5

If F := GF(p^n) is the finite field with p^n elements, where p is a prime number and n a natural number, is there any efficient algorithm to work out the product of two elements in F?

Here are my thoughts so far:

I know that the standard construction of F is to take an irreducible polynomial f of degree n in GF(p) and then view elements of F as polynomials in the quotient GF(p)[X]/(f), and I have a feeling that this is probably already the right approach since polynomial multiplication and addition should be easy to implement, but I somehow fail to see how this can be actually done. For example, how would one choose an appropriate f, and how can I get the equivalence class of an arbitrary polynomial?

Benno
  • 5,288
  • 5
  • 42
  • 60
  • You'll probably have more luck asking this on http://mathoverflow.net/ – Nifle Dec 20 '09 at 12:18
  • 4
    mathoverflow is aimed at research mathematicians, this question is on a much lower niveau. It probably only needs knowledge of stuff you learn in the third semester...i feel like i should be able answer it, but i'm just missing something obvious, and I'm very far from being a professional mathematician. I'm actually not even a mathemtician. – Benno Dec 20 '09 at 12:35
  • 1
    (continued) Aditionally, the problem here is more related to programming: mathematically it's pretty clear whats going on, I just cant convert the concept into an actually working computer program. – Benno Dec 20 '09 at 12:45
  • I’m voting to close this question because it belongs on Math Exchange. – duffymo Mar 28 '21 at 14:55

5 Answers5

5

First pick an irreducible polynomial of degree n over GF[p]. Just generate random ones, a random polynomial is irreducible with probability ~1/n.

To test your random polynomials, you'll need some code to factor polynomials over GF[p], see the wikipedia page for some algorithms.

Then your elements in GF[p^n] are just n-degree polynomials over GF[p]. Just do normal polynomial arithmetic and make sure to compute the remainder modulo your irreducible polynomial.

It's pretty easy to code up simple versions of this scheme. You can get arbitrarily complicated in how you implement, say, the modulo operation. See modular exponentiation, Montgomery multiplication, and multiplication using FFT.

Keith Randall
  • 22,985
  • 2
  • 35
  • 54
3

Whether there is an efficient algorithm to multiply elements in GF(p^n) depends on how you are representing the elements of GF(p^n).

As you say, one way is indeed to work in GF(p)(X)/(f). Addition and multiplication is relatively straightforward here. However, determining a suitable irreducible polynomial f is not easy - as far as I know there isn't an efficient algorithm for calculating a suitable f.

Another way is to use what are called Zech's logarithms. Magma uses pre-computed tables of them for working with small finite fields. It is possible that GAP does too, although its documentation is less clear.

Computing with mathematical structures is often quite tricky. You're certainly not missing anything obvious here.

Luke Woodward
  • 63,336
  • 16
  • 89
  • 104
  • Think, the Rabin Test for irreducibility in GF(p^n) is straight forward, https://en.wikipedia.org/wiki/Factorization_of_polynomials_over_finite_fields#Rabin%27s_test_of_irreducibility [with according to discussion q:=p and "g≠1" means "degree g ≠ 0"] – Sam Ginrich Apr 03 '21 at 18:00
3

It depends on your needs and on your field.

When you multiply you have to pick a generator of Fx. When you are adding you have to use the fact that F is a vector space over some smaller Fpm. In practice what you do a lot of time is some mixed approach. E.g. if you are working over F256, take a generator X of F256x, and let G be it's minimal polynomial over F16. You now have

(sumi smaller then 16 ai Xi)(sumj smaller then 16 bj Xj)= sum_k sumi+j = k ai bj Xi+j

All you have to do to make multiplication efficient, is store a multipication table of F16, and (using G) construct X^m in terms of lower powers of X and elements in F16

Finanly, in the rare case where pn = 22n, you get Conways field of nimbers (look in Conways "winning ways", or in Knuth's volume 4A section 7.1.3), for which there are very efficient algorithms.

David Lehavi
  • 1,186
  • 7
  • 16
  • Thought multiplication modulo irreducible polynomial is defined without knowing a generator. – Sam Ginrich Mar 26 '21 at 20:59
  • @SamGinrich : defined - yes; efficient - not so much. – David Lehavi Mar 27 '21 at 22:03
  • Certainly performance! Guess your approach is a "divide and conquer" method. What is the complexity? – Sam Ginrich Mar 28 '21 at 05:13
  • Yes it is divide and conquer. If you have (p^n)^2=p^(2n) elements in the field, then holding the full conversion tables from the multiplicative group to the addition friendly representation costs (memory-wise) 2p^(2n). whereas doing it as I described above would cost you 2p^n memory wise, but also 3p^nlog(p^n) for performing the product with FFT. I.e. it's really a trade off. You pay with performance to save (sometime prohibitively a lot of) memory. – David Lehavi Mar 28 '21 at 07:57
2

Galois Field Arithmetic Library (C++, mod 2, doesn't look like it supports other prime elements)

LinBox (C++)

MPFQ (C++)

I have no personal experience w/ these, however (have made my own primitive C++ classes for Galois fields of degree 31 or less, nothing too exotic or worth copying). Like one of the commenters mentioned, you might check mathoverflow.net -- just ask nicely and make sure you've done your homework first. Someone there ought to know what kinds of mathematical software is suitable for manipulation of finite fields, and it's close enough to mathoverflow's area of interest that a well-stated question should not get closed down.

Community
  • 1
  • 1
Jason S
  • 184,598
  • 164
  • 608
  • 970
  • It will probably be closed very fast on MO, which is aimed at graduate / pedagogical / research math. – David Lehavi Dec 21 '09 at 10:37
  • I disagree. First of all because it's a tool that could be used by research mathematicians; secondly, I asked a question about the spiral of Theodorus and got a very courteous answer. (http://mathoverflow.net/questions/3440/spiral-of-theodorus) – Jason S Dec 21 '09 at 12:38
1

Assume this is the question for an algorithm performing multiplication in finite fields, when a monic irreducible polynomial f(X) is identified (else consider Rabin's Test for Irreducibility)

You have two polynomials of degree n-1

A(X) = a_0 + a_1*X + a_2*X^2 + ... + a_(n-1)*X^(n-1) and
B(X) = b_0 + b_1*X + b_2*X^2 + ... + b_(n-1)*X^(n-1)

coefficients a_k, b_k are out of representatives {0,1,...,p-1} of Z/pZ.

The product is defined as

C(X) = A(X)*B(X) % f(X),

where the modulo operator "%" is the remainder of the polynomial division A(X)*B(X) / f(X).

Following is an approach with complexity O(n^2)

1.) By distributive law the product can be decomposed to

  B(X) * X^(n-1) * a_(n-1)
+ B(X) * X^(n-2) * a_(n-2)
+ ...
+ B(X) * a_0

=

  (...(a_(n-1) * B(X)  * X 
   +  a_(n-2)  * B(X)) * X
   +  a_(n-3)  * B(X)) * X
   ...
   +  a_1      * B(X)) * X
   +  a_0      * B(X)

2.) For the %-operator is a ring homomorphism from Z/pZ[X] onto GF(p^n) it can be applied in each step of the iteration above.

 A(X)*B(X) % f(X) =

  (...(a_(n-1) * B(X)  * X % f(X)
   +  a_(n-2)  * B(X)) * X % f(X)
   +  a_(n-3)  * B(X)) * X % f(X)
   ...
   +  a_1      * B(X)) * X % f(X)
   +  a_0      * B(X)

3.) After each multiplication with X, i.e. a shift in the coefficient space, you have a polynomial T_k(X) of degree n with element t_kn * X^n. Reduction modulo f(X) is done by

T_k(X) % f(X) = T_k(X) - t_kn*f(X),

which is a polynomial of degree n-1.

Finally, with reduction polynomial

r(x) := f(x) - X^n  and

T_k(X) =: t_kn * X^n + U_(n-1)(X)

T_k(X) % f(X) = t_kn * X^n + U_(n-1)(X) - t_kn*( r(x) + X^n)
              = U_(n-1)(X) - t_kn*r(x)

i.e. all steps can be done with polynomials of maximum degree n-1.

Sam Ginrich
  • 661
  • 6
  • 7