Standard Lattices of Compatibly Embedded Finite Fields

TL;DR

This paper introduces a new lattice construction for compatibly embedded finite fields that is more efficient than existing methods like Bosma-Cannon-Steel, with practical implementation demonstrating its effectiveness.

Contribution

It generalizes existing constructions of finite field lattices using the Lenstra-Allombert isomorphism algorithm, offering improved efficiency and practicality.

Findings

Larger set of field extensions from small tables

Quadratic complexity algorithms

Linear storage relative to number of extensions

Abstract

Lattices of compatibly embedded finite fields are useful in computer algebra systems for managing many extensions of a finite field $\mathbb{F}_p$ at once. They can also be used to represent the algebraic closure $\bar{\mathbb{F}}_p$, and to represent all finite fields in a standard manner. The most well known constructions are Conway polynomials, and the Bosma-Cannon-Steel framework used in Magma. In this work, leveraging the theory of the Lenstra-Allombert isomorphism algorithm, we generalize both at the same time. Compared to Conway polynomials, our construction defines a much larger set of field extensions from a small pre-computed table; however it is provably as inefficient as Conway polynomials if one wants to represent all field extensions, and thus yields no asymptotic improvement for representing $\bar{\mathbb{F}}_p$. Compared to Bosma-Cannon-Steel lattices, it is considerably more efficient both in computation time and storage: all algorithms have at worst quadratic complexity, and storage is linear in the number of represented field extensions and their degrees. Our implementation written in C/Flint/Julia/Nemo shows that our construction in indeed practical.

Tables

Table 1. Table 1. The first ten standard polynomials derived from Conway polynomials for p = 2 𝑝 2 p=2 .

$x+1$	$x^9+x^7+x^4+x^2+1$
$x^3+x+1$	$x^{11}+x^8+x^7+x^6+x^2+x+1$
$x^5+x^3+1$	$x^{13}+x^{10}+x^5+x^3+1$
$x^7+x+1$	$x^{15}+x+1$
$x^{17}+x^{11}+x^{10}+x^8+x^7+x^6+x^4+x^3+x^2+x+1$
$x^{19}+x^{17}+x^{16}+x^{15}+x^{14}+x^{13}+x^{12}+x^8+x^7+x^6+x^5+x^3+1$

Equations

$${\mathcal{S}}^I=\{(K_l,{\zeta }_l){\}}_{l\in I}$$

$$K_l={\mathbb{F}}_p({\zeta }_l),({\zeta }_l{)}^l=1,$$

$$\begin{array}[]{cccc}{\iota_{{l},{m}}}:&K_{l}&\hookrightarrow&K_{m}\\ &\zeta_{l}&\mapsto&(\zeta_{m})^{\frac{m}{l}}\end{array}$$

$$C_{a}\Bigl{(}X^{\frac{p^{b}-1}{p^{a}-1}}\Bigr{)}=0\mod C_{b}$$

$$A_l={\mathbb{F}}_{p^l}\otimes {\mathbb{F}}_p({\zeta }_l),$$

$$\nu (l)={\mathrm{ord}}_{(\mathbb{Z}/l\mathbb{Z}{)}^{\times }}(p)=[{\mathbb{F}}_p({\zeta }_l):{\mathbb{F}}_p],$$

$$(\sigma \otimes 1)(x)=(1\otimes \eta )x,$$

$$({\alpha }_l{)}^l=1\otimes c_l$$

$$A_l\simeq {\mathbb{F}}_p({\zeta }_l)[T]/(T^l-c_l).$$

$${\lfloor \beta \rfloor }_{\eta }=y_0.$$

$${\alpha }_l=\sum _{i=0}^{a-1}{x}_i\otimes {\zeta }_l^i$$

$$\begin{array}[]{l}x_{a-1}=\sigma(x_{0})/b_{0}\\ x_{i}\quad\,=\sigma(x_{i+1})-b_{i+1}x_{a-1}\quad\text{for $i=a\!-\!2$ down to $1$}\end{array}$$

$$\begin{array}[]{cccc}{\iota_{{l},{m}}}:&\mathbb{F}_{p}(\zeta_{l})&\hookrightarrow&\mathbb{F}_{p}(\zeta_{m})\\ &\zeta_{l}&\mapsto&(\zeta_{m})^{\frac{m}{l}}.\end{array}$$

$$\Phi ⟷\hat{\alpha }=\Phi ({\alpha }_l).$$

$$\hat{\alpha }=\Phi ({\alpha }_l)=\sum _{i=0}^{a-1}\varphi (x_i)\otimes ({\zeta }_m{)}^{\frac{mi}{l}}.$$

$$A_{p^a-1}={\mathbb{F}}_{p^{p^a-1}}\otimes {\mathbb{F}}_{p^a}$$

$$\begin{array}{rl}({\alpha }_{p^a-1}{)}^{p^a}=({\sigma }^a\otimes {\sigma }^a)({\alpha }_{p^a-1})& =({\sigma }^a\otimes 1)({\alpha }_{p^a-1})\\ & =(1\otimes {\zeta }_{p^a-1}{)}^a{\alpha }_{p^a-1}.\end{array}$$

$$c_l^{\mathrm{std}}=({\iota }_{l,p^a-1}{)}^{-1}(({\zeta }_{p^a-1}{)}^a)\in {\mathbb{F}}_p({\zeta }_l)$$

$$({\alpha }_l{)}^l=1\otimes c_l^{\mathrm{std}}.$$

$$(A_l,{\alpha }_l)$$

$$({\alpha }_{p^a-1}{)}^{\frac{p^a-1}{l}}=(1\otimes \lambda )\Phi ({\alpha }_l^{\prime })=\Phi ((1\otimes \tilde{\lambda }){\alpha }_l^{\prime }),$$

$${\Phi }_{l,m}^{\mathrm{std}}:A_l\hookrightarrow A_m$$

$$A_m={\mathbb{F}}_{p^m}\otimes {\mathbb{F}}_p({\zeta }_m)\stackrel{\sim }{⟶}{\mathbb{F}}_{p^m}\otimes {\mathbb{F}}_p({\zeta }_{p^b-1}),$$

$$(A_m{)}^{1\otimes {\sigma }^a}\simeq {\mathbb{F}}_{p^m}\otimes {\mathbb{F}}_p(({\zeta }_{p^b-1}{)}^{\frac{p^b-1}{p^a-1}}),$$

$$\begin{array}[]{cccc}\mathcal{N}_{b/a,A_{n}}:&(A_{n})^{1\otimes\sigma^{b}}&\to&(A_{n})^{1\otimes\sigma^{a}}\\ &\gamma&\mapsto&\prod_{0\leq j<\frac{b}{a}}(1\otimes\sigma^{ja})(\gamma).\end{array}$$

$${\mathcal{N}}_{b/a}(\gamma {\gamma }^{\prime })={\mathcal{N}}_{b/a}(\gamma ){\mathcal{N}}_{b/a}({\gamma }^{\prime }),$$

$${\mathcal{N}}_{c/a}={\mathcal{N}}_{b/a}\circ {\mathcal{N}}_{c/b},$$

$${\Phi }_{p^a-1,p^b-1}^{\mathrm{std}}:A_{p^a-1}\hookrightarrow A_{p^b-1}$$

$$\begin{array}{rl}({\mathcal{N}}_{b/a}({\alpha }_{p^b-1}){)}^{p^a}& =({\sigma }^a\otimes {\sigma }^a)({\mathcal{N}}_{b/a}({\alpha }_{p^b-1}))\\ & =({\sigma }^a\otimes 1)({\mathcal{N}}_{b/a}({\alpha }_{p^b-1}))\\ & ={\mathcal{N}}_{b/a}(({\sigma }^a\otimes 1)({\alpha }_{p^b-1}))\\ & ={\mathcal{N}}_{b/a}((1\otimes ({\zeta }_{p^b-1}{)}^a){\alpha }_{p^b-1})\\ & =(1\otimes {\iota }_{p^a-1,p^b-1}({\zeta }_{p^a-1}{)}^a){\mathcal{N}}_{b/a}({\alpha }_{p^b-1}).\end{array}$$

$$\begin{array}{ccc}(A_{p^a-1},{\alpha }_{p^a-1})& \stackrel{{\Phi }_{p^a-1,p^b-1}^{\mathrm{std}}}{\to }& (A_{p^b-1},{\alpha }_{p^b-1})\\ {\Phi }_{l,p^a-1}^{\mathrm{std}}\uparrow & & \uparrow {\Phi }_{m,p^b-1}^{\mathrm{std}}\\ (A_l,{\alpha }_l)(A_m,{\alpha }_m)& & \end{array}$$

Full text

The most well known constructions are Conway polynomials, and the Bosma–Cannon–Steel framework used in Magma. In this work, leveraging the theory of the Lenstra-Allombert isomorphism algorithm, we generalize both at the same time.

Compared to Conway polynomials, our construction defines a much larger set of field extensions from a small pre-computed table; however it is provably as inefficient as Conway polynomials if one wants to represent all field extensions, and thus yields no asymptotic improvement for representing $\bar{}\mathbb{F}_{p}$.

Compared to Bosma–Cannon–Steel lattices, it is considerably more efficient both in computation time and storage: all algorithms have at worst quadratic complexity, and storage is linear in the number of represented field extensions and their degrees.

Our implementation written in C/Flint/Julia/Nemo shows that our construction in indeed practical.

Finite fields; field extensions; Conway polynomials.

††journalyear: 2019††copyright: acmlicensed††conference: International Symposium on Symbolic and Algebraic Computation; July 15–18, 2019; Beijing, China††booktitle: International Symposium on Symbolic and Algebraic Computation (ISSAC ’19), July 15–18, 2019, Beijing, China††price: 15.00††doi: 10.1145/3326229.3326251††isbn: 978-1-4503-6084-5/19/07††ccs: Mathematics of computing Mathematical software††ccs: Computing methodologies Algebraic algorithms

1. Introduction

Computer algebra systems (CAS) are often faced with the problem of constructing several extensions of a finite field $\mathbb{F}_{p}$ in a compatible way, i.e., such that the (subfield) inclusion lattice of the given extensions can be computed and evaluated efficiently.

Concretely, what is sought is a data structure $\Lambda$ to represent arbitrary collections of extensions of $\mathbb{F}_{p}$, in such a way that elements of $\mathbb{F}_{p^{m}}$ are represented in optimal space (i.e., $O(m)$ coefficients), and that arithmetic operations are performed efficiently (i.e., $O\left(\operatorname{lcm}(l,m)^{d}\right)$ arithmetic operations to combine an element of $\mathbb{F}_{p^{l}}$ and an element of $\mathbb{F}_{p^{m}}$, where $d\leq 3$ and, possibly, $d=1+\varepsilon$). To this end, it is useful to set several sub-goals:

**Effective embeddings:****: **

For any pair of extensions $k\subseteq K$ in $\Lambda$, there exists an efficiently computable embedding $\phi:k\to K$, and algorithms to evaluate $\phi$ on $k$, and the section $\phi^{-1}$ on $K$.

**Compatibility:****: **

The embeddings are compatible, i.e., for any triple $k\subseteq K\subseteq L$ in $\Lambda$, and embeddings $\phi:k\to K$, $\psi:K\to L$, $\chi:k\to L$, one has $\chi=\psi\circ\phi$.

**Incrementality:****: **

The data associated with an extension (e.g., its irreducible polynomial, change-of-basis matrices, …) must be computable efficiently and incrementally, i.e., adding a new field extension to $\Lambda$ does not require recomputing data for all extensions already in $\Lambda$.

**Uniqueness:****: **

Any extension of $\mathbb{F}_{p}$ is determined by an irreducible polynomial whose definition only depends on the characteristic $p$ and the degree of the extension.

**Generality:****: **

Extensions of $\mathbb{F}_{p}$ can be represented by arbitrary irreducible polynomials.

Some goals, such as incrementality, uniqueness and generality are optional, and it is obvious that uniqueness and generality are even in conflict with each other. An incremental data structure can be used to effectively represent an algebraic closure $\bar{}\mathbb{F}_{p}$, with new finite extensions built on the fly as they are needed. Uniqueness is useful for defining field elements in a standard way, portable between different CAS, while generality is useful in a context where the user is left with the freedom of choosing the defining polynomials. Note that any solution can be made unique by replacing all random choices with pseudo-random ones, however one is usually interested in unique solutions that have a simple mathematical description. Also, any solution can be made general by means of an isomorphism algorithm (Lenstra, 1991; Allombert, 2002; Brieulle et al., 2019; Narayanan, 2018). Other optional goals, such as computing normal bases or evaluating Frobenius morphisms, may be added to the list, however they are out of the scope of this work.

Previous work

The first and most well known solution is the family of Conway polynomials (Nickel, 1988; Heath and Loehr, 1999), first adopted in GAP (The GAP Group, 2018), and then also by Magma (Bosma et al., 1997a) and Sage (The Sage Developers, 2019). Conway polynomials yield uniqueness, however computing them requires exponential time using the best known algorithm, thus incrementality is only available at a prohibitive cost; for this reason, they are usually pre-computed and tabulated up to some bound.

Lenstra (Lenstra, 1991) was the first to show the existence of a (incremental, general) data structure computable in deterministic polynomial time. He proved that, besides the problem of finding irreducible polynomials, any other question is amenable to linear algebra. Subsequent work of Lenstra and de Smit (Lenstra Jr. and de Smit, 2013) tackled the uniqueness problem, albeit only from a theoretical point of view.

In practice, randomized algorithms are good enough for a CAS, then polynomial factorization and basic linear algebra provide an easy (incremental, general) solution, that was first analyzed by Bosma, Cannon and Steel (Bosma et al., 1997b), and is currently used in Magma.

All solutions presented so far have superquadratic complexity, i.e., $d>2$. Recent work on embedding algorithms (Doliskani and Schost, 2015; De Feo et al., 2013, 2014) yields subquadratic (more precisely, $d\leq 1.5$) solutions for specially constructed (non-unique, non-general) families of irreducible polynomials, and even quasi-optimal ones (i.e., $d=1+\varepsilon$) if a quasi-linear modular composition algorithm is available. However these constructions involve counting points of random elliptic curves over finite fields, and have thus a rather high polynomial dependency in $\log p$; for this reason, they are usually considered practical only for relatively small characteristic.

Our contribution

In this work we present an incremental, general and/or unique solution for lattices of compatibly embedded finite fields, where all embeddings can be computed and evaluated in quasi-quadratic time. Our starting point is Allombert’s (Allombert, 2002) and subsequent (Brieulle et al., 2019) improvements to Lenstra’s isomorphism algorithm (Lenstra, 1991). Plugging them in the Bosma–Cannon–Steel framework immediately produces an incremental general solution with quasi-quadratic complexity; however we go much further. Indeed, we show that the compatibility requirement can be taken a step further by constructing a lattice of $\mathbb{F}_{p}$-algebras with a distinguished element, which is a byproduct of the Lenstra-Allombert algorithm.

The advantages of our construction over a naive combination of the Lenstra-Allombert algorithm and the Bosma–Cannon–Steel framework are multiple. Storage drops from quadratic to linear in the number of extensions stored in $\Lambda$ and in their degrees, and the cost of adding a new extension to $\Lambda$ drops similarly.

Our $\mathbb{F}_{p}$-algebras are constructed by tensoring an arbitrary lattice of extensions of $\mathbb{F}_{p}$ with what we call a cyclotomic lattice (see next section). In this work we mostly abstract away from the concrete instantiation of the cyclotomic lattice, only fixing a choice in Section 6, where we use Conway polynomials to analyze the complexity and implement our algorithms. This choice allows us to uniquely represent finite fields of degree exponentially larger than with Conway polynomials alone; however it also has the serious drawback of being generically as hard to compute as Conway polynomials, and thus relatively unpractical. We leave the exploration of other, more practical, instantiations of cyclotomic lattices for future work.

Organization

The presentation is structured as follows. In Section 2 we review some basic algorithms and facts on roots of unity and Conway polynomials. In Section 3 we review the Lenstra-Allombert algorithm and we define and study Kummer algebras, the main ingredient to our construction. In Section 4 we introduce a notion of compatibility for solutions of Hilbert 90 in Kummer algebras, that provides standard defining polynomials for finite fields. Then in Section 5 we again use these compatible solutions to construct standard compatible embeddings between finite fields, from which a lattice can be incrementally constructed. Finally, in Section 6 we give the complexities of our algorithms, and present our implementation.

2. Preliminaries

Fundamental algorithms and complexities

Throughout this paper we let $\mathbb{F}_{p}$ be a finite field. For simplicity, we shall assume that $p$ is prime, which is arguably the most useful case, however our results could easily be extend to non-prime fields. We measure time complexities as a number of arithmetic operations $(+,\times,/)$ over $\mathbb{F}_{p}$, and storage as a number of elements of $\mathbb{F}_{p}$. We let $\mathsf{M}(m)$ denote the number of operations required to multiply two polynomials with coefficients in $\mathbb{F}_{p}$ of degree at most $m$, and adopt the usual super-linearity assumptions on the function $\mathsf{M}$ (see (von zur Gathen and Gerhard, 1999, Ch. 8.3)).

Any finite extension $\mathbb{F}_{p^{m}}$ can be represented as the quotient of $\mathbb{F}_{p}[X]$ by an irreducible polynomial of degree $m$. The algorithms we present in the next sections need not assume any particular representation for finite fields, however when analyzing their complexities we will assume this representation. Then, multiplications in $\mathbb{F}_{p^{m}}$ can be carried out using $O(\mathsf{M}(m))$ operations, and inversions using $O(\mathsf{M}(m)\log(m))$. In this work we will also need to perform computations in algebras $\mathbb{F}_{p^{m}}\otimes\mathbb{F}_{p^{n}}$: representing them as quotients of a bivariate polynomial ring, we can multiply elements using $O(\mathsf{M}(mn))$ operations.

We will extensively use a few standard routines, that we recall briefly. Brent and Kung’s algorithm (Brent and Kung, 1978) computes the modular composition $f(g)\bmod h$ of three polynomials $f,g,h\in\mathbb{F}_{p}[X]$ of degree at most $m$ using O\bigl{(}m^{(\omega+1)/2)}\bigr{)} operations, where $\omega$ is the exponent of linear algebra over $\mathbb{F}_{p}$. The Kedlaya–Umans algorithm (Kedlaya and Umans, 2011) solves the same problem, and has better complexity in the binary RAM model, however it is widely considered impractical, we shall thus not consider it in our complexity estimates.

By applying transposition techniques (Bürgisser et al., 1997; Bostan et al., 2003) to Brent and Kung’s algorithm, Shoup (Shoup, 1994, 1999) derived an algorithm to compute minimal polynomials of arbitrary elements of $\mathbb{F}_{p^{m}}$, having the same complexity O\bigl{(}m^{(\omega+1)/2)}\bigr{)}. Kedlaya and Umans’ improvements also apply to Shoup’s minimal polynomial algorithm, with the same practical limitations.

Shoup’s techniques can also be applied to evaluate embeddings of finite fields. Let $\mathbb{F}_{p^{l}},\mathbb{F}_{p^{m}}$ be a pair of finite fields related by an embedding $\phi:\mathbb{F}_{p^{l}}\hookrightarrow\mathbb{F}_{p^{m}}$, and let a generator $\alpha_{l}$ of $\mathbb{F}_{p^{l}}$ and its image $\phi(\alpha_{l})$ in $\mathbb{F}_{p^{m}}$ be given. Given these data, for any element $x\in\mathbb{F}_{p^{l}}$ it is possible to compute its image $\phi(x)$ using O\bigl{(}m^{(\omega+1)/2)}\bigr{)} operations; similarly, given an element $y=\phi(x)$ in $\mathbb{F}_{p^{m}}$, it is possible to recover $x$ in the same asymptotic number of operations. The relevant algorithms are summarized in (Brieulle et al., 2017, Sec. 6); note that, for specially constructed generators $\alpha_{l}$, more efficient algorithms may exist (De Feo and Schost, 2012; Doliskani and Schost, 2015; De Feo et al., 2013, 2014).

The present work focuses on algorithms to compute embeddings of finite fields, i.e., algorithms that, given finite fields $\mathbb{F}_{p^{l}}$ and $\mathbb{F}_{p^{m}}$ with $l\,|\,m$, find an embedding $\phi:\mathbb{F}_{p^{l}}\hookrightarrow\mathbb{F}_{p^{m}}$, a generator $\alpha_{l}$ of $\mathbb{F}_{p^{l}}$, and its image $\phi(\alpha_{l})$. An extensive review of known algorithms is given in (Brieulle et al., 2019); here we shall only be interested in the Lenstra–Allombert isomorphism algorithm (Lenstra, 1991; Allombert, 2002), and its adaptation to compatible lattices of finite fields.

Conway polynomials and cyclotomic lattices

The algorithms of the next sections will be dependent on the availability of a cyclotomic lattice. By this we mean, formally, a collection

[TABLE]

over some support set $I\subseteq\mathbb{N}\setminus p\mathbb{N}$. Where $K_{l}$ is an explicitly represented finite extension of $\mathbb{F}_{p}$, and $\zeta_{l}\in K_{l}$ a generating element that is also a primitive $l$-th root of unity, so

[TABLE]

together with explicit embeddings

[TABLE]

whenever $l\,|\,m$.

If $I$ is a finite set of indices, there is an easy randomized algorithm to construct a cyclotomic lattice: compute $n=\operatorname{lcm}_{l\in I}(l)$, construct the smallest field $\mathbb{F}_{p^{a}}$ such that $n$ divides $p^{a}-1$, take a random $x^{(p^{a}-1)/n}\in\mathbb{F}_{p^{a}}$ and test that it has multiplicative order $n$; then all roots $\zeta_{l}$ in the lattice are constructed as powers of this element, and we can set $K_{l}=\mathbb{F}_{p}(\zeta_{l})\subseteq\mathbb{F}_{p^{a}}$ and let ${\iota_{{l},{m}}}$ be natural inclusion.

Nevertheless, the most useful cyclotomic lattices are those where $I$ is the whole set $\mathbb{N}\setminus p\mathbb{N}$. It may seem odd to ask for such data, which in the end provides a representation of $\bar{}\mathbb{F}_{p}$, as a prerequisite for a construction whose goal is precisely to represent $\bar{}\mathbb{F}_{p}$. However we shall see that a relatively small cyclotomic sub-lattice is enough to construct a much larger lattice of compatibly embedded finite fields; it thus makes sense to assume that a cyclotomic lattice is available, if it can be computed incrementally.

Conway polynomials (Nickel, 1988) offer a classic example of cyclotomic lattice. The $a$-th Conway polynomial $C_{a}\in\mathbb{F}_{p}[X]$ is defined as the lexicographically smallest monic irreducible polynomial of degree $a$ that is also primitive (i.e., its roots generate $\mathbb{F}_{p^{a}}^{\times}$) and norm compatible (i.e,

[TABLE]

whenever $a$ divides $b$). The cyclotomic lattice is defined first by letting $\zeta_{p^{a}-1}$ be the image of $X$ in $K_{p^{a}-1}=\mathbb{F}_{p^{a}}=\mathbb{F}_{p}[X]/C_{a}$ for any $a$; this is then extended to all $l\in I$ by setting $K_{l}=K_{p^{a}-1}$ and $\zeta_{l}=(\zeta_{p^{a}-1})^{\frac{p^{a}-1}{l}}$ where $\mathbb{F}_{p^{a}}$ is the smallest extension $\mathbb{F}_{p}$ containing $l$-th roots of unity.

The best known algorithm to compute Conway polynomials has exponential complexity (Heath and Loehr, 1999), hence they are usually precomputed and tabulated up to a certain bound. Most computer algebra systems switch to other ways of representing finite fields when the tables of Conway polynomials are not enough. A notable exception is SageMath (The Sage Developers, 2019) (since version 5.13 (Roe et al., 2013)), that defines pseudo-Conway polynomials by relaxing the “lexicographically first” requirement; although easier to compute in practice, their computation still requires an exponential amount of work.

Other ways to construct cyclotomic lattices are possible. One may, for example, factor cyclotomic polynomials over $\mathbb{F}_{p}$, being careful to maintain compatibility. In the next sections we shall not suppose any cyclotomic lattice construction in particular, and simply assume that we are given a collection $\mathcal{S}^{I}$ that satisfies the properties given at the beginning of this paragraph.

3. The Lenstra-Allombert algorithm

We now review the theory behind Allombert’s adaptation (Allombert, 2002) of Lenstra’s isomorphism algorithm (Lenstra, 1991). This will be our stepping stone towards the definition of some standard elements in field extensions of $\mathbb{F}_{p}$ with an effective compatibility condition.

The main ingredient of the algorithm is an extension of Kummer theory. Because of this, the algorithm is limited to field extensions $\mathbb{F}_{p^{l}}$ of degree $l$ prime to $p$. The easier case of extensions of degree $p^{e}$ is covered in a similar way using Artin-Schreier theory, and the generic case is solved by separately computing isomorphisms for the power-of-$p$ and the prime-to-$p$ parts, and then tensoring the results together. Due to space constraints, we will not give details for the general case here; see (Lenstra, 1991; Allombert, 2002; Brieulle et al., 2019).

For any finite extension of $\mathbb{F}_{p}$, we denote by $\sigma:x\mapsto x^{p}$ the Frobenius automorphism. Let $l$ be an integer not divisible by $p$. Then $\sigma$ is an $\mathbb{F}_{p}$-linear endomorphism of $\mathbb{F}_{p^{l}}$ with minimal polynomial $T^{l}-1$, separable but not necessarily split, i.e., $\mathbb{F}_{p^{l}}$ is not necessarily a Kummer extension of $\mathbb{F}_{p}$. We extend scalars and work in the Kummer algebra of degree $l$:

[TABLE]

where $\otimes$ is the tensor product over $\mathbb{F}_{p}$, and $\zeta_{l}$ is a primitive $l$-th root of unity, taken from the given cyclotomic lattice. We call $\mathbb{F}_{p}(\zeta_{l})$ the field of scalars of $A_{l}$, and we define the level of $A_{l}$ as

[TABLE]

that is, the degree of its field of scalars.

Now $\sigma\otimes 1$ is a $1\otimes\mathbb{F}_{p}(\zeta_{l})$-linear endomorphism of $A_{l}$ with $l$ distinct eigenvalues, namely the powers of $1\otimes\zeta_{l}$. Thus, if $\eta=\zeta_{l}^{i}$ is any $l$-th root of unity in $\mathbb{F}_{p}(\zeta_{l})$, the corresponding eigenspace is defined by the Hilbert 90 equation for $\eta$:

[TABLE]

which plays the role of $\sigma(x)=\eta x$ in classical Kummer theory. The solutions of (H90) in $A_{l}$ form a $1\otimes\mathbb{F}_{p}(\zeta_{l})$-vector space of dimension $1$, and if $x$ is such a solution for $\eta$, then $x^{j}$ is a solution for $\eta^{j}$.

In particular, let $\alpha_{l}$ be a nonzero solution of (H90) for $\zeta_{l}$. Then $1,\alpha_{l},\cdots,(\alpha_{l})^{l-1}$ are eigenvectors for distinct eigenvalues and thus form a basis of $A_{l}$ over $1\otimes\mathbb{F}_{p}(\zeta_{l})$. Likewise

[TABLE]

for some scalar $c_{l}\in\mathbb{F}_{p}(\zeta_{l})$, that we shall call the Kummer constant of $\alpha_{l}$. This proves:

Proposition 1.

Any nonzero solution $\alpha_{l}$ of (H90) for $\zeta_{l}$ is a generating element for $A_{l}$ as an algebra over $1\otimes\mathbb{F}_{p}(\zeta_{l})$, inducing an isomorphism

[TABLE]

Since $A_{l}$ is known to be an étale algebra, $\alpha_{l}$ being nonzero implies that $c_{l}$ is nonzero, which in turn implies that $\alpha_{l}$ is invertible in $A_{l}$, indeed $\;(\alpha_{l})^{-1}=(1\otimes c_{l}^{-1})(\alpha_{l})^{l-1}$.

We will make frequent use of the following:

Lemma 2.

Let $K,L$ be two finite extensions of $\mathbb{F}_{p}$. Then, for any $\beta\in K\otimes L$, we have $(\sigma\otimes\sigma)(\beta)=\beta^{p}$.

Proof.

If $\beta=u\otimes v$ is an elementary tensor we have $(\sigma\otimes\sigma)(\beta)=u^{p}\otimes v^{p}=\beta^{p}$. This then extends by linearity since we’re in characteristic $p$. ∎

In this generality we also introduce the following notation: if $\eta\in L$ has degree $d$ over $\mathbb{F}_{p}$, then any $\beta\in K\otimes\mathbb{F}_{p}(\eta)\subseteq K\otimes L$ decomposes uniquely as $\beta=\sum_{i=0}^{d-1}y_{i}\otimes\eta^{i}$, and we set

[TABLE]

In particular, coming back to $A_{l}$, if we write

[TABLE]

where $a=\nu(l)$, it is shown in (Allombert, 2002) that $x_{0}=\left\lfloor\alpha_{l}\right\rfloor_{\zeta_{l}}$ is a generating element for the extension $\mathbb{F}_{p^{l}}/\mathbb{F}_{p}$. Moreover, (Allombert, 2002) (see also (Brieulle et al., 2019)) provides the following equations that allow, in the opposite direction, to recover $\alpha_{l}$ from $x_{0}$:

[TABLE]

where $\zeta_{l}^{a}=\sum_{i=0}^{a-1}b_{i}\zeta_{l}^{i}$ is the minimal equation for $\zeta_{l}$.

Proposition 3.

With the notations above, there are precisely $l$ elements $x\in A_{l}$ that are solutions of (H90) for $\zeta_{l}$ and satisfy $x^{l}=1\otimes c_{l}$, namely, these are the $(1\otimes\zeta_{l})^{u}\alpha_{l}=(\sigma^{u}\otimes 1)(\alpha_{l})$ for $0\leq u<l$. The corresponding generating elements for $\mathbb{F}_{p^{l}}/\mathbb{F}_{p}$ are the $\left\lfloor(\sigma^{u}\otimes 1)(\alpha_{l})\right\rfloor_{\zeta_{l}}=\sigma^{u}(x_{0})$; they all have the same minimal polynomial, which is a generating polynomial for $\mathbb{F}_{p^{l}}/\mathbb{F}_{p}$ depending only on $c_{l}$.

Proof.

The solutions of (H90) for $\zeta_{l}$ form a $1\otimes\mathbb{F}_{p}(\zeta_{l})$-vector space of dimension $1$, thus they all are of the form $x=(1\otimes\xi)\alpha_{l}$. Adding the condition $x^{l}=1\otimes c_{l}$ then forces $\xi^{l}=1$, from which all assertions follow. ∎

Now we consider Kummer algebras of various degrees. Since we assumed that the fields of scalars are defined from a cyclotomic lattice $\mathcal{S}^{I}$, they are compatibly embedded: for $l\,|\,m$ prime to $p$, we have the embedding

[TABLE]

It is easily shown that, as an $\mathbb{F}_{p}$-algebra, $A_{l}$ is isomorphic to a product of copies of $\mathbb{F}_{p^{l}}(\zeta_{l})$, and $A_{m}$ to a product of copies of $\mathbb{F}_{p^{m}}(\zeta_{m})$. This allows us to describe all $\mathbb{F}_{p}$-algebra morphisms from $A_{l}$ to $A_{m}$. However here we will focus only on a certain subclass of them:

Definition 4.

A Kummer embedding of $A_{l}$ into $A_{m}$ is an injective $\mathbb{F}_{p}$-algebra morphism $\Phi:A_{l}\hookrightarrow A_{m}$ such that:

• •

$\Phi$* extends the scalar embedding $1\otimes{\iota_{{l},{m}}}$*

• •

$\Phi$* commutes with $\sigma\otimes 1$.*

Proposition 5.

Let $\alpha_{l}\in A_{l}$ be a nonzero solution of (H90) for $\zeta_{l}$, with Kummer constant $c_{l}$. Then, there is a $1$-to-$1$ correspondence between Kummer embeddings $\Phi:A_{l}\hookrightarrow A_{m}$ and solutions $\hat{\alpha}\in A_{m}$ of (H90) for $(\zeta_{m})^{\frac{m}{l}}$ that satisfy $(\hat{\alpha})^{l}=1\otimes{\iota_{{l},{m}}}(c_{l})$, given by

[TABLE]

Proof.

Direct consequence of Proposition 1 and Definition 4. ∎

Actually, Kummer embeddings are easily characterized:

Proposition 6.

There is a natural $1$-to-$1$ correspondence between Kummer embeddings $\Phi:A_{l}\hookrightarrow A_{m}$ and embeddings of finite fields $\phi:\mathbb{F}_{p^{l}}\hookrightarrow\mathbb{F}_{p^{m}}$, given by:

• •

If $\Phi$ is a Kummer embedding, then $\Phi$ maps $\mathbb{F}_{p^{l}}\otimes 1$ into $\mathbb{F}_{p^{m}}\otimes 1$. Thus the restriction of $\Phi$ to $\mathbb{F}_{p^{l}}\otimes 1$ is of the form $\phi\otimes 1$ for some $\phi:\mathbb{F}_{p^{l}}\hookrightarrow\mathbb{F}_{p^{m}}$.

• •

Conversely, if $\phi:\mathbb{F}_{p^{l}}\hookrightarrow\mathbb{F}_{p^{m}}$ is an embedding of finite fields, then $\Phi=\phi\otimes{\iota_{{l},{m}}}$ is a Kummer embedding.

Moreover, this correspondence commutes with composition of embeddings.

Proof.

Let $\Phi$ be a Kummer embedding. Being a $\mathbb{F}_{p}$-algebra morphism, it satisfies $\Phi(\beta^{p})=\Phi(\beta)^{p}$ for all $\beta\in A_{l}$. By Lemma 2, this means that $\Phi$ commutes with $\sigma\otimes\sigma$, and thus, also with $(\sigma\otimes 1)^{-1}\circ(\sigma\otimes\sigma)=1\otimes\sigma$. This implies that $\Phi$ maps $\mathbb{F}_{p^{l}}\otimes 1$ into $\mathbb{F}_{p^{m}}\otimes 1$. The other assertions are clear. ∎

Corollary 7.

Let $\alpha_{l}\in A_{l}$ be a nonzero solution of (H90) for $\zeta_{l}$, with Kummer constant $c_{l}$, and let $\hat{\alpha}\in A_{m}$ be a solution of (H90) for $(\zeta_{m})^{\frac{m}{l}}$ that satisfies $(\hat{\alpha})^{l}=1\otimes{\iota_{{l},{m}}}(c_{l})$. Then:

• •

$\hat{\alpha}\in\mathbb{F}_{p^{m}}\otimes\mathbb{F}_{p}((\zeta_{m})^{\frac{m}{l}})\;\subseteq\;A_{m}$;

• •

the assignation $\left\lfloor\alpha_{l}\right\rfloor_{\zeta_{l}}\mapsto\left\lfloor\hat{\alpha}\right\rfloor_{(\zeta_{m})^{\frac{m}{l}}}$ defines an embedding $\phi:\mathbb{F}_{p^{l}}\hookrightarrow\mathbb{F}_{p^{m}}$;

• •

$\Phi=\phi\otimes{\iota_{{l},{m}}}$* is the unique Kummer embedding such that $\Phi(\alpha_{l})=\hat{\alpha}$.*

Proof.

By Proposition 5 there is a unique Kummer embedding $\Phi$ such that $\Phi(\alpha_{l})=\hat{\alpha}$. By Proposition 6 we have that $\Phi=\phi\otimes{\iota_{{l},{m}}}$ for some $\phi:\mathbb{F}_{p^{l}}\hookrightarrow\mathbb{F}_{p^{m}}$. Writing $\alpha_{l}=\sum_{i=0}^{a-1}x_{i}\otimes\zeta_{l}^{i}$, it follows that

[TABLE]

Thus $\left\lfloor\hat{\alpha}\right\rfloor_{(\zeta_{m})^{\frac{m}{l}}}=\phi(x_{0})=\phi(\left\lfloor\alpha_{l}\right\rfloor_{\zeta_{l}})$, and, since $\left\lfloor\alpha_{l}\right\rfloor_{\zeta_{l}}$ generates $\mathbb{F}_{p^{l}}$, this uniquely characterizes $\phi$. ∎

We can now state Allombert’s algorithm and prove its correctness; we give below a minor variation on the original algorithm, better adapted to our more general setting.

Proposition 8.

Algorithm 1 is correct: it returns elements that define an embedding $\phi:\mathbb{F}_{p^{l}}\hookrightarrow\mathbb{F}_{p^{m}}$.

Proof.

By Propositions 5 and 6, there exists $\hat{\alpha}\in A_{m}$ solution of (H90) for $(\zeta_{m})^{\frac{m}{l}}$ that satisfies $(\hat{\alpha})^{l}=1\otimes{\iota_{{l},{m}}}(c_{l})$. On the other hand, $(\alpha_{m})^{\frac{m}{l}}\in A_{m}$ is also a solution of (H90) for $(\zeta_{m})^{\frac{m}{l}}$, thus $\hat{\alpha}=(1\otimes\lambda)(\alpha_{m})^{\frac{m}{l}}$ for some $\lambda\in\mathbb{F}_{p}(\zeta_{m})$. It follows that ${\iota_{{l},{m}}}(c_{l})/c_{m}=\lambda^{l}$ is a $l$-th power, and $\kappa=(\zeta_{m})^{\frac{um}{l}}\lambda$ for some integer $u$. Now we can replace $\hat{\alpha}$ with $(1\otimes(\zeta_{m})^{\frac{um}{l}})(\hat{\alpha})=(1\otimes\kappa)(\alpha_{m})^{\frac{m}{l}}$ and conclude with Corollary 7. ∎

From this proof and Proposition 3, it follows that another choice of the $l$-th root $\kappa$ only changes $\phi$ by a power of $\sigma$.

4. Standard solutions of (H90)

Plugging Algorithm 1 into the Bosma–Cannon–Steel framework immediately gives a way to compatibly embed arbitrary finite fields. However, there are two points in Allombert’s algorithm on which we would like to improve:

**Uniqueness:****: **

As mentioned, the element $\left\lfloor\alpha_{l}\right\rfloor_{\zeta_{l}}$ is a generating element for $\mathbb{F}_{p^{l}}$, or equivalently, it provides a defining irreducible polynomial of degree $l$. However this polynomial depends on the choice of $\alpha_{l}$ (even though only through $c_{l}$, cf. Proposition 3).

**Compatibility:****: **

The embedding $\phi$ depends on a constant $\kappa$, which itself depends on the choice of $\alpha_{l},\alpha_{m}$ (and of a $l$-th root extraction). Thus, given a certain number of finite fields, in order to ensure compatibility of the various embeddings between them, one has to keep track of these constants $\kappa$ for all pairs $(l,m)$, which grow quadratically with the number of fields.

It would be useful if one could force $\kappa=1$, that is, if $\alpha_{l},\alpha_{m}$ and $\Phi:A_{l}\hookrightarrow A_{m}$ could be chosen so that $\Phi(\alpha_{l})=(\alpha_{m})^{\frac{m}{l}}$. From the description of Algorithm 1, this requires $c_{m}={\iota_{{l},{m}}}(c_{l})$. Thus, necessarily $c_{m}$ lies in the subfield $\mathbb{F}_{p}((\zeta_{m})^{\frac{m}{l}})$ of $\mathbb{F}_{p}(\zeta_{m})$. Possibly this condition could fail if $A_{l}$ and $A_{m}$ do not have the same field of scalars. This motivates:

Definition 1.

A Kummer algebra is complete if it is of the largest degree for a given level.

Thus, the complete Kummer algebra of level $a$ is

[TABLE]

with field of scalars $\mathbb{F}_{p^{a}}=\mathbb{F}_{p}(\zeta_{p^{a}-1})$ given by the corresponding $\zeta_{p^{a}-1}$ in our cyclotomic lattice $\mathcal{S}^{I}$, e.g., defined by a (pseudo)-Conway polynomial of degree $a$.

Lemma 2.

All nonzero solutions $\alpha_{p^{a}-1}\in A_{p^{a}-1}$ of (H90) for $\zeta_{p^{a}-1}$ have the same Kummer constant $c_{p^{a}-1}=(\zeta_{p^{a}-1})^{a}$.

Proof.

From Lemma 2 and the fact that $\sigma^{a}$ is trivial on $\mathbb{F}_{p^{a}}\simeq\mathbb{F}_{p}(\zeta_{p^{a}-1})$ we get that

[TABLE]

We conclude since $\alpha_{p^{a}-1}$ is invertible. ∎

Definition 3.

Let $l$ be an integer prime to $p$. We define the standard Kummer constant of order $l$ as

[TABLE]

where $a=\nu(l)$ is the level of $A_{l}$.

We say a solution $\alpha_{l}\in A_{l}$ of (H90) for $\zeta_{l}$ is standard if its Kummer constant is standard:

[TABLE]

Then, by a decorated Kummer algebra we mean a pair

[TABLE]

with such $\alpha_{l}$ standard.

Observe that ${\iota_{{l},{p^{a}-1}}}$ is an isomorphism when $a=\nu(l)$, so $c^{\mathrm{std}}_{l}$ is well defined.

For complete algebras, Lemma 2 asserts that all nonzero $\alpha_{p^{a}-1}$ are standard.

Proposition 4.

Let $l$ be an integer not divisible by $p$. Then $A_{l}$ can be decorated, i.e., it admits a standard $\alpha_{l}$. Moreover, this $\alpha_{l}$ is unique up to a $l$-th root of unity.

Proof.

Let $\alpha^{\prime}_{l}$ be any nonzero solution of (H90) for $\zeta_{l}$. Set $a=\nu(l)$, pick any $\alpha_{p^{a}-1}\in A_{p^{a}-1}$ standard (Lemma 2), and pick any Kummer embedding $\Phi:A_{l}\hookrightarrow A_{p^{a}-1}$ (Proposition 6). Then $\Phi(\alpha^{\prime}_{l})$ and $(\alpha_{p^{a}-1})^{\frac{p^{a}-1}{l}}$ are two nonzero solutions of (H90) for ${\iota_{{l},{p^{a}-1}}}(\zeta_{l})=(\zeta_{p^{a}-1})^{\frac{p^{a}-1}{l}}$ in $A_{p^{a}-1}$, thus there is a scalar $\lambda\in\mathbb{F}_{p}(\zeta_{p^{a}-1})$ such that

[TABLE]

where $\tilde{\lambda}=({\iota_{{l},{p^{a}-1}}})^{-1}(\lambda)\in\mathbb{F}_{p}(\zeta_{l})$.

Setting $\alpha_{l}=(1\otimes\eta\tilde{\lambda})\alpha^{\prime}_{l}\in A_{l}$ for $\eta\in\mathbb{F}_{p}(\zeta_{l})$, we get $c_{l}=\eta^{l}({\iota_{{l},{p^{a}-1}}})^{-1}(c^{\mathrm{std}}_{p^{a}-1})=\eta^{l}c^{\mathrm{std}}_{l}$, and thus the standard $\alpha_{l}\in A_{l}$ are the $(1\otimes\zeta_{l}^{u}\tilde{\lambda})\alpha^{\prime}_{l}$, for $0\leq u<l$. ∎

Definition 5.

A generating element $s\in\mathbb{F}_{p^{l}}$ is called standard if it is of the form $s=\left\lfloor\alpha_{l}\right\rfloor_{\zeta_{l}}$ for $\alpha_{l}\in A_{l}$ a standard solution of (H90).

The standard defining polynomial $P_{l}$ for $\mathbb{F}_{p^{l}}$ is then the minimal polynomial over $\mathbb{F}_{p}$ of such a standard $s$.

By Proposition 3, we note that $P_{l}$ is entirely determined by $c^{\mathrm{std}}_{l}$, and thus, by the given cyclotomic lattice $\mathcal{S}^{I}$, possibly up to order $p^{\nu(l)}-1$. As an example, we give in Table 1 the first ten standard polynomials induced by the system of Conway polynomials for $p=2$ (thus, in this example, $P_{l}$ only depends on the Conway polynomial of degree $\nu(l)$).

We remark that it is easy to extend the definitions of decorated algebras and standard elements to any extension degree, similarly to the way this is done for the basic Lenstra–Allombert algorithm. Use any (standard) construction for Artin-Schreier towers over finite fields (e.g., (De Feo and Schost, 2012)), define decorated algebras by tensoring together Kummer algebras and Artin-Schreier extensions of $\mathbb{F}_{p}$, and define standard elements as, e.g., the product of a solution of multiplicative H90 and one of additive H90. While this solution is simple and effective, it is rather orthogonal to our work, hence we omit the details here.

The decoration of an algebra $A_{l}$, and the associated standard generating element and polynomial for $\mathbb{F}_{p^{l}}$, can be computed by the simple adaptation of Allombert’s algorithm presented below.

Algorithm 2 is correct, indeed Proposition 4 ensures that a standard $\alpha_{l}$ exists, and thus $\alpha^{\prime}_{l}=(1\otimes\kappa^{-1})\alpha_{l}$ for some $\kappa\in\mathbb{F}_{p}(\zeta_{l})$, so $c^{\mathrm{std}}_{l}/c^{\prime}_{l}=\kappa^{l}$ is a $l$-th power.

By design, decorated Kummer algebras of the same level admit standard Kummer embeddings, under which the corresponding standard solutions of (H90) are power-compatible:

Proposition 6.

Let $l\,|\,m$ be integers prime to $p$ and such that $\nu(l)=\nu(m)=a$. Let $(A_{l},\alpha_{l})$, $(A_{m},\alpha_{m})$ be decorated Kummer algebras of degree $l,m$ respectively (and of the same level $a$). Then, there is a unique Kummer embedding

[TABLE]

such that ${\Phi^{\mathrm{std}}_{{l},{m}}}(\alpha_{l})=(\alpha_{m})^{\frac{m}{l}}$.

Proof.

Proposition 5 with $\hat{\alpha}=(\alpha_{m})^{\frac{m}{l}}$. ∎

Most often we will apply Proposition 6 with $m=p^{a}-1$.

On the other hand, since power-compatibility implies $c_{m}={\iota_{{l},{m}}}(c_{l})$, it cannot be satisfied for a Kummer embedding between decorated Kummer algebras of different levels. However, at least between complete decorated algebras, we can request some norm-compatibility instead.

Let $A_{m}$ be a Kummer algebra of level $b=\nu(m)$, so

[TABLE]

where the isomorphism is given by $1\otimes{\iota_{{m},{p^{b}-1}}}$. Then, for an integer $a\,|\,b$, the subalgebra of $A_{m}$ invariant under $1\otimes\sigma^{a}$ is identified by this isomorphism with

[TABLE]

where $(\zeta_{p^{b}-1})^{\frac{p^{b}-1}{p^{a}-1}}=\operatorname{N}_{\mathbb{F}_{p^{b}}/\mathbb{F}_{p^{a}}}(\zeta_{p^{b}-1})={\iota_{{p^{a}-1},{p^{b}-1}}}(\zeta_{p^{a}-1})$, and with $\operatorname{N}_{\mathbb{F}_{p^{b}}/\mathbb{F}_{p^{a}}}$ the norm of the field extension $\mathbb{F}_{p^{b}}/\mathbb{F}_{p^{a}}$.

Definition 7.

Given a Kummer algebra $A_{n}$, and some integers $a\,|\,b\,|\,\nu(n)$, we define the scalar norm operator

[TABLE]

This is well-defined, i.e., the image of $\mathcal{N}_{b/a,A_{n}}$ is invariant under $1\otimes\sigma^{a}$ as specified. Often the ambient algebra $A_{n}$ will be implicit, and we will write $\mathcal{N}_{b/a}$ instead of $\mathcal{N}_{b/a,A_{n}}$.

By construction, $\mathcal{N}_{b/a}$ acts on $1\otimes\mathbb{F}_{p^{b}}^{\times}$ as $1\otimes\operatorname{N}_{\mathbb{F}_{p^{b}}/\mathbb{F}_{p^{a}}}$. Scalar norms are multiplicative:

[TABLE]

transitive:

[TABLE]

and they commute with $\sigma\otimes 1$.

Proposition 8.

Let $a\,|\,b$ be integers, and let $(A_{p^{a}-1},\alpha_{p^{a}-1})$, $(A_{p^{b}-1},\alpha_{p^{b}-1})$ be decorated complete Kummer algebras of level $a,b$ respectively. Then there is a unique Kummer embedding

[TABLE]

such that ${\Phi^{\mathrm{std}}_{{p^{a}-1},{p^{b}-1}}}(\alpha_{p^{a}-1})=\mathcal{N}_{b/a}(\alpha_{p^{b}-1})$.

Proof.

By Lemma 2 and the properties of the norm,

[TABLE]

So $\hat{\alpha}=\mathcal{N}_{b/a}(\alpha_{p^{b}-1})$ satisfies $(\hat{\alpha})^{p^{a}-1}=1\otimes{\iota_{{p^{a}-1},{p^{b}-1}}}(c_{p^{a}-1})$ and we conclude with Proposition 5. ∎

5. Standard embeddings

In Proposition 6, we saw how to construct a standard power-compatible embedding of a decorated Kummer algebra into its decorated complete algebra, and in Proposition 8, a standard norm-compatible embedding between decorated complete algebras of dividing levels.

Now, consider general $l\,|\,m$ not divisible by $p$, set $a=\nu(l)$, $b=\nu(m)$, and consider the diagram

[TABLE]

of standard embeddings of decorated algebras.

Lemma 1.

In this setting, there exists a unique Kummer embedding

[TABLE]

that makes the diagram commute.

Proof.

Consider $\hat{\hat{\alpha}}={\Phi^{\mathrm{std}}_{{p^{a}-1},{p^{b}-1}}}({\Phi^{\mathrm{std}}_{{l},{p^{a}-1}}}(\alpha_{l}))\in A_{p^{b}-1}$. Then $\hat{\hat{\alpha}}$ is invariant under $\sigma^{l}\otimes 1$ and under $1\otimes\sigma^{a}$ (because $\alpha_{l}$ is), thus, a fortiori, invariant under $\sigma^{m}\otimes 1$ and under $1\otimes\sigma^{b}$, which means it lies in the image of ${\Phi^{\mathrm{std}}_{{m},{p^{b}-1}}}$. We can then set $\hat{\alpha}=({\Phi^{\mathrm{std}}_{{m},{p^{b}-1}}})^{-1}(\hat{\hat{\alpha}})$. If ${\Phi^{\mathrm{std}}_{{l},{m}}}$ exists, then it necessarily maps $\alpha_{l}$ to $\hat{\alpha}$. However, chasing in the diagram, it is easily seen that $\hat{\alpha}$ is a solution of (H90) for $(\zeta_{m})^{\frac{m}{l}}$ that satisfies $(\hat{\alpha})^{l}=1\otimes{\iota_{{l},{m}}}(c_{l})$, and we conclude with Proposition 5. ∎

This existence result is “constructive”, but impractical, since it requires computations in the possibly very large algebra $A_{p^{b}-1}$. However, as in Algorithm 1, one should be able to write $\hat{\alpha}=(1\otimes\kappa)(\alpha_{m})^{\frac{m}{l}}$ for some $\kappa\in\mathbb{F}_{p}(\zeta_{m})$. Moreover $\hat{\alpha}$ is uniquely determined by our data, thus, so should $\kappa$. Now our aim is to give an explicit expression for this $\kappa=\kappa_{l,m}$. We start with the case of complete algebras.

Proposition 2.

In the complete algebra $A_{p^{b}-1}$ we have

[TABLE]

Proof.

Using first Lemma 2, and then (H90), we get:

[TABLE]

We conclude thanks to the identity

[TABLE]

∎

Corollary 3.

Let $(A_{l},\alpha_{l})$ and $(A_{m},\alpha_{m})$ be decorated Kummer algebras, of respective degrees $l\,|\,m$ prime to $p$. Then the standard Kummer embedding ${\Phi^{\mathrm{std}}_{{l},{m}}}:A_{l}\hookrightarrow A_{m}$ is defined by the assignation $\alpha_{l}\;\mapsto\;(1\otimes\kappa_{l,m})(\alpha_{m})^{\frac{m}{l}}$, where

[TABLE]

Proof.

It suffices to check that ${\Phi^{\mathrm{std}}_{{p^{a}-1},{p^{b}-1}}}({\Phi^{\mathrm{std}}_{{l},{p^{a}-1}}}(\alpha_{l}))$ and the image of the right-hand-side under ${\Phi^{\mathrm{std}}_{{m},{p^{b}-1}}}$ coincide in $A_{p^{b}-1}$. However, we have ${\Phi^{\mathrm{std}}_{{p^{a}-1},{p^{b}-1}}}({\Phi^{\mathrm{std}}_{{l},{p^{a}-1}}}(\alpha_{l}))=\mathcal{N}_{b/a}(\alpha_{p^{b}-1})^{\frac{p^{a}-1}{l}}$, while ${\Phi^{\mathrm{std}}_{{m},{p^{b}-1}}}((\alpha_{m})^{\frac{m}{l}})=(\alpha_{p^{b}-1})^{\frac{p^{b}-1}{l}}$, and we conclude with Proposition 2 ∎

Proposition 4.

Standard Kummer embeddings are compatible with composition: if $(A_{l},\alpha_{l})$, $(A_{m},\alpha_{m})$, and $(A_{n},\alpha_{n})$ are decorated Kummer algebras with $l\,|\,m\,|\,n$, the corresponding standard embeddings satisfy ${\Phi^{\mathrm{std}}_{{l},{n}}}={\Phi^{\mathrm{std}}_{{m},{n}}}\circ{\Phi^{\mathrm{std}}_{{l},{m}}}$.

Proof.

We have to show that ${\Phi^{\mathrm{std}}_{{l},{n}}}(\alpha_{l})={\Phi^{\mathrm{std}}_{{m},{n}}}({\Phi^{\mathrm{std}}_{{l},{m}}}(\alpha_{l}))$; nothing but a pleasant computation with the explicit constants given by Corollary 3.

Alternatively, set $a=\nu(l),b=\nu(m),c=\nu(n)$, and decorate $A_{p^{a}-1},A_{p^{b}-1},A_{p^{c}-1}$. It suffices to show that the elements ${\Phi^{\mathrm{std}}_{{l},{n}}}(\alpha_{l})$ and ${\Phi^{\mathrm{std}}_{{m},{n}}}({\Phi^{\mathrm{std}}_{{l},{m}}}(\alpha_{l}))$ have the same image under ${\Phi^{\mathrm{std}}_{{n},{p^{c}-1}}}$ in $A_{p^{c}-1}$. Chasing in the diagram

[TABLE]

we see that this common image is $\mathcal{N}_{c/a}(\alpha_{p^{c}-1})^{\frac{p^{a}-1}{l}}$. ∎

By a decorated finite field (of degree $l$, an integer prime to $p$, and relative to a given cyclotomic lattice $\mathcal{S}^{I}$), we mean a pair $(\mathbb{F}_{p^{l}},s_{l})$, where $\mathbb{F}_{p^{l}}$ is a finite field, and $s_{l}\in\mathbb{F}_{p^{l}}$ a standard generating element in the sense of Definition 5.

We can finally state:

Proposition 5.

Standard finite field embeddings are compatible with composition: if $(\mathbb{F}_{p^{l}},\alpha_{l})$, $(\mathbb{F}_{p^{m}},\alpha_{m})$, and $(\mathbb{F}_{p^{n}},\alpha_{n})$ are decorated finite fields with $l\,|\,m\,|\,n$, the corresponding standard embeddings satisfy ${\phi^{\mathrm{std}}_{{l},{n}}}={\phi^{\mathrm{std}}_{{m},{n}}}\circ{\phi^{\mathrm{std}}_{{l},{m}}}$.

Proof.

Corollary 7 and Proposition 4. ∎

6. Implementation

In the previous sections we kept the description of Kummer embeddings abstract, leaving many computational details unspecified. There are various ways in which our algorithms can possibly be implemented, depending on how one chooses to represent finite fields and the cyclotomic lattice $\mathcal{S}^{I}$. A reasonable option is to use (pseudo)-Conway polynomials to represent the fields $\mathbb{F}_{p}(\zeta_{p^{a}-1})$, and deduce from them the smallest possible representation for any other field $\mathbb{F}_{p}(\zeta_{l})$. Assuming this technique, we can prove a bound on the complexity of our algorithms.

Proposition 1.

Given a collection of (pseudo)-Conway polynomials for $\mathbb{F}_{p}$, of degree up to $d$, standard solutions $\alpha_{l}$ of (H90) can be computed for any $l\,|\,(p^{i}-1)$ for any $i\leq d$ using O\bigr{(}\mathsf{M}(l^{2})\log(l)+\mathsf{M}(l)\log(l)\log(p)\bigl{)} operations. After that, Kummer embeddings $\mathbb{F}_{p^{l}}\subseteq\mathbb{F}_{p^{m}}$ can be computed using $O(\mathsf{M}(m^{2})\log(m))$ operations.

Proof.

Let $a=\nu(l)$ be the level of $A_{l}$. We take the $a$-th polynomial from the collection of (pseudo)-Conway polynomials, and use it to define $\zeta_{p^{a}-1}$. Because $a\in O(l)$, the cost of multiplications in $\mathbb{F}_{p}(\zeta_{p^{a}-1})$ will be bounded by $O(\mathsf{M}(l))$.

From $\zeta_{p^{a}-1}$, we compute $\zeta_{l}$ using $O(l\mathsf{M}(l))$ operations, and its minimal polynomial in $O(l^{(\omega+1)/2})$. Then, the Kummer constant $c^{\mathrm{std}}_{l}=(\zeta_{p^{a}-1})^{a}$ is computed in negligible time, and its expression in the power basis of $\zeta_{l}$ is computed in $O(l^{(\omega+1)/2})$ using the algorithms for evaluating embeddings mentioned in Section 2.

To construct the Kummer algebra $A_{l}=\mathbb{F}_{p^{l}}\otimes\mathbb{F}_{p}(\zeta_{l})$ we need an irreducible polynomial of degree $l$, not necessarily related to the (pseudo)-Conway polynomials used to represent the fields of scalars. Very efficient, quasi-optimal algorithms for finding such a polynomial are given in (Bostan et al., 2006; Couveignes and Lercier, 2013; De Feo et al., 2013), we can thus neglect this cost.

The cost of computing a solution $\alpha^{\prime}_{l}$ to (H90) was extensively studied in (Brieulle et al., 2019), where it was found to be bounded by O\bigr{(}\mathsf{M}(l^{2})\log(l)+\mathsf{M}(l)\log(p)\bigl{)}. Then, the constant $c^{\prime}_{l}=(\alpha^{\prime}_{l})^{l}$ is computed using $O\left(\mathsf{M}(l^{2})\log(l)\right)$ operations, and the $l$-th root $\kappa$ is computed in $O(\mathsf{M}(l)\log(l)\log(p))$ according to (Brieulle et al., 2019). $\alpha_{l}=(1\otimes\kappa)\alpha^{\prime}_{l}$ is then computed in a negligible number of operations.

Finally, the projection $\left\lfloor\alpha_{l}\right\rfloor_{\zeta_{l}}$ comes for free, and its minimal polynomial $P_{l}$ is computed again in $O(l^{(\omega+1)/2})$ operations.

Now, in order to compute a Kummer embedding of $(\mathbb{F}_{p^{l}},\alpha_{l})$ into $(\mathbb{F}_{p^{m}},\alpha_{m})$, we compute the scalar $\kappa_{l,m}$ in $O(m\mathsf{M}(m))$ operations, and $(\alpha_{m})^{\frac{m}{l}}$ in $O(\mathsf{M}(m^{2})\log(m))$.

We then need to convert $(\alpha_{m})^{\frac{m}{l}}$ in the power basis of $\zeta_{l}$. Applying a generic change of basis algorithm as before would be too expensive: indeed we have to convert $m$ coefficients from the field of scalars $\mathbb{F}_{p}(\zeta_{m})$ to $\mathbb{F}_{p}(\zeta_{l})$, which would cost $O(m^{(\omega+3)/2})$. Instead we notice that we are only interested in the value $\left\lfloor(1\otimes\kappa)(\alpha_{m})^{\frac{m}{l}}\right\rfloor_{\zeta_{l}}$, therefore we proceed as follows.

Let $\mathrm{Tr}$ denote the trace map from $\mathbb{F}_{p}(\zeta_{m})$ to $\mathbb{F}_{p}(\zeta_{l})$, and let $\eta\in\mathbb{F}_{p}(\zeta_{m})$ be such that $\mathrm{Tr}(\eta)=1$. Then the map $x\mapsto\mathrm{Tr}(x\eta)$ sends $(\zeta_{m})^{\frac{m}{l}}$ to $\zeta_{l}$, and is $\mathbb{F}_{p}(\zeta_{l})$-linear, it thus agrees with the inverse map of $\zeta_{l}\mapsto(\zeta_{m})^{\frac{m}{l}}$ on the image of $\mathbb{F}_{p}(\zeta_{l})$.

We thus need to evaluate $x\mapsto\left\lfloor\mathrm{Tr}(x\eta)\right\rfloor_{\zeta_{l}}$ for many values in $\mathbb{F}_{p}(\zeta_{m})$, but this is a $\mathbb{F}_{p}$-linear form, hence we can precompute its vector on the power basis of $\zeta_{m}$. Let $h_{m},h_{l}$ be the minimal polynomials of $\zeta_{m},\zeta_{l}$, and let $b,a$ be their degrees. Let $h_{0}$ be the constant coefficient of $h_{l}$, and let

[TABLE]

direct calculation shows that

[TABLE]

where by $\tau(Z)$ we mean $\tau\in\mathbb{F}_{p}(\zeta_{m})$ seen as a polynomial in $\zeta_{m}$. Hence, we can compute the vector of the linear form $x\mapsto\left\lfloor\mathrm{Tr}(x)\right\rfloor_{\zeta_{l}}$ using only basic polynomial arithmetic and modular composition, i.e., in $O(m^{(\omega+1)/2})$ operations.

Finally, we compute $(1\otimes\kappa\eta)(\alpha_{m})^{\frac{m}{l}}$, we see it as a polynomial with coefficients in $\mathbb{F}_{p}(\zeta_{m})$, and we apply the map $\left\lfloor\mathrm{Tr}(x)\right\rfloor_{\zeta_{l}}$ to each coefficient. This costs $O(m\mathsf{M}(m))$ operations. ∎

We remark that storing the decorated fields $(\mathbb{F}_{p^{l}},\alpha_{l})$ requires $O(l^{2})$ field elements, however, using the formulas in (Allombert, 2002; Brieulle et al., 2019), it is possible to only store $\left\lfloor\alpha_{l}\right\rfloor_{\zeta_{l}}$, and recover all other coefficients of $\alpha_{l}$ in $O(l\mathsf{M}(l)\log(p))$ operations.

To demonstrate the feasibility of this approach, we implemented it in the Julia-based CAS Nemo (Fieker et al., 2017), with performance critical routines written in C/Flint (Hart et al., 2013). Our code is available as a Julia package at https://github.com/erou/LatticeGFH90.jl.

We tested Algorithms 2 and 3 for various small primes, using precomputed Conway polynomials available in Nemo. We do not see major differences between different primes. In Figure 1 we report timings obtained for the case $p=3$, on an Intel Core i7-7500U CPU clocked at 2.70GHz, using Nemo 0.11.1 running on Julia 1.1.0, and Nemo’s current version of Flint. The plot on the left shows timings for Algorithm 2, for degrees $l$ growing from $1$ to $200$, for every $l$ coprime to $p$ and such that the $\nu(l)$-th Conway polynomial is available in Nemo; the color scale shows the level of the associated algebra $A_{l}$. The bottleneck of this algorithm appears to be the $l$-th root extraction routine.

The plot on the right shows timings for Algorithm 3, measured by computing the standard embedding of $\mathbb{F}_{p^{2}}$ in $\mathbb{F}_{p^{l}}$. As expected, computing the embeddings takes negligible time in comparison to the decoration of the finite fields. We also tested embedding fields larger than $\mathbb{F}_{p^{2}}$, and noticed that the running time mostly depends on the size of the larger field.

7. Conclusion and future work

We presented a new family of standard compatible polynomials for defining finite fields. Its construction being dependent on the availability of Conway polynomials, it has, at the present moment, very little practical impact; its existence is nevertheless remarkable in itself.

It is even evident that computing our standard polynomials is essentially equivalent to computing Conway polynomials; indeed from $\alpha_{l}$ one can immediately deduce $(\zeta_{p^{a}-1})^{a}$, and by taking an $a$-th root (doable in polynomial time in $l$), deduce $\zeta_{p^{a}-1}$ and the associated Conway polynomial. Hence, an efficient algorithm for computing our polynomials (for arbitrary degrees) would imply an efficient algorithm to compute Conway polynomials, which would be unexpected.

However, our proposed implementation is not the only possible way to exploit our definitions. It would be interesting, indeed, to find some middle ground between the flexibility of the Bosma–Steel–Cannon framework and the rigidity of Conway polynomials, for example by lazily enforcing the conditions required to have a standard solution of (H90), while incrementally constructing the lattice of roots of unity.

Another line of work would be to give a complete implementation of a lattice of finite fields, not limited to extensions of degree coprime to $p$. We leave these questions for future work.

Acknowledgements.

We would like to thank the anonymous reviewers for their useful comments. We thank Éric Schost for fruitful discussions and for helping bootstrap this work during a visit by two of the authors to the University of Waterloo. We acknowledge financial support from the French ANR-15-CE39-0013 project Manta, the OpenDreamKit Horizon 2020 European Research Infrastructures project (#676541), and from the French Domaine d’Intérêt Majeur Math’Innov.