## Linear recurrences with polynomial coefficients and computation of the Cartier-Manin operator on hyperelliptic curves (2004)

### Cached

### Download Links

- [www.s1on1.com]
- [algo.inria.fr]
- [www-rocq.inria.fr]
- DBLP

### Other Repositories/Bibliography

Venue: | In International Conference on Finite Fields and Applications (Toulouse |

Citations: | 21 - 8 self |

### BibTeX

@INPROCEEDINGS{Bostan04linearrecurrences,

author = {Alin Bostan and Pierrick Gaudry and Éric Schost},

title = {Linear recurrences with polynomial coefficients and computation of the Cartier-Manin operator on hyperelliptic curves},

booktitle = {In International Conference on Finite Fields and Applications (Toulouse},

year = {2004},

pages = {40--58},

publisher = {Springer-Verlag}

}

### OpenURL

### Abstract

Abstract. We study the complexity of computing one or several terms (not necessarily consecutive) in a recurrence with polynomial coefficients. As applications, we improve the best currently known upper bounds for factoring integers deterministically and for computing the Cartier–Manin operator of hyperelliptic curves.

### Citations

818 | The arithmetic of elliptic curves - Silverman - 1986 |

801 |
Matrix multiplications via arithmetic progressions
- Coppersmith, Winograd
- 1990
(Show Context)
Citation Context ... space O(n2 ). Thus, one can take MM(n) ∈ O(n3 ) using classical multiplication, and MM(n) ∈ O(nlog 7 ) ⊂ O(n2.81 ) using Strassen’s algorithm [46]. We do not know whether the current record estimate =-=[13]-=- of O(n2.38 ) satisfies our requirements. Note that n2 ≤ MM(n); see [8, Chapter 15]. 2.2. Boolean complexity model. In sections 5 and 8, we discuss the complexity of factoring integers and of computin... |

616 |
The Magma algebra system. I. The user language
- Bosma, Cannon, et al.
- 1997
(Show Context)
Citation Context ... the Schoof-like algorithms of [19] to compute χ modulo 128 × 9 × 5 × 7, and finally we used the modified BSGS algorithm of [29] to finish the computation. These other parts were implemented in Magma =-=[5]-=- and were performed in about 15 days of computation on an Alpha EV67 at 667 MHz. This computation was meant as an illustration of the possible use of our method, so little time was spent optimizing ou... |

429 |
zur Gathen and
- von
- 1999
(Show Context)
Citation Context ...torization of any positive integer N using at most O(Mint( 4√ N log N)) bit operations. The space complexity is O( 4√ N log N) bits. Our proof closely follows that of Strassen, in the presentation of =-=[15]-=-, the main ingredient being now Theorem 8; some additional complications arise due to the nontrivial invertibility conditions required by that theorem. First, applying Lemma 3 (with m = 1) gives the d... |

373 |
Gaussian elimination is not optimal
- Strassen
- 1969
(Show Context)
Citation Context ...ny ring can be computed in MM(n) base ring operations, in space O(n2 ). Thus, one can take MM(n) ∈ O(n3 ) using classical multiplication, and MM(n) ∈ O(nlog 7 ) ⊂ O(n2.81 ) using Strassen’s algorithm =-=[46]-=-. We do not know whether the current record estimate [13] of O(n2.38 ) satisfies our requirements. Note that n2 ≤ MM(n); see [8, Chapter 15]. 2.2. Boolean complexity model. In sections 5 and 8, we dis... |

248 |
Seminumerical Algorithms
- Knuth
- 1998
(Show Context)
Citation Context ... d). Euclidean division in bit-size d can be done in time O(Mint(d)) and space O(d); see [12]. The extended gcd of two bit-size d integers can be computed in time O(Mint(d) log d) and space O(d); see =-=[25, 38]-=-. Effective rings. We next introduce effective rings as a way to obtain results of a general nature in the Turing model. Let R be a finite ring, let ℓ be in N, and consider an injection σ : R ↩→ {0,1}... |

186 |
Speeding the Pollard and elliptic curve methods of factorization
- Montgomery
- 1987
(Show Context)
Citation Context ...ents that have to be stored, or of “space requirements”; such quantities correspond to the number of pebbles in the underlying pebble game. Basic operations. Let R be a ring. The following lemma (see =-=[32]-=- and [33, p. 66]) shows how to trade inversions (when they are possible) for multiplications. r −1 0 Lemma 1. Let r0,... ,rd be units in R. Given (r0 ···rd) −1 , one can compute ,... ,r−1 d in O(d) op... |

151 | Fast multiplication of polynomials over arbitrary algebras
- Cantor, Kaltofen
- 1991
(Show Context)
Citation Context ...ithms for polynomials. We denote by M : N −{0} →N a function such that over any ring, the product of polynomials of degree less than d can be computed in M(d) ring operations. Using the algorithms of =-=[41, 39, 9]-=-, M(d) can be taken in O(d log d log log d). Following [15, Chapter 8], we suppose that for all d and d ′ , M satisfies the inequalities M(d) d ≤ M(d′ ) d ′ if d ≤ d ′ and M(dd ′ ) ≤ d 2 M(d ′ (2) ), ... |

116 |
On computing the determinant in small parallel time using a small number of processors
- Berkowitz
- 1984
(Show Context)
Citation Context ...ost of the characteristic polynomial computation of an n × n matrix defined over an effective ring can be bounded by O(n 4 ) operations in the ring using a sequential version of Berkowitz’s algorithm =-=[1]-=-. This adds a negligible O(g 4 Mint(d log(dp))) contribution to the complexity.s1800 ALIN BOSTAN, PIERRICK GAUDRY, AND ÉRIC SCHOST If we are interested only in the complexity in p and d, i.e., if we a... |

81 | Counting points on hyperelliptic curves using Monsky-Washnitzer cohomology
- Kedlaya
(Show Context)
Citation Context ...ns. This improves the methods of [18] and [29] which have a complexity essentially linear in p. Note that when p is small enough, other methods, such as the p-adic methods used in Kedlaya’s algorithm =-=[24]-=-, also provide very efficient pointcounting procedures, but their complexity is at least linear in p; see [17]. Main algorithmic ideas. We briefly recall Strassen’s factorization algorithm and Chudnov... |

72 |
Theorems on factorization and primality testing
- Pollard
(Show Context)
Citation Context ...it complexity in O � Mint( 4√ N log N) � . To our knowledge, this gives the fastest deterministic integer factorization algorithm. Prior to Strassen’s work, the record was held by Pollard’s algorithm =-=[35]-=-; for any δ >0, its bit complexity is in O(Mint( 4√ N log N)N δ ). Other deterministic factorization algorithms exist [36, 30]; some have a better conjectured complexity, whose validity relies on unpr... |

70 |
NTL: A library for doing number theory,” http: //www.shoup.net/ntl
- Shoup
(Show Context)
Citation Context ...X X X X X X X Approx. X X X X X MCT X X CM X X X X X X Cplx. p3/4 p1/2 p3/2 p1/2 p9/4 p5/4 p p1/2 p2 p3/2 p3 p5/2 Computer experiments. We have implemented our algorithm using Shoup’s NTL C++ library =-=[42]-=-. NTL does not provide any arithmetic of local fields or rings, but allows one to work in finite extensions of rings of the form Z/pgZ, as long as no divisions by p occur; the divisions by p are well ... |

69 | The Number Field Sieve
- Lenstra, Jr, et al.
- 1990
(Show Context)
Citation Context ...d complexity bound, is due to Lenstra, Jr. and Pomerance [27], with a bit complexity polynomial insLINEAR RECURRENCES WITH POLYNOMIAL COEFFICIENTS 1779 exp( √ log N log log N). The number field sieve =-=[26]-=- has a better conjectured complexity, expected to be polynomial in exp( 3� log N(log log N) 2 ). In accordance with these estimates, the latter algorithms are better suited for practical computations ... |

63 | Challenges of symbolic computation: my favorite open problems - Kaltofen |

63 |
The canonical lift of an ordinary elliptic curve over a prime field and its point counting
- Satoh
- 2000
(Show Context)
Citation Context ...od p is computed. We now survey different ways to complete the computation; we give rough complexity estimates, neglecting the logarithmic factors. If p is small compared to g or d, p-adic algorithms =-=[24, 37]-=- have the best asymptotic complexity. These algorithms compute χ modulo high powers of p, so they necessarily recompute the information that has been obtained via the Cartier–Manin operator. Hence, ou... |

60 |
Schnelle Berechnung von Kettenbruchentwicklungen
- Schönhage
- 1971
(Show Context)
Citation Context ... d). Euclidean division in bit-size d can be done in time O(Mint(d)) and space O(d); see [12]. The extended gcd of two bit-size d integers can be computed in time O(Mint(d) log d) and space O(d); see =-=[25, 38]-=-. Effective rings. We next introduce effective rings as a way to obtain results of a general nature in the Turing model. Let R be a finite ring, let ℓ be in N, and consider an injection σ : R ↩→ {0,1}... |

58 |
On the Minimum Computation Time of Functions
- Cook
- 1966
(Show Context)
Citation Context ...gorithm of [41], Mint(d) can be taken insLINEAR RECURRENCES WITH POLYNOMIAL COEFFICIENTS 1783 O(d log d log log d). Euclidean division in bit-size d can be done in time O(Mint(d)) and space O(d); see =-=[12]-=-. The extended gcd of two bit-size d integers can be computed in time O(Mint(d) log d) and space O(d); see [25, 38]. Effective rings. We next introduce effective rings as a way to obtain results of a ... |

58 | Counting Points on Hyperelliptic Curves over Finite Fields
- Gaudry, Harley
- 2000
(Show Context)
Citation Context ...lly linear in √ p. For instance, in a fixed genus, for a curve defined over the finite field Fp, the complexity of our algorithm is O � Mint( √ p log p) � bit operations. This improves the methods of =-=[18]-=- and [29] which have a complexity essentially linear in p. Note that when p is small enough, other methods, such as the p-adic methods used in Kedlaya’s algorithm [24], also provide very efficient poi... |

57 |
Schnelle Multiplikation von Polynomen über Körpern der Charakteristik 2
- Schönhage
- 1977
(Show Context)
Citation Context ...ithms for polynomials. We denote by M : N −{0} →N a function such that over any ring, the product of polynomials of degree less than d can be computed in M(d) ring operations. Using the algorithms of =-=[41, 39, 9]-=-, M(d) can be taken in O(d log d log log d). Following [15, Chapter 8], we suppose that for all d and d ′ , M satisfies the inequalities M(d) d ≤ M(d′ ) d ′ if d ≤ d ′ and M(dd ′ ) ≤ d 2 M(d ′ (2) ), ... |

54 |
M.: Algebraic complexity theory, Grundlehren der Mathematischen Wissenschaften
- Bürgisser, Clausen, et al.
- 1997
(Show Context)
Citation Context ...ithms of sections 3, 4, 6, and 7 apply over arbitrary rings. To give complexity estimates, we use the straight-line program model, counting at unit cost the operations (+, −, ×) in the base ring; see =-=[8]-=-. Hence, the time complexity of an algorithm is the size of the underlying straight-line program; we will simply speak of “ring operations.” Branching and divisions are not used; thus, if we need the ... |

53 |
Analysis and comparison of some integer factoring algorithms
- Pomerance
- 1982
(Show Context)
Citation Context ...gorithm. Prior to Strassen’s work, the record was held by Pollard’s algorithm [35]; for any δ >0, its bit complexity is in O(Mint( 4√ N log N)N δ ). Other deterministic factorization algorithms exist =-=[36, 30]-=-; some have a better conjectured complexity, whose validity relies on unproved number-theoretic conjectures. The fastest probabilistic algorithm for integer factorization, with a fully established com... |

50 |
Frobenius maps of abelian varieties and finding roots of unity in finite fields
- Pila
- 1990
(Show Context)
Citation Context ... p, so they necessarily recompute the information that has been obtained via the Cartier–Manin operator. Hence, our approach is of no interest here. Consider next the extensions of Schoof’s algorithm =-=[34]-=-. These algorithms have a complexity that is polynomial in d log p and exponential in g. For fixed g, our algorithm will be faster only if p is small compared to d, so that the power of d in the compl... |

47 |
Approximations and complex multiplication according to Ramanujan, Ramanujan revisited (Urbana-Champaign
- Chudnovsky, Chudnovsky
- 1987
(Show Context)
Citation Context ...ogarithmic in N, using binary powering. In the general case, there is a significant gap, as no algorithm with a complexity polynomial in (log N) is known. However, Chudnovsky and Chudnovsky showed in =-=[11]-=- how to compute one term in such a sequence without computing all intermediate ones. This algorithm is closely related to Strassen’s algorithm [48] for integer factorization; using baby steps/giant st... |

43 |
A rigorous time bound for factoring integers
- Pomerance
- 1992
(Show Context)
Citation Context ...alidity relies on unproved number-theoretic conjectures. The fastest probabilistic algorithm for integer factorization, with a fully established complexity bound, is due to Lenstra, Jr. and Pomerance =-=[27]-=-, with a bit complexity polynomial insLINEAR RECURRENCES WITH POLYNOMIAL COEFFICIENTS 1779 exp( √ log N log log N). The number field sieve [26] has a better conjectured complexity, expected to be poly... |

40 | An FFT Extension of the Elliptic Curve Method of Factorization - Montgomery - 1992 |

37 | Construction of secure random curves of genus 2 over prime fields
- Gaudry, Schost
- 2004
(Show Context)
Citation Context ...ul, and can be of practical interest. Indeed, as far as we know, there is no implementation of any Schoof-like approach for genus greater than 2, and even for genus 2, the current record computations =-=[19, 29]-=- are obtained by combining many methods, including the baby steps/giant steps approach. Here is thus a short description of known approaches using BSGS ideas: 1. BSGS method: This is the generic metho... |

36 |
On the Jacobian varieties of hyperelliptic curves over fields of characteristic p > 2
- Yui
- 1978
(Show Context)
Citation Context ...ed that this matrix is strongly related to the action of the Frobenius endomorphism on i=1 kisLINEAR RECURRENCES WITH POLYNOMIAL COEFFICIENTS 1797 the p-torsion part of the Jacobian of C. The article =-=[50]-=- provides a complete survey about these facts; they are summarized in the following theorem. Theorem 16 (Manin). Let Hπ = HH (p) ···H (pd−1 ) , where the notation H (q) means elementwise raising to th... |

34 |
Tellegen’s principle into practice
- Bostan, Lecerf, et al.
(Show Context)
Citation Context ...that d ≤ M(d); the second one is used to derive the inclusion M(O(d)) ⊂ O(M(d)). We use the following results for arithmetic over a ring R. The earliest references we know of are [22, 31, 47, 4], and =-=[7]-=- gives more recent algorithms. Evaluation. If P is in R[X], of degree at most d, and r0,... ,rd are in R, then P(r0),... ,P(rd) can be computed in time O(M(d) log d) and space O(d log d). Using the al... |

31 |
Die Berechnungskomplexität von elementarsymmetrischen Funktionen und von
- Strassen
- 1973
(Show Context)
Citation Context ... ) ≤ M(d + d ′ ) and that d ≤ M(d); the second one is used to derive the inclusion M(O(d)) ⊂ O(M(d)). We use the following results for arithmetic over a ring R. The earliest references we know of are =-=[22, 31, 47, 4]-=-, and [7] gives more recent algorithms. Evaluation. If P is in R[X], of degree at most d, and r0,... ,rd are in R, then P(r0),... ,P(rd) can be computed in time O(M(d) log d) and space O(d log d). Usi... |

28 | Fast modular transforms
- Borodin, Moenck
- 1974
(Show Context)
Citation Context ... ) ≤ M(d + d ′ ) and that d ≤ M(d); the second one is used to derive the inclusion M(O(d)) ⊂ O(M(d)). We use the following results for arithmetic over a ring R. The earliest references we know of are =-=[22, 31, 47, 4]-=-, and [7] gives more recent algorithms. Evaluation. If P is in R[X], of degree at most d, and r0,... ,rd are in R, then P(r0),... ,P(rd) can be computed in time O(M(d) log d) and space O(d log d). Usi... |

22 |
Fast modular transforms via division
- MOENCK, BORODIN
- 1972
(Show Context)
Citation Context ... ) ≤ M(d + d ′ ) and that d ≤ M(d); the second one is used to derive the inclusion M(O(d)) ⊂ O(M(d)). We use the following results for arithmetic over a ring R. The earliest references we know of are =-=[22, 31, 47, 4]-=-, and [7] gives more recent algorithms. Evaluation. If P is in R[X], of degree at most d, and r0,... ,rd are in R, then P(r0),... ,P(rd) can be computed in time O(M(d) log d) and space O(d log d). Usi... |

20 |
A general network theorem with applications
- Tellegen
- 1953
(Show Context)
Citation Context ...t it can be computed in time M(d)+O(d) (but with a possible loss in space complexity): this is the transposition principle for linear algorithms, which is an analogue of results initiated by Tellegen =-=[49]-=- and Bordewijk [2] in circuit theory. Thus, the time complexity of the algorithm above can be reduced to M(d)+O(d) ring operations, but possibly with an increased space complexity. We refer to [23, Pr... |

18 |
Une nouvelle opération sur les formes différentielles
- Cartier
- 1957
(Show Context)
Citation Context ...], proving unconditional, deterministic upper bounds remains an important challenge. Our second application is point-counting in cryptography, related to the computation of the Cartier–Manin operator =-=[10, 28]-=- of hyperelliptic curves over finite fields. The basic ideas already appear for elliptic curves [44, Chapter V]. Suppose we are to count the number n of solutions of the equation y2 = f(x) over Fp, wh... |

18 |
The middle product algorithm I. speeding up the division and square root of power series
- Hanrot, Quercia, et al.
(Show Context)
Citation Context ...) are computed at an additional cost of O(dmR), since again everything is well organized. This concludes the time analysis. The space complexity is easily seen to fit the required bound. Remark 1. In =-=[20]-=-, the operation called middle product is defined: Given a ring R, and A, B in R[X] of respective degrees at most d and 2d, write AB = C0 + C1X d+1 + C2X 2d+2 , with all Ci of degree at most d; then th... |

18 | A fast deterministic algorithm for factoring polynomials over finite fields of small characteristic - Shoup - 1991 |

18 |
Some methods for evaluating the regulator of a real quadratic function field, Experiment
- Stein, Williams
- 1999
(Show Context)
Citation Context ...unting (naively) the points of C up to extension degree k costs O(pdk ), and the cost of the BSGS algorithm beg k+1 d( comes O(q 2 − 4 ) ). This method (and additional practical improvements) is from =-=[45]-=-. We call it “approximation method” below. 3. When χ is known modulo some integer M, the group order is also known modulo M and therefore the BSGS method can be sped up by a factor ofsLINEAR RECURRENC... |

17 |
An improved baby step giant step algorithm for point counting of hyperelliptic curves over finite fields
- Matsuo, Chao, et al.
- 2002
(Show Context)
Citation Context ...r in √ p. For instance, in a fixed genus, for a curve defined over the finite field Fp, the complexity of our algorithm is O � Mint( √ p log p) � bit operations. This improves the methods of [18] and =-=[29]-=- which have a complexity essentially linear in p. Note that when p is small enough, other methods, such as the p-adic methods used in Kedlaya’s algorithm [24], also provide very efficient pointcountin... |

17 |
Einige Resultate über Berechnungskomplexität
- Strassen
- 1976
(Show Context)
Citation Context ... known. However, Chudnovsky and Chudnovsky showed in [11] how to compute one term in such a sequence without computing all intermediate ones. This algorithm is closely related to Strassen’s algorithm =-=[48]-=- for integer factorization; using baby steps/giant steps (BSGS) techniques, it requires a number of operations which are roughly linear in √ N to compute the Nth term. Precisely, let R be a commutativ... |

15 |
Inter-reciprocity applied to electrical networks
- Bordewijk
- 1956
(Show Context)
Citation Context ...d in time M(d)+O(d) (but with a possible loss in space complexity): this is the transposition principle for linear algorithms, which is an analogue of results initiated by Tellegen [49] and Bordewijk =-=[2]-=- in circuit theory. Thus, the time complexity of the algorithm above can be reduced to M(d)+O(d) ring operations, but possibly with an increased space complexity. We refer to [23, Problem 6] for a lon... |

15 |
Time Space Tradeoffs (Getting Closer to the Barrier
- BORODIN
- 1993
(Show Context)
Citation Context ...of some elements, they will be given as inputs to the algorithm. To assign a notion of space complexity to a straight-line program, we play a pebble game on the underlying directed acyclic graph; see =-=[3]-=- for a description. However, we will not use such a detailed presentation: we will simply speak of the number of ring elements that have to be stored, or of “space requirements”; such quantities corre... |

15 |
Counting points in medium characteristic using Kedlaya’s algorithm
- Gaudry, Gürel
(Show Context)
Citation Context ... p is small enough, other methods, such as the p-adic methods used in Kedlaya’s algorithm [24], also provide very efficient pointcounting procedures, but their complexity is at least linear in p; see =-=[17]-=-. Main algorithmic ideas. We briefly recall Strassen’s factorization algorithm and Chudnovsky and Chudnovsky’s generalization, and describe our modifications. To factor an integer N, trial division wi... |

15 |
Zyklische unverzweigte Erweiterungskörper vom Primzahlgrade p über einem algebraischen Funktionenkörper der Characteristik p
- Hasse, Witt
- 1936
(Show Context)
Citation Context ...tion of C is of the form y 2 = f(x), where f is monic and square free, of degree 2g + 1. The generalization to hyperelliptic curves of the Hasse invariant for elliptic curves is the Hasse–Witt matrix =-=[21]-=-: Let hk be the coefficient of degree x k in the polynomial f (p−1)/2 . The Hasse–Witt matrix is the g×g matrix with coefficients in F p d given by H =(hip−j)1≤i,j≤g. It represents, in a suitable basi... |

14 |
The Hasse-Witt matrix of an algebraic curve
- Manin
- 1965
(Show Context)
Citation Context ...], proving unconditional, deterministic upper bounds remains an important challenge. Our second application is point-counting in cryptography, related to the computation of the Cartier–Manin operator =-=[10, 28]-=- of hyperelliptic curves over finite fields. The basic ideas already appear for elliptic curves [44, Chapter V]. Suppose we are to count the number n of solutions of the equation y2 = f(x) over Fp, wh... |

9 |
A fast method for interpolation using preconditioning
- Horowitz
- 1972
(Show Context)
Citation Context |

6 | Old and New Deterministic Factoring Algorithms
- McKee, Pinch
- 1996
(Show Context)
Citation Context ...gorithm. Prior to Strassen’s work, the record was held by Pollard’s algorithm [35]; for any δ >0, its bit complexity is in O(Mint( 4√ N log N)N δ ). Other deterministic factorization algorithms exist =-=[36, 30]-=-; some have a better conjectured complexity, whose validity relies on unproved number-theoretic conjectures. The fastest probabilistic algorithm for integer factorization, with a fully established com... |

6 |
Schnelle Multiplikation großer
- Schönhage, Strassen
- 1971
(Show Context)
Citation Context ...ithms for polynomials. We denote by M : N −{0} →N a function such that over any ring, the product of polynomials of degree less than d can be computed in M(d) ring operations. Using the algorithms of =-=[41, 39, 9]-=-, M(d) can be taken in O(d log d log log d). Following [15, Chapter 8], we suppose that for all d and d ′ , M satisfies the inequalities M(d) d ≤ M(d′ ) d ′ if d ≤ d ′ and M(dd ′ ) ≤ d 2 M(d ′ (2) ), ... |

5 |
Fast Algorithms. Bibliographisches Institut
- Schönhage, Grotefeld, et al.
- 1994
(Show Context)
Citation Context ...in operator on curves over finite fields. For these applications, the proper complexity measure is bit complexity. For this purpose, our model will be the multitape Turing machine; see, for instance, =-=[40]-=-. We will speak of bit operations to estimate time complexities in this model. Storage requirements will be expressed in bits as well, taking into account input, output, and intermediate data size. Bo... |

4 | The SIGSAM challenges: Symbolic asymptotics in practice
- Flajolet, Salvy
- 1997
(Show Context)
Citation Context ...s of the previous sections. We will make the additional assumption that the constant term of f is not zero; otherwise, the problem is actually simpler. Introduction of a linear recurrent sequence. In =-=[14]-=-, Flajolet and Salvy already treated the question of computing a selected coefficient in a high power of some given polynomial, as an answer to a SIGSAM challenge. The key point of their approach is t... |