Computing the Characteristic Polynomial of a Finite Rank Two Drinfeld Module Yossef Musleh Éric Schost Cheriton School of Computer Science Cheriton School of Computer Science University of Waterloo University of Waterloo Waterloo, Ontario, Canada Waterloo, Ontario, Canada [email protected] [email protected] Abstract Rank two Drinfeld modules enjoy remarkable similarities with Motivated by finding analogues of elliptic curve point counting elliptic curves: analogues exist of good reduction, complex multi- techniques, we introduce one deterministic and two new Monte plication, etc. Based in part on these similarities, Drinfeld modules Carlo randomized algorithms to compute the characteristic poly- have recently started being considered under the algorithmic view- nomial of a finite rank-two Drinfeld module. We compare their point. For instance, they have been proved to be unsuitable for usual asymptotic complexity to that of previous algorithms given by forms of public key cryptography [34]; they have also been used to Gekeler, Narayanan and Garai-Papikian and discuss their practical design several polynomial factorization algorithms [7, 29, 30, 38]; behavior. In particular, we find that all three approaches represent recent work by Garai and Papikian discusses the computation of either an improvement in complexity or an expansion of the pa- their endomorphism rings [9]. Our goal is to study in detail the rameter space over which the algorithm may be applied. Some complexity of computing the characteristic polynomial of a rank experimental results are also presented. two Drinfeld module over a finite field. A fundamental object attached to an elliptic curve E defined CCS Concepts over a finite field Fq is its Frobenius endomorphism π : ¹x;yº 7! ¹xq;yq º; it is known to satisfy a degree-two relation with integer • Computing methodologies → Symbolic and algebraic algo- coefficients called its characteristic polynomial. Much is known rithms; about this polynomial: it takes the form T 2 − hT + q, for some integer h called the trace of π, with log2¹jhjº ≤ log2¹q)/2 + 1 (this Keywords is known as the Hasse bound). In 1985, Schoof famously designed Drinfeld module; algorithms; complexity. the first polynomial-time algorithm for finding the characteristic ACM Reference Format: polynomial of such a curve [35]. Yossef Musleh and Éric Schost. 2019. Computing the Characteristic Polyno- Our main objective is to investigate the complexity of a Drinfeld mial of a Finite Rank Two Drinfeld Module. In International Symposium on analogue of this question. Given a rank two Drinfeld module over a Symbolic and Algebraic Computation (ISSAC ’19), July 15–18, 2019, Beijing, degree n extension L of Fq , one can define its Frobenius endomor- China. ACM, New York, NY, USA, 8 pages. https://doi.org/10.1145/3326229. phism, and prove that it satisfies a degree-two relation T 2 − AT + B, 3326256 where A and B are now in Fq »x¼. As in the elliptic case, B is rather easy to determine, and of degree n. Hence, our main question is the 1 Introduction determination of the polynomial A, which is known to have degree Drinfeld modules were introduced by Drinfeld in [8] (under the at most n/2 (note the parallel with the elliptic case). name elliptic modules) to prove certain conjectures pertaining to the Contrary to the elliptic case, computing the characteristic polyno- Langlands program; they are themselves extensions of a previous mial of a Drinfeld module is easily seen to be feasible in polynomial construction known as the Carlitz module [3]. time: it boils down to finding the Θ¹nº coefficients of a, which are In this paper, we consider so-called Drinfeld modules of rank known to satisfy certain linear relations. Gekeler detailed such an algorithm in [12]; we will briefly revisit it in order to analyse its com- arXiv:1907.12731v1 [cs.SC] 30 Jul 2019 two over a finite field L. Precise definitions are given below, but this means that we will study the properties of ring homomorphisms plexity, which turns out to be cubic in n. Our main contributions in this paper are several new algorithms with improved runtimes; we from Fq »x¼ to the skew polynomial ring Lfτ g, where τ satisfies the commutation relation τu = uqτ for u in L. Here, the rank of such a also present experimental results obtained by an implementation morphism φ is the degree in τ of φ¹xº. based on NTL [37]. An implementation of Gekeler’s algorithm was described in [18] Permission to make digital or hard copies of all or part of this work for personal or and used to study the distribution of characteristic polynomials of classroom use is granted without fee provided that copies are not made or distributed Drinfeld modules by computing several thousands of them. for profit or commercial advantage and that copies bear this notice and the full citation on the first page. Copyrights for components of this work owned by others than the author(s) must be honored. Abstracting with credit is permitted. To copy otherwise, or 2 Preliminaries republish, to post on servers or to redistribute to lists, requires prior specific permission and/or a fee. Request permissions from [email protected]. In this section, we introduce notation to be used throughout the ISSAC ’19, July 15–18, 2019, Beijing, China paper; we recall the basic definition of Drinfeld modules and state © 2019 Copyright held by the owner/author(s). Publication rights licensed to ACM. precisely our main problem. For a general reference on these ques- ACM ISBN 978-1-4503-6084-5/19/07...$15.00 https://doi.org/10.1145/3326229.3326256 tions, see for instance [15]. 2.1 The Fields Fq, K and L For U in Fq »x¼, we will abide by the convention of writing φU φ¹U º φ φ = In all the paper, Fq is a given finite field, of order a prime power q, in place of . Since is a ring homomorphism, we have UV φ φ φ = φ + φ U ;V F »x¼ and L ⊃ Fq is another finite field of degree n over Fq . Explicitly, we U V and U +V U V for all in q ; hence, the φ φ U assume that L is given as L = Fq »z]/f, for some monic irreducible Drinfeld module is determined entirely by x ; precisely, for in F »x¼ φ = U ¹φ º f 2 Fq »z¼ of degree n. When needed, we will denote by ζ 2 L the q , we have U x . class ¹z mod fº. We will restrict our considerations to rank two Drinfeld modules. In addition, we suppose that we are given a ring homomorphism In particular, we will use the now-standard convention of writing φ = γ ¹xº + дτ + ∆τ 2 ¹L;γ º γ : Fq »x¼ ! L. The kernel ker¹γ º of the mapping γ : Fq »x¼ ! L is x . Hence, for a given , we can represent ¹L;γ º ¹д; ∆º 2 L2 a prime ideal of Fq »x¼ generated by a monic irreducible polynomial any rank two Drinfeld module over by the pair . p, referred to as the F »x¼-characteristic of L. Then, γ induces an 4 2 q Example 1. Let q = 5, f = z +4z +4z+2 and L = F5»z]/f = F625, embedding K := F »x]/p ! L; we will write m := »L : K¼, so that q so that n = 4; we let ζ be the class of z in L. Let γ : F5»x¼ ! F625 be n = md, with d = degp. When needed, we will denote by ξ 2 K given by x 7! ζ , so that p = f, K = L = F625 and m = 1. We define the class ¹x mod pº. 2 the Drinfeld module φ : F5»x¼ ! F625fτ g by φx = ζ +τ +τ , so that Although it may not seem justified yet, we may draw a parallel ¹д; ∆º = ¹1; 1º. with this setting and that of elliptic curves over finite fields. As F »x¼ Z Suppose φ is a rank two Drinfeld module over ¹L;γ º. A central said before, one should see q playing here the role of in the n elliptic theory. The irreducible p is the analogue of a prime integer element in Lfτ g is called an endormorphism of φ. Since uq = u n p, so that the field K = Fq »x]/p is often thought of as the “prime for all u in L, τ is such an endomorphism. The following key field”, justifying the term “characteristic” for p. The field extension theorem [12, Cor. 3.4] defines the main objects we wish to compute. L will be the “field of definition” of our Drinfeld modules. 2 q Theorem 1. There is a polynomial T − AT + B 2 Fq »x¼»T ¼ such We denote by π : L ! L the q-power Frobenius u 7! u ; for n i that τ satisfies the equation i ≥ 0, the ith iterate πi : L ! L is thus u 7! uq ; for i ≤ 0, πi is 2n n the ith iterate of π −1. τ − φAτ + φB = 0; (2) with deg A ≤ n/2 and deg B = n. 2.2 Skew Polynomials The polynomials A and B are respectively referred to as the We write Lfτ g for the ring of so-called skew polynomials Frobenius trace and Frobenius norm of φ. Note in particular the s Lfτ g = fU = u0 + u1τ + ··· + usτ j s 2 N;u0;:::;us 2 Lg: (1) similarity with Hasse’s theorem for elliptic curves over finite fields regarding the respective “sizes” (degree, here) of the Frobenius This ring is endowed with the multiplication induced by the relation trace and norm.