Computing normal integral bases of abelian number fields

TL;DR

This paper presents an efficient method for computing normal integral bases in abelian number fields, assuming known Galois group and integral basis, enhancing computational number theory techniques.

Contribution

It introduces a new approach to compute normal integral bases in abelian fields when the Galois group and an integral basis are known.

Findings

Efficient algorithms for normal integral basis computation

Applicable to abelian number fields with known Galois group

Improves existing computational methods

Abstract

Let L be an abelian number field of degree n with Galois group G. In this paper we study how to compute efficiently a normal integral basis for L, if there is at least one, assuming that the group G and an integral basis for L are known.

Equations

$$(\sum _{g\in G}{a}_{g}g)x=\sum _{g\in G}{a}_{g}g(x),$$

$$\mathcal{O}\subseteq \mathbb{Z}[G]\frac{\alpha }{D}.$$

$${\beta }_j=\sum _{i=1}^n{b}_{ij}{\alpha }_i^{\prime },$$

$$b_j=\sum _{i=1}^n{b}_{ij}{g}_i\in \mathbb{Z}[G].$$

$$\mathcal{O}=\mathbb{Z}[G]t{\alpha }^{\prime }=\left(\sum _{j=1}^n\mathbb{Z}[G]b_j\right){\alpha }^{\prime },$$

$$\mathbb{Z}[G]t=\sum _{j=1}^n\mathbb{Z}[G]b_j.$$

$$I=\sum _{j=1}^n\mathbb{Z}[G]b_j.$$

$$\mathbb{Q}G\cong {\oplus }_{q|n}{a}_q\mathbb{Q}({\zeta }_q)$$

$$e_{\chi }=\frac{1}{|G|}\sum _{g\in G}\chi (g^{-1})g.$$

$$h=\sum _{i=1}^n{h}_i{g}_i=\sum _{i=1}^n{c}_i{e}_i,$$

$$\mathbb{C}G=\mathbb{C}{e}_1\oplus \cdots \oplus \mathbb{C}{e}_n.$$

$$\left(\begin{array}[]{c}c_{1}\\ \vdots\\ c_{n}\end{array}\right)=A\left(\begin{array}[]{c}h_{1}\\ \vdots\\ h_{n}\end{array}\right).$$

$$\left(\begin{array}[]{c}h_{1}\\ \vdots\\ h_{n}\end{array}\right)=A^{-1}\left(\begin{array}[]{c}c_{1}\\ \vdots\\ c_{n}\end{array}\right).$$

$$\left(\begin{array}[]{c}c_{1}\\ \vdots\\ c_{k}\end{array}\right)=B\left(\begin{array}[]{c}h_{1}\\ \vdots\\ h_{n}\end{array}\right).$$

$$\left(\begin{array}[]{c}h_{1}\\ \vdots\\ h_{n}\end{array}\right)=A^{-1}\left(\begin{array}[]{c}c_{1}\\ \vdots\\ c_{n}\end{array}\right).$$

$$\psi :\mathbb{Z}G\hookrightarrow \mathbb{Z}[{\zeta }_{q_1}]\oplus \cdots \oplus \mathbb{Z}[{\zeta }_{q_k}],$$

$${\chi }_j\left(\sum _{i=1}^n{a}_i{g}_i\right)=\sum _{i=1}^n{a}_i{\chi }_j(g_i)\in \mathbb{Z}[{\zeta }_{q_j}].$$

$$b_j=\sum _{i=1}^n{b}_{ij}{g}_i,$$

$$\left(\begin{array}[]{c}c_{1,j}\\ \vdots\\ c_{k,j}\end{array}\right)=B\left(\begin{array}[]{c}b_{1,j}\\ \vdots\\ b_{n,j}\end{array}\right).$$

$$t=\sum _{i=1}^n{t}_i{g}_i,$$

$$\left(\begin{array}[]{c}t_{1}\\ \vdots\\ t_{n}\end{array}\right)=A^{-1}\left(\begin{array}[]{c}d_{1}\\ \vdots\\ d_{n}\end{array}\right).$$

$$(U(\Gamma ):U(\mathbb{Z}G))<n^n{\left({\Pi }_{q|n}{\left(\frac{q^{\varphi (q)}}{{\Pi }_{p|q}{p}^{\varphi (q)/(p-1)}}\right)}^{a_q}\right)}^{-1}$$

Full text

1. Introduction

Let $L$ be a Galois number field and let $\mathcal{O}$ denote its ring of algebraic integers. A major problem of algorithmic algebraic number theory is to compute efficiently a normal integral basis for $L$ over ${\mathbb{Q}}$, that is a basis of $\mathcal{O}$ as a ${\mathbb{Z}}$–module which is made up of all the conjugates of a single algebraic integer.

Although the theoretical aspects of the question are well understood, the effective construction of normal integral basis has been accomplished only in few particular cases.

In this paper we focus our attention to the abelian case. We extend the results obtained in [2] for abelian number fields of exponent 2, 3, 4 and 6 to any abelian number field.

From a theoretical point of view, the Hilbert-Speiser theorem asserts that an abelian number field $L$ admits a normal integral basis if and only if the conductor of $L$ is squarefree. When this is the case, such a basis may be constructed by means of Gaussian periods: if we denote the conductor of $L$ by $f$, then $\mathop{\mathrm{Tr}}_{{\mathbb{Q}}(\zeta_{f})/L}(\zeta_{f})$ generates a normal integral basis for $L$ (see [8]). From a practical point of view, this is quite unsatisfacory, since we need to work in ${\mathbb{Q}}(\zeta_{f})$ whose degree $\varphi(f)$ may be very large in comparison to $[L:{\mathbb{Q}}]$. Hence the computation of the relative trace might be very expensive.

The algorithm presented here has the advantage that it is essentially independent of the conductor.

In Section 2, we fix some notation, give some basic results, and reduce our problem to that of computing a generator of a certain ideal of the group ring ${\mathbb{Z}}[G]$ of the Galois group $G$ of $L$. In Section 3, we construct an explicit homomorphic embedding of this group ring into the finite product of some cyclotomic rings. In Section 5, we describe the essential steps of our algorithm. Finally, in Section 7, we give some explicit numerical examples.

2. Notation and general framework

From now on, let $L$ be an abelian number field of degree $n$, let $\mathcal{O}$ be its ring of algebraic integers, and let $\alpha$ be a primitive element for the extension $L/{\mathbb{Q}}$, so that $L={\mathbb{Q}}[\alpha]$. We can assume that $\alpha\in\mathcal{O}$, and we denote the minimal polynomial of $\alpha$ over ${\mathbb{Q}}$ by $m(x)$, which is therefore a monic polynomial of degree $n$ with integer coefficients.

Let $G$ be the Galois group of $L/{\mathbb{Q}}$. Under the Extended Riemann Hypothesis it is possible to compute efficiently $G$ by using the algorithm described in [3]. Such algorithm gives us explicitly the action of the elements of $G$ on $\alpha$. So, we let $G=\left\{g_{1},\ldots,g_{n}\right\}$, and put $\alpha_{i}=g_{i}(\alpha)$, for $i=1,\ldots,n$. Then, we can assume that the conjugates of $\alpha$ constitute a basis of $L$ as a vector space over ${\mathbb{Q}}$.

Finally, we let $\left\{\beta_{1},\ldots,\beta_{n}\right\}$ be an integral basis of $\mathcal{O}$, that is a basis of $\mathcal{O}$ as a ${\mathbb{Z}}$–module. We recall that an integral basis can be computed using the algorithms described in [5] and [10].

Let ${\mathbb{Z}}[G]$ and ${\mathbb{Q}}[G]$ denote respectively the group ring of $G$ over ${\mathbb{Z}}$ and over ${\mathbb{Q}}$. The action of $G$ on $L$ can be extended by linearity to an action of ${\mathbb{Q}}[G]$ (or ${\mathbb{Z}}[G]$), setting

[TABLE]

for all $a_{g}$ in ${\mathbb{Q}}$ (resp. ${\mathbb{Z}}$), and all $x\in L$.

We say that $L$, or $\mathcal{O}$, has a normal integral basis when there exists $\theta\in\mathcal{O}$ such that the conjugates of $\theta$ constitute a basis of $\mathcal{O}$ as a ${\mathbb{Z}}$–module. In such a case we call $\theta$ a normal integral basis generator.

If $\theta\in\mathcal{O}$, then $\theta$ is a normal integral basis generator if and only if the discriminant of the set $\left\{g_{1}(\theta),\ldots,g_{n}(\theta)\right\}$ equals the discriminant of $L$. We will need to perform such a check just once, and our algorithm will return $\theta$ if such a $\theta$ exists, and ‘$\theta$ does not exist’ otherwise.

The fact that the conjugates of $\alpha$ constitute a basis for $L/{\mathbb{Q}}$ can be rephrased by saying that $L$ is free of rank one as a ${\mathbb{Q}}[G]$–module. The integer counterpart of this property is given next.

Lemma 2.1**.**

The field $L$ possesses a normal integral basis if and only if the ring $\mathcal{O}$ is free of rank one as a ${\mathbb{Z}}[G]$–module.

Assume now that $\mathcal{O}$ has a normal integral basis and that $\theta$ is a normal integral basis generator, so that $\mathcal{O}={\mathbb{Z}}[G]\theta$.

Since $\mathcal{O}=\sum_{i=1}^{n}{\mathbb{Z}}\beta_{i}$ and $L$ is normal, we also have $\mathcal{O}=\sum_{i=1}^{n}{\mathbb{Z}}[G]\beta_{i}$ (where this sum is not direct). In other words, the $\beta_{i}$’s form a set of generators of $\mathcal{O}$ as a ${\mathbb{Z}}[G]$–module. We would like to compute a single free generator of $\mathcal{O}$ from the given set $\{\beta_{1},\ldots,\beta_{n}\}$.

Let $D\in{\mathbb{Z}}$ be such that

[TABLE]

For instance, we could take $D$ equal to the discriminant of the set $\{\alpha_{1},\ldots,\alpha_{n}\}$. For the sake of convenience, we put $\alpha^{\prime}=\alpha/D$, and $\alpha^{\prime}_{i}=g_{i}(\alpha^{\prime})=\alpha_{i}/D$, for $i=1,\ldots,n$.

On the one hand, we have $\theta\in{\mathbb{Z}}[G]\alpha^{\prime}$, so that $\theta=\sum_{i=1}^{n}t_{i}\alpha^{\prime}_{i}$, for some $t_{i}\in{\mathbb{Z}}$. In other words, if we let $t=\sum_{i=1}^{n}t_{i}g_{i}$, then we have $\theta=t\alpha^{\prime}$, where $t\in{\mathbb{Z}}[G]$.

On the other hand, we can express each element $\beta_{j}$ of the known integral basis as a linear combination with integral coefficients of the elements $\alpha^{\prime}_{1},\ldots,\alpha^{\prime}_{n}$. In other words, for $j=1,\ldots,n$ we can write

[TABLE]

with $b_{ij}\in{\mathbb{Z}}$. This is equivalent to say that $\beta_{j}=b_{j}\alpha^{\prime}$, where

[TABLE]

Therefore we have

[TABLE]

and, since $\alpha$ gives a normal basis for $L/{\mathbb{Q}}$ and the same is true for $\alpha^{\prime}$,

[TABLE]

In conclusion, we have reduced our problem to the problem of finding a generator of the ideal of ${\mathbb{Z}}[G]$ generated by the set $\{b_{1},\ldots,b_{n}\}$. For future reference, let us call this ideal $I$, that is let us define

[TABLE]

We complete our arguments and state the main results of this section in the following theorem.

Theorem 2.2**.**

Let $L$ be an abelian number field, and let $I$ be the ideal of ${\mathbb{Z}}[G]$ defined by (2.3). Then, $L$ has a normal integral basis if and only if $I$ is principal. More precisely, if $\alpha^{\prime}\in L$ is such that $L={\mathbb{Q}}[G]\alpha^{\prime}$ and $\mathcal{O}\subseteq{\mathbb{Z}}[G]\alpha^{\prime}$, then we have:

• •

If $\theta$ is a normal integral basis generator, and $\theta=t\alpha^{\prime}$, with $t\in{\mathbb{Z}}[G]$, then $I={\mathbb{Z}}[G]t$.

• •

If $I$ is principal and $t\in{\mathbb{Z}}[G]$ is a generator of $I$, then $t\alpha^{\prime}$ is normal integral basis generator.

Proof.

The above arguments show that if $L$ has a normal integral basis and $\theta$ is a normal integral basis generator then $I$ is principal and is generated by $t$, which is defined by the relation $\theta=t\alpha^{\prime}$. Then, it is easily seen that the converse holds true, and that if $t$ is a generator of $I$, then the element $t\alpha^{\prime}$ is integral and it is a normal integral basis generator. ∎

3. Decomposition of the group ring ${\mathbb{Q}}G$

We begin by stating a result about rational group rings of finite abelian groups, proved by S. Perlis and G. Walker in [9] as well as by Higman [7].

Theorem 3.1** (Perlis, Walker).**

Let $G$ be a finite abelian group of order $n$. Then

[TABLE]

where ${a_{q}}{\mathbb{Q}}(\zeta_{q})$ denotes the direct sum of $a_{q}$ copies of ${\mathbb{Q}}(\zeta_{q})$. Moreover, $a_{q}=n_{q}/\varphi(q)$, with $n_{q}$ equal to the number of elements of order $q$ in $G$.

A very enjoyable proof of this result can be found in [11]. However, for our purposes, we are going to construct this isomorphism explicitly, and then we will restrict it to ${\mathbb{Z}}G$.

Following Higman’s approach the idempotent $e_{\chi}\in{\mathbb{C}}G$ associated to any character (representation of degree 1) $\chi$ is defined as:

[TABLE]

Let $\chi_{1},\ldots,\chi_{n}$ be the irreducible characters of $G$, and denote the character group by $\widehat{G}$. From now on, we write $e_{i}$ in place of $e_{\chi_{i}}$, for short.

Extending the characters linearly to the full group ring, we see that any element $h$ of ${\mathbb{C}}G$ admits two unique representations:

[TABLE]

and we have the well known decomposition

[TABLE]

If we denote the character matrix $\left(\chi_{i}(g_{j})\right)_{i,j=1,\ldots,n}$ of $G$ by $A$, then we have the following equality:

[TABLE]

Conversely, as $A$ is not singular, if the coefficients $(c_{i})$ of an element $h$ of ${\mathbb{C}}G$ are known, we can easily compute the coefficients $(h_{i})$:

[TABLE]

Here we can compute directly the inverse of the matrix $A$, as it is well known that $(A^{-1})_{ij}=\overline{\chi_{j}(g_{i})}/|G|={\chi_{j}(g_{i}^{-1})}/|G|$. Hence, we have:

Proposition 3.2**.**

The map ${\mathbb{C}}G\rightarrow{\mathbb{C}}^{n}$ which sends $h$ to $\left(\chi_{1}(h),\ldots,\chi_{n}(h)\right)$ is a ${\mathbb{C}}$-algebra isomorphism, and the associated matrix with respect to the bases $\left(g_{1},\ldots,g_{n}\right)$ and $\left(e_{1},\ldots,e_{n}\right)$ is the character matrix $A$.

Now, we turn our attention back to the group ring ${\mathbb{Q}}G$ and to Theorem 3.1. For each irreducible character $\chi_{i}$, $i=1,\ldots,n$, let us denote its order in $\widehat{G}$ by $q_{i}$. Therefore $\chi_{i}(g)$ is a root of unity of order $q_{i}$ for all $g\in G$, and is a primitive root of unity of order $q_{i}$ for some $g\in G$.

Note that if $\chi$ is a character of $G$ with values in some Galois number field $K$ (actually, some ${\mathbb{Q}}(\zeta)$, for some root of unity $\zeta$) and $\sigma$ is an automorphism of $K$, then $\sigma(\chi)$ is another character of $G$ with values in the same field $K$. We say that $\chi_{i}$ and $\chi_{j}$, with values in some $K$, are algebraically conjugate if there exists an automorphism $\sigma$ of $K$ such that $\chi_{j}=\sigma(\chi_{i})$. Thus, $\chi_{i}$ and $\chi_{j}$ are algebraically conjugate if and only if they are equivalent over ${\mathbb{Q}}$. However, for our purposes, it is better to think in terms of conjugation rather than in terms of equivalence of the associated representations.

Let us select from the set $\left\{\chi_{1},\ldots,\chi_{n}\right\}$ a maximal subset of irreducible characters such that no one of them is algebraically conjugate to some other.

Let us assume that $\chi_{r}$ is an irreducible character of $G$ of order $o_{r}$, so that $\chi_{r}$ maps ${\mathbb{Q}}G$ onto ${\mathbb{Q}}[\zeta_{o_{r}}]$. If $\sigma$ is an automorphism of ${\mathbb{Q}}[\zeta_{o_{r}}]$, then $\sigma$ sends $\zeta_{o_{r}}$ to $\zeta_{o_{r}}^{s}$, where $o_{r}$ and $s$ are coprime, and therefore $\chi_{r}$ to $\chi_{r}^{s}$.

Viceversa, if $\chi_{a}$ and $\chi_{r}$ are two characters of $G$ such that $\chi_{a}=\chi_{r}^{s}$ in $\widehat{G}$, with $(r,o_{r})=1$, then $\chi_{a}=\sigma(\chi_{r})$ where $\sigma$ sends $\zeta_{o_{r}}$ to $\zeta_{o_{r}}^{s}$ in ${\mathbb{Q}}[\zeta_{o_{r}}]$.

Thus, the computation of a maximal subset of irreducible characters such that no one of them is algebraically conjugate to some other can be done by applying one of the following methods:

• •

For each character $\chi$, remove all co-prime powers of $\chi$ from the list;

• •

For each character $\chi$, form the orbit of $\chi$ under the action of the Galois group of ${\mathbb{Q}}[\zeta_{o_{r}}]$, and remove all the conjugates of $\chi$ from list.

After rearranging the original set, we can assume that $\left\{\chi_{1},\ldots,\chi_{k}\right\}$ is such a subset, where $1\leq k\leq n$.

For further reference, for any character which has not been selected, we keep track of the selected character which is algebraically conjugate to it, and of the automorphism which gives such a relation. Precisely, for any $i$, where $k<i\leq n$, we take note of the (unique) index $k_{i}$, with $1\leq k_{i}\leq k$, such that $\chi_{i}$ and $\chi_{k_{i}}$ are algebraically conjugate, and also of the automorphism $\sigma_{i}$ such that $\sigma_{i}(\chi_{k_{i}})=\chi_{i}$.

It is easy to see that, for any divisor $q$ of $n$, the number of irreducible characters of order $q$ equals $\varphi(q)$ times the number of subgroups of $G$ of order $q$, and the maximal number of irreducible characters of order $q$ which are not algebraically conjugate equals the number of subgroups of $G$ of order $q$. In this way, we recover the same arithmetic conditions stated in Theorem 3.1.

Summarizing, we have:

Proposition 3.3**.**

Assume that $\{\chi_{1},\ldots,\chi_{k}\}$ is a maximal subset of irreducible characters which are not pairwise algebraically conjugate. Then, the map $\phi:{\mathbb{Q}}G\rightarrow{\mathbb{Q}}(\zeta_{q_{1}})\oplus\cdots\oplus{\mathbb{Q}}(\zeta_{q_{k}})$ which sends $h$ to $\left(\chi_{1}(h),\ldots,\chi_{k}(h)\right)$ is a ${\mathbb{Q}}$-algebra isomorphism. Moreover, if we let $B$ be the matrix made of the first $k$ rows of the character matrix $A$, then for $h=\sum_{i=1}^{n}h_{i}g_{i}$, we have $\phi(h)=(c_{1},\ldots,c_{k})$, where

[TABLE]

Finally, if $(c_{1},\ldots,c_{k})\in{\mathbb{Q}}(\zeta_{q_{1}})\oplus\cdots\oplus{\mathbb{Q}}(\zeta_{q_{k}})$, we let $c_{i}=\sigma_{i}(c_{k_{i}})$ for all $i$ with $k<i\leq n$, and we have $\phi^{-1}((c_{1},\ldots,c_{k}))=\sum_{i=1}^{n}h_{i}g_{i}$, where

[TABLE]

At last, we consider the integral case, by restricting the map defined on ${\mathbb{Q}}G$, and we obtain:

Proposition 3.4**.**

The restriction of $\phi$ to ${\mathbb{Z}}G$ gives a ${\mathbb{Z}}$–algebra homomorphism

[TABLE]

which is injective. If $h=\sum_{i=1}^{n}h_{i}g_{i}$, then $\psi(h)=(c_{1},\ldots,c_{k})$, where $(c_{1},\ldots,c_{k})$ is given by (3.3). If $(c_{1},\ldots,c_{k})\in\psi({\mathbb{Z}}G)$, then $\psi^{-1}((c_{1},\ldots,c_{k}))=\sum_{i=1}^{n}h_{i}g_{i}$, where $(h_{1},\ldots,h_{n})$ is given by (3.4).

Proof.

If $\chi_{j}$ is an irreducible character of $G$ and $a_{1},\ldots,a_{n}\in{\mathbb{Z}}$, then

[TABLE]

This shows that the restriction of $\phi$ to ${\mathbb{Z}}G$ defines an algebra homomorphism from ${\mathbb{Z}}G$ into ${\mathbb{Z}}[\zeta_{q_{1}}]\oplus\cdots\oplus{\mathbb{Z}}[\zeta_{q_{k}}]$. The other claims follows from Proposition 3.3. ∎

We remark that the homomorphism $\psi$ is not surjective.

4. Ideals in products of integral domains

In the next section we are going to exploit Theorem 2.2 and Proposition 3.4 in order to give an explicit algorithm to find a normal integral basis of $L$. Here we state some other preliminary results.

Since it is quite difficult to work in ${\mathbb{Z}}[G]$, we will consider the extension of the ideal $I$ by means of the homomorphism $\psi$. Then we would like to recover a generator of $I$ starting from a generator of such an extended ideal, whenever they exist.

We first state a simple lemma about product of rings. If $\Gamma$ is any ring, we denote its group of units by $U(\Gamma)$.

Lemma 4.1**.**

Let $\Gamma$ be commutative ring which can be expressed as a direct product $\Gamma=\Gamma_{1}\times\cdots\times\Gamma_{k}$ of some rings $\Gamma_{i}$, where $i=1,\ldots,k$.

• •

Any ideal $J$ of $\Gamma$ has the form $J=J_{1}\times\cdots\times J_{k}$, where $J_{i}$ is an ideal of $\Gamma_{i}$.

• •

An ideal $J$ of $\Gamma$ is principal if and only if $J_{i}$ is principal, for all $i$; in such a case, if $J=a\Gamma$ with $a=(a_{1},\ldots,a_{k})\in\Gamma$, then $J_{i}=a_{i}\Gamma_{i}$.

• •

If each $\Gamma_{i}$ is an integral domain and $a,b\in\Gamma$, then $a\Gamma=b\Gamma$ if and only if there is a $u\in U(\Gamma)$ such that $a=ub$.

• •

$u\in U(\Gamma)$* if and only if $u=(u_{1},\ldots,u_{k})$, with $u_{i}\in U(\Gamma_{i})$.*

Now we let $\Gamma={\mathbb{Z}}[\zeta_{q_{1}}]\times\cdots\times{\mathbb{Z}}[\zeta_{q_{k}}]$ and $J=\psi(I)\Gamma$, where $I$ is defined by (2.3), and apply the previous lemma to them. The next result explains how we can recover a generator of $I$, when it exists.

Proposition 4.2**.**

Let $I$ be a principal ideal of ${\mathbb{Z}}[G]$, $I=t{\mathbb{Z}}[G]$, and let $J=\psi(I)\Gamma$. Then $J$ is principal, and if $J=d\Gamma$, then $t=\psi^{-1}(ud)$, for some $u\in U(\Gamma)$.

Proof.

It is obvious that $J$ is principal, since $J=\psi(t)\Gamma$. If $J=\Gamma d$, Lemma 4.1 implies that $\psi(t)=ud$, for some $u\in U(\Gamma)$, whence the result. ∎

The proof of the following proposition is easy.

Proposition 4.3**.**

Let $S$ be a set of coset representatives of $U({\mathbb{Z}}G)$ in $U(\Gamma)$. Let $I$ a principal ideal of ${\mathbb{Z}}[G]$, $I=t{\mathbb{Z}}[G]$, and let $J=\psi(I)\Gamma$. Then $J$ is principal, and if $J=d\Gamma$, then $t=\psi^{-1}(ud)$, for some $u\in S$.

5. Outline of the algorithm

Let us assume that $L$ is an abelian number field of degree $n$ with Galois group $G$, and that $L$ it is described by giving the minimal polynomial $m(x)$ of an integral primitive element $\alpha$, which generates a normal basis for $L/{\mathbb{Q}}$. We assume that the Galois group $G$ has been computed, that we know the action of its elements on $\alpha$, and that we have fixed an ordering of them, say $\left(g_{1},\ldots,g_{n}\right)$. We assume also that an integral basis of $\mathcal{O}$ has been computed, and that we have fixed an ordering of its elements, say $\left(\beta_{1},\ldots,\beta_{n}\right)$.

We first compute the discriminant $D$ of the conjugates of $\alpha$, and determine $\alpha^{\prime}:=\alpha/D$. We then compute the matrix $(b_{ij})$ defined by (2.1).

Then we fix an ordering of the irreducible characters $\chi_{i}$ of $G$, take note of their orders $q_{i}$, and compute the character matrix $A:=(\chi_{i}(g_{j}))$. We reorder the characters and extract the matrix $B$ from $A$, as is described in Proposition 3.3.

Next, we compute the ideal $J:=\psi(I)R$, which is generated over $R$ by $\psi(b_{1})$, $\ldots$, $\psi(b_{n})$. This is done by applying (3.3). Namely, for $j=1,\ldots,n$, if

[TABLE]

then $\psi(b_{j})=(c_{1,j},\ldots,c_{k,j})$, where

[TABLE]

Then, for each $i=1,\ldots,k$, we let $J_{i}$ be the ideal of ${\mathbb{Z}}[\zeta_{q_{i}}]$ generated by the set $\left\{c_{i,1},\ldots,c_{i,n}\right\}$ - in other words, the ideal $J_{i}$ is generated by the $i$-th row of the matrix $(b_{ij})\cdot B$.

Next we must find, for each $i=1,\ldots,k$, a generator $d_{i}$ of the ideal $J_{i}$, whenever it exists. For this purpose we use the Sage function is_principal which returns True if the ideal $J_{i}$ is principal, followed by the function gens_reduced which expresses $J_{i}$ in terms of at most two generators, and one if possible.

Now, note that if an irreducible character $\chi_{i}$ maps $I$ into $J_{i}$ and $\sigma$ is an automorphism of ${\mathbb{Q}}(\zeta_{q_{i}})$, where $i=1,\dots,k$, then:

• •

$\sigma(\chi_{i})$ maps $I$ into $\sigma(J_{i})$;

• •

if $d_{i}$ is a generator of $J_{i}$ then $\sigma(d_{i})$ is a generator of $\sigma(J_{i})$.

Therefore the remaining elements $d_{k+1},\ldots,d_{n}$ are obtained by applying to each $d_{i}$ all the non–trivial automorphisms of ${\mathbb{Q}}(\zeta_{q_{i}})$, where $i=1,\ldots,k$.

Now, Lemma 4.1 tells us that the element $d:=(d_{1},\ldots,d_{n})$ generates $J$. We put $t:=\psi^{-1}(d)$. In order to recover the standard form of $t$ we just apply (3.4). Hence,

[TABLE]

where

[TABLE]

Let us point out that all these computations are done in ${\mathbb{Q}}(\zeta_{r})$, where $r$ is the exponent of $G$. Now we let $\theta:=t\alpha^{\prime}$, and we compute the discriminant of $\{g_{1}\theta,\ldots,g_{n}\theta\}$.

If $\mathrm{D}(g_{1}\theta,\ldots,g_{n}\theta)$ equals the discriminant of $L$ *and * $\theta$ is an algebraic integer then $\theta$ generates a normal integral basis.

Otherwise, we ‘adjust’ $d$ by multiplying it by a suitable unit $u\in S$, and then we repeat the last matrix multiplication. Precisely, we first multiply the element $(d_{1},\ldots,d_{k})$ by a unit $u=(u_{1},\ldots,u_{k})\in S$, then we obtain the remaining elements $d_{k+1},\ldots,d_{n}$ by applying to each $d_{i}$ all the non–trivial automorphisms of ${\mathbb{Q}}(\zeta_{q_{i}})$, where $i=1,\ldots,k$, and finally we apply again formula (5.4). In this way, we obtain a new $\theta$ and we have now to verify whether $\mathrm{D}(g_{1}\theta,\ldots,g_{n}\theta)$ equals the discriminant of $L$ *and * it is an algebraic integer or not.

The process must terminate after a finite number of steps, since the cardinality of $S$, i.e. the index $(U(\Gamma):U({\mathbb{Z}}G))$ is finite. Furthermore, Proposition 4.2 implies that we will surely find a normal basis generator in one of these steps, if it exists.

6. Computation of the set $S$

Our task is to compute efficiently a set $S$ of coset representatives of $U({\mathbb{Z}}G)$ in $U(\Gamma)$.

This task could be accomplished, for example, by first computing $U(\Gamma)$ using standard algorithms in algebraic number theory, then computing $U({\mathbb{Z}}G)$ by means of the algorithm designed by P. Faccin [6, 2.5], and, finally, computing the sought set of coset representatives. However, the computational effort involved by this method is not justified in this context.

So, we have to revert to a different method. E. Teske [14] and, later, J. Buchmann and A. Schmidt [4] developed some efficient algorithms allowing one to compute the structure of an unknown finite abelian group $X$, i.e. its invariant factors, assuming that a set $V$ of generators is given, and that for $a,b\in X$ it is possible to compute their product, it is possible to compute $a^{-1}$, and it is possible to test the equality $a=b$. Buchmann’s algorithm requires $O(|V|\sqrt{|X|})$ group operations and stores $O(\sqrt{|X|})$ group elements. Once we have expressed $X$ as a direct product of cyclic invariant factors we can list easily all its elements, in $O(|X|)$ time.

In our case $X=U(\Gamma)/U({\mathbb{Z}}G)$. Now, we know a set $V$ of generators of $U(\Gamma)$ (they can be computed in Sage for each $\Gamma_{i}$ using the function UnitGroup). We define the product of two elements $a,b\in U(\Gamma)$ as their ordinary product in $\Gamma$. We define the inverse of an element $a\in U(\Gamma)$ as its ordinary inverse in $\Gamma$. Finally, we decreed two elements $a$ and $b$ to be equal whenever they are congruent modulo $U({\mathbb{Z}}G)$. To test if two elements of $U(\Gamma)$ are congruent modulo $U({\mathbb{Z}}G)$, we must divide $a$ by $b$, and the result must be in $U({\mathbb{Z}}G)$; but this is equivalent to say that $a/b$ lies in ${\mathbb{Z}}G$, since both $a$ and $b$ are units of $\Gamma$, and thus $a/b$ is a unit of $\Gamma$ lying in ${\mathbb{Z}}G$.

As far as it concerns $|X|$, we have the following estimate proved in [1]:

Theorem 6.1**.**

Let $G$ be a finite abelian group of order $n$. If $a_{q}$ stands for the number of cyclic subgroups of order $q$ of $G$, then:

[TABLE]

7. Some worked out examples

We computed the following examples with the public domain computer algebra system SAGE [13]. Unfortunately, the current version of Sage does not allow one to compute Galois groups of fields of degree greater than 11 natively, i.e. without installing extra packages.

Example 7.1**.**

Consider the polynomial $x^{12}+8*x^{11}-837*x^{10}-98016*x^{9}-9093374*x^{8}+971323080*x^{7}+88039800038*x^{6}+3042444275430*x^{5}+67073014243125*x^{4}-3252703653719588*x^{3}-94326521098073965*x^{2}+3079043710339656342*x+75641678543561531059$. The discriminant of its splitting field $L$ is $205924456521$. A generator of a normal integral basis exists in this case, and its minimal polynomial is $x^{12}-x^{11}+x^{9}-x^{8}+x^{6}-x^{4}+x^{3}-x+1$, which ’resembles’ the 13-th cyclotomic polynomial $x^{12}+x^{11}+x^{10}+x^{9}+x^{8}+x^{7}+x^{6}+x^{5}+x^{4}+x^{3}+x^{2}+x+1$.

Example 7.2**.**

Consider the polynomial $x^{8}+20*x^{7}+800*x^{6}+12485*x^{5}+235045*x^{4}+2387800*x^{3}+24032600*x^{2}-34407800*x+62712400$. The discriminant of its splitting field $L$ is 1265625. A generator of a normal integral basis exists in this case, and its minimal polynomial is $x^{8}+x^{7}-x^{5}-x^{4}-x^{3}+x+1$, which ’resembles’ the 15-th cyclotomic polynomial $x^{8}-x^{7}+x^{5}-x^{4}+x^{3}-x+1$.