Quadratic Probabilistic Algorithms for Normal Bases

TL;DR

This paper presents a probabilistic algorithm for efficiently finding normal elements in finite Galois extensions with abelian or metacyclic Galois groups, improving computational methods for constructing normal bases.

Contribution

It introduces a novel probabilistic algorithm that reduces the problem of finding normal elements to invertibility checks, with quadratic or near-quadratic complexity depending on the group type.

Findings

Algorithm is quadratic in the size of G for metacyclic groups.

Algorithm is slightly subquadratic for abelian groups.

Deciding normality reduces to invertibility in the group algebra.

Abstract

It is well known that for any finite Galois extension field $K/F$, with Galois group $G = \mathrm{Gal}(K/F)$, there exists an element $\alpha \in K$ whose orbit $G\cdot\alpha$ forms an $F$-basis of $K$. Such an element $\alpha$ is called \emph{normal} and $G\cdot\alpha$ is called a normal basis. In this paper we introduce a probabilistic algorithm for finding a normal element when $G$ is either a finite abelian or a metacyclic group. The algorithm is based on the fact that deciding whether a random element $\alpha \in K$ is normal can be reduced to deciding whether $\sum_{\sigma \in G} \sigma(\alpha)\sigma \in K[G]$ is invertible. In an algebraic model, the cost of our algorithm is quadratic in the size of $G$ for metacyclic $G$ and slightly subquadratic for abelian $G$.

Equations

$$\sum _{j=1}^n{c}_j{g}_j(\alpha )=0,c_j\in \mathsf{F}$$

$$\sum _{j=1}^n{c}_j{g}_i{g}_j(\alpha )=0.$$

$${\mathbf{M}}_G(\alpha )=\left[\begin{array}{cccc}{g}_1{g}_1(\alpha )& g_1{g}_2(\alpha )& \cdots & g_1{g}_n(\alpha )\\ g_2{g}_1(\alpha )& g_2{g}_2(\alpha )& \cdots & g_2{g}_n(\alpha )\\ ⋮& ⋮& ⋮& ⋮\\ g_n{g}_1(\alpha )& g_n{g}_2(\alpha )& \cdots & g_n{g}_n(\alpha )\end{array}\right]\in M_n(\mathsf{K}).$$

$$S_{\alpha }:=\sum _{g\in G}g(\alpha )g\in \mathsf{K}[G],$$

$$\ell ({\mathbf{M}}_G(\alpha )):=[\ell (g_i{g}_j(\alpha )){]}_{ij}\in M_n(\mathsf{F})$$

$$\sum _{k=0}^{n-1}{a}_{ijk}{\xi }^k,$$

$${\mathbf{M}}_G(\alpha )=\sum _{j=0}^{n-1}{\mathbf{M}}^{(j)}{\xi }^j,{\mathbf{M}}^{(j)}\in M_n(\mathsf{F})\text{ for all j}.$$

$$\sum _{j=0}^{n-1}{\mathbf{M}}^{(j)}{\ell }_j\mathbf{u}=0$$

$$s_{\alpha ,\ell }:=\sum _{g\in G}\ell (g(\alpha ))g\in \mathsf{F}[G].$$

$$\ell (g^i(\alpha )),\text{mbox}for0\le i\le n-1.$$

$$(\ell \circ g^{tj})(g^i(\alpha )),\text{mbox}for0\le j<m:=\lceil n/t\rceil \text{mbox}and0\le i<t.$$

$${\alpha }_i=\sum _{0\le j<m}{a}_{i,j}{\xi }^{tj},$$

$$\mathbf{A}:={\left[A_{1,0}\cdots A_{1,m-1}\cdots A_{s,0}\cdots A_{s,m-1}\right]}^T,$$

$$g_1^{i_1}\cdots g_r^{i_r}(\alpha ),\text{ for }0\le i_j\le s_j,1\le j\le r$$

$$G_{i_1,\dots ,i_m}:=g_m^{i_m}\cdots g_1^{i_1}(\alpha )$$

$$\ell \circ g_1^{i_1}\cdots g_r^{i_r},\text{ for }0\le i_j\le s_j,1\le j\le r,$$

$$⟨g_1,\dots ,g_r:g_1^{e_1}=\cdots =g_r^{e_r}=1⟩,$$

$$\ell (g_1^{i_1},\dots ,g_r^{i_r}(\alpha )),1\le j\le r,0\le i_j\le e_j,$$

$$G_{i_1,\dots ,i_r}=g_1^{i_1}\cdots g_r^{i_r}(\alpha ),1\le m\le r,0\le i_m<s_m,$$

$$L_{j_1,\dots ,j_r}=\ell \circ (g_1^{s_1{j}_1}\cdots g_r^{s_r{j}_s}),1\le m\le r,0\le j_m<s_m,$$

$$⟨\sigma ,\tau :{\sigma }^m=1,{\tau }^s={\sigma }^t,{\tau }^{-1}\sigma \tau ={\sigma }^r⟩,$$

$$D_{2m}=⟨\sigma ,\tau :{\sigma }^m=1,{\tau }^2=1,{\tau }^{-1}\sigma \tau ={\sigma }^{m-1}⟩,$$

$$Q_m=⟨\sigma ,\tau :{\sigma }^{2m}=1,{\tau }^2={\sigma }^m,{\tau }^{-1}\sigma \tau ={\sigma }^{2m-1}⟩,$$

$$\{{\sigma }^i{\tau }^j,0\le i\le m-1,0\le j\le s-1\}$$

$$\{{\tau }^j{\sigma }^i,0\le i\le m-1,0\le j\le s-1\}.$$

$$\sum _{\begin{array}{c}i<m\\ j<s\end{array}}{c}_{i,j}{\sigma }^i{\tau }^j\text{or}\sum _{\begin{array}{c}i<m\\ j<s\end{array}}{c}_{i,j}^{\prime }{\tau }^j{\sigma }^i.$$

$$G_{i,j}:={\sigma }^i{\tau }^j(\alpha ),0\le i<\lceil \sqrt{m/s}\rceil ,0\le j<s.$$

$$L_k:=\ell \circ {\sigma }^{k\lceil \sqrt{m/s}\rceil },0\le k<\lceil \sqrt{sm}\rceil ,$$

$$L_k(s_{i,j})=\ell ({\sigma }^{k\lceil \sqrt{m/s}\rceil +i}{\tau }^j(\alpha )),$$

$$\mathsf{F}[G]\to M_{d_1}(D_1)\times \cdots \times M_{d_r}(D_r),$$

Full text

1 Introduction

For a finite Galois extension field ${\mathsf{K}}/{\mathsf{F}}$, with Galois group $G=\mathrm{Gal}({\mathsf{K}}/{\mathsf{F}})$, an element $\alpha\in{\mathsf{K}}$ is called normal if the set of its Galois conjugates $G\cdot\alpha=\{\sigma(\alpha):\sigma\in G\}$ forms a basis for ${\mathsf{K}}$ as a vector space over ${\mathsf{F}}$. The existence of normal element for any finite Galois extension is classical, and constructive proofs are provided in most algebra texts (see, e.g., Lang (2002), Section 6.13).

While there is a wide range of well-known applications of normal bases in finite fields, such as fast exponentiation Gao et al. (2000), there also exist applications of normal elements in characteristic zero. For instance, in multiplicative invariant theory, for a given permutation lattice and related Galois extension, a normal basis is useful in computing the multiplicative invariants explicitly Jamshidpey et al. (2018).

A number of algorithms are available for finding a normal element in characteristic zero fields and finite fields. Because of their immediate applications in finite fields, algorithms for determining normal elements in this case are most commonly seen. A fast randomized algorithm for determining a normal element in a finite field ${\mathbb{F}}_{q^{n}}/{\mathbb{F}}_{q}$, where ${\mathbb{F}}_{q^{n}}$ is the finite field with $q^{n}$ elements for any prime power $q$ and integer $n>1$, is presented by von zur Gathen and Giesbrecht (1990), with a cost of $O(n^{2}+n\log q)$ operations in ${\mathbb{F}}_{q}$. A faster randomized algorithm is introduced by Kaltofen and Shoup (1998), with a cost of $O(n^{1.815}\log q)$ operations in ${\mathbb{F}}_{q}$. In the bit complexity model, Kedlaya and Umans showed how to reduce the exponent of $n$ to $1.5+\varepsilon$ (for any $\varepsilon>0$), by leveraging their quasi-linear time algorithm for modular composition Kedlaya and Umans (2011). Lenstra (1991) introduced a deterministic algorithm to construct a normal element which uses $n^{O(1)}$ operations in ${\mathbb{F}}_{q^{n}}/{\mathbb{F}}_{q}$. To the best of our knowledge, the algorithm of Augot and Camion (1994) is the most efficient deterministic method, with a cost of $O(n^{3}+n^{2}\log q)$ operations in ${\mathbb{F}}_{q}$.

In characteristic zero, Schlickewei and Stepanov (1993) gave an algorithm for finding a normal basis of a number field over $\mathbb{Q}$ with a cyclic Galois group of cardinality $n$ which requires $n^{O(1)}$ operations in $\mathbb{Q}$. Poli (1994) gives an algorithm for the more general case of finding a normal basis in an abelian extension ${\mathsf{K}}/{\mathsf{F}}$ which requires $n^{O(1)}$ in ${\mathsf{F}}$. More generally in characteristic zero, for any Galois extension ${\mathsf{K}}/{\mathsf{F}}$ of degree $n$ with Galois group given by a collection of $n$ matrices, Girstmair (1999) gives an algorithm which requires $O(n^{4})$ operations in ${\mathsf{F}}$ to construct a normal element in ${\mathsf{K}}$.

In this paper we present a new randomized algorithm for finding a normal element for abelian and metacyclic extensions, with a runtime quadratic in the degree $n$ of the extension. The costs of all algorithms are measured by counting arithmetic operations in ${\mathsf{F}}$ at unit cost. Questions related to the bit-complexity of our algorithms are challenging, and beyond the scope of this paper.

Our main conventions are the following.

Assumption 1**.**

Let ${\mathsf{K}}/{\mathsf{F}}$ be a finite Galois extension presented as ${\mathsf{K}}={\mathsf{F}}[x]/\langle P(x)\rangle$, for an irreducible polynomial $P\in{\mathsf{F}}[x]$ of degree $n$, with ${\mathsf{F}}$ of characteristic zero. Then,

• •

elements of ${\mathsf{K}}$ are written on the power basis $1,\xi,\dots,\xi^{n-1}$, where $\xi:=x\bmod P$;

• •

elements of $G$ are represented by their action on $\xi$.

In particular, for $g\in G$ given by means of $\gamma:=g(\xi)\in{\mathsf{K}}$, and $\beta=\sum_{0\leq i<n}\beta_{i}\xi^{i}\in{\mathsf{K}}$, the fact that $g$ is an ${\mathsf{F}}$-automorphism implies that $g(\beta)$ is equal to $\beta(\gamma)$, the polynomial composition of $\beta$ at $\gamma$ (reduced modulo $P$).

Our algorithms combine techniques and ideas due to von zur Gathen and Giesbrecht (1990); Kaltofen and Shoup (1998): $\alpha\in{\mathsf{K}}$ is normal if and only if the element $S_{\alpha}:=\sum_{g\in G}g(\alpha)g\in{\mathsf{K}}[G]$ is invertible in the group algebra ${\mathsf{K}}[G]$. The algorithms choose $\alpha$ at random; a generic choice is normal (so we expect $O(1)$ random trials to be sufficient). However, writing down $S_{\alpha}$ involves $\Theta(n^{2})$ elements in ${\mathsf{F}}$, which precludes a subquadratic runtime. Instead, knowing $\alpha$, the algorithms use a randomized reduction to a similar question in ${\mathsf{F}}[G]$, that amounts to applying a random projection $\ell:{\mathsf{K}}\to{\mathsf{F}}$ to all entries of $S_{\alpha}$, giving us an element $s_{\alpha,\ell}\in{\mathsf{F}}[G]$. For that, we adapt algorithms from Kaltofen and Shoup (1998) that were written for Galois groups of finite fields.

Having $s_{\alpha,\ell}$ in hand, we need to test its invertibility. In order to do so, we present an algorithm in the abelian case which relies on the fact that ${\mathsf{F}}[G]$ is isomorphic to a multivariate quotient polynomial ring by an ideal $(x^{e_{i}}_{i}-1)_{1\leq i\leq m}$, where $e_{i}$’s are positive integers.

For metacyclic groups, two algorithms are introduced to solve the same problem; which one is faster depends on the parameters defining our group. Both algorithms are based on testing the invertibility of an injective homomorphic image of $s_{\alpha,\ell}$ in a matrix algebra over a product of fields. These questions are closely related to that of Fourier transform over $G$, and it is worth mentioning that there is a vast literature on fast algorithms for Fourier transforms (over the base field $\mathbb{C}$). Relevant to our current context, we invite the reader to consult Clausen and Müller (2004); Maslen et al. (2018) and references therein for details. At this stage, it is not clear how we can apply these methods in our context.

This paper is written from the point of view of obtaining improved asymptotic complexity estimates. Since our main goal is to highlight the exponent (in $n$) in our runtime analyses, costs are given using the soft-O notation: $S(n)$ is in $\tilde{O}(T(n))$ if it is in $O(T(n)\log(T(n))^{c})$, for some constant $c$.

The main result of this paper is the following theorem; we use a constant $\omega(4/3)$ that describes the cost of certain rectangular matrix products (see the end of this section).

Theorem 1**.**

Under Assumption 1, a normal element of ${\mathsf{K}}$ can be found using $\tilde{O}(|G|^{(3/4)\cdot\omega(4/3)})$ operations in ${\mathsf{F}}$ if $G$ is abelian, with $(3/4)\cdot\omega(4/3)<1.99$. Moreover, the same problem for metacyclic groups can be solved using $\tilde{O}(|G|^{2})$ operations in ${\mathsf{F}}$. The algorithms are randomized.

Although the cost is quadratic in the size of input for a general metacyclic group, in many cases it will be (slightly) subquadratic, under specific conditions on the parameters defining $G$ (see Section 4).

Section 2 of this paper is devoted to definitions and preliminary discussions. In Section 3, two subquadratic-time algorithms are presented for the randomized reduction of our main question to invertibility testing in ${\mathsf{F}}[G]$, for respectively abelian and metacyclic groups. Finally, in Section 4, we show that the latter problem can be solved in quasi-linear time for an abelian group; for metacyclic groups, we give a quadratic time algorithm, and discuss cases when the cost can be improved.

Our algorithms make extensive of known algorithms for polynomial and matrix arithmetic; in particular, we use repeatedly the fact that polynomials of degree $d$ in ${\mathsf{F}}[x]$, for any field ${\mathsf{F}}$ of characteristic zero, can be multiplied in $\tilde{O}(n)$ operations in ${\mathsf{F}}$ Schönhage and Strassen (1971). As a result, arithmetic operations $(+,\times,\div)$ in ${\mathsf{K}}$ can all be done using $\tilde{O}(n)$ operations in ${\mathsf{F}}$ von zur Gathen and Gerhard (2013).

For matrix arithmetic, we will rely on some non-trivial results on rectangular matrix multiplication initiated by Lotti and Romani (1983). For $k\in\mathbb{R}$, we denote by $\omega(k)$ a constant such that over any ring, matrices of sizes $(n,n)$ by $(n,\lceil n^{k}\rceil)$ can be multiplied in $O(n^{\omega(k)})$ ring operations (so $\omega(1)$ is the usual exponent of square matrix multiplication, which we simply write $\omega$). The sharpest values known to date for most rectangular formats are from Le Gall and Urrutia (2018); for $k=1$, the best known value is $\omega\leq 2.373$ by Le Gall (2014). Over a field, we will frequently use the fact that further matrix operations (determinant or inverse) can be done in $O(n^{\omega})$ base field operations.

2 Preliminaries

One of the well-known proofs of the existence of a normal element for a finite Galois extension (Lang, 2002, Theorem 6.13.1) suggests a randomized algorithm for finding such an element. Assume ${\mathsf{K}}/{\mathsf{F}}$ is a finite Galois extension with Galois group $G=\{g_{1},\ldots,g_{n}\}$. If $\alpha\in{\mathsf{K}}$ is a normal element, then

[TABLE]

implies $c_{1}=\dots=c_{n}=0$. For each $i\in\{1,\ldots,n\}$, applying $g_{i}$ to equation (2.1) yields

[TABLE]

Using (2.1) and (2.2), one can form the linear system $\mathbf{{M}}_{G}(\alpha)\boldsymbol{c}=\textbf{0}$, with $\boldsymbol{c}=[c_{1}~{}\cdots~{}c_{n}]^{T}$ and where, for $\alpha\in{\mathsf{K}}$,

[TABLE]

Classical proofs then proceed to show that there exists $\alpha\in{\mathsf{K}}$ with $\det(\mathbf{{M}}_{G}(\alpha))\neq 0$.

This approach can be used as the basis of a randomized algorithm for finding a normal element: choose a random element $\alpha$ in ${\mathsf{K}}$ until we find one such that $\mathbf{{M}}_{G}(\alpha)$ is invertible. A direct implementation computes all the entries of the matrix and then uses linear algebra to compute its determinant; using fast matrix arithmetic this requires $O(n^{\omega})$ operations in ${\mathsf{K}}$, that is $\tilde{O}(n^{\omega+1})$ operations in ${\mathsf{F}}$. This is at least cubic in $n$, and only a minor improvement over the previously best-known approach of Girstmair (1999). The main contribution of this paper is to show how to speed up this verification.

Before entering that discussion, we briefly discuss the probability that $\alpha$ be a normal element: if we write $\alpha=a_{0}+\cdots+a_{n-1}\xi^{n-1}$, the determinant of $\mathbf{{M}}_{G}(\alpha)$ is a (not identically zero) homogeneous polynomial of degree $n$ in $(a_{0},\dots,a_{n-1})$. If the $a_{i}$’s are chosen uniformly at random in a finite set $X\subset{\mathsf{F}}$, the Lipton-DeMillo-Schwartz-Zippel implies that the probability that $\alpha$ be normal is at least $1-n/|X|$.

If $G$ is cyclic, von zur Gathen and Giesbrecht (1990) avoid computing a determinant by computing the GCD of $S_{\alpha}:=\sum_{i=0}^{n-1}g_{i}(\alpha)x^{i}$ and $x^{n}-1$. In effect, this amounts to testing whether $S_{\alpha}$ is invertible in the group ring ${\mathsf{K}}[G]$, which is isomorphic to ${\mathsf{K}}[x]/\langle x^{n}-1\rangle$. This is a general fact: for any $G$, $\mathbf{{M}}_{G}(\alpha)$ is the matrix of (left) multiplication by the orbit sum

[TABLE]

and $\alpha$ being normal is equivalent to $S_{\alpha}$ being a unit in ${\mathsf{K}}[G]$. This point of view may make it possible to avoid linear algebra of size $n$ over ${\mathsf{K}}$, but writing $S_{\alpha}$ itself still involves $\Theta(n^{2})$ elements in ${\mathsf{F}}$. The following lemma is the main new ingredient in our algorithm: it gives a randomized reduction to testing whether a suitable projection of $S_{\alpha}$ in ${\mathsf{F}}[G]$ is a unit.

Lemma 2**.**

For $\alpha\in{\mathsf{K}}$, $\mathbf{{M}}_{G}(\alpha)$ is invertible if and only if

[TABLE]

is invertible, for a generic ${\mathsf{F}}$-linear projection $\ell:{\mathsf{K}}\to{\mathsf{F}}$.

Proof.

$(\Rightarrow)$ For a fixed $\alpha\in{\mathsf{K}}$, any entry of $\mathbf{{M}}_{G}(\alpha)$ can be written as

[TABLE]

and for $\ell:{\mathsf{K}}\to{\mathsf{F}}$, the corresponding entry in $\ell(\mathbf{{M}}_{G}(\alpha))$ can be written $\sum_{k=0}^{n-1}a_{ijk}\ell_{k}$, with $\ell_{k}=\ell(\xi^{k})$. Replacing these $\ell_{k}$’s by indeterminates $L_{k}$’s, the determinant becomes a polynomial in $P\in{\mathsf{F}}[L_{1},\ldots,L_{n}].$ Viewing $P$ in ${\mathsf{K}}[L_{1},\ldots,L_{n}]$, we have $P(1,\xi,\ldots,\xi^{n-1})$ $=\det(\mathbf{{M}}_{G}(\alpha))$, which is non-zero by assumption. Hence, $P$ is not identically zero, and the conclusion follows.

$(\Leftarrow)$ Assume $\mathbf{{M}}_{G}(\alpha)$ is not invertible. Following the proof of (Jamshidpey et al., 2018, Lemma 4), we first show that there exists a non-zero $\boldsymbol{u}\in{\mathsf{F}}^{n}$ in the kernel of $\mathbf{{M}}_{G}(\alpha)$.

The elements of $G$ act on rows of $\mathbf{{M}}_{G}(\alpha)$ entrywise and the action permutes the rows the matrix. Assume $\varphi:G\to\mathfrak{S}_{n}$ is the group homomorphism such that $g(\mathbf{{M}}_{i})=\mathbf{{M}}_{\varphi(g)(i)}$ for all $i$, where $\mathbf{{M}}_{i}$ is the $i$-th row of $\mathbf{{M}}_{G}(\alpha)$.

Since $\mathbf{{M}}_{G}(\alpha)$ is singular, there exists a non-zero $\boldsymbol{v}\in{\mathsf{K}}^{n}$ such that $\mathbf{{M}}_{G}(\alpha)\boldsymbol{v}=0$; we choose $\boldsymbol{v}$ having the minimum number of non-zero entries. Let $i\in\{1,\ldots,n\}$ such that $v_{i}\neq 0$. Define $\boldsymbol{u}=1/v_{i}\boldsymbol{v}$. Then, $\mathbf{{M}}_{G}(\alpha)\boldsymbol{u}=0,$ which means $\mathbf{{M}}_{j}\boldsymbol{u}=0$ for $j\in\{1,\ldots,n\}$. For $g\in G$, we have $g(\mathbf{{M}}_{j}\boldsymbol{u})=\mathbf{{M}}_{\varphi(g)(j)}g(\boldsymbol{u})=0.$ Since this holds for any $j$, we conclude that $\mathbf{{M}}_{G}(\alpha)g(\boldsymbol{u})=0$, hence $g(\boldsymbol{u})-\boldsymbol{u}$ is in the kernel of $\mathbf{{M}}_{G}(\alpha)$. On the other hand since the $i$-th entry of $\boldsymbol{u}$ is one, the $i$-th entry of $g(\boldsymbol{u})-\boldsymbol{u}$ is zero. Thus the minimality assumption on v shows that $g(\boldsymbol{u})-\boldsymbol{u}=0$, equivalently $g(\boldsymbol{u})=\boldsymbol{u}$, and hence $\boldsymbol{u}\in{\mathsf{F}}^{n}$.

Now we show that $\ell(\mathbf{{M}}_{G}(\alpha))$ is not invertible for all choices of $\ell$. By Equation (2.3), we can write

[TABLE]

Since $\boldsymbol{u}$ has entries in ${\mathsf{F}}$, $\mathbf{{M}}_{G}(\alpha)\boldsymbol{u}=0$ yields $\mathbf{{M}}^{(j)}\boldsymbol{u}=0$ for $j\in\{1,\ldots,n\}$. Hence,

[TABLE]

for any $\ell_{j}$’s in ${\mathsf{F}}$, and $\ell(\mathbf{{M}}_{G}(\alpha))$ is not invertible for any $\ell$. ∎

Our algorithm can be sketched as follows: choose random $\alpha$ in ${\mathsf{K}}$ and $\ell:{\mathsf{K}}\to{\mathsf{F}}$, and let

[TABLE]

The matrix $\ell(\mathbf{{M}}_{G}(\alpha))$ is the multiplication matrix by $s_{\alpha,\ell}$ in ${\mathsf{F}}[G]$, so once $s_{\alpha,\ell}$ is known, we are left with testing whether it is a unit in ${\mathsf{F}}[G]$. In the next two sections, we address the respective questions of computing $s_{\alpha,\ell}$, and testing its invertibility in ${\mathsf{F}}[G]$.

3 Computing projections of the orbit sum

In this section we present algorithms to compute $s_{\alpha,\ell}$, when $G$ is either abelian or metacyclic. We start by sketching our ideas in simplest case, cyclic groups. We will see that they follow closely ideas used in Kaltofen and Shoup (1998) over finite fields.

Suppose $G=\langle g\rangle$, so that given $\alpha$ in ${\mathsf{K}}$ and $\ell:{\mathsf{K}}\to{\mathsf{F}}$, our goal is to compute

[TABLE]

Kaltofen and Shoup (1998) call this the automorphism projection problem and gave an algorithm to solve it in subquadratic time, when $g$ is the $q$-power Frobenius $\mathbb{F}_{q^{n}}\to\mathbb{F}_{q^{n}}$. The key idea in their algorithm is to use the baby-steps/giant-steps technique: for a suitable parameter $t$, the values in (3.1) can be rewritten as

[TABLE]

First, we compute all $G_{i}:=g^{i}(\alpha)$ for $0\leq i<t$. Then we compute all $L_{j}:=\ell\circ g^{tj}$ for $0\leq j<m$, where the $L_{j}$’s are themselves linear mappings ${\mathsf{K}}\to{\mathsf{F}}$. Finally, a matrix product yields all values $L_{j}(G_{i})$.

The original algorithm of Kaltofen and Shoup (1998) relies on the properties of the Frobenius mapping to achieve subquadratic runtime. In our case, we cannot apply these results directly; instead, we have to revisit the proofs of Kaltofen and Shoup (1998), Lemmata 3, 4 and 8, now considering rectangular matrix multiplication. Our exponents involve the constant $\omega(4/3)$, for which we have the upper bound $\omega(4/3)<2.654$: this follows from the upper bounds on $\omega(1.3)$ and $\omega(1.4)$ given by Le Gall and Urrutia (2018), and the fact that $k\mapsto\omega(k)$ is convex Lotti and Romani (1983). In particular, $3/4\cdot\omega(4/3)<1.99$. Note also the inequality $\omega(k)\geq 1+k$ for $k\geq 1$, since $\omega(k)$ describes products with input and output size $O(n^{1+k})$.

3.1 Multiple automorphism evaluation and applications

The key to the algorithms below is the remark following Assumption 1, which reduces automorphism evaluation to modular composition of polynomials. Over finite fields, this idea goes back to von zur Gathen and Shoup (1992), where it was credited to Kaltofen.

For instance, given $g\in G$ (by means of $\gamma:=g(\xi)$), we can deduce $g^{2}\in G$ (again, by means of its image at $\xi$) as $\gamma(\gamma)$; this can be done with $\tilde{O}(n^{(\omega+1)/2})$ operations in ${\mathsf{F}}$ using Brent and Kung’s modular composition algorithm Brent and Kung (1978). The algorithms below describe similar operations along these lines, involving several simultaneous evaluations.

Lemma 3**.**

Given $\alpha_{1},\dots,\alpha_{s}$ in ${\mathsf{K}}$ and $g$ in $G=\mathrm{Gal}({\mathsf{K}}/{\mathsf{F}})$, with $s=O(\sqrt{n})$, we can compute $g(\alpha_{1}),\dots,g(\alpha_{s})$ with $\tilde{O}(n^{(3/4)\cdot\omega(4/3)})$ operations in ${\mathsf{F}}$.

Proof.

(Compare (Kaltofen and Shoup, 1998, Lemma 3)) As noted above, for $i\leq s$, $g(\alpha_{i})=\alpha_{i}(\gamma)$, with $\gamma:=g(\xi)\in{\mathsf{K}}$. Let $t:=\lceil n^{3/4}\rceil$, $m:=\lceil n/t\rceil$, and rewrite $\alpha_{1},\ldots,\alpha_{s}$ as

[TABLE]

where the $a_{i,j}$’s are polynomials of degree less than $t$. The next step is to compute $\gamma_{i}:=\gamma^{i}$, for $i=0,\ldots,t$. There are $t$ products in ${\mathsf{K}}$ to perform, so this amounts to $\tilde{O}(n^{7/4})$ operations in ${\mathsf{F}}$.

Having $\gamma_{i}$’s in hand, one can form the matrix $\boldsymbol{\Gamma}:=\left[\Gamma_{0}~{}\cdots~{}\Gamma_{t-1}\right]^{T}$, where each column $\Gamma_{i}$ is the coefficient vector of $\gamma_{i}$ (with entries in ${\mathsf{F}}$); this matrix has $t\in O(n^{3/4})$ rows and $n$ columns. We also form

[TABLE]

where ${A}_{i,j}$ is the coefficient vector of $a_{i,j}$. This matrix has $sm\in O(n^{3/4})$ rows and $t\in O(n^{3/4})$ columns.

Compute $\mathbf{{B}}:=\mathbf{{A}}\,\boldsymbol{\Gamma}$; as per our definition of exponents $\omega(\cdot)$, this can be done in $O(n^{(3/4)\cdot\omega(4/3)})$ operations in ${\mathsf{F}}$, and the rows of this matrix give all $a_{i,j}(\gamma)$. The last step to get all $\alpha_{i}(\gamma)$ is to write them as $\alpha_{i}(\gamma)=\sum_{0\leq j<m}a_{i,j}(\gamma)\gamma_{t}^{j}.$ Using Horner’s scheme, this takes $O(sm)$ operations in ${\mathsf{K}}$, which is $\tilde{O}(n^{7/4})$ operations in ${\mathsf{F}}$. Since we pointed out that $\omega(3/4)\geq 7/4$, the leading exponent in all costs seen so far is $(3/4)\cdot\omega(4/3)$. ∎

Lemma 4**.**

Given $\alpha$ in ${\mathsf{K}}$, $g_{1},\ldots,g_{r}$ in $G=\mathrm{Gal}({\mathsf{K}}/{\mathsf{F}})$ and positive integers $(s_{1},\ldots s_{r})$ such that $\prod_{i=1}^{r}s_{i}=O(\sqrt{n})$ and $r\in O(\log(n))$, all

[TABLE]

can be computed in $\tilde{O}(n^{(3/4)\cdot\omega(4/3)})$ operations in ${\mathsf{F}}$.

Proof.

(Compare (Kaltofen and Shoup, 1998, Lemma 4).) For a given $m\in\{1,\dots,r\}$, suppose we have computed

[TABLE]

for $0\leq i_{j}\leq s_{j}$ if $1\leq j<m$, and $0\leq i_{m}<k_{m},$ as well as the automorphism $\eta:={g_{m}}^{k_{m}}$ (by means of its value at $\xi$, as per our convention).

Then, we can obtain $G_{i_{1},\dots,i_{m}}$ for $0\leq i_{j}\leq s_{j}$ if $1\leq j<m$, and $0\leq i_{m}<2k_{m}$, by computing $\eta(G_{i_{1},\dots,i_{m}})$, for all indices $i_{1},\dots,i_{m}$ available to us, that is, $0\leq i_{j}\leq s_{j}$ if $1\leq j<m$, and $0\leq i_{m}<k_{m}$. This can be carried out using $\tilde{O}(n^{(3/4)\cdot\omega(4/3)})$ operations in ${\mathsf{F}}$ by applying Lemma 3. Prior to entering the next iteration, we also compute $\eta^{2}$ by means of one modular composition, whose cost is negligible.

Using the above doubling method for $g_{m}$, we have to do $O(\log s_{m})$ steps, for a total cost of $\tilde{O}(n^{(3/4)\cdot\omega(4/3)})$ operations in ${\mathsf{F}}$. We repeat this procedure for $m=1,\dots,r$; since $r$ is in $O(\log(n))$, the cost remains $\tilde{O}(n^{(3/4)\cdot\omega(4/3)})$. ∎

We now present dual versions of the previous two lemmas (our reference Kaltofen and Shoup (1998) also had such a discussion). Seen as an ${\mathsf{F}}$-linear map, the operator $g:\alpha\mapsto g(\alpha)$ admits a transpose, which maps an ${\mathsf{F}}$-linear form $\ell:{\mathsf{K}}\to{\mathsf{F}}$ to the ${\mathsf{F}}$-linear form $\ell\circ g:\alpha\mapsto\ell(g(\alpha))$. The transposition principle Kaminski et al. (1988); Canny et al. (1989) implies that if a linear map ${\mathsf{F}}^{N}\to{\mathsf{F}}^{M}$ can be computed in time $T$, its transpose can be computed in time $T+O(N+M)$. In particular, given $s$ linear forms $\ell_{1},\dots,\ell_{s}$ and $g$ in $G$, transposing Lemma 3 shows that we can compute $\ell_{1}\circ g,\dots,\ell_{s}\circ g$ in time $\tilde{O}(n^{(3/4)\cdot\omega(4/3)})$. The following lemma sketches the construction.

Lemma 5**.**

Given ${\mathsf{F}}$-linear forms $\ell_{1},\dots,\ell_{s}:{\mathsf{K}}\to{\mathsf{F}}$ and $g$ in $G=\mathrm{Gal}({\mathsf{K}}/{\mathsf{F}})$, with $s=O(\sqrt{n})$, we can compute $\ell_{1}\circ g,\dots,\ell_{s}\circ g$ in time $\tilde{O}(n^{{3}/{4}\omega({4}/{3})})$.

Proof.

Given $\ell_{i}$ by its values on the power basis $1,\xi,\dots,\xi^{n-1}$, $\ell_{i}\circ g$ is represented by its values at $1,\gamma,\dots,\gamma^{n-1}$, with $\gamma:=g(\xi)$.

Let $t,m$ and $\gamma_{0},\dots,\gamma_{t}$ be as in the proof of Lemma 3. Next, compute the “giant steps” $\gamma_{t}^{j}=\gamma^{tj}$, $j=0,\dots,m-1$ and for $i=1,\dots,s$ and $j=0,\dots,m-1$, deduce the linear forms $L_{i,j}$ defined by $L_{i,j}(\alpha):=\ell_{i}(\gamma^{tj}\alpha)$ for all $\alpha$ in ${\mathsf{K}}$. Each of them can be obtained by a transposed multiplication in time $\tilde{O}(n)$ (Shoup, 1995, Section 4.1), so that the total cost thus far is $\tilde{O}(n^{7/4})$.

Finally, multiply the $(sm\times n)$ matrix with entries the coefficients of all $L_{i,j}$ (as rows) by the $(n\times t)$ matrix with entries the coefficients of $\gamma_{0},\dots,\gamma_{t-1}$ (as columns) to obtain all values $\ell_{i}(\gamma^{j})$, for $i=1,\dots,s$ an $j=0,\dots,n-1$. This can be accomplished with $O(n^{(3/4)\cdot\omega(4/3)})$ operations in ${\mathsf{F}}$. ∎

From this, we deduce the transposed version of Lemma 4, whose proof follows the same pattern.

Lemma 6**.**

Given $\ell:{\mathsf{K}}\to F$, $g_{1},\ldots,g_{r}$ in $G=\mathrm{Gal}({\mathsf{K}}/{\mathsf{F}})$ and positive integers $(s_{1},\ldots s_{r})$ such that $\prod_{i=1}^{r}s_{i}=O(\sqrt{n})$ and $r\in O(\log(n))$, all linear maps

[TABLE]

can be computed in $\tilde{O}(n^{(3/4)\cdot\omega(4/3)})$ operations in ${\mathsf{F}}$.

Proof.

(Compare (Kaltofen and Shoup, 1998, Lemma 8).) We proceed as in Lemma 4. For $m=1,\dots,r$, assume we know $L_{i_{1},\dots,i_{m}}:=\ell\circ(g_{1}^{i_{1}}\cdots g_{m}^{i_{m}}),$ for $0\leq i_{j}\leq s_{j}$ if $1\leq j<m$, and $0\leq i_{m}<k_{m}.$ Using the previous lemma, we compute all $L_{i_{1},\dots,i_{m}}\circ{g_{m}}^{k_{m}},$ which gives us $L_{i_{1},\dots,i_{m}}$ for indices $0\leq i_{m}<2k_{m}$. The cost analysis is as in Lemma 4. ∎

3.2 Abelian Groups

The first main result in this section is the following proposition. Assume $G$ is an abelian group presented as

[TABLE]

where $e_{i}\in\mathbb{N}$ is the order of $g_{i}$ and $n=e_{1}\cdots e_{r}$. Without loss of generality, we assume $e_{i}\geq 2$ for all $i$, so that $r$ is in $O(\log n)$. Elements of ${\mathsf{F}}[G]$ are written as polynomials $\sum_{i_{1},\dots,i_{r}}c_{i_{1},\dots,i_{r}}{g_{1}}^{e_{1}}\cdots{g_{r}}^{e_{r}}$, with $0\leq i_{j}<e_{j}$ for all $j$.

Proposition 7**.**

Suppose that $G$ is abelian, with notation as above. For $\alpha$ in ${\mathsf{K}}$ and $\ell:{\mathsf{K}}\to{\mathsf{F}}$, $s_{\alpha,\ell}\in{\mathsf{F}}[G]$, as defined in (2.4), is computable using $\tilde{O}(n^{(3/4)\cdot\omega(4/3)})$ operations in ${\mathsf{F}}$.

Proof.

Our goal is to compute

[TABLE]

where $\ell$ is an ${\mathsf{F}}$-linear projection ${\mathsf{K}}\to{\mathsf{F}}$. For $1\leq i\leq r$, define $s_{i}:=\lceil\sqrt{e_{i}}\rceil$. As we sketched in the cyclic case, the elements in (3.2) can be expressed as $L_{j_{1},\dots,j_{r}}(G_{i_{1},\dots,i_{r}})$, for $1\leq m\leq r,0\leq i_{m}<s_{m},0\leq j_{m}<s_{m}$. Here, $L_{j_{1},\dots,j_{r}}:=\ell\circ(g_{1}^{s_{1}j_{1}}\cdots g_{r}^{s_{r}j_{s}})$ are linear projections presented as row vectors and $G_{i_{1},\dots,i_{r}}:=g_{1}^{i_{1}}\cdots g_{r}^{i_{r}}(\alpha)$ are field elements presented as column vectors. Then, all elements in (3.2) can be computed with the following steps, the sum of whose costs proves the proposition.

Step 1. Apply Lemma 4 to get

[TABLE]

with cost $\tilde{O}(n^{(3/4)\cdot\omega(4/3)})$.

Step 2. Compute all $g_{i}^{s_{i}}$, $i=1,\dots,r$; this involves $O(\log(n))$ modular compositions, so the cost is negligible compared to that of Step 1.

Step 3. Use Lemma 6 to compute

[TABLE]

with cost $\tilde{O}(n^{(3/4)\cdot\omega(4/3)})$

Step 4. Multiply the matrix with rows the coefficients of all $L_{j_{1},\dots,j_{r}}$ by the matrix with columns the coefficients of all $G_{i_{1},\dots,i_{r}}$; this yields all required values. We compute this product in $O(n^{(1/2)\cdot\omega(2)})$ operations in ${\mathsf{F}}$, which is in $O(n^{(3/4)\cdot\omega(4/3)})$. ∎

3.3 Metacyclic Groups

A group $G$ is metacyclic if it has a normal cyclic subgroup $H$ such that $G/H$ is cyclic; for instance, any group with a squarefree order is metacyclic. See (Johnson, 1976, p. 88) or (Curtis and Reiner, 1988, p. 334) for more background. A metacyclic group can always be presented as

[TABLE]

for some integers $m,t,r,s$, with $r,t\leq m$ and $r^{s}=1\bmod t,rt=t\bmod m$. For example, the dihedral group

[TABLE]

is metacyclic, with $s=2$. Generalized quaternion groups, which can be presented as

[TABLE]

are metacyclic, with $s=2$ as well.

Using the notation of (3.3), $n=|G|$ is equal to $ms$, and all elements in a metacyclic group can be presented uniquely as either

[TABLE]

or

[TABLE]

Accordingly, elements in the group algebra ${\mathsf{F}}[G]$ can be written as either

[TABLE]

Conversion between the two representations involves no operation in ${\mathsf{F}}$, using the commutation relation $\sigma^{k}\tau^{c}=\tau^{c}\sigma^{kr^{c}}$ for $k,c\geq 0$.

Proposition 8**.**

Suppose that $G$ is metacyclic, with notation as above. For $\alpha$ in ${\mathsf{K}}$ and $\ell:{\mathsf{K}}\to{\mathsf{F}}$, $s_{\alpha,\ell}\in{\mathsf{F}}[G]$ is computable using $\tilde{O}(n^{(3/4)\cdot\omega(4/3)})$ operations in ${\mathsf{F}}$.

Proof.

Suppose first that $s\leq m$; then, we use the presentation (3.4) of the elements of $G$. Take $\alpha$ in ${\mathsf{K}}$ and $\ell:{\mathsf{K}}\to{\mathsf{F}}$; the goal is to compute $\ell(\sigma^{i}\tau^{j}(\alpha))$, for all $0\leq i<m$ and $0\leq j<s.$ This is accomplished with the following steps.

Step 1. Apply Lemma 4 to compute

[TABLE]

Note that $\lceil\sqrt{m/s}\rceil s\leq\lceil\sqrt{sm}\rceil\in O(\sqrt{n})$, so we are under the assumptions of the lemma. This takes $\tilde{O}(n^{(3/4)\cdot\omega(4/3)})$ operations in ${\mathsf{F}}$.

Step 2. Compute $\sigma^{\lceil\sqrt{m/s}\rceil}$, in $O(\log(n))$ modular compositions in degree $n$. The cost is no more than that of Step 1.

Step 3. Compute

[TABLE]

using Lemma 6. This takes $\tilde{O}(n^{(3/4)\cdot\omega(4/3)})$ operations in ${\mathsf{F}}$.

Step 4. At this point, we compute all

[TABLE]

for $0\leq k<\lceil\sqrt{sm}\rceil$, $0\leq i<\lceil\sqrt{m/s}\rceil$ and $0\leq j<s;$ these are precisely the values we needed.

This can be carried out by multiplying the matrix with rows the coefficients of all $L_{k}$ by the matrix with columns the coefficients of all $G_{i,j}$; this yields all required values, as pointed out above. There are $O(\sqrt{sm})=O(\sqrt{n})$ linear forms $L_{k}$’s, and $O(\sqrt{n})$ field elements $G_{i,j}$’s, so we can compute this product in $O(n^{(1/2)\cdot\omega(2)})$ operations in ${\mathsf{F}}$, which is $O(n^{(3/4)\cdot\omega(4/3)})$.

This concludes the proof in the case $s\leq m$. When $m\leq s$, use the presentation (3.5) of the elements of $G$ and proceed as above. ∎

4 Testing Invertibility in the Group Algebra

In this section we consider the problem of invertibility testing in ${\mathsf{F}}[G]$, specifically for abelian and metacyclic groups $G$: given an element $\beta$ in ${\mathsf{F}}[G]$, for a field ${\mathsf{F}}$ and a group $G$, determine whether $\beta$ is a unit in ${\mathsf{F}}[G]$. As well as being necessary in our application to normal bases, we believe these problems are of independent interest.

Since we are in characteristic zero, Wedderburn’s theorem implies the existence of an ${\mathsf{F}}$-algebra isomorphism (which we will refer to as a Fourier Transform)

[TABLE]

where all $D_{i}$’s are division algebras over ${\mathsf{F}}$. If we were working over ${\mathsf{F}}=\mathbb{C}$, all $D_{i}$’s would simply be $\mathbb{C}$ itself. A natural solution to test the invertibility of $\beta\in{\mathsf{F}}[G]$ would then be to compute its Fourier transform and test whether all its components $\beta_{1}\in M_{d_{1}}(\mathbb{C}),\dots,\beta_{r}\in M_{d_{r}}(\mathbb{C})$ are invertible. This boils down to linear algebra over $\mathbb{C}$, and takes $O(d_{1}^{\omega}+\cdots+d_{r}^{\omega})$ operations. Since $d_{1}^{2}+\cdots+d_{r}^{2}=|G|$, this is $O(|G|^{\omega/2})$ operations in $\mathbb{C}$.

However, we do not wish to make such a strong assumption as ${\mathsf{F}}=\mathbb{C}$. Since we measure the cost of our algorithms in ${\mathsf{F}}$-operations, the direct approach that embeds ${\mathsf{F}}[G]$ into $\mathbb{C}[G]$ does not make it possible to obtain a subquadratic cost in general. If, for instance, ${\mathsf{F}}=\mathbb{Q}$ and $G$ is cyclic of order $n=2^{k}$, computing the Fourier Transform of $\beta$ requires we work in a degree $n/2$ extension of $\mathbb{Q}$, implying a quadratic runtime.

In this section, we give algorithms for the problem of invertibility testing for the families of group seen so far, abelian and metacyclic. For the former, we actually prove a stronger result: starting from a suitable presentation of $G$, we give a softly linear-time algorithm to find an isomorphic image of $\beta\in{\mathsf{F}}[G]$ in a product of ${\mathsf{F}}$-algebras of the form ${\mathsf{F}}[z]/\langle P_{i}(z)\rangle$, for certain polynomials $P_{i}\in{\mathsf{F}}[z]$ (recovering $\beta$ from its image is softly-linear time as well). Not only does this allow us to test whether $\beta$ is invertible, this would also make it possible to find its inverse in ${\mathsf{F}}[G]$ (or to compute products in ${\mathsf{F}}[G]$) in softly-linear time. We are not aware of previous results of this kind. For metacyclic groups, we describe an injective ${\mathsf{F}}$-algebra homomorphism from ${\mathsf{F}}[G]$ to a matrix algebras over a cyclotomic ring. The codomain is in general of dimension higher than $|G|$, so the algorithm we deduce from this is not linear-time.

4.1 Abelian groups

Because an abelian group is a product of cyclic groups, the group algebra ${\mathsf{F}}[G]$ of such a group is the tensor product of cyclic algebras. Using this property, given an element $\beta$ in ${\mathsf{F}}[G]$, our goal in this section is to determine whether $\beta$ is a unit.

The previous property implies that ${\mathsf{F}}[G]$ admits a description of the form ${\mathsf{F}}[x_{1},\dots,x_{t}]/\langle x_{1}^{n_{1}}-1,\dots,x_{t}^{n_{t}}-1\rangle$, for some integers $n_{1},\dots,n_{t}$. The complexity of arithmetic operations in an ${\mathsf{F}}$-algebra such as $\mathbb{A}:={\mathsf{F}}[x_{1},\dots,x_{t}]/\langle P_{1}(x_{1}),\dots,P_{t}(x_{t})\rangle$ is difficult to pin down precisely. For general $P_{i}$’s, the cost of multiplication in $\mathbb{A}$ is known to be $O(\dim(\mathbb{A})^{1+\varepsilon})$, for any $\varepsilon>0$ (Li et al., 2009, Theorem 2). From this it may be possible to deduce similar upper bounds on the complexity of invertibility tests, following Dahan et al. (2006), but this seems non-trivial.

Instead, we give an algorithm with softly linear runtime, that uses the factorization properties of cyclotomic polynomials and Chinese remaindering techniques to transform our problem into that of invertibility testing in algebras of the form ${\mathsf{F}}[z]/\langle P_{i}(z)\rangle$, for various polynomials $P_{i}$. The reference Poli (1994) also discusses the factors of algebras such as ${\mathsf{F}}[x_{1},\dots,x_{t}]/\langle x_{1}^{n_{1}}-1,\dots,x_{t}^{n_{t}}-1\rangle$, but the resulting algorithms are different (and the cost of the Poli’s 1994 algorithm is only known to be polynomial in $|G|$).

Tensor product of two cyclotomic rings: coprime orders. The following proposition will be the key to foregoing multivariate polynomials, and replacing them by univariate ones. Let $m,m^{\prime}$ be two coprime integers and define

[TABLE]

where for $i\geq 0$, $\Phi_{i}$ is the cyclotomic polynomial of order $i$. In what follows, $\varphi$ is Euler’s totient function, so that $\varphi(i)=\deg(\Phi_{i})$ for all $i$.

Lemma 9**.**

There exists an ${\mathsf{F}}$-algebra isomorphism $\gamma:\mathbbm{h}\to{\mathsf{F}}[z]/\langle\Phi_{mm^{\prime}}(z)\rangle$ given by $xx^{\prime}\mapsto z$. Given $\Phi_{m}$ and $\Phi_{m^{\prime}}$, $\Phi_{mm^{\prime}}$ can be computed in time $\tilde{O}(\varphi(mm^{\prime}))$; given these polynomials, one can apply $\gamma$ and its inverse to any input using $\tilde{O}(\varphi(mm^{\prime}))$ operations in ${\mathsf{F}}$.

Proof.

Without loss of generality, we prove the first claim over $\mathbb{Q}$; the result over ${\mathsf{F}}$ follows by scalar extension. In the field $\mathbb{Q}[x,x^{\prime}]/\langle\Phi_{m}(x),\Phi_{m^{\prime}}(x^{\prime})\rangle$, $xx^{\prime}$ is cancelled by $\Phi_{mm^{\prime}}$. Since this polynomial is irreducible, it is the minimal polynomial of $xx^{\prime}$, which is thus a primitive element for $\mathbb{Q}[x,x^{\prime}]/\langle\Phi_{m}(x),\Phi_{m^{\prime}}(x^{\prime})\rangle$. This proves the first claim.

For the second claim, we first determine the images of $x$ and $x^{\prime}$ by $\gamma$. Start from a Bézout relation $am+a^{\prime}m^{\prime}=1$, for some $a,a^{\prime}$ in $\mathbb{Z}$. Since $x^{m}={x^{\prime}}^{m^{\prime}}=1$ in $\mathbbm{h}$, we deduce that $\gamma(x)=z^{u}$ and $\gamma(x^{\prime})=z^{v}$, with $u:=am\bmod mm^{\prime}$ and $v:=a^{\prime}m^{\prime}\bmod mm^{\prime}$. To compute $\gamma(P)$, for some $P$ in $\mathbbm{h}$, we first compute $P(z^{u},z^{v})$, keeping all exponents reduced modulo $mm^{\prime}$. This requires no arithmetic operations and results in a polynomial $\bar{P}$ of degree less than $mm^{\prime}$, which we eventually reduce modulo $\Phi_{mm^{\prime}}$ (the latter is obtained by the composed product algorithm of Bostan et al. (2006) in quasi-linear time). By (Bach and Shallit, 1996, Theorem 8.8.7), we have the bound $s\in O(\varphi(s)\log(\log(s)))$, so that $s$ is in $\tilde{O}(\varphi(s))$. Thus, we can reduce $\bar{P}$ modulo $\Phi_{mm^{\prime}}$ in $\tilde{O}(\varphi(mm^{\prime}))$ operations, establishing the cost bound for $\gamma$.

Conversely, given $Q$ in ${\mathsf{F}}[z]/\langle\Phi_{mm^{\prime}}(z)\rangle$, we obtain its preimage by replacing powers of $z$ by powers of $xx^{\prime}$, reducing all exponents in $x$ modulo $m$, and all exponents in $x^{\prime}$ modulo $m^{\prime}$. We then reduce the result modulo both $\Phi_{m}(x)$ and $\Phi_{m^{\prime}}(x^{\prime})$. By the same argument as above, the cost is softly linear in $\varphi(mm^{\prime})$. ∎

Extension to several cyclotomic rings. The natural generalization of the algorithm above starts with pairwise distinct primes $\boldsymbol{p}=(p_{1},\dots,p_{t})$, non-negative exponent $\boldsymbol{c}=(c_{1},\dots,c_{t})$ and variables $\boldsymbol{x}=(x_{1},\dots,x_{t})$ over ${\mathsf{F}}$. Now, we define

[TABLE]

when needed, we will write $\mathbb{H}$ as $\mathbb{H}_{\boldsymbol{p},\boldsymbol{c},\boldsymbol{x}}$. Finally, we let $\mu:={p_{1}}^{c_{1}}\cdots{p_{t}}^{c_{t}}$; then, the dimension $\dim(\mathbb{H})$ is $\varphi(\mu)$.

Lemma 10**.**

There exist an ${\mathsf{F}}$-algebra isomorphism $\Gamma:\mathbb{H}\to{\mathsf{F}}[z]/\langle\Phi_{\mu}(z)\rangle$ given by $x_{1}\cdots x_{t}\mapsto z$. One can apply $\Gamma$ and its inverse to any input using $\tilde{O}(\dim(\mathbb{H}))$ operations in ${\mathsf{F}}$.

Proof.

We proceed iteratively. First, note that the cyclotomic polynomials $\Phi_{{p_{i}}^{c_{i}}}$ can all be computed in time $O(\varphi(\mu))$. The isomorphism $\gamma:{\mathsf{F}}[x_{1},x_{2}]/\langle\Phi_{{p_{1}}^{c_{1}}}(x_{1}),\Phi_{{p_{2}}^{c_{2}}}(x_{2})\rangle\to{\mathsf{F}}[z]/\langle\Phi_{{p_{1}}^{c_{1}}{p_{2}}^{c_{2}}}(z)\rangle$ given in the previous paragraph extends coordinate-wise to an isomorphism

[TABLE]

By the previous lemma, $\Gamma_{1}$ and its inverse can be applied to any input in time $\tilde{O}(\varphi(\mu))$. Iterate this process another $t-2$ times, to obtain $\Gamma$ as a product $\Gamma_{t-1}\circ\cdots\circ\Gamma_{1}$. Since $t$ is logarithmic in $\varphi(\mu)$, the proof is complete. ∎

Tensor product of two prime-power cyclotomic rings, same $p$. In the following two paragraphs, we discuss the opposite situation as above: we now work with cyclotomic polynomials of prime power orders for a common prime $p$. As above, we start with two such polynomials.

Let thus $p$ be a prime. The key to the following algorithms is the lemma below. Let $c,c^{\prime}$ be positive integers, with $c\geq c^{\prime}$, and let $x,y$ be indeterminates over ${\mathsf{F}}$. Define

[TABLE]

Note that $\mathbbm{a}$ and $\mathbbm{b}$ have respective dimensions $\varphi(p^{c})$ and $\varphi(p^{c})\varphi(p^{c^{\prime}})$.

Lemma 11**.**

There is an ${\mathsf{F}}$-algebra isomorphism $\theta:\mathbbm{b}\to\mathbbm{a}^{\varphi(p^{c^{\prime}})}$ such that one can apply $\theta$ or its inverse to any inputs using $\tilde{O}(\dim(\mathbbm{b}))$ operations in ${\mathsf{F}}$.

Proof.

Let $\xi$ be the residue class of $x$ in $\mathbb{A}$. Then, in $\mathbbm{a}[y]$, $\Phi_{p^{c^{\prime}}}(y)$ factors as

[TABLE]

with $\rho_{i}:={\xi}^{ip^{c-c^{\prime}}}$ for all $i$. Even though $\mathbbm{a}$ may not be a field, the Chinese Remainder theorem implies that $\mathbbm{b}$ is isomorphic to $\mathbbm{a}^{\varphi(p^{c^{\prime}})}$; the isomorphism is given by

[TABLE]

In terms of complexity, arithmetic operations $(+,-,\times)$ in $\mathbbm{a}$ can all be done in $\tilde{O}(\varphi(p^{c}))$ operations in ${\mathsf{F}}$. Starting from $\rho_{1}\in\mathbbm{a}$, all other roots $\rho_{i}$ can then be computed in $O(\varphi(p^{c^{\prime}}))$ operations in $\mathbbm{a}$, that is, $\tilde{O}(\dim(\mathbbm{b}))$ operations in ${\mathsf{F}}$.

Applying $\theta$ and its inverse is done by means of fast evaluation and interpolation (von zur Gathen and Gerhard, 2013, Chapter 10) in $\tilde{O}(\varphi(p^{c^{\prime}}))$ operations in $\mathbbm{a}$, that is, $\tilde{O}(\deg(\mathbbm{b}))$ operations in ${\mathsf{F}}$ (the algorithms do not require that $\mathbbm{a}$ be a field). ∎

Extension to several cyclotomic rings. Let $p$ be as before, and consider now non-negative integers $\boldsymbol{c}=(c_{1},\dots,c_{t})$ and variables $\boldsymbol{x}=(x_{1},\dots,x_{t})$. We define the ${\mathsf{F}}$-algebra

[TABLE]

which we will sometimes write $\mathbb{A}_{p,\boldsymbol{c},\boldsymbol{x}}$ to make the dependency on $p$ and the $c_{i}$’s clear. Up to reordering the $c_{i}$’s, we can assume that $c_{1}\geq c_{i}$ holds for all $i$, and define as before $\mathbbm{a}:={\mathsf{F}}[x_{1}]/\Phi_{p^{c_{1}}}(x_{1})$.

Lemma 12**.**

There exists an ${\mathsf{F}}$-algebra isomorphism $\Theta:\mathbb{A}\to\mathbbm{a}^{\dim(\mathbb{A})/\dim(\mathbbm{a})}$. This isomorphism and its inverse can be applied to any inputs using $\tilde{O}(\dim(\mathbb{A}))$ operations in ${\mathsf{F}}$.

Proof.

Without loss of generality, we can assume that all $c_{i}$’s are non-zero (since for $c_{i}=0$, $\Phi_{p^{c_{i}}}(x_{i})=x_{i}-1$, so ${\mathsf{F}}[x_{i}]/\langle\Phi_{p^{c_{i}}}(x_{i})\rangle={\mathsf{F}}$). We proceed iteratively. First, rewrite $\mathbb{A}$ as

[TABLE]

The isomorphism $\theta:\mathbbm{a}[x_{2}]/\Phi_{p^{c_{2}}}(x_{2})\to\mathbbm{a}^{\varphi(p^{c_{2}})}$ introduced in the previous paragraph extends coordinate-wise to an isomorphism

[TABLE]

$\Theta_{1}$ and its inverse can be evaluated in quasi-linear time $\tilde{O}(\dim(\mathbb{A}))$. We now work in all copies of $\mathbbm{a}[x_{3},\dots,x_{t}]/\langle\Phi_{p^{c_{3}}}(x_{3}),\dots,\Phi_{p^{c_{t}}}(x_{t})\rangle$ independently, and apply the procedure above to each of them. Altogether we have $t-1$ such steps to perform, giving us an isomorphism

[TABLE]

The exponent can be rewritten as $\dim(\mathbb{A})/\dim(\mathbbm{a})$, as claimed. In terms of complexity, all $\Theta_{i}$’s and their inverses can be computed in quasi-linear time $\tilde{O}(\dim(\mathbb{A}))$, and we do $t-1$ of them, where $t$ is $O(\log(\dim(\mathbb{A})))$. ∎

Decomposing certain $p$-group algebras. The prime $p$ and indeterminates $\boldsymbol{x}=(x_{1},\dots,x_{t})$ are as before; we now consider positive integers $\boldsymbol{b}=(b_{1},\dots,b_{t})$, and the ${\mathsf{F}}$-algebra

[TABLE]

If needed, we will write $\mathbb{B}_{p,\boldsymbol{b},\boldsymbol{x}}$ to make the dependency on $p$ and the $b_{i}$’s clear. This is the ${\mathsf{F}}$-group algebra of $\mathbb{Z}/p^{b_{1}}\mathbb{Z}\times\cdots\times\mathbb{Z}/p^{b_{t}}\mathbb{Z}$.

Lemma 13**.**

There exists a positive integer $N$, non-negative integers $\boldsymbol{c}=(c_{1},\dots,c_{N})$ and an ${\mathsf{F}}$-algebra isomorphism

[TABLE]

One can apply the isomorphism and its inverse to any input using $\tilde{O}(\dim(\mathbb{B}))$ operations in ${\mathsf{F}}$.

Proof.

For $i\leq t$, we have the factorization

[TABLE]

note that $\Phi_{1}(x_{i})=x_{i}-1$. The factors may not be irreducible, but they are pairwise coprime, so that we have a Chinese Remainder isomorphism

[TABLE]

Together with its inverse, this can be computed in $\tilde{O}(p^{b_{i}})$ operations in ${\mathsf{F}}$ (von zur Gathen and Gerhard, 2013, Chapter 10). By distributivity of the tensor product over direct products, this gives an ${\mathsf{F}}$-algebra isomorphism

[TABLE]

with $\boldsymbol{c}=(c_{1},\dots,c_{t})$. Together with its inverse, $\lambda$ can be computed in $\tilde{O}(\dim(\mathbb{B}))$ operations in ${\mathsf{F}}$. Composing with the result in Lemma 12, this gives us an isomorphism

[TABLE]

where $\mathbbm{a}_{\boldsymbol{c}}={\mathsf{F}}[z]/\langle\Phi_{p^{c}}(z)\rangle$, with $c=\max(c_{1},\dots,c_{t})$ and $D_{\boldsymbol{c}}=\dim(\mathbb{A}_{t,\boldsymbol{c},\boldsymbol{x}})/\dim(\mathbbm{a}_{\boldsymbol{c}})$. As before, $\Lambda$ and its inverse can be computed in quasi-linear time $\tilde{O}(\dim(\mathbb{B}))$. ∎

As for $\mathbb{B}$, we will write $\mathbb{D}_{p,\boldsymbol{b},\boldsymbol{x}}$ if needed; it is well-defined, up to the order of the factors.

Main result. Let $G$ be an abelian group. We can write the elementary divisor decomposition of $G$ as $G=G_{1}\times\cdots\times G_{s}$, where each $G_{i}$ is of prime power order $p_{i}^{a_{i}}$, for pairwise distinct primes $p_{1},\dots,p_{s}$, so that $|G|=p_{1}^{a_{1}}\cdots p_{s}^{a_{s}}$. Each $G_{i}$ can itself be written as a product of cyclic groups, $G_{i}=G_{i,1}\times\cdots\times G_{i,t_{i}}$, where the factor $G_{i,j}$ is cyclic of order ${p_{i}}^{b_{i,j}}$, with $b_{i,1}\leq\cdots\leq b_{i,t_{i}}$; this is the invariant factor decomposition of $G_{i}$, with $b_{i,1}+\cdots+b_{i,t_{i}}=a_{i}$.

We henceforth assume that generators $\gamma_{1,1},\dots,\gamma_{s,t_{s}}$ of respectively $G_{1,1},\dots,G_{s,t_{s}}$ are known, and that elements of ${\mathsf{F}}[G]$ are given on the power basis in $\gamma_{1,1},\dots,\gamma_{s,t_{s}}$. Were this not the case, given arbitrary generators $g_{1},\dots,g_{r}$ of $G$, with orders $e_{1},\dots,e_{r}$, a brute-force solution would factor each $e_{i}$ (factoring $e_{i}$ takes $o(e_{i})$ bit operations on a standard RAM), so as to write $\langle g_{i}\rangle$ as a product of cyclic groups of prime power orders, from which the required decomposition follows.

Proposition 14**.**

Given $\beta\in{\mathsf{F}}[G]$, written on the power basis $\gamma_{1,1},\dots,\gamma_{s,t_{s}}$, one can test if $\beta$ is a unit in ${\mathsf{F}}[G]$ using $\tilde{O}(|G|)$ operations in ${\mathsf{F}}$.

The proof occupies the rest of this paragraph. From the factorization $G=G_{1}\times\cdots\times G_{s}$, we deduce that the group algebra ${\mathsf{F}}[G]$ is the tensor product ${\mathsf{F}}[G_{1}]\otimes\cdots\otimes{\mathsf{F}}[G_{s}]$. Furthermore, the factorization $G_{i}=G_{i,1}\times\cdots\times G_{i,t_{i}}$ implies that ${\mathsf{F}}[G_{i}]$ is isomorphic, as an ${\mathsf{F}}$-algebra, to

[TABLE]

with $\boldsymbol{b}_{i}=(b_{i,1},\dots,b_{i,t_{i}})$ and $\boldsymbol{x}_{i}=(x_{i,1},\dots,x_{i,t_{i}})$. Given $\beta$ on the power basis in $\gamma_{1,1},\dots,\gamma_{s,t_{s}}$, we obtain its image $B$ in $\mathbb{B}_{p_{1},\boldsymbol{b}_{1},\boldsymbol{x}_{1}}\otimes\cdots\otimes\mathbb{B}_{p_{s},\boldsymbol{b}_{s},\boldsymbol{x}_{s}}$ simply by renaming $\gamma_{i,j}$ as $x_{i,j}$, for all $i,j$.

For $i\leq s$, by Lemma 13, there exist integers $c_{i,1},\dots,c_{i,N_{i}}$ such that $\mathbb{B}_{p_{i},\boldsymbol{b}_{i},\boldsymbol{x}_{i}}$ is isomorphic to an algebra $\mathbb{D}_{p_{i},\boldsymbol{b}_{i},z_{i}}$, with factors ${\mathsf{F}}[z_{i}]/\langle\Phi_{{p_{i}}^{c_{i,j}}}(z_{i})\rangle$. By distributivity of the tensor product over direct products, we deduce that $\mathbb{B}_{p_{1},\boldsymbol{b}_{1},\boldsymbol{x}_{1}}\otimes\cdots\otimes\mathbb{B}_{p_{s},\boldsymbol{b}_{s},\boldsymbol{x}_{s}}$ is isomorphic to the product of algebras

[TABLE]

for all indices $\boldsymbol{j}=(j_{1},\dots,j_{s})$, with $j_{1}=1,\dots,N_{1},\dots,j_{s}=1,\dots,N_{s}$; call $\Gamma$ the isomorphism. Given $B$ in $\mathbb{B}_{p_{1},\boldsymbol{b}_{1},\boldsymbol{x}_{1}}\otimes\cdots\otimes\mathbb{B}_{p_{s},\boldsymbol{b}_{s},\boldsymbol{x}_{s}}$, Lemma 13 also implies that $B^{\prime}:=\Gamma(B)$ can be computed in softly linear time $\tilde{O}(|G|)$ (apply the isomorphism corresponding to $\boldsymbol{x}_{1}$ coordinate-wise with respect to all other variables, then deal with $\boldsymbol{x}_{2}$, etc). The codomain in (4.3) is the product of all $\mathbb{H}_{\boldsymbol{p},\boldsymbol{c}_{\boldsymbol{j}},\boldsymbol{z}}$, with

[TABLE]

Apply Lemma 10 to all $\mathbb{H}_{\boldsymbol{p},\boldsymbol{c}_{\boldsymbol{j}},\boldsymbol{z}}$ to obtain an ${\mathsf{F}}$-algebra isomorphism

[TABLE]

for certain integers $d_{\boldsymbol{j}}$. The lemma implies that given $B^{\prime}$, $B^{\prime\prime}:=\Gamma^{\prime}(B^{\prime})$ can be computed in softly linear time $\tilde{O}(|G|)$ as well. Invertibility of $\beta\in{\mathsf{F}}[G]$ is equivalent to $A^{\prime\prime}$ being invertible, that is, to all its components being invertible in the respective factors ${\mathsf{F}}[z]/\langle\Phi_{d_{\boldsymbol{j}}}(z)\rangle$. Invertibility in such an algebra can be tested in softly linear time by applying the fast extended GCD algorithm (von zur Gathen and Gerhard, 2013, Chapter 11), so our conclusion follows.

Together with Proposition 7, the above result proves the first part of Theorem 1.

4.2 Metacyclic Groups

In this last section, we study the invertibility problem for a metacyclic group $G$. Instead of using an ${\mathsf{F}}$-algebra isomorphism, as we did above, we will use an injective homomorphism, whose image will be easy to compute. This is the object of the following lemma, where the map is inspired by the one used in (Curtis and Reiner, 1988, §47).

Assume that $G=\langle\sigma,\tau:\sigma^{m}=1,\tau^{s}=\sigma^{t},\tau^{-1}\sigma\tau=\sigma^{r}\rangle$, where $r^{s}=1\bmod m$ and $rt=t\bmod m$; in particular, $n=|G|$ is equal to $ms$. Define $\mathbb{A}:={\mathsf{F}}[z]/\langle z^{m}-1\rangle$ and let $\zeta$ be the image of $z$ in $\mathbb{A}$.

Lemma 15**.**

The mapping

[TABLE]

an injective homomorphism of ${\mathsf{F}}$-algebras.

Proof.

It is straightforward to verify that $\psi(\sigma)^{m}=\mathbf{{I}}_{m}$, $\psi(\tau)^{s}=\psi(\sigma)^{t}$ and $\psi_{i}(\sigma)\psi_{i}(\tau)=\psi(\tau)\psi_{i}(\sigma)^{r}$; this shows that $\psi$ is a well-defined ${\mathsf{F}}$-algebras homomorphism.

Take $\beta\in{\mathsf{F}}[G]$, and write it $\beta=\sum_{j=0}^{s-1}\left(\sum_{i=0}^{m-1}b_{i,j}\sigma^{i}\right)\tau^{j}$. For $j=0,\dots,s-1$, define $F_{j}(x):=\sum_{i=0}^{m-1}b_{i,j}x^{i}\in{\mathsf{F}}[x]$ and, for $1\leq i,j\leq s$,

[TABLE]

Then, $\psi(\beta)$ is the matrix

[TABLE]

If $\beta$ is in $\mathrm{Ker}(\psi)$, we get $F_{i}(\zeta)=0$, that is, $F_{i}\bmod(z^{m}-1)=0$, for $0\leq i<s$. Since all $F_{i}$’s have degree less than $m$, they are all zero. ∎

We conclude this section with two algorithms that test whether $\psi(\beta)\in M_{s}(\mathbb{A})$ is invertible, for a given $\beta$ in ${\mathsf{F}}[G]$. Minor difficulties will arise as we work over $\mathbb{A}$, since $\mathbb{A}$ is not a field, but a product of fields (if the irreducible factorization of $z^{m}-1$ in ${\mathsf{F}}[z]$ is available, one would simply use the Chinese Remainder theorem and work in field extensions of ${\mathsf{F}}$).

Corollary 16**.**

Given $\beta$ in ${\mathsf{F}}[G]$, one can test if $\beta$ is a unit in ${\mathsf{F}}[G]$ either by a deterministic algorithm that uses $\tilde{O}(s^{2.7}m)$ operations in ${\mathsf{F}}$, or a Monte Carlo one that uses $\tilde{O}(n^{2})$ operations in ${\mathsf{F}}$.

The second statement provides the last part of the proof of Theorem 1. Note that the first algorithm gives a better cost in many cases. For instance, if $s\leq m$, the first algorithm uses $O(n^{1.85})$ operations in ${\mathsf{F}}$. This happens if $s$ is prime, since then the number ${(m-\gcd(m,r-1))}/{s}$ is a positive integer, which implies $s\leq m$ (see (Curtis and Reiner, 1988, Theorem 47.12, Corollary 47.14 )).

First algorithm..

The first algorithm uses fast linear algebra algorithms over the ring $\mathbb{A}$. Here, we start from $\beta$ written as $\beta=\sum_{j=0}^{s-1}\left(\sum_{i=0}^{m-1}b_{i,j}\sigma^{i}\right)\tau^{j}\in{\mathsf{F}}[G]$. Then, the proof of the previous lemma shows an explicit formula for $\psi(\beta)$. In order to compute this matrix, we note that $\zeta^{r^{j-1}}=\zeta^{r^{j-1}\bmod m}$; computing this element and its powers requires no arithmetic operation, so that the coefficients of each $F_{i,j}$ are obtained in linear time $O(m)$. Hence the matrix $\psi(\beta)$ can be computed in time $O(s^{2}m)$.

Next, we have to determine whether $\psi(\beta)$ is a unit (the injectivity of $\psi$ implies that this is the case if and only if $\beta$ itself is a unit). This amounts to computing the determinant of this matrix, which can be done in $\tilde{O}(s^{2.7}m)$ operations in ${\mathsf{F}}$, using the determinant algorithm of (Kaltofen and Villard, 2004, Section 6). ∎

Before giving our second algorithm, let us point out that matrix-vector products by $\psi(\beta)$ can be done fast.

Lemma 17**.**

Given $\beta$ in ${\mathsf{F}}[G]$ and $\boldsymbol{v}$ in $\mathbb{A}^{s}$, one can compute $\psi(\beta)\boldsymbol{v}\in\mathbb{A}^{s}$ using $\tilde{O}(sm^{2})$ operations in ${\mathsf{F}}$.

Proof.

We use the basis of ${\mathsf{F}}[G]$ given in (3.5), writing $\beta=\sum_{i=0}^{m-1}\left(\sum_{j=0}^{s-1}b_{i,j}\tau^{i}\right)\sigma^{j}\in{\mathsf{F}}[G]$. We rewrite this as $\beta=\sum_{i=0}^{m-1}B_{i}(\tau)\sigma^{i}$, for some $B_{0},\dots,B_{m-1}$ in ${\mathsf{F}}[z]$ of degree less than $s$.

Given $\boldsymbol{v}$ as above, we compute all $B_{i}(\psi(\tau))\psi(\sigma)^{i}\boldsymbol{v}$ independently, and add them to obtain $\psi(\beta)\boldsymbol{v}$. Hence, let us fix an index $i$ in $\{0,\dots,m-1\}$. The vector $\psi(\sigma)^{i}\boldsymbol{v}$ can be obtained by multiplying each entry of $\boldsymbol{v}$ by a power of $\zeta$; this takes $\tilde{O}(sm)$ operations in ${\mathsf{F}}$. Then, since $\psi(\tau)$ is the matrix of multiplication by $y$ in $\mathbb{A}[y]/\langle y^{s}-\zeta\rangle$, $B_{i}(\psi(\tau))$ is the matrix of multiplication by $B_{i}(y)$ in $\mathbb{A}[y]/\langle y^{s}-\zeta\rangle$. Thus, applying this matrix to a vector also takes softly linear time $\tilde{O}(sm)$.

Adding a factor of $m$ to account for indices $i=0,\dots,m-1$, we get the result. ∎

Second algorithm for Corollary 16..

The second algorithm uses Wiedemann’s 1986 algorithm, and its extension by Kaltofen and Saunders (1991). Extra care will be needed to accommodate the fact that $\mathbb{A}$ has zero-divisors. Let $F_{1},\dots,F_{s}$ be the (unknown) irreducible factors of $z^{m}-1$ in ${\mathsf{F}}[z]$ and define $\mathbb{A}_{i}:={\mathsf{F}}[z]/\langle F_{i}\rangle$ for $i=1,\dots,s$. We write $\pi_{i}:\mathbb{A}\to\mathbb{A}_{i}$ for the canonical projection, and extend the notation to matrices over $\mathbb{A}$.

For $\beta$ in ${\mathsf{F}}[G]$, $\mathbf{{M}}:=\psi(\beta)$ is invertible if and only if all $\mathbf{{M}}_{i}:=\pi_{i}(\mathbf{{M}})$ are. We are going to use the algorithm of (Kaltofen and Saunders, 1991, Section 4) to compute the rank of all these matrices (these ranks are well-defined, since all $\mathbb{A}_{i}$’s are fields). Let $\mathbf{{L}}$ and $\mathbf{{U}}$ be respectively random lower triangular and upper triangular Toeplitz matrices over $\mathbb{A}$, and define $\mathbf{{M}}^{\prime}:=\mathbf{{L}}\mathbf{{M}}\mathbf{{U}}\in M_{s}(\mathbb{A})$. Finally, let $\mathbf{{M}}^{\prime\prime}$ be $\mathbf{{M}}^{\prime}$, to which we adjoin a bottom row and a rightmost column of zeros (so it has size $s+1$), let $\mathbf{{M}}^{\prime\prime}_{i}:=\pi_{i}(\mathbf{{M}}^{\prime\prime})$ and let $r_{i}:=\text{rank}(\mathbf{{M}}^{\prime\prime}_{i})$, $i=1,\dots,s$. Then, all $r_{i}$’s are less than $s+1$, and $\mathbf{{M}}$ is invertible if and only if $r_{i}=s$ for all $i$.

The condition that $\mathbf{{M}}^{\prime\prime}_{i}$ has rank less than $s+1$ makes it possible to apply (Kaltofen and Saunders, 1991, Lemma 2): for generic $\boldsymbol{u}_{i},\boldsymbol{v}_{i}$ in $\mathbb{A}_{i}^{s+1}$ and diagonal matrix $\mathbf{{X}}$ in $M_{s+1}(\mathbb{A}_{i})$, the minimal polynomial of the sequence $(\boldsymbol{u}_{i}^{T}(\mathbf{{M}}^{\prime\prime}_{i}\mathbf{{X}}_{i})^{j}\boldsymbol{v}_{i})_{j\geq 0}$ has degree $r_{i}+1$.

To compute these degrees without knowing the factorization $z^{m}-1=F_{1}\cdots F_{s}$, we choose random $\boldsymbol{u},\boldsymbol{v}$ in $\mathbb{A}^{s+1}$ and diagonal matrix $\mathbf{{X}}$ in $M_{s+1}(\mathbb{A})$. Then, we compute $2s$ terms in the sequence $(\gamma_{j})_{j\geq 0}$, with $\gamma_{j}:=\boldsymbol{u}^{T}(\mathbf{{M}}^{\prime\prime}\mathbf{{X}})^{j}\boldsymbol{v}$. Since multiplication by $\mathbf{{L}}$, $\mathbf{{U}}$ and $\mathbf{{X}}$ all take quasi-linear time $\tilde{O}(sm)$, Lemma 17 shows that one product by $\mathbf{{M}}^{\prime\prime}\mathbf{{X}}$ takes $\tilde{O}(sm^{2})$ operations in ${\mathsf{F}}$. Hence, all required terms can be obtained in $\tilde{O}(s^{2}m^{2})=\tilde{O}(n^{2})$ operations in ${\mathsf{F}}$.

Finally, we apply the fast Euclidean algorithm to $\sum_{j=0}^{2s-1}\gamma_{j}y^{j}$ and $y^{2s}$ in the ring $\mathbb{A}[y]$ to find the ranks $r_{1},\dots,r_{s}$. Since $\mathbb{A}$ is not a field, we rely on the algorithm of Accettella et al. (2003); Dahan et al. (2006). Using $\tilde{O}(sm)$ operations in ${\mathsf{F}}$, it reveals a partial factorization of $z^{m}-1$ as $G_{1}\cdots G_{t}$ (the factors may not be irreducible) and integers $\rho_{j}$, $j=1,\dots,t$, such that for all $i\leq s$, $j\leq t$, if $F_{i}$ divides $G_{j}$, then $r_{i}=\rho_{j}$. This allows us to determine all $r_{i}$’s, and thus decide whether $\psi(\beta)$ is singular. ∎