Computing Multiplicative Inverses in Finite Fields by Long Division

Home , Finite field arithmetic, Long division, Multiplicative inverse

sciendo Journal of ELECTRICAL ENGINEERING, VOL 69 (2018), NO5, 400–402

COMMUNICATIONS

Computing multiplicative inverses in ﬁnite ﬁelds by long division

∗ Otokar Groˇsek, Tom´aˇsFabˇsiˇc

We study a method of computing multiplicative inverses in finite fields using long division. In the case of fields of a prime order p, we construct one fixed integer d(p) with the property that for any nonzero field element a, we can compute its inverse by dividing d(p) by a and by reducing the result modulo p. We show how to construct the smallest d(p) with this property. We demonstrate that a similar approach works in finite fields of a non-prime order, as well. However, we demonstrate that the studied method (in both cases) has worse asymptotic complexity than the extended Euclidean algorithm. K e y w o r d s: finite fields, multiplicative inverses

1 Introduction Thus to find an inverse mod p requires one long division and one reduction mod p. Computing a multiplicative inverse in a finite field is a This approach, although very laborious, has an in- common operation used in cryptography. For instance, it teresting history [4–6]. J. Waring in Meditationes alge- is a key operation in the cryptographic standard AES [1]. braicae, Cambridge, 1770, p. 218, first published the the- After M. Repka studied the McEliece cryptosystem orem that p|1 + (p − 1)! ascribing it to Sir John Wilson in [2], he set the question (in personal communication, (1714–93). J. L. Lagrange was the first to publish a proof 2017) if would be possible to find multiplicative inverses also with the converse in Nouv. Mém. Acad. Roy, Berlin, F in 2[x]/(f(x)) by dividing one fixed polynomial by field 2, 1773, anne 1771, p. 125. elements. Here we present this problem in a more complex Also Ibn al-Haytham (c. 1000 AD) solved problems form. The result is positive, but probably not valuable for involving congruences using Wilson’s theorem [5]. a real application since the extended Euclidean algorithm (EEA) is asymptotically faster. Finally, J. P. M. Binet in Comptes Rendus Paris, 13, A number of methods for calculating a multiplicative 1841, pp. 210–13, employed Wilson’s theorem to find the inverse for an element a of a finite field are known. Below, inverse element to a by −(p − 1)!/a. we list the methods mentioned in [3]: This method for finding inverses mod p relies on two 1. Multiplying a by elements in the field until the prod- facts: Let d = (p − 1) (p − 1)! , then uct is one. m −1 Z∗ 2. Calculating the inverse of a ∈ GF(p ) as a = 1. for any a ∈ p , d is divisible by a, and m ap −2 . 2. d = 1 mod p. 3. By using the extended Euclidean algorithm. Now a question arises: For a prime p, find the smallest 4. By making a logarithm table of the finite field, and possible number d = d(p) satisfying these two conditions. performing subtraction in the table. Clearly, d(p) ≤ (p − 1) (p − 1)! , eg d(5) ≤ 96, d(7) ≤ Z∗ Another method, which is not mentioned on the web- 4320. Then for any a ∈ p , page [3], is based on so called Wilson’s Theorem: −1 Theorem 1. For any n, d(p)/a mod p = a . (2)

(n − 1)! = −1 mod n , if and only if n is a prime number. 2 Finding d(p) From Wilson’s Theorem it follows that if p is prime, Z∗ −1 It is not diﬃcult to observe that d(p) can be found in then for any a ∈ p , we can compute a as two steps. First, ﬁnd ℓ(p) = LCM(1,... ,p−1), and then Z∗ (p − 1) (p − 1)! h(p) ∈ p such that h(p)ℓ(p) = 1 mod p. The searched a−1 = mod p . (1) a number will be d(p)= h(p)ℓ(p).

* Faculty of Electrical Engineering and Information Technology, Slovak University of Technology in Bratislava, Ilkoviˇcova 3, 812 19 Bratislava, Slovakia, {otokar.grosek, tomas.fabsic}@stuba.sk

DOI: 10.2478/jee-2018–0059, Print (till 2015) ISSN 1335-3632, On-line ISSN 1339-309X c 2018FEI STU Journal of ELECTRICAL ENGINEERING 69 (2018), NO5 401

The magnitude of d(p) can be estimated as follows [7]: Theorem 3. Let q = pm , where p is prime and m ≥ 1. Let π(n) denotes the number of primes not exceeding n. The product I(q, k; x) of all monic irreducible polynomi- Then for any n ≥ 2, we have als in Fq[x] of degree k is given by ln ℓ(n) qd µ( k ) qk/d µ(d) π(n) ≥ , (3) I(q, k; x)= (x − x) d = (x − x) . (6) ln n Y Y d|k d|k or ln ℓ(n) lim =1. (4) Z n→+∞ n Let f(x) be an irreducible polynomial in p[x] of the degree m. Our goal is to find a polynomial d(x) in Z [x] Thus from a form of the Prime Number Theorem it fol- p such that lows that actually 1. for any a(x) ∈ Zp[x]/(f(x)) \{0}, d(x) is divisible by LCM(1,...,n) ≈ eψ(n), a(x), 2. d(x) = 1 mod f(x), and where ψ is the Chebyshev’s function, ψ(x) = x + o(x), 3. the polynomial d(x) is of the least degree. as x → +∞. Thus for a large p, d(p) is a very large number. To satisfy the first and the third condition, we are searching for We will illustrate our approach by an example. Example 1. Let p = 7,a = 5. Our goal is to find ℓ(x) = LCM{u(x) ∈ Zp[x]/(f(x)),u(x) 6=0}. (7) 5−1 mod 7. We compute ℓ(7) = 60, h(7) = 2, d(7) = −1 120, d(7)/5=24 and 5 = 24 mod 7 = 3. From Theorem 3, it is not difficult to see that Now, we will estimate the complexity of this method. m−1 We ignore the complexity of computing d(p), since it has −1 ⌊ m ⌋ ℓ(x)= I(p, k; x) k . (8) to be done only once, and afterwards the same d(p) can Y Z∗ k=1 be used for computing all multiplicative inverse in p . By [8] the following is valid: The degree of this polynomial is 1. Complexity of division d(p)/a is O (log d(p) )(log a) . 2 a 2 Thus the complexity of the method can be estimated m −1 m − 1 as O (log d(p))(log p). t = deg ℓ(x)= N (k)k⌊ ⌋. (9) 2 2 X p k 2. Complexity of the extended Euclidean algorithm is k=1 O (log p)2 . 2 Thus EEA is asymptotically faster than our new algo- To satisfy the second condition, let h(x) ∈ Zp[x]/(f(x)) rithm. be such that h(x)ℓ(x) = 1 mod f(x). The polynomial d(x)= h(x)ℓ(x) then satisfies all required conditions.

m 3 A generalization for a field GF(p ) Theorem 4. Let us consider a finite field Zp[x]/(f(x)), where f(x) is an irreducible polynomial of the degree m In this section, we will use a similar approach for a in Zp[x]. Let us consider the polynomial finite field GF(pm) with m > 1. The role of primes in the previous section will be played by irreducible polyno- d(x)= h(x)ℓ(x) , mials. Thus we start with three well known facts [9]. Definition 1. The Moebius function µ is the function where ℓ(x) is defined by (8) and h(x) is a polynomial Z on N defined by in p[x]/(f(x)) such that h(x)ℓ(x) = 1 mod f(x). Then d(x) satisfies the following property: µ(n) For any a(x) ∈ Zp[x]/(f(x)), a(x) 6=0, we can compute −1 1, if n =1 , a(x) as  =  (−1)k, if n is the product of k distinct primes,  a(x)−1 = d(x)/a(x) mod f(x) . 0, if n is divisible by the square of a prime.  Moreover, the polynomial d(x) is the monic polynomial Theorem 2. m Let q = p , where p is prime and m ≥ 1. with the least degree in Zp[x] which satisfies this prop- The number Nq(k) of monic irreducible polynomials in erty. The degree of d(x) is Fq[x] of degree k is given by deg d(x)= t + deg h(x)

Example 2. Let f(x) be the AES polynomial, ie f(x)= For the ﬁeld GF(28) (which is used in AES, for exam- x8 + x4 + x3 + x + 1. Then t = 254, deg h(x) < 8, ple), we experimentally found (the experiment was per- deg d(x) < 262. The calculation in Z2[x] is as follows: formed in the mathematics software system SageMath) 1. I(2, 1; x)= x(x + 1) that the presented algorithm is on average approximately 2. I(2, 2; x)= x2 + x +1 4.4 times slower than the extended Euclidean algorithm. 3. I(2, 3; x)= x6 + x5 + x4 + x3 + x2 + x +1 Acknowledgment 4. I(2, 4; x)= x12 + x9 + x6 + x3 +1 32 x +x 5. I(2, 5; x)= x2+x This research was sponsored in part by grant VEGA 64 2 (x +x)(x +x) 1/0159/17 and by the NATO Science for Peace and Se- 6. I(2, 6; x)= 4 8 (x +x)(x +x) curity Programme under grant G5448. 128 x +x 7. I(2, 7; x)= x2+x 7 3 2 ℓ(x)= I(2, 1; x) I(2, 2; x) I(2, 3; x) I(2, 4; x)I(2, 5; x) References I(2, 6; x)I(2, 7; x), 6 4 6 4 h(x)= x + x + x, d(x)= h(x)ℓ(x) = (x + x + x)ℓ(x). [1] J. Daemen and V. Rijmen, The design of Rijndael, Springer-Ver- The degree and the Hamming weight of d(x) is lag Berlin Heidelberg, 2002. Journal of Electrical deg d(x) = 260, wH (d(x)) = 88. [2] M. Repka, “McEliece PKC Calculator”, Engineering, 2014, vol. 65, no. 6, pp. 342–348. Now, we will compare the complexity of our method [3] Wikimedia Foundation, Inc.: “Finite Field Arithmetic”, with the complexity of the extended Euclidean algorithm. Wikipedia: The free encyclopedia, We ignore the complexity of computing d(x), since it https://en.wikipedia.org/wiki/Finite ﬁeld arithmetic, accessed March 2018. has to be done only once, and afterwards the same d(x) [4] L. E. Dickson, “History of the Theory of Numbers, Vol. I.”, G. can be used for computing all multiplicative inverses in E. Stechert & Co., New York, 1934. m GF(p ). We express the complexities in the number of [5] J. J. O’Connor and E. F. Robertson, “Abu Ali al-Hasan Zp operations. ibn al-Haytham, MacTutor History of Mathematics archive”, The complexity of the extended Euclidean algorithm http://www-history.mcs.st-and.ac.uk/Biographies/ for elements in GF(pm) is O(m2) [8]. Al-Haytham.html, accessed March 2018. Z [6] L. E. Dickson, “History of the Theory of Numbers, Vol. II.” G. Let f(x) be an irreducible polynomial in p[x] of the E. Stechert & Co., New York, 1934. Z degree m. Let a(x) ∈ p[x]/(f(x))\{0}. The complexity [7] G. Tenenbaum, “Introduction to Analytic and Probabilistic of the division of d(x) by a(x) is Number Theory”, American Mathematical Society, 2015, third O deg a(x)(deg d(x)−deg a(x)) . Thus the complexity of edition. our method is [8] A. J. Menezes, P. C. van Oorschot and S. A. Vanstone, “Hand- O m(deg d(x)) . book of Applied Cryptography”, CRC Press, Boca Raton, 1996. [9] R. Lidl and H. Niederreiter, “Finite Fields”, Cambridge Univer- The value of deg d(x) is at least t, where t is given sity Press, Cambridge, 1984. by (9). By the estimate from page 93 in [9], we have that Np(k) ≥ 1 for all k . Thus we obtain Received 16 October 2017

m−1 m−1 Otokar Groˇsek (Prof, RNDr, PhD) was born in 1950. t ≥ k m−1 ≥ k m−1 − 1 = (m − 1) m − 1 . He graduated at the Comenius University (1973), and was X k X k 2 k=1 k=1 assigned to Professor Stefanˇ Schwarz as a graduate student (PhD-1978), (Prof-1998). He is the Chair of the Institute of Therefore EEA is asymptotically faster than our new Informatics and Mathematics at the Faculty of Electrical En- algorithm. gineering and Information Technology, Slovak University of Technology in Bratislava. Since 1983 he is working in cryptology. 4 Conclusions TomáˇsFabˇsiˇc (Mgr, PhD) was born in 1986. He holds a bachelor’s degree in mathematics from the University of War- We studied the method of finding multiplicative in- wick and master’s degrees in mathematics from the University verses in Zp by constructing one fixed integer d(p) with of Cambridge and the Comenius University. He completed Z∗ −1 graduate study under the supervision of Professor Otokar the property that for any a ∈ p , we can compute a as −1 Groˇsek at the Faculty of Electrical Engineering and Informa- a = d(p)/a mod p. We demonstrated that a similar ap- tion Technology, Slovak University of Technology in Bratislava m proach works in finite fields GF(p ) with m> 1, as well. (PhD-2017). Currently, he is a postdoc at the Faculty of Elec- However, we showed that the studied method (both in the trical Engineering and Information Technology, Slovak Uni- m case of Zp and in the case of GF(p )) has worse asymp- versity of Technology in Bratislava. His research interests lie totic complexity than the extended Euclidean algorithm. in cryptology.