Fast Polynomial Factorization and Modular Composition

Abstract

We obtain randomized algorithms for factoring degree n univariate polynomials over F q requiring O(n 1.5+o(1) log 1+o(1) q + n 1+o(1) log 2+o(1) q) bit operations. When log q < n, this is asymptotically faster than the best previous algorithms (von zur Gathen & Shoup (1992) and Kaltofen & Shoup (1998)); for log q ≥ n, it matches the asymptotic running time of the best known algorithms.The improvements come from new algorithms for modular composition of degree n univariate polynomials, which is the asymptotic bottleneck in fast algorithms for factoring polynomials over finite fields. The best previous algorithms for modular composition use O(n (ω+1)/2 ) field operations, where ω is the exponent of matrix multiplication (Brent & Kung (1978)), with a slight improvement in the exponent achieved by employing fast rectangular matrix multiplication (Huang & Pan (1997)).We show that modular composition and multipoint evaluation of multivariate polynomials are essentially equivalent, in the sense that an algorithm for one achieving exponent α implies an algorithm for the other with exponent α + o(1), and vice versa. We then give two new algorithms that solve the problem near-optimally: an algebraic algorithm for fields of characteristic at most n o(1) , and a nonalgebraic algorithm that works in arbitrary characteristic. The latter algorithm works by lifting to characteristic 0, applying a small number of rounds of multimodular reduction, and finishing with a small number of multidimensional FFTs. The final evaluations are reconstructed using the Chinese Remainder Theorem. As a bonus, this algorithm produces a very efficient data structure supporting polynomial evaluation queries, which is of independent interest.Our algorithms use techniques that are commonly employed in practice, in contrast to all previous subquadratic algorithms for these problems, which relied on fast matrix multiplication. * The material in this paper appeared in conferences as [Uma08] and [KU08].

An energy complexity model for algorithms

“…Finally, we argue (17). The inequality follows from the fact that the only ways A ′ differs from A are (i) Computing the random map-one needs O(1) amount of work per entry in the random map (this includes the time taken to compute the random permutation-the Fischer-Yates shuffle can be implemented with O(1) work per element); (ii) the copying of elements from the run to another portion in the memory using the random map-this just needs O(1) work per elements in the run; (iii) while doing a memory access, one can has to compute its location from the random map, which again takes O(1) work per element.…”

“…(As before all this information is stored in a table.) To get a better work complexity, instead of using the naive polynomial evaluation algorithm, we use a recent efficient data structure for polynomial evaluation designed by Kedlaya and Umans [17].…”

“…It turns out we can do better. Kedlaya and Umans [17] recently presented a data structure that given the coefficients of R build a data structure in time (and hence space) O((P log q) 1+δ ) (for any constant δ) such that given this data structure, R(b) can be evaluated at any b in time poly log P (log q)…”

Efficient Delegated Private Set Intersection on Outsourced Private Datasets

“…Since 6. To find the roots of a polynomial over a finite field, we can first factorize it to get a set of monic polynomials (see [33] for some algorithms), then find the monic degree-1 polynomials' roots.…”

Fast arithmetic for the algebraic closure of finite fields

“…If S = Φ(x) and T = Φ(y) are known, a result by Kedlaya and Umans [26] for modular composition, and its extension in [32], yield an algorithm with bit complexity essentially linear in mn and log(p) on a RAM. Unfortunately, making these algorithms competitive in practice is challenging; we are not aware of any implementation of them.…”