# The Eleventh Power Residue Symbol

• Marc Joye , Oleksandra Lapiha , Ky Nguyen and David Naccache

## Abstract

This paper presents an efficient algorithm for computing 11th-power residue symbols in the cyclo-tomic field (ζ11), where 11 is a primitive 11th root of unity. It extends an earlier algorithm due to Caranay and Scheidler (Int. J. Number Theory, 2010) for the 7th-power residue symbol. The new algorithm finds applications in the implementation of certain cryptographic schemes.

MSC 2010: 11A15; 11R18; 11A05; 11Y40; 11T71

## 1 Introduction

Quadratic and higher-order residuosity is a useful tool that finds applications in several cryptographic constructions. Examples include [6, 13, 14, 19] for encryption schemes and [1, 2, 12] for authentication schemes and digital signatures. A central operation therein is the evaluation of a residue symbol of the form [ αλ ] without factoring the modulus λ in the cyclotomic field ℚ(ζp), where ζp is a primitive pth root of unity.

For the case p = 2, it is well known that the Jacobi symbol can be computed by combining Euclid’s algorithm with quadratic reciprocity and the complementary laws for −1 and 2; see e.g. [10, Chapter 1]. This eliminates the necessity to factor the modulus. In a nutshell, the computation of the Jacobi symbol (an)2 proceeds by repeatedly performing 3 steps: (i) reduce a modulo n so that the result (in absolute value) is smaller than n/2, (ii) extract the sign and the powers of 2 for which the symbol is calculated explicitly with the complementary laws, and (iii) apply the reciprocity law resulting in the ‘numerator’ and ‘denominator’ of the symbol being flipped. Eventually, the numerator of the symbol becomes ±1 and the algorithm terminates with the value of (an)2. Under certain conditions, this methodology naturally extends to higher values for p. The case p = 3 is discussed in [4, 14, 19], the case p = 4 in [4, 18], the case p = 5 in [14], the case p = 7 in [3], and the case p = 8 in [10, Chapter 9].

Caranay and Scheidler describe a generic algorithm in [3, Section 7] for computing the pth-power residue symbol for any prime p ≤ 11, building on Lenstra’s norm-Euclidean algorithm. They also provide a detailed implementation for the case p = 7. The case p = 11 is difficult. We quote from [3]:

“Even for the case p = 11, for which Euclidean division remains straightforward, the other details of the method get increasingly complicated. Finding explicit conditions for a cyclotomic integer to be primary becomes more and more technical, as does an algorithm to find a primary associate. The cyclotomic field generated by an 11th primitive root of unity has four fundamental units, so complementary laws need to be found for three of them as well as for the ramified prime lying above 11 (or for 11 itself).”

The general case is addressed in a recent algorithm by de Boer and Pagano [5].

Our contributions

This paper takes up the challenge put forward in [3] and presents the first implementation of the Caranay– Scheidler algorithm for the 11th-power residue symbol. The contributions of this paper are three-fold: We provide explicit conditions for primary algebraic integers in ℤ[ζ11];we devise an efficient algorithm for finding a primary associate; and we give explicit complementary laws for a set of four fundamental units and for the special prime 1 − ζ11.

Organization

The rest of this paper is organized as follows. In Section 2,we review some basic definitions and known results on cyclotomic fields. Section 3 particularizes to the 11th cyclotomic field.We establish and prove an efficient criterion for primary cyclotomic integers. We also define a set of four fundamental units and give explicit formulas to find their index. Section 4 is the core of the paper. We present the ingredients and develop the companion algorithms for the computation of the eleventh power residue symbol.

## 2 Higher-Order Power Residue Symbols

Throughout this section, p ≤ 13 denotes an odd rational prime.

### 2.1 Basic definitions and notation

Fix ζ:=ζp=e2πi/p a primitive pth root of unity and let ω = 1 − ζ . The number field (ζ) defines the pth cyclotomic field. The ring of integers of (ζ) is ℤ[ζ ] and is norm-Euclidean [9, 11] (in particular, it is a unique factorization domain). Since ζ,ζ2,,ζp1 form an integral basis for (ζ), any element α[ζ] can be expressed as α=j=1p1ajζj with aj Z. The norm and trace of α[ζ] are the rational integers respectively given by N(α)=k=1p1σk(α) and T(α)=k=1p1σk(α), where σk:ζζk. The group of units of ℤ[ζ ] is the direct product of ±ζ ⟩ and a free abelian group ε of rank r = (p − 3)/2. The generators of ε are called fundamental units and will be denoted by η1,,ηr. Two elements α and β are called associates if they differ only by a unit factor. We write α~β

We follow the approach of Kummer. A central notion is that of primary elements (see [7, p. 158]) in ℤ[ζ ].

### Definition 2.1

An element α[ζ] is said to be primary whenever it satisfies

α0(modω),
αB(modω2),
αα¯B2(modp)

for some B ∈ Z.

### Lemma 2.2

([3, Lemma 2.6]). Every element α[ζ] with α0(modω) has a primary associate α* of the form

α=±ζe0η1e1ηrerα where 0e0,e1,,erp1.

Moreover, α* is unique up to its sign.

### 2.2 Kummer’s reciprocity law

Let α,π[ζ] with π prime, πω, and πα. The pth-power residue symbol [ απ ]p is then defined to be the pth-root of unity ζ i such that

α(N(π)1)/pζi(modπ).

This exponent i (with 0 ≤ ip − 1) is called the index of α w.r.t. π and is noted indπ(α). If π divides α then [ απ ]p=0.

Analogously to the Legendre symbol, the pth-power residue symbol generalizes: For any α,λ[ζ] with λ non-unit and gcd(λ, ω) 1, writing λ=jπjej for primes πj in ℤ[ζ], the generalized pth-power residue symbol [ αλ ]p is defined as [ αλ ]p=j[ απj ]pej.

Kummer [7] stated the reciprocity law in 1850 (see also [15, Art. 54]). It is restricted to so-called “regular” primes, [1]which include odd primes p ≤ 13. Although initially formulated for primary primes in ℤ[ζ ], the reciprocity law readily extends to all primary elements; see [3, Corollary 3.4].

### Theorem 2.3

(Kummer’s Reciprocity Law). Let α and λ be two primary elements in ℤ[ ]. Then [ αλ ]p=[ λα ]p.

### 2.3 Complementary laws

The special prime ω and its conjugates are excluded from Kummer’s reciprocity law. Moreover, it does not apply to units other than ±1 as they are not primary. For these elements, the pth-power residue symbol is determined through complementary laws, also stated by Kummer [7, 8] (see also [15, Art. 55]). The complementary laws rely on the logarithmic differential quotients given by

Δn(α)=dnln(F(ev))dvn|V=0

for any α=j=1p1ajζj[ζ] with T(α)0 and where F(X)=j=0p2bjXj[X] whose coefficients are b0=ap1 and bj=ajap1 for 1jp2. Notice that α=F(ζ).

### Theorem 2.4

(Complementary Laws). Let π be a primary prime in ℤ[ζ ]. Then,

1. indπ(p)Δp(π)p (mod p);

2. for any unit ε[ζ]*,

indπ(ε)Δ1(ε)N(π)1p+i=1rΔ2i(ε)Δp2i(π)(modp)

where r = (p − 3)/2.

For completeness, we give the complementary laws for ±1 and ζ . Alternatively, they can be obtained directly from the definition of the pth-power residue symbol. The next corollary is a straightforward extension to composite moduli.

### Corollary 2.5

([3, Corollary 3.6]). Let λ[ζ] such that ωλ. Then [ ±1λ ]p=1 and [ ζλ ]p=ζN(λ)1pmodp.

## 3 The Case p = 11

This section presents results for the special case p = 11. We henceforth assume that ζ:=ζ11 is a primitive 11th root of unity.

### 3.1 Primary elements

Definition 2.1 explicitly characterizes primary elements. The next proposition specializes it for prime p = 11 in order to have a simple criterion involving only rational integers.

It is useful to introduce some notation. For α=j=110ajζj[ζ], we define the rational integers Ak(α)= j=110ajjk, for 0 ≤ k ≤ 9. Also, when A0(α)0 (mod 11), we define aj(α)=Aj(α)A0(α) mod 11, for 1 ≤ j ≤ 9. Notice that A0(α) = − T().

### Proposition 3.1

Let α=j=110ajζj[ζ] and Ak:=Ak(α). Then α is primary if and only if the following conditions hold:

1. A0 ≢ 0 (mod 11);

2. A1 0 (mod 11);

3. A2 ≡ A4 0 (mod 11);

4. Ak:=Ak(α)A0A6+A320(mod11);

5. A3A5A0A80(mod11).

Proof. Let ω = 1 − ζ . From Definition 2.1, α is primary if and only if α / 0 (mod ω), α ≡ B (mod ω2), and αα¯B2 (mod 11) for some rational integer B. We have i=110ajζjj=110aj(1ω)jj=110aj(1jω) A0A1 ω (mod ω2). As a result, the condition α0 (mod ω) is equivalent to A0 / 0 (mod ω), and the condition α ≡ B (mod ω2) with B = A0 ℤ is equivalent to A1ω0(modω2)A10 (mod ω). We observe that rational integers are congruent modulo ω if and only if they are congruent modulo p (in this case 11). We therefore have A00(modω)A00(mod11) and A10(modω)A10 (mod 11).

It remains to look at the third condition, αα¯A02 (mod 11). Using matrix notation and defining the Vandermonde matrix

V=(1111122229110102109)(mod11),

we can express (A0,,A9) as (A0,,A9)=(a1,,a10) V. In turn, we can write αj=110aj(1ω)j (a1,,a10)(1ω,,(1ω)10)(A0,,A9)V1((1ω),,(1ω)10)(mod11). . Similarly, we can write α¯j=110ajζ11jj=110aj(1ω)11j(A0,,A9)V1( (1ω)10,. (1ω)). Hence, noting that ω10 11, the product αα¯ (mod 11) can be put after a little algebra in the form of a degree-9 polynomial in ω:

(1) αα¯A02(A0A2A12)ω2+(A0A2A12)ω3+(A0A44A1A3+3A22)ω4+(A0A2+2A0A4+A12+3A1A35A22)ω5+(4A0A2+A0A44A0A64A124A1A3+2A1A5+3A225A2A44A32)ω6+(4A0A22A0A4A0A64A123A1A35A1A5+5A224A2A4A32)ω7+(5A0A4A0A64A0A82A1A35A1A5A1A74A224A2A42A2A6A32+4A3A5+3A42)ω8+(4A0A2+5A0A43A0A65A0A84A12+2A1A34A1A54A1A7+4A22A2A4+3A2A63A32+5A3A5+A42)ω9(mod11).

For conciseness,we write Cj the rational coefficient of ωj in the right hand side of Eq. (1): αα¯A02+j=29Cjωj (mod 11). The condition αα¯A02 (mod 11) can be thus rewritten as j=29Cjωj0 (mod 11). Further, since ωj | 11 for 2 ≤ j ≤ 9, we get C2ω20(modω3)C20(modω)C20(mod11), C2ω2+C3ω3C3ω30(modω4) C30(modω)C30(mod11), and so on: C4 0(mod 11), ..., C9 0 (mod 11). Now, assuming A0 0 (mod 11) and A1 0 (mod 11) in Eq. (1), the congruences C2C3C4C90(mod11) yield A2A4A0A6+A32A0A8+A3A50 (mod 11). This completes the proof.

### 3.2 Fundamental units

For p = 11, the fundamental_units() function from SageMath [16] provides the set { v1,v2,v3,v4 } of fundamental units, with v1=ζ+1,v2=ζ2+1,v3=ζ2+ζ+1,v4=ζ6+ζ.

Every unit can be rendered real by multiplying it by some power of . Another set of fundamental units is so given by { η1,η2,η3,η4 } with η1=ζ5v1,η2=ζ10v2,η3=ζ10v3, and η4=ζ2v4. Observe that

η1=ζ5+ζ5,

η2=ζ+ζ1,

η3=ζ1(1+ζ+ζ2),

η4=ζ3+ζ3,

and ηi=σ1(ηi) for 1 ≤ i ≤ 4, where σ1:ζζ1. We will use this set { η1,η2,η3,η4 } of fundamental units in later computations.

### Remark 3.2

Suppose α[ ζ ] is real (i.e., α=α¯). Then 2A1(α)A1(2α)A1(α+α¯)0(mod11) A1(α)0(mod11). Since the units η1,,n4 are real, it follows that A1(η1)A1(η2)A1(η3) A1(η4)0(mod11).

We now apply Theorem 2.4 to find the index of the fundamental units ηi,1i4, and of special prime ω.

### Proposition 3.3

Let π be a primary prime in ℤ[ζ ]. Then

indπ(η1)a3(π)+3a5(π)+4a7(π)+4a6(π)a3(π)+3a9(π)(mod11),
indπ(η2)3a3(π)+5a5(π)2a7(π)+5a6(π)a3(π)+a9(π)(mod11),
indπ(η3)2a3(π)2a5(π)+3a7(π)4a6(π)a3(π)3a9(π)(mod11),
indπ(η4)4a3(π)+4a5(π)+3a7(π)+a6(π)a3(π)2a9(π)(mod11),

and

indπ(ω)5a6(π)a3(π)2a6(π)a5(π)A1(π)5N(π)1115(mod11)

where A1(π)=A1(π)A0(π)mod12111.

Proof. Let π[ ζ ] be a primary prime. Recalling that A1(ηi)0(mod11) for 1 ≤ i ≤ 4, we have Δ1(ηi)0 (mod 11); see Appendix A. Applied to ηi, the general formula for computing the index w.r.t. a primary prime (cf. Theorem 2.4) becomes indπ(ηi)Δ2(ηi)Δ9(π)+Δ4(ηi)Δ7(π)+Δ6(ηi)Δ5(π)+Δ8(ηi)Δ3(π)(mod11). An application of the formulas given in Appendix A yields

Δ2(ηi)mod11 Δ4(ηi)mod11 Δ6(ηi)mod11 Δ8(ηi)mod11
i = 1 3 4 3 1
i = 2 1 9 5 3
i = 3 8 3 9 2
i = 4 9 3 4 4

Further, π being primary and thus A0(π)0(mod11) and a1(π)a2(π)a4(π)a6(π)+a3(π)20 (mod 11), those formulas also yield, modulo 11,

Δ3(π)a3(π),Δ5(π)a5(π),Δ7(π)a7(π),
Δ9(π)a3(π)3+4a6(π)a3(π)+a9(π)5a6(π)a3(π)+a9(π).

Plugging all these quantities in the above expression for indπ(ηi) gives the desired result.

For ω, since ω10 11, there exists a unit ε such that εω10=11. This holds for ε=j=1101ζj1ζ= ζ6η14η22η32η42. As a result, owing to the multiplicative nature of the power residue symbol, we have indπ(ω)indπ(ε)indπ(11)(mod11) where indπ(ε)indπ(1)+6indπ(ζ)+4indπ(η1)+2indπ(η2)+ 2indπ(η3)2indπ(η4)0+6N(π)111+6a3(π)+10a5(π)+a7(π)+5a6(π)a3(π)+a9(π)(mod11) from Corollary 2.5 and using the previously obtained expressions for indπ(ηi). The result now follows by plugging the value for indπ(11)Δ11(π)11(mod11); see Eq. (A2) in Appendix A.  □

## 4 Computation of the Eleventh Power Residue Symbol

### 4.1 Obtaining primary associates

We need to investigate the multiplicative properties of the Ak's. Namely, given α,β[ζ], how to relate Ak(αβ) to Ar(α) and As(β)? We also need to express ak(αn) as a function of aj(α)

### Proposition 4.1

Let α,β[ζ]. Then, for 0 ≤ k ≤ 9,

Ak(αβ)j=0kkjAj(α)Akj(β)mod11.

Proof. Using ζ 11 = 1, the product of α=j=110ajζj and β=j=110bjζj satisfies αβ==220cζ=c11+c12ζ+ j=29(cj+cj+11)ζj+c10ζ10, where c= m+n=1m,n10 ambn. Hence, we get

Ak(αβ)Ak(c11)+Ak(c12ζ+j=29(cj+cj+11)ζj+c10ζ10)Ak(c11)+c12+j=29(cj+cj+11)jk+c1010kAk(c11)+22011ck(mod11).

Furthermore, Ak(c11)Ak(c11( j=110ζj))c11( j=110jk) (mod 11). So, for k = 0, we get A0(c11)c11 (mod 11) and thus A0(αβ) 220c (mod 11). For k ≥ 1, we get Ak(c11)0 (mod 11), which leads to Ak(αβ) 22011ck 220ck (mod 11). Therefore, in all cases, we have

Ak(αβ)220ck220(m+n=1m,n10ambn)km=110n=110ambn(m+n)km=110n=110ambn(j=0kkjmjnkj)j=0kkjm=110n=110ambnmjnkjj=0kkj(m=110ammj)(n=110bnnkj)j=0kkjAj(α)Akj(β)(mod11),

which completes the proof.

### Corollary 4.2

Let α[ζ] and let n ∈ N. Then

A0(αn)A0(α)n(mod11)

and, provided that A0(α)0(mod11), for 1 ≤ k ≤ 9,

akαn=1knhk,(α)(mod11)

where

hk,(α)={ ak(α) for =1 j=1k+1(kj)hkj,1(α)aj(α) for 2k .

Proof. This is a direct application of Proposition 4.1.

### Proposition 4.3

Let η1=ζ5+ζ5,η2=ζ+ζ1,η3=ζ1(1+ζ+ζ2), and n4=ζ3+ζ3. Let also α ∈ ℤ[ζ] with A0(α) ≢ 0 (mod 11) and A1(α) 0 (mod 11). If rational integers 0 ≤ e1, e2, e3, e4 ≤ 10 verify

(2) i=14a2ηieia2(α)(mod11)i=14a4ηi3a2ηi2eia4(α)+3a2(α)2(mod11)i=14a6ηi4a4ηia2ηi3a2ηi3eia6(α)+4a4(α)a2(α)a3(α)2+3a2(α)3(mod11)i=14a8ηi+5a6ηia2ηi2a4ηi2+2a4ηia2ηi23a2ηi4eia8(α)5a6(α)a2(α)+a5(α)a3(α)+2a4(α)22a4(α)a2(α)2+a3(α)2a2(α)+3a2(α)4(mod11)

then α=η1e1η2e2η3e3η4e4α is a primary associate of .

Proof. Write E=ε1ε2ε3ε4 and εi=ηiei. Hence, α* = ε α is an associate of α. It is worth noting that ε is real and thus A1(ε)a1(ε)0 (mod 11). Proposition 3.1 lists the conditions for α* being primary. From Proposition 4.1 and Corollary 4.2 (see also Appendix A), we get A0(ε) i=14A0(εi) i=14A0(ηi)ei (mod 11). Therefore, since A0(ηi)0(mod11), it follows that A0(α*) ≡ A0(ε)A0(α) /0 (mod 11). Further, since A1(α)A1(ε)0 (mod 11), we also have A1(α)A0(ε)A1(α)+A1(ε)A0(α)0(mod11).

Likewise, again from Proposition 4.1 and Corollary 4.2, we find after a little algebra a2(ε) i=14a2(εi) i=14a2(ηi)ei (mod 11). Consequently, since α* = ε α, the condition A2(α*) 0 (mod 11) translates into A2(α)A0(ε)A2(α)+A2(ε)A0(α)0a2(ε)A2(ε)A0(ε)A2(α)A0(α)a2(α)(mod11), that is i=14a2(ηi)eia2(α)(mod11).

The calculation for a4(ε) is more involved and technical. An application of Proposition 4.1 and Corollary 4.2 yields a4(ε)i=14( a4(ηi)ei+ 3a2(ηi)2ei(ei1) )+6i=13(j=i+14a2(ηi)a2(ηj)eiej)(mod11). In turn, as i=14a2(ηi)eia2(α) (mod 11), we therefore obtain a4(ε)i=14(a4(ηi)3a2(ηi)2)ei+ 3(i=14a2(ηi)ei)2[ i=14(a4(ηi)3a2(ηi)2)ei ]+3a2(α)2(mod11). The condition A4(α*) 0 (mod 11) so leads to a4(α) + 6a2(ε) a2(α) + a4(ε) 0 (mod 11) ⇐⇒ a4(ε) −a4(α) + 6a2(α)2 (mod 11), that is i=14(a4(ηi)3a2(ηi)2)eia4(α)+3a2(α)2(mod11).

The two remaining relations are proved similarly as a respective consequence of A0(α)A6(α)+A3(α)2 0(mod11) and A3(α)A5(α)A0(α)A8(α)0(mod11). Notice that a3(ε) a5(ε) a7(ε) 0 (mod 11).  □

From Lemma 2.2, applied to the case p = 11, we know that every α ∈ ℤ[ζ ] with α ≡ /0 (mod ω) has a primary associate of the form

α=±ζe0η1e1η2e2η3e3η4e4α

where 0 ≤ e0, e1, e2, e3, e4 ≤ 10 and α* is unique up to the sign. First, we observe that the sign does not affect the fact of being primary. Indeed, from Proposition 3.1, it is easily seen that if α* is primary then so is −α*. Second, as shown in the proof of Proposition 3.1, we observe that the condition α / 0 (mod ω) is equivalent to A0(α) ≢ 0 (mod 11).

Applying Proposition 4.3 demands that α satisfies A0(α) 0 (mod 11) and A1(α) 0 (mod 11). It turns out that if A0(α) 0 (mod 11) then

α:=ζa1(α)α

satisfies A0(α)A0(ζa1(α))A0(α)A0(α)0(mod11) and A1(α)A0(ζa1(α))A1(α)+A1(ζa1(α))A0(α) A1(α)a1(α)A0(α)0(mod11). Note that AQ(ζ)=A1(ζ)=1.

Putting all together, we therefore obtain an efficient way to compute a primary associate of an element α ∈ ℤ[ζ] with A0(α) /0 (mod 11). This is depicted in Algorithm 1. With matrix notation, letting (w1, w2, w3, w4) denote the right-hand side of (2) (i.e., w1 = −a2(α), etc) and replacing the aj(ηi)s by their respective values, the system of equations (2) can be rewritten as

(e1,e2,e3,e4)M(w1,w2,w3,w4)(mod11)

and so

(e1,e2,e3,e4)(w1,w2,w3,w4)M1(mod11)

where M1=(2413435155343231)(mod11).

 Algorithm 1: Computing α* and its representation Input: α∈ℤ[ζ] with A0(α)≡0( mod 11) α⋆=ζe0η1e1η2e2η3e3η44e4α Output: primary(α) = α* and repr(α) = (e0, e1, e2, e3, e4) with α∗=ζe0η1e1η2e2η3e3η4e4α primary e0←−a1(α)(mod11) α←ζe0α w1←−a2(α)( mod 11) w2←−a4(α)+3a2(α)2( mod 11) w3←−a6(α)+4a4(α)a2(α)−a3(α)2+3a2(α)3( mod 11) w4←−a8(α)−5a6(α)a2(α)+a5(α)a3(α)+2a4(α)2−2a4(α)a2(α)2+a3(α)2a2(α)+3a2(α)4( mod 11) e1←−2w1−4w2+5w3−3w4( mod 11) e2←4w1+3w2−5w3+2w4( mod 11) e3←w1+5w2−3w3−3w4( mod 11) e4←−3w1−w2+4w3+w4( mod 11) α⋆←η1e1η2e2η3e3η4e4α return [α*, (e0, e1, e2, e3, e4)]

### 4.2 Norm-Euclidean division

The last ingredient for our algorithm is a norm-Euclidean division. For p = 11, the ring ℤ[ζ] is known to be norm-Euclidean, i.e., for all α, λ ∈ ℤ[ζ], there exists some ρ ∈ ℤ[ζ] such that ρ ≡ α (mod λ) and N(ρ) < N(). In [11], Lenstra provides an efficient algorithm for approximating an algebraic number χ(ζ) by an algebraic integer ι ∈ ℤ[ζ] satisfying N(χι)<1. See also [14, Algorithm 5.1] or [3, Algorithm 7.1]. Therefore, if we let χ=αλ=αj=210σj(λ)N(λ)(ζ), we obtain lζ] such that N( − ι) < 1, and thus ρ := αιλ verifies ρ ≡ α (mod λ) and N(ρ)=N(λ)N(χι)<N(λ). We write ρ = euclid_div(α,λ).

### 4.3 Our algorithm

The main result is the hendecic reciprocity law.

### Theorem 4.4

(Hendecic Reciprocity). Let α and λ be two primary elements in ℤ[ζ ]. Then

[ αλ ]11=[ λα ]11.

Moreover,

[ +1λ ]11=1,[ ζλ ]11=ζN(λ)111[ ζ5+ζ5λ ]11=ζa3(λ)+3a5(λ)+4a7(λ)+4a6(λ)a3(λ)+3a9(λ)[ ζ+ζ1λ ]11=ζ3a3(λ)+5a5(λ)2a7(λ)+5a6(λ)a3(λ)+a9(λ)[ ζ1(1+ζ+ζ2)λ ]11=ζ2a3(λ)2a5(λ)+3a7(λ)4a6(λ)a3(λ)3a9(λ)
[ ζ3+ζ3λ ]11=ζ4a3(λ)+4a5(λ)+3a7(λ)+a6(λ)a3(λ)2a9(λ)

and, letting A1(λ)=A1(λ)/A0(λ)mod12111,

[ 1ζλ ]11=ζ5a6(λ)a3(λ)2a6(λ)a5(λ)A1(λ)5N(λ)1115.

Proof. The first statement is Theorem 2.3 for p = 11. The second statement for units ±1 and ζ is Corollary 2.5 for p = 11; note that ωλ because λ is primary.

The last statements are proved in Proposition 3.3 for a primary prime λ. We need to show that Proposition 3.3 remains valid for any primary element λ ∈ ℤ[ζ]. Actually, it is sufficient to consider the case of λ being of the form λ = π1 π2 for two primary primes π1 and π2. If π1 and π2 are primary then Proposition 3.1 tells that a1(πi)a2(πi)a4(πi)a6(πi)+a3(πi)20 (mod 11), i ∈ {1, 2}. Combined with Proposition 4.1, we so obtain for j ∈ {3, 5, 7}, aj(π1 π2) aj(π1) + aj(π2) (mod 11). We also obtain a6(π1π2)a3(π1π2)a6(π1)a3(π1)+a6(π2)a3(π2)+3a6(π1)a3(π2)+3a6(π2)a3(π1)(mod11) and a9(π1 π2)

η1=ζ5+ζ5, It is now easily checked, for a9(π1)+a9(π2)4a6(π1)a3(π2)4a6(π2)a3(π1)(mod11). that a3(π1π2)+3a5(π1π2)+4a7(π1π2)+4a6(π1π2)a3(π1π2)+3a9(π1π2)indπ1(η1)+indπ2(η1)indπ1π2(η1) (mod 11) where the values of indπ1(η1) and indπ2(η1) are given by Proposition 3.3; and similarly for the other fundamental units η2 = ζ + ζ −1, η3 = ζ −1(1 + ζ + ζ 2), and η4 = ζ + ζ −3. The proof for ω = 1 − ζ essentially follows the same lines using a refinement of Proposition 4.1 for A1(α) mod 121.  □

[ αλ ]11.

Theorem 4.4 gives rise to an efficient algorithm for computing the 11th-power residue symbol It requires α and λ to be co-prime and T(λ) ≢ 0 (mod 11) (as otherwise the symbol is not defined). As a reminder, ω η1=ζ5+ζ5,η2=ζ+ζ1,η3=ζ1(1+ζ+ζ2),η4=ζ3+ζ3 stands for the special prime 1 − ζ and arefundamental units.

 Algorithm 2: Computing [ αλ ]11 Input: α, λ ∈ ℤ[ζ] with gcd(α, λ) ∼ 1 and T(λ) ≢ 0 (mod 11) [ αλ ]11 Output: λ* ← primary(λ) j ← 0 while N(*)> 1 do ρ ← euclid_div(α, λ*) s ← 0 while T() ≡ 0 (mod 11) do S←S+1ρ←ρ÷ω end [ ρ*,(e0,e1,e2,e3,e4) ]←[primary(ρ),repr(ρ)] // ρ⋆=ζe0η1e1η2e2η3e3η4e4ρ j←j+s×indλ⋆(ω)−e0×indχ⋆(ζ)−e1×indλ⋆(η1)                     −e2×indλ⋆(η2)−e3×indλ⋆(η3)−e4×indλ⋆(η4)( mod 11) α ← λ*; λ* ← ρ* end return ζ j

### Proposition 4.5

Algorithm 2 is correct.

Proof. Clearly, we have [ αλ ]11=[ αλ ]11=[  euclid_d1v(α,λ)λ ]11.

Let α(in) and λ(in) (resp. α(out) and λ(out) ) denote the values of α and of λ* when entering (resp. exiting) the outer while-loop. Define ϱ:=eucliddiv(α(in),λ(in)) At the end of the inner while-loop, we have ρ= ζe0η1e1η2e2η3e3η4e4ϱωs and so [ ϱλ ]11 =[ pλ ]11ζsindλ(ω)e0indλ(ζ) i=14eiindλ(ηi), and wherein indλ(ω),indλ(ζ) and indλ(ηi) are evaluated using Theorem 4.4 and [ ρλ ]11=[ λρ ]11 by hendecic reciprocity. The last step of the outer while-loop replaces (α, λ*) with (λ*, ρ*). Since ℤ[ζ] is norm-Euclidean, it follows that the norm of λ* strictly decreases: N(λ(out))=N(ρ)=N(ϱ)/N(ω)sN(ϱ)<N(λ(in)). It eventually becomes 1 and the algorithm terminates.  □

## References

[1] William D. Banks, Daniel Lieman and Igor E. Shparlinski, An extremely small and efficient identification scheme, in: Information Security and Privacy (ACISP 2000) (E. Dawson et al., eds.), Lecture Notes in Computer Science 1841, pp. 378–384, Springer, 2000.10.1007/10718964_31Search in Google Scholar

[2] Éric Brier, Houda Ferradi, Marc Joye and David Naccache, New number-theoretic cryptographic primitives, Journal of Mathematical Cryptology (To appear).10.1515/jmc-2019-0035Search in Google Scholar

[3] Perlas C. Caranay and Renate Scheidler, An efficient seventh power residue symbol algorithm, International Journal of Number Theory 6 (2010), 1831–1853.10.1142/S1793042110003770Search in Google Scholar

[4] Ivan Bjerre Damgård and Gudmund Skovbjerg Frandsen, Eflcient algorithms for the gcd and cubic residuosity in the ring of Eisenstein integers, Journal of Symbolic Computation 39 (2005), 643–652.10.1016/j.jsc.2004.02.006Search in Google Scholar

[5] Koen de Boer and Carlo Pagano, Calculating the power residue symbol and ibeta: Applications of computing the group structure of the principal units of a p-adic number field completion, in: 42nd International Symposium on Symbolic and Algebraic Computation (M. A. Burr et al., eds.), pp. 117–124, ACM, 2017.10.1145/3087604.3087637Search in Google Scholar

[6] Shafi Goldwasser and Silvio Micali, Probabilistic encryption, Journal of Computer and System Sciences 28 (1984), 270–299.10.1016/0022-0000(84)90070-9Search in Google Scholar

[7] Ernst E. Kummer, Allgemeine Reziprozitätsgesetze für beliebig hohe Potenzreste, Monatsberichte der Königlichen Preußischen Akademie der Wissenschaften zu Berlin (1850), 154–165, Reprinted in [17, pages 345–357].Search in Google Scholar

[8] Ernst E. Kummer, Über die Ergänzungssätze zu den allgemeinen Reciprocitätsgesetzen, Journal für die reine und angewandte Mathematik 56 (1859), 270–279, Reprinted in [17, pages 688–697].10.1515/crll.1859.56.270Search in Google Scholar

[9] Franz Lemmermeyer, The Euclidean algorithm in algebraic number fields, Expositiones Mathematicæ 13 (1995), 385–416, Updated version, February 14, 2004.Search in Google Scholar

[10] Franz Lemmermeyer, Reciprocity Laws: From Euler to Eisenstein Springer Monographs in Mathematics, Springer, 2000.10.1007/978-3-662-12893-0Search in Google Scholar

[11] Hendrik W. Lenstra, Jr., Euclid’s algorithm in cyclotomic fields, Journal of the London Mathematical Society (2) 10 (1975), 457–465.10.1112/jlms/s2-10.4.457Search in Google Scholar

[12] Jean Monnerat and Serge Vaudenay, Short undeniable signatures based on group homomorphisms, Journal of Cryptology 24 (2011), 545–587.10.1007/s00145-010-9070-1Search in Google Scholar

[13] Renate Scheidler, A public-key cryptosystem using purely cubic fields, Journal of Cryptology 11 (1998), 109–124.10.1007/s001459900038Search in Google Scholar

[14] Renate Scheidler and Hugh C. Williams, A public-key cryptosystem utilizing cyclotomic fields, Designs, Codes and Cryptography 6 (1995), 117–131.10.1007/BF01398010Search in Google Scholar

[15] Henry J. S. Smith, Report on the Theory of Numbers (Part II) Collected Mathematical Papers (J. W. L. Glaisher, ed.), 1, The Clarendon Press, 1894, pp. 93–162.Search in Google Scholar

[16] The Sage developers, SageMath, the Sage Mathematics Software System (Version 8.6) 2019.Search in Google Scholar

[17] André Weil (ed.), Collected Papers I: Contributions to Number Theory Springer-Verlag, 1975.Search in Google Scholar

[18] André Weilert, Fast computation of the biquadratic residue symbol, Journal of Number Theory 96 (2002), 133–151.10.1016/S0022-314X(02)92783-6Search in Google Scholar

[19] Hugh C. Williams, An M3 public-key encryption scheme, in: Advances in Cryptology – CRYPTO’85 (H. C. Williams, ed.), Lecture Notes in Computer Science 218, pp. 358–368, Springer, 1986.10.1007/3-540-39799-X_26Search in Google Scholar

### A Formulary

In this appendix,we list the general formulas for the logarithmic differential quotients Δj(α) and for the quantities aj(αn).

We use Kummer’s notation (cf. Section 2.3) and represent an algebraic integer α= j=110ajζj[ζ] with T(α) ≠0 as α = F( ). The following lemma is useful; it relates F(k)(1) to Ak().

Lemma A.1. Let a= j=110ajζj[ζ]. Then, letting F(k) denote the kth derivative of F, F(k)(1) ≡ Ak(α) (mod 11) for 0 ≤ k ≤ 9.

Proof. The proof is immediate. From the definition of F, we have F(ev)= j=09evj where b0 = −a10 and bj = aja10 for 1 ≤ j ≤ 9. Hence, evaluating F(ev) at v = 0, we get F(1)= j=09bja10+ j=19(aja10) A0(α)11α10A0(α)(mod11). Also, for 1k9,F(k)(1) j=19jkbj j=19jk(aja10)Ak(α) a10 j=110jkAk(α)(mod11).  □

We assume that A0(α) ≢ 0 (mod 11). From Δ1(α)=F(1)F(1)F(1)=Δ1(α)F(1), we get by induction F(k)(1)= j=1k(k1j1)Δj(α)F(kj)(1) and therefore

(A1) Δk(α)=F(k)(1)F(1)j=1k1k1j1Δj(α)F(kj)(1)F(1).

So, using Lemma A.1 and letting aj := aj(α), we obtain the successive logarithmic differential quotients modulo 11.

1. Δ1(α) a1 (mod 11)

2. Δ2(α)a12+a2(mod11)

3. Δ3(α)2a133a2a1+a3(mod11)

4. Δ4(α)5a14+a2a124a3a13a22+a4(mod11)

5. Δ5(α)2a155a2a132a3a123a22a15a4a1+a3a2+a5(mod11)

6. Δ6(α)a163a2a14+a3a13+5a22a123a4a12a3a2a1+5a5a13a234a4a2+a32+a6(mod11)

7. Δ7(α)5a17a2a15+4a3a14+a22a13a4a13+5a3a2a122a5a123a23a1+a4a2a13a32a1+4a6a1+a3a22+a5a22a3a4+a7(mod11)

8. Δ8(α)2a183a2a16+a3a15+a22a143a4a142a3a2a13+5a5a13+4a23a12a4a2a12+3a32a12+a6a122a3a22a15a5a2a1a3a4a1+3a7a13a24+2a4a22a32a2+5a6a22a42a5a3+a8(mod11)

9. Δ9(α)5a19+5a2a17+2a3a162a22a15+5a4a155a3a2a14a5a145a23a13+a4a2a133a32a13+2a6a13+3a3a22a124a5a2a123a3a4a125a7a122a24a1+a4a22a1+5a32a2a12a6a2a1+3a42a14a5a3a1+2a8a13a3a233a5a22+a3a4a23a7a25a5a4a33+4a6a3+a9(mod11)

In order to get Δ11(α) mod 121, we resort on the general relation (A1). We define fj:=fj(α)=Fj(1)F(1) and obtain

Δ11(α)11(5f2f192f3f18f22f175f4f174f3f2f16+f5f16+5f23f15+4f4f2f15f32f152f6f152f3f22f14+3f5f2f14+5f4f3f14+5f7f14f24f13+4f4f22f132f32f2f13+4f6f2f133f5f3f13+5f42f132f8f13
3f3f23f124f5f22f12+5f4f3f2f122f7f2f125f33f12f6f3f12+4f5f4f12f9f12f25f13f4f23f1+5f32f22f1+4f6f22f1+5f5f3f2f1f42f2f1+2f8f2f15f4f32f12f7f3f1+2f6f4f1f52f1f10f1+4f3f24+4f5f232f4f3f22+4f7f22+4f3f2+4f6f3f25f5f4f25f9f2+4f5f32+5f42f34f8f3+3f7f4+2f6f5)+f11+10f111(mod121).

When α is primary, we have A0(α)0 (mod 11) and f1(α)f2(α)f4(α)f3(α)f5(α)f8(α)0 (mod 11). For α= j=110jζj primary, the previous relation then yields

Δ11(α)114f5f324f8f3+2f6f5+f11mod121112f6f5+f11mod121112a6a5+A11(α)A0(α)11a10mod121112a6a5+A11(α)A0(α)mod121112a6a5+f1+55a3a5+a7+a9(mod11)

where A11(α)= j=110j11 and

A1:=A1(α)=A1(α)A0(α)mod12111,

noting that A11(α)A1(α)11(a24a4+2a53a6+3a7a8a10)11(5A0(α)5A3(α)A5(α)+ A7(α)+A9(α) )(mod121).

We now look at the quantities aj(αn) for n > 1.We write { ni } as a shortcut to j!(nj)=n(n1)(nj+1) and again let aj:=aj(α). The next formulas expand those given by Corollary 4.2.

1. a1(αn){ n1 }a1(mod11)

2. a2(αn){ n1 }a2+{ n2 }a12(mod11)

3. a3(αn)n1a3+n23a1a2+n3a13(mod11)

4. a4(αn)n1a4+n2(4a1a3+3a22)n35a12a2+n4a14(mod11)

5. a5(αn)n1a5+n2(5a1a4a2a3)n3a1(a1a34a22)n4a13a2+n5a15(mod11)

6. a6(αn)n1a6n2(5a1a54a2a4+a32)+n3(4a12a4+5a1a2a3+4a23)n4a12(2a1a3a22)+n54a14a2+n6a16(mod11)

7. a7(αn)n1a7n2(4a1a6+a2a52a3a4)n3(a12a5+5a1a2a44a1a32+5a22a3)+n4a1(2a12a4+a1a2a35a23)+n5a13(2a1a35a22)n6a15a2+n7a17(mod11)

8. a8(αn)n1a8n2(3a1a7+5a2a6a3a52a42)n3(5a12a63a1a2a55a1a3a4a22a45a2a32)+n4(a13a5+2a12a2a4+5a12a32+4a1a22a35a24)+n5a12(4a12a4a1a2a3+2a23)+n6a14(a1a3+a22)n75a16a2+n8a18(mod11)

9. a9(αn)n1a9n2(2a1a83a2a7+4a3a65a4a5)+n3(3a12a7a1a2a62a1a3a54a1a42+4a22a55a2a3a4+5a33)n4(4a13a6+3a12a2a5+5a12a3a4+2a1a22a4a1a2a32+5a23a3)+n5a1(5a13a55a12a2a4+4a12a324a1a22a3a24)+n6a13(5a12a45a1a2a35a23)n7a15(4a1a34a22)+n83a17a2+n9a19(mod11)