View metadata, citation and similar papers at core.ac.uk brought to you by CORE provided by Elsevier - Publisher Connector Journal of Number Theory 96, 133–151 (2002) doi:10.1006/jnth.2002.2783 Fast Computation of the Biquadratic Residue Symbol Andre´ Weilert1 Schwartzkopffstraße 6, 10115 Berlin, Germany E-mail: [email protected] Communicated by M. Pohst Received April 2, 2001; revised October 8, 2001 This article describes an asymptotically fast algorithm for the computation of the biquadratic residue symbol. The algorithm achieves a running time of Oðnðlog nÞ2log log nÞ for Gaussian integers bounded by 2n in the norm. Our algorithm is related to an asymptotically fast GCD computation in Z½i which uses the technique of a controlled Euclidean descent in Z½i: At first, we calculate a Euclidean descent with suitable Euclidean steps xjÀ1 ¼ qjxj þ xjþ1 storing the qj ’s for later use. Then we calculate the biquadratic residue symbol of x0; x1 from the quotient sequence in linear time in the length of the qj’s. # 2002 Elsevier Science (USA) Key Words: GCD calculation; Euclidean algorithm; reciprocity law; power residue symbol; biquadratic residue symbol; Jacobi symbol. 1. INTRODUCTION This article deals with an idea to use the quotient sequence of a Euclidean descent of two operands to calculate the biquadratic residue symbol in a fast manner. We will show that it is sufficient to extract the intermediate operands by calculating the Euclidean descent backwards using only the residue classes in Z½i=8Z½i of the operands and of the precalculated quotients. To calculate the biquadratic residue symbol, we use first our asymptotically fast greatest common divisor (GCD) algorithm in Z½i [14] to calculate a controlled Euclidean descentin time Oðnðlog nÞ2 log log nÞ and to save the quotients of the single Euclidean steps where the initial Gaussian integers are bounded by 2n in absolute value. The technique of a controlled Euclidean descentis due toScho ¨ nhage, who developed itfor thefast computation of an integer GCD. It is based on ideas related to the fast 1 Former address: Department of Computer Science II, University of Bonn, Ro¨ merstrae 164, 53117 Bonn, Germany 133 0022-314X/02 $35.00 # 2002 Elsevier Science (USA) All rights reserved. 134 ANDRE´ WEILERT continued fraction decomposition [6]. Combining this technique with a fast multiplication due to Scho¨ nhage and Strassen [9] one achieves a running time of Oðnðlog nÞ2 log log nÞ bit operations for the calculation of the GCD or the Jacobi symbol of n-bit integers [7, 8]. His algorithm for the Jacobi symbol computation uses the same idea as our algorithm for the computation of the biquadratic residue symbol. First, one calculates a Euclidean descent, then one calculates the descent backwards with the stored quotients, but all these operations are done in a fixed small residue class (Z=4Z in case of the Jacobi symbol, Z½i=8Z½i in case of the biquadratic residue symbol). The theory of biquadratic residues was already studied by Gau [1] as a natural generalization of the quadratic reciprocity law. It deals with the question whether a given number is a fourth power modulo a coprime number. Algorithms for the calculation of the quadratic residue symbol (Jacobi symbol) were studied in detail by several authors. (Mostly, they use a relation to a modified binary GCD algorithm and achieve quadratic running time, e.g. [4, 10]). In modern number theory, the concept of general reciprocity laws was developed. It covers the case of the quadratic and biquadratic reciprocity laws. We will sketch this theory shortly and refer to [5, Chap. VI, Sect. 8] for omitted details. Let n52 be an integer and K a number field which contains the group mn of nth roots of unity. For every place p of K; we have the nth Hilbertsymbol n n ðÁ; ÁÞp : Kp  Kp ! mn: Let us summarize some of the useful properties of the Hilbert symbol. The proofs can be found in [5, Chap. IV, (3.2) Theorem; Chap. VI, (8.2) Theorem]. Theorem 1.1. Let a; b; a0; b0 2 K n: 0 0 0 0 1. ðaa ; bÞp ¼ða; bÞpða ; bÞp and ða; bb Þp ¼ða; bÞpða; b Þp: 2. ða; bÞpðb; aÞp ¼ 1: 3. Qða; 1 À aÞp ¼ 1(Steinberg identity) and ða; ÀaÞp ¼ 1: 4. p ða; bÞp ¼ 1 where the product is to be taken over all places of K: Definition 1.1. Let p[n be a place of K; let a 2 K n: We define the generalized Legendre symbol or nth power residue symbol using the BIQUADRATIC RESIDUE SYMBOL 135 generalized Euler equation a NðpÞÀ1 a n mod p; p where NðpÞ denotes the norm of the ideal p: More in general, we define the nth power residue symbol a Y a vpðbÞ a vpðbÞ ¼ ; where ¼ 1ifvpðbÞ¼0 b p[n p p Q vpðbÞ n for an ideal b ¼ p[n p ; which is coprime to n; and for every a 2 K coprime to b: Now we quote a theorem that gives a connection between the power residue symbol and the Hilbert symbol. A proof can be found in [5, Chap. VI, (8.3) Theorem]. Theorem 1.2 (General Reciprocity Law of the nth Power Residues). Let a; b 2 K n and n 2 N be pairwise coprime. Then we get the following reciprocity law Y b a À1 ¼ ða; bÞ : a b p pjn;1 This reciprocity law generalizes the quadratic ðn ¼ 2Þ and biquadratic ðn ¼ 4Þ reciprocity law. For the reciprocity law, the only important places are the Hilbert symbols at such places p which divides n: The infinite places are only important in case of the quadratic reciprocity law because otherwise the infinite places are complex as the number field is totally imaginary. We will apply this theorem later in this article and will use concrete values of the Hilbert symbol at the place 1 þ i which is the only place that divides n ¼ 4: 2. THE BIQUADRATIC RECIPROCITY LAW We want to introduce the biquadratic residue symbol and the corresponding reciprocity law. From the general theory, we know that we have to consider K ¼ QðiÞ and its ring of integers Z½i with n ¼ 4: For 136 ANDRE´ WEILERT convenience, Gau [1] introduced the notation of a primary integer in Z½i which is an analogue to the odd numbers in Z: Definition 2.1. A Gaussian integer x 2 Z½i is called primary if x 1 mod 2 þ 2i: Definition 2.2. Let a; b be Gaussian integers. Denote the fourth power residue symbol in Z½i (QðiÞ), called biquadratic residue symbol, with hi a or ½a=b: b For a; b notbeing coprime, we define ½a=b¼0: This biquadratic residue symbol has some canonical properties which we do not mention here. For further details see, e.g., [2, Chap. 9.8]. It corresponds to the problem whether a Gaussian number is a fourth power modulo a coprime Gaussian number in the following way. Let p 2 Z½i be a prime elementand x 2 Z½i: Then ½x=p¼1 if and only if there exists a z 2 Z½i such that z4 x mod p: We decompose a Gaussian integer w 2 Z½i as w ¼ w0 þ iw1 where w0 denotes the real and w1 the imaginary part of w: Theorem 2.1 (Biquadratic Reciprocity Law). Let x; y 2 Z½i be primary coprime Gaussian integers. Then we have À1 x y NðxÞÀ1 NðyÞÀ1 x0À1 y0À1 x1y1 ¼ðÀ1Þ 4 4 ¼ðÀ1Þ 2 2 ¼ðÀ1Þ 4 ; y x where N denotes the algebraic norm of the field extension QðiÞ=Q: Furthermore, we have the supplementary laws x Àx Àx2À1 i 1Àx0 1 þ i 0 1 1 2 Àx1 ¼ i 2 ; ¼ i 4 ; ¼ i 2 : x x x Proof. See [1; 2, Theorem 9.9.2; 3, Sect. 6]. ] We will explain now why this biquadratic reciprocity law is not suitable in an obvious manner for our fastalgorithm. For convenience, we define l :¼ 1 þ i: Theorem 1.2 implies that l is the only prime element in Z½i which divides 4 (QðiÞ contains the group of fourth roots of unity), thus l mustbe considered for the reciprocity law. Let x 2 Z½i be primary and y 2 Z½i be divisible atleastby l; i.e. k :¼ vlðyÞ51: In this situation, it is not sufficient to know only a small residue class of x and y for applying Theorem 2.1 BIQUADRATIC RESIDUE SYMBOL 137 because we need to know k mod 4 to use the secondary supplementary law: " # "#"# "# k k x Àx Àx2À1 k y ð1 þ iÞ y=l 0 1 1 y=l ¼ ¼ i k 4 if x is primary: x x x x After using this supplementary law there does not exist a canonical correspondence to a quotient sequence calculated by a Euclidean descent any more. Thus, we will develop an alternative reciprocity law for the biquadratic residue symbol which matches well with the quotient sequence of every Euclidean descent. Therefore, we use the relation between the residue symbol and the Hilbert symbol at the place l (Theorem 1.2). Every element a 2 QðiÞ has a representation as a ¼ lvlðaÞan where an is the part of a that is coprime to l: Since l is the only prime divisor of 4 in Q½i and Z½i; we getas reciprocitylaw from Theorem 1.2 b a ¼ða; bÞ : ð1Þ a l bn Now consider a division chain x ¼ qy þ z; y ¼ qz˜ þ u with vlðxÞ¼0: If y is also notdivisible by l; we have y ¼ yn and (1) implies y x z ¼ðx; yÞ ¼ðx; yÞ : ð2Þ x l y l y Otherwise, if y is divisible by l; we know that vlðzÞ¼0 and get the equation y x z y u ¼ðx; yÞ ¼ðx; yÞ ¼ðx; yÞ ðz; yÞÀ1 ¼ðx=z; yÞ : ð3Þ x l yn l yn l l z l z These two Eqs.