Some Results on Linearized Trinomials that Split Completely

TL;DR

This paper investigates the properties of linearized polynomials over finite fields, focusing on calculating their rank and nullity, and characterizes certain trinomials that split completely for specific field sizes.

Contribution

It provides a new method to determine the nullity of linearized polynomials using associated matrices and characterizes splitting trinomials for certain parameters.

Findings

Nullity of linearized polynomials can be computed via associated matrices.

Characterization of splitting trinomials for field sizes up to d^2 - d + 1.

Connections established between polynomial properties and finite geometry.

Abstract

Linearized polynomials over finite fields have been much studied over the last several decades. Recently there has been a renewed interest in linearized polynomials because of new connections to coding theory and finite geometry. We consider the problem of calculating the rank or nullity of a linearized polynomial $L(x)=\sum_{i=0}^{d}a_i x^{q^i}$ (where $a_i\in \mathbb{F}_{q^n}$) from the coefficients $a_i$. The rank and nullity of $L(x)$ are the rank and nullity of the associated $\mathbb{F}_q$-linear map $\mathbb{F}_{q^n} \longrightarrow \mathbb{F}_{q^n}$. McGuire and Sheekey defined a $d\times d$ matrix $A_L$ with the property that $$\mbox{nullity} (L)=\mbox{nullity} (A_L -I).$$ We present some consequences of this result for some trinomials that split completely, i.e., trinomials $L(x)=x^{q^d}-bx^q-ax$ that have nullity $d$. We give a full characterization of these trinomials for $n\le d^2-d+1$.

Equations

$$\text{mbox}nullity(L)=\text{mbox}nullity(A_L-I).$$

$$L(x)=a_{0}x+a_1{x}^q+a_2{x}^{q^2}+\cdots +a_d{x}^{q^d}$$

$$\text{mbox}nullity(L)=\text{mbox}nullity(A_L-I_d).$$

$$L(x)=x^{q^d}-b{x}^q-ax\in {\mathbb{F}}_{q^n}[x]$$

$$\left(\begin{array}{ccccc}0& 0& \dots & 0& a\\ 1& 0& \dots & 0& b\\ 0& 1& \dots & 0& 0\\ ⋮& ⋮& \ddots & ⋮& ⋮\\ 0& 0& \dots & 1& 0\end{array}\right).$$

$$M_k=M_{k-d}{a}^{q^{k-1}}+M_{k-d+1}{b}^{q^{k-1}}.$$

$$M_{id+1}=M_{(i-1)d+1}{a}^{q^{id}}.$$

$$M_{l,k}=M_{l,k-d}{a}^{q^{k-1}}+M_{l,k-d+1}{b}^{q^{k-1}}.$$

$$M_{1,i(d-1)+1}$$

$$=M_{1,(i-2)(d-1)+1}{b}^{q^{(i-1)(d-1)}+q^{i(d-1)}}$$

$$=\dots$$

$$=a{b}^{q^{d-1}+q^{2(d-1)}+\cdots +q^{i(d-1)}}.$$

$$M_{l,(i-1)d+1}$$

$$=\dots$$

$$=M_{l,1-d}{a}^{1+q^d+\cdots +q^{(i-1)d}}$$

$$=M_{l,1-d}$$

$$=\{\begin{array}{l}1\text{ for }l=1,\\ 0\text{ for }l=2,\dots ,d.\end{array}$$

$$\{\begin{array}{l}{M}_{l,(d-2)d+l+1}=1\\ M_{l,(d-2)d+j+1}=0\text{ for }j=1,\dots ,l-1,l+1,\dots ,d\end{array}$$

$$M_{1,(d-2)d+2}$$

$$=M_{1,d}{b}^{q^{(d-2)d+1}+q^{(d-3)d+2}+\cdots +q^{2d-2}}$$

$$=a{b}^{q^{(d-2)d+1}+q^{(d-3)d+2}+\cdots +q^{2d-2}+q^{d-1}}$$

$$=a{b}^{{\sum }_{i=1}^{d-1}{q}^{i(d-1)}}$$

$$=a{b}^{e_2}.$$

$$M_{1,(d-1)d+1}=M_{1,(d-2)d+1}{a}^{q^{(d-1)d}}+M_{1,(d-2)d+2}{b}^{q^{(d-1)d}}.$$

$$M_{1,(d-1)d+1}$$

$$=a^{e_1}+a{b}^{e_2+q^{(d-1)d}}.$$

$$a^{-1}=b^{e_2}=(-a^{q{e}_1}{)}^{e_2}=(-1{)}^{e_2}{a}^{q{e}_1{e}_2},$$

$$\{\begin{array}{l}{a}^{1+q{e}_1{e}_2}=(-1{)}^{d-1}\\ a^{\frac{q^n-1}{q-1}}=(-1{)}^{d-1}.\end{array}$$

$$\gcd (1+q{e}_1{e}_2,\frac{q^n-1}{q-1})=\frac{q^n-1}{q-1}.$$

$$1+q(\frac{q^{d^2}-1}{q^d-1})(\frac{q^{(d-1)d}-q^{d-1}}{q^{d-1}-1})$$

$$=1+\sum _{i=0}^{d-1}\sum _{j=1}^{d-1}{q}^{id+j(d-1)+1}.$$

$$\{(i+j)d-(j-1)\mid i=0,\dots ,d-1;j=1,\dots ,d-1\}$$

$$\{kd-m\mid m=0,\dots ,d-2;k=m+1,\dots ,m+d\}$$

$$jd-(j-1),(j+1)d-(j-1),\dots ,(j+d-1)d-(j-1).$$

$$\gcd (x^{1+q{e}_1{e}_2}+(-1{)}^d,x^{\frac{q^n-1}{q-1}}+(-1{)}^d)=x^{\frac{q^n-1}{q-1}}+(-1{)}^d.$$

$$\gcd (x^{1+q{e}_1{e}_2}+(-1{)}^d,x^{\frac{q^n-1}{q-1}}+(-1{)}^d)=x^{\gcd (1+q{e}_1{e}_2,\frac{q^n-1}{q-1})}+(-1{)}^d$$

$$M_{l,n-d+1}=\{\begin{array}{l}1\text{ for }l=1,\\ 0\text{ for }l=2,\dots ,d\end{array}$$

Full text

[TABLE]

We present some consequences of this result for some trinomials that split completely, i.e., trinomials $L(x)=x^{q^{d}}-bx^{q}-ax$ that have nullity $d$. We give a full characterization of these trinomials for $n\leq d^{2}-d+1$.

1 Introduction

Let $\mathbb{F}_{q^{n}}$ be the finite field with $q^{n}$ elements, where $q$ is a prime power. Let

[TABLE]

be a $q$-linearized polynomial with coefficients in $\mathbb{F}_{q^{n}}$. The roots of $L(x)$ that lie in the field $\mathbb{F}_{q^{n}}$ form an $\mathbb{F}_{q}$-vector space, which can have dimension anywhere between 0 and $d$.

The dimension of the space of roots of $L$ that lie in $\mathbb{F}_{q^{n}}$ is equal to the nullity of $L$ considered as an $\mathbb{F}_{q}$-linear map from $\mathbb{F}_{q^{n}}$ to $\mathbb{F}_{q^{n}}$. McGuire and Sheekey [MS19] defined a $d\times d$ matrix $A_{L}$ with the property that

[TABLE]

The entries of $A_{L}$ can be computed directly from the coefficients of $L$.

In this paper we focus on the case of largest possible nullity, i.e., the case that $L(x)$ has all its roots in $\mathbb{F}_{q^{n}}$. In this case, $\mbox{nullity}(L)=d$, and so $A_{L}-I_{d}$ has rank 0 and is therefore the zero matrix. Thus we will be studying when $A_{L}=I_{d}$. This case of largest possible nullity was also obtained in [CMPZ19].

We also restrict to trinomials. When computing the rank or nullity, we may assume without loss of generality that $L(x)$ is monic. We will study polynomials of the form

[TABLE]

where $q$ is a prime power and $n\geq 1$. We want to find $a,b\in\mathbb{F}_{q^{n}}$ such that $L$ splits completely over $\mathbb{F}_{q^{n}}$, i.e., $L$ has $q^{d}$ roots in $\mathbb{F}_{q^{n}}$. Thus, the problem becomes finding $a,b\in\mathbb{F}_{q^{n}}$ such that $A_{L}=I_{d}$. We will provide a full characterization of this situation for $n\leq d(d-1)+1$. Our results are summarized and stated in the following theorem.

Theorem 1.1.

If $n\leq(d-1)d$ and $d$ does not divide $n$, then there is no polynomial $L=x^{q^{d}}-bx^{q}-ax$ with $a,b\in\mathbb{F}_{q^{n}}$ that splits completely over $\mathbb{F}_{q^{n}}$. 2. 2.

Let $n=id$ with $i\in\{1,\dots,d-1\}$. Let $L=x^{q^{d}}-bx^{q}-ax\in\mathbb{F}_{q^{n}}[x]$. Then $L$ has $q^{d}$ roots in $\mathbb{F}_{q^{n}}$ if and only if $a^{1+q^{d}+\dots+q^{(i-1)d}}=1$ and $b=0$. 3. 3.

Let $n=(d-1)d+1$. Let $L=x^{q^{d}}-bx^{q}-ax\in\mathbb{F}_{q^{n}}[x]$. Then $L$ has $q^{d}$ roots in $\mathbb{F}_{q^{n}}$ if and only if all the following hold:

$\bullet$ $N(a)=(-1)^{d-1}$

$\bullet$ $b=-a^{qe_{1}}$ where $e_{1}=\sum_{i=0}^{d-1}q^{id}$

$\bullet$ $d-1$ is a power of the characteristic of $\mathbb{F}_{q^{n}}$

where $N(a)=a^{1+q+\dots+q^{(d-1)d}}=a^{(q^{n}-1)/(q-1)}$.

We will prove part 1 in Section 2, part 2 in Section 3 and part 3 in Sections 4 and 5. In Section 6 we present a possible application to elliptic curve cryptography.

Our result generalizes a a result of Csajbok et al [CMPZ18] which states that $a_{0}x+a_{1}x^{q}+a_{3}x^{q^{3}}$ (where $a_{i}\in\mathbb{F}_{q^{7}}$) cannot have $q^{3}$ roots in $\mathbb{F}_{q^{7}}$ if $q$ is odd. This is the $d=3$ case of our theorem. Also in that paper, the authors give one example of a trinomial that does split completely when $d=3$, $n=7$, and $q=2$. Our theorem characterizes fully the trinomials that split completely and allows us to count their number (for each nonzero $a$ of norm 1 there is one polynomial, so there are $\frac{q^{n}-1}{q-1}$ such trinomials).

One can trivially obtain some results by taking $q$-th powers. For example, when $n=2d-2$, the trinomial $x^{q^{d}}-bx^{q}-ax$ cannot have $q^{d}$ roots in $\mathbb{F}_{q^{n}}$. This follows by taking the $q^{d-2}$ power of the trinomial. Our theorem extends this to a larger range of values of $n$.

One recent application of calculating the rank of linearized polynomials concerns rank metric codes and MRD codes, see [She19]. In particular, we would obtain an $\mathbb{F}_{q^{n}}$-linear MRD code from a space of linearized polynomials of dimension $kn$ over $\mathbb{F}_{q}$, with the property that every nonzero element has rank at least $n-k+1$. For example, in the case $k=3$, we would obtain an MRD code from the set of all trinomials $cx^{q^{d}}-bx^{q}-ax$ ($a,b,c\in\mathbb{F}_{q^{n}}$) if all of them have nullity 0 or 1 or 2.

Finally, we set the scene for our results. We are seeking $n\geq 1$ and $a,b\in\mathbb{F}_{q^{n}}$ such that $L=x^{q^{d}}-bx^{q}-ax$ splits over $\mathbb{F}_{q^{n}}$. The companion matrix $C_{L}$ of $L(x)=x^{q^{d}}-bx^{q}-ax$ as defined in [MS19] is the $d\times d$ matrix

[TABLE]

We define $A_{L}=A_{L,n}=C_{L}C_{L}^{q}\cdots C_{L}^{q^{n-1}}$, where $C^{q}$ means raising every matrix entry to the power of $q$. As stated above, $L$ splits completely over $\mathbb{F}_{q^{n}}$ if and only if $A_{L}=I_{d}$.

2 Fixed $d$ not dividing $n$ and $n\leq(d-1)d$

In this section we will prove the first part of Theorem 1.1.

Theorem 2.1.

If $n\leq(d-1)d$ and $d$ does not divide $n$, then there is no polynomial $L=x^{q^{d}}-bx^{q}-ax$ with $a,b\in\mathbb{F}_{q^{n}}$ that splits completely over $\mathbb{F}_{q^{n}}$.

• Proof.

We will write $A_{n}$ instead of $A_{L,n}$ as $L$ is fixed throughout the proof.

If $n=1$ then $A_{1}=C_{L}\neq I_{d}$. Indeed, if $n\leq d-1$ then the $(1,1)$ entry of $A_{n}$ is [math], so $A_{n}\neq I_{d}$.

Note that $A_{n}=A_{n-1}C_{L}^{q^{n-1}}$. But the 1st column of $C_{L}^{q^{n-1}}$ is $\begin{pmatrix}010\dots 0\end{pmatrix}^{T}$. Thus, the $(1,1)$ entry of $A_{n}$ is the $(1,2)$ entry of $A_{n-1}$. If $n\geq d$ then the $(1,1)$ entry of $A_{n}$ is also the $(1,d)$ entry of $A_{n-d+1}$.

Let $M_{k}$ denote the $(1,d)$ entry of $A_{k}$. Then $M_{1}=a$, and $M_{k}=0$ for $k=2,\dots,d-1$, since $M_{k}=\begin{pmatrix}0\dots 0M_{1}\dots M_{k-1}\end{pmatrix}\cdot\begin{pmatrix}a^{q^{k-1}}b^{q^{k-1}}0\dots 0\end{pmatrix}^{T}$.

Set $M_{0}=0$. Then for $k\geq d$, we have a recursive formula, which follows directly from matrix multiplication:

[TABLE]

Claim: $M_{j}=0$ for $j=id+2,\dots,(i+1)d-(i+1)$ and $i=0,\dots,d-3$.

Proof of Claim: We prove the claim by induction on $i$. The base case $i=0$ was done above. Note that if $M_{k-d}=M_{k-d+1}=0$ then $M_{k}=0$. So if the claim is true for $i$, then we have $M_{id+2+d}=0,\dots,M_{(i+1)d-(i+1)+d-1}=0$, i.e. the claim is true for $i+1$. This completes the proof of the claim.

Note that when $i=d-3$, then $id+2=(i+1)d-(i+1)$, so the claim is not true for $i=d-2$.

For the remaining $n$ not divisible by $d$, we will show that the $(1,1)$ entry of $A_{n}$ cannot be 1 if the $(1,j)$ entry is 0 for some $j\in\{2,\dots,d\}$, and thus $A_{n}$ cannot be the identity matrix. Note that the $(1,j)$ entry of $A_{n}$ is $M_{n-d+j}$.

For $i=1,\dots,d-2$, we have $M_{(i-1)d+2}=0$ and thus

[TABLE]

Since $M_{1}=a$, we have $M_{id+1}=a^{1+q^{d}+\dots+q^{id}}$. But $M_{id+1}$ is the $(1,(i+1)d+1-n)$ entry of $A_{n}$ for $n=id+1,\dots,(i+1)d-1$. If $A_{n}=I_{d}$ then the $(1,(i+1)d+1-n)$ entry must be [math], so we must have $M_{id+1}=a^{1+q^{d}+\dots+q^{id}}=0$, and thus $a=0$.

Recall that the $(1,1)$ entry of $A_{n}$ is $M_{n-d+1}$. But $M_{n-d+1}$ must be either 0 or a power of $a$, since all initial values $M_{0},\dots,M_{d-1}$ of the recursive formula are either $a$ or [math]. Therefore, if $a=0$, we have $M_{n-d+1}=0$ and so $A_{n}\neq I_{d}$. ∎

Remark 2.1.

The proof is not valid when $d$ divides $n$. If $n=id$ with $i\in\{1,\dots,d-1\}$, the $(1,1)$ entry of $A_{id}$ is $M_{(i-1)d+1}=a^{1+q^{d}+\dots+q^{(i-1)d}}$ for $i\geq 1$, and so we have the equation $a^{1+q^{d}+\dots+q^{(i-1)d}}=1$ and cannot deduce that $a=0$.

The recursive formula (1) established in the proof of Theorem 2.1 is valid in greater generality: Set $M_{l,l-d}=1$, and $M_{l,k}=0$ for $k\leq 0$ and $k\neq l-d$. For $1\leq l\leq d$ and $k\geq 1$, let

[TABLE]

Then $M_{l,k}$ is the $(l,d)$ entry of $A_{L,k}$. Furthermore, the $(l,j)$ entry of $A_{L,k}$ is $M_{l,k-d+j}$.

3 Fixed $d$ dividing $n$ and $n\leq(d-1)d$

In the case that $d$ divides $n$, we have a solution, namely $a=1$ and $b=0$, i.e., the polynomial $x^{q^{d}}-x$ splits completely because $\mathbb{F}_{q^{n}}$ has a subfield $\mathbb{F}_{q^{d}}$. We now characterize exactly which polynomials split completely.

Theorem 3.1.

Let $n=id$ with $i\in\{1,\dots,d-1\}$. Let $L=x^{q^{d}}-bx^{q}-ax\in\mathbb{F}_{q^{n}}[x]$. Then $L$ has $q^{d}$ roots in $\mathbb{F}_{q^{n}}$ if and only if $a^{1+q^{d}+\dots+q^{(i-1)d}}=1$ and $b=0$.

• Proof.

By Remark 2.1, if $L$ splits completely, we have $a^{1+q^{d}+\dots+q^{(i-1)d}}=1$. Now the $(1,d+1-i)$ entry of $A_{id}$ is $M_{1,i(d-1)+1}$. For $i=1$, this is $M_{1,d}=ab^{q^{d-1}}$. For $i\geq 2$, we have $M_{1,i(d-1)+1}=M_{1,(i-1)d-(i-1)}a^{q^{i(d-1)}}+M_{1,(i-1)(d-1)+1}b^{q^{i(d-1)}}$. But by the claim in the proof of Theorem 2.1, we have $M_{1,(i-1)d-(i-1)}=0$ for $i=2,\dots,d-1$. Thus

[TABLE]

But if $A_{id}=I_{d}$ then $M_{1,i(d-1)+1}=0$, and since $a\neq 0$, we must have $b=0$.

To show the converse, assume that $a^{1+q^{d}+\dots+q^{(i-1)d}}=1$ and $b=0$. Then the $(l,1)$ entry of $A_{id}$ is

[TABLE]

By [CMPZ19, Corollary 3.2], this implies that $A_{id}=I_{d}$. ∎

4 Fixed $d$ and $n=(d-1)d+1$

In this section we will prove some preliminary results which are part of the proof of Theorem 1.1 part 3.

4.1 Assuming $L$ splits completely

If $n=(d-1)d+1$, then, the $(1,j)$ entry of $A_{L,n}$ is $M_{1,(d-2)d+j+1}$ (where $j=1,\dots,d$). So to get $A_{L,n}=I_{d}$, the following system of equations has to be satisfied for $l=1,\dots,d$

[TABLE]

Lemma 4.1.

$\displaystyle{M_{1,(d-2)d+2}=ab^{e_{2}}}$ where $e_{2}=\frac{q^{(d-1)d}-q^{d-1}}{q^{d-1}-1}$.

• Proof.

By the recursive formula (2), $M_{1,(d-2)d+2}=M_{1,(d-3)d+2}a^{q^{(d-2)d+1}}+M_{1,(d-3)d+3}b^{q^{(d-2)d+1}}$. But it follows from the claim in the proof of Theorem 2.1 that $M_{1,(d-j-1)d+j}=0$ for $j=2,\dots,d-1$. Thus

[TABLE]

∎

Lemma 4.2.

$M_{1,(d-1)d+1}=a^{e_{1}}+ab^{e_{2}+q^{(d-1)d}}$ where $e_{1}=\frac{q^{d^{2}}-1}{q^{d}-1}$ and $e_{2}=\frac{q^{(d-1)d}-q^{d-1}}{q^{d-1}-1}$.

• Proof.

By the recursive formula (2),

[TABLE]

By Lemma 4.1, $M_{1,(d-2)d+2}=ab^{e_{2}}$. Also $M_{1,(d-2)d+1}=a^{1+q^{d}+\dots+q^{(d-2)d}}$ as established in the proof of Theorem 2.1.

Therefore

[TABLE]

∎

Theorem 4.1.

Let $n=(d-1)d+1$. Let $L=x^{q^{d}}-bx^{q}-ax\in\mathbb{F}_{q^{n}}[x]$. If $L$ has $q^{d}$ roots in $\mathbb{F}_{q^{n}}$ then

$a^{1+q+\dots+q^{(d-1)d}}=(-1)^{d-1}\mbox{ and }$ 2. 2.

$a^{1+qe_{1}e_{2}}=(-1)^{d-1}\mbox{ and }$ 3. 3.

$b=-a^{qe_{1}},$

where $e_{1}=\frac{q^{d^{2}}-1}{q^{d}-1}$ and $e_{2}=\frac{q^{(d-1)d}-q^{d-1}}{q^{d-1}-1}$.

• Proof.

If $A_{L,n}=I_{d}$, then equation (3) has to be satisfied. By Lemma 4.1, we have $ab^{e_{2}}=1$ (the $(1,1)$ entry of $A_{L,n}$), and by Lemma 4.2, we have $a^{e_{1}}+ab^{e_{2}+q^{(d-1)d}}=0$ (the $(1,d)$ entry of $A_{L,n}$). But if $ab^{e_{2}}=1$, then $a^{e_{1}}+ab^{e_{2}+q^{(d-1)d}}=a^{e_{1}}+b^{q^{(d-1)d}}$, and thus we have $b^{q^{(d-1)d}}=-a^{e_{1}}$. Raising both sides to the power of $q$ gives us $b^{q^{n}}=(-1)^{q}a^{qe_{1}}$. Since $q$ is a prime power, $(-1)^{q}=-1$ in $\mathbb{F}_{q^{n}}$. Thus, $b=-a^{qe_{1}}$ which proves the third conclusion.

Lemma 4.1 says $ab^{e_{2}}=1$ which now implies

[TABLE]

and so $a^{1+qe_{1}e_{2}}=(-1)^{e_{2}}$. (Note that $a\neq 0$ since $ab^{e_{2}}=1$.)

Recall that $e_{2}=\sum_{i=1}^{d-1}q^{i(d-1)}$. So if $q$ is even, then $e_{2}$ is even. If $q$ is odd, then $q^{i(d-1)}$ is odd for all $i=1,\dots,d-1$. So if $d-1$ is even, then $e_{2}$ is an even sum of odd numbers and thus even, and if $d-1$ is odd, then $e_{2}$ is an odd sum of odd numbers and thus odd. Thus, $(-1)^{e_{2}}=(-1)^{q(d-1)}$. Since $(-1)^{q}=-1$ in $\mathbb{F}_{q^{n}}$ we have $(-1)^{e_{2}}=(-1)^{d-1}$.

By [MS19, Corollary 1], if $L$ splits, then $N(-a)=(-1)^{nd}N(1)$, where $N$ is the norm function over $\mathbb{F}_{q^{n}}$. So we have the additional condition $N(a)=(-1)^{n(d-1)}$ or $a^{\frac{q^{n}-1}{q-1}}=(-1)^{n(d-1)}$. But $n=(d-1)d+1$, so $n$ is always odd. Consequently, $(-1)^{n(d-1)}=(-1)^{d-1}$.

Hence, $a$ satisfies the equations

[TABLE]

∎

In the next section we will show that conclusion 1 of this theorem actually implies conclusion 2.

4.2 GCD of $x^{k}\pm 1$ and $x^{l}\pm 1$

The GCD of $x^{k}-1$ and $x^{l}-1$ is well known to be $x^{\gcd(k,l)}-1$, but we are interested in the GCD of $x^{k}+1$ and $x^{l}+1$. The following is surely well known, but we include a proof.

Theorem 4.2.

The GCD of $x^{k}+1$ and $x^{l}+1$ is $x^{\gcd(k,l)}+1$ if $\frac{k}{\gcd(k,l)}$ and $\frac{l}{\gcd(k,l)}$ are both odd, and $1$ otherwise.

• Proof.

Let $d=\gcd(k,l)$ and let $s,t$ be Bézout Coefficients for $k$ and $l$, i.e. $sk+tl=d$. Let $g=\gcd(x^{k}+1,x^{l}+1)$. Then $x^{k}\equiv-1\ \mathrm{mod}\ g$ and $x^{l}\equiv-1\ \mathrm{mod}\ g$. Thus $x^{sk+tl}\equiv(-1)^{s+t}\ \mathrm{mod}\ g$. So $g$ divides $x^{sk+tl}-(-1)^{s+t}=x^{d}-(-1)^{s+t}$. We need to check if $x^{d}-(-1)^{s+t}$ divides $x^{k}+1$ and $x^{l}+1$.

Let $e=\frac{k}{d}$ and $f=\frac{l}{d}$. Then $x^{k}+1=x^{ed}+1=((-1)^{s+t})^{e}+1\ \mathrm{mod}\ x^{d}-(-1)^{s+t}$ and similarly, $x^{l}+1=((-1)^{s+t})^{f}+1\ \mathrm{mod}\ x^{d}-(-1)^{s+t}$. So we need to have $(-1)^{(s+t)e}+1=0$ and $(-1)^{(s+t)f}+1=0$, i.e. $e,f,s+t$ all need to be odd. But $sk+tl=d$ implies $se+tf=1$, so $e,f$ odd implies $s+t$ odd. Thus if $e,f$ are odd, then $g=x^{d}-(-1)^{s+t}=x^{d}+1$. ∎

Remark 4.1.

Similarly, one can show that $\gcd(x^{k}-1,x^{l}+1)=x^{\gcd(k,l)}+1$ if $\frac{k}{\gcd(k,l)}$ is even and $\frac{l}{\gcd(k,l)}$ is odd.

Lemma 4.3.

Let $n=(d-1)d+1$ and let $e_{1}=\frac{q^{d^{2}}-1}{q^{d}-1}$ and $e_{2}=\frac{q^{(d-1)d}-q^{d-1}}{q^{d-1}-1}$. Then

[TABLE]

• Proof.

We first show that $\frac{q^{n}-1}{q-1}=1+q(\frac{q^{d^{2}}-1}{q^{d}-1})(\frac{q^{(d-1)d}-q^{d-1}}{q^{d-1}-1})\ \mathrm{mod}\ q^{n}-1$. Recall that $\frac{q^{n}-1}{q-1}=\sum_{i=0}^{n-1}q^{i}=1+q+q^{2}+\dots+q^{n-1}$ and $n=d^{2}-d+1$. Then

[TABLE]

We claim that $id+j(d-1)+1\ \mathrm{mod}\ n$ with $i=0,\dots,d-1$ and $j=1,\dots,d-1$ gives us exactly the numbers $\{1,\dots,n-1\}$. Assuming the truth of this claim, $1+q(\frac{q^{d^{2}}-1}{q^{d}-1})(\frac{q^{(d-1)d}-q^{d-1}}{q^{d-1}-1})\ \mathrm{mod}\ q^{n}-1=1+q+q^{2}+\dots+q^{n-1}=\frac{q^{n}-1}{q-1}$. Since $\frac{q^{n}-1}{q-1}$ divides $q^{n}-1$, $\frac{q^{n}-1}{q-1}$ divides $1+q(\frac{q^{d^{2}}-1}{q^{d}-1})(\frac{q^{(d-1)d}-q^{d-1}}{q^{d-1}-1})$ and thus $\gcd(1+q(\frac{q^{d^{2}}-1}{q^{d}-1})(\frac{q^{(d-1)d}-q^{d-1}}{q^{d-1}-1}),\frac{q^{n}-1}{q-1})=\frac{q^{n}-1}{q-1}$ and the result is proved.

It remains to prove the claim. To see this, we will show that the sets

[TABLE]

and

[TABLE]

are equal, and it is easy to see that all values in the second set are distinct.

Fixing $j$ and varying $i=0,\dots,d-1$ gives us the numbers

[TABLE]

When $i+j\leq d-1$ then $(i+j)d-(j-1)\leq n$ and all these numbers are of the form $kd-m$ where $m\in\{0,\dots,d-2\}$ and $m<k\leq d-1$.

When $i+j\geq d$, then $(i+j)d-(j-1)>n$ and we subtract $n$ to get $(i+j-d+1)d-j$. Now $i+j-d+1\leq j$ since $i\leq d-1$, and thus $(i+j-d+1)d-j$ is not of the above form $kd-m$ with $m<k\leq d-1$. ∎

Corollary 4.1.

Let $n=(d-1)d+1$ and let $e_{1}=\frac{q^{d^{2}}-1}{q^{d}-1}$ and $e_{2}=\frac{q^{(d-1)d}-q^{d-1}}{q^{d-1}-1}$. Then

[TABLE]

• Proof.

If $q$ is even, then both $1+qe_{1}e_{2}$ and $\frac{q^{n}-1}{q-1}$ are odd. Recall that $\frac{q^{n}-1}{q-1}=\sum_{i=0}^{n-1}q^{i}$. So if $q$ is odd, then $\frac{q^{n}-1}{q-1}$ is odd if $n$ is odd, and even if $n$ is even. But $n=(d-1)d+1$ is always odd, so $\frac{q^{n}-1}{q-1}$ is odd. We have already established in the proof of Theorem 4.1 that if $q$ is odd, then $e_{2}$ is odd if $d-1$ is odd, and even if $d-1$ is even. Now $e_{1}=\sum_{i=0}^{d-1}q^{id}$ is odd if $q$ and $d$ are odd and even if $q$ is odd but $d$ is even. But either $d$ or $d-1$ is always even, so $e_{1}e_{2}$ is even. Thus $1+qe_{1}e_{2}$ is odd. Consequently, by Theorem 4.2

[TABLE]

for any $q,d$. ∎

Corollary 4.2.

In the conclusions of Theorem 4.1, conclusion 1 implies conclusion 2.

5 The Main Result

In this section, we will prove the third part of the main theorem as stated in the introduction. The following Lemma is surely well known but we include a short proof.

Lemma 5.1.

$\binom{n}{i}=0\ \mathrm{mod}\ p$ for all $i=1,2,\dots,n-1$ if and only if $n$ is a power of $p$.

• Proof.

If $n$ is a power of $p$, then the above binomial coefficients are divisible by $p$. On the other hand, we claim that if $n=p^{k}w$, where $p\nmid w$, $w>1$ and $k\geq 0$, then $\binom{p^{k}w}{p^{k}}$ is not divisible by $p$. First note that $\binom{n}{m}=\frac{n!}{m!(n-m)!}=\frac{\prod_{i=1}^{n}i}{(\prod_{i=1}^{m}i)(\prod_{i=1}^{n-m}i)}=\frac{\prod_{i=n-m+1}^{n}i}{\prod_{i=1}^{m}i}=\frac{\prod_{i=0}^{m-1}(n-i)}{\prod_{i=1}^{m}i}=\frac{n}{m}\prod_{i=1}^{m-1}\frac{n-i}{i}$. Thus $\binom{p^{k}w}{p^{k}}=w\prod_{i=1}^{p^{k}-1}\frac{p^{k}w-i}{i}$. Now write $i=lp^{j}$ with $p\nmid l$. Then $\frac{p^{k}w-i}{i}=\frac{p^{k}w-lp^{j}}{lp^{j}}=\frac{(p^{k-j}w-l)p^{j}}{lp^{j}}=\frac{p^{k-j}w-l}{l}$ which is not divisible by $p$. ∎

Finally, we present the last part of the proof of the main theorem.

Theorem 5.1.

Let $n=(d-1)d+1$ and $e_{1}=\frac{q^{d^{2}}-1}{q^{d}-1}$. Let $L=x^{q^{d}}-bx^{q}-ax\in\mathbb{F}_{q^{n}}[x]$. Then $L$ has $q^{d}$ roots in $\mathbb{F}_{q^{n}}$ if and only if each of the following holds:

$a^{1+q+\dots+q^{(d-1)d}}=(-1)^{d-1}$ 2. 2.

$b=-a^{qe_{1}}$ 3. 3.

$d-1$ is a power of the characteristic of $\mathbb{F}_{q^{n}}$.

• Proof.

Recall that the $(l,1)$ entry of $A_{L,n}$ is $M_{l,n-d+1}$. We will first show that

[TABLE]

whenever the three conditions of the theorem are fulfilled. By [CMPZ19, Corollary 3.2], this implies that $A_{L,n}=I_{d}$.

Let $k\geq d+1$. By the recursion (2),

[TABLE]

Since $b=-a^{qe_{1}}=-a^{1+\sum_{i=0}^{d-2}q^{id+1}}\ \mathrm{mod}\ a^{q^{n}}-a$ (condition 2 in the statement of the theorem) we have

[TABLE]

So the coefficient of $M_{l,k-2d+1}$ in (5) that comes from expanding $M_{l,k-d}$ is the same as the coefficient that comes from expanding $M_{l,k-d+1}$.

\Tree

[.$M_{l,k}$ [.$M_{l,k-d}$ [.$M_{l,k-2d}$ ] $M_{l,k-2d+1}$ ][.$M_{l,k-d+1}$ $M_{l,k-2d+1}$ $M_{l,k-2d+2}$ ] ]

Let $c_{2,0}=a^{q^{k-1}+q^{k-d-1}}$, $c_{2,1}=a^{q^{k-d}}b^{q^{k-1}}$, and $c_{2,2}=b^{q^{k-1}+q^{k-d}}$. Thus (5) is saying that

[TABLE]

One can see Pascal's triangle emerging. We claim that

[TABLE]

for all $j=0,\dots,\lfloor\frac{k-1}{d}+1\rfloor$, where $c_{j,i}$ are expressions in $a$ and $b$, determined by the following recursion:

[TABLE]

We have shown the statement for $j=2$. Assume that the statement is true for any index less than $j$. Then

[TABLE]

Let $m=k-(j-2)d+i-1$. Then $a^{q^{m-1}}b^{q^{m-d-1}}=a^{q^{m-d}}b^{q^{m-1}}$, i.e.

[TABLE]

and hence

[TABLE]

Then

[TABLE]

and

[TABLE]

and by (6), these two expressions are equal.

Thus

[TABLE]

as desired. This completes the proof of the claim.

We now have

[TABLE]

since $M_{l,2-d+i}=0$ when $i\neq l-2$.

As before, let $e_{1}=\frac{q^{d^{2}}-1}{q^{d}-1}$ and $e_{2}=\frac{q^{(d-1)d}-q^{d-1}}{q^{d-1}-1}$.

Then

[TABLE]

Also

[TABLE]

Thus

[TABLE]

since $a^{\frac{q^{n}-1}{q-1}}=(-1)^{d-1}$ (condition 1 in the statement of the theorem).

Hence,

[TABLE]

since $M_{l,l-d}=1$ and $M_{l,k}=0$ when $k\neq l-d$ and $k\leq 0$.

So far we have only used conditions 1 and 2 in the statement of the theorem (so note for later that conditions 1 and 2 imply (7)). Assume now that condition 3 holds. By Lemma 5.1, $M_{l,n-d+1}=0$ for all $l\geq 3$ because $\binom{d-1}{l-2}=0$. This completes the proof that if the three conditions in the statement hold, then $L$ splits completely.

Now we complete the proof of the theorem by showing the converse, i.e. we show that if $L$ splits completely then the three conditions in the statement hold. Theorem 4.1 and Corollary 4.2 show that if $L$ splits completely, then conditions 1 and 2 of the theorem hold. Because conditions 1 and 2 hold, we know that (7) holds.

On the other hand, since $L$ splits completely, $M_{l,n-d+1}=0$ for all $l\geq 3$. Therefore $\binom{d-1}{l-2}c_{d-1,l-2}=0$ for all $3\leq l\leq d$. We now use the fact that $c_{d-1,l-2}$ is a power of $a$, and is therefore nonzero because $a$ is nonzero. We are forced to conclude that $\binom{d-1}{l-2}=0$ for all $3\leq l\leq d$. This implies that $d-1$ is a power of the characteristic of $\mathbb{F}_{q^{n}}$ by Lemma 5.1. ∎

6 Possible Application to Cryptography

6.1 Quasi-Subfield Polynomials

The recent work [HKP*+*18] explored the use of quasi-subfield polynomials to solve the Elliptic Curve Discrete Logarithm Problem (ECDLP). They define quasi-subfield polynomials as polynomials of the form $x^{q^{d}}-\lambda(x)\in\mathbb{F}_{q^{n}}[x]$ which divide $x^{q^{n}}-x$ and where $\log_{q}(\deg(\lambda))<d^{2}/n$. For appropriate choices of $n$ and $d$, linearized polynomials have a chance of being quasi-subfield polynomials. We first observe that the polynomials in Theorem 5.1 are quasi-subfield polynomials.

Lemma 6.1.

The linearized polynomial $L=x^{q^{d}}-bx^{q}-ax\in\mathbb{F}_{q^{(d-1)d+1}}[x]$ is a quasi-subfield polynomial when all the following conditions are satisfied.

$a^{1+q+\dots+q^{(d-1)d}}=(-1)^{d-1}$ 2. 2.

$b=-a^{qe_{1}}$ 3. 3.

$d-1$ is a power of the characteristic of $\mathbb{F}_{q^{n}}$.

• Proof.

Here, $\log_{q}(\deg(\lambda))=1$ and $d^{2}>n=(d-1)d+1$ so the condition $\log_{q}(\deg(\lambda))<d^{2}/n$ is satisfied. By Theorem 5.1, $L(x)$ divides $x^{q^{n}}-x$. ∎

6.2 The ECDLP

Let $E$ be an elliptic curve over a finite field $\mathbb{F}_{q}$, where $q$ is a prime power. In practice, $q$ is often a prime number or a large power of 2. Let $P$ and $Q$ be $\mathbb{F}_{q}$-rational points on $E$. The Elliptic Curve Discrete Logarithm Problem (ECDLP) is finding an integer $l$ (if it exists) such that $Q=lP$. The integer $l$ is called the discrete logarithm of $Q$ to base $P$.

The ECDLP is a hard problem that underlies many cryptographic schemes and is thus an area of active research. The introduction of summation polynomials by [Sem04] has led to algorithms that resemble the index calculus algorithm of the DLP over finite fields.

The algorithm to solve the ECDLP in [HKP*+*18] also uses summation polynomials, so we recall their definition.

Definition 6.1.

[Sem04] Let $E$ be an elliptic curve over a field $K$. For $m\geq 1$, we define the summation polynomial $S_{m+1}=S_{m+1}(X_{0},X_{1},\ldots,X_{m})\in K[X_{0},X_{1},\ldots,X_{m}]$ of $E$ by the following property. Let $x_{0},x_{1},\ldots,x_{m}\in\overline{K}$, then $S_{m+1}(x_{0},x_{1},\ldots,x_{m})=0$ if and only if there exist $y_{0},y_{1},\ldots,y_{m}\in\overline{K}$ such that $(x_{i},y_{i})\in E(\overline{K})$ and $(x_{0},y_{0})+(x_{1},y_{1})+\ldots+(x_{m},y_{m})=\mathcal{O}$, where $\mathcal{O}$ is the identity element of $E$.

The summation polynomials $S_{m}$ have many terms and have only been computed for $m\leq 9$.

[HKP*+*18] develop an algorithm to solve the ECDLP over the field $\mathbb{F}_{q^{n}}$ using a quasi-subfield polynomial $X^{q^{d}}-\lambda(X)\in\mathbb{F}_{q^{n}}[X]$ and the summation polynomial $S_{m+1}(X_{0},X_{1},\ldots,X_{m})\in\mathbb{F}_{q^{n}}[X_{0},X_{1},\ldots,X_{m}]$. By [HKP*+*18, Theorem 3.2] (see also Appendix A1) their algorithm has complexity

[TABLE]

6.3 Linearized Quasi-Subfield Polynomials

One of the problems outlined in [HKP*+*18] is to find suitable quasi-subfield polynomials that give optimal complexity in their algorithm. So in this section, we will investigate whether the linearized polynomials in this paper are a suitable choice.

In our notation the field is $\mathbb{F}_{q^{n}}$ so brute force algorithms have $O(q^{n})$ complexity and generic algorithms (Pollard Rho or Baby-Step-Giant-Step) have $O(q^{n/2})$ complexity.

If $n=(d-1)d+1$ and we use $L=x^{q^{d}}-bx^{q}-ax\in\mathbb{F}_{q^{(d-1)d+1}}[x]$ as in Lemma 6.1 as our quasi-subfield polynomial, then we get complexity

[TABLE]

for the algorithm in [HKP*+*18]. However, since $d^{2}-dm+1+4.876m(m-1)>n/2$ for any $d,m$, this will not beat generic discrete log algorithms. Thus it appears that the polynomials of Theorem 5.1 will not lead to an ECDLP algorithm that beats generic algorithms, although they can beat brute force algorithms.

Remark 6.1.

We briefly discuss adding another term of small degree, for example, an $x^{q^{2}}$ term. Suppose we have a linearized polynomial $L=x^{q^{d}}-cx^{q^{2}}-bx^{q}-ax\in\mathbb{F}_{q^{n}}[x]$ which splits completely and with $d^{2}>2n$ (so $L(x)$ is a quasi-subfield polynomial). Then the algorithm of [HKP*+*18] has complexity

[TABLE]

To beat generic discrete log algorithms, we require at least $n-d(m-1)\leq n/2$ and $2d\leq n/2$, which implies $\frac{n}{2(m-1)}\leq d\leq\frac{n}{4}$ and therefore $m\geq 3$. As an example, if we choose $q=2$ and $m=4$ then we have $2^{7.376m(m-1)}(q^{2})^{4.876m(m-1)}\approx 1.45\cdot q^{205}$ inside the $\tilde{O}$. This means that the overall complexity can beat generic algorithms over $\mathbb{F}_{2^{n}}$ (for $n$ sufficiently large). For example, a choice of $d$ around $n/5$ when $q=2$, $m=4$, would give a complexity $O(q^{0.4n})$ for $n>500$.

To obtain an estimate for smaller field sizes we may try $m=3$, which implies that $d\approx\frac{n}{4}$. These choices would give us complexity

[TABLE]

which is not better than generic algorithms. One example of a linearized polynomial which splits completely and matches these choices ($q=2$, $d\approx\frac{n}{4}$) is $L=x^{1024}+x^{4}+x\in\mathbb{F}_{2^{42}}[x]$.

7 Conclusion and open questions

We have provided necessary and sufficient conditions for $L=x^{q^{d}}-bx^{q}-ax\in\mathbb{F}_{q^{(d-1)d+1}}[x]$ to have all $q^{d}$ roots in $\mathbb{F}_{q^{(d-1)d+1}}$.

The recursive formula that we found for trinomial linearized polynomials is valid for more general linearized polynomials too: Let $L=x^{q^{d}}-\sum_{i=0}^{d-1}a_{i}x^{q^{i}}$.

Set $M_{l,l-d}=1$, and $M_{l,k}=0$ for $k\leq 0$ and $k\neq l-d$. For $1\leq l\leq d$ and $k\geq 1$, let

[TABLE]

Then $M_{l,k}$ is the $(l,d)$ entry of $A_{L,k}$. Furthermore, the $(l,j)$ entry of $A_{L,k}$ is $M_{l,k-d+j}$.

We are currently working on extending these results to this more general case, for example, to polynomials of the form $L=x^{q^{d}}-cx^{q^{2}}-bx^{q}-ax$.

@noitemerr

We thank Christophe Petit and John Sheekey for helpful conversations.

@noitemerr

This research was supported by a Postgraduate Government of Ireland Scholarship from the Irish Research Council.