TC^0 circuits for algorithmic problems in nilpotent groups

TL;DR

This paper demonstrates that key algorithmic problems in finitely generated nilpotent groups are complete for the circuit class TC^0, extending previous Logspace results and showing their computational efficiency within this class.

Contribution

The paper proves that multiple algorithmic problems in nilpotent groups are TC^0-complete, and establishes the TC^0 complexity of the unary extended gcd problem, broadening understanding of their computational complexity.

Findings

Problems are TC^0-complete for finitely generated nilpotent groups.

Unary extended gcd problem is in TC^0.

Word problem and normal form computations are in uniform TC^0 with binary inputs.

Abstract

Recently, Macdonald et. al. showed that many algorithmic problems for finitely generated nilpotent groups including computation of normal forms, the subgroup membership problem, the conjugacy problem, and computation of subgroup presentations can be done in Logspace. Here we follow their approach and show that all these problems are complete for the uniform circuit class TC^0 - uniformly for all r-generated nilpotent groups of class at most c for fixed r and c. In order to solve these problems in TC^0, we show that the unary version of the extended gcd problem (compute greatest common divisors and express them as linear combinations) is in TC^0. Moreover, if we allow a certain binary representation of the inputs, then the word problem and computation of normal forms is still in uniform TC^0, while all the other problems we examine are shown to be TC^0-Turing reducible to the binary extended gcd problem.

Figures

Equations

$${\mathsf{AC}}^0⫋{\mathsf{TC}}^0\subseteq \mathsf{LOGSPACE}\subseteq \mathsf{P}.$$

$$\mathrm{Count}(u,j)=\mathrm{Maj}(u{0}^j{1}^{n-j})\wedge \left(\neg \mathrm{Maj}(u{0}^j{1}^{n-j})\right).$$

$$G=G_1\ge G_2\ge \cdots \ge G_c\ge G_{c+1}=1$$

$$A=(a_{11},a_{12},\dots ,a_{c{m}_c})$$

$$\mathcal{T}=\{i|e_i<\infty \}.$$

$$g=a_1^{{\alpha }_1}\cdots a_m^{{\alpha }_m},$$

$$a_i^{e_i}=a_{\ell }^{{\mu }_{i\ell }}\cdots a_m^{{\mu }_{im}}$$

$$\text{allowdisplaybreaks}{a}_j{a}_i$$

$$a_j^{-1}{a}_i$$

$$A=\left(\begin{array}[]{ccc}\alpha_{11}&\cdots&\alpha_{1m}\\ \vdots&\ddots&\vdots\\ \alpha_{n1}&\cdots&\alpha_{nm}\end{array}\right),$$

$$\mathcal{T}=\left\{{\pi }_i|i\in \left\{1,\dots ,s\right\}\right\}$$

$$a_k^x{a}_1^y=a_1^y{a}_k^x{a}_{k+1}^{p_{k,k+1}(x,y)}\cdots a_m^{p_{k,m}(x,y)}\text{ for all }x,y\in \mathbb{Z}.$$

$$u=a_2^{q_2(0,{\mu }_{12},\dots ,{\mu }_{1m},s)}\cdots a_m^{q_m(0,{\mu }_{12},\dots ,{\mu }_{1m},s)}$$

$$x_1{a}_1+\cdots +x_n{a}_n=\gcd (a_1,\dots ,a_n).$$

$$x_1{a}_1+\cdots +x_n{a}_n=\gcd (a_1,\dots ,a_n)$$

$$d_i=\gcd (a_1,\dots ,a_i)=\gcd (\gcd (a_1,\dots ,a_{i-1}),a_i)=\gcd (d_{i-1},a_i).$$

$$x_i=z_i\prod _{j=i+1}^n{y}_j.$$

$$x_1{a}_1+\cdots +x_n{a}_n=\gcd (a_1,\dots ,a_n).$$

$$p_i^{\prime }$$

$$P_n^{\prime }-N_n^{\prime }\le \left|\mathcal{N}\right|\text{ and }{N}_n^{\prime }-P_n^{\prime }\le \left|\mathcal{P}\right|$$

$$(P_n^{\prime }-N_n^{\prime })A^2$$

$$=x_1{a}_1+\cdots +x_n{a}_n+\left|\mathcal{N}\right|A^2=1+\left|\mathcal{N}\right|A^2$$

$$p_i$$

$$\begin{array}{rl}-A^2\le x_i{a}_i-p_i{A}^2\le A^2& \text{for }i\in \mathcal{P},\\ -A^2\le x_i{a}_i+n_i{A}^2\le A^2& \text{for }i\in \mathcal{N}.\end{array}$$

$$p_{j,i}=\{\begin{array}{ll}{p}_i& \text{if }{N}_{j-1}\le P_{i-1}<P_i\le N_j\\ N_j-P_{i-1}& \text{if }{N}_{j-1}\le P_{i-1}<N_j\le P_i\\ P_i-N_{j-1}& \text{if }{P}_{i-1}\le N_{j-1}<P_i\le N_j\\ n_j& \text{if }{P}_{i-1}\le N_{j-1}<N_j\le P_i\\ 0& \text{otherwise.}\end{array}$$

$${\alpha }_i$$

$$P_i-P_{i-1}=\sum _{j=0}^i{p}_i-\sum _{j=0}^{i-1}{p}_i=p_i\text{ and}$$

$$N_{{\beta }_i-1}-N_{{\alpha }_i}-\sum _{j={\alpha }_i+1}^{{\beta }_i-1}{n}_j=\sum _{j=1}^{{\beta }_i-1}{n}_j-\sum _{j=1}^{{\alpha }_i}{n}_j-\sum _{j={\alpha }_i+1}^{{\beta }_i-1}{n}_j=0,$$

$$\sum _j{p}_{j,i}$$

$$(p_{j,i}-1)A^2<y_{j,i}{a}_i{a}_j\le p_{j,i}{A}^2.$$

$${\tilde{x}}_i=\{\begin{array}{ll}{x}_i-{\sum }_j{y}_{j,i}{a}_j& \text{if }i\in \mathcal{P},\\ x_i+{\sum }_j{y}_{i,j}{a}_j& \text{if }i\in \mathcal{N},\\ x_i& \text{otherwise.}\end{array}$$

Full text

In order to solve these problems in $\mathsf{TC}^{0}$, we show that the unary version of the extended gcd problem (compute greatest common divisors and express them as linear combinations) is in $\mathsf{TC}^{0}$.

Moreover, if we allow a certain binary representation of the inputs, then the word problem and computation of normal forms is still in uniform $\mathsf{TC}^{0}$, while all the other problems we examine are shown to be $\mathsf{TC}^{0}$-Turing reducible to the binary extended gcd problem.

1. 1 Introduction

2. 2 Preliminaries

3. 2.1 Complexity

4. 2.2 Nilpotent groups and Mal’cev coordinates

5. 3 Presentation of subgroups

6. 3.1 Quotient presentations

7. 4 Word problem and computation of Mal’cev coordinates

8. 5 The extended gcd problem

9. 6 Matrix reduction and subgroup membership problem

10. 6.1 Subgroup membership problem

11. 6.2 Subgroup presentations

12. 7 More algorithmic problems

13. 7.1 Homorphisms and kernels

14. 7.2 Centralizers

15. 7.3 The conjugacy problem

16. 8 Computing quotient presentations

17. 9 Power problem and conjugacy in wreath products of nilpotent groups

18. 10 Conclusion and Open Problem

1 Introduction

The word problem (given a word over the generators, does it represent the identity?) is one of the fundamental algorithmic problems in group theory introduced by Dehn in 1911 [3]. While for general finitely presented groups all these problems are undecidable [23, 2], for many particular classes of groups decidability results have been established – not just for the word problem but also for a wide range of other problems. Finitely generated nilpotent groups are a class where many algorithmic problems are (efficiently) decidable (with some exceptions like the problem of solving equations – see e. g. [6]).

In 1958, Mal’cev [18] established decidability of the word and subgroup membership problem by investigating finite approximations of nilpotent groups. In 1965, Blackburn [1] showed decidability of the conjugacy problem. However, these methods did not allow any efficient (e. g. polynomial time) algorithms. Nevertheless, in 1966 Mostowski provided “practical” algorithms for the word problem and several other problems [20]. In terms of complexity, a major step was the result by Lipton and Zalcstein [15] that the word problem of linear groups is in $\mathsf{LOGSPACE}$. Together with the fact that finitely generated nilpotent groups are linear (see e. g. [7, 10]) this gives a $\mathsf{LOGSPACE}$ solution to the word problem of nilpotent groups, which was later improved to uniform $\mathsf{TC}^{0}$ by Robinson [24].

A typical algorithmic approach to nilpotent groups is using so-called Mal’cev (or Hall–Mal’cev) bases (see e. g. [7, 10]), which allow to carry out group operations by evaluating polynomials (see Lemma 2.3). This approach was systematically used in [11] and [20] or – in the more general setting of polycyclic presentations – in [25] for solving (among others) the subgroup membership and conjugacy problem of polycyclic groups. Recently in [21, 22] polynomial time bounds for the equalizer and subgroup membership problems in nilpotent groups have been given. Finally, in [16] the following problems were shown to be in $\mathsf{LOGSPACE}$ using the Mal’cev basis approach. Here, $\mathcal{N}_{c,r}$ denotes the class of nilpotent groups of nilpotency class at most $c$ generated by at most $r$ elements.

• •

The word problem: given $G\in\mathcal{N}_{c,r}$ and $g\in G$, is $g=1$ in $G$?

• •

Given $G\in\mathcal{N}_{c,r}$ and $g\in G$, compute the (Mal’cev) normal form of $g$.

• •

The subgroup membership problem: Given $G\in\mathcal{N}_{c,r}$ and $g,h_{1},\ldots,h_{n}\in G$, decide whether $g\in\langle h_{1},\ldots,h_{n}\rangle$ and, if so, express $g$ as a word over the subgroup generators $h_{1},\ldots,h_{n}$ (in [16] only the decision version was shown to be in $\mathsf{LOGSPACE}$ – for expressing $g$ as a word over the original subgroup generators a polynomial time bound was given).

• •

Given $G,H\in\mathcal{N}_{c,r}$ and $K=\langle g_{1},\ldots,g_{n}\rangle\leq G$, together with a homomorphism $\varphi:K\rightarrow H$ specified by $\varphi(g_{i})=h_{i}$, and some $h\in\mathrm{Im}(\varphi)$, compute a generating set for $\ker(\varphi)$ and find $g\in G$ such that $\varphi(g)=h$.

• •

Given $G\in\mathcal{N}_{c,r}$ and $K=\langle g_{1},\ldots,g_{n}\rangle\leq G$, compute a presentation for $K$.

• •

Given $G\in\mathcal{N}_{c,r}$ and $g\in G$, compute a generating set for the centralizer of $g$.

• •

The conjugacy problem: Given $G\in\mathcal{N}_{c,r}$ and $g,h\in G$, decide whether or not there exists $u\in G$ such that $u^{-1}gu=h$ and, if so, find such an element $u$.

These problems are not only of interest in themselves, but also might serve as building blocks for solving the same problems in polycyclic groups – which are of particular interest because of their possible application in non-commutative cryptography [4]. In this work we follow [16] and extend these results in several ways:

• •

We give a complexity bound of uniform $\mathsf{TC}^{0}$ for all the above problems.

• •

In order to derive this bound, we show that the extended gcd problem (given $a_{1},\dots,a_{n}\in\mathbb{Z}$, compute $x_{1},\dots,x_{n}\in\mathbb{Z}$ with $\gcd(a_{1},\dots,a_{n})=\sum_{i}a_{i}x_{i}$) with input and output in unary is in uniform $\mathsf{TC}^{0}$.

• •

Our description of circuits is for the uniform setting where $G\in\mathcal{N}_{c,r}$ is part of the input (in [16] the uniform setting is also considered; however, only in some short remarks).

• •

Since nilpotent groups have polynomial growth, it is natural to allow compressed inputs: we give a uniform $\mathsf{TC}^{0}$ solution for the word problem allowing words with binary exponents as input – this contrasts with the situation with straight-line programs (i. e., context-free grammars which produces precisely one word – another method of exponential compression) as input: then the word problem is hard for $\mathsf{C}_{=}\mathsf{L}$ [12]. Thus, the difficulty of the word problem with straight-line programs is not due to their compression but rather due to the difficulty of evaluating a straight-line program.

• •

We show that the other of the above problems are uniform-$\mathsf{TC}^{0}$-Turing-reducible to the (binary) extended gcd problem when the inputs (both the ambient group and the subgroup etc.) are given as words with binary exponents.

• •

We show how to solve the power problem in nilpotent groups. This allows us to apply a result from [19] in order to show that iterated wreath products of nilpotent groups have conjugacy problem in uniform $\mathsf{TC}^{0}$.

Thus, in the unary case we settle the complexity of the above problems completely. Moreover, it also seems rather difficult to solve the subgroup membership problem without computing gcds – in this case our results on binary inputs would be also optimal. Altogether, our results mean that many algorithmic problems are no more complicated in nilpotent groups than in abelian groups. Notice that while in [16] explicit length bounds on the outputs for all these problems are proven, we obtain polynomial length bounds simply by the fact that everything can be computed in uniform $\mathsf{TC}^{0}$ (for which in the following we only write $\mathsf{TC}^{0}$).

Throughout the paper we follow the outline of [16]. For a concise presentation, we copy many definitions from [16]. Most of our theorems involve two statements: one for unary encoded inputs and one for binary encoded inputs. In order to have a concise presentation, we always put them in one result. We only consider finitely generated nilpotent groups without mentioning that further.

Outline.

We start with basic definitions on complexity as well as on nilpotent groups. In Section 3 we describe how subgroups of nilpotent groups can be represented and develop a “nice” presentation for all groups in $\mathcal{N}_{c,r}$. Section 4 deals with the word problem and computation of normal forms. After that we solve the unary extended gcd problem in $\mathsf{TC}^{0}$ and introduce the so-called matrix reduction in order to solve the subgroup membership problem. In Section 7 we present our result for the remaining of the above problems, in Section 8 we explain how to compute “nice” presentations, and in Section 9 we apply the results of [19] in order to show that the conjugacy problem of iterated wreath products of nilpotent groups is in $\mathsf{TC}^{0}$. Finally, we conclude with some open questions.

2 Preliminaries

2.1 Complexity

For a finite alphabet $\Sigma$, the set of words over $\Sigma$ is denoted by $\Sigma^{*}$. Computation or decision problems are given by functions $f:\Delta^{*}\to\Sigma^{*}$ for some finite alphabets $\Delta$ and $\Sigma$. A decision problem ($=$ formal language) $L$ is identified with its characteristic function $\chi_{L}:\Delta^{*}\to\left\{\mathinner{0,1}\right\}$ with $\chi_{L}(x)=1$ if, and only if, $x\in L$. (In particular, the word and conjugacy problems can be seen as functions $\Sigma^{*}\to\left\{\mathinner{0,1}\right\}$.) We use circuit complexity as described in [26].

Circuit Classes.

The class $\mathsf{TC}^{0}$ is defined as the class of functions computed by families of circuits of constant depth and polynomial size with unbounded fan-in Boolean gates (and, or, not) and majority gates. A majority gate (denoted by $\mathrm{Maj}$) returns $1$ if the number of $1$s in its input is greater or equal to the number of [math]s. In the following we always assume that the alphabets $\Delta$ and $\Sigma$ are encoded over the binary alphabet $\left\{\mathinner{0,1}\right\}$ such that each letter uses the same number of bits. We say a function $f$ is $\mathsf{TC}^{0}$-computable if $f\in\mathsf{TC}^{0}$.

In the following, we only consider $\mathsf{Dlogtime}$-uniform circuit families and we simply write $\mathsf{TC}^{0}$ as shorthand for $\mathsf{Dlogtime}$-uniform $\mathsf{TC}^{0}$. $\mathsf{Dlogtime}$-uniform means that there is a deterministic Turing machine which decides in time $\mathcal{O}(\log n)$ on input of two gate numbers (given in binary) and the string $1^{n}$ whether there is a wire between the two gates in the $n$-input circuit and also computes of which type some gates is. Note that the binary encoding of the gate numbers requires only $\mathcal{O}(\log n)$ bits – thus, the Turing machine is allowed to use time linear in the length of the encodings of the gates. For more details on these definitions we refer to [26].

We have the following inclusions (note that even $\mathsf{TC}^{0}\subseteq\mathsf{P}$ is not known to be strict):

[TABLE]

Reductions.

A function $f$ is $\mathsf{TC}^{0}$-Turing-reducible to a function $g$ if there is a $\mathsf{Dlogtime}$-uniform family of $\mathsf{TC}^{0}$ circuits computing $f$ which, in addition to the Boolean and majority gates, also may use oracle gates for $g$ (i. e., gates which on input $x$ output $g(x)$). This is expressed by $f\in\mathsf{TC}^{0}(g)$. Note that if $f_{1},\dots,f_{k}$ are in $\mathsf{TC}^{0}$, then $\mathsf{TC}^{0}(f_{1},\dots,f_{k})=\mathsf{TC}^{0}$.

In particular, if $f$ and $g$ are $\mathsf{TC}^{0}$-computable functions, then also the composition $g\circ f$ is $\mathsf{TC}^{0}$-computable. We will extensively make use of this observation – which will also guarantee the polynomial size bound on the outputs of our circuits without additional calculations.

We will also use another fact frequently without giving further reference: on input of two alphabets $\Sigma$ and $\Delta$ (coded over the binary alphabet), a list of pairs $(a,v_{a})$ with $a\in\Sigma$ and $v_{a}\in\Delta^{*}$ such that each $a\in\Sigma$ occurs in precisely one pair, and a word $w\in\Sigma^{*}$, the image $\varphi(w)$ under the homomorphism $\varphi$ defined by $\varphi(a)=v_{a}$ can be computed in $\mathsf{TC}^{0}$ [13].

Encoding numbers: unary vs. binary.

There are essentially two ways of representing integer numbers: the usual way as a binary number where a string $a_{0}\cdots a_{n}$ with $a_{i}\in\left\{\mathinner{0,1}\right\}$ represents $\sum a_{i}2^{n-i}$, and as a unary number where $k\in\mathbb{N}$ is represented by $1^{k}=\smash{\underbrace{11\cdots 1}_{k}}$ (respectively by $0^{n-k}1^{k}$ if $n$ is the number of input bits).

We will state most results in this paper with both representations. The unary representation corresponds to group elements given as words over the generators, whereas the binary encoding will be used if inputs are given in a compressed form.

Example 2.1*.*

The following problem $\mathrm{Count}$ is in $\mathsf{TC}^{0}$: given a bit-string $u$ of length $n$ and a number $j<n$ (we assume that it is given in unary as $0^{n-j}1^{j}$), decide whether the number of ones $\left|\mathinner{u}\right|_{1}$ in $u$ is exactly $j$. We have $\left|\mathinner{u}\right|_{1}\geq j$ if, and only if, $\left|\mathinner{u0^{j}1^{n-j}}\right|_{1}\geq n$. Thus,

[TABLE]

In particular, the word problem of $\mathbb{Z}$ when $1$ is encoded as $1$ and $-1$ as [math], which is simply the question whether $\left|\mathinner{u}\right|_{1}=n/2$ and $n$ even, is in $\mathsf{TC}^{0}$.

Arithmetic in $\mathsf{TC}^{0}$.

Iterated Addition (resp. Iterated Multiplication) are the following computation problems: On input of $n$ binary integers $a_{1},\dots,a_{n}$ each having $n$ bits (i. e., the input length is $N=n^{2}$), compute the binary representation of the sum $\sum_{i=1}^{n}a_{i}$ (resp. product $\prod_{i=1}^{n}a_{i}$). For Integer Division the input are two binary $n$-bit integers $a,b$; the binary representation of the integer $c=\left\lfloor\mathinner{a/b}\right\rfloor$ has to be computed. The first statement of Theorem 2.2 is a standard fact, see [26]; the other statements are due to Hesse, [8, 9].

Theorem 2.2* ([8, 9, 26]).*

The problems Iterated Addition, Iterated Multiplication, Integer Division are all in $\mathsf{TC}^{0}$ no matter whether inputs are given in unary or binary.

Note that if the numbers $a$ and $b$ are encoded in unary (as strings $1^{a}$ and $1^{b}$), division can be seen to be in $\mathsf{TC}^{0}$ very easily: just try for all $0\leq c\leq a$ whether $0\leq a-bc<b$.

Representing groups for algorithmic problems.

We consider finitely generated groups $G$ together with finite generating sets $A$. Group elements are represented as words over the generators and their inverses (i. e., as elements of $(A\cup A^{-1})^{*}$). We make no distinction between words and the group elements they represent. Whenever it might be unclear whether we mean equality of words or of group elements, we write “$g=h$ in $G$” for equality in $G$.

Words over the generators $\pm 1$ of $\mathbb{Z}$ correspond to unary representation of integers. As a generalization of binary encoded integers, we introduce the following notion: a word with binary exponents is a sequence $w_{1},\dots,w_{n}$ where the $w_{i}$ are from a fixed generating set of the group together with a sequence of exponents $x_{1},\dots,x_{n}$ where the $x_{i}\in\mathbb{Z}$ are encoded in binary. The word with binary exponents represents the word (or group element) $w=w_{1}^{x_{1}}\cdots w_{n}^{x_{n}}$. Note that in a fixed nilpotent group every word of length $n$ can be rewritten as a word with binary exponents using $\mathcal{O}(\log n)$ bits (this fact is well-known and also a consequence of Theorem 4.1 below); thus, words with binary exponents are a natural way of representing inputs for algorithmic problems in nilpotent groups.

2.2 Nilpotent groups and Mal’cev coordinates

Let $G$ be a group. For $x,y\in G$ we write $x^{y}=y^{-1}xy$ ($x$ conjugated by $y$) and $[x,y]=x^{-1}y^{-1}xy$ (commutator of $x$ and $y$). For subgroups $H_{1},H_{2}\leq G$, we have $[H_{1},H_{2}]=\left<\mathinner{\left\{[h_{1},h_{2}]\;\middle|\;h_{1}\in H_{1},h_{2}\in H_{2}\right\}}\right>$. A group $G$ is called nilpotent if it has central series, i.e.

[TABLE]

such that $[G,G_{i}]\leq G_{i+1}$ for all $i=1,\ldots,c$. If $G$ is finitely generated, so are the abelian quotients $G_{i}/G_{i+1}$, $1\leq i\leq c$. Let $a_{i1},\ldots,a_{im_{i}}$ be a basis of $G_{i}/G_{i+1}$, i.e. a generating set such that $G_{i}/G_{i+1}$ has a presentation $\left<\,\mathinner{a_{i1},\ldots,a_{im_{i}}}\;\middle|\;\mathinner{\!a_{ij}^{e_{ij}},\>\![a_{ik},a_{i\ell}],\text{ for }j\in\mathcal{T}_{i},\,k,\ell\in\{1,\ldots,m_{i}\}\!}\,\right>$, where $\mathcal{T}_{i}\subseteq\{1,\ldots,m_{i}\}$ (here $\mathcal{T}$ stands for torsion) and $e_{ij}\in\mathbb{Z}_{>0}$ (be aware that we explicitly allow $e_{ij}=1$, which is necessary for our definition of quotient presentations in Section 3). Formally put $e_{ij}=\infty$ for $j\notin\mathcal{T}_{i}$. Note that

[TABLE]

is a so-called polycyclic generating sequence for $G$, and we call $A$ a Mal’cev basis associated to the central series (1). Sometimes we use $A$ interchangeably also for the set $A=\left\{\mathinner{a_{11},a_{12},\ldots,a_{cm_{c}}}\right\}$.

For convenience, we will also use a simplified notation, in which the generators $a_{ij}$ and exponents $e_{ij}$ are renumbered by replacing each subscript $ij$ with $j+\sum\limits_{\ell<j}m_{\ell}$, so the generating sequence $A$ can be written as $A=(a_{1},\ldots,a_{m})$. We allow the expression $ij$ to stand for $j+\sum\limits_{\ell<j}m_{\ell}$ in other notations as well. We also denote

[TABLE]

By the choice of $\{a_{1},\ldots,a_{m}\}$, every element $g\in G$ may be written uniquely in the form

[TABLE]

where $\alpha_{i}\in\mathbb{Z}$ and $0\leq\alpha_{i}<e_{i}$ whenever $i\in\mathcal{T}$. The $m$-tuple $(\alpha_{1},\ldots,\alpha_{m})$ is called the coordinate vector or Mal’cev coordinates of $g$ and is denoted $\mathrm{Coord}({g})$, and the expression $a_{1}^{\alpha_{1}}\cdots a_{m}^{\alpha_{m}}$ is called the (Mal’cev) normal form of $g$. We also denote $\alpha_{i}=\mathrm{Coord}_{{i}}({g})$.

To a Mal’cev basis $A$ we associate a presentation of $G$ as follows. For each $1\leq i\leq m$, let $n_{i}$ be such that $a_{i}\in G_{n_{i}}\mathbin{\mathchoice{\raisebox{0.8pt}{\hbox{ \leavevmode\hbox to4.1pt{\vbox to5.8pt{\pgfpicture\makeatletter\hbox{\hskip 0.3pt\lower-0.3pt\hbox to0.0pt{\pgfsys@beginscope\pgfsys@invoke{ }\definecolor{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@rgb@stroke{0}{0}{0}\pgfsys@invoke{ }\pgfsys@color@rgb@fill{0}{0}{0}\pgfsys@invoke{ }\pgfsys@setlinewidth{0.4pt}\pgfsys@invoke{ }\nullfont\hbox to0.0pt{\pgfsys@beginscope\pgfsys@invoke{ }{{}{{}}{} {{}{}}{}\pgfsys@beginscope\pgfsys@invoke{ }\pgfsys@setlinewidth{0.6pt}\pgfsys@invoke{ }\pgfsys@roundcap\pgfsys@invoke{ }{}\pgfsys@moveto{3.5pt}{0.0pt}\pgfsys@lineto{0.0pt}{5.2pt}\pgfsys@stroke\pgfsys@invoke{ } \pgfsys@invoke{\lxSVG@closescope }\pgfsys@endscope} \pgfsys@invoke{\lxSVG@closescope }\pgfsys@endscope{}{}{}\hss}\pgfsys@discardpath\pgfsys@invoke{\lxSVG@closescope }\pgfsys@endscope\hss}}\lxSVG@closescope\endpgfpicture}}}}}{\raisebox{0.8pt}{\hbox{ \leavevmode\hbox to4.1pt{\vbox to5.8pt{\pgfpicture\makeatletter\hbox{\hskip 0.3pt\lower-0.3pt\hbox to0.0pt{\pgfsys@beginscope\pgfsys@invoke{ }\definecolor{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@rgb@stroke{0}{0}{0}\pgfsys@invoke{ }\pgfsys@color@rgb@fill{0}{0}{0}\pgfsys@invoke{ }\pgfsys@setlinewidth{0.4pt}\pgfsys@invoke{ }\nullfont\hbox to0.0pt{\pgfsys@beginscope\pgfsys@invoke{ }{{}{{}}{} {{}{}}{}\pgfsys@beginscope\pgfsys@invoke{ }\pgfsys@setlinewidth{0.6pt}\pgfsys@invoke{ }\pgfsys@roundcap\pgfsys@invoke{ }{}\pgfsys@moveto{3.5pt}{0.0pt}\pgfsys@lineto{0.0pt}{5.2pt}\pgfsys@stroke\pgfsys@invoke{ } \pgfsys@invoke{\lxSVG@closescope }\pgfsys@endscope} \pgfsys@invoke{\lxSVG@closescope }\pgfsys@endscope{}{}{}\hss}\pgfsys@discardpath\pgfsys@invoke{\lxSVG@closescope }\pgfsys@endscope\hss}}\lxSVG@closescope\endpgfpicture}}}}}{\raisebox{0.5pt}{\hbox{ \leavevmode\hbox to2.65pt{\vbox to4.25pt{\pgfpicture\makeatletter\hbox{\hskip 0.22499pt\lower-0.22499pt\hbox to0.0pt{\pgfsys@beginscope\pgfsys@invoke{ }\definecolor{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@rgb@stroke{0}{0}{0}\pgfsys@invoke{ }\pgfsys@color@rgb@fill{0}{0}{0}\pgfsys@invoke{ }\pgfsys@setlinewidth{0.4pt}\pgfsys@invoke{ }\nullfont\hbox to0.0pt{\pgfsys@beginscope\pgfsys@invoke{ }{{{}{}}{{}}{} {{}{}}{}\pgfsys@beginscope\pgfsys@invoke{ }\pgfsys@setlinewidth{0.45pt}\pgfsys@invoke{ }\pgfsys@roundcap\pgfsys@invoke{ }{}\pgfsys@moveto{2.2pt}{0.0pt}\pgfsys@lineto{0.0pt}{3.8pt}\pgfsys@stroke\pgfsys@invoke{ } \pgfsys@invoke{\lxSVG@closescope }\pgfsys@endscope} \pgfsys@invoke{\lxSVG@closescope }\pgfsys@endscope{}{}{}\hss}\pgfsys@discardpath\pgfsys@invoke{\lxSVG@closescope }\pgfsys@endscope\hss}}\lxSVG@closescope\endpgfpicture}}}}}{\raisebox{0.35pt}{\hbox{ \leavevmode\hbox to1.9pt{\vbox to3.2pt{\pgfpicture\makeatletter\hbox{\hskip 0.2pt\lower-0.2pt\hbox to0.0pt{\pgfsys@beginscope\pgfsys@invoke{ }\definecolor{pgfstrokecolor}{rgb}{0,0,0}\pgfsys@color@rgb@stroke{0}{0}{0}\pgfsys@invoke{ }\pgfsys@color@rgb@fill{0}{0}{0}\pgfsys@invoke{ }\pgfsys@setlinewidth{0.4pt}\pgfsys@invoke{ }\nullfont\hbox to0.0pt{\pgfsys@beginscope\pgfsys@invoke{ }{{{}{}}{{}}{} {{}{}}{}\pgfsys@beginscope\pgfsys@invoke{ }\pgfsys@setlinewidth{0.4pt}\pgfsys@invoke{ }\pgfsys@roundcap\pgfsys@invoke{ }{}\pgfsys@moveto{1.5pt}{0.0pt}\pgfsys@lineto{0.0pt}{2.8pt}\pgfsys@stroke\pgfsys@invoke{ } \pgfsys@invoke{\lxSVG@closescope }\pgfsys@endscope} \pgfsys@invoke{\lxSVG@closescope }\pgfsys@endscope{}{}{}\hss}\pgfsys@discardpath\pgfsys@invoke{\lxSVG@closescope }\pgfsys@endscope\hss}}\lxSVG@closescope\endpgfpicture}}}}}}G_{n_{i}+1}$. If $i\in\mathcal{T}$, then $a_{i}^{e_{i}}\in G_{n_{i}+1}$, hence a relation

[TABLE]

holds in $G$ for $\mu_{ij}\in\mathbb{Z}$ and $\ell>i$ such that $a_{\ell},\ldots,a_{m}\in G_{n_{i}+1}$. Let $1\leq i<j\leq m$. Since the series (1) is central, relations of the form

[TABLE]

hold in $G$ for $\alpha_{ijk},\beta_{ijk}\in\mathbb{Z}$ and $l>j$ such that $a_{\ell},\ldots,a_{m}\in G_{n_{j}+1}$. Now, $G$ is the group with generators $\{a_{1},\ldots,a_{m}\}$ subject to the relation of the the form (2)–(4).

A presentation with relations of the form (2)–(4) for all $i$ resp. $i$ and $j$ is called a nilpotent presentation. Indeed, any presentation of this form will define a nilpotent group. It is called consistent if the order of $a_{i}$ modulo $\left<\mathinner{a_{i+1},\ldots,a_{m}}\right>$ is precisely $e_{i}$ for all $i$. While presentations of this form need not, in general, be consistent, those derived from a central series of a group $G$ as above are consistent.

Given a consistent nilpotent presentation, there is an easy way to solve the word problem: simply apply the rules of the form (3) and (4) to move all occurrences of $a_{1}^{\pm 1}$ in the input word to the left, then apply the power relations (2) to reduce their number modulo $e_{1}$; finally, continue with $a_{2}$ and so on.

Multiplication functions.

An crucial feature of the coordinate vectors for nilpotent groups is that the coordinates of a product $(a_{1}^{\alpha_{1}}\cdots a_{m}^{\alpha_{m}})(a_{1}^{\beta_{1}}\cdots a_{m}^{\beta_{m}})$ may be computed as a “nice” function (polynomial if $\mathcal{T}=\emptyset$) of the integers $\alpha_{1},\ldots,\alpha_{m},\beta_{1},\ldots,\beta_{m}$.

Lemma 2.3* ([7, 10]).*

Let $G$ be a nilpotent group with Mal’cev basis $a_{1},\ldots,a_{m}$ and $\mathcal{T}=\emptyset$. There exist $p_{1},\ldots,p_{m}\in\mathbb{Z}[x_{1},\dots,x_{m},y_{1},\dots,y_{m}]$ and $q_{1},\ldots,q_{m}\in\mathbb{Z}[x_{1},\dots,x_{m},z]$ such that for $g,h\in G$ with $\mathrm{Coord}({g})=(\gamma_{1},\ldots,\gamma_{m})$ and $\mathrm{Coord}({h})=(\delta_{1},\ldots,\delta_{m})$ and $l\in\mathbb{Z}$ we have

1. (i)

$\mathrm{Coord}_{{i}}({gh})=p_{i}(\gamma_{1},\ldots,\gamma_{m},\delta_{1},\ldots,\delta_{m})$, 2. (ii)

$\mathrm{Coord}_{{i}}({g^{l}})=q_{i}(\gamma_{1},\ldots,\gamma_{m},l)$, 3. (iii)

$\mathrm{Coord}_{{1}}({gh})=\gamma_{1}+\delta_{1}$ and $\mathrm{Coord}_{{1}}({g^{l}})=l\gamma_{1}$.

Notice that an explicit algorithm to construct the polynomials $p_{i},q_{i}$ is given in [14]. For further background on nilpotent groups we refer to [7, 10].

3 Presentation of subgroups

Before we start with algorithmic problems, we introduce a canonical way how to represent subgroups of nilpotent groups. This is important for two reasons: first, of course we need it to solve the subgroup membership problem, and, second, for the uniform setting it allows us to represent nilpotent groups as free nilpotent group modulo a kernel which is represented as a subgroup. Let $h_{1},\ldots,h_{n}$ be elements of $G$ given in normal form by $h_{i}=a_{1}^{\alpha_{i1}}\cdots a_{m}^{\alpha_{im}}$, for $i=1,\ldots,n$, and let $H=\left<\mathinner{h_{1},\ldots,h_{n}}\right>$. We associate the matrix of coordinates

[TABLE]

to the tuple $(h_{1},\ldots,h_{n})$ and conversely, to any $n\times m$ integer matrix, we associate an $n$-tuple of elements of $G$, whose Mal’cev coordinates are given as the rows of the matrix, and the subgroup $H$ generated by the tuple. For each $i=1,\ldots,n$ where row $i$ is non-zero, let $\pi_{{i}}$ be the column of the first non-zero entry (‘pivot’) in row $i$. The sequence $(h_{1},\ldots,h_{n})$ is said to be in standard form if the matrix of coordinates $A$ is in row-echelon form and its pivot columns are maximally reduced (similar to the Hermite normal form), more specifically, if $A$ satisfies the following properties:

1. (i)

all rows of $A$ are non-zero (i.e. no $h_{i}$ is trivial), 2. (ii)

$\pi_{{1}}<\pi_{{2}}<\cdots<\pi_{{s}}$ (where $s$ is the number of pivots), 3. (iii)

$\alpha_{i\pi_{{i}}}>0$, for all $i=1,\ldots,n$, 4. (iv)

$0\leq\alpha_{k\pi_{{i}}}<\alpha_{i\pi_{{i}}}$, for all $1\leq k<i\leq s$ 5. (v)

if $\pi_{{i}}\in\mathcal{T}$, then $\alpha_{i\pi_{{i}}}$ divides $e_{\pi_{{i}}}$, for $i=1,\ldots,s$.

The sequence (resp. matrix) is called full if in addition

1. (vi)

$H\cap\left<\mathinner{a_{i},a_{i+1},\ldots,a_{m}}\right>$ is generated by $\{h_{j}\mid\pi_{j}\geq i\}$, for all $1\leq i\leq m$.

Note that $\{h_{j}\mid\pi_{j}\geq i\}$ consists of those elements having 0 in their first $i-1$ coordinates. It is an easy exercise (see also [16]) to show that (vi) holds for a given $i$ if, and only if,

• •

for all $1\leq k<j\leq s$ with $\pi_{{k}}<i$, $h_{k}^{-1}h_{j}h_{k}$ and $h_{k}h_{j}h_{k}^{-1}$ are elements of $\left<\,\mathinner{h_{l}}\;\middle|\;\mathinner{l>k}\,\right>$, and

• •

for all $1\leq k\leq s$ with $\pi_{{k}}<i$ and $\pi_{{k}}\in\mathcal{T}$, $h_{k}^{e_{\pi_{{k}}}/\alpha_{k\pi_{{k}}}}\in\left<\,\mathinner{h_{l}}\;\middle|\;\mathinner{l>k}\,\right>$.

We will use full sequences and the associated matrices in full form interchangeably without mentioning it explicitly. For simplicity we assume that the inputs of algorithms are given as matrices. The importance of full sequences is described in the following lemma – a proof can be found in [25] Propositions 9.5.2 and 9.5.3.

Lemma 3.1* ([16, Lem. 3.1]).*

Let $H\leq G$. There is a unique full sequence $U=(h_{1},\ldots,h_{s})$ that generates $H$. We have $s\leq m$ and H=\{h_{1}^{\beta_{1}}\cdots h_{s}^{\beta_{s}}\,|\,\beta_{i}\in\mathbb{Z}\mbox{ and 0\leq\beta_{i}<e_{\pi_{{i}}}$if$\pi_{{i}}\in\mathcal{T}}\}.

Thus, computing a full sequence will be the essential tool for solving the subgroup membership problem. Before we focus on subgroup membership, we will first solve the word problem and introduce how the nilpotent group can be part of the input.

3.1 Quotient presentations

Let $c,r\in\mathbb{N}$ be fixed. The free nilpotent group $F_{c,r}$ of class $c$ and rank $r$ is defined as $F_{c,r}=\left<\,\mathinner{a_{1},\dots,a_{r}}\;\middle|\;\mathinner{[x_{1},\dots,x_{c+1}]=1\text{ for }x_{1},\dots,x_{c+1}\in F_{c,r}}\,\right>$ where $[x_{1},\dots,x_{c+1}]=[[x_{1},\dots,x_{c}],x_{c+1}]$, i. e., $F_{c,r}$ is the $r$-generated group only subject to the relations that weight $c+1$ commutators are trivial. Throughout, we fix a Mal’cev basis $A=(a_{1},\dots,a_{m})$ (which we call the standard Mal’cev basis) associated to the lower central series of $F_{c,r}$ such that the associated nilpotent presentation consists only of relations of the form (3) and (4) (i. e., $\mathcal{T}=\emptyset$ – such a presentation exists since $F_{c,r}$ is torsion-free), $a_{1},\dots,a_{r}$ generates $F_{c,r}$, and all other Mal’cev generators are iterated commutators of $a_{1},\dots,a_{r}$.

Denote by $\mathcal{N}_{c,r}$ the set of $r$-generated nilpotent groups of class at most $c$. Every group $G\in\mathcal{N}_{c,r}$ is a quotient of the free nilpotent group $F_{c,r}$, i. e., $G=F_{c,r}/N$ for some normal subgroup $N\leq F_{c,r}$. Assume that $T=(h_{1},\ldots,h_{s})$ is a full sequence generating $N$. Adding $T$ to the set of relators of the free nilpotent group yields a new nilpotent presentation. This presentation will be called quotient presentation of $G$. For inputs of algorithms, we assume that a quotient presentation is always given as its matrix of coordinates in full form. Depending whether the entries of the matrix are encoded in unary or binary, we call the quotient presentation be given in unary or binary.

Lemma 3.2* ([16, Prop. 5.1]).*

Let $c$ and $r$ be fixed integers and let $A=(a_{1},\dots,a_{m})$ be the standard Mal’cev basis of $F_{c,r}$. Moreover, denote by $S$ the set of relators of $F_{c,r}$ with respect to $A$. Let $G\in\mathcal{N}_{c,r}$ with $G=F_{c,r}/N$ and let $T$ be the full-form sequence for the subgroup $N$ of $F_{c,r}$. Then, $\left<\,\mathinner{A}\;\middle|\;\mathinner{S\cup T}\,\right>$ is a consistent nilpotent presentation of $G$.

Proof 3.3*.*

Clearly, we have $G\simeq\langle A\mid S\cup T\rangle$. Since $\langle A\mid S\rangle$ is a nilpotent presentation and the elements of $T$ add relators of the form (2), the presentation is nilpotent. To prove that it is consistent, suppose some $a_{i}\in A$ has order $\alpha_{i}$ modulo $\langle a_{i+1},\ldots,a_{m}\rangle$ in $\langle A\mid S\cup T\rangle$. Since the order is infinite in $F$, there must be element of the form $a_{i}^{\alpha_{i}}a_{i+1}^{\alpha_{i+1}}\cdots a_{m}^{\alpha_{m}}$ in $N$. But then, by Lemma 3.1, $T$ must contain an element $a_{i}^{\alpha^{\prime}_{i}}a_{i+1}^{\alpha^{\prime}_{i+1}}\cdots a_{m}^{\alpha^{\prime}_{m}}$ where $\alpha^{\prime}_{i}$ divides $\alpha_{i}$. Hence $\alpha_{i}$ cannot be smaller than $\alpha^{\prime}_{i}$ and so the presentation is consistent.

For the following we always assume that a quotient presentation is part of the input, but $c$ and $r$ are fixed. Later, we will show how to compute quotient presentations from an arbitrary presentation.

Remark 3.4*.*

Lemma 3.2 ensures that each group element has a unique normal form with respect to the quotient presentation; thus, it guarantees that all our manipulations of Mal’cev coordinates are well-defined.

4 Word problem and computation of Mal’cev coordinates

In this section we deal with the word problem of nilpotent groups, which is well-known to be in $\mathsf{TC}^{0}$ [24]. Here, we generalize this result by allowing words with binary exponents (recall that word with binary exponents is a sequence $w=w_{1}^{x_{1}}\cdots w_{n}^{x_{n}}$ where $w_{i}\in\left\{\mathinner{a_{1},\dots,a_{m}}\right\}$ and the $x_{i}\in\mathbb{Z}$). By using words with binary exponents the input can be compressed exponentially – making the word problem, a priori, harder to solve. Nevertheless, it turns out that the word problem still can be solved in $\mathsf{TC}^{0}$ when allowing the input to be given as a word with binary exponents. Note that this contrasts with the situation where the input is given as straight-line program (which like words with binary exponents allow an exponential compression) – then the word problem is complete for the counting class $\mathsf{C}_{=}\mathsf{L}$ [12].

Theorem 4.1*.*

Let $c,r\geq 1$ be fixed and let $(a_{1},\dots,a_{m})$ be the standard Mal’cev basis of $F_{c,r}$. The following problem is $\mathsf{TC}^{0}$-complete: on input of

• •

$G\in\mathcal{N}_{c,r}$ given as a binary encoded quotient presentation and

• •

a word with binary exponents $w=w_{1}^{x_{1}}\cdots w_{n}^{x_{n}}$,

compute integers $y_{1},\dots,y_{m}$ (in binary) such that $w=a_{1}^{y_{1}}\cdots a_{m}^{y_{m}}$ in $G$ and $0\leq y_{i}<e_{i}$ for $i\in\mathcal{T}$. Moreover, if the input is given in unary (both $G$ and $w$), then the output is in unary.

Note that the statement for unary inputs is essentially the one of [24]. Be aware that in the formulation of the theorem, $\mathcal{T}$ and $e_{i}$ for $i\in\mathcal{T}$ depend on the input group $G$. These parameters can be read from the full matrix $(\alpha_{ij})_{i,j}$ of coordinates representing $G$ (recall that $\pi_{i}$ denotes the column index of the $i$-th pivot and here $s$ is the number of rows of the matrix):

[TABLE]

(all columns which have a pivot) and $e_{i}=\alpha_{ji}$ if $\pi_{j}=i$. As an immediate consequence of Theorem 4.1, we obtain:

Corollary 4.2*.*

Let $c,r\geq 1$ be fixed. The uniform, binary version of the word problem for groups in $\mathcal{N}_{c,r}$ is $\mathsf{TC}^{0}$-complete (where the input is given as in Theorem 4.1).

The proof of Theorem 4.1 follows the outline given in Section 2.2; however, we cannot apply the rules (2)–(4) one by one. Instead we make only two steps for each generator: first apply all possible rules (3) and (4) in one step and then apply the rules (2) in one step.

Proof 4.3* (Proof of Theorem 4.1).*

The hardness part is clear since already the word problem of $\mathbb{Z}$ is $\mathsf{TC}^{0}$-complete. For describing a $\mathsf{TC}^{0}$ circuit, we proceed by induction along the standard Mal’cev basis $(a_{1},\dots,a_{m})$ of the free nilpotent group $F_{c,r}$. If $w$ does not contain any letter $a_{1}$, we have $y_{1}=0$ and we can compute $y_{i}$ for $i>1$ by induction.

Otherwise, we rewrite $w$ as $a_{1}^{y_{1}}uv$ (with $0\leq y_{1}<e_{1}$ if $1\in\mathcal{T}$) such that $u$ and $v$ are words with binary exponents not containing any $a_{1}$s. Once this is completed, $uv$ can be rewritten as $a_{2}^{y_{2}}\cdots a_{m}^{y_{m}}$ by induction. For computing $y_{1}$, $u$ and $v$, we proceed in two steps:

First, we rewrite $w$ as $a_{1}^{\tilde{y}_{1}}v$ with $\tilde{y}_{1}=\sum_{w_{i}=a_{1}}x_{i}$ (this is possible by Lemma 2.3 (iii)). The exponent $\tilde{y}_{1}$ can be computed by iterated addition, which by Theorem 2.2 is in $\mathsf{TC}^{0}$ (in the unary case $\tilde{y}_{1}$ can be written down in unary). Now, $v$ consists of what remains from $w$ after $a_{1}$ has been “eliminated”: for every position $i$ in $w$ with $w_{i}\neq a_{1}$, we compute $z_{i}=\sum_{\stackrel{{\scriptstyle j>i}}{{w_{j}=a_{1}}}}x_{j}$ using iterated addition. Let $w_{i}=a_{k}$. By Lemma 2.3 (i) there are fixed polynomials $p_{k,k+1},\dots,p_{k,m}\in\mathbb{Z}[x,y]$ such that in the free nilpotent group holds

[TABLE]

Hence, in order to obtain $\tilde{w}$, it remains to replace every $w_{i}^{x_{i}}$ with $w_{i}=a_{1}$ by the empty word and every $w_{i}^{x_{i}}$ with $w_{i}=a_{k}\neq a_{1}$ by $a_{k}^{x_{i}}a_{k+1}^{p_{k,k+1}(x_{i},z_{i})}\cdots a_{m}^{p_{k,m}(x_{i},z_{i})}$, which is a word with binary exponents (resp. as a word of polynomial length in the unary case), for $k=2,\dots,m$. The exponents can be computed in $\mathsf{TC}^{0}$ by Theorem 2.2. Since the $p_{k,i}$ are bounded by polynomials, in the unary case, $a_{k}^{x_{i}}a_{k+1}^{p_{k,k+1}(x_{i},z_{i})}\cdots a_{m}^{p_{k,m}(x_{i},z_{i})}$ can be written as a word without exponents.

The second step is only applied if $1\in\mathcal{T}$ (as explained above, this can be decided and $e_{i}$ can be read directly from the quotient presentation by checking whether there is a pivot in the first column) – otherwise $y_{1}=\tilde{y}_{1}$ and $u$ is the empty word. We rewrite $a_{1}^{\tilde{y}_{1}}$ to $a_{1}^{y_{1}}u$ with $y_{1}=\tilde{y}_{1}\bmod e_{1}$ and a word with binary exponents $u$ not containing any $a_{1}$. Again $y_{1}$ can be computed in $\mathsf{TC}^{0}$ by Theorem 2.2. Let $a_{1}^{e_{1}}=a_{2}^{\mu_{12}}\cdots a_{m}^{\mu_{1m}}$ be the power relation for $a_{1}$ (which can be read from the quotient presentation – it is just the row where the pivot is in the first column) and write $\tilde{y}_{1}=s\cdot e_{1}+y_{1}$. Now, $u$ should be equal to $(a_{2}^{\mu_{12}}\cdots a_{m}^{\mu_{1m}})^{s}$ in $F_{c,r}$. We use the fixed polynomials $q_{i}\in\mathbb{Z}[x_{1},\dots,x_{m},z]$ from Lemma 2.3 (ii) for $F_{c,r}$ yielding

[TABLE]

(which, in the binary setting, is a word with binary exponents, and in the unary setting a word without exponents of polynomial length). Now, we have $w=a_{1}^{y_{1}}uv$ in $G$ as desired.

5 The extended gcd problem

Computing greatest common divisors and expressing them as a linear combination is an essential step for solving the subgroup membership problem. Indeed, consider the nilpotent group $\mathbb{Z}$ and let $a,b,c\in\mathbb{Z}$. Then $c\in\left<\mathinner{a,b}\right>$ if, and only if, $\gcd(a,b)\mid c$.

Binary gcds.

The (binary) extended gcd problem (ExtGCD) is as follows: on input of binary encoded numbers $a_{1},\dots,a_{n}\in\mathbb{Z}$, compute $x_{1},\dots,x_{n}\in\mathbb{Z}$ such that

[TABLE]

Clearly this can be done in $\mathsf{P}$ using the Euclidean algorithm, but it is not known whether it is actually in $\mathsf{NC}$. Since we need to compute greatest common divisors, we will reduce the subgroup membership problem to the computation of gcds.

Unary gcds.

Computing the $\gcd$ of numbers encoded in unary is straightforward in $\mathsf{TC}^{0}$ by an exhaustive search; yet, it is not obvious how to express $\gcd(a_{1},\dots,a_{n})$ as $x_{1}a_{1}+\dots+x_{n}a_{n}$ in $\mathsf{TC}^{0}$. By [17] such $x_{i}$ with $|x_{i}|\leq\frac{1}{2}\max\{|a_{1}|,\ldots,|a_{n}|\}$ can be computed in $\mathsf{LOGSPACE}$. However, that algorithm uses a logarithmic number of rounds each depending on the outcome of the previous one – so it does not work in $\mathsf{TC}^{0}$. Note that for $n=2$ the problem is easy:

Example 5.1*.*

Let $a,b\in\mathbb{Z}$. Then, there are $x,y\in\mathbb{Z}$ with $\left|\mathinner{x}\right|,\left|\mathinner{y}\right|\leq\max\left\{\mathinner{\left|\mathinner{a}\right|,\left|\mathinner{b}\right|}\right\}$ such that $ax+by=\gcd(a,b)$. This is easy to see: assume $a,b>0$ (the other cases are similar) and we are given $x,y$ with $ax+by=\gcd(a,b)$ and $x\geq b$, then we can replace $x$ with $x-b$ and $y$ with $y+a$. This does not change the sum and by iterating this step, we can assure that $0\leq x<b$. Then we have $y=-\frac{ax-\gcd(a,b)}{b}$; hence, $-a<y\leq 1$.

If $a$ and $b$ are given in unary, the coefficients $x,y$ can be computed in $\mathsf{TC}^{0}$ by simply checking all (polynomially many) values for $x$ and $y$ with $\left|\mathinner{x}\right|,\left|\mathinner{y}\right|\leq\max\left\{\mathinner{\left|\mathinner{a}\right|,\left|\mathinner{b}\right|}\right\}$.

However, if we want to express the $\gcd$ of unboundedly many numbers $a_{i}$ as a linear combination, we cannot check all possible values for $x_{1},\dots,x_{n}$ in $\mathsf{TC}^{0}$ because there are $\max\{|a_{1}|^{n},\ldots,|a_{n}|^{n}\}$ (i. e., exponentially) many. Expressing the gcd as a linear combination can be viewed as a linear equation with integral coefficients. Recently, in [5, Thm. 3.14] it has been shown that, if all the coefficients are given in unary, it can be decided in $\mathsf{TC}^{0}$ whether such an equation or a system of a fixed number of equations has a solution. Since from the proof of [5, Thm. 3.14] it is not obvious how to find an actual solution, we prove the following result:

Theorem 5.2*.*

The following problem is in $\mathsf{TC}^{0}$: Given integers $a_{1},\ldots,a_{n}$ as unary numbers, compute $x_{1},\dots,x_{n}\in\mathbb{Z}$ (either in unary or binary) such that

[TABLE]

with $|x_{i}|\leq(n+1)\left(\max\{|a_{1}|,\ldots,|a_{n}|\}\right)^{2}$.

Proof 5.3*.*

Let $A=\max\{|a_{1}|,\ldots,|a_{n}|\}$, which clearly can be computed in $\mathsf{TC}^{0}$. W. l. o. g. we assume that all the $a_{i}$ are positive. We assume that all numbers which appear as intermediate results are encoded in binary (indeed, these numbers will grow too fast to encode them in unary).

First observe that $\gcd(a_{1},\ldots,a_{i})$ can be computed in $\mathsf{TC}^{0}$ for all $i\in\left\{\mathinner{1,\dots,n}\right\}$. The reason is simply that there are only linearly many numbers less than each $a_{i}$. In fact, for computing $\gcd(a_{1},\ldots,a_{n})$, the circuit just checks for all $d\leq A$ whether for every $i$ there is some $c_{i}\leq a_{i}$ with $dc_{i}=a_{i}$. If for some $d$ there are such $c_{i}$ for all $i$, we have found a common divisor. The $\gcd$ is simply the largest one.

Thus, it remains to compute the coefficients $x_{i}$. Since we can compute $\gcd(a_{1},\ldots,a_{n})$ in $\mathsf{TC}^{0}$, we can divide all numbers $a_{i}$ by the $\gcd$ and henceforth assume that $\gcd(a_{1},\ldots,a_{n})=1$ (note that this does not change the coefficients $x_{i}$).

The first step for computing the $x_{i}$s, is to compute $d_{i}=\gcd(a_{1},\ldots,a_{i})$ for $i=1,\dots,n$ and $d_{0}=0$ (note that by our assumption, $d_{n}=1$). We have

[TABLE]

Using this observation, the next step computes for each $i$ integers $y_{i}$ and $z_{i}$ such that $d_{i}=y_{i}d_{i-1}+z_{i}a_{i}$. For all $i$ this can be done in parallel in $\mathsf{TC}^{0}$ by simply trying all possible values with $\left|\mathinner{y_{i}}\right|,\left|\mathinner{z_{i}}\right|\leq A$ as in Example 5.1. We set

[TABLE]

These $x_{i}$ can be computed in $\mathsf{TC}^{0}$ using iterated multiplication [8] – see Theorem 2.2. Moreover, an easy induction shows that

[TABLE]

There is only one problem with the numbers $x_{i}$: in general, they do not meet the bounds $|x_{i}|\leq(n+1)A^{2}$. So, the next step will be to modify these $x_{i}$ in such a way that they meet the desired bound. The idea is to apply a sequence of operations as in Example 5.1 to make the coefficients small. The difficulty here is to find out where exactly to add/subtract a multiple of which $a_{i}$.

Let $\mathcal{P}=\left\{i\in\left\{\mathinner{1,\dots,n}\right\}\;\middle|\;x_{i}>0\right\}$ and $\mathcal{N}=\left\{i\in\left\{\mathinner{1,\dots,n}\right\}\;\middle|\;x_{i}<0\right\}$. Note that $\mathcal{P}\cap\mathcal{N}=\emptyset$ and w. l. o. g. we can assume that $\mathcal{P}\cup\mathcal{N}=\left\{\mathinner{1,\dots,n}\right\}$. For all $i=1,\dots n$, we set

[TABLE]

Obviously, we have $p^{\prime}_{i}=0$ for $i\in\mathcal{N}$ and $n^{\prime}_{i}=0$ for $i\in\mathcal{P}$. The non-zero $p^{\prime}_{i}$ correspond to those indices which have a too large positive $x_{i}$ and the non-zero $n^{\prime}_{i}$ to those indices which have a too small negative $x_{i}$ (this is because we assumed the $a_{i}$ to be positive). Moreover, $x_{i}$ should be decreased (resp. increased) by $A^{2}p^{\prime}_{i}/a_{i}$ (resp. $A^{2}n^{\prime}_{i}/a_{i}$) in order to make it reasonably small. We will not be able to reach this aim completely, but with a sufficiently small error.

Next, we set $P^{\prime}_{i}=\sum_{j=1}^{i}p^{\prime}_{j}$ and $N^{\prime}_{i}=\sum_{j=1}^{i}n^{\prime}_{j}$. All the $p^{\prime}_{i}$, $n^{\prime}_{i}$, $P^{\prime}_{i}$, $N^{\prime}_{i}$ and $\mathcal{P}$ and $\mathcal{N}$ can be computed in $\mathsf{TC}^{0}$ using iterated addition and division – see Theorem 2.2.

Lemma 5.4*.*

[TABLE]

Proof 5.5*.*

For $i\in\mathcal{P}$, we have $0\leq x_{i}a_{i}-p^{\prime}_{i}A^{2}<A^{2}$ by definition of $p^{\prime}_{i}$. Likewise, we have $0\geq x_{i}a_{i}+n^{\prime}_{i}A^{2}>-A^{2}$ for $i\in\mathcal{N}$. Since $\mathcal{P}\cap\mathcal{N}=\emptyset$ and $\mathcal{P}\cup\mathcal{N}=\left\{\mathinner{1,\dots,n}\right\}$, we obtain

[TABLE]

meaning that $P^{\prime}_{n}-N^{\prime}_{n}\leq\left|\mathinner{\mathcal{N}}\right|$. The same argument yields $(P^{\prime}_{n}-N^{\prime}_{n})A^{2}>1-\left|\mathinner{\mathcal{P}}\right|A^{2}$, and thus $N^{\prime}_{n}-P^{\prime}_{n}<\left|\mathinner{\mathcal{P}}\right|$.

Let $D=N^{\prime}_{n}-P^{\prime}_{n}$. For $i\in\left\{\mathinner{1,\dots,n}\right\}$, we set

[TABLE]

and $P_{i}=\sum_{j=1}^{i}p_{j}$ and $N_{i}=\sum_{j=1}^{i}n_{j}$ for $i\in\left\{\mathinner{0,\dots,n}\right\}$. Because of Lemma 5.4, we have $N_{n}=P_{n}$. Clearly, the $p_{i},n_{i},P_{i},N_{i}$ can be computed in $\mathsf{TC}^{0}$ and from now on we will work with these numbers. Also, as an immediate consequence of (6) and (7), we have

[TABLE]

Now, for $i\in\mathcal{P}$ and $j\in\mathcal{N}$, we define

[TABLE]

Note that the cases overlap. However, then the different definitions of $p_{j,i}$ agree. For $i\in\mathcal{N}$ and $j\in\mathcal{P}$, we set $p_{j,i}=p_{i,j}$ and for $i,j\in\mathcal{P}$ or $i,j\in\mathcal{N}$ we set $p_{j,i}=0$.

Lemma 5.6*.*

We have $\displaystyle\sum_{j}p_{j,i}=p_{i}$ and $\displaystyle\sum_{i}p_{j,i}=n_{j}$.

Proof 5.7*.*

We only show $\sum_{j}p_{j,i}=p_{i}$; the other statement follows by symmetry. First, assume that $p_{i}=p_{i,j}$ for some $j$. Then $p_{i,j^{\prime}}=0$ for all $j^{\prime}\neq j$; hence, the lemma holds. Now, let $p_{i}\neq p_{i,j}$ for any $j$. We define

[TABLE]

In particular, we have $p_{j,i}=0$ for $j<\alpha_{i}$ or $j>\beta_{i}$. Notice that $\alpha_{i}$ and $\beta_{i}$ exist for all $i\in\mathcal{P}$ (since $N_{n}=P_{n}$). Also $\alpha_{i}<\beta_{i}$ because $\alpha_{i}=\beta_{i}=j$ implies $N_{j-1}\leq P_{i-1}<N_{j}$ and $N_{j-1}<P_{i}\leq N_{j}$; thus, $p_{j,i}=p_{i}$. Moreover, we have $p_{\alpha_{i},i}=N_{\alpha_{i}}-P_{i-1}$ and $p_{\beta_{i},i}=P_{i}-N_{\beta_{i}-1}$ and $p_{j,i}=n_{j}$ for $\alpha_{i}<j<\beta_{i}$. Since

[TABLE]

[TABLE]

we obtain

[TABLE]

We set $y_{j,i}=\left\lfloor\mathinner{\frac{p_{j,i}A^{2}}{a_{i}a_{j}}}\right\rfloor$ for $i,j=1,\dots,n$. Notice that, since $a_{i}a_{j}\leq A^{2}$, this means that

[TABLE]

Finally, we define our new coefficients $\tilde{x}_{i}$ as follows:

[TABLE]

It remains to show the following:

1. (i)

the numbers $\tilde{x}_{i}$ can be computed in $\mathsf{TC}^{0}$, 2. (ii)

$\tilde{x}_{1}a_{1}+\cdots+\tilde{x}_{n}a_{n}=1$, 3. (iii)

$\left|\mathinner{\tilde{x}_{i}}\right|\leq(n+1)A^{2}$ for all $i$.

The first point is straightforward: we already remarked that the $p_{i}$, $n_{i}$, $P_{i}$, $N_{i}$ and $\mathcal{P}$ and $\mathcal{N}$ can be computed in $\mathsf{TC}^{0}$. Hence, also the $p_{j,i}$ can be computed in $\mathsf{TC}^{0}$ (as simple Boolean combination resp. addition of the previous numbers). Now, the $y_{j,i}$ can be computed using division [8]. Finally, the computation of the $\tilde{x_{i}}$ is simply another application of iterated addition.

For the second point observe that

[TABLE]

The last equality is due to the fact that $y_{j,i}=y_{i,j}$ for all $i,j$ and that $y_{i,j}=0$ if $i$ and $j$ are both in $\mathcal{P}$ or both in $\mathcal{N}$.

For the third point, let $i\in\mathcal{P}$. Then,

[TABLE]

The case $i\in\mathcal{N}$ is completely symmetric. This concludes the proof of Theorem 5.2.

Notice that it is straightforward to improve the bounds of Theorem 5.2 further (e. g. getting rid of the factor $n+1$). However, since there is no need for that in order to perform the matrix reduction, we do not do this additional effort. Also we could not find a $\mathsf{TC}^{0}$ circuit which yields the bound $x_{i}\leq\frac{1}{2}A$ (which is achievable in $\mathsf{LOGSPACE}$ by [17]).

6 Matrix reduction and subgroup membership problem

In [16], the so-called matrix reduction procedure converts an arbitrary matrix of coordinates into its full form and, thus, is an essential step for solving the subgroup membership problem and several other problems. It was first described in [25] – however, without a precise complexity estimate. In this section, we repeat the presentation from [16] and show that for fixed $c$ and $r$, it can be actually computed uniformly for groups in $\mathcal{N}_{c,r}$ in $\mathsf{TC}^{0}$ – in the case that the inputs are given in unary (as words). If the inputs are represented as words with binary exponents, then we still can show that it is $\mathsf{TC}^{0}$-Turing-reducible to ExtGCD. In Section 3, we defined the matrix representation of subgroups of nilpotent groups. We adopt all notation from Section 3.

As before, let $c,r\in\mathbb{N}$ be fixed and let $(a_{1},\dots,a_{m})$ be the standard Mal’cev basis of $F_{c,r}$. Let $G\in\mathcal{N}_{c,r}$ be given as quotient presentation, i. e., as a matrix in full form (either with unary or binary coefficients). We define the following operations on tuples $(h_{1},\ldots,h_{n})$ (our subgroup generators) of elements of $G$ and the corresponding operations on the associated matrix, with the goal of converting $(h_{1},\ldots,h_{n})$ to a sequence in full form generating the same subgroup $H=\left<\mathinner{h_{1},\ldots,h_{n}}\right>$:

1. (1)

Swap $h_{i}$ with $h_{j}$. This corresponds to swapping row $i$ with row $j$. 2. (2)

Replace $h_{i}$ by $h_{i}h_{j}^{l}$ ($i\neq j,\;l\in\mathbb{Z}$). This corresponds to replacing row $i$ by $\mathrm{Coord}({h_{i}h_{j}^{l}})$. 3. (3)

Add or remove a trivial element from the tuple. This corresponds to adding or removing a row of zeros; or (3’) a row of the form $(0\;\ldots\;0\;e_{i}\;\alpha_{i+1}\;\ldots\;\alpha_{m})$, where $i\in\mathcal{T}$ and $a_{i}^{-e_{i}}=a_{i+1}^{\alpha_{i+1}}\cdots a_{m}^{\alpha_{m}}$. 4. (4)

Replace $h_{i}$ with $h_{i}^{-1}$. This corresponds to replacing row $i$ by $\mathrm{Coord}({h_{i}^{-1}})$. 5. (5)

Append an arbitrary product $h_{i_{1}}^{l_{1}}\cdots h_{i_{k}}^{l_{k}}$ with $i_{1},\dots,i_{k}\in\left\{\mathinner{1,\dots,n}\right\}$ and $l_{1},\dots,l_{k}\in\mathbb{Z}$ to the tuple: add a new row with $\mathrm{Coord}({h_{i_{1}}^{l_{1}}\cdots h_{i_{k}}^{l_{k}}})$.

Clearly, all these operations preserve $H$.

Lemma 6.1*.*

On input of a quotient presentation of $G\in\mathcal{N}_{c,r}$ in unary (resp. binary) and a matrix of coordinates $A$ given in unary (resp. binary), operations (1)–(5) can be done in $\mathsf{TC}^{0}$. The output matrix will be also encoded in unary (resp. binary). For operations (2) and (5), we require that the exponents $l$, $l_{1},\dots,l_{k}$ are given in unary (resp. binary).

Moreover, as long as the rows in the matrix which are changed are pairwise distinct, a polynomial number of such steps can be done in parallel in $\mathsf{TC}^{0}$.

Proof 6.2*.*

Operations (1) and (3), clearly can be done in $\mathsf{TC}^{0}$. Notice that operation (3’) means simply that a row of the quotient presentation of $G$ is appended to the matrix.

In the unary case, it follows directly from Theorem 4.1 that operations (2), (4), and (5) are in $\mathsf{TC}^{0}$ because, since $l$, $l_{1},\dots,l_{k}$ are given in unary, the respective group elements can be written down as words.

In the case of binary inputs, (5) works as follows ((2) and (4) analogously): by Lemma 2.3 (ii), there are functions $q_{1},\ldots,q_{m}\in\mathbb{Z}[x_{1},\dots,x_{m},z]$ such that for every $h\in F_{c,r}$ with $\mathrm{Coord}({h})=(\gamma_{1},\ldots,\gamma_{m})$ anda $l\in\mathbb{Z}$, we have $\mathrm{Coord}_{{i}}({h^{l}})=q_{i}(\gamma_{1},\ldots,\gamma_{m},l)$ in $F_{c,r}$. These functions can be used to compute $\mathrm{Coord}({h_{i_{j}}^{l_{j}}})$ for $j=1,\dots,k$. After that, $h_{i_{1}}^{l_{1}}\cdots h_{i_{k}}^{l_{k}}$ can be written down as word with binary exponents and Theorem 4.1 can be applied.

Using the row operations defined above, in [16] it is shown how to reduce any coordinate matrix to its unique full form. Let us repeat these steps:

Let $A_{0}$ be a matrix of coordinates, as in (5) in Section 3. Recall that $\pi_{k}$ denotes the column index of the $k$-th pivot (of the full form of $A_{0}$). We produce matrices $A_{1},\ldots,A_{s}$, where $s$ is the number of pivots in the full form of $A_{0}$, such that for every $k=1,\ldots,s$ the first $\pi_{k}$ columns of $A_{k}$ form a matrix satisfying conditions (ii)-(v) of being a full sequence, condition (vi) is satisfied for all $i<\pi_{k+1}$, and $A_{s}$ is the full form of $A_{0}$. Here we formally denote $\pi_{{s+1}}=m+1$. Set $\pi_{{0}}=0$ and assume that $A_{k-1}$ has been constructed for some $k\geq 1$. In the steps below we construct $A_{k}$. We let $n$ and $m$ denote the number of rows and columns, respectively, of $A_{k-1}$. At all times during the computation, $h_{i}$ denotes the group element corresponding to row $i$ of $A_{k}$ and $\alpha_{ij}$ denotes the $(i,j)$-entry of $A_{k}$, which is $\mathrm{Coord}_{{j}}({h_{i}})$. These may change after every operation.

Step 1.

Locate the column $\pi_{{k}}$ of the next pivot, which is the minimum integer $\pi_{{k-1}}<\pi_{{k}}\leq m$ such that $\alpha_{i\pi_{{k}}}\neq 0$ for at least one $k\leq i\leq n$. If no such integer exists, then $k-1=s$ and $A_{s}$ is already constructed. Otherwise, set $A_{k}$ to be a copy of $A_{k-1}$ and denote $\pi=\pi_{{k}}$. Compute a linear expression of

[TABLE]

Let $h_{n+1}=h_{k}^{l_{k}}\cdots h_{n}^{l_{n}}$ and note that $h_{n+1}$ has coordinates of the form

[TABLE]

with $d$ occurring in position $\pi$. Perform operation 5 to append $h_{n+1}$ as row $n+1$ of $A_{k}$.

Step 2.

For each $i=k,\ldots,n$, perform operation 2 to replace row $i$ by $\mathrm{Coord}({h_{i}\cdot h_{n+1}^{-\alpha_{i\pi}/d}}).$ and for each $i=1,\ldots,k-1$, use 2 to replace row $i$ by $\mathrm{Coord}({h_{i}\cdot h_{n+1}^{-\lfloor\alpha_{i\pi}/d\rfloor}})$. After that, swap row $k$ with row $n+1$ using 1. At this point, properties (ii)-(iv) hold on the first $k$ columns of $A_{k}$.

Step 3.

If $\pi\in\mathcal{T}$, we additionally ensure condition (v) as follows. Perform row operation (3’), with respect to $\pi$, to append a trivial element $h_{n+2}$ with $\mathrm{Coord}({h_{n+2}})=(0,\ldots,0,e_{\pi},\ldots)$ to $A_{k}$. Let $\delta=\gcd(d,e_{\pi})$ and compute the linear expression $\delta=n_{1}d+n_{2}e_{\pi}$, with $|n_{1}|,|n_{2}|\leq\max\{d,e_{\pi}\}$. Let $h_{n+3}=h_{k}^{n_{1}}h_{n+2}^{n_{2}}$ and append this row to $A_{k}$, as row $n+3$. Note that $\mathrm{Coord}({h_{n+3}})=(0,\ldots,0,\delta,\ldots)$, with $\delta$ in position $\pi$. Replace row $k$ by $\mathrm{Coord}({h_{k}\cdot h_{n+3}^{-d/\delta}})$ and row $n+2$ by $\mathrm{Coord}({h_{n+2}\cdot h_{n+3}^{-e_{\pi}/\delta}})$, producing zeros in column $\pi$ in these rows. Swap row $k$ with row $n+3$. At this point, (ii), (iii), and (v) hold (for the first $\pi_{{k}}$ columns) but (iv) need not, since the pivot entry is now $\delta$ instead of $d$. For each $j=1,\ldots,k-1$, replace row $j$ by $\mathrm{Coord}({h_{j}\cdot h_{k}^{-\lfloor\alpha_{j\pi}/\delta\rfloor}})$, ensuring (iv).

Step 4.

Identify the next pivot $\pi_{{k+1}}$ (like in Step 1). If $\pi_{{k}}$ is the last pivot, we set $\pi_{{k+1}}=m+1$. We now ensure condition (vi) for $i<\pi_{k+1}$. Observe that Steps 1-3 preserve $\left<\,\mathinner{h_{j}}\;\middle|\;\mathinner{\pi_{{j}}\geq i}\,\right>$ for all $i<\pi_{{k}}$. Hence (vi) holds in $A_{k}$ for $i<\pi_{{k}}$ since it holds in $A_{k-1}$ for the same range. Now consider $i$ in the range $\pi_{{k}}\leq i<\pi_{{k+1}}$. It suffices to establish (vi.i) for all $j>k$ and (vi.ii) for $\pi_{{k}}$ only. To obtain (vi.i), notice that $h_{k}^{-1}h_{j}h_{k},h_{k}h_{j}h_{k}^{-1}\in\left<\,\mathinner{h_{\ell}}\;\middle|\;\mathinner{\ell>k}\,\right>$ if, and only if, $[h_{j},h_{k}^{\pm 1}]\in\left<\,\mathinner{h_{\ell}}\;\middle|\;\mathinner{\ell>k}\,\right>$. Further, note that the subgroup generated by

[TABLE]

where $h_{k}$ appears $m-\pi_{{k}}$ times in the last commutator, is closed under commutation with $h_{k}$ since if $h_{k}$ appears more than $m-\pi_{{k}}$ times then the commutator is trivial. An inductive argument shows that the subgroup $\left<\mathinner{S_{j}}\right>$ coincides with $\langle h_{k}^{-\ell}h_{j}h_{k}^{\ell}\mid 0\leq\ell\leq m-\pi_{k}\rangle$. Similar observations can be made for conjugation by $h_{k}^{-1}$. Therefore, appending via operation 5 rows $\mathrm{Coord}({h_{k}^{-\ell}h_{j}h_{k}^{\ell}})$ for all $1\leq|\ell|\leq m-\pi_{{k}}$ and all $k<j\leq n+3$ delivers (vi.i) for all $j>k$. Note that (vi.i) remains true for $i<\pi_{{k}}$.

To obtain (vi.ii), in the case $\pi_{k}\in\mathcal{T}$, we add row $\mathrm{Coord}({h_{k}^{e_{k}/\alpha_{k\pi_{k}}}})$. Note that this element commutes with $h_{k}$ and therefore (vi.i) is preserved.

Step 5.

Using operation 3, eliminate all zero rows. The matrix $A_{k}$ is now constructed.

We have to show that each step can be performed in $\mathsf{TC}^{0}$ given that all Mal’cev coordinates are encoded in unary (resp. in $\mathsf{TC}^{0}(\textsc{ExtGCD})$ if Mal’cev coordinates are encoded in binary). Since the total number of steps is constant (only depending on the nilpotency class and number of generators), this gives a $\mathsf{TC}^{0}$ (resp. $\mathsf{TC}^{0}(\textsc{ExtGCD})$) circuit for computing the full form of a given subgroup.

Step 1.

The next pivot can be found in $\mathsf{TC}^{0}$ since it is simply the next column in the matrix with a non-zero entry, which can be found as a simple Boolean combination of test whether the entries are zero. In the unary case, by Theorem 5.2, $d={\rm gcd}(\alpha_{k\pi},\ldots,\alpha_{n\pi})$ can computed in $\mathsf{TC}^{0}$ together with $l_{k},\dots,l_{n}$ encoded in unary such that $d=l_{k}\alpha_{k\pi}+\cdots+l_{n}\alpha_{n\pi}$. Now, by Lemma 6.1, Step 1 can be done in $\mathsf{TC}^{0}$.

In the binary case, $d$ and $l_{k},\dots,l_{n}$ can be computed using ExtGCD. Hence, by Lemma 6.1, Step 1 can be done in $\mathsf{TC}^{0}(\textsc{ExtGCD})$.

Step 2.

The numbers $\lfloor\alpha_{i\pi}/d\rfloor$ (either in unary or binary) can be computed in $\mathsf{TC}^{0}$ for all $i$ in parallel by Theorem 2.2. After that one operation (2) is applied to each row of the matrix. By Lemma 6.1, this can be done in parallel for all rows in $\mathsf{TC}^{0}$. Finally, swapping rows $k$ and $n+1$ can be done in $\mathsf{TC}^{0}$.

Step 3.

As explained in Section 4, $\mathcal{T}$ and $e_{i}$ for $i\in\mathcal{T}$ can be read directly from the quotient presentation. Thus, it can be decided in $\mathsf{TC}^{0}$ whether Step 3 has to be executed. Appending a new row is in $\mathsf{TC}^{0}$. Computing $\gcd(d,e_{\pi})=d=n_{1}dn_{2}e_{\pi}$ is in $\mathsf{TC}^{0}$ by Example 5.1 (in the unary case) and in $\mathsf{TC}^{0}(\textsc{ExtGCD})$ in the binary case. After that one operation (5) is followed by two operations (2), one operation (1), and, finally, $k-1$ times operation (2), which all can be done in $\mathsf{TC}^{0}$ again by Lemma 6.1.

Step 4.

The next pivot can be found in $\mathsf{TC}^{0}$ as outlined in Step 1. After that, Step 4 consists of an application of a constant number (only depending on the nilpotency class and number of generators) of operations (5) and thus, by Lemma 6.1, is in $\mathsf{TC}^{0}$.

Step 5.

Clearly that is in $\mathsf{TC}^{0}$.

Thus, we have completed the proof of our main result:

Theorem 6.3*.*

Let $c,r\in\mathbb{N}$ be fixed. The following problem is in $\mathsf{TC}^{0}$: given a unary encoded quotient presentation of $G\in\mathcal{N}_{c,r}$ and $h_{1},\ldots,h_{n}\in G$, compute the full form of the associated matrix of coordinates encoded in unary and hence the unique full-form sequence $(g_{1},\ldots,g_{s})$ generating $\langle h_{1},\ldots,h_{n}\rangle$. Moreover, if the $G$ and $h_{1},\ldots,h_{n}$ are given in binary, then the full-form sequence with binary coefficients can be computed in $\mathsf{TC}^{0}(\textsc{ExtGCD})$.

6.1 Subgroup membership problem

We can now apply the matrix reduction algorithm to solve the subgroup membership problem in $\mathsf{TC}^{0}$.

Theorem 6.4*.*

Let $c,r\in\mathbb{N}$ be fixed. The following problem is in $\mathsf{TC}^{0}$ (resp. $\mathsf{TC}^{0}(\textsc{ExtGCD})$ for binary inputs): given a quotient presentation of $G\in\mathcal{N}_{c,r}$, elements $h_{1},\ldots,h_{n}\in G$ and $h\in G$, decide whether or not $h$ is an element of the subgroup $H=\left<\mathinner{h_{1},\ldots,h_{n}}\right>$.

Moreover, if $h\in H$, the circuit computes the unique expression $h=g_{1}^{\gamma_{1}}\cdots g_{s}^{\gamma_{s}}$ where $(g_{1},\ldots,g_{s})$ is the full-form sequence for $H$ with the $\gamma_{i}$ encoded in unary (resp. binary).

Alternatively, for unary inputs, the output can be given as word $h=h_{i_{1}}^{\epsilon_{1}}\cdots h_{i_{t}}^{\epsilon_{t}}$ where $i_{j}\in\{1,\ldots,n\}$ and $\epsilon_{j}=\pm 1$.

Note that we do not know whether there is an analog of the second type of output for binary inputs. A possible way of expressing the output would be as a word with binary exponents over $h_{1},\ldots,h_{n}$. However, simply applying the same procedure as for unary inputs will not lead to a word with binary exponents.

Proof 6.5*.*

The circuit works as follows: first, the the full form $A$ of the coordinate matrix corresponding to $H$ and the standard-form sequence $(g_{1},\ldots,g_{s})$ are computed in $\mathsf{TC}^{0}$ (resp. $\mathsf{TC}^{0}(\textsc{ExtGCD})$) using Theorem 6.3. As before, denote by $\alpha_{ij}$ the $(i,j)$-entry of $A$ and by $\pi_{{1}},\ldots,\pi_{{s}}$ its pivots.

By Lemma 3.1, any element of $H$ can be written as $g_{1}^{\gamma_{1}}\cdots g_{s}^{\gamma_{s}}$. We show how to find these exponents. Denote $h^{(1)}=h$ and $\mathrm{Coord}({h^{(j)}})=(\beta_{1}^{(j)},\ldots,\beta_{m}^{(j)})$, with $h^{(j)}$ being defined below. For $j=1,\ldots,s$, do the following. If $\beta_{l}^{(j)}\neq 0$ for any $1\leq l<\pi_{j}$, then $h\notin H$. Otherwise, check whether $\alpha_{j{\pi_{j}}}$ divides $\beta_{\pi_{j}}^{(j)}$. If not, then $h\notin H$. If yes, let

[TABLE]

If $j<s$, continue to $j+1$. If $j=s$, then $h=g_{1}^{\gamma_{1}}\cdots g_{s}^{\gamma_{s}}\in H$ if $h^{(s+1)}=1$ and $h\notin H$ otherwise.

Since $s$ is bounded by a constant, there are only a constant number of steps. Each step can be done in $\mathsf{TC}^{0}$ by Theorem 2.2 (division) and Theorem 4.1 (computation of Mal’cev coordinates).

For the second type of output in the unary case, while performing the matrix reduction, we store for every row of the matrix also how that row can be expressed as a word over the subgroup generators $h_{1},\dots,h_{n}$ (here, we need the unary inputs, as otherwise the group elements cannot be expressed as words in polynomial space). In every operation on the matrix these words are updated correspondingly, which clearly can be done in $\mathsf{TC}^{0}$. In the end after writing $h=g_{1}^{\gamma_{1}}\cdots g_{s}^{\gamma_{s}}$, every $g_{i}$ can be substituted by the respective word.

Since abelian groups are nilpotent, we obtain:

Corollary 6.6*.*

Let $r$ be fixed. The following problem is in $\mathsf{TC}^{0}$: Given a list $h_{1},\dots,h_{n}\in\mathbb{Z}^{r}$ and $g\in\mathbb{Z}^{r}$ (all as words over the generators), decide whether $g\in\left<\mathinner{h_{1},\dots,h_{n}}\right>$. Moreover, in the case of a positive answer, compute $x_{1},\dots,x_{n}\in\mathbb{Z}$ in unary such that $g=x_{1}h_{1}+\dots+x_{n}h_{n}$.

In other words: for fixed $r$, given a unary encoded system of linear equations $(A,b)$ with $A\in\mathbb{Z}^{r\times n}$ and $b\in\mathbb{Z}^{r}$, a unary encoded solution $x\in\mathbb{Z}^{n}$ with $Ax=b$ can be computed in $\mathsf{TC}^{0}$.

6.2 Subgroup presentations

The full-form sequence associated to a subgroup $H$ forms a Mal’cev basis for $H$. This allows us to compute a consistent nilpotent presentation for $H$. Note, however, that the resulting presentation is not a quotient presentation (although it can be transformed into one, see Proposition 8.1) – partly this is due to the fact that, in general, $H\notin\mathcal{N}_{c,r}$. The following is the extended version of [16, Thm. 3.11]:

Theorem 6.7*.*

Let $c,r\in\mathbb{N}$ be fixed. The following is in $\mathsf{TC}^{0}$ for unary inputs and in $\mathsf{TC}^{0}(\textsc{ExtGCD})$ for binary inputs:

Input: a quotient presentation for $G\in\mathcal{N}_{c,r}$ and elements $h_{1},\ldots,h_{n}\allowbreak\in G$.

Output: a consistent nilpotent presentation for $H=\left<\mathinner{h_{1},\ldots,h_{n}}\right>$ given by a list of generators $(g_{1},\ldots,g_{s})$ and numbers $\mu_{ij},\alpha_{ijk},\beta_{ijk}\in\mathbb{Z}$ encoded in unary (resp. binary) for $1\leq i<j<k\leq s$ representing the relations (2)-(4).

Proof 6.8*.*

First, the full sequence $(g_{1},\ldots,g_{s})$ for $H$ is computed in $\mathsf{TC}^{0}$ (resp. $\mathsf{TC}^{0}(\textsc{ExtGCD})$) according to Theorem 6.3. Let $H_{i}=\langle g_{i},g_{i+1},\ldots,g_{s}\rangle$. In the proof of [16, Thm. 3.11], it is shown that $(g_{1},\ldots,g_{s})$ is a Mal’cev basis for $H$. Hence, it remains to compute the relators (2)-(4) in order to give a consistent nilpotent presentation of $H$. The order $e_{i}^{\prime}$ of $g_{i}$ modulo $H_{i+1}$ is simply $e_{i}/\mathrm{Coord}_{{\pi_{{i}}}}({g_{i}})$ (as before $\mathcal{T}$ and $e_{i}$ for $i\in\mathcal{T}$ can be read from the quotient presentation). Each relation (2) can be computed using the $\mathsf{TC}^{0}$ (resp. $\mathsf{TC}^{0}(\textsc{ExtGCD})$) circuit of Theorem 6.4 with input $g_{i}^{e_{i}^{\prime}}$ and $H_{i+1}=\langle g_{i+1},\ldots,g_{s}\rangle$. Since $g_{i}^{e_{i}^{\prime}}\in H_{i+1}$ and $(g_{i+1},\ldots,g_{s})$ is the unique full sequence for $H_{i+1}$, the membership algorithm returns the expression on the right side of (2). Relations (3) and (4) are established using the same method. Note that there are only a constant number of relations to establish – so everything can be done in $\mathsf{TC}^{0}$ (resp. $\mathsf{TC}^{0}(\textsc{ExtGCD})$).

7 More algorithmic problems

7.1 Homorphisms and kernels

Given nilpotent groups $G$ and $H$ and a subgroup $K\leq G$ and a generating set $g_{1},\ldots,g_{n}$ of $K$, a homomorphism $\varphi:K\to H$ can be specified by a list of elements $h_{1},\ldots,h_{n}$ where $\varphi(g_{i})=h_{i}$ for $i=1,\ldots,n$. For a homomorphism, we consider the problem of finding a generating set for its kernel, and given $h\in\varphi(K)$ finding $g\in G$ such that $\varphi(g)=h$. Following [16], both problems are solved using matrix reduction in the group $H\times G$.

Theorem 7.1* (Kernels and preimages).*

Let $c,r\in\mathbb{N}$ be fixed. The following is in $\mathsf{TC}^{0}$ for unary inputs and in $\mathsf{TC}^{0}(\textsc{ExtGCD})$ for binary inputs: On input of

• •

$G,H\in\mathcal{N}_{c,r}$ given as quotient presentations,

• •

a subgroup $K=\langle g_{1},\ldots,g_{n}\rangle\leq G$,

• •

a list of elements $h_{1},\ldots,h_{n}$ defining a homomorphism $\varphi:K\rightarrow H$ via $\varphi(g_{i})=h_{i}$, and

• •

optionally, an element $h\in H$ guaranteed to be in the image of $\varphi$,

compute

1. (i)

a generating set $X$ for the kernel of $\varphi$, and 2. (ii)

an element $g\in G$ such that $\varphi(g)=h$.

In case of unary inputs, $X$ and $g$ will be returned as words, and for binary inputs, as words with binary exponents.

Proof 7.2*.*

Let $(a_{1},\dots,a_{m})$ be the standard Mal’cev basis of $F_{c,r}$ and $(b_{1},\dots,b_{m^{\prime}})$ the standard Mal’cev basis of $F_{c,2r}$ We have two embeddings of $\varphi_{H},\varphi_{G}:F_{c,r}\to F_{c,2r}$ with $\varphi_{H}(a_{i})=b_{i}$ and $\varphi_{G}(a_{i})=b_{r+i}$ for $i=i,\dots,r$. We can assume that the Mal’cev basis of $F_{c,2r}$ is chosen in such a way that these embeddings send all Mal’cev generators of $F_{c,r}$ to Mal’cev generators of $F_{c,2r}$. Note that we have $\varphi_{H}(F_{c,r})\cap\varphi_{G}(F_{c,r})=\left\{\mathinner{1}\right\}$.

Thus, we can read all relators of $H$ and $G$ in $F_{c,2r}$ via the embeddings $\varphi_{H}$ and $\varphi_{G}$, respectively. To obtain a quotient presentation of $H\times G$, we simply need to add the relations that $H$ and $G$ commute – that is we need to introduce additional relations $b_{i}=1$ for all Mal’cev generators which are not in the image of $\varphi_{G}$ or $\varphi_{H}$. As the new quotient presentation is basically a copy of those of $H$ and $G$, it can be computed in $\mathsf{TC}^{0}$. From now on we work only in the direct product $H\times G\in\mathcal{N}_{c,2r}$ and identify $G$ and $H$ with their images under $\varphi_{G}$ and $\varphi_{H}$.

Let $Q=\langle h_{i}g_{i}\,|\,1\leq i\leq n\rangle$ and let $W=(v_{1}u_{1},\ldots,v_{s}u_{s})$ be the sequence in full form for the subgroup $Q$, where $u_{i}\in G$ and $v_{i}\in H$. Let $0\leq r\leq s$ be the greatest integer such that $v_{r}\neq 1$ (with $r=0$ if all $v_{i}$ are 1). Set $X=(u_{r+1},\ldots,u_{n})$ and $Y=(v_{1},\ldots,v_{r})$. In [16, Thm. 4.1] it is shown that $X$ is the full-form sequence for the kernel of $\varphi$ and $Y$ is the full-form sequence for the image.

Now, to solve (i), it suffices to compute $W$ using Theorem 6.3 and return the corresponding $X$ as defined above. For (ii), apply Theorem 6.4 to express $h$ as $h=v_{1}^{\beta_{1}}\cdots v_{r}^{\beta_{r}}$ – then return $g=u_{1}^{\beta_{1}}\cdots u_{r}^{\beta_{r}}$.

7.2 Centralizers

Before we focus on the conjugacy problem, we need one more preliminary result: the problem of computing centralizers.

Theorem 7.3* (Centralizers).*

Let $c,r\in\mathbb{N}$ be fixed. The following is in $\mathsf{TC}^{0}$ for unary inputs and in $\mathsf{TC}^{0}(\textsc{ExtGCD})$ for binary inputs:

On input of some $G\in\mathcal{N}_{c,r}$ given as quotient presentation and an element $g\in G$, compute a generating set $X$ for the centralizer of $g$ in $G$ (in case of binary inputs, the generating set will be given as set of words with binary exponents).

Proof 7.4*.*

Let $F_{c,r}=\Gamma_{0}\geq\Gamma_{1}\geq\cdots\geq\Gamma_{c+1}=1$ be the lower central series of $F_{c,r}$. Clearly this central series projects onto a central series of $G$ and we simply write $\Gamma_{i}$ for its projection in $G$. Denote with $A=(a_{1},\dots a_{m})$ the standard Mal’cev basis of $F_{c,r}$, which is associated to the lower central series – in particular $a_{1},\dots,a_{r}$ is a generating set for $F_{c,r}$.

We proceed by induction on $c$. If $c=1$, then $F_{c,r}$ and $G$ are abelian and $C(g)=G$ so the output is $\left\{\mathinner{a_{1},\dots,a_{r}}\right\}$. Assume that the theorem holds for groups in $\mathcal{N}_{c-1,r}$ – in particular, for $G/\Gamma_{c}$ (we obtain a quotient presentation of $G/\Gamma_{c}$ by simply forgetting about the Mal’cev generators in $\Gamma_{c}$). A generating set $K=\{k_{1}\Gamma_{c},\ldots,k_{n}\Gamma_{c}\}$ for the centralizer of $g\Gamma_{c}$ in $G/\Gamma_{c}$ can be computed in $\mathsf{TC}^{0}$ (resp. $\mathsf{TC}^{0}(\textsc{ExtGCD})$) by induction. Let

[TABLE]

where $\left\{\mathinner{a_{m^{\prime}},\dots,a_{m}}\right\}=A\cap\Gamma_{c}$. Then $J$ is the preimage of $\langle K\rangle$ under the homomorphism $G\rightarrow G/\Gamma_{c}$. Define $f:J\rightarrow G$ by

[TABLE]

Since $u\in J$, $u$ commutes with $g$ modulo $\Gamma_{c}$; hence, $[g,u]\in\Gamma_{c}$ and so $\mathrm{Im}(f)\subseteq\Gamma_{c}$. Moreover, $f$ is a homomorphism: we have

[TABLE]

and $[g,u_{1}]\in\Gamma_{c}$; therefore, $[[g,u_{1}],u_{2}]\in\Gamma_{c+1}=1$, and $[g,u_{1}]$ and $[g,u_{2}]$ commute, both being elements of the abelian group $\Gamma_{c}$.

If $h$ commutes with $g$, then $h\Gamma_{c}\in\langle K\rangle$, i. e.,  $h\in J$. Thus, the centralizer of $g$ is precisely the kernel of $f:J\rightarrow\Gamma_{c}$. A generating set can be computed in $\mathsf{TC}^{0}$ (resp. $\mathsf{TC}^{0}(\textsc{ExtGCD})$) using Theorem 7.1.

7.3 The conjugacy problem

Now, we can combine the previous theorems to solve the conjugacy problem in $\mathsf{TC}^{0}$ following [16, Thm. 4.6].

Theorem 7.5* (Conjugacy Problem).*

Let $c,r\in\mathbb{N}$ be fixed. The following is in $\mathsf{TC}^{0}$ for unary inputs and in $\mathsf{TC}^{0}(\textsc{ExtGCD})$ for binary inputs: On input of some $G\in\mathcal{N}_{c,r}$ given as quotient presentation and elements $g,h\in G$, either

• •

produce some $u\in G$ such that $g=h^{u}$, or

• •

determine that no such element $u$ exists.

In case of unary inputs, $u$ will be returned as a word, for binary inputs, as a word with binary exponents.

Proof 7.6*.*

Again we proceed by induction on $c$. If $c=1$, then $G$ is abelian and $g$ is conjugate to $h$ if and only if $g=h$. If so, we return $u=1$.

Now let us assume $c>1$ and that the theorem holds for any nilpotent group of class $c-1$ – in particular, for $G/\Gamma_{c}$. We use the notation as in the proof of Theorem 7.3.

The first step of the circuit is to check conjugacy of $g\Gamma_{c}$ and $h\Gamma_{c}$ in $G/\Gamma_{c}$ which can be done in $\mathsf{TC}^{0}$ by induction. If these elements are not conjugate, then $g$ and $h$ are not conjugate and the overall answer is ‘No’. Otherwise, we obtain some $v\Gamma_{c}\in G/\Gamma_{c}$ such that $g\Gamma_{c}=h^{v}\Gamma_{c}$.

Let $\varphi:G\rightarrow G/\Gamma_{c}$ be the canonical homomorphism, $J=\varphi^{-1}(C(g\Gamma_{c}))$ (where $C(g\Gamma_{c})$ denotes the centralizer of $g\Gamma_{c}$), and define $f:J\rightarrow\Gamma_{c}$ by $f(x)=[g,x]$. As in the proof of Theorem 7.3, the image of $f$ is indeed in $\Gamma_{c}$ and $f$ is a homomorphism. We claim that $g$ and $h$ are conjugate if and only if $g^{-1}h^{v}\in f(J)$. Indeed, if there exists $w\in G$ such that $g=h^{vw}$, then

[TABLE]

hence $w\in J$, so $w^{-1}\in J$ as well. Then $g^{-1}h^{v}=[g,w^{-1}]\in f(J)$, as required. The converse is immediate. So it suffices to express, if possible, $g^{-1}h^{v}$ as $[g,w]$ with $w\in J$, in which case the conjugator is $u=vw^{-1}$.

Now, the circuit computes a generating set $\{w_{1}\Gamma_{c},\ldots,w_{n}\Gamma_{c}\}$ for $C(g\Gamma_{c})$ using Theorem 7.3. Then $J$ is generated by $\{w_{1},\ldots,w_{n},a_{m^{\prime}},\dots,a_{m}\}$, where again $\left\{\mathinner{a_{m^{\prime}},\dots,a_{m}}\right\}=A\cap\Gamma_{c}$. After that, $\mathrm{Coord}({g^{-1}h^{v}})$ is computed and Theorem 6.4 used to determine whether $g^{-1}h^{v}\in f(J)$. If so, Theorem 7.1 is applied to find some $w\in G$ such that $g^{-1}h^{v}=f(w)$. Finally, $u=vw^{-1}$ is returned in case all previous tests succeed. Since we only concatenate a fixed constant number of $\mathsf{TC}^{0}$ (resp. $\mathsf{TC}^{0}(\textsc{ExtGCD})$) computations, the whole computation is in $\mathsf{TC}^{0}$ (resp. $\mathsf{TC}^{0}(\textsc{ExtGCD})$) again.

Remark 7.7*.*

We want to outline briefly how in the unary case the bounds of [16, Thm. 4.6] can be used to directly solve the conjugacy problem of nilpotent groups in $\mathsf{TC}^{0}$. Since [16, Thm. 4.6] is for a non-uniform setting, we fix a nilpotent group $G$ with generating set $A$. Let $g,h$ be words over $A^{\pm 1}$ as inputs for the conjugacy problem with of total length $n$. By [16, Thm. 4.6], the length of conjugators is polynomial in $n$. By using binary exponents, the conjugators can be written with respect to a Mal’cev basis of $G$ using only $C\log n$ bits for some constant $C$ which only depends on $G$ (this is a well-known fact – see e. g. [16, Thm. 2.3]). In particular, for all possible conjugators $u$ which have bit-length at most $C\log n$, it can be checked in parallel by a uniform family of $\mathsf{TC}^{0}$ circuits whether $g=h^{u}$ in $G$ by using the circuits for the word problem [24] (note that for this purpose each $u$ can be written down in unary since it is of length at most $n^{C}$).

8 Computing quotient presentations

The results in the previous sections always required that the group is given as a quotient presentation. However, we can use Theorem 6.3 to transform an arbitrary presentation with at most $r$ generators of a group in $\mathcal{N}_{c,r}$ into a quotient presentation.

Proposition 8.1*.*

Let $c$ and $r$ be fixed integers. The following is in $\mathsf{TC}^{0}$: given an arbitrary finite presentation with generators $a_{1},\dots,a_{r}$ of a group $G\in\mathcal{N}_{c,r}$ (as a list of relators given as words over $\left\{\mathinner{a_{1},\dots,a_{r}}\right\}^{\pm 1}$), compute a quotient presentation of $G$ (encoded in unary) and an explicit isomorphism.

Moreover, if the relators are given as words with binary exponents, then the binary encoded quotient presentation can be computed in $\mathsf{TC}^{0}(\textsc{ExtGCD})$.

Proof 8.2*.*

Let $A=\left\{\mathinner{a_{1},\dots,a_{r}}\right\}$ and let $R$ be the set of relators, i. e., $G$ is presented as $G=\left<\,\mathinner{A}\;\middle|\;\mathinner{R}\,\right>$. Let $F=F_{c,r}=\left<\mathinner{a_{1},\dots,a_{r}}\right>$ be the free nilpotent group of class $c$ on generators $A$. Let $B=\left\{\mathinner{b_{1},\dots,b_{m}}\right\}$ be the standard Mal’cev basis of $F$ such that $b_{i}=a_{i}$ for $i=1,\dots,r$ and let $S$ denote the set of relations such that $\left<\,\mathinner{B}\;\middle|\;\mathinner{S}\,\right>$ is a consistent nilpotent presentation for $F$.

Consider the natural surjection $\varphi:F\rightarrow G$ and let $N=\ker(\varphi)$, which is the normal closure of $R$ in $F$. Denoting $R=\{r_{1},\ldots,r_{k}\}$, $N$ is generated by iterated commutators $[\ldots[[r_{i},x_{1}],x_{2}],\ldots,x_{j}]$, where $i=1,\ldots,k$, $j\leq c$, and $x_{1},\ldots,x_{j}\in A\cup A^{-1}$. The total length of these generators is linear since $c$ and $r$ are constant. Using Theorem 6.3 in the group $F$, we can produce the full-form sequence $T$ for $N$ in $\mathsf{TC}^{0}$ (resp. in $\mathsf{TC}^{0}(\textsc{ExtGCD})$ for binary inputs).

Now $G\simeq\langle B\mid S\cup T\rangle$ and by Lemma 3.2 this is a (consistent) quotient presentation.

Remark 8.3*.*

Because of Proposition 8.1, in all theorems above where the input is a quotient presentation, we can also take an arbitrary $r$-generated presentation of a group in $\mathcal{N}_{c,r}$ as input. However, be aware that for the word problem (Theorem 4.1 and Corollary 4.2) the complexity changes from $\mathsf{TC}^{0}$ to $\mathsf{TC}^{0}(\textsc{ExtGCD})$ in the binary case.

9 Power problem and conjugacy in wreath products of nilpotent groups

In [19], the conjugacy problem in iterated wreath products of abelian is shown to be in $\mathsf{TC}^{0}$ (for a definition of iterated wreath products we refer to [19]). The crucial step there is the transfer result that the conjugacy problem in a wreath product $A\wr B$ is $\mathsf{TC}^{0}$-Turing-reducible to the conjugacy problems of $A$ and $B$ and the so-called power problem of $B$.

The power problem of $G$ is defined as follows: on input of $g,h\in G$ (as words over the generators) decide whether $h$ is a power of $g$ that is whether there is some $k\in\mathbb{Z}$ such that $g^{k}=h$ in $G$. In the “yes” case compute this $k$ in binary representation. If $g$ has finite order in $G$, the computed $k$ has to be the smallest non-negative such $k$.

By [19], also the power problem of $A\wr B$ is $\mathsf{TC}^{0}$-Turing-reducible to the power problems of $A$ and $B$ given that torsion elements of $B$ have uniformly bounded order. The latter condition is also preserved by wreath products. Thus, in the light of [19], it remains to show that the power problem of nilpotent groups is in $\mathsf{TC}^{0}$ and that the order of torsion elements is uniformly bounded, in order to establish the following theorem (note that [19] is only for fixed groups; therefore, we formulate also the following results in a non-uniform setting):

Theorem 9.1*.*

Let $A$ and $B$ be finitely generated nilpotent groups and let $d\geq 1$, then the conjugacy problem of the $d$-fold iterated wreath products $A\wr^{d}B$ as well as $A\;{{}^{d}\wr}\;B$ is in $\mathsf{TC}^{0}$.

Proof 9.2*.*

The following two lemmas together with a repeated application of Theorem 3, Lemma 5, and Theorem 5 of [19].

Lemma 9.3*.*

Every finitely generated nilpotent group has a uniform bound on the order of torsion elements.

Proof 9.4*.*

We proceed by induction along a Mal’cev basis $(a_{1},\dots,a_{m})$ of $G$. If $a_{1}$ has infinite order, we are done by induction. Otherwise, let $k$ be the order of $a_{1}$ and $M$ be such that $g^{M}=1$ for all torsion elements $g\in\left<\mathinner{a_{2},\dots,a_{m}}\right>$. Consider a torsion element $h\in\left<\mathinner{a_{1},\dots,a_{m}}\right>$. Then $h^{k}\in\left<\mathinner{a_{2},\dots,a_{m}}\right>$. Thus, $h^{kM}=1$. Therefore, $kM$ is an upper bound on the order of torsion elements in $G$.

Lemma 9.5*.*

For every finitely generated nilpotent group $G$, the power problem of $G$ is in uniform $\mathsf{TC}^{0}$.

Proof 9.6*.*

We show a slightly more general statement by induction along a Mal’cev basis $(a_{1},\dots,a_{m})$ of $G$: for every fixed arithmetic progression $\alpha+\beta\mathbb{Z}$, the power problem restricted to $\alpha+\beta\mathbb{Z}$ is in $\mathsf{TC}^{0}$, i. e., given $g,h\in G$ it can be decided in $\mathsf{TC}^{0}$ whether there is some $n\in\alpha+\beta\mathbb{Z}$ with $g^{n}=h$ in $G$ and, if so, that $n$ can be computed in $\mathsf{TC}^{0}$.

We consider the input words $g$ and $h$ in the quotient $G/\left\{\mathinner{a_{2}=\cdots=a_{m}=1}\right\}$. Let $g=a_{1}^{k}$ and $h=a_{1}^{\ell}$ in this quotient. If $k=\ell=0$, it remains to solve the power problem in the subgroup $\left<\mathinner{a_{2},\dots,a_{m}}\right>$, which can be done by induction. Next, we distinguish the two cases that $a_{1}$ has infinite order and that it has finite order (in $G/\left\{\mathinner{a_{2}=\cdots=a_{m}=1}\right\}$).

In the case of infinite order, the only possible value for $n$ can be computed as $\ell/k$ (in $\mathsf{TC}^{0}$ by Theorem 2.2). If this is not an integer or not contained in the arithmetic progression (i. e.,  $\ell/k\not\equiv\alpha\mod\beta$), then $h$ is not a power of $g$. Otherwise, one simply checks whether $g^{\ell/k}=h$ in $G$ (i. e.,  solving the word problem). As $\ell$ is bounded by the input length by Lemma 2.3, this can be done in $\mathsf{TC}^{0}$ by Theorem 4.1.

In the case of finite order, let $d$ denote the order of $a_{1}$. It can be checked for all $0\leq i<d$ in parallel whether $ki=\ell\mod d$. In case that there is such an $i$, the answer to the power problem is the same as the answer to the power problem in the subgroup $\left<\mathinner{a_{2},\dots,a_{m}}\right>$ restricted to the arithmetic progression $i+d\mathbb{Z}\cap\alpha+\beta\mathbb{Z}$ (the intersection can be hard-wired since there are only finitely many possibilities for a fixed group since the modulo is bounded by the least common multiple of the orders of finite order elements of the Mal’cev basis) – if there is no such $i$, the answer is “no”.

10 Conclusion and Open Problem

We have seen that most problems which in [16] were shown to be in $\mathsf{LOGSPACE}$ indeed are in $\mathsf{TC}^{0}$ even in the uniform setting where the number of generators and nilpotency class is fixed. Moreover, their binary versions are in $\mathsf{TC}^{0}(\textsc{ExtGCD})$ meaning that nilpotent groups are no more complicated than abelian groups in many algorithmic aspects. This contrasts with the slightly larger class of polycyclic groups: while the word problem is still in $\mathsf{TC}^{0}$ [24, 12], the conjugacy problem is not even known to be in $\mathsf{NP}$. We conclude with some possible generalizations of our results:

Question 10.1*.*

Does a uniform version of Theorem 4.1 hold (i. e., is the uniform word problem still in $\mathsf{TC}^{0}$) for fixed nilpotency class but an arbitrary number of generators?

What happens to the complexity if also the nilpotency class is part of the input? Note that in that case it is even not clear whether the word problem is still in polynomial time.

Question 10.2*.*

Is there a way to solve the conjugacy problem for nilpotent groups with binary exponents in $\mathsf{TC}^{0}$? Notice that we needed to compute greatest common divisors for solving the subgroup membership problem. However, there might be a way of solving the conjugacy problem using another method.

Question 10.3*.*

What is the complexity of the uniform conjugacy problem when the nilpotency class is not fixed?

On the way for proving that the subgroup membership problem of nilpotent groups is in $\mathsf{TC}^{0}$, we established that the extended gcd problem with unary inputs and outputs is in $\mathsf{TC}^{0}$. However, the computed solution is not as small as the one computed by the $\mathsf{LOGSPACE}$ algorithm from [17]:

Question 10.4*.*

Is the following problem in $\mathsf{TC}^{0}$: given unary encoded numbers $a_{1},\dots,a_{n}\in\mathbb{Z}$, compute $x_{1},\dots,x_{n}\in\mathbb{Z}$ with $\left|\mathinner{x_{i}}\right|\leq\frac{1}{2}\max\left\{\mathinner{\left|\mathinner{a_{1}}\right|,\dots,\left|\mathinner{a_{n}}\right|}\right\}$ such that $x_{1}a_{1}+\dots+x_{n}a_{n}=\gcd(a_{1},\ldots,a_{n})$?