3

As far I understand it correctly, GF(Integer) is used to declare a finite field which can for example be used for declaring an elliptic curve (this is what I want to do).
But why using a very large composite number (2 or 3 thousands bits long) like :

GF(12092909088188237225393433017559174875623137613219078327682045681675023350320878590139619158941453632724570634378148379186020109423506557278061404249513976103803771139954000579995199902828634263992330574392218791796266323480026479977659504287064359209036331389750395884727865805793574046154686347934603866375769645860851559671200189106819576945533990794197558448169154800495832790107673176422796675256499746815795625450299074794144048526198146639914021389804755241528331708078456200260597013666698340612446162656471808349941941036242500801205678881620332591272087635015318077794473705628671572713897714140224506269671672327501746902155512482220944778556374239955378577691861316356789180373125486706142640931817968722234080019888921817141837856053156323850750365255047978587780912486395587404967932864588640269696396456375831408999624015664858331115319294937654521467886227817728683577618500683880562054279134724944161)

seems to take too much time to feasible ? How to declare a dummy elliptic curve using a finite‑field without using GF() ?

  • Finite field size must be a prime power – J. W. Tanner Jul 16 '24 at 18:41
  • 1
    @J.W.Tanner If I'm not mistaken that integer equals $p^{12}$ where $p$ is the prime number $21888 242871 839275 222246 405745 257275 088696 311157 297823 662689 037894 645226 208583$. – Servaes Jul 16 '24 at 18:49
  • @Servaes correct. I’m trying to exercise on weak curves. So I need to declare a curve using a composite of a large prime (though it would work on p⁶). By the way, which hardware did you use to factor that number that fast ? It seems you went faster than using ᴇᴄᴍ. – user2284570 Jul 16 '24 at 19:15
  • 2
    Sage factors that number in about 20 milliseconds on my computer. – John Palmieri Jul 16 '24 at 19:36
  • @JohnPalmieri sage or Sagecell? It doesn t seems to work when used in GF(). – user2284570 Jul 16 '24 at 20:16
  • Sage factors the number quickly, but I agree that GF(-) doesn't seem to work with it, at least not in a reasonable amount of time. – John Palmieri Jul 16 '24 at 20:49
  • @JohnPalmieri seems to be linked to https://github.com/sagemath/sage/issues/38376. I need to E_extend() points. How to declare the curve or E_extend() equivalent without using sage ? I need a workaround – user2284570 Jul 16 '24 at 21:36
  • 1
    I don't know if this is connected to your linked issue: GF(5**32) works fine on my machine, returning almost immediately, but GF(p**6) does not, where p is the prime number you're using. A number like $5^{32}$ is much smaller than the numbers you're using. – John Palmieri Jul 16 '24 at 23:14

1 Answers1

3

Answering the question of how to get the desired field. Leaving the construction of suitable elliptic curves to you, as I have zero experience with Sage. I hope this helps in your task in some way, but I am prepared to be wrong.

This seems to be relatively close to the limit of "simple computability" in the sense that it took a bit of tinkering to coerce Mathematica to find a suitable way. I like to think Sage has been programmed to be more efficient with number theoretic crunching, so I would welcome a confirmation of all of the following by Sage or any other CAS.

My starting point is @Servaes's observation that your cardinality is $p^{12}$ with $$ p=21888242871839275222246405745257275088696311157297823662689037894645226208583, $$ a prime number with $77$ digits. I want to extend the prime field $GF(p)$ by adjoining a root of unity of a smallish order $\ell$. To that end I first want to know which roots of unity are in the prime field, so I factor $$ p-1=2\cdot3^3\cdot13\cdot29\cdot67\cdot229\cdot311\cdot983\cdot11003\cdot 405928799\cdot11465965001\cdot13427688667394608761327070753331941386769. $$ Here the powers of $2$ and $3$ are of interest, because to get a field of cardinality $p^{12}$ we need $\ell$ to be a factor of $p^{12}-1$, but not to be a factor of $p^n-1$ for any $n$ that is a proper factor of $12$.

The well known properties of the Euler totient function suggest to look for numbers of the form $\ell=2^a\cdot 3^b$. A bit of testing reveals that $$\ell=864=2^5\cdot3^3$$ works for us in the sense that the residue class $$p\equiv 775\pmod{864}$$ has multiplicative order exactly twelve.

So we need to adjoin a root of unity of order $864$. To do that we need a modular factorization of the cyclotomic polynomial $$ \Phi_{864}(x)=x^{288}-x^{144}+1 $$ in the ring $GF(p)[x]$.

I was delighted to see that the Mathematica implementation of modular factorization algorithms (don't know which they are using) worked. It took a while, but it gave a factorization of $\Phi_{864}(x)$ consisting of the expected $24$ degree $12$ factors $f_i(x)$, $1\le i\le 24$, one of which is $$ f_1(x)=1989524725549740340342230321930199252175174949955210132320435129795479 5986100 + 469168846834798856517972474313896222613925797978349957617992393054855 137997 x^6 + x^{12}. $$ Furthermore, all the factors $f_i(x)$ have the shape $f_i(x)=g_i(x^6)$, where the polynomials $g_i(x)$ are irreducible quadratics. It behooves me to explain this phenomenon, as it points at possible extensions of this technique (possibly widening the range of extension degrees that can be covered).

As $864=6\cdot144$, the polynomials $g_i(x)$ must be factors of the cyclotomic polynomial $$ \Phi_{144}(x)=x^{48}-x^{24}+1. $$ We have $$p\equiv55\pmod{144},\qquad p^2\equiv1\pmod{144},$$ so $p$ has order two modulo $48$, whence $\Phi_{144}(x)$ factors into a product of quadratics $g_i(x), 1\le i\le 24$, modulo $p$. The catch is that if $\zeta\in K:=GF(p^2)$ is a root of unity of order $144$, then ALL the roots of the polynomial $$h(x)=x^6-\zeta\in K[x]$$ necessarily have multiplicative order $6\cdot144=864$ because both $2$ and $3$ already appear as factors of $144$. So any zero of $h(x)$ generates the desired field $L:=GF(p^{12})$. As $[L:K]=6$, it follows that $h(x)$ is irreducible over $K$ and that $g_i(x^6)$ must also be irreducible over the prime field.

Anyway, you can construct $L$ as $$ L=GF(p)[x]/\langle f_1(x)\rangle $$ in the usual way.

Jyrki Lahtonen
  • 140,891
  • Factoring $\Phi_{864}(x)$ modulo $p$ took a while, but succeeded. So that's why I was happy to start putting together an answer at that point. In retrospect I should have reverse enginereed the end game, and begin with a factorization of $\Phi_{144}(x)$, which takes 1-2 seconds by Mathematica. Adding this, because it may be possible to get $GF(p^{12m})$ for a few selected values of $m>1$ with this exact process. Assuming the residue class arithmetic plays out nicely :-) – Jyrki Lahtonen Jul 18 '24 at 04:29
  • Your answer is basically how to enhance Sagemath s source code without understanding it doesn t compile on rpm based linux. This isn t a workaround. The problem isn t factorizarion but building pseudo conway polynomials which isn t needed for using a curve. I recognize my post is only a language question (How to declare a curve witout GF). Not a math problem – user2284570 Jul 18 '24 at 07:40
  • I felt that I am answering the first question. I'm sure Sage has a mechanism for creating such a quotient field of the polynomial ring. And, surely Sage has a way of declaring an elliptic curve over a field that you first define. Sorry to hear that you wanted something else. I am not worried about Conway polynomials. If that is relevant to you, you could make the question more specific, so that people who have used Sage can help you. – Jyrki Lahtonen Jul 18 '24 at 08:30
  • I wrote in my initial question that I want to perform operations on elliptic curves. You didn t read it correctly. – user2284570 Jul 18 '24 at 08:53
  • Your question still makes it sound like constructing the field is the part you don't know how to accomplish. So once you have the field, you can define an elliptic curve, and let Sage do its usual stuff on it? Then again I have never studied Sage, this is just the impression I have. It is possible that I am mixing Sage with a snippet for some other CAS, where it went 1) define the field, 2) define the EC, 3) use the predefined operations on the EC. Apparently you don't have that workflow. Shrug. – Jyrki Lahtonen Jul 18 '24 at 18:22