed in doing so. Indeed, the algorithm can be formulated without even mentioning the Weil restriction, and we do so.

Computational models and representations

In order to make a computation problem – like, for example, the discrete logarithm problem in degree 0 class groups of curves over finite fields – well defined, one has to state how the mathematical objects under consideration are represented for the computations. In Chapter 2 we discuss various possibilities to represent the objects under consideration: (non-singular, proper) curves, as well as divisors and divisor classes on curves. Our starting point is here the representation of a curve via a plane model, whereby we mean a possibly singular plane curve which is birational to the curve under consideration. We discuss various ways to represent divisors, with an emphasis on the ideal theoretic method inspired by the analogous task for number fields. We do not consider methods which use expansions at singular points because these methods lead – in particular in small positive characteristic – to various complications which can easily be avoided with the ideal theoretic approach.

We discuss basic manipulations of divisors and divisor classes, and in particular the computation of the so-called “Riemann-Roch space” L(D) of a divisor D. Also, we discuss how one can efficiently change between the various representations we describe. The results are based on a particular “field oriented” model of computation which we define in Chapter 1.

The main purpose of this chapter is to show that there are natural ways to represent curves, divisors and divisor classes such that basic computations can be performed in an number (or expected number) of field and bit operations which is polynomially bounded in certain input parameters. The results also translate to corresponding results over finite fields and in a bit-oriented model. The most important result for the discrete logarithm algorithms is that with a particular representation one can perform the computation in degree 0 class groups of curves over finite fields in the so-called free representation (where divisors are represented by formal sums of closed points) in an expected time which is polynomially bounded in the genus of the curve and the logarithm of the cardinality of the ground field (see Proposition 2.117).

Chapter 1 is more abstract: We discuss various problems which might be described as lying in the foundations of computational mathematics.

In complexity theoretic statements one often represents mathematical objects by other objects, often bit-strings. We are of the opinion that it is convenient to talk about representations not only in terms of representations by bit-strings but also by other kind of mathematical objects. Let us illustrate this with an example: Say we want to represent divisors on curves. We would like to express that we represent divisors by formal sums of closed points, but we do not want at that particular point in time consider the task to represent the closed points. A natural statement would then be the following sentence: “We represent divisors on curves by closed points.” But now the question arises if one can give a precise mathematical meaning to this sentence. With other words: Can one define mathematical objects which capture the intuition of this sentence? We propose to capture a sentence like the one under consideration with an essentially surjective partial functor between two large groupoids.

In computational mathematics (especially in computational number theory), one often reads about “bit-operations”, but very often at the same time no computational model is given. We propose a particular model which we call the bit-RAM model to capture the intuitive meaning of bit complexity.

Further, we introduce what we call the “generic field RAM” model. This is an abstract computational model which is designed to capture the idea of an algorithm which can be applied to instances of a computational problem over various fields. It captures the idea of “uniformity” in a stronger sense than any “algebraic” model in the literature we are aware of.

Related works

We mention now how this work relates to previous work by both other authors and the author, and we give some more information about the methods used to establish the results.

As already mentioned, all theorems mentioned above are new.

The algorithms for all the theorems rely on the so-called index calculus method which roughly consists of finding relations between prime divisors in a set of “medium size” and input elements and solving the discrete logarithm problem via linear algebra.

The theorems are as follows related to previous work by other authors: The idea to apply the index calculus method to curves of a fixed genus

goes back to P. Gaudry ([Gau00]). After a first improvement was suggested by R. Harley, it was realized by N. Thériault ([Thé03]) that by applying a large prime variation one can decrease the expected running time by a factor which is superpolynomial in the input length. The idea to use a double large prime variation goes back to K. Nagao and independently to P. Gaudry and E. Thomé. In both cases, the authors argued that on a heuristic basis it should be possible to obtain an expected running time of Õ(q^{2− \frac{2}{g}}) for hyperelliptic curves of fixed genus g in imaginary quadratic representation. Later a complete proof for hyperelliptic curves in imaginary quadratic representation and with cyclic degree 0 class group was given by Gaudry, Thomé and Thériault. A substantially easier proof for the same class of curves was then given by the author, and the work has meanwhile been published (see [GTTD07]). To obtain Theorem 1, we modify the construction of the graph of large prime relations, and we give an efficient procedure to compute a small system of group elements which with high probability is a generating system.

The proofs of Theorems 2 and 3 are then not so difficult. They rely on a quite weak statement on the probability that a uniformly distributed divisor splits into prime divisors whose degree satisfies a particular upper bound. The statement we need can be obtained from a certain much more refined statement in the work by F. Heß on the computation of discrete logarithms in degree 0 class groups of “high genus” which was already mentioned above ([Heß05]).

The algorithms for Theorem 4 and Theorem 5 rely on what we call a “decomposition procedure” which in turn is based on solving systems of multivariate equations. The systems in turn are obtained with appropriate homogenizations of the so-called summation polynomials introduced by I. Semaev in [Sem98].

Shortly after Semaev made his preprint available, it was realized by Gaudry that one can use these summation polynomials to obtain interesting complexities for fixed extension degree. In the meantime Gaudry’s work has been accepted for publication, and the present publicly available version of his work ([Gau04b]) also contains a “Theorem” in which the statement of Theorem 5 is claimed. We would however like to point out that Gaudry’s work in various substantial ways falls short of establishing this result. More details on the shortcomings of Gaudry’s work can be found in subsection 3.5.1.

Already at a presentation at the Elliptic Curve Cryptography Workshop (ECC) in Bochum in 2004, the author has argued that on a heuristic basis a statement similar to the corollary to Theorem 4 should hold. But it is only this work which contains a proof that there really does exist a sequence of increasing finite fields over which the elliptic curve discrete logarithm problem is solvable in subexponential time.

We consider most results in Chapter 2 to be “more or less known” to the experts. However, the fragmented literature on the questions studied in Chapter 2 made it hard for the author to judge if really all basic computations related of divisors which are necessary for the index calculus algorithms can be performed in a satisfying complexity for all curves. A related problem is that one should be careful in interpreting statements in the literature that certain computations can be performed in a particular time. Sometimes there are hidden restrictive assumptions, and in any case one should be careful to check if the representation used can efficiently be transformed into a representation one needs for other purposes.

As already remarked, we focus on the ideal theoretic approach to divisors. A key algorithm for this approach, namely an ideal-based algorithm for computation of Riemann-Roch spaces, has been published in [Heß01]. Further information on ideal arithmetic for number fields can be found in the book [Coh96], and often statements from [Coh96] can easily be transferred to function fields.

We would however like to stress that even though the basic techniques in this chapter where surely known before, some key statements in this chapter have not appeared in the literature before. Here we mention as examples the efficient transformation between the different representations we discuss and the factorization free computation of the maximal order.

It is our hope that this chapter will serve as a useful reference.

Chapter 1 consists mostly of definitions some of which are completely new while others are variants of definitions in the literature.

On the nature of this work

As already indicated in the beginning, we view this work as lying within the realm of complexity theory. Because of the objects under consideration and the methods employed, the work also falls within arithmetic algebraic geometry.

The discrete logarithm problems in the groups of rational points of elliptic curves over finite fields and more generally in degree 0 class groups of curves over finite fields have been suggested as primitives for public key cryptographic systems. The reader might therefore ask himself: What is the relationship between this work and cryptology? Is there any cryptologic application of the results obtained in this work?

Our answer is that this depends on the meaning of the word “cryptology” one has in mind. Surely the area of cryptology should include the design and analysis of cryptographic systems – whereby we mean practical cryptographic systems. Some researchers also consider the part of complexity theory dealing with theoretical problems which are motived by questions related to secrecy as being part of cryptology.

To us it seems however to be more appealing to reserve the work “cryptology” for the study of questions which are indeed related to potential practical applications. With this meaning of the word in mind, we clearly want to state:

This work does not fall into the realm of cryptology.

Moreover, the work is related to cryptologic questions only tangentially, if at all. It would clearly be a misuse of this work to evaluate the security of (practical) cryptographic systems on the basis of the asymptotic complexity theoretic statements in this work or the absence thereof.

We would like to take the opportunity and reflect a bit on the nature of works in complexity theory. Given the language of complexity theory – in which sentences like “Given X one can compute Y in time T ” are made – one might have the feeling that complexity theory is part of applied mathematics. We would however like to point out that this would be a misconception. Indeed, in complexity theory a statement like the one above does not at all mean that something can really be computed in the sense that a physical machine outputs a result. Rather, the statement is an abbreviation for a longer statement in which the existence of certain mathematical objects with certain well-defined properties is asserted (for example the existence of a Turing machine with certain properties).

In short, we view this work as lying within complexity theory and for a large part also within arithmetic algebraic geometry, which both lie within pure mathematics.

We mention that this work contains no computer experiments. This is deliberate. Indeed, computer experiments would not bring us any closer to the goal we have set ourself: To study the discrete logarithm problem in class groups of curves from a complexity theoretic point of view.

Acknowledgments

I thank J. Adler, A. Bluher, A. Enge, G. Frey, S. Galbraith, P. Gaudry, F. Heß, M.-D. Huang, K. Khuri-Makdisi, V. Miller, A. Odlyzko, J. Scholten, E. Thomé, N. Thériault, E. Volcheck, and M. Wendt for discussions related to this work. xiv Introduction

Chapter 1

Computational problems, computational models, and complexity

1.1 Introduction

In order to make a computational problem, like for example the discrete logarithm problem in degree 0 class groups of curves, well defined, one has to answer the following questions.

• On what computational model is the problem based?

• What complexity measure / cost function is used?

• How are the mathematical objects under consideration represented?

It suggests itself to ask for a computational model and a complexity measure which captures the intuitive notion of bit-complexity and at the same time allows for efficient indirect addressing. Surely, if indirect addressing is desired, RAM models are an appropriate answer. A problem is however that RAM models are always based on a particular set of commands, and the selection of these commands is associated with a certain arbitrariness. In order to overcome this arbitrariness we define a particular Random Access Machine (RAM) model which we call bit-oriented Random Access Machine (bit-RAM). Information on this can be found in Section 1.4.

The bit-oriented approach is however not always the most appropriate one to model computational problems. For example, given a field k, one might enquire about the complexity to multiply two matrices with entries in k, measured in field operations in k. In this case, it does not seem to be appropriate to demand that the field elements be represented by bitstrings (which is only possible when the field is countable anyway). Rather, one wishes to take what is called a “macroscopic standpoint starting from an idealized computer” in [BCS91]. One then enters the field of algebraic complexity. Models based on this approach are discussed in Section 1.6. Moreover, often computational problems can be formulated for arbitrary fields (for example the multiplication of two matrices). In this case, it is appropriate to ask for a uniform algorithm for all inputs over over all fields. We propose such a uniform computational model which we call a generic field RAM. Most of the results of Chapter 2 on basic computations related to curves and their divisors rely on variants of this model.

Additionally to presenting the bit-RAM and the generic field RAM model and randomized variants of these and deriving some basic properties of these models, we propose in this chapter a body of definitions related to computational problems.

1.2 Computational problems

We now propose some definitions which make it possible to talk about computational problems from the point of view of “mathematical content”, that is, without having to put too much emphasis on the question of how the objects under consideration are represented for computational purposes, while on the other hand not being too imprecise. In particular, we propose a definition of the phrase “computational problem” which up to now has only been used in an intuitive way.

1.2.1 Representations

To motivate the following definitions, let us fix a (non-separably closed) field k and consider the problem to represent finite separable field extensions in terms of field elements in k and natural numbers. Every such extension is primitive, thus it is isomorphic to an extension of the form (k[t]/(f(t)))|k with f(t) ∈ k[t] separable and irreducible. Because of this, it is reasonable to say that “every finite separable extension of k can be represented by a polynomial in k[t]”. In this statement, one might (but need not) add the information that the polynomials in question are separable and irreducible. This situation can also be described from a functorial point of view:

Example 1.1 We consider the set S of all separable irreducible polynomials in k[t] and let S be the category whose objects are the elements from S and which does not have any morphisms except the identities. Now the assignment f(t) ↦ k[t]/(f(t)) is a functor from S to the category of finite separable extensions of k. The fact that every extension is isomorphic to an extension of the form k[t]/(f(t)) can be expressed by saying that this functor is essentially surjective.

Definition 1.2 Let C and D be categories. Then a partial functor from C to D is a pair (S, F), where S is a subcategory of C and F : S ⟶ D is a functor. We denote the pair (S, F) by F. The category S is then called the domain of F.

Recall that a large groupoid is a category whose only morphisms are isomorphisms. Note that the class of objects of such a category might or might not be a set. Recall also that a full subcategory S of a category C is a subcategory of C such that for all a, b ∈ S, Mor_{S}(a, b) = Mor_{C}(a, b).

Definition 1.3 Let C and X be a large groupoids. Then a partial representation of C by X is a partial functor from X to C whose domain is a full subcategory of C. A representation of C by X is a partial representation which is essentially surjective.

Remark 1.4 All categories we consider in this chapter are large groupoids. The general philosophy is that representations and computational problems (see subsection 1.2.2) should in a certain sense be “well behaved” with respect to isomorphisms but not necessarily with respect to other morphisms. In applications of the terminology developed here the starting point are often general categories, and one applies the terminology to the associated large groupoids obtained by discarding all morphisms which are not isomorphisms. Another special case one often encounters is that one is given a set and one considers the associated groupoid whose objects are the elements of the set and which only has the identities as morphisms (see e.g. Example 1.1).

We also remark that one could just as well apply this above definition in a situation where only X but not C is a large groupoid. However, in subsection 1.2.2 we will need that C is a large groupoid, and according to our general philosophy it does not cause any harm to impose this condition already now.

Definition 1.5 Let us fix a (partial) representation F of C by X.

We say that C is via F (partially) represented by X, and we then call X the category of representing objects of C. We omit F if it is obvious from the context.

Now let furthermore a be an object of C and x an object of X. If then a ≈ F(x) we call x a representing object or a representative of a.

If the large groupoid X is obtained from a set X by defining only the identities to be morphisms, we say that C is (partially) represented by X. The same applies if the large groupoid C is obtained from a set by defining only the identities to be morphisms.

Remark 1.6 Note that we can only “recover” an object of C up to isomorphism from a representing object.

Terminology 1.7 Following the usual (intuitive) terminology in computational mathematics, if a is a representing object of x, we also say that “a represents x”. We use similar expressions also to indicate that a large groupoid C is represented by a large groupoid X.

For example, let k be a fixed field. Then instead of saying that we represent the large groupoid of finite separable field extensions of k by the large groupoid of separable irreducible polynomials, we might say that we represent finite separable field extensions of k by separable irreducible polynomials.

Let us now consider finite extensions of 𝔽_{p}(t) for some prime p. Not all extensions are separable, and in fact not all extensions are primitive. This means that the large groupoid of finite field extensions of 𝔽_{p}(t) is partially represented by the set of univariate polynomials over 𝔽_{p}(t).

Remark 1.8 Let both X and C be obtained from sets X and C by defining only the identities to be morphisms. In this case, a partial representation of C by X is nothing but a partial map from X to C. A representation of C by X is a surjective partial map from X to C. (Note that partial representations correspond to partial maps but representations do not correspond to maps X ⟶ C but as stated to surjective partial maps.)

Remark 1.9 Let C, D and X be large groupoids. Let (T , G) be a representation of D by C, and let (S, F) be a partial representation of C by X. Then G ∘ F : S ⟶ D is a partial representation of D by X. Moreover, if F is a representation, so is (S, G ∘ F).

Let us again consider finite separable field extensions over a fixed field k. If we fix such an extension λ|k and a primitive element a ∈ λ, we can represent each element of λ by its coordinate vector with respect to the “polynomial basis” 1, a, …, a^{[λ:k]−1} defined by a. Now, as above, we want to vary the extension as well, and we want to use an irreducible separable polynomial f(t) ∈ k[t] with λ ≈ k[t]/(f(t)) to represent λ. All in all the task is now to “extend” the representation of separable extension fields by also representing an element in such a field.

This motives the following definition.

Definition 1.10 Let C ⟶ D and X ⟶ Y be two functors between large groupoids. Then a relative partial representation of C ⟶ D by X ⟶ Y consists of a partial representation (S, F) of C by X and a partial representation (T , G) of D by Y such that the image of S in Y is contained in T and such that the diagram

\xymatrix{C \ar[r] & D \\ S \ar[r] \ar@{^{(}->}[d] \ar[u]^{F} & T \ar@{^{(}->}[d] \ar[u]_{G} \\ X \ar[r] & Y}

is commutative. A relative representation of C ⟶ D by X ⟶ Y is a relative partial representation such that both F and G are essentially surjective.

Example 1.11 We return to the example of finite separable field extensions over a fixed field k. Let now D be the large groupoid of such extensions, and let C be the large groupoid whose objects are tuples (λ|k, a), where λ|k is a finite separable field extension and a ∈ λ, and whose (iso-)morphisms are defined as follows: A morphism from (λ|k, a) to (λ′|k, a′) is an isomorphism of field extensions λ ⟶ λ′ which maps a to a′. Now the large groupoid C is represented by the set of all polynomials in k[t]. The large groupoid D is represented by the set of tuples (f(t), \underline{a}), where f(t) ∈ k[t] and \underline{a} ∈ k^{[λ:k]}. (Here \underline{a} represents the element in k[t]/(f(t)) given by ∑_{i=1}^{t} a_{i}t^{i−1}.) Obviously we obtain a relative representation of C ⟶ D.

Definition 1.12 Let C and X be a large groupoids and (S, F) a partial representation of C by X. Then the category of represented objects of C by X is is defined as follows: The objects are tuples (a, x), where a is an object of C and x is an object of S such that a ≈ F(x). We define the morphisms by Mor((a, x), (b, y)) := Mor(x, y).

Note that by definition we have a fully faithful functor from the domain of F to the category of represented objects of C by X. Moreover, if F is a representation, we have an equivalence of categories between the domain of F and C. Because of this, one might question the relevance of this definition. However, it is of great help for the intuition to think about objects of C with some “extra data for the representation” rather than merely the barren objects used for the representation themselves.

1.2.2 A formalism for computational problems

The following two definitions relate our abstract definitions on representability to the classical theory of computability. Here, by “classical theory” we mean the theory which is based on Turing machines or equivalent models (from the point of computability). In Section 1.6 analogous definitions in an “algebraic setting” are given.

Definition 1.13 Let C still be a large groupoid. A bit-representation of C is a representation of C by ℕ_{0}.^{1}

Remark 1.14 We often use the injection ℕ_{0} ⟶ {0, 1}^{∗} given by the 2-adic expansion. (That is, n = ∑_{i=0}^{k−1} n_{i}2^{i} with n_{i} ∈ {0, 1} for all i = 1, …, k − 2 and n_{k−1} = 1 is mapped to the string n_{0}n_{1} ⋯ n_{k−1}.) This also explains the name “bit-representation”.

Definition 1.15 Let S ⊆ ℕ_{0}, and let c : S ⟶ ℕ_{0}. Then we say that c is computable if there exists a Turing machine (or a machine based on an equivalent model from the point of view of computability) M which for every x ∈ S computes c(x). We then also say that M computes c.

Remark 1.16 Note that we do not impose any condition for s ∈ ℕ_{0} − S, and in particular we do not require that the machine halts for s ∈ ℕ_{0} − S.

For the following definition note that for every category C we have the large category of full subcategories of C. The objects of this category are the full subcategories of C and the morphisms between two such subcategories S and S′ are the functors from S to S′. With the natural transformations this category is in fact a 2-category.

Definition 1.17 Let C and C′ be large groupoids, and let F be a bitrepresentation of C with domain S ⊆ ℕ_{0} and F′ be a bit-representation of C′.

Then a computational problem from C to C′ (with respect to the fixed representations) consists of:

• a functor P from C to the category of full subcategories of C′ (for α : a ⟶ a′ we write P_{α} for the associated functor from P(a) to P(a′))

• for every morphism α : a ⟶ a′ of C and every b ∈ P(a) a morphism m_{α,b} : b ⟶ P_{α}(b)

such that • for all a ∈ C, P(a) is non-empty

1We set ℕ_{0} := ℤ_{≥0}.

• all diagrams of the form

\xymatrix{b \ar[r]^{β} \ar[d]_{m_{α,b}} & b′ \ar[d]^{m_{α,b′}} \\ P_{α}(b) \ar[r]^{P_{α}(β)} & P_{α}(b′)}

with α : a ⟶ a′, b, b′ ∈ P (a) and β : b ⟶ b′ commute.

We denote a computational problem as above by P. Let now such a computational problem be given. Then we call the objects from C the instances of the problem and the elements from S legitimate inputs. We say that the computational problem (problem for short) is computable if there exists a computable function c : S ⟶ ℕ_{0} such that for all x ∈ S, F′(c(x)) is isomorphic to an object in P(F(x)). Moreover, if we have a (Turing or other) machine M which computes c, we also say that M computes P. (Note that we only require termination for legitimate inputs by Definition 1.15.)

Remark 1.18 Note again that C and C′ are large groupoids. This implies that all morphisms in P(a) and all morphisms m_{α,b} are isomorphisms.

It follows immediately that the morphisms

\xymatrix{(P_{α′} ∘ P_{α})(b) \ar[r]^{(m_{α′,Pα(b)})^{−1}} & P_{α}(b) \ar[r]^{(m_{α,b})^{−1}} & b \ar[r]^{m_{α′α,b}} & P_{α′α}(b)}

define an isomorphism of functors between P_{α′} ∘ P_{α} and P_{α′∘α}.

Note also that the definition of m_{α,·} : P(a) ⟶ P(a′) is analogous to the definition of an isomorphism of functors (it is an isomorphism of functors from id_{P(α)} to P_{α} if and only if P(a) = P(a′)).

We have the following three classes of examples:

Example 1.19 Let C′ be obtained from a set C′ by defining only the identities to be morphisms, a computational problem from C to C′ is nothing but an assignment P from the objects of C to ℙ(C′) with P (a) = P (a′) for a ≈ a′. (Here for a set X ℙ(X) is the power set of X.) In particular, if C is also obtained from a set C by defining only the identities to be morphisms, a computational problem from C to C′ is the same as a map C ⟶ ℙ(C).

Example 1.20 Let C and C′ be large groupoids with fixed representations. Then every functor P : C ⟶ C′ induces a computational problem from C to C′ as follows:

The assignment on the objects is given by assigning to every object a ∈ C the class consisting of P (a). For every morphism α : a ⟶ a′ of C the functor P_{α} is given by P_{α}(P (a)) := P (a′) on the objects and by P_{α}(β) := P (α) ∘ β ∘ P (α)^{−1} for every isomorphism β of P (a). Furthermore, we set m_{α,P (a)} := P (α).

Example 1.21 Let again C and C′ be large groupoids with fixed representations, and let p : C′ ⟶ C be a functor such that for every (iso-)morphism α : a ⟶ a′ and every b in the fiber over a, there exists an object b′ in the fiber over a′ and an (iso-)morphism β : b ⟶ b′ with α ∘ p = p ∘ β. (Note that C with p is a special case of a category fibered in groupoids.)

Then we obtain as follows a computational problem P from C to C′: On objects the functor P is defined by assigning to a ∈ C its fiber in C′. Now let α : a ⟶ a′ be a morphism in C. Then for each object b of C′ over a we choose some object P_{α}(b) over a′ in C′ together with some isomorphism m_{α,b} : b ⟶ P_{α}(b) over α.^{2} Here, if a′ = a and α = id_{a}, we choose P_{α}(b) = b and m_{α,b} = id_{b}. Finally, for β : b ⟶ b′ in P(a), we set P_{α}(β) := m_{α,b′} ∘ β ∘ m_{α,b}^{−1}. This choice of b′ and β defines the functor P_{α} and the assignments m_{α,·}.

Arguably the most important example of a computational problem related to this work is the general discrete logarithm problem for class groups of curves, which can be defined as follows:

Example 1.22 We consider the large groupoid of all triples (C/𝔽_{q}, a, b) where C is a curve over 𝔽_{q}, a, b ∈ Cl^{0}(C) with b ∈ ⟨a⟩, where the (iso- )morphisms (C, a, b) ⟶ (C′, a′, b′) are isomorphisms φ : C ⟶ C′ with φ^{∗}(a′) = a, φ^{∗}(b′) = b. The methods of the next chapter give various bitrepresentations of this large groupoid; let us choose one. We now consider the set of non-negative integers ℕ_{0} which we turn into a category by defining only the identities to be morphisms, and we represented it by itself via the identity. The computational problem is now the assignment (C/𝔽_{q}, a, b) ↦ x, where x is the smallest non-negative integer with x · a = b.

Example 1.23 As an example of a computational problem which is not induced by a functor as in Example 1.20 consider the following problem: We represent ℚ by ℤ × ℕ via (n, d) ↦ \frac{n}{d}, and we represent ℤ × ℕ (essentially) by concatenation of the bit-strings of the two numbers. Let us fix a dense representation of vectors in ℚ^{n} for arbitrary n ∈ ℕ ((essentially) given by concatenation of the representations of the elements), and let us represent univariate polynomials over ℚ by the corresponding coefficient vectors. Now consider the problem to determine if a given univariate polynomial over ℚ has a root in ℚ and if this is the case to compute one.

2Here we apply the axiom of choice. In order not to run into logical problems, one should first choose a universe and restrict oneself to sets in this universe.

Formally, this computational problem is defined as follows: C is the large groupoid obtained from the set ℚ[t] and C′ is the large groupoid obtained from the set ℚ ˙∪ {“No”}. The computational problem is given by the map ℚ[t] ⟶ ℙ(ℚ ˙∪ {“No”}) mapping a polynomial to {”No”} if has no roots in ℚ and to the set of roots otherwise.

Definition 1.24 Let a functor C ⟶ D be given. Then a (partial) relative bit-representation of C ⟶ D is a (partial) relative representation of C ⟶ D by the projection to the first coordinate p_{1} : ℕ_{0}^{2} ⟶ ℕ_{0}.

In the following, we represent (n_{1}, n_{2}) ∈ ℕ_{0}^{2} essentially by concatenation of the two bit-strings of n_{1} and n_{2}. More precisely, let n_{1,0} ⋯ n_{1,k−1} be the bit-string for n_{1} and n_{2,0} ⋯ n_{2,ℓ−1} the bit-string for n_{2}. Then we represent (n_{1}, n_{2}) by the string n_{1,0}0n_{1,1}0 ⋯ 0n_{1,k−1}1n_{2,0}0 ⋯ 0n_{2,ℓ−1}. (We always write a bit followed by a 0 until we reach the end of n_{1}. Here we write a 1, then we alternatingly write a bit of n_{2} and 0.)

In the context of Definition 1.24 this means that an object x of C is represented by a bit-representation of its image in D concatenated with a further bit-string.

Definition 1.25 Let C, C′ and D be a large groupoids, and let p : C ⟶ D and p′ : C′ ⟶ D be functors. Let relative bit-representations of C ⟶ D and C′ ⟶ D be given which induce the same bit-representation on D. Let (S, F) be the representation of C by ℕ_{0}^{2}, (S′, F′) the representation of C′ by ℕ_{0}^{2} and (T, G) the representation of D by ℕ_{0}. Then a relative computational problem from C to C′ over D (with respect to F, F′ and G) is a computational problem P from C to C′ which satisfies that p′(P(x)) = {p(x)} for all x ∈ C.

We say that such a problem P is computable if there exists a computable function c : S ⟶ ℕ with F′(x, c(x)) ∈ P(F(x)) for all x ∈ S. A (Turing or other) machine which computes c is again said to compute the relative computational problem.

Remark 1.26 Let C, C′, D, p and p′ be as above. Then similarly as for computational problems, every functor P : C ⟶ C′ with p ∘ P = p′ induces a relative computational problem.

Remark 1.27 The computational problem defined in Example 1.21 defines a relative computational problem of C ⟶ C′ over C.

Example 1.28 We continue with Example 1.11. As in this example, let D be the large groupoid of finite separable field extensions of a fixed field k. Similarly to but slightly different from Example 1.11, let C be the large groupoid of tuples (λ|k, (a, b)), where λ|k is a finite separable field extension and (a, b) ∈ λ^{2} and λ|k. Moreover, let C′ be the large groupoid of tuples (λ|k, c) where c ∈ λ and λ|k is a finite separable field extension (both categories with the obvious (iso-)morphisms).

Now let k be a countable field, and let us fix a bit-representation of k such that the arithmetic operations in k are computable. This bit-representation induces a bit-representation of the polynomials over k and vectors in k^{n} for n ∈ ℕ. Following Example 1.11, we obtain relative bit-representations of C ⟶ D and C′ ⟶ D.

Now we can describe the multiplication in finite separable field extensions of k via the functor (λ|k, a, b) ↦ (λ, a · b). Clearly, this functor defines a relative computational problem which is computable.

1.3 The O-notation

The O-notation is of course classical; we present it here with an approach which is closely related to the definitions of the previous section.

Let C be a large groupoid. In the following, we denote large groupoids associated to sets by defining only the identities to be morphism by boldface letters.

Let f : C ⟶ R_{≥0} be a functor. Then we define the class O(f) by

O(f) := {g : C ⟶ R a functor | ∃c > 0 : |g(A)| ≤ c · f(A)

for all objects A of C} .

We define

Õ(f) := (log_{2}(max{f, 2}))^{O(1)} · O(f) .

Here – and also in the following – we use the obvious generalizations of the usual definitions for sets of functions from some set C to ℝ to classes of functors from C to R.

Similar definitions and considerations also apply to the Ω-notation (denoting lower bounds) and the Θ-notation (denoting both upper and lower bounds). We note that we will not use the usual “Landau-style” notation “f = O(g)” for g ∈ O(f).

For a functor f : C ⟶ R_{≥0} we define

Poly(f) := {g : C ⟶ R a functor | ∃p(X) ∈ R[X] with non-negative coefficients: |g(A)| ≤ p(f(A)) for all objects A of C} , 1.3. The O-notation 11

and if g ∈ Poly(f), we say that g is polynomially bounded in f. More generally, for functors f_{1}, …, f_{k} : C ⟶ R_{≥0} we define

Poly(f_{1}, …, f_{k}) := {g : C ⟶ R a functor | ∃p(X) ∈ R[X_{1}, …, X_{n}] with non-negative coefficients: |g(A)| ≤ p(f_{1}(A), …, f_{n}(A)) for all objects A of C} ,

and if g ∈ Poly(f_{1}, …, f_{k}), we say that g is polynomially bounded in f_{1}, …, f_{k}.

Moreover, we fix the following generalization of the previous O-notation (which we do however not use in the sequel).

Let m_{1}, …, m_{k} : C ⟶ R be functors. Now let (S, f) be partial functor from C to R_{≥0}, where S is a full subcategory of C such that there exist C_{1}, …, C_{k} > 0 with A ∈ S for all objects A of C with m_{1}(A) ≥ C_{1}, …, m_{k}(A) ≥ C_{k}.

Then we define

O_{m_{1},...,m_{k}}(f) := {g : T ⟶ R a functor | T a large subcategory of S such that there exist c > 0, C_{1}, …, C_{k} > 0 with A ∈ T and |g(A)| ≤ c · f(A) for all objects A of C with m_{1}(A) ≥ C_{1}, …, m_{k}(A) ≥ C_{k} } .

For a partial functor g from C to R we express g ∈ O_{m_{1},...,m_{k}}(f) by saying “g ∈ O(f) for m_{1}, …, m_{k} ⟶ ∞”. Similarly to above we set

Õ_{m_{1},...,m_{k}}(f) := (log_{2}(max{f, 2}))^{O_{m_{1},...,m_{k}} (1)} · O_{m_{1},...,m_{k}}(f) .

Remark 1.29 With these definitions one has particular the following intuitive compatability: Let C be a large groupoid, and let f : C ⟶ R_{≥0} and g : C ⟶ R be functors. Now let X be another large groupoid, and let (S, F) be a representation of C by X. Then g ∈ O(f) if and only if g ∘ F ∈ O(f ∘ F). A similar statement holds if m_{1}, …, m_{k} are considered too, and a similar statement holds for Poly(f_{1}, …, f_{k}).

In applications, one does not distinguish between the functors f, g and values of these functors. (E.g., one considers the genus of curves, which one denotes by g or the degree of plane models which one denotes by d and so on.) Because of the compatibility this does not cause any problems, even if one completely suppresses the domain of the functors. (Note that this is similar to the situation one encounters with probability spaces and random variables, where the probability spaces are often completely suppressed.)

Remark 1.30 In [vzGG03] the O-notation is defined as follows: A partial function f from ℕ to ℝ is called eventually positive if there exists some N > 0 such that for n ≥ N, f(n) is defined and (strictly) positive. Then for such a function f the set O(f) is the set of all partial functions from ℕ to ℝ which are eventually positive and such that there exist N, c ∈ ℕ with g(n) ≤ c · f(n) for all n ≥ N.

We would like to comment on this definition and the relationship with our definition above.

First, it seems to be convenient to us to change this definition as follows: Given some f which is eventually positive, one defines O(f) as the set of all partial functions from ℕ to ℝ which are defined almost everywhere such that there exists N, c ∈ ℕ with |g(n)| ≤ c · f(n) for all n ≥ N.

Now a generalization of this definition from ℕ to large groupoids would be: Let C be a large groupoid and let f be a functor which is defined on a full subcategory S of C such that there are up to isomorphism only finitely many objects of C which are not contained in S, and let f be a functor from S to R_{>0}. Then one might define

O(f) := {g : T ⟶ ℝ | T a full subcategory of S

such that there are up to isomorphism

only finitely many objects of C
which are not contained in T

and such that ∃c > 0 : |g(A)| ≤ f(A) for all objects A of T } .

However, this definition is problematic for the following reason: As mentioned in the previous remark, in applications of the O-notation one often does not fully define which category one considers. Therefore in particular it is not clear how the isomorphism classes are defined, and it is then not clear what is meant by the condition that f and g in the definition are not defined on finitely many isomorphism classes. Note that in particular, with this definition one does not have the compatibility we mentioned in the previous remark.

We would like to comment on a particular use of the O-notation in the literature which we consider to be a misuse. Often the O-notation is used as follows: Let C be a large groupoid and let f_{1} and f_{2} be two functions C ⟶ R_{≥0}.^{3} Then by “g = O(f_{1}f_{2})” authors often mean that there exists some c > 0 such that g(n) ≤ c·f_{1}(n)·f_{2}(n) for f_{1}(n) and f_{2}(n) large enough. This is however not well-defined since the product f_{1}f_{2} is also merely a functor on C. In fact, this use of the O-notation means in particular that the statement “g = O(f_{1}f_{2})” has a different meaning than the statement “for f := f_{1}f_{2} we have g = O(f)”, which is an unfortunate situation.

3Of course, the large groupoid is not defined, but this is not what we would like to focus on here.

For example, often in works on the manipulation of square matrices with polynomial entries one finds statements that certain computations can be performed with O(n^{α} · d^{β}) field operations, where n is the size of the matrix and d the maximum of the degrees of the entries and α, β are constants. However, for d = 0 there are then often infinitely many matrices for which the bound does not hold, and therefore the statement is incorrect, even if one uses the definition of the O-notation which is inspired by the definition in [vzGG03].

1.4 Bit-complexity

So far we have not addressed the first two questions posed at the beginning of this chapter: We still have to fix a particular computational model and complexity measure / cost function. In this section, we propose a particular computational model to capture the intuitive meaning of “bit-complexity”.

On the basis of this model, we can then in particular talk about the complexity of a computational problem as defined in Section 1.2.

1.4.1 Some comments on bit-complexity

In the works on computational number theory, often no or very limited information is given on the underlying computational model and an intuitive approach is taken with respect to computational complexity: In a certain sense bit-operations needed for arithmetic operations are counted, but usually operations on the storage of the machine are assumed to be for free or essentially for free. It arises the question which of the various computational models in the literature capture this intuitive notion of “bit-complexity” appropriately.

At the first sight, one might think of multiple string Turing machines because this model is truly bit-oriented. However, on the other hand, one wants to be able to have quick access to the storage, and in particular indirect addressing should be possible, a feature which is not present in Turing machines.

These important features are present in the various Random Access Machine (RAM) models, and if nothing else is stated explicitly in a certain work on algorithms, it seems to be fair to interpret the claims with respect to an appropriate RAM. Let us recall the general idea of a Random Access Machine on an intuitive level:

The machine has registers r_{i} (i ∈ ℕ_{0}), each of which can store integers or non-negative integers of arbitrary length (depending on the model). Furthermore, the machine has a program which is described with a rather limited programming language. The register r_{0} serves as an accumulator and contains the results of various instructions. An important feature of the programming language is that it allows indirect addressing: Let r(i) be the content of register i at a particular time during the execution of the program. Then for every i ∈ ℕ_{0}, one can load r(r(i)), the content of register r_{r(i)}, into the accumulator.

It arises however a problem because there is a certain level of arbitrariness with respect to the possible instructions and the cost measure of the RAM.

In order to cope with this problem of arbitrariness we propose as a computational model a Random Access Machines whose arithmetic commands are obtained from Turing machines. This means that from a “macroscopic perspective” such a machine operates as the RAMs in the literature but the arithmetic operations are performed by Turing machines. An informal description of such machines, which we call bit-oriented Random Access Machines (bit-RAMs), is as follows: The machine has registers r_{i} (i ∈ ℕ_{0}) and a program. The instructions in the program are of two types. The first type of instructions is based on the commands LOAD, STORE, GOTO, IF … GOTO and END which have the same meaning as usual in the literature. Now additionally, for every multiple string Turing machine T with multiple input strings and one output string, we introduce a command c_{T}. The execution of this command is modeled by the Turing machine T. The running time in bit operations of the bit-RAM upon a certain input is then the sum of the running times for the executions of the Turing machine-related commands plus some cost for storage management.

1.4.2 Bit oriented Random Access Machines

We first fix a definition of the Turing machines which give rise to the arithmetic commands of the bit oriented RAM model. This definition is closely related to the definition of a multiple string Turing machine with with input and output string in [Pap94].

We fix a 4-element set Σ with elements 0, 1, ⊔, ▷, called the alphabet (the elements of Σ are called symbols). The element ⊔ is called blank symbol, and the element ▷ is called first symbol. Furthermore, we fix a 3-element set with elements ←, −, →, called the set of directions.

Definition 1.31 A bit-oriented multiple string Turing machine with multiple input strings and one output string consists of

• two natural numbers k, ℓ with ℓ < k, the number of strings and the number of input strings • a finite set Q, the state space

• an element q_{0} ∈ Q, the initial state and an element h ∈ Q, the halting state

• a map δ : Q × Σ^{k} ⟶ Q × (Σ × {←, −, →})^{k} , the transition function

such that the following holds: Let q ∈ Q and (σ_{1}, …, σ_{k}) ∈ Σ^{k}, and let δ(q, σ_{1}, …, σ_{k}) = (q′, σ′_{1}, D_{1}, …, σ′_{k}, D_{k}) with q′ ∈ Q, σ′_{i} ∈ Σ and D_{i} ∈ {← , −, →}. Then:

• For all i = 1, …, k: σ_{i} = ▷ iff σ′_{i} = ▷, and if this is the case then D_{i} =→.

• If q = h, then q′ = h, σ′_{i} = σ_{i} and D_{i} = − for all i.

• σ_{k} ∈ {0, 1} and D_{k} ≠←.

• For all i = 1, …, ℓ, σ′_{i} = σ_{i}.

The four requirements can be interpreted as follows (see also the definitions of configuration and starting configuration below).

• Every string starts with a ▷ (which does not occur anywhere else in the string), and if the head hits this symbol, it recognizes that it is at the beginning of the string and moves right again.

• If the machine has reached the halting state, no more operations are performed.

• The k^{th} tape is write-only, and the k^{th} string has no blanks.

• Tapes 1, …, ℓ are read only.

A configuration is a tuple (q, w_{1}, u_{1}, …, w_{k}, u_{k}) where q is a state and w_{i}, u_{i} ∈ Σ^{∗} such that for all i, the first symbol of w_{i} is ▷, and this symbol occurs nowhere else in w_{i} and u_{i}. The set of configurations is called configuration space. The intuition of a configuration is that it indicates the current state q of the machine as well as the current string left to the reading head (including the symbol under the head) and the current string right to the reading head (without the symbol under the head).

The transition function in an obvious way leads to an operation on the configurations space. (If a reading head “falls off” the right side of a string, a ⊔ is written, in particular strings cannot become shorter during the computation; cf. [Pap94] for details.)

Let for α ∈ ℕ_{0} S(α) be the corresponding bit-string (see also Remark 1.14).

Now let T be a bit-oriented multiple string Turing machine with ℓ input tapes, and let \underline{α} ∈ ℕ_{0}^{ℓ}. Then we define the starting configuration associated to \underline{α} as follows: The machine is in state q_{0}, for all i = 1, …, ℓ, string i is ▷S(α_{i}), and strings ℓ + 1, …, k are equal to ▷. Moreover, the heads are at the beginning of the strings.

If the machine halts, we associate to the k^{th} string the corresponding natural number (note that this string is of the form ▷w, where w ∈ {0, 1}^{∗}).

This association defines a partial function f_{T} : ℕ_{0}^{ℓ} ⟶ ℕ_{0}, the function computed by T. As usual, we define the running time τ_{T} (\underline{α}) of T applied to \underline{α} to be ∞ if the machine does not halt (that is, f_{T} (\underline{α}) is not defined), and otherwise to be the number of operations until it halts. If T applied on α halts, we define the space requirements or the space complexity Space_{T} (α) as the sum of the lengths of springs ℓ+1, …, k at the time of halting. (Note that the strings never get shorter during the computation.)

We now give a formal definition of bit-oriented Random Access Machines. Let C_{basic} be a set with 5 elements which we denote by LOAD, STORE,

GOTO, IFGOTO, END; this set is called the set of basic commands.

Furthermore, let A be a set with 2 elements, which we denote by “=” and “↑”.

Definition 1.32 A basic instruction is an element from the set C_{bit} ˙∪ C_{bit} × ℕ_{0} ˙∪ C_{bit} × A × ℕ_{0} which corresponds to a ∗ in the following table. Here and in the following we use the following notation: We write X n (resp. X m n) for (X, n) (resp. (X, m, m)), and we call n (resp. (m, n) the operand. We denote the set of basic instructions by I_{basic}.

command no operand  operand
=n n ↑n
LOAD  —  ∗ ∗ ∗
STORE  —  — ∗ ∗
GOTO  —  — ∗ —
IFGOTO  —  — ∗ —
END  ∗  — — —

Example 1.33 LOAD 10 (that is, (LOAD, 10)) and STORE ↑ 5 (that is, (STORE, ↑, 5)), are instructions.

Let T be the set of all bit-oriented multiple string Turing machines with one output string. We fix a set C_{arith} which is in bijection to T via a map c : T ⟶ C_{arith} , T ↦ c_{T}. We call C_{arith} the set of arithmetic commands, and for T ∈ T , we call c_{T} the (arithmetic) command for machine T.^{4} Definition 1.34 The instruction space is I_{bit} := I_{basic} ˙∪ C_{arith}. The elements of this space are called instructions, and the arithmetic commands are also called arithmetic instructions.

4We can of course set C_{arith} := T and c := id, but it helps for the intuition to distinguish between a Turing machine and the related command.

Definition 1.35 A bit-oriented Random Access Machine (bit-RAM) is a tuple Π = (π_{1}, …, π_{r}) of instructions.

We now define the semantics of the instructions, that is, we define how a bit-RAM operates.

We first define the configuration space as S := ℕ_{0}^{(ℕ_{0})} × (ℕ_{0} ˙∪ {∞}) (where ℕ_{0}^{(ℕ_{0})} := {r ∈ ℕ_{0}^{ℕ_{0}} | for nearly all i, r(i) = 0}); the elements of this set are called configurations. If (r, k) is a configuration, r is called the register configuration and k is called the counter. Note that the configuration space does not depend on a particular bit-RAM.

Now we define the configuration transition function Δ : I_{bit} × S ⟶ S as follows. Let (r, k) be a configuration, and let Δ(x, r, k) = (r′, k′).

Let x first be a basic instruction. Then r′(i) = r(i) and k′ = k +1 except for the cases indicated in the table.

command no operand  operand
= n  n  ↑n
LOAD  —  r′(0) = n r′(0) = r(n)  r′(0) = r(r(n))
STORE  —  —  r′(n) = r(0)  r′(r(n)) = r(0)
GOTO  —  —  k′ = n  —
IFGOTO —  —  \begin{matrix}k′ = n if r(0) = 0 and \\ k′ = k + 1 if r(0) > 0 \end{matrix} —
END  k′ = 0  —  —  —

Now let x = c_{T} for some bit-oriented k-string Turing machine T with ℓ input strings and one output string. Then r′(i) = r(i) for all i ≥ 1. If T does not halt on (r(1), …, r(ℓ)), then r′(0) = r(0) and k′ = ∞. If it halts then r′(0) = f_{T} (r(1), …, r(ℓ)) and k′ = k + 1.

We define the operation of Π on an input α ∈ ℕ_{0} as the following sequence (r_{t}, k_{t})_{t∈ℕ_{0}} ∈ S^{ℕ_{0}}:

We define r_{0} by r_{0}(0) := α and r_{0}(i) := 0 otherwise, and we set k_{0} := 1. Then we define (r_{t}, k_{t}) for t ≥ 1 by (r_{t}, k_{t}) := Δ(r_{t−1}, π_{k_{t−1}}) if k_{t−1} ∈ {1, …, r} and by (r_{t}, k_{t}) := (r_{t−1}, k_{t−1}) otherwise.

If there exists some t with k_{t} = 0 or k_{t} > r and k_{t} ≠ ∞, we say that the machine terminates, and in this case, we define the output as r_{t}(0) for such a t. (This definition is independent of t.) Note in particular that if there exists some t with k_{t} = ∞, then the machine does not terminate.

We define the running time in RAM operations or the uniform running time τ_{u} as ∞ if the machine does not terminate and otherwise as min{t ∈ ℕ | k_{t} ∉ {1, …, r}}. Note here that this measure does not say anything about the complexity of the operation because arbitrary complexity can be hidden in the application of one command c_{T}.

Finally, we define the logarithmic running time or the running time in bit-operations as follows: First we define a function L := I_{bit} × ℕ_{0}^{(ℕ_{0})} ⟶ ℕ, the logarithmic cost measure. Intuitively, this measure captures the complexities of the storage accesses and the operations of the Turing machines. More precisely, the definition is as follows. For some non-negative integer n, let ℓ(n), the bit-length of n, be defined as follows: ℓ(0) := 0 and ℓ(n) := ⌊log_{2}(n)⌋ + 1 if n ≥ 1. Then:

• – L(LOAD =n, r) := ℓ(n), – L(LOAD n, r) := ℓ(n) + ℓ(r(n)),

– L(LOAD ↑n) := ℓ(n) + ℓ(r(n)) + ℓ(r(r(n))).

– L(STORE n, r) := ℓ(r(0)) + ℓ(n),

– L(STORE ↑n, r) := ℓ(r(0)) + ℓ(r(n))

• L(GOTO n, r) := 1, L(IFGOTO n) := 1, L(END ) := 1

• L(c_{T} , r) := τ_{T} (r(1), …, r(ℓ)), the running time of T applied to (r(1), …, r(ℓ)) if the Turing machine T has ℓ input strings.

Now, we are coming back to the operation of the RAM Π on the input α. We define the logarithmic running time or the running time in bit-operations of Π applied to α as ∞ if the machine does not terminate and otherwise as

τ = τ_{Π}(α) := ∑_{t=0}^{τ_{u}−1} L(r_{t}, π_{k_{t}}) ,

with the notations from above. In the following, whenever we speak about the running time or simply the time of the operation of a bit-RAM we mean the running time in bit-operations.

Moreover, if Π we define the space requirements or the space complexity Space_{Π}(α) of Π applied to α as follows: Let (t_{1}, …, t_{r}) with t_{1} < t_{2} < ⋯ < t_{r} be such that π_{t_{i}} is an instruction based on a Turing machine, and π_{t} is a basic instruction if t ≠ t_{i} for all i. Let π_{t_{i}} = c_{T_{i}} for some Turing machine T_{i} with j_{i} input strings. Then

Space_{Π}(α) := ∑_{i∈ℕ} sup_{t∈ℕ_{0}} ℓ(r_{t}(i)) + ∑_{i=1}^{r} Space_{T_{i}}(r(1), …, r(j_{i})) .^{5}

5Note that with this definition, the space complexity is at least as large as the input length. This means that this definition is not appropriate to study questions related to sub-linear space complexity classes.

1.4.3 Randomization

We persistently use the method of randomization. Informally this means that we introduce a new command RAND into the Random Access Machine which if executed returns a “random bit” which is stored in the accumulator r_{0}. Here the drawing is stochastically independent of all previous drawings. We call the resulting machine a randomized bit-oriented Random Access Machine (randomized bit-RAM ).

We sketch the new ingredients for a possible rigorous approach to randomized bit-RAMs, starting with the bit-RAM model defined above.

First we enlarge the set of commands by a new element which we call RAND. We also enlarge the instruction space by RAND (that is, RAND has no operand).

Let Ω be a probability space with stochastically independent equidistributed probability variables X_{t} : Ω ⟶ {0, 1} for t ∈ ℕ.

Let an input be fixed. Then similarly to the series (r_{t}, k_{t})_{t∈ℕ} defined above we now define a stochastic process (R_{t}, K_{t})_{t∈ℕ_{0}}) with values in the configuration space S.

The process is determined by the randomized bit-RAM and the input similarly to above.

More precisely, let α ∈ ℕ be the input. Then we set R_{0}(0) := α, R_{0}(i) := 0 and K_{0} := 1 and define (R_{t}, K_{t}) for t ≥ 1 as follows: If K_{t−1} ∉ {1, …, r} then (R_{t}, K_{t}) := (R_{t−1}, K_{t−1}). So let K_{t−1} ∈ {1, …, r}. If now π_{K_{t−1}} ≠ RAND then (R_{t}, K_{t}) := Δ(R_{t−1}, π_{K_{t−1}}), just as above.

Now let π_{K_{t−1}} = RAND. Then we set K_{t} := K_{t−1}+1 and R_{t}(i) := R_{t−1}(i) for all i ≥ 1, and we define R_{t}(0) := X_{t}.

We define the logarithmic cost for the command RAND as L(RAND, r, s) := 1. The definitions of output, uniform running time and running time in bit operations are as above; these quantities are now also random variables on Ω. Note that the uniform running time and logarithmic running time are stopping times of the stochastic process (R_{t})_{t∈ℕ}.

This completes the description of operation of a randomized bit-RAM. We fix the following two obvious remarks.

Remark 1.36 (R_{t}, K_{t})_{t∈ℕ_{0}} is a time-homogeneous Markov chain.

Remark 1.37 Let n be a natural number, let r_{1}, …, r_{ℓ(n)} be independently uniformly distributed random variables with values in {0, 1}, and let N := ∑_{i=1}^{ℓ(n)} r_{i}2^{i−1}. Then the probability that N ≤ n is ≥ \frac{1}{2}. Moreover, conditionally to N ≤ n, N is uniformly randomly distributed in {1, …, n}. With these remarks one can easily obtain a randomized bit-RAM which upon input of some α outputs a uniformly randomly distributed random variable with values in {1, …, α} and which terminates in an expected time of O(log(α)).

The following definition relates randomized bit-RAMs with computational problems as defined in Section 1.2.

Definition 1.38 Let C be a large groupoid with bit-representation (S, F), let C′ be a large groupoid with bit-representation (S′, F′), and let P be a computational problem from C to C′. Now let Π be a randomized bit-RAM. Then we say that Π computes P if for every x ∈ S,

• Π applied to x terminates in finite expected time (that is, 𝔼(τ_{Π}(x)) < ∞)

• if with a probability > 0 Π applied to x terminates with some y ∈ S′, then we have F′(y) ∈ P(F(x)).

An analogous definition holds for relative computational problems.

1.5 The use of the word “algorithm”

In Theorems 1 to 5 in the introduction to this work, we asserted the existence of “randomized algorithms” with certain properties. We should thus give a formal definition of “algorithm”. As we stated above the theorems, “the underlying complexity model is always a randomized random access machine model with logarithmic cost function”. This suggests that we define a randomized algorithm as nothing but a randomized bit-RAM and a deterministic algorithm as a bit-RAM.

Such a definition would however be at odds with the intuitive meaning of the world algorithm. Consider for example an “algorithm” in the intuitive meaning of the word which contains an instruction like “c ⟵ ab”, where a and b are natural numbers. Then we would not obtain an “algorithm” in the rigorous sense because it is unclear how the two numbers should be multiplied.

It seems to us to be impossible to find a compromise between the usual informal use of the word algorithm and a formal definition. One possibility to resolve this problem would be to reserve the word “algorithm” only for informal descriptions and otherwise use words with formally defined meanings like “randomized bit-RAM”.

We think however that it causes no harm if after these remarks we accept that there are two uses of the word algorithm: An informal use and a formal use. Whenever we make a claim that there exists an algorithm with certain properties, we have a formal use in mind. The specific computational model is then clearly stated, and moreover, if we use randomization, we speak about a randomized algorithm.

If we use the word informally, we also have a specific computational model in mind, which might be randomized.^{6} However, we always leave out certain details on the execution (as remarked above, even an innocently looking instruction like “c ⟵ ab” leaves out important information). We do however require that the various steps of the algorithm can be performed on the basis of the fixed computational model. We then often argue earlier or later that some steps in the algorithm can be performed in a certain time (resp. expected time) and maybe with certain space requirements, and this is all which is of interest to us. A priori, we also not demand that the algorithm terminates in a finite expected time.

In Chapter 3 we also talk about procedures. A procedure is similar to an algorithm, and in Chapter 3 the formal definition for procedure is also that of a randomized bit-RAM. However, there is a change of perspective: An algorithm takes an input and produces an output. A procedure on the other hand operates on the data structure. This is particularly important for the “relation generation procedure” for Theorem 1 in Section 3.3; in fact a “relation generation algorithm” would be extremely inefficient simply because then the tree of large prime relations would have to be read and stored again every time the “algorithm” is executed.

1.6 Algebraic complexity

In this section, we first briefly review some approaches to exact computations in rings in the literature, and then we describe a particular computational model which is based on bit-oriented Random Access Machines but allows exact computation over a fixed ring. We show how this model can also be applied for variable rings too, obtaining what we call generic ring RAMs. This model then allows a uniform formal description of algorithms over variable rings (in particular fields), and it will serve as a basis for the considerations in the next chapter.

1.6.1 Terminology

By a ring we always mean a ring with 1. Likewise, a homomorphism of rings is a homomorphism of rings with 1. Note that we do not demand that rings are always commutative.

6In contrast, in the literature, the word “algorithm” is often used without reference to a particular computational model.

Let now R be a commutative ring. By an algebra over R we mean a tuple (A, φ), where A is a ring and φ : R ⟶ A is a homomorphism of rings whose image lies in the center of A. (As usual we omit φ if possible.) If (A, φ) and (B, ψ) are two R-algebras, then a homomorphism of R-algebras from A to B is a homomorphism of rings χ : A ⟶ B with χ ∘ φ = ψ.

1.6.2 Computation trees

One can use computation trees to study algorithmic problems in a fixed field (or in extension fields of a fixed field). This approach is for example taken in Bürgisser, Clausen, Shokrollahi: Algebraic Complexity Theory ([BCS91]). The model has however at least one shortcoming: It is not uniform for inputs of varying length. In fact, for different input lengths in principle completely different computations might be used. Another shortcoming is that the ground field is fixed (and in particular the characteristic is fixed). However if one wants to describe an algorithm which applies to varying fields, it is reasonable to demand that the formal description is also uniform over the fields.

We note that the phrase “algebraic complexity” is often used to denote the part of complexity theory which is based on straight-line programs and computation trees. We would however like to suggest to use this phrase for the part of complexity theory which is based on models which take a “macroscopic point of view” to computations in (possibly uncountable) rings. Straight-line programs and computation trees would then fall in the area of non-uniform algebraic complexity.

1.6.3 R-RAMs

A well-known model which features uniformity over a fixed ring R is described by Blum, Shub and Smale in [BSS89] (see also [BCSS98]). Roughly speaking this model can be seen as a Turing machine model over R.

This model is surely appropriate to study questions related to complexity classes such as if a particular problem can be computed in polynomial time. We are however seeking for a model which features (exact) arithmetic over a ring and otherwise is close to the RAM model; in particular we want to be able to (efficiently) use indirect addressing.

A model similar to the RAM model but for computations with real numbers is briefly described in [PS85]; it is called the real RAM model. This is a similar model than usual RAM model with the additional feature that (exact) storage and operation of real numbers is possible. This approach can easily be generalized to arbitrary rings R. We now give such a generalization; we call the resulting machines R-RAMs (R refers to the specific ring).

From an intuitive point of view the starting point is a device similar to a bit-RAM, but now there are two kinds of registers (both indexed by natural numbers): The first kind of cells can store integers and the second kind can store elements of the ring R. Let us call the former registers r_{i} (as above) and the latter registers s_{i} (i ∈ ℕ_{0}). Now additionally to r_{0} the register s_{0} serves as a second accumulator, and we have a second set of commands to operate on the registers s_{i}.

A formal description is as follows:

Let R be a ring. We take the definition of the Random Access Machine in subsection 1.4.2 as a starting point and only discuss the necessary modifications.

Additionally to the set C_{bit} we fix a second set of commands C_{Ring} with 7 elements which we denote by RINGLOAD, RINGSTORE, RINGADD, RING-SUB, RINGMULT, RINGDIV and RINGIFGOTO. We call these commands ring oriented commands.

A ring oriented instruction is an element from the set C_{Ring} ˙∪ C_{Ring} × R ˙∪ C_{Ring} × {=} × ℕ_{0} ˙∪ C_{Ring} × {↑} × ℕ_{0} which corresponds to a ∗ in the following table (where a ∈ R and n ∈ ℕ_{0}). We denote the set of ring oriented instructions by I_{R,Ring}.

command  no operand  operand
=a n ↑n
RINGLOAD  —  ∗ ∗ ∗
RINGSTORE  —  — ∗ ∗
RINGADD  ∗  — — —
RINGSUB  ∗  — — —
RINGMULT  ∗  — — —
RINGDIV  ∗  — — —
RINGIFGOTO  —  — ∗ —

We define the instruction space as I_{R} := I_{bit} ˙∪ I_{R,Ring}, where I_{bit} is defined as for bit-RAMs.

Definition 1.39 An R-RAM is a tuple Π = (π_{1}, …, π_{r}) of instructions, that is, of elements from I_{R}.

We now define the configuration space as S_{R} := ℕ_{0}^{(ℕ_{0})} × R^{(ℕ_{0})} × (ℕ_{0} ˙∪ {∞}). If (r, s, k) is a configuration, that is, an element from S_{R}, we call r the bit-register configuration, s the ring-register configuration and k the counter.

We define the configuration transition function Δ : I_{R} × S_{R} ⟶ S as follows: Let x be an instruction, let (x, r, s, k) be a configuration, and let T (x, r, s, k) = (r′, s′, k′). Then if x ∈ I_{bit}, s′ = s, and r′ and k′ are defined as in subsection 1.4.2. If x is a ring oriented instruction, then r′(i) = r(i) for all i ∈ ℕ_{0}, k′ = k, s′(i) = s(i) for all i ∈ ℕ and s′(0) is defined as follows (with a ∈ R, n ∈ ℕ_{0}):

• – If x = RINGLOAD a : s′(0) = a

– If x = RINGLOAD n : s′(0) = s(n)

– If x = RINGLOAD ↑n : s′(0) = s(r(n))

• – If x = RINGSTORE n : s′(n) = s(0)

– If x = RINGSTORE ↑n : s′(r(n)) = s(0)

• If x = RINGIFGOTO n: k′ = n if s(0) = 0 and k′ = k + 1 otherwise

• If x = RINGADD : s′(0) = s(1) + s(2)

• If x = RINGSUB : s′(0) = s(1) − s(2)

• If x = RINGMULT : s′(0) = s(1) · s(2)

• If x = RINGDIV : s′(0) = s(1) · s(2)^{−1} if s′(2) ∈ R^{∗} and s′(0) = 0 otherwise.

We define the set of inputs of R-RAMs as ℕ_{0}× ˙⋃_{ℓ∈ℕ_{0}} R^{ℓ}.

Now the operation of the RAM Π = (π_{1}, …, π_{k}) on the input (α, \underline{a}) = (α; a_{1}, …, a_{ℓ}) is the following sequence (r_{t}, s_{t}, k) ∈ S^{ℕ_{0}}:

We define r_{0} by r_{0}(0) := α and r_{0}(i) := 0 otherwise. We define s_{0} by s_{0}(i) := a_{i} for i = 1, …, ℓ and s_{0}(i) := 0 for i ≥ ℓ + 1. We define k_{0} := 1. Then for t ≥ 1 we define (r_{t}, s_{t}, k_{t}) for t ≥ 1 analogously to the definition in subsection 1.4.2: (r_{t}, s_{t}, k_{t}) := Δ(r_{t−1}, s_{t−1}, k_{t−1}) if k_{t−1} ∈ {1, …, r} and by (r_{t}, s_{t}, k_{t}) := (r_{k−1}, s_{t−1}, k_{t−1}) otherwise.

The definitions of termination, output and running time in RAM operation are now just as in subsection 1.4.2.

Given an input such that Π terminates with a running time in RAM operations of τ_{u}, we define the running time in ring operations with overhead as τ_{R} := #{t ∈ {0, …, τ_{u} − 1 | the command in π_{k_{t}} is in C_{Ring}}. Moreover, we define the running time in ring operations without overhead as

#{t ∈ {0, …, τ_{u} − 1 | the command in π_{k_{t}} is in

{RINGADD, RINGSUB, RINGMULT, RINGDIV}} .

We call the running time in ring operations with overhead also the running time in ring operations. Note however, usually in the literature the running time in ring operations without overhead is called running time in ring operations. (This corresponds for example to the definitions for computation trees.) Sometimes, when we want to emphasize the underlying ring, we also speak about the running time in ring operations in R. If R is a field, we also speak about the running time in field operations.

Furthermore, we define the logarithmic cost measure L : I_{R} × ℕ_{0}^{(ℕ_{0})} × k^{(ℕ_{0})} ⟶ ℕ similarly to the logarithmic cost measure in subsection 1.4.2: For instructions in I_{bit} the definitions are as in subsection 1.4.2, and for the instructions based on commands in C_{Ring}, the definition is as follows: If X is a command, n ∈ ℕ and a ∈ k, then

• L(X = a, r, s) := 1

• L(X n, r, s) := ℓ(n)

• L(X ↑n, r, s) := ℓ(n) + ℓ(r(n))

• L(X, r, s) := 1

We define the logarithmic running time or the running time in bit operations as τ_{bit} := ∑_{t=0}^{τ_{u}−1} L(π_{k_{t}}, r_{t}, s_{t}). We call the sum τ_{R} + τ_{bit} the running time in ring and bit operations or the running time is ring operations in R and bit operations.

Finally we define the space requirements in ring elements or the space complexity in ring elements as the number of registers which contain element ≠ 0 at least once during the computation, that is, #{i ∈ ℕ_{0} | ∃t ∈ ℕ_{0} : r_{t}(i) ≠ 0}.

Remark 1.40 If R is a field with a total ordering ≤ (e.g., R = ℝ), one might introduce a further command which returns 1 or 0 according to the field element in s_{1} being ≥ 0 or < 0.

Also, if R is a field of characteristic p > 0, one might introduce a command to compute p^{th}-th roots of unity. Indeed, we will introduce such a command below.

1.6.4 Generic field RAMs

Let now φ : R ⟶ S be a ring homomorphism. Note that we have an obvious canonical map I_{R} ⟶ I_{S}. Via this map, we associate to every R-RAM Π an S-RAM φ(Π).

Let now R be a commutative ring. If now A is an R-algebra with canonical morphism φ : R ⟶ A, we denote φ(Π) also by A(Π).

We call a tuple (A, α, \underline{a}), where A is an R-algebra, α ∈ ℕ_{0}, \underline{a} ∈ R^{n} for some n ≥ 0, an input over A. We define the operation of the R-RAM Π on such a tuple (A, α, \underline{a}) as the operation of A(Π) on (α, \underline{a}).

With this definition, we can also define the uniform running time, the running time in ring operations (in A) (with or without overhead) and the running time in bit operation of Π applied to such a tuple (A, α, \underline{a}).

Note the following informal description of the operation of Π on (A, α, \underline{a}): At the beginning of the computation, the “algebraic registers” s_{i} are instantiated to contain elements from A and the ring-oriented commands are likewise instantiated to perform operations with such elements, and then the input is stored and the computation is performed.

If we want to stress that we allow inputs over arbitrary R-algebras rather then merely over R itself, we call an R-RAM also an R-algebra RAM. Note however that by definition an R-RAM just as an R-algebra RAM is merely a tuple of elements from I_{R}; it is the operation which is extended to Ralgebras.

We call a ℤ-algebra RAM a ring RAM. Note that this RAM operates on inputs over arbitrary rings. To emphasize this, we also speak of a generic ring RAM. If we now restrict the possible inputs to triples (k, a, \underline{a}), where k is a field, we obtain what we call a (generic) field RAM.

For Chapter 2 the following variant of the generic field RAM model is particularly relevant: We enrich the generic field RAM model with a command to compute p^{th} roots in characteristic p > 0. The additional command, called FIELDCHARROOT, takes no operand and operates as follows: If the characteristic of the field k is 0, then 0 is written in register s_{0}. If the characteristic of the field k is p > 0, then if s(1)^{\frac{1}{p}} ∈ k, this is written in s_{0}. Otherwise, again 0 is written. We charge one field and one bit operation for each application of the command. The resulting machines will serve as a formal basis for deterministic algorithms in the “algebraic setting”.

We remark that it would be reasonable to enrich generic field RAMs also with a command which returns the characteristic of the field. The existence of such a command would however not change the complexities obtained in the next chapter.^{7}

Analogously to randomized bit-RAMs we also define randomized generic field RAMs. For this we enrich the generic field RAM model with two further commands: RAND and FIELDFACTOR. (We could also include the command FIELDCHARROOT but this would not change our results.) The formal definition of the operation of the command RAND is analogous to the one in subsection 1.4.3.

The command FIELDFACTOR (which does not take an operand) factors a univariate polynomial, and in doing so it mimics the behavior of randomized (Las Vegas) algorithms: With a probability of \frac{1}{2} it fails and with a probability of \frac{1}{2} it returns the list of normalized irreducible factors (including multiplicities).

7Sometimes – for example in the algorithm we give for Proposition 1.50 – we have to check if the characteristic is positive and below a certain bound, and if so, we have to determine it. However, such bounds are always so small that this computation can efficiently be performed by brute force.

It follows a more detailed but still informal description of the operation of this command. A formal description can be given analogously to the description of the command RAND given in subsection 1.4.3.

We first fix how univariate polynomials are stored. The idea is to use the dense representation. The concrete representation is of course somewhat arbitrary, but let us for concreteness say that a polynomial ∑_{i=0}^{d} a_{i}t^{i} with a_{d} ≠ 0 is stored as an array (a_{0}, 0, a_{1}, …, a_{d−1}, 0, a_{d}, 1) which starts at at a certain register s_{i} and ends in register s_{i+2d−1}.

Now the command operates as follows: It tries to interpret the contents of the registers starting at s_{0} as a polynomial. If this is not the case, the command terminates with writing 0 in r_{0}. If it recognizes a polynomial, it operates as follows: With a probability of \frac{1}{2} the command terminates with writing 0 in register r_{0}. (The idea is that the factorization fails.) With a probability of \frac{1}{2} it terminates with the normalized irreducible factors (without multiplicities), starting with the first coefficient of the first element in s_{0}. Also, starting in r_{0}, the corresponding list of multiplicities is written. The ordering of the factors is chosen uniformly at random from all possible orderings. Moreover, the execution of the command is stochastically independent of all previous and later uses of randomization in the algorithm.

We are now coming to the complexity of the two commands RAND and FIELDFACTOR. To define the bit-complexity, we again extend the logarithmic cost measure L to include the two commands. Analogously to above, we define L(RAND, r, s) := 1, and we define L(FIELDFACTOR, r, s) := 1. Then we define the running time in bit-operations analogously to above.

Concerning the running running time in field operations (with or without overhead), we proceed as follows: We do not take into account an occurrence of the command RAND. Moreover, whenever the command FIELDFACTOR is applied we charge 1 field operation if the content of the registers starting with s_{0} cannot be interpreted as a univariate polynomial, and otherwise, if the polynomial has degree d, we charge d^{2} field operations. Note that this means that with the command FIELDFACTOR a polynomial of degree d can be factored with an expected number of O(d^{2}) field operations. We note that we choose to charge d^{2} field operations because a polynomial of degree d over a fixed finite field can be factored with an expected number of o(d^{2}) field operations with the Kaltofen-Shoup algorithm; see [KS98]. See also subsection 1.6.6 for further discussion.

1.6.5 Algebraic computational problems

We come to the changes in our definitions for computational problems which have to be performed for the change from the bit-oriented to the “algebraic” computational model.

If one fixes a ground field, the modifications are indeed quite minor, but we would like to vary the field as well.

Let Fields be the large groupoid obtained from the category of fields by discarding all morphisms which are not isomorphisms. We now only consider large groupoids over Fields, that is, we consider tuples (C, C ⟶ Fields), where C is a large groupoid and C ⟶ Fields is a functor. Also the functors we consider are over Fields, that is, they are compatible with the functors to fields.

Apart from this “relative approach” we use the terminology on (partial) representations and relative (partial) representations from subsection 1.2.

Remark 1.41 A situation one encounters often is as follows: The fibers of X over Fields are sets, and moreover: For x ∈ X lying over a field k and an isomorphism k ⟶ k′ there exists exactly one x′ ∈ X such that there exists some isomorphism x ⟶ x′ over the isomorphism k ⟶ k′.

Example 1.42 A large groupoid which is often used to represent other large groupoids is the large groupoid of vectors of arbitrary lengths over arbitrary fields, defined as follows: The objects are tuples (k, \underline{a}), where k is a field and \underline{a} ∈ k^{n} for some n ∈ ℕ_{0}. The morphisms are defined as follows: Let k and k′ be fields, and let \underline{a} ∈ k^{n}, \underline{a}′ ∈ (k′)^{m}. If m ≠ n, there are no morphisms. If n = m, we define Mor((k, \underline{a}), (k′, \underline{a}′)) := \{φ : Iso(k, k′) | φ(a_{i}) = a′_{i} for all i = 1, …, n}.

Now we have to substitute the bit representations by representations which are appropriate for a generic field RAM.

For this we define a large groupoid RAMinputs: The objects are the inputs over arbitrary fields already considered in the definition of generic field RAMs, that is, they are triples (k, α, \underline{a}), where α ∈ ℕ_{0} and \underline{a} ∈ k^{n} for some n ∈ ℕ_{0}. The morphisms are defined as follows: Let (k, α, \underline{a}), (k′, α, \underline{a}) be two objects with \underline{a} ∈ k^{n} and \underline{a}′ ∈ k^{m}. Then if α ≠ α′, there are no morphisms from (k, α, \underline{a}) to (k′, α, \underline{a}′)). For α = α′, we define Mor((k, α, \underline{a}), (k′, α′, \underline{a})) := Mor((k, \underline{a}), (k′, \underline{a}′)).

Definition 1.43 A generic field RAM representation of a large groupoid C is a representation of C by RAMinputs. Similarly, a relative generic field RAM representation of a functor C ⟶ C′ between large groupoids is a representation of C ⟶ C′ by RAMinputs ⟶ RAMinputs.

Note again that we consider throughout large groupoids and functors over Fields; this applies in particular the definition just made.

A field oriented computational problem is defined as a computational problem in the bit-oriented models (see Definition 1.17) with the differences that we substitute ℕ_{0} by RAMinputs (and all categories and functors are over Fields). Analogously relative field oriented computational problems are defined as in Definition 1.25 with these modifications.

Let a computational problem or a relative computational problem be given, and let Π be a generic field RAM enriched with the command FIELDCHARROOT or a randomized generic field RAM. Then we use the phrase “Π computes the problem” analogously to Definitions 1.17, 1.25 and 1.38.

1.6.6 Algebraic complexity and bit-complexity over finite fields

If one considers computational problems over finite fields, any complexity theoretic statement on the basis of a generic field RAM immediately leads to a corresponding statement on the basis of a bit-RAM, as described now:

Let Fields_{fin} be the large groupoid of finite fields. We fix a bit-re-presentation of Fields_{fin} along the following lines: We first represent each finite field by an irreducible polynomial over the prime field, and we represent the irreducible polynomial by its coefficient vector. Then we represent the coefficient vector by a natural number. (There is of course some ambiguity in this description but clearly, there are “reasonable” possibilities to fill in the gaps.)

Now we fix a relative representation of the large groupoid of tuples (k, a) where k is a finite field and a ∈ k over Fields_{fin} by representing the element a ∈ k by its coefficient vector with respect to a polynomial basis; cf. the discussion above Definition 1.10. We extend this representation in an obvious way to represent the large groupoid of tuples (k, \underline{a}), where \underline{a} ∈ k^{n} for some n ∈ ℕ and then also to RAMinputs.

It is obvious that with this representation the field operations of a generic field RAM restricted to instances over finite fields 𝔽_{q} can be performed with O(log^{2}(q)) bit-operations. In fact, this running time can be lowered to O(log(q) · (log log(q))^{2} · log log log(q)) by using FFT for multiplication and additionally a fast Euclidian algorithm for division; see [vzGG03, Corollary 11.10].

With this result, one can associate to any generic field RAM a bit-RAM which performs the same computations over finite fields. Roughly, the bit-RAM is defined by using the even numbered registers for the previous bitregisters r_{i} and the odd-numbered registers for the previous “algebraic” registers. Along these lines one obtains the following proposition.

Proposition 1.44 Let Π be a generic field RAM. Then there exists a bit-RAM Π_{bit} such that the following holds: Let (𝔽_{q}, α, \underline{a}) be an input over a finite field, and let y represent this input. Then Π applied to (𝔽_{q}, α, \underline{a}) terminates if and only Π_{bit} applied to y terminates.

Let us assume that Π terminates, and let τ_{f} be the running time in field operations with overhead and τ_{bit} the running time in bit operations. Then Π_{bit} terminates in O(τ_{f} · log(q) · (log log(q))^{2} · log log log(q) + τ_{bit}) bit operations.

Remark 1.45 Let q = p^{n} for a prime p. Then in the finite field 𝔽_{p^{n}}, we have a^{−p} = a^{p^{n−1}}. Therefore the computation of p^{th} roots in 𝔽_{p^{n}} can be performed with O(log(q)) field multiplications in 𝔽_{p^{n}}. On a bit-RAM this is possible with O(log(q)^{2} · log log(q) · log log log(q)) bit operations.

Therefore, for every generic field RAM enriched with the command FIELDCHARROOT Π, there exists a bit-RAM Π_{bit} as in the proposition except that if Π_{bit} terminates, then it terminates in O(τ_{f} · log(q)^{2} · log log(q) · log log log(q) + τ_{bit}) bit operations.

With the Kaltofen-Shoup algorithm ([KS98]) and FFT-based multiplication one needs O((d log(q))^{2}) bit-operations to factorize a polynomial of degree d over a finite field 𝔽_{q}. (The given bound is not best-possible.) As we have defined the running time in field operations of one application of the command FIELDFACTOR to a polynomial of degree d to be d^{2} field operations, this gives rise to the following proposition.

Proposition 1.46 Let Π be a generic field RAM with randomization. Then there exists a bit-RAM Π_{bit} such that the following holds:

Let (𝔽_{q}, α, \underline{a}) be an input over a finite field, and let y represent this input. Then Π applied to (𝔽_{q}, α, \underline{a}) terminates in a finite expected number of bit operations if and only Π_{bit} applied to y terminates in a finite expected number of bit operations.

Let us assume that Π terminates in a finite expected number of bit operations, and let 𝔼(τ_{f}) be the expected running time in field operations with overhead and 𝔼(τ_{bit}) the expected number of bit operations. Then Π_{bit} terminates in an expected number of O(𝔼(τ_{f}) · log^{2}(q) + 𝔼(τ_{bit})) bit operations.

1.7 Algebraic complexity and finite algebras

This section focuses on basic computational problems related to finite commutative algebras over fields. As an application we consider basic questions related to field oriented computational problems and finite field extensions. The model of computation is always given by generic field RAMs enriched with the command FIELDCHARROOT or by randomized generic field RAMs (which means in particular that the command FIELDFACTOR is available).

It is a basic observation that given any finite algebra A, represented by a multiplication table over k, one can perform (deterministically) the arithmetic operations in A with O(dim_{k}(A)) field operations (in k). We start off by formalizing this result with the terminology of the previous sections.

We then recall results from the literature which say that if k is perfect, one can determine the primary decomposition as well as the prime ideals of a commutative k-algebra A with an expected number of field operations which is polynomially bounded in dim_{k}(A). As an application we show that given a finite field extension λ|k, again represented by a multiplication table, and a polynomial f(t) ∈ λ[t], one can factorize this polynomial over λ with an expected number of field operations which is polynomially bounded in [λ : k] and deg(f).

As an application of these results we study the following problem: Let a field oriented computational problem P : C ⟶ C′ be given. Then one can consider the problem which is intuitively described as follows: Given a finite field extension λ|k, represented by a multiplication table, and some object x of C lying over λ, compute P(x) with a generic field RAM instantiated with k (and not λ)! It is easy to turn every deterministic algorithm to compute P into an algorithm to compute this “extended problem”. With the result on factorization of polynomials the same holds for randomized algorithms if one restricts oneself to computational problems over perfect fields.

1.7.1 Computing in finite algebras

In this subsection, we discuss the easy statement that given any finite kalgebra A, represented by a multiplication table, one can perform the arithmetic operations in A with O(dim_{k}(A)) field operations in k. In doing so we make the effort to in detail describe how one should define the large groupoids, functors etc. for an application of the notions of the previous sections. Just as in subsection 1.6.6, all large groupoids and functors are over the large groupoid Fields of fields.

We start off with the large groupoid ALG whose objects and (iso-)mor-phisms are defined as follows: The objects are finite algebras over fields. The (iso- )morphisms are pairs of isomorphisms which fit into the following diagram.

\xymatrix{A \ar[r] & A′ \\ k \ar[r] \ar[u] & k′ \ar[u]}

Note that ALG is a large groupoid over the large groupoid Fields of fields.

For some field k and n ∈ ℕ we define k^{n×n×n} := k^{{1,...,n}^{3}}, and we call the elements of this set multiplication tables.

If M = (m_{i,j,k})_{i,j,k} ∈ k^{n×n×n} is such a multiplication table, we define an associated operation ·_{M} on k^{n} as follows: The operation is the unique k-bilinear operation with \underline{e}_{i} ·_{M} \underline{e}_{j} = (m_{i,j,1}, …, m_{i,j,n}), where \underline{e}_{i} is the i-th standard vector.

Note that if B(k, n) is the set of k-bilinear operations on k^{n}, we have a bijection k^{n×n×n} ⟶ B(k, n) , M ↦ ·_{M}.

Now let M be the large groupoid of multiplication tables over arbitrary fields. The definition is completely analogous to the definition in Example 1.42: The objects are tuples (k, M), where k is a field and M a multiplication table with entries in k. Let (k, M) and (k′, M′) be two objects. Then if the multiplication tables have different size, there are no morphisms between the objects. If on the other hand both have size n, the set of (iso-)morphisms from (k, M) and (k′, M′) is {φ ∈ Iso(k, k′) | m′_{i,j,k} = φ(m_{i,j,k}) for all i, j, k = 1, …, n}.

We now want to define an M-representation of ALG over k which makes the statement “we represent finite k-algebras by multiplication tables” precise.

For this, we first define the full subcategory S of M which consists of all multiplication tables which define algebras. Then the representation is given by the functor F : S ⟶ ALG which is given as follows: If M ∈ k^{n×n×n}, then F((k, M)) = (k^{n}, ·_{M}). If φ : (k, M) ⟶ (k′, M′) is a morphism with M ∈ k^{n×n×n} and M′ ∈ (k′)^{n×n×n}, then in particular φ : k ⟶ k′. This induces a map k^{n} ⟶ (k′)^{n}. Now by definition of the morphisms in M this map is a morphism of fields and we have the commutative diagram

\xymatrix{(k^{n}, ·_{M}) \ar[r] & ((k′)^{n}, ·_{M′}) \\ k \ar[r]^{φ} \ar[u] & k′ . \ar[u]}

We define F(φ) to be the morphism in the upper row. Obviously we have defined an essentially surjective functor, that is, a representation of ALG by M.

This representation induces a relative representation of the large groupoid of tuples (A, a) with a ∈ A (and the obvious isomorphisms) over ALG.

We now fix a representation of M by RAMinputs. (As often, there is some ambiguity here but we assume that the representation is in an obvious sense “reasonable”.) We obtain also a relative representation of the large groupoid of tuples (A, a) by RAMinputs. (With the obvious isomorphisms.) (Again there is some ambiguity here.) Analogously, we obtain a relative representation of the large groupoid of tuples ((k, A), (a, b)) with k a field, A a finite separable k-algebra and (a, b) ∈ A^{2} by RAMinputs.

We now have the following obvious proposition.

Proposition 1.47 There exists a generic field RAM Π which computes P such that the following holds: If r represents ((k, A), (a, b)), then the number of field operations performed by Π if applied to r is in O(dim_{k}(A)^{3}), and the number of bit operations is polynomially bounded in dim_{k}(A).

Remark 1.48 More intuitively, the previous proposition can be stated as follows:

Given a field k and a finite k-algebra A, represented by a multiplication table, as well as a, b ∈ A, one can compute a · b ∈ A in a number of field operations in k which is in O(dim_{k}(A)^{3}) and a number of bit operations which is polynomially bounded in dim_{k}(A).

In the following we mostly use an intuitive formulation along the lines of this formulation.

1.7.2 Factoring finite commutative algebras and polynomials

We consider the problem to determine the decomposition into local rings as well as the prime ideals of a finite commutative algebra over a field. Throughout we assume that the algebra is given by a multiplication table with respect to a k-basis. A nice overview over algorithms for this problem is given in [KM04a, Section 7].

We do not anymore make the effort to formalize the description with the notions of the previous sections.

The following result is proven in [KM04a, Section 7].

Proposition 1.49 Given a finite commutative k-algebra A, one can with a randomized algorithm determine the canonical decomposition A = A_{1} ⊕⋯⊕ A_{ℓ} of A into local rings in an expected number of field and bit operations which is polynomially bounded in dim_{k}(A). (Here the A_{i} are represented via coordinate vectors of k-bases with respect to the chosen basis of A.)

Note again that we assume that the algebra A is given by a multiplication table with respect to a k-basis. Note also that the A_{i} are not subalgebras of A in our terminology as the unity of A_{i} does not coincide with the unity of A.

The statement in the following proposition is proven in [KM04a] under the additional assumption that the algebra A is local. Because of this, we state it here with a proof.

Proposition 1.50 Given a finite commutative k-algebra A over a perfect field k, one can with a deterministic algorithm compute the nilradical of A in a number of field operations which is polynomially bounded in dim_{k}(A). (Again the nilradical is represented via coordinate vectors of a k-basis.)

Let d := dim_{k}(A) and p := char(k). Let N be the nilradical. Our proof of this proposition is based on the following two lemmata.

Lemma 1.51 Let either the characteristic of k be 0 or larger than d. Then some a ∈ A is nilpotent if and only if Tr(ab) = 0 for all b ∈ A. With other words, N is the kernel of the k-linear map

A ⟶ Hom_{k}(A, k) , a ↦ (b ↦ Tr(ab)) .

Proof. Let a ∈ N. Then a^{i} = 0 for some i ∈ ℕ. Now let b ∈ A. Then (ab)^{i} = 0 too. Therefore the minimal polynomial of ab is t^{i} ∈ k[t] for some i ≤ d. In particular the characteristic polynomial of a is t^{d}. Therefore, the trace of ab is 0.

For the converse let us first assume that A is a local algebra. Now let a ∉ N. Then a is a unit and there exists some b ∈ A with ab = 1. Therefore Tr(ab) = d ≠ 0.

Let now A be arbitrary, and let A = A_{1} ⊕ ⋯ ⊕ A_{t} be the decomposition into local algebras, and let 𝔪_{i} be the maximal ideal of A_{i}. Then N = ⋂_{i=1}^{ℓ} 𝔪_{i}. Let a ∉ N, a = (a_{1}, …, a_{ℓ}). Then there exists some j = 1, …, t such that a_{j} ∉ 𝔪_{j}. Therefore there exists a b ∈ A with ab = (δ_{i,j})_{i,j}. Now Tr_{A/k}(ab) = Tr_{A_{j}/k}(1) ≠ 0. □

The beginning of the proof also implies:

Lemma 1.52 N = {a ∈ A | a^{d} = 0}

The algorithm for Proposition 1.50 is now as follows:

First we check by “brute force” if either (p = 0 or p > d) or (p > 0 and p ≤ d). In the first case, we compute the nilradical following Lemma 1.51.

So let us now assume that p ≥ 0 and p ≤ d. Let j ∈ ℕ be such that p^{j} ≥ d. Let b_{1}, …, b_{d} be the fixed basis of A. For a ∈ A, let \underline{a} ∈ k^{d} be the associated coordinate vector. Let M ∈ k^{d×d} be the matrix which defines the k-linear map given by b_{i} ↦ b_{i}^{p}.

Let σ : k^{d} ⟶ k^{d}, (a_{1}, …, a_{d}) ↦ (a_{1}^{p}, …, a_{d}^{p}). Let Λ_{M} : k^{d} ⟶ k^{d} , \underline{a} ↦ M\underline{a}. Note that for a ∈ A, Mσ\underline{a} = (Λ_{M} ∘ σ)(\underline{a}) is the coordinate vector of a^{p}. More generally, for i ∈ ℕ (Λ_{M} ∘ σ)^{i}(\underline{a}) is the coordinate vector of a^{p^{i}}.

By the previous lemma, an element a ∈ A is in N if and only if a^{p^{j}} = 0, and this is the case if and only if (Λ_{M} ∘ σ)^{j}(\underline{a}) = 0.

Let for N ∈ k^{d×d} σ(N) be the matrix obtained by raising all entries of N to the p^{th} power. Then σ ∘ Λ_{M} = Λ_{σ(M)} ∘ σ, and therefore, (Λ_{M} ∘ σ)^{j} = Λ_{σ^{j−1}(M)σ^{j−2}(M)···σ(M)M} ∘ σ^{j}.

Now let \underline{g}_{1}, …, \underline{g}_{t} be a basis of ker(Λ_{σ^{j−1}(M)σ^{j−2}(M)···σ(M)M}). Then as k is perfect, σ^{−j}(\underline{g}_{1}), …, σ^{−j}(\underline{g}_{t}) are the coordinate vectors of a basis of N.

The computation is now obvious. □

Remark 1.53 Note that by the previous proposition, one can determine the maximal ideal of a local finite commutative k-algebra A in a number of field operations which is polynomially bounded in dim_{k}(A). This applies of course in particular to the components A_{i} in Proposition 1.49.

Remark 1.54 Let 𝔪 be the maximal ideal of A, let λ := A/𝔪, and let a_{1}, …, a_{dim_{k}(𝔪)} be a k-basis of 𝔪. Let a_{1}, …, a_{dim_{k}(A)} be an extension to a k-basis of A. Then a_{dim_{k}(𝔪)+1}, …, a_{dim_{k}(A)} induces a k-basis of λ.

From the previous proposition it follows that one can compute a k-basis of λ and the corresponding multiplication matrix of λ in a number of field operations which is polynomially bounded in dim_{k}(A).

The previous results imply:

Proposition 1.55 Given a finite field extension λ|k over a perfect field k, represented by a multiplication table over k, as well as a polynomial f(t) ∈ λ[t] of the form f(t) = g(t)^{e} for a monic irreducible polynomial g(t) ∈ λ[t] and e ∈ ℕ, one can with a deterministic algorithm compute g(t) and e in a number of field operations which is polynomially bounded in [λ : k] and deg(f).

In particular, if char(k) = p > 0, then one can compute p^{th} roots in finite extension fields λ|k in a number of field operations which is polynomially bounded in [λ : k] and deg(f).

Proof. Let A := λ[t]/(f(t)). Then A is a local commutative k-algebra with maximal ideal 𝔪 = (g(t)).

As a λ-vector space A has the basis given by the residue classes [1]_{(f)}, …, [t^{deg(f)−1}]_{(f)}. We fix the ordering [1]_{(f)} < ⋯ < [t^{deg(f)−1}]_{(f)} on the basis elements. Then [g(t)]_{(f)}, the residue class of g(t), is the unique element of 𝔪 whose coefficient vector with respect to [1]_{(f)}, …, [t^{deg(f)−1}]_{(f)} has the least initial term and whose leading coefficient is 1.

So to determine g(t), we proceed as follows: We compute a k-basis of 𝔪 (see Proposition 1.50). This basis also gives a generating system of 𝔪 over λ. From this generating system we determine g(t) with a Gaussian elimination. □

Proposition 1.56 Given a finite field extension λ|k over a perfect field k, represented by a multiplication table over k, as well as a polynomial f(t) ∈ λ[t], one can with a randomized algorithm determine the factorization of f(t) (over λ) in an expected number of field and bit operations in k which is polynomially bounded in [λ : k] and deg(f).

Proof. Let f(t) = c · f_{1}^{e_{1}} ⋯ f_{ℓ}^{e_{ℓ}} with c ∈ λ, distinct monic and irreducible polynomials f_{i} ∈ λ[t] and e_{i} ∈ ℕ. We consider the finite k-algebra λ[t]/(f(t)). We have the decomposition λ[t]/(f(t)) ≃ λ[t]/((f_{1})^{e_{1}}) ⊕ ⋯ ⊕ λ[t]/((f_{k})^{e_{ℓ}}). Let φ_{i} be the projection to the i^{th} factor. Then by the decomposition we have [t]_{(f)} = φ_{1}([t]) + ⋯ + φ_{ℓ}([t]). Moreover, the characteristic polynomial of φ_{i}([t]) is f_{i}^{e_{i}}.

We first compute the decomposition, say λ[t]/(f(t)) = A_{1} ⊕⋯⊕A_{ℓ}. We compute the multiplication tables of the A_{i} (with respect to the computed bases) and the decomposition of [t]_{(f)}, say [t]_{(f)} = t_{1} + ⋯ + t_{ℓ}. For the first task see Proposition 1.49, the second task is an easy linear algebra computation.

Now we compute the characteristic polynomials of the t_{i}’s in the factors A_{i}. This gives the polynomials f_{i}^{e_{i}}. Now the f_{i}’s and the e_{i}’s can be computed as claimed by the previous proposition. □

1.7.3 Computational problems and finite field extensions

Let C be a large groupoid, as usual over the large groupoid of fields, and let p : C ⟶ Fields be the structural functor. Now we consider the following large groupoid C_{ext}:

The objects are tuples (x, λ|k), where λ|k is a finite field extension and x is an object of C over λ. Let (x, λ|k) and (x′, λ′|k′) be two such objects. Then Mor((x, λ|k), (x′, λ′|k)) := {φ ∈ Mor(x, x′) | p(φ) ∈ Iso(k, k′)}.

Let FE be the large groupoid of finite field extensions. Note that this is a full subcategory of ALG. Just as ALG we represent FE by M, the large groupoid of multiplication tables. Note that we have already fixed a representation of M by RAMinputs, thus we have a representation of FE by RAMinputs as well.

We have the functor C_{ext} ⟶ FE defined by (a, λ|k) ↦ λ|k (and the obvious maps for morphisms). By composing this with the functor FE ⟶ Fields, λ|k ↦ k, C_{ext} becomes a large groupoid over the large groupoid of fields.

For the following propositions we consider the special case of C = RAMinputs. We choose a relative field RAM representation of RAMinputs_{ext} ⟶ FE, that is, a representation by RAMinputs ⟶ RAMinputs (as always over Fields), where RAMinputs ⟶ FE is the representation already considered. (The field extensions are represented by multiplication matrices, and the elements of a fixed field extension are represented by their coordinate vectors in k^{[λ:k]}; we assume that this representation is “reasonable”.)

The following proposition is obvious.

Proposition 1.57 Let a generic field RAM Π be given. There exists a RAM Π_{ext} such that the following holds:

For every field extension λ|k, input x over λ and some input y over k representing (x, λ|k) ∈ RAMinputs_{ext}, Π terminates on x if and only if Π_{ext} terminates on y.

For instances for which Π terminates, the running time in field operations of Π_{ext} is in O([λ : k]^{3} · (the number of field operations used by Π on x)). An analogous statement holds for the running time in bit operations.

The following two propositions follow from Propositions 1.55 and 1.56 respectively.

Proposition 1.58 Let a generic field RAM enriched with FIELDCHARROOT Π be given. There exists a RAM Π_{ext} such that the following holds:

For every field extension λ|k over a perfect field k, input x over λ and some input y over k representing (x, λ|k) ∈ RAMinputs_{ext}, Π terminates on x if and only if Π_{ext} terminates on y.

For instances over perfect fields for which Π terminates, the running time in field operations of Π_{ext} is in Poly([λ : k] · (the number of field operations used by Π on x)). An analogous statement holds for the running time in bit operations.

Proposition 1.59 Now let a generic field RAM Π enriched by randomization be given. There exists a randomized RAM Π_{ext} such that the following holds:

For every field extension λ|k, input x over λ and some input y over k representing (x, λ|k) ∈ RAMinputs_{ext}, Π terminates on x in a finite expected number of field operations if and only if Π_{ext} terminates on y in a finite expected number of field operations.

For instances for which Π terminates in a finite expected number of field operations, the expected running time of Π_{ext} in field operations is in Poly([λ : k] · (the expected number of field operations used by Π on x)). An analogous statement holds for the running time in bit operations.

If now C is any large groupoid represented by RAMinputs (over Fields), then C_{ext} ⟶ FE is relatively represented by RAMinputs_{ext} ⟶ FE (again over Fields) which in turn is relatively represented by RAMinputs ⟶ RAMinputs. In this way, any computational problem P : C ⟶ C′ leads to a computational problem P_{ext} : C_{ext} ⟶ C′_{ext}. Now the three propositions above can be used to study the complexity of P_{ext} in relation to the complexity of the complexity of the original problem P.

Similar remarks also hold for relative computational problems.

Representations and basic computations

2.1 Introduction

In this chapter, we discuss various methods to represent the basic objects in the computations: curves as well as points, divisors and divisor classes on curves. Moreover, we state some results concerning computations with divisors, most importantly concerning the arithmetic in the divisor group and the computation of Riemann-Roch spaces, and applications on the arithmetic in the divisor class group. We restrict ourselves throughout to curves over perfect fields.

Throughout this most of this chapter, we use generic field RAMs enriched with the command FIELDCHARROOT (to determine p^{th} roots in characteristic p > 0) or randomized generic field RAMs (that is, generic field RAMs enriched with the commands FIELDFACTOR (to factorize polynomials) and RAND (for randomization) as computational models for the algorithms; see Section 1.6. If we use randomized generic field RAMs to derive a certain computational result, we state that we use a randomized algorithm. (If we do not use randomization, sometimes we stress this by saying that we have a deterministic algorithm, but not always.)

All running times (resp. expected running times) in field and bit operations we derive in this chapter are polynomially bounded in certain data associated with the input. For computations over finite fields 𝔽_{q}, one can obtain running times (resp. expected running times) in bit-operations (on a bit-RAM) by multiplying the given running times (resp. expected running times) with a polynomial factor in log(q) (see subsection 1.6.6 for details). Note moreover that if we give a deterministic algorithm (that is, if we have a (deterministic) generic field RAM), and we restrict ourselves to instances over finite fields, then we have a deterministic algorithm in the bit-oriented setting (that is, a (deterministic) bit-RAM) too.

At the end of the chapter we also discuss some computations over finite fields and in the randomized bit-RAM model.

2.2 Terminology and notation

We start off by fixing some terminology and notation which we use throughout this work. We also comment on some well known facts from algebraic geometry.

Generalities

We usually denote fields by k, λ and K. The algebraic closure of a field k is denoted by \overline{k}. The characteristic is always denoted by p.

If A is a graded commutative ring and M a graded A-module, we denote the degree-i part of M by M_{i}.

If A is a ring, I an ideal in A and a ∈ A, we denote the residue class of a in A/I by [a]_{I}. If A = ℤ and I = (n), we also write [a]_{n}.

Closed subschemes

Let A be a commutative ring and I an ideal in A. Then we denote the closed subscheme defined by I (that is, the closed subscheme defined by the closed immersion Spec(A/I) ⟶ Spec(A) induced by A ⟶ A/I) by V (I). If I = (f_{1}, …, f_{s}), we set V (f_{1}, …, f_{s}) := V (I).

Let now A be a graded commutative ring and I a homogeneous ideal of A. Then similarly to the previous notation we denote the closed subscheme defined by I (the closed subscheme defined by the closed immersion Proj(A/I) ⟶ Proj(A)) by V (I). If I = (F_{1}, …, F_{s}), we again set V (F_{1}, …, F_{s}) := V (I).

Base change

Let S be a scheme, let X be an S-scheme and let T ⟶ S be a morphism. Then as usual we denote the T -scheme X ×_{S} T by X_{T}. Note that the definition is in fact relative not only to T but also to the morphism from T to S, whereas the notation does not reflect this. This ambiguity does however not cause any problems in this work. Moreover, also as usual, if T = Spec(A), we set X_{A} := X_{T}.

Let again X be an S-scheme, let k be a field, and a morphism Spec(k) ⟶ S be given. Let us assume that X_{k} is integral. Then we set k(X) := κ(X_{k}), the function field of X_{k}.

Meromorphic sections and divisors

For background on the following definitions and remarks on meromorphic sections and divisors we refer to [Gro67, §20, §21].

Let X be an integral scheme, and let L be an invertible sheaf on X. Let M_{X} be the sheaf of meromorphic (that is, rational) functions on X (for every non-empty open subset U of X, Γ(U, M_{X}) = κ(X)). Further, let M(L) := L ⊗_{O_{X}} M_{X} be the sheaf of meromorphic sections of L, and let M(X, L) := Γ(X, M(L)) be the space of meromorphic sections of L on X. Now let s ∈ M(X, L) − {0} by a non-trivial meromorphic section of L on X. Then (L, s) defines a Cartier divisor (the divisor of zeroes of s) which we denote by div_{L}(s) or by div(s) if L is obvious from the context. For L = O_{X}, the divisor of zeroes of s is the principal divisor of s which we denote by (s).

If D is a Cartier divisor on X, we denote the associated invertible subsheaf of the sheaf M_{X} by O(D). Note that by definition for every open subset U of X, Γ(U, O(D)) is contained in Γ(U, M_{X}) = κ(X), and therefore M(X, O(D)) is canonically isomorphic to κ(X); we identify them. Note now that div_{O(D)}(1) = D and more generally for u ∈ κ(X)^{∗}, div_{O(D)}(u) = (u) + D. In particular,

\begin{aligned}Γ(C, O(D)) & = & \{u ∈ κ(X)^{∗} | div_{O(D)}(u) ≥ 0\} ∪ \{0\} \\ & = & \{u ∈ κ(X)^{∗} | (u) ≥ −D\} ∪ \{0\} . \end{aligned}

Another interesting fact is that every non-trivial meromorphic section s of an invertible sheaf L, defines an isomorphism L ⟶^{∼} O(div_{L}(s)).

If X is locally noetherian, we identify the effective Cartier divisors on (ℙ_{k}^{1})^{n} and the locally principal closed subschemes of (ℙ_{k}^{1})^{n} (cf. [Gro67, (21.2.12)]).

Affine and projective space

We set 𝔸^{1} := Spec(ℤ[x]) and ℙ^{1} := Proj(ℤ[X, Y]). We identify ℤ[x] with ℤ[\frac{X}{Y}] ⊂ κ(ℙ^{1}) via x ⟷ \frac{X}{Y}, and with this identification, we identify 𝔸^{1} with ℙ^{1} − V (Y).

We set ℙ^{2} := Proj(ℤ[X, Y, Z]) (note the different font for the variables!). Furthermore we set x := \frac{X}{Z} and y := \frac{Y}{Z}. Note that with this definition Proj(ℙ_{A}^{2}, O(i)) is canonically isomorphic to A[X, Y, Z]_{i}. In particular, we have the “homogeneous coordinate system” X, Y, Z ∈ Γ(ℙ_{A}^{n}, O(1)) on ℙ_{A}^{n}.

Projective spaces of dimension > 2 are seldomly considered in this work, and we do not use coordinate systems of these spaces. However in Section 3.5 we consider products of ℙ^{1}’s, and then we identify (ℙ^{1})^{n} componentwise with ∏_{i=1}^{n} Proj(ℤ[X_{i}, Y_{i}]). We then set x_{i} := \frac{X_{i}}{Y_{i}} and define 𝔸^{n} := Spec(ℤ[x_{1}, …, x_{n}]).

Curves and their plane models

By a curve over a field k we mean a smooth and proper geometrically irreducible 1-dimensional k-scheme. We denote the genus of a curve C by g = g(C).

Let k be a field, and let C be a curve over k.

We have ℙ^{1}(\overline{k}) = 𝔸^{1}(\overline{k}) ˙∪ \{∞\} for a unique point ∞ ∈ ℙ^{1}(k) − 𝔸^{1}(k) which we call the point at infinity. Note that every rational function on C, that is, every element in k(C), extends uniquely to a morphism from C to ℙ_{k}^{1}. Indeed, the set of morphisms from C to ℙ_{k}^{1} without the constant morphism to ∞ are in bijection with k(C). Note in particular that x then becomes the identity on ℙ_{k}^{1}.

For a (Cartier or Weil) divisor D on C, we set L(D) := Γ(C, O(D)), and following [Heß01] we call this vector space the Riemann-Roch space of D.

We often make use of plane models of curves. By a plane model of C we mean a proper 1-dimensional subscheme of ℙ_{k}^{2} which is over k birational to the curve. We denote a plane model of a curve C by C_{pm}, and we usually fix a birational map π : C ⟶ C_{pm}. Moreover, we assume that C_{pm} ≠ V (Z). We then denote the non-singular part of C_{pm} by C_{ns}. We denote the degree of a plane model by d, that is d = deg(C_{pm}). As every invertible sheaf on ℙ_{k}^{n} is isomorphic to O(d) for some d ∈ ℤ, every plane model is given by an irreducible polynomial F (X, Y, Z) ∈ k[X, Y, Z] (unique up to constants) which satisfies deg(F) = d (see [Har77, Corollary 6.17]).

So let π : C ⟶ C_{pm} ⊆ ℙ_{k}^{2} be a birational map from a curve to one of its plane models. We set O_{C}(i) := π^{∗}(O(i)) for i ∈ ℤ. Let W ∈ M(ℙ_{k}^{2}, O(i)) = k(X, Y, Z)_{i} be a meromorphic section degree i whose pole divisor does not contain C_{pm}. Then π^{∗}(W) ∈ M(C, O_{C}(i)) is defined, and we set W_{|C} := π^{∗}(W). Let now W ∈ M(ℙ_{k}^{2}, O(i)) with W ≠ 0 such that the support of V (W) does not contain C_{pm}. Then W_{|C} ≠ 0, and we have π^{∗}(div(W)) = div(W_{|C}). Note that these definitions and remarks in particular apply to rational functions on ℙ_{k}^{2} (which we denote by small letters).

The divisor class group

Let C still be a curve over k. Let P(C) be the group of principal divisors on C. Then the (divisor) class group of C is the group Cl(C) := Div(C)/P(C). We denote the divisor class of a divisor D on C by [D]. The degree of a class [D] is deg([D]) := deg(D). Moreover, the degree 0 (divisor) class group of C is Cl^{0}(C) := Div^{0}(C)/P(C).

Note that the definition of the divisor class group relies on the fact that principal divisors have degree 0.

Random variables

We frequently use random variables. We adopt the following convention: A random variable with values in a set X is called a random element of X. Likewise, for example, we talk about random vectors in a vector space, random vector subspaces of a fixed vector space, and so on. Note that this terminology is for example also used in the theory of random graphs; a “random graph” is in fact by definition a random variable with values in the set of graphs on a fixed set of vertices.

We would like to stress that every time we use this terminology we do in fact consider random variables, not specific elements which are chosen according to a certain distribution.

In fact, we reserve the terminology that a certain element is chosen with respect to a certain distribution to the description of algorithms (as a shorthand for applications of the command RAND), whereas otherwise, in particular in the analyses of algorithms, we use random variables.

Moreover, we denote random elements in a set X, that is random variables with values in X, just as the elements in X themselves. Indeed, the usual notation from probability theory, where one denotes random variables by capital letters and elements from the set by small letters is not applicable in our context because we consider random variables with values in various different sets whose elements are denoted in all kind of different ways.

2.3 Representing finite separable field extensions

As a preliminary consideration for computations with curves, we consider in this section the question how to represent finite separable field extensions and elements in these extensions.

In this section we furthermore – and for the last time – make the effort to in detail describe how one should define the categories, functors etc. for an application of the notions of the previous chapter. In the rest of this work, we use a less rigorous descriptions, as usual in computational mathematics. It is a rather straightforward but sometimes tedious task to turn formulate the statements rigorously using the general terminology on representations developed in the previous chapter.

Every finite separable extension of fields λ|k is primitive, that is, there exists some a ∈ λ with λ = k[a]. We address the question how to compute such a primitive element.

The computation is of course trivial if λ is represented over k as a primitive extension, that is, if it is represented by an irreducible polynomial f ∈ k[t] with λ ≃ k[t]/(f(t)).

We now assume that λ is represented over k by a multiplication table. We first discuss the necessary setup to formulate the computational problem rigorously using the terminology of the previous chapter. Here we apply the definitions of Section 1.2 with the modifications of Section 1.6.

We start off with the large groupoid SF E of finite separable field extensions defined analogously to ALG and FE. We represent this large groupoid by the large groupoid M of multiplication tables (which we represent by RAMinputs).

We define the large groupoid C′ whose objects are tuples (λ|k, a) of finite separable field extensions λ|k and elements a ∈ λ with the obvious morphisms. We represent such tuples by multiplication tables and coordinate vectors, such that we obtain a relative generic field RAM representation of C′ ⟶ FSE.

We now consider the relative field oriented computational problem (over FSE) given by FSE ⟶ C′, λ|k ↦ {(λ|k, a) | a is a primitive element of λ|k} together with: For every isomorphism α : λ ⟶ λ′ of separable field extensions over k the morphism P_{α} : (λ|k, a) ↦ (λ′|k, α(a)) and for every such α and a the induced morphism (λ|k, a) ↦ (λ′|k, α(a)) (called m_{α,a}). (Note that this problem is a special case of an analog of Example 1.26 for generic field RAMs.)

We have the following satisfying proposition.

Proposition 2.1 Given a finite field extension λ|k, represented by a multiplication table, one can with a randomized algorithm compute a primitive element of λ|k (and its minimal polynomial) in an expected number of field and bit operations which is polynomially bounded in the extension degree [λ : k].

This proposition is essentially proven in [KM04a, Section 6]. We note however that the proof in [KM04a] does not immediately give the desired result because it is (essentially) based on k-RAMs whereas we want to derive the result on the basis of a generic field RAM. (As stated in the introduction to this chapter, we also allow the computation of p^{th} roots of unity in positive characteristic p, but we do not need this here.) Because of this and for the sake of completeness, we give the proof of the proposition below.

Remark 2.2 As always, the proposition implies a corresponding statement over finite fields and on a bit-RAM: Given an extension λ|k of finite fields, represented by a multiplication table, one can with a randomized algorithm compute a primitive element of λ|k (and its minimal polynomial) in an expected time which is polynomially bounded in the extension degree [λ : k] and log(q).

Over finite fields and for the bit-RAM model, there is however a much easier proof than the one we give below: One uniformly randomly chooses an element of λ|k and computes its minimal polynomial. As shown in [KM04a, Section 6], the probability that the element is primitive is ≥ \frac{1}{2}.

Remark 2.3 One often encounters representations of finite separable field extensions in the following form: The extension is given by a tower of primitive extensions λ = λ_{r} ⊋ λ_{r−1} ⊋ ⋯ ⊋ λ_{0} = k, where each λ_{i} is given in the form λ_{i} ≃ λ_{i−1}[t_{i}]/(f_{i}(t_{i})) for i = 1, …, r and an explicit polynomial f_{i} ∈ λ_{i−1}. Then to represent the elements of λ, one recursively represents elements of λ_{i} by the polynomial basis given by t_{i} over λ_{i−1}.

Given such a representation, it is an easy task to compute a multiplication table of λ|k, and then one can apply Proposition 2.1 to find a primitive element.

Proof of Proposition 2.1

Before we come to the proof we note again that we want to derive the desired result on the basis of a generic field RAM. Note that the computational model requires that we can only access field elements which are algebraic combinations of the images of the integers and the input elements.

The algorithm is based on the following easy lemma from [BG04] (see also [KM04a, Lemma 3.8]), which we state here without proof.

Lemma 2.4 Let W be an n-dimensional vector space over k with basis w_{1}, …, w_{n}. Let H_{1}, …, H_{m} ⊊ W be proper vector subspaces of W, and let S ⊆ k be a finite set. Now let c_{1}, …, c_{n} be independently and uniformly distributed random elements of S. Then the probability that c_{1}w_{1}+⋯ c_{n}w_{n} ∈ H_{1} ∪ ⋯ ∪ H_{m} is at most \frac{m}{#S}.

Let n := [λ : k]. Now an element a ∈ λ is not primitive over k if and only if for some i = 1, …, n, σ_{1}(a) = σ_{i}(a), where σ_{i} : λ ↪ \overline{k} for i = 1, …, n are the different embeddings of λ|k into an algebraic closure \overline{k} of k.

The idea is now to apply this lemma with H_{i} := {a ∈ λ | σ_{1}(a) = σ_{i+1}(a)} (i = 1, …, m := n − 1) and #S = 2m = 2([λ : k] − 1), except if the all input elements are algebraic over the prime field and the field generated by the input elements is too small for this.

The following lemma guarantees that we can generate sufficiently fast sufficiently many field elements from the input elements.

Lemma 2.5 Let a vector \underline{v} ∈ k^{r} and a natural number s be given. Let k_{0} be the prime field of k and R := k_{0}[v_{1}, …, v_{r}]. Then one can construct a vector consisting of min{s, #R} different elements from R with O(s) field and bit operations (independently of n).

We give an algorithm with the claimed properties below at the end of this subsection.

Now we show how we can apply the previous two lemmata to obtain a proof of Proposition 2.1.

Let M = (m_{i,j,k})_{i,j,k} be the multiplication table. Analogously to the notation in the previous lemma, let k_{0} be the prime field of k, and let R := k_{0}[{m_{i,j,k}}_{i,j,k}]. Let m := n − 1. Let b_{1}, …, b_{n} be the fixed basis of λ|k with respect to which the multiplication table is given.

We are now coming to the algorithm.

We start off with computing a vector \underline{a} over R ⊆ k consisting of min{2m, #R} elements of k. According to the previous lemma, this can be done with O(n) = O([λ : k]) field and bit operations.

Now we make a case distinction according to whether the length of the vector is 2m or less.

Assume first that the vector has length 2m. We choose i_{1}, …, i_{n} ∈ {1, …, 2m} uniformly at random and test whether the element given by (a_{i_{1}}, …, a_{i_{n}}) defines a primitive element. This can be done in a number of field and bit operations which is polynomially bounded in n = [λ : k]. By Lemma 2.4 with S = {a_{1}, …, a_{2m}}, the probability that the element is primitive is ≥ \frac{1}{2}.

We now consider the case that the vector has smaller length. Then R is a finite field. We now first give some mathematical background and then return to the algorithm.

Let q be the power of p such that R = 𝔽_{q}. Let λ_{0} be the vector space which is generated by the basis elements b_{1}, …, b_{n} over R. By definition of R, the multiplication of λ restricts to λ_{0}; with the induced multiplication λ_{0} is a finite extension field of R of degree n. Now λ is generated by λ_{0} and k over R, and [λ_{0} : r] = [λ : k] = n. This equality implies that λ_{0} and k are linearly disjoint over R, that is, λ = λ_{0} ⊗_{R} k. It follows in particular that the extension λ|k is cyclic of order n. Let σ_{λ_{0}|R} be the Frobenius automorphism of λ_{0}|R. Then the automorphism group of λ|k is generated by σ := σ_{λ_{0}|R} ⊗_{R} id_{k}, and σ is given on coordinate vectors by (a_{1}, …, a_{n}) ↦ (a_{1}^{q}, …, a_{n}^{q}).

Let now d_{i} := [k[b_{i}] : k] = [R[b_{i}] : R]. Then lcm(d_{1}, …, d_{n}) = n. There therefore exist e_{1}, …, e_{n} ∈ ℕ such that e_{i}|d_{i}, the e_{i} are coprime and

e_{1} ⋯ e_{n} = n. Let now c_{i} := N_{𝔽_{q}[b_{i}]|𝔽_{q^{e_{i}}}}(b_{i}) = bi^{\frac{q^{d_{i}} −1}{q^{e_{i}} −1}} . Then R[c_{i}] = 𝔽_{q^{e_{i}}}.

Therefore, the extension k[c_{i}]|k has degree e_{i} too. By the properties of the f_{i} stated above, c := c_{1} ⋯ c_{n} is a primitive element of λ_{0}|R and of λ|k.

We now return to the algorithm. We first compute the minimal polynomials of the basis elements b_{i}. Then we in particular know the degrees d_{i} of the extensions k[b_{i}]|k. We determine suitable e_{i} and then the c_{i}. Finally, we compute c. All these computations can obviously be performed as claimed.□

Proof of Lemma 2.5

The idea of the algorithm is: One tries to construct a vector containing s elements from k by first considering all elements in the prime field k_{0}, then from k_{0}[v_{1}], then from k_{0}[v_{1}, v_{2}] and so on, and furthermore, if the elements from k_{0}[v_{1}, …, v_{ℓ−1}] have already been considered, one considers first the elements of k_{0}[v_{1}, …, v_{ℓ}] of degree 1 in v_{ℓ}, then of degree 2 in v_{ℓ} and so on.

Note that if we have constructed a vector consisting of all elements of k[v_{1}, …, v_{ℓ−1}] then in particular we know that k[v_{1}, …, v_{ℓ−1}] is a finite field.

Algorithm for constructing a vector of different elements in a field

Input: A field k, \underline{v} ∈ k^{r} and s ∈ ℕ.

1. Let i ⟵ 0 Let a_{1} ⟵ 0_{k} ∈ k Repeat

Let i ⟵ i + 1

Let a_{i} ⟵ a_{i−1} + 1_{k}
If i = s, then output \underline{a}, STOP

Until a = 0_{k}. Let ch ⟵ i (This is the characteristic of k.)

2. For ℓ = 1, …, r do 2.1. Let v ⟵ 1_{k}

2.2. Repeat

2.2.1. Let v ⟵ v · v_{ℓ} 2.2.2. For ℓ = 1, …, i do

If v = a_{ℓ}, then abandon the Repeat-loop

2.2.3. Let t ⟵ i

2.2.4. For j = 1, …, ch − 1 do

For u = 1, …, t do

Let i ⟵ i + 1
Let a_{i} ⟵ v + a_{i−t}
If i = s, then output \underline{a}, STOP

3. Output \underline{a}.

We sketch the proof of the correctness of the algorithm.

Note first that i is always the length of the array already constructed.

In Step 1 an array of distinct elements of the prime field k_{0} is constructed. Now either the algorithm stops with an array of s different field elements from k_{0} or at the end of Step 1 the array contains all elements from k_{0}.

Let us now consider Step 2.

Now the following statements always hold:

• v is a power of v_{ℓ}.

• Before the execution of Step 2.1.: k_{0}[v_{1}, …, v_{ℓ−1}] is a field and \underline{a} contains all elements from this field exactly once.

• After Step 2.2.1.: Let v = v_{ℓ}^{d}. (This also applies to the next items.) Then \underline{a} contains all elements of k_{0}[v_{1}, …, v_{ℓ}] of degree < d in v_{ℓ}.

• Concerning Step 2.2.2.: This loop is abandoned if and only if v_{ℓ} is algebraic over k_{0}[v_{1}, …, v_{ℓ−1}] and its minimal polynomial has degree d.

• After Step 2.2.4.: Then a_{1}, …, a_{t} contains all elements of k_{0}[v_{1}, …, v_{ℓ}] of degree < d in v_{ℓ} and furthermore either v_{ℓ} is transcendental over k_{0}[v_{1}, …, v_{ℓ−1}] or it is algebraic and its minimal polynomial has degree > d.

The enlargement of the vector in Step 2.2.4. is based on the following fact: Let a_{1}, …, a_{t} contain all elements of k_{0}[v_{1}, …, v_{ℓ}] of degree < d in v_{ℓ} exactly once. Then the elements of k_{0}[v_{1}, …, v_{ℓ}] of degree ≤ d in v_{ℓ} can uniquely be written as cv^{d} + a_{x} with c ∈ k_{0} and x ∈ {1, …, t}. Moreover, of course, (c + 1)v^{d} + a_{x} = v^{d} + (cv^{d} + a_{x}).

It is obvious that the algorithm has the claimed complexity. □

2.4 Representing curves

We represent curves by plane models which are birational to the curve. The plane models themselves are represented by a defining homogeneous polynomial in k[X, Y, Z].

The following proposition is [Heß05, Theorem 56].

Proposition 2.6 Any curve over a finite field has a plane model of degree O(g) (uniformly over all finite fields).

This proposition is complemented by the following proposition for curves over infinite fields. Together these two propositions indicate that it is reasonable to represent curves by plane models for computational purposes.

Proposition 2.7 Every curve of genus ≥ 1 with a divisor of degree 1 over an infinite field has a plane model of degree at most 4g.

Proof. Every genus 1 curve with such a divisor is isomorphic to a plane cubic (if D is a divisor of degree 1, the linear system |3D| is very ample of (projective) dimension 2 and degree 3 and thus defines an embedding into ℙ_{k}^{2}).

Let C be a curve of genus g ≥ 2. Let first C be hyperelliptic. Then we have a covering of degree 2 C ⟶ D with g(D) = 0. Now as C has a divisor of degree 1, so has D. Therefore, D ≈ ℙ_{k}^{1}. Now by Artin-Schreier and by Kummer theory, k(C) ≃ k(x)[y]/(f(x, y)), for a polynomial f(x, y) ∈ K[x, y] which has degree 2 in x and degree 2g + 1 or 2g + 2 in y.

So let C be non-hyperelliptic, and let D be a divisor of degree 1 on C. Note that for n ≥ 2g − 1, nD is non-special, thus dim(L(nD)) = n + 1 − g.

Now depending on the characteristic of k we proceed as follows:

If the characteristic divides 2g, then we choose some u ∈ L((2g + 1)D) − L(2gD). Otherwise we choose some u ∈ L(2gD)−L((2g−1)D). Now in any case the degree of the covering u : C ⟶ ℙ_{k}^{1}, that is, the extension degree [k(C) : k(u)], is prime to the characteristic. In particular, the extension k(C)|k(u) is separable.

Let u, v_{1}, …, v_{g+1} be a basis of L((2g + 1)D). Note that u, v_{1}, …, v_{g+1} generate k(C) over k because (2g+1)·D is very ample; see [Har77, Corollary 3.2]. With other words, we have k(C) = k(u)[v_{1}, …, v_{g+2}].

Now by the theorem of the primitive element and its proof in [Lan93] ([Lan93, V, §4, Theorem 4.6]), there exist a, a_{1}, …, a_{g+2} ∈ k such that k(C) = k(u, v) with v := au + a_{1}u_{1} + ⋯ + a_{g+2}u_{g+2}.

This implies that u, v, 1 define a rational map to ℙ_{k}^{2} (which of al always extends to a morphism) which is birational onto its image (that is, the image is a plane model of the curve).

Let F ∈ K[X, Y, Z] be the polynomial defining the plane model. Note that F is unique up to multiplication by a scalar, and it is a polynomial of minimal degree with F (u, v, 1) = 0.

By the Riemann-Roch Theorem, for i ≥ 1, L(i·(2g+1)·D) has dimension i·(2g +1)+1−g. On the other hand, the space of homogeneous polynomials in 3 variables of degree i has dimension \binom{i+2}{2} = (i + 2)(i + 1)/2. For i ≥ 4g, we have (i + 2)(i + 1)/2 > i · (2g + 1) + 1 − g, and there exists some nonzero polynomial G ∈ K[X, Y, Z] with G(u, v, 1) = 0. This implies that deg(F) ≤ 4g. □

We will use Proposition 2.6 later in this work, in Sections 3.3 and 3.4. Proposition 2.7 will in fact never be used, and for the time being we impose no restriction on the degree d.

2.5 Representing points and divisors and related computational problems

In this section, we present various possibilities of representing closed points and divisors on curves over perfect fields, starting from a plane model. We also address related computational aspects like for example the arithmetic in the divisor group, the computation of principal divisors, and the computation of Riemann-Roch spaces.

2.5.1 Overview

In this subsection we first give a brief overview over different approaches to represent closed points and divisors over perfect fields appearing in the literature. We then briefly mention the different approaches to compute Riemann-Roch spaces which are described in the literature. We also make some historical remarks.

The following three different approaches to represent closed points on curves over perfect fields are classical and appear often in the literature.

The first (and arguably most intuitive) approach to represent closed points of a curve is based on coordinates (in finite extension fields of the ground field) of points of a plane model. Divisors can then be represented by giving the support and the coefficients. We describe this approach briefly in subsection 2.5.2. For a fixed curve with a fixed birational morphism to a plane model this description as such leads however often only to a partial representation of points and divisors on the curve. If the plane model has singularities with various branches one needs additional “local” information to represent points lying over these singular points. One possibility to represent points lying over singular points is to use truncated parameterizations of local branches. The description is particularly easy for ordinary singular points (that is, if the tangents of the local branches are all distinct). In characteristic 0 or in “large” positive characteristic, one can use truncated Newton-Puiseux expansions for arbitrary singularities. However, in “small” characteristic one cannot use Newton-Puiseux expansions anymore in general. A natural substitute are then the more complex Hamburger-Noether expansions: These are certain systems of polynomials together with one power series. As pointed out by A. Campillo and J. Farrán in [CF05], one might also use symbolic Hamburger-Noether expansions. Here the power series is substituted by a polynomial in two variables.

The second approach is based on ideal theory of function fields. Here one realizes the curve as a covering of the projective line and one defines two orders in the function field, a “finite” and an “infinite” order. Now, there is a bijection between the divisor group on the curve and the product of the two ideal groups of the two orders. One can represent each divisor by the corresponding pair of ideals. The ideals in turn can then conveniently be represented by module bases (for example by so-called Hermite normal form bases). We call this representation joint ideal representation. Alternatively, one can represent each divisor by as a formal sum of prime divisors, where each prime divisor is represented as a prime ideal of one of the two orders. We call this representation the free ideal representation. We describe the ideal theoretic approach in detail in subsection 2.5.4. Note that the so-called “Mumford representation” of so-called semi-reduced divisors on hyperelliptic curves in “imaginary quadratic representation” is a special case of the joint ideal representation.

Thirdly, one can represent effective divisors by linear subspaces of Riemann-Roch spaces of sufficiently high degree or more generally of spaces of global sections of invertible sheaves of sufficiently high degree. We call the corresponding representation the joint global representation, and again we have a related free representation. This approach is addressed in subsection 2.5.5.

An important basic computational problem related to divisors is the computation of the Riemann-Roch space L(D) of a divisor D. This is in particular so because together with algorithms for the computation of principal divisors and addition / subtraction of divisors, every algorithm to compute Riemann-Roch spaces leads to an algorithm for the computation in degree 0 class groups of curves.

The three approaches to represent divisors described above are closely related to three approaches for algorithms for these problems.

A classical approach for the effective determination of Riemann-Roch spaces relies on the theory of adjoints and the “Residue Theorem” by A. Brill and M. Noether from 1874 ([BN74]). In fact, the first effective method for the computation of Riemann-Roch spaces was given by M. Noether in 1884 ([Noe84]). Noether’s approach was in particular suggested by Goppa ([Gop82]) in 1982 to construct algebraic-geometric codes. It was subsequently studied by various authors, including (in chronological order) D. Le Brigand and J. Risler ([LBR88]), M.-D. Huang and D. Ierardi ([HI94]), E. Volcheck ([Vol94], [Vol95]) and finally A. Campillo and A. Farrán ([CF05]).

The ideal theoretic approach leads to an easy algorithm with a satisfying complexity due to F. Heß ([Heß01]). This algorithm from about the year 1999 is inspired by the ideal-theoretic proof of the Riemann-Roch Theorem by K. Hensel and G. Landsberg from about a century earlier ([HL02]). However, in contrast to the work by Hensel and Landsberg, no expansions are used. We present this algorithm in subsubsection 2.5.4.7.

The third approach leads to elegant and very fast algorithms based on linear algebra due to K. Khuri-Makdisi ([KM04b], [KM04a]). It should however be noted that if one starts with a curve represented by a plane model, to set up the representation via the third approach, one needs first to compute Riemann-Roch space of some divisors of sufficiently high degree.

One of the main goals of this section is to show that one can represent divisors in such a way that one can perform various computational problems related to divisors efficiently. In particular, one goal is to show that – with an appropriate representation – one can compute Riemann-Roch spaces of divisors in a number of field and bit operations which is polynomially bounded in d, the degree of the plane model, and the so-called height of the divisor. Using the theory of adjoints, partial results were established by M.-D. Huang and D. Ierardi ([HI94]) and E. Volcheck ([Vol94]): M.- D. Huang and D. Ierardi showed the result for curves given plane models with ordinary singularities which are defined over the ground field,^{1} using a different representation (which can be easily obtained from the coordinate representation): They represent systems of points by their so-called Chow-form (which gives a “dual description”).

Volcheck then studied curves with ordinary singularities of any kind. He gave an appropriate algorithm which does however require that the ground field is “not too small” in relation to the degree of the curve.

Using the ideal-based representation and the ideal theoretic approach to Riemann-Roch spaces, the desired result was established by Heß. Indeed, the author is of the opinion that it is much easier to show this result in full generality with the ideal theoretic method than with the expansion-based method via adjoints.

Based on these considerations, in the following we only discuss expansion free representations and corresponding algorithms in detail. In doing so we put particular emphasis on the ideal theoretic approach.

The reader is referred to [CF05] for an up-to-date account for computations with divisors using Hamburger-Noether expansions. Note, however, that no complexity estimates are given in this work.

2.5.2 The coordinate representation

As stated above, we consider curves over perfect fields, represented by plane models. Let C be such a curve with a fixed plane model C_{pm}. We represent both the curve and the plane model by a homogeneous polynomial F (X, Y, Z) ∈ k[X, Y, Z] defining the plane model. Let π : C ⟶ C_{pm} be a fixed birational map. Let g = g(C) be the genus of C, d = deg(C_{pm}) = deg(F) the degree of the plane model, and let p be the characteristic of k; cf. the notations in section 2.2

1The introduction as well as the results in [HI94] are formulated as if they did hold for arbitrary curves provided that the singularities are defined over the ground field. This is however not the case, and in fact it is implicitly assumed throughout the work that the singularities are ordinary. The first occurrence is in subsection 1.1., where the authors claim that a singularity of a plane curve can be resolved by another plane curve of at most twice the degree of the original curve. Another occurrence is in the proof of Lemma 2.1.

For any extension λ|k of fields, the points in C_{pm}(λ) can easily be represented by their coordinates in λ. This also provides an easy representation for all points in C(λ) which lie over non-singular points of C_{pm}.

Now every closed point P of C_{pm} (resp. every closed point of C) can be represented by a finite field extension λ|k and one point in C(λ) (resp. in C(λ)) defining P. (We can for example set λ := κ(P), such that [λ : k] = deg(P).) In order to bound the length of the representation, we choose some c ≥ 1 and consider only such extensions λ|k for which [λ : k] < deg(P)^{c} (uniformly over all curves C and all plane models). Following the definitions in Section 1.3, abbreviate this by saying that “[λ : k] is polynomially bounded in deg(P)”.

The field extension λ|k can then for example be represented by a multiplication table or by a finite separable polynomial over k. Note here again that a separable defining polynomial can be computed from a multiplication table with a randomized algorithm in an expected number of field and bit operations which is polynomially bounded in [λ : k].

We call the partial representation of closed points of curves by coordinates in finite extension fields in plane models we just described the coordinate representation.

This partial representation immediately leads to a representation of divisors whose support is disjoint from the points lying over singular points of the plane model: Similarly to the sparse representation of vectors one stores the support and the coefficients. We call this partial representation of divisors free coordinate representation.

We note here that obviously in a similar manner every (partial) representation of points leads to a corresponding (partial) representation of divisors, which we then call a free representation.

Points of C lying over the singular points of C_{pm} are not so easy to deal with. As a generalization of the representation via coordinates, it is natural to consider some expansion based description for these points. This is quite easy if one is concerned with ordinary singularities (that is, the tangent lines of all local branches are different), but the general case (in particular in small positive characteristic) is quite technical. As already mentioned above, we refer to [CF05] for further information.

2.5.3 Reduced matrices and Hermite normal forms

In the next subsection we will discuss how one can use ideal theory in function fields to represent and compute with divisors of curves. In doing so we will extensively use Hermite normal form bases (HNF-bases) of k[x]- and k[\frac{1}{x}]-submodules of finite field extensions of k(x).

Additionally, in Heß’ algorithm to compute Riemann-Roch spaces matrices over k[x] we call degree-reduced are used.

In this subsection we first give an overview over degree-reduced matrices. Then we briefly discuss applications of Gröbner base theory to matrices over k[x]. Finally, we turn to Hermite normal forms and HNF-bases. Here we restrict ourselves to definitions and statements with respect to k[x] since the definitions and statements with respect to k[\frac{1}{x}] can immediately be obtained by applying the isomorphism k[x] ≃ k[\frac{1}{x}] , x ⟷ \frac{1}{x}.

T. Mulders and A. Storjohann have obtained particularly efficient algorithms for various computational tasks we consider in this subsection, like the computation of determinants and Hermite normal forms of matrices over k[x] (see [MS03]). For readers who are interested in these issues we recommend to read this work in conjunction with this subsection. Note however that in [MS03] row-operations on matrices are considered whereas we consider column-operations. When citing [MS03] we implicitly transpose all definitions and statements.

2.5.3.1 Degree-reduced matrices

Definition 2.8 Let R be a domain, and let A, B ∈ Quot(R)^{r×s}. Then B is R-right-equivalent or R-column equivalent to A if there exists a unimodular matrix (that is, an invertible matrix) U ∈ R^{s×s} with B = A U. Similarly, B is R-left-equivalent or R-row equivalent to A if there exists a unimodular matrix T ∈ R^{r×r} with B = T A.

In this work, we use column vectors for elements in R^{r}. Consequently, we consider matrices up to right-equivalence.

Definition 2.9 Let g_{1}, g_{2} ∈ k[x] with g_{1}, g_{2} ≠ 0. Then the valuationdegree of \frac{g_{1}}{g_{2}} ∈ k(x) is valdeg(\frac{g_{1}}{g_{2}} ) := deg(g_{1}) − deg(g_{2}). Moreover, we set valdeg(0) := −∞.

Remark 2.10 Note that v_{∞}(\frac{g_{1}}{g_{2}} ) = − valdeg(\frac{g_{1}}{g_{2}} ), where v_{∞} is the degree valuation on k(x) (corresponding to the point ∞ on ℙ_{k}^{1}).

We remark that we use the phrase “valuation-degree” instead of merely “degree” because for non-constant \frac{g_{1}}{g_{2}} the degree of \frac{g_{1}}{g_{2}} interpreted as an element in k(ℙ^{1}), that is, as a covering ℙ_{k}^{1} ⟶ ℙ_{k}^{1}, is equal to the height of the divisor (\frac{g_{1}}{g_{2}} ), and if gcd(g_{1}, g_{2}) = 1, this is equal to max\{deg(g_{1}), deg(g_{2})\}.

Definition 2.11 Let g_{1}, g_{2} ∈ k[x] with g_{1}, g_{2} ≠ 0, and let d := valdeg(\frac{g_{1}}{g_{2}} ). Then the leading coefficient of \frac{g_{1}}{g_{2}} is the unique element a ∈ k with valdeg(\frac{g_{1}}{g_{2}} − ax^{d}) < d.

Explicitly, let b be the leading coefficient of the polynomial g_{1}, and let c be the leading coefficient of the polynomial of g_{2}. Then a = \frac{b}{c}. Indeed, we have deg(g_{1} − \frac{b}{c} x^{deg(g_{1})−deg(g_{2})}g_{2}) < deg(g_{1}), thus valdeg(\frac{g_{1}}{g_{2}} − \frac{b}{c}x^{valdeg( \frac{g_{1}}{g_{2}} )}) < valdeg(\frac{g_{1}}{g_{2}} ).

Definition 2.12 Let now \underline{v} ∈ k(x)^{r} for some r. Then the valuation-degree of \underline{v} is valdeg(\underline{v}) := max_{i=1}^{r} valdeg(v_{i}). If \underline{v} ∈ k[x]^{r}, we speak also of the degree of \underline{v}, deg(\underline{v}). Similarly, the valuation-degree of a matrix over k(x) is the maximum of the valuation-degrees of its entries.

Definition 2.13 Let \underline{v} ∈ k(x)^{r}, \underline{v} ≠ \underline{0}. Let d = valdeg(\underline{v}) and \underline{v} = \underline{a}x^{d} + \underline{w}, where valdeg(\underline{w}) < d. Then \underline{a} is called the vector of leading coefficients of \underline{v}, denoted lc(\underline{v}). We complement this definition with lc(\underline{0}) := \underline{0}.

Moreover, for A = ( \underline{a}_{1} ⋯ \underline{a}_{s} ) ∈ k[x]^{r×s}, we set lc(A) := ( lc(\underline{a}_{1}) ⋯ lc(\underline{a}_{s}) ) ∈ k^{r×s}.

Let in the following A ∈ k(x)^{r×s} be a matrix with columns \underline{a}_{1}, …, \underline{a}_{s}.

Lemma 2.14 If the columns of A are k(x)-linearly dependent, the columns of lc(A) are k-linearly dependent.

Proof. The statement is trivial if A has a zero-column. So let us assume that this is not the case.

Let \underline{b} ∈ k(x)^{s}, \underline{b} ≠ \underline{0} be such that A\underline{b} = \underline{0}. Let d := max_{j=1}^{s} valdeg(b_{j}\underline{a}_{j}), and let

c_{j} := \{ \begin{matrix}b_{j} & if valdeg(b_{j}\underline{a}_{j}) = d \\ 0 & if valdeg(b_{j}\underline{a}_{j}) < d . \end{matrix}

Then \underline{c} ≠ \underline{0} and ∑_{j=1}^{s} c_{j}lc(\underline{a}_{j}) = \underline{0}. □

The following lemma is easy.

Lemma 2.15 The following conditions are equivalent:

a) For all \underline{b} ∈ k[x]^{s}, valdeg(A \underline{b}) = max_{j=1}^{s} valdeg(b_{j} \underline{a}_{j}).

b) The non-zero columns of lc(A) are linearly independent.

c) Let Ã ∈ k(x)^{r×t} be the matrix obtained from A by deleting the zerocolumns. Then Ã has full column rank and the maximum of the degrees of the determinants of the t × t-minors of Ã is equal to ∑_{j=1}^{s} valdeg(\underline{a}_{j}).

In [Heß01] and related works a matrix A ∈ k(x)^{r×s} of full column rank is called reduced if the conditions of the lemma are satisfied. As however the word “reduced” occurs frequently in the literature with different meanings, and we also use it differently below, we define:

Definition 2.16 The matrix A is degree-reduced if the conditions of the lemma are satisfied.

Remark 2.17 Let Ã be the matrix which is obtained from A by deleting the zero-columns. Then A is degree-reduced if and only if Ã is, and this means in particular that Ã has full column rank.

Remark 2.18 Let T ∈ k(x)^{r×r}. Then T ∈ (k[\frac{1}{x}]_{( \frac{1}{x} )})^{r×r} if and only if valdeg(T) ≤ 0 if and only if valdeg(T \underline{v}) ≤ valdeg(\underline{v}) for all \underline{v} ∈ k(x)^{r}. Let now T be invertible in (k[\frac{1}{x}]_{( \frac{1}{x} )})^{r×r}. Then valdeg(T \underline{v}) = valdeg(\underline{v}) for all \underline{v} ∈ k(x)^{r}.^{2} By item a) of Lemma 2.15 this implies in particular that A is degree-reduced if and only if T A is degree-reduced.

Proposition 2.19

a) There exists a degree-reduced matrix M ∈ k(x)^{r×s} which is k[x]-right-equivalent to A.

b) Let M, M′ ∈ k(x)^{r×s} be degree-reduced matrices which are both k[x]-right-equivalent to A such that the degrees of the columns are monotonically increasing from left to right. Then valdeg(\underline{m}_{j}) = valdeg(\underline{m}′_{j}) for all j = 1, …, s.

c) Given a matrix A ∈ k[x]^{r×s}, one can compute such a matrix M in a number of field and bit operations which is polynomially bounded in deg(A), r and s.

Proof. Let g ∈ k(x), g ≠ 0. Then obviously A is degree-reduced if and only if gA is. For the existence of M we can therefore restrict ourselves to matrices in k[x]^{r×s}.

Both the existence of M in a) as well as the computational result in c) follow from an obvious reduction algorithm:

Let us assume that A ∈ k[x]^{r×s} is not degree-reduced. By a column swap we can obtain that there exists some t ∈ {1, …, s} such that columns 1, …, t are zero and columns t + 1, …, s are non-zero. Let \underline{b} ∈ ker(lc(A)) with \underline{b} ≠ \underline{0} with b_{1} = ⋯ = b_{t} = 0. Now let k ∈ \{t + 1, …, s\} be such that deg(b_{k}\underline{a}_{k}) is maximal. (This means that b_{k} ≠ 0 and for all j = 1, … s with j ≠ k and b_{j} ≠ 0, deg(\underline{a}_{j}) ≤ deg(\underline{a}_{k}).) Then a′_{k} := ∑_{j} b_{j}x^{deg(\underline{a}_{k})−deg(\underline{a}_{j})}\underline{a}_{j} = b_{k} \underline{a}_{k} + ∑_{j≠k} b_{j}x^{deg(\underline{a}_{k})−deg(\underline{a}_{j})}\underline{a}_{j} has smaller degree than \underline{a}_{k}. Note here that the coefficients are all in k[x].

2 One can show that conversely any matrix T ∈ k(x)^{r×r} with valdeg(T \underline{v}) = valdeg(\underline{v})

for all \underline{v} ∈ k(x)^{r} is invertible in (k[ \frac{1}{x} ]_{( \frac{1}{x} )})^{r×r}. Indeed, this follows easily with Hermite normal forms with respect to (k[ \frac{1}{x} ]_{( \frac{1}{x} )})^{r×r}.

This means that if we substitute \underline{a}_{k} by \underline{a}′_{k}, the sum of the degrees of the columns decreases. After finitely many such reduction steps, the procedure has to terminate, and the result is a degree-reduced matrix. More precisely, the number of reduction steps is bounded by deg(A) · s.

A possible algorithm consists of the following loop: Swap the zerocolumns to the left and let A = (O|Ã) as above. Then compute ker(Ã). If ker(Ã) = 0, the algorithm terminates, otherwise a reduction step is performed as indicated.

We come to item b). Let 𝔐 be the k[x]-module generated by the columns of A. Now let d ∈ ℕ, and let 𝔐_{d} be the k[x]-submodule of 𝔐 generated by the elements of 𝔐 of degree ≤ d. As M (resp. M′) is degree-reduced, the columns of degree ≤ d of M (resp. M′) generate 𝔐_{d}. This implies that the columns of degree d form k[x]-bases of 𝔐_{d}/𝔐_{d−1}. This implies the claim.□

The following observations are crucial for the ideal-theoretic approach to Riemann-Roch spaces and thus for Heß’ algorithm (see subsubsection 2.5.4.7).

Lemma 2.20 Let A ∈ k(x)^{r×r} be of full rank. Then the following conditions are equivalent:

a) A is degree-reduced.

b) valdeg(det(A)) = ∑_{j=1}^{r} valdeg(\underline{a}_{j}).

c) The matrix T := A diag(x^{− valdeg(\underline{a}_{1})}, …, x^{− valdeg(\underline{a}_{r})}) ∈ (k[\frac{1}{x}]_{( \frac{1}{x} )})^{r×r} is unimodular.

d) There exists a unimodular matrix T ∈ (k[\frac{1}{x}]_{( \frac{1}{x} )})^{r×r} and d_{1} ≥ ⋯ ≥ d_{r} ∈ ℤ such that A = T diag(x^{−d_{1}}, …, x^{−d_{r}}).

Lemma 2.21 Let A ∈ k(x)^{r×r} be of full rank. Then there exists uniquely determined integers d_{1} ≥ ⋯ ≥ d_{r} and unimodular matrices T ∈ (k[\frac{1}{x}]_{( \frac{1}{x} )})^{r×r}, U ∈ k[x]^{r×r} such that AU = T diag(x^{−d_{1}}, …, x^{−d_{r}}).

Proof. The existence is obvious. For the uniqueness, let d_{1} ≥ ⋯ ≥ d_{r} ∈ ℤ and d′_{1} ≥ ⋯ ≥ d′_{r} ∈ ℤ, and let T ∈ (k[\frac{1}{x}]_{( \frac{1}{x} )})^{r×r}, U ∈ k[x] with diag(x^{−d_{1}}, …, x^{−d_{r}}) U = T diag(x^{−d′_{1}}, …, x^{−d′_{r}}). By the previous lemma, the right-hand side and thus also the left-hand side is degree-reduced. Now the matrices diag(x^{−d_{1}}, …, x^{−d_{r}}) and T diag(x^{−d′_{1}}, …, x^{−d′_{r}}) are k[x]-right-equivalent, and thus by Proposition 2.19 b) d_{i} = d′_{i} for all i = 1, …, r. □

Proposition 2.22 Let V be an r-dimensional k(x)-vector space (r < ∞). Let 𝔐_{0} be a finitely generated k[x]-submodule of V and 𝔐_{∞} a finitely generated k[\frac{1}{x}]_{( \frac{1}{x} )}-submodule of V, both of rank r. Then there exist uniquely determined integers d_{1} ≥ ⋯ ≥ d_{r} and a basis v_{1}, …, v_{r} of 𝔐_{0} such that x^{d_{1}}v_{1}, …, x^{d_{r}}v_{r} is a k[\frac{1}{x}]_{( \frac{1}{x} )}-basis of 𝔐_{∞}. Then the following holds:

• For all n ∈ ℤ, the set

⋃_{i=1}^{r} {x^{j}v_{i} | 0 ≤ j ≤ d_{i} + n}

is a k-basis of 𝔐_{0} ∩ x^{n} · 𝔐_{∞}.

• Let for n ∈ ℤ ι(n) := max{j ∈ {1, …, r} | d_{j} + n ≥ −1}. Then dim(𝔐_{0} ∩ x^{n} · 𝔐_{∞}) − dim(𝔐_{0} ∩ x^{n−1} · 𝔐_{∞}) = ι(n − 1).

Proof. Let b_{1}, …, b_{r} be a k[\frac{1}{x}]_{( \frac{1}{x} )}-basis of 𝔐_{∞} and ṽ_{1}, …, ṽ_{r} a k[x]-basis of 𝔐_{0}. Let A be the coordinate matrix of ṽ_{1}, …, ṽ_{r} with respect to b_{1}, …, b_{r}, and let AU = M with U ∈ k[x]^{r×r} unimodular and M degree-reduced. Let M = T D with D = diag(x^{−d_{1}}, …, x^{−d_{r}}) and T ∈ k[\frac{1}{x}]_{( \frac{1}{x} )} unimodular. Now let v_{1}, …, v_{r} ∈ k(x) be such that the coordinate matrix with respect to ṽ_{1}, …, ṽ_{r} is U. Then

• ṽ_{1}, …, ṽ_{r} from a k[x]-basis of 𝔐_{0}.

• The coordinate matrix of ṽ_{1}, …, ṽ_{r} with respect to b_{1}, …, b_{r} is M.

• The coordinate matrix of x^{d_{1}} ṽ_{1}, …, x^{d_{r}} ṽ_{r} with respect to b_{1}, …, b_{r} is T. In particular, x^{d_{1}} ṽ_{1}, …, x^{d_{r}} ṽ_{r} form a k[\frac{1}{x}]_{( \frac{1}{x} )}-basis of 𝔐_{∞}.

This proves the existence of the integers d_{1} ≥ ⋯ ≥ d_{r} and the basis v_{1}, …, v_{r}. The uniqueness of the integers follows from the previous lemma.

We come to the first item in the proposition. Clearly x^{d_{i}+n}v_{1}, …, x^{d_{r}+n}v_{r} forms a k[\frac{1}{x}]_{( \frac{1}{x} )}-basis of x^{n} · 𝔐_{∞}.

Now let a_{1}, …, a_{r} ∈ k[x]. Then ∑_{i=1}^{r} a_{i}v_{i} = ∑_{i=1}^{r} a_{i}x^{−d_{i}−n}x^{d_{i}+n}v_{i} ∈ x^{n} · 𝔐_{∞} if and only if a_{i}x^{−d_{i}−n} ∈ k[\frac{1}{x}]_{( \frac{1}{x} )}, and this is the case if and only if valdeg(a_{i}x^{−d_{i}−n}) ≤ 0, that is, valdeg(a_{i}) ≤ d_{i} + n.

Now, we are coming to the second item in the proposition. By the first item dim_{k}(𝔐_{0} ∩ x^{n} · 𝔐_{∞}) = ∑_{j=1}^{ι(n)}(d_{j} + n + 1) = ∑_{j=1}^{ι(n−1)}(d_{j} + n + 1). This implies that

dim_{k}(𝔐_{0} ∩ x^{n} · 𝔐_{∞}) − dim_{k}(𝔐_{0} ∩ x^{n−1} · 𝔐_{∞}) = ι(n − 1) .

Note that this formula also establishes the uniqueness of the integers d_{1} ≥ ⋯ ≥ d_{r}. □

Remark 2.23 For matrices A of full column rank, all statements in this subsubsection up to Lemma 2.21 also hold if k(x) is replaced by k((x^{−1})) and k[\frac{1}{x}]_{( \frac{1}{x} )} is replaced by k[[x^{−1}]].

The statements of Proposition 2.22 then also hold provided that 𝔐_{0} is generated as a k[x]-module by a k((x^{−1}))-basis of V.

Let still V be a finite dimensional k((x^{−1}))-vector space. Then a k[x]- submodule of V which is generated by a k((x^{−1}))-linearly independent set can be regarded as a non-archimedean lattice with respect to the nonarchimedean absolute value || · || = e^{−v_{∞}} = e^{deg}. Moreover, by Remark 2.18 (and footnote 2) the isometric transformations of V are exactly the endomorphisms given by univariate matrices over k[[x^{−1}]] (with respect to some basis). Section 4 of [Heß01] is written from the point of view of nonarchimedean lattices. (But maybe the role of the role of the absolute value ||·|| is not so clear because Heß works with the degree instead of the absolute value || · ||.)

2.5.3.2 Monomial orders

In this subsubsection we first discuss some general statements concerning monomial orders on k[x]^{r} and right-equivalence of matrices in k[x]^{r×s}. Then we relate these statements with degree-reduced matrices and matrices in Hermite normal form, which we discuss in the next subsubsection. The exposition crucially relies on the theory of Gröbner bases.

We follow the terminology in Chapter 15 of [Eis95]. In particlar, a monomial is an element of k[x]^{r} of the form x^{α}\underline{e}_{i} for α ≥ 0 (where \underline{e}_{i} is the i-th standard basis vector), and a term is the product of scalar and a monomial.

We require that a reduced Gröbner basis has monic leading terms.^{3}

Let us fix a (strict) monomial order > on k[x]^{r}. All the following definitions and statements are with respect to this fixed monomial order.

Let now A ∈ k[x]^{r×s}. Inspired by the usual definitions in the theory of Gröbner bases we define:

Definition 2.24 The matrix A is top-reduced if the initial terms of the nontrivial columns of A occur in distinct rows. The matrix A is reduced if the non-zero columns of A form a reduced Gröbner basis.

3The book [Eis95] is a bit vague on the issue if a reduced Gröbner basis should have monic initial terms. The condition seems not be be required at the end of Section 15.2, but it is part of the definition in Exercise 15.14.

Remark 2.25 The following conditions are equivalent:

• A is top-reduced.

• No non-zero column is top-reducible with respect to the system of the remaining columns (that is, for no j, ℓ = 1, …, s with j ≠ ℓ and \underline{a}_{ℓ} ≠ 0, in_{>}(\underline{a}_{j}) | in_{>}(\underline{a}_{ℓ})).

• The non-zero columns of A form a minimal Gröbner basis.^{4}

Proposition 2.26 Let A ∈ k[x]^{r×s}. Then there exists a unique matrix M ∈ k[x]^{r×s} which is right-equivalent to A and has the following properties:

• M is reduced

• the zero-columns are to the left, and the initial terms of the other columns are increasing from left to right, that is, in_{>}(\underline{m}_{1}) ≤ in_{>}(\underline{m}_{2}) ≤ ⋯ ≤ in_{>}(\underline{m}_{s}).

Moreover, the matrix M can be computed from A.

Definition 2.27 We call the matrix M in the proposition the normal form of A with respect to >, and M itself is called in normal form with respect to >.

Proof of Proposition 2.26. The existence and uniquenes of the matrix M follows from the general statements that reduced Gröbner bases exist and are unique. As usual, M can be computed with a Buchberger-style reduction algorithm. We review this procedure now in our context.

We first show how one can obtain a top-reduced matrix: Let A ∈ k[x]^{r×s}. Assume that there are j, ℓ ∈ \{1, …, s\} with j ≠ ℓ such that \underline{a}_{j}, \underline{a}_{ℓ} ≠ 0 and the initial terms of \underline{a}_{j} and \underline{a}_{ℓ} occur in the same row, say row i. Let us further assume that the initial term of \underline{a}_{j} is larger than or equal to the one of \underline{a}_{ℓ}. Then one substitutes \underline{a}_{j} by the S-polynomial S(\underline{a}_{j}, \underline{a}_{ℓ}) = a_{i,ℓ} · \underline{a}_{j} − a_{i,j} · x^{deg(\underline{a}_{i,j})−deg(\underline{a}_{i,ℓ})} · \underline{a}_{ℓ}. Upon iterating this procedure one finally obtains a top-reduced matrix.

Let now A ∈ k[x]^{r×s} be top-reduced. Note again that the columns of A now form a Gröbner basis. One now performs a column swap such that \underline{a}_{1} ≤ \underline{a}_{2} ≤ ⋯ ≤ \underline{a}_{s}. Then one divides each non-zero column by the coefficient of its initial term, such that the columns are monic.

One can now obtain a right-equivalent reduced matrix with the desired additional properties by the following loop:

4Note that it is a special property of k[x]^{r} that top-reduced systems form a Gröbner basis. The statement is far from true in polynomial rings over k in several variables.

For j = 2 to r do substitute \underline{a}_{j} by the (unique) reduction of \underline{a}_{j} by \underline{a}_{1}, …, \underline{a}_{j−1}.

More precicely, let us consider the j^{th} iteration, so that the matrix (\underline{a}_{1} ⋯ \underline{a}_{j−1}) is already reduced. Then the reduction of \underline{a}_{j} with respect to \underline{a}_{1}, …, \underline{a}_{j−1} can be computed as follows:

For ℓ = 1, …, j − 1 such that \underline{a}_{ℓ} ≠ \underline{0} we consider the leading term of \underline{a}_{ℓ}. Say for some ℓ this leading term is ax^{α}\underline{e}_{i} with a ∈ k − \{0\} and α ≤ deg(a_{i,j}). Then we substitute \underline{a}_{j} by the reduction of \underline{a}_{j} by \underline{a}_{ℓ}, which is \underline{a}_{j} − x^{deg(a_{i,j})−α}\underline{a}_{ℓ}. We stop if for no ℓ = 1, …, j − 1 the condition is satisfied. □

As already stated in the proposition, the normal form of a matrix over k[x] can be computed. However, the complexity of the reduction algorithm just described depends crucially on the order.

Let us explicitly consider the following two monomial orders for k[x]^{r}:

x^{α}\underline{e}_{i} >_{d} x^{β}\underline{e}_{j}

if and only if

α > β or α = β and j > i ,

and

x^{α}\underline{e}_{i} >_{e} x^{β}\underline{e}_{j}

if and only if

j > i or j = i and α > β .

Note that >_{d} refines the order by degree, and >_{e} refines the elimination order \underline{e}_{n} > \underline{e}_{n−1} > ⋯ > \underline{e}_{1}.

We first discuss order >_{d}. The order >_{e} is strongly related to Hermite normal forms which are discussed in the next subsubsection.

Note first the following characterization of the initial term: Let \underline{a} ∈ k[x]^{r}, \underline{a} ≠ \underline{0}. Let ax^{α}\underline{e}_{i} be the initial term of \underline{a} (with a ∈ k) with respect to >_{d}. Then for all j ≤ i, deg(a_{j}) ≤ α and for all j > i, deg(a_{j}) > α. In particular, α = deg(\underline{a}).

Note now that a matrix of full column rank with is top-reduced with respect to >_{d} is in particular degree-reduced (in fact, up to a column swap, the matrix of leading coefficients is in column echelon form).

Note further that in the reduction algorithm in the proof of Proposition 2.26 the degrees of the intermediate matrices never exceed the degree of the original matrix. This implies immediately that with the reduction algorithm one can compute a right-equivalent top-reduced matrix in a number of field and bit operations which is polynomially bounded by r, s and deg(A).

It is a bit more complicated that with this bound on field and bit operations one can also compute a normal form. This is however shown in [MS03, Section 7]. Let us indicate how the final reduction is performed: We want to compute the reduction of \underline{a}_{j} by \underline{a}_{1}, …, \underline{a}_{j−1} as at the end of the proof of Proposition 2.26. For this we proceed with reductions by \underline{a}_{j} by the individual columns \underline{a}_{1}, …, \underline{a}_{j−1} as indicated in the proof of Proposition 2.26, however with a condition on the index ℓ: Let for ℓ = 1, …, j−1 such that \underline{a}_{ℓ} ≠ \underline{0} i_{ℓ} be index of the row in which the leading term of \underline{a}_{ℓ} is situated. Then we choose ℓ ∈ \{1, …, j − 1\} such that deg(a_{i_{ℓ},j}) − deg(\underline{a}_{ℓ}) = deg(a_{i_{ℓ},j}) − deg(a_{i,ℓ}) is maximal, and we reduce \underline{a}_{j} by \underline{a}_{ℓ}. With this choice one obtains (cf. [MS03]):

Proposition 2.28 One can compute the normal form of a matrix A ∈ k[x]^{r×s} with respect to >_{d} in a number of field and bit operations which is polynomially bounded in r, s and deg(A).

We therefore in particular obtain a second efficient reduction algorithm for the computation of a degree-reduced right-equivalent matrix.

Remark 2.29 Top-reduced matrices with respect to >_{d} are called matrices in weak Popov form in [MS03]. The reduction algorithm for the computation of a weak Popov form in [MS03] is the same as the reduction algorithm to obtain a top-reduced matrix presented above. Additionally, a matrix in Popov form is exactly a matrix in normal form with respect to >_{d}. Note here again that we implicitly “transpose” all definitions and statements in [MS03]. Monomial orders and the relationship with Gröbner bases are not discussed in [MS03].

In [MS03] it is shown that one can efficiently compute the determinant by a reduction algorithm with respect to >_{d} (we omit the details):

Proposition 2.30 Given a matrix A ∈ k[x]^{r×r}, one can compute the determinant of A in a number of field and bit operations which is polynomially bounded in r and deg(A).

Note that in characteristic 0 (or if the ground field is not too small) one can also obtain this result by computing the determinant of A by interpolation. However, over small finite fields, field extensions might be necessary for this approach, and by current knowledge, no (deterministic) polynomial time algorithm is known for this task. (Such an algorithm exists however under the assumption of the Generalized Riemann Hypothesis ([AL86], [Evd89]).)

We also mention the following consequence of Proposition 2.30.

Proposition 2.31 Let A ∈ k[x]^{r×r}. Then the degree of the adjoint matrix A^{#} is ≤ deg(A) · (r − 1). Moreover, A^{#} can be computed in a number of field and bit operations which is polynomially bounded in r and deg(A).

2.5.3.3 Hermite normal forms

We are now coming to Hermite normal forms and Hermite normal form bases (HNF-bases) of k[x]-modules. A very compact definition can be given with the notions of the previous subsubsection:

Definition 2.32 A matrix M ∈ k[x]^{r×s} is in Hermite normal form if it is in normal form with respect to >_{e}.

Remark 2.33 Explicitly, a matrix M ∈ k[x]^{r×s} is in Hermite normal form if and only if there exists some t ∈ ℕ_{0} with t ≤ s and a strictly increasing map ι : {t + 1, s} ⟶ {1, …, r} such that

1. the first t columns of M are zero.

2. For t + 1 ≤ j ≤ s,

• m_{ι(j),j} is monic

• for all i > ι(j), m_{i,j} = 0

• for all ℓ > j, deg(m_{ι(j),j}) > deg(m_{ι(j),ℓ}).

Note that these conditions are analogous to the conditions for the Hermite normal form of matrices with integer entries as in [Coh96, Theorem 4.7.3].

Let now M be of full row rank. Then M is in Hermite normal form if and only if it is of the form M = (O|N), where the entries of O are all zero, N is an r × r-matrix and

• N is upper triangular

• for all i = 1, …, r, n_{i,i} is monic

• for all j > i, deg(n_{i,i}) > deg(n_{i,j}).

By Proposition 2.26 we already know that given a matrix A ∈ k[x]^{r×s}, there exists a unique matrix which is right-equivalent to A and in Hermite normal form. This matrix is called the Hermite normal form of A.

We are now coming to the efficient computation of Hermite normal forms. The reduction algorithm in the proof of Proposition 2.26 suffers from

the problem that the degrees of the entries of intermediate matrices become extraordinarily large for certain inputs.

In [MS03] the following result is proven. The algorithm is similar to the algorithm for the computation of the determinant and again relies crucially on a reduction algorithm with respect to >_{d} (!).

Proposition 2.34 One can compute the Hermite normal form of a matrix A ∈ k[x]^{r×s} of full row rank in a number of field and bit operations which is polynomially bounded in s and deg(A).

Let us note that by computing a degree-reduced right-equivalent matrix the problem to compute the Hermite normal form of a matrix of full row rank immediately reduces to the problem to compute the Hermite normal form of a square matrix of full rank, and this is also the first step in the algorithm by Mulders and Storjohann.

There are various other efficient approaches for the computation of Hermite normal forms of square matrices over k[x] of full rank in the literature. We just mention the algorithm by P. Domich, R. Kanan, L. Trotter. This algorithm relies on computations “modulo the determinant” (see [DKT87]). Again the required number of field and bit operations is polynomially bounded in the size of the matrix and the degree.

We now apply Hermite normal forms to finitely generated k[x]-sub-modules of finite dimensional k(x)-vector spaces.

Definition 2.35 Let V be an r-dimensional k(x)-vector space with r < ∞, let 𝔐 be a submodule of V of rank r, and let 𝔑 be any finitely generated submodule of V.

• The denominator of 𝔑 with respect to 𝔐 is the unique monic generator of the ideal {a ∈ k[x] | a 𝔑 ⊆ 𝔐} of k[x].

• Let b_{1}, …, b_{r} be a k[x]-bases of 𝔐, and let 𝔑 be a finitely generated submodule of V of rank s. Let d be the denominator of 𝔑 with respect to 𝔐. Then the HNF-basis of 𝔑 with respect to b_{1}, …, b_{r} is the unique k[x]-basis v_{1}, …, v_{s} of 𝔑 such that the coordinate matrix of dv_{1}, …, dv_{s} with respect to b_{1}, …, b_{r} is in Hermite normal form.

We have the following obvious lemma.

Lemma 2.36 Let V be an r-dimensional k(x)-vector space, and let U be a t-dimensional k(x)-vector subspace. Let b_{1}, …, b_{r} be a basis of V such that b_{1}, …, b_{t} is a basis of U. Moreover, let 𝔑 be an r-dimensional k[x]- submodule of V with HNF-basis v_{1}, …, v_{r} with respect to b_{1}, …, b_{r}. Then v_{1}, …, v_{t} is the HNF-basis of 𝔑 ∩ U with respect to b_{1}, …, b_{t}.

Definition 2.37 Let A ∈ k(x)^{r×s}. Then the denominator d of A is the denominator of the submodule of k(x)^{r} generated by the columns of A. The numerator matrix associated to A is the matrix dA.

Remark 2.38 Let g ∈ k[x] be monic and A ∈ k(x)^{r×s}, and let h be the gcd of g and all entries of A. Then the denominator of \frac{1}{g}A is lcm(\frac{h}{g}, 1). In particular, the denominator can be computed in a number of field and bit operations which is polynomially bounded in r, s, deg(g) and deg(A) with the Euclidian algorithm. Then the numerator matrix can of course also be computed with this complexity.

Convention 2.39 If not stated otherwise, the following applies:

• We represent a matrix in k(x)^{r×s} by its denominator and its numerator matrix.

• Given a finite dimensional k(x)-vector space V with a fixed basis, we represent finite dimensional k[x]-submodules of V by their HNF-basis, which in turn we represent by their coordinate matrix.

This convention in particular applies to the following computational problem.

Proposition 2.40 Let A ∈ k(x)^{r×s}, where the entries are represented in the form a_{i,j} = \frac{b_{i,j}}{c_{i,j}} with b_{i,j}, c_{i,j} ∈ k[x]. Let M be the coordinate matrix (in HNF-form) of the k[x]-module generated by the columns of A. Then:

a) The degrees of the denominator of M as well as the numerator matrix of M are polynomially bounded in r, s and the maximum of the degrees of b_{i,j} and c_{i,j} for i ∈ {1, …, r} and j ∈ {1, …, s}.

b) One can compute the HNF-basis of the module generated by the columns of A in a number of field and bit operations which is polynomially bounded in r, s and the maximum of the degrees of b_{i,j} and c_{i,j} for i ∈ {1, …, r} and j ∈ {1, …, s}.

Proof. We first discuss the computational statement: We compute c := ∏_{i,j} c_{i,j} and Ã := ((b_{i,j} \frac{c}{c_{i,j}}))_{i,j} ∈ k[x]. Now we perform Hermite reduction on A. Let M be the resulting matrix. Finally, we compute the denominator of \frac{1}{c}M and the numerator matrix.

Let m be the maximum of the degrees of the b_{i,j} and c_{i,j}. Then deg(c) ≤ rsm, deg(Ã) ≤ deg(c) + deg(((b_{i,j}))_{i,j}) ≤ rsm + m. All computations can therefore be performed with the claimed complexity by Propositions 2.34 and 2.38.

The statement on the degrees is now also obvious. □

Finally, by imitating the theory of ℤ-modules, we define:

Definition 2.41 Let 𝔐 be a free finitely generated k[x]-module, and let 𝔑 be a k[x]-submodule of 𝔐 of the same rank. Then we define the k[x]-index [𝔐 : 𝔑]_{k[x]} of 𝔑 in 𝔐 as the unique monic polynomial which is a k-multiple of the determinant of the coordinate matrix of a basis of 𝔑 with respect to a basis of 𝔐.

Remark 2.42 The k[x]-index [𝔐 : 𝔑]_{k[x]} is equal to the invariant χ(𝔐/𝔑) defined in [Ser79, I, §5]. This invariant can be defined in a more general context, and in particular if A is a finitely generated free abelian group and B is a subgroup of A of the same rank, then χ(A/B) = [A : B].

Remark and Definition 2.43 Let 𝔐 and 𝔑 be as above, let b_{1}, …, b_{r} be a k[x]-basis of 𝔐, and let M be the coordinate matrix of the HNF-basis of 𝔑 with respect to b_{1}, …, b_{r}. Then the system of elements x^{α}b_{j} with α < deg(m_{j,j}), j = 1, …, r is k-linearly independent. Let C be the vector space spanned by it. Then C is a direct complement of the k-vector space 𝔑 in 𝔐; we refer to C as the canonical complement of 𝔑 in 𝔐 and to the basis just defined as the canonical complementary system (with respect to b_{1}, …, b_{r}). The projection 𝔐 ⟶ 𝔐/𝔑 induces an isomorphism of k-vector spaces C ⟶ 𝔐/𝔑. We call the image of the canonical system the canonical basis of 𝔐/𝔑 and the inverse of the isomorphism the canonical lift of 𝔐/𝔑 to 𝔐 with respect to b_{1}, …, b_{r}.

Remark 2.44 Let 𝔐 = k[x]^{r} and b_{i} = \underline{e}_{i}. Then the basis elements x^{α}b_{j} = x^{α}\underline{e}_{j} in Remark and Definition 2.43 are the monomials which do not lie in in_{>_{e}}(𝔑). The statements are then a special case of a theorem of Macaulay’s (cf. [Eis95, Theorem 15.3]).

Remark 2.45 The k[x]-index [𝔐 : 𝔑]_{k[x]} is in particular equal to the determinant (= the product of diagonal entries) of the HNF-basis of 𝔑 with respect to some basis of 𝔐. Note also that deg([𝔐 : 𝔑]_{k[x]}) = dim_{k}(𝔐/𝔑).

Let now d_{1}| ⋯ |d_{r} be the (monic) elementary divisors of 𝔑 in 𝔐. Then [𝔐 : 𝔑]_{k[x]} = d_{1} ⋯ d_{r}. On the other hand, the denominator of 𝔐 with respect to 𝔑 is equal to d_{r}. In particular, the denominator divides the k[x]-index.

2.5.3.4 Modules over extension fields

Let us as a generalization now consider the previous definitions and results over finite extension fields λ|k. All the following computations still take place on a generic field RAM, instantiated with the field k.

Let λ|k be a finite field extension, and let a_{1}, …, a_{[λ:k]} be a basis of λ|k. We assume that a multiplication table of of λ with respect to this basis is known. (As a special case, λ|k might be given by an irreducible polynomial, and a_{1}, …, a_{[λ:k]} might be a polynomial basis.) The elements of λ are then represented via their coordinate vectors with respect to this basis.

Note that by Proposition 1.58 all earlier computational results from this subsection can be transferred to the more general setting of this subsubsection. The only difference is that now the required number of field and bit operations (in k) and bit operations is additionally polynomially bounded in [λ : k].

Note that a_{1}, …, a_{[λ:k]} is also a basis of λ[x] over k[x] and of λ(x) over k(x). Given a polynomial g(x) ∈ λ[x], it is computationally trivial to “expand” g with respect to a_{1}, … a_{[λ:k]}, that is, to compute g_{1}, …, g_{[λ:k]} ∈ k[x] with

g = ∑_{j=1}^{[λ:k]} g_{j} a_{j} .  (2.1)

Let now two polynomials g(x), h(x) ∈ λ[x] with h(x) ≠ 0 be given. We now want to compute g_{j} ∈ k(x) with \frac{g}{h} = ∑_{j=1}^{[λ:k]} g_{j} a_{j}. If h(x) ∈ k[x] this is again straightforward. If this is not the case, one easily reduce to this case by the formula

\frac{g}{h} = \frac{g · N(h)/h}{N(h)} ,

where N(h) is the norm of h with respect to λ(x)|k(x). The required number of field and bit operations is then polynomially bounded in deg(g) and deg(h).

Let now V be an r-dimensional λ(x)-vector space with r < ∞, and let 𝔐 be a λ[x]-submodule of V with a λ[x]-basis b_{1}, …, b_{r}. Now the elements

b̂_{i+(j−1)r} := b_{i} a_{j} for i = 1, …, r, j = 1, …, [λ : k] .  (2.2)

form a k[x]-basis of 𝔐.

Note that if v ∈ V has coordinate vector \underline{c} ∈ λ(x)^{r} with respect to b_{1}, …, b_{r} and if we write c_{i} = ∑_{j=1}^{[λ:k]} c_{i,j} a_{j} with c_{i,j} ∈ k(x), then the vector \underline{d} ∈ k(x)^{r·[λ:k]} defined by

d_{i+(j−1)r} := c_{i,j} for i = 1, …, r, j = 1, …, [λ : k]

is the coordinate vector of v with respect to b̂_{1}, …, b̂_{r·[λ:k]}.

Note that at this point we have two natural representations of λ[x]- submodules of V of rank r: First we can represent them by HNF-bases with respect to b_{1}, …, b_{r} and second, we can represent them by HNF-bases with respect to b̂_{1}, …, b̂_{r·[λ:k]}. Note that in the former case the coefficients lie in λ[x], and in the latter case the coefficients lie in k[x]. Note in particular that in the former case the coefficients of the numerator matrix as well as the denominator lie in λ[x], and in the latter case the coefficients of the numerator matrix as well as the denominator lie in k[x].

With the above remarks and the previous statements on the computation of Hermite normal forms, one obtains:

Proposition 2.46 Let 𝔑 be a finitely generated λ[x]-submodule of V with denominator d with respect to 𝔐. Then one can change between the representation of 𝔑 by the HNF-basis with respect to b_{1}, …, b_{r} and the representation of 𝔑 by the HNF-basis with respect to b̂_{1}, …, b̂_{r·[λ:k]} in a number of field operations in k and bit operations which is polynomially bounded in r, [λ : k], deg([𝔐 : d · 𝔑]_{λ[x]}) and deg(d).

2.5.4 The ideal representation

2.5.4.1 The idea and some notation

One can use ideal theory in function fields to represent closed points and divisors. The ideal theoretic approach is crucial because it leads to an easy and efficient algorithm to compute Riemann-Roch spaces (Heß’ algorithm).

In the ideal theoretic approach which we are going to describe now it is irrelevant whether the extension k(C)|k is regular or not. Therefore all the considerations from now on until including subsubsection 2.5.4.4 hold not only if C is a curve over k but also if C is merely a irreducible (rather than geometrically irreducible) smooth, proper 1-dimensional k-scheme.

As stated in Section 2.2, we assume that C_{pm} is not equal to V (Z) ⊂ ℙ_{k}^{2}. Also following the general terminology and notation, we set x := \frac{X}{Z} , y := \frac{Y}{Z} ∈ k(ℙ^{2}) and let x_{|C} resp. y_{|C} ∈ k(C) be the pull-backs of the rational functions x resp. y to C. Let f(x, y) := \frac{F (X,Y,Z)}{Z^{deg(F)}} = F (x, y, 1) ∈ k[x, y].

Note that one of x_{|C} and y_{|C} is a separating element of the function field k(C). (Otherwise f(x, y) would be a p-th power.) Let us assume wlog. that x_{|C} is a separating element.

Let us consider the covering x_{|C} : C ⟶ ℙ_{k}^{1} of curves as well as the corresponding separable field extension k(C)|k(x) given by x ↦ x_{|C}.

Convention 2.47 In the following function field theoretic considerations, we identify k(x) with its image in k(C). We do however not perform this identification if we consider the elements of the function fields as functions on the curves.

Notation 2.48 We set r := [k(C) : k(x)] = deg(x_{|C} : C ⟶ ℙ_{k}^{1}), the extension degree of k(C) over k(x).

Note that we have a canonical isomorphism k(C) = k(x_{|C}, y_{|C}) ≃ k(x)[y]/(f(x, y)), and r is equal to the degree in y of f(x, y).

We now consider the subrings ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) and ((x_{|C})_{∗}O_{C})_{∞} of k(C); these rings are the integral closures of k[x] resp. k[\frac{1}{x}]_{( \frac{1}{x} )} in k(C). They are called finite and infinite order of k(C) (with respect to x_{|C}).

Now the closed points of C correspond to the places of k(C) and these in turn correspond to maximal ideals of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) as well as ((x_{|C})_{∗}O_{C})_{∞}.

The main idea for the ideal representation of points is to compute bases of these orders and to represent the points of C by “nice” k[x]- respectively k[\frac{1}{x}]_{( \frac{1}{x} )}-bases of the corresponding maximal ideals. In order to have a better control over the size of this representation, we consider however prime ideals of ((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1})) with support “at infinity” instead of prime ideals in ((x_{|C})_{∗}O_{C})_{∞}.

Now divisors can be represented in two ways: The first way is to take the representation of points as a basis for a free representation: The divisors are represented by their support and the coefficient vector, and the points are represented by maximal ideals of the two orders.

Another way to represent divisors is to consider the isomorphism

Div(C) ˜ ⟶ Div(((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})) × Div((x_{|C})_{∗}O_{C})_{∞})

˜ ⟶I(((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})) × I(((x_{|C})_{∗}O_{C})_{∞}) ,

(2.3)

where the first isomorphism is induced by pull-back and the second isomorphism is induced by the canonical isomorphisms between the divisor and ideal groups. Via this isomorphism every divisor corresponds to a pair of fractional ideals, a “finite” and an “infinity” ideal. To represent the “infinite” ideal, one furthermore applies the canonical inclusion I(((x_{|C})_{∗}O_{C})_{∞}) ↪ I(((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1}))). We call this representation of divisors the joint ideal representation.

Notation 2.49 Let D be a divisor on C. Then the associated “finite” fractional ideal in I(((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})) is denoted by I^{fin}(D). The associated “infinite” fractional ideal in I(((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1}))) is denoted by I^{∞}(D), and the corresponding ideal in I(((x_{|C})_{∗}O_{C})_{∞}) (the localization of I^{∞}(D) at ∞) by (I^{∞}(D))_{∞}.

Note here that I^{∞}(D) by definition only has support “at infinity”, and (I^{∞}(D))_{∞} is the ideal generated by I^{∞}(D) inside ((x_{|C})_{∗}O_{C})_{∞}.

We now need to describe how we represent the fractional ideals of the orders ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) and ((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1})).

One can easily adapt usual methods to represent and manipulate ideals in number fields to the function field theoretic setting. In fact, the exposition in this subsection relies on the Sections 2.4, 4.7, 4.8, 6.1 and 6.2 of the book [Coh96] by H. Cohen.

2.5.4.2 On the maximal orders

Let us fix the following notation:

Notation 2.50

• Let f(x, y) = ∑_{i=0}^{r} a_{i}(x)y^{i} with a_{i}(x) ∈ k[x], let ỹ:= a_{r}(x) · y, and let f̃(x, ỹ) := a_{r}(x)^{r−1}f(x, \frac{ỹ}{a_{r}(x)}) ∈ k[x][ỹ].

• Let c := max_{i=0}^{r}⌈\frac{deg(a_{i}(x))}{r−i}⌉, let ˜ ỹ := \frac{ỹ}{x^{c}}, and let ˜ f̃(x, ˜ ỹ) := \frac{1}{x^{rc}} f̃(x, x^{c} ˜ỹ) ∈ k[\frac{1}{x}][˜ỹ]

Now ỹ_{|C} ∈ k(C) is integral over k[x], as it is a root of the monic polynomial f̃(x, ỹ) ∈ k[x][ỹ] over k[x]. Moreover, ˜ ỹ is integral over k[\frac{1}{x}] as it is the root of the monic polynomial ˜ f̃(x, ˜ ỹ) ∈ k[\frac{1}{x}][ỹ].

We now first consider the finite order. After this we briefly mention how the following considerations can be adapted to the infinite order.

Notation 2.51 Let δ(x) ∈ k[x] be the discriminant of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})|k[x]. Similarly, let disc(f̃) be the discriminant of f̃ as a polynomial in ỹ. Let i := [((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) : k[x][y]/(f̃)]_{k[x]}.

Notation 2.52 Let w_{1}, …, w_{r} be the HNF-basis of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) with respect to the k(x)-basis 1, ỹ_{|C}, …, ỹ_{|C}^{r−1}.

Proposition 2.53

a) i) disc(f̃) = δ i^{2}.

ii) deg(disc(f̃)) (and in particular deg(i)) is polynomially bounded in

d. iii) w_{1} = 1. iv) The denominator d of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) with respect to k[x][y]/(f̃) di-

vides i.

v) Let W ∈ k[x]^{r×r} be the coordinate matrix of dw_{1}, …, dw_{r} with respect to 1, ỹ_{|C}, …, ỹ_{|C}^{r−1}. Then deg(W) = deg(d).

b) One can compute the HNF-basis of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) with respect to 1, ỹ_{|C}, …, ỹ_{|C}^{r−1} with a deterministic algorithm in a number of field and bit operations which is polynomially bounded in d.

Proof of a).

i) Let more generally v_{1}, …, v_{r} be any basis of k(C)|k(x). Then we have disc(v_{1}, …, v_{r}) = det(Tr(v_{i}v_{j})_{i,j}). Now let A be the coordinate matrix of v_{1}, …, v_{r} with respect to another basis ṽ_{1}, …, ṽ_{r}. Then clearly disc(v_{1}, …, v_{r}) = det(A)^{2} disc(ṽ_{1}, …, ṽ_{r}).

ii) This follows for example from disc(f̃) = (−1)^{\frac{1}{2} n(n−1)} · Res(f̃, \begin{matrix}d & f̃ \\ d & ỹ \end{matrix}).

iii) Clearly ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) ∩ k(x) = k[x]. This implies that w_{1} = 1 with Lemma 2.36.

iv) This is a special case of Remark 2.45.

v) We have deg(W) ≥ d because w_{1} = 1 and therefore the first column of W is d\underline{e}_{1}. Moreover, for all i = 1, …, r, ỹ_{|C}^{i−1} ∈ ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}), thus d\underline{e}_{i} is in the span of the columns of W. As W is a non-singular matrix in upper diagonal form, this implies that the degrees of the diagonal elements of W are ≤ deg(d). As W is in Hermite normal form, this implies that deg(W) ≤ deg(d).

An algorithm for Part b) is presented in Section 2.7.

Convention 2.54 In the following we assume that the data in the proposition and the corresponding data for the infinite order ((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1})) have been computed.

(This means that the following algorithms take as input a curve represented by a plane model as well as data as in Proposition 2.53 as well as the corresponding data for the infinite order and some further input which is described in detail below. All complexity related statements below are relative to this input.)

We now represent fractional ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})-ideals as described in Convention 2.39:

Convention 2.55 We always represent fractional ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})-ideals by their HNF-bases with respect to w_{1}, …, w_{r}, and the HNF-bases are represented by the denominator and the coordinate matrix in k[x]^{r×r} in Hermite normal form.

The following lemmata complement Proposition 2.53.

Lemma 2.56 The k[x]-index i as well as the discriminant δ can be computed in a number of field and bit operations which is polynomially bounded in d.

Proof. We have i = det(dW^{−1}) = d^{r} det(W)^{−1} and det(W) = w_{1,1} ⋯ w_{r,r}. Moreover, δ = \frac{disc(f̃)}{i^{2}}. □

Lemma 2.57 The degree of the coordinate vector of ỹ_{|C} with respect to w_{1}, …, w_{r} is ≤ d. The coordinate vector can be computed in a number of field and bit operations which is polynomially bounded in d.

Proof. By the shape of the matrix W, ỹ_{|C} is a k[x]-linear combination of w_{1} = 1 and w_{2}; let ỹ_{|C} = a + bw_{2} with a, b ∈ k[x]. Let W = ((w_{i,j}))_{i,j}. Then

( \begin{matrix}0 \\ d \end{matrix} ) = a ( \begin{matrix}d \\ 0 \end{matrix} ) + b ( \begin{matrix}w_{1,2} \\ w_{2,2} \end{matrix} ) .

The second row implies that deg(b) ≤ deg(d). As deg(w_{1,2}) < deg(d) this implies together with the first row that deg(a) < deg(d).

The computational result is obvious. □

This lemma and Proposition 2.53 iv) and v) imply:

Lemma 2.58 The degree of the multiplication table of w_{1}, …, w_{r} (which is an element of k[x]^{r×r×r}) is polynomially bounded in d. The table can be computed with a number of field and bit operations which is polynomially bounded in d.

On the infinite order

Let us fix the following definition: Let for some a ∈ k[\frac{1}{x}] deg_{\frac{1}{x}} (a) be the degree of a in \frac{1}{x}. Analogously to the definitions for matrices in k[x], we define for a matrix M over k[\frac{1}{x}] the degree of M in \frac{1}{x}, deg_{\frac{1}{x}} (M), as the maximum of the degrees in \frac{1}{x} of the entries of M.

Proposition 2.53 holds mutatis mutandis also for the infinite order: One first has to substitute x by \frac{1}{x}, ỹ by ˜ ỹ, and instead of considering k[x]-bases one has to consider k[\frac{1}{x}]-bases. One also has to substitute the usual degree by the degree in \frac{1}{x}. Then one has to substitute f̃by ˜ f̃, the HNF basis w_{1}, …, w_{r} by the HNF basis of the infinite order with respect to 1, ˜ ỹ_{|C}, …, ˜ ỹ_{|C}, and one has to adopt the definitions of the index, the denominator and the matrix W accordingly. The degree d of F (X, Y, Z) is however left as it is.

Note here that indeed deg_{\frac{1}{x}} (disc( ˜f̃)) is polynomially bounded in d as

deg_{\frac{1}{x}} ( ˜f̃) is polynomially bounded in d. This implies that the degree of the coordinate matrix in v) as well as the running time in field and bit operations in b) are polynomially bounded in d.

2.5.4.3 Ideal arithmetic

An important aspect of the joint ideal representation of divisors is that one can apply the usual ideal arithmetic. From a computational point of view, one can easily adapt the algorithms described in [Coh96, 4.7, 4.8] from the number field theoretic to the function field theoretic setting. A crucial ingredient is here the computation of Hermite normal forms.

In the following, we concentrate on fractional ideals of the finite order ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) and its fractional ideals. Similar definitions and results hold for fractional ideals of ((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1})).

Note again that in all the following computational statements we assume that the fractional ideals of the finite order are given by HNF-bases with respect to w_{1}, …, w_{r}.

Terminology 2.59 We refer to a non-trivial ideal of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) as a proper ideal.^{5}

Terminology 2.60 By the norm N(I) of a fractional ideal I of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) we mean the norm of I with respect to k(x).

Lemma 2.61 Let I be a proper ideal of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}), and let M = (m_{i,j})_{i,j} ∈ k(x)^{r×r} be a coordinate matrix of I with respect to w_{1}, …, w_{r} (not necessarily in Hermite normal form). Then N(I) = (det(M)). Moreover, if M is in Hermite normal form, I ∩ k[x] = (m_{1,1}).

Proof. Let I = 𝔓 be a prime ideal, let 𝔭 := I ∩ k[x], let 𝔭 = (P) with P monic, and let f be the residue degree. Then the residue field k(𝔓) is an f-dimensional k(𝔭)-vector space. This means that as k[x]-module k(𝔓) is isomorphic to (k[x]/𝔭)^{f}. Thus if S is the Smith normal form of M, the non-trivial entries of S are either 1 or P, and there are exactly f entries equal to P. In particular, the determinant of S is P^{f}. This implies that (det(M)) = (P^{f}) = 𝔭^{f} = N(I).

For general ideals the statement follows because both the norm and the determinant are multiplicative.

The last statement follows from w_{1} = 1. □

Definition 2.62 The degree of a proper ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})-ideal I is deg(I) := dim_{k}(((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})/I).

Let now I be a fractional ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})-ideal. Then we define I_{+} and I_{−} as the unique proper ideals with I = I_{+} I_{−}^{−1}.

The degree of I is deg(I) := deg(I_{+}) − deg(I_{−}) and the height of I is max{deg(I_{+}), deg(I_{−})}.

5Note that this terminology is at odds the usual terminology in commutative algebra where one calls an ideal not equal to the full ring a proper ideal.

Remark 2.63 Note that deg(I) = deg(N(I)). In particular, if I is given by a coordinate matrix M ∈ k(x) with respect to w_{1}, …, w_{r} then deg(I) = deg(det(M)).

The following lemma is obvious:

Lemma 2.64 Let I be a fractional ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})-ideal. Then the denominator of I divides N(I_{−}). In particular, the degree of the denominator d of I is bounded by ht(I). Moreover, the degree of the proper ideal dI is bounded by (r + 1) · ht(I). In particular, let M ∈ k[x]^{r×r} be the coordinate matrix of dI in Hermite normal form. Then deg(M) ≤ (r + 1) · ht(I).

In analogy of the sum of ideals we define:

Definition 2.65 Let I a and J be two fractional ideals of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}). Then the sum of I and J the k[x]-submodule of k(C) generated by I and J. We denote the sum of I and J by I + J = (I, J).

The sum of fractional ideals should not be confused with their product. Note also the following formula for fractional ideals I and J of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}):

I · J = (I ∩ J) · (I + J)  (2.4)

Proposition 2.66 Given two fractional ideals I, J of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}), one can compute the product I · J and the sum I + J = (I, J) in a number of field and bit operations which is polynomially bounded in d, ht(I) and ht(J).

Proof. If I is generated by g_{1}, …, g_{r} and J is generated by h_{1}, …, h_{r}, then I · J is generated by {g_{i}h_{j}|i, j = 1, …, r} and I + J is generated by g_{1}, …, g_{r}, h_{1}, …, h_{r}. The result follows from Lemma 2.64 and Proposition 2.40. □

Recall that the codifferent of k(C) (or ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})) with respect to k[x] is defined as

ℭ := {g ∈ k(C) | Tr(g · ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})) ⊆ k[x] } .

The different 𝔇, which is a proper ideal, is then defined as the inverse of this fractional ideal.

Lemma 2.67 Let I be a fractional ideal of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}), and let h ∈ k(C). Then h ∈ I^{−1}ℭ if and only if Tr(hI) ⊆ k[x].

Proof. Note that I^{−1}ℭ = {h ∈ k(C) | hI ⊆ ℭ}.

Let first h ∈ I^{−1}ℭ. Then hI ⊆ ℭ. Therefore Tr(hI) = Tr(hI · 1) ⊆ k[x].

Now let Tr(hI) ⊆ k[x]. Then Tr(hI · ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})) ⊆ k[x], therefore hI ⊆ ℭ. Thus h ∈ I^{−1}ℭ. □

The following lemma and its proof are analogous to [Coh96, Proposition 4.8.19].

Lemma 2.68 Let I be a fractional ideal of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})), and let M = (m_{i,j})_{i,j} ∈ k(x)^{r×r} be a coordinate matrix of I with respect to w_{1}, …, w_{r}. Let T be the r × r-matrix with entries t_{i,j} = Tr(w_{i}w_{j}). Then T is regular. Let h_{1}, …, h_{r} ∈ k(C) be the elements whose coordinate matrix with respect to w_{1}, …, w_{r} is (M^{t}T)^{−1}. Then h_{1}, …, h_{r} form a k[x]-basis of I^{−1}ℭ.

Proof. Let g_{1}, …, g_{r} be the k[x]-basis of I whose coordinate matrix with respect to w_{1}, …, w_{r} is M.

The matrix T is regular as the extension k(C)|k(x) is separable by assumption. (It is here that we use this condition for the first time.)

Let N := M^{t}T. Then n_{i,j} = ∑_{ℓ=1}^{r} m_{ℓ,i}Tr(w_{ℓ}w_{j}) = Tr(∑_{ℓ=1}^{r} m_{ℓ,i}w_{ℓ} w_{j}) = Tr(g_{i}w_{j}).

Let now \underline{h} ∈ k(x)^{r}, and let h := ∑_{j=1}^{r} h_{j}w_{j}. By the previous lemma, h ∈ I^{−1}ℭ if and only if Tr(hI) ⊆ k[x]. This is equivalent to: ∀i = 1, …, r : Tr(g_{i}h) ⊆ k[x], that is, ∀i = 1, …, r : ∑_{j=1}^{r} h_{j}Tr(g_{i}w_{j}) ⊆ k[x], that is, N\underline{h} ∈ k[x]^{r}. This in turn is equivalent to \underline{h} being in the k[x]-module generated by the columns of N^{−1}. □

This lemma immediately implies the following computational result:

Proposition 2.69

a) One can compute the codifferent ℭ and the different 𝔇 in a number of field and bit operations which is polynomially bounded in d.

b) One can compute the inverse of a fractional ideal I of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) in a number of field and bit operations which is polynomially bounded in d and ht(I).

Proof. By the previous lemma and Proposition 2.34 on the computation of the Hermite normal form, the following holds: Given a fractional ideal I, one can compute I^{−1}ℭ in a number of field and bit operations which is polynomially bounded in d and ht(I). In particular, one can compute ℭ in a number of field and bit operations which is polynomially bounded in d. By the formula 𝔇 = (ℭ^{2})^{−1}ℭ one can also compute 𝔇 in a number of field and bit operations which is polynomially bounded in d. Now point b) follows from the formula I^{−1} = I^{−1}ℭ 𝔇. □

This result and Equation (2.4) imply:

Proposition 2.70 Given two fractional ideals I, J of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}), one can compute the intersection I ∩ J in a number of field and bit operations which is polynomially bounded in d, ht(I) and ht(J).

We also have:

Lemma 2.71 Given a fractional ideal I, one can compute the proper ideals I_{+} and I_{−} with I = I_{+}I_{−}^{−1} in a number of field and bit operations which is polynomially bounded in d and ht(I).

Proof. One can for example use the formulae I_{+} = I∩(1) and I_{−}^{−1} = I+(1).□

For the following proposition, recall again that we represent fractional ideals by HNF-bases with respect to the basis w_{1}, … w_{r} of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}).

Proposition 2.72 Let s ∈ ℕ, and let a_{i,j}, b_{i,j} ∈ k[x] for i = 1, …, r, j = 1, …, s. Let g_{j} := ∑_{i=1}^{r} \frac{a_{i,j}}{b_{i,j}} w_{i} ∈ k(C) for j = 1, …, s. Then the height of the fractional ideal (g_{1}, …, g_{s}) is polynomially bounded in r, s and the maximum of the degrees of the a_{i,j} and b_{i,j}. Moreover, one can compute this ideal in a number of field and bit operations which is polynomially bounded in d, s and the maximum of the degrees of the a_{i,j} and b_{i,j}.

Proof. Note that the elements y^{ℓ}g_{j} for ℓ = 0, …, r − 1 and j = 1, …, s generate the ideal as a k[x]-module.

The computational statement now follows from Proposition 2.40.

Let now \frac{1}{d}M be the coordinate matrix of the HNF-basis of the ideal, where d is the denominator. Then again by Proposition 2.40 the degrees of both d and M are polynomially bounded in the given data. Let J be the proper ideal given by M. Then (g_{1}, …, g_{s}) = \frac{1}{d}J, and the degree of J is equal to the degree of the determinant of M. Therefore, the height of (g_{1}, …, g_{s}) can be bounded as claimed. □

Remark 2.73 A similar statement holds if g is not represented with respect to w_{1}, …, w_{r} but with respect to 1, ỹ_{|C}, …, ỹ_{|C}^{r−1} or 1, y_{|C}, …, y_{|C}^{r−1}.

2.5.4.4 Divisor arithmetic

We now relate the previous ideal-theoretic considerations with divisors, using the joint ideal representation.

Definition 2.74 For a divisor D on C, we define D_{+} and D_{−} as the unique effective divisors with D = D_{+} − D_{−}.

The height of a divisor D on C is ht(D) := max{deg(D_{+}), deg(D_{−})}.^{6} Remark 2.75 The height of a fractional ideal of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) is the height of the corresponding divisor.

6In [Heß01], the height of a divisor D is defined as deg(D_{+}) + deg(D_{−}).

Definition 2.76 Let D_{1} = ∑_{P ∈C} v_{P} (D_{1}) P and D_{2} = ∑_{P ∈C} v_{P} (D_{2}) P be two divisors on C. Then the minimum of D_{1} and D_{2} is min{D_{1}, D_{2}} := ∑_{P ∈C} min{v_{P} (D_{1}), v_{P} (D_{2})} · P, and the maximum is max{D_{1}, D_{2}} := ∑_{P ∈C} max{v_{P} (D_{1}), v_{P} (D_{2})} · P.

Remark 2.77 We have I^{fin}(D_{1}) ∩ I^{fin}(D_{2}) = I^{fin}(max{D_{1}, D_{2}}) and I^{fin}(D_{1}) + I^{fin}(D_{2}) = I^{fin}(min{D_{1}, D_{2}}), and similarly for the “infinite” ideals.

Recall that the joint ideal representation of a divisor consists of a pair of ideals I(((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}))×I(((x_{|C})_{∗}O_{C})_{∞}) obtained by isomorphism (2.3). The “infinite” ideal is represented by the corresponding ideal in I(((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1}))) with support “at infinity”. These ideals are represented by HNF-bases as above.

Propositions 2.66, 2.69 and 2.70 as well as the corresponding result for the “infinite” ideals immediately imply:

Proposition 2.78 Given two divisors D_{1}, D_{2} in joint ideal representation, one can compute D_{1} +D_{2}, min{D_{1}, D_{2}} and max{D_{1}, D_{2}} with a deterministic algorithm in a number of field and bit operations which is polynomially bounded in d, ht(D_{1}) and ht(D_{2}). Similarly, one can compute the inverse of a divisor D in joint ideal representation in a number of field and bit operations which is polynomially bounded in d and ht(D).

Proposition 2.72 implies:

Proposition 2.79 Let g = ∑_{i=1}^{r} \frac{a_{i}}{b_{i}} w_{i} ∈ k(C) with a_{i}, b_{i} ∈ k[x], represented by the vector (a_{1}, …, a_{r}, b_{1}, …, b_{r}). Then the height of the principal divisor (g) is polynomially bounded in d and the degree of the vector (a_{1}, … a_{r}, b_{1}, …, b_{r}). Moreover, this divisor in joint ideal representation can be computed in a number of field and bit operations which is polynomially bounded in the same data.

Proof. By Proposition 2.72 the principal fractional ideals (g) of both ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) and ((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1})) can be computed with the claimed complexity, and their heights are polynomially bounded in d and the degree of the vector in question.

Note that we are not yet finished at this point because we demand that the “infinite” ideal has support “at infinity”. The result now follows from the next lemma. □

Lemma 2.80 Given a fractional ideal I of ((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1})) one can compute the ideal (I) in ((x_{|C})_{∗}O_{C})_{∞}, represented by the corresponding ideal in ((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1})), in a number of field and bit operations which is polynomially bounded in d and ht(I).

Proof. Let first I be a proper ideal. Note first that the principal fractional ideal (x^{−1}) of ((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1})) is a proper ideal whose support consists exactly of all prime ideals “at infinity”. Now for any i > 0, the fractional ideal (x^{−i})+I has support “at infinity”. Moreover, x^{− deg(I)} ∈ (I) ⊆ ((x_{|C})_{∗}O_{C})_{∞}. Thus (x^{− deg(I)}) + I ⊆ ((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1})) is the desired ideal.

We come to the computation. We first compute I_{−} and I_{+}. Note that the degrees of these ideals can immediately be read off from the coordinate matrices of the HNF-bases. Now we compute the ideals J_{+} := (x^{− deg(I_{+})}) + I_{+} and J_{−} := (x^{− deg(I_{−})}) + I_{−} and finally J_{+}J_{−}^{−1}, which is the desired ideal. All these computations can be performed with the claimed complexity by Lemma 2.71, Proposition 2.72 and Proposition 2.69. □

Recall that the different ideal sheaf of the covering x_{|C} : C ⟶ ℙ_{k}^{1} is defined as Ann(Ω_{C/ℙ_{k}^{1}}), the annihilator of the O_{C}-module Ω_{C/ℙ_{k}^{1}}. The ramification divisor (or different divisor) R is then the (effective) divisor defined by this ideal sheaf. Note that by definition,

O_{R} ≃ Ω_{C/ℙ_{k}^{1}} .  (2.5)

Along the lines of the proof of [Neu91, Satz 2.7], one can prove that the module of sections of the different ideal sheaf over ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) is isomorphic to the different ideal 𝔇 defined above. This statement together with the corresponding statement for ((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1})) imply:

Proposition 2.81 One can compute the ramification divisor R of x_{|C} : C ⟶ ℙ_{k}^{1} in joint ideal representation in a number of field and bit operations which is polynomially bounded in d.

We now have the important formula of divisors on C

div(dx_{|C}) = −2(x_{|C})_{−} + R .  (2.6)

To prove this formula, note first that we have the exact sequence

0 ⟶ x_{|C}^{∗}(Ω_{ℙ_{k}^{1}}) ⟶ Ω_{C} ⟶ Ω_{C/ℙ_{k}^{1}} ⟶ 0  (2.7)

(see [Har77, IV, Proposition 2.1]). Together with (2.5) this means that as subsheaf of Ω_{C}, x_{|C}^{∗}(Ω_{ℙ_{k}^{1}}) is isomorphic to Ω_{C}(−R). This implies that for any s ∈ Γ(C, x_{|C}^{∗}(Ω_{ℙ_{k}^{1}})) with s ≠ 0,

div_{Ω_{C}}(s) = div_{x_{|C}^{∗}(Ω_{ℙ^{1}_{k}})}(s) + R .  (2.8)

Moreover, we have on ℙ_{k}^{1}

div(dx) = −2(x)_{−} .  (2.9)

Note now that x_{|C}^{∗}(dx) = d(x_{|C}^{∗}(x)) = dx_{|C}. Altogether we obtain

−2(x_{|C})_{−} = −2x_{|C}^{∗}(x)_{−} = x_{|C}^{∗}(div(dx)) =
div_{x_{|C}^{∗}(Ω_{ℙ^{1}_{k}})}(x_{|C}^{∗}(dx)) = div_{Ω_{C}}(x_{|C}^{∗}(dx)) − R =
div(dx_{|C}) − R .
□

By Proposition 2.81, (2.6) and Lemma 2.80 we obtain:

Proposition 2.82 One can compute the canonical divisor div(dx_{|C}) in joint ideal representation in a number of field and bit operations which is polynomially bounded in d.

2.5.4.5 Curves over extension fields

As a generalization we now consider curves over finite extension fields of k. This subsubsection is in a certain sense a continuation of subsubsection 2.5.3.4. In particular, as in subsubsection 2.5.3.4, all computations take place over k.

Let λ|k be a finite field extension. Let C be a curve over λ or more generally a smooth and proper 1-dimensional irreducible λ-scheme. Analogously to the previous considerations, we assume that C is represented by a plane model C_{pm} of degree d in ℙ_{λ}^{2}, not equal to V (Z). As above, let F (X, Y, Z) ∈ λ[X, Y, Z] be a homogeneous polynomial defining C_{pm}. We define x, y and f(x, y) ∈ λ[x, y] as in subsubsection 2.5.4.1, and we also use the notations of subsubsection 2.5.4.2 (with λ instead of k).

Furthermore, let a_{1}, …, a_{[λ:k]} be a basis of λ|k, again with known multiplication table.

Similarly to above, we first consider the extension λ(C)|λ(x). Let w_{1}, …, w_{r} be the HNF-basis of ((x_{|C})_{∗}O_{C})(𝔸_{λ}^{1})) with respect to 1, ỹ_{|C}, …, ỹ_{|C}^{r−1}.

Note that by Propositions 1.58 and 2.53, w_{1}, …, w_{r} can be computed with a deterministic algorithm in a number of field operations (in k) and bit operations which is polynomially bounded in d and [λ : k]. More generally, by Proposition 1.58 all results from on ideal arithmetic from subsubsection 2.5.4.2 and subsubsection 2.5.4.3 can be transferred to the more general setting of this subsubsection. The only difference is that now the required number of field operations (in k) and bit operations is additionally polynomially bounded in [λ : k].

If one proceeds similarly with the “infinite” order, the corresponding results can be transferred too, and consequently the results from subsubsection 2.5.4.4 can then be transferred in the same way.

Now we consider the extension λ(C)|k(x) (of degree [λ : k] · r), and we regard ((x_{|C})_{∗}O_{C})(𝔸_{λ}^{1})) as a k[x]-module.

Following (2.2), let

ŵ_{i+(j−1)r} := w_{i} a_{j} for i = 1, …, r, j = 1, …, [λ : k] .  (2.10)

We can now represent fractional ideals of ((x_{|C})_{∗}O_{C})(𝔸_{λ}^{1})) via HNF-bases with respect to ŵ_{1}, …, ŵ_{r·[λ:k]}.

By Lemma 2.64, the following proposition is a special case of Proposition 2.46.

Proposition 2.83 Let I be a fractional ideal of ((x_{|C})_{∗}O_{C})(𝔸_{λ}^{1})). Then one can change between the representation of I by the HNF-basis with respect to w_{1}, …, w_{r} and the representation of I by the HNF-basis with respect to ŵ_{1}, …, ŵ_{r·[λ:k]} in a number of field operations in k and bit operations which is polynomially bounded in d and ht(I).

By this result the computational statements in subsubsections 2.5.4.2 and subsubsection 2.5.4.3 excluding Remark 2.73 can also be transferred to the representation with respect to ŵ_{1}, …, ŵ_{r·[λ:k]}. Again, the only difference is that the number of field operations in k and bit operations required is now additionally polynomially bounded in [λ : k]. (This can also be checked directly by going through the proofs of these results.)

An analogous statement to Remark 2.73 also holds: One merely has to consider the bases consisting of ỹ_{|C}^{i−1} a_{j} or of y_{|C}^{i−1} a_{j} for i = 1, …, r and j = 1, …, [λ : k]. (This can for example again be seen with Proposition 2.46.)

We now turn to an important application: The computation of intersections of fractional ideals “along a constant field extension”.

For this, let C be a curve over k, represented as described above. As above, we assume that we are given the HNF-basis w_{1}, …, w_{r} of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})) with respect to 1, ỹ_{|C}, …, ỹ_{|C}^{r−1}.

Let λ|k again be a finite field extension, represented by a multiplication table with respect to a k-basis a_{1}, …, a_{[λ:k]} of λ with a_{1} = 1.

Note that under the isomorphism λ(C) ≃ k(C) ⊗_{k} λ,

((x_{|C_{λ}})_{∗}O_{C_{λ}})(𝔸_{λ}^{1})) ≃ ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})) ⊗_{k} λ .  (2.11)

(The left-hand side is the normalization of the right-hand side, but as k is perfect, ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})) is smooth, and this property is invariant under field extensions.)

Now we have:

Lemma 2.84 Let I be a fractional ideal of ((x_{|C_{λ}})_{∗}O_{C_{λ}})(𝔸_{λ}^{1})) in λ(C), and let g_{1}, …, g_{[λ:k]·r} be the HNF-basis of I with respect to ŵ_{1}, …, ŵ_{[λ:k]·r}. Then g_{1}, …, g_{r} is the HNF-basis of I ∩ k(C) with respect to w_{1}, …, w_{r}.

Indeed, this is a special case of Lemma 2.36.

Remark 2.85 If the ideal I in Lemma 2.84 is instead given by a generating set g_{1}, …, g_{s}, where each element is represented in the form g_{j} = ∑_{i=1}^{r·[λ:k]} \frac{a_{i,j}}{b_{i,j}} ŵ_{i} with a_{i,j}, b_{i,j} ∈ k[x], one can compute the intersection I ∩ k(x) in a number of field and bit operations which is polynomially bounded in d, [λ : k], s and the maximum of the heights of the a_{i,j} and b_{i,j}. (Briefly, one first computes an HNF-basis with respect to w_{1}, …, w_{r·[λ:k]} and then applies Lemma 2.84.)

2.5.4.6 Changing representations

We address the question to efficiently change between the (free) coordinate, the free ideal and the joint ideal representations. We show that one can change from the free representations to the joint ideal representation (deterministically) in a number of field and bit operations which is polynomially bounded in d and ht(D), where D is the divisor under consideration.

On the basis of our computational model, every algorithm which computes a free ideal representation from the joint ideal representation of divisors has to be randomized. Indeed, factorization of polynomials is a special case of factorization of ideals, and for this task the algorithm has to use the command FIELDFACTOR, which means that it has to be randomized.

We remark here that it is an interesting open problem to derive a deterministic polynomial time algorithm to factor polynomials over finite fields (on a RAM / Turing machine).

Proposition 2.86 Given a fractional ideal I of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}), one can compute the factorization of I with a randomized algorithm in an expected number of field and bit operations which is polynomially bounded in d and ht(I).

Proof. Let us first assume that I is a proper ideal.

Let us first fix some notation and make some non-computational observations: Let ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})/I ≃ A_{1} ⊕ ⋯ ⊕ A_{ℓ} with local algebras A_{i}, and let 𝔪_{i} be the corresponding maximal ideals. Let 𝔭_{i} be the preimage of 𝔪_{i} in ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}), f_{i} := dim_{k}(A_{i}/𝔪_{i}) and e_{i} := \frac{dim_{k}(A_{i})}{f_{i}} (for i = 1, …, ℓ). Then the factorization of I is I = 𝔭_{1}^{e_{1}} ⋯ 𝔭_{ℓ}^{e_{ℓ}}. Explicitly, if for i = 1, …, ℓ b_{1}, …, b_{s} ∈ ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) are such that modulo I they form a basis of 𝔪_{i}. Then 𝔭_{i} := (b_{1}, …, b_{s}) + I.

Let now – as always – I be given by the coordinate matrix M (with respect to w_{1}, …, w_{r}) in Hermite normal form. We proceed as follows:

We consider the canonical basis of ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})/I with respect to w_{1}, … w_{r} (see Definition 2.43). We compute the multiplication table of this basis. For this we first compute the multiplication table of w_{1}, …, w_{r} (see Lemma 2.58). Then we compute the desired multiplication table with a reduction algorithm with respect to the columns of M. This is possible in a number of field and bit operations which is polynomially bounded in d an d ht(I).

Then we determine the factorization of the algebra ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})/I and determine the maximal ideals 𝔪_{i} with respect to this basis (that is, for each maximal ideal, we obtain coordinate vectors of basis elements). We apply the canonical lift to the basis elements to obtain elements in ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) (see again Definition 2.43). Note that the lifting is computationally trivial. These computations can be performed with the claimed expected number of field and bit operations by Propositions 1.49 and 1.50

For every i = 1, …, ℓ, we have then obtained elements b_{1}, … b_{s} and the index e_{i} as above. Finally, we compute the HNF-bases of the ideals 𝔭_{i} = (b_{1}, …, b_{s}) + I. What concerns the complexity of these computations note first that s = dim_{k}(𝔪_{i}) ≤ dim_{k}(A_{i}) ≤ deg(I) and ℓ ≤ deg(I). Now these computations can also be performed with the claimed complexity by Proposition 2.72.

Now let I be an arbitrary fractional ideal. We then compute I_{+} and I_{−} (see Lemma 2.71). After this we determine their factorizations. □

This result as well as the corresponding result for fractional ideals of ((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1})) imply the second statement of the following proposition. The first statement follows immediately from Proposition 2.66.

Proposition 2.87 Let D be a divisor on C. Then one can change from the free to the joint ideal representation with a deterministic algorithm in a number of field and bit operations which is polynomially bounded in d and ht(D). Conversely, one can change from the joint to the free ideal representation of D with a randomized algorithm in an expected number of field and bit operations which is polynomially bounded in d and ht(D).

Note for the following proposition that we have fixed a birational map π : C ⟶ C_{pm}.

Proposition 2.88 Given a point P ∈ C_{pm}(k) ⊆ ℙ^{2}(k), one can compute the divisor π^{−1}(P) = π^{∗}(P) on C in joint ideal representation in a number of field and bit operations which is polynomially bounded in d.

Sketch of a proof. Let P = (X(P) : Y (P) : Z(P)) ∈ ℙ^{2}(k). We proceed with several case distinctions.

Let first \underline{Z(P) ≠ 0}. Then π^{−1}(P) = min\{(x_{|C} − \frac{X(P)}{Z(P)})_{+}, (y_{|C} − \frac{Y (P)}{Z(P)})_{+}\}. Let now \underline{Z(P) = 0}. If \underline{X(P) ≠ 0} then π^{−1}(P) = min\{(\frac{1}{x_{|C}})_{+}, (\frac{y_{|C}}{x_{|C}} −

\frac{Y (P)}{X(P)})_{+}\}. If \underline{Y (P) ≠ 0} then π^{−1}(P) = min\{(\frac{1}{y_{|C}})_{+}, (\frac{x_{|C}}{y_{|C}} − \frac{X(P)}{Y (P)})_{+}\}.

The computations can be performed in a number of field and bit operations which is polynomially bounded in d by Proposition 2.78. □

Proposition 2.89 Given a field extension λ|k (represented by a multiplication table) and a point P ∈ C_{pm}(λ), one can compute the set of closed points of C lying over the closed point defined by P with a randomized algorithm in an expected number of field and bit operations which is polynomially bounded in d and deg([λ : k]). Here the closed points of C are represented in joint ideal representation.

Proof. First one computes the divisor π^{−1}(P) on C_{λ} in joint ideal representation. This is possible as claimed by the previous proposition and Proposition 1.58. Then one computes the intersection of the corresponding ideals with the coordinate rings over k (see subsubsection 2.5.4.5, and in particular Lemma 2.84). Finally, one factors the ideals (see Proposition 2.86). □

If the point P lies in C_{ns}, then π^{−1}(P) is a prime divisor, and we can avoid factorization. We therefore obtain:

Proposition 2.90 Let a closed point P ∈ C, not lying over a singular point of C_{pm}, be given in coordinate representation as described in subsection 2.5.2. Then one can compute the ideal representation (that is, the corresponding prime ideal of either the finite or infinite order) with a deterministic algorithm in a number of field and bit operations which is polynomially bounded in d and deg(P).

Proposition 2.91 Given a closed point P ∈ C in ideal representation, one can compute with a randomized algorithm a field extension λ|k (of degree polynomially bounded in deg(P), given by a defining separable polynomial) such that π(P) is given by a point in ℙ^{2}(λ), and coordinates of such a point (that is, coordinates of π(P)) in an expected number of field and bit operations which is polynomially bounded in d and deg(P).

Proof. Let first P be represented by an ideal of the infinite order. Then π(P) lies in V (Z). Therefore, we can proceed as follows: We factorize the polynomial F (X, Y, 0) to obtain the points in the intersection C_{pm} ∩ V (Z) = V (F (X, Y, Z), Z). Let F (X, Y, 0) = ∏_{i=1}^{a} F_{i}(X, Y)^{e_{i}} be the factorization. Then each factor F_{i} corresponds to a closed point Q_{i} in C_{pm} ∩ V (Z). Coordinates of these points can be obtained as follows: If F_{i} = c · Y for c ∈ k^{∗}, then the point is given by (0 : 1 : 0). Otherwise, let f_{i}(x) := F (x, 1). Then with λ := k[x]/(f_{i}) and α the residue class of x in λ, the closed point associated to (α : 1 : 0) is Q_{i}. For each point Q_{i} (represented by coordinates as described), we compute the set of closed points of C lying over Q_{i}, and we check if P is contained in this set. If this is the case, we have determined π(P).

By Proposition 2.89 this computation can be performed in an expected number of field and bit operations which is polynomially bounded in d and deg(P).

Let now P be represented by an ideal 𝔭 of the finite order. Let m be the monic generator of the intersection 𝔭 ∩ k[x]. Note that m is irreducible; let K := k[x]/(m(x)), and let α be the residue class of x in this field. Then there exists a point in (C_{pm})_{K} ∩V (X −αZ) ⊆ ℙ_{K}^{2} which lies over π(P) under the map (C_{pm})_{K} ⟶ C_{pm}.

The computation is as follows: Recall that 𝔭 is given by its HNF-basis with respect to w_{1}, …, w_{r}, which in turn is given by the coordinate matrix M, and m = m_{1,1} (see Lemma 2.61). We compute the points in (C_{pm})_{K} ∩ V (X −αZ) ⊆ ℙ_{K}^{2}, that is, we factorize F (αZ, Y, Z); let again F (αZ, Y, Z) = ∏_{i=1}^{a} F_{i}(Y, Z) be the factorization. Then for each i = 1, …, a we compute primitive elements over k and their minimal polynomials for the resulting field extensions (see Proposition 2.1). Finally, as before for each point Q_{i} corresponding to the factor F_{i} we compute the set of closed points of C lying over Q_{i}, and again we determine in which set P is contained. □

2.5.4.7 Computing Riemann-Roch spaces

The joint ideal representation of divisors is particularly important because it allows for a simple and efficient computation of Riemann-Roch spaces via Heß’ algorithm ([Heß01]). We present the algorithm here.

Let us first fix the computational problem we consider: Given a divisor D on C in joint ideal representation, we want to compute a basis of the space L(D). More precisely, we want to compute the coordinate matrix of such a basis with respect to 1, y_{|C}, …, y_{|C}^{r−1}. As usual, we represent the coordinate matrix by its denominator and the numerator matrix.

The algorithm relies on the following easy fact: Let D be a divisor on C. Then

L(D) = I^{fin}(−D) ∩ (I^{∞}(−D))_{∞} .

Note that for n ∈ ℤ, (I^{∞}(−(D + n(x)_{−})))_{∞} = (I^{∞}(−D + nx))_{∞} = x^{n} · I^{∞}(−D). As a special case of Proposition 2.22 we then obtain:

Proposition 2.92 There exist uniquely determined integers d_{1} ≥ ⋯ ≥ d_{r} and a basis v_{1}, …, v_{r} of I^{fin}(−D) such that x^{d_{1}}v_{1}, …, x^{d_{r}}v_{r} is a k[\frac{1}{x}]_{( \frac{1}{x} )}-basis of (I^{∞}(−D))_{∞}. With these data the following holds:

• For all n ∈ ℤ, the set

⋃_{i=1}^{r} {x^{j}v_{i} | 0 ≤ j ≤ d_{i} + n}

is a k-basis of L(D + n · (x)_{−}).

• Let ι(n) := max{j ∈ {1, …, r} | d_{j} + n ≥ −1}. Then dim_{k}(D + n · (x)_{−}) − dim_{k}(D − (n − 1) · (x)_{−}) = ι(n − 1).

Remark 2.93 The uniquely determined integers d_{1} ≥ ⋯ ≥ d_{r} are called the k[x]-invariants of D in [Heß01].

Recall that by the proof of Proposition 2.22 we have the following explicit result:

Lemma 2.94 Let ṽ_{1}, …, ṽ_{r} be a k[x]-basis of I^{fin}(−D), and let b_{1}, …, b_{r} be a k[\frac{1}{x}]_{( \frac{1}{x} )} be a basis of I^{∞}(−D)_{∞}. Now let A ∈ k(x)^{r×r} be the coordinate matrix of ṽ_{1}, …, ṽ_{r} with respect to b_{1}, …, b_{r}. Let A U = M with U ∈ k[x]^{r×r} unimodular and M degree-reduced. Let M = T D with D = diag(x^{−d_{1}}, …, x^{−d_{r}}) and T ∈ k[\frac{1}{x}]_{( \frac{1}{x} )} unimodular.

Let now v_{1}, …, v_{r} ∈ k(x) be such that their coordinate matrix with respect to ṽ_{1}, …, ṽ_{r} is U. Then

a) v_{1}, …, v_{r} from a k[x]-basis of I^{fin}(−D).

b) The coordinate matrix of v_{1}, …, v_{r} with respect to b_{1}, …, b_{r} is M.

c) The coordinate matrix of x^{d_{1}}v_{1}, …, x^{d_{r}}v_{r} with respect to b_{1}, …, b_{r} is T. In particular, x^{d_{1}}v_{1}, …, x^{d_{r}}v_{r} form a k[\frac{1}{x}]_{( \frac{1}{x} )}-basis of I^{∞}(−D)_{∞}.

This immediately leads to an algorithm to compute a basis v_{1}, …, v_{r} as in Proposition 2.92 and the k[x]-invariants of D:

Algorithm for computation of Riemann-Roch spaces

Input: A curve given by a plane model and the data described in subsubsection 2.5.4.2, a divisor D on C in joint ideal representation.

1. Determine the HNF-bases ṽ_{1}, …, ṽ_{r} of I^{fin}(−D) and b_{1}, …, b_{r} of I^{∞}(−D)_{∞}.

2. Compute the coordinate matrix of ṽ_{1}, …, ṽ_{r} with respect to b_{1}, …, b_{r} in the form \frac{1}{g}N, where g ∈ k[x] is the denominator

and N ∈ k[x]^{r×s} the numerator matrix.

3. Compute a degree-reduced matrix M which is right-equivalent to N, where the degrees of the columns of M monotonically increase from left to right.

4. Compute v_{1}, …, v_{r} via point b) in the lemma.

5. Let d′_{i} be the degree of the i^{th} column of M.

Let d_{i} ⟵ −d′_{i} − deg(g) for i = 1, …, r.

6. Output v_{1}, …, v_{r} and d_{1}, …, d_{r}.

We now show that all steps can be performed in a number of field and bit operations which is polynomially bounded in d and ht(D).

Step 1 can be performed in polynomial time in ht(D) and d by Proposition 2.69.

To analyze, Step 2, let us first fix some notation:

• Let A_{1} be the coordinate matrix of ṽ_{1}, …, ṽ_{r} with respect to w_{1}, …, w_{r},

• let A_{2} be the coordinate matrix of w_{1}, …, w_{r} with respect to 1, y_{|C}, …, y_{|C}^{r−1},

• let A_{3} := diag(1, x^{c}, ⋯, x^{c(r−1)}),

• let A_{4} be the coordinate matrix of the HNF-basis of ((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1}))

with respect to 1, \frac{y_{|C}}{x^{c}} , …, \frac{y_{|C}^{r−1}}{x^{c(r−1)}} ,

• and let A_{5} be the coordinate matrix of b_{1}, …, b_{r} with respect to the HNF-basis of ((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1})).

Note that A_{5}^{−1}A_{4}^{−1}A_{3}A_{2}A_{1} is the coordinate matrix of v_{1}, …, v_{r} with respect to b_{1}, …, b_{r}.

Note that the matrices A_{1}, A_{2}, A_{4}, A_{5} are given with the input of the algorithm, however they are represented differently: A_{1} and A_{2} are represented in the form \frac{1}{d_{i}} N_{i} with d_{i} ∈ k[x] and N_{i} ∈ k[x]^{r×r}, where d_{i} is the denominator. A_{4} and A_{5} are represented in the form \frac{1}{d̃_{i}} Ñ_{i} with d̃_{i} ∈ k[\frac{1}{x}] and Ñ_{i} ∈ k[\frac{1}{x}]^{r×r}, where again d̃_{i} is the denominator, but with respect to k[\frac{1}{x}].

Note now that deg(N_{1}) and deg(d_{1}) are polynomially bounded in d and ht(D) by Lemma 2.64, and deg(N_{2}) and deg(d_{2}) are polynomially bounded in d by Proposition 2.53 v). Similarly, deg_{\frac{1}{x}} (Ñ_{3}) and deg_{\frac{1}{x}} (d̃_{3}) are polynomially bounded in d by Proposition 2.53 v), and deg_{\frac{1}{x}} (Ñ_{4}) and deg_{\frac{1}{x}} (d̃_{4}) are polynomially bounded in d and ht(D) by Lemma 2.64.

Let now for i = 4, 5 N_{i} := x^{deg_{\frac{1}{x}} (Ñ_{i})}Ñ_{i} ∈ k[x]^{r×r} and d_{i} := x^{deg_{\frac{1}{x}} (d_{i})}d̃_{i}.

Then A_{i} = ^{\frac{x^{deg \frac{1}{x} (d_{i})−deg \frac{1}{x} (Ñ_{i})}}{d_{i}}} N_{i}.

The degrees of all polynomials d_{i} and all matrices N_{i} are now polynomially bounded in d and ht(D). Moreover, one can therefore easily compute d_{i} and N_{i} for i = 4, 5 in a number of field and bit operations which is polynomially bounded in d and ht(D).

Now for i = 4, 5 the adjoint matrix N_{i}^{#} can be computed in a number of field and bit operations which is polynomially bounded in r and deg(N_{i}) by Proposition 2.31, and the degree of the resulting matrix is also polynomially bounded in r and deg(N_{i}). We conclude that these computations are possible in a number of field and bit operations which is polynomially bounded in d and ht(D), and the degrees of the resulting matrices also are polynomially bounded in these quantities.

Therefore, the matrix N_{5}^{#}N_{4}^{#}A_{3}N_{2}N_{1} can also be computed in a number of field and bit operations which is polynomially bounded in d and ht(D). Finally, the matrix

A_{5}^{−1}A_{4}^{−1}A_{3}A_{2}A_{1} = \frac{x^{deg_{\frac{1}{x}} (Ñ_{4})+deg_{\frac{1}{x}} (Ñ_{5})−deg_{\frac{1}{x}} (d̃_{4})−deg_{\frac{1}{x}} (d̃_{5})}d_{4}d_{5}}{d_{1}d_{2} det(N_{5}) det(N_{4})} N_{5}^{#}N_{4}^{#}A_{3}N_{2}N_{1}

(that is, its denominator and numerator matrix) can also be computed in a number of field and bit operations which is polynomially bounded in d and ht(D) (see Remark 2.38).

In Step 4 explicitly we have to compute the coordinate matrix of ṽ_{1}, …, ṽ_{r} with respect to 1, y_{|C}, …, y_{|C}^{r−1}. This matrix is diag(1, a_{r}(x), …, a_{r}(x)^{r−1}) · A_{3}^{−1}A_{4}A_{5} · \frac{1}{g}M. Similarly to Step 3, this task can again be performed in a number of field and bit operations which is polynomially bounded in d and ht(D).

Step 5 can obviously also be carried out as desired.

We obtain:

Proposition 2.95 Given a divisor D on C in joint ideal representation, one can compute the k[x]-invariants d_{1}, …, d_{r} of D and a basis v_{1}, …, v_{r} of I^{fin}(D) as in Proposition 2.92 (given by its coordinate matrix with respect to 1, y_{|C}, …, y_{|C}^{r−1}) in a number of field and bit operations which is polynomially bounded in d and ht(D). The degrees of the denominator and the numerator matrix of the coordinate matrix are then also polynomially bounded in d and ht(D).

In particular, one can compute the space L(D) in a number of field and bit operations which is polynomially bounded in d and ht(D), and the degrees of the denominator and the numerator matrix are then again polynomially bounded in d and ht(D).

By Equation (2.6) the height of div(dx_{|C}) is polynomially bounded in d. With Proposition 2.82 and the previous proposition we obtain:

Proposition 2.96 One can compute the genus of C in a number of field and bit operations which is polynomially bounded in d.

We have the following application of the computation of Riemann-Roch spaces:

Proposition 2.97 Given a divisor D on C in joint ideal representation, one can with a deterministic algorithm determine in a number of field and bit operations which is polynomially bounded in d and ht(D) if there exists an effective divisor which is linearly equivalent to D and if this is the case compute such a divisor.

Proof. Such a divisor exists if and only if L(D) is non-empty. Moreover, if this is the case and g ∈ L(D), then D + (g) is an effective divisor which is linearly equivalent to D.

We therefore compute L(D). If L(D) is non-empty, we choose some element g ∈ L(D) (this can be done in a deterministic way). Then we compute the ideal D + (g).

These operations can be performed with the claimed complexity by Proposition 2.95 and Proposition 2.72 together with Remark 2.73. □

Remark 2.98 Let us consider curves over finite fields: Let C be a curve over 𝔽_{q}, and let again D be a divisor on C. Then the following holds:

a) One can with a deterministic algorithm determine in a time (in bit operations) which is polynomially bounded in log(q), d and ht(D) if there exists an effective divisor which is linearly equivalent to D.

b) If this is the case one can with a randomized algorithm compute a random divisor which is uniformly distributed in the linear system |D| in an expected time which is polynomially bounded in log(q), d and ht(D).

Indeed, the first statement immediately follows from the proposition. For the second statement, one merely has to choose the function g ∈ L(D) uniformly at random. Note that this is easily possible by choosing its coordinate vector with respect to the computed basis of L(D) uniformly at random.

2.5.4.8 Heß’ algorithm and non-archimedean lattices

All computations in Heß’ algorithm take place on matrices with entries in k[x]. There is however a connection between the ideal theoretic approach to Riemann-Roch spaces and “non-archimedean lattices” which is interesting for two reasons: First one can see certain analogies to Minkowski’s lattice theory for ideals in number fields. And second, several important works on the ideal theoretic approach, in particular the book by Hensel and Landsberg ([HL02]), can be interpreted via this “lattice theory”. We now briefly describe these connections.

Minkowski theory Let first K be a number field of degree r, and let σ_{1}, …, σ_{r} : K ⟶ ℂ be the r embeddings of K in to ℂ. (We do not distinguish between real and complex embeddings.) There is an obvious operation of Gal(ℂ|ℝ) on {σ_{1}, …, σ_{r}}, and this operation induces an operation of Gal(ℂ|ℝ) on ℂ^{r}. Now the “Minkowski space” for K is the fixed set of ℂ^{r} under this operation. If I is a fractional ideal of K, the associated lattice is the image of I in the Minkowski space.

There is another more intrinsic approach to the Minkowski space which we describe now. Note that we have an isomorphism

\xymatrix{K⊗_{ℚ}ℂ \ar[r]^{∼} & ℂ^{r}}  (2.12)

induced by the embeddings σ_{1}, …, σ_{r}. Now on the left-hand side we have the canonical operation of Gal(ℂ|ℝ), and on the right-hand side we have the operation just defined. Now the isomorphism in (2.12) is Gal(ℂ|ℝ)- invariant. It follows that we have an induced ℝ-vector space isomorphism between K ⊗_{ℚ} ℝ and the Minkowski space. Under this isomorphism, the lattice associated to a fractional ideal I of K is the image of I under the canonical embedding of K into K ⊗_{ℚ} ℝ.

An analog for function fields In analogy to these considerations for number fields, it is natural to consider the following construction for the separable extension k(C)|k(x) of function fields:

We follow the notations from above, and we let I be a proper ideal in ((x_{|C_{λ}})_{∗}O_{C})(𝔸_{k}^{1}). We now consider the r-dimensional k((x^{−1}))-vector space k(C) ⊗_{k(x)} k((x^{−1})), and we identify I with its image under the canonical inclusion. Now as already remarked in Remark 2.23, one can consider I as a “non-archimedean lattice”.

Let now σ_{1}, …, σ_{r} : k(C) ⟶ k((x^{−1}))^{sep} be the embeddings of k(C)|k(x) into k((x^{−1}))^{sep}. Again these embeddings induce an isomorphism

\xymatrix{k(C) ⊗_{k(x)} k((x^{−1}))^{sep} \ar[r]^{∼} & (k((x^{−1}))^{sep})^{r} .}  (2.13)

Now again we have an obvious operation by Γ_{k((x^{−1}))} := Gal(k((x^{−1}))^{sep}|k((x^{−1}))) on the left-hand side and on {σ_{1}, …, σ_{r}}, and thus on the right-hand side. Isomorphism (2.13) is now Γ_{k((x^{−1}))}-invariant, and in particular the image of k(C) ⊗_{k(x)} k((x^{−1})) under isomorphism (2.13) is equal to the fixed set of (k((x^{−1}))^{sep})^{r} under the operation of Γ_{k((x^{−1}))}.

Let 𝔭_{∞} be the place of k(x)|k “at infinity”, and let 𝔭_{1}, …, 𝔭_{h} be the places of k(C)|k over 𝔭_{∞}. Then we have a k((x^{−1}))-isomorphism

\xymatrix{k(C) ⊗_{k(x)} k((x^{−1})) \ar[r]^{∼} & ∏_{i=1}^{h} k(C)_{𝔭_{i}} .}  (2.14)

Let r_{i} := [k(C)_{𝔭_{i}} : k((x^{−1}))]. Then we have r_{i} embeddings σ_{i,j} : k(C)_{𝔭_{i}} ⟶ k((x^{−1}))^{sep} over k((x^{−1})), and these embeddings induce isomorphisms

\xymatrix{k(C)_{𝔭_{i}} ⊗_{k((x^{−1}))} k((x^{−1}))^{sep} \ar[r]^{∼} & (k((x^{−1}))^{sep})^{r_{i}} .}  (2.15)

Let ι_{i} : k(C) ⟶ k(C)_{𝔭_{i}} be the canonical embedding. Then the r embeddings of k(C) into k((x^{−1}))^{sep} are σ_{i,j} ∘ ι_{i} for i = 1, …, h, j = 1, …, r_{i}.

We are now coming back to the determination of the space L(D) for a divisor D on C. Let I := I^{fin}(−D). As already stated, we now regard I as a “lattice” in k(C) ⊗_{k(x)} k((x^{−1})). We want to express L(D) via the “lattice” I and some condition “at infinity”. Let for this | · |_{i} be the non-archimedean absolute value on k(C)_{𝔭_{i}} given by |a|_{i} = e^{−v_{𝔭_{i}}(a)}. Let I^{∞}(−D)_{∞} = ∏_{i} 𝔭_{i}^{c_{i}}, and let 𝔐_{∞} be the k[[x^{−1}]]-submodule of k(C) ⊗_{k(x)} k((x^{−1})) corresponding to

\{\underline{a} = (a_{i})_{i} ∈ ∏_{i=1}^{h} k(C)_{𝔭_{i}} | |a_{i}|_{i} ≤ e^{c_{i}}\}

under isomorphism (2.14).

Now we clearly have L(D) = I ∩ 𝔐_{∞}. Note here that 𝔐_{∞} can be interpreted as a (higher dimensional) “non-archimedean cuboid”, and thus L(D) is the intersection of a “lattice” with a “cuboid”. This idea can now be converted back to the number theoretic situation, and in fact the analogously defined set H^{0}(𝔞) for a “complete ideal” 𝔞 of a number field defined for example in [Neu91, III, §3] is the intersection of a lattice with a higherdimensional cuboid.^{7}

Note also that Proposition 2.92 and Lemma 2.94 on the determination of L(D + n · (x)_{−}) still hold if k[\frac{1}{x}]_{( \frac{1}{x} )} is replaced by k[[x^{−1}]] and I^{∞}(−D)_{∞} is replaced by 𝔐_{∞}. (See also Remark 2.23.)

We now claim that we have

I^{∞}(−D)_{∞} ⊗_{k[ \frac{1}{x} ]_{( \frac{1}{x} )}} k[[x^{−1}]] = 𝔐_{∞} .  (2.16)

Note first that the result holds for the trivial divisor, that is, isomorphism (2.14) restricts to a k[[x^{−1}]]-isomorphism

\xymatrix{((x_{|C})_{∗}O_{C})_{∞} ⊗_{k[ \frac{1}{x} ]_{( \frac{1}{x} )}} k[[x^{−1}]] \ar[r]^{∼} & ∏_{i=1}^{h}𝔒̂_{𝔭} ,}  (2.17)

7Note the minus signs in the definition of o(D) in [Neu91].

where 𝔒̂_{𝔭_{i}} is the completion of the local ring at the place 𝔭_{i}. Indeed, this is a special case of [Eis95, Corollary 7.6.].

Note now that the semi-local ring ((x_{|C})_{∗}O_{C})_{∞} is a principal ideal domain. Let u be a generator of I^{∞}(−D)_{∞}. Then the right-hand side is u·((x_{|C})_{∗}O_{C})_{∞}⊗_{( \frac{1}{x} )}k((x^{−1})), which corresponds to ∏_{i} ι_{i}(u)𝔒̂_{𝔭_{i}} = ∏_{i} 𝔭_{i}^{−c_{i}} 𝔒̂_{𝔭_{i}} under isomorphism (2.14), which in turn corresponds to 𝔐_{∞} again under isomorphism (2.14).

Note that by (2.16) every basis k[\frac{1}{x}]_{( \frac{1}{x} )}-basis of I^{∞}(−D)_{∞} is also a k[[x^{−1}]]-basis of 𝔐_{∞}. The statements in Proposition 2.92 and Lemma 2.94 are thus special cases of the corresponding statements if one replaces k(x)_{( \frac{1}{x} )} by k((x^{−1})) and I^{∞}(−D)_{∞} by 𝔐_{∞}.

Instead of a basis of I^{∞}(−D)_{∞} one might now in particular use a k[[x^{−1}]]- basis of 𝔐_{∞} of the following form: For i = 1, …, h, let b_{i,1}, …, b_{i,r_{i}} be a basis of 𝔭_{i}𝔒̂_{𝔭_{i}}. Then the basis of k(C) ⊗_{k(x)} k((x^{−1})) corresponding to (δ_{i,ℓ}b_{ℓ,j})_{ℓ} for i = 1, …, h and j = 1, …, r_{i} under isomorphism (2.14) is a basis of 𝔐_{∞}.

The approach by Hensel and Landsberg We are now coming to the explicit determination of L(D) following Hensel and Landsberg ([HL02]) and its connection with Heß’ algorithm and the discussion so far. Hensel and Landsberg only consider function fields over the complex numbers but this can easily be generalized to an arbitrary algebraically closed ground field. They first perform a coordinate change on ℙ_{k}^{1} such that D does have no support “at infinity” and such that the covering C ⟶ ℙ_{k}^{1} is unramified “at infinity”.

We assume that all these conditions are satisfied. In this case h = r and k(C)_{𝔭_{i}} = k((x^{−1})) for all i = 1, …, r. Now given a k[x]-basis ṽ_{1}, …, ṽ_{r} of I, Hensel and Landsberg consider the matrix ((ι_{i}(ṽ_{j})))_{i,j} ∈ k((x^{−1})). (This is the coordinate matrix of ṽ_{1}, …, ṽ_{r} with respect to the basis of k(C) ⊗_{k(x)} k((x^{−1})) which corresponds to the standard basis of the k((x^{−1}))- vector space ∏_{i=1}^{h} k(C)_{𝔭_{i}} = k((x^{−1}))^{r} under isomorphism (2.14).) Let us call this matrix the expansion matrix at ∞ of ṽ_{1}, …, ṽ_{r}. (The matrix depends on the ordering of the places of k(C) “at infinity”.)

With a “reduction algorithm” they show that there always exists a k[x]- basis v_{1}, …, v_{r} of I whose expansion matrix at ∞ is degree-reduced. Let M be this matrix, and let d_{i} := − deg(\underline{m}_{i}). Then again the x^{j}v_{i} with 0 ≤ j ≤ d_{i} form a basis of L(D). This result is of course a special case of the considerations above, but it can also be easily seen directly: For all \underline{b} ∈ k[x]^{r}, max_{i=1}^{r} valdeg(ι_{i}(∑_{j} b_{j}v_{j})) = valdeg(M\underline{b}) = max_{j=1}^{r} valdeg(b_{j}\underline{m}_{j}), and this is ≤ 0 if and only if deg(b_{i}) ≤ d_{i} for all i = 1, …, r.

Note that by (2.16) the matrices considered by Hensel and Landsberg and by Heß are related via the multiplication by a k[[x^{−1}]]-unimodular matrix from the left. Note here the interesting fact that as stated in Remark 2.23, the linear transformation given by such a matrix can be seen as a “nonarchimedean isometry”.

Let us still assume that there is no ramification “at infinity”. Then a k(x)-basis of k(C) such that the expansion matrix at ∞ is degree-reduced is called normal at ∞ by Hensel and Landsberg. Note that by the discussion above (in particular the isomorphism in (2.17)) and the fact that “degreereducedness” is invariant under multiplication by a k[[x^{−1}]]-univariate matrix from the left, a system is normal at ∞ if and only if the coordinate matrix with respect to any k[[x^{−1}]]-basis of (x_{|C}O_{C})_{∞}⊗_{k(x)}k[[x^{−1}]] is degreereduced.

The work by Hensel and Landsberg contains a generalization of the notion of normal basis at a point of ℙ_{k}^{1} to ramified points (for k = ℂ). This generalization is not used in their proof of the Riemann-Roch Theorem but it can also be used for the description of Riemann-Roch spaces.

We describe this approach now for the point ∞. For this it is crucial to assume that ∞ is only tamely ramified.

Let e_{i} = r_{i} be the ramification index of 𝔭_{i} over 𝔭_{∞}, and let e be the least common multiple of the e_{i}. Then Hensel and Landsberg consider a matrix whose entries are Laurent series in x^{− \frac{1}{e}}, defined as follows (in slightly updated terminology):

For every i = 1, …, h, we have e_{i} embeddings σ_{i,j} : k(C)_{𝔭_{i}} ⟶ k((x^{− \frac{1}{e}})) over k((x^{−1})). Let us choose an e^{th} root of unity in k((x^{− \frac{1}{e}})). Then the embeddings σ_{i,j} can be numbered such that the following holds: Let σ_{i,1}(u) = ∑_{ℓ=a}^{∞} u_{i,ℓ}x^{− \frac{ℓ}{e}}. Then σ_{i,j}(u) = ∑_{ℓ=a}^{∞} ζ_{ℓ}^{(j−1)ℓ}u_{i,ℓ}x^{− \frac{ℓ}{e}}.

Let ṽ_{1}, …, ṽ_{r} be a k(x)-basis of k(C), and let us fix an ordering on the embeddings of k(C) into k((x^{− \frac{1}{e}})). Then Hensel and Landsberg consider the matrix A in k((x^{− \frac{1}{e}})) whose j^{th} column is given by the images of ṽ_{j} under all embeddings into k((x^{− \frac{1}{e}})) (with the fixed ordering). Again we call this matrix the expansion matrix at ∞ of ṽ_{1}, …, ṽ_{r}.

We now need to generalize some notions from subsubsection 2.5.3.1 on degree-reduced matrices: We define the valuation-degree of a Laurent series in x^{− \frac{1}{e}} with leading coefficient x^{\frac{a}{e}} to be \frac{a}{e}. With this definition we generalize the definitions of subsubsection 2.5.3.1 to Laurent series in x^{− \frac{1}{e}}.

Now Hensel and Landsberg call the system ṽ_{1}, …, ṽ_{r} normal at ∞ if the matrix A defined above satisfies valdeg(det(A)) = ∑_{j=1}^{r} valdeg(\underline{a}_{j}). An equivalent condition is the matrix lc(A) of leading coefficients of A is nonsingular.^{8} Moreover, it is easy to see that this condition implies that for all \underline{b} ∈ k[x]^{r}, valdeg(A\underline{b}) = max_{j=1}^{r} valdeg(b_{j}\underline{a}_{j}).

8More generally, they define a notion of a normal k(x)-basis with respect to any point

Hensel and Landsberg show:

Every k[x]-submodule of k(C) of rank r has a k[x]-basis which is normal at ∞.

This has the following application for Riemann-Roch spaces: Let still D be a divisor on C which has no support “at infinity”, and let still I := I^{fin}(−D). Let v_{1}, …, v_{r} be normal at ∞. Let M ∈ k((x^{− \frac{1}{e}})) be the expansion matrix at ∞ and let \underline{b} ∈ k[x]^{r}. Then ∑_{j} b_{j}v_{j} lies in L(D) if and only if valdeg(M\underline{b}) ≤ 0. Now this is the case if and only if valdeg(b_{i}) ≤ − valdeg(\underline{m}_{i}) for all i = 1, …, r. With d_{i} := −⌈valdeg(\underline{m}_{i})⌉, this implies that a basis for L(D) is given by x^{j}v_{i} for 0 ≤ j ≤ d_{i}.

We now give a proof that every k[x]-submodule 𝔐 of k(C) of full rank has a basis which is normal at ∞.

Let t_{i} (i = 1, …, h) be the uniformizing element of k(C)_{𝔭_{i}} which is mapped to x^{− \frac{1}{e_{i}}} under σ_{i,1}. Then 1, t_{i}, …, t_{i}^{e_{i}−1} form a k[[x^{−1}]]-basis of 𝔒̂_{𝔭_{i}}. Let now B be the ordered basis of k(C) ⊗_{k(x)} k((x^{−1})) whose elements correspond to (δ_{k,ℓ}t_{ℓ}^{j−1})_{ℓ} for k = 1, …, h, j = 1, …, e_{i} under isomorphism (2.14) (ordered lexicographically where the first index is dominating).

Let now v_{1}, …, v_{r} be a k[x]-basis of 𝔐 such that the following holds: Let N be the coordinate matrix of v_{1}, …, v_{r} with respect to the basis B. Then lc(N) is an upper triangular matrix of the form

( \begin{matrix}1 & ∗ & ∗ & ⋯ & ∗ \\ & 1 & ∗ & ⋯ & ∗ \\ & & 1 & ⋯ & ∗ \\ & & & ... & ∗ \\ & & & & 1 \end{matrix} ) .

Such a basis always exists. This follows for example from an obvious generalization of the reduction algorithm for >_{d} in the proof of Proposition 2.26 to Laurent series and a final permutation.

We claim that v_{1}, …, v_{r} is then also normal at ∞.

The embeddings σ_{i,j} induce an isomorphism of k((x^{− \frac{1}{e}}))-vector spaces

\xymatrix{k(P)_{𝔭_{i}} ⊗_{k((x^{−1}))} k((x^{− \frac{1}{e}})) \ar[r]^{∼} & k((x^{− \frac{1}{e}}))^{r}} .  (2.18)

Let C be the coordinate matrix of the basis B with respect to the basis of k(C) ⊗_{k(x)} k((x^{− \frac{1}{e}})) which corresponds to the standard basis of k((x^{− \frac{1}{e}}))^{r}.

of ℙ_{k}^{1}.

Then C has the form

( \begin{matrix}C_{1} \\ & C_{2} \\ & & . & . & . \\ & & & & & C_{h} \end{matrix} ) ,

where the matrix C_{i} is an e_{i}×e_{i}-matrix whose (a, j)-entry is ζ_{e_{i}}^{(a−1)·(j−1)}x^{\frac{(j−1)}{e_{i}}}. Let A be the expansion matrix at ∞ of v_{1}, …, v_{r}. Then A = CN.

Let now N = ( N_{1} ; ⋮ ; N_{h} ), where N_{i} has e_{i} rows. Then A has the form

( \begin{matrix}C_{1}N_{1} & ∗ & ∗ & ∗ \\ & C_{2}N_{2} & ∗ & ∗ \\ & & ... & ∗ \\ & & & C_{h}N_{h} \end{matrix} ) .

As all elements of column j of C_{i} have degree \frac{j−1}{e_{i}} and lc(N_{i}) is upper triangular with unity on the diagonal, lc(C_{i}N_{i}) = lc(C_{i}) = ((ζ_{e_{i}}^{(a−1)·(j−1)}))_{a,j}. In particular, lc(C_{i}N_{i}) is non-singular. Now by the shape of A, det(lc(A)) = det(lc(C_{1}N_{1})) ⋯ det(lc(C_{i}N_{i})), thus lc(A) is also non-singular. This establishes the claim.

A warning We would like to issue a warning at this point: It is not true in general that every non-singular matrix in k((x^{− \frac{1}{e}}))^{r×r} can with k[x]-column operations be transformed into a matrix whose matrix of leading coefficients is non-singular.

An obvious generalization of degree-reducedness is as follows: A matrix in k((x^{− \frac{1}{e}})) is degree-reduced with respect to x if for all \underline{b} ∈ k[x]^{r}, valdeg(A\underline{b}) = max_{j=1}^{r} valdeg(b_{j}\underline{a}_{j}). As already stated the matrix of a normal system is degree reduced. It is however not true in general that the matrix of leading coefficients of a non-singular degree-reduced matrix is non-singular. Consider for example the matrix

( \begin{matrix}x + 1 & x^{\frac{1}{2}} \\ x^{\frac{1}{2}} & 1 \end{matrix} ) ,

which is degree-reduced with respect to x.

With an obvious “reduction algorithm” one can however prove that for any matrix A ∈ k((x^{− \frac{1}{e}}))^{r×s} there exists a degree-reduced matrix which is related to A by k[x]-column operations.

What concerns the determination of the Riemann-Roch space L(D), clearly instead of a basis of I which is normal at ∞ in the sense of Hensel and Landsberg one might just consider an ideal basis whose matrix is degreereduced. This approach is for example pursued by W. Schmidt in [Sch91]. More information on matrices in k((x^{− \frac{1}{e}})) which are degree-reduced with respect to x can also be found in [Heß01].

2.5.5 The global representation

One can represent effective divisors by linear subspaces of the spaces of global sections of invertible sheaves. The theoretical background of this representation is given by the following lemma.

Lemma 2.99 Let L be an invertible sheaf of degree ≥ 2g + 1 on C. Then the space Γ(C, L) has dimension deg(L) − g + 1. For an effective divisor D on C of degree ≤ deg(L) − 2g, L(−D) is base point free, the space Γ(C, L(−D)) has codimension deg(D) in Γ(C, L), and D is the base divisor of (L, Γ(C, L(−D))). In particular, D is uniquely determined by Γ(C, L(−D)) inside Γ(C, L).

Proof. We have deg(L(−D)) = deg(L) − deg(D) ≥ 2g. This implies that L(−D) is base point free; see [Har77, IV, Corollary 3.2]. In particular both L and L(−D) are non-special. Now the dimension statements follow from the Riemann-Roch Theorem. Let D′ ≥ D be the base divisor of (L, Γ(C, L(−D))). We then have Γ(C, L(−D′)) ≃ Γ(C, L(−D)). Now if D′ ≠ D, then L(−D) would not be base point free. □

One can therefore represent an effective divisor D by the pair (L, Γ(C, L(−D))), where L is an invertible sheaf of degree ≥ 2g+deg(D). We call this representation of effective divisors the joint global representation. The free global representation is the free representation of divisors obtained by restricting this representation to prime divisors and then applying the usual construction for a free representation.

For computational purposes one can for example choose a divisor E and set L := Γ(C, O(E)). Then one can represent Γ(C, O(E)) = L(E) by a kbasis consisting of elements in the function field k(C), and one can represent a basis of Γ(C, O(E − D)) = L(E − D) by their coordinate matrix with respect to the basis of Γ(C, O(E)).

The following lemma is helpful if one wants to change between the ideal and the global representation.

Lemma 2.100 Let B be a base point free divisor on C. Then L(B) generates the fractional ideal I^{fin}(−B) as ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1})–module. Similarly, it generates the fractional ideal corresponding to the restriction of −B to (x_{|C})^{−1}(\frac{1}{x}(𝔸_{k}^{1})) as ((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1}))-module.^{9}

Proof. Clearly L(B) is contained in both ideals (it is in fact the intersection of the two ideals). Now let P ∈ C. Then as B is base point free by assumption, L(B) generates the fractional ideal 𝔪_{P}^{v_{P} (B)} as an O_{C,P} -module. This implies the statements. □

Remark 2.101 In the context of Lemma 2.99, let L = O(E) for a divisor E on C. Then the divisor E − D is base point free, and Lemma 2.100 in particular applies to this divisor.

We now discuss the change from the joint ideal to the joint global representation with respect to sheaves of the form O(n · (x_{|C})_{−}) and conversely. For this we restrict ourselves to curves with plane models such that x_{|C} is a separating element. We assume that the finite and infinite orders as well as the k[x]-invariants and a basis v_{1}, …, v_{r} as in Proposition 2.95 of the trivial divisor have already been computed. Note that these computations can be performed in a number of field and bit operations which is polynomially bounded in d by Propositions 2.72 and 2.95.

Proposition 2.102 Under the above assumptions the following holds:

Given an effective divisor D in joint ideal representation and n ∈ ℕ such that n · r ≥ 2g + deg(D) and such that n is polynomially bounded in d and deg(D), one can compute the coordinate representation of a basis of L(n · (x_{|C})_{−} − D) with respect to the basis of L(n · (x_{|C})_{−}) described in Proposition 2.92 in a number of field and bit operations which is polynomially bounded in d and deg(D).

Conversely, given an effective divisor D represented by the corresponding subspace L(n · (x_{|C})_{−} − D) of L(n · (x_{|C})_{−}), where n is as above, one can compute the joint ideal representation of D in a number of field and bit operations which is polynomially bounded in d and deg(D).

Proof. For the first claim, we proceed as follows: First the divisor −D is computed (see Proposition 2.78). Then a basis of L(n · (x_{|C})_{−} − D) as in Proposition 2.95 is computed. Now, the elements of this basis are expressed in terms of the basis of L(n · (x_{|C})_{−}) via a linear algebra computation. Note that the sizes of the matrices to be considered are polynomially bounded in d and deg(D) because the degrees of the denominators and the numerator matrices of the bases of the two spaces are polynomially bounded in d and deg(D) (see again Proposition 2.95).

9If B has support outside the preimages of the points ∞ and 0 on ℙ_{k}^{1}, this ideal is not equal to I^{∞}(−B).

We come to the second claim. We first compute (x_{|C})_{−} − D in joint ideal representation: The “finite” ideal of the ideal representation of (x_{|C})_{−} − D can be computed as claimed by Lemma 2.100 / Remark 2.101 and Proposition 2.72 (on the computation of ideals from generators). In the same way, one can compute the ideal I (that is, a HNF-basis thereof) of ((x_{|C})_{∗}O_{C})(\frac{1}{x}(𝔸_{k}^{1})) which corresponds to the restriction of n · (x_{|C})_{−} − D to (x_{|C})^{−1}(\frac{1}{x}(𝔸_{k}^{1})). At this point we do not have yet a joint ideal representation of (x_{|C})_{−} − D as we require that the “infinite ideal” only has support “at infinity”. We can however compute the desired infinite ideal by Proposition 2.80 as claimed.

Now D can be computed as claimed by Proposition 2.78. □

Given that we represent the curve C by a plane model C_{pm}, another natural choice for L is O_{C}(n) = π^{∗}(O_{ℙ_{k}^{2}}(n)).

Note that O_{C}(n) ≃ O(n · div(Z_{|C})) (via division by Z_{C}^{n}). In particular, if div(X_{|C}) and div(Z_{|C}) have disjoint support then O_{C}(n) ≃ O(n · (x_{|C})_{−}).

It is however more natural to not perform this division by Z_{|C}^{n} and rather consider the following approach. We consider the inclusion into the associated sheaf of meromorphic sections O_{C}(n) ↪ M(O_{C}(n)) =^{Def} O_{C}(n) ⊗_{O_{C}} M_{C}. This inclusion induces an inclusion Γ(C, O_{C}(n)) ↪ Γ(C, M(O_{C}(n))) ≃ Quot(k[X, Y, Z]/(F))_{n} (the degree n part of Quot(k[X, Y, Z]/(F))).

Explicitly, the space Γ(C, O_{C}(n)) as a subspace of Quot(k[X, Y, Z]/(F))_{n} is Z^{n} · L(n · div(Z_{|C}), and this allows an efficient computation of a basis of Γ(C, M(O_{C}(n))) inside Quot(k[X, Y, Z]/(F))_{n} via Heß’ algorithm. (Of course, Z can be substituted by any other linear form.)

Proposition 2.103

a) Given C (represented by C_{pm}) and n ∈ ℕ there exists a homogeneous element H ∈ k[X, Y, Z]/(F) whose total degree is polynomially bounded in d such that H · Γ(C, O_{C}(n)) ⊆ k[X, Y, Z]/(F).

b) One can compute such an element H and a basis of H ·Γ(C, O_{C}(n)) inside (k[X, Y, Z]/(F))_{n+deg(H)} in a number of field and bit operations which is polynomially bounded in d and n.

c) Let us assume that x_{|C} is a separating element and that the finite and infinite order have been computed. Let us furthermore assume that an element H and a basis B_{1}, …, B_{ℓ} of H · Γ(C, O_{C}(n)) as in b) have been computed. We represent linear subspaces of Γ(C, O_{C}(n)) via bases which we represent by their coordinate vectors with respect to \frac{B_{1}}{H} , …, \frac{B_{ℓ}}{H}. Then for divisors of degree ≤ n · r − 2g, one can change between the joint ideal representation of divisors and the representation via subspaces of Γ(C, O_{C}(n)) in a number of field and bit operations which is polynomially bounded in d, deg(D) and n.

Proof. The first statement follows immediately from Proposition 2.95 applied to D = div(Z_{|C}).

For b) one can use this algorithm:

1. Set up the ideal representation with respect to x_{|C} or y_{|C} (depending on whether x_{|C} is a separating element).

2. Compute div(Z_{|C}) in ideal representation.

3. Apply Heß’ algorithm to compute a basis v_{1}, …, v_{dim(L(n·Z_{|C}))} of L(n · Z_{|C})

4. Write the basis in the form v_{i} = \frac{G_{i}}{H} with homogeneous elements H, G_{i} ∈ k[X, Y, Z]/(F).

5. Output H and G_{i} · Z^{n} for all i.

By Proposition 2.53, Step 1 can be performed with a number of field and bit operations which is polynomially bounded in d. For Step 2, note that as V (X, Y, Z) = ∅ div(Z_{|C}) = max{(x_{|C})_{−}, (y_{|C})_{−}}. Furthermore (x_{|C})_{−} = max{−(x_{|C}), 0} and (y_{|C})_{−} = max{−(y_{|C}), 0}. Therefore one can compute div(Z_{|C}) (deterministically) in a number of field and bit operations which is polynomially bounded in d by Proposition 2.66. Step 3 can be performed as claimed by Proposition 2.95, and the forth step can also be performed as claimed.

For the last statement, see the proof of Proposition 2.102. □

Remark 2.104 Let L be any invertible sheaf on C, let D_{1} and D_{2} be effective divisors on C, and let s be a non-trivial global section of L such that div(s) = D_{1} + D′_{1} for some effective divisor D′_{1}. Then multiplication by s gives an isomorphism

O(D_{1} − D_{2}) ⟶ L(−D′_{1} − D_{2}) ,

which induces an isomorphism

L(D_{1} − D_{2}) ⟶ Γ(C, L(−D′_{1} − D_{2})) .

Now in [KM04b] K. Khuri-Makdisi gives an efficient algorithm based on easy linear algebra computations for the following computational problem; see [KM04b, Theorem / Algorithm 5.5]:

Let L be some invertible sheaf, and let us fix bases of Γ(C, L), Γ(C, L^{⊗2}) and Γ(C, L^{⊗3}). For the computation the only information on L we require is the matrix of the multiplication maps

\xymatrix{Γ(C, L) ⊗ Γ(C, L) \ar[r] & Γ(C, L^{⊗2})}

and

\xymatrix{Γ(C, L) ⊗ Γ(C, L^{⊗2}) \ar[r] & Γ(C, L^{⊗3})}

with respect to the fixed bases. Now let D_{1}, D_{2} be two effective divisors with deg(D_{i}) ≥ 2g + 1 and deg(D_{i}) ≤ deg(L) − 2g − 1, each represented in joint global representation with respect to L, thus via the subspaces Γ(C, L(−D_{i})) of Γ(C, L).

The problem is now to compute a global section s of L as above and the subspace Γ(C, L(−D′_{1} − D_{2})) of Γ(C, L), where D′_{1} is as above. Moreover, if |D_{1} − D_{2}| is non-empty, an effective divisor linearly equivalent to D_{1} − D_{2} in global representation with respect to L shall be computed.

Note that if L = O(E), where E is some divisor on C, one can regard the section s as a function on C, and one then obtains L(D_{1} − D_{2}) = \frac{1}{s} · Γ(C, L(−D′_{1} − D_{2})). Thus if the fixed basis of Γ(C, L) = L(E) in k(C) is also given, one obtains a basis of the space L(D_{1} − D_{2}).

Another result by Khuri-Makdisi concerns the computation of a free representation. We already know that one can in an efficient way pass from a joint to a free ideal representation; see Proposition 2.86. So one can also pass from a joint to a free global representation via the ideal representation. In [KM04a, Sections 6 and 7] it is shown how one can pass directly from a joint to a free global representation.

2.6 Representing divisor classes and computations in the class group

Let still C be a curve over a field k, represented by a plane model C_{pm}. Let g be the genus of C.

We are now considering the task to represent divisor classes and compute with them.

We have already discussed several ways to represent divisors, and we have discussed algorithmic aspects related to divisors as well. The most straightforward representation of divisor classes would thus arguably be to simply use the canonical homomorphism Div(C) ⟶ Cl(C) as a representation of the divisor class group by the divisor group.

The problem with this approach is however that even for divisors of degree 0 on a fixed curve C, the length of the input (the divisor used for the representation) would be arbitrarily large.

This problem can however be avoided as by the Riemann-Roch Theorem every divisor of degree ≥ g is linearly equivalent to an effective divisor.

Let us fix a divisor D_{0} of degree ≥ 1.

The following definition is [Heß01, Definition 8.1].

Definition 2.105 Let D̃ be an effective divisor on C. Then D̃ is (maximally) reduced along D_{0} if the linear system |D̃ − D_{0}| is empty.

Remark 2.106 Let D̃ be an effective divisor which is reduced along D_{0}. Then

• dim(L(D̃)) ≤ deg(D_{0}), that is, dim_{k}(|D̃|) < deg(D_{0}).

• deg(D̃) < g + deg(D_{0}).

Both statements follow immediately from the conditions and the Riemann-Roch Theorem.

Definition 2.107 Let now D be any divisor on C, and let D̃ be an effective divisor reduced along D_{0} such that D ∼ D̃ + rD_{0} for some r ∈ ℤ. Then D̃ is called a reduction of D along D_{0}.

Lemma 2.108 Let D be a divisor on C. Then there exists a reduction of D along D_{0}. The set of reductions of D along D_{0} forms a complete linear system. Moreover, it depends only on the divisor class of D (and on D_{0}).

Proof. Note first that the divisor D + (⌈\frac{g}{deg(D_{0})}⌉ − deg(D))D_{0} has degree ≥ g, thus in particular it is linear equivalent to an effective divisor. If now r is minimal such that |D + rD_{0}| is non-empty, then D + rD_{0} is linearly equivalent to a reduced divisor.

Obviously, if D̃ is a reduction, then so is every divisor linear equivalent to D̃. For the converse let D̃ and D̃′ be two reductions with D̃ − rD_{0} ∼ D ∼ D̃′ − r′D_{0}. Let wlog. r ≥ r′. Then D̃ − (r − r′)D_{0} ∼ D̃′. Therefore r = r′ as otherwise D̃ would not be reduced.

The last statement is obvious. □

The first point of Remark 2.106 and this lemma imply:

Lemma 2.109 Let deg(D_{0}) = 1. Then the reduction of a divisor D on C along D_{0} is unique.

Proposition 2.110 Given a divisor in joint ideal representation, one can compute with a deterministic algorithm a reduction of a divisor D on C along D_{0} in a number of field and bit operations which is polynomially bounded in d, deg(D_{0}) and ht(D).

Proof. This follows from the proof of Lemma 2.108 and Propositions 2.78 and 2.97. □

Remark 2.111 Let us consider the corresponding computational problem over finite fields. Then given a curve C over 𝔽_{q} and two divisors D and D_{0} as above one can with a randomized algorithm compute a uniformly randomly distributed reduction of D along D_{0} in a time which is polynomially bounded in log(q), d, deg(D_{0}) and ht(D).

This follows from Remark 2.98.

Every divisor class a ∈ Cl(C) can be represented by a tuple consisting of a reduction D̃ of any divisor defining a and the number r with [D̃]−r[D_{0}] = a. For classes in Cl^{0}(C), one can omit the number r.

Proposition 2.112 Let us represent divisor classes as described, where the divisors are given in joint ideal representation. Then given two divisor classes a, b ∈ Cl(C), one can compute the sum a+b ∈ Cl(C) and the difference a − b ∈ Cl(C) in a number of field operations which is polynomially bounded in d and ht(D_{0}) and in a number of bit operations which is polynomially bounded in d, deg(D_{0}), log(deg(a)) and log(deg(b)).

Proof. This follows from Proposition 2.78 on divisor arithmetic and Proposition 2.110. □

Remark 2.113 Note that the height of the canonical divisor div(dx_{|C}) on C considered in subsubsection 2.5.4.4 is max{2r, deg(R)} with the notations of that subsubsection. Therefore, this divisor has a height which is polynomially bounded in d. By applying the proposition to this divisor, one obtains that the arithmetic in Cl^{0}(C) can be performed in a number of field and bit operations which is polynomially bounded in d.

By Lemma 2.109 we obtain a particularly nice representation of the divisor class group if we have a divisor of degree 1 and height polynomially bounded in d.

For arbitrary curves such a divisor does not always exist. For example, by the Riemann-Roch theorem, a curve of genus 1 has a divisor of degree 1 if and only if it has a rational point. However, not every genus 1 curve has a rational point.

On the other hand, every curve over a finite field does have a divisor of degree 1.

Proposition 2.114 Given a curve over a finite field 𝔽_{q}, one can compute with a randomized algorithm a divisor of degree 1 and height in O(log(d)) in joint or free ideal representation in an expected time which is polynomially bounded in d and log(q).

Proof. Assume we have some r_{0} ∈ ℕ and points Q_{+} ∈ C(𝔽_{q^{r_{0}+1}}) and Q_{−} ∈ C(𝔽_{q^{r_{0}}} ). Let P_{+} and P_{−} be the corresponding closed points of C. Let f_{+} be the residue field degree of P_{+} and f_{−} the residue degree of P_{−}. Then f_{+}|r_{0} + 1 and f_{−}|r_{0}. Let e_{+} := \frac{r_{0}+1}{f_{+}} and e_{−} := \frac{r_{0}}{f_{−}}. Then e_{+}P_{+} − e_{−}P_{−} is a divisor of degree 1. The height of the divisor is ≤ r_{0} + 1.

We now have to prove that

- one can always find such points Q_{+} and Q_{−} in an expected time which is polynomially bounded in d and log(q),

- one can at the same time choose r_{0} to be in O(log(d))

- given Q_{+} and Q_{−}, one can compute the divisor of degree 1 in the claimed time.

Recall that by the Hasse-Weil bound, for r ∈ ℕ, we have

#C(𝔽_{q^{r}}) ≥ q^{r} + 1 − 2g q^{r/2} .

Therefore,

#C_{ns}(𝔽_{q^{r}}) ≥ q^{r} + 1 − 2gq^{r/2} − (\frac{(d − 1)(d − 2)}{2} − 1) ,

where C_{ns} is the non-singular part of C_{pm}.

Let r_{0} := ⌈4 log_{2}(2d)⌉, and let r ≥ r_{0}. Then q^{r/2} ≥ 2^{r_{0}/2} ≥ (2d)^{2} = 4d^{2}, and therefore \frac{1}{4}q^{r} ≥ d^{2}q^{r/2} > 2gq^{r/2} and \frac{1}{4}q^{r} ≥ d^{2}q^{r/2} > \frac{(d−1)(d−2)}{2}. Thus #C_{ns}(𝔽_{q^{r}}) ≥ \frac{q^{r}}{2} .

By the following lemma, if one intersects (C_{pm})_{𝔽_{q^{r}}} with a uniformly distributed random line in ℙ_{𝔽_{q^{r}}}^{2}, the probability that the line contains a point from C(𝔽_{q^{r}}) is ≥ \frac{1}{2d}.

We thus proceed as follows: For r = r_{0} and r_{0} + 1 we intersect C_{𝔽_{q^{r}}} with uniformly randomly chosen lines in ℙ_{𝔽_{q^{r}}}^{2}. We compute all 𝔽_{q^{r}}-rational points in the intersection, and for each such point we check if it lies in C_{ns}. We repeat this until we have found the desired points Q_{+} and Q_{−}. After we have found the two points Q_{+} and Q_{−}, we compute P_{+} and P_{−} and finally e_{+}P_{+} − e_{−}P_{−}.

Let us check that these steps can indeed by carried out with the claimed complexity. First, r_{0} can easily be computed. It is also easy to choose a line in ℙ_{𝔽_{q^{r}}}^{2} uniformly at random. The computation of the intersection can be performed as claimed by Lemma 2.116 below. The check if the points lie in C_{pm} can be performed by evaluating the partial derivatives of F (X, Y, Z). We already know that the expected number of lines we have to consider for r = r_{0} and r = r_{0} + 1 is ≤ 2d. The computation of P_{+} and P_{+} and finally e_{+}P_{+} − e_{−}P_{−} is possible with the claimed complexity by Propositions 2.90 and 2.78. □

Lemma 2.115 Let #C_{ns}(𝔽_{q}) ≥ \frac{q}{2}. Now let L be a uniformly distributed random line in ℙ_{𝔽_{q}}^{2}. Then the probability that L intersects C_{pm} in at least one point in C_{ns}(𝔽_{q}) is larger than \frac{1}{2d}.

Proof. Each point in ℙ^{2}(𝔽_{q}) (in particular each element from C_{ns}(𝔽_{q})) lies on q + 1 lines. Moreover, on each line lie at most d elements from C_{ns}(𝔽_{q}). This means that ≥ \frac{1}{d}(q + 1) · \frac{q}{2} lines contain an element from C_{ns}(𝔽_{q}).

In total there are q^{2} + q + 1 lines. Therefore, the probability that a uniformly randomly distrubted line contains an element from C_{ns}(𝔽_{q}) is > \frac{1}{2d}. □

Lemma 2.116 Given a non-trivial homogeneous polynomial F (X, Y, Z) ∈ 𝔽_{q}[X, Y, Z] and a non-trivial linear homogeneous polynomial G(X, Y, Z) ∈ 𝔽_{q}[X, Y, Z], one can compute the set of 𝔽_{q}-rational points in V (F, G) in an expected number of field and bit operations which is polynomially bounded in deg(F) and log(q).

Proof. Let G = a_{X}X + a_{Y} Y + a_{Z}Z. Let us wlog. assume that a_{Y} = 1. Then the point (0 : 1 : 0) does not lie in V (F, G), and the schemetheoretic image of V (F, G) under the projection to the (X, Z)-coordinates is given by F (X, −a_{X}X − a_{Z}Z, Z) ∈ 𝔽_{q}[X, Z]. One can therefore perform the computation as follows: One factors this polynomial, and for each linear factor one computes the corresponding Y -coordinate via G. □

The computations of discrete logarithms with the index calculus method the following proposition is crucial.

Proposition 2.117 Let us consider curves over finite fields. As always we represent curves by plane models, and let d be the degree of the plane model. We represent divisor classes by divisors which are reduced along a divisor D_{0} of degree 1 and of a height which is polynomially bounded in d. Moreover, we represent divisors in free ideal representation. Then the arithmetic (addition and subtraction) in the degree 0 class groups can we a randomized algorithm be performed in an expected time which is polynomially bounded in d and log(q), where q is the cardinality of the ground field. If the curves are represented by plane models of degree O(g), one can with a randomized algorithm perform the arithmetic in the degree 0 class groups in an expected time which is polynomially bounded in g and log(q); one can then with a randomized algorithm perform the arithmetic in an expected time which is polynomially bounded in log(# Cl^{0}(C)).

Proof. The first statement follows from Proposition 2.112 and Proposition 2.87, the second statement is an immediate consequence, and the third statement follows from the second statement and the inequality # Cl^{0}(C) ≥ (\sqrt{q} − 1)^{2g}. □

Recall here that by Proposition 2.6 ([Heß05, Theorem 56]), any curve over a finite field has a plane model of degree O(g). Thus one can represent curves over finite fields in such a way that the second and the third statement hold for all curves.

Remark 2.118 If instead of the free ideal representation one uses the joint ideal representation, statements analogous to the ones in the proposition hold with a deterministic algorithm.

2.7 Appendix: Computing the maximal order

We address in this section the problem to compute the order ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) of k(C), given the homogeneous polynomial F (X, Y, Z) defining the plane model, or given f(x, y) ∈ k[x, y] or the associated monic polynomial f̃(x, ỹ) ∈ k[x][ỹ].

Recall that we usually assume that C is geometrically irreducible. All the following considerations however also apply if C is only a smooth and proper irreducible k-scheme. Equivalently, for the following considerations we not assume that k(C)|k is a regular field extension.

Moreover, in subsection 2.5.4, we assumed that x is a separating element. We drop this assumption as well.

For separable extensions k(C)|k(x) it was shown by Chistov that the complexity of the related problem for finite fields k = 𝔽_{q} are polynomially bounded in the input length (in a bit-oriented model such as on a bit-RAM or on a Turing machine).

If p ≤ d, his algorithm relies however on factorization of univariate polynomials over k (he uses Berlekamp’s algorithm). Therefore his algorithm does not lead to a deterministic algorithm in our computational models but only to a randomized algorithm. Another aspect of Chistov’s approach is the use of expansions whereas we strive for expansion free methods.

We present here a completely different algorithm which relies heavily on HNF-bases and which does not use factorization of polynomials. As a side effect, we can remove the prerequisite that the field extension be separable.

The algorithm can be seen as a variant of several algorithms already present in the literature. However, to our knowledge, it has not been previously shown that one can compute the order ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) with a number of field and bit operations which is polynomially bounded in d without polynomial factorization (but with the ability to compute p^{th} roots). This also applies to algorithms which can be obtained by obvious variations of algorithms for the computation of maximal orders in number fields. In particular, contrary to the statement in Section 3 of [Heß01], an obvious variant for function fields of the algorithm by Buchmann and Lenstra ([BL94]) does require factorization of polynomials in the same way as the algorithm by Chistov does.

At the end of this section, some further historical remarks on the algorithm can be found.

We now first describe some theoretical background of the algorithm in a more abstract setting. The following two lemmata and Proposition 2.121 are essentially the content of [GR71, Anhang §3, 3, Sätze 6,7]. We follow closely [GLS01] which in turn is based on [dJ98].

Let A be a commutative reduced noetherian ring and let I be an ideal of A, containing a non-zero-divisor u. Let Quot(A) be the total quotient ring of A, and let Ã be the normalization of A.

Lemma 2.119 The homomorphism of A-modules

{g ∈ Quot(A) | gI ⊆ A} ⟶ Hom_{A}(I, A) , g ↦ (h ↦ hg)

is an isomorphism. Likewise is the restriction

{g ∈ Quot(A) | gI ⊆ I} ⟶ Hom_{A}(I, I) .

Proof. The homomorphism Hom_{A}(I, A) ⟶ {g ∈ Quot(A) | gI ⊆ A} φ ↦ \frac{φ(u)}{u} is clearly an inverse to the first homomorphism. The second statement is then obvious. □

We set

A′ := {g ∈ Quot(A) | gI ⊆ I} .

Lemma 2.120 A′ is a commutative ring and

A ⊆ A′ ⊆ \{g ∈ Quot(A) ∩ Ã | gI ⊆ A\} ⊆ \{g ∈ Quot(A) | gI ⊆ \sqrt{I}\} .

In particular, if I = \sqrt{I}, then

A′ = {g ∈ Quot(A) ∩ Ã | gI ⊆ A} .

Proof. It is obvious that A′ is a commutative ring and that A ⊆ A′.

For the second inclusion, we have to show that A′ ⊆ Ã. By the Cayley-Hamilton Theorem for finitely generated modules ([Eis95, Theorem 4.3]), the endomorphism I ⟶ I , h ↦ hg satisfies a monic polynomial with coefficients in A. As the homomorphism A′ ⟶ End_{A}(I) is injective, so does g.

For the last inclusion, let g ∈ Quot(A) ∩ Ã with gI ⊆ A. Let t^{n} + a_{n−1}t^{n−1} + ⋯ + a_{0} be a monic polynomial in A[t] which is satisfied by g. Now let h ∈ I. Then (gh)^{n} = −a_{n−1}(gh)^{n−1} · h − ⋯ − a_{0} · h^{n} ∈ I. Hence gh ∈ \sqrt{I}. □

Let

NN(A) := {𝔭 ∈ Spec(A) | A_{𝔭} is not normal} .

be the non-normal locus of A. Note that NN(A) is the closed subset of Spec(A) defined by the conductor ideal 𝔠 := Ann_{A}(Ã/A).

We now have the following criterion for normality.

Proposition 2.121 Let A be a reduced noetherian commutative ring, and let I ⊆ A be an ideal satisfying

a) I is a radical ideal

b) NN(A) is contained in the closed subset of Spec(A) defined by I.

Then A = Ã if and only if A = A′, where A′ is defined as above.

Proof. If A = Ã then A = A′ by the lemma above.

So let the three conditions be satisfied, and let A = A′. Then by b) I ⊆ \sqrt{𝔠}. As A is noetherian, there exists a minimal j ∈ ℕ_{0} with I^{j} ⊆ 𝔠, that is, I^{j}Ã ⊆ A. If j = 0, the result follows.

So let us assume that j > 0. Let h ∈ Ã and g ∈ I^{j−1} such that hg ∉ A. Then hg ∈ Ã and hgI ⊆ hI^{j} ⊆ A, thus by the previous lemma gh ∈ A′ = A. This is a contradiction. We conclude that j = 0, thus A = Ã. □

The following formula gives a convenient description of A′ for algorithmic purposes.

A′ = \frac{1}{u} · (I :_{A} uI)  (2.19)

For a proof note first that

A′ ⊆ \frac{1}{u}I ⊆ \frac{1}{u}A  (2.20)

Indeed, as u ∈ I, we have u · A′ ⊆ I by definition of A′.

The inclusion \frac{1}{u}(I :_{A} uI) ⊆ A′ is obvious. So let g ∈ A′. Then ug ∈ A and ugI ⊆ uI. Therefore ug ∈ (I :_{A} uI). □

We now return to our application, the computation of the finite order ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}). Let us first fix the following definition.

Definition 2.122 An order of k(C) with respect to x or with respect to k[x] is an a subring of k(C) which contains k[x] and is finitely generated over k[x].

Remark 2.123 A subring A of k(C) is an order with respect to k[x] if and only if A contains x and A is contained in ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}).

Proposition 2.121 and Lemma 2.120 and Equation (2.19) imply:

Proposition 2.124 Let O be an order of k(C) with respect to k[x]. Let u ∈ k[x] − {0}, and let I be an ideal of O containing u. Let

O′ := {g ∈ k(C) | gI ⊆ I} .

Then

a) O′ is an order with O ⊆ O′ ⊆ \frac{1}{u}O.

b) Let U be the kernel of

O ⟶ End_{k}(I/(u)) , g ↦ (\overline{h} ↦ \overline{gh}) .

Then O′ = \frac{1}{u}U.

c) Let now u ∈ k[x] be such that every prime divisor of [((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) : O]_{k[x]} also divides u. (For example, u might be a multiple of the discriminant of O.) Let I := \sqrt{u · O} be the radical of the ideal u · O in O. Then O = O′ if and only if O = ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}).

Remark 2.125 In the classical terminology of number fields, O′ would be called “the order associated to the module I”.

Proof of the proposition. Part a) follows immediately from (2.20). Part b) is a reformulation of (2.19).

For part c) note that the prime divisors of 𝔠 ∩ k[x] (where 𝔠 is the conductor of O) are equal to the prime divisors of [((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) : O]_{k[x]}. Therefore the element u in the proposition is contained in \sqrt{𝔠}. The result now follows from Proposition 2.121. □

We are now coming to the algorithm. Recall that the task is to compute the order ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}), given the homogeneous polynomial F (X, Y, Z) defining the plane model or the polynomial f(x, y) ∈ k[x, y] or the associated monic polynomial f(x, ỹ) ∈ k[x][ỹ].

Convention 2.126 In the following we represent all k[x]-submodules of k(x) of rank r by the corresponding HNF-bases with respect to 1, y_{|C}, …, y_{|C}^{r−1}. As usual, here the HNF-basis is represented by the denominator and the coordinate matrix in k[x]^{r×r}.

The algorithm is based on successive enlargements of orders until one reaches the maximal order ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) and is very easy to describe:

We start with O = k[x][ỹ]/(f̃). Then we successively substitute O by O′, where O′ is as in Proposition 2.124 with u = disc(f̃). We terminate if O = O′.

By Proposition 2.124 it is clear that we obtain an algorithm which computes the finite order, provided that we can compute O′ from O.

What concerns the complexity, note that we always have deg([(x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) : O′]_{k[x]}) < deg([(x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) : O]_{k[x]}). As deg([(x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) : k[x][ỹ]/(f̃)]_{k[x]}) ≤ \frac{deg(disc(f̃))}{2}, we need at most ⌊\frac{deg(disc(f̃))}{2}⌋ substitutions, thus the number of substitutions is polynomially bounded in d.

By the next lemma, we obtain the desired result:

Proposition 2.127 One can compute the finite order ((x_{|C})_{∗}O_{C})(𝔸_{k}^{1}) of k(C) in a number of field and bit operations which is polynomially bounded in d.

Lemma 2.128 Given a polynomial u(x) which divides disc(f̃) and an order O of k(C) with respect to k[x], one can with a deterministic algorithm compute O′ in a number of field and bit operations which is polynomially bounded in d.

Proof. Let v_{1}, …, v_{r} be the HNF-basis of O with respect to 1, ỹ_{|C}, …, y_{|C}^{r−1}. We use the formula O′ = \frac{1}{u}U in part b) of Proposition 2.124. As above, let I be the radical of (u) in O. Note that I/(u) is the nilradical

of the local finite k-algebra O/(u).

We can therefore proceed as follows: First we compute the multiplication table of O/(u) with respect to the canonical basis of O/(u) (cf. Definition 2.43) (with respect to v_{1}, …, v_{r}). Secondly we compute a basis \overline{h}_{1}, …, \overline{h}_{k} of the nilradical (that is, we compute coordinate vectors of the elements \overline{h}_{i} with respect to the canonical basis). Then we compute the multiplication table of O/(u)×I/(u) ⟶ I/(u) with respect to the canonical basis of O/(u) and the basis of I/(u) just computed.

Let for i, j = 1, …, k, φ_{i,j} : I/(u) ⟶ I/(u) be the endomorphism given by \overline{h}_{i} ⟶ δ_{i,j}\overline{h}_{j}. Note that the multiplication table immediately gives the matrix of the homomorphism O/(u) ⟶ End_{k}(I/(u)) , \overline{g} ↦ (\overline{h} ↦ \overline{gh}) with respect to the canonical basis of O/(u) and the basis (φ_{i,j})_{i,j}.

Finally, we compute a basis \overline{b}_{1}, …, \overline{b}_{ℓ} of this matrix. Then U is generated as a k[x]-module by the canonical lifts of \overline{b}_{1}, …, \overline{b}_{ℓ} to O and uv_{1}, …, uv_{r} (see again Definition 2.43 and note that the lifting is computationally trivial).

We obtain the final result by a Hermite normal form computation.

As for the complexity, note first that deg(u) is polynomially bounded in d (because disc(f̃) is polynomially bounded in d). The canonical complementary system of (u) in O has deg(u) · r elements (which is polynomially bounded in d) each of which has degree < deg(u). It is then clear that the multiplication table can be computed in a number of field and bit operations which is polynomially bounded in d. By Proposition 1.50 the computation of the nilradical can then be performed (with a deterministic algorithm) in a number of field and bit operations which is polynomially bounded in d.

The computation of \overline{b}_{1}, …, \overline{b}_{ℓ} involves linear algebra over k with matrices whose size is polynomially bounded in d. Finally, the Hermite normal form computation takes place on a matrix of size polynomially bounded in d and degree polynomially bounded in d. All these computations can be performed in a number of field and bit operations which is polynomially bounded in d. □

Some historical remarks

The computational problem to determine maximal orders in function fields is closely related to two well-studied computational problems: The computation of maximal orders in number fields and the computation of normalizations of arbitrary finitely generated commutative k-algebras.

For both these problems, various algorithms have been proposed, and the algorithm above can be seen as a variant of algorithms for both these problems. We try to give here an account of the historical development as far as it is relevant for the present algorithm.

We start with the problem to compute maximal orders of number fields. Key ideas of the algorithm presented above were already present in an algorithm developed in the 1960ies by H. Zassenhaus. It seems that the algorithm was not formally published by him for a long time. The algorithm does however appear in a proceeding of an workshop of the “Mathematisches Forschungsinstitut Oberwolfach” from 1967 (see [Zas67]). In this work Zassenhaus in fact considers the following more general problem: He defines an order as a (not necessarily commutative) ring O which is as ℤ-module free of finite rank. The computational problem is now: Given such an order (represented by its multiplication table), compute an order which is contained in O ×_{ℤ} ℚ, contains O, and is maximal!

As a special case of the results for arbitrary rings, the following criterion is stated for orders of number fields (see pp. 102-103 of [Zas67]): Let p be a prime, and let O be an order in a number field. Then the p-radical of O is defined as \sqrt{p · O}. Now the index of O in the maximal order is divisible by p (one says “O is p-maximal”) if and only if the order associated to the p-radical of O is equal to O.

This leads to the following algorithm to compute maximal orders in number fields, starting with any order O: First the discriminant of O is factored. Then one successively enlarges the order along the following procedure: One iterates over all prime factors which divide the discriminant at least twice, and for each such factor p one proceeds as follows: Let us assume that we have already constructed the order O. Then one successively substitutes O with O′, where O′ is the order associated to the p-radical in O. One moves on the next prime if O = O′.

The algorithm in [Zas67] is a bit more complex but this is only because Zassenhaus considers non-commutative orders.

We make several remarks here: First Zassenhaus’ criterion on “p-maxi-mality” of orders can be viewed as a “local version” of Proposition 2.124. In fact, the criterion can be viewed as a special case of Proposition 2.121 (namely, one sets A := O_{p}). We note also that the Zassenhaus’ criterion is incorrectly attributed to both M. Pohst and H. Zassenhaus by H. Cohen in his book [Coh96].

Zassenhaus’ algorithm immediately leads an algorithm for the computation of maximal orders in function fields, provided one assumes that factorization of univariate polynomials is possible. The algorithm we presented above can then be viewed as a variant of this algorithm which avoids factorization of polynomials.

In the meantime several variants of Zassenhaus’ algorithm have been given. We mention in particular the Round 2 algorithm and the algorithm by Buchmann and Lenstra.

The Round 2 algorithm is based on Zassenhaus’ algorithm but additionally the so-called Dedekind criterion is used: Let f(t) ∈ ℤ[t] be irreducible, and let the order O of ℚ[t]/(f(t)) be such that [O : ℤ[t]/(f(t))] is prime to p. Then the Dedekind criterion is a simple criterion with which one can decide if p does not divide the index of O in the maximal order. Moreover, if this is not the case, one can easily compute the enlarged order O′. The Round 2 algorithm can for example be found in [Coh96].

Before we come to the algorithm by Buchmann and Lenstra we remark that in 1989 Chistov published a work on the relationship between the computation of commutative maximal orders ([Chi89]) and factorization. He claims that the computation of maximal orders in number fields is polynomially equivalent to determine the largest square-free divisor of an integer. Building on the fact that the corresponding computational problem for polynomials over finite fields is algorithmically easy, he also claims that the maximal order of a global function field L|𝔽_{q} respect to a separable field extension L|𝔽_{q}(x) and the ring 𝔽_{q}[x] can be computed in a time which is polynomially bounded in the input length. This algorithm is based on a previous algorithm of his for computations of approximations of factorizations of polynomials over local fields ([Chi87]). As the method used by Chistov is completely different than Zassenhaus’ method, and there is no relationship to the algorithm presented above, we do not describe his algorithm here.

We just remark how in Chistov’s algorithm for global function fields factorization of polynomials is used, respectively avoided: For global function fields whose characteristic is less-or-equal to the extension degree, he uses Berlekamp’s algorithm to factor the discriminant. In the other case, Chistov uses what might be called “passive factorization” of the discriminant: He considers divisors of the discriminant, and he computes modulo these divisors as if he was computing in a field. If now one hits during the execution of the algorithm some element which is not invertible, one has obtained a further factorization of the discriminant, and one proceeds recursively. This approach means that in our computational models, the algorithm by Chistov would require randomization in the “small characteristic” case.

We also mention that Chistov’s work is very brief, and some steps of the algorithm are not described at all. From the wording in the article by Chistov, the author of this work has the impression that these missing steps might be given in previous works. But unfortunately, such works are not cited by Chistov.

Now inspired by the result by Chistov, J. Buchmann and H.W. Lenstra revisited Zassenhaus’ ideas in an article from 1994 (see [BL94]). Just like Chistov, they employed the idea of “passive factorization”. They are only concerned with the number field case, but their algorithm can easily be adapted to global function fields. We remark again that just as Chistov’s work, an obvious generalization of the algorithm to arbitrary ground fields would require polynomial factorization for the “small characteristic case” (see Step 1 of Algorithm 6.6 in [BL94]).

We are now coming to the second computational problem, the computation of normalizations of arbitrary commutative k-algebras. After various previous works by several authors, T. de Jong gave in 1998 an algorithm for the computation of normalizations of arbitrary finitely generated commutative algebras over fields. (See the citations in [dJ98] and [GLS01] for an overview over previous algorithms.) In fact, de Jong realized that one can easily build an algorithm on the previous (purely theoretical) criterion for normality by Grauert and Remmert ([GR71]) from the year 1971 which can essentially be found above.

De Jong has a representation by generators and relations in mind. The algorithm we have presented above can be seen as a variant of the algorithm by de Jong for the special case of orders in function fields and with HNFbases.

It is interesting to note that despite their similarity the work by Zassenhaus and subsequent works based on it on the one hand and the work by Grauert, Remmert and finally de Jong on the other hand seem to be completely independent:

As already stated, Zassenhaus’ criterion on “p-maximality” can be viewed as a special case of results by Grauert and Remmert. We found however no indication that Zassenhaus or Grauert and Remmert were aware of this. Also, it seems that various authors who later worked on variants of Zassenhaus’ algorithm were not aware of the results by Grauert and Remmert.

As stated, de Jong’s work builds on the work by Grauert and Remmert. However, it seems that he was also ignorant of the fact that a variant of his algorithm was already given by Zassenhaus before Grauert and Remmert published their work. The same applies to Greuel, Lossen and Schulze ([GLS01]) who in the introduction to their overview article from the year 2001 write on the computation of normalizations: “The problem [...] is to know when to stop, that is, to have an effective criterion for a ring to be normal. It had escaped the computer algebra community that such a criterion has been known for more than thirty years, having been discovered by Grauert and Remmert. It was rediscovered by de Jong.”

Computing discrete logarithms

3.1 Introduction

We now come to the heart of this work: The computation of discrete logarithms in degree 0 class groups of curves, including the groups of rational points of elliptic curves, over finite fields.

All results on the computation of discrete logarithms we present follow the so-called index calculus method. Very briefly, the index calculus method consists of the following: One fixes a set of prime divisors F, called the factor base, and one searches for relations between the factor base elements and the input elements. If one has enough relations, one tries to derive the discrete logarithm by linear algebra.

An outline over this chapter is as follows: In the next section we present the index calculus method. In particular, we give a “general algorithm” which relies on five subroutines, namely a subroutine for the computation of the group order, a subroutine for integer factorization, a subroutine for construction of a factor base and for precomputation, a subroutine for relation generation, and a subroutine for sparse linear algebra. Let us note here that the “precomputation” we mentioned might in particular include the construction of a so-called tree of large prime relations. Later in this chapter we then give subroutines for the discrete logarithm problem for specific classes of curves.

In the following section we discuss an index calculus algorithm with double large prime variation for curves of a fixed genus. In Section 3.4 we focus on the following computation problem: Let a natural number g_{0} be fixed. Now the task is to compute discrete logarithms of elements of degree 0 class groups of arbitrary curves of genus ≥ g_{0} over finite fields. Then main result Sections 3.3 and 3.4 is arguably that one can compute discrete logarithms in (suitably represented) degree 0 class groups of curves C/𝔽_{q} of genus at least 3 over finite fields in an expected time of Õ(# Cl^{0}(C))^{\frac{4}{9}} ).

Finally, in the last section, we present and analyze index calculus algorithms for elliptic curves over extension fields. These algorithms rely on what we call a decomposition algorithm which in turn is based in solving systems of multigraded polynomials. We then in particular show that there exists an infinite family of increasing finite fields such that the elliptic curve discrete logarithm problem over these fields can be solved in subexponential time in the input length.

If not stated otherwise, the computational model for deterministic (resp. randomized) algorithms is the bit-RAM model (resp. randomized bit-RAM model).

3.2 The index calculus method

In this section we give a general outline to the index calculus method.

3.2.1 The setting

Let us first fix the following general definition:

Definition 3.1 Let G be a finite group (written multiplicatively), and let a ∈ G and b ∈ ⟨a⟩. Then the discrete logarithm of b with respect to a is the smallest non-negative integer x with a^{x} = b. Here a is called the base of the logarithm. One writes x = log_{a}(b).

Remark 3.2 In the “Disquisitiones Arithmeticae”, C.F. Gauß introduced the name index for what is now called the discrete logarithm of some element 𝔽_{p}^{∗} (p any prime number) with respect to a multiplicative generator of 𝔽_{p}. This classical terminology was for example still used by J. Pollard in [Pol78], but nowadays it seems to be not so common anymore.

Convention 3.3 As we are concerned with the computation of discrete logarithms in degree 0 class groups of curves over finite fields, we use additive notation in the following. This means: Given a finite abelian group G, written additively, a ∈ G and b ∈ ⟨a⟩, the discrete logarithm of b with respect to a is the smallest non-negative integer x with x · a = b.

We are interested in the discrete logarithm problem in degree 0 class groups of curves over finite fields. This means that given a curve C over a finite field 𝔽_{q} and two elements a, b ∈ Cl^{0}(C) with b ∈ ⟨a⟩, we want to compute the discrete logarithm of b to the base a. Here we assume that the curve and the divisor classes are represented as in Chapter 2: The curve is given by a plane model, which in turn is given by a homogeneous polynomial F (X, Y, Z); a divisor D_{0} of degree 1 is fixed, and the divisor classes are given by divisors which are reduced along D_{0}; all these divisors are given by any of the representations described in the previous chapter.

We now give an overview over one variant of the so-called index calculus method, assuming – for this introductory description – that the degree 0 class group is cyclic and generated by a.

Let x ∈ {0, …, ord(a) − 1} with x · a = b be the unknown discrete logarithm we want to compute.

One first chooses a so-called factor base F consisting of prime divisors of C,^{1} and one enumerates the elements of F, say F = {F_{1}, F_{2}, …, F_{k}} with pairwise distinct F_{j}. Furthermore, one chooses a divisor D_{1} of degree 1. (One might set D_{1} := D_{0} but this is not necessary.)

Then one generates relations between the input elements a, b, the elements of the factor base and D_{1}:

∑_{j} r_{i,j}[F_{j}] − (∑_{j} r_{i,j} deg(F_{j})) · [D_{1}] = α_{i}a + β_{i}b  (3.1)

with r_{i,j}, α_{i}, β_{i} ∈ ℤ.^{2}

If one has generated more than k relations, one can – under certain additional assumptions – determine the unknown discrete logarithm x. The basic idea is here to eliminate the factor base elements via linear algebra such that one obtains a relation between the input elements a and b.

In the cases we consider we can always compute the group order and its factorization in a way which is (asymptotically) not time-critical. Then all computations can be performed “modulo the group order and its factors”. We describe this now in greater detail.

Let N := # Cl^{0}(C). One then proceeds as outlined above: One fixes a factor base and one generates relations. However, now the coefficients r_{i,j}, α_{i}, β_{i} lie in ℤ/Nℤ.

Let us now for simplicity for the moment assume that N is prime. Let now k + 1 relations be generated; let R = ((r_{i,j}))_{i,j} ∈ (ℤ/Nℤ)^{(k+1)×k} be the relation matrix, that is, the matrix whose rows are the coefficients occurring in the relations.

Now the left-kernel of the matrix R is non-trivial. One computes some non-trivial row vector \underline{γ} ∈ (ℤ/Nℤ)^{1×(k+1)} with \underline{γ}R = 0. Note that this means that

1In this section, we always speak of prime divisors instead of closed points, in order to highlight the factorization of divisors into prime divisors.

2Let D_{1}, …, D_{n} be divisors and c_{1}, …, c_{m} be divisor classes on C. Then a relation between D_{1}, …, D_{n} and c_{1}, …, c_{m} is a tuple (r_{1}, …, r_{n}, s_{1}, …, s_{m}) ∈ ℤ^{m+n} with ∑_{j} r_{j}[D_{j}] = ∑_{j} s_{j}c_{j}. We always describe relations by giving the corresponding equation.

∑_{i} γ_{i}r_{i,j} = 0  (3.2)

for all j = 1, …, k. We now have

\begin{matrix}∑_{i} γ_{i}α_{i}a + ∑_{i} γ_{i}β_{i}b = ∑_{i} γ_{i}(α_{i}a + β_{i}b) = \\ ∑_{i} ∑_{j} γ_{i}r_{i,j}[F_{j}] = ∑_{j}(∑_{i} γ_{i}r_{i,j})[F_{j}] = 0 . \end{matrix}  (3.3)

If now ∑_{i} γ_{i}β_{i} ≠ 0, then with ξ := (∑_{i} γ_{i}α_{i}) (∑_{i} γ_{i}β_{i})^{−1} ∈ ℤ/Nℤ, we have

ξ · a = b ∈ Cl^{0}(C) .

This means that the unique representative x ∈ {0, …, N − 1} of ξ is the discrete logarithm of b with respect to a we are looking for.

Of course, in order to put this general idea to work, one needs algorithms to obtain a factor base, to compute relations as well as an algorithm to perform the linear algebra.

In subsection 3.2.3 below we give a framework for the computation of discrete logarithms in degree 0 class groups of curves over finite fields. We give a general algorithm which relies subroutines for

a) computation of the order of the degree 0 class group

b) integer factorization

c) construction of a factor base and for precomputation

d) relation generation.

e) sparse linear algebra.

Specifications of the inputs and outputs of these subroutines are given in subsection subsection 3.2.3. Then later in this chapter, specific subroutines are discussed for specific classes of curves. In fact, one obtains very different algorithms depending on which subroutines one chooses. The algorithms for integer factorization as well we for linear algebra are however the same in all the following algorithms, and can be discussed already now.

For integer factorization we use the algorithm by H.W. Lenstra and C. Pomerance ([LP92]), which gives rise to the following result.

Proposition 3.4 An integer N can with a randomized algorithm be factored in an expected time of L_{N}[\frac{1}{2}, 1 + o(1)].

3.2.2 Sparse linear algebra

After the relation collection, we will have obtained a matrix M in sparse representation over ℤ/Nℕ, where N := Cl^{0}(C), and we want to compute some row vector \underline{γ} over ℤ/Nℤ with \underline{γ}M = 0 and [\underline{γ}]_{ℓ} ≠ 0 for all prime divisors ℓ of N.

Let N = ∏_{i=1}^{v} ℓ_{i}^{e_{i}} be the factorization of N, where ℓ_{i} are pairwise distinct prime numbers and e_{i} natural numbers. If we then have found row vectors \underline{γ}^{(i)} over ℤ/ℓ^{e_{i}}ℤ with \underline{γ} [M]_{ℓ_{i}^{e_{i}}} = 0 and \underline{γ}^{(i)} ≠ 0, we can use the Chinese Remainder Theorem to obtain a solution \underline{γ} as desired.

It remains to determine such vectors \underline{γ}^{(i)}. This computation will be based on a computation over the finite field 𝔽_{ℓ_{i}} (discussed below) and an obvious “lifting algorithm” which is described in the following lemma.

In the rest of this subsubsection, as usual, we describe all linear algebra computations on column vectors.

As outlined above, in the index calculus algorithms, we will however use operations on row vectors.

Lemma 3.5 Let ℓ be a prime number, and let A ∈ (ℤ/ℓ^{e}ℤ)^{m×n} for some e, m, n ∈ ℤ. Let now \underline{v} ∈ (ℤ/ℓ^{e}ℤ)^{n} with [A\underline{v}]_{ℓ^{e−1}} = 0; let \underline{b} ∈ (ℤ/ℓℤ)^{m} with A\underline{v} = ℓ^{e−1}\underline{b}. If now there exists a \underline{u} ∈ (ℤ/ℓℤ)^{n} with A\underline{u} = \underline{b}, then we have A(\underline{v} − ℓ^{e−1}\underline{u}) = 0. Moreover, every \underline{w} ∈ (ℤ/ℓℤ)^{n} with A\underline{w} = 0 can be obtained in this way.

Note that the lifting algorithm is guaranteed to succeed — starting from any row vector over 𝔽_{ℓ} — if [A]_{ℓ} has full row rank; otherwise it might fail. Because of this, our goal in the relation generation — where we use the corresponding result for row vectors — is to produce a matrix which has full column rank modulo all prime divisors of the group order.

It remains to give an efficient algorithm for solving sparse linear systems over finite fields and for computing non-trivial solutions of homogeneous systems, provided that the matrix has full row rank. For this, one can use various variants of Wiedemann’s and Lanczos’ algorithms. An algorithm as we require it can in fact already be found in the original work by Wiedemann. Indeed, from [Wie86] one obtains (with fast multiplication and division in finite fields):

Proposition 3.6 There is a randomized algorithm such that the following holds: Upon input of a matrix A ∈ 𝔽_{q}^{m×n} in sparse representation and a vector \underline{b} ∈ 𝔽_{q}^{m}, the algorithm outputs either “failure” or a vector \underline{v} ∈ 𝔽_{q}^{n} with A\underline{v} = \underline{b}. Moreover, if the matrix A has full row rank, the algorithm outputs a solution \underline{v} with a probability of at least \frac{1}{2}. The running time of the algorithm is in Õ(n · (n + ω) · log(q)), where ω is the number of non-zero entries of A.

Alternatively, one might also use the variant of Wiedemann’s algorithm described in [KS91] or the variant of Lanczos’ algorithm from [EK97] together with the remarks on necessary field extensions in [EG02, Section 4]. One can then substitute the condition that A has full column rank by the condition that \underline{b} lies in the column space of A.

It is well-known that one can obtain an algorithm as in the proposition with the additional property that if the algorithm does not fail, the output is uniformly distributed over the kernel of A.

For this, one first chooses \underline{w} ∈ 𝔽_{q}^{n} uniformly randomly, and then one applies the algorithm to A and \underline{b} − A\underline{w} (for \underline{b}). If \underline{v} is the random vector computed by the algorithm, then we have A(\underline{v} + \underline{w}) = \underline{b} − A\underline{w} + A\underline{w} = \underline{b}.

Let us recall why the result \underline{v} +\underline{w} is uniformly distributed over the kernel of A:

Let \underline{y} := A\underline{w}. Let us fix any value \underline{y}^{(0)} ∈ 𝔽_{q}^{m} of \underline{y} (occurring with nontrivial probability). Then conditionally to \underline{y} = \underline{y}^{(0)}, the following holds: \underline{w} is uniformly distributed in the preimage of \underline{y}^{(0)} upon multiplication by A. Moreover, all random choices in the algorithm are stochastically independent of \underline{w}. Therefore, the output \underline{v} is stochastically independent of \underline{w}. Thus conditionally to any value \underline{v}^{(0)} of \underline{v} (which occurs with non-trivial probability) (and still conditionally to \underline{y} = \underline{y}^{(0)}), \underline{w} is still uniformly distributed in the preimage of \underline{y}^{(0)}, and then \underline{v}^{(0)} + \underline{w} is uniformly distributed in the preimage of \underline{b}.

But if the result holds conditionally to any fixed value of \underline{y} and \underline{v}, it also holds unconditionally.

Note that if we apply the algorithm just described to a matrix A of full column rank with non-trivial kernel and the vector \underline{0}, then with a probability of ≥ \frac{1}{2} · (1 − \frac{1}{q}) ≥ \frac{1}{4} it outputs a non-trivial vector in the kernel of A. By applying the algorithm up to three times we obtain:

Proposition 3.7 There is a randomized algorithm such that the following holds: Upon input of a matrix A ∈ 𝔽_{q}^{m×n} in sparse representation with nontrivial kernel, the algorithm outputs either “failure” or a non-trivial vector \underline{v} ∈ 𝔽_{q}^{m} with A\underline{v} = 0. Moreover, if the matrix A has full row rank, the algorithm outputs a vector \underline{v} with a probability of at least \frac{1}{2}. The running time of the algorithm is in Õ(n · (n + ω) · log(q)), where ω is the number of non-zero entries of A.

Altogether we have:

Proposition 3.8 There is a randomized algorithm such that the following holds: Upon input of a matrix A ∈ (ℤ/Nℤ)^{m×n} in sparse representation and the factorization of N, the algorithm determines some \underline{v} ∈ (ℤNℤ)^{m} with A\underline{v} = 0 and [\underline{v}]_{ℓ} ≠ 0 for every prime divisor ℓ of N or it reports “failure”. Moreover, if for all prime divisors ℓ of N the matrix [A]_{ℓ} has full row rank, the probability that it reports “failure” is ≤ \frac{1}{2}. The running time of the algorithm is in Õ(n · (n + ω) · log(N)^{2}), where ω is the number of non-trivial entries in the matrix.

Proof. As above, let N = ∏_{i=1}^{v} ℓ_{i}^{e_{i}} be the factorization of N. Note that ∑_{i} e_{i} log_{2}(ℓ_{i}) = log_{2}(N), and therefore ∑_{i} e_{i} ≤ log_{2}(N).

As outlined above, we proceed for each prime power individually and then use the Chinese Remainder Theorem to obtain a solution over ℤ/Nℤ. For each prime, we start off with an algorithm satisfying Proposition 3.7 and then we apply the lifting algorithm above with an algorithm satisfying Proposition 3.6. In each of these cases, we repeat the computation up to ⌈log_{2} log_{2}(N) + 1⌉ times if the any algorithm reports “failure”. Like this, we obtain: If the matrix has full column rank, then the total success probability is ≥ (1 − (\frac{1}{2})^{⌈log_{2} log_{2}(N)+1⌉})^{log_{2}(N)} ≥ (1 − \frac{1}{2 log_{2}(N)})^{log_{2}(N)} ≥ 1 − \frac{1}{2} = \frac{1}{2}. □

3.2.3 The general algorithm

As already noted, in this subsection we give a framework for computations of discrete logarithms in degree 0 class groups of curves over finite fields. We outline a general algorithm relying on various subroutines. This general algorithm is closely related to the framework for computations of discrete logarithms in groups with known group order given in [EG02] (see subsection 3.2.5 for further remarks on the relationship).

The setting is as follows: We fix a particular full subcategory of the large groupoid of instances (C/𝔽_{q}, a, b) of the discrete logarithm problem in degree 0 class groups of curves over finite fields (cf. Example 1.22). The inputs to the algorithm will consist of these instances together the group order and divisor classes c_{1}, …, c_{u} of Cl^{0}(C).^{3} Here the curve and the divisor classes are represented as described above, but additionally we allow that certain restrictions on the allowed representations imposed. For example, in the applications of the general framework we will always assume that the degree of the plane model is in O(g), where g is the genus of the curve.

Roughly, in the algorithm, we first compute the group order and factor it. Then we set up the ideal representation with respect to the covering x_{C} : C ⟶ ℙ_{𝔽_{q}}^{1} or the covering y_{|C} : C ⟶ ℙ_{𝔽_{q}}^{1}, depending on whether the former covering is separable; all further computations take place in ideal representation with respect to this covering. Then we apply a procedure for construction of the factor base and precomputation which outputs an enumerated factor base and a divisor D_{1} of degree 1. After this we generate relations between the factor base elements, D_{1}, the input elements a, b and the further degree 0 divisor classes c_{1}, … c_{u} using a procedure for relation generation applied to divisor classes of the form αa+βb. Finally, we perform a linear algebra computation to generate a relation between a and b.

3For the moment we put no restriction on the elements c_{1}, …, c_{u}. However, in applications of the “general algorithm” we will only be able to derive upper bounds on expected running times if we assume that c_{1}, …, c_{u} is a generating system.

For this, we assume that we have fixed the following five procedures (all of which can be randomized).

If the covering x_{|C} : C ⟶ ℙ_{𝔽_{q}}^{1} is separable, the following divisors are represented in ideal representation with respect this covering, otherwise they are represented in ideal representation with respect to the covering y_{|C} : C ⟶ ℙ_{𝔽_{q}}^{1}.

a) An algorithm for computing orders of degree 0 class groups of curves C/𝔽_{q} as above.

b) An algorithm for integer factorization.

c) A procedure for generation of the factor base and for precomputation. We require the following: If the procedure terminates, a well-defined part of its final state (given by pointers) contains:

• a divisor D_{1} on C of degree 1

• a description of an enumerated factor base F = {F_{1}, …, F_{k}} (by this we mean that given such a result as well as a prime divisor P of C, one can compute whether P is contained in F, and if this is the case the number i with P = F_{i})

• representations of the divisor classes a, b, c_{1}, …, c_{u} by along D_{1} reduced divisors

• possibly some additional information for later use.

We call all this the “result” of the computation.

d) A procedure for relation generation. Let us assume that we have a result of the previous procedure, as indicated above. Now let c ∈ Cl^{0}(C) be some degree 0 divisor class, represented by an along D_{1} reduced divisor. Then, if the relation generation procedure terminates, it outputs vectors (r_{j})_{j=1,...,k} ∈ (ℤ/Nℤ)^{k} and (s_{j})_{j=1,...,u} ∈ (ℤ/Nℤ)^{u} defining a relation

∑_{j} r_{j}[F_{j}] − (∑_{j} r_{j} deg(F_{j})) · [D_{1}] = ∑_{j} s_{j}c_{j} + c .  (3.4)

Here D_{1} is the divisor of degree 1 which is computed in the previous procedure. (Usually, in the applications of the “general algorithm” D_{1} is equal to D_{0}, which is part of the input, but in the algorithm in Section 3.3 we allow for another divisor D_{1}.) An important condition is that the distribution of the output is (for a fixed result of the previous procedure) independent of the representation of the input c. (Note that one element c ∈ Cl^{0}(C) might be represented by different bit-strings.)

e) An algorithm for sparse linear algebra satisfying Proposition 3.8.

The algorithm is as follows.

General index calculus algorithm

Input: An instance (C/𝔽_{q}, a, b) of the discrete logarithm problem in degree 0 class groups of curves over finite fields and some elements c_{1}, c_{2}, …, c_{u} of Cl^{0}(C), satisfying certain conditions and appropriately represented. Maybe some additional information.

1. Apply the algorithm to compute the group order and then the algorithm for integer factorization.

(Let N = # Cl^{0}(C) and N = ∏_{i=1}^{v} ℓ_{i}^{e_{i}} with e_{i} ∈ ℕ and pairwise distinct prime elements ℓ_{i}.)

2. If the covering x_{|C} : C ⟶ ℙ_{𝔽_{q}}^{1} is separable: Set up the ideal-theoretic description of divisors with respect to this covering (see subsubsection 2.5.4.2). Compute free or joint ideal representations of the input divisors. If the covering is not separable, proceed analogously with y instead of x.

(If the input is already given in this form, this step can be omitted.)

3. Apply the procedure for generation of a factor base and for precomputation. (Let F = {F_{1}, P_{2}, …, F_{k}} ⊆ C be the chosen enumerated factor base, and let D_{1} be the computed divisor of degree 1.)

4. 4.1. Let t ⟵ ⌈log_{2}(k + u) + log_{2}(2 log_{2}(N))⌉ + 1

4.2. Construct matrices R ∈ (ℤ/Nℤ)^{(2(k+u)·t)×k} and S ∈ (ℤ/Nℤ)^{(2(k+u)·t)×u} in sparse representation as well as vectors \underline{α}, \underline{β} ∈ (ℤ/Nℤ)^{2(k+u)·t} as follows: 4.2.1. For i = 1, …, (k + u) · t do

Choose uniformly and independently randomly α_{i}, β_{i} ∈ ℤ/Nℤ and apply the algorithm to generate relations over the factor base to α_{i}a + β_{i}b.

Let

∑_{j} r_{i,j}[F_{j}] − r_{i} · [D_{1}] = ∑_{j} s_{i,j}c_{j} + α_{i}a + β_{i}b

with r_{i} := ∑_{j} r_{i,j} · deg(F_{j}) be the relation generated.

4.2.2. For i_{1} = 1, …, k

For i_{2} = 1, …, t Let i ⟵ (i_{1} − 1) · t + i_{2} + (k + u) · t. Choose uniformly and independently randomly α_{i}, β_{i} ∈ ℤ/Nℤ and apply the relation generation algorithm to [P_{i_{1}}] − [D_{1}] + α_{i}a + β_{i}b. Let

∑_{j} r_{i,j}[F_{j}] − r_{i}[D_{1}] = ∑_{j} s_{j}c_{j} + α_{i}a + β_{i}b

be the relation generated.

4.2.3. For i_{1} = 1, …, u

For i_{2} = 1, …, t Let i ⟵ (i_{1} − 1) · t + i_{2} + (2k + u) · t. Choose uniformly and independently randomly α_{i}, β_{i} ∈ ℤ/Nℤ and apply the relation generation algorithm to c_{i} + α_{i}a + β_{i}b. Let

∑_{j} r_{i,j}[F_{j}] − r_{i}[D_{1}] = ∑_{j} s_{j}c_{j} + α_{i}a + β_{i}b

be the relation generated.

5. Try to compute a row vector \underline{γ} ∈ (ℤ/Nℤ)^{1×(2(k+u)·t)} with \underline{γ}(R|S) = 0 and [γ]_{ℓ} ≠ 0 for all prime divisors ℓ of # Cl^{0}(C) with the algorithm for linear algebra. If this fails, go back to Step 4.

6. If ∑_{i} γ_{i}β_{i} ∈ (ℤ/Nℤ)^{∗}, let ξ := −\frac{∑_{i} γ_{i}α_{i}}{∑_{i} γ_{i}β_{i}}, otherwise go back to Step 4.

7. Compute ord(a), using the factorization of N.

Output the unique non-negative number x ∈ {0, …, ord(a) − 1} with [x]_{ord(a)} = [ξ]_{ord(a)}.

Note here that the computation of ord(a) can be performed efficiently (in polynomial time in log(N)) along the following lines:

As in the algorithm, let N = ∏_{i=1}^{v} ℓ_{i}^{e_{i}} with e_{i} ∈ ℕ and pairwise distinct prime numbers ℓ_{i}. Now let L_{i} := _{\frac{N}{ℓ_{i}^{e_{i}}}}, and let o_{i} := min\{j ∈ 0, …, e_{i} | ℓ_{i}^{j}L_{i} · a = 0} for i = 1, …, v. Then ∏_{i=1}^{v} ℓ_{i}^{o_{i}} is the order of a.

It is again obvious that the algorithm is correct, that is, if the algorithm terminates, x is the discrete logarithm of a with respect to b.

3.2.4 Analysis of general algorithm

We now analyze the algorithm for a fixed input and a fixed output of the factor base generation and precomputation algorithm (Step 3 in the “general algorithm”).

As remarked in subsection 1.4.3, the execution of a randomized algorithm on a particular input is given by a time-uniform Markov chain. In the present analysis, we not only fix a particular input but also a particular result of Step 3. We then again obtain a time-uniform Markov chain.

We now analyze the (values of the) variables at the time Step 6 is reached. In this way we obtain random variables which we denote in the same way as the corresponding variables in the algorithm.

We have:

Proposition 3.9 Conditionally to any result of Step 3, at the time Step 6 is reached, the random element ∑_{i} γ_{i}β_{i} is uniformly randomly distributed in ℤ/Nℤ. In particular, the probability that ∑_{i} γ_{i}β_{i} ∈ (ℤ/Nℤ)^{∗} is \frac{φ(N)}{N}.

The proof relies on the following lemma.

Lemma 3.10 Let N be a natural number, and let \underline{γ} ∈ (ℤ/Nℤ)^{m} with [\underline{γ}]_{ℓ} ≠ \underline{0} for all prime divisors ℓ of N. Furthermore, let \underline{w} be a uniformly distributed random element in (ℤ/Nℤ)^{m}. Then ∑_{i} γ_{i}w_{i} is uniformly distributed in ℤ/Nℤ.

Proof. Let us first consider the case that N is a prime power. Then at least one entry of \underline{γ} is invertible. This implies the statement. The general case follows then easily with the Chinese Remainder Theorem. □

Sketch of a proof of Proposition 3.9.

All random elements α_{i}a + β_{i}b and β_{i} are stochastically independent. Moreover, for each i β_{i} is uniformly distributed in (ℤ/Nℤ)^{k+1}.

The first statement implies that all random vectors (r_{i,j})_{j} and all elements β_{i} are stochastically independent, and this implies in particular that the random matrix R and the random vector \underline{β} are stochastically independent. This in turn implies that \underline{γ} and \underline{β} are stochastically independent.

Now conditionally to \underline{γ} = \underline{γ}^{(0)} for any fixed \underline{γ}^{(0)} ∈ (ℤ/Nℤ)^{k+1} with [γ]_{ℓ} ≠ 0 for all prime divisors ℓ of N, \underline{β} is still uniformly distributed. With the lemma this implies that – again conditionally to \underline{γ} = \underline{γ}^{(0)} –, ∑_{i} γ_{i}β_{i} is uniformly randomly distributed in ℤ/Nℤ. But then the random element ∑_{i} γ_{i}β_{i} is uniformly distributed too. □

Proposition 3.11 Conditionally to any result of Step 3, the probability that the linear algebra computation fails is ≤ \frac{1}{2}.

This proposition relies on the following lemma. For a uniform distribution this lemma appears in [Pom87]. We note however that the proof contains quite a gap. It is also stated that the lemma below holds, but no argument is given. A generalization of the result in [Pom87] was proven by F. Heß in [Heß05]. The lemma below follows from part (i) of the proof of [Heß05, Lemma 64].

Lemma 3.12 Let V be a vector space over any field with n := dim(V) < ∞, and let b_{1}, …, b_{n} be a basis of V. Let t ∈ ℕ, and let v_{1}, …, v_{nt} and v′_{1}, …, v′_{nt} be identically distributed independent random vectors with values in a finite subset of V. Let for i = 1, …, n and j = 1, …, t v_{nt+(i−1)·t+j} := b_{i} + v′_{nt+(i−1)·t+j}.

Let V′ be the random subspace of V defined by V′ := ⟨v_{1}, …, v_{2kn}⟩. Then with a probability of at least 1 − \frac{n}{2^{t−1}} we have V′ = V.

Proof of Proposition 3.11

With n := k + u and t as in the algorithm, the lemma applies to the rows of the matrix [(R|S)]_{ℓ} for each prime divisor ℓ of N.

Let us fix a prime ℓ which divides N. By the lemma, the probability that the matrix [(R|S)]_{ℓ} does not have full column rank is ≤ \frac{k+u}{2^{t−1}} . By the definition of t, this is ≤ \frac{1}{2 log_{2}(N)}.

The number of primes dividing N is bounded by log_{2}(N). This implies that the probability that the linear algebra computation fails is ≤ \frac{1}{2}. □

A brief discussion of the running time

We conclude this analysis with a very brief discussion of the running time. Of course, the actual running time of an application of the general algorithm depends crucially on the running times of the subroutines for generation of the factor base and precomputation and for relation generation.

We cannot say anything about the running time of Steps 1 and 3 at the present time. We merely want to caution the reader here that Step 3 might not in any way be of “negligible” complexity in applications. For example, Step 3 might consist of the choice of a factor base and a subsequent construction of a so-called tree of large prime relations (cf. subsubsection 3.2.6.2 below).

Step 2 can be performed in a time which is polynomially bounded in d, the degree of the plane model, and log(q) by the results of subsubsections 2.5.4.2 and 2.5.4.6 as well as subsection 2.5.5. If one allows only plane models of degree O(g), this is of course polynomially bounded in g and log(q).

In Step 4, clearly, we need 2(k + u) calls to the relation generation procedure. Again nothing can be said about the actual running time.

Step 5 can be performed with Õ((k+u)·(k+u+ω)·log(N)) bit operations according to Proposition 3.8 and the definition of t, where ω is the number of non-zero elements of the matrix. We note again that the success probability is ≥ \frac{1}{2} conditionally to any outcome of Step 3 by Proposition 3.11.

The success probability of Step 6 is \frac{φ(N)}{N} by Proposition 3.9. Note that \frac{φ(N)}{N} ∈ Ω(\frac{1}{log log(N)}) (cf. [RS62, Formula 3.41]).

This means that conditionally to any outcome of Step 3, with a probability of Ω(\frac{1}{log log(N)}), the algorithm terminates without going back to Step 4. Or with other words: Conditionally to any outcome of Step 3, the expected number of iterations is in O(log log(N)).

3.2.5 Some historical remarks

We make some historical remarks on the index calculus method and the origin of the phrase “index calculus”, and we put the general algorithm given above into historical perspective.

As mentioned above, a classical term for “discrete logarithm” in 𝔽_{p}^{∗} with respect to a generating element is “index”. Various authors have produced tables of indices (analogous to usual logarithm tables). For example, C.G. Jacobi gave such a table for all prime powers less than 1000 in his “Canon Aritheticus” ([Jac39]). In his book “Théorie des nombres” ([Kra22]) from 1922 M. Kraitchik showed how one can compute indices of residue classes of small primes via relation generation and linear algebra without having to compute the indices of all elements of 𝔽_{p}^{∗}. He stated that with this method he has computed all indices of primes up to 100 in all prime fields 𝔽_{p}^{∗} with p ≤ 10000. A book of tables was also produced by A. Western and J. Miller in 1968 ([WM68]) with a relation-based method. In [Mil75] J. Miller attributed the method to A. Western, but as we have just remarked it was in fact already used by Kraitchik. To our knowledge, the first time that a relation generation and linear algebra based approach to index computation was called “index calculus” was in A. Odlyzko’s work “Discrete logarithms in finite fields and their cryptographic significance” ([Odl84]) from 1984.

Around 1978-79 the method was independently studied L. Adleman ([Adl79]); it was also mentioned by J. Pollard [Pol78]).

An outline for an analysis of an index calculus algorithm leading to an expected subexponential running time in the case of the multiplicative groups finite prime fields was given by Adleman in [Adl79]. A rigorous result for computations in finite fields of characteristic 2 was given by M. Hellman and J. Reyneri in [HR83]. After that a rigorous result for both finite fields in characteristic 2 and finite prime fields was given by C. Pomerance in [Pom87]. Pomerance obtained an expected running time of L_{q}[\frac{1}{2}, \sqrt{2}+o(1)], where q is the size of the finite field and L[α, c] is the subexponentiality function with parameters α and c which was already defined in the introduction:

L_{N}[α, c] := e^{c·(log(N))^{α}·(log log(N))^{1−α}}

This is still the best proven running time for discrete logarithms in prime fields or finite fields of a fixed characteristic.

A. Enge and P. Gaudry gave in [EG02] a general framework for subexponential discrete logarithm algorithms under the assumption that the group order is known. Their setting is as follows: They consider groups G such that there exists a free abelian monoid M and a computable surjective morphism p : M ⟶ G with a computable section or “lifting” s : G ⟶ M and a degree-function on M. To define the factor base, they fix a “smoothness bound” S and define the factor base as the set of basis elements of M whose degree is ≤ S.

As examples of this general setting they discussed the discrete logarithm problems in finite prime fields, in finite fields of a fixed characteristic, in class groups of number fields and in degree 0 class groups of hyperelliptic curves in imaginary quadratic representation. They showed in particular that in this framework discrete logarithms in degree 0 class groups of hyperelliptic curves in imaginary quadratic representation can be computed in an expected running time of L_{q^{g}}[\frac{1}{2}, \sqrt{2} + o(1)], provided that one restricts oneself to instances with \frac{g}{log(q)} ⟶ ∞ and the group is cyclic or a basis of the group is known. Here g is the genus and 𝔽_{q} the ground field of a curve, and by a basis of the group a set of elements is meant such that every element has a unique coordinate vector with respect to the set.^{4}

Even though the work by Enge and Gaudry is related to the work by Pomerance, there is a noticeable difference: Pomerance’s work is based on the traditional way to compute indices, going back to Kraitchik as well as Western and Miller: Let g ∈ 𝔽_{p}^{∗} be a generating element, and let F be a factor base. Let us now assume that g^{i} splits over the factor base. Then one obtains a relation between i on the one hand and the (unknown) indices on the other hand. Using Lemma 3.12 Pomerance shows that one can with high probability obtain a linear system with a unique solution; the entries of the solution are then the indices. In a second step one then relates the input of the discrete logarithm problem to the factor base.

4In fact, the analysis in [EG02] shows that one only needs that g ≥ ϑ · log(q) for some constant ϑ > 0. Explicitly, in Example 3, the condition k ≥ ϑ log p implies that p ≤ e^{( \frac{log N}{ϑ} )^{1/2}} ∈ L_{N}(o(1)), and then one obtains a total running time of L_{N}(\sqrt{2} + o(1)).

An analogous observation holds for Example 5.

In contrast, Enge and Gaudry use a direct approach to eliminate the factor base elements. Our general index calculus algorithm presented above is closely related to the general algorithm in [EG02]; we only depart from the algorithm in [EG02] in the following four points.

• We make use of an arbitrary generating system whereas for non-cyclic groups in [EG02] a basis of the group is required. In order to deal with the arbitrary generating system, our algorithm is slightly different from the one in [EG02].

• We do not use a free abelian monoid M in the way Enge and Gaudry do. Of course, we have the canonical surjective map Div(C) ⟶ Cl(C), but only if the divisor D_{1} is a prime P of degree 1, we have the map Div(C − {P }) ⟶ Cl^{0}(C), D ↦ [D] − deg(D) · [P] which naturally generalizes the setting for hyperelliptic curves in imaginary quadratic representation in [EG02]. In particular we do not fix a lifting from divisor classes to divisors in the way it is done in [EG02].

• We drop the condition of the factor base being defined by a smoothness bound.

• We not only choose a factor base but also allow of a “precomputation” afterwards. This will become important when we describe the double large prime variation algorithms for curves of small genus. The fact that the analysis in [EG02] still holds true after a precomputation was already pointed out in [GTTD07] (concerning the computation of a graph of large prime relations).

3.2.6 Large prime variation and double large prime variation

“Large prime variation” and “double large prime variation” are add-ons to the index calculus method which can be used to improve the running time. We describe the ideas of these approaches and then show how slightly modified approaches can be integrated into the general algorithm given above.

3.2.6.1 Large prime variation

We give a general description of “large prime variation” in the case of groups with arbitrary (not necessarily cyclic) group structure.

As above, let c_{1}, …, c_{u} be a generating set of Cl^{0}(C). Now additionally to the factor base F one fixes a so-called set of large primes L consisting of prime divisors of C which are not contained in F.

Now one not only tries to find relations of the form

∑_{j} r_{j}[F_{j}] − r[D_{1}] = s_{1}c_{1} + ⋯ + s_{u}c_{u} + αa + βb  (3.5)

but in fact relations which involve up to one element from L, that is, relations as (3.5) and also relations of the form

∑_{j} r_{j}[F_{j}] + r_{P} [P] − r[D_{1}] = s_{1}c_{1} + ⋯ + s_{u}c_{u} + αa + βb  (3.6)

with P ∈ L and r_{P} ≠ 0. (How these relations are generated depends on the application and is not discussed here.) The original idea of large prime variation is now to proceed as follows: Whenever one encounters two such relations with the same large prime, one produces a relation between factor base elements, generating elements and a, b by eliminating the large prime.

A different method which fits well into our general algorithm above is as follows: One proceeds as above, but if one encounters a relation without a large prime, one discards it. Now each relation generated links a particular large prime to the factor base elements and the generating set. If one has linked enough large primes to the factor base and the generating set, one stops the process; let L′ ⊆ L be the set of large primes linked to the factor base in this way. Then one generates relations as in Step 4 of the general algorithm, but with F ∪ L′ in place of F. Whenever one has obtained a relation between factor base elements, large primes, the generating system and the input elements a, b one can eliminate the large primes in these relations, thus obtaining a relation between factor base elements and the generating elements. In this way one proceeds as in the general algorithm above.

Note here that this approach can be described as follows: The first part of the method can be seen as a “precomputation”. After this, we again have a procedure to obtain relations over the factor base, just a different one than the previous one. Therefore, the approach still fits our general algorithm, and in particular Propositions 3.9 and 3.11 remain valid.

Finally, we would like to caution the reader not to take the terminology “large primes” too literally: The idea of large prime variation was first used in the context of integer factorization, and there the large primes are really larger than the factor base elements. However, in our applications below, both the factor base elements and the large primes have degree 1.

3.2.6.2 Double large prime variation

“Double large prime variation” can be seen as a further development of large prime variation.

We fix a set of “large primes” L as above. Now one uses relations with up to two large primes, that is relations of the form (3.5), (3.6) as well as

∑_{j} r_{j}[F_{j}] + r_{P} [P] + r_{Q}[Q] − r[D_{1}] = s_{1}c_{1} + ⋯ s_{u}c_{u} + αa + βb (3.7)

with P, Q ∈ L, P ≠ Q and r_{P} , r_{Q} ≠ 0. Let us fix the following terminology, following for example [GTTD07].

Terminology 3.13 A relation of the form (3.5) is called a Full relation, a relation of the form (3.6) is called an FP relation, and a relation of the form (3.7) is called a PP relation.

The general idea to use all these relations is now as follows: One constructs a so called graph of large prime relations, which is a labeled graph on the set L ˙∪ {∗}: A PP relation involving large primes P and Q leads to an edge from P to Q, labeled with the relation. A FP relation involving a large prime P leads to an edge from P to ∗. Now cycles in the graph allow that large primes are canceled. A cycle involving ∗ always leads to a Full relation, and other cycles lead to a Full or an FP relation.

There are several variants of this idea. Below we discuss the variants which are relevant in the context of the present work (see also Remark 3.15 below). In all these variants, we represent the graph of large prime relations by adjacency lists.

Construction of an acyclic graph In this variant, first of all, Full relations are saved in the relation matrix. If one has an FP or a PP relation, one proceeds with a case distinction. One inserts a corresponding edge provided that it does not lead to a cycle. If however one would obtain a cycle in doing so, one does not insert the corresponding edge – the graph thus stays acyclic. Additionally, via the cycle one then tries to cancel large primes so that one obtains a Full relation or an FP relation. With these “combined” relations one proceeds as already indicated. Note here that one always obtains a Full relation if the cycle contains ∗ but otherwise one might obtain a Full or an FP relation. One terminates if one has obtained enough Full relations.

This variant is referred to as “full algorithm” in [GTTD07].

Note however that this approach does not fit into our general algorithm given above. Indeed, for an asymptotic analysis, generally speaking, it seems to be preferable to first construct a suitable tree with root ∗ and then to use this tree to obtain Full relations as follows:

Let us assume that a tree T has been constructed. Now one again generates relations. If one has a relation which only involves elements of the factor base or vertices from T, one can eliminate the vertices from T with the help of the tree to obtain a relation over the factor base.

Note that this approach fits into our general algorithm. It remains however the question how to construct such a tree, which we call a tree of large prime relations. We are aware of the following three possibilities.

Direct computation of a tree Here during the construction of the graph of large prime relations, one discards all relations which would lead to a component which is not connected to ∗, and one discards all relations which would lead to cycles. This means that at all times during the construction, the graph of large prime relations is already a tree.

An algorithm based on such a direct computation of a tree is given in [GTTD07]. It is called simplified algorithm, and it is used to obtain a proven result on the complexity of the computation of discrete logarithms in cyclic degree 0 class groups of hyperelliptic curves in imaginary quadratic representation.

Stage-wise computation of a tree In our applications, we want to control the depth of the tree, because we want to keep the relation matrix sparse. One possibility to do so is the following variant of the direct computation: One proceeds in “stages around ∗”. In the first stage, one considers only relations involving elements of the factor base and one large prime, that is, FP relations. This leads to a tree of depth one. After having found suitably many FP relations, one moves to the second stage. Here one considers only relations which contain one elements of the factor base, vertices of the first stage and one large prime. This leads to a tree of depth ≤ 2. Again, if the tree has enough vertices, one moves to the next stage. One continues in this manner, such that after the k^{th} step the depth of the tree is ≤ k and the tree has a predefined number of vertices.

Section 3.3, where we extend the results of [GTTD07] to arbitrary curves of a fixed genus, is based on this approach.

Computation of a tree from a graph Here one first constructs a suitably large graph. Then inside this graph one constructs a so-called shortest path tree inside this graph. This approach is for example taken in the work [Die06] by the author.

Remark 3.14 Above we suggested to construct a tree labeled with relations. Note that given an edge of the tree one can easily obtain a relation between the edge, factor base elements and the generating system. However, if one always immediately generates these relations, one does not need the tree at all; rather one just needs a list of relations involving one large prime each. A variant of the stage-wise computation following this approach was pursued by K. Nagao in [Nag04] (see also [AT06, subsubsection 3.2 c)] where a slightly different method is called “concentric circles method”).

Remark 3.15 Double large prime variation was originally suggested by A.K. Lenstra and M.S. Manasse as a practical improvement for factorization algorithms in [LM91] and [LM94]. (As noted in [LM94] the idea might however have been older.) Since then various works on practical aspects of double large prime variation, including for computations of discrete logarithms, appeared. In practical computations one faces severe storage problems if one tries to store all generated FP and PP relations in the RAM of a computer. Because of this, one usually proceeds as follows: First one stores a list of FP and PP relations and stores them on a hard drive. Then in several “filtering steps” (and using Hash-tables) one constructs a graph. For example, in [LM94] it was suggested to construct directly a breadth-first tree in the graph of large prime relations by reading the list of FP and PP relations over and over.

It was then realized by N. Thériault that for the solution of the discrete logarithm problem in hyperelliptic curves in imaginary quadratic representation of a fixed genus, one can obtain a decrease in the running time which is superpolynomial in the cardinality of the ground field (see [Thé03]). (Note however that the main results in [Thé03] are not proven but only argued heuristically.) Later, it was proven by P. Gaudry, E. Thomé, N. Thériault and the author that one can obtain a further superpolynomial decrease in the running time by using a double large prime variation, provided that the degree 0 class group of the curve is cyclic.

It is the superpolynomial decrease in the running time for discrete logarithm computation in degree 0 class groups of a fixed genus which is our motivation for investigation into this method. As we study in this work algorithms from an asymptotic point of view in formalized models, practical considerations as mentioned above are not relevant for the present work.

3.3 Index calculus with double large prime variation for curves of fixed genus

3.3.1 Introduction and results

In this section we present an index calculus algorithm with double large prime variation for curves of a fixed genus g. The input of the algorithm consists of a tuple (C/𝔽_{q}, a, b), where C is a curve of genus g over 𝔽_{q}, a, b ∈ Cl^{0}(C) and b ∈ ⟨a⟩. The representation of the input follows Chapter 2: The curve is represented by a plane model, a divisor D_{0} of degree 1 is fixed and a, b are represented by along D_{0} reduced divisors which in turn is given by any of the possibilities described in Chapter 2.

Additionally, we fix some number d_{max} and demand that the curve C is represented by a plane model of degree ≤ d_{max}. Note that by Proposition 2.6 such a number d_{max} exists. We also fix an upper bound on the height of the divisor D_{0}.

On the basis of our algorithm, we obtain the following result.

Theorem 1 Let some natural number g ≥ 2 be fixed. Then the discrete logarithm problem in the degree 0 class groups of curves of genus g over finite fields can with a randomized algorithm be solved in an expected time of

Õ(q^{2− \frac{2}{g}}) ,

where 𝔽_{q} is the ground field of the curve.

We remark that the algorithm has storage requirements of Õ(q^{1− \frac{1}{g} + \frac{1}{g^{2}}} ). More concretely, although the algorithm is randomized, there exists a function in Õ(q^{1− \frac{1}{g} + \frac{1}{g^{2}}} ) such that the storage requirements are bounded by this function for every run.

For hyperelliptic curves in imaginary quadratic representation such that the degree 0 class group is cyclic or a basis of the group is known, the result was already obtained in [GTTD07]. As already mentioned in subsubsection 3.2.6.2 the result in [GTTD07] is proven with an algorithm which follows the strategy of “direct computation of a tree”. With minor modifications, this algorithm also applies to arbitrary curves, and on a heuristic basis, the “simplified algorithm” leads to the result in Theorem 1.

On the proof of Theorem 1

We now give an outline of the proof of Theorem 1.

First we give an index calculus algorithm with double large prime variation which gives rise to the following proposition.

Proposition 3.16 Let us fix some g ≥ 2. Then there exists a randomized algorithm such that the following holds: Upon input of a curve C/𝔽_{q}, elements a, b ∈ Cl^{0}(C) with b ∈ ⟨a⟩ and a generating system c_{1}, …, c_{u} whose size is polynomially bounded in log(q), the algorithm outputs the discrete logarithm of b to with respect to a. The expected running time of the algorithm is in Õ(q^{2− \frac{2}{g}}). Moreover, the algorithm has storage requirements of Õ(q^{1− \frac{1}{g} + \frac{1}{g^{2}}} ). More precisely, the algorithm uses only the first Õ(q^{1− \frac{1}{g} + \frac{1}{g^{2}}} ) registers for LOAD and STORE operations, and each register always contains elements whose bit-length is polynomially bounded in log(q).

The algorithm is given in the next subsection and the analysis in subsection 3.3.3.

Then we show the that there is an efficient algorithm which outputs a small system of divisor classes of degree 0 which generates the degree 0 class group with high probability (see subsection 3.3.5):

Proposition 3.17 Let us fix some g ≥ 1. Then there exists a randomized algorithm such that the following holds: Upon input of a curve C/𝔽_{q} (as always represented by a plane model of degree ≤ d_{max}) and a divisor D_{0} of degree 1 and height polynomially bounded in log(q), the algorithm computes a system of random elements c_{1}, …, c_{u} of Cl^{0}(C), represented by along D_{0} reduced divisors, where u := eℓ with e := ⌈log_{2}(# Cl^{0}(C))⌉ and ℓ := ⌈log_{2}(e)+1⌉. Moreover, expected running time is polynomially bounded in d and log(q), and with a probability ≥ \frac{1}{2}, the system c_{1}, …, c_{u} is a generating system of Cl^{0}(C).

A problem is however that we do not know how one can in a sufficiently efficient way certify that the output is indeed a generating system. As a work-around, we proceed as follows: We assume that we have a generating system and apply the index calculus algorithm. We stop the computation if it has not terminated within a predefined time.

An obvious consequence of Proposition 3.16 is:

Proposition 3.18 Let us fix some g ≥ 2. Then there exists a randomized algorithm such that the following holds: Upon input of a curve C/𝔽_{q}, elements a, b ∈ Cl^{0}(C) with b ∈ ⟨a⟩ and a system c_{1}, …, c_{u} of elements in Cl^{0}(C) with u polynomially bounded in log(q), the algorithm either fails or outputs the discrete logarithm of b with respect to a. The running time of the algorithm is in Õ(q^{2− \frac{2}{g}}), and if c_{1}, …, c_{u} is a generating system, the probability of failure is ≤ \frac{1}{2}. The algorithm has storage requirements of

Õ(q^{1− \frac{1}{g} + \frac{1}{g^{2}}} ).

Indeed, let us fix a bit-RAM Π satisfying the claim in Proposition 3.16, and let δ > 0 such that the bit-RAM terminates in an expected time of q^{2− \frac{2}{g}} · log(q)^{δ} if applied to an instance as in Proposition 3.16. We apply this bit-RAM with the input of Proposition 3.18 and terminate the execution if a time of ⌈2 · q^{2− \frac{2}{g}} · log(q)^{δ}⌉ is exceeded – provided the algorithm has not terminated at this point in time. (For this we “mix” the Turing machines for the commands with “control units” which measure the running times and terminate if necessary, and we mix Π with similar “control units”.) By Markov’s bound we have: If c_{1}, …, c_{u} is a generating system, with a probability of ≥ \frac{1}{2}, the algorithm outputs the discrete logarithm of b with respect to a.

Note here that just from the statement on the running time we cannot conclude that we indeed the running time is in Õ(q^{2− \frac{2}{g}}). It has to be ruled out that very expensive LOAD and STORE operations are performed, commands whose running time is not in Õ(q^{2− \frac{2}{g}}). However, as stated in 3.16 every LOAD and STORE command is executed in a time which is polynomially bounded in log(q). □

The proof of Theorem 1 is now easy:

So let g ≥ 2 be fixed. Now given an instance (C, a, b) with g(C) = g as described above, we proceed as follows: First we apply an algorithm for which Proposition 3.17 holds; let the result be c_{1}, …, c_{u}. Then we apply an algorithm for which Proposition 3.18 holds to C, a, b and the system c_{1}, …, c_{u}. The expected running time is then in O(q^{2− \frac{2}{g}}), and moreover, the probability of failure is ≤ \frac{3}{4}. This implies Theorem 1. □

3.3.2 The index calculus algorithm

Let g ≥ 2 be fixed. We now describe the index calculus algorithm which leads to Proposition 3.16. As already stated, the algorithm uses double large prime variation. We do so by computing a tree of large prime relations. The main challenge resides in controlling the growth of the tree of large prime relations as well as its depth, that is, the maximal distance of any vertex to the root. This task is more difficult than for hyperelliptic curves in imaginary quadratic representation, where one has a concrete description of the effective divisors which are reduced along the point at infinity, and one knows that the growth process is very regular.

In the algorithm below we employ the strategy of “stage-wise computation of a tree” in subsubsection 3.2.6.2. The reason why we adopt this strategy is that it is then immediate that the depth of the tree (not only the expected value of the depth) lies in O(log(q)).

The algorithm is a realization of the “general algorithm” of the previous section. It therefore relies on subroutines for a) computation of the group order, b) factorization, c) generation of a factor base and precomputation as well as d) relation generation, e) linear algebra. Algorithms for factorization and for linear algebra where already discussed above.

We now outline procedures for a), c) and d) which lead to Proposition 3.16.

a) Computation of the group order

The L-polynomial of a curve over 𝔽_{q} given by a plane model of bounded degree can be computed (with a deterministic algorithm) in a time which is polynomially bounded in log(q). (This follows from [Pil91, Theorem H] which in turn relies on Pila’s extension of the point counting algorithm by Schoof ([Sch85]) to abelian varieties ([Pil90]).) This means in particular that the order of the degree 0 class group can be computed in polynomial time in log(q).

In the following description as well in the analysis of subroutine c) and d) in the next subsection, we implicitly assume that certain lower bounds on q are satisfied. In the analysis in the next subsection, we then state further lower bounds which have to be satisfied in order that the analysis holds. If these bounds are not satisfied, the algorithm might fail (it might stop without a result or not terminate in finite expected time). Note that the number of isomorphism classes of curves for which the algorithm fails is finite. As usual, one obtains an algorithm which always terminates in a finite expected time by running the algorithm “in parallel” with a brute-force computation.

c) Construction of the factor base and the graph of large prime relations

Let an instance as described in Proposition 3.16 be given: Let C be a curve of genus g over 𝔽_{q}, let a, b ∈ Cl^{0}(C), and let c_{1}, …, c_{u} be a generating system of Cl^{0}(C). Moreover, let N := # Cl^{0}(C). As usual, let C be given by a plane model which in turn is given by a homogeneous polynomial F (X, Y, Z) ∈ 𝔽_{q}[X, Y, Z].

In the procedure, a point P_{0} ∈ C(𝔽_{q}) is fixed and divisor classes are represented by along P_{0} reduced divisors. The procedure uses a factor base F = \{F_{1}, F_{2}, …\} ⊆ C(𝔽_{q}) − \{P_{0}\} of size ⌈q^{1− \frac{1}{g}} ⌉, and the set of large primes is L := C(𝔽_{q}) − (F ∪ {P_{0}}).

Construction of the factor base We first enumerate the points in C(𝔽_{q}). Then we fix a point P_{0} (if such a point exists) and an enumerated factor base F ⊆ C(𝔽_{q}) − \{P_{0}\} of size ⌈q^{1− \frac{1}{g}} ⌉ (if this is possible).

The tree of large prime relations We construct a tree of large prime relations whose vertex set is contained in L ˙∪ {∗}.

In the following, we always represent divisor classes by along P_{0} reduced divisors in free ideal representation. We therefore change the representation of the divisor classes a, b, c_{1}, …, c_{u} from along D_{0} to along P_{0} reduced divisors.

Then we proceed as follows: We repeatedly choose uniformly randomly s_{1}, …, s_{u} ∈ ℤ/Nℤ and compute the along P_{0} reduced effective divisor D in free representation with

[D] − deg(D) · [P_{0}] = ∑_{j=1}^{u} s_{j} c_{j} ,  (3.8)

where P_{0} ∈ C(𝔽_{q}) is the point computed above. (As stated, P_{0} takes the role of D_{1} in the “general algorithm”.)^{5}^{,}^{6} Note that by Proposition 2.117 and the representation of the curve by a plane model of bounded degree, the computation of D is possible in an expected time which is polynomially bounded in log(q).

As already mentioned, we construct the tree in stages, and during each stage we only attach edges to the tree which are connected to vertices constructed in the previous stage. In Stage 1, we attach ⌈q^{1−1/g}⌉ edges coming from FP relations to the root ∗. Thereafter, we terminate Stage s and start Stage s + 1 whenever the tree has 2^{s−1} · ⌈q^{1−1/g}⌉ edges.

The construction of the tree is abandoned if a predefined number of edges N_{max} is reached. We could for example set N_{max} := ⌈q/4⌉. We will however argue in the analysis of the algorithm in the next subsection that N_{max} := ⌈q^{1−1/g+1/g^{2}}⌉ suffices. This smaller value of N_{max} only lowers the time for the construction of the tree by a constant factor but decreases the storage requirements substantially. This is analogous to the situation in [GTTD07].

Let us fix this notation.

Notation 3.19 The set of vertices of a tree T is also denoted by T.

Altogether, we have the following procedure for construction of a suitable tree of large prime relations. In the procedure we construct a labeled tree called T. The edges of the tree are labeled with the corresponding relations; the vertices are labeled too, namely with the stage at which they inserted into the tree. We denote the subtree of T which has been constructed until (including) stage s by T_{s}. With other words: A vertex of T occurs in T_{s} if and only if its label is ≤ s.

5Note here that by the fixed representation of divisor classes, to compute the divisor D is the same as computing the sum ∑_{j=1}^{u} s_{j} c_{j} in the degree 0 class group.

6As usual, we apply the command RAND to choose the s_{i}. (Such that these elements are chosen independently of each other.)

Procedure: Construction of the tree of large prime relations

Construct a tree T with vertex set contained in L ˙∪ {∗} as follows: Let T consist only of the root ∗. Let N_{max} ⟵ ⌈q^{1−1/g+1/g^{2}}⌉ Let s ⟵ 1. Repeat

Repeat Choose s_{1}, …, s_{u} ∈ ℤ/Nℤ uniformly and independently at random. Compute the along P_{0} reduced divisor D in free representation with [D] − deg(D) · [P_{0}] = ∑_{j} s_{j}c_{j}. If D splits as D = ∑_{j} r_{j}F_{j} + c_{P} P + c_{Q}Q where c_{P} > 0, c_{Q} > 0

and P ∈ F ∪ T_{s−1} and Q ∈ L − (F ∪ T), if P ∈ F (i.e. if we have an FP relation),

insert Q and an edge from ∗ to Q into T if P ∈ T_{s−1} (i.e. if we have a PP relation),

insert Q and an edge from P to Q into T. In both cases label Q with s and the edge with (r_{j})_{j} (in sparse representation).

Until T contains min{2^{s−1} · ⌈q^{1−1/g}⌉, N_{max}} edges.

If the number of edges equals N_{max}, STOP.

Let s ⟵ s + 1.

This construction of the tree guarantees that the depth of the tree is always in O(log(q)) (see also inequality (3.15) in the next subsection). The main difficulty of the analysis of the procedure resides in proving that a tree of sufficient size can be constructed in an expected time of Õ(q^{2−2/g}). This is verified in the next subsection.

d) Relation generation

We come to the relation generation procedure. Recall that we have the following specification of the relation generation procedure: If applied to a result of the procedure for generation of the factor base and precomputation as well as an element g ∈ Cl^{0}(C), it should output vectors (r_{j})_{j} and (s_{j})_{j} over ℤ/Nℤ defining a relation

∑_{j} r_{j}[F_{j}] − (∑_{j} r_{j} deg(F_{j})) · [P_{0}] = ∑_{j} s_{j}c_{j} + c .  (3.9)

So let us assume that the factor base has been chosen and a tree of large prime relations T as above has been constructed, and let g ∈ Cl^{0}(C). Then we repeatedly choose s_{1}, …, s_{u} uniformly at random and compute the along P_{0} reduced divisor D in free representation such that

[D] − deg(D) · [P_{0}] = ∑_{j=1}^{u} s_{i} c_{j} + c ,  (3.10)

until D splits over F ∪ T. If this is the case, we use the tree to substitute the large primes involved. Like this we obtain a Full relation. We output this relation.

3.3.3 Analysis of the index calculus algorithm

We now show that with the subroutines described above, one can with the “general algorithm” given in subsection 3.2.3 compute a solution to the discrete logarithm problem in an expected time of Õ(q^{2−2/g}) (as always for fixed genus g ≥ 2, and moreover if the size of the generating system is polynomially bounded in log(q)).

Steps 1 and 2 – computation of the group order and factorization, setting up of the ideal representation

We have already argued that one can perform these steps in an expected time of L_{q}[\frac{1}{2}, 1 + o(1)]. Therefore, these steps are not time critical.

Step 3 – construction of the factor base and the tree of large prime relations

Construction of the factor base One can iterate over all points of C(𝔽_{q}) in an expected time of Õ(q) as follows: Let us assume wlog. that the covering x : C ⟶ ℙ_{𝔽_{q}}^{1} is separable. (Thus in Step 2 of the “general algorithm”, this covering is considered.) Then using the ideal representation, we proceed as follows: We iterate over all points of ℙ^{1}(𝔽_{q}), and for each such point P we consider its preimage x^{−1}(P) in C (a trivial operation in joint ideal representation). We compute the free representation of x^{−1}(P), which is possible in an expected time which is polynomially bounded in log(q) by Proposition 2.86.

In particular, we can find a point P_{0} (if such a point exists) and an appropriate factor base in an expected time of Õ(q).

Construction of the tree of large prime relations We come to the analysis of the growth of the tree of large prime relations. The analysis relies crucially on the following proposition.

Proposition 3.20 For curves of fixed genus g over finite fields 𝔽_{q}, the number of special effective divisors of degree g is in O(q^{g−1}).

Recall that an effective divisor D is called special if the linear system |K −D| is non-empty, where K is a canonical divisor. Note that by the Riemann-Roch theorem, an effective divisor of degree g is non-special if and only if it is the only if the linear system |D| merely contains D itself.

Note that map D ↦ [D] gives an injection from the set of non-special divisors of degree g into the set of divisor classes of degree g, and therefore, the map D ↦ [D −P_{0}] gives an injection from the set of non-special divisors of degree g into the degree 0 divisor class group. Then we can apply the bijection between the degree 0 class group and the set of along P_{0} reduced divisors.

Explicitly, let D be a non-special effective divisor of degree g, and let D′ be the unique effective divisor of minimal degree with D′ + (deg(D) − deg(D′)) · P_{0} = D. Then D′ is reduced along P_{0}, and it is the along P_{0} reduced divisor which represents the class [D].

We assume that Proposition 3.20 is well known to many experts in curves and function fields. For the lack of a suitable reference we give a proof in the next subsection. Note that a straightforward application of the Hasse-Weil bound merely gives that the number in question is in O(q^{q−1/2}).

This proposition makes it possible to discard all special divisors in the analysis of the construction of the tree of large prime relations.

Let C > 0 be such that for all curves of genus g over any finite fields 𝔽_{q} the number of special divisors of degree g is ≤ C · q^{g−1}.

As in the previous subsection, let N_{max} := ⌈q^{1−1/g+1/g^{2}}⌉ be the number of edges (that is, the number of vertices different from ∗) at which the construction of the tree is stopped.

The conditions

N_{max} + #F ≤ q/4  #(C(𝔽_{q}) − \{P_{0}\}) ∈ [max\{q^{1− \frac{1}{g}} , q/2\}, 2q]
# Cl^{0}(C) ≤ 2q^{g}  q ≥ (4 · g! · C)^{g}

hold for q ≫ 0, that is, for q large enough; we assume that they are satisfied.

Note that by our assumption that c_{1}, …, c_{u} generate Cl^{0}(C), if s_{1}, …, s_{u} are uniformly distributed random elements from ℤ/Nℤ, ∑_{i} s_{i}c_{i} is uniformly distributed in Cl^{0}(C). This means that the divisor D in (3.8) is uniformly distributed in the set of all effective divisors which are reduced along P_{0}.

By our assumptions on q, we always have

#(C(𝔽_{q}) − (T ∪ F ∪ {P_{0}}) ≥ q/2 − q/4 = q/4 .  (3.11)

Let Div^{g}(C) be the set of effective divisors of degree g on C, and let Div^{g,ns}(C) (resp. Div^{g,s}(C)) be the subset of non-special (resp. special) effective divisors of degree g.

Let us first assume that we are still in Stage 1, that is, only relations with one large prime (not yet in the tree) are considered.

Let us thus assume we are given the tree T with < ⌈q^{1−1/g}⌉ edges. We want to bound the expected number of relations (3.8) needed until a new edge is inserted into the tree.

Let

\begin{matrix}D := \{P_{1} + ⋯ + P_{g} ∈ Div^{g}(C) | ∀i = 1, …, g − 1 : P_{i} ∈ F, \\ P_{g} ∈ C(𝔽_{q}) − (T ∪ F ∪ \{P_{0}\})\} , \end{matrix}

D^{ns} := D ∩ Div^{g,ns}(C) .

Note that any divisor D ∈ D^{ns} is reduced along P_{0} (because P_{0} is not contained in the support of D and the linear system |D| consists merely of D). If a divisor D = P_{1}+⋯+P_{g} as in the set D^{ns} appears in a relation (3.8), a new edge is inserted into the tree. (Other divisors might also lead to new edges: We ignore FP relations which involve a larger multiple of the large prime, we ignore non-special divisors, and we ignore divisors of degree < g.)

We have

\begin{matrix}#D = \binom{#F+g−2}{g−1} · #(C(𝔽_{q}) − (T ∪ F ∪ \{P_{0}\})) ≥ \frac{#F^{g−1}}{(g−1)!} · q/4 by (3.11) \\ ≥ \frac{1}{4(g−1)!} · q^{\frac{(g−1)^{2}}{g}} · q = \frac{1}{4(g−1)!} · q^{\frac{g^{2}−g+1}{g}} = \frac{1}{4(g−1)!} · q^{g−1+ \frac{1}{g}} . \end{matrix}

(3.12)

By our assumption that q ≥ (4 · g! · C)^{g}, we have

# Div^{g,s}(C) ≤ Cq^{g−1} ≤ \frac{1}{4g!} · q^{g−1+ \frac{1}{g}} ≤ \frac{1}{8(g − 1)!} · q^{g−1+ \frac{1}{g}} .  (3.13)

Inequalities (3.12) and (3.13) imply

#D^{ns} ≥ \frac{1}{8(g − 1)!} · q^{g−1+ \frac{1}{g}} .

Together with our assumption that # Cl^{0}(C) ≤ 2q^{g}, this implies that the probability that a relation (3.8) enlarges the tree is

≥ \frac{#D^{ns}}{# Cl^{0}(C)} ≥ \frac{1}{16(g − 1)!} · q^{−(1− \frac{1}{g})} .

The expected number of relations (3.8) which have to be considered until the tree is enlarged is thus

≤ 16(g − 1)! · q^{1− \frac{1}{g}} .

This implies that the expected number of tries until the tree has ⌈q^{1− \frac{1}{g}} ⌉ edges is

≤ 16(g − 1)! · q^{1− \frac{1}{g}} · ⌈q^{1− \frac{1}{g}} ⌉ ≤ 16(g − 1)! · (q + 1)^{2− \frac{2}{g}} .

We now assume that s ≥ 2 and a tree T with < 2^{s−1} · ⌈q^{1−1/g}⌉ edges containing a subtree T_{s−1} with 2^{s−2} · ⌈q^{1−1/g}⌉ edges, has already been constructed. The task is again to derive a bound on the expected number of relations (3.8) needed until the tree is enlarged.

Similarly to above, let

\begin{matrix}D := \{P_{1} + ⋯ + P_{g} ∈ Div^{g}(C)| ∀i = 1, …, g − 2 : P_{i} ∈ F, \\ P_{g−1} ∈ F ∪ T_{s−1}, P_{g} ∈ C(𝔽_{q}) − (T ∪ F ∪ \{P_{0}\})\} , \end{matrix}

D^{ns} := D ∩ Div^{g,ns}(C) .

We now have

#D = (\binom{#F+g−2}{g−1} + \binom{#F+g−3}{g−2} · #(T_{s−1} − \{∗\})) · #(C(𝔽_{q}) − (T ∪ F ∪ \{P_{0}\}))

≥ (\frac{#F^{g−1}}{(g−1)!} + \frac{#F^{g−2}}{(g−2)!} · 2^{s−2} · q^{1−1/g}) · q/4
≥ (\frac{1}{(g−1)!} · q^{\frac{(g−1)^{2}}{g}} + \frac{1}{(g−2)!} · 2^{s−2} · q^{\frac{(g−1)^{2}}{g}}) · q/4
= (\frac{1}{4(g−1)!} + \frac{1}{4(g−2)!} · 2^{s−2}) · q^{g−1+ \frac{1}{g}} .

(3.14)

Together with (3.13), this implies

#D^{ns} ≥ \frac{1}{4(g − 2)!} · 2^{s−2} · q^{g−1+ \frac{1}{g}} .

This implies that the probability that a relation (3.8) enlarges the tree is

≥ \frac{1}{8(g − 2)!} · 2^{s−2} · q^{−(1− \frac{1}{g})} .

The expected number of relations (3.8) which have to be considered until the tree is enlarged is thus

≤ 8(g − 2)! · \frac{1}{2^{s−2}} · q^{1− \frac{1}{g}} .

This implies that given any tree T_{s−1} with 2^{s−2} · ⌈q^{1− \frac{1}{g}} ⌉ edges, the expected number of tries until a tree T with min\{2^{s−1} · ⌈q^{1− \frac{1}{g}} ⌉, N_{max}\} edges is constructed is

≤ 16(g − 2)! · (q + 1)^{2− \frac{2}{g}} .

We have s ∈ O(log(q)) as can be easily be seen: During the execution of the procedure we always have for s ≥ 2

2q ≥ #(T − \{∗\}) ≥ #(T_{s−1} − \{∗\}) = 2^{s−2} · ⌈q^{1− \frac{1}{g}} ⌉ ,

i.e.

s ≤ log_{2}(q^{\frac{1}{g}}) + 3 = \frac{1}{log(2) · g} · log(q) + 3 ∈ O(log(q)) .  (3.15)

It follows that in total an expected number of O(log(q) · q^{2− \frac{2}{g}}) relations (3.8) have to be considered until the tree has N_{max} edges. As each of these relations can be obtained in an expected time which is polynomially bounded in log(q), we conclude that a tree with N_{max} edges can be constructed in an expected time of

Õ(q^{2− \frac{2}{g}}) .

Note that the depth of the tree is always bounded by s. In particular, as s ∈ O(log(q)), the depth of the tree is also in O(log(q)).

Step 4 – relation generation

We now assume we have constructed a tree T with N_{max} = ⌈q^{1− \frac{1}{g} + \frac{1}{g^{2}}} ⌉ edges. Similarly to above let

D := {P_{1} + ⋯ + P_{g} ∈ Div^{g}(C)| ∀i = 1, …, g : P_{i} ∈ F ∪ (T − {∗})} ,

D^{ns} := D ∩ D^{g,ns} .

Then D contains ≥ \frac{1}{g!} · (#F + #(T − \{∗\}))^{g} ≥ \frac{1}{g!} · q^{g−1+ \frac{1}{g}} elements. By the

first two inequalities of (3.13), D^{ns} contains at least \frac{3}{4g!} · q^{g−1+ \frac{1}{g}} elements. This means that the probability that the divisor D in relation (3.8) splits into elements of the factor base or vertices of the tree is

≥ \frac{3}{8g!} · q^{−(1− \frac{1}{g})} .

The expected number of relations (3.10) which have to be considered in each call to the relation generation procedure is therefore in O(q^{1− \frac{1}{g}}). As each relation (3.10) can be obtained in an expected time which is polynomially bounded in log(q^{g}), this means that the expected running time of the relation generation procedure is in Õ(q^{1− \frac{1}{g}}).

In the relation generation part of the algorithm (Step 4 of the general algorithm), we have to generate Õ(#F) = Õ(q^{1− \frac{1}{g}}) “combined” Full relations. This means that the total running time of this step of the algorithm is in Õ(q^{2− \frac{2}{g}}).

Step 5 – linear algebra

The linear algebra takes place on a sparse matrix with Õ(q^{1−1/g}) rows and O(q^{1−1/g}) columns.

As the tree has depth O(log(q)) and the size of the generating system is by assumption polynomially bounded in log(q), every row of the matrix (R|S) contains only Poly(log(q)) non-zero entries. By Proposition 3.8, the computation can then be performed in an expected time of Õ(q^{2−2/g}).

Final result

We have seen that Steps 1 – 5 of the algorithm all have an expected running time of Õ(q^{2− \frac{2}{g}}). Moreover, we have argued in subsection 3.2.4 that after an expected number of O(log log(N)) ⊆ O(log(q)) restarts of the computation of the matrix (R|S), the linear algebra computation leads the solution to the discrete logarithm problem. This means that the total running time is in

Õ(q^{2− \frac{2}{g}}) ,

in accordance with the statement in Proposition 3.16.

Storage requirements

Clearly there exists a function in Õ(q^{1− \frac{1}{g} + \frac{1}{g^{2}}} ) such that the storage requirements for the tree are bounded by this function for every run of the algorithm.

The storage requirements for the matrix are (for every run of the algorithm) bounded by a function in Õ(q^{1− \frac{1}{g}}). Note again that this is the case because we restart the construction of the matrix every time the linear algebra computation fails instead of inserting a new row.

3.3.4 On the number of special divisors

The purpose of this subsection is to prove Proposition 3.20.

We consider curves of a fixed genus g over finite fields.

Let C be such a curve over 𝔽_{q}. Let Div^{g}(C) be the set of effective divisors of degree g on C, and let D_{0} be an divisor of degree g on C. We have the surjective map Div^{g}(C) ⟶ Cl^{0}(C), D ↦ [D] − [D_{0}]. Note that the set of special divisors of degree g is exactly the subset of Div^{g}(C) where the map to Cl^{0}(C) is not injective.

The number of special divisors is therefore bounded from above by 2 (# Div^{g}(C)−# Cl^{0}(C)), and it suffices to prove that # Div^{g}(C)−# Cl^{0}(C) ∈ O(q^{g−1}).

We follow the exposition to the zeta-function in [Sti93]. Note however that we use different symbols for the indices.

Let L = ∏_{i=1}^{2g}(1 − α_{i}t) ∈ ℂ(t) be the L-polynomial of C, let A_{n} be the number of effective divisors of degree n, let B_{n} be the number of prime divisors of degree n on C, and let^{7}

S_{n} := ∑_{i=1}^{2g} α_{i}^{n} .

As the α_{i} can be arranged such that α_{i}α_{g+i} = q for all i = 1, …, g, we have

# Cl^{0}(C) = L(1) ∈ q^{g} − S_{1} · q^{g−1} + O(q^{g−1}) .

We thus have to show that

A_{g} ∈ q^{g} − S_{1} · q^{g−1} + O(q^{g−1}) .

We will in fact show the more general statement

A_{n} ∈ q^{n} − S_{1} · q^{n−1} + O(q^{n−1})  (3.16)

for any fixed n ∈ ℕ.

Let us fix the following definition.

Definition 3.21 Let D be an effective divisor of degree n on C such that D = ∑_{ℓ=1}^{n} D_{ℓ}, where D_{ℓ} is a sum of e_{ℓ} prime divisors of degree ℓ. Then the vector \underline{e} = (e_{ℓ})_{ℓ} ∈ ℕ_{0}^{n} (with ∑_{ℓ} ℓe_{ℓ} = n) is called the decomposition type of D.

By sorting effective divisors of degree n by decomposition types, we obtain

A_{n} = ∑_{\underline{e}} ∏_{ℓ} \binom{B_{ℓ} + e_{ℓ} − 1}{e_{ℓ}} ,  (3.17)

where the sum runs over all \underline{e} ∈ ℕ_{0}^{n} with ∑_{ℓ} e_{ℓ}ℓ = n and the products run over ℓ ∈ {1, … n}. We have

A_{1} = B_{1} = q + 1 − S_{1} ,

7The definition of S_{n} follows Equation (2.25) in [Sti93]. In [Sti93, Corollary V.1.17] an analogous definition is made with opposite sign.

which establishes the claim for n = 1. So let n ≥ 2. By [Sti93, Proposition V.2.9], we have

\begin{aligned}B_{ℓ} = \frac{1}{ℓ} · ∑_{m|ℓ} μ(\frac{ℓ}{m})(q^{m} − S_{m}) & ∈ \frac{1}{ℓ} · q^{ℓ} + O(q^{ℓ/2}) \\ & ⊆ \frac{1}{ℓ} · q^{ℓ} + O(q^{ℓ−1}) \end{aligned}  (3.18)

for ℓ ≥ 2.

This implies that

\begin{aligned}A_{n} & ∈ ∑_{\underline{e}} \frac{1}{e_{1}!}(q − S_{1})^{e_{1}} · ∏_{ℓ≥2} \frac{1}{e_{ℓ}!} · \frac{1}{ℓ^{e_{ℓ}}} · q^{ℓ·e_{ℓ}} + O(q^{n−1}) \\ & ⊆ ∑_{\underline{e}}(∏_{ℓ} \frac{1}{e_{ℓ}!} · \frac{1}{ℓ^{e_{ℓ}}}) · (q^{n} − e_{1} · S_{1} · q^{n−1}) + O(q^{n−1}) . \end{aligned}

In order to derive (3.16) it remains to be shown that

∑_{\underline{e}} ∏_{ℓ} \frac{1}{e_{ℓ}!} · \frac{1}{ℓ^{e_{ℓ}}} = 1  (3.19)

and

∑_{\underline{e}} e_{1} · ∏_{ℓ} \frac{1}{e_{ℓ}!} · \frac{1}{ℓ^{e_{ℓ}}} = 1 .  (3.20)

Equation (3.19) is equivalent to

∑_{\underline{e}} ∏_{ℓ} \frac{n!}{e_{ℓ}!} · \frac{1}{ℓ^{e_{ℓ}}} = n! .  (3.21)

This is true because for any \underline{e} ∈ ℕ_{0}^{n} with ∑_{ℓ} e_{ℓ}ℓ = n, the set of permutations on n elements having exactly e_{ℓ} ℓ-cycles (for ℓ = 1, …, n) has ∏_{ℓ} \frac{n!}{e_{ℓ}!} · \frac{1}{ℓ^{e_{ℓ}}} elements.

We come to Equation (3.20). Note that we have a bijection

\begin{matrix}\{\underline{e} ∈ ℕ_{0}^{n}| ∑_{ℓ} e_{ℓ}ℓ = n, e_{1} ≠ 0\} & ⟶ & \{\underline{e}′ ∈ ℕ_{0}^{n−1}| ∑_{ℓ} e′_{ℓ}ℓ = n − 1\} , \\ \underline{e} & ↦ & \underline{e}′ \end{matrix}

with e′_{1} = e_{1} − 1 and e′_{i} = e_{i} for all i = 1, …, n − 1.

Equation (3.20) is then equivalent to

∑_{\underline{e}′} ∏_{ℓ} \frac{1}{e′_{ℓ}!} · \frac{1}{ℓ^{e′_{ℓ}}} = 1 ,  (3.22)

where the sum runs over all \underline{e}′ ∈ ℕ_{0}^{n−1} with ∑_{ℓ} e′_{ℓ}ℓ = n−1 and the products run over ℓ ∈ {1, …, n − 1}. We already know that this equation is true.

3.3.5 Finding a generating system

The main purpose of this subsection is to show Proposition 3.17. Note that in Proposition 3.17 we only consider curves of a fixed genus, represented by plane models of bounded degree. In this subsection, we consider arbitrary curves over finite fields. We show below how one can efficiently compute a small system of degree 0 divisor classes which with a probability ≥ \frac{1}{2} generates the degree 0 class group, provided the L-polynomial is known (see Proposition 3.29). Proposition 3.17 follows from this statement and the fact – already mentioned in subsection 3.3.2 –, that one can then compute the L-polynomial in a time which is polynomially bounded in log(q) ([Pil90], [Pil91]). On our way to prove Proposition 3.29, we also show how one can efficiently compute uniformly randomly generated divisors of a specific degree, provided one knows the L-polynomial, a result which might be of independent interest (see Proposition 3.28).

As usual, curves are represented by plane models, and divisors are given in ideal representation.

Proposition 3.22 Given a curve C over a finite field 𝔽_{q}, represented by a plane model of degree d, and a natural number n one can with a randomized algorithm

• decide if C has an 𝔽_{q}-rational point

• if this is the case compute such a point which is uniformly randomly distributed in C(𝔽_{q})

in an expected time which is polynomially bounded in d and log(q).

Proof. As in subsection 2.5.4, we assume that the covering x_{|C} : C ⟶ ℙ_{𝔽_{q}}^{1} is separable. As usual we set r := deg(x_{|C}).

By the Hasse-Weil bound, we have #C(𝔽_{q}) ≥ q + 1 − 2gq^{1/2}. This means that for q ≥ 4g^{2}, C(𝔽_{q}) is non-empty. The algorithm depends on a case distinction:

If q < d^{4} we compute a list of the elements in C(𝔽_{q}) by iterating over all elements P of ℙ^{1}(𝔽_{q}) and computing for each such P the divisor x_{|C}^{−1}(P) in free representation. If it turns out that C(𝔽_{q}) is empty, we output that this is the case, otherwise we choose one of the points in C(𝔽_{q}) uniformly at random. We have already argued in subsection 3.3.3 that this computation can be performed in an expected time which is polynomially bounded in d and q, that is, in an expected time which is polynomially bounded in d as q is also polynomially bounded in d by assumption.

If q ≥ d^{4} (such that q > 4g^{2} and therefore C(𝔽) ≠ ∅), we proceed with the following algorithm.

Algorithm for computation of a uniformly randomly distributed rational point on a curve over a finite field

Input: A curve C, represented by a plane model.

1. Choose a point P ∈ ℙ^{1}(𝔽_{q}) uniformly at random.

2. Compute x^{−1}(P) in free representation.

3. Let P_{1}, …, P_{a} be the distinct 𝔽_{q}-rational points occurring in x^{−1}(P).

(The other prime divisors in the support of x^{−1}(P) are ignored, and a = 0 is possible.)

4. Choose a number i in {1, …, r} uniformly at random.

5. If i ≤ a, output P_{i}, otherwise go back to Step 1.

Without any assumption on q and g, this algorithm computes a uniformly randomly distributed point in C(𝔽_{q}) provided that this set is non-empty, as we show now.

The computation of Steps 1 – 5 can be performed in an expected time which is polynomially bounded in d and log(q) (see in particular Proposition 2.86).

Let us analyze the algorithm: After Step 4 the following always holds: The random variable (P, i) is uniformly distributed on the set ℙ^{1}(𝔽_{q}) × {1, …, r}, which has (q + 1) · r elements. This means that in every iteration of the algorithm, the probability that the algorithm terminates in Step 5 is always \frac{#C(𝔽_{q})}{(q+1)·r}, and if this is the case, every point in C(𝔽_{q}) is chosen with the same probability of \frac{1}{#C(𝔽_{q})}.

It follows that the output of the algorithm is a uniformly randomly distributed element in C(𝔽_{q}). Moreover, the expected number of iterations is \frac{(q+1)·r}{#C(𝔽_{q})}. In order to prove the proposition, we therefore have to show that the quantity \frac{q+1}{#C(𝔽_{q})} is polynomially bounded in d and log(q); we show that it is polynomially bounded in g (which in turn is polynomially bounded in d).

We have #C(𝔽_{q}) ≥ q +1−2gq^{1/2} by the Hasse-Weil bound. For q ≥ 16g^{2} we have #C(𝔽_{q}) ≥ \frac{q}{2} + 1, and therefore \frac{q+1}{#C(𝔽_{q})} ≤ 2. On the other hand, for q < 16g^{2} the quantity \frac{q+1}{#C(𝔽_{q})} is clearly polynomially bounded in g. □

Proposition 3.23 Given a curve C over a finite field 𝔽_{q}, represented by a plane model of degree d and a natural number n, one can with a randomized algorithm

• decide if C has a prime divisor of degree n • if this is the case compute such a prime divisor which is uniformly

randomly distributed in the set of all prime divisors of C of degree n

in an expected time which is polynomially bounded in d, log(q) and n.

Proof. As in subsection 3.3.4, let B_{n} be the number of prime divisors of C of degree n. Then we have (cf. [Sti93, Corollary V.2.10.]):

B_{n} ≥ \frac{q^{n}}{n} − (2 + 7g) · \frac{q^{n/2}}{n}

For q > (2 + 7g)^{2/n} we therefore have B_{n} ≥ 1.

Similarly to the algorithm for the previous proposition, we have a case distinction according to q > (2 + 7d^{2})^{2}.

In both cases we consider 𝔽_{q^{n}}-rational points of C_{𝔽_{q^{n}}}, which we represent as described in the beginning of subsubsection 2.5.4.5. Note that given such a point, one can compute the associated prime divisor (=closed point) by computing the intersection of the corresponding prime ideal with the function field 𝔽_{q}(C) as described in subsubsection 2.5.4.5 in a time which is polynomially bounded in d, n and log(q).

If q ≤ (2 + 7d^{2})^{2}, we iterate over all 𝔽_{q^{n}}-rational points of C_{𝔽_{q^{n}}} (as described at the beginning of the proof of Proposition 3.22). For each such point we compute the associated prime divisor (=closed point) of C, and check if this is a prime divisor of degree n. Like this we check if a prime divisor of degree n on C exists, and if this is the case, we uniformly randomly choose one.

So let now q > (2 + 7d^{2})^{2}. Then in particular q > (2 + 7d^{2})^{2/n}, and therefore there is a prime divisor of degree n on C. Then the algorithm is also easy: We first choose an 𝔽_{q^{n}}-rational point of C_{𝔽_{q^{n}}} uniformly at random compute the associated prime divisor (=closed point) of C. If the prime divisor has degree n, we output it, otherwise we repeat this process.

Here we compute the 𝔽_{q^{n}}-rational point using an algorithm for Proposition 3.22 with the modifications described in subsubsection 2.5.4.5. The expected time of one iteration is polynomially bounded in d, log(q) and n. We therefore have to show that the number of iterations is polynomially bounded in d, log(q) and n.

The number of points in C(𝔽_{q^{n}}) such that the associated prime divisor has degree n is n · B_{n}. Therefore the probability that a uniformly distributed point in C(𝔽_{q^{n}}) does not give rise to a prime divisor of degree n is \frac{#C(𝔽_{q^{n}})−nB_{n}}{#C(𝔽_{q^{n}})} which is ≤ \frac{(2+9g)·q^{n/2}}{q^{n}−2gq^{n/2}} . For q ≥ (4 + 20g)^{n/2} this is ≤ \frac{1}{2}. □

We aim at giving an efficient algorithm to compute a random effective divisor which is uniformly randomly distributed in the set of all effective divisors of a specific degree. We want to use the fact that we can efficiently compute prime divisors which are uniformly randomly distributed among all prime divisors of a specific degree. Let us for this first fix the following usual definition and the following notations which are inspired by the notations in [Heß05]. Let us for this fix a curve C over a finite field.

Definition 3.24 Let n ∈ ℕ_{0} and m ∈ ℕ. Then an effective divisor on C of degree n which is the sum of prime divisors of degree at most m is called m-smooth or (n, m)-smooth.

Notation 3.25 Let n ∈ ℕ_{0} and m ∈ ℕ. Then the number of effective divisors on C of degree n which split into prime divisors of degree ≤ m (resp. = m, resp. ≥ m) is denoted by ψ_{≤}(n, m) (resp. ψ_{=}(n, m), resp. ψ_{≥}(n, m)). We also set ψ(n, m) := ψ_{≤}(n, m), the number of (n, m)-smooth divisors.

Note that in the notation of subsection 3.3.4, ψ(n, n) = A_{n}.

Lemma 3.26 Given the L-polynomial of a curve of genus g over a finite field 𝔽_{q} and two natural number m ≤ n, one can compute the numbers ψ_{≤}(n, m), ψ_{=}(n, m) and ψ_{≥}(n, m) in a time which is polynomially bounded in n, g and log(q).

The proof of this lemma is inspired by the product formula for the zetafunction. As in subsection 3.3.4 let A_{n} be the number of effective divisors of degree n, and let B_{n} be the number of prime divisors of degree n. Then the zeta-function is

∑_{i∈ℕ}A_{i}t^{i} = ∑_{D an eff. divisor} t^{deg D} =
∏_{P a prime divisor}(1 − t^{deg(P)})^{−1} = ∏_{ℓ∈ℕ}(1 − t^{ℓ})^{−B_{ℓ}} .

Similarly, for all m ∈ ℕ,

∑_{i∈ℕ}ψ_{≤}(i, m)t^{i} = ∏_{ℓ≤m}(1 − t^{ℓ})^{−B_{ℓ}} ,  (3.23)

∑_{i∈ℕ}ψ_{=}(i, m)t^{i} = (1 − t^{m})^{−B_{m}} ,  (3.24)

and

∑_{i∈ℕ}ψ_{≥}(i, m)t^{i} = ∏_{ℓ≥m}(1 − t^{ℓ})^{−B_{ℓ}} .  (3.25)

The algorithm to compute ψ_{≤}(n, m) is as folllows:

Let the an L-polynomial L(t) be given. We first compute S_{1}, …, S_{m} via Newton’s identities (that is, via the equation L′(t) = −L(t) · (∑_{i=1}^{∞} S_{i}t^{i})) from the coefficients of the L-polynomial. From these we compute B_{1}, …, B_{m} using (3.18). Then we compute ∏_{ℓ≤m}(1−t^{ℓ})^{B_{ℓ}} and the inverse of its residue class modulo t^{n+1}, which is ∑_{i=1}^{n} ψ_{≤}(i, m) [t]_{(t^{n+1})}^{i}.

The other algorithms operate similarly. □

Lemma 3.27 Given the L-polynomial of a curve g over a finite field 𝔽_{q} and natural numbers n, m with m ≤ n, one can with a randomized algorithm compute in an expected time which is polynomially bounded in g, n and log(q) a random tuple \underline{e} ∈ ℕ_{0}^{n} with ∑_{ℓ} e_{ℓ}ℓ = n whose distribution is equal to the distribution of the decomposition type of a random effective divisor on C which is uniformly distributed among all (n, m)-smooth divisors.

Proof. The algorithm operates in a recursive way and is based on partitioning the set of (n, m)-smooth divisors into subsets, according to how many prime divisors (with multiplicities) of degree m occur in an (n, m)-smooth divisor.

If m ≥ 2 and ℓ ∈ \{0, …, ⌊\frac{n}{m}⌋\}, there are

ψ_{=}(ℓm, m) · ψ(n − ℓm, m − 1)

(n, m)-smooth divisors of the form ∑_{i=1}^{ℓ} P_{i} + D′, where the P_{i} are prime divisors of degree m and D′ is an m − 1-smooth divisor.

Algorithm to compute a random tuple reflecting the distribution type of a random smooth divisor

Input: L, the L-polynomial of a curve over a finite field and two natural numbers n, m. (The algorithm is called by A(L, n, m)).

If m = 1, output (n, 0, …, 0) ∈ ℕ_{0}^{n}. Otherwise:

1. Compute ψ(n, m) and the numbers a_{ℓ} ⟵ ψ_{=}(ℓm, m)·ψ(n−ℓm, m−1) for ℓ = 0, …, ⌊\frac{n}{m}⌋.

2. Let b_{ℓ} ⟵ ∑_{i=0}^{ℓ} a_{i} for i = 0, …, ⌊\frac{n}{m}⌋; let b_{−1} ⟵ 0.

3. Choose a natural number x ≤ ψ(n, m) uniformly at random.

4. Determine ℓ such that x ∈ [b_{ℓ−1} + 1, b_{ℓ}].

5. Output

(0, …, 0, ℓ, 0, …, 0) + (A(L, n − ℓm, m − 1) | \underline{0}) ∈ ℕ_{0}^{n} ,

where the non-trivial entry in the first tuple is at index m and (A(L, n − ℓm, m − 1) \underline{0}) is the concatenation of the output of the algorithm applied to L, n − ℓm, m − 1 and the zero-tuple of length ℓm.

By the remarks above the algorithm, the distribution of the random variable ℓ in the algorithm is equal to the distribution of the number of (n, m)-smooth divisors being the sum of ℓ prime divisors of degree m and an m − 1-smooth divisor.

It follows by induction on m that the algorithm operates correctly. Moreover, the running time is as claimed by Lemma 3.26. □

We now easily obtain:

Proposition 3.28 Given a curve C over a finite field 𝔽_{q}, represented by a plane model of degree d as well as its L-polynomial, one can with a randomized algorithm compute a random effective divisor of degree n which is uniformly randomly distributed in the set of all effective divisors of degree n on C in an expected time which is polynomially bounded in d, log(q) and n.

Proof. Given the previous statements, the algorithm for this proposition is straightforward: We compute a random tuple \underline{e} ∈ ℕ_{0}^{n} with ∑_{ℓ} e_{ℓ}ℓ = n whose distribution is equal to the distribution of the decomposition type of a random effective divisor on C which is uniformly distributed among all effective divisors of degree n.

Then for each ℓ = 1, …, n, we compute e_{ℓ} prime divisors P_{ℓ,i} which are uniformly distributed among the set of all prime divisors of degree ℓ.

We output the divisor ∑_{ℓ} ∑_{i} P_{ℓ,i}.

By Proposition 3.23 and Lemma 3.27 these computations can be performed in the claimed expected running time. □

Proposition 3.29 Given a curve C over a finite field 𝔽_{q}, represented by a plane model of degree d as well as its L-polynomial and a divisor D_{0} of degree 1 whose height is polynomially bounded in d and log(q), one can with a randomized algorithm compute a uniformly randomly distributed element of Cl^{0}(C), represented by an along D_{0} reduced divisor, in an expected time which is polynomially bounded in d and log(q).

Proof. Every divisor of degree ≥ 2g − 1 is non-special. Therefore, if D is an effective divisor which is uniformly distributed among all divisors of some degree n ≥ 2g − 1, [D − D_{0}] is uniformly distributed in Cl^{0}(C). Moreover, 2g − 1 ≤ (d − 1)(d − 2) − 1.

In order to compute the desired uniformly distributed divisor class, we first compute a uniformly distributed effective divisor D of degree (d−1)(d− 2) − 1, and then we compute its reduction along D_{0}.

The computations can be performed in the claimed expected running time by the previous proposition and Proposition 2.110. □

We now prove:

Proposition 3.30 There exists a randomized algorithm such that the following holds: Given a curve C over a finite field 𝔽_{q}, represented by a plane model of degree d, as well as its L-polynomial and a divisor D_{0} of degree 1 whose height is polynomially bounded in d and log(q), the algorithm computes a system of elements c_{1}, …, c_{u} ∈ Cl^{0}(C), represented by along D_{0} reduced divisors, where u := eℓ with e := ⌈log_{2}(# Cl^{0}(C))⌉ and ℓ := ⌈log_{2}(e) + 1⌉. Moreover, the expected running time is polynomially bounded in d and log(q), and with a probability ≥ \frac{1}{2}, the system c_{1}, …, c_{u} is a generating system of Cl^{0}(C).

The proposition immediately follows from the preceding proposition and the following lemma (cf. the proof of [Heß05, Lemma 50]).

Lemma 3.31 Let G be a finite abelian group with N elements, let e := ⌈log_{2}(N)⌉, ℓ := ⌈log_{2}(e) + 1⌉, u := eℓ, and let g_{1}, …, g_{u} be uniformly distributed random elements of G. Then with a probability of ≥ \frac{1}{2}, g_{1}, …, g_{u} generate G.

Proof. Let first H be a proper subgroup of G, and let g_{1}, …, g_{a} be uniformly randomly distributed elements from G. Then as \frac{#H}{#G} ≤ \frac{1}{2}, with a probability ≤ \frac{1}{2^{a}}, all g_{i} lie in H, that is, with a probability ≥ 1− \frac{1}{2^{a}}, H ⊊ ⟨H, g_{1}, …, g_{a}⟩.

It follows by induction on b: Let a, b ∈ ℕ, and let g_{1}, …, g_{ab} be uniformly randomly distributed elements from G. Then with a probability ≥ (1 − \frac{1}{2^{a}})^{b} ≥ 1 − \frac{b}{2^{a}}, ⟨g_{1}, …, g_{a}⟩ contains at least min\{N, 2^{b}\} elements.

With b := e and a := ℓ, we have 2^{b} ≥ N and \frac{b}{2^{a}} ≤ \frac{1}{2}. The lemma thus follows. □

Proposition 3.17 follows from Proposition 3.30 and the fact – already mentioned in subsection 3.3.2 – that for curves of a bounded degree over finite fields, one can compute the L-polynomial in polynomially bounded time in log(q), where q is the base field.

3.4 Index calculus for curves of lower-bounded genus

3.4.1 Introduction and results

Previous works on computing discrete logarithms in class groups of curves over finite fields have been directed in two distinct directions: In one class of works, curves of a fixed genus are considered (cf. [Gau00], [Thé03], [GTTD07] and also [Die06]). In the other class of works, only curves whose genus is is a certain sense large against the bit-length of the cardinality of the ground field are considered (cf. e.g. [Cou01], [Eng02], [EG02], [Heß05]). (Often more conditions are imposed, for example that the curves are hyperelliptic and given in imaginary quadratic representation).

The algorithms in the first kind of works give rise to expected running times which are exponential but not subexponential in q^{g} whereas in the second kind of works expected running times which are subexponential in q^{g} are established.

In this section, we break with this tradition by proving the following result.

Theorem 2 Let some natural number g_{0} ≥ 2 be fixed. Then the discrete logarithm problem in the degree 0 class groups of curves of genus ≥ g_{0} over finite fields can with a randomized algorithm be solved in an expected time of

Õ((q^{g})^{\frac{2}{g_{0}} (1− \frac{1}{g_{0}} )}) ,

where 𝔽_{q} is the ground field and g the genus of the curve.

Here as well as in the rest of this section, we assume that the curve is represented by a plane model of degree O(g) (which is possible by Proposition 2.6). As in Proposition 2.117, the divisor classes are represented by an along a divisor D_{0} reduced divisors, where the height of D_{0} is polynomially bounded in d, that is, polynomially bounded in g.

Note that this theorem clearly generalizes Theorem 1. Of course, the expected running time is exponential and not subexponential in q^{g} because we cannot even for any fixed genus prove a subexponential expected running time.

It is natural to bound the running time in terms of the number of elements in the degree 0 class group instead of q^{g}. We show that the corresponding statement then holds too:

Theorem 3 Let some natural number g_{0} ≥ 2 be fixed. Then the discrete logarithm problem in the degree 0 class groups of curves C/𝔽_{q} of genus ≥ g_{0} over finite fields can with a randomized algorithm be solved in an expected time of

Õ((# Cl^{0}(C))^{\frac{2}{g_{0}} (1− \frac{1}{g_{0}} )}) .

By applying Theorem 3 with g_{0} = 3 we obtain that one can solve the discrete logarithm problem in degree 0 class groups of curves of genus ≥ 3 in an expected time of

Õ(# Cl^{0}(C))^{\frac{4}{9}} ) = Õ((# Cl^{0}(C))^{\frac{1}{2}} )^{\frac{8}{9}} ) .  (3.26)

Outline of the proof

We give an outline of the proof of Theorems 2 and 3.

Below we prove the following result.

Proposition 3.32 Let C > 0 be fixed. Then there exists some g_{1} ∈ ℕ such that one can solve the discrete logarithm problem in the degree 0 class groups of curves of genus ≥ g_{1} in an expected time of O((q^{g})^{C}), where q is the cardinality of the ground field and g is the genus.

We show how one can obtain Theorems 2 and 3 via this result and Theorem 1. We first consider the statement in Theorem 2.

Let g_{0} be a natural number ≥ 2, and let C := \frac{2}{g_{0}} (1 − \frac{1}{g_{0}} ). Let g_{1} be as in the proposition for this constant C.

Then given an instance of the discrete logarithm problem with a curve of genus g ≥ g_{0}, we first compute its genus g (this is possible in poly-logarithmic time by Proposition 2.96). Then we proceed with a case distinction. If the genus is ≥ g_{1} we apply an algorithm which satisfies Proposition 3.32. If the genus is < g_{1}, we apply an algorithm which satisfies Theorem 1 for genus g curves.

We now come to Theorem 3.

Note first that # Cl^{0}(C) ∈ [(\sqrt{q} − 1)^{2g}, (\sqrt{q} + 1)^{2g}]. This implies that

# Cl^{0}(C) ≥ (\sqrt{q} − 1)^{2g} = (q^{g})^{\frac{log((\sqrt{q}−1)^{2})}{log(q)}} ≥ (q^{g})^{\frac{log((\sqrt{2}−1)^{2})}{log(2)}} .

Let now again g_{0} be a natural number ≥ 2, and this time let C := \frac{2}{g_{0}} (1 − \frac{1}{g_{0}} ) · ^{\frac{log((\sqrt{2}−1)^{2})}{log(2)}}, such that # Cl^{0}(C)^{\frac{2}{g_{0}} (1− \frac{1}{g_{0}} )} ≥ (q^{g})^{C}. Let g_{1} again be as in Proposition 3.32. Now again for curves of genus ≥ g_{1} we apply an algorithm satisfying Proposition 3.32 and for curves of genus g < g_{1} (and of course g ≥ g_{0}) we apply an algorithm satisfying Theorem 1 for genus g curves.

3.4.2 The algorithm

We now outline an algorithm for Proposition 3.32, accompanied by statements on running times. The algorithm is substantially easier to state than the index calculus algorithm in Section 3.3: It is a ”basic” index calculus algorithm, and there is no precomputation like for example a construction of a graph of large prime relations. The algorithm is closely related to the algorithms in [Heß05], and we make use of various results from [Heß05].

We again wish to follow the “general algorithm” in subsection 3.2.3. Recall that the input to the “general algorithm” not only consists of the curve and the two group elements a, b but also of a system of elements c_{1}, …, c_{u} of the degree 0 class group. We could now proceed as in Section 3.3: Using a very small system which with probability ≥ \frac{1}{2} is a generating system and terminating the algorithm if a predefined time bound is reached. However, in the situation we are concerned with here, there is an easier solution: It is shown in [Heß05] that one can compute a generating system of a size which is polynomially bounded in q and g in an expected time which is also polynomially bounded in q and g (see [Heß05, Theorem 34 and Algorithm 35]).

Note that generally if any subroutine of our algorithm has an expected running time which is polynomially bounded in q and g, then this subroutine in particular has an expected running time of O(q^{Cg}) for g large enough. Thus if such a subroutine is executed once or even a number of times which is polynomially bounded in q and g, then the running time of this subroutine is not critical for the establishment of the desired result.

We now describe the various subroutines for the ”general algorithm”; we also discuss the expected running times of the routines.

Obviously, we only have to establish Proposition 3.32 for constants C of the form C = \frac{1}{k} for k ∈ ℕ. So let k ∈ ℕ be fixed, and let C := \frac{1}{k}.

As usual, let us fix an instance consisting of a curve C/𝔽_{q}, a, b ∈ Cl^{0}(C) and a generating system c_{1}, …, c_{u}.

a) Computation of the group order

A. Lauder and D. Wan have shown in [LW] that one compute the order of the degree 0 class group of a curve over 𝔽_{q} given by a plane model of degree d in a time which is polynomially bounded in q and d. (In fact, if q = p^{e} with p prime and n ∈ ℕ, the running time is polynomially bounded in p, e and d.) Note that as by our assumption d ∈ O(g), the running time is in particular polynomially bounded in q and g.

c) Construction the factor base

We first compute the genus g. We fix a ”smoothness bound” m := ⌈\frac{g}{8k}⌉, and let the factor base F be the set of prime divisors of degree ≤ m. Let us assume (wlog.) that in Step 2 of the ”general algorithm”, the ideal representation is set up with respect to the covering x_{|C} : C ⟶ ℙ_{𝔽_{q}}^{1}. Then we construct the set of prime divisors by iterating over all prime divisors of degree ≤ m on ℙ_{𝔽_{q}}^{1} and considering the preimages under the covering x_{|C} : C ⟶ ℙ_{𝔽_{q}}^{1}.

The factor base has ≤ r · (q + 1)^{m} elements, where r := deg(x_{|C}). For g ≥ 8k, we have m ≤ \frac{g}{4k}. As further r ≤ d ∈ O(g), the size of the factor base is then (for g ≥ 8k) in Õ(q^{\frac{g}{4k}}), and the expected running time is also in Õ(q^{\frac{g}{4k}}).

d) Relation generation

Let c_{1}, …, c_{u} ∈ Cl^{0}(C) be a generating system, and let c ∈ Cl^{0}(C). Then we proceed as follows: We choose s_{1}, …, s_{u} uniformly at random and then choose an effective divisor D uniformly at random in the class s_{1}c_{1} + ⋯ + s_{u}c_{u} + c + (2g − 1) · [D_{0}], which has degree 2g − 1. We compute the free representation of D. If D is m-smooth, we have obtained a relation. Otherwise we repeat the process.

Each iteration can be performed in an expected time of Poly(g log(q))·u. Note also that as the random divisor class s_{1}c_{1} +⋯+s_{u}c_{u} +c+(2g −1)[D_{0}] is uniformly distributed in the set of divisor classes of degree 2g − 1 and divisors of degree ≥ 2g−1 are non-special, the random divisor D is uniformly distributed in the set of all effective divisors of degree 2g − 1.

In order to bound the expected running time of this relation generation procedure, we need a lower bound on the probability that a uniformly distributed random divisor of degree 2g − 1 is m-smooth. For this we can use [Heß05, Theorem 8] which gives a much more precise statement than the one we need. In fact, just from the fact that m ∈ Ω(2g − 1), we learn from [Heß05, Theorem 8] that the probability in question is in g^{Ω(1)}.

This establishes that the expected running time of the relation generation procedure is in Poly(g · log(q)) · u.

Analysis of the algorithm

It is now easy to establish that the algorithm gives rise to Proposition 3.32.

First, in Step 1 the expected running time is polynomially bounded in q and d for the computation of the group order. The expected running time for the factorization is in L_{# Cl^{0}(C)}[\frac{1}{2}, O(1)] = L_{q}[\frac{1}{2}, O(1)].

Let g_{2} ∈ ℕ be a constant such that for g ≥ g_{2} the size of the generating systems in O(q^{\frac{g}{4k}}) and expected running time of the procedure to compute a generating system is in O(q^{\frac{g}{4k}}) too. Let us restrict to instances with g ≥ g_{2}. Let us – as already indicated in subroutine c) above – restrict to instances which additionally satisfy g ≥ 8k, such that the size of the factor base is in Õ(q^{\frac{g}{4k}}) and the expected running time of the subroutine for generation of the factor base too. The expected time for the generation of the relation matrix is in Poly(g · log(q)) · u · Õ(#F) ⊆ Õ(q^{\frac{g}{2k}}). The size of the relation matrix is in Õ(q^{\frac{g}{4k}}), and the number of non-zero entries is in Õ(q^{\frac{g}{2k}}). Therefore, the expected time for the linear algebra is in Õ(q^{\frac{3g}{4k}}).

In total, for g large enough, the expected running time is in O(q^{\frac{g}{k}}). This establishes the result.

3.5 Index calculus for elliptic curves over extension fields

3.5.1 Introduction and results

In this section we show that the index calculus technique can also be successfully applied to the discrete logarithm problem in elliptic curves over finite non-prime fields.

We establish the following theorem.

Theorem 4 Let ϵ > 0. Then the discrete logarithm problem in the groups of rational points of elliptic curves over finite fields 𝔽_{q^{n}} with (2+ϵ)·n^{2} ≤ log_{2}(q) can with a randomized algorithm be solved in an expected time which is polynomially bounded in q.

Here and in the following, q is a prime power and n a natural number. The theorem leads to the following corollary.

Corollary 3.33 Let again ϵ > 0, and let a > 2 + ϵ. Then the discrete logarithm problem in the groups of rational points of elliptic curves over finite fields 𝔽_{q^{n}} with (2 + ϵ) · n^{2} ≤ log_{2}(q) ≤ a · n^{2} can be solved in an expected time of

e^{O(1)·(log(q^{n}))^{2/3}} .

This corollary follows easily from the theorem. Indeed, restricted to instances as in the corollary the elliptic curve discrete logarithm problem can be solved in an expected time which is polynomially bounded in

q = 2^{log_{2}(q)} = 2^{(log_{2}(q))^{(1+1/2)·2/3}} ≤ 2^{(\sqrt{a}·n log_{2}(q))^{2/3}} .

We note that the corollary establishes for the first time that there exists a sequence of finite fields of increasing size such that the elliptic curve discrete logarithm problem over these fields can be an expected time which is subexponential in the field size (or the group order or the input length).

When fixing the extension degree, we obtain the following result, which is analogous to Theorem 1 in Section 3.3.

Theorem 5 Let some natural number n ≥ 2 be fixed. Then the discrete logarithm problem in the groups of rational points of elliptic curves over finite fields 𝔽_{q^{n}} can with a randomized algorithm be solved in an expected time of

Õ(q^{2− \frac{2}{n}}) .

Similarly to the algorithm for Theorem 1 the algorithm has storage requirements of Õ(q^{1− \frac{1}{n} + \frac{1}{n^{2}}} ).

On the proofs

We give here a very brief overview of the algorithms leading to the above theorems.

As already mentioned, the algorithms again follow the index calculus method. From a macroscopic point of view we proceed as in the previous index calculus algorithms in this work: We first compute a “potential generating system”, and then we follow the “general algorithm” in subsection 3.2.3.

Note that in Section 3.2 we consider the discrete logarithm problem in degree 0 class groups of curves, but the general approach outlined there also applies to elliptic curves if the consider the canonical isomorphism E(K) ⟶ Cl^{0}(E), P ↦ [P − O] for an elliptic curve E/K. Note here also that for computational purposes we represent degree 0 divisor classes on any curve by divisors which are reduced along a fixed divisor of degree 1. Thus if we fix the divisor O on an elliptic curve, the class [P − O] is represented by P (for P ≠ O). Thus to say that we compute in the degree 0 class group Cl^{0}(E) means by definition that we compute in E(K). In the following, we use the corresponding capital letters to denote points corresponding to divisor classes in the general algorithm (which are denoted there by small letters). Divisors (apart from points in E(K) of course) are not used in the following.

The most challenging aspects in the proofs of the above results lie (as might be expected) in finding appropriate factor bases and efficient relation generation procedures as well as in analyzing the procedures.

For the definition of the factor base and the relation generation we depart from the previous algorithms in this work: In contrast to the usual approach in index calculus, we define the factor base in an algebraic rather than an arithmetic way, and for the relation generation we solve systems of multivariate polynomial equations.

Let us discuss the approach for Theorem 4:

Let E/𝔽_{q^{n}} be an elliptic curve. Then we compute a covering φ : E ⟶ ℙ_{k}^{1} of degree 2 which satisfies φ ∘ [−1] = φ as well as certain additional conditions. The factor base is then given by

{P ∈ E(𝔽_{q^{n}}) | φ(P) ∈ 𝔽_{q}} ,  (3.27)

where as always we identify 𝔽_{q} = 𝔸^{1}(𝔽_{q}) with ℙ^{1}(𝔽_{q}) − {0}.

The relation generation relies on an algorithm which we call decomposition algorithm. Given an elliptic curve E/𝔽_{q^{n}} the extension degree n, a covering φ as above and some point P ∈ E(𝔽_{q^{n}}), this algorithm either fails or outputs a tuple (P_{1}, …, P_{n}) ∈ E(𝔽_{q^{n}})^{n} with φ(P_{i}) ∈ 𝔽_{q} or P_{i} = O for i = 1, …, n such that

P_{1} + ⋯ + P_{n} = P .

The decomposition algorithm is based on solving multivariate systems of polynomial equations over 𝔽_{q}. Of course it fails if there is no such tuple (P_{1}, …, P_{n}). But it also fails if the solution set of the associated multivariate system is not zero-dimensional. We remark here that the most difficult part of the proof is to show that for a uniformly distributed point P ∈ E(𝔽_{q^{n}}) with a sufficiently high probability the solution sets to these systems are indeed zero-dimensional. In order to prove this result, we pass to higherdimensional schemes over 𝔽_{q} by using so-called Weil restrictions. The proof then relies crucially on intersection theory in (ℙ_{𝔽_{q^{n}}}^{1})^{n}.

For Theorem 5 we proceed similarly. But now we let the factor base be an appropriate subset of the set defined in (3.27). We then proceed with a double large prime variation, similarly to the algorithm for curves of a fixed genus in subsection 3.3.2.

Some historical comments

In Feb. 2004 I. Semaev put a preprint on the server of the International Association for Cryptographic Research (IACR) in which he discussed the possibility of index calculus in the groups of rational points on elliptic curves over prime fields ([Sem04]). In his work, Semaev defined the factor base via an upper bound on the x-coordinates of points.

He also introduced so-called summation polynomials: Let E be an elliptic curve over a field K, given by a Weierstraß model, and let m ∈ ℕ, m ≥ 2. Then the m-th summation polynomial as defined by Semaev is an irreducible polynomial f ∈ K[x_{1}, …, x_{m}] such that for the following holds: Given P_{1}, …, P_{m} ∈ E(\overline{K}) − \{O\}, we have

f(x(P_{1}), …, x(P_{m})) = 0 ⟷ ∃ϵ_{1}, …, ϵ_{m} ∈ {1, −1} : ϵ_{1}P_{1}+⋯+ϵ_{m}P_{m} = O ,

where we identify 𝔸^{1}(\overline{K}) = ℙ^{1}(\overline{K}) − \{∞\} with \overline{K}. These summation polynomials have degree 2^{m−2} in each variable.

Now, any algorithm to determine solutions with “small coordinates” for multivariate equations of high degree would give rise to an algorithm for relation generation. However, no efficient algorithm for this task is known (except for very special equations), and therefore, Semaev’s approach does (currently) not lead to an algorithm which is faster than generic algorithms to solve discrete logarithm problems.

Semaev’s work lead however both P. Gaudry and the author to reflect on the question whether a similar approach over extension fields might not give algorithms which (at least asymptotically) are faster than generic algorithms.

Both had previous work on G. Frey’s “Weil descent” idea in mind, which is based on the so-called Weil restriction: Given any separable finite field extension K|k and an abelian variety A over K, the Weil restriction of A with respect to K|k is an abelian variety Res_{k}^{K}(A) such that for any kscheme Z one has Res_{k}^{K}(A)(Z) ≃ A(Z) in a functorial way, thus in particular Res_{k}^{K}(A)(k) ≃ A(K). The Weil restriction of A with respect to K|k has dimension [K : k] · dim(A) and is attached to A in a functorial way. Very generally speaking, Frey’s idea was as follows: Let K and k be finite fields, and let E be an elliptic curve over k. Now maybe one can use the fact that Res_{k}^{K}(E)(k) is an abelian variety of higher dimension over a smaller field to attack the discrete logarithm problem in E(K). More concretely, his idea was to find curves on Res_{k}^{K}(E)(k) of low genus and to “pull-back” the discrete logarithm problem in E(k) to the Jacobians of such curves, where one then might use index calculus methods. These ideas lead for example to the so-called GHS-attack^{8} (see for example [GHS02], [Heß03], [Die03]) and more generally to what the author calls covering attacks (see for example the appendix of [Die03]). Now both Gaudry and the author wanted to use the Weil restriction directly, without a transfer to any further curve.

Already in March 2004 Gaudry put a first version of his work on the archive of the IACR ([Gau04a]). This work in fact not only focuses on elliptic curves but includes also a discussion on the discrete logarithm problem in any abelian variety, in particular including Jacobians of hyperelliptic curves.

For elliptic curves, Gaudry fixes the extension degree n and lets q go to infinity. Using a single-large prime variation Gaudry originally obtained, on a heuristic basis, an expected running time of

Õ(q^{2− \frac{2}{n−1/2}} ) .

Later, using a double large prime variation, he improved this to a heuristic expected running time of

Õ(q^{2− \frac{2}{n}}) .

8GHS stands for Gaudry, Heß, Smart.

The author on the other hand tried if a common variation of n and q would lead to a sequence of finite fields such that the elliptic curve discrete logarithm problem over these fields would become subexponential.

Gaudry then presented his results at the Elliptic Curve Cryptography Workshop (ECC) 2004 in Bochum. In his presentation he also mentioned the results by the author, and this lead to an ad-hoc presentation by the author on the next day. The author then in particular argued – again on a heuristic basis – that restricted to instances over finite fields 𝔽_{q^{n}} with n ∈ Θ(log(q)), one can solve the elliptic curve discrete logarithm problem in an expected time of

e^{O(1)·(log(q^{n}))^{3/4}} .

In the meantime, Gaudry’s work has been accepted for publication in the Journal of Symbolic Computation. The newest publically available version of Gaudry’s work is from Oct. 2004 ([Gau04b]). We would like to make some comments on this version: This work contains in particular two statements which are called “Theorems”. Theorem 1 is concerned with index calculus on abelian varieties of a fixed dimension, Theorem 2 is Theorem 5 above. However, in the setting of [Gau04b] Theorem 1 is incorrect and Theorem 2 is correct as we show below but in [Gau04b]) this result in not established but only heuristically argued to be true.

We first explain why in the context of [Gau04b] [Gau04b, Theorem 1] is incorrect: It is claimed that for fixed n one can solve the discrete logarithm problem in abelian varieties of dimension n in an expected time of Õ(q^{2− \frac{2}{n}}), where as usual 𝔽_{q} is the ground field. We conjecture that this statement is correct provided one represents the abelian varieties appropriately. However, the statement is clearly not correct if one follows the information on the representation given in [Gau04b], and additionally, during the description of the representation a severe mathematical mistake is made:

On page 3 of [Gau04b] it is stated that an abelian variety A over 𝔽_{q} is represented as follows: An open part U of A is embedded in 𝔸_{𝔽_{q}}^{n+m} such that the projection to the first n coordinates U ⟶ 𝔸_{𝔽_{q}}^{n} is quasi-finite. Then the author states that “a coordinate system with these properties is called Noether normalization of the variety”. With other words: It is concluded that the map U ⟶ 𝔸_{𝔽_{q}}^{n} is finite, but this is incorrect.

However, even if we restrict ourselves to a representation as above with a finite map, the alleged running time cannot be accurate for a very simple reason: No bound in m is given, thus the description can be arbitrarily complex. We note here that it would however not suffice to fix a bound on m. One should for example also fix some upper bound on the number of defining equations and their degrees. But even if one has done so, one should still also consider the group law.

We are now coming to the shortcomings in the establishment of [Gau04b, Theorem 2].

• The factor base is a subset of the set {P ∈ E(𝔽_{q^{n}}) | x(P) ∈ 𝔽_{q}}. Under the bijection E(𝔽_{q^{n}}) ≃ Res_{𝔽_{q}}^{𝔽_{q^{n}}}(E)(𝔽_{q}) this set corresponds to the set of rational points in a particular 1-dimensional subscheme of the Weil restriction. In [Gau04b] it is written “For simplicity we assume that [this subscheme] is irreducible.” But what if it is not irreducible? For example, it might be that it only contains one irreducibility component but is geometrically reducible. In this case the factor base might be very small.

• Even if we assume that the factor base is defined by a curve, to establish that it contains about q elements, one should establish a bound on the genus of the curve, but this is not done.

• In subsection 3.6 the average number of “decompositions” generated by solving one system is discussed. There is however an important shortcoming: In the algorithm only systems which give rise to zerodimensional solution sets are solved. Therefore, when computing the average number of decompositions, solutions in systems with higherdimensional solution sets should be discarded. It is implicitly assumed that the number of solutions of the systems with higher-dimensional solution sets is negligible, but this is not established.

• The algorithm uses a double large prime variation. However, it is not at all discussed why this leads to the desired expected running time. Heuristically, this is the case, but one has to establish that the constructed graph of large prime relations contains (with sufficiently high probability) sufficiently many points and has a sufficiently small diameter.

• Even if all the previous points are addressed, the algorithm in [Gau04b] only gives the desired result if the group is cyclic.

We also make some comments on the relationship between Theorem 4 and our heuristic result presented at ECC 2004: For the result at ECC 2004 we enlarged the factor base – it is not anymore the set of rational points of a 1-dimensional subscheme but of a higher dimensional subscheme. We have tried hard to prove that with a sufficiently high probability the generated systems of polynomial equations have a zero-dimensional solution set. However, we can only prove this important statement if we go back to 1-dimensional subschemes and to rather small extension degrees.

An outline

Let us give an outline of the rest of this section:

In the next subsection, we give the algorithms for the two theorems stated above. For this we start off with an overview of the “decomposition algorithm”. Then we give the two algorithms. The subalgorithms for the computation of a suitable covering φ are given in the following subsection. In subsection 3.5.4 we review some well known facts on multihomogeneous polynomials. We in particular discuss intersection theory in (ℙ_{k}^{1})^{n} and resultants, including computational aspects. Then we introduce the homogeneous summation polynomials via an abstract approach. Finally, the last subsection contains the analysis of the algorithm.

An interesting aspect about the algorithm and its analysis is that the algorithm can be stated with substantially less theoretical background than the analysis, and our exposition reflects this fact. In particular, it is not necessary to speak about Weil restriction when describing the algorithm, and consequently we only introduce the Weil restriction at the beginning of the analysis. One might however argue that the Weil restrictions are implicitly present in the definition of the factor base and the construction of the multivariate system in the decomposition algorithm.

3.5.2 The algorithms

In this subsection we outline the algorithms for theorems 4 and 5.

As already mentioned, the relation generation procedure of both algorithms relies on a decomposition algorithm. Before we come to the two algorithms, we give an overview over this procedure. All computational results in this subsection are over finite fields and on a bit-RAM.

3.5.2.1 The decomposition algorithm

The decomposition algorithm relies on “homogeneous summation polynomials”. These polynomials can be obtained by homogenizing the summation polynomials introduced by Semaev in [Sem04] in an appropriate way. A more systematic point of view is however to regard Semaev’s summation polynomials as being obtained by dehomogenization of the homogeneous summation polynomials. The homogeneous summation polynomials are studied in detail in subsection 3.5.5; here we merely merely mention the key results which are needed to describe the decomposition algorithm.

Let us fix some notation and terminology.

Notation and Terminology 3.34 We identify (ℙ^{1})^{n} componentwise with Proj(ℤ[X_{1}, Y_{1}]) × ⋯ × Proj(ℤ[X_{n}, Y_{n}]). Therefore we have bases X_{i}, Y_{i} ∈ Γ((ℙ^{1})^{n}, O(0, …, 0, 1, 0, …, 0)), where the 1 is at the i^{th} position. For any commutative ring A we have the multigraded homogeneous coordinate ring A[X_{1}, Y_{1}, …, X_{n}, Y_{n}] of (ℙ_{A}^{1})^{n}. In the following by a multihomogeneous polynomial in A[X_{1}, Y_{1}, …, X_{n}, Y_{n}] we mean a polynomial which is homogeneous with respect to the multigrading. A multihomogeneous ideal in A[X_{1}, Y_{1}, …, X_{n}, Y_{n}] is then an ideal in A[X_{1}, Y_{1}, …, X_{n}, Y_{n}] which is generated by multihomogeneous polynomials. Now for some multihomogeneous ideal I, we denote the subscheme defined by I in (ℙ_{k}^{1})^{n} by V (I). Moreover, we set x_{i} := \frac{X_{i}}{Y_{i}} and 𝔸^{n} := Spec(ℤ[x_{1}, …, x_{n}]).

In subsection 3.5.5 we show the following two propositions.

Proposition 3.35 Let E be an elliptic curve over a field k, and let us fix a covering φ : E ⟶ ℙ_{k}^{1} of degree 2 with φ ∘ [−1] = φ. Let m ∈ ℕ with m ≥ 2. Then there exists an up to multiplication by a non-trivial constant unique irreducible multihomogeneous polynomial S_{φ,m} ∈ k[X_{1}, Y_{1}, X_{2}, Y_{2}, …, X_{m}, Y_{m}] such that for all P_{1}, …, P_{m} ∈ E(\overline{k}) we have S_{φ,m}(φ(P_{1}), …, φ(P_{m})) = 0 ⟷ ∃ϵ_{1}, …, ϵ_{m} ∈ {1, −1} such that ϵ_{1}P_{1} + ⋯ ϵ_{m}P_{m} = O. The polynomial S_{φ,m} has multidegree (2^{m−2}, …, 2^{m−2}).

Definition 3.36 We call a multihomogeneous polynomial S_{φ,m} as in the proposition an m^{th} summation polynomial of E with respect to φ.

Proposition 3.37 Given an elliptic curve in Weierstraß form over a finite field 𝔽_{q} m ∈ ℕ with m ≥ 2 and φ : E ⟶ ℙ_{k}^{1} of degree 2 with φ ∘ [−1] = φ, the m^{th} summation polynomial with respect to the covering φ : E ⟶ ℙ_{𝔽_{q}}^{1} can be computed with a randomized algorithm in an expected time of Poly(e^{m^{2}} · log(q)).

Now let K|k be a field extension of degree n with basis b_{1}, …, b_{n}, let E be an elliptic curve over K (rather than over k!), and let φ : E ⟶ ℙ_{K}^{1} be a covering of degree 2 with φ ∘ [−1] = φ.

Now let P ∈ E(K). Let S_{φ,n+1}(X_{1}, Y_{1}, …, X_{n}, Y_{n}, φ(P)) be a polynomial obtained by inserting the coordinates of φ(P) for the variables X_{n+1}, Y_{n+1} in an (n + 1)^{th} summation polynomial of E with respect to φ; note that this polynomial is unique up to multiplication with a non-trivial constant.

Let S^{(1)}, …, S^{(n)} ∈ k[X_{1}, Y_{1}, …, X_{n}, Y_{n}] be defined by

∑_{j=1}^{n} b_{j}S^{(j)} = S_{φ,n+1}(X_{1}, Y_{1}, …, X_{n}, Y_{n}, φ(P)) .  (3.28)

Clearly, if S^{(j)} is non-zero, just as S_{φ,n+1} it is multigraded of multidegree (2^{n−1}, …, 2^{n−1}). Note also that a different basis of K|k would give rise to a system of polynomials over k which generate the same k-vector space. The same holds if the summation polynomial is multiplied by a non-trivial constant or if the coordinates of φ(P) are simultaneously multiplied by a non-trivial constant. In particular, the subscheme V (S^{(1)}, …, S^{(n)}) of (ℙ_{k}^{1})^{n} does not depend on these choices.

For Q_{1}, …, Q_{n} ∈ ℙ^{1}(k), the following conditions are equivalent:

• There exist P_{1}, …, P_{n} ∈ E(\overline{K}) such that P_{1} + ⋯ + P_{n} = P and x(P_{i}) = Q_{i} for all i = 1, …, n.

• S_{φ,n+1}(Q_{1}, …, Q_{n}, φ(P)) = 0.

• For all j = 1, …, n, S^{(j)}(Q_{1}, …, Q_{n}) = 0, that is, (Q_{1}, …, Q_{n}) is a k-rational point of V (S^{(1)}, …, S^{(n)}).

By a “decomposition algorithm” we mean an algorithm for the following computational problem: Given a prime power q, n ∈ ℕ, an 𝔽_{q}-basis b_{1}, …, b_{n} of 𝔽_{q^{n}}|𝔽_{q}, an elliptic curve E over 𝔽_{q^{n}} (given by a Weierstraß model), φ : E ⟶ ℙ_{k}^{1} as well as P ∈ E(𝔽_{q^{n}}), determine if the subscheme V (S^{(1)}, …, S^{(n)}) of (ℙ_{𝔽_{q}}^{1})^{n} defined by S^{(1)}, …, S^{(n)} is zero-dimensional, and if this is the case, determine all tuples (P_{1}, …, P_{n}) ∈ E(𝔽_{q^{n}})^{n} with φ(P_{i}) ∈ ℙ^{1}(𝔽_{q}) for all i = 1, …, n and P_{1} + ⋯ + P_{n} = P!

In subsection 3.5.4 we show the following proposition (see subsubsection 3.5.4.1 and Proposition 3.65 in subsubsection 3.5.4.3).

Proposition 3.38

a) Let k be a field, and let F_{1}, …, F_{n} ∈ k[X_{1}, Y_{1}, …, X_{n}, Y_{n}] be multigraded polynomials of multidegree (d, d, …, d) for some d ∈ ℕ. If then V (F_{1}, …, F_{n}) is zero-dimensional, its degree is n!·d^{n} (that is, the number of solutions over \overline{k} “with multiplicities” is n! · d^{n}).

b) Given a system of multihomogeneous polynomials F_{1}, …, F_{n} ∈ 𝔽_{q}[X_{1}, Y_{1}, …, X_{n}, Y_{n}] of multidegree (d, d, …, d) for some d ∈ ℕ, one can determine if the system has a zero-dimensional solution set and if this is the case compute all solutions over 𝔽_{q} in an expected time of Poly(n! · d^{n} · log(q)).

Based on the previously mentioned computational results, we have the following decomposition algorithm.

We have already remarked that one can compute the polynomial S_{φ,n+1} in an expected time of Poly(e^{n^{2}} · log(q)). Thus one can also determine the polynomials S^{(1)}, …, S^{(n)} in an expected time of Poly(e^{n^{2}} · log(q)). By the previous proposition one can then determine if the subscheme V (S^{(1)}, …, S^{(n)}) of (ℙ_{𝔽_{q}}^{1})^{n} is zero-dimensional and if this is the case compute all its 𝔽_{q}-rational points in an expected time of Poly(n! · 2^{n^{2}} · log(q)) = Poly(e^{n^{2}} · log(q)).

Assume now that the scheme is indeed zero-dimensional, and that all 𝔽_{q}-rational points have been computed. We now want to find all tuples (P_{1}, …, P_{n}) ∈ E(𝔽_{q^{n}})^{n} with φ(P_{i}) ∈ ℙ^{1}(𝔽_{q}) for all i = 1, …, n and P_{1} + ⋯ + P_{n} = P.

For this we iterate over all 𝔽_{q}-rational points of V (S^{(1)}, …, S^{(n)}). For each (Q_{1}, …, Q_{n}) ∈ V (S^{(1)}, …, S^{(n)})(𝔽_{q}) we consider all possibles tuples (P_{1}, …, P_{n}) ∈ E(𝔽_{q^{n}})^{n} with x(P_{i}) = Q_{i} for i = 1, …, n and check if P_{1} + ⋯ + P_{n} = P. We output all tuples (P_{1}, …, P_{n}) for which this is the case.

Now for each tuple (P_{1}, …, P_{n}) ∈ V (S^{(1)}, …, S^{(n)})(𝔽_{q}) we need Õ(2^{n}) · Poly(log(q)) bit operations, and we have Poly(e^{n^{2}}) such tuples (P_{1}, …, P_{n}). The expected total running time is then still in Poly(e^{n^{2}} · log(q)).

We obtain:

Proposition 3.39 Given q, n ∈ ℕ, E, φ and P as above, one can determine if the subscheme V (S^{(1)}, …, S^{(n)}) of (ℙ_{𝔽_{q}}^{1})^{n} is zero-dimensional, and if this is the case determine all tuples (P_{1}, …, P_{n}) ∈ E(𝔽_{q^{n}})^{n} with φ(P_{i}) ∈ ℙ^{1}(𝔽_{q}) for i = 1, …, n in an expected time of Poly(e^{n^{2}} · log(q)).

Terminology 3.40 We say that “the decomposition algorithm succeeds” if applied to an instance as described above if the scheme V (F_{1}, …, F_{n}) is zerodimensional and there exists a tuple (P_{1}, …, P_{n}) ∈ E(𝔽_{q^{n}})^{n} with φ(P_{i}) ∈ ℙ^{1}(𝔽_{q}) and P_{1} + ⋯ + P_{n} = P. Otherwise we say that “the decomposition algorithm fails”.

In order to analyze the index calculus algorithms we need a lower bound in the probability that the decomposition algorithm succeeds. Let us mention the key result for the analysis of the algorithm for Theorem 4, which we prove in subsubsection 3.5.6.5 (Proposition 3.98):

Proposition 3.41 Let ϵ > 0. Then for n large enough^{9} and (2 + ϵ) · n^{2} ≤ log_{2}(q) the following holds: Let E/𝔽_{q^{n}} be an elliptic curve, and let φ : E ⟶ ℙ_{K}^{1} be a covering of degree 2 with φ ∘ [−1] = φ such that the following condition holds:

There exists a point P ∈ ℙ^{1}(\overline{k}) which is a ramification point of φ such that the points P, σ(P), …, σ^{n−1}(P) are all distinct and φ is not ramified at σ(P), …, σ^{n−1}(P).

Then the probability that the decomposition algorithm succeeds if applied to a uniformly randomly distributed element in E(𝔽_{q^{n}}) is ≥ q^{− \frac{1}{2}} .

9As usual, by the phrase “for n large enough” we mean that there exists a constant C > 0 such that the statement holds for n ≥ C.

3.5.2.2 The algorithm for Theorem 4

Below we give an algorithm which leads to the following result.

Proposition 3.42 Let ϵ > 0. Then there exists a randomized algorithm such that the following holds: Given a prime power q, a natural number n with (2 + ϵ) · 2^{n} ≤ log_{2}(q), an elliptic curve over 𝔽_{q^{n}} (in Weierstraß form) and two points A, B ∈ E(𝔽_{q^{n}}) with B ∈ ⟨A⟩ as well as a generating system of E(𝔽_{q^{n}}) whose size is polynomially bounded in log(q^{n}), the algorithm outputs the discrete logarithm of B with respect to A. Moreover, the expected running time is polynomially bounded in q, and each LOAD and STORE operation operates in a time which is polynomially bounded in log(q).

Let us see how one can with this proposition obtain Theorem 4:

First, Proposition 3.42 implies (see the proof of Proposition 3.18 from Proposition 3.16):

Proposition 3.43 Let ϵ > 0. Then there exists a randomized algorithm such that the following holds: Given a prime power q, a natural number n with (2 + ϵ) · n^{2} ≤ log_{2}(q), an elliptic curve over 𝔽_{q^{n}} (in Weierstraß form) and two points A, B ∈ E(𝔽_{q^{n}}) with B ∈ ⟨A⟩ as well as a generating system of E(𝔽_{q^{n}}) whose size is polynomially bounded in log(q^{n}), the algorithm outputs the discrete logarithm of B with respect to A or fails. Moreover, the running time of the algorithm is polynomially bounded in q, and the probability of failure is ≤ \frac{1}{2}.

If we repeat the two steps

1. choose a “potential generating system” of size Poly(log(q^{n})) with an algorithm satisfying Proposition 3.17

2. apply an algorithm satisfying Proposition 3.43

until we have obtained the discrete logarithm, we obtain:

Proposition 3.44 Let ϵ > 0. Then there exists a randomized algorithm such that the following holds: Given a prime power q, a natural number n with (2 + ϵ) · n^{2} ≤ log_{2}(q), an elliptic curve over 𝔽_{q^{n}} (in Weierstraß form) and two points A, B ∈ E(𝔽_{q^{n}}) with B ∈ ⟨A⟩, the algorithm outputs the discrete logarithm of B in an expected time which is polynomially bounded in q.

Note now that in Proposition 3.43 in particular the extension degree n is part of the input whereas in Theorem 4 this is not the case. To obtain Theorem 4 we apply an algorithm for Proposition 3.43 with all possible extension degrees “in parallel”.

We are now coming to the algorithm for Proposition 3.42. For this we outline – as already mentioned – an index calculus algorithm which follows the “general algorithm” in subsection 3.2.3. The input of the algorithm consists of q, n, E, A, B as described in Proposition 3.42 as well as a system of elements C_{1}, …, C_{u} in E(𝔽_{q^{n}}).

We give the subroutines together with an analysis of their complexity. The subroutines and thus also the complete algorithm apply to all instances without any bound on n, but they might not always terminate. Indeed, we prove the following statement:

Let ϵ > 0. Then given a prime power q, a large enough natural number n with (2+ϵ)·2^{n} ≤ log_{2}(q), an elliptic curve over 𝔽_{q^{n}} (in Weierstraß form) and two points A, B ∈ E(𝔽_{q^{n}}) with B ∈ ⟨A⟩ as well as a generating system of E(𝔽_{q^{n}}) whose size is polynomially bounded in log(q^{n}), the algorithm outputs the discrete logarithm of B with respect to A. Moreover, the expected running time is then polynomially bounded in q.

Proposition 3.42 can then be obtained by applying this algorithm “in parallel” with a brute force computation.

a) Computation of the group order

We use Schoof’s algorithm to compute the L-polynomial ([Sch85]), which operates in a time which is polynomially bounded in log(q^{n}).

c) Construction of the factor base

We have already mentioned that the factor base is a set

{P ∈ E(𝔽_{q^{n}}) | φ(P) ∈ 𝔽_{q}} .

for a suitable covering of degree 2 φ : E ⟶ ℙ_{𝔽_{q^{n}}}^{1} with φ ∘ [−1] = φ.

Let σ be the relative Frobenius automorphism of \overline{𝔽}_{q}|𝔽_{q}. Now the condition on φ we impose is the following condition, already mentioned in Proposition 3.41.

Condition 3.45 There exists a point P ∈ ℙ^{1}(\overline{𝔽}_{q}) which is a ramification point of φ such that the points P, σ(P), …, σ^{n−1}(P) are all distinct and φ is not ramified at σ(P), …, σ^{n−1}(P).

This condition might seem strange for the moment. The reasons for this condition will be discussed in subsubsection 3.5.6.3. Very briefly, the factor base is in a certain sense defined by a 1-dimensional 𝔽_{q}-scheme, and the condition ensures that this scheme is birational to a curve over 𝔽_{q}.

In subsection 3.5.3 we prove:

Proposition 3.46 Given a prime power q, n ∈ ℕ and an elliptic curve over 𝔽_{q^{n}} in Weierstraß form such that (q, n) ≠ (3, 2) one can compute a covering φ : E ⟶ ℙ_{𝔽_{q^{n}}}^{1} of degree 2 with φ ∘ [−1] = φ satisfying Condition 3.45 in an expected time which is polynomially bounded in n · log(q).

Thus clearly the factor base can be constructed in an expected time which is polynomially bounded in log(q^{n}).

d) Relation generation

Let C_{1}, …, C_{u} be the system of elements in E(𝔽_{q^{n}}) which is part of the input, and let C ∈ E(𝔽_{q^{n}}) be given.

We choose s_{1}, …, s_{u} ∈ {0, …, #E(𝔽_{q^{n}}) − 1} uniformly at random and compute ∑_{j} s_{j}C_{j} + C. Then we apply the decomposition algorithm as described in the previous subsubsection to this element and the covering φ. If the procedure does not fail, we have obtained at least one relation between factor base elements, C_{1}, …, C_{u} and the input elements A, B. We output such a relation. (It does not matter which one we output as long as the distribution of the output only depends on the element ∑_{j} s_{j}C_{j} + C (and not on the further internal state of the algorithm).) We repeat this procedure until we have obtained such a relation.

In our applications of the algorithm, u is polynomially bounded in log(q^{n}). Then the time to compute ∑_{j} s_{j}C_{j} + C is polynomial in log(q^{n}). By Proposition 3.39, the expected running time of one iteration is then in Poly(e^{n^{2}} · log(q)). Moreover, by Proposition 3.41 (Proposition 3.98) for instances with (2 + ϵ) · n^{2} ≤ log_{2}(q) and n large enough the expected number of iterations is in O(q^{1/2}).

We conclude that for instances with (2 + ϵ) · n^{2} ≤ log_{2}(q) and n large enough and for u polynomially bounded in log(q^{n}), the expected running time of the relation generation procedure is in Poly(e^{n^{2}} · log(q)) · O(q^{1/2}) ⊆ Poly(q).

The overall running time

We again restrict ourselves to instances with (2 + ϵ) · n^{2} ≤ log_{2}(q) and u polynomially bounded in log(q^{n}). As the factor base has a size of O(q), it is now clear that for n large enough the expected running time of the whole algorithm is then polynomially bounded in q.

3.5.2.3 The algorithm for Theorem 5

It order to obtain Theorem 5 we modify the previous algorithm with a double large prime variation.

Let us fix n and consider the discrete logarithm problem in elliptic curves over finite fields 𝔽_{q^{n}}. Then we follow exactly the algorithm in subsubsection 3.3.2, with the following obvious modifications: Let φ be a covering as above. Then the factor base is a subset of size ⌈q^{1− \frac{1}{n}} ⌉ of \{P ∈ E(𝔽_{q^{n}}) | φ(P) ∈ 𝔽_{q}\} which is invariant under application of [−1], for relation generation we rely on the “decomposition algorithm”, and generally the genus g is substituted by the extension degree n. An important observation is (cf. Proposition 3.39): For fixed extension degree n there is a decomposition algorithm whose expected running time is polynomially bounded in log(q).

The analysis is also similar to the analysis of the algorithm in subsection 3.3.2. It relies on the following proposition.

Proposition 3.47 Let n be fixed. Then again for elliptic curves E/𝔽_{q^{n}} and coverings φ such that Condition 3.45 holds the following is true:

a) #{P ∈ E(𝔽_{q^{n}}) | φ(P) ∈ ℙ^{1}(𝔽_{q})} ∼ q.

b) There exist constants C, D > 0 such that the following holds: Let M be any subset of {(P_{1}, …, P_{n}) ∈ E(K)^{n} | φ(P_{i}) ∈ ℙ^{1}(k) for all i = 1, …, n}. Then the number of elements P ∈ E(K) such that the decomposition algorithm succeeds and there exist P_{1}, …, P_{n} ∈ M with P_{1} + ⋯ + P_{n} = ±P is

≥ D · #M − C · q^{n−1} .

For a) we refer to Remark 3.79 in subsubsection 3.5.6.3. Part b) is a summary of Proposition 3.96 in subsubsection 3.5.6.5 for fixed n.

The subroutines a) and b) are exactly as above. So let us describe subroutines c) and d) in greater detail.

c) Construction of the factor base and the graph of large prime relations

First we again construct a covering φ : E ⟶ ℙ_{𝔽_{q^{n}}}^{1} of degree 2 with φ∘[−1] = φ satisfying Condition 3.45. As indicated above, this can be done in an expected time which is polynomially bounded in log(q^{n}). We enumerate this set and define the factor base F as any subset F of cardinality ⌈q^{1− \frac{1}{n}} ⌉ or ⌈q^{1− \frac{1}{n}} ⌉+1 of \{P ∈ E(𝔽_{q^{n}}) | φ(P) ∈ 𝔽_{q}\} which is invariant under application of [−1]. The set of large primes is then L := {P ∈ E(𝔽_{q^{n}}) | φ(P) ∈ 𝔽_{q} , P ∉ F}.

Clearly these operations can be performed in an expected time of Õ(q). Now as already mentioned the construction of the tree of large prime

relations is performed as in subsection 3.3.2. A minor difference is that we do not anymore have unique factorization, and we check for each output of the decomposition algorithm if it leads to an FP or a PP relation. The procedure is therefore as follows:

Procedure: Construction of the tree of large prime relations

Construct a tree T with vertex set contained in L ˙∪ {∗} as follows: Let T consist only of the root ∗. Let N_{max} ⟵ ⌈q^{1−1/n+1/n^{2}}⌉ Let s ⟵ 1. Repeat

Repeat Choose s_{1}, …, s_{u} ∈ ℤ/Nℤ uniformly and independently at random. Apply the decomposition algorithm to ∑_{j} s_{j}C_{j}. If the decomposition algorithm succeeds,

check for every tuple (P_{1}, …, P_{n}) with φ(P_{i}) ∈ ℙ^{1}(𝔽_{q}) and ∑_{j} P_{j} = ∑_{j} s_{j}C_{j} if it leads to a FP or a PP relation, that is, to a relation of the form ∑_{j} r_{j}F_{j} + c_{P} P + c_{Q}Q = ∑_{j} s_{j}C_{j} where c_{P} > 0, c_{Q} > 0 and P ∈ F ∪ T_{s−1}, Q ∈ L − (F ∪ T). If this is the case,

fix such a relation.

if P ∈ F (i.e. if we have an FP relation),

insert Q and an edge from ∗ to Q into T if P ∈ T_{s−1} (i.e. if we have a PP relation),

insert Q and an edge from P to Q into T. In both cases label Q with s and the edge with (r_{j})_{j} (in sparse representation).

Until T contains 2^{s−1} · ⌈q^{1−1/n}⌉ edges or the number of edges equals N_{max}. If the number of edges equals N_{max}, STOP. Let s ⟵ s + 1.

Here as in subsection 3.3.2 T_{s} is the subtree of T consisting of vertices with label ≤ s, that is, the tree which is constructed until including stage s.

With part b) of Proposition 3.47 the analysis in subsection 3.3.3 carries also easily over to the present setting. Let us first consider Stage 1 of the algorithm, that is, s = 1.

We set

M := F^{n−1} × (L − T) .

For q large enough (independently of T) this set has cardinality ≥ (q^{1− \frac{1}{n}})^{n−1}· \frac{q}{4}. Therefore the number of elements in E(𝔽_{q^{n}}) for which we obtain a new edge is ≥ \frac{D}{4} · (q^{1− \frac{1}{n}})^{n−1} · q − C · q^{n−1} = \frac{D}{4} · q^{n−1+ \frac{1}{n}} − Cq^{n−1}. For q large enough this is

≥ \frac{D}{8} · q^{n−1+ \frac{1}{n}} ,

and the probability to obtain an FP relation is therefore

≥ \frac{D}{16} · q^{−(1− \frac{1}{n})} .

We thus obtain: A tree of large prime relations of size ⌈q^{1− \frac{1}{n} + \frac{1}{n^{2}}} ⌉ is constructed in an expected time of Õ(q^{2− \frac{2}{n}}).

Let us now assume that we are in Stage s with s ≥ 2. We set

M := F^{n−2} × (F × T_{s−1}) × (L − T) .

Now for q large enough (and independently of T, in particular independently of s) this set has cardinality ≥ (q^{1− \frac{1}{n}})^{n−2}·2^{s−2}·q^{g−1+ \frac{1}{g}} · \frac{q}{4} = 2^{s−2}·(q^{1− \frac{1}{n}})^{n−1}· \frac{q}{4}. For q large enough the number of elements in E(𝔽_{q^{n}}) for which we obtain a new edge is

≥ \frac{D}{16} · 2^{s−2} · q^{−(1− \frac{1}{n})} .

This implies that for q large enough (independently of s) the following holds: Given any tree T_{s−1} with 2^{s−2} · ⌈q^{1− \frac{1}{g}} ⌉ edges, the expected number of tries until a tree T with min\{2^{s−1} · ⌈q^{1− \frac{1}{g}} ⌉, N_{max}\} edges is constructed is

≤ \frac{32}{D} · q^{−(1− \frac{1}{n})} .

This completes the analysis.

d) Relation generation

The relation generation is also as in subsection 3.3.2, again with the obvious difference that we use the decomposition algorithm. Again by item b) of Proposition 3.47 it is obvious that the expected running time is in Õ(q^{2− \frac{2}{n}}).

The overall running time and conclusion

Altogether we obtain an expected running time of Õ(q^{2− \frac{2}{n}}), and we have storage requirements of Õ(q^{1− \frac{1}{n} + \frac{1}{n^{2}}} ).

3.5.3 Computing a suitable covering

We discuss how a covering φ : E ⟶ ℙ_{𝔽_{q^{n}}}^{1} as required in the construction of the factor base can be computed.

We make some case distinctions. In each case we start off with a specific Weierstraß model and determine some automorphism α of ℙ_{𝔽_{q^{n}}}^{1}. Then we set φ := α ∘ x_{|E}.

3.5.3.1 Even characteristic

Let first j(E) = 0. Then E is the projective curve defined by the homogenization of some polynomial of the form

y^{2} + a_{3}y + x^{3} + a_{4}x + a_{6} .

(see [Sil86, Appendix A]) (with a_{3} ≠ 0). (In similar situations we say from now on that E is “defined” by a polynomial for shortness.) Now x_{|E} is ramified exactly over ∞. We set α := \frac{ax−1}{x} for some a ∈ 𝔽_{q^{n}} which is not contained in any proper subfield of 𝔽_{q^{n}}|𝔽_{q}.^{10} Then α maps ∞ to a, and thus φ is ramified exactly at a. Clearly the condition is satisfied.

Let now j(E) ≠ 0. Then E is the projective curve defined by the polynomial

y^{2} + xy + x^{3} + a_{2}x^{2} + a_{6} .

Then x_{|E} is ramified exactly over 0 and ∞. We set α := x + a with a as above. Then φ is ramified at a and ∞, and again the condition is satisfied.

3.5.3.2 Odd characteristic

Let E be defined by

y^{2} − f(x) ,

where f(x) ∈ 𝔽_{q}[x] is monic of degree 3. The conditions which have to be satisfied are now more subtle but the algorithm is very simple:

We choose λ ∈ 𝔽_{q^{n}} uniformly at random and with α := x − λ we check if the condition is satisfied. We repeat this until the condition is satisfied.

Note here that if f(x) = (x − λ_{1})(x − λ_{2})(x − λ_{3}) (with λ_{i} ∈ 𝔽_{q^{6n}}), then the ramification points of φ = α ∘ x_{|E} in ℙ^{1}(\overline{𝔽}_{q}) are λ_{i} − λ for i = 1, 2, 3. So it is easy to check the condition.

Proposition 3.46 now follows from the following lemma. (Note that we only apply the lemma in the case that q is odd.)

10By a “proper subfield” we mean here a subfield of a field extension K|k which is not equal to K.

Lemma 3.48 There exists a constant C ∈ (0, 1) such that the following holds:

Let q be a prime power and n a natural number such that (q, n) ≠ \{(2, 2), (3, 2), (2, 3), (2, 4)\}. Now let λ_{1}, λ_{2}, λ_{3} ∈ \overline{𝔽}_{q}, and let λ be a uniformly distributed element in 𝔽_{q^{n}}. Then with a probability ≥ C we have

(λ_{1} − λ)^{q^{i}} ∉ {λ_{1} − λ, λ_{2} − λ, λ_{3} − λ}

for i = 1, …, n − 1.

Proof. Let ℓ = 1, 2, 3. We have (λ_{1} − λ)^{q^{i}} = λ_{ℓ} − λ if and only if λ^{q^{i}} − λ = λ_{1}^{q^{i}} − λ_{ℓ}. The map λ ↦ λ^{q^{i}} − λ is an 𝔽_{q}-linear map with kernel 𝔽_{q^{gcd(i,n)}}. There are thus either no or q^{gcd(i,n)} such λ.

We obtain: In total there are at most 3 ∑_{i=1}^{n−1} q^{gcd(i,n)} elements λ for which the condition in the lemma is not satisfied.

Now 3 ∑_{i=1}^{n−1} q^{gcd(i,n)} ≤ 3(n − 1) · q^{n/2}, and therefore the probability in question is

≥ 1 − \frac{3(n − 1)}{q^{n/2}} ≥ 1 − \frac{3(n − 1)}{2^{n/2}} .

For n ≥ 10 this is ≥ \frac{5}{32} > 0.

One also easily sees that for n ≤ 9 and (q, n) ≠ {(2, 2), (3, 2), (2, 3), (2, 4)} the probability is positive. □

3.5.4 Some results on multihomogeneous polynomials

In this subsection we are concerned with results related to multihomogeneous polynomials and systems of such polynomials. In particular, we give some information on aspects of intersection theory in the special case of (ℙ_{k}^{1})^{n}, including multigraded resultants, and we discuss computational aspects. Here and in this whole subsection, k is a field.

3.5.4.1 Intersection theory in (ℙ_{k}^{1})^{n}

In this subsubsection we review some standard material on intersection theory in the special case of (ℙ_{k}^{1})^{n}.

Lemma 3.49 Let X be a closed subscheme of (ℙ_{k}^{1})^{n} of dimension at least 1, and let F ∈ k[X_{1}, Y_{1}, …, X_{n}, Y_{n}] be a multihomogeneous polynomial whose multidegree is componentwise positive. Then V (F) and X intersect nontrivially.

Proof. The invertible sheaf O(\underline{d}) is very ample, and under the corresponding embedding into projective space F corresponds to a non-trivial linear form. The result thus follows from intersection theory in projective space. □

Definition 3.50 We define the dimension of the empty scheme as −1.

Lemma 3.51 Let k ≤ n + 1. Let F_{1}, …, F_{k} be multihomogeneous polynomials in k[X_{1}, Y_{1}, …, X_{n}, Y_{n}] such that all multidegrees are componentwise positive. Then dim(V (F_{1}, …, F_{k})) ≥ n − k. Moreover, we have equality if and only if for ℓ = 2, …, k no irreducibility component of V (F_{1}, …, F_{ℓ−1}) is contained in V (F_{ℓ}).

Proof. Let first k ≥ n (such that the first statement is non-trivial). Then by the previous lemma V (F_{1}, …, F_{k}) is non-empty. The first statement thus follows with Krull’s Hauptidealsatz. The second statement also follows easily with the previous lemma and Krull’s Hauptidealsatz. □

Notation 3.52 Let V be a fixed quasi-projective variety, and let X be a closed subscheme of V. Then we denote the class of V in the Chow ring of V by [X]. (We do not fix a notation for the cycle corresponding to a closed subscheme as we never perform operations with cycles but only with classes.)

Remark 3.53 Let X be a closed subscheme of (ℙ_{k}^{1})^{n} and let F ∈ k[X_{1}, Y_{1}, …, X_{n}, Y_{n}] be a multihomogeneous polynomial such that no irreducibility component of X is contained in V (F). Then

[X ∩ V (F)] = [X] · [V (F)] ,

where X ∩ V (F) is the scheme-theoretic intersection. Indeed, this is a special case of Axiom A7 on intersection theory in [Har77, Appendix A]. In particular, if F_{1}, …, F_{k} are multihomogeneous polynomials such that for all ℓ = 2, …, k no irreducibility component of V (F_{1}, …, F_{ℓ−1}) is contained in V (F_{ℓ}), then

[V (F_{1}, …, F_{k})] = [V (F_{1})] ⋯ [V (F_{k})] .

Note that by the previous lemma this is in particular the case if the multidegrees of the polynomials are componentwise positive and dim(V (F_{1}, …, F_{k})) = n − k.

We have the following explicit description of the Chow ring of (ℙ_{k}^{1})^{n}:

Proposition 3.54 Let h_{i} be the class of V (X_{i}) ⊆ (ℙ_{k}^{1})^{n} for i = 1, …, n. Then the Chow ring of (ℙ_{k}^{1})^{n} is generated by h_{1}, …, h_{n}, and we have an isomorphism ℤ[H_{1}, …, H_{n}]/(H_{1}^{2}, …, H_{n}^{2}) ⟶ CH((ℙ_{k}^{1})^{n}) , [H_{i}] ↦ h_{i}.

This proposition can easily be derived from a general result on the Chow rings of toric varieties (cf. the proposition on page 106 of [Ful93, Section 5.2]). We remark here that the book [Ful93] is concerned with toric varieties over the complex number. However, analytic arguments play a minor role in the exposition, and the few such arguments can rather easily be replaced with algebraic arguments. In particular, the proposition just mentioned holds over arbitrary fields.

Example 3.55 The class of an effective Cartier divisor on (ℙ_{k}^{1})^{n} of multidegree (d_{1}, …, d_{n}) is d_{1}h_{1} + ⋯ + d_{n}h_{n}.

Let us consider the pull-back and push-forward homomorphisms associated with the canonical projections between products of ℙ_{k}^{1}’s. The following considerations follow immediately from the axioms of intersection theory in [Har77, Appendix A].

Let for n_{1} > n_{2} p : (ℙ_{k}^{1})^{n_{1}} ⟶ (ℙ_{k}^{1})^{n_{2}} be the projection to the first n_{2} components. Let us denote by h_{i} for i = 1, …, n_{2} the class of V (X_{i}) in any of the two Chow groups.

Then the pull-back p^{∗} : CH((ℙ_{k}^{1})^{n_{2}}) ⟶ CH(ℙ_{k}^{1})^{n_{1}}), which is a ring homomorphism, is given by the homomorphism which corresponds to the obvious inclusion under the isomorphism in Proposition 3.54. This means that it is given by p^{∗}(h_{i}) = h_{i}.

The push-forward, which is a group homomorphism, is given as follows:

Lemma 3.56 Let \underline{e} ∈ \{0, 1\}^{n_{1}}. Then p_{∗}(h_{1}^{e_{1}} ⋯ h_{n_{1}}^{e_{n_{1}}} ) = 1 if e_{n_{2}+1} = ⋯ = e_{n_{1}} = 1 and p_{∗}(h_{1}^{e_{1}} ⋯ h_{n_{1}}^{e_{n_{1}}} ) = 0 otherwise.

Let now F_{1}, …, F_{n} be multihomogeneous polynomials whose multidegree is componentwise positive. Let the multidegree of F_{i} be (d_{i,1}, …, d_{i,n}), and let D := ((d_{i,j}))_{i,j}. If now the scheme V (F_{1}, …, F_{n}) is zero-dimensional we conclude with the above proposition and Remark 3.53 that the class of V (F_{1}, …, F_{n}) in the Chow group is a cycle of degree Perm(D), the permanent of D. With other words: If the scheme V (F_{1}, …, F_{n}) is zerodimensional, it has degree Perm(D). In particular, if additionally the multidegree of each F_{i} is (d, …, d) for a common d ∈ ℕ, then the degree of V (F_{1}, …, F_{n}) is n! · d^{n}.

3.5.4.2 Multigraded resultants

We will make repeated use of resultants for systems of multihomogeneous polynomials in k[X_{1}, Y_{1}, …, X_{n}, Y_{n}]. Let us recall the definition and basic properties:

Let us fix some n ∈ ℕ. Let for \underline{d} ∈ ℕ M\underline{d} be the set of monomials of multidegree \underline{d} in k[X_{1}, Y_{1}, …, X_{n}, Y_{n}].

Let for each i = 1, …, n + 1 some \underline{d}^{(i)} ∈ ℕ^{n} be given. (Note that all coefficients are positive). We want to define the generic resultant for multihomogeneous polynomials of multidegrees \underline{d}^{(1)}, …, \underline{d}^{(n+1)}. For this we consider a “universal coefficient ring”, which is a multivariate polynomial ring over the integers which for each pair (i, m) with m ∈ M_{\underline{d}_{(i)}} has one indeterminate c_{i,m}, that is, it is the ring ℤ[\{c_{i,m}\}_{i=1,...,n+1,m∈M_{\underline{d}_{(i)}}} ]. We define the generic system of n + 1 multihomogeneous polynomials with multidegrees \underline{d}^{(1)}, …, \underline{d}^{(n+1)} as G_{1}, …, G_{n+1} ∈ ℤ[\{c_{(i,m)}\}_{i,m}][X_{1}, Y_{1}, …, X_{n}, Y_{n}] with G_{i} = ∑_{m∈M_{\underline{d}_{(i)}}} c_{i,m} m.

The generic resultant under consideration is then an element of ℤ[{c_{i,m}}_{i,m}], and the resultant of a particular system of multihomogeneous polynomials is obtained by substituting the coefficients of the polynomials for the generic coefficients.

Proposition 3.57

a) There is an irreducible polynomial Res ∈ ℤ[\{c_{i,m}\}_{i=1,...,n+1,m∈M_{\underline{d}_{(i)}}} ] which for i = 1, …, n+1 is homogeneous in the coefficients the i^{th} generic polynomial and which has the following property: For all fields k and all systems of multihomogeneous polynomials F_{1}, …, F_{n+1} ∈ k[X_{1}, Y_{1}, …, X_{n}, Y_{n}], where F_{i} has multidegree \underline{d}^{(i)}, we have Res(F_{1}, …, F_{n+1}) = 0 if and only if V (F_{1}, …, F_{n+1}) is non-empty. Here Res(F_{1}, …, F_{n+1}) is obtained by substituting the coefficients of the polynomials for the generic coefficients.

b) The polynomial Res with the above properties unique up to sign.

c) For every field k, the induced polynomial in k[{c_{i,m}}_{i,m}] is irreducible.

d) For each i = 1, …, n + 1, Res has degree Perm(D_{i}) in the coefficients of the i^{th} generic polynomial, where D_{i} is obtained from the matrix

( \underline{d}^{(1)} ; ⋮ ; \underline{d}^{(n+1)} ) by deleting the i^{th} row.

Sketch of a proof. A corresponding result over the complex numbers follows from the general results in [GKZ94]. (The polynomial Res is then unique up to multiplication by a non-trivial complex number.) Even though there are various other works on general resultants, we could not find this “universal” result in the literature. We explain now how it can be derived from the results on “mixed resultants” in [GKZ94, Section 3.3].

For every commutative ring R, the set Spec(ℤ[{c_{i,m}}_{i,m}])(R) ≃ ∏_{i,m} R corresponds in an obvious way to the set of systems F_{1}, …, F_{n+1} ∈ R[X_{1}, Y_{1}, …, X_{n}, Y_{n}], where F_{i} has multidegree \underline{d}^{(i)}. For such a system of polynomials over a field such that at least one polynomial is non-trivial, we denote by \overline{(F_{1}, …, F_{n+1})} the class of the coefficient vectors in projective space Proj(ℤ[{c_{i,m}}_{i,m}])(k).

Let p : (ℙ^{1})^{n} ×_{ℤ} Proj(ℤ[{c_{i,m}}_{i,m}]) ⟶ Proj(ℤ[{c_{i,m}}_{i,m}]) be the projection to the second component. Let V (G_{1}, …, G_{n+1}) be the closed subscheme of (ℙ^{1})^{n}×_{ℤ}Proj(ℤ[{c_{i,m}}_{i,m}]) defined by the generic multihomogeneous polynomials G_{1}, …, G_{n+1} introduced above.

We consider p(V (G_{1}, …, G_{n+1})), which is a closed subscheme of Proj(ℤ[{c_{i,m}}_{i,m}]), with the induced reduced structure. Note that for a system F_{1}, …, F_{n+1} of polynomials as above over a field k, the fiber of V (G_{1}, …, G_{n+1}) above \overline{(F_{1}, …, F_{n+1})} is V (F_{1}, …, F_{n+1}), and thus the fiber of p(V (G_{1}, …, G_{n+1})) at \overline{(F_{1}, …, F_{n+1})} is set-theoretically equal to p_{k}(V (F_{1}, …, F_{n+1})). In particular, \overline{(F_{1}, …, F_{n+1})} is contained in p_{k}(V (G_{1}, …, G_{n+1})_{k}) if and only if V (F_{1}, …, F_{n+1}) is non-empty.

Now the results in [GKZ94] immediately generalize to aribitrary algebraically closed fields, and therefore V (G_{1}, …, G_{n+1}))\overline{ℚ} as well as V (G_{1}, …, G_{n+1}))_{\overline{𝔽}_{p}} for every prime number p are irreducible of codimension 1. It follows that V (G_{1}, …, G_{n+1}) is irreducible of codimension 1. As Proj(ℤ[{c_{i,m}}_{i,m}]) is regular, this implies that it is a Cartier divisor and thus given by a section of an invertible sheaf on Proj(ℤ[{c_{i,m}}]). But every invertible sheaf on a projective space over ℤ is isomorphic to O(a) for some a ∈ ℕ (cf. [Mum65, §0, 5 b)]). Therefore V (G_{1}, …, G_{n+1}) is defined by a homogeneous polynomial in ℤ[{c_{i,m}}_{i,m}]; let Res be such a polynomial.

We already know that Res is irreducible. Moreover, for every prime number p, the residue class [Res]_{𝔽_{p}[{c_{i,m}}_{i,m}]} is non-trivial, and thus the gcd of the coefficients of Res is 1. It is immediate that Res is homogeneous in the coefficients of each generic polynomial.

We have established a) and b). Result d) follows from the general results in [GKZ94] over the complex numbers.

It remains to prove c), where we can restrict ourself to algebraically closed fields. So let k be such a field. Let Res_{k} be the induced polynomial obtained from Res. We already know that Res_{k} is the product of a constant and a power of an irreducible polynomial. Now first, by d), Res_{k} is a polynomial of degree ∑_{i} Perm(D_{i}). Also, by applying the reasoning in [GKZ94] for k instead of ℂ, one obtains that p_{k}(V (G_{1}, …, G_{n+1})_{k}) with the reduced structure also has degree ∑_{i} Perm(D_{i}). As we already know that set-theoretically p_{k}(V (G_{1}, …, G_{n+1})_{k}) is defined by Res_{k}, we know now that this is also true scheme-theoretically. We conclude that Res_{k} is irreducible. □

We call the polynomial Res a generic mixed multigraded resultant. If the multidegrees of the generic polynomials are equal, we speak of a multigraded resultant. For some commutative ring R and multihomogeneous F_{1}, …, F_{n+1} ∈ R[X_{1}, Y_{1}, …, X_{n}, Y_{n}] we call Res(F_{1}, …, F_{n+1}) (where Res is the generic mixed multihomogeneous resultant for polynomials of appropriate multidegree) the multigraded resultant of F_{1}, …, F_{n+1}.

3.5.4.3 Computing resultants and solving systems

In this subsubsection we address computational problems related to multigraded resultants and the solution of zero-dimensional multihomogeneous polynomial systems. In particular, we give an algorithm to determine all solutions of a multihomogeneous polynomial system F_{1}, …, F_{n} over a field k, where each F_{i} has multidegree (d, d, …, d) for some d ∈ ℕ and the scheme V (F_{1}, …, F_{n}) is zero-dimensional. We have not explicitly found our approach in the literature, but similar algorithms for related computational problems have been proposed.

Let F_{1}, …, F_{n+1} ∈ k[X_{1}, Y_{1}, …, X_{n}, Y_{n}] be non-constant multihomogeneous polynomials of equal multidegree (d, d, …, d), and let Res(F_{1}, …, F_{n+1}) be the multigraded resultant of these polynomials. Now just as the usual Sylvester resultant, this resultant can be expressed as the determinant of a matrix each of whose entries is 0 or a coefficient of one of the polynomials F_{i}.

Let us to state this result fix the following definition.

Definition 3.58 Let M be a multigraded k[X_{1}, Y_{1}, …, X_{n}, Y_{n}]-module, and let \underline{d} ∈ ℤ^{n}. Then the k-vector subspace of M consisting of elements of multidegree \underline{d} is denoted by M\underline{d}.

We now consider the linear map

Φ : (k[X_{1}, Y_{1}, …, X_{n}, Y_{n}]_{(d−1,2d−1,...,nd−1)})^{n+1} ⟶

k[X_{1}, Y_{1}, …, X_{n}, Y_{n}]_{(2d−1,3d−1,...,(n+1)d−1)} ,
(A_{1}, …, A_{n+1}) ↦ ∑_{i=1}^{n+1} F_{i}A_{i} .

(3.29)

Note that both the domain as well as the codomain have dimension (n + 1)! · d^{n}. Now in [SZ94] it is proven:

Proposition 3.59 Let M be the matrix of Φ with respect to the monomial bases in the domain and the codomain with any ordering. Then

Res(F_{1}, …, F_{n+1}) = ± det(M) .

Note here that the resultant is only defined up to a sign, and a change of the ordering of any of the two the bases changes a sign too.

This description of the resultant immediately gives rise to the following result in the generic field RAM model:

Proposition 3.60 Given F_{1}, …, F_{n+1} of multidegree (d, …, d) one can compute Res(F_{1}, …, F_{n+1}) with a number of field and bit operations which is polynomially bounded in (n + 1)! · d^{n}.

Proposition 3.59 states in particular that V (F_{1}, …, F_{n+1}) is empty if and only if Φ is surjective, that is, the ideal (F_{1}, …, F_{n+1})_{(2d−1,3d−1,...,(n+1)d−1)} is equal to the whole ambient space k[X_{1}, Y_{1}, …, X_{n}, Y_{n}]_{(2d−1,3d−1,...,(n+1)d−1)}. This statement can be generalized:

Proposition 3.61 Let F_{1}, …, F_{m} be multihomogeneous polynomials in k[X_{1}, Y_{1}, …, X_{n}, Y_{n}] of multidegree (d, d, …, d). Then V (F_{1}, …, F_{m}) is empty if and only if (F_{1}, …, F_{m})_{(2d−1,3d−1,...,(n+1)d−1)} = k[X_{1}, Y_{1}, …, X_{n}, Y_{n}]_{(2d−1,3d−1,...,(n+1)d−1)}.

Proof. It is obvious that the latter statement implies the former. So let V (F_{1}, …, F_{m}) be empty. To show the equality we can perform a basechange. So we consider the field extension k((c_{i,j})_{i=1,...,n+1,j=1,...,m})|k, where the c_{i,j} are indeterminates, and let G_{i} := ∑_{j=1}^{m} c_{i,j}F_{j} for i = 1, …, n+1. By the following lemma, if g_{1}, …, g_{n+1} are obtained by any dehomogenization from G_{1}, …, G_{n+1}, then V (g_{1}, …, g_{n+1}) is empty. Thus V (G_{1}, …, G_{n+1}) is empty too. Therefore (G_{1}, …, G_{n+1})_{(2d−1,3d−1,...,(n+1)d−1)} is equal to the ambient space. This clearly implies that (F_{1}, …, F_{m})_{(2d−1,3d−1,...,(n+1)d−1)} is equal to the ambient space too. □

Lemma 3.62 Let k be a field, and let R be a non-trivial commutative noetherian k-algebra of dimension n. Let f_{1}, …, f_{m} ∈ R with (f_{1}, … f_{m}) = R. Now let g_{i} := ∑_{j=1}^{m} c_{i,j}f_{j} in R ⊗_{k} k((c_{i,j})_{i,j}) for i = 1, …, n + 1. Then g_{1}, …, g_{n+1} generate the unit ideal of R ⊗_{k} k((c_{i,j})_{i,j}).

Proof. This statement follows from the following statement by induction on n:

Let R be a non-trivial commutative noetherian k-algebra, and let f_{1}, …, f_{m} ∈ R with (f_{1}, …, f_{m}) = R. Then dim((R⊗_{k}k(c_{1}, …, c_{m}))/(c_{1}f_{1}+ ⋯ + c_{m}c_{m})) < dim(R ⊗_{k} k(c_{1}, …, c_{m})) = dim(R), where we define the dimension of the trivial algebra as −1.

To prove this we have to show that c_{1}f_{1} + ⋯ + c_{m}f_{m} is not contained in any minimal prime ideal of R ⊗_{k} k(c_{1}, …, c_{m}).

Now, the minimal prime ideals of R ⊗_{k} k(c_{1}, …, c_{m}) are exactly the ideals of the form (𝔭), where 𝔭 is a minimal prime ideal of R. (Let first 𝔭 be a prime ideal of R. Then R/(𝔭) ⊗_{k} k[c_{1}, …, c_{n}] ≃ (R/𝔭)[c_{1}, …, c_{n}] is a domain. Therefore R/𝔭 ⊗_{k} k(c_{1}, …, c_{n}) ≃ (R ⊗_{k} k(c_{1}, …, c_{n}))/(𝔭), which is a localization of the previous ring, is a domain too. Thus (𝔭) is prime. Let us assume that 𝔭 is minimal, and let 𝔓 ⊆ (𝔭) be a prime ideal of R ⊗_{k} k(c_{1}, …, c_{m}). Then 𝔓 ∩ R = 𝔭 by the minimality of 𝔭, thus (𝔓 ∩ R) = (𝔭). As (𝔓 ∩ R) ⊆ 𝔓, we have 𝔓 = (𝔭). We conclude that (𝔭) is a minimal prime ideal. Now let 𝔓 be any minimal prime ideal of R ⊗_{k} k(c_{1}, …, c_{m}). Then by what we just have shown (𝔓 ∩ R) is then a prime ideal of R⊗_{k} k(c_{1}, …, c_{m}). Moreover, this ideal is obviously contained in 𝔓 and thus equal to 𝔓. Now 𝔓 ∩ R is also minimal because otherwise (𝔓 ∩ P) was not minimal either.)

So let us fix a minimal prime ideal 𝔭 of R. By assumption the residue classes [f_{1}]_{𝔭}, …, [f_{m}]_{𝔭} generate R/𝔭. This implies in particular that there exists some i ∈ {1, …, m} such that [f_{i}]_{𝔭} ≠ 0. Therefore c_{1}[f_{1}]_{𝔭} + ⋯ + c_{m}[f_{m}]_{𝔭} ≠ 0 ∈ R/𝔭 ⊗_{k} k(c_{1}, …, c_{m}) ≃ (R ⊗_{k} k(c_{1}, …, c_{m}))/(𝔭). Thus c_{1}f_{1} + ⋯ + c_{m}f_{m} ∉ (𝔭). □

Proposition 3.61 implies immediately:

Proposition 3.63 Given F_{1}, …, F_{m} ∈ k[X_{1}, Y_{1}, …, X_{n}, Y_{n}] as above, one can determine if V (F_{1}, …, F_{m}) is empty in a number of field and bit operations which is polynomially bounded in m · n! · d^{n}.

We now prove:

Proposition 3.64 Given multihomogeneous polynomials F_{1}, …, F_{n} ∈ k[X_{1}, Y_{1}, …, X_{n}, Y_{n}] of multidegree (d, d, …, d) as well as a list of (n+1)·d^{n} distinct elements from k, one can determine in a number of field and bit operations which is polynomially bounded in n! · d^{n} if V (F_{1}, …, F_{n}) is zerodimensional. If this is the case, one can compute in an expected number of field and bit operations which is polynomially bounded in n! · d^{n} all its k-rational points.

Proof. Let for i = 1, …, n p_{i} : (ℙ_{k}^{1})^{n} ⟶ ℙ_{k}^{1} be the projection to i^{th} component. Then V (F_{1}, …, F_{n}) is not zero-dimensional if and only if there is some i = 1, …, n such that p_{i}(V (F_{1}, …, F_{n})) is equal to ℙ_{k}^{1}. (If p_{i}(V (F_{1}, …, F_{n})) = ℙ_{k}^{1} for some i, then clearly V (F_{1}, …, F_{n}) is not zerodimensional. Otherwise V (F_{1}, …, F_{n}) is contained in the finite set ⋂_{i=1}^{n} p_{i}^{−1}(p_{i}(V (F_{1}, …, F_{n}))).)

For each i = 1, …, n we consider the multigraded resultant of F_{1}, …, F_{n} with respect to all coordinates except X_{i}, Y_{i}. Let us denote this resultant by Res_{(X_{i},Y_{i})^{∨}}(F_{1}, …, F_{n}). By definition Res_{(X_{i},Y_{i})^{∨}}(F_{1}, …, F_{n}) vanishes exactly

on p_{i}(V (F_{1}, …, V_{n})), and one easily see with Proposition 3.57 c) that this is a homogeneous polynomial of degree n! · d^{n}. We conjecture in fact that it defines the scheme-theoretic image of V (F_{1} …, V_{n}) under p_{i} but we do not need this statement.

We thus see that V (F_{1}, …, F_{n}) is not zero-dimensional if and only if at least one of the resultants Res_{(X_{i},Y_{i})^{∨}}(F_{1}, …, F_{n}) vanishes. We can thus

decide if V (F_{1}, …, F_{n}) is zero-dimensional or not by checking if all these resultants are non-trivial.

Each of these resultants is a homogeneous polynomial of degree n! · d^{n}, thus it vanishes if and only if it vanishes on n! · d^{n} + 1 distinct points in ℙ^{1}(\overline{k}).

By assumption we have a list of n! · d^{n} elements of k at our disposal. Including ∞ these give n! · d^{n} + 1 elements of ℙ^{1}(k). We can therefore check if the resultant Res_{(X_{i},Y_{i})^{∨}}(F_{1}, …, F_{n}) vanishes by computing all the

resultants obtained by substituting X_{i} and Y_{i} with the n! · d^{n} + 1 elements of ℙ^{1}(k) and checking if the result is 0. By Proposition 3.60 each of these computations can be performed in a number of field operations which is polynomially bounded in n! · d^{n−1}, and there are n · (n! · d^{n} + 1) resultants to be computed. The overall running time is thus polynomially bounded in n! · d^{n}. We have shown the first statement of the proposition.

We now come to the computation of the k-rational solutions, provided that the system is indeed zero-dimensional.

We start off in the same way as above, and from the “evaluated resultants” we compute the resultants Res_{(X_{i},Y_{i})^{∨}}(F_{1}, …, F_{n}) by interpolation.

For this we again compute the “evaluated resultants” as determinants as in Proposition 3.59. Here for each i all the n! · d^{n} + 1 matrices have to be computed with respect to the same ordering of monomials in order that the sign is consistent.

By assumption all these resultants are non-trivial. We factorize them and determine their roots in k; let L_{i} be a list of the roots of the i^{th} resultant, that is, of the k-rational points of p_{i}(V (F_{1}, …, F_{n})).

We now compute the solutions in an iterative manner, by successively imposing conditions of the coordinates. We start out with the k-rational points in p_{1}(V (F_{1}, …, F_{n})), that is, L_{1}. Suppose now that we know the k-rational points of (p_{1}, …, p_{i})(V (F_{1}, …, F_{n})), which we have stored in a list S_{i}. Then for each point of P = (P_{1}, …, P_{i}) in S_{i} and Q in L_{i+1}, we check if the system obtained by substituting P for X_{1}, Y_{1}, …, X_{i}, Y_{i} and Q for (X_{i+1}, Y_{i+1}) is consistent, that is if it has a solution over \overline{k}. Then all tuples (P, Q) are inserted into a new list S_{i+1} for later inspection. Note here the important point that the list S_{i} has ≤ n! · d^{n} elements.

Let us give the algorithm in a more formal way:

Algorithm for solving multihomogeneous zero-dimensional systems

Input: Multihomogeneous polynomials F_{1}, …, F_{n} ∈ k[X_{1}, Y_{1}, …, X_{n}, Y_{n}] of multidegree (d, d, …, d) and n! · d^{n} distinct field elements a_{1}, …, a_{n!·d^{n}} such that V (F_{1}, …, F_{n}) is zero-dimensional.

1. For each i = 1, …, n, compute Res_{(X_{i},Y_{i})^{∨}}(F_{1}, …, F_{n}) by interpolation.

(Each of these resultants is non-trivial by assumption.)

2. Factorize these resultants and compute their roots in ℙ^{1}(k). Let L_{i} be a list of roots of the i^{th} resultant.

3. Let S_{1} ⟵ L_{1}.

4. For i = 1, …, n − 1 do Determine a list S_{i+1} consisting of elements of (ℙ^{1}(k))^{i+1} as follows: For each P = (P_{1}, …, P_{i}) ∈ L and Q ∈ L_{i+1} check if the system obtained by substituting P for X_{1}, Y_{1}, …, X_{i}, Y_{i} and Q for X_{i+1}, Y_{i+1} is consistent. If this is the case, insert (P, Q) into S_{i+1}.

5. Output S_{n}.

It is obvious that each of the lists S_{i} contains exactly the k-rational points of (p_{1}, …, p_{i})V (F_{1}, …, F_{n}). Thus the output of the algorithm consists of the k-rational points of V (F_{1}, …, F_{n}).

Let us analyze the complexity: Step 1 can clearly be performed in a number of field operations which is polynomially bounded in n! · d^{n} (cf. Proposition 3.60). Step 3 can be performed in an expected running time of O(n! · d^{n}) bit and field operations. Each of the checks in Step 4 can be performed with a number of field and bit operations which is polynomially bounded in n! · d^{n} by Proposition 3.61. Now, as already remarked each list S_{i} contains at most n! · d^{n} elements. Therefore, there are at most (n! · d^{n})^{2} tuples (P, Q) to be considered for each value of i. Thus Step 4 can also be performed with a number of bit and field operations which is polynomially bounded in n! · d^{n}. □

Over finite fields one might have to pass to a field extension of degree ≤ log_{2}(n! · d^{n}) in order that enough field elements are available. By doing so, one obtains:

Proposition 3.65 Given multihomogeneous polynomials F_{1}, …, F_{n} ∈ 𝔽_{q}[X_{1}, Y_{1}, …, X_{n}, Y_{n}] of multidegree (d, d, …, d), one can determine if V (F_{1}, …, F_{n+1}) is zero-dimensional and if this is the case compute all its 𝔽_{q}-rational points in an expected time which is polynomially bounded in n! · d^{n} · log(q).

3.5.4.4 Interpolation

Similarly to the algorithm above, the computation of the summation polynomials will be based on an interpolation. In contrast to the computation above, the result is however a multihomogeneous polynomial. Here we consider the corresponding interpolation problem.

Let us first consider the classical 1-dimensional interpolation problem in the context of homogeneous polynomials: Let d ∈ ℕ and (a_{j}, b_{j}) ∈ k^{2} − {0} for j = 1, …, d + 1 such that the induced elements in ℙ^{1}(k) are pairwise distinct. Moreover, let c_{1}, …, c_{d+1} ∈ k. Then there is exactly one homogeneous polynomial F (X, Y) ∈ k[X, Y] of degree d with F (a_{j}, b_{j}) = c_{j} for all j = 1, …, d + 1. Moreover, with

L_{j} := ∏_{ℓ≠j} \frac{b_{ℓ}X − a_{ℓ}Y}{a_{j}b_{ℓ} − a_{ℓ}b_{j}}  (3.30)

we have

F = ∑_{j} c_{j}L_{j} .  (3.31)

Proposition 3.66 Let \underline{d} ∈ ℕ^{n}, and let S := \{1, …, d_{1} + 1\} × ⋯ × \{1, …, d_{n} + 1}. Let k be a field, let (a_{i,j}, b_{,j}) ∈ k^{2} − {0} for i = 1, …, n and j = 1, …, d_{i} + 1 such that for each i, the elements (a_{i,1} : b_{i,1}), …, (a_{i,d_{i}+1} : b_{i,d_{i}+1}) ∈ ℙ^{1}(k) are pairwise distinct, and let c\underline{j} ∈ k for \underline{j} ∈ S.

Then there is exactly one multihomogeneous polynomial F ∈ k[X_{1}, Y_{1}, …, X_{n}, Y_{n}] of multidegree \underline{d} with F (a_{1,j_{1}}, b_{1,j_{2}}, …, a_{n,j_{n}}, b_{n,j_{n}}) = b\underline{j} for all \underline{j} ∈ S.

Proof. The case n = 1 is treated above. For the general case we proceed by induction on n.

Let us first prove the uniqueness. For this, let \underline{d}, S, k, and (a_{i,j}, b_{,j}) ∈ k^{2} − {0} for i = 1, …, n and j = 1, …, d_{i} + 1 be as in the proposition, and let F ∈ k[X_{1}, Y_{1}, …, X_{n}, Y_{n}] be of multidegree \underline{d} with F (a_{1,j_{1}}, b_{1,j_{2}}, …, a_{n,j_{n}}, b_{n,j_{n}}) = 0 for all \underline{j} ∈ S.

Then be induction hypothesis, for each j = 1, …, d_{n} + 1, F (X_{1}, Y_{1}, …, X_{n−1}, Y_{n−1}, a_{n,j}, b_{n,j}) = 0 ∈ k[X_{1}, Y_{1}, …, X_{n−1}, Y_{n−1}]. We now regard F (X_{1}, Y_{1}, …, X_{n}, Y_{n}) as a bivariate homogeneous polynomial in the ring k(X_{1}, Y_{1}, …, X_{n−1}, Y_{n−1})[X_{n}, Y_{n}]. Then by the uniqueness of the solution of the 1-dimensional interpolation problem, we conclude that F = 0.

We come to the existence. So let objects as in the proposition be given. For each j = 1, …, d_{n} + 1 there is by induction assumption exactly one

multihomogeneous polynomial C_{j} ∈ k[X_{1}, Y_{1}, …, X_{n−1}, Y_{n−1}] of multidegree (d_{1}, …, d_{n−1}) with C_{j}(a_{1,j_{1}}, b_{1,j_{2}}, …, a_{n−1,j_{n−1}}, b_{n−1,j_{n−1}}) = c\underline{j} for all \underline{j} ∈ S with j_{n} = j. Let L_{j} := ∏_{ℓ≠j} \frac{b_{ℓ}X_{n}−a_{ℓ}Y_{n}}{a_{j}b_{ℓ}−a_{ℓ}b_{j}} for j = 1, …, d_{n} + 1. Then the polynomial F := ∑_{j} C_{j}L_{j} fulfills the requirements. □

We call the computation problem to determine the polynomial F, given the data in the proposition the multihomogeneous interpolation problem. One can solve this problem with an obvious linear algebra approach. We therefore obtain:

Proposition 3.67 The multihomogeneous interpolation problem can be solved in a number of field and bit operations which is polynomially bounded in (d_{1} + 1) ⋯ (d_{n} + 1), where as above \underline{d} is the multidegree of the polynomial to be computed.

3.5.5 The summation polynomials

In this subsection we prove Propositions 3.35 and 3.37 on the summation polynomials. Let E be an elliptic curve over a field k, let m ∈ ℕ, m ≥ 2, and let φ : E ⟶ ℙ_{k}^{1} be a covering of degree 2 which satisfies φ ∘ [−1] = φ.

Now let N_{m} (or N) be the kernel of the addition map E^{m} ⟶ E, (P_{1}, …, P_{m}) ↦ P_{1} + ⋯ + P_{m}. (Here the P_{i} are Z-valued points for some kscheme Z.) Note that N is isomorphic to E^{m−1} via the projection (P_{1}, …, P_{m}) ↦ (P_{1}, …, P_{m−1}).

We now consider the projection E^{m} ⟶ (ℙ_{k}^{1})^{m} induced by φ. Note that [−1] operates on N, and the map N ↪ E^{m} ⟶ (ℙ_{k}^{1})^{m} factors through the quotient N/[−1].

Definition 3.68 Let H_{φ,m} (or H_{m} or H) be the image of N in (ℙ_{k}^{1})^{m} (with the induced subscheme structure).

Lemma 3.69

a) The induced map N/[−1] ⟶ H is finite and birational.

b) H is a hyperplane (ℙ_{k}^{1})^{m} of multidegree (2^{m−2}, …, 2^{m−2}).

c) The projections H ⟶ ℙ_{K}^{m−1} to any m − 1 of the m components are flat coverings of degree 2^{m−2}.

Proof. The maps N ↪ E^{m} ⟶ (ℙ_{k}^{1})^{m} and H ⟶ (ℙ_{k}^{1})^{m} are clearly finite. It follows immediately that the induced map N ⟶ H is also finite. This in turn implies that the induced map N/[−1] ⟶ H is finite too (by definition of the geometric quotient).

Let us now consider the commutative diagram

[figure: N; E^{m}; E^{m−1}; H; (ℙ_{k}^{1})^{m} ,; (ℙ_{k}^{1})^{m−1}]

where the morphisms E^{m} ⟶ E^{m−1} and (ℙ_{k}^{1})^{m} ⟶ (ℙ_{k}^{1})^{m−1} are the projections to the first m − 1 coordinates. Then the induced morphism N ⟶ E^{m−1} is an isomorphism, and the morphism E^{m−1} ⟶ (ℙ_{k}^{1})^{m−1} is finite separable of degree 2^{m−1}.

Below we show that the map N ⟶ H has degree 2, and the map H ⟶ (ℙ_{k}^{1})^{m−1} generically has degree 2^{m−2}. This statement implies statements a) and b) in the lemma. Indeed, first as N ⟶ H has degree 2, the induced map N/[−1] ⟶ H has degree 1, that is, it is birational. Second, the fact that the map H ⟶ (ℙ_{k}^{1})^{m−1} is quasi-finite and generically of degree 2^{m−2} implies that the last component of the multidegree of H is 2^{m−2}. By “by symmetry” (or by a repetition of the argument with projections to different components) then all components of the multidegree are 2^{m−2}.

Note first that we have already established that both maps are separable, and that the product of the two degrees is 2^{m−1}. Therefore, it suffices to show that the extension of function fields k(N)|k(H) has separability degree 2.

We are going to apply the isomorphism E^{m−1} ⟶ N which is the inverse of the projection N ⟶ E^{m−1} and consider the extension k(E^{m−1})|k(H).

Let Ω := \overline{k(E^{m−1})}, let p_{i} : E^{m−1} ⟶ E be the projection to the i^{th} coordinate, and let P_{i} ∈ E(Ω) be the induced points. (That is, P_{i} is the morphism Spec(Ω) ⟶ Spec(k(E^{m−1})) ⟶ E^{m−1} ⟶^{p_{i}} E, where the first two morphisms are the canonical ones.) Let p_{m} := − ∑_{i=1}^{m−1} p_{i} and P_{m} := − ∑_{i=1}^{m−1} P_{i}.

Then the inverse of the projection N ⟶ E^{m−1} to the first n − 1 coordinates is given by (p_{1}, …, p_{m}); the corresponding k(E^{n−1})-valued point of N is given by (P_{1}, …, P_{m}).

The P_{i} are linearly independent, since the p_{i} are linearly independent, the map Mor_{k}(E^{m−1}, E) ⟶ E(k(E^{m−1})) is injective (in fact, it is an isomorphism), and the map E(k(E^{m−1})) ⟶ Spec(Ω) is injective too.

Now let us consider the preimage of x(P_{1}, …, P_{m}) = (x∘P_{1}, …, x∘P_{m}) ∈ H(Ω) in N(Ω). This set consists of all tuples (ϵ_{1}P_{1}, …, ϵ_{m}P_{m}) ∈ E^{m}(Ω) with ϵ_{i} = ±1 and ∑_{i=1}^{m} ϵ_{i}P_{i} = O. Clearly, there are exactly two such tuples:

±(P_{1}, …, P_{m}).

We conclude: There are exactly two Ω-valued points of E^{m−1} which induce the Ω-valued point (x ∘ P_{1}, …, x ∘ P_{m}) ∈ H(Ω) under the projection N ⟶ H. This means that there are exactly two extensions of the canonical inclusion k(E^{m−1}) ⟶ Ω to k(N). Therefore, the separability degree of the extension k(E^{m−1})|k(H) is 2.

We come to c). We still (wlog.) only consider the projection p : H ⟶ (ℙ_{k}^{1})^{m−1} to the first m − 1 components. As the map is quasi-finite and as H has multidegree (2^{m−2}, …, 2^{m−2}), each fiber has degree 2^{m−2}. With other words: The Hilbert polynomials of the fibers are equal to 2^{m−2}. With [Har77, Theorem 9.9] we conclude that p is flat.

Note that H is a projective over (ℙ^{1})^{m−1}, thus in particular proper. Moreover, p is quasi-finite. These two properties together are equivalent to being finite by [Gro61, Proposition 4.4.2]. □

Now clearly, if S is any irreducible polynomial in k[X_{1}, Y_{1}, …, X_{m}, Y_{m}] which is multihomogeneous, then S satisfies the conditions of Proposition 3.35 if and only if H = V (S). This establishes Proposition 3.35.

Thus the m^{th} summation polynomial (cf. Definition 3.36) with respect to φ is the (up to a multiplicative constant unique) polynomial S with V (S) = H.

Remark 3.70 Let α ∈ Aut(ℙ_{k}^{1}). Then H_{α∘φ,m} = α(H_{φ,m}), with other words: H_{α^{−1}∘φ,m} = α^{−1}(H_{φ,m}). This implies that S_{α^{−1}∘φ,m} = α^{∗}(S_{φ,m}).

We now discuss how the summation polynomials for elliptic curves in Weierstraß form can be given in an explicit and constructive way, following [Sem98].

Lemma 3.71 Let E be an elliptic curve in ℙ_{k}^{2} in Weierstraß form:

E = V (Y^{2}Z + a_{1}XY Z + a_{3}Y Z^{2} − (X^{3} + a_{2}X^{2}Z + a_{4}XZ^{2} + a_{6}Z^{3}))

with a_{1}, a_{2}, a_{3}, a_{4}, a_{6} ∈ k and O = [0 : 1 : 0]. Then the 3^{rd} summation polynomial of E with respect to x_{|E} is given by

((x_{1}^{2}x_{2}^{2} + x_{2}^{2}x_{3}^{2} + x_{1}^{2}x_{3}^{2}) − 2(x_{1}^{2}x_{2}x_{3} + x_{1}x_{2}^{2}x_{3} + x_{1}x_{2}x_{3}^{2})
−(a_{1}^{2} + 4a_{2})x_{1}x_{2}x_{3} − (a_{1}a_{3} + 2a_{4}) · (x_{1}x_{2} + x_{2}x_{3} + x_{1}x_{3})
−(a_{3}^{2} + 4a_{6}) · (x_{1} + x_{2} + x_{3})
−a_{1}^{2}a_{6} + a_{1}a_{3}a_{4} − a_{2}a_{3}^{2} − 4a_{2}a_{6} + a_{4}^{2}) · Y_{1}^{2}Y_{2}^{2}Y_{3}^{2} .

Sketch of the proof. Let S be the polynomial in the lemma. Using the inversion and addition formulae for elliptic curves in Weierstraß form (cf. [Sil86]), one can check (with a rather lengthy computation) that for all P_{1}, P_{2} ∈ E(\overline{k}), S(x(P_{1}), x(P_{2}), x(P_{1} + x(P_{3})) = 0. This implies that S_{3} divides S. As both polynomials have multidegree (2, 2, 2), it follows that they are equal. Let us note here that one only has to check that S(x(P_{1}), x(P_{2}), x(P_{1} + P_{3})) for P_{1} ≠ ±P_{2} and P_{1}, P_{2} ≠ O because then S vanishes on an open part of H_{3} and thus also on all of H_{3}. □

Let us indicate how the polynomial S was found, following [Sem04]:

Let P_{1}, P_{2} ∈ E(\overline{k}) with P_{1}, P_{2} ≠ O and P_{1} ≠ ±P_{2}. Then clearly both x(P_{1} +P_{2}) and x(P_{1} −P_{2}) satisfy the polynomial (x−x(P_{1} +P_{2}))(x−x(P_{1} + P_{2})). So we computed this polynomial over the field ℚ(a_{1}, a_{2}, a_{3}, a_{4}, a_{6}) and for “generic” P_{1}, P_{2}, using the computer algebra system MAGMA. The polynomial S is then obtained by multiplication with the denominator and homogenization.

Lemma 3.72 Let E still be an elliptic curve and φ : E ⟶ ℙ_{k}^{1} a covering of degree 2 with φ ∘ [−1] = φ. Let s, t ∈ ℕ with s, t ≥ 2. Then

S_{φ,s+t}(X_{1}, Y_{1}, …, X_{s+t}, Y_{s+t}) =
Res_{(X,Y)}(S_{φ,s+1}(X_{1}, Y_{1}, …, X_{s}, Y_{s}, X, Y),
S_{φ,t+1}(X_{s+1}, Y_{s+1}, …, X_{s+t}, Y_{s+t}, X, Y)) .

Here by Res_{(X,Y)} we mean the usual Sylvester resultant for homogeneous polynomials in X and Y of degrees 2^{s−1} and 2^{t−1}.

Proof. For (P_{1}, …, P_{s+t}) ∈ (E(\overline{k}))^{s+t} we have P_{1} + ⋯ + P_{s+t} = O if and only if there exists some P ∈ E(\overline{k}) with P_{1} + ⋯ + P_{s} + P = O and P_{s+1} + ⋯ + P_{s+t} + P = O.

It follows that topologically the hyperplane H_{s+t} is the image of V (S_{φ,s+1}(X_{1}, Y_{1}, …, X_{s}, Y_{s}, X, Y), S_{φ,t+1}(X_{s+1}, Y_{s+1}, …, X_{s+t−1}, Y_{s+t}, X, Y)) in (ℙ_{k}^{1})^{n}×Proj(k[X, Y]) under the projection to (ℙ_{k}^{1})^{n}. As H_{s+t} is irreducible it follows that the resultant in the lemma is (up to a multiplicative constant) a power of S_{φ,s+t}.

In order to prove that the resultant is (up to a constant) equal to S_{φ,s+t}, we consider their multidegrees.

The generic Sylvester resultant for polynomials of degrees a and b has degree b in the coefficients of the first polynomial and degree a in the coefficients of the second polynomial. We apply this with a = 2^{s−1} and b = 2^{t−1}. In our case we obtain a polynomial of degree 2^{s−1} · 2^{t−1} = 2^{s+t−2} in (X_{i}, Y_{i}) for all i = 1, …, s + t.

As S_{φ,s+t} has multidegree (2^{s+t−2}, …, 2^{s+t−2}), the result follows. □

The two preceeding lemmata give rise to algorithmic constructions of the summation polynomials.

First, given an elliptic curve in Weierstraß form and a covering of degree 2 φ : E ⟶ ℙ_{k}^{1} with φ ∘ [−1] = φ (which means that the automorphism α ∈ Aut(ℙ_{k}^{1}) with φ = α ∘ x_{|E} is given), one can easily determine S_{φ,3} via Lemma 3.71 and Remark 3.70.

Further, one can compute S_{φ,m} for m ≥ 3 from S_{φ,m−1} and S_{φ,3} by applying the above lemma with s = m − 2 and t = 2. This computation can be performed via interpolation provided we have 2^{m−2} distinct field elements available (which give rise to 2^{m−2} + 1 distinct elements in ℙ^{1}(k)) (cf. Proposition 3.67). We therefore obtain:

Proposition 3.73 Given an elliptic curve E over a field k in Weierstraß form and a covering φ : E ⟶ ℙ_{k}^{1} of degree 2 with φ ∘ [−1] = φ, a natural number m ≥ 3 and a list of 2^{m−2} elements of k, one can compute the m^{th} summation polynomial of E with respect to φ in a number of field and bit operations of Poly(e^{m^{2}}).

Proposition 3.37 is a consequence of this proposition. (It might be necessary to compute in field extensions.)

3.5.6 Geometric background on the algorithm and analysis

The main purpose of this subsection is to prove Propositions 3.41 and 3.47. Additionally, we give some background information on the definition of the factor base from a geometric point of view.

3.5.6.1 Weil restrictions

We make use of Weil restrictions of schemes. Here we briefly recall the definition and some basic properties of Weil restrictions. For further information we refer to [BLR80, 7.6] and [Die01, Chapter 1]. Let us first fix the following terminology:

Terminology 3.74 Let X and Y be locally noetherian schemes. Then a finite and flat morphism X ⟶ Y is also called a flat covering.

Note that a flat covering is locally free (see [Mat89, Theorem 7.10]).

Now let S′ and S locally noetherian schemes, and let a flat covering S′ ⟶ S be fixed. Let X′ be an S′-scheme such that the fibers of X′ over S′ are quasi-projective. Then one can show that the functor from S-schemes to sets Z ↦ Mor_{S′}(Z_{S′}, X′) is representable by an S-scheme; the (up to unique isomorphism unique) representing object is called the Weil restriction of X′ with respect to S′ ⟶ S. We denote it by Res_{S}^{S′}(X′).^{11}

11The similarity between the notations for Weil restrictions and resultants is accidental.

A reformulation of this definition is: The Weil restriction of X′ with respect to S′ ⟶ S is a an S-scheme Res_{S}^{S′}(X′) together with an S′-morphism u : (Res_{S}^{S′}(X′))_{S′} ⟶ X′ such that the following holds: Whenever Z is an S-scheme, and α : Z ×_{S} S′ = Z_{S′} ⟶ X′ is an S′-morphism, there is a unique S-morphism β : Z ⟶ Res_{S}^{S′}(Z) with α = β_{S′} ∘ u, where β_{S′} := β ×_{S} S′ = β ×_{S} id_{S′}. We denote the morphism β by α_{⊚}.

The assignment X ↦ Res_{S}^{S′}(X′) gives rise to a functor (which we call scalar-restriction functor) from the category of S′-schemes with quasi-pro-jective fibers to the category of S-schemes. Moreover, if X′ is an affine S′-scheme (that is, the structural morphism is affine), then Res_{S}^{S′}(X′) is an affine S-scheme.

We will use the following two lemmata.

Lemma 3.75 Let S′ ⟶ S′ be as above, and let X′, Y′, W′ be S′-schemes with S′-morphisms X′ ⟶ W′ and Y′ ⟶ W′. Then we have a Cartesian diagram

\xymatrix{Res_{S}^{S′}(X′ ×_{W′} Y′) \ar[r] \ar[d] & Res_{S}^{S′}(Y′) \ar[d] \\ Res_{S}^{S′}(X′) \ar[r] & Res_{S}^{S′}(W′)}

with the obvious canonical morphisms.

Proof. Let for this Z be an S-scheme, and let two S-morphisms Z ⟶ Res_{S}^{S′}(X′) and Z ⟶ Res_{S}^{S′}(Y′) be given which induce the same morphism Z ⟶ Res_{S}^{S′}(W′). These morphisms induce S′-morphisms Z_{S′} ⟶ X′ and Z_{S′} ⟶ Y′, again inducing the same morphism to W′. Thus by the universal property of the product, we have an induced morphism Z_{S′} ⟶ X′. Again this morphism corresponds to a morphism Z ⟶ Res_{S}^{S′}(X′); it is immediate that it has the correct property. □

Lemma 3.76 Let S′ ⟶ S′ as above, let T be an S-scheme, and let T′ := T ×_{S} S′. Let X′ be a T′-scheme with structural morphism α : X′ ⟶ T′.

Let v : (Res_{T}^{T′}(X′))_{T′} ⟶ X′ be the universal morphism; v is thus a T′-morphism. We have (Res_{T}^{T′}(X′)) ×_{T} T′ ≃ (Res_{T}^{T′}(X′)) ×_{S} S′, and v is in particular an S′-morphism. Thus by the universal property of Res_{S}^{S′}(X′) we have an induced S-morphism v_{⊚} : Res_{T}^{T′}(X′) ⟶ Res_{S}^{S′}(X′).

Now we have a Cartesian diagram

\xymatrix{Res_{T}^{T′}(X′) \ar[d] \ar[r] & Res_{S}^{S′}(X′) \ar[d] \\ T \ar[r] & Res_{S}^{S′}(T′) ,}

where the morphisms are defined as follows: The left morphism is the structural morphism, the right morphism is Res_{S}^{S′}(α), the upper morphism is v_{⊚}, and the lower morphism is the morphism id_{⊚} : T ⟶ Res_{S}^{S′}(T′) corresponding to the identity on T′ under the defining functorial property of Res_{S}^{S′}(T′).

This lemma follows from [Die01, Chapter I, Lemma 1.2].

Let now K|k be a finite field extension. Then if X′ is a quasi-projective (resp. projective) scheme over K, Res_{k}^{K}(X′) is a quasi-projective (resp. projective) scheme of dimension [K : k] · dim(X′) over k. Note that by the defining functorial property of the Weil restriction we have in particular a bijection

X′(K) = Mor_{K}(Spec(K), X′) ⟶ Res_{k}^{K}(X′)(k) = Mor_{k}(Spec(k), Res_{k}^{K}(X′)),

↦ P_{⊚} .

If X′ is a group scheme over K, Res_{k}^{K}(X′) is in a natural way again a group scheme, and in particular if A′ is an abelian variety over K, then Res_{k}^{K}(A) is in a natural way an abelian variety too.

Let K|k now be an extension of finite fields of degree n, and let σ be the relative Frobenius automorphism of K|k. We denote the induced isomorphism Spec(k) ⟶ Spec(k) again by σ. Let X′ be a quasi-projective K-scheme. Then we have a canonical isomorphism

(Res_{k}^{K}(X′))_{K} ≃ ∏_{i=0}^{n−1} σ^{i}(X′)

of K-schemes under which the universal morphism u : (Res_{k}^{K}(X′))_{K} ⟶ X′ corresponds to the projection

u : ∏_{i=0}^{n−1} σ^{i}(X′) ⟶ X′ .

Moreover, if Z is any k-scheme and α : Z_{K} ⟶ X′ is a morphism, then (α_{⊚})_{K} corresponds to

(α, σ(α), …, σ^{n−1}(α)) : Z_{K} ⟶ ∏_{i=0}^{n−1} σ^{i}(X′)

and if φ : X′ ⟶ Y′ is a morphism of quasi-projective K-schemes, then Res_{k}^{K}(φ) corresponds to

φ × σ(φ) × ⋯ × σ^{n−1}(φ) : ∏_{i=0}^{n−1} σ^{i}(X′) ⟶ ∏_{i=0}^{n−1} σ^{i}(Y′) .

3.5.6.2 Background on the factor base

Let still K|k be an extension of finite fields of degree n, and as above let σ the Frobenius automorphism relative to k. Let E be an elliptic curve over K, and let us fix a covering φ : E ⟶ ℙ_{K}^{1} of degree 2 with φ ∘ [−1] = φ.

Let ι = id_{⊚} : ℙ_{k}^{1} ⟶ Res_{k}^{K}(ℙ_{K}^{1}) be the morphism corresponding to the identity on ℙ_{K}^{1}. One can easily see (for example via base change to K) that ι is a closed immersion.

Let V be the preimage of ι_{⊚}(ℙ_{k}^{1}) under Res_{k}^{K}(φ) : Res_{k}^{K}(E) ⟶ Res_{k}^{K}(ℙ_{k}^{1}). This means by definition that we have a Cartesian diagram

\xymatrix{V \ar@{^{(}->}[r] \ar[d] & Res_{k}^{K}(E) \ar[d]^{Res_{k}^{K}(φ)} \\ ℙ_{k}^{1} \ar@{^{(}->}[r]^{ι_{⊚}} & Res_{k}^{K}(ℙ_{k}^{1}) .}  (3.32)

Note that Res_{k}^{K}(φ) : Res_{k}^{K}(E) ⟶ Res_{k}^{K}(ℙ_{k}^{1}) is a flat covering of degree 2^{n} (as one sees after base change to K), and therefore V ⟶ ℙ_{k}^{1} is a flat covering of degree 2^{n} too.

Let us now explain the connection of these definitions to the definition of the factor base in the algorithm for Theorem 4: Let us consider a particular run of the algorithm. Then under the bijection ℙ^{1}(K) ≃ Res_{k}^{K}(ℙ_{K}^{1})(k) the inclusion ℙ^{1}(k) ⊆ ℙ^{1}(K) corresponds to ι_{⊚}(ℙ_{k}^{1}(k)) ⊆ Res_{k}^{K}(ℙ_{K}^{1}))(k). Therefore the factor base F = (φ^{−1}(𝔸_{k}^{1}))(k) corresponds to V (k) − {O} under the bijection E(K) ≃ Res_{k}^{K}(E)(k). One can therefore say that the factor base is defined in a “geometric way” – something that immediately apparent from the definition of the factor base in the algorithm.

The addition on the Weil restriction induces a morphism V^{n} ⟶ Res_{k}^{K}(E), and – again under the bijection E(K) ≃ Res_{k}^{K}(E)(k) – for P ∈ E(K) the tuples (P_{1}, …, P_{n}) with φ(P_{i}) ∈ ℙ^{1}(k) and ∑_{i} P_{i} = P correspond to the k-valued points of the fiber of V^{n} ⟶ Res_{k}^{K}(E) at P_{⊚}, the k-rational point of Res_{k}^{K}(E) corresponding to P.

3.5.6.3 Study of the factor base

In this subsubsection we study the addition morphism V^{n} ⟶ Res_{k}^{K}(E).

Proposition 3.77 Let Condition (3.45) be satisfied. Then

a) V is geometrically reduced and geometrically irreducible (and thus birational to a curve),

b) the addition morphism V^{n} ⟶ Res_{k}^{K}(E) is surjective.

Proof. By (3.32) and Lemma 3.76 we have V ≃ Res_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(E), with respect to the covering φ : E ⟶ ℙ_{k}^{1}. This implies that

V_{K} ≃ E ×_{ℙ_{K}^{1}} σ(E) ×_{ℙ_{K}^{1}} ⋯ ×_{ℙ_{K}^{1}} σ^{n−1}(E) ,  (3.33)

where the morphisms are φ : E ⟶ ℙ_{K}^{1}, …, σ^{n−1}(φ) : σ^{n−1}(E) ⟶ ℙ_{K}^{1}.

Let us now fix an algebraic closure \overline{k(x)} of k(x). Let us denote the Frobenius automorphism of \overline{k}|k also by σ. Let us then prolong σ first to \overline{k}(x) via σ(x) := x, and and let us fix any automorphism of \overline{k(x)}|k(x) which restricts to σ; let us denote this automorphism again by σ. Moreover, let us fix an injection of \overline{k}(E) into \overline{k(x)} over k(x).

We now consider the total quotient ring of the scheme V\overline{k}, which is isomorphic to

\overline{k}(E) ⊗_{k(x)} σ(\overline{k}(E)) ⊗_{\overline{k}(x)} ⋯ ⊗_{\overline{k}(x)} σ^{n−1}(\overline{k}(E)) .

By Condition (3.45) for i = 1, …, n − 1, the extension σ^{i}(\overline{k}(E))|\overline{k}(x) is ramified at σ^{i}(P) but for any j = 0, …, i−1, the extension σ^{j}(\overline{k}(E))|\overline{k}(x) is not ramified at σ^{i}(P), thus the extension \overline{k}(E)σ(\overline{k}(E)) ⋯ σ^{i−1}(\overline{k}(E))|\overline{k}(x) in \overline{k(x)} is also not ramified at σ^{i}(P). Thus σ^{i}(\overline{k}(E)) is not contained in \overline{k}(E)σ(\overline{k}(E)) ⋯ σ^{i−1}(\overline{k}(E)). It follows therefore by induction that the extension \overline{k}(E)σ(\overline{k}(E) ⋯ σ^{n−1}(\overline{k}(E))|\overline{k}(x) in \overline{k(x)} has degree 2^{n}. Thus the total quotient ring of V\overline{k} is is isomorphic to the composite \overline{k}(E)σ(\overline{k}(E)) ⋯ σ^{n−1}(\overline{k}(E)) in \overline{k(x)} and therefore a field. We see that V\overline{k} is reduced and irreducible, thus V is geometrically reduced and geometrically irreducible.

We come to b). Let C be the curve which is birational to V, and let us fix a birational morphism π : C ⟶ V. Let β : C ⟶ Res_{k}^{K}(E) be the composition of π with the inclusion into Res_{k}^{K}(E). We claim that the induced homomorphism

β_{∗} : J_{C} ⟶ Res_{k}^{K}(E)

is surjective.

We show this statement after base change to K. Let v : V = Res_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(E)×_{ℙ_{k}^{1}}

ℙ_{K}^{1} ≃ Res_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(E) ×_{k} K ⟶ E be the universal morphism (this is the projec-

tion to the first factor in (3.33)), and as always let u : (Res_{k}^{K}(E))_{K} ⟶ E be the universal morphism. Let ψ := v ∘ π_{K} : C_{K} ⟶ E.

Note that the inclusion V = Res_{ℙ_{k}^{1}}^{ℙ_{K}^{1}}(E) ⟶ Res_{k}^{K}(E) is given by v_{⊚} (cf. Lemma 3.76). We therefore have

β = v_{⊚} ∘ π = (v ∘ π_{K})_{⊚} = ψ_{⊚} .

Thus β_{K} is given by

(ψ, σ(ψ), …, σ^{n−1}(ψ)) : C_{K} ⟶ E × σ(E) × ⋯ × σ^{n−1}(E) ,

and we have

(β_{∗})_{K} = (ψ_{∗}, σ(ψ)_{∗}, …, σ^{n−1}(ψ)_{∗}) .

Let now γ : E × σ(E) × ⋯ × σ^{n−1}(E) ⟶ J_{C} be homomorphism which is induced by (σ^{i}(ψ))^{∗} : σ^{i}(E) ⟶ (J_{C})_{K}. (Under the identification of J_{C} with its dual, this is the dual homomorphism to (β_{∗})_{K}.)

We claim that

(β_{∗})_{K} ∘ γ = [2^{n−1}] .

For this we have to show:

• i = 0, …, n − 1 : (σ^{i}(ψ))_{∗} ∘ (σ^{i}(ψ))^{∗} = [2^{n−1}]

• i, j = 0, …, n with i ≠ j : (σ^{j}(ψ))_{∗} ∘ (σ^{i}(ψ))^{∗} = 0

By the proof for item a) the extension K(C)|K(x) ≃ K(V)|K(x) is isomorphic to the extension K(E) ⋯ σ(K(E)) ⋯ σ^{n−1}(K(E))|K(x) (where the composite is with respect to the fixed inclusions into \overline{k(x)}). The first claim is therefore obvious. For the second claim we consider the diagram of function fields

[figure: \overline{k}(C); σ^{i}(\overline{k}(E)) σ^{j}(\overline{k}(E)); σ^{i}(\overline{k}(E)); σ^{j}(\overline{k}(E)) .; \overline{k}(x)]

As σ^{i}(\overline{k}(E)) σ^{j}(\overline{k}(E))|\overline{k}(x) is a ℤ/2ℤ × ℤ/2ℤ-extension, the conorm-norm homomorphism from Cl^{0}(σ^{i}(\overline{k}(E))) to Cl^{0}(σ^{j}(\overline{k}(E))) via σ^{i}(\overline{k}(E)) σ^{j}(\overline{k}(E)) is trivial. Thus the conorm-norm homomorphism via \overline{k}(C) is trivial too. This gives the second claim.

We have therefore derived that β_{∗} : J_{C} ⟶ Res_{k}^{K}(E) is surjective.

Let for i ∈ ℕ a_{i} : V^{i} ⟶ Res_{k}^{K}(E) be the map which is induced by the addition in Res_{k}^{K}(E). Assume now that the map a_{n} : V^{n} ⟶ Res_{k}^{K}(E) is not surjective. Then a_{n}(V^{n}) a variety of dimension < n. Therefore dim(a_{i}(V^{i})) = dim(a_{i+1}(V^{i+1})) for some i < n. Moreover, a_{i+1}(V^{i+1}) clearly contains a translate of a_{i}(V^{i}). Thus a_{i+1}(V^{i+1}) is equal to a translate of a_{i}(V^{i}). By induction one easily sees that a_{m}(V^{m}) is a translate of a_{i}(V^{i}) for all m ≥ i. But the image of β_{∗} is a_{g(C)}(V^{g(C)}), a contradiction. □

□

Proposition 3.78 Let us still assume that Condition 3.45) is satisfied, and let C be as above. Then

a) The genus of C is ≤ (2n − 1) · (2^{n} − 1).

b) C(\overline{k}) contains at most n · 2^{n+2} points which map to singular points under the birational morphism π : C ⟶ V.

Proof. By a general result on elementary abelian extensions (see e.g. [KR89]) we have

g(C) = ∑_{L} g(L) ,

where L runs over all subextensions of \overline{k}(C)|\overline{k}(x) of degree 2. We show below that the genus of a function field L as in the sum is always ≤ 2n − 1. This implies that g(C) ≤ (2n − 1) · (2^{n} − 1).

To show the claim on the subfields L we proceed with a case distinction. \underline{Let q be even.} By Artin-Schreier theory every subfield L of \overline{k(x)}|k(x) of degree 2 corresponds to the a 1-dimensional subspace of the 𝔽_{2}-vector space \overline{k}(x)/P(\overline{k}(x)), where P is the Artin-Schreier operator.

If now \overline{k}(E) corresponds to ⟨\overline{f}⟩, where \overline{f} is the residue class of some f ∈ \overline{k}(x), then each field L as in the sum corresponds to ⟨a_{0}\overline{f} + a_{1}\overline{σ(f)} + ⋯ + a_{n−1}\overline{σ^{n−1}(f)}⟩ for a uniquely defined tuple (a_{0}, …, a_{n−1}) ∈ 𝔽_{2}^{n} − \{0\}. \underline{Let first j(E) = 0.} In this case the extension \overline{k}(E)|\overline{k}(x) is ramified at one place, and \overline{k}(E) corresponds to some space ⟨\overline{f}⟩, where f is either a polynomial of degree 3 or of the form \frac{g}{(x−λ)^{3}} for λ ∈ \overline{k} and deg(g) = 3.

Using [Sti93, Proposition III.7.8] one sees: If L is any field as in the sum, then L|\overline{k}(x) is ramified at at most n places (this is also immediately obvious), and the corresponding discriminant exponents are all 4. This implies that the genus of L is ≤ 2n − 1. \underline{Let now j(E) ≠ 0.} In this case \overline{k}(E)|\overline{k}(x) is ramified at 2 places, and \overline{k}(E) corresponds to ⟨\overline{f}⟩, where f is the sum of two distinct polynomials f_{1}, f_{2} such that each of these polynomials is either x or \frac{1}{x−a} for some a ∈ \overline{k}. Now each subfield L as in the sum is ramified over at most 2n places and the different exponents are all 2. Again the genus of L is ≤ 2n − 1.

\underline{Let q be odd.} In this case \overline{k}(E)|\overline{k}(x) is (tamely) ramified at 4 places. If thus L is as in the sum, L|\overline{k}(x) is ramified at at most 4n places. Thus the genus of L is ≤ 2n − 1.

We come to b). Let S be the set of points of ℙ^{1}(\overline{k}) over which one of the coverings σ^{i}(E) ⟶ ℙ1 ; \overline{k} is ramified. Using the fact that a morphism obtained from an étale morphism via base change is étale we obtain: The canonical morphism V ⟶ ℙ_{k}^{1} is étale outside S. This implies that V is smooth outside the preimage of S, and the birational morphism π : C ⟶ V is an isomorphism outside the preimages of S. With other words: All points in C(\overline{k}) which map to singular points of V are contained in the preimage of S.

As the covering C ⟶ ℙ_{k}^{1} has degree 2^{n}, the preimage of the set S has at most #S · 2^{n} ≤ 4n · 2^{n} elements. □

Remark 3.79 Let k = 𝔽_{q}. Then under Condition 3.45 by the above propositions, and the Hasse-Weil bound we have

\begin{matrix}#\{P ∈ E(K) | φ(P) ∈ ℙ^{1}(k)\} = #V (k) \\ ≥ q + 1 − 2 · (2n − 1) · (2^{n} − 1) · q^{\frac{1}{2}} − n · 2^{n+2} + 1 . \end{matrix}

For fixed n this is clearly ∼ q. Moreover, for log_{2}(q) ≥ 3n, that is, 2^{\frac{3}{2} ·n} ≤ q^{\frac{1}{2}} , and n large enough we have

V (k) ≥ \frac{1}{2} · (q + 1) .

(The bound q ≥ 3 log_{2}(n) is a bit arbitrary but it serves its purposes, and in order to complete the analysis for the algorithm for Theorem 4, we anyway have to impose a more restricted bound.)

This result shows that if φ satisfies Condition 3.45, the set {P ∈ E(K) | φ(P) ∈ ℙ^{1}(k)} is “reasonably large”. Note that this applies then of course in particular to the factor base constructed in the algorithm for Theorem 4. We remark however that the main purpose of showing that V is birational to a curve is not to prove that a suitably large factor base can be efficiently constructed – this goal can also easily be reached by choosing the automorphism α used to define φ in a randomized fashion. Rather the key statement is that V^{n} contains an irreducibility component which maps surjectively to Res_{k}^{K}(E) under the addition morphism and which contains “enough” elements.

Remark 3.80 There is a connection between the considerations here and the GHS-attack ([GHS02]) for elliptic curves: Let the notations be as above but let us drop Condition 3.45. Then V\overline{k} can be reducible. Let us assume that V contains an irreducibility component which is geometrically irreducible; let D be a curve which is birational to such a component, and let us fix a map from D to V which is birational to its image. The map from D to Res_{k}^{K}(E) corresponds to a covering c : D_{K} ⟶ E.

Now the GHS-attack applied to E consists of finding such a D and the covering explicitly and transferring the discrete logarithm problem in E(K) to a discrete logarithm problem in Cl^{0}(D) via the homomorphism

E(K) ⟶^{c^{∗}} Cl^{0}(D_{K}) ⟶ Cl^{0}(D) ,

where the second homomorphism is the norm. This homomorphism is also related to the considerations above: One can show that under the isomorphism E(K) ≃ Res_{k}^{K}(E) this homomorphism corresponds to the pull-back homomorphism from β^{∗} : Res_{k}^{K}(E) ⟶ J_{D} ≃ Cl^{0}(D).

The idea of the GHS attack is that it might be faster to solve the discrete logarithm problem in Cl^{0}(D) than in E(K). Of course, for this one requires that the kernel of the homomorphism is “small” and the genus of D is as small as possible under this condition.

For the analysis of the present algorithm it is important that V\overline{k} is irreducible. In the GHS attack one has in a certain sense an opposite requirement on the covering φ : E ⟶ ℙ_{K}^{1} used to define V than we have here: one wants that V contains a component which is birational a curve C of “small genus”, however still such that the induced addition morphism C^{n} ⟶ Res_{k}^{K}(E) is surjective.

We would however like to stress that the Weil restriction Res_{k}^{K}(E) is not needed for an explicit construction of such a curve D. Indeed, the function field of K(D) is a composite of K(E), K(σ(E)), …, K(σ^{n−1}(E)), and one can construct such a composite and then the function field of a suitable curve D over k (provided that such a curve exists) with a purely field-theoretic approach. For further information on the function field theoretic approach to the GHS attack we refer to [Die03] and [Heß03].

3.5.6.4 The role of the summation polynomials

Let the hyperplane H = H_{n+1} of (ℙ_{k}^{1})^{n+1} be defined as in subsection 3.5.5. By applying the scalar-restriction functor, we obtain:

Res_{k}^{K}(H) ⟶ Res_{k}^{K}((ℙ_{K}^{1})^{n+1}) ≃ (Res_{k}^{K}(ℙ_{K}^{1}))^{n+1} .

Via base change to K one sees immediately that we have a closed immersion.

Let X be the scheme-theoretic preimage of Res_{k}^{K}(H) in (ℙ_{k}^{1})^{n}×Res_{k}^{K}(ℙ_{K}^{1}) under the closed immersion ι_{⊚} × ι_{⊚} × ⋯ × ι_{⊚} × id : (ℙ_{k}^{1})^{n} × Res_{k}^{K}(ℙ_{K}^{1}) ⟶ Res_{k}^{K}((ℙ^{1}))^{n+1}. This means by definition that we have a Cartesian diagram

\xymatrix{X \ar@{^{(}->}[d] \ar@{^{(}->}[r] & Res_{k}^{K}(H) \ar@{^{(}->}[d] \\ (ℙ_{k}^{1})^{n} × Res_{k}^{K}(ℙ_{K}^{1}) \ar@{^{(}->}[r] & (Res_{k}^{K}(ℙ_{K}^{1}))^{n+1} .}  (3.34)

Note that – again under the obvious bijections – the elements of X(k) correspond to the tuples (Q_{1}, …, Q_{n}, Q) with Q_{i} ∈ ℙ^{1}(k) and Q ∈ ℙ^{1}(K) with (Q_{1}, …, Q_{n}, Q) ∈ H(K). The latter condition means of course that there are P_{1}, …, P_{n}, P ∈ E(\overline{K}) with φ(P_{i}) = Q_{i} and ∑_{i} P_{i} = P.

Notation 3.81 Let p_{1} : (ℙ_{k}^{1})^{n} × Res_{k}^{K}(ℙ_{K}^{1}) ⟶ (ℙ_{k}^{1})^{n} and p_{2} : (ℙ_{k}^{1})^{n} × Res_{k}^{K}(ℙ_{K}^{1}) ⟶ Res_{k}^{K}(ℙ_{K}^{1}) be the two projections.

Lemma 3.82 (p_{1})_{|X} : X ⟶ (ℙ_{k}^{1})^{n} is a flat covering of degree 2^{(n−1)·n}.

Proof. By Lemma 3.69 c) the projection to the first n components H ⟶ (ℙ_{K}^{1})^{n} is a flat covering of degree 2^{n−1}. Therefore the induced map Res_{k}^{K}(H) ⟶ Res_{k}^{K}((ℙ_{K}^{1})^{n}) ≃ (Res_{k}^{K}(ℙ^{1}))^{n} is a flat covering of degree 2^{(n−1)·n}. The map (p_{1})_{|X} : X ⟶ (ℙ_{k}^{1})^{n} is obtained from this map via base change with ι × ⋯ × ι : (ℙ_{k}^{1})^{n} ⟶ (Res_{k}^{K}(ℙ_{K}^{1}))^{n}. □

Notation 3.83 Let G be the graph of −a_{n} : V^{n} ⟶ Res_{k}^{K}(E), where as in the proof of Proposition 3.77 a_{n} is the restriction of the addition morphism to V^{n}. (Note the minus sign!)

As in subsection 3.5.5 let for m ∈ ℕ N_{m} be the kernel of the addition morphism E^{m} ⟶ E. One easily sees that Res_{k}^{K}(N_{m}) is (as a subscheme of Res_{k}^{K}(E^{m})) the kernel of the addition homomorphism on Res_{k}^{K}(E^{m}). Let now N := N_{n+1}. By considering Z-valued points for any k-scheme Z, one obtains immediately:

Lemma 3.84 G is the scheme-theoretic intersection of V^{n} × Res_{k}^{K}(E) and Res_{k}^{K}(N) in Res_{k}^{K}(E^{n+1}) ≃ (Res_{k}^{K}(E))^{n+1}.

Proposition 3.85 There is a canonical surjective morphism G ⟶ X. Moreover, if Condition 3.45 is satisfied, then X is geometrically irreducible and (p_{2})_{|X} : X ⟶ Res_{k}^{K}(ℙ_{K}^{1}) is surjective.

Proof. Let us consider the commutative diagram with the obvious canonical morphisms. As by definition of X the right-lower subdiagram (i.e. diagram (3.34)) is Cartesian, we have an induced morphism G ⟶ X.

[figure: G; Res_{k}^{K}(N); X; Res_{k}^{K}(H); V^{n} × Res_{k}^{K}(E); (Res_{k}^{K}(E))^{n+1}; (ℙ_{k}^{1})^{n} × Res_{k}^{K}(ℙ_{K}^{1}); (Res_{k}^{K}(ℙ_{K}^{1}))^{n+1}]

It suffices to prove the surjectivity on \overline{k}-valued points. So let Q ∈ X(\overline{k}). As the map N ⟶ H is surjective, so is Res_{k}^{K}(N) ⟶ Res_{k}^{K}(H). Let us consider Q as a point in Res_{k}^{K}(H), and let us fix a preimage P ∈ Res_{k}^{K}(N)(\overline{k}).

We claim that P lies in G(\overline{k}), or with other words that the image of P in (Res_{k}^{K}(E))^{n+1}(\overline{k}) lies in (V^{n} × Res_{k}^{K}(E))(\overline{k}). For this we have to check that the image of P in Res_{k}^{K}(ℙ_{K}^{1}))(\overline{k}) lies in ((ℙ^{1})^{n} × Res_{k}^{K}(ℙ_{K}^{1}))(\overline{k}). But this is obvious as the image is nothing but the point Q we started with.

Let now Condition 3.45 be satisfied. By Proposition 3.77 a) V is then geometrically reduced and geometrically irreducible, thus so is V^{n}, which is isomorphic to the graph G. As the map G ⟶ X is surjective, X is then also geometrically irreducible.

For the second claim we consider the commutative diagram

\xymatrix{G \ar@{^{(}->}[d] \ar[r] & X \ar@{^{(}->}[d] \\ V^{n} × Res_{k}^{K}(E) \ar[d] \ar[r] & (ℙ_{k}^{1})^{n} × Res_{k}^{K}(ℙ_{K}^{1}) \ar[d]^{p_{2}} \\ Res_{k}^{K}(E) \ar[r] & Res_{k}^{K}(ℙ_{K}^{1}) .}

The image of G in Res_{k}^{K}(E) is the image of −a_{n} : V^{n} ⟶ Res_{k}^{K}(E) (which is equal to the image of a_{n}), and by Proposition 3.77 b) this is Res_{k}^{K}(E). Moreover, the morphism Res_{k}^{K}(E) ⟶ Res_{k}^{K}(ℙ_{K}^{1}) (being a flat covering) is also surjective. Thus the morphism (p_{2})_{|X} : X ⟶ Res_{k}^{K}(ℙ_{K}^{1}) is surjective too. □

Let us now fix some Q ∈ ℙ^{1}(K). Following our notation, let Q_{⊚} be the corresponding k-rational point of Res_{k}^{K}(ℙ_{K}^{1}). Let X_{Q_{⊚}} be the fiber of X at Q_{⊚}, that is, we have the Cartesian diagram

\xymatrix{X_{Q_{⊚}} \ar@{^{(}->}[r] \ar@{^{(}->}[d] & X \ar@{^{(}->}[d] \\ (ℙ_{k}^{1})^{n} \ar@{^{(}->}[r] \ar[d] & (ℙ_{k}^{1})^{n} × Res_{k}^{K}(ℙ_{K}^{1}) \ar[d] \\ Spec(k) \ar@{^{(}->}[r]^{Q_{⊚}} & Res_{k}^{K}(ℙ_{K}^{1}) .}

Then we have the following connection with the decomposition algorithm:

Proposition 3.86 As a subscheme of (ℙ_{k}^{1})^{n} × Res_{k}^{K}(ℙ_{K}^{1}), X_{Q_{⊚}} is V (S^{(1)}, …, S^{(n)}), where the polynomials S^{(j)} ∈ k[X_{1}, Y_{1}, …, X_{n}, Y_{n}] are defined as in Equation (3.28).

We show first:

Lemma 3.87 Let H_{Q} ⊂ (ℙ_{K}^{1})^{n} be the restriction of H to (ℙ_{K}^{1})^{n} via the closed immersion id × ⋯×id ×Q : (ℙ_{K}^{1})^{n} ≃ (ℙ_{K}^{1})^{n}×_{K}Spec(K) ⟶ (ℙ_{K}^{1})^{n+1}. Then we have a Cartesian diagram

\xymatrix{X_{Q_{⊚}} \ar@{^{(}->}[r] \ar@{^{(}->}[d] & Res_{k}^{K}(H_{Q}) \ar@{^{(}->}[d] \\ (ℙ_{k}^{1})^{n} \ar@{^{(}->}[r] & (Res_{k}^{K}(ℙ_{K}^{1}))^{n} ,}

where the lower arrow is given by ι × ⋯ × ι.

Proof. We have Res_{k}^{K}(Spec(K)) = Spec(k) and Res_{k}^{K}(Q) = Q_{⊚}. By Lemma 3.75 the defining Cartesian diagram

\xymatrix{H_{Q} \ar@{^{(}->}[r] \ar@{^{(}->}[d] & H \ar@{^{(}->}[d] \\ (ℙ_{K}^{1})^{n} \ar@{^{(}->}[r] & (ℙ^{1})^{n+1}}

gives rise to the Cartesian diagram

\xymatrix{Res_{k}^{K}(H_{Q}) \ar@{^{(}->}[r] \ar@{^{(}->}[d] & Res_{k}^{K}(H) \ar@{^{(}->}[d] \\ (Res_{k}^{K}(ℙ_{K}^{1}))^{n} \ar@{^{(}->}[r] & (Res_{k}^{K}(ℙ_{K}^{1}))^{n+1} ,}

where the lower arrow is given by id × ⋯ × id ×Q_{⊚} : (Res_{k}^{K}(ℙ_{K}^{1}))^{n} ≃ (Res_{k}^{K}(ℙ_{K}^{1}))^{n} ×_{k} Spec(k) ⟶ (Res_{k}^{K}(ℙ_{K}^{1}))^{n+1}.

Now X_{Q_{⊚}} is the pull-back of Res_{k}^{K}(H) to (ℙ_{k}^{1})^{n} under the map ι × ⋯ × ι × Q_{⊚} : (ℙ_{k}^{1})^{n} ≃ (ℙ_{k}^{1})^{n} ×_{k} Spec(k) ⟶ (Res_{k}^{K}(ℙ_{K}^{1}))^{n+1}. This implies that we have a Cartesian diagram

\xymatrix{X_{Q_{⊚}} \ar@{^{(}->}[r] \ar@{^{(}->}[d] & Res_{k}^{K}(H_{Q}) \ar@{^{(}->}[r] \ar@{^{(}->}[d] & Res_{k}^{K}(H) \ar@{^{(}->}[d] \\ (ℙ^{1})_{k}^{n} \ar@{^{(}->}[r] & (Res_{k}^{K}(ℙ_{K}^{1}))^{n} \ar@{^{(}->}[r] & (Res_{k}^{K}(ℙ_{K}^{1}))^{n+1} .}

□

We come to the proof of Proposition 3.86.

By Lemma 3.87 and Lemma 3.76 we have a commutative diagram

\xymatrix{X_{Q_{⊚}} \ar@{^{(}->}[dr] \ar[rr]^{∼} &  & Res_{(ℙ_{k}^{1})^{n}}^{(ℙ_{K}^{1})^{n}}(H_{Q}) \ar@{-->}[dl] \\  & (ℙ_{k}^{1})^{n} ,}

where the arrow to the left is the structural morphism, which of course is then also a closed immersion.

To establish the result we thus have to show that as a closed subscheme of (ℙ_{k}^{1})^{n}, Res_{(ℙ_{k}^{1})^{n}}^{(ℙ_{K}^{1})^{n}}(H_{Q}) is equal to V (S^{(1)}, …, S^{(n)}).

Let now S_{φ,n+1} be the same summation polynomial as in subsubsection 3.5.2.1 (recall that the (n + 1)^{th} summation polynomial with respect to φ is only unique up to multiplication by a non-trivial constant). Also, let b_{1}, …, b_{n} be the fixed k-basis of K from subsubsection 3.5.2.1. Note that b_{1}, …, b_{n} is then also a basis of the free k[x_{1}, …, x_{n}]-module K[x_{1}, …, x_{n}]. Moreover, let S′ := S_{φ,n+1}(X_{1}, Y_{1}, …, X_{n}, Y_{n}, Q) be the polynomial obtained by inserting the same coordinates of Q = φ(P) into the summation polynomial as in 3.5.2.1 (again these are only unique up to multiplication by a non-trivial constant).

We now prove the result by restriction to affine parts of (ℙ_{k}^{1})^{n}.

Let for the moment X_{i,1} := X_{i} and X_{i,2} := Y_{i}. Moreover, let for some multihomogeneous polynomial F ∈ k[X_{1}, Y_{1}, …, X_{n}, Y_{n}] U_{F} := (ℙ_{k}^{1})^{n} − V (F) be the corresponding open subscheme.

One can now show that for any \underline{a} ∈ \{1, 2\}^{n}, the restrictions of both schemes to U_{X_{1,a_{1}}} ∩ U_{X_{2,a_{2}}} ∩ ⋯ ∩ U_{X_{n,an}} are equal; and this implies that the schemes are equal. For notational convenience we consider in the following the case of \underline{a} = (2, …, 2) (“dehomogenization with respect to Y_{1}, …, Y_{n}”); the other cases can be established in exactly the same way.

Let s(x_{1}, …, x_{n}) := S′(x_{1}, 1, x_{2}, 1, …, x_{n}, 1) ∈ K[x_{1}, …, x_{n}]. Then H_{Q}∩ 𝔸_{k}^{n} ⊆ 𝔸_{k}^{n} = Spec(k[x_{1}, …, x_{n}]) corresponds to the quotient ring k[x_{1}, …, x_{n}]/(s) of k[x_{1}, …, x_{n}].

As the formation of the Weil restriction commutes with base-change on the base, we have (Res_{(ℙ_{k}^{1})^{n}}^{(ℙ_{K}^{1})^{n}}(H_{Q})) ∩ 𝔸_{k}^{n} = Res_{𝔸_{k}^{n}}^{𝔸_{K}^{n}}(H_{Q} ∩ 𝔸_{K}^{n}) as closed

subschemes of 𝔸_{k}^{n}. A defining system of polynomials for Res_{𝔸_{k}^{n}}^{𝔸_{K}^{n}}(H_{Q} ∩ 𝔸_{K}^{n}) can be derived via the well-known method to obtain defining equations for Weil restrictions of affine schemes over rings (see example [Die01, Chapter 1] or the proof of [BLR80, §7.6., Theorem 4]):

Let s^{(1)}, …, s^{(n)} ∈ k[x_{1}, …, x_{n}] be defined by the equation

∑_{j} b_{j} s^{(j)} = s .

Then Res_{𝔸_{k}^{n}}^{𝔸_{K}^{n}}(H_{Q} ∩ 𝔸_{K}^{n}) = Spec(k[x_{1}, …, x_{n}]/(s^{(1)}, …, s^{(n)})) = V (s^{(1)}, …, s^{(n)}) ⊂ 𝔸_{k}^{n}. But the s^{(j)} are exactly the dehomogenizations of the polynomials S^{(j)}, and thus (X_{Q_{⊚}}) ∩ 𝔸_{k}^{n} = (Res_{(ℙ_{k}^{1})^{n}}^{(ℙ_{K}^{1})^{n}}(H_{Q})) ∩ 𝔸_{k}^{n} =

Res_{𝔸_{k}^{n}}^{𝔸_{K}^{n}}(H_{Q} ∩𝔸_{K}^{n}) = V (s^{(1)}, …, s^{(n)}) = V (S^{(1)}, …, S^{(n)})∩𝔸_{k}^{n} as subschemes of 𝔸_{k}^{n}. □

3.5.6.5 Determination of non-zero-dimensional fibers

We are interested in the number of points Q ∈ ℙ^{1}(K) for which the fiber X_{Q_{⊚}} = p_{2}^{−1}(Q_{⊚}) is not zero-dimensional. For this we first consider a base change to K, such that X_{K} is a closed subscheme of (ℙ_{K}^{1})^{n} × (ℙ_{K}^{1})^{n}, and we perform explicit computations in the Chow ring of (ℙ_{K}^{1})^{n} ×(ℙ_{K}^{1})^{n}. We identify for notational reasons (ℙ^{1})^{n} × (ℙ^{1})^{n} componentwise with ∏_{i=1}^{n} Proj(ℤ[X_{1,i}, Y_{1,i}]) × ∏_{i=1}^{n} Proj(ℤ[X_{2,i}, Y_{2,i}]), and let h_{ℓ,i} be the class of X_{ℓ,i} in the Chow ring of (ℙ_{K}^{1})^{n} × (ℙ_{K}^{1})^{n}.

Lemma 3.88 The class of X_{K} in CH((ℙ_{K}^{1})^{n}×(ℙ_{K}^{1})^{n}) is 2^{(n−1)·n} ∏_{i=1}^{n}(h_{1,1}+ ⋯ + h_{1,n} + h_{2,i}).

Proof. X_{K} is defined inside (ℙ_{K}^{1})^{n} × (ℙ_{K}^{1})^{n} by the polynomials

F_{j} := S_{φ,n+1}(X_{1,1}, Y_{1,1}, …, X_{1,n}, Y_{1,n}, X_{2,j}, Y_{2,j})

for j = 1, …, n. One can easily see with this explicit description that for all ℓ = 2, …, n no irreducibility component of V (F_{1}, …, F_{ℓ−1}) is contained in V (F_{ℓ}).

Indeed, let C be an irreducibility component of V (F_{1}, …, F_{ℓ−1}). Then C = C′ ×(ℙ_{K}^{1})^{n−ℓ+1} for some C′ ⊆ (ℙ_{K}^{1})^{n} ×(ℙ_{K}^{1})^{ℓ−1}. Let (Q_{1}, Q_{2}) ∈ C′(\overline{K}), where Q_{1} ∈ (ℙ^{1})^{n}(\overline{K}) and Q_{2} ∈ (ℙ^{1})^{ℓ−1}(\overline{K}). Now there are at most 2^{n−1} points in Q_{3} ∈ ℙ^{1}(\overline{K}) with F_{ℓ}(Q_{1}, Q_{3}) = 0. Choose some Q_{3} ∈ ℙ^{1}(\overline{K}) which is distinct from these points, and choose Q_{4} ∈ (ℙ^{1})^{n−ℓ}(\overline{K}) arbitrarily. Then (Q_{1}, Q_{2}, Q_{3}, Q_{4}) is a \overline{K}-valued point of C which does not lie in V (F_{ℓ}).

We therefore have [X_{K}] = [V (F_{1})] ⋯ [V (F_{n})] in the Chow ring of (ℙ_{K}^{1})^{n}× (ℙ_{K}^{1})^{n} (cf. Remark 3.53). Moreover, [V (F_{i})] = 2^{n−1}(h_{1,1} + ⋯ + h_{1,n} + h_{2,i}). This gives the statement. □

Remark 3.89 By the lemma we have in particular ((p_{2})_{K})_{⊚}([X_{K}]) = n! · 2^{(n−1)·n}, thus (p_{2})_{K}(X_{K}) is equal to the ambient space ∏_{i=1}^{n} Proj(K[X_{2,i}, Y_{2,i}]), or with other words: (p_{2})_{|X} is surjective. Another way to see this is: Let Q = (Q_{1}, …, Q_{n}) ∈ ∏_{i=1}^{n} Proj(K[X_{2,i}, Y_{2,i}])(\overline{K}). Then the geometric fiber X_{Q} is the subscheme of ∏_{i=1}^{n} Proj(\overline{K}[X_{1,i}, Y_{1,i}]) defined by F_{i}(X_{1,1}, Y_{1,n}, …, X_{1,n}, Y_{1,n}, Q_{i}) for i = 1, …, n. We see in particular that the fiber is never empty. More precisely, if it is zero-dimensional then its degree is n! · 2^{(n−1)·n}. Under Condition 3.45 we have already proven in Proposition 3.85 that (p_{2})_{|X} is surjective.

Let now q_{i} : ∏_{i=1}^{n}(Proj(K[X_{1,i}, Y_{1,i}])) ⟶ Proj(K[X_{1,i}, Y_{1,i}]) be the projection to the i^{th} component.

For some Q ∈ ∏_{i=1}^{n}(Proj(K[X_{2,i}, Y_{2,i}]))(\overline{K}) the geometric fiber X_{Q} (which is contained in ∏_{i=1}^{n} Proj(\overline{K}[X_{1,i}, Y_{1,i}])) is zero-dimensional if and only if for no i = 1, …, n the image of X_{Q} under q_{i} is equal to Proj(\overline{K}[X_{1,i}, Y_{1,i}]).

Let R_{i} ∈ K[X_{1,i}, Y_{1,i}, X_{2,1}, Y_{2,1}, …, X_{2,n}, Y_{2,n}] be the multigraded resultant of F_{1}, …, F_{n} with respect to the variables X_{1,1}, Y_{1,1}, …, X_{1,i−1}, Y_{1,i−1}, X_{1,i+1}, Y_{1,i+1}, …, X_{1,n}, Y_{1,n}. Then for Q = (Q_{1}, …, Q_{n}) ∈ ∏_{i=1}^{n} Proj(K[X_{2,i}, Y_{2,i}])(\overline{K}) the geometric fiber X_{Q} is zero-dimensional if and only if for all i = 1, …, n R_{i}(X_{i}, Y_{i}, Q_{1}, …, Q_{n}) is non-trivial (cf. also the proof of Proposition 3.64).

Note now that not all fibers are non-zero-dimensional because X has dimension n (see Lemma 3.82) and (ℙ_{K}^{1})^{n} has dimension n too. Thus the polynomials R_{1}, …, R_{n} are all non-trivial.

Lemma 3.90 Each polynomial R_{i} has multidegree (n! · 2^{(n−1)·n}, (n − 1)! · 2^{(n−1)·n}, …, (n − 1)! · 2^{(n−1)·n}).

Proof. The polynomials F_{1}, …, F_{n} have multidegree (2^{n−1}, …, 2^{n−1}) ∈ ℕ^{n−1} with respect to the variables under consideration. Therefore the corresponding generic resultant is homogeneous in the coefficients of each of the polynomials of degree (n − 1)! · 2^{(n−1)^{2}}. This implies that the degree with respect to X_{2,i}, Y_{2,i} for some i is (n − 1)! · 2^{(n−1)^{2}} · 2^{n−1} = (n − 1)! · 2^{(n−1)·n}. Moreover, the degree with respect to X_{1,i}, Y_{1,i} is (n − 1)! · 2^{(n−1)^{2}} · n · 2^{n−1} = n! · 2^{(n−1)·n}. □

Let us now for every i = 1, …, n fix some non-trivial coefficient C_{i} of R_{i} regarded as a polynomial in K[X_{2,n}, Y_{2,n}, …, X_{2,n}, Y_{2,n}][X_{1,i}, Y_{1,i}]. Then clearly the points Q ∈ ∏_{i=1}^{n} ∏ Proj(K[X_{2,i}, Y_{2,i}]) for which the fiber X_{Q} is not zero-dimensional are contained in

⋃_{i=1}^{n} V (C_{i}) ⊆ (ℙ_{K}^{1})^{n} .

Let us fix some i = 1, …, n. Then V (C_{i}) is an effective Cartier divisor of multidegree ((n−1)!·2^{(n−1)·n}, …, (n−1)!·2^{(n−1)·n}) in ∏_{i=1}^{n} Proj(K[X_{2,i}, Y_{2,i}]), and (p_{2})_{K}^{−1}(V (C_{i})) is an effective Cartier divisor of multidegree (0, …, 0, (n − 1)! · 2^{(n−1)·n}, …, (n − 1)! · 2^{(n−1)·n}) in (ℙ_{K}^{1})^{n} × (ℙ_{K}^{1})^{n}.

It follows that

\begin{matrix}[X_{K}] · [(p_{2})_{K}^{−1}(V (C_{i}))] = \\ (n − 1)! · 2^{2(n−1)·n} · (∏_{i=1}^{n}(h_{1,1} + ⋯ + h_{1,n} + h_{2,i})) · (h_{2,1} + ⋯ + h_{2,n}) \end{matrix}

in CH((ℙ_{K}^{1})^{n} × (ℙ_{K}^{1})^{n}). With Lemma 3.56 this implies that

\begin{aligned}& ((p_{1})_{K})_{⊚}([X_{K}] · [(p_{2})_{K}^{−1}(V (C_{i}))]) \\ = & (n − 1)! · 2^{2(n−1)·n} · n · (h_{1,1} + ⋯ + h_{1,n}) \\ = & n! · 2^{2(n−1)·n} · (h_{1,1} + ⋯ + h_{1,n}) . \end{aligned}  (3.35)

Assumption 3.91 Let us from now on assume that Condition 3.45 is satisfied.

Notation 3.92 Let k = 𝔽_{q} (such that K = 𝔽_{q^{n}}).

Recall that X is now geometrically irreducible (Proposition 3.85). Clearly X_{K} is not contained in V ((p_{2})_{K}^{−1}(C_{i})) (because otherwise (p_{2})_{K}(X_{K}) would be contained in V (C_{i}), contradicting the surjectivity of p_{2}). Thus we have [X_{K}] · [V ((p_{2})_{K}^{−1}(C_{i}))] = [X_{K} ∩ V ((p_{2})_{K}^{−1}(C_{i}))] (cf. Remark 3.53). As the map (p_{1})_{K} : X_{K} ⟶ ∏_{i=1}^{n} Proj([X_{1,i}, Y_{1,i}]) is finite and flat (cf. Lemma 3.82), the dimension of (p_{1})_{K}(X_{K} ∩C_{i}) is equal to the dimension of X_{K} ∩C_{i}. With (3.35) we conclude:

Lemma 3.93 (p_{1})_{K}(X_{K} ∩ C_{i}) (with the induced reduced scheme structure) is a reduced effective Cartier divisor of ∏_{i=1}^{n} Proj([X_{1,i}, Y_{1,i}]) whose multidegree is componentwise ≤ (n! · 2^{2(n−1)·n}, …, n! · 2^{2(n−1)·n}).

The subscheme

⋃_{i=1}^{n} ⋃_{j=0}^{n−1} σ^{j}((p_{1})_{K}(X_{K} ∩ C_{i}))

of ∏_{i=1}^{n} Proj([X_{1,i}, Y_{1,i}]) is Gal(K|k)-invariant. It thus descends to a subscheme of (ℙ_{k}^{1})^{n}; let B be this scheme.

Lemma 3.94

a) B is a reduced effective Cartier divisor whose multidegree is componentwise ≤ (n^{2} · n! · 2^{2(n−1)·n}, …, n^{2} · n! · 2^{2(n−1)·n}). b) Let Q ∈ (ℙ^{1}(\overline{k}))^{n} − B(k), and let Q′ be any preimage of Q under p_{1}.

Then the fiber X_{p_{2}(Q′)} is zero-dimensional.

c) There are at most n^{3} · n! · 2^{2(n−1)·n} · (q + 1)^{n−1} points in B(k).

Proof. Let A_{i} be a multihomogeneous polynomial defining (p_{1})_{K}(X_{K} ∩ C_{i}). Then B is V (∏_{j=0}^{n−1} A_{1} ⋯ A_{n})^{red}. The polynomial in question has a multidegree which is componentwise ≤ (n^{2}·n!·2^{2(n−1)·n}, …, n^{2}·n!·2^{2(n−1)·n}).

Statement b) follows immediately from the definition of B.

Statement c) follows from a) and the following lemma. □

Lemma 3.95 Let H be an effective Cartier divisor of multidegree \underline{d} in (ℙ_{k}^{1})^{n}. Then

#H(k) ≤ (∑_{i=1}^{n} d_{i}) · (q + 1)^{n−1} .

Proof. It clearly suffices to show the result under the condition that all indices of the multidegree are positive.

We proceed with induction by n. For n = 1 the claim is that #H(k) ≤ d_{1}, and this is surely correct.

Now let H be defined by the polynomial F (X_{1}, Y_{1}, …, X_{n}, Y_{n}) ∈ k[X_{1}, Y_{1}, …, X_{n}, Y_{n}]. Let us consider the projection to the first n−1 components: (ℙ_{k}^{1})^{n} ⟶ (ℙ_{k}^{1})^{n−1} and the induced morphism H ⟶ (ℙ_{k}^{1})^{n−1}. Now for every point P = (P_{1}, …, P_{n−1}) ∈ (ℙ_{k}^{1})^{n−1}(k) for which F (P_{1}, …, P_{n−1}, X_{n}, Y_{n}) does not vanish, the fiber has degree d_{n}, thus in particular it contains at most d_{n} k-rational points. Let now C be a non-trivial coefficient of F regarded as a polynomial in k[X_{1}, Y_{1}, …, X_{n−1}, Y_{n−1}][X_{n}, Y_{n}]. Then all points P ∈ (ℙ_{k}^{1})^{n−1}(k) for which F (P_{1}, …, P_{n−1}, X_{n}, Y_{n}) vanishes are contained in V (C). Now C has multidegree (d_{1}, …, d_{n−1}), and thus #V (C)(k) ≤ (∑_{i=1}^{n−1} d_{i}) · (q + 1)^{n−2} by induction. We conclude:

#H(k) ≤ d_{n} · (q + 1)^{n−1} + #V (C)(k) · (q + 1)
≤ d_{n} · (q + 1)^{n−1} + (∑_{i=1}^{n−1} d_{i}) · (q + 1)^{n−1}
= (∑_{i=1}^{n} d_{i}) · (q + 1)^{n−1}
□

Given an element P ∈ E(K), the decomposition algorithm succeeds when applied to P if and only if the fiber X_{φ(P)_{⊚}} is zero-dimensional and contains a k-rational point (Q_{1}, …, Q_{n}) such that there exist P_{1}, …, P_{n} ∈ E(K) with φ(P_{i}) = Q_{i} and ∑_{i} P_{i} = P.

We want to derive a lower bound on the number of such elements P ∈ E(K). More generally, given any subset M of {(P_{1}, …, P_{n}) ∈ E(K)^{n} | φ(P_{i}) ∈ ℙ^{1}(k) for all i = 1, …, n}, we want to derive a lower bound on the number of elements P ∈ E(K) such that the decomposition algorithm succeeds and there exist P_{1}, …, P_{n} ∈ M with ∑_{i} P_{i} = ±P.

Let us for this consider the commutative diagram of sets of k-valued points

\xymatrix{G(k) \ar[r]^{ρ} & X(k) \ar[d]^{(p_{1})_{|X}} \\ V^{n}(k) \ar[u]^{γ} \ar[r]^{τ} & ∏_{i=1}^{n} Proj(k[X_{1,i}, Y_{1,i}])(k) ,}

where the map γ : V (k) ⟶ G(k) is induced by the graph morphism, that is, it is explicitly given by (P_{1}, …, P_{n}) ↦ (P_{1}, …, P_{n}, − ∑_{i} P_{i}), the map ρ : G(k) ⟶ X(k) is induced by the morphism G ⟶ X defined in Proposition 3.85, and the map τ : V^{n}(k) ⟶ ∏_{i=1}^{n} Proj(k[X_{1,i}, Y_{1,i}])(k) is induced componentwise by the canonical morphism in diagram (3.32).

Note that under the scalar restriction functor and in the context of the algorithms V (k) corresponds to {P ∈ E(K) | φ(P) ∈ ℙ^{1}(k)}, G(k) corresponds to the set of tuples (P_{1}, …, P_{n}, P) with φ(P_{i}) ∈ ℙ^{1}(k) and P = − ∑_{i} P_{i}, and X(k) corresponds to the set of tuples (Q_{1}, …, Q_{n}, Q) with Q_{i} ∈ ℙ^{1}(k) and Q ∈ ℙ^{1}(K) and S_{n+1}(Q_{1}, …, Q_{n}, Q) = 0. The map γ corresponds then to the map which is again given by (P_{1}, …, P_{n}) ↦ (P_{1}, …, P_{n}, − ∑_{i} P_{i}), and the maps ρ and τ correspond to the componentwise application of φ.

Let now M ⊆ {(P_{1}, …, P_{n}) ∈ E(K)^{n} | φ(P_{i}) ∈ ℙ^{1}(k) for all i = 1, …, n}, and let M_{⊚} be the corresponding subset of V (k). Then every element P ∈ E(K) such that φ(P)_{⊚} ∈ Res_{k}^{K}(ℙ_{K}^{1})(k) is the image under p_{2} of an element in (ρ ∘ γ)(M_{⊚}) − p_{1}^{−1}(B(k)) is an element as desired. (Indeed, if P is such an element, first the fiber X_{φ(P_{⊚})} is zero-dimensional because φ(P_{⊚}) ∈ p_{2}(p_{1}^{−1}(B(k))) (cf. Lemma 3.94 b)), and second there exist P_{1}, …, P_{n} ∈ M with φ(P_{1} + ⋯ + P_{n}) = φ(P), thus P_{1} + ⋯ + P_{n} = ±P.)

We are thus interested in the cardinality of the set

p_{2}((ρ ∘ γ)(M_{⊚}) − p_{1}^{−1}(B(k))) .

For this we first derive a lower bound on

(ρ ∘ γ)(M_{⊚}) − p_{1}^{−1}(B(k)) .

The image of this set in ∏_{i=1}^{n} Proj(k[X_{1,i}, Y_{1,i}])(k) is contained in

τ(M_{⊚}) − B(k) .

As τ corresponds to the componentwise application of φ, we have #τ(M_{⊚}) ≥ \frac{1}{2^{n}} #M_{⊚} = \frac{1}{2^{n}} #M.

With Lemma 3.94 c) we obtain:

\begin{aligned}& #((ρ ∘ γ)(V^{n}(k)) − p_{1}^{−1}(B(k))) \\ ≥ & #(τ(M_{⊚}) − B(k)) \\ ≥ & \frac{#M}{2^{n}} − n^{3} · n! · 2^{2(n−1)·n} · (q + 1)^{n−1} . \end{aligned}  (3.36)

Now if an element Q in the set p_{2}((ρ ∘ γ)(V^{n}(k)) − p_{1}^{−1}(B(k))) is given, the fiber of p_{2}(Q) under p_{2} is zero-dimensional, and thus its degree is n! · 2^{(n−1)·n} (see Remark 3.89 or consider the structure of the system in the decomposition algorithm in subsubsection 3.5.2.1). We therefore have the following proposition.

Proposition 3.96 Let

M ⊆ {(P_{1}, …, P_{n}) ∈ E(K)^{n} | φ(P_{i}) ∈ ℙ^{1}(k) for all i = 1, …, n} .

Then the number of elements P ∈ E(K) such that the decomposition algorithm succeeds and there exist P_{1}, …, P_{n} ∈ M with P_{1} + ⋯ P_{n} = ±P is

≥ \frac{#M − n^{3} · 2^{2n^{2}−n} · (q + 1)^{n−1}}{n! · 2^{n^{2}}} .

This proposition is crucial for the analysis of the algorithm for Theorem 5. For Theorem 4 we set the factor base equal to the full set {P ∈ E(K) | φ(P) ∈ ℙ^{1}(k)} and we vary n and q.

As mentioned in Remark 3.79 for log_{2}(q) ≥ 3n and n large enough we have #V (k) ≥ \frac{q+1}{2}, thus #V^{n}(k) ≥ \frac{(q+1)^{n}}{2^{n}}. With Proposition 3.96 we obtain that the number of elements P ∈ E(K) such that there exist P_{1}, …, P_{n} ∈ E(K) with φ(P_{i}) ∈ ℙ^{1}(k) and ∑ P_{i} = P is

≥ \frac{(q + 1)^{n−1}}{n! · 2^{n·(n+1)}} · (q + 1 − n^{3} · 2^{2n^{2}}) .

Let now ϵ > 0. Then for n large enough this is

≥ \frac{q^{n−1}}{n! · 2^{n·(n+1)}} · (q − \frac{1}{2} · 2^{(2+ϵ)·n^{2}}) .

Then for log_{2}(q) ≥ (2 + ϵ) · n^{2} this is

≥ \frac{q^{n}}{n! · 2^{n·(n+1)+1}} .

Again for n large enough and log_{2}(q) ≥ (2 + ϵ) · n^{2} this is

≥ 2 · q^{n− \frac{1}{2}} .

We therefore have:

Proposition 3.97 Let ϵ > 0. Then for n large enough and (2 + ϵ) · n^{2} ≤ log_{2}(q) there are at least 2 · q^{n− \frac{1}{2}} elements in E(K) for which the decomposition algorithm succeeds.

And this implies the main result for the analysis of the algorithm for Theorem 4:

Proposition 3.98 Let ϵ > 0. Then for n large enough and (2 + ϵ) · n^{2} ≤ log_{2}(q) the following holds: Let E/𝔽_{q^{n}} be an elliptic curve, and let φ be chosen such that Condition 3.45 holds. Then the probability that the decomposition algorithm succeeds if applied to a uniformly randomly distributed element in E(𝔽_{q^{n}}) is ≥ q^{− \frac{1}{2}} .

Bibliography

[Adl79] L. Adleman. A subexponential algorithm for the discrete logarithm problem with applications to cryptography. In 20th IEEE Found. Comp. Sci. Symp., pages 55–60, 1979.

[AL86] L. Adleman and H.W. Lenstra, Jr. Finding irreducible polynomials over finite fields. In Proc. 18th ACM Symp. on Computing (STOC), pages 350–353, 1986.

[AT06] R. Avanzi and N. Thériault. Index Calculus for Hyperelliptic Curves. In H. Cohen and G. Frey, editors, Handbook of Elliptic and Hyperelliptic Curve Cryptogrpahy, chapter 21. Chapman & Hall/CRC, 2006.

[BCS91] P Bürgisser, M. Clausen, and M.A. Shokrollahi. Algebraic Complexity Theory. Springer-Verlag, 1991.

[BCSS98] L. Blum, F. Chucker, M. Shub, and S. Smale. Complexity and real computation. Springer-Verlag, 1998.

[BG04] J. Brawley and S. Gau. On the density of primitive elements for field extensions. preprint, 2004.

[BL94] J. Buchmann and H.W. Lenstra, Jr. Approximating rings of integers in number fields. J. Théo. Nombres Bordx., 6:221–260, 1994.

[BLR80] S. Bosch, W. Lütkebohmert, and W. Raynaud. Néron Models. Springer-Verlag, 1980.

[BN74] A. Brill and M. Noether. Über die algebraischen Functionen und ihre Anwendung in der Geometrie. Math. Ann., pages 269–310, 1874.

[BSS89] L. Blum, M. Shub, and S. Smale. On a theory of computation over the real numbers: NP completeness, recursive functions and unversal machines. Bull. Amer. Math. Soc., 21(1), 1989.

[CF05] H. Cohen and G. Frey, editors. Handbook of Elliptic and Hyperelliptic Curve Cryptography. Chapman & Hall/CRC, 2005.

[Chi87] A. Chistov. Efficent factorization of polynomials over local fields (Russian). Dokl. Akad. Nauk SSSR, 293:1073–1077, 1987. English translation: Soviet Math. Dokl. 35 (1987), 434-438.

[Chi89] A. Chistov. The complexity of constructing the ring of integers of a global field (Russian). Dokl. Akad. Nauk SSSR, 306:1063 – 1067, 1989. English translation in Soviet Math. Dokl. 39 (1989), 597 - 600.

[Coh96] H. Cohen. A Course in Computational Algebraic Number Theory. Springer-Verlag, 1996.

[Cou01] J.-M. Couveignes. Algebraic groups and discrete logarithms. In Public key cryptography and computational number theory. de Gruyter, 2001.

[Die01] C. Diem. A study on theoretical and practical aspects of Weilrestrictions of varieties. PhD thesis, University of Essen, 2001.

[Die03] C. Diem. The GHS Attack in odd Characteristic. J. Ramanujan Math. Soc., 18:1–32, 2003.

[Die06] C. Diem. An Index Calculus Algorithm for Plane Curves of Small Degree. In F. Hess, S. Pauli, and M. Pohst, editors, Algorithmic Number Theory — ANTS VII, LNCS 4076, pages 543 – 557, Berlin, 2006. Springer.

[dJ98] T. de Jong. An algorithm for computing the integral closure. J. Symb. Comput., 23:273–277, 1998.

[DKT87] P. Domich, R. Kannan, and L. Trotter, Jr. Hermite normal form computations using modulo determinant arithmetic. Mathematics of Operations Research, 12:50–59, 1987.

[EG02] A. Enge and P. Gaudry. A general framework for subexponential discrete logarithm algorithms. Acta. Arith., 102:83–103, 2002.

[Eis95] D. Eisenbud. Commutative Algebra with a View Toward Algebraic Geometry. Springer-Verlag, 1995.

[EK97] W. Eberly and E. Kaltofen. On randomized Lanczos algorithms. In W. Küchlin, editor, Proceedings ISSAC 1997, pages 176–183. ACM Press, 1997.

[Eng02] A. Enge. Computing discrete logarithms in high-genus hyperelliptic jacobians in provably subexponential time. Math. Comp, 71:729–742, 2002.

[Evd89] S. Evdokimov. Factorization of a solvable polynomial over finite fields and the generalized Riemann hypothesis (Russian). Zap. Nauchn. Sem. Leningrad. Otdel. Mat. Inst. Steklov. (LOMI), 176, 1889. English translation: J. Soviet Math. 59 (1992), 842 - 849.

[Ful93] W. Fulton. Introduction to Toric Varieties. Princeton University Press, 1993.

[Gau00] P. Gaudry. An algorithm for solving the discrete log problem on hyperelliptic curves. In Advances in Cryptology — EURO-CRYPT 2000, LNCS 1807, pages 19–34. Springer-Verlag, 2000.

[Gau04a] P. Gaudry. Index calculus for abelian varieties and the elliptic curve discrete logarithm problem. Available under http://eprint.iacr.org/2004/073, Mar. 4 2004.

[Gau04b] P. Gaudry. Index calculus for abelian varieties and the elliptic curve discrete logarithm problem. Available under http://www.loria.fr/∼gaudry/papers.html (as of May 4 2008), accepted for publication at J. Symbolic Comput., Oct. 26 2004.

[GHS02] P. Gaudry, F. Heß, and N. Smart. Constructive and destructive facets of Weil descent on elliptic curves. J. Cryptology, 15(19-46), 2002.

[GKZ94] I. Gelfand, M. Kapranov, and A. Zelevinsky. Discriminants, Resultants, and Multidimensional Determinants. Birkäuser, 1994.

[GLS01] G.-M. Greuel, C. Lossen, and M. Schulze. Three algorithms in Algebraic Geometry, Coding Theory, and Singularity Theory. In C. Ciliberto et al, editor, Application of Algebraic Geometry to Coding Theory, Physics and Computation, Proceedings, pages 161–194. Kluwer, 2001.

[Gop82] V. Goppa. Algebraic-geometric codes. Izv. Akad. Nauk SSSR Ser. Mat, 46(4):762–781, 896, 1982. English translation: Math. USSR-Izv. 21 (1983), 75-91.

[GR71] H. Grauert and R. Remmert. Analytische Stellenalgebren. Springer-Verlag, 1971.

[Gro61] A. Grothendieck. Eléments de Géométrie Algébrique III, Première Partie. Publication Mathématiques, 11, 1961.

[Gro67] A. Grothendieck. Eléments de Géométrie Algébrique IV, Quatrième Partie. Publication Mathématiques, 32, 1967.

[GTTD07] P. Gaudry, E. Thomé, N. Thériault, and C. Diem. A double large prime variation for small genus hyperelliptic index calculus. Math. Comp., 76:475–492, 2007.

[Har77] R. Hartshorne. Algebraic Geometry. Springer-Verlag, 1977.

[Heß01] F. Heß. Computing Riemann-Roch spaces in algebraic function fields and related topics. J. Symb. Comput., 11, 2001.

[Heß03] F. Heß. The GHS Attack Revisited. In E. Biham, editor, Advances in Cryptology — EUROCRYPT 2003, volume 2656 of LNCS, pages 374–387. Springer-Verlag, 2003.

[Heß05] F. Heß. Computing relations in divisor class groups of algebraic curves over finite fields. preprint, ca. 2005.

[HI94] M.-D. Huang and D. Ierardi. Efficient Algorithms for the Riemann-Roch Problem and for Addition in the Jacobian of a Curve. J. Symb. Comput., 18:519–539, 1994.

[HL02] K. Hensel and G. Landsberg. Theorie der algebraischen Funktionen einer Variablen. Teubner, 1902.

[HR83] M. Hellman and J. Reyneri. Fast computation of discrete logarithms in GF(q). In D. Chaum, R. Rivest, and A. Sherman, editors, Advances in Cryptology — CRYPTO 1982, pages 3–13. Plenum Press, 1983.

[Jac39] C.G. Jacobi. Canon arithmeticus sive tabulae quibus exhibentur pro singulis numeris primis vel primorum potestatibus infra 1000 numeri ad datos indices et indices ad datos numeros pertinentes. Berlin, 1839.

[KM04a] K. Khuri-Makdisi. Asymptotically fast group operations on Jacobians of general curves. available on the arXiv under math.NT/0409209 (version 2), 2004.

[KM04b] K. Khuri-Makdisi. Linear algebra algorithms for divisors on an algebraic curve. Math. Comp., 73:333–357, 2004.

[KR89] E. Kani and M. Rosen. Idempotent relations and factors of Jacobians. Math. Ann., 284:307–327, 1989.

[Kra22] M. Kraitchik. Théorie des nombres (Tome I). Gauthier-Villars, 1922.

[KS91] E. Kaltofen and B. Saunders. On wiedemann’s method for solving sparse linear systems. In H. Mattson, T. Mora, and T. Rao, editors, Applied Algebra, Algebraic Algorithms and Error-Correcting Codes, volume 539 of LNCS, pages 29–38. Springer-Verlag, 1991.

[KS98] E. Kaltofen and V. Shoup. Subquadratic-time factoring of polynomials over finite fields. Math. Comp., 67(223):1179–1197, 1998.

[Lan93] S. Lang. Algebra (Third Edition). Addison-Wesley Publishing Company, 1993.

[LBR88] D. Le Brigand and J. Risler. Algorithme de Brill-Noether et codes de Goppa. Bull. Soc. Math. France, 116:231–253, 1988.

[LM91] A.K. Lenstra and M.S. Manasse. Factoring with two large primes (extended abstract). In Advances in cryptology — EUROCRYPT 1990, volume 473 of LNCS, pages 72–82. Springer-Verlag, 1991.

[LM94] A.K. Lenstra and M.S. Manasse. Factoring with two large primes. Math. Comp, 63:785–798, 1994.

[LP92] H.W. Lenstra and C. Pomerance. A rigorous time bound for factoring integers. J. Amer. Math. Soc., 5, 1992.

[LW] A. Lauder and D. Wan. Counting points on varieties over finite fields of small characteristic. In J. Buhler and P. Stevenhagen, editors, Algorithmic Number Theory: Lattices, Number Fields, Curves and Cryptography. Cambridge University Press. forthcoming, available on the arXiv under math.NT/0612147.

[Mat89] H. Matsumura. Commutative Ring Theory. Cambridge University Press, 1989.

[Mil75] J. Miller. On Factorization, with a Suggested New Approach. Math. Comp., 29:155–172, 1975.

[MS03] T. Mulders and A. Storjohann. On lattice reduction for polynomial matrices. J. Symb. Comput., 35:377–401, 2003.

[Mum65] D. Mumford. Geometric Invariant Theory. Springer-Verlag, [Nag04] K. Nagao. Improvement of Thériault Algorithm of In-

dex Calculus of Jacobian of Hyperelliptic Curves of Small Genus. Cryptology ePrint Archive, Report 2004/161, http://eprint.iacr.org/2004/161, 2004.

[Neu91] J. Neukirch. Algebraische Zahlentheorie. Springer-Verlag, 1991.

[Noe84] M. Noether. Rationale Ausführung der Operationen in der Theorie der algebriaschen Functionen. Math. Ann., 23:311–358, 1884.

[Odl84] A. Odlyzko. Discrete logarithms in finite fields and their cryptographic significance. In T. Beth, N. Cot, and I. Ingemarsson, editors, Advances in Cryptology — EUROCRYPT 1984, volume 209 of LNCS, pages 224–314, 1984.

[Pap94] C. Papadimitriou. Computational Complexity. Addison Wesley, 1994.

[Pil90] J. Pila. Frobenius maps of abelian varieties and fining roots of unity in finite fields. Math. Comp., 55:745–763, 1990.

[Pil91] J. Pila. Counting points on curves over families in polynomial time. available on the arXiv under math.NT/0504570, 1991.

[Pol78] J. Pollard. Monte Carlo methods for index computations (mod p). Math. Comp., pages 918–924, 1978.

[Pom87] C. Pomerance. Fast, rigorous factorization and discrete logarithm algorithms. In D. Johnson, T. Nishizeki, A. Nozaki, and H. Wolf, editors, Discrete Algorithms and Complexity, Proceedings of the Japan US Joint Seminar, June 4-6, 1986, Kyoto, Japan, pages 119–143, 1987.

[PS85] F. Preparata and M. Shamos. Computational Geometry. Springer-Verlag, 1985.

[RS62] J. Rosser and L. Schoenfeld. Approximate formulas for some functions of prime numbers. Illinois J. Math., 6(64-94), 1962.

[Sch85] R. Schoof. Elliptic curves over finite fields and the compuation of square roots mod p. Math. Comp., 44:483–494, 1985.

[Sch91] W. Schmidt. Construction and estimation of bases in function fields. J. Number Th., 39:181–224, 1991.

[Sem98] I. Semaev. Evaluation of discrete logarithms in a group of ptorsion points of an elliptic curve in characteristic p. Math. Comp., 67:353–356, 1998.

[Sem04] I. Semaev. Summation polynomials and the discrete logarithm problem on elliptic curves. available under http://eprint.iacr.org/2004/031, Feb. 2004.

[Ser79] J.-P. Serre. Local Fields. Springer, 1979.

[Sil86] J. Silverman. The Arithmetic of Elliptic Curves. Springer-Verlag, 1986.

[Sti93] H. Stichtenoth. Algebraic Function Fields and Codes. Springer-Verlag, 1993.

[SZ94] B. Sturmfels and A. Zelevinsky. Multigraded Resultants of Sylvester Type. J. Algebra, 163:115–127, 1994.

[Thé03] N. Thériault. Index calculus attack for hyperelliptic curves of small genus. In Advances in Cryptology — ASIACRYPT 2003, volume 2894 of LNCS, pages 75–92. Springer-Verlag, 2003.

[Vol94] E. Volcheck. Computing in the Jacobian of a Plane Algebraic Curve. In L. Adleman and M.-D. Huang, editors, Algebraic Number Theory – ANTS I, volume 877 of LNCS, pages 221–233. Springer-Verlag, 1994.

[Vol95] E. Volcheck. Addition in the Jacobian of a Curve over a Finite Field. Manuscript for a presentation given at the Oberwolfach institute, available under http://www.emilvolcheck.com, 1995.

[vzGG03] J. von zur Gathen and J. Gerhard. Modern Computer Algebra. Cambridge Unversity Press, 2003.

[Wie86] D. Wiedemann. Solving Sparse Linear Equations Over Finite Fields. IEEE Trans. Inform. Theory, 32(1):54–62, 1986.

[WM68] A.E. Western and J.C.P. Miller. Tables of Indices and Primitive Roots, volume 9. Royal Society Mathematical Tables, 1968. Published for the Royal Society at the Cambridge University Press.

[Zas67] H. Zassenhaus. Ein Algorithmus zur Berechnung einer Minimalbasis über gegebener Ordnung. In L Collarz, G. Meinardus, and H. Ungers, editors, Funktionalanalysis, Approximationstheorie, Numerische Mathematik (Oberwolfach 1965), pages 90 – 103. Birkhäuser, 1967.

216 Bibliography

Zusammenfassung

In dieser Arbeit werden Berechnungsprobleme, die einen Bezug zu Divisoren und Divisorklassen auf Kurven haben, von einem komplexitätstheoretischen Standpunkt aus untersucht. Besondere Betonung liegt hierbei auf der Komplexität des diskreten Logarithmusproblems in Grad 0 Klassengruppen von Kurven über endlichen Körpern. Hierbei studieren wir die folgende allgemeine Fragestellung: Welche interessanten Resultate über erwartete Laufzeiten kann man erhalten, wenn man Bedingungen an das Geschlecht und den Grundkörper aber keine weiteren Bedingungen an die Kurven stellt und die erwartete Laufzeit entweder mittels q^{g}, wobei q die Körpergröße und g das Geschlecht ist, oder mittels der Kardinalität der Grad 0 Klassengruppe der Kurve ausdrückt?

Man beachte hier, dass, wenn E eine elliptische Kurve über einen Körper K ist, die Gruppe der rationalen Punkte E(K) von E kanonisch isomorph zu Cl^{0}(E), der Grad 0 Klassengruppe, ist. Wir betrachten also insbesondere das diskrete Logarithmusproblem in in Gruppen rationaler Punkte elliptischer Kurven.

Außerdem wird in dieser Arbeit ein Beitrag zu den Grundlagen der algorithmischen Mathematik geleistet.

Es folgt eine Zusammenfassung der wesentliche Aspekte der einzelnen Kapitel der Arbeit.

Kapitel 1 Berechnungsprobleme, Berechnungsmodelle und Komplexität

Ausgangspunkt der Fragestellungen in Kapitel 1 ist die Beobachtung, dass man die folgenden drei Fragen beantworten muss, um ein Berechnungsproblem wohldefiniert zu machen:

• Auf welchem Berechnungsmodell ist das Problem basiert?

• Wie lautet das Komplexitätsmaß / die Kostenfunktion?

• Wie werden die betrachteten mathematischen Objekte dargestellt?

Das Kapitel beginnt mit einigen Definitionen, die es ermöglichen, über Berechnungsprobleme vom “mathematischen Inhalt” her zu sprechen, d.h. ohne eine zu große Betonung darauf zu legen, wie die betrachteten Objekte für Berechnungen dargestellt werden, und dabei gleichzeitig nicht zu unpräzise zu sein. Die grundlegende Idee der Definitionen ist, dass sich Darstellungen von Objekten wohlverhalten sollen bezüglich Isomorphismen aber nicht notwendigerweise bezüglich anderen Morphismen.

Die wesentliche Definition lautet dann wie folgt:

Seien C und X zwei große Gruppoide (d.h. Kategorien, in denen jeder Morphismus ein Isomorphismus ist). Dann ist eine Darstellung von C durch X ein essenziell surjektiver partieller Funktor von X nach C, dessen Definitionsbereich eine volle Unterkategorie von X ist.

Es ist naheliegend, nach einen Berechnungsmodell zu fragen, dass die intuitive Idee von bit-Komplexität erfasst und dabei in effizienter Weise indirekte Adressierung erlaubt. Sicher bieten RAM-Modelle eine angemessene Antwort, wenn indirekte Adressierung gewünscht wird. Ein Problem ist jedoch, dass RAM-Modelle immer auf einer bestimmten Menge von Kommandos beruhen, und die Auswahl der Kommandos geht mit einer gewissen Willkürlichkeit einher. Um diese Willkürlichkeit zu überwinden, schlagen wir eine gewisse bit-orientierte Registermaschine, die wir bit-orientierte Random Access Machine (bit-RAM) nennen.

Eine intuitive Beschreibung dieser Maschine ist schnell zu geben: wie üblich besteht die Maschine aus Registern und einem Programm. Der Befehlssatz besteht aus den üblichen Befehlen LOAD, STORE, GOTO, IFGOTO, END, und zusätzlich gibt es für jede Turing Maschine T (in einem bestimmten Modell) einen Befehl c_{T}.

Außerdem definieren wir randomisierte bit-RAMs.

Der bit-orientierte Zugang ist jedoch nicht immer der angemessenste, um Berechnungsprobleme zu modellieren. Zum Beispiel könnte man, gegeben ein Körper k, nach der Komplexität der Multiplikation zweier Matrizen mit Einträgen in k fragen, gemessen in Körperoperationen. In diesem Fall scheint es nicht angemessen, zu verlangen, dass die Körperelemente durch bit-Strings dargestellt werden, was ohnehin nur möglich ist, wenn der Körper abzählbar ist. Stattdessen wünscht man, was in [BCS91] ein “makroskopischer Standpunkt, ausgehend von einen idealisierten Computer” genannt wird, einzunehmen.

In der Tat gibt es einige Modelle in der Literatur, die es erlauben, einen solchen “makroskopischen Standpunkt” einzunehmen. Hier sei zunächst das Modell der Rechenbäume erwähnt. Dieses Modell ist jedoch nicht uniform über verschiedene Eingabelängen, während wir ein uniformes Modell anstreben, um die Idee eines Algorithmus zu modellieren. Ein anderes bekanntes Modell ist das Modell von Blum, Shub und Smale ([BSS89]), welches als ein algebraisches Turing-Maschinenmodell betrachtet werden kann. Wir sind jedoch an einem Registermodell interessiert. Ausgehend von dem bit-RAM Modell definieren wir so ein so ein Berechnungsmodell, das über einem festen Ring R arbeitet. Wir nennen die resultierenden Maschinen R-RAMs (wobei sich R auf den Ring bezieht).

Sei nun R ein kommutativer Ring. Wenn S eine R-Algebra ist, definiert jede R-RAM in natürlicher Weise eine S-RAM. Wenn wir betonen wollen, dass eine R-RAM Eingaben aus allen R-Algebren entgegennimmt, sprechen wir von einer R-Algebra RAM. Eine ℤ-Algebra RAM nennen wir auch eine (generische) Ring RAM ; wenn wir uns auf Eingaben über Körpern statt Ringen beschränken, sprechen wir auch von einer generischen Körper RAM. Für Kapitel 2 ist die folgende Variante der generischen Körper RAM besonders relevant: Wir reichern das generische Körper RAM Modell mit einem Kommando an, um p-te Einheitswurzeln in Charakteristik p > 0 zu berechnen.

Außerdem definieren wir noch randomisierte generische Körper RAMs. Hierfür reichern wir das generische Körper RAM Modell mit einem Kommando zur Berechnung von Zufallszahlen und einem Kommando zum Faktorisieren an. Das Kommando zum Faktorisieren ahmt dabei das Verhalten der Bekannten (Las Vegas) Algorithmen zum Faktorisieren von Polynomen über endlichen Körpern nach.

Zuletzt beschäftigen wir uns in diesem Kapitel mit algebraischer Komplexität und endlichen Algebren und als Anwendung hiervon mit grundlegenden Fragen, die mit Berechnungsproblemen und Körpererweiterungen zu tun haben.

Kapitel 2 Darstellungen und grundlegende Berechnungen

In diesem Kapitel diskutieren wir verschiedene Methoden, um die den Berechnungen zugrundeliegenden Objekte darzustellen: Kurven sowie Punkte, Divisoren und Divisorklassen auf Kurven. Weiterhin geben wir einige Resultate zu grundlegenden Berechnungen mit Divisoren, insbesondere zu Berechnungen in der Divisorgruppe und die Berechnung der sogenannten “Riemann-Roch-Räume” L(D), sowie Anwendungen auf die Arithmetik in der Divisorklassengruppe, an. Wir beschränken uns hierbei auf Kurven über vollkommenen Körpern.

Nach einer Darstellung der in dieser Arbeit verwendeten Notationen behandeln wir zunächst die Darstellung endlicher separabler Körpererweiterungen für rechnerische Zwecke. Die wichtigste Aussage ist hier die folgende:

Gegeben eine endliche Körpererweiterung λ|k, dargestellt durch eine Multiplikationstabelle, kann man mittels eines randomisierten Algorithmus ein primitives Element von λ|k (und sein Minimalpolynom) in einer erwarteten Anzahl von Körperoperationen berechnen, welche polynomiell beschränkt in [λ : k] ist.

Danach behandeln wir die Darstellung von Kurven, wobei im dieser Arbeit eine Kurve – wenn keine andere Information gegeben ist – immer geometrisch irreduzibel, eigentlich und glatt ist. Wir stellen Kurven immer durch ebene Modelle dar; ein ebenes Modell einer Kurve ist eine möglicherweise singuläre Kurve, die birational zur ursprünglichen Kurve ist. Die ebenen Modelle stellen wir durch eine definierende homogene Gleichung dar.

Die folgenden beiden Sätze legen nahe, dass diese Form der Darstellung vernünftig ist. (Der erste Satz ist [Heß05, Theorem 56].)

Jede Kurve über einem endlichen Körper hat ein ebenes Modell von Grad O(g) (unabhängig von den endlichen Körpern).

Jede Kurve von Geschlecht ≥ 1 mit einem Divisor von Grad 1 über einem undendlichen Körper hat ein ebenes Modell von Grad höchstens 4g.

Im größten Abschnitt des Kapitels behandeln wir die Darstellung von Punkten und Divisoren und hiermit zusammenhängende Berechnungsprobleme. Wir geben hierbei verschiedene Möglichkeiten an, abgeschlossene Punkte und Divisoren auf Kurven über vollkommenen Körpern darzustellen, ausgehend von einem ebenen Modell. Dabei gehen wir auch auf hiermit zusammenhängende algorithmische Aspekte wie z.B. die Arithmetik in der Divisorgruppe, die Berechnung von Hauptdivisoren und die Berechnung von Riemann-Roch-Räumen, ein.

Es gibt drei klassische Zugänge, um abgeschlossene Punkte und Divisoren auf Kurven darzustellen:

Der erste (und wohl auch intuitivste Zugang), um abgeschlossene Punkte darzustellen, beruht auf Koordinaten (in endlichen Erweiterungskörpern des Grundkörpers) von Punkten in einem ebenen Modell. Divisoren können dann dargestellt werden, indem man den Träger und die Koeffizienten angibt. Um jedoch für eine feste Kurve und ein festes singuläres ebenes Modell alle abgeschlossenen Punkte beschreiben zu können, benötigt man oft noch zusätzliche Information. Wenn nämlich das ebene Modell Singularitäten mit mehreren Zweigen hat, benötigt man weitere “lokale Information”, um die Punkte über den Singularitäten zu beschreiben. Es ist einfach, solche lokale Information zu geben, wenn das ebene Modell nur gewöhnliche Singularitäten hat (d.h. wenn die Tangenten der lokalen Zweige alle verschieden sind). Weiterhin kann man in Charakteristik 0 oder in “großer” positiver Charakteristik abgeschnittene Newton-Puiseux Entwicklungen verwenden.

In kleiner positiver Charakteristik stößt man allerdings auf größere technische Schwierigkeiten.

Die zweite Methode basiert auf der Idealtheorie in Funktionenkörpern. Hier stellt man eine Kurve als eine Überlagerung der projektiven Geraden dar und definiert zwei Ordnungen in ihrem Funktionenkörper, eine “endliche” und eine “unendliche” Ordnung. Nun gibt es eine Bijektion zwischen der Divisorklassengruppe der Kurve und dem Produkt der Idealklassen der beiden Ordnungen. Man kann jeden Divisor durch das korrespondierende Paar von Idealen darstellen. Die Ideale kann man durch Modulbasen dargestellen (zum Beispiel durch Hermite Normalform-Basen). Wir nennen diese Darstellung zusammengesetzte Idealdarstellung. Alternativ kann man auch jeden Divisor als formale Summe von Primdivisoren darstellen, wobei jeder Primdivisor (= abgeschlossener Punkt) als Primideal einer der beiden Ordnungen dargestellt wird. Wir nennen diese Darstellung freie Idealdarstellung.

Man beachte, dass die so genannte “Mumford Darstellung” von so genannten semi-reduzierten Divisoren auf hyperelliptischen Kurven in imaginär quadratischer Darstellung ein Spezialfall der zusammengesetzten Idealdarstellung ist.

Drittens kann man effektive Divisoren durch lineare Unterräume von Riemann-Roch-Räumen von Divisoren genügend hohen Grades oder allgemeiner von Räumen globaler Schnitte invertierbarer Garben genügend hohen Grades darstellen. Wir nennen die entsprechende Darstellung zusammengesetzte globale Darstellung, und wiederum haben wir eine verwandte freie Darstellung.

Aufgrund der schon erwähnten technischen Schwierigkeiten gehen wir auf die Darstellung mittels Entwicklungen an singulären Punkten nicht ein und richten unser Hauptaugenmerk auf die idealtheoretische Darstellung. Wir geben eine ausführlichen Überblick über die Darstellung und hiermit zusammenhängende Berechnungsprobleme. Insbesondere gehen wir hierbei – in einem Anhang zu diesem Kapitel – auf die Berechnung von Hauptordnungen in Funktionenkörpern ein. Wir zeigen, dass diese Berechnung mit einem deterministischen Algorithmus (ohne Polynomfaktorisation) in einer Anzahl von Körper- und Bitoperationen durchgeführt werden kann, welche polynomiell im Grad des ebenen Modells ist.

Die idealtheoretische Darstellung erlaubt auch auf einfache Weise die Berechnung des Riemann-Roch Raums L(D) zu einem Divisor D. Wir geben den entsprechenden Algorithmus an, der von F. Heß in seiner Doktorarbeit entwickelt wurde ([Heß01]). Es gibt einen Zusammenhang zwischen Heß’ Algorithmus und “nicht-archimedischen Gittern”. Wir diskutieren diesen Zusammenhang und gehen dabei auch auf eine Verbindung zur expliziten Bestimmung der Riemann-Roch-Räume ein, die von K. Hensel und G. Landsberg in [HL02] angegeben wurde.

Außerdem gehen wir auf die globale Darstellung und den rechnerischen Transfer zwischen den verschiedenen Darstellungen (inklusive der Koordinatendarstellung von Punkten, die über nicht-singulären Punkten im ebenen Modell liegen) ein.

Schließlich kommen wir zur Darstellung der Divisorklassen und Berechnungen in der Klassengruppe. Hierbei sind die folgende Definitionen grundlegend:

Sei C eine Kurve und D_{0} ein fester Divisor auf C von Grad ≥ 1. Sei D̃ ein effektiver Divisor auf C. Dann ist D̃ (maximal) reduziert entlang D_{0}, wenn das lineare System |D̃ − D_{0}| leer ist.

Sei nun D ein Divisor auf C und D̃ ein entlang D_{0} reduzierter effektiver Divisor mit D ∼ D̃ + rD_{0} für ein r ∈ ℤ. Dann heißt D̃ eine Reduktion von D entlang D_{0}.

Die Reduktionen von D entlang D_{0} bilden ein nicht-leeres vollständiges Linearsystem. Ferner ist die Reduktion eindeutig, wenn D_{0} den Grad 1 hat.

Um die Elemente der Divisorklassengruppe darzustellen, fixieren wir so einen Divisor D_{0} und stellen dann eine beliebige Divisorklasse a mittels eines reduzierten Divisors D̃ und einer ganzen Zahl r mit [D̃] − r[D_{0}] = a dar.

Der kanonische Divisor hat Grad 2g − 2. Wenn man nun diesen Divisor (oder einen Divisor kleineren Grades) für die Darstellung verwendet und Divisoren in zusammengesetzter Idealdarstellung darstellt, erhält man die folgende Aussage:

Die Arithmetik in der Divisorklassengruppe kann in einer Anzahl von Körper- und Bitoperation durchgeführt werden, die polynomiell beschränkt im Grad des ebenen Modells ist.

Kurven über endlichen Körpern haben immer einen Divisor von Grad 1. Wir zeigen, wie man einen solchen Divisor effizient konstruieren kann. Für das 3. Kapitel ist nun die folgende Aussage grundlegend:

Wir betrachten Kurven über endlichen Körpern. Wie immer stellen wir Kurven durch ebene Modelle dar, und definieren d als den Grad des ebenen Modells. Wir stellen Divisorklassen durch entlang einem Divisor D_{0} von Grad 1 und mit einer Höhe, welche polynomiell beschränkt in d ist, reduzierte Divisoren dar. Außerdem stellen wir Divisoren in freier Idealdarstellung dar. Dann kann die Arithmetik in den Grad 0 Klassengruppen mittels eines randomisieren Algorithmus in einer erwarteten Zeit durchgeführt werden, welche polynomiell beschränkt in d und log(q) ist, wobei q die Größe des Grundkörpers ist. Wenn die Kurven durch ebene Modelle von Grad O(g) dargestellt werden, kann man mittels eines randomisierten Algorithmus die Arithmetik in den Grad 0 Klassengruppen in einer Zeit durchführen, die polynomiell beschränkt in g und log(q) ist; man kann dann mit einem randomisieren Algorithmus die Arithmetik in einer erwarteten Zeit durchführen, die polynomiell beschränkt in log(# Cl^{0}(C)) ist, wobei C die Kurve ist.

Kapitel 3 Berechnen diskreter Logarithmen

Kapitel 3 ist das Herz dieser Arbeit und beinhaltet die Berechnung von diskreten Logarithmen in Grad 0 Klassengruppen von Kurven, inklusive der Gruppen rationaler Punkte elliptischer Kurven, über endlichen Körpern.

Alle Resultate über das diskrete Logarithmusproblem in dieser Arbeit basieren auf der Index Calculus Methode. Grob gesagt besteht die Index Calculus Methode aus dem Folgenden: Man fixiert eine Menge von Primdivisoren F, genannt Faktorbasis, und sucht nach Relationen zwischen den Faktorbasiselementen und den Eingabeelementen. Wenn man genug Relationen hat, versucht man, den gesuchten diskreten Logarithmus mittels linearer Algebra zu finden.

Wir geben hier einen groben Überblick über die Variante von Index Calculus, auf der dieses Kapitel beruht:

Seien eine Kurve C über einem endlichen Körper 𝔽_{q} sowie a, b ∈ Cl^{0}(C) mit b ∈ ⟨a⟩ gegeben, wobei die Kurve und die Klassen a, b dargestellt werden, wie in Kapitel 2 beschrieben. Wir setzen der Einfachheit halber voraus, dass die Grad 0 Klassengruppe prime Gruppenordnung hat und von a erzeugt wird. Ferner setzen wir voraus, dass die Gruppenordnung N := # Cl^{0}(C) bekannt ist.

Sei x ∈ {0, …, N −1} mit x·a = b der unbekannte diskrete Logarithmus, den wir berechnen wollen.

Man wählt zuerst die Faktorbasis F, sagen wir F = {F_{1}, …, F_{k}} mit paarweise verschiedenen Primdivisoren F_{j}. Außerdem wählt man einen Divisor D_{1} von Grad 1.

Dann erzeugt man Relationen zwischen den Eingabeelementen a, b, den Faktorbasiselementen und D_{1}:

∑_{j} r_{i,j}[F_{j}] − (∑_{j} r_{i,j} deg(F_{j})) · [D_{1}] = α_{i}a + β_{i}b

mit r_{i,j}, α_{i}, β_{i} ∈ ℤ/Nℤ.

Es seien nun k + 1 Relationen erzeugt; sei R = ((r_{i,j}))_{i,j} ∈ ℤ^{(k+1)×k} die Relationenmatrix, d.h. die Matrix, deren Zeilen den Koeffizienten entsprechen, die in den Relationen vorkommen.

Nun ist der Links-Kern der Matrix R nicht-trivial. Man berechnet einen nicht-trivialen Zeilenvektor \underline{γ} ∈ (ℤ/Nℤ)^{1×(k+1)} mit \underline{γ}R = 0. Man sieht nun leicht, dass

∑_{i} γ_{i}α_{i}a + ∑_{i} γ_{i}β_{i}b = 0 .

Wenn nun ∑_{i} γ_{i}β_{i} ≠ 0, dann haben wir mit ξ := (∑_{i} γ_{i}α_{i})(∑_{i} γ_{i}β_{i})^{−1} ∈ ℤ/Nℤ

ξ · a = b ∈ Cl^{0}(C) .

Das bedeutet, dass der eindeutige Repräsentant x ∈ {0, …, N − 1} von ξ der gesuchte diskrete Logarithmus von b bezüglich a ist.

Nach einer Einleitung geben wir im 2. Abschnitt des Kapitels einen “allgemeinen Index Calculus Algorithmus” für das diskrete Logarithmusproblem in Grad 0 Klassengruppen von Kurven. Dieser Algorithmus ist eine Variante eines Algorithmus von A. Enge und P. Gaudry ([EG02]). Eine Besonderheit dieses Algorithmus ist, dass man den diskreten Logarithmus mit großer Wahrscheinlichkeit berechnen kann, wenn die Relationensuche beendet ist. Der Algorithmus basiert auf fünf Unterroutinen für

a) Berechnung der Ordnung der Grad 0 Klassengruppe

b) Faktorisierung ganzer Zahlen

c) Konstruktion einer Faktorbasis und Vorberechnung

d) Relationenerzeugung

e) dünne lineare Algebra.

Im weiteren Verlauf des Kapitels geben wir dann spezielle Unterroutinen für a), c) und d) und für spezielle Klassen von Kurven an. Für Unterroutinen b) und e) verwenden wir (respektive) den Algorithmus von Lenstra und Pommerance ([LP92]) sowie einen Algorithmus, der auf Wiedemanns Algorithmus ([Wie86]) beruht.

Doppelt große Primvariation ist eine Möglichkeit, die Relationensuche zu beschleunigen. Hier geht man wie folgt vor: Zusätzlich zur Faktorbasis F definiert man eine weitere Menge von Primdivisoren L, der Menge der so genannten großen Primdivisoren, die disjunkt zu F ist. Man betrachtet dann Relationen mit höchstens zwei großen Primdivisoren. Die grundlegende Idee ist wie folgt: Solche Relationen werden wie folgt in einem Graphen auf der Menge L ˙∪ {∗} abgespeichert: Relationen mit zwei großen Primdivisoren P, Q werden mittels einer Kante zwischen P und Q abgespeichert, und Relationen mit einem großen Primdivisor P werden durch eine Kante zwischen ∗ und P abgespeichert. Zykel in dem Graph führen dann zu “kombinierten Relationen” zwischen den Eingabeelementen und den Faktorbasiselementen.

Wir gehen in unseren Algorithmen allerdings etwas anders vor: Wir konstruieren nicht einen vollen Graphen sondern nur einen Baum, wobei wir zusätzlich noch diesen Baum in “Abschnitten” konstruieren. Bei Konstruktion eines Abschnitts betrachten wir nur solche Relationen, die eine Kante ergeben, die mit dem vorherigen Abschnitt verbunden ist.

Die gesamte Konstruktion des Baumes findet in der Unterroutine c) statt. In d) werden dann neue Relationen erzeugt, die zunächst auch Elemente aus L enthalten dürfen. Mittels des Baums werden dann diese “großen Primdivisoren” eliminiert.

Mittels dieser Methode zeigen wir in Abschnitt 3 das folgende Theorem:

Theorem 1 Es sei eine natürliche Zahl g ≥ 2 fixiert. Dann kann das diskrete Logarithmusproblem in den Grad 0 Klassengruppen von Kurven von Geschlecht g über endlichen Körpern mittels eines randomisierten Algorithmus in einer erwarteten Zeit von

Õ(q^{2− \frac{2}{g}})

gelöst werden, wobei 𝔽_{q} der Grundkörper der Kurve ist.

Für dieses Resultat wählen wir den Divisor D_{1} als einen 𝔽_{q}-rationalen Punkt P_{0}, die Faktorbasis als eine Teilmenge von C(𝔽_{q})−\{P_{0}\} mit ⌈q^{1− \frac{1}{g}} ⌉ Elementen und L := C(𝔽_{q}) − (F ∪ {P_{0}}).

Neben dem Index Calculus Algorithmus beruht dieses Resultat auch auf einem effizienten Algorithmus, der mit hoher Wahrscheinlichkeit ein kleines Erzeugendensystem berechnet. Allerdings können wir nicht überprüfen, dass es sich tatsächlich um ein Erzeugendensystem handelt. Deshalb gehen wir wie folgt vor: Wir wenden diesen Algorithmus an, um ein “potenzielles Erzeugendensystem” zu berechnen, und dann wenden wir den Index Calculus Algorithmus an. Wenn der Index Calculus Algorithmus nicht in einer vorgegebenen Zeit terminiert, starten wir den ganzen Prozess von vorne.

Im nächsten Abschnitt zeigen wir dann ausgehend von dem obigen Theorem die folgenden beiden Theoreme.

Theorem 2 Es sei eine natürliche Zahl g_{0} ≥ 2 fixiert. Dann kann das diskrete Logarithmusproblem in den Grad 0 Klassengruppen von Kurven von Geschlecht ≥ g_{0} über endlichen Körpern mittels eines randomisierten Algorithmus in einer erwarteten Zeit von

Õ((q^{g})^{\frac{2}{g_{0}} (1− \frac{1}{g_{0}} )})

gelöst werden, wobei 𝔽_{q} der Grundkörper der Kurve ist.

Theorem 3 Es sei eine natürliche Zahl g_{0} ≥ 2 fixiert. Dann kann das diskrete Logarithmusproblem in den Grad 0 Klassengruppen von Kurven C/𝔽_{q} von Geschlecht ≥ g_{0} mittels eines randomisierten Algorithmus in einer erwarteten Zeit von

Õ((# Cl^{0}(C))^{\frac{2}{g_{0}} (1− \frac{1}{g_{0}} )})

gelöst werden.

Wenn man Theorem 3 mit g_{0} := 3 anwendet erhält man:

Man kann das diskrete Logarithmusproblem in den Grad 0 Klassengruppen von Kurven C/𝔽_{q} von Geschlecht mindestens 3 in einer erwarteten Zeit von

Õ((# Cl^{0}(C))^{\frac{4}{9}} )

lösen.

Im Gegensatz hierzu haben “generische Methoden” für jede Folge von Kurven, deren Gruppenordnung durch eine Primzahl der Größe Θ(# Cl^{0}(C)) teilbar ist, eine erwartete Laufzeit von Ω(# Cl^{0}(C)^{\frac{1}{2}} ).

Um diese beiden Theoreme zu erhalten, gehen wir wie folgt vor: Für kleines Geschlecht wenden wir einen Algorithmus für Theorem 1 an. Für großes Geschlecht ist der Algorithmus viel einfacher: Es ist ein “einfacher” Index Calculus Algorithmus ohne große Primvariation. Die Analyse für großes Geschlecht beruht auf einer Aussage aus [Heß05].

Im letzten Abschnitt zeigen wir die folgenden beiden Theoreme:

Theorem 4 Es sei ϵ > 0. Dann kann das diskrete Logarithmusproblem in den Gruppen rationaler Punkte von elliptischen Kurven über endlichen Körpern 𝔽_{q^{n}} mit (2 + ϵ) ≤ log_{2}(q) mittels eines randomisierten Algorithmus in einer erwarteten Zeit gelöst werden, welche polynomiell beschränkt in q ist.

Theorem 5 Es sei eine natürliche Zahl n ≥ 2 fixiert. Dann kann das diskrete Logarithmusproblem in den Gruppen rationaler Punkte von elliptischen Kurven über endlichen Körpern 𝔽_{q^{n}} mittels eines randomisierten Algorithmus in einer erwarteten Zeit von

Õ(q^{2− \frac{2}{n}})

gelöst werden.

Theorem 4 hat das folgende offensichtliche Korollar:

Sei ϵ > 0, und sei a > 2+ϵ. Dann kann das diskrete Logarithmusproblem in den Gruppen rationaler Punkte von elliptischen Kurven über endlichen Körpern 𝔽_{q^{n}} mit (2 + ϵ) · n^{2} ≤ log_{2}(q) ≤ a · n^{2} in einer erwarteten Zeit von

e^{O(1)·(log_{2}(q^{n}))^{2/3}}

gelöst werden.

In der Tat erhält man eine erwartete Laufzeit, welche polynomiell beschränkt in

q = 2^{log_{2}(q)} = 2^{(log_{2}(q))^{(1+1/2)·2/3}} ≤ 2^{(\sqrt{a}·n log_{2}(q))^{2/3}}

ist.

Mit diesem Korollar wird zum ersten Mal gezeigt, dass es Folgen endlicher Körper wachsender Größe gibt, über denen das elliptische Kurven diskrete Logarithmusproblem in einer erwarteten Zeit gelöst werden kann, welche subexponententiell in der Eingabelänge (oder im Logarithmus der Körpergröße bzw. der Gruppenordnung) ist.

Im Algorithmus zu Theorem 4 ist die Faktorbasis wie folgt gegeben: Es wird eine Überlagerung φ : E ⟶ ℙ_{𝔽_{q^{n}}}^{1} von Grad 2 mit φ ∘ [−1] = φ

fixiert. Dann ist die Faktorbasis

F := {P ∈ E(𝔽_{q^{n}}) | φ(P) ∈ 𝔽_{q}} .

Die Relationensuche beruht auf einem “Zerlegungsalgorithmus”, der auf dem Lösen polynomieller Gleichungssysteme beruht. Diese Gleichungssysteme beruhen auf einer homogenisierten Variante der von I. Semaev eingeführten Summationspolynome. Diese Polynome sind durch die folgende Aussage definiert:

Es sei E eine elliptische Kurve über einem Körper k und φ : E ⟶ ℙ_{k}^{1} eine Überlagerung von Grad 2 mit φ ∘ [−1] = φ. Sei m ∈ ℕ mit m ≥ 2. Dann gibt es ein bis auf Multiplikation mit einer nicht-trivialen Konstanten eindeutig bestimmtes multihomogenes irreduzibles Polynom S_{φ,m} ∈ k[X_{1}, Y_{1}, …, X_{m}, Y_{m}] so dass für alle P_{1}, …, P_{m} ∈ E(\overline{k}) gilt: S_{φ,m}(φ(P_{1}), …, φ(P_{m})) = 0 ⟷ ∃ϵ_{1}, …, ϵ_{m} ∈ {1, −1} : ϵ_{1}P_{1}+⋯+ϵ_{m}P_{m} = O. Das Polynom S_{φ,m} hat Multigrad (2^{m−2}, …, 2^{m−2}).

Diese Polynome werden wie folgt eingesetzt:

Zu einer festen Überlagerung φ wie oben, einem Punkt P ∈ E(𝔽_{q^{n}}) und einer 𝔽_{q}-Basis von 𝔽_{q^{n}} definieren wir wie folgt Polynome S^{(1)}, …, S^{(n)} ∈ 𝔽_{q}[X_{1}, Y_{1}, …, X_{n}, Y_{n}]:

∑_{j=1}^{n} b_{j}S^{(j)} = S_{φ,n+1}(X_{1}, Y_{1}, …, X_{m}, Y_{m}, φ(P)) .

Für Q_{1}, …, Q_{n} ∈ ℙ^{1}(𝔽_{q}) sind nun die folgenden beiden Aussagen äquivalent:

• Es gibt P_{1}, …, P_{n} ∈ E(\overline{𝔽}_{q}) so dass P_{1} + ⋯ + P_{n} = P und x(P_{i}) = Q_{i} für i = 1, …, n.

• Für alle j = 1, …, n ist S^{(j)}(Q_{1}, …, Q_{n}) = 0, d.h. (Q_{1}, …, Q_{n}) ist ein 𝔽_{q}-rationaler Punkt von V (S^{(1)}, …, S^{(n)}) ⊆ (ℙ_{𝔽_{q}}^{1})^{n}.

Unter einem Zerlegungsalgorithmus verstehen wir nun einen Algorithmus für das folgende Berechnungsproblem: Gegeben q, n, eine 𝔽_{q}-Basis b_{1}, …, b_{n}, E/𝔽_{q^{n}} und eine Überlagerung φ : E ⟶ ℙ_{𝔽_{q^{n}}}^{1} wie oben, bestimme man, ob das Unterschema V (S^{(1)}, …, S^{(n)}) ⊆ (ℙ_{𝔽_{q}}^{1})^{n} 0-dimensional ist, und wenn dies der Fall ist, bestimme man alle seine 𝔽_{q}-rationalen Punkte!

Der schwierigste Teil der Analyse des Algorithmus ist nun, für geeignetes φ eine untere Schranke für die Anzahl der Punkte P ∈ E(𝔽_{q}) anzugeben, für die V (S^{(1)}, …, S^{(n)}) 0-dimensional ist und es P_{1}, …, P_{n} wie soeben beschrieben gibt.

Hierfür verwenden wir insbesondere Schnitttheorie in Produkten projektiver Geraden. Es folgt ein kurzer Einblick in den Beweis.

Sei Res_{𝔽_{q}}^{𝔽_{q^{n}}}(ℙ_{𝔽_{q^{n}}}^{1}) die Weil Restriktion von ℙ_{𝔽_{q^{n}}}^{1} bezüglich der Erweiterung 𝔽_{q^{n}}|𝔽_{q}; dies ist eine n-dimensionale Varietät über 𝔽_{q} so dass es insbesondere eine kanonische Bijektion ℙ^{1}(𝔽_{q^{n}}) ≃ Res_{𝔽_{q}}^{𝔽_{q^{n}}}(ℙ_{𝔽_{q^{n}}}^{1})(𝔽_{q}) gibt.

Für Q ∈ ℙ^{1}(𝔽_{q^{n}}) sei Q_{⊚} der entsprechende 𝔽_{q}-rationale Punkt in Res_{𝔽_{q}}^{𝔽_{q^{n}}}(ℙ_{𝔽_{q^{n}}}^{1}). Außerdem seien p_{1} : (ℙ_{𝔽_{q}}^{1})^{n} × Res_{𝔽_{q}}^{𝔽_{q^{n}}}(ℙ_{𝔽_{q^{n}}}^{1}) ⟶ (ℙ_{𝔽_{q}}^{1})^{n} und

p_{2} : (ℙ_{𝔽_{q}}^{1})^{n} × Res_{𝔽_{q}}^{𝔽_{q^{n}}}(ℙ_{𝔽_{q^{n}}}^{1}) ⟶ Res_{𝔽_{q}}^{𝔽_{q^{n}}}(ℙ_{𝔽_{q^{n}}}^{1}) die beiden Projektionen.

Wir definieren ein gewisses Unterschema X von (ℙ_{𝔽_{q}}^{1})^{n} × Res_{𝔽_{q}}^{𝔽_{q^{n}}}(ℙ_{𝔽_{q^{n}}}^{1}) mit der folgenden Eigenschaft: Für P ∈ E(𝔽_{q^{n}}) ist die Faser X_{Q_{⊚}} kanonisch isomorph zu V (S^{(1)}, …, S^{(n)}).

Es wesentlicher Aspekt des Beweises ist es, die Anzahl der 𝔽_{q}-rationalen Punkte in den nicht-nulldimensionalen Fasern unter p_{2} nach oben abzuschätzen.

Hierfür bestimmen wir einen effektiven Cartierdivisor B in (ℙ_{𝔽_{q}}^{1})^{n} so dass alle nicht-nulldimensionalen Fasern bezüglich p_{2} in p_{1}^{−1}(B) enthalten sind. Mittels Schnitttheorie können wir den Multigrad von B nach oben abschätzen. Das gewünschte Ergebnis erhalten wir dann, weil p_{1} eine flache Überlagerung eines bekannten Grades ist.

Auch der Algorithmus für Theorem 5 beruht auf dem Zerlegungsalgorithmus, und zusätzlich verwenden wir eine doppelt große Primvariation. Bis auf die Verwendung des Zerlegungsalgorithmus ist dieser Algorithmus sehr ähnlich zu dem für Theorem 1.

Bezug zu anderen Arbeiten

Wir erwähnen noch kurz, wie sich diese Arbeit von verwandten Arbeiten abgrenzt.

Die wesentlichen neuen Resultate sind die Theoreme 1 – 5 oben, und alle diese Theoreme sind neu.

Für hyperelliptische Kurven in imaginär quadratischer Darstellung mit zyklischer Grad 0 Klassengruppe wurde Theorem 1 in [GTTD07] bewiesen.

In einer Arbeit von P. Gaudry ([Gau04]) befindet sich auch ein “Theorem”, in der die Aussage von Theorem 5 behauptet wird. Jedoch wird kein Beweis der Aussage sondern lediglich eine knappe heuristische Argumentation gegeben.

Wie betrachten die Aussagen von Kapitel 2 als “mehr oder weniger bekannt” unter Experten. Grundlegende Ideen befinden sich in der Arbeit [Heß01] von F. Heß sowie im Buch [Coh96] über Algorithmen für Zahlkörper von H. Cohen. Wir möchten jedoch betonen, dass, obwohl die grundlegenden Techniken dieses Kapitels schon vorher bekannt waren, einige wesentliche Aussagen noch nicht in der Literatur erschienen sind. Wir erwähnen hier beispielhaft die effiziente Transformation zwischen den verschiedenen Darstellungen von Divisoren, die wir diskutieren, sowie die effiziente faktorisierungsfreie Berechnung der Maximalordnung.

Kapitel 1 besteht hauptsächlich aus Definitionen, wobei einige vollkommen neu und andere Varianten von Definitionen in der Literatur sind.

Wir kommen abschließend auf die zu Beginn gestellte allgemeine Frage zum diskreten Logarithmusproblem in Grad 0 Klassengruppen von Kurven über endlichen Körpern zurück. Neben den soeben beschriebenen neuen Resultaten sind uns die folgenden Resultate zu der Frage bekannt:

Mit dem baby-step-giant-step Algorithmus und Resultaten über Arithmetik in Klassengruppen in Kapitel 2 dieser Arbeit kann das diskrete Logarithmusproblem für Kurven C/𝔽_{q} in einer Zeit von Õ(# Cl^{0}(C)^{\frac{1}{2}} ) gelöst werden. Mit der Schranke # Cl^{0}(C) ≤ (\sqrt{q} + 1)^{2g} erhält man auch obere Schranken mittels q^{g} anstatt mittels # Cl^{0}(C).

Neben diesen Resultaten ist uns nur ein weiteres (bewiesenes) Resultat bekannt. Es ist das Resultat über “Kurven großen Geschlechts” von F. Heß in ([Heß05]). Um dieses Resultat zu formulieren, definieren wir die übliche Komplexitätsfunktion

L_{N}[α, c] := e^{c·log(N)^{α}·(log log(N))^{1−α}}

für Parameter α ∈ (0, 1) und c > 0. Dann ist das Resultat wie folgt:

Wir betrachten eine Klasse von Kurven über endlichen Körpern so dass log(q) ∈ o(g log(q)), wobei wie üblich q die Körpergröße und g das Geschlecht ist. Dann kann für jedes ϵ > 0 das diskrete Logarithmusproblem in den Grad 0 Klassengruppen solcher Kurven in einer erwarteten Zeit von

L_{q^{g}}[\frac{1}{2}, 32^{\frac{1}{2}} + ϵ]

gelöst werden.

Ähnlich zum vorherigen Resultat kann man mit der Ungleichung (\sqrt{q} − 1)^{2g} ≤ # Cl^{0}(C) auch obere Schranken mittels # Cl^{0}(C) erhalten.