Irreducibility and r-th root finding over finite fields

TL;DR

This paper explores connections between constructing r-th nonresidues and irreducible polynomials over finite fields, providing new deterministic algorithms and extending classical results like Stickelberger's Lemma.

Contribution

It extends Stickelberger's Lemma, offers deterministic algorithms for constructing finite fields and finding r-th roots, and discusses a conjecture weaker than GRH for deterministic root finding.

Findings

Deterministic poly-time construction of finite fields when m is an r-power.

Deterministic poly-time r-th root finding when r is constant and divides gcd(m,p-1).

Extension of Stickelberger's Lemma relating polynomial factors to nonresidues.

Abstract

Constructing $r$-th nonresidue over a finite field is a fundamental computational problem. A related problem is to construct an irreducible polynomial of degree $r^e$ (where $r$ is a prime) over a given finite field $\mathbb{F}_q$ of characteristic $p$ (equivalently, constructing the bigger field $\mathbb{F}_{q^{r^e}}$). Both these problems have famous randomized algorithms but the derandomization is an open question. We give some new connections between these two problems and their variants. In 1897, Stickelberger proved that if a polynomial has an odd number of even degree factors, then its discriminant is a quadratic nonresidue in the field. We give an extension of Stickelberger's Lemma; we construct $r$-th nonresidues from a polynomial $f$ for which there is a $d$, such that, $r|d$ and $r\nmid\,$#(irreducible factor of $f(x)$ of degree $d$). Our theorem has the following interesting consequences: (1) we can construct $\mathbb{F}_{q^m}$ in deterministic poly(deg($f$),$m\log q$)-time if $m$ is an $r$-power and $f$ is known; (2) we can find $r$-th roots in $\mathbb{F}_{p^m}$ in deterministic poly($m\log p$)-time if $r$ is constant and $r|\gcd(m,p-1)$. We also discuss a conjecture significantly weaker than the Generalized Riemann hypothesis to get a deterministic poly-time algorithm for $r$-th root finding.

Equations

$$\left(\frac{D}{p}\right)=(-1{)}^{n-s}$$

$$N(\alpha )=N_{{\mathbb{F}}_{q^k}/{\mathbb{F}}_q}(\alpha )={\alpha }^{\frac{q^k-1}{q-1}}.$$

$$N_{{\mathbb{F}}_{q^k}/{\mathbb{F}}_q}(\alpha )=\prod _{i=1}^{k-1}{\alpha }^{q^i}={\alpha }^{\frac{q^k-1}{q-1}}.$$

$$\alpha^{\frac{q^{k}-1}{r}}\neq 1\Longleftrightarrow\Big{(}{\alpha}^{\frac{q^{k}-1}{q-1}}\Big{)}^{\frac{q-1}{r}}=\Big{(}N_{\mathbb{F}_{q^{k}}/\mathbb{F}_{q}}(\alpha)\Big{)}^{\frac{q-1}{r}}\neq 1.$$

$${\chi }_r(ab)={\chi }_r(a){\chi }_r(b).$$

$$R(f,g):=a_m^m{b}_n^n{\prod _{\alpha \in \mathcal{Z}(f)}}_{\beta \in \mathcal{Z}(g)}(\alpha -\beta )=a_m^m\prod _{\alpha \in \mathcal{Z}(f)}g(\alpha ).$$

$$R(f,g)\,=\,\left|\begin{array}[]{cccccccc}a_{m}&0&\cdots&0&b_{n}&0&\cdots&0\\ a_{m-1}&a_{m}&\cdots&0&b_{n-1}&b_{n}&\cdots&0\\ a_{m-2}&a_{m-1}&\ddots&0&b_{n-2}&b_{n-1}&\ddots&0\\ \vdots&\vdots&\ddots&a_{m}&\vdots&\vdots&\ddots&b_{n}\\ \vdots&\vdots&\cdots&a_{m-1}&\vdots&\vdots&\cdots&b_{n-1}\\ a_{0}&a_{1}&\cdots&\vdots&b_{0}&b_{1}&\cdots&\vdots\\ 0&a_{0}&\ddots&\vdots&0&b_{0}&\ddots&\vdots\\ \vdots&\vdots&\ddots&a_{1}&\vdots&\vdots&\ddots&b_{1}\\ 0&0&\cdots&a_{0}&0&0&\cdots&b_{0}\\ \end{array}\right|\,.$$

$$\Delta (p):=a_m^{2m-2}\prod _{1\le i<j\le m}({\alpha }_i-{\alpha }_j{)}^2.$$

$$L_{f,r}:=\sum _{i=0}^{r-1}{x}^{(q^k{)}^i}{{\zeta }_r}^i\mathrm{mod}f.$$

$$\big{(}L_{f,r}\big{)}^{\frac{q^{d}-1}{r}}\,=\,\zeta_{r}^{-1}\,.$$

$${(L_{f,r})}^{q^k}$$

$$=\sum _{i=0}^{r-1}{x}^{q^{k\cdot (i+1)}}{{\zeta }_r}^i={{\zeta }_r}^{-1}\cdot L_{f,r}.$$

$${(L_{f,r})}^{\frac{q^d-1}{r}}$$

$$={(L_{f,r})}^{(1+q^k+q^{2k}\dots +q^{(r-1)k})\cdot (\frac{q^k-1}{r})}$$

$$={(L_{f,r}\cdot {\zeta }_r^{-1}{L}_{f,r}\cdot {\zeta }_r^{-2}{L}_{f,r}\cdots {\zeta }_r^{-(r-1)}{L}_{f,r})}^{(\frac{q^k-1}{r})}$$

$$\displaystyle=\Big{(}(L_{f,r})^{r}(\zeta_{r}^{-1})^{{r}\choose{2}}\Big{)}^{(\frac{q^{k}-1}{r})}\,.$$

$${(L_{f,r})}^{\frac{q^d-1}{r}}$$

$$=(L_{f,r}{)}^{(q^k-1)}={\zeta }_r^{-1}.$$

$$a^{\frac{q^{\prime }-1}{r}}=(a^{\frac{p^m-1}{r}}{)}^{\frac{q^{\prime }-1}{p^m-1}}=({\zeta }_r^{-1}{)}^{\frac{q^{\prime }-1}{p^m-1}}\ne 1.$$

$$R(f,g)=N_{{\mathbb{F}}_{q^d}/{\mathbb{F}}_q}(g).$$

$$R(f,g)$$

$$=\prod _{i=0}^{d-1}g({\alpha }^{q^i})$$

$$=\prod _{i=0}^{d-1}g(\alpha {)}^{q^i}$$

$$=g(\alpha {)}^{{\sum }_{i=0}^{d-1}{q}^i}$$

$$=N_{{\mathbb{F}}_{q^d}/{\mathbb{F}}_q}(g).$$

$$g(x):=\sum _{i=0}^{r-1}{x}^{q^{ki}}{{\zeta }_r}^i.$$

$$R(f,g\mathrm{mod}f)=R(f,g).$$

$$R(f,g^{\prime })$$

$$=\prod _{\alpha \in \mathcal{Z}(f)}g(\alpha )[\because g^{\prime }(\alpha )=g(\alpha )]$$

$$=R(f,g).$$

$$R(f,g\mathrm{mod}f)=R(f,g)=\prod _{i=1}^{r^{\prime }}R(f_i,g)=\prod _{i=1}^{r^{\prime }}R(f_i,g\mathrm{mod}{f}_i).$$

$${\chi }_r(R(f,g\mathrm{mod}f))=\prod _{i=1}^{r^{\prime }}{\chi }_r(R(f_i,g\mathrm{mod}{f}_i))=({\zeta }_r^{-1}{)}^{r^{\prime }}.$$

$${\phi }_r(Y)=\prod _{i\in {\mathbb{F}}_r^{\ast }}(Y-{\eta }^i),$$

$${\mathbb{F}}_q[\zeta ]\cong {\text{varprod}}_{i\in {\mathbb{F}}_r^{\ast }/⟨q⟩}{\mathbb{F}}_{q^e}[Y]/⟨Y-{\eta }^i⟩,$$

$$R(f,g\mathrm{mod}f{)}^{\frac{q^e-1}{r}}={\zeta }^{-r^{\prime }\ell },$$

$$g(x):=\sum _{i=0}^{r-1}{x}^{q^{e{k}^{\prime }i}}{\zeta }^i.$$

Full text

In 1897, Stickelberger proved that if a polynomial has an odd number of even degree factors, then its discriminant is a quadratic nonresidue in the field. We give an extension of Stickelberger’s Lemma; we construct $r$-th nonresidues from a polynomial $f$ for which there is a $d$, such that, $r|d$ and $r\nmid\,$#(irreducible factor of $f(x)$ of degree $d$). Our theorem has the following interesting consequences: (1) we can construct $\mathbb{F}_{q^{m}}$ in deterministic poly($\deg(f),m\log q$)-time if $m$ is an $r$-power and $f$ is known; (2) we can find $r$-th roots in $\mathbb{F}_{p^{m}}$ in deterministic poly($m\log p$)-time if $r$ is constant and $r|\gcd(m,p-1)$.

We also discuss a conjecture significantly weaker than the Generalized Riemann hypothesis to get a deterministic poly-time algorithm for $r$-th root finding.

Visiting Scholar, Centre for Quantum Technologies, NUS, Singapore

1. Introduction

The problem of finding $r$-th roots in a finite field is to solve $x^{r}=a$ given an $r$-th residue $a\in\mathbb{F}_{q}$. Note that, without loss of generality, we can assume $r$ to be prime, otherwise for $r=r_{1}\cdot r_{2}$, we can solve the problem iteratively by first solving $x^{r_{1}}=a$ and then solving $y^{r_{2}}=x$. Moreover, we can assume $r|(q-1)$, otherwise $x=a^{r^{-1}\mod(q-1)}$ is an easy solution.

It can be shown that $x^{r}=a$ has a solution iff $a^{\frac{q-1}{r}}=1$ . If $a^{\frac{q-1}{r}}\neq 1$ then we call $a$ an $r$-th nonresidue. Interestingly, the problem of finding an $r$-th nonresidue is equivalent to that of finding $r$-th roots in $\mathbb{F}_{q}$ [2, 21, 29]. This gives a randomized poly-time algorithm for finding $r$-th roots and, thus, solves the problem for practical applications. Also, assuming Generalized Riemann hypothesis (GRH) there is a deterministic poly-time algorithm for finding $r$-th nonresidue in any finite field [3, 5, 8, 13]. For a detailed survey see [6, Chap.7].

The special case of $r=2$ is particularly well studied. The problem now is to find square-roots in $\mathbb{F}_{q}$, which is equivalent to finding a quadratic nonresidue in $\mathbb{F}_{q}$. There are other randomized algorithms – Cipolla’s algorithm [10], singular elliptic curves based algorithm [18], etc. There are also deterministic solutions for some special cases:

• •

Schoof [20] gave an algorithm using point counting on elliptic curves having complex-multiplication to find square-roots of fixed numbers over prime fields.

• •

Tsz-Wo-Sze [28] gave an algorithm to take square-roots over $\mathbb{F}_{q}$, when $q-1=r^{e}t$ and $r+t=\text{poly}(\log p)$.

However, computing square-roots over finite fields in deterministic polynomial time is still an open problem. The best known deterministic complexity for this problem is exponential, namely, $\tilde{O}(p^{1/4\sqrt{e}})$; which is also a bound on the least quadratic nonresidue [9]. The distribution of quadratic nonresidues in a finite field is still mostly a mystery; it relates to some interesting properties of the zeta function, see Thm.6.7.

In 1897, L. Stickelberger [26] proved that if $p$ is a prime, $K$ is an algebraic number field of degree $n$ of discriminant $D$, and integer ring $\mathcal{O}_{K}$ where the ideal $(p)$ factorizes as $\mathfrak{p}_{1}\mathfrak{p}_{2}\mathfrak{p}_{3}\ldots\mathfrak{p}_{s}$ into distinct prime ideals then

[TABLE]

Equivalently, if the number of even degree irreducible factors of a squarefree $f(x)\mod p$ are odd, then the discriminant of $f$ will be a quadratic nonresidue in $\mathbb{F}_{p}$. Swan [27] and Dalen [11] gave alternative proofs of Stickelberger lemma. Stickelberger lemma is used in factorization of polynomials over finite fields and in constructing irreducible polynomials of a given degree over finite fields [30, 27, 12].

We generalize this idea of constructing quadratic nonresidues from Stickelberger’s lemma to constructing $r$-th nonresidues from “special”, possibly reducible, polynomials. Formally, these “special” polynomials are over $\mathbb{F}_{q}$ and satisfy the following factorization pattern,

Property 1.1**.**

Let $r$ be a prime and $f(x)\in\mathbb{F}_{q}[x]$ be a squarefree polynomial. $f$ satisfies Stickelberger property 1.1 if $\exists d$, such that, $r|d$ and $r\nmid\,$#(irreducible factor of $f(x)$ of degree $d$).

Our goal is to show that the construction of such a, possibly reducible, polynomial solves many of the open problems. It is somewhat surprising that a reducible polynomial be related so strongly to non-residuosity and irreducibility.

Our first main result relates Property 1.1 to the construction of $r$-th nonresidues in any field above $\mathbb{F}_{p}$ (equivalently, finding $r$-th roots there).

Theorem 1.2**.**

Given $\zeta_{r}\in\mathbb{F}_{q}$ and any polynomial $f$ satisfying Property 1.1, we can find $r$-th roots in any finite field of characteristic $p$, in deterministic poly$(\deg(f),\log q)$-time.

We get a stronger result in the case when we have $\mathbb{F}_{p^{r}}$ available and $r=O(1)$. Even $r=2$ is an interesting special case.

Corollary 1.3**.**

We can find $r$-th roots in $\mathbb{F}_{p^{m}}$ in deterministic poly($m\log p$)-time if $r$ is constant and $r|\gcd(m,p-1)$.

Finding an $r$-th nonresidue $a$ in $\mathbb{F}_{q}$ suffices to construct an extension $\mathbb{F}_{q^{r}}$. For example, we have $\mathbb{F}_{q}[a^{1/r}]\cong\mathbb{F}_{q^{r}}$; equivalently, $X^{r}-a$ is an irreducible polynomial. However, it is not clear how to find $r$-th nonresidue given $\mathbb{F}_{q^{r}}$. Anyways, the question of constructing $\mathbb{F}_{q^{r}}$ efficiently is of great interest [1, 23, 24] and still open.

Our second main result relates Property 1.1 to the construction of an irreducible polynomial of degree $m$, where $m$ is any $r$-power.

Theorem 1.4**.**

Given a polynomial satisfying Property 1.1, we can construct the field $\mathbb{F}_{q^{m}}$, for any $r$-power $m$, in deterministic poly$(\deg(f),m\log q)$-time.

Note that, if we are given fields $\mathbb{F}_{q^{m_{1}}}$ and $\mathbb{F}_{q^{m_{2}}}$ (for coprime $m_{1},m_{2}$), we can combine them to get the field $\mathbb{F}_{q^{m_{1}m_{2}}}$ [22, Lem.3.4]. Hence, it is sufficient to be able to construct fields whose sizes are prime powers.

Organization of the paper

In this paper, the main results and ideas are presented in Sec.3. Sec.2 has notation and preliminaries. For concreteness, Sec.4 sketches our algorithm for finding an $r$-th nonresidue in any finite field, given a polynomial (in $\mathbb{F}_{p}[x]$) satisfying Property 1.1. We discuss some special cases of our analysis in Sec.5.

In Sec.6, we discuss few conjectures; particularly in Sec.6.2 we introduce a strictly weaker version of Generalized Riemann hypothesis to get poly-time algorithms.

2. Preliminaries

We are going to work in the finite field $\mathbb{F}_{q}$, where $q=p^{d}$ for some prime $p$. We will assume that $\mathbb{F}_{q}$ is specified by a degree $d$ irreducible polynomial over $\mathbb{F}_{p}$. This can be assumed without loss of generality, see [15, Thm.1.1].

Given a finite field $\mathbb{F}_{q}$ and its extension $\mathbb{F}_{q^{k}}$, the multiplicative norm of an element $\alpha\in\mathbb{F}_{q^{k}}$ is defined as,

[TABLE]

The following properties of finite fields will be useful (for proofs refer standard texts, eg. [16]).

Theorem 2.1** (Finite fields).**

Given a finite field $\mathbb{F}_{q}$ with characteristic $p$ and algebraic closure $\overline{\mathbb{F}}_{p}$ ,

• •

For any $a\in\overline{\mathbb{F}}_{p}$ , $a^{q}=a$ if and only if $a\in\mathbb{F}_{q}$.

• •

For any $a,b\in\mathbb{F}_{q}$, $(a+b)^{p}=a^{p}+b^{p}$.

• •

The multiplicative group $\mathbb{F}_{q}^{*}$ is cyclic.

• •

Any polynomial $f\in\mathbb{F}_{q}[x]$ of degree $k$ has at most $k$ roots in $\mathbb{F}_{q}$. The notation $\mathcal{Z}(f)$ will be used to denote the set of zeros of polynomial $f(x)$.

We are interested in finding $r$-th nonresidue in $\mathbb{F}_{q}$ for a prime $r$. An element $a\in\mathbb{F}_{q}$ is called an $r$-th nonresidue iff $x^{r}=a$ has no roots in $\mathbb{F}_{q}$. This possibility is there only if $r|(q-1)$. In that case, $a$ is an $r$-th nonresidue iff $a^{\frac{q-1}{r}}\neq 1$ [6]. Using this characterization, the following lemma constructs an $r$-th nonresidue in $\mathbb{F}_{q}$ given an $r$-th nonresidue in $\mathbb{F}_{q^{k}}$.

Lemma 2.2** (Projection).**

Let $r$ be a prime which divides $q-1$. Then, $\alpha\in\mathbb{F}_{q^{k}}$ is an $r$-th nonresidue iff $N_{\mathbb{F}_{q^{k}}/\mathbb{F}_{q}}(\alpha)$ is an $r$-th nonresidue in $\mathbb{F}_{q}$.

Proof.

We know that,

[TABLE]

Also, $\alpha\in\mathbb{F}_{q^{k}}$ is a $r$-th nonresidue iff $\alpha^{\frac{q^{k}-1}{r}}\neq 1$.

Hence, the proof follows from the bi-implication,

[TABLE]

∎

We can define a multiplicative character– $\chi_{r}(a):=a^{\frac{q-1}{r}}$ –of $\mathbb{F}_{q}^{*}$. Notice that $\chi_{r}(a)\neq 1$ iff $a$ is an $r$-th nonresidue in $\mathbb{F}_{q}$. Multiplicativity follows from the definition, i.e.,

[TABLE]

Since $a^{q-1}=1$, $\chi_{r}(a)$ is an $r$-th root of unity. We will denote a primitive $r$-th root of unity by $\zeta_{r}$.

Since $\mathbb{F}_{q}^{*}$ is cyclic and $r\mid q-1$, we have that $\zeta_{r}$ exists in $\mathbb{F}_{q}$. Note that $\zeta_{r}^{i}$, $i\in\mathbb{F}_{r}^{*}$, are the $(r-1)$ primitive $r$-th roots of unity in $\mathbb{F}_{q}$.

One of the central algebraic tool used in our analysis is the resultant of two polynomials. Let $f(x)=a_{m}x^{m}+a_{m-1}x^{m-1}+\cdots+a_{0}$ and $g(x)=b_{n}x^{n}+b_{n-1}x^{n-1}+\cdots+b_{0}$ be two polynomials over a field $\mathbb{F}$.

Definition 2.3** (Resultant).**

One way to define resultant of the two polynomials $f,g\in\mathbb{F}[x]$ is by invoking the zeros of the polynomials (in $\overline{\mathbb{F}}$),

[TABLE]

We will use the following properties of resultant (for proof see [16, Chap.1]). In fact, the property (3) in Lem.2.4 can be taken as the general definition of resultant, as it makes the resultant efficient to compute even when the base ring is not a field.

Lemma 2.4** (Properties of $R(\cdot)$).**

Given polynomials $f,g,h\in\mathbb{F}[x]$, we have that,

1. (1)

$R(f,g)\in\mathbb{F}$. 2. (2)

Resultant is multiplicative, $R(fh,g)=R(f,g)\cdot R(h,g)$. 3. (3)

*Resultant is the determinant of Sylvester matrix of order $m+n$ and, thus, can be computed in time $\tilde{O}((m+n)^{\omega_{0}})$, where ${\omega_{0}}\leq 2.373$ is the exponent of matrix multiplication.

---

[TABLE]

Another tool, closely related to resultant, is called the discriminant.

Definition 2.5** (Discriminant).**

The discriminant of a polynomial $f\in\mathbb{F}[x]$ with roots $\mathcal{Z}(f)=\{\alpha_{1},\alpha_{2},\cdots,\alpha_{m}\}$ is defined by,

[TABLE]

It is known that $\Delta(f)=(-1)^{m(m-1)/2}a_{m}^{-1}\cdot R(f,f^{\prime})$ [16, Eqn.1.11], where $f^{\prime}$ is the formal derivative of $f$. Hence, $\Delta(f)\in\mathbb{F}$ and it can be computed in poly($m$) field operations.

Note that although resultant (resp. discriminant) is defined in terms of the zeros of the polynomials, it can be computed without the knowledge of the zeros. This relationship between the zeros and the coefficients is very useful computationally.

3. Main results

We will prove the main theorems in this section. We are interested in finding $r$-th nonresidue in the finite field $\mathbb{F}_{q}$. So we will assume that $r\mid q-1$ in Sec.1.3 and Sec.3.2. Moreover, for $r=2$ we can assume that $4|(q-1)$, otherwise $-1$ is a quadratic nonresidue and we are done.

Our first step will be to construct an $r$-th nonresidue using an irreducible polynomial $f$ of degree divisible by $r$.

3.1. From an irreducible polynomial $f$ – Proof of Cor.1.3

Given an irreducible polynomial $f(x)\in\mathbb{F}_{q}[x]$ of degree $d=rk$, define the following polynomial (inspired from Lagrange resolvents):

[TABLE]

The following theorem finds an $r$-th nonresidue in $\mathbb{F}_{q}$ using $f$.

Theorem 3.1** (Irreducibility to nonresiduosity).**

Let $f(x)\in\mathbb{F}_{q}[x]$ be an irreducible polynomial of degree $d=rk$ and $\gcd(2,r)\cdot r\mid q-1$. If $L_{f,r}:=\sum_{i=0}^{r-1}x^{q^{k\cdot i}}{\zeta_{r}}^{i}\mod f$, then

[TABLE]

This implies that $L_{f,r}$ is an $r$-th nonresidue in $\mathbb{F}_{q^{d}}=\mathbb{F}_{q}[x]/\langle f\rangle$. Also, $N_{\mathbb{F}_{q^{d}}/\mathbb{F}_{q}}(L_{f,r})$ is an $r$-th nonresidue in $\mathbb{F}_{q}$.

Proof.

We know that $L_{f,r}\in\mathbb{F}_{q^{d}}$ and $\zeta_{r}\in\mathbb{F}_{q}$. Taking the $q^{k}$-th power,

[TABLE]

Using the above equation,

[TABLE]

When $r$ is an odd prime, $(\zeta_{r}^{-1})^{{r}\choose{2}}$ is $1$. If $r$ is $2$ then we have $4|(q-1)$, thus the factor of $-1$ can be ignored. Simplifying,

[TABLE]

By definition of $r$-th nonresidue, this implies that $L_{f,r}$ is an $r$-th nonresidue in $\mathbb{F}_{q^{d}}$. Applying Lem. 2.2, we get that $N_{\mathbb{F}_{q^{d}}/\mathbb{F}_{q}}(L_{f,r})$ is an $r$-th nonresidue in $\mathbb{F}_{q}$. ∎

Thm. 3.1 gives the Cor.1.3.

Proof of Cor.1.3.

Since $\mathbb{F}_{p^{m}}$ is specified by an irreducible polynomial of degree $m$ (and we know $r|\gcd(m,p-1)$), we get an $r$-th nonresidue by Thm.3.1 if we can find $\zeta_{r}$ in $\mathbb{F}_{p}$. The latter can be done using Pila’s algorithm based on arithmetic algebraic-geometry [19, Thm.D]. Once we have an $r$-th nonresidue one gets an $r$-th root finding algorithm [21, 29]. ∎

Thm. 3.1 also gives us a way to construct $r$-th nonresidue, in $\mathbb{F}_{p^{n}}$ for any $n$, using an irreducible polynomial of degree divisible by $r$.

Corollary 3.2** (Any field).**

Suppose we have an irreducible $f\in\mathbb{F}_{q}[x]$ with degree $d=rk$ and $\zeta_{r}\in\mathbb{F}_{q}$, where $\mathbb{F}_{q}$ has characteristic $p$. Then, we can find $r$-th nonresidue in any finite field $\mathbb{F}_{q^{\prime}}$ of characteristic $p$ (assuming $r|(q^{\prime}-1)$).

Proof.

Let $\mathbb{F}_{p^{m}}$ be the smallest subfield of $\mathbb{F}_{q}$, with $r|(p^{m}-1)$. Using Thm. 3.1 & Lem. 2.2 on $f$, we can find an $r$-th nonresidue in $\mathbb{F}_{p^{m}}$.

Now consider the given field $\mathbb{F}_{q^{\prime}}$ with, say, $p^{m\ell}$ elements (since $r|q^{\prime}-1$, $\ell\in\mathbb{N}$). It has a subfield $\mathbb{F}^{\prime}$ of size $p^{m}$, and so by [15, Thm.1.2], we also get an $r$-th nonresidue in $\mathbb{F}^{\prime}$, say $a$. We intend to lift this nonresidue to the bigger field $\mathbb{F}_{q^{\prime}}$; to do that we consider two cases.

• •

Case 1: If $r\nmid\ell$ then $a$ is an $r$-th nonresidue in $\mathbb{F}_{q^{\prime}}$. Because,

[TABLE]

Last inequality holds because $\frac{q^{\prime}-1}{p^{m}-1}=\frac{p^{m\ell}-1}{p^{m}-1}$ is not divisible by $r$.

• •

Case 2: If $r\mid\ell$ then we have an irreducible polynomial that defines $\mathbb{F}_{p^{m\ell}}$ and on that we can apply Thm.3.1 to get an $r$-th nonresidue in $\mathbb{F}_{q^{\prime}}$.

∎

The following lemma relates $N_{\mathbb{F}_{q^{d}}/\mathbb{F}_{q}}(g)$ to the resultant $R(f,g)$ when $f$ is irreducible.

Lemma 3.3** (Resultant as a norm).**

If $f$ is an irreducible polynomial of degree $d$ in $\mathbb{F}_{q}[x]$, then

[TABLE]

Proof.

We know that the roots of polynomial $f$ are $\mathcal{Z}(f)=\{\alpha,\alpha^{q},\cdots,\alpha^{q^{d-1}}\}$. Using the definition of resultant,

[TABLE]

∎

Using Thm. 3.1 and Lem. 3.3, we immediately get the following information about the quadratic character of the resultant of the Lagrange resolvent,

Corollary 3.4** (Resultant of resolvent).**

In the notation of Thm.3.1, $R(L_{f,r},f)$ is an $r$-th nonresidue in $\mathbb{F}_{q}$.

In particular, $\chi_{r}(R(L_{f,r},f))=\zeta_{r}^{-1}$.

3.2. From a reducible polynomial $f$ – Proof of Thm.1.2

We will look at the case of reducible polynomials now. The Thm.1.2 shows that a reducible polynomial satisfying Property 1.1 will give us an $r$-th nonresidue. Note that an irreducible polynomial of a degree divisible by $r$ will trivially satisfy Property 1.1.

Proof of Thm.1.2.

By distinct degree factorization [6, Thm.7.5.3], the polynomial $f$ can be decomposed as $f=h_{1}h_{2}\cdots h_{n}$, s.t.,

• •

For all $i$, $h_{i}$ has irreducible factors of same degree.

• •

For all $i\neq j$, irreducible factors of $h_{i}$ and $h_{j}$ have different degree.

We know that $f$ satisfies Property 1.1. So, the distinct degree factorization guarantees a factor $h_{i}=f_{1}f_{2}\cdots f_{r^{\prime}}$ of $f$ such that,

• •

$f_{i}$’s are irreducible of degree $d=rk$.

• •

$r\nmid r^{\prime}$.

For convenience we shall denote $f_{1}f_{2}\cdots f_{r^{\prime}}$ as $f$ from now on. Define $g(x)$ to be the Lagrange resolvent inspired polynomial,

[TABLE]

We will show that $R(f,g\bmod f)$ is an $r$-th nonresidue in $\mathbb{F}_{q}$. Here $g\bmod f$ refers to some representative in $\mathbb{F}_{q^{d}}[x]$. We will now show that the resultant is independent of the representative chosen.

Claim 1*.*

Let $f,g$ be two polynomials over any field. Then,

[TABLE]

Proof.

Let $g^{\prime}:=g\bmod f$ be a representative. Using the definition of resultant,

[TABLE]

∎

Clm.1 implies that,

[TABLE]

Since $\chi_{r}$ is multiplicative, we have,

[TABLE]

The last step follows from Cor. 3.4 and the fact that $f_{i}$ are irreducible. Since $r\nmid r^{\prime}$, we get $\chi_{r}(R(f,g\bmod f))\neq 1$ and hence $R(f,g\bmod f)$ is an $r$-th nonresidue in $\mathbb{F}_{q}$.

The last statement of the theorem (about fields of characteristic $p$) follows in the same way as in the proof of Cor. 3.2.

The time complexity is straightforward and further discussed in Sec.4.

∎

3.3. Constructing fields – Proof of Thm.1.4

The result in the previous subsection required the existence and knowledge of $\zeta_{r}$. Now we would like to eliminate those assumptions, hence we will remove the assumption $r|q-1$. First, we will show that if we have a reducible polynomial $f$ satisfying Property 1.1 then we can construct $\mathbb{F}_{q^{r}}$ (equivalently, we can construct an irreducible polynomial of degree $r$). The concepts that we will use are inspired from the proof of [15, Thm.5.2].

The starting idea is to work with a “virtual” $\zeta_{r}$, i.e. define the ring $\mathbb{F}_{q}[\zeta]:=\mathbb{F}_{q}[Y]/\langle\varphi_{r}(Y)\rangle$, where $\varphi_{r}(Y):=\sum_{0\leq i\leq r-1}Y^{i}$, and let $\zeta$ be the residue-class of $Y\bmod\varphi_{r}(Y)$ in that ring. Let $e$ be the smallest positive integer such that $r|q^{e}-1$, in other words, the multiplicative order of $q$ modulo $r$. Then $\varphi_{r}(Y)$ completely splits over $\mathbb{F}_{q^{e}}$ as

[TABLE]

where $\eta\in\mathbb{F}_{q^{e}}$ is a primitive $r$-th root of unity, but we may not have access to $\eta$ and in general not even to $\mathbb{F}_{q^{e}}$. So we will do computations over the ring $\mathbb{F}_{q}[\zeta]$ and try to construct the field $\mathbb{F}_{q^{r}}$.

Clearly, $\zeta$ has order $r$ in the unit group $\mathbb{F}_{q}[\zeta]^{*}$. For each integer $a\in\mathbb{F}_{r}^{*}$ there is a unique ring automorphism $\rho_{a}$ of $\mathbb{F}_{q}[\zeta]$ that fixes $\mathbb{F}_{q}$ and maps $\zeta\mapsto\zeta^{a}$. The set $\{\rho_{a}\,\mid\,a\in\mathbb{F}_{r}^{*}\}=:\Delta$ forms a group (under map composition) that is isomorphic to $\mathbb{F}_{r}^{*}$. If we consider the elements of the ring fixed under $\Delta$ then we get back $\mathbb{F}_{q}$, i.e. $\mathbb{F}_{q}[\zeta]^{\Delta}=\mathbb{F}_{q}$ [15, Prop.4.1].

Like Sec.3.2, suppose we have an $f=f_{1}f_{2}\cdots f_{r^{\prime}}\in\mathbb{F}_{q}[x]$ with $f_{i}$’s being irreducibles of degree $d=rk$ and $r\nmid r^{\prime}$. When we move to $\mathbb{F}_{q^{e}}$, $f_{i}$ factors into $\ell:=\gcd(k,e)=\gcd(d,e)$ many irreducibles each of degree $d/\ell=kr/\gcd(k,e)=:k^{\prime}r$. Since $r\nmid e$, we have that $r\nmid\ell$.

Our ring $\mathbb{F}_{q}[\zeta]$ is a semisimple algebra that decomposes as:

[TABLE]

and the proof given in Sec.3.2 holds simultaneously over each of the component fields ($\cong\mathbb{F}_{q^{e}}$) of $\mathbb{F}_{q}[\zeta]$. Hence, simply by Chinese remaindering, we get the equality:

[TABLE]

where, as expected, $g(x)$ is the following Lagrange resolvent over $\mathbb{F}_{q}[\zeta]$,

[TABLE]

(Also, note that we are now computing mod and resultant over the base ring $\mathbb{F}_{q}[\zeta]$.)

Teichmüller subgroup. Let $r^{\prime\prime}$ be an integer representative for $(r^{\prime}\ell)^{-1}\bmod r$. Let $q^{e}-1=ur^{t}$ such that $r\nmid u$ and $t\geq 1$. Define $\delta:=R(f,g\bmod f)^{ur^{\prime\prime}}$. Then, by Eqn.2, we have $\delta^{r^{t-1}}=\zeta^{-1}$. In particular, $\delta$ has order $r^{t}$ in $\mathbb{F}_{q}[\zeta]^{*}$. Define a function $\omega$ that maps any integer $a$ to $a^{r^{t-1}}\bmod r^{t}$. Note that, by binomial expansion, $(a+r)^{r^{t-1}}\equiv a^{r^{t-1}}\bmod r^{t}$. In other words, value of $\omega(a)$ only depends on $a\bmod r$. Now we come to the key definition, inspired from [15],

[TABLE]

The following properties can be easily verified:

• •

$c^{r^{t-1}}=\zeta$,

• •

$c$ has order $r^{t}$ in $\mathbb{F}_{q}[\zeta]^{*}$, and

• •

for all $\rho_{b}\in\Delta$, $\,\rho_{b}(c)=c^{\omega(b)}$.

At this point recall the definition of Teichmüller subgroup w.r.t. $\mathbb{F}_{q}$:

[TABLE]

By the properties above and invoking [15, Thm.5.1], we can deduce that $c$ is a generator of $T_{\mathbb{F}_{q}}$.

Consider the extension ring $\mathbb{F}_{q}[\zeta][c^{1/r}]:=\mathbb{F}_{q}[\zeta][X]/\langle X^{r}-c\rangle$, where $c^{1/r}$ is the residue class of $X\bmod X^{r}-c$ in the ring. By [15, Prop.4.3] we have: $\forall b\in\mathbb{F}_{r}^{*}$, $\rho_{b}$ extends uniquely to a ring automorphism of $\mathbb{F}_{q}[\zeta][c^{1/r}]$ such that $c^{1/r}\mapsto(c^{1/r})^{\omega(b)}$. Thus, $\Delta$ can now be seen as a group of ring automorphisms of $\mathbb{F}_{q}[\zeta][c^{1/r}]$.

Now we have the following nice way to construct a field extension.

Theorem 3.5** (Field extension).**

The fixed subring $\mathbb{F}_{q}[\zeta][c^{1/r}]^{\Delta}$ is isomorphic to $\mathbb{F}_{q^{r}}$. Moreover, given $f$, $\mathbb{F}_{q^{r}}$ can be constructed in deterministic poly($\deg(f),r\log q$)-time.

Proof.

It directly follows from [15, Thm.5.1] that $\mathbb{F}_{q}[\zeta][c^{1/r}]^{\Delta}\cong\mathbb{F}_{q^{r}}$.

From the above discussion it can be seen that, given $f$, we can compute $c$. Hence, we have a representation of the ring $\mathbb{F}_{q}[\zeta][c^{1/r}]$ in terms of a linear basis $\mathcal{B}$ over $\mathbb{F}_{q}$ (& their multiplication relations). Because of the properties of $\rho_{b}(\zeta)$ and $\rho_{b}(c^{1/r})$ we also have a description of the action of $\Delta$ on $\mathbb{F}_{q}[\zeta][c^{1/r}]$ in terms of $\mathcal{B}$. Thus, we can compute the fixed subring $\mathbb{F}_{q}[\zeta][c^{1/r}]^{\Delta}$ efficiently. It is straightforward to get the time complexity estimate. ∎

Proof of Thm.1.4.

From $f$, by Thm.3.5, we can get an irreducible polynomial $g$ over $\mathbb{F}_{q}$ of degree $r$. Let $m$ be any $r$-power. Then, by [15, Thm.1.1], we can construct $\mathbb{F}_{q^{m}}$ using $g$ efficiently. ∎

4. Algorithm

For concreteness, we state our algorithm (Algo.1) for constructing $r$-th nonresidue in this section. The proof of correctness for this algorithm follows directly from Thm.1.2.

The input to this algorithm is a polynomial $f(x)\in\mathbb{F}_{p}[x]$ satisfying Property 1.1, $\zeta_{r}\in\mathbb{F}_{p}$, and the finite field $\mathbb{F}_{q^{\prime}}$ of characteristic $p$ where we want to construct $r$-th nonresidue. The algorithm outputs an $r$-th nonresidue in $\mathbb{F}_{q^{\prime}}$.

Note that, since $f(x)$ satisfies Property 1.1, wlog (by the distinct degree factorization) $f=f_{1}f_{2}\cdots f_{r^{\prime}}$ such that,

• •

$f_{i}$’s are irreducible of degree $d=rk$, and

• •

$r\nmid r^{\prime}$.

Time complexity analysis-

One can refer to [25] for basic arithmetic operations. Polynomial computation in Step 2, takes time $\tilde{O}(rn\log{p}\log q^{\prime})$ using repeated squaring. Similarly, Step 5 can be done in $\tilde{O}(r^{2}k\log{p}$ $\deg(f))$. The most expensive part of the algorithm is the resultant computation in Step 6. The same can be done in time $\tilde{O}(\deg(f)^{\omega_{0}}\log{p})$, where $\omega_{0}<2.373$.

5. Some special case applications

5.1. The special case of $r=2$

Notice that for $r=2$, we have $\zeta_{2}=-1$ available in any finite field with odd characteristic. Thus, using Thm.1.2 and an $f$ (Property 1.1), we can construct a quadratic nonresidue. The same can also be calculated using Stickelberger lemma directly.

A striking difference, in the case of $r=2$, is that using Stickelberger lemma (Eqn.1) discriminant is the quadratic nonresidue. This implies that over even degree finite field extensions, the derivative of the minimal polynomial of the extension is a quadratic nonresidue. We formally state this property below.

Lemma 5.1** (Derivative).**

Given a finite field $\mathbb{F}_{q^{d}}=\mathbb{F}_{q}[x]/\langle f\rangle$ with even $d=\deg(f)$ and $4|(q-1)$, $f^{\prime}$ is a quadratic nonresidue in $\mathbb{F}_{q}[x]/\langle f\rangle$.

Proof.

Using Stickelberger lemma (Eqn.1) we know that the discriminant is a quadratic nonresidue in $\mathbb{F}_{q}$. Since,

[TABLE]

where $a_{d}=1$ is the leading coefficient of $f(x)$, we can deduce that $R(f,f^{\prime})$ is a quadratic nonresidue in $\mathbb{F}_{q}$.

Using Lem.3.3 we get that $N_{\mathbb{F}_{q^{d}}/\mathbb{F}_{q}}(f^{\prime})$ is a quadratic nonresidue in $\mathbb{F}_{q}$, and using Lem.2.2 we get that $f^{\prime}(x)$ is a quadratic nonresidue in $\mathbb{F}_{q}[x]/\langle f\rangle$. ∎

5.2. Cases for which $\zeta_{r}$ is known

Since our first main theorem, Thm.1.2, requires $\zeta_{r}$, in this section we state some known methods to construct the same.

One of the most significant results on this is by Pila [19]. He generalized Schoof’s [20] elliptic curve point-counting algorithm to Fermat curves, and as an application gave an algorithm for factoring the $r$-th cyclotomic polynomial over $\mathbb{F}_{p}$. The algorithm is deterministic and runs in time polynomial in $\log{p}$ for a fixed $r$. If $r|p-1$ then the factorization of the $r$-th cyclotomic will give us $\zeta_{r}\in\mathbb{F}_{p}$.

A limitation of Pila’s algorithm is that it can give us $\zeta_{r}$ only in prime fields. Below we state few results that can give $\zeta_{r}$ in extensions of prime fields.

The following theorem by Bach, von zur Gathen and Lenstra [7] gives an elegant way to construct $\zeta_{r}\in\mathbb{F}_{q}$ using “special” irreducible polynomials.

Theorem 5.2**.**

[7, Thm.2]** Given two prime numbers $p$ and $r$, the $h=\text{ord}_{r}(p)$, the explicit data for $\mathbb{F}_{p^{h}}$; and given for each prime $\ell|(r-1)$ but not dividing $h$, an irreducible polynomial $g_{\ell}$ of degree $\ell$ in $\mathbb{F}_{p}[X]$, there is a deterministic poly($rh\log(p)$)-time algorithm to construct a primitive $r$-th root of unity in $\mathbb{F}_{p^{h}}$.

We immediately get the following.

Corollary 5.3** (Inspired by BGL [7]).**

Let prime $r|q-1$. If for each prime $\ell\mid(r-1)$ we are given an irreducible polynomial $h_{\ell}\in\mathbb{F}_{q}[x]$ of degree divisible by $\ell$, then we can construct $\zeta_{r}\in\mathbb{F}_{q}$.

Proof.

Using $h_{\ell}$ we can construct an irreducible polynomial of degree $\ell$ [15, Thm.1.1]. Using Thm.5.2 on these, we can construct $\zeta_{r}\in\mathbb{F}_{q}$. ∎

There are also some other methods for finding $\zeta_{r}\in\mathbb{F}_{q}$ that are based on the factorization pattern of $q-1$. We present one such result and its proof.

Theorem 5.4** (Tsz-Wo Sze [28]).**

We can find $\zeta_{r}\in\mathbb{F}_{q}$ if $q-1=r^{e}t$, where $r+t=\text{poly}(\log q)$.

Proof.

The number of elements whose order is not a multiple of $r$ is $t$. So if we take $t+1$ elements in $\mathbb{F}_{q}$, this will give us an element $a$ that has order a multiple of $r$. Then, $a^{t}$ is an element with an $r$-power order. Let $\text{ord}(a^{t})=:r^{s}$, where $s\geq 1$. Finally, $a^{t\cdot r^{s-1}}$ is an element of order $r$ in $\mathbb{F}_{q}$. ∎

5.3. Necessary condition for the irreducibility of a polynomial

Our analysis provides a necessary condition for checking irreducibility of a polynomial.

Lemma 5.5**.**

If $f\in\mathbb{F}_{q}[x]$ is irreducible and prime $r|\deg(f)$ with $\gcd(2,r)\cdot r\mid(q-1)$, then $R(L_{f,r},f(x))$ is an $r$-th nonresidue in $\mathbb{F}_{q}$.

Proof.

This follows directly from Thm.3.1. ∎

Lem.5.5 for $r=2$ is used by von zur Gathen in his paper to prove properties about irreducible trinomials [30, Cor.3]. We hope that this generalized lemma gives conditions that can help construct additional polynomial families.

6. Some conjectures

6.1. Finding polynomials satisfying Property 1.1

A natural question that arises from our analysis is: How can one construct a polynomial satisfying Property 1.1? An approach can be to come up with a polynomial family $\mathcal{F}$ such that at least one of the polynomial in $\mathcal{F}$ satisfies Property 1.1. We leave the construction of such a polynomial family as an open question.

This question for $r=2$ will also be very interesting. For $r=2$, if we can construct a polynomial satisfying Property 1.1 then its discriminant will be a quadratic nonresidue by Stickelberger’s lemma.

A well studied polynomial family for such properties are trinomials. Trinomials are univariate polynomials with sparsity three:

[TABLE]

An elegant property of trinomials is the closed form expression for their discriminant and, thus, it can be computed efficiently. (Even if the degree of the trinomial is exponential.)

Theorem 6.1** (Swan [27]).**

Let $n>k>0$. Let $d=\gcd(n,k)$ and $n=n_{1}d,k=k_{1}d$ . Then,

[TABLE]

where $E=n^{n_{1}}b^{n_{1}-k_{1}}+(-1)^{n_{1}+1}(n-k)^{n_{1}-k_{1}}k^{k_{1}}a^{n_{1}}$ .

Trinomials are used to construct irreducible polynomials in [30, 27]. Based on our experiments we give the following conjecture.

Conjecture 6.2**.**

The following polynomial family has at least one polynomial that satisfy property 1.1 for $r=2$,

[TABLE]

We leave the proof, or a refutation, of this conjecture as an open question.

6.2. Weaker Generalized Riemann Hypothesis

In 1952, Ankeny [3] proved that if the Generalized Riemann Hypothesis is true then the least quadratic nonresidue in $\mathbb{F}_{p}$ is $O(\log^{2}p).$ The Generalized Riemann hypothesis(GRH) says that all the non-trivial roots $\rho$ of the Dirichlet L function are on real line $z=\frac{1}{2}$, but what if we consider a weaker form of it? Instead of saying that all the nontrivial roots lie on Re$(\rho)=\frac{1}{2}$, we “merely” conjecture that all the nontrivial roots lie in a wider strip $[\frac{1}{2}-\epsilon,\frac{1}{2}+\epsilon]$, for a constant $\epsilon$.

Conjecture 6.3** (Weak GRH).**

Let $\chi$ be a Dirichlet character, i.e. $\chi:\mathbb{F}_{p}^{*}\longrightarrow\mathbb{C}^{*}$. There exists a constant $\frac{1}{2}>\epsilon\geq 0$ such that the Dirichlet L function $L(s,\chi)=\sum\frac{\chi(n)}{n^{s}}$ have all its nontrivial roots in the interval $\frac{1}{2}-\epsilon<\text{Re}(s)<\frac{1}{2}+\epsilon$.

We will now use some known facts from Analytic number theory, for detailed proofs of these facts see [17, Chap.7]. Let $\Lambda$ be the Mangoldt function and $\zeta(s)$ be the Riemann zeta function.

Lemma 6.4** (Bounds for $\psi(x,\chi)$).**

Let $\psi(x,\chi)=\sum_{i\leq x}\Lambda(i)\chi(i)$ and $\chi$ be a primitive Dirichlet character of $\mathbb{F}_{p}^{*}$ , then

[TABLE]

where $\rho=\sigma+i\gamma$ are the nontrivial roots of the Dirichlet L function $L(s,\chi)$. Also, $\sum_{|\gamma|<\sqrt{x}}\frac{1}{|\rho|}=O(\log^{2}px)$.

Lemma 6.5** (Bounds for $\psi(x)$).**

Let $\psi(x)=\sum_{i\leq x}\Lambda(i)$, then

[TABLE]

where $\rho=\sigma+i\gamma$ are the nontrivial roots of the Riemann zeta function $\zeta(s)$. Also, $\sum_{|\gamma|<\sqrt{x}}\frac{1}{|\rho|}=O(\log^{2}x)$.

We will now prove bounds on $\psi(x)$ and $\psi(x,\chi)$ assuming Weak GRH.

Lemma 6.6** (New bounds).**

Assuming Weak GRH,

1. (1)

$\psi(x,\chi)=O(x^{\frac{1}{2}+\epsilon}\log^{2}px)$, and 2. (2)

$\psi(x)=x+O(x^{\frac{1}{2}+\epsilon}\log^{2}x)$.

Proof.

1. (1)

Using the notation in Lem.6.4,

[TABLE]

Since, \psi(x,\chi)=-\sum_{|\gamma|<\sqrt{x}}\frac{x^{\rho}}{\rho}+O\big{(}\log^{2}px\big{)}, we get that $\psi(x,\chi)=O(x^{\frac{1}{2}+\epsilon}\log^{2}px)$. 2. (2)

Using the notation in Lem.6.5,

[TABLE]

Since, \psi(x)=x-\sum_{|\gamma|<\sqrt{x}}\frac{x^{\rho}}{\rho}+O\big{(}\sqrt{x}\log^{2}x\big{)}, we get that $\psi(x)=x+O(x^{\frac{1}{2}+\epsilon}\log^{2}x)$.

∎

Using this lemma we will bound the least $r$-th nonresidue in $\mathbb{F}_{p}$.

Theorem 6.7**.**

Let n(p,r) denote the least $r$-th nonresidue in $\mathbb{F}_{p}^{*}$. Then, assuming the Weak GRH,

[TABLE]

Proof.

Let $\chi_{r}(a):=a^{\frac{p-1}{r}}\bmod p$, and $\chi_{o}$ be the trivial character i.e., $\chi_{0}(a)=1,\forall a\in\mathbb{F}_{p}^{*}$. Consider

[TABLE]

Note that, S(M) is zero iff there is no $r$-th nonresidue in the initial interval $[M]$.

We have,

[TABLE]

We are interested in finding the maximum $M_{0}$ such that $S(M_{0})=0$. The above estimate implies that $M_{0}=O(M_{0}^{0.5+\epsilon}\log^{2}pM_{0})$.

Therefore, $n(p,r)=O(\log^{\frac{4}{1-2\epsilon}}p)$. ∎

This elementary analysis, assuming Weak GRH, has remarkable consequences. Ankeny’s result has been used in derandomizing many computational problems under the assumption of GRH. Some of them are primality testing [6, Chap.9], $r$-th root finding [2], constructing irreducible polynomials over finite fields [1] and cases of polynomial factoring over finite fields [7, 1]. (Also, see [4, 14] and the references therein.) Our result implies that, for derandomizing these problems, proving the Weak GRH suffices.

7. Conclusion

We give a significant generalization of Stickelberger Lemma (Eqn.1); we can construct an $r$-th nonresidue in $\mathbb{F}_{q}$ given $\zeta_{r}\in\mathbb{F}_{q}$ and a polynomial $f$ satisfying Stickelberger property 1.1. Using this, we also gave an algorithm to find $r$-th roots in $\mathbb{F}_{q^{m}}$ if $r=O(1)$ and $r|\gcd(m,p-1)$. An interesting open question here is whether one can weaken the Stickelberger property (eg. remove the nondivisibility by $r$ condition?).

Our result along with some known results on finding $\zeta_{r}\in\mathbb{F}_{q}$ gives us some interesting applications. It seems that finding $\zeta_{r}\in\mathbb{F}_{q}$ is an inherent requirement in our analysis. We leave removing the requirement of $\zeta_{r}$ from our algorithm as an open question. This we have been able to achieve, if the goal is only to construct a degree $r$ irreducible (given $f$) instead of an $r$-th nonresidue.

We also leave the concrete conjectures Conj.6.2 & 6.3 open.

Acknowledgements

Part of research was accomplished while the first two authors were visiting CQT, NUS. V.B. would also like to thank CSE and IITK for their generous hospitality. N.S. thanks the funding support from DST (DST/SJF/MSA-01/2013-14). R.M. would like to thank DST Inspire grant.