Efficiently factoring polynomials modulo $p^4$

TL;DR

This paper introduces the first randomized polynomial-time algorithm for factoring univariate polynomials modulo prime powers up to p^4, solving an open problem and extending Hensel lifting techniques.

Contribution

It presents a novel randomized algorithm for factoring polynomials modulo p^k for k ≤ 4, reducing the problem to root finding and generalizing Hensel lifting to handle repeated factors.

Findings

First randomized polynomial-time algorithm for p^4

Reduction of factoring to root finding in related polynomials

Generalization of Hensel lifting for repeated factors

Abstract

Polynomial factoring has famous practical algorithms over fields-- finite, rational \& $p$-adic. However, modulo prime powers it gets hard as there is non-unique factorization and a combinatorial blowup ensues. For example, $x^2+p \bmod p^2$ is irreducible, but $x^2+px \bmod p^2$ has exponentially many factors! We present the first randomized poly(deg $f, \log p$) time algorithm to factor a given univariate integral $f(x)$ modulo $p^k$, for a prime $p$ and $k \leq 4$. Thus, we solve the open question of factoring modulo $p^3$ posed in (Sircana, ISSAC'17). Our method reduces the general problem of factoring $f(x) \bmod p^k$ to that of {\em root finding} in a related polynomial $E(y) \bmod\langle p^k, \varphi(x)^\ell \rangle$ for some irreducible $\varphi \bmod p$. We could efficiently solve the latter for $k\le4$, by incrementally transforming $E(y)$. Moreover, we discover an efficient and strong generalization of Hensel lifting to lift factors of $f(x) \bmod p$ to those $\bmod\ p^4$ (if possible). This was previously unknown, as the case of repeated factors of $f(x) \bmod p$ forbids classical Hensel lifting.

Equations

$$S_y=\{y_0+\dots +p^i{y}_i+p^{i+1}{y}_{i+1}+\dots +p^{k-1}{y}_{k-1}\mid \forall y_{i+1},\dots ,y_{k-1}\in R/⟨p⟩\}.$$

$$S_y=\{y_0+\dots +{\phi }^i{y}_i+{\phi }^{i+1}{y}_{i+1}+\dots +{\phi }^{k-1}{y}_{k-1}\mid \forall y_{i+1},\dots ,y_{k-1}\in R/⟨\phi ⟩\}.$$

$$I:J:=\{a\in R\mid aJ\subseteq I\}.$$

$$p^{i}c=c_1{p}^l+c_2{p}^i{\phi }^m\in I\Rightarrow c\in I:⟨p^i⟩.$$

$$E(y):=f(x)({\phi }^{a(k-1)}+{\phi }^{a(k-2)}(py)+\dots +{\phi }^a(py{)}^{k-2}+(py{)}^{k-1}).$$

$$E(y)=f(x)({\phi }^{a(k-1)}+{\phi }^{a(k-2)}(py)+\dots +{\phi }^a(py{)}^{k-2}+(py{)}^{k-1})\equiv 0\mathrm{mod}⟨p^k,{\phi }^{ak}⟩.$$

$$({\phi }^a-py)((f/{\phi }^{ak}){\Sigma }_{i=0}^{k-1}{\phi }^{a(k-1-i)}(py{)}^i)\equiv (f/{\phi }^{ak})({\phi }^{ak}-(py{)}^k)\equiv f\cdot {\phi }^{ak}/{\phi }^{ak}\equiv f\mathrm{mod}{p}^k.$$

$$f(x)=h(x)g(x)\text{ and }f(x)=h(x)(E(y)/{\phi }^{ak}).$$

$$h(x)\left(g(x)-(E(y)/{\phi }^{ak})\right)=0.$$

$$f({\phi }^{3a}+{\phi }^{2a}(py)+{\phi }^a(py{)}^2+(py{)}^3)\equiv 0\mathrm{mod}⟨p^4,{\phi }^{4a}⟩.$$

$$f({\phi }^{3a}+{\phi }^{2a}p(y_0+p{y}_1)+{\phi }^a{p}^2(y_0^2+2p{y}_0{y}_1)+(p{y}_0{)}^3)\equiv 0\mathrm{mod}⟨p^4,{\phi }^{4a}⟩.$$

$$E((a_0+{\phi }^{i_0}{y}_0)+p{y}_1)=p^3{E}^{\prime }(y_0,y_1)\mathrm{mod}⟨p^4,{\phi }^{4a}⟩$$

$$f{\phi }^{2a}({\phi }^a+p{y}_0)\equiv 0\mathrm{mod}⟨p^2,{\phi }^{4a}⟩.$$

$$h_1\equiv 0\mathrm{mod}⟨p,{\phi }^a⟩,$$

$$({\phi }^e+p{h}_1)({\phi }^{3a}+{\phi }^{2a}p{y}_0+{\phi }^a{p}^2{y}_o^2)\equiv 0\mathrm{mod}⟨p^3,{\phi }^{4a}⟩.$$

$${\phi }^{e+a}{p}^2{y}_0^2+{\phi }^{3a}p{h}_1+{\phi }^{2a}{p}^2{h}_1{y}_0\equiv 0\mathrm{mod}⟨p^3,{\phi }^{4a}⟩.$$

$$p^2\left({\phi }^{e+a}{y}_0^2+{\phi }^{3a}{h}_{1,2}{y}_0+{\phi }^{3a}{h}_{1,1}\right)\equiv 0\mathrm{mod}⟨p^3,{\phi }^{4a}⟩.$$

$$E(y)\equiv 0\mathrm{mod}⟨p^3,{\phi }^{4a}⟩.$$

$$E(a_0+{\phi }^{i_0}{y}_0+p{y}_1)\equiv p^3{E}^{\prime }(y_0,y_1)\mathrm{mod}⟨p^4,{\phi }^{4a}⟩,$$

$$E_1(b+{\phi }^i{y}_0)\equiv E_2(b+{\phi }^i{y}_0)\equiv 0\mathrm{mod}⟨p,{\phi }^r⟩.$$

$$E_2(b+{\phi }^i(\theta +\phi y_0))\equiv 0\mathrm{mod}⟨p,{\phi }^{r+1}⟩.$$

$$z_1\equiv {\tilde{z}}_1:=-(C(y_0)/L(y_0))\mathrm{mod}⟨p,{\phi }^{4a-r}⟩.$$

$$f=g^{\ast }{h}^{\ast }\mathrm{mod}{\mathcal{I}}^l\text{ (called emlift of the factorization) }$$

$$y=y_0+\phi y_1+{\phi }^2{y}_2+\dots +{\phi }^{i-1}{y}_{i-1},$$

$$f(x)\equiv \prod _{i=1}^n{f}_i(x)\equiv \prod _{i=1}^n({\phi }_i^{e_i}+p{h}_i)\mathrm{mod}{p}^3$$

$$E(y)\equiv f(x)({\phi }^{2a}+{\phi }^a(py)+(py{)}^2)\equiv 0\mathrm{mod}⟨p^3,{\phi }^{3a}⟩.$$

$$E(y)\equiv p^2{g}_2{\phi }^{2a}+(p^2{g}_1{\phi }^{2a})y_0+(p^2{\phi }^e)y_0^2\equiv 0\mathrm{mod}⟨p^3,{\phi }^{3a}⟩,$$

$$g_2+g_1{y}_0+{\phi }^{e-2a}{y}_0^2\equiv 0\mathrm{mod}⟨p,{\phi }^a⟩.$$

$$E(y):=f(x)({\phi }^{4a}+{\phi }^{3a}(py)+{\phi }^{2a}(py{)}^2+{\phi }^a(py{)}^3+(py{)}^4)\equiv 0\mathrm{mod}⟨p^5,{\phi }^{5a}⟩$$

$$E(y)=:E_1(y_0)+E_2(y_0)y_1+E_3(y_0)y_2+(f{\phi }^{2a}{p}^4)y_1^2\equiv 0\mathrm{mod}⟨p^5,{\phi }^{5a}⟩,$$

Full text

Our method reduces the general problem of factoring $f(x)\bmod p^{k}$ to that of root finding in a related polynomial $E(y)\bmod\langle p^{k},\varphi(x)^{\ell}\rangle$ for some irreducible $\varphi\bmod p$. We could efficiently solve the latter for $k\leq 4$, by incrementally transforming $E(y)$. Moreover, we discover an efficient and strong generalization of Hensel lifting to lift factors of $f(x)\bmod p$ to those $\bmod\ p^{4}$ (if possible). This was previously unknown, as the case of repeated factors of $f(x)\bmod p$ forbids classical Hensel lifting.

2012 ACM CCS concept: Theory of computation– Algebraic complexity theory, Problems, reductions and completeness; Computing methodologies– Algebraic algorithms, Hybrid symbolic-numeric methods; Mathematics of computing– Number-theoretic computations.

Keywords: efficient, randomized, factor, local ring, prime-power, Hensel lift, roots, p-adic.

1 Introduction

Polynomial factorization is a fundamental question in mathematics and computing. In the last decades, quite efficient algorithms have been invented for various fields, e.g., over rationals [LLL82], number fields [Lan85], finite fields [Ber67, CZ81, KU11], $p$-adic fields [Chi87, CG00], etc. Being a problem of huge theoretical and practical importance, it has been very well studied; for more background refer to surveys, e.g., [Kal92, vzGP01, FS15].

The same question over composite characteristic rings is believed to be computationally hard, e.g. it is related to integer factoring [Sha93, Kli97]. What is less understood is factorization over a local ring; especially, ones that are the residue class rings of $\mathbb{Z}$ or $\mathbb{F}_{q}[z]$. A natural variant is as follows.

Problem: Given a univariate integral polynomial $f(x)$ and a prime power $p^{k}$, with $p$ prime and $k\in\mathbb{N}$; output a nontrivial factor of $f\bmod p^{k}$ in randomized poly($\deg f,k\log p$) time.

Note that the polynomial ring $(\mathbb{Z}/\langle p^{k}\rangle)[x]$ is not a unique factorization domain. So $f(x)$ may have many, usually exponentially many, factorizations. For example, $x^{2}+px$ has an irreducible factor $x+\alpha p\bmod p^{2}$ for each $\alpha\in[p]$ and so $x^{2}+px$ has exponentially many (wrt $\log p$) irreducible factors modulo $p^{2}$. This leads to a total breakdown in the classical factoring methods.

We give the first randomized polynomial time algorithm to non-trivially factor (or test for irreducibility) a polynomial $f(x)\bmod p^{k}$, for $k\leq 4$.

Additionally, when $f\bmod p$ is power of an irreducible, we provide (& count) all the lifts $\bmod\ p^{k}$ ($k\leq 4$) of any factor of $f\bmod p$, in randomized polynomial time.

Usually, one factors $f(x)\bmod p$ and tries to “lift” this factorization to higher powers of $p$. If the former is a coprime factorization then Hensel lifting [Hen18] helps us in finding a non-trivial factorization of $f(x)\bmod p^{k}$ for any $k$. But, when $f(x)\bmod p$ is power of an irreducible then it is not known how to lift to some factorization of $f(x)\bmod p^{k}$. To illustrate the difficulty let us see some examples (also see [vzGH96]).

Example. [coprime factor case] Let $f(x)=x^{2}+10x+21$. Then $f\equiv x(x+1)\bmod 3$ and Hensel lemma lifts this factorization uniquely mod $3^{2}$ as $f(x)\equiv(x+1\cdot 3)(x+1+2\cdot 3)\equiv(x+3)(x+7)\bmod 9$. This lifting extends to any power of $3$.

Example. [power of an irreducible case] Let $f(x)=x^{3}+12x^{2}+3x+36$ and we want to factor it mod $3^{3}$. Clearly, $f\equiv x^{3}\bmod 3$. By brute force one checks that, the factorization $f\equiv x\cdot x^{2}\bmod 3$ lifts to factorizations mod $3^{2}$ as: $x(x^{2}+3x+3)$, $(x+6)(x^{2}+6x+3)$, $(x+3)(x^{2}+3)$. Only the last one lifts to mod $3^{3}$ as: $(x+3)(x^{2}+9x+3),(x+12)(x^{2}+3),(x+21)(x^{2}+18x+3)$.

So the big issue is: efficiently determine which factorization out of the exponentially many factorizations mod $p^{j}$ will lift to mod $p^{j+1}$?

1.1 Previously known results

Using Hensel lemma it is easy to find a non-trivial factor of $f\bmod p^{k}$ when $f\bmod p$ has two coprime factors. So the hard case is when $f\bmod p$ is power of an irreducible polynomial. The first resolution in this case was achieved by [vzGH98] assuming that $k$ is “large”. They assumed $k$ to be larger than the maximum power of $p$ dividing the discriminant of the integral $f$. Under this assumption (i.e. $k$ is large), they showed that factorization modulo $p^{k}$ is well behaved and it corresponds to the unique $p$-adic factorization of $f$ (refer $p$-adic factoring [Chi87, Chi94, CG00]). To show this, they used an extended version of Hensel lifting (also discussed in [BS86]). Using this observation they could also describe all the factorizations modulo $p^{k}$, in a compact data structure. The complexity of [vzGH98] was improved by [CL01].

The related questions of root finding and root counting of $f\bmod p^{k}$ are also of classical interest, see [NZM13, Apo13]. A recent result by [BLQ13, Cor.24] resolves these problems in randomized polynomial time. Again, it describes all the roots modulo $p^{k}$, in a compact data structure.

Root counting has interesting applications in arithmetic algebraic-geometry, eg. to compute Igusa zeta function of a univariate integral polynomial [ZG03, DH01]. Partial derandomization of root counting algorithm has been obtained by [CGRW18, KRRZ18] last year; however, a deterministic poly-time algorithm is still unknown.

Going back to factoring $f\bmod p^{k}$, [vzGH96] discusses the hurdles when $k$ is small. The factors could be completely unrelated to the corresponding $p$-adic factorization, since an irreducible $p$-adic polynomial could reduce mod $p^{k}$ when $k$ is small. We give an example from [vzGH96].

Example. Polynomial $f(x)=x^{2}+3^{k}$ is irreducible over $\mathbb{Z}/\langle 3^{k+1}\rangle$ and so over $3$-adic field. But, it is reducible mod $3^{k}$ as $f\equiv x^{2}\bmod 3^{k}$.

They also discussed that the distinct factorizations are completely different and not nicely related, unlike the case when $k$ is large. An example taken from [vzGH96] is,

Example. $f=(x^{2}+243)(x^{2}+6)$ is an irreducible factorization over $\mathbb{Z}/\langle 3^{6}\rangle$. There is another completely unrelated factorization $f=(x+351)(x+135)(x^{2}+243x+249)\bmod 3^{6}$.

Many researchers tried to solve special cases, especially when $k$ is constant. The only successful factoring algorithm is by [Săl05] over $\mathbb{Z}/\langle p^{2}\rangle$; it is actually related to Eisenstein criterion for irreducible polynomials. The next case, to factor modulo $p^{3}$, is unsolved and was recently highlighted in [Sir17].

1.2 Our results

We saw that even after the attempts of last two decades we do not have an efficient algorithm for factoring mod $p^{3}$. Naturally, we would like to first understand the difficulty of the problem when $k$ is constant. In this direction we make significant progress by devising a unified method which solves the problem when $k=2,3$ or $4$ (and sketch the obstructions we face when $k\geq 5$). Our first result is,

Theorem 1**.**

Let $p$ be prime, $k\leq 4$ and $f(x)$ be a univariate integral polynomial. Then, $f(x)\bmod p^{k}$ can be factored (& tested for irreducibility) in randomized poly($\deg f,\log p$) time.

Remarks. 1) The procedure to factorize $f\bmod p^{4}$ also factorizes $f\bmod p^{3}$ and $f\bmod p^{2}$ (and tests for irreducibility) in randomized poly($\deg f,\log p$) time. This solves the open question of efficiently factoring $f\bmod p^{3}$ [Sir17] and gives a more general proof for factoring $f\bmod p^{2}$ than the one in [Săl05].

2) Our method can as well be used to factor a ‘univariate’ polynomial $f\in\left(\mathbb{F}_{p}[z]/\langle\psi^{k}\rangle\right)[x]$, for $k\leq 4$ and irreducible $\psi(z)\bmod p$, in randomized poly($\deg f,\deg\psi,\log p$) time.

Next, we do more than just factoring $f$ modulo $p^{k}$ for $k\leq 4$. It is well known that Hensel lemma efficiently gives two (unique) coprime factors of $f(x)$ modulo any prime power $p^{k}$, given two coprime factors of $f\bmod p$; but it fails to lift when $f$ is power of an irreducible polynomial modulo $p$. We show that our method works in this case to give all the lifts $g(x)\bmod p^{k}$ (possibly exponentially many) of any given factor $\tilde{g}$ of $f\bmod p$, for $k\leq 4$.

Theorem 2**.**

Let $p$ be prime, $k\leq 4$ and $f(x)$ be a univariate integral polynomial such that $f\bmod p$ is a power of an irreducible polynomial. Let $\tilde{g}$ be a given factor of $f\bmod p$. Then, in randomized poly($\deg f,\log p$) time, we can compactly describe (& count) all possible factors of $f(x)\bmod p^{k}$ which are lifts of $\tilde{g}$ (or report that there is none).

Remark. Theorem 2 can be seen as a significant generalization of Hensel lifting method (Lemma 16) to $\mathbb{Z}/\langle p^{k}\rangle$, $k\leq 4$. To lift a factor $f_{1}$ of $f\bmod p$, Hensel lemma relies on a cofactor $f_{2}$ which is coprime to $f_{1}$. Our method needs no such assumption and it directly lifts a factor $\tilde{g}$ of $f\bmod p$ to (possibly exponentially many) factors $g(x)\bmod p^{k}$.

1.3 Proof technique– Root finding over local rings

Our proof involves two main techniques which may be of general interest.

Technique 1: Known factoring methods $\bmod\ p$ work by first reducing the problem to that of root finding $\bmod\ p$. In this work, we efficiently reduce the problem of factoring $f(x)$ modulo the principal ideal $\langle p^{k}\rangle$ to that of finding roots of some polynomial $E(y)\in(\mathbb{Z}[x])[y]$ modulo a bi-generated ideal $\langle p^{k},\varphi(x)^{\ell}\rangle$, where $\varphi(x)$ is an irreducible factor of $f(x)\bmod p$. This technique works for all $k\geq 1$.

Technique 2: Next, we find a root of the equation $E(y)\equiv 0\bmod\langle p^{k},\varphi(x)^{\ell}\rangle$, assuming $k\leq 4$. With the help of the special structure of $E(y)$ we will efficiently find all the roots $y$ (possibly exponentially many) in the local ring $\mathbb{Z}[x]/\langle p^{k},\varphi(x)^{\ell}\rangle$.

It remains open whether this technique extends to $k=5$ and beyond (even to find a single root of the equation). The possibility of future extensions of our technique is discussed in Appendix D.

1.4 Proof overview

Proof idea of Theorem 1: Firstly, assume that the given degree $d$ integral polynomial $f$ satisfies $f(x)\equiv\varphi^{e}\bmod p$ for some $\varphi(x)\in\mathbb{Z}[x]$ which is irreducible mod $p$. Otherwise, using Hensel lemma (Lemma 16) we can efficiently factor $f\bmod p^{k}$.

Any factor of such an $f\bmod p^{k}$ must be of the form $(\varphi^{a}-py)\bmod p^{k}$, for some $1\leq a<e$ and $y\in(\mathbb{Z}/\langle p^{k}\rangle)[x]$. In Theorem 8, we first reduce the problem of finding such a factor $(\varphi^{a}-py)$ of $f\bmod p^{k}$ to finding roots of some $E(y)\in(\mathbb{Z}[x])[y]$ in the local ring $\mathbb{Z}[x]/\langle p^{k},\varphi^{ak}\rangle$. This is inspired by the $p$-adic power series expansion of the quotient $f/(\varphi^{a}-py)$. On going $\bmod\ p^{k}$ we get a polynomial in $y$ of degree $(k-1)$; which we want to be divisible by $\varphi^{ak}$.

The root $y$ of $E(y)\bmod\langle p^{k},\varphi^{ak}\rangle$ can be further decomposed into coordinates $y_{0},y_{1},\ldots$, $y_{k-1}\in\mathbb{F}_{p}[x]/\langle\varphi^{ak}\rangle$ such that $y=:y_{0}+py_{1}+\ldots+p^{k-1}y_{k-1}\bmod\langle p^{k},\varphi^{ak}\rangle$. When we take $k=4$, it turns out that the root $y$ only depends on the coordinates $y_{0}$ and $y_{1}$ (i.e. $y_{2},y_{3}$ can be picked arbitrarily).

Next, we reduce the problem of root finding of $E(y_{0}+py_{1})$ in the ring $\mathbb{Z}[x]/\langle p^{4},\varphi^{4a}\rangle$ to root finding in characteristic $p$; of some $E^{\prime}(y_{0},y_{1})$ in the ring $\mathbb{F}_{p}[x]/\langle\varphi^{4a}\rangle$ (Lemma 11). We take help of a subroutine Root-Find given by [BLQ13] which can efficiently find all the roots of a univariate $g(y)$ in the ring $\mathbb{Z}/\langle p^{j}\rangle$. We need a slightly generalized version of it, to find all the roots of a given $g(y)$ in the ring $\mathbb{F}_{p}[x]/\langle\varphi(x)^{j}\rangle$ (Appendix B).

Note that $y_{0},y_{1}$ are in the ring $\mathbb{F}_{p}[x]/\langle\varphi^{4a}\rangle$ and so they can be decomposed as $y_{0}=:y_{0,0}+\varphi y_{0,1}+\ldots+\varphi^{4a-1}y_{0,4a-1}$ and $y_{1}=:y_{1,0}+\varphi y_{1,1}+\ldots+\varphi^{4a-1}y_{1,4a-1}$, with all $y_{i,j}$’s in the field $\mathbb{F}_{p}[x]/\langle\varphi\rangle$.

To get $E^{\prime}(y_{0},y_{1})\bmod\langle p,\varphi^{4a}\rangle$ the idea is: to first divide by $p^{2}$, and then to go modulo the ideal $\langle p,\varphi^{4a}\rangle$. Apply Algorithm Root-Find to solve $E(y_{0}+py_{1})/p^{2}\equiv 0\bmod\langle p,\varphi^{4a}\rangle$. This allows us to fix some part of $y_{0}$, say $a_{0}\in\mathbb{F}_{p}/\langle\varphi^{4a}\rangle$, and we can replace it by $a_{0}+\varphi^{i_{0}}y_{0}$, $i_{0}\geq 1$. Thus, $p^{3}|E(a_{0}+\varphi^{i_{0}}y_{0}+py_{1})\bmod\langle p^{4},\varphi^{4a}\rangle$ and we divide out by this $p^{3}$ (& change the modulus to $\langle p,\varphi^{4a}\rangle$). In Lemma 11 we show that when we go modulo the ideal $\langle p,\varphi^{4a}\rangle$ (to find $a_{0}$), we only need to solve a univariate in $y_{0}$ using Root-Find. So, we only need to fix some part of $y_{0}$, that we called $a_{0}$, and $y_{1}$ is irrelevant. Finally, we get $E^{\prime}(y_{0},y_{1})$ such that $E^{\prime}(y_{0},y_{1}):=E(a_{0}+\varphi^{i_{0}}y_{0}+py_{1})/p^{3}\bmod\langle p,\varphi^{4a}\rangle$. Importantly, the process yields at most two possibilities of $E^{\prime}$ (resp. $a_{0}$) to deal with.

Lemma 11 also shows that the bivariate $E^{\prime}(y_{0},y_{1})$ is a special one of the form $E^{\prime}(y_{0},y_{1})\equiv E_{1}(y_{0})+E_{2}(y_{0})y_{1}\bmod\langle p,\varphi^{4a}\rangle$, where $E_{1}(y_{0})\in(\mathbb{F}_{p}[x]/\langle\varphi^{4a}\rangle)[y_{0}]$ is a cubic univariate polynomial and $E_{2}(y_{0})\in(\mathbb{F}_{p}[x]/\langle\varphi^{4a}\rangle)[y_{0}]$ is a linear univariate polynomial. We exploit this special structure to represent $y_{1}$ as a rational function of $y_{0}$, i.e. $y_{1}\equiv-E_{1}(y_{0})/E_{2}(y_{0})\bmod\langle p,\varphi^{4a}\rangle$. The important issue is that, we can calculate $y_{1}$ only when on some specialization $y_{0}=a_{0}$, the division by $E_{2}(a_{0})$ is well defined. So what we do is, we guess each value of $0\leq r\leq 4a$ and ensure that the valuation (wrt $\varphi$ powers) of $E_{1}(y_{0})$ is at least $r$ but that of $E_{2}(y_{0})$ is exactly $r$. Once we find such a $y_{0}$, we can efficiently compute $y_{1}$ as $y_{1}\equiv-(E_{1}(y_{0})/\varphi^{r})/(E_{2}(y_{0})/\varphi^{r})\bmod\langle p,\varphi^{4a-r}\rangle$.

To find $y_{0}$, we find common solution of the two equations: $E_{1}(y_{0})\equiv E_{2}(y_{0})\equiv 0\bmod\langle p,\varphi^{r}\rangle$, for each guessed value $r$, using Algorithm Root-Find. Since the polynomial $E_{2}(y_{0})$ is linear, it is easy for us to filter all $y_{0}$’s for which valuation of $E_{2}(y_{0})$ is exactly $r$ (Lemma 13). Thus, we could efficiently find all $(y_{0},y_{1})$ pairs that satisfy the equation $E^{\prime}(y_{0},y_{1})\equiv 0\bmod\langle p,\varphi^{4a}\rangle$.

Proof idea of Theorem 2: If $f\equiv\varphi^{e}\bmod p$ then any lift $g(x)$ of a factor $\tilde{g}(x)\equiv\varphi^{a}\bmod p$ of $f\bmod p$ will be of the form $g\equiv(\varphi^{a}-py)\bmod p^{k}$. So basically we want to find all the $y$’s $\bmod\ p^{k-1}$ that appear in the proof idea of Theorem 1 above. This can be done easily, because Algorithm Root-Find (Appendix B) [BLQ13] describes all possible $y_{0}$’s in a compact data structure. Moreover, using this, a count of all $y$’s could be provided as well.

2 Preliminaries

Let $R(+,.)$ be a ring and $S$ be a non-empty subset of $R$. The product of the set $S$ with a scalar $a\in R$ is defined as $aS:=\{as\mid s\in S\}$. Similarly, the sum of a scalar $u\in R$ with the set $S$ is defined as $u+S:=\{u+s\mid s\in S\}$. Note that the product and the sum operations used inside the set are borrowed from the underlying ring $R$. Also note that if $S$ is the empty set then so are $aS$ and $u+S$ for any $a,u\in R$.

Representatives. The symbol ‘*’ in a ring $R$, wherever appears, denotes all of ring $R$. For example, suppose $R=\mathbb{Z}/\langle p^{k}\rangle$ for a prime $p$ and a positive integer $k$. In this ring, we will use the notation $y=y_{0}+py_{1}+\ldots+p^{i}y_{i}+p^{i+1}*$, where $i+1<k$ and each $y_{j}\in R/\langle p\rangle$, to denote a set $S_{y}\subseteq R$ such that

[TABLE]

Notice that the number of elements in $R$ represented by $y$ is $|S_{y}|=p^{k-i-1}$.

We will sometimes write the set $y=y_{0}+py_{1}+\ldots+p^{i}y_{i}+p^{i+1}*$ succinctly as $y=v+p^{i+1}*$, where $v\in R$ stands for $v=y_{0}+py_{1}+\ldots+p^{i}y_{i}$.

In the following sections, we will add and multiply the set $\{*\}$ with scalars from the ring $R$. Let us define these operations as follows ($*$ is treated as an unknown)

• •

$u+\{*\}:=\{u+*\}$ and $u\{*\}:=\{u*\}$, where $u\in R$.

• •

$c+\{a+{b*}\}=\{(a+c)+{b*}\}$ and $c\{a+{b*}\}=\{ac+{bc*}\}$, where $a,b,c\in R$.

Another important example of the $*$ notation: Let $R=\mathbb{F}_{p}[x]/\langle\varphi(x)^{k}\rangle$ for a prime $p$ and an irreducible $\varphi\bmod p$. In this ring, we use the notation $y=y_{0}+\varphi y_{1}+\ldots+\varphi^{i}y_{i}+\varphi^{i+1}*$, where $i+1<k$ and each $y_{j}\in R/\langle\varphi\rangle$, to denote a set $S_{y}\subseteq R$ such that

[TABLE]

Zerodivisors. Let $R[x]$ be the ring of polynomials over $R=\mathbb{Z}/\langle p^{k}\rangle$. The following lemma about zero divisors in $R[x]$ will be helpful.

Lemma 3**.**

A polynomial $f\in R[x]$ is a zero divisor iff $f\equiv 0\bmod p$. Consequently, for any polynomials $f,g_{1},g_{2}\in R[x]$ and $f\not\equiv 0\bmod p$, $f(x)g_{1}(x)=f(x)g_{2}(x)$ implies $g_{1}(x)=g_{2}(x)$.

Proof.

If $f\equiv 0\bmod p$ then $f(x)p^{k-1}$ is zero, and $f$ is a zero divisor.

For the other direction, let $f\not\equiv 0\bmod p$ and assume $f(x)g(x)=0$ for some non-zero $g\in R[x]$. Let

• •

$i$ be the biggest integer such that the coefficient of $x^{i}$ in $f$ is non-zero modulo $p$,

• •

and $j$ be the biggest integer such that the coefficient of $x^{j}$ in $g$ has minimum valuation with respect to $p$.

Then, the coefficient of $x^{i+j}$ in $f\cdot g$ has same valuation as the coefficient of $x^{j}$ in $g$, implying that the coefficient is nonzero. This contradicts the assumption $f(x)g(x)=0$.

The consequence follows because $f\not\equiv 0\bmod p$ implies that $f$ cannot be a zero divisor. ∎

Quotient ideals. We define the quotient ideal (analogous to division of integers) and look at some of its properties.

Definition 4** (Quotient Ideal).**

Given two ideals $I$ and $J$ of a commutative ring $R$, we define the quotient of $I$ by $J$ as,

[TABLE]

It can be easily verified that $I:J$ is an ideal. Moreover, we can make the following observations about quotient ideals.

Claim 5** (Cancellation).**

Suppose $I$ is an ideal of ring $R$ and $a,b,c$ are three elements in $R$. By definition of quotient ideals, $ca\equiv cb\bmod I$ iff $a\equiv b\bmod I:\langle c\rangle$.

Claim 6**.**

Let $p$ be a prime and $\varphi\in(\mathbb{Z}/\langle p^{k}\rangle)[x]$ be such that $\varphi\not\equiv 0\bmod p$. Given an ideal $I:=\langle p^{l},\phi^{m}\rangle$ of $\mathbb{Z}[x]$,

$I:\langle p^{i}\rangle=\langle p^{l-i},\phi^{m}\rangle$, for $i\leq l$, and 2. 2.

$I:\langle\phi^{j}\rangle=\langle p^{l},\phi^{m-j}\rangle$, for $j\leq m$.

Proof.

We will only prove part $(1)$, as proof of part $(2)$ is similar. If $c\in\langle p^{l-i},\varphi^{m}\rangle$ then there exists $c_{1},c_{2}\in\mathbb{Z}[x]$, such that, $c=c_{1}p^{l-i}+c_{2}\varphi^{m}$. Multiplying by $p^{i}$,

[TABLE]

To prove the reverse direction, if $c\in I:\langle p^{i}\rangle$ then there exists $c_{1},c_{2}\in\mathbb{Z}[x]$, such that, $p^{i}c=c_{1}p^{l}+c_{2}\varphi^{m}$. Since $i\leq l$ and $p\not|\ \varphi$, we know $p^{i}|c_{2}$. So,

$c=c_{1}p^{l-i}+(c_{2}/p^{i})\varphi^{m}\ \Rightarrow\ c\in\langle p^{l-i},\phi^{m}\rangle.$ ∎

Lemma 7** (Compute quotient).**

Given a polynomial $\varphi\in\mathbb{Z}[x]$ not divisible by $p$, define $I$ to be the ideal $\langle p^{l},\phi^{m}\rangle$ of $\mathbb{Z}[x]$. If $g(y)\in(\mathbb{Z}[x])[y]$ is a polynomial such that $g(y)\equiv 0\bmod\langle p,\phi^{m}\rangle$, then $p|g(y)\bmod I$ and $g(y)/p\bmod I:\langle p\rangle$ is efficiently computable.

Proof.

The equation $g(y)\equiv 0\bmod\langle p,\phi^{m}\rangle$ implies $g(y)=pc_{1}(y)+\varphi^{m}c_{2}(y)$ for some polynomials $c_{1}(y),c_{2}(y)\in\mathbb{Z}[x][y]$. Going modulo $I$, $g(y)\equiv pc_{1}(y)\bmod I$. Hence, $p|g(y)\bmod I$ and $g(y)/p\equiv c_{1}(y)\bmod I:\langle p\rangle$ (Claim 5).

If we write $g$ in the reduced form modulo $I$, then the polynomial $g(y)/p$ can be obtained by dividing each coefficient of $g(y)\bmod I$ by $p$. ∎

3 Main Results: Proof of Theorems 1 and 2

Our task is to factorize a univariate integral polynomial $f(x)\in\mathbb{Z}[x]$ of degree $d$ modulo a prime power $p^{k}$. Without loss of generality, we can assume that $f(x)\not\equiv 0\bmod p$. Otherwise, we can efficiently divide $f(x)$ by the highest power of $p$ possible, say $p^{l}$, such that $f(x)\equiv p^{l}\tilde{f}(x)\bmod p^{k}$ and $\tilde{f}(x)\not\equiv 0\bmod p$. In this case, it is equivalent to factorize $\tilde{f}$ instead of $f$.

To simplify the input further, write $f\bmod p$ (uniquely) as a product of powers of coprime irreducible polynomials. If there are two coprime factors of $f$, using Hensel lemma (Lemma 16), we get a non-trivial factorization of $f$ modulo $p^{k}$. So, we can assume that $f$ is a power of a monic irreducible polynomial $\varphi\in\mathbb{Z}[x]$ modulo $p$. In other words, we can efficiently write $f\equiv\varphi^{e}+pl\bmod p^{k}$ for a polynomial $l$ in $(\mathbb{Z}/\langle p^{k}\rangle)[x]$. We have $e\cdot\deg\varphi\leq\deg f$, for the integral polynomials $f$ and $\varphi$.

3.1 Factoring to Root-finding

By the preprocessing above, we only need to find factors of a polynomial $f$ such that $f\equiv\varphi^{e}+pl\bmod p^{k}$, where $\varphi$ is an irreducible polynomial modulo $p$. Up to multiplication by units, any nontrivial factor $h$ of $f$ has the form $h\equiv\varphi^{a}-py$, where $a<e$ and $y$ is a polynomial in $(\mathbb{Z}/\langle p^{k}\rangle)[x]$.

Let us denote the ring $\mathbb{Z}[x]/\langle p^{k},\varphi^{ak}\rangle$ by $R$. Also, denote the ring $\mathbb{Z}[x]/\langle p,\varphi^{ak}\rangle$ by $R_{0}$. We define an auxiliary polynomial $E(y)\in R[y]$ as

[TABLE]

Our first step is to reduce the problem of factoring $f(x)\bmod p^{k}$ to the problem of finding roots of the univariate polynomial $E(y)$ in $R$. Thus, we convert the problem of finding factors of $f(x)\in\mathbb{Z}[x]$ modulo a principal ideal $\langle p^{k}\rangle$ to root finding of a polynomial $E(y)\in(\mathbb{Z}[x])[y]$ modulo a bi-generated ideal $\langle p^{k},\varphi^{ak}\rangle$.

Theorem 8** (Reduction theorem).**

Given a prime power $p^{k}$; let $f(x),h(x)\in\mathbb{Z}[x]$ be two polynomials of the form $f(x)\equiv\varphi^{e}+pl\bmod p^{k}$ and $h(x)\equiv\varphi^{a}-py\bmod p^{k}$. Here $y,l$ are elements of $(\mathbb{Z}/\langle p^{k}\rangle)[x]$ and $a\leq e$. Then, $h$ divides $f$ modulo $p^{k}$ if and only if

[TABLE]

Proof.

Let $Q$ denote the ring of fractions of the ring $(\mathbb{Z}/\langle p^{k}\rangle)[x]$. Since $\varphi$ is not a zero divisor, $(E(y)/\varphi^{ak})\in Q$.

We first prove the reverse direction. If $E(y)\equiv 0\bmod\langle p^{k},\varphi^{ak}\rangle$, then $(E(y)/\varphi^{ak})$ is a valid polynomial over $(\mathbb{Z}/\langle p^{k}\rangle)[x]$. Multiplying $h$ with $(E(y)/\varphi^{ak})\bmod p^{k}$, we write,

[TABLE]

Hence, $h$ divides $f$ modulo $p^{k}$.

For the forward direction, assume that there exists some $g(x)\in(\mathbb{Z}/\langle p^{k}\rangle)[x]$, such that, $f(x)\equiv h(x)g(x)\bmod p^{k}$. We get two factorizations of $f$ in $Q$,

[TABLE]

Subtracting the first equation from the second one,

[TABLE]

Notice that $h(x)$ is not a zero divisor in $(\mathbb{Z}/\langle p^{k}\rangle)[x]$ (by Lemma 3) and is thus invertible in $Q$. So, $E(y)/\varphi^{ak}=g(x)$ in $Q$. Since $g(x)$ is in $(\mathbb{Z}/\langle p^{k}\rangle)[x]$, we deduce the equivalent divisibility statement: $E(y)\equiv 0\bmod\langle p^{k},\varphi^{ak}\rangle$. ∎

The following two observations simplify our task of finding roots $y$ of polynomial $E(y)$.

• •

First, due to symmetry, it is enough to find factors $h\equiv\varphi^{a}\bmod p$ with $a\leq e/2$. The assertion follows because $f\equiv hg\bmod p^{k}$ implies, at least one of the factor (say $h$) must be of the form $\varphi^{a}\bmod p$ for $a\leq e/2$. By Lemma 3, for a fixed $h\equiv(\varphi^{a}-py)\bmod p^{k}$, there is a unique $g\equiv(\varphi^{e-a}-py^{\prime})\bmod p^{k}$ such that $f\equiv hg\bmod p^{k}$. So, to find $g$, it is enough to find $h$.

• •

Second, observe that any root $y\in R$ (of $E(y)\in R[y]$) can be seen as $y=y_{0}+py_{1}+p^{2}y_{2}+\ldots+p^{k-1}y_{k-1}$, where each $y_{i}\in R_{0}$ for all $i$ in $\{0,\ldots,k-1\}$. The following lemma decreases the required precision of root $y$.

Lemma 9**.**

Let $y=y_{0}+py_{1}+p^{2}y_{2}+\ldots+p^{k-1}y_{k-1}$ be a root of $E(y)$, where $k\geq 2$ and $a\leq e/2$. Then, all elements of set $y=y_{0}+py_{1}+p^{2}y_{2}+\ldots+p^{k-3}y_{k-3}+p^{k-2}*$ are also roots of $E(y)$.

Proof.

Notice that the variable $y$ is multiplied with $p$ in $E(y)$, implying $y_{k-1}$ is irrelevant. Similar argument is applicable for the variable $y_{k-2}$ in any term of the form $(py)^{i}$ for $i\geq 2$. The only remaining term containing $y_{k-2}$ is $f\varphi^{a(k-2)}(py)$. The coefficient of $y_{k-2}$ in this term is $\varphi^{a(k-2)}fp^{k-1}$. This coefficient vanishes modulo $\langle p^{k},\varphi^{ak}\rangle$ too, because

$\varphi^{a(k-2)}f\,\equiv\,\varphi^{a(k-2)}\varphi^{e}\,\equiv\,\varphi^{ak}\varphi^{e-2a}\,\equiv\,0\bmod\langle p,\varphi^{ak}\rangle\ .$ ∎

Root-finding modulo a principal ideal. Finally, we state a slightly modified version of the theorem from [BLQ13, Cor.24], showing that all the roots of a polynomial $g(y)\in R_{0}[y]$ can be efficiently described. They gave their algorithm to find (all) roots in $\mathbb{Z}/\langle p^{n}\rangle$; we modify it in a straightforward way to find (all) roots in $\mathbb{F}_{p}[x]/\langle\varphi^{ak}\rangle=R_{0}$ (Appendix B). Any root in $R_{0}$ can be written as $y=y_{0}+\varphi y_{1}+\cdots+\varphi^{ak-1}y_{ak-1}$, where each $y_{j}$ is in the field $R_{0}/\langle\varphi\rangle$.

Let $g(y)$ be a polynomial in $R[y]$, then a set $y=y_{0}+\varphi y_{1}+\ldots+\varphi^{i}y_{i}+\varphi^{i+1}*$ will be called a representative root of $g$ iff

• •

All elements in $y=y_{0}+\varphi y_{1}+\ldots+\varphi^{i}y_{i}+\varphi^{i+1}*$ are roots of $g$.

• •

Not all elements in $y^{\prime}=y_{0}+\varphi y_{1}+\ldots+\varphi^{i-1}y_{i-1}+\varphi^{i}*$ are roots of $g$.

We will sometimes represent the set of roots, $y=y_{0}+\varphi y_{1}+\ldots+\varphi^{i}y_{i}+\varphi^{i+1}*$, succinctly as $y=v+\varphi^{i+1}*$, where $v\in R$ stands for $y=y_{0}+\varphi y_{1}+\ldots+\varphi^{i}y_{i}$. Such a pair, $(v,i+1)$, will be called a representative pair.

Theorem 10**.**

[BLQ13*, Cor.24]**

Given a bivariate $g(y)\in R_{0}[y]$ where $R_{0}=\mathbb{Z}[x]/\langle p,\varphi^{ak}\rangle$, let $Z\subseteq R_{0}$ be the root set of $g(y)$. Then $Z$ can be expressed as the disjoint union of at most $\deg_{y}(g)$ many representative pairs $(a_{0},i_{0})$ ($a_{0}\in R_{0}$ and $i_{0}\in\mathbb{N}$).*

These representative pairs can be found in randomized poly($\deg_{y}(g),\log p,ak\deg\varphi$) time.

For completeness, Algorithm Root-Find($g,R_{0}$) is given in Appendix B.

We will fix $k=4$ for the rest of this section. Similar techniques (even simpler) work for $k=3$ and $k=2$. The issues with this approach for $k>4$ will be discussed in Appendix D.

3.2 Reduction to root-finding modulo a principal ideal of $\mathbb{F}_{p}[x]$

In this subsection, the task to find roots of $E(y)$ modulo the bi-generated ideal $\langle p^{4},\varphi^{4a}\rangle$ of $\mathbb{Z}[x]$ will be reduced to finding roots modulo the principal ideal $\langle\varphi^{4a}\rangle$ (of $\mathbb{F}_{p}[x]$).

Let us consider the equation $E(y)\equiv 0\bmod\langle p^{4},\varphi^{4a}\rangle$. We have,

[TABLE]

Using Lemma 9, we can assume $y=y_{0}+py_{1}$,

[TABLE]

The idea is to first solve this equation modulo $\langle p^{3},\varphi^{4a}\rangle$. Since $f\equiv\varphi^{e}\bmod p$, $e\geq 2a$, variable $y_{1}$ is redundant while solving this equation modulo $p^{3}$. Following lemma finds all representative pairs $(a_{0},i_{0})$ for $y_{0}$, such that, $E(a_{0}+\varphi^{i_{0}}y_{0}+py_{1})\equiv 0\bmod\langle p^{3},\varphi^{4a}\rangle$ for all $y_{0},y_{1}\in R$. Alternatively, we can state this in the polynomial ring $R[y_{0},y_{1}]$. Dividing by $p^{3}$, we will be left with an equation modulo the principal ideal $\langle\varphi^{4a}\rangle$ (of $\mathbb{F}_{p}[x]$).

Lemma 11** (Reduce to char=$p$).**

We efficiently compute a unique set $S_{0}$ of all representative pairs $(a_{0},i_{0})$, where $a_{0}\in R_{0}$ and $i_{0}\in\mathbb{N}$, such that,

[TABLE]

for a polynomial $E^{\prime}(y_{0},y_{1})\in R_{0}[y_{0},y_{1}]$ (it depends on $(a_{0},i_{0})$). Moreover,

$|S_{0}|\leq 2$. If our efficient algorithm fails to find $E^{\prime}$ then Eqn. 2 has no solution. 2. 2.

$E^{\prime}(y_{0},y_{1})=:E_{1}(y_{0})+E_{2}(y_{0})y_{1}$, where $E_{1}(y_{0})\in R_{0}[y_{0}]$ is cubic in $y_{0}$ and $E_{2}(y_{0})\in R_{0}[y_{0}]$ is linear in $y_{0}$. 3. 3.

For every root $y\in R$ of $E(y)$ there exists $(a_{0},i_{0})\in S_{0}$ and $(a_{1},a_{2})\in R\times R$, such that $y=(a_{0}+\varphi^{i_{0}}a_{1})+pa_{2}$ and $E^{\prime}(a_{1},a_{2})\equiv 0\bmod\langle p,\varphi^{4a}\rangle$.

We think of $E^{\prime}$ as the quotient $E((a_{0}+\varphi^{i_{0}}y_{0})+py_{1})/p^{3}$ in the polynomial ring $R_{0}[y_{0},y_{1}]$; and would work with it instead of $E$ in the root-finding algorithm.

Proof.

Looking at Eqn. 2 modulo $p^{2}$,

[TABLE]

Substituting $f=\varphi^{e}+ph_{1}$, we get $(\varphi^{e}+ph_{1})(\varphi^{3a}+\varphi^{2a}py_{0})\ \equiv\ 0\bmod\langle p^{2},\varphi^{4a}\rangle$. Implying, $ph_{1}\varphi^{3a}\ \equiv\ 0\bmod\langle p^{2},\varphi^{4a}\rangle$. Using Claim 6 the above equation implies that,

[TABLE]

is a necessary condition for $y_{0}$ to exist.

We again look at Eqn. 2, but modulo $p^{3}$ now: $f(\varphi^{3a}+\varphi^{2a}py_{0}+\varphi^{a}p^{2}y_{0}^{2})\,\equiv\,0\,\bmod\langle p^{3},\varphi^{4a}\rangle$.

Notice that $y_{1}$ is not present because its coefficient: $p^{2}f\varphi^{2a}\ \equiv\ 0\bmod\langle p^{3},\varphi^{4a}\rangle$. Substituting $f=\varphi^{e}+ph_{1}$, we get,

[TABLE]

Removing the coefficients of $y_{0}$ which vanish modulo $\langle p^{3},\varphi^{4a}\rangle$,

[TABLE]

From Eqn. 3, $h_{1}$ can be written as $ph_{1,1}+\varphi^{a}h_{1,2}$, so

[TABLE]

We can divide by $p^{2}\varphi^{3a}$ using Claim 6 to get an equation modulo $\varphi^{a}$ in the ring $\mathbb{F}_{p}[x]$. This is a quadratic equation in $y_{0}$. Using Theorem 10, we find the solution set $S_{0}$ with at most two representative pairs: for $(a_{0},i_{0})\in S_{0}$, every $y\in a_{0}+\varphi^{i_{0}}*+p*$ satisfies,

[TABLE]

In other words, on substituting $(a_{0}+\varphi^{i_{0}}y_{0}+py_{1})$ in $E(y)$,

[TABLE]

for a “bivariate” polynomial $E^{\prime}(y_{0},y_{1})\in R_{0}[y_{0},y_{1}]$. This sets up the correspondence between the roots of $E$ and $E^{\prime}$.

Substituting $(a_{0}+\varphi^{i_{0}}y_{0}+py_{1})$ in Eqn. 2, we notice that $E^{\prime}(y_{0},y_{1})$ has the form $E_{1}(y_{0})+E_{2}(y_{0})y_{1}$ for a linear $E_{2}$ and a cubic $E_{1}$.

Finally, this reduction is constructive, because of Lemma 7 and Theorem 10, giving a randomized poly-time algorithm. ∎

3.3 Finding roots of a special bi-variate $E^{\prime}(y_{0},y_{1})$ modulo $\langle p,\varphi^{4a}\rangle$

The final obstacle is to find roots of $E^{\prime}(y_{0},y_{1})$ modulo $\langle\varphi^{4a}\rangle$ in $\mathbb{F}_{p}[x]$. The polynomial $E^{\prime}(y_{0},y_{1})=E_{1}(y_{0})+E_{2}(y_{0})y_{1}$ is special because $E_{2}\in R_{0}[y_{0}]$ is linear in $y_{0}$.

For a polynomial $u\in\mathbb{F}_{p}[x][\mathbf{y}]$ we define valuation $\text{val}_{\varphi}(u)$ to be the largest $r$ such that $\varphi^{r}|u$. Our strategy is to go over all possible valuations $0\leq r\leq 4a$ and find $y_{0}$, such that,

• •

$E_{1}(y_{0})$ has valuation at least $r$.

• •

$E_{2}(y_{0})$ has valuation exactly $r$.

From these $y_{0}$’s, $y_{1}$ can be obtained by ‘dividing’ $E_{1}(y_{0})$ with $E_{2}(y_{0})$. The lemma below shows that this strategy captures all the solutions.

Lemma 12** (Bivariate solution).**

A pair $(u_{0},u_{1})\in R_{0}\times R_{0}$ satisfies an equation of the form $E_{1}(y_{0})+E_{2}(y_{0})y_{1}\equiv 0\bmod\langle p,\varphi^{4a}\rangle$ if and only if $\text{val}_{\varphi}(E_{1}(u_{0}))\geq\text{val}_{\varphi}(E_{2}(u_{0}))$.

Proof.

Let $r$ be $\text{val}_{\varphi}(E_{2}(u_{0}))$, where $r$ is in the set $\{0,1,\ldots,4a\}$. If $\text{val}_{\varphi}(E_{1}(u_{0}))\geq\text{val}_{\varphi}(E_{2}(u_{0}))$ then set $u_{1}\equiv-(E_{1}(u_{0})/\varphi^{r})/(E_{2}(u_{0})/\varphi^{r})\bmod\langle p,\varphi^{4a-r}\rangle$. The pair $(u_{0},u_{1})$ satisfies the required equation. (Note: If $r=4a$ then we take $u_{1}=*$.)

Conversely, if $r^{\prime}:=\text{val}_{\varphi}(E_{1}(u_{0}))<\text{val}_{\varphi}(E_{2}(u_{0}))\leq 4a$ then, for every $u_{1}$,

$\text{val}_{\varphi}(E_{1}(u_{0})+E_{2}(u_{0})u_{1})=r^{\prime}\,\,\Rightarrow\,\,E_{1}(u_{0})+E_{2}(u_{0})u_{1}\,\not\equiv\,0\,\bmod\langle p,\varphi^{4a}\rangle\,.$ ∎

We can efficiently find all representative pairs for $y_{0}$, at most three, such that $E_{1}(y_{0})$ has valuation at least $r$ (using Theorem 10). The next lemma shows that we can efficiently filter all $y_{0}$’s, from these representative pairs, that give valuation exactly $r$ for $E_{2}(y_{0})$.

Lemma 13** (Reduce to a unit $E_{2}$).**

Given a linear polynomial $E_{2}(y_{0})\in R_{0}[y_{0}]$ and an $r\in[4a-1]$, let $(b,i)$ be a representative pair modulo $\langle p,\varphi^{r}\rangle$, i.e., $E_{2}(b+\varphi^{i}*)\equiv 0\bmod\langle p,\varphi^{r}\rangle$. Consider the quotient $E_{2}^{\prime}(y_{0}):=E_{2}(b+\varphi^{i}y_{0})/\varphi^{r}$.

If $E_{2}^{\prime}(y_{0})$ does not vanish identically modulo $\langle p,\varphi\rangle$, then there exists at most one $\theta\in R_{0}/\langle\varphi\rangle$ such that $E_{2}^{\prime}(\theta)\equiv 0\bmod\langle p,\varphi\rangle$, and this $\theta$ can be efficiently computed.

Proof.

Suppose $E_{2}(b+\varphi^{i}y_{0})\equiv u+vy_{0}\equiv 0\bmod\langle p,\varphi^{r}\rangle$. Since $y_{0}$ is formal, we get $\text{val}_{\varphi}(u)\geq r$ and $\text{val}_{\varphi}(v)\geq r$. We consider the three cases (wrt these valuations),

$\text{val}_{\varphi}(u)\geq r$ and $\text{val}_{\varphi}(v)=r$: $E_{2}^{\prime}(\theta)\not\equiv 0\bmod\langle p,\varphi\rangle$, for all $\theta\in R_{0}/\langle\varphi\rangle$ except $\theta=(-u/\varphi^{r})/(v/\varphi^{r})\bmod\langle p,\varphi\rangle$. 2. 2.

$\text{val}_{\varphi}(u)=r$ and $\text{val}_{\varphi}(v)>r$: $E_{2}^{\prime}(\theta)\not\equiv 0\bmod\langle p,\varphi\rangle$, for all $\theta\in R_{0}/\langle\varphi\rangle$. 3. 3.

$\text{val}_{\varphi}(u)>r$ and $\text{val}_{\varphi}(v)>r$: $E_{2}^{\prime}(y_{0})$ vanishes identically modulo $\langle p,\varphi\rangle$, so this case is ruled out by the hypothesis.

There is an efficient algorithm to find $\theta$, if it exists; because the above proof only requires calculating valuations which entails division operations in the ring. ∎

3.4 Algorithm to find roots of $E(y)$

We have all the ingredients to give the algorithm for finding roots of $E(y)$ modulo ideal $\langle p^{4},\varphi^{4a}\rangle$ of $\mathbb{Z}[x]$.

Input: A polynomial $E(y)\in R[y]$ defined as $E(y):=f(x)(\varphi^{3a}+\varphi^{2a}(py)+\varphi^{a}(py)^{2}+(py)^{3})$.

Output: A set $Z\subseteq R_{0}$ and a bad set $Z^{\prime}\subseteq R_{0}$, such that, for each $y_{0}\in Z-Z^{\prime}$, there are (efficiently computable) $y_{1}\in R_{0}$ (Theorem 14) satisfying $E(y_{0}+py_{1})\,\equiv\,0\ \bmod\langle p^{4},\varphi^{4a}\rangle$. These are exactly the roots of $E$.

Also, both sets $Z$ and $Z^{\prime}$ can be described by $O(a)$ many representatives (Theorem 14). Hence, a $y_{0}\in Z-Z^{\prime}$ can be picked efficiently.

Algorithm 1 Finding all roots of $E(y)$ in $R$

1:

Given $E(y_{0}+py_{1})$, using Lemma 11, get the set $S_{0}$ of all representative pairs $(a_{0},i_{0})$, where $a_{0}\in R_{0}$ and $i_{0}\in\mathbb{N}$, such that $p^{3}|E((a_{0}+\varphi^{i_{0}}y_{0})+py_{1})\bmod\langle p^{4},\varphi^{4a}\rangle$.

2:

Initialize sets $Z=\{\}$ and $Z^{\prime}=\{\}$; seen as subsets of $R_{0}$.

3:for each $(a_{0},i_{0})\in S_{0}$ do

4:     

Substitute $y_{0}\mapsto a_{0}+\varphi^{i_{0}}y_{0}$, let $E^{\prime}(y_{0},y_{1})=E_{1}(y_{0})+E_{2}(y_{0})y_{1}\bmod\langle p,\varphi^{4a}\rangle$ be the polynomial obtained from Lemma 11.

5:     

If $E_{2}(y_{0})\not\equiv 0\bmod\langle p,\varphi\rangle$ then find (at most one) $\theta\in R_{0}/\langle\varphi\rangle$ such that $E_{2}(\theta)\equiv 0\bmod\langle p,\varphi\rangle$. Update $Z\leftarrow Z\cup(a_{0}+\varphi^{i_{0}}*)$ and $Z^{\prime}\leftarrow Z^{\prime}\cup(a_{0}+\varphi^{i_{0}}(\theta+\varphi*))$.

6:     for each possible valuation $r\in[4a]$ do

7:         

Initialize sets $Z_{r}=\{\}$ and $Z_{r}^{{}^{\prime}}=\{\}$.

8:         

Call Root-Find($E_{1}$, $\varphi^{r}$) to get a set $S_{1}$ of representative pairs $(a_{1},i_{1})$ where $a_{1}\in R_{0}$ and $i_{1}\in\mathbb{N}$ such that $E_{1}(a_{1}+\varphi^{i_{1}}y_{0})\equiv 0\bmod\langle p,\varphi^{r}\rangle$.

9:         for each $(a_{1},i_{1})\in S_{1}$ do

10:              

Analogously consider $E_{2}^{\prime}(y_{0}):=E_{2}(a_{1}+\varphi^{i_{1}}y_{0})\bmod\langle p,\varphi^{4a}\rangle$.

11:              

Call Root-Find($E_{2}^{\prime}$, $\varphi^{r}$) to get a representative pair $(a_{2},i_{2})$ ($\because E_{2}^{\prime}$ is linear), where $a_{2}\in R_{0}$ and $i_{2}\in\mathbb{N}$ such that $E_{2}^{\prime}(a_{2}+\varphi^{i_{2}}y_{0})\equiv 0\bmod\langle p,\varphi^{r}\rangle$.

12:              if $r=4a$ then

13:                  

Update $Z_{r}\leftarrow Z_{r}\cup(a_{1}+\varphi^{i_{1}}(a_{2}+\varphi^{i_{2}}*))$ and $Z_{r}^{{}^{\prime}}\leftarrow Z_{r}^{{}^{\prime}}\cup\{\}$.

14:              else if $E_{2}^{\prime}(a_{2}+\varphi^{i_{2}}y_{0})\not\equiv 0\bmod\langle p,\varphi^{r+1}\rangle$ then

15:                  

Get a $\theta\in R_{0}/\langle\varphi\rangle$ (Lemma 13), if it exists, such that $E_{2}^{\prime}(a_{2}+\varphi^{i_{2}}(\theta+\varphi y_{0}))\equiv 0\bmod\langle p,\varphi^{r+1}\rangle$. Update $Z_{r}^{{}^{\prime}}\leftarrow Z_{r}^{\prime}\cup(a_{1}+\varphi^{i_{1}}(a_{2}+\varphi^{i_{2}}(\theta+\varphi*)))$.

16:                  

Update $Z_{r}\leftarrow Z_{r}\cup(a_{1}+\varphi^{i_{1}}(a_{2}+\varphi^{i_{2}}*))$.

17:              end if

18:         end for

19:         

Update $Z\leftarrow Z\cup(a_{0}+\varphi^{i_{0}}Z_{r})$ and $Z^{\prime}\leftarrow Z^{\prime}\cup(a_{0}+\varphi^{i_{0}}Z_{r}^{{}^{\prime}})$.

20:     end for

21:end for

22:

Return $Z$ and $Z^{\prime}$.

We prove the correctness of Algorithm 3.4 in the following theorem.

Theorem 14**.**

The output of Algorithm 3.4 (set $Z-Z^{\prime}$) contains exactly those $y_{0}\in R_{0}$ for which there exist some $y_{1}\in R_{0}$, such that, $y=y_{0}+py_{1}$ is a root of $E(y)$ in $R$. We can easily compute the set of $y_{1}$ corresponding to a given $y_{0}\in Z-Z^{\prime}$ in poly($\deg f,\log p$) time.

Thus, we efficiently describe (& exactly count) the roots $y=y_{0}+py_{1}+p^{2}y_{2}$ in $R$ of $E(y)$, where $y_{0},y_{1}\in R_{0}$ are as above and $y_{2}$ can assume any value from $R$.

Proof.

The algorithm intends to output roots $y$ of equation $E(y)\equiv f(x)(\varphi^{3a}+\varphi^{2a}(py)+\varphi^{a}(py)^{2}+(py)^{3})\equiv 0\bmod\langle p^{4},\varphi^{4a}\rangle$, where $y=y_{0}+py_{1}+p^{2}y_{2}$ with $y_{0},y_{1}\in R_{0}$ and $y_{2}\in R$. From Lemma 9, $y_{2}$ can be kept as $*$, and is independent of $y_{0}$ and $y_{1}$.

Using Lemma 11, Algorithm 3.4 partially fixes $y_{0}$ from the set $S_{0}$ and reduces the problem to finding roots of an $E^{\prime}(y_{0},y_{1})\bmod\langle p,\varphi^{4a}\rangle$. In other words, if we can find all roots $(y_{0},y_{1})$ of $E^{\prime}(y_{0},y_{1})\bmod\langle p,\varphi^{4a}\rangle$, then we can find (and count) all roots of $E(y)\bmod\langle p^{4},\varphi^{4a}\rangle$. This is accomplished by Step $1$. From Lemma 11, $|S_{0}|\leq 2$, so loop at Step $3$ runs only for a constant number of times.

Using Lemma 11, $E^{\prime}(y_{0},y_{1})\equiv E_{1}(y_{0})+E_{2}(y_{0})y_{1}\bmod\langle p,\varphi^{4a}\rangle$ for a cubic polynomial $E_{1}(y_{0})\in R_{0}[y_{0}]$ and a linear polynomial $E_{2}(y_{0})\in R_{0}[y_{0}]$.

We find all solutions of $E^{\prime}(y_{0},y_{1})$ by going over all possible valuations of $E_{2}(y_{0})$ with respect to $\varphi$. The case of valuation [math] is handled in Step 5 and valuation $4a$ is handled in Step 12. For the remaining valuations $r\in[4a-1]$, Lemma 12 shows that it is enough to find $(z_{0},z_{1})\in R_{0}\times R_{0}$ such that $\varphi^{r}|E_{1}(z_{0})$ and $\varphi^{r}||E_{2}(z_{0})$.

Notice that the number of valuations is bounded by $4a=O(\deg f)$. At Step $6$, the algorithm guesses the valuation $r$ of $E_{2}(y_{0})\in R_{0}[y_{0}]$ and subsequent conputation finds all representative roots $b+\varphi^{i}*$ efficiently (using Theorem 10), such that,

[TABLE]

The representative root $b+\varphi^{i}*$ is denoted by $a_{1}+\varphi^{i_{1}}(a_{2}+\varphi^{i_{2}}*)$ in Steps 13 & 16 of Algorithm 3.4.

Finally, we need to filter out those $y_{0}$’s for which $E_{2}(b+\varphi^{i}y_{0})\equiv 0\bmod\langle p,\varphi^{r+1}\rangle$. This can be done efficiently using Lemma 13, where we get a unique $\theta\in R_{0}/\langle\varphi\rangle$ for which,

[TABLE]

We store partial roots in two sets $Z_{r}$ and $Z_{r}^{\prime}$, where $Z_{r}^{\prime}$ contains the bad values filtered out by Lemma 13 as ${b+\varphi^{i}(\theta+\varphi*)}$ and $Z_{r}$ contains all possible roots $b+\varphi^{i}*$. So, the set $Z_{r}-Z_{r}^{\prime}$ contains exactly those elements $z_{0}$ for which there exists $z_{1}\in R_{0}$, such that, the pair $(z_{0},z_{1})$ is a root of $E^{\prime}(y_{0},y_{1})\bmod\langle p,\varphi^{4a}\rangle$.

Note that size of each set $S_{1}$ obtained at Step $9$ is bounded by three using Theorem 10 ($E_{1}$ is at most a cubic in $y_{0}$). Again using Theorem 10, we get at most one pair $(a_{2},i_{2})$ at Step $11$ for some $a_{2}\in R_{0}$ and $i_{2}\in\mathbb{N}$ ($E_{2}^{\prime}$ is linear in $y_{0}$).

Now, for a fixed $z_{0}\in Z_{r}-Z_{r}^{\prime}$ we can calculate all $z_{1}$’s by the equation

[TABLE]

Here $C(y_{0}):=E_{1}(z_{0})/\varphi^{r}\bmod\langle p,\varphi^{4a-r}\rangle$ and $L(y_{0}):=E_{2}(z_{0})/\varphi^{r}\bmod\langle p,\varphi^{4a-r}\rangle$. So, $z_{1}\in R_{0}$ comes from the set $z_{1}\in\tilde{z}_{1}+\varphi^{4a-r}*$. This can be done efficiently in poly($\deg f,\log p$) time.

Finally, sets $Z=a_{0}+\varphi^{i_{0}}Z_{r}$ and $Z^{\prime}=a_{0}+\varphi^{i_{0}}Z_{r}^{\prime}$, for $(a_{0},i_{0})\in S_{0}$ and corresponding valid $r\in\{0,\ldots,4a-1\}$, returned by Algorithm 3.4, describe the $y_{0}$ for the roots of $E(y_{0}+py_{1})\bmod\langle p^{4},\varphi^{4a}\rangle$. The number of representatives in each of these sets is $O(a)$, since $|S_{0}|\leq 2$ and sizes of $Z_{r}$ and $Z_{r}^{\prime}$ are only constant.

Since we can efficiently describe these $y_{0}$’s and corresponding $y_{1}$’s, and we know their precision, we can count all roots $y=y_{0}+py_{1}+p^{2}*\subseteq R$ of $E(y)\bmod\langle p^{4},\varphi^{4a}\rangle$. ∎

Remark 1** (Root finding for $k=3$ and $k=2$).**

Algorithm 3.4 can as well be used when $k\in\{2,3\}$ (the algorithm simplifies considerably).

For $k=3$, by Lemma 9, the only relevant coordinate is $y_{0}$. Moreover, we can directly call algorithm Root-Find to find all roots of $E(y)/p^{2}$.

For $k=2$, using Lemma 9 again, we see that there are only two possibilities: $y_{0}=*$, or there is no solution. This can be determined by testing whether $E(y)/p^{2}\bmod\langle\varphi^{2a}\rangle$ exists.

3.5 Wrapping up Theorems 1 & 2

Proof of Theorem 1.

We prove that given a general univariate $f(x)\in\mathbb{Z}[x]$ and a prime $p$, a non-trivial factor of $f(x)$ modulo $p^{4}$ can be obtained in randomized poly$(\deg f,\log p)$ time (or the irreducibility of $f(x)\bmod p^{4}$ gets certified).

If $f(x)\equiv f_{1}(x)f_{2}(x)\bmod p$, where $f_{1}(x),f_{2}(x)\in\mathbb{F}_{p}[x]$ are two coprime polynomials, then we can efficiently lift this factorization to the ring $(\mathbb{Z}/\langle p^{4}\rangle)[x]$, using Hensel lemma (Lemma 16), to get non-trivial factors of $f(x)\bmod p^{4}$.

For the remaining case, $f(x)\equiv\varphi^{e}\bmod p$ for an irreducible polynomial $\varphi(x)$ modulo $p$. The question of factoring $f\bmod p^{4}$ then reduces to root finding of a polynomial $E(y)\bmod\langle p^{4},\varphi^{4a}\rangle$ by Reduction theorem (Theorem 8). Using Theorem 14, we get all such roots and hence a non-trivial factor of $f(x)\bmod p^{4}$ is found. If there are no roots $y\in R$ of $E(y)$, for all $a\leq e/2$, then the polynomial $f$ is irreducible (by symmetry, if there is a factor for $a>e/2$ then there is a factor for $a\leq e/2$). ∎

Remark 2**.**

As discussed before, the above proof applies to factorization modulo $p^{3}$ and $p^{2}$ as well (by considering the generality of Theorems 8 & 14). Hence, Theorem 1 also solves the open question of factoring $f$ modulo $p^{3}$. In fact, in Appendix C we observe that our efficient algorithm outputs all the factors of $f\bmod p^{3}$ in a compact way.

Proof of Theorem 2.

We will prove the theorem for $k=4$, case of $k<4$ is similar.

We are given a univariate $f(x)\in\mathbb{Z}[x]$ of degree $d$ and a prime $p$, such that, $f(x)\bmod p$ is a power of an irreducible polynomial $\varphi(x)$. So, $f(x)$ is of the form $\varphi(x)^{e}+ph(x)\bmod p^{4}$, for an integer $e\in\mathbb{N}$ and a polynomial $h(x)\in(\mathbb{Z}/\langle p^{4}\rangle)[x]$ of degree $\leq d$ (also, $\deg\varphi^{e}\leq d$). By unique factorization over the ring $\mathbb{F}_{p}[x]$, if $\tilde{g}(x)$ is a factor of $f(x)\bmod p$ then, $\tilde{g}(x)\equiv\tilde{v}\varphi(x)^{a}\bmod p$ for a unit $\tilde{v}\in\mathbb{F}_{p}$.

First, we show that it is enough to find all the lifts of $\tilde{g}(x)$, such that, $\tilde{g}(x)\equiv\varphi(x)^{a}\bmod p$ for an $a\leq e$. If $\tilde{g}(x)\equiv\tilde{v}\varphi(x)^{a}\bmod p$, then any lift has the form $g(x)\equiv v(x)(\varphi^{a}-py)\bmod p^{4}$ for a unit $v(x)\in(\tilde{v}+p*)\subseteq(\mathbb{Z}/\langle p^{4}\rangle)[x]$. Any such $g(x)$ maps uniquely to a $g_{1}(x):=\tilde{v}^{-1}g(x)\bmod p^{4}$, which is a lift of $\varphi(x)^{a}\bmod p$. So, it is enough to find all the lifts of $\varphi(x)^{a}\bmod p$.

We know that any lift $g(x)\in(\mathbb{Z}/\langle p^{4}\rangle)[x]$ of $\tilde{g}(x)$, which is a factor of $f(x)$, must be of the form $\varphi(x)^{a}-py(x)\bmod p^{4}$ for a polynomial $y(x)\in(\mathbb{Z}/\langle p^{4}\rangle)[x]$. By Reduction theorem (Theorem 8), we know that finding such a factor is equivalent to solving for $y$ in the equation $E(y)\equiv 0\bmod\langle p^{4},\varphi^{4a}\rangle$. By Theorem 14, we can find all such roots $y$ in randomized poly($d,\log p$) time, for $a\leq e/2$.

If $a>e/2$ then we replace $a$ by $b:=e-a$, as $b\leq e/2$, and solve the equation $E(y)\equiv 0\bmod\langle p^{4},\varphi^{4b}\rangle$ using Theorem 14. This time the factor corresponding to $y$ will be, $g(x)\ \equiv\ f/(\varphi^{b}-py)\ \equiv\ E(y)/\varphi^{4b}\ \bmod p^{4}$, from Reduction theorem (Theorem 8).

The number of lifts of $\tilde{g}(x)$ which divide $f\bmod p^{4}$ is the count of $y$’s that appear above. This is efficiently computable. ∎

4 Conclusion

The study of [vzGH98, vzGH96] sheds some light on the behaviour of the factoring problem for integral polynomials modulo prime powers. It shows that for “large” $k$ the problem is similar to the factorization over $p$-adic fields (already solved efficiently by [CG00]). But, for “small” $k$ the problem seems hard to solve in polynomial time. We do not even know a practical algorithm.

This motivated us to study the case of constant $k$, with the hope that this will help us invent new tools. In this direction, we make significant progress by giving a unified method to factor $f\bmod p^{k}$ for $k\leq 4$. We also generalize Hensel lifting for $k\leq 4$, by giving all possible lifts of a factor of $f\bmod p$, in the classically hard case of $f\bmod p$ being a power of an irreducible.

We give a general framework (for any $k$) to work on, by reducing the factoring in a big ring to root-finding in a smaller ring. We leave it open whether we can factor $f\bmod p^{5}$, and beyond, within this framework.

We also leave it open, to efficiently get all the solutions of a bivariate equation, in $\mathbb{Z}/\langle p^{k}\rangle$ or $\mathbb{F}_{p}[x]/\langle\varphi^{k}\rangle$, in a compact representation. Surprisingly, we know how to achieve this for univariate polynomials [BLQ13]. This, combined with our work, will probably give factoring mod $p^{k}$, for any $k$.

**Acknowledgements. ** We thank Vishwas Bhargava for introducing us to the open problem of factoring $f\bmod p^{3}$. N.S. thanks the funding support from DST (DST/SJF/MSA-01/2013-14). R.M. would like to thank support from DST through grant DST/INSPIRE/04/2014/001799.

Appendix A Preliminaries

The following theorem by Cantor-Zassenhaus [CZ81] efficiently finds all the roots of a given univariate polynomial over a finite field.

Theorem 15** (Cantor-Zassenhaus).**

Given a univariate degree $d$ polynomial $f(x)$ over a given finite field $\mathbb{F}_{q}$, we can find all the irreducible factors of $f(x)$ in $\mathbb{F}_{q}[x]$ in randomized poly($d,\log{q}$) time.

Currently, it is a big open question to derandomize this algorithm.

Below we state a lemma, originally due to Hensel [Hen18], for $\mathcal{I}$-adic lifting of coprime factorization for a given univariate polynomial. Over the years, it has acquired many forms in different texts; the version being presented here is due to Zassenhaus [Zas69].

Lemma 16** (Hensel lemma & lift [Hen18]).**

Let $R$ be a commutative ring with unity, and let $\mathcal{I}\subseteq R$ be an ideal. Given a polynomial $f(x)\in R[x]$, let $g(x),h(x),u(x),v(x)\in R[x]$ be polynomials, such that, $f(x)=g(x)h(x)\bmod\mathcal{I}$ and $g(x)u(x)+h(x)v(x)=1\bmod\mathcal{I}$.

Then, for any $l\in\mathbb{N}$, we can efficiently compute $g^{*},h^{*},u^{*},v^{*}\in R[x]$ such that

[TABLE]

where $g^{*}=g\bmod\mathcal{I}$, $h^{*}=h\bmod\mathcal{I}$ and $g^{*}u^{*}+h^{*}v^{*}=1\bmod\mathcal{I}^{l}$.

Moreover, $g^{*}$ and $h^{*}$ are unique upto multiplication by a unit.

Appendix B Root finding modulo $\varphi(x)^{i}$

Let us denote the ring $\mathbb{F}_{p}[x]/\langle\varphi^{i}\rangle$ by $R_{0}$ (for an irreducible $\varphi(x)\bmod p$). In this section, we give an algorithm to find all the roots $y$ of a polynomial $g(y)\in R_{0}[y]$ in the ring $R_{0}$. The algorithm was originally discovered by [BLQ13, Cor.24] to find roots in $\mathbb{Z}/\langle p^{i}\rangle$, we adapt it here to find roots in $R_{0}$.

Note that $R_{0}/\langle\varphi^{j}\rangle=\mathbb{F}_{p}[x]/\langle\varphi^{j}\rangle$, for $j\leq i$, and $R_{0}/\langle\varphi\rangle=:\mathbb{F}_{q}$ is the finite field of size $q:=p^{\deg(\varphi\bmod p)}$. The structure of a root $y$ of $g(y)$ in $R_{0}$ is

[TABLE]

where $y\in R_{0}$ and each $y_{j}\in\mathbb{F}_{q}$ for all $j\in\{0,\ldots,i-1\}$. Also, recall the notation of $*$ (given in Section 2) and representative roots (in Section 3.1).

The output of this algorithm is simply a set of at most ($\deg g$) many representative roots of $g(y)$. This bound of $\deg g$ is a curious by-product of the algorithm.

Algorithm 2 Root-finding in ring $R_{0}$

1:procedure Root-find($g(y)$, $\varphi^{i}$)

2:     

If $g(y)\equiv 0$ in $R_{0}/\langle\varphi^{i}\rangle$ return $*$ (every element is a root).

3:     

Let $g(y)\equiv\varphi^{\alpha}\tilde{g}(y)$ in $R_{0}/\langle\varphi^{i}\rangle$, for the unique integer $0\leq\alpha<i$ and the polynomial $\tilde{g}(y)\in R_{0}/\langle\varphi^{i-\alpha}\rangle[y]$, s.t., $\tilde{g}(y)\not\equiv 0$ in $R_{0}/\langle\varphi\rangle$ and $\deg(\tilde{g})\leq\deg(g)$.

4:     

Using Cantor-Zassenhaus algorithm find all the roots of $\tilde{g}(y)$ in $R_{0}/\langle\varphi\rangle$.

5:     

If $\tilde{g}(y)$ has no root in $R_{0}/\langle\varphi\rangle$ then return $\{\}$. (Dead-end)

6:     

Initialize $S=\{\}$.

7:     for each root $a$ of $\tilde{g}(y)$ in $R_{0}/\langle\varphi\rangle$ do

8:         

Define $g_{a}(y):=\tilde{g}(a+\varphi y)$.

9:         

$S^{\prime}\leftarrow$Root-find($g_{a}(y)$, $\varphi^{i-\alpha}$).

10:         

$S\leftarrow S\cup(a+\varphi S^{\prime})$.

11:     end for

12:     

return $S$.

13:end procedure

Note that in Step 9 we ensure: $\varphi|g_{a}(y)$. So, in every other recursive call to Root-find the second argument reduces by at least one. The key reason why $|S|\leq\deg g$ holds: The number of representative roots of $g_{a}(y)$ are upper bounded by the multiplicity of the root $a$ of $\tilde{g}(y)$.

Appendix C Finding all the factors modulo $p^{3}$

We will give a method to efficiently get and count all the distinct factors of $f\bmod p^{3}$, where $f(x)\in\mathbb{Z}[x]$ is a univariate polynomial of degree $d$.

Theorem 17**.**

Given $f(x)\in\mathbb{Z}[x]$, a univariate polynomial of degree $d$ and a prime $p\in\mathbb{N}$, we give (& count) all the distinct factors of $f\bmod p^{3}$ of degree at most $d$ in randomized poly($d,\log p$) time.

Note: We will not distinguish two factors if they are same up to multiplication by a unit. We will only find monic (leading coefficient $1$) factors of $f(x)\bmod p^{3}$ and assume that $f$ is monic.

Proof of Theorem 17.

By Theorem 15 and Lemma 16 we write:

[TABLE]

where $f_{i}(x)\equiv(\varphi_{i}^{e_{i}}+ph_{i})\bmod p^{3}$ with $\varphi_{i}\bmod p^{3}$ being monic and irreducible mod $p$, $e_{i}\in\mathbb{N}$, and $h_{i}(x)\bmod p^{3}$ of degree $<e_{i}\deg(\varphi_{i})$, for all $i\in[n]$.

Thus, wlog, consider the case of $f\equiv\varphi^{e}+ph$.

By Reduction theorem (Theorem 8) finding factors of the form $\varphi^{a}-py\bmod p^{3}$ of $f\equiv\varphi^{e}+ph\bmod p^{3}$, for $a\leq e/2$, is equivalent to finding all the roots of the equation

[TABLE]

Consider $R:=\mathbb{Z}[x]/\langle p^{3},\varphi^{3a}\rangle$ and $R_{0}:=\mathbb{Z}[x]/\langle p,\varphi^{3a}\rangle$, analogous to those in Section 2.

Using Lemma 9, we know that all solutions of the equation $E(y)\equiv 0\bmod\langle p^{3},\varphi^{3a}\rangle$ will be of the form $y=y_{0}+p*\in R$, for a $y_{0}\in R_{0}$. On simplifying this equation we get $E(y)\,\equiv\,ph\varphi^{2a}+(p^{2}h\varphi^{a})y_{0}+(p^{2}\varphi^{e})y_{0}^{2}\,\equiv\,0\,\bmod\langle p^{3},\varphi^{3a}\rangle$.

Reducing this equation mod $\langle p^{2},\varphi^{3a}\rangle$, we get that $h\equiv 0\bmod\langle p,\varphi^{a}\rangle$ is a necessary condition for a root $y_{0}$ to exist. So, we get

[TABLE]

where $h:=\varphi^{a}g_{1}+pg_{2}$ for unique $g_{1},g_{2}\in\mathbb{F}_{p}[x]$.

This equation is already divisible by $p^{2}$ as well as $\varphi^{2a}$ and so using Claim 6 we get that, finding factors of the form $\varphi^{a}-py\bmod p^{3}$ of $f\equiv\varphi^{e}+ph\bmod p^{3}$, for $a\leq e/2$, is equivalent to finding all the roots of the equation

[TABLE]

We find all the roots of this equation using one call to Root-find in randomized poly($d,\log p$) time. Note that any output root $u_{0}$ lives in $\mathbb{F}_{p}[x]/\langle\varphi^{a}\rangle$ and so its degree in $x$ is $<a\deg(\varphi)$. This yields monic factors of $f\bmod p^{3}$ (with $0\leq a\leq e/2$).

For $e\geq a>e/2$, we can replace $a$ by $b:=e-a$ in the above steps. Once we get a factor $\varphi^{b}-py\bmod p^{3}$, we output the cofactor $f/(\varphi^{b}-py)$ (which remains monic).

Counting these factors can be easily done in poly-time.

In the general case, if $N_{i}$ is the number of factors of $f_{i}\bmod p^{3}$ then, $\prod_{i=1}^{n}N_{i}$ is the count on the number of distinct monic factors of $f\bmod p^{3}$. ∎

Appendix D Barriers to extension modulo $p^{5}$

The reader may wonder about polynomial factoring when $k$ is greater than $4$. In this section we will discuss the issues in applying our techniques to factor $f(x)\bmod p^{5}$.

Given $f(x)\equiv\varphi^{e}\bmod p$, finding one of its factor $\varphi^{a}-py\bmod p^{5}$, for $a\leq e/2$ and $y\in(\mathbb{Z}/\langle p^{5}\rangle)[x]$, is reduced to solving the equation

[TABLE]

By Lemma 9, the roots of $E(y)\bmod\langle p^{5},\varphi^{5a}\rangle$ are of the form $y=y_{0}+py_{1}+p^{2}y_{2}+p^{3}*$ in $R$, where $y_{0},y_{1},y_{2}\in R_{0}$ need to be found.

First issue. The first hurdle comes when we try to reduce root-finding modulo the bi-generated ideal $\langle p^{5},\varphi^{5a}\rangle\subseteq\mathbb{Z}[x]$ to root-finding modulo the principal ideal $\langle\varphi^{5a}\rangle\subseteq\mathbb{F}_{p}[x]$. In the case $k=4$, Lemma 11 guarantees that we need to solve at most two related equations of the form $E^{\prime}(y_{0},y_{1})\equiv 0\bmod\langle p,\varphi^{4a}\rangle$ to find exactly the roots of $E(y)\bmod\langle p^{4},\varphi^{4a}\rangle$. Below, for $k=5$, we show that we have exponentially many candidates for $E^{\prime}(y_{0},y_{1},y_{2})\in R_{0}[y_{0},y_{1},y_{2}]$ and it is not clear if there is any compact efficient representation for them.

Putting $y=y_{0}+py_{1}+p^{2}y_{2}$ in Eqn. 4 we get,

[TABLE]

where $E_{1}(y_{0}):=f\varphi^{4a}+f\varphi^{3a}py_{0}+f\varphi^{2a}p^{2}y_{0}^{2}+f\varphi^{a}p^{3}y_{0}^{3}+fp^{4}y_{0}^{4}$ is a quartic in $R[y_{0}]$, $E_{2}(y_{0}):=f\varphi^{3a}p^{2}+f\varphi^{2a}2p^{3}y_{0}+f\varphi^{a}3p^{4}y_{0}^{2}$ is a quadratic in $R[y_{0}]$ and $E_{3}(y_{0}):=f\varphi^{3a}p^{3}+f\varphi^{2a}2p^{4}y_{0}$ is linear in $R[y_{0}]$.

To divide Eqn. 5 by $p^{3}$, we go mod $\langle p^{3},\varphi^{5a}\rangle$ obtaining

[TABLE]

a univariate quadratic equation which requires the whole machinery used in the case $k=3$. We get this simplified equation since $E_{3}(y_{0})\equiv 0\bmod\langle p^{3},\varphi^{5a}\rangle$ and $E_{2}(y_{0})\equiv f\varphi^{3a}p^{2}\equiv\varphi^{e-2a}\varphi^{2a+3a}p^{2}\equiv 0\bmod\langle p^{3},\varphi^{5a}\rangle$.

But, to really reduce Eqn. 5 to a system modulo the principal ideal $\langle\varphi^{5a}\rangle\subseteq\mathbb{F}_{p}[x]$, we need to divide it by $p^{4}$. So, we go mod $\langle p^{4},\varphi^{5a}\rangle$:

[TABLE]

where $E_{1}^{{}^{\prime}}(y_{0})\equiv E_{1}(y_{0})\bmod\langle p^{4},\varphi^{5a}\rangle$ is a cubic in $R[y_{0}]$ and $E_{2}^{{}^{\prime}}(y_{0})\equiv E_{2}(y_{0})\bmod\langle p^{4},\varphi^{5a}\rangle$ is linear in $R[y_{0}]$. This requires us to solve a special bivariate equation which requires the machinery used in the case $k=4$.

Now, the problem reduces to computing a solution pair $(y_{0},y_{1})\in(R_{0})^{2}$ of this bivariate. We can apply the idea used in Algorithm 3.4 to get all valid $y_{0}$ efficiently, but since $y_{1}$ is a function of $y_{0}$, we need to compute exponentially many $y_{1}$’s. So, there seem to be exponentially many candidates for $E^{\prime}(y_{0},y_{1},y_{2})$, that behaves like $E(y)/p^{4}$ and lives in $(\mathbb{F}_{p}[x]/\langle\varphi^{5a}\rangle)[y_{0},y_{1},y_{2}]$. At this point, we are forced to compute all these $E^{\prime}$s, as we do not know which one will lead us to a solution of Eqn. 5.

Second issue. Even if we resolve the first issue and get a valid $E^{\prime}$, we are left with a trivariate equation to be solved mod $\langle p,\varphi^{5a}\rangle$ (Eqn. 5 after shifting $y_{0}$ and $y_{1}$ then dividing by $p^{4}$). We could do this when $k$ was $4$, because we could easily write $y_{1}$ as a function of $y_{0}$. Though, it is unclear how to solve this trivariate now as the equation is nonlinear in both $y_{0}$ and $y_{1}$.

For $k>5$ the difficulty will only increase because of the recursive nature of Eqn. 4 with more and more number of unknowns (with higher degrees).