- The document presents a probabilistic algorithm for computing the polynomial greatest common divisor (PGCD) with smaller factors.
- It summarizes previous work on the subresultant algorithm for computing PGCD and discusses its limitations, such as not always correctly determining the variant ฯ.
- The new algorithm aims to determine ฯ correctly in most cases when given two polynomials f(x) and g(x). It does so by adding a few steps instead of directly computing the polynomial t(x) in the relation s(x)f(x) + t(x)g(x) = r(x).
"Lesotho Leaps Forward: A Chronicle of Transformative Developments"
ย
A Probabilistic Algorithm for Computation of Polynomial Greatest Common with Smaller Factors
1. Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022
DOI : 10.5121/mathsj.2022.9301 1
A PROBABILISTIC ALGORITHM FOR
COMPUTATION OF POLYNOMIAL GREATEST
COMMON WITH SMALLER FACTORS
Yang Zhang1,2
, Xin Qian1, 2
, Qidi You1,2
, Xuan Zhou1,2
,
Xiyong Zhang1, 2
and Yang Wang1, 2
1
Space star technology co., LTD
2
State Key Laboratory of Space-Ground Integrated Information Technology
ABSTRACT
In the earlier work, Knuth present an algorithm to decrease the coefficient growth in the Euclidean
algorithm of polynomials called subresultant algorithm. However, the output polynomials may have a
small factor which can be removed. Then later, Brown of Bell Telephone Laboratories showed the
subresultant in another way by adding a variant called๐ and gave a way to compute the variant.
Nevertheless, the way failed to determine every๐ correctly.
In this paper, we will give a probabilistic algorithm to determine the variant ๐ correctly in most cases by
adding a few steps instead of computing ๐ก(๐ฅ) when given ๐(๐ฅ) and๐(๐ฅ) โ โค[๐ฅ], where ๐ก(๐ฅ) satisfies that
๐ (๐ฅ)๐(๐ฅ) + ๐ก(๐ฅ)๐(๐ฅ) = ๐(๐ฅ), here ๐ก(๐ฅ), ๐ (๐ฅ) โ โค[๐ฅ]
KEYWORDS
Euclidean Algorithm, Subresultant, Primitive Remainder Sequences,
1. INTRODUCTION
The Euclidean algorithm and the extended Euclidean algorithm of polynomials is an important
research object in polynomial computer algebra. Using this algorithm, one can get the g.c.d. of
two polynomials (denoted as gcd(๐, ๐) when given polynomials ๐(๐ฅ) and ๐(๐ฅ)) and decides
whether these polynomials are coprime or not. Specifically, if the degree of gcd(๐, ๐) is larger
than 0, ๐(๐ฅ) and ๐(๐ฅ) are not coprime, otherwise, ๐(๐ฅ) and ๐(๐ฅ) are coprime. Being coprime
between two polynomials means there exist common roots between these two polynomials.
To quantify the indicator whether there exists a common root between ๐(๐ฅ) and ๐(๐ฅ), Sylvester
gave a matrix in 1840 called Sylvester matrix with entries simply being the coefficients of ๐(๐ฅ)
and ๐(๐ฅ). The determinant of Sylvester matrix is called resultant. Whether the resultant of ๐(๐ฅ)
and ๐(๐ฅ) is nonzero corresponds to the case where ๐(๐ฅ) and ๐(๐ฅ) are coprime or not
respectively. Moreover, Sylvester generalized his definition and introduced the concept of
subresultant. They are nonzero if and only if the corresponding degree appears as a degree of a
remainder of the Euclidean algorithm.
However, the early Euclidean algorithm of polynomials works for polynomials in๐ฝ[๐ฅ], here ๐ฝ is
a field. In 1836 Jacobi introduced pseudo-division over polynomials and extended the Euclidean
2. Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022
2
algorithm of polynomials in field to a domain by multiplying ๐(๐ฅ) with a certain power of the
leading coefficient of ๐(๐ฅ) before starting the division.
Using pseudo-division, there are a lot of results about polynomials even the ideal lattice used in
cryptography. From 1960, researchers built early computer algebra systems and G.C.D.
computations were an important test problem. Nevertheless, using pseudo-division in Euclidean
algorithm causes exponential coefficients growth. In 1967, Collins [1] explained that the ๐-th
intermediate coefficients are approximately longer by a factor of (1 + โ2)
๐
than the input
coefficients. There are many ways to decrease the size of coefficients, most of them are quite
inefficient, however. In this paper, we mainly focus on the subresultant algorithm and its variant.
In [2], Knuth present the early subresultant algorithm and gave an elegant proof of its correctness.
In [3], Brown showed the variant of subresultant algorithm and gave a way to remove the small
factor of each remainder. However, the method he present didn't work always.
Recently, in [4], they show an algorithm to triangularize the basis of an ideal lattice which is
often used to construct ideal lattice-based cryptosystems. In their algorithm, they need to compute
all the PPRSoL (the definition given in Sec.2.4) of ๐(๐ฅ) and ๐(๐ฅ). However, to obtain the
PPRSoL, we need to compute each content of ๐ก๐(๐ฅ) satisfying ๐ ๐(๐ฅ)๐(๐ฅ) + ๐ก๐(๐ฅ)๐(๐ฅ) = ๐๐(๐ฅ) to
remove the extra factor in each original remaindes ๐๐(๐ฅ). However, in this paper, we find a new
way to obtain PPRSoL without computing ๐ก๐(๐ฅ) by applying the variant of subresultant
algorithm.
In this paper, we give some results about the extended Euclidean algorithm. Using these results,
we propose a new algorithm that outputting the PPRSoL of ๐(๐ฅ) and ๐(๐ฅ) which works for most
cases.
2. PRELIMINARIES
2.1. Notations
In this paper, a matrix is denoted as uppercase bold letter and a vector is denoted as lowercase
bold letter. For a matrix๐จ โ โ๐ร๐
, the element in the ๐-th row and the ๐-th column of ๐จ is
expressed as ๐๐,๐ . For a polynomial ๐(๐ฅ) with degree ๐, we use ๐๐(๐) to present the leading
coefficient of ๐(๐ฅ) and use๐๐๐(๐) to present the degree. The degree of a constant polynomial is
defined as 0 and the degree of a zero polynomial is defined as โโ. The greatest common divisor
is abbreviated to g.c.d.. Let ๐[๐ฅ] denote the domain of polynomials in x with coefficients in ๐.
Unless otherwise specified, we only consider the polynomials in โค[๐ฅ].
2.2. Some Definitions
Definition 1: [Hermite Normal Form] Given a square matrix ๐ฏ โ โค๐ร๐
. Then ๐ฏ is Hermite
Normal Form(HNF) if and only if it satisfies:
1) โ๐,๐ โฅ 1, for1 โค ๐ โค ๐;
2) โ๐,๐ = 0, for 1 โค ๐ โค ๐ โค ๐;
3) โ๐,๐ < โ๐,๐, for 1 โค ๐ < ๐ โค ๐.
We need to emphasize that the definition given above is only one way to define HNF. According
to row or column transformation and upper or lower triangularization, there are other different
definitions of HNF.
3. Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022
3
Definition 2: [Primitive Polynomial] A polynomial ๐(๐ฅ) โ โค[๐ฅ] is called a primitive polynomial
if for any integer |๐| > 1, ๐(๐ฅ)/๐ โ โค[๐ฅ].
Definition 3: [Content] For a polynomial ๐(๐ฅ) = ๐๐๐ฅ๐
+ โฏ + ๐1๐ฅ + ๐0 โ โค[๐ฅ], the content of
๐(๐ฅ), denoted as๐๐๐๐ก(๐(๐ฅ)), is the g.c.d of (๐๐, โฏ , ๐1, ๐0).
Definition 3: [Resultant] Let ๐(๐ฅ) = ๐
๐๐ฅ๐
+ โฏ + ๐1๐ฅ + ๐0, ๐(๐ฅ) = ๐๐๐ฅ๐
+ โฏ + ๐1๐ฅ + ๐0 be
two polynomials with degree ๐ and ๐ respectively. Define the Sylvester matrix of ๐(๐ฅ) and ๐(๐ฅ)
as
๐๐ฒ๐ฅ๐ฏ(๐, ๐) =
[
๐ฅ๐โ1
๐(๐ฅ)
๐ฅ๐โ2
๐(๐ฅ)
โฎ
๐(๐ฅ)
๐ฅ๐โ1
๐(๐ฅ)
๐ฅ๐โ2
๐(๐ฅ)
โฎ
๐(๐ฅ) ]
=
[
๐
๐ ๐๐โ1 โฏ ๐0
๐
๐ ๐๐โ1 โฏ ๐0
โฑ โฑ
๐
๐ ๐๐โ1 โฏ ๐0
๐๐ ๐๐โ1 โฏ ๐1 ๐0
๐๐ ๐๐โ1 โฏ ๐1 ๐0
โฑ โฑ
๐๐ ๐๐โ1 โฏ ๐1 ๐0](๐+๐)ร(๐+๐)
Then the resultant of ๐(๐ฅ) and ๐(๐ฅ) , denoted as Res(๐(๐ฅ), ๐(๐ฅ)) , is the determinant of
๐๐ฒ๐ฅ๐ฏ(๐, ๐).
Definition 3: [Subresultant] Let ๐(๐ฅ) = ๐
๐๐ฅ๐
+ โฏ + ๐1๐ฅ + ๐0 , ๐(๐ฅ) = ๐๐๐ฅ๐
+ โฏ + ๐1๐ฅ + ๐0
be two polynomials with degree ๐ and ๐ respectively.For 0 โค ๐ < ๐, the ๐-th subresultant of
๐(๐ฅ) and ๐(๐ฅ) is the determinant of ๐๐(๐, ๐) defines as
๐๐(๐, ๐) =
[
๐
๐ ๐๐โ1 โฏ ๐๐โ๐+๐+1 โฏ ๐๐+1 โฏ ๐2๐โ๐+1
๐
๐ โฏ ๐๐โ๐+๐+2 โฏ ๐๐+2 โฏ ๐2๐โ๐+2
โฑ โฎ โฎ โฎ
๐
๐ โฏ ๐
๐ โฏ ๐๐
๐๐ ๐๐โ1 โฏ ๐๐+1 โฏ ๐๐โ๐+๐+1 โฏ ๐2๐โ๐+1
๐๐ โฎ โฎ โฎ
โฑ โฎ โฎ โฎ
๐๐ โฎ โฎ
โฑ โฎ โฎ
๐๐ โฏ ๐๐ ](๐+๐โ2๐)ร(๐+๐โ2๐)
4. Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022
4
Remark 1. From the structure of ๐๐(๐, ๐) and ๐๐ฒ๐ฅ๐ฏ(๐, ๐), we can tell that indeed if we delete the
last 2๐ columns and the last ๐ rows of ๐(๐ฅ) and ๐(๐ฅ) respectively in ๐๐ฒ๐ฅ๐ฏ(๐, ๐), we obtain
๐๐(๐, ๐). Expecially, ๐0(๐, ๐) = ๐๐ฒ๐ฅ๐ฏ(๐, ๐).
Next we will give the conception of ideal lattice which takes an important role in the lattice-based
cryptography, and we mainly focus on the cases in which an ideal lattice can be derived from
๐(๐ฅ) and ๐(๐ฅ).
Ideal Lattice We define ideal lattice over a ring ๐ = โค[๐ฅ]/โฉ๐(๐ฅ)โช, where ๐(๐ฅ) โ โค[๐ฅ] is a monic
and irreducible polynomial of degree ๐ and โฉ๐(๐ฅ)โช is the ideal generated by ๐(๐ฅ) โ โค[๐ฅ].
Consider the coefficient embedding
๐๏ผ๐ โฆ โค๐
โ ๐๐๐ฅ๐
๐โ1
๐=0
โฆ (๐๐โ1, ๐๐โ2, โฏ , ๐0)
From [5], we know that the ideal generated by ๐(๐ฅ) forms a lattice under ๐ and we call it the
ideal lattice โ generated by ๐(๐ฅ) . Moreover, ๐(๐ฅ)mod๐(๐ฅ) , ๐ฅ๐(๐ฅ)mod๐(๐ฅ) , โฏ ,
๐ฅ๐โ1
๐(๐ฅ)mod๐(๐ฅ) form a basis of โ. As we can see, the basis is closely related to the Sylvester
matrix of ๐(๐ฅ) and ๐(๐ฅ). When ๐(๐ฅ) and ๐(๐ฅ) are coprime over โ[๐ฅ], the ideal lattice is full-
rank.
Then we present a lemma in [5] that we will use later.
Lemma 1. Let โ be the ideal lattice generated by ๐(๐ฅ) โ ๐ = โค[๐ฅ]/โฉ๐(๐ฅ)โช, where ๐(๐ฅ) is a
monic polynomial of degree ๐ and is relatively prime to ๐(๐ฅ). Then the Hermite Normal Form of
a basis of โ
๐ป =
[
โ1,1 โ1,2 โฏ โ1,๐
โ2,2 โฏ โ2,๐
โฑ โฎ
โ๐,๐]
satisfies โ๐,๐|โ๐,๐, for 1 โค ๐ โค ๐ โค ๐ โค ๐.
2.3. The Classical Euclidean Algorithm of Polynomials over A Field
Given a field ๐ฝ. Let ๐(๐ฅ) and ๐(๐ฅ) โ ๐ฝ[๐ฅ] with ๐๐๐(๐) > ๐๐๐(๐). Then the division of ๐(๐ฅ)
and ๐(๐ฅ) yields a unique quotient ๐(๐ฅ) and remainder ๐ (๐ฅ) such that
๐(๐ฅ) = ๐(๐ฅ)๐(๐ฅ) + ๐ (๐ฅ)
here ๐๐๐(๐) > ๐๐๐(๐), ๐๐๐(๐) = ๐๐๐(๐) โ ๐๐๐(๐).
If we repeat the step for each divisor polynomial and remainder, we will obtain a sequence of
remainders with decreasing degrees. Formally, a detailed procedure of the Euclidean algorithm of
polynomials over a field is present as following:
5. Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022
5
{
๐(๐ฅ) = ๐1(๐ฅ)๐(๐ฅ) + ๐ 1(๐ฅ)
๐(๐ฅ) = ๐2(๐ฅ)๐ 1(๐ฅ) + ๐ 2(๐ฅ)
โฎ
๐ ๐โ2(๐ฅ) = ๐๐(๐ฅ)๐ ๐โ1(๐ฅ) + ๐ ๐(๐ฅ)
๐ ๐โ1(๐ฅ) = ๐๐+1(๐ฅ)๐ ๐(๐ฅ)
where๐๐๐(๐) > ๐๐๐(๐ 1) > โฏ > ๐๐๐(๐ ๐) and all the coefficients are in the given field. Note
that if deg(๐ ๐) = 0, it shows that ๐(๐ฅ) and ๐(๐ฅ) are coprime in ๐ฝ[๐ฅ], which means the resultant
of ๐(๐ฅ) and ๐(๐ฅ) is nonzero.
2.4. Polynomial Remainder Sequence
The procedure of the Euclidean algorithm of polynomials over a unique factorization domain
(UFD) is similar to the one over a field. The difference exits because the division between two
polynomials requires exact divisibility in the given domain, which is usually impossible to
realize. To solve the problem, the procedure of pseudo-division is proposed, which yields a
unique pseudo-quotient ๐(๐ฅ) and pseudo-remainder ๐(๐ฅ) such that
(lc(๐))
๐ฟ+1
๐(๐ฅ) = ๐(๐ฅ)๐(๐ฅ) + ๐(๐ฅ)
here ๐๐๐(๐) > ๐๐๐(๐), ๐ฟ = ๐๐๐(๐) โ ๐๐๐(๐), ๐(๐ฅ) is equivalent with prem(๐, ๐). Moreover,
the coefficients of ๐(๐ฅ) and ๐(๐ฅ) are in the given domain.
For nonzero polynomials ๐(๐ฅ), ๐(๐ฅ) โ ๐[๐ฅ], we say ๐(๐ฅ) is similar to ๐(๐ฅ)(๐(๐ฅ)~๐(๐ฅ)) if there
exist ๐1, ๐2 โ ๐ such that ๐1๐(๐ฅ) = ๐2๐(๐ฅ). So if we choose ๐โฒ(๐ฅ) that is similar to ๐(๐ฅ), we can
do the same step as above for ๐(๐ฅ) and ๐โฒ(๐ฅ). Thus, we can rewrite the procedure of pseudo-
division:
๐ผ๐(๐ฅ) = ๐(๐ฅ)๐(๐ฅ) + ๐ฝ๐(๐ฅ).
Then the detailed procedure of pseudo-division is present as following:
{
๐ผ1๐(๐ฅ) = ๐1(๐ฅ)๐(๐ฅ) + ๐ฝ1๐1(๐ฅ)
๐ผ2๐(๐ฅ) = ๐2(๐ฅ)๐1(๐ฅ) + ๐ฝ2๐2(๐ฅ)
โฎ
๐ผ๐๐๐โ2(๐ฅ) = ๐๐(๐ฅ)๐๐โ1(๐ฅ) + ๐ฝ๐๐๐(๐ฅ)
๐ผ๐+1๐๐โ1(๐ฅ) = ๐๐+1(๐ฅ)๐๐(๐ฅ)
here ๐๐๐(๐) > ๐๐๐(๐1) > โฏ > ๐๐๐(๐๐) and all the๐ผ๐ and ๐ฝ๐ are in the given domain.
Generally, we denote ๐(๐ฅ) = ๐โ1(๐ฅ) and ๐(๐ฅ) = ๐0(๐ฅ), then ๐ผ๐ = (๐๐(r๐โ1))
๐ฟ๐โ2โ1
, where ๐ฟ๐ =
๐๐๐(๐๐) โ ๐๐๐(๐๐+1). Note that now prem(๐๐โ2, ๐๐โ1) = ๐ฝ๐๐๐(๐ฅ). Then ๐โ1(๐ฅ), ๐0(๐ฅ),โฏ,๐๐(๐ฅ)
form a sequence called polynomial remainder sequence(PRS).
From [5], if a remainder ๐(๐ฅ) = ๐ (๐ฅ)๐(๐ฅ) + ๐ก(๐ฅ)๐(๐ฅ) can derive a basis of ideal lattice, ๐ก(๐ฅ)
must be primitive. In this paper, we also want to obtain such remainders and we call these
remainders as primitive PRS of lattice (PPRSoL). Next, we give a result about ๐ ๐(๐ฅ) and ๐ก๐(๐ฅ).
6. Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022
6
Lemma 2. Let ๐(๐ฅ), ๐(๐ฅ) โ โค[๐ฅ] be two polynomials with degree ๐ and ๐ respectively, where
๐ > ๐ . Let ๐โ1(๐ฅ), ๐0(๐ฅ), โฏ , ๐๐(๐ฅ) be the remainders in procedure of pseudo-division. If
๐๐๐(๐๐) = ๐๐, then ๐๐(๐ฅ) = ๐ ๐(๐ฅ)๐(๐ฅ) + ๐ก๐(๐ฅ)๐(๐ฅ) satisfies ๐๐๐(๐ ๐) < ๐, ๐๐๐(๐ก๐) < ๐ and:
1) ๐ ๐(๐ฅ) = (๐ผ๐๐ ๐โ2(๐ฅ) โ ๐๐(๐ฅ)๐ ๐โ1(๐ฅ))/๐ฝ๐, ๐ก๐(๐ฅ) = (๐ผ๐๐ก๐โ2(๐ฅ) โ ๐๐(๐ฅ)๐ก๐โ1(๐ฅ))/๐ฝ๐
2) ๐๐๐(๐ ๐) = ๐ โ ๐๐๐(๐๐โ1),๐๐๐(๐ก๐) = ๐ โ ๐๐๐(๐๐โ1)
If we represent ๐๐(๐ฅ) = ๐ ๐(๐ฅ)๐(๐ฅ) + ๐ก๐(๐ฅ)๐(๐ฅ) under the embedding ฯ, for ๐ = โ1, 0, โฏ , ๐, then
we can denote ๐๐(๐ฅ) as a sequence of vectors and we use a matrix ๐น to represent ๐๐(๐ฅ) as
following:
[
๐๐ โฏ ๐๐โ๐+1 ๐๐โ๐ โฏ ๐0
โฑ โฑ
๐๐ ๐๐โ1 โฏ ๐๐โ1 ๐๐โ2 โฏ ๐1 ๐0
๐0,๐0
โฏ ๐0,0
โฑ
โฎ ๐0,๐0
โฏ ๐0,0
๐1,๐0
โฏ ๐1,0
๐ โฑ
๐1,๐1
โฏ ๐1,0
โฑ
โฎ ๐๐,๐๐
โฑ
๐๐,๐๐](๐+๐)ร(๐+๐)
Also, we use ๐บ and ๐ป to represent the matrice denoting ๐ ๐(๐ฅ) and ๐ก๐(๐ฅ) respectively.
๐ป =
[
1
โฑ
1
๐ก1,๐โ๐0
โฏ ๐ก1,0
โฑ โฑ
๐ก1,๐โ๐0
โฏ ๐ก1,0
โฑ
๐ก๐,๐โ๐๐โ1
โฏ ๐ก๐,0
โฑ โฑ
๐ก๐,๐โ๐๐โ1
โฏ ๐ก๐,0 ]๐ร๐
7. Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022
7
๐บ =
[
0
โฑ
0
๐ 1,๐โ๐0
โฏ ๐ 1,0
โฑ โฑ
๐ 1,๐โ๐0
โฏ ๐ 1,0
โฑ
๐ ๐,๐โ๐๐โ1
โฏ ๐ ๐,0
โฑ โฑ
๐ ๐,๐โ๐๐โ1
โฏ ๐ ๐,0 ]๐ร๐
So if we give a matrix named ๐บ๐ป, then procedure of pseudo-division can be represent as a matrix
multiplication.
๐บ๐ป = [
1
โฑ ๐
1
๐บ ๐ป
]
(๐+๐)ร(๐+๐)
๐บ๐ป โ ๐๐ฒ๐ฅ๐ฏ(๐, ๐) = ๐น
Here we need to show that by elementary row transformation, ๐บ๐ป can be transformed into
๐บ๐ป = [
1
โฑ ๐
1
๐ ๐ป
]
(๐+๐)ร(๐+๐)
which means that the determinant of ๐บ๐ป equals to the determinant of ๐ป. Also according to lemma
2, it turns out that after appropriate row switching, ๐ป is actually an upper triangular matrix, thus
the determinant of ๐ป is |โ lc(๐ก๐)๐๐โ1โ๐๐
๐
๐=0 |.
In the following part, we introduce some typical PRSs which differs from each other by choosing
different ๐ฝ๐.
2.4.1. Euclidean Polynomial Remainder Sequences
When choosing ๐ฝ๐ = 1 for all ๐ in PRS, we obtain Euclidean PRS. This is a generalization of the
Euclidean algorithm over integers. However, the algorithm is quite inefficient because with the
proceeding of the sequence, the coefficients of the remainders grow exponentially. To be
specific, we need to calculate each ๐ก๐(๐ฅ) and cont(๐ก๐(๐ฅ)) to get a eligible PPRSoL, which costs
too much. So we need to determine certain ๐ฝ๐ to ensure the efficiency.
8. Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022
8
2.4.2. Primitive Polynomial Remainder Sequences
When choosing ๐ฝ๐ = cont(prem(๐๐โ2, ๐๐โ1)) for all ๐ in PRS, we obtain primitive PRS. Although
the algorithm stops the coefficients growing exponentially in every step of the pseudo-division,
however, when proceeding primitive PRS, the coefficients of ๐ ๐(๐ฅ) and ๐ก๐(๐ฅ) may be not in the
given domain, which means that the PRS we obtain is not PPRSoL. So primitive PRS doesn't
satisfy our requirement.
2.4.3. Subresultant Polynomial Remainder Sequences
When ๐ฝ๐ is related to the subresultant, we obtain subresultant PRS. The equation set as following
depicts the procedure of the subresultant PRS algorithm in [2].
{
๐ผโฒ1๐(๐ฅ) = ๐โฒ1(๐ฅ)๐(๐ฅ) + ๐ฝโฒ1๐โฒ1(๐ฅ)
๐ผโฒ2๐(๐ฅ) = ๐โฒ2(๐ฅ)๐1(๐ฅ) + ๐ฝโฒ2๐โฒ2(๐ฅ)
โฎ
๐ผโฒ๐๐โฒ๐โ2(๐ฅ) = ๐โฒ๐(๐ฅ)๐๐โ1(๐ฅ) + ๐ฝโฒ๐๐โฒ๐(๐ฅ)
where ๐โ1(๐ฅ) = ๐(๐ฅ), ๐0(๐ฅ) = ๐(๐ฅ), ๐๐ = ๐๐๐(๐โฒ๐), ๐ฟ๐ = ๐๐ โ ๐๐+1 , ๐ผโฒ๐ = (lc(๐โฒ๐โ1))
๐ฟ๐โ2+1
,
๐ฝโฒ๐ = lc(๐โฒ๐โ2)โ๐
๐ฟ๐โ2
, โ1 = 1, โ๐ = (๐๐(๐โฒ๐โ2))๐ฟ๐โ3โ๐โ1
1โ๐ฟ๐โ3
, for 2 โค ๐ โค ๐ + 1.
Intuitively, the intact subresultant algorithm can be present in Algorithm 1. We point out that
because we want to get PPRSoL, the input of every PRS algorithm in the paper contains a monic
and irreducible polynomial.
Algorithm 1 Subresultant PRS Algorithm
Input: two polynomials ๐(๐ฅ), ๐(๐ฅ) โ โค[๐ฅ] with degree ๐ and ๐ respectively and ๐(๐ฅ) is monic and
irreducible
Output: Subresultant PRS, ๐โฒ0(๐ฅ), ๐โฒ1(๐ฅ), โฏ
1.[Initialize] ๐ โ โ โ 1, ๐โฒ0(๐ฅ) = ๐(๐ฅ),๐ โ 1
2.[Pseudo-division]
2.1 Set ฮด = ๐๐๐(๐) โ ๐๐๐(๐)
2.2 Calculate ๐(๐ฅ) such that ๐(๐ฅ) = ๐ (๐ฅ)๐(๐ฅ) + ๐ก(๐ฅ)๐(๐ฅ)
3.[Adjust remainder]
3.1 ๐ข(๐ฅ) โ ๐(๐ฅ), ๐โฒ๐(๐ฅ) โ ๐(๐ฅ) โ ๐(๐ฅ)/๐โ๐ฟ
3.2 ๐ โ ๐๐(๐),โ โ โ1โ๐ฟ
๐๐ฟ
3.3 If ๐๐๐(๐) = 0, go to Step 4
3.4 ๐ โ ๐ + 1, go to Step 2
4.[Return] ๐โฒ0(๐ฅ), ๐โฒ1(๐ฅ), โฏ
Notice that for ๐โฒ๐(๐ฅ) = ๐ โฒ๐(๐ฅ)๐(๐ฅ) + ๐กโฒ๐(๐ฅ)๐(๐ฅ) , ๐กโฒ๐(๐ฅ) maybe not primitive in the given
domain, which means that we can still decrease the coefficients of ๐โฒ๐(๐ฅ) by removing a factor.
In [6], the author shows that the โ๐ is indeed the ๐๐โ1-th subresultant of ๐(๐ฅ) and ๐(๐ฅ), that is
โ๐ = ๐๐๐โ1
(๐, ๐). Also, in [3], the author shows that every โ๐ is an integer and ๐โฒ๐(๐ฅ) โ โค[๐ฅ] and
gives an elegant proof.
9. Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022
9
2.4.4. Improvements of Subresultant Polynomial Remainder Sequences
This is another expression of subresultant PRS. As stated above, for the output of Algorithm 1,
๐โฒ๐(๐ฅ) = ๐ โฒ๐(๐ฅ)๐(๐ฅ) + ๐กโฒ๐(๐ฅ)๐(๐ฅ), ๐กโฒ๐(๐ฅ) maybe not primitive and there might exist a divisor ๐๐
such that ๐ก๐(๐ฅ) = ๐กโฒ๐(๐ฅ)/๐๐ is primitive. So in the improvement version, the author transforms the
procedure of the subresultant PRS algorithm as following,
{
๐ผ1๐(๐ฅ) = ๐1(๐ฅ)๐(๐ฅ) + ๐ฝ1๐1(๐ฅ)
๐ผ2๐(๐ฅ) = ๐2(๐ฅ)๐1(๐ฅ) + ๐ฝ2๐2(๐ฅ)
โฎ
๐ผ๐๐๐โ2(๐ฅ) = ๐๐(๐ฅ)๐๐โ1(๐ฅ) + ๐ฝ๐๐๐(๐ฅ)
where ๐โ1(๐ฅ) = ๐(๐ฅ) , ๐0(๐ฅ) = ๐(๐ฅ) , โ1 = 1 , ๐๐ = ๐๐๐(๐๐) , ๐ฟ๐ = ๐๐ โ ๐๐+1 , ๐ผ๐ =
(๐๐(๐๐โ1))
๐ฟ๐โ2+1
, ๐ฝ๐ = ๐๐(๐๐โ2)โ๐
๐ฟ๐โ2
๐๐โ1
โ๐ฟ๐โ2โ1
๐๐ , โ๐ = (๐๐โ2๐๐(๐๐โ2))๐ฟ๐โ3โ๐โ1
1โ๐ฟ๐โ3
, for 2 โค
๐ โค ๐ + 1. ๐๐ is an integer such that ๐กโฒ๐(๐ฅ)/๐๐is a primitive polynomial. Clearly, ๐0 = 1. In [3], the
author chose ๐๐ = lc(๐๐โ1) if lc(๐๐โ1)|๐โฒ๐(๐ฅ), otherwise ๐๐ = 1. However, the method to choose ๐๐
doesn't work for every ๐๐.
Comparing the two subresultant algorithms, we need to emphasis that all the โ๐s are equal in the
two algorithms.
3. SOME PROPERTIES OF THE SUB RESULTANT POLYNOMIAL REMAINDER
SEQUENCE
Before presenting our algorithm, we give some results about the subresultant PRS.
Proposition 1. Given two polynomials ๐(๐ฅ) = ๐๐๐ฅ๐
+ โฏ + ๐1๐ฅ + ๐0 and ๐(๐ฅ) = ๐๐๐ฅ๐
+ โฏ +
๐1๐ฅ + ๐0 โ โค[๐ฅ], where ๐ > ๐. Write ๐๐
๐โ๐+1
๐(๐ฅ) = ๐(๐ฅ)๐(๐ฅ) + ๐(๐ฅ). Define the matrix
If the determinant of the matrix ๐ด๐ is denoted as โ๐ , where ๐ด๐ is the ๐ ร ๐ submatrix of ๐ด
obtained by deleting the last (๐ โ ๐ + 2 โ ๐) rows and the last (๐ + 1 โ ๐) columns from ๐ด, ๐ =
0, โฆ , ๐ โ ๐ + 1 . Then ๐(๐ฅ) = โ โ๐โ๐+1โ๐๐๐
๐
๐ฅ๐
๐โ๐
๐=0 . Moreover, we have
(๐๐๐๐ก(๐(๐ฅ))๐๐๐๐ก(๐(๐ฅ))
๐โ๐
)|๐(๐ฅ).
Proof. We first give the detail of the pseudo-division procedure,
{
๐๐๐(๐ฅ) = ๐๐๐ฅ๐โ๐
๐(๐ฅ) + ๐ 1(๐ฅ)
๐๐๐ 1(๐ฅ) = ๐๐(๐ 1)๐ฅ๐โ๐โ1
๐(๐ฅ) + ๐ 2(๐ฅ)
โฎ
๐๐๐ ๐โ๐โ1(๐ฅ) = ๐๐(๐ ๐โ๐โ1)๐ฅ๐(๐ฅ) + ๐ ๐โ๐(๐ฅ)
๐๐๐ ๐โ๐(๐ฅ) = ๐๐(๐ ๐โ๐)๐ฅ๐(๐ฅ) + ๐(๐ฅ)
10. Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022
10
We denote ๐ 0(๐ฅ) = ๐(๐ฅ) and ๐ ๐โ๐+1(๐ฅ) = ๐(๐ฅ), then we claim that ๐ ๐(๐ฅ) = โ โ
ฬ ๐,๐๐ฅ๐
๐โ๐
๐=0 ,
where โ
ฬ ๐,๐ is the determinant of the (๐ + 1) ร (๐ + 1) matrix ๐๐,๐ obtained by deleting the last
(๐ โ ๐ + 1 โ ๐) rows and the last (๐ + 1 โ ๐) columns except column (๐ + 1 โ ๐) from ๐, ๐ =
0, โฆ , ๐ โ ๐ + 1, ๐ = 0, โฆ , ๐ โ ๐. Clearly, โ๐+1= โ
ฬ ๐,๐โ๐.
Then we explain the claim by induction on ๐, ๐ = 0, โฆ , ๐ โ ๐ + 1.
For ๐ = 0, we have ๐ 0(๐ฅ) = ๐(๐ฅ) and it's obvious that ๐๐ = โ
ฬ 0,๐ for ๐ = 0, โฆ , ๐.
Next we assume that the claim holds for ๐ = ๐ โ 1. Then we denote ๐๐๐ ๐โ1(๐ฅ) and ๐(๐ฅ) as
following,
[
๐๐โ
ฬ ๐โ1,๐+1โ๐ ๐๐โ
ฬ ๐โ1,๐โ๐ โฏ ๐๐โ
ฬ ๐โ1,๐โ๐+1โ๐ โฏ โฏ ๐๐โ
ฬ ๐โ1,1 ๐๐โ
ฬ ๐โ1,0
๐๐ ๐๐โ1 โฏ ๐0 0 โฏ 0 0
]
Then the coefficient of ๐ฅ๐โ๐+1โ๐
in ๐ ๐(๐ฅ) is ๐๐โ
ฬ ๐โ1,๐+1โ๐โ๐ โ ๐๐โ๐โ
ฬ ๐โ1,๐+1โ๐ if 1 โค ๐ โค ๐
and ๐๐โ
ฬ ๐โ1,๐+1โ๐โ๐ otherwise. According to the structure of ๐ we know that the coefficient of
๐ฅ๐โ๐+1โ๐
is exactly โ
ฬ ๐,๐โ๐+1โ๐. So the claim holds.
From the claim we have ๐๐(๐ ๐) = โ
ฬ ๐,๐โ๐= โ๐+1 , so ๐(๐ฅ) = โ ๐๐(๐ ๐โ๐โ๐)๐๐
๐
๐ฅ๐
๐โ๐
๐=0 =
โ โ๐โ๐+1โ๐๐๐
๐
๐ฅ๐
๐โ๐
๐=0 .
Then from the structure of ๐๐ , we know (๐๐๐๐ก(๐(๐ฅ))๐๐๐๐ก(๐(๐ฅ))
๐โ๐โ๐
)|โ๐โ๐+1โ๐ . So
(๐๐๐๐ก(๐(๐ฅ))๐๐๐๐ก(๐(๐ฅ))
๐โ๐
)|โ๐โ๐+1โ๐๐๐
๐
, which means (๐๐๐๐ก(๐(๐ฅ))๐๐๐๐ก(๐(๐ฅ))
๐โ๐
)|๐(๐ฅ).
Proposition 2. Let ๐1(๐ฅ), โฏ , ๐๐(๐ฅ) be the remainders obtained in improved subresultant algorithm.
Present ๐๐(๐ฅ) = ๐ ๐(๐ฅ)๐(๐ฅ) + ๐ก๐(๐ฅ)๐(๐ฅ), for ๐ = 1, โฏ, ๐. Then we have ๐๐(๐ก๐) =
โ๐+1
๐๐
.
Proof. According to Lemma 2, ๐ก๐(๐ฅ) =
1
๐ฝ๐
(๐ผ๐๐ก๐โ2(๐ฅ) โ ๐๐(๐ฅ)๐ก๐โ1(๐ฅ)) and ๐๐๐(๐ก๐) = ๐ โ ๐๐โ1.
Also ๐๐๐(๐๐) = ๐ฟ๐โ2 , so ๐๐๐(๐ก๐) = ๐ โ ๐๐โ3 < ๐๐๐(๐๐๐ก๐โ1) = ๐ โ ๐๐โ1 . Then ๐๐(๐ก๐) =
1
๐ฝ๐
๐๐(๐๐) ๐๐(๐ก๐โ1), so ๐๐(๐๐) =
๐๐(๐๐โ2)
๐๐(๐๐โ1)
๐ผ๐. Then ๐๐(๐ก๐) =
๐๐(๐๐โ2)๐ผ๐
๐๐(๐๐โ1)๐ฝ๐
๐๐(๐ก๐โ1) =
๐ผ1โฆ๐ผ๐
๐ฝ1โฆ๐ฝ๐๐๐(๐๐โ1)
.
Because ๐ผ๐ = (๐๐(๐๐โ1))
๐ฟ๐โ2+1
, ๐ฝ๐ = ๐๐(๐๐โ1)โ๐
๐ฟ๐โ2
๐๐โ1
โ๐ฟ๐โ2โ1
๐๐, then we have
๐๐(๐ก๐) =
1
๐๐(๐๐โ1)
(๐๐โ1 ๐๐(๐๐โ1))๐ฟ๐โ2+1
๐๐(๐๐โ2) โ๐
๐ฟ๐โ2
๐๐
(๐๐โ2 ๐๐(๐๐โ2))๐ฟ๐โ3+1
๐๐(๐๐โ3) โ๐โ1
๐ฟ๐โ3
๐๐โ1
โฆ
(๐0 ๐๐(๐0))๐ฟโ1+1
๐๐(๐โ1) โ1
๐ฟโ1
๐1
=
1
๐๐
(๐๐โ1 ๐๐(๐๐โ1))๐ฟ๐โ2
โ๐
๐ฟ๐โ2
(๐๐โ2 ๐๐(๐๐โ2))๐ฟ๐โ3
โ๐โ1
๐ฟ๐โ3
โฆ
(๐0 ๐๐(๐0))๐ฟโ1
โ1
๐ฟโ1
=
1
๐๐
(๐๐โ1 ๐๐(๐๐โ1))๐ฟ๐โ2
โ๐
๐ฟ๐โ2
(๐๐โ2 ๐๐(๐๐โ2))๐ฟ๐โ3
โ๐โ1
๐ฟ๐โ3
โฆ
(๐0 ๐๐(๐1))๐ฟ0
โ1
๐ฟโ1
โ2
= โฏ =
โ๐+1
๐๐
Remark 2. If we do similar steps for ๐โฒ0(๐ฅ), ๐โฒ1(๐ฅ), โฏ , ๐โฒ๐(๐ฅ) in Algorithm 1 and present each
๐โฒ๐(๐ฅ) = ๐ โฒ๐(๐ฅ)๐(๐ฅ) + ๐กโฒ๐(๐ฅ)๐(๐ฅ), then we obtain ๐๐(๐กโฒ๐) = โ๐+1.
Before giving next lemmas, we first present a useful algorithm from [5]. We use the same
symbols in [5], {๐ โ ๐๐โ1 + 1, โฏ , ๐ โ ๐๐} = ๐ผ๐, then {1,2, โฏ, ๐} = โ ๐ผ๐
๐
๐+1 .
11. Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022
11
Algorithm 2 A Useful Algorithm
Input:๐0(๐ฅ), ๐1(๐ฅ), โฏ , ๐๐(๐ฅ)from improved subresultant algorithm
Output: ๐ฬ 0(๐ฅ), ๐ฬ 1(๐ฅ), โฏ , ๐ฬ ๐(๐ฅ)
1.When๐ โ ๐ผ๐, ๐โฒ๐(๐ฅ) = ๐๐(๐ฅ)๐ฅ๐โ๐
,๐ โ ๐ โ 1
2.When ๐ โ ๐ผ๐
2.1 Set Compute ๐ and ๐, such that ๐๐๐(๐๐) + ๐๐๐(๐ฬ ๐+1) = gcd(๐๐(๐๐), ๐๐(๐ฬ ๐+1))
2.2 Set ๐ฬ ๐(๐ฅ) = ๐๐๐(๐ฅ) + ๐๐ฬ ๐+1(๐ฅ)๐ฅ๐ฟ๐
2.3 If ๐๐(๐ฬ ๐โ๐๐
) = 1, set ๐ฬ ๐(๐ฅ) = ๐ฬ ๐โ๐๐
(๐ฅ)๐ฅ๐โ๐๐โ๐
, ๐ = 1, โฏ , ๐ โ ๐๐, go to Step 3; otherwise
๐ฬ ๐(๐ฅ) = ๐ฬ ๐โ๐๐
(๐ฅ)๐ฅ๐โ๐๐โ๐
, ๐ โ ๐ โ 1
2.4If ๐ > 0, go to Step 2, otherwise go to Step 3
4.Return๐ฬ 0(๐ฅ), ๐ฬ 1(๐ฅ), โฏ , ๐ฬ ๐(๐ฅ)
We need to explain that Algorithm 2 is equivalent to the corresponding algorithm in [4] and we
just use polynomials to express the output instead of a matrix in [4].
Then we will present some results of ๐๐๐๐ก(๐๐(๐ฅ))and ๐๐(๐ฬ ๐).
Lemma 3. Let ๐1(๐ฅ), โฏ, ๐๐(๐ฅ) be the polynomial remainder sequence obtained in improved
subresultant algorithm. Then ๐๐๐๐ก(๐๐(๐ฅ))|๐๐๐๐ก(๐๐โ1(๐ฅ)) for 0 โค ๐ โค ๐ โ 1.
Proof. We prove this lemma by induction on ๐, ๐ = 0, โฆ , ๐ โ 1.
Suppose that ๐ป is the Hermite Normal Form over the ideal lattice โ generated by ๐(๐ฅ) โ
โค[๐ฅ]/โฉ๐(๐ฅ)โช, and ๐๐(๐ฅ) belongs to โ. When ๐ = 0, because ๐0(๐ฅ) generates the ideal lattice โ ,
then all the vectors in โ can be divided exactly by ๐๐๐๐ก(๐0(๐ฅ)).
Next we suppose that when ๐ โค ๐ โ 1, ๐๐๐๐ก(๐๐โ1(๐ฅ))|๐๐๐๐ก(๐๐(๐ฅ)), then we need to show that
๐๐๐๐ก(๐๐(๐ฅ))|๐๐๐๐ก(๐๐+1(๐ฅ)).
Consider the (๐ + 1)-th equation in improved subresultant algorithm,
๐ผ๐+1๐๐โ1(๐ฅ) = ๐๐+1(๐ฅ)๐๐(๐ฅ) + ๐ฝ๐+1(๐ฅ)๐๐+1(๐ฅ),
then we know ๐๐๐๐ก(๐๐โ1(๐ฅ))๐๐๐๐ก(๐๐(๐ฅ))
๐ฟ๐โ1+1
|๐ฝ๐+1๐๐+1(๐ฅ). Because
๐ก๐+1(๐ฅ) = (๐ผ๐+1๐ก๐โ1(๐ฅ) โ ๐๐+1(๐ฅ)๐ก๐(๐ฅ)) ๐ฝ๐+1
โ ,
๐ฝ๐+1 must contain a factor as the content of ๐ผ๐+1๐ก๐โ1(๐ฅ) โ ๐๐+1(๐ฅ)๐ก๐(๐ฅ) . Also ๐ผ๐+1 =
๐๐(๐๐)๐ฟ๐โ1+1
, (๐๐๐๐ก(๐๐โ1(๐ฅ))๐๐๐๐ก(๐๐(๐ฅ))
๐ฟ๐โ1
)|๐๐+1(๐ฅ) due to Proposition 1. Based on the
assumption(๐๐๐๐ก(๐๐โ1(๐ฅ))|๐๐๐๐ก(๐๐(๐ฅ)), so (๐๐๐๐ก(๐๐โ1(๐ฅ))๐๐๐๐ก(๐๐(๐ฅ))
๐ฟ๐โ1
) |๐ฝ๐+1.
If (๐๐๐๐ก(๐๐(๐ฅ)) โค ๐๐๐๐ก(๐๐+1(๐ฅ)) , then there exists a prime ๐ such that ๐|๐๐๐๐ก(๐๐(๐ฅ)) and
(๐ โ ๐๐๐๐ก(๐๐โ1(๐ฅ))๐๐๐๐ก(๐๐(๐ฅ))
๐ฟ๐โ1
) |๐ฝ๐+1. We give 2 cases as following:
1) ๐ โ ๐๐๐๐ก(๐๐โ1(๐ฅ)) โค ๐๐๐๐ก(๐๐(๐ฅ)) , which means that ๐ โค ๐๐๐๐ก(๐๐โ1(๐ฅ)) and ๐ โค
๐๐๐๐ก(๐๐(๐ฅ))
๐๐๐๐ก(๐๐โ1(๐ฅ))
. According to Proposition 1, we know ๐๐+1(๐ฅ) = โ โ
ฬ ๐๐โ1,๐ ๐ฅ๐
๐ฝ๐+1
โ
๐๐โ1
๐=0 , here
12. Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022
12
โ
ฬ ๐๐โ1,๐ is the determinant of the (๐ฟ๐โ1 + 2) ร (๐ฟ๐โ1 + 2) matrix obtained by deleting the
last ๐๐ columns except column ๐๐โ1 + 1 โ ๐ from ๐ , ๐ = 0, โฆ , ๐๐ โ 1 . Because ๐ โค
๐๐โ1(๐ฅ)
๐๐๐๐ก(๐๐โ1(๐ฅ))
, there exits a ๐ > 1 such that ๐|๐๐(๐ฅ), which means ๐|
๐๐(๐๐)
๐๐๐๐ก(๐๐(๐ฅ))
. Thus we
obtan (๐ โ ๐๐๐๐ก(๐๐โ1(๐ฅ))๐๐๐๐ก(๐๐(๐ฅ))
๐ฟ๐โ1
) |๐ผ๐+1 . According to equation ๐ก๐+1(๐ฅ) =
(๐ผ๐+1๐ก๐โ1(๐ฅ) โ ๐๐+1(๐ฅ)๐ก๐(๐ฅ)) ๐ฝ๐+1
โ ,we have that
(๐ โ ๐๐๐๐ก(๐๐โ1(๐ฅ))๐๐๐๐ก(๐๐(๐ฅ))
๐ฟ๐โ1
) |๐๐+1(๐ฅ).
(๐ โ ๐๐๐๐ก(๐๐โ1(๐ฅ))๐๐๐๐ก(๐๐(๐ฅ))
๐ฟ๐โ1
) |๐ฝ๐+1๐๐+1(๐ฅ), which means we have get
๐๐๐๐ก(๐๐(๐ฅ))|๐๐๐๐ก(๐๐+1(๐ฅ)).
2) ๐ โ ๐๐๐๐ก(๐๐โ1(๐ฅ))|๐๐๐๐ก(๐๐(๐ฅ)). Because ๐ผ๐+1 = ๐๐(๐๐)๐ฟ๐โ1+1
, then we have result that
๐๐๐๐ก(๐๐(๐ฅ))๐ฟ๐โ1+1
|๐ผ๐+1 , thus (๐ โ ๐๐๐๐ก(๐๐โ1(๐ฅ))๐๐๐๐ก(๐๐(๐ฅ))
๐ฟ๐โ1
) |๐ผ๐+1 . As the same
step in case 1, we still get ๐๐๐๐ก(๐๐(๐ฅ))|๐๐๐๐ก(๐๐+1(๐ฅ)).
So in conclusion we obtain ๐๐๐๐ก(๐๐(๐ฅ))|๐๐๐๐ก(๐๐+1(๐ฅ)). The proof is completed.
Lemma 4. Let ๐1(๐ฅ), โฏ, ๐๐(๐ฅ) be the polynomial remainder sequence obtained in improved
resultant algorithm and ๐1
ฬ (๐ฅ), โฏ , ๐๐
ฬ (๐ฅ) be the output of Algorithm 2. If
gcd(๐๐(๐๐),๐๐๐๐ก(๐๐+1(๐ฅ))) = ๐๐๐๐ก(๐๐(๐ฅ)) for ๐ โค ๐ โ 1 , then ๐๐(๐ฬ ๐) = ๐๐๐๐ก(๐๐(๐ฅ)) .
Moreover, ๐๐(๐ฬ ๐)|๐๐
ฬ (๐ฅ).
Proof. We notice that from Algorithm 2, ๐ฬ ๐(๐ฅ) = ๐๐๐(๐ฅ) + ๐๐ฬ ๐+1(๐ฅ)๐ฅ๐ฟ๐ , where ๐ and ๐
satisfy ๐๐๐(๐๐) + ๐๐๐(๐ฬ ๐+1) = gcd(๐๐(๐๐),๐๐(๐ฬ ๐+1)) = ๐๐(๐ฬ ๐) . If we already have
gcd(๐๐(๐๐),๐๐๐๐ก(๐๐+1(๐ฅ))) = ๐๐๐๐ก(๐๐(๐ฅ)) and ๐๐๐๐ก(๐๐+1(๐ฅ)) = ๐๐(๐ฬ ๐+1), then we have ๐๐(๐ฬ ๐) =
๐๐๐๐ก(๐๐(๐ฅ)).
When ๐ = ๐, this is a trivial result because ๐๐(๐ฬ ๐) = ๐ฬ ๐(๐ฅ) = ๐๐๐๐ก(๐๐(๐ฅ)). So we know ๐๐(๐ฬ ๐โ1) =
๐๐๐๐ก(๐๐โ1(๐ฅ)),๐๐(๐ฬ ๐โ2) = ๐๐๐๐ก(๐๐โ2(๐ฅ)), โฆ,, and so on. Thus, if gcd(๐๐(๐๐), ๐๐๐๐ก(๐๐+1(๐ฅ))) =
๐๐๐๐ก(๐๐(๐ฅ)) for ๐ โค ๐ โ 1, then ๐๐(๐ฬ ๐) = ๐๐๐๐ก(๐๐(๐ฅ)).
For the second part, according to the assumption, gcd(๐๐(๐๐),๐๐๐๐ก(๐๐+1(๐ฅ))) = ๐๐๐๐ก(๐๐(๐ฅ)),
then ๐๐๐๐ก(๐๐(๐ฅ))|๐๐๐๐ก(๐๐+1(๐ฅ)) . Also ๐ฬ ๐(๐ฅ) = ๐๐๐(๐ฅ) + ๐๐ฬ ๐+1(๐ฅ)๐ฅ๐ฟ๐ , so ๐๐๐๐ก(๐๐(๐ฅ))|๐ฬ ๐(๐ฅ) .
Due to ๐๐(๐ฬ ๐) = ๐๐๐๐ก(๐๐(๐ฅ)), we know that ๐๐(๐ฬ ๐) = ๐๐๐๐ก(๐๐(๐ฅ))|๐ฬ ๐(๐ฅ), for 0 โค ๐ โค ๐.
Lemma 5. Let ๐1(๐ฅ), โฏ, ๐๐(๐ฅ) be the polynomial remainder sequence obtained in improved
resultant algorithm. Then gcd(๐๐(๐๐),๐๐๐๐ก(๐๐+1(๐ฅ))) = ๐๐๐๐ก(๐๐(๐ฅ)).
Proof. We prove this lemma by induction on ๐, ๐ = 1, โฆ , ๐ โ 1.
First, suppose that ๐ฏ is the Hermite Normal Form of the ideal lattice โ generated by ๐(๐ฅ) โ
โค[๐ฅ]/โฉ๐(๐ฅ)โช, and ๐๐(๐ฅ) belongs to โ. Denote
๐๐(๐๐)
๐๐(๐ป๐โ๐๐
)
as ๐พ๐ and ๐๐ = ๐ โ ๐๐, here ๐ฏ๐(๐ฅ) is the
corresponding polynomial of the ๐ -th row, then ๐๐(๐ฅ) = ๐พ๐๐ฏ๐๐
(๐ฅ) + โ ๐ด๐,๐(๐ฅ)
๐
๐=๐+1 ๐ฏ๐๐
(๐ฅ) ,
where deg(๐ด๐,๐) < ๐๐ โ ๐๐.
13. Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022
13
From Lemma 4, ๐๐ (๐ฏ๐๐
) |๐ฏ๐๐
(๐ฅ), for ๐ โค ๐ โค ๐ . So ๐๐(๐ฏ๐๐
)|๐๐๐๐ก(๐๐(๐ฅ)). Because ๐๐(๐ฅ) =
๐ก๐(๐ฅ)๐(๐ฅ)๐๐๐๐(๐ฅ) belongs to โ and ๐ก๐(๐ฅ) is primitive, then gcd(๐พ๐, ๐ด๐,๐+1(๐ฅ), โฆ , ๐ด๐,๐(๐ฅ)) = 1,
thus there exists some ๐ < ๐ โค ๐ , ๐๐๐๐ก (
๐๐(๐ฅ)
๐๐(๐ป๐๐
)
) = gcd(๐พ๐,
๐๐(๐ป๐๐
)
๐๐(๐ป๐๐
)
) , which means that
๐๐๐๐ก(๐๐(๐ฅ)) = gcd(๐๐(๐๐),๐๐(๐ป๐๐
)). So every content of ๐๐(๐ฅ) must be a factor of ๐ฏ๐. Specially,
we have ๐๐๐๐ก(๐๐โ1(๐ฅ)) = ๐๐(๐ฬ ๐โ1), which shows that the result holds for ๐ = ๐ โ 1.
Now assume that for ๐ โฅ ๐ , we have gcd(๐๐(๐๐),๐๐๐๐ก(๐๐+1(๐ฅ)) = ๐๐๐๐ก(๐๐(๐ฅ)) . Then from
Lemma 3, we have ๐๐(๐ฬ ๐) = ๐๐๐๐ก(๐๐(๐ฅ)).
Next we consider ๐ โ 1, from the Algorithm 2, gcd(๐๐(๐๐โ1), ๐๐(๐ฬ ๐)) = ๐๐(๐ฬ ๐โ1). Then because
๐๐(๐ฬ ๐) = ๐๐๐๐ก(๐๐(๐ฅ)) for ๐ โฅ ๐, gcd(๐๐(๐๐โ1), ๐๐๐๐ก(๐๐(๐ฅ))) = ๐๐(๐ฬ ๐โ1). So we need to show
๐๐(๐ฬ ๐โ1) = ๐๐๐๐ก(๐๐โ1(๐ฅ)).
First, ๐๐๐๐ก(๐๐โ1(๐ฅ))|๐๐(๐๐โ1) and according to the Lemma 3, ๐๐๐๐ก(๐๐โ1(๐ฅ))|๐๐๐๐ก(๐ฬ ๐(๐ฅ)), so
๐๐๐๐ก(๐๐โ1(๐ฅ))|gcd(๐๐(๐๐โ1), ๐๐๐๐ก(๐๐(๐ฅ))) = ๐๐(๐ฬ ๐โ1) . We suppose ๐๐(๐ฬ ๐โ1) = ๐ โ
๐๐๐๐ก(๐๐โ1(๐ฅ)) for a prime ๐. According to Lemma 4, ๐๐(๐ฬ ๐) = ๐๐๐๐ก(๐๐(๐ฅ)) = ๐๐๐๐ก(๐ฬ ๐(๐ฅ)) for
๐ โฅ ๐ , so we have ๐๐๐๐ก(๐๐โ1(๐ฅ))|๐๐๐๐ก(๐ฬ ๐โ1(๐ฅ)) . Also the step diminishes the leading
coefficient and ๐๐(๐ฬ ๐โ1)|๐๐(๐๐โ1), then ๐๐๐๐ก(๐ฬ ๐โ1(๐ฅ)) โค ๐๐๐๐ก(๐๐โ1(๐ฅ)). So ๐๐๐๐ก(๐๐โ1(๐ฅ)) =
๐๐๐๐ก(๐ฬ ๐โ1(๐ฅ)).
Consider the๐-th equation in improved subresultant algorithm,
๐ผ๐๐๐โ2(๐ฅ) = ๐๐(๐ฅ)๐๐โ1(๐ฅ) + ๐ฝ๐๐๐(๐ฅ)
here ๐ผ๐ = ๐๐(๐๐โ1)๐ฟ๐โ2+1
. Because ๐ โ ๐๐๐๐ก(๐๐โ1(๐ฅ))|๐๐(๐๐โ1) and ๐ โ
๐๐๐๐ก(๐๐โ1(๐ฅ))|๐๐๐๐ก(๐๐(๐ฅ)) , we know that ๐ โ (๐๐๐๐ก(๐๐โ1(๐ฅ)))
๐ฟ๐โ2+1
|๐ผ๐ and ๐ โ
๐๐๐๐ก(๐๐โ1(๐ฅ))|๐๐(๐ฅ) , which means, if we divide the equation above by ๐ = ๐ โ
(๐๐๐๐ก(๐๐โ1(๐ฅ)))
๐ฟ๐โ2+1
๐๐๐๐ก(๐๐โ2(๐ฅ)), then
๐ผ๐๐๐โ2(๐ฅ)
๐
and
๐ฝ๐๐๐(๐ฅ)
๐
both belong to โค[๐ฅ], while
๐๐(๐ฅ)๐๐โ1(๐ฅ)
๐
doesn't. This is a contradiction. So the proof is completed.
Using the results above, we realize that ๐๐(๐ก๐) is related to ๐๐ which is the unknown. We tried
some equations and found the following equation,
gcd(๐๐(๐ก๐), ๐๐(๐ฬ ๐โ1)) = ๐๐๐ (
๐๐(๐๐โ1)
๐๐(๐ฬ ๐โ1)
, ๐๐(๐ฬ ๐โ1))
for ๐ = 0,1,2, โฏ, ๐.Also in our experiments, the conjecture hold with extremely high probability.
4. A NEW ALGORITHM FOR COMPUTATION OF POLYNOMIAL GREATEST
COMMON
In this section, we give a probabilistic subresultant algorithm by applying the results in the last
section. We need to emphasis that the algorithm is not deterministic yet. The detail of the
algorithm is present as following.
14. Applied Mathematics and Sciences: An International Journal (MathSJ) Vol.9, No.2/3, September 2022
14
Algorithm 3 Probabilistic Subresultant Algorithm
Input: two polynomials ๐(๐ฅ), ๐(๐ฅ) โ โค[๐ฅ] with degree ๐ and ๐ respectively and ๐(๐ฅ) is monic and
irreducible
Output: Probabilistic subresultant PRS, ๐0(๐ฅ), ๐1(๐ฅ), โฏ
1.[Initialize] ๐ โ โ โ 1, ๐ข1(๐ฅ) โ ๐(๐ฅ),๐ข2(๐ฅ) โ ๐(๐ฅ),๐ โ 1
2.Compute ๐๐(๐ข2)๐ฟ+1
๐ข1(๐ฅ) โ ๐(๐ฅ)๐ข2(๐ฅ) = ๐(๐ฅ), here ๐๐๐(๐) < ๐๐๐(๐ข2), ๐ฟ = ๐๐๐(๐ข1) โ ๐๐๐(๐ข2)
3.๐ข(๐ฅ) โ ๐ข1(๐ฅ), ๐ข1(๐ฅ) โ ๐ข2(๐ฅ), ๐ข2(๐ฅ) โ ๐(๐ฅ)
4.When ๐๐๐(๐ข2) โ 0,
4.1 ๐ โ ๐๐(๐ข2), โ โ ๐๐ฟ
โ1โ๐ฟ
4.2 ๐ โ gcd(โ, ๐๐๐๐ก(๐ข2(๐ฅ))), ๐โฒ โ gcd(๐๐(๐ข)/๐๐๐๐ก(๐ข(๐ฅ)), ๐๐๐๐ก(๐ข(๐ฅ)))
4.3 ๐ โ/๐โฒ, ๐๐(๐ฅ) โ ๐(๐ฅ)/(๐โ๐ฟ
๐)
4.4 ๐ฟ = ๐๐๐(๐ข1) โ ๐๐๐(๐ข2)
4.5 Compute ๐๐(๐ข2)๐ฟ+1
๐ข1(๐ฅ) โ ๐(๐ฅ)๐ข2(๐ฅ) = ๐(๐ฅ), ๐๐๐(๐) < ๐๐๐(๐ข2), ๐ฟ = ๐๐๐(๐ข1) โ ๐๐๐(๐ข2)
4.6 ๐ข(๐ฅ) โ ๐ข1(๐ฅ), ๐ข1(๐ฅ) โ ๐ข2(๐ฅ), ๐ข2(๐ฅ) โ ๐(๐ฅ)/(๐โ๐ฟ
)
4.7 ๐ โ ๐ + 1
5.[Return] ๐0(๐ฅ), ๐1(๐ฅ), โฏ
For the often-used polynomials in ideal lattice-based cryptography ๐ฅ๐
+ 1 and ๐ฅ๐
โ ๐ฅ โ 1, here
๐ is a power of 2, we give the experiment results. For each polynomial, we sample 10000
examples randomly with coefficients in the range [-20,20] and the correctness is present below.
Polynomial ๐ฅ๐
+ 1 ๐ฅ๐
โ ๐ฅ โ 1
Correctness 97.88% 99.73%
5. CONCLUSIONS
In this paper, we give some results about the contents and small factors of remainders during
Euclidean algorithm of polynomials. By applying these results, we proposed a probabilistic
subresultant which can output correct remainders with high probability.
Due to the case of failure, the next research will be focus on the exact expression of each ๐๐ and
relation between ๐๐(๐ก๐) and cont(๐๐(๐ฅ)) to obtain a determinisitic improved subresultant
algorithm.
REFERENCES
[1] G.E. Collins. Subresultants and reduced polynomial remainder sequences. J. ACM, 14(1): 128--142
(1967)
[2] D.E. Knuth. The art of computer programming. Seminumerical Algorithms. vol. 2, 3rd Edition, 1998
(1st Edition, 1969)
[3] W.S. Brown. The subresultant PRS algorithm. ACM Trans. Math. Software, 4(3):237--249 (1978)
[4] Y. Zhang, R.Z. Liu, D.D. Lin. Fast Triangularization of Ideal Latttice Basis. Journal of Electronics
and Information Technology, 42(1): 98-104 (2020)
[5] Y. Zhang, R.Z. Liu, D.D. Lin. Improved Key Generation Algorithm for Gentry's Fully Homomorphic
Encryption Scheme. ICISC: 97-111 (2018)
[6] J Gathen, T Lรผcking. Subresultants Revisited. Latin American Symposium on Theoretical
Informatics, LNCS 1776: 318โ342