The next application deals with finding generators for extensions of finite fields with special properties. LetE⊆F, of degreee, be such an extension; it is easy to construct a generatorb ofFoverEsuch that, for example, thetrace ofb in the extensionF/E
is equal to some given element a ∈ E(except that when the characteristic and the extension degree are both 2, a generator cannot have trace 0). This says, in fact,
7.3. Field generators of prescribed norm 69
that we can usually prescribe the coefficient of Xe−1 in the minimal polynomial of a generator b. Also, as will be shown in the present section, it is possible to require the norm of a generating element to take any nonzero value; this corresponds to prescribing the constant term of the minimal polynomial.
The question of whether it is possible to prescribe an arbitrary coefficient is known as theHansen-Mullen conjecture [27, 54]. Another version of this conjecture restricts attention to primitive elements, i.e., field generators for F/Ethat also generate the multiplicative groupF∗. For a recent overview of this problem, we refer to [17].
The Hansen-Mullen conjecture has been settled, except possibly for finitely many combinations ofEande, and even some extensions have been proved, like cases where it is possible to prescribemore than one coefficients in the minimal polynomial of a primitive element. The methods of proof, however, are mostly non-constructive, and it is hence still interesting to construct algorithms that determine field generators with desirable properties.
Unfortunately, up to now no efficient method is known for computing primitive elements, let alone to prescribe coefficients of their minimal polynomials. In fact, it is not known if we can test an element for being primitive efficiently, as all known algorithms for this require the factorisation of the order of the multiplicative group
F∗.
However, it is possible to give algorithms that construct field generators with prescribed norm, for example. This is easily done probabilistically, if the field is not too small; but the following theorem gives a deterministic algorithm for this problem, which works over finite fields of any size. For the proof, we use several of the algorithms that have been developed in this thesis.
Theorem 7.1 There exists an efficient deterministic algorithm that, given an exten- sion of finite fieldsE⊆F and an element a∈E∗, computesb∈F such that
(i) b generates FoverE;
(ii) NormF/E(b) =a.
Another way to put this result is the following.
Corollary 7.2 There exists an efficient deterministic algorithm that, given a finite fieldE, an irreducible polynomialf of degreeewith coefficients inE, and an element
a ∈ E∗, computes a monic irreducible polynomial of degree e with coefficients in E
whose constant coefficient is equal toa.
Proof. Applying the algorithm from the Theorem toF=E[X]/(f), computeb∈F
such that Normb = (−1)e−1a. Then the minimal polynomial of b over E has the
required properties.
The proof of Theorem 7.1 is done in three steps, given by the following three Propositions. The first shows how to compute a field generator of norm 1.
Proposition 7.3 There exists an efficient deterministic algorithm that, given an ex- tension of finite fields E⊆F of degree e, computes a generator c for F overE such that NormF/E(c) = 1.
Proof. We consider the subfield K consisting of all sums of eth powers in F. By Proposition 2.2, we have K =Fwhenever e2 <|F|. But ife2 ≥ |F|, then it follows thatE=F2 ande= 2,3,4, and in these caseseis relatively prime to|F| −1, so that every element ofFis aneth power, and againK=F.
Use Algorithm 4.14 to compute a generator αe for K = F over E. Then the
element
c= α
e
Normα
still generatesFoverE, whereas clearly its norm is 1. Next, we compute an elementbinF(not necessarily a generator) of norma, with the additional property that ordbcontains only primes that already divide orda.
Proposition 7.4 There exists an efficient deterministic algorithm that, given an ex- tension of finite fieldsE⊆Fof degreee, and an elementa∈E, computes b∈Fsuch that NormF/Eb=aand such thatordbhas the same prime factors as orda.
The proof of this Proposition will use four Lemmata.
Lemma 7.5 Let E⊆Fbe an extension of finite fields of prime degreeℓ. Letabe an element ofE. Ifb∈Fis such that bℓ=a, then
NormF/E(b) =
(
a if b∈E, and
(−1)ℓ−1a otherwise.
Proof. If b ∈ E, then Normb = bℓ = a. Otherwise, b generates F over E, so its
minimal polynomial isXℓ
−a, and its norm is (−1)ℓ−1a.
Lemma 7.6 There exists an efficient deterministic algorithm that, given an exten- sion of finite fieldsE⊆F of prime degreeℓ, and an elementa∈E∗, computesb∈F∗
such that bℓ=a, and such thatordb has the same prime factors asorda.
Proof. There are three cases. Note that we do not assume thatℓis odd.
Ifℓdoes not divide|E| −1, we simply writeaas theℓth power of some elementb using Algorithm 2.1. The orders ofbandaare equal.
Ifℓdivides|E| −1 but not ord(a), then the first case of Proposition 3.6 shows that anℓth rootb ofaexists such thatvℓ(ordb) = 0. It follows that calling Algorithm 3.7
with finite fieldE, primeℓ, exponentf = 1, and generatorg= 1 will return such an ℓth rootb, and that the orders ofband awill be equal.
7.3. Field generators of prescribed norm 71
Finally, if ℓdivides ord(a), we have to do some work. Note that by our assump- tions, we know thatℓdivides|E| −1 and is different from charE. First, using Lemma 5.25 withn= 1, we know that there exists anℓth root of unity inE, and we construct such an element. Then, we use Lagrange resolvents to writeF as a radical extension of E, following the proofs of Theorems VI.6.1 and VI.6.2(ii) of [33]. The Lagrange resolvent is a nonzero E-linear map φonF, such that wheneverφ(x)6= 0 forx∈F, then φ(x) is such thatφ(x)ℓ
∈E whileφ(x)∈/ E. Thus, we must find an element x outside the kernel ofφ; butφ, being linear, must take a nonzero value on at least one element of any basis for F over E, and this shows that we can construct such anx efficiently and deterministically.
Assume now, as we may, that F is given as a radical extension ofE; that is, we are given an elementc ∈F such thatcℓ ∈E whilec /∈E. Becausecℓ is not anℓth power in E, we see that ord(c) has more factors ℓ than the order of any element in
E. Thus, we can use c as a generator in Algorithm 3.7 to compute an ℓth root in
F of any element inE, and in particular an ℓth root b ofa. Finally, it is clear that ord(b)/ord(a) =ℓ, so that ord(b) and ord(a) have the same prime factors.
Lemma 7.7 The task of taking square roots in finite fields is efficiently and deter- ministically reducible to the task of taking square roots in finite prime fields.
Proof. LetFbe a finite field of characteristicp, and leta∈Fbe a square. Clearly NormF/Fp(a) is a square inFp; therefore,
Norm(a(p−1)/2) = (Norma)(p−1)/2= 1.
DefineA=a(p−1)/2; by Hilbert’s Theorem 90 [33, Theorem VI.6.1], there existsc
∈F
such that cp−1=A. To find such a c, we solve the equationcp=Ac; the operators
c 7→ cp and c
7→ Ac are both Fp-linear, so c can be found by taking any nonzero
solution of a linear system of equations overFp. Alternatively, we can again use the
linear operator given in the proof of Theorem VI.6.1 in [33], taking care to select an element ofFwhere the operator takes a nonzero value.
Now the elementc2/aofFsatisfies
c2/a(p−1)/2= 1;
therefore, it is in the prime field, and it is even a square there. Now letdbe a square root ofc2/a, given to us by an oracle that computes square roots inF
p. Then clearly
c/dis a square root ofa, and we are done.
Remark. The same proof shows that, for any primeℓand any finite fieldF, taking ℓth roots inFis reducible to takingℓth roots in the smallest subfield ofFthat contains anℓth root of unity.
Lemma 7.8 There exists an efficient deterministic algorithm that, given an exten- sion of finite fieldsE⊆Fof prime degreeℓ, computesb∈Fsuch thatNormF/Eb=−1
Proof. If charE = 2, we take b = 1; if ℓ 6= 2, we take b = −1. Consider the remaining case, viz.,Fis quadratic overEand charEis odd.
This being so, we compute c ∈Fsuch thatc2
∈E, but c /∈E, as in the proof of Lemma 7.6, using the primitive 2nd root of unity−1. Alternatively, we can take for c the discriminant of the minimal polynomial of any generator for F over E. Then, again, we can usecas a generator in Algorithm 3.7 to compute a square root inFof any element inE, and, by Lemma 7.7, even of any square element inF.
Now the norm map projects the 2-Sylow subgroup ofF∗onto that ofE∗. Therefore,
if we start with−1∈Eand repeatedly take a square root, we will find an elementb of norm−1, such that ord(b) is a power of 2, as desired.
Proof of Proposition 7.4. We use induction on the prime divisors ofe, taken with multiplicities. Ife= 1, we takeb=a.
Assume e >1, and letℓ be a prime divisor ofe. Let M be the unique degree ℓ extension ofE contained inF; a generator forM overEcan be computed efficiently and deterministically. We first prove the Proposition for the extensionM/E.
Using Lemmata 7.5 and 7.6, compute b′ ∈ M such that Norm
M/Eb′ = ±a and such that ord(b′) and ord(a) have the same prime factors. If Normb′ =a, we take
b=b′, and we are done. If not, we haveℓ= 2 and charE6= 2. Furthermore, we have
b /∈E, soais a nonsquare inE, and hence the order ofais even. Now using Lemma 7.8, computec∈M such that Normc=−1 and ord(c) is a power of 2. It follows that Norm(c b′) =a, and ord(c b′) has the same prime factors as ord(a). We take b=c b′,
and we are done.
Now by induction, we can compute some d∈F such that NormF/M(d) =b, and
ord(d) has the same prime factors as ord(b). Because NormF/E= NormM/E◦NormF/M,
we see thatdsatisfies the requirements of the Proposition.
Remark. The approach given above, proceeding by extensions of prime degree only, has been chosen for making the proofs simple. It is also possible to give a more direct approach, which will eliminate the need for computing a complete chain of subfields ofF, and will therefore be preferable in case of implementation. This remark pertains especially to Lemmata 7.5 and 7.6.
The third step of the computation is very simple.
Proposition 7.9 Let E ⊆ F be an extension of finite fields, and let a ∈ E∗. Fur-
thermore, letb∈Fbe such that NormF/Eb=aand such thatord(b)andord(a)have
the same prime factors. Finally, let c ∈ F be a generator for F over E such that
NormF/Ec= 1.
Then the element bchas norma and generatesF overE.
Proof. We obviously have Norm(bc) =a. We claim that, for any prime ℓdividing ord(c), we have vℓ(ord(bc))≥vℓ(ordc). Thus, c is contained in the subgroup of F∗