The Eleventh Power Residue Symbol

Marc Joye; Oleksandra Lapiha; Ky Nguyen; David Naccache

doi:10.1515/jmc-2020-0077

Open Access Published by De Gruyter November 17, 2020

The Eleventh Power Residue Symbol

Marc Joye , Oleksandra Lapiha , Ky Nguyen and David Naccache

From the journal Journal of Mathematical Cryptology

https://doi.org/10.1515/jmc-2020-0077

Abstract

This paper presents an efficient algorithm for computing 11^th-power residue symbols in the cyclo-tomic field ℚ(ζ11), where ₁₁ is a primitive 11^th root of unity. It extends an earlier algorithm due to Caranay and Scheidler (Int. J. Number Theory, 2010) for the 7^th-power residue symbol. The new algorithm finds applications in the implementation of certain cryptographic schemes.

Keywords: Power residue symbol; Cyclotomic field; Reciprocity law; Cryptography

MSC 2010: 11A15; 11R18; 11A05; 11Y40; 11T71

1 Introduction

Quadratic and higher-order residuosity is a useful tool that finds applications in several cryptographic constructions. Examples include [6, 13, 14, 19] for encryption schemes and [1, 2, 12] for authentication schemes and digital signatures. A central operation therein is the evaluation of a residue symbol of the form [ αλ ] without factoring the modulus λ in the cyclotomic field ℚ(ζ_p), where ζ_p is a primitive p^th root of unity.

For the case p = 2, it is well known that the Jacobi symbol can be computed by combining Euclid’s algorithm with quadratic reciprocity and the complementary laws for −1 and 2; see e.g. [10, Chapter 1]. This eliminates the necessity to factor the modulus. In a nutshell, the computation of the Jacobi symbol (an)2 proceeds by repeatedly performing 3 steps: (i) reduce a modulo n so that the result (in absolute value) is smaller than n/2, (ii) extract the sign and the powers of 2 for which the symbol is calculated explicitly with the complementary laws, and (iii) apply the reciprocity law resulting in the ‘numerator’ and ‘denominator’ of the symbol being flipped. Eventually, the numerator of the symbol becomes ±1 and the algorithm terminates with the value of (an)2. Under certain conditions, this methodology naturally extends to higher values for p. The case p = 3 is discussed in [4, 14, 19], the case p = 4 in [4, 18], the case p = 5 in [14], the case p = 7 in [3], and the case p = 8 in [10, Chapter 9].

Caranay and Scheidler describe a generic algorithm in [3, Section 7] for computing the p^th-power residue symbol for any prime p ≤ 11, building on Lenstra’s norm-Euclidean algorithm. They also provide a detailed implementation for the case p = 7. The case p = 11 is difficult. We quote from [3]:

“Even for the case p = 11, for which Euclidean division remains straightforward, the other details of the method get increasingly complicated. Finding explicit conditions for a cyclotomic integer to be primary becomes more and more technical, as does an algorithm to find a primary associate. The cyclotomic field generated by an 11^th primitive root of unity has four fundamental units, so complementary laws need to be found for three of them as well as for the ramified prime lying above 11 (or for 11 itself).”

The general case is addressed in a recent algorithm by de Boer and Pagano [5].

Our contributions

This paper takes up the challenge put forward in [3] and presents the first implementation of the Caranay– Scheidler algorithm for the 11^th-power residue symbol. The contributions of this paper are three-fold: We provide explicit conditions for primary algebraic integers in ℤ[ζ₁₁];we devise an efficient algorithm for finding a primary associate; and we give explicit complementary laws for a set of four fundamental units and for the special prime 1 − ζ₁₁.

Organization

The rest of this paper is organized as follows. In Section 2,we review some basic definitions and known results on cyclotomic fields. Section 3 particularizes to the 11^th cyclotomic field.We establish and prove an efficient criterion for primary cyclotomic integers. We also define a set of four fundamental units and give explicit formulas to find their index. Section 4 is the core of the paper. We present the ingredients and develop the companion algorithms for the computation of the eleventh power residue symbol.

2 Higher-Order Power Residue Symbols

Throughout this section, p ≤ 13 denotes an odd rational prime.

2.1 Basic definitions and notation

Fix ζ:=ζp=e2πi/p a primitive p^th root of unity and let ω = 1 − ζ . The number field ℚ(ζ) defines the p^th cyclotomic field. The ring of integers of ℚ(ζ) is ℤ[ζ ] and is norm-Euclidean [9, 11] (in particular, it is a unique factorization domain). Since ζ,ζ2,…,ζp−1 form an integral basis for ℚ(ζ), any element α∈ℤ[ζ] can be expressed as α=∑j=1p−1ajζj with a_j ∈ Z. The norm and trace of α∈ℤ[ζ] are the rational integers respectively given by N(α)=∏k=1p−1σk(α) and T(α)=∑k=1p−1σk(α), where σk:ζ↦ζk. The group of units of ℤ[ζ ] is the direct product of ⟨±ζ ⟩ and a free abelian group ε of rank r = (p − 3)/2. The generators of ε are called fundamental units and will be denoted by η1,…,ηr. Two elements α and β are called associates if they differ only by a unit factor. We write α~β

We follow the approach of Kummer. A central notion is that of primary elements (see [7, p. 158]) in ℤ[ζ ].

Definition 2.1

An element α∈ℤ[ζ] is said to be primary whenever it satisfies

α≡0 ( mod ω),

α≡B ( mod ω2),

αα¯≡B2 ( mod p)

for some B ∈ Z.

Lemma 2.2

([3, Lemma 2.6]). Every element α∈ℤ[ζ] with α≡0( mod ω) has a primary associate α* of the form

α⋆=±ζe0η1e1⋯ηrerα where 0≤e0,e1,…,er≤p−1.

Moreover, α* is unique up to its sign.

2.2 Kummer’s reciprocity law

Let α,π∈ℤ[ζ] with π prime, π≁ω, and π∤α. The p^th-power residue symbol [ απ ]p is then defined to be the p^th-root of unity ζ ⁱ such that

α(N(π)−1)/p≡ζi ( mod π).

This exponent i (with 0 ≤ i ≤ p − 1) is called the index of α w.r.t. π and is noted ind_π(α). If π divides α then [ απ ]p=0.

Analogously to the Legendre symbol, the p^th-power residue symbol generalizes: For any α,λ∈ℤ[ζ] with λ non-unit and gcd(λ, ω) ∼ 1, writing λ=∏jπjej for primes π_j in ℤ[ζ], the generalized p^th-power residue symbol [ αλ ]p is defined as [ αλ ]p=∏j[ απj ]pej.

Kummer [7] stated the reciprocity law in 1850 (see also [15, Art. 54]). It is restricted to so-called “regular” primes, ^[1]which include odd primes p ≤ 13. Although initially formulated for primary primes in ℤ[ζ ], the reciprocity law readily extends to all primary elements; see [3, Corollary 3.4].

Theorem 2.3

(Kummer’s Reciprocity Law). Let α and λ be two primary elements in ℤ[ ]. Then [ αλ ]p=[ λα ]p.

2.3 Complementary laws

The special prime ω and its conjugates are excluded from Kummer’s reciprocity law. Moreover, it does not apply to units other than ±1 as they are not primary. For these elements, the p^th-power residue symbol is determined through complementary laws, also stated by Kummer [7, 8] (see also [15, Art. 55]). The complementary laws rely on the logarithmic differential quotients given by

Δn(α)=dnln(F(ev))dvn|V=0

for any α=∑j=1p−1ajζj∈ℤ[ζ] with T(α)≠0 and where F(X)=∑j=0p−2bjXj∈ℤ[X] whose coefficients are b0=−ap−1 and bj=aj−ap−1 for 1≤j≤p−2. Notice that α=F(ζ).

Theorem 2.4

(Complementary Laws). Let π be a primary prime in ℤ[ζ ]. Then,

indπ(p)≡Δp(π)p (mod p);
for any unit ε∈ℤ[ζ]*,

indπ(ε)≡Δ1(ε)N(π)−1p+∑i=1rΔ2i(ε)Δp−2i(π)(modp)

where r = (p − 3)/2.

For completeness, we give the complementary laws for ±1 and ζ . Alternatively, they can be obtained directly from the definition of the p^th-power residue symbol. The next corollary is a straightforward extension to composite moduli.

Corollary 2.5

([3, Corollary 3.6]). Let λ∈ℤ[ζ] such that ω∤λ. Then [ ±1λ ]p=1 and [ ζλ ]p=ζN(λ)−1p mod p.

3 The Case p = 11

This section presents results for the special case p = 11. We henceforth assume that ζ:=ζ11 is a primitive 11^th root of unity.

3.1 Primary elements

Definition 2.1 explicitly characterizes primary elements. The next proposition specializes it for prime p = 11 in order to have a simple criterion involving only rational integers.

It is useful to introduce some notation. For α=∑j=110ajζj∈ℤ[ζ], we define the rational integers Ak(α)= ∑j=110ajjk, for 0 ≤ k ≤ 9. Also, when A0(α)≡0 (mod 11), we define aj(α)=Aj(α)A0(α) mod 11, for 1 ≤ j ≤ 9. Notice that A₀(α) = − T().

Proposition 3.1

Let α=∑j=110ajζj∈ℤ[ζ] and Ak:=Ak(α). Then α is primary if and only if the following conditions hold:

A₀ ≢ 0 (mod 11);
A₁ ≡ 0 (mod 11);
A₂ ≡ A₄ ≡ 0 (mod 11);
Ak:=Ak(α)A0A6+A32≡0( mod 11) ;
A3A5−A0A8≡0( mod 11).

Proof. Let ω = 1 − ζ . From Definition 2.1, α is primary if and only if α /≡ 0 (mod ω), α ≡ B (mod ω²), and αα¯≡B2 (mod 11) for some rational integer B. We have ∑i=110ajζj≡∑j=110aj(1−ω)j≡∑j=110aj(1−jω)≡ A₀ − A₁ ω (mod ω²). As a result, the condition α≡0 (mod ω) is equivalent to A₀ /≡ 0 (mod ω), and the condition α ≡ B (mod ω²) with B = A₀ ∈ ℤ is equivalent to A1ω≡0( mod ω2) ⇔A1≡0 (mod ω). We observe that rational integers are congruent modulo ω if and only if they are congruent modulo p (in this case 11). We therefore have A0≡0( mod ω) ⇔ A0≡0( mod 11) and A1≡0( mod ω) ⇔A1≡0 (mod 11).

It remains to look at the third condition, αα¯≡A02 (mod 11). Using matrix notation and defining the Vandermonde matrix

V=(111…11222…29⋮⋮⋮⋱⋮110102…109) ( mod 11) ,

we can express (A0,…,A9) as (A0,…,A9)=(a1,…,a10) V. In turn, we can write α≡∑j=110aj(1−ω)j≡ (a1,…,a10)(1−ω,…,(1−ω)10)⊤≡(A0,…,A9)V−1((1−ω),…,(1−ω)10)⊤( mod 11). . Similarly, we can write α¯≡∑j=110ajζ11−j≡∑j=110aj(1−ω)11−j≡(A0,…,A9)V−1( (1−ω)10,. …(1−ω))⊤. Hence, noting that ω¹⁰ ∼ 11, the product αα¯ (mod 11) can be put after a little algebra in the form of a degree-9 polynomial in ω:

(1) αα¯≡A02(A0A2−A12)ω2+(A0A2−A12)ω3+(A0A4−4A1A3+3A22)ω4+(−A0A2+2A0A4+A12+3A1A3−5A22)ω5+(4A0A2+A0A4−4A0A6−4A12−4A1A3+2A1A5+3A22−5A2A4−4A32)ω6+(4A0A2−2A0A4−A0A6−4A12−3A1A3−5A1A5+5A22−4A2A4−A32)ω7+(−5A0A4−A0A6−4A0A8−2A1A3−5A1A5−A1A7−4A22−4A2A4−2A2A6−A32+4A3A5+3A42)ω8+(4A0A2+5A0A4−3A0A6−5A0A8−4A12+2A1A3−4A1A5−4A1A7+4A22−A2A4+3A2A6−3A32+5A3A5+A42)ω9(mod11).

For conciseness,we write C_j the rational coefficient of ω^j in the right hand side of Eq. (1): αα¯≡A02+∑j=29Cjωj (mod 11). The condition αα¯≡A02 (mod 11) can be thus rewritten as ∑j=29Cjωj≡0 (mod 11). Further, since ω^j | 11 for 2 ≤ j ≤ 9, we get C2ω2≡0( mod ω3)⇔C2≡0( mod ω)⇔C2≡0( mod 11), C2ω2+C3ω3≡C3ω3≡0( mod ω4)⇔ C3≡0( mod ω)⇔C3≡0( mod 11), and so on: C₄ ≡ 0(mod 11), ..., C₉ ≡ 0 (mod 11). Now, assuming A₀ ≡ 0 (mod 11) and A₁ ≡ 0 (mod 11) in Eq. (1), the congruences C2≡C3≡C4≡⋯≡C9≡0 (mod 11) yield A2≡A4≡A0A6+A32≡−A0A8+A3A5≡0 (mod 11). This completes the proof.

3.2 Fundamental units

For p = 11, the fundamental_units() function from SageMath [16] provides the set { v1,v2,v3,v4 } of fundamental units, with v1=ζ+1,v2=ζ2+1,v3=ζ2+ζ+1,v4=ζ6+ζ.

Every unit can be rendered real by multiplying it by some power of . Another set of fundamental units is so given by { η1,η2,η3,η4 } with η1=ζ5v1,η2=ζ10v2,η3=ζ10v3, and η4=ζ2v4. Observe that

η1=ζ5+ζ−5,

η2=ζ+ζ−1,

η3=ζ−1(1+ζ+ζ2),

η4=ζ3+ζ−3,

and ηi=σ−1(ηi) for 1 ≤ i ≤ 4, where σ−1:ζ↦ζ−1. We will use this set { η1,η2,η3,η4 } of fundamental units in later computations.

Remark 3.2

Suppose α∈ℤ[ ζ ] is real (i.e., α=α¯). Then 2A1(α)≡A1(2α)≡A1(α+α¯)≡0( mod 11)⇔ A1(α)≡0( mod 11). Since the units η1,…,n4 are real, it follows that A1(η1)≡A1(η2)≡A1(η3)≡ A1(η4)≡0( mod 11).

We now apply Theorem 2.4 to find the index of the fundamental units ηi,1≤i≤4, and of special prime ω.

Proposition 3.3

Let π be a primary prime in ℤ[ζ ]. Then

indπ(η1)≡a3(π)+3a5(π)+4a7(π)+4a6(π)a3(π)+3a9(π) (mod 11),

indπ(η2)≡3a3(π)+5a5(π)−2a7(π)+5a6(π)a3(π)+a9(π) ( mod 11),

indπ(η3)≡2a3(π)−2a5(π)+3a7(π)−4a6(π)a3(π)−3a9(π) (mod 11),

indπ(η4)≡4a3(π)+4a5(π)+3a7(π)+a6(π)a3(π)−2a9(π) (mod 11),

and

indπ(ω)≡5a6(π)a3(π)−2a6(π)a5(π)−A1(π)−5N(π)−111−5 (mod 11)

where A1(π)=A1(π)A0(π) mod 12111.

Proof. Let π∈ℤ[ ζ ] be a primary prime. Recalling that A1(ηi)≡0( mod 11) for 1 ≤ i ≤ 4, we have Δ1(ηi)≡0 (mod 11); see Appendix A. Applied to ηⁱ, the general formula for computing the index w.r.t. a primary prime (cf. Theorem 2.4) becomes indπ(ηi)≡Δ2(ηi)Δ9(π)+Δ4(ηi)Δ7(π)+Δ6(ηi)Δ5(π)+Δ8(ηi)Δ3(π) (mod 11). An application of the formulas given in Appendix A yields

	Δ2(ηi) mod 11	Δ4(ηi) mod 11	Δ6(ηi) mod 11	Δ8(ηi) mod 11
i = 1	3	4	3	1
i = 2	1	9	5	3
i = 3	8	3	9	2
i = 4	9	3	4	4

Further, π being primary and thus A0(π)≡0( mod 11) and a1(π)≡a2(π)≡a4(π)≡a6(π)+a3(π)2≡0 (mod 11), those formulas also yield, modulo 11,

Δ3(π)≡a3(π), Δ5(π)≡a5(π), Δ7(π)≡a7(π),

Δ9(π)≡−a3(π)3+4a6(π)a3(π)+a9(π)≡5a6(π)a3(π)+a9(π).

Plugging all these quantities in the above expression for indπ(ηi) gives the desired result.

For ω, since ω_¹⁰ ∼ 11, there exists a unit ε such that εω10=11. This holds for ε=∏j=1101−ζj1−ζ= −ζ6η14η22η32η4−2. As a result, owing to the multiplicative nature of the power residue symbol, we have indπ(ω)≡indπ(ε)−indπ(11)( mod 11) where indπ(ε)≡indπ(−1)+6indπ(ζ)+4indπ(η1)+2indπ(η2)+ 2indπ(η3)−2indπ(η4)≡0+6N(π)−111+6a3(π)+10a5(π)+a7(π)+5a6(π)a3(π)+a9(π)( mod 11) from Corollary 2.5 and using the previously obtained expressions for ind_π(η_i). The result now follows by plugging the value for indπ(11)≡Δ11(π)11( mod 11); see Eq. (A2) in Appendix A. □

4 Computation of the Eleventh Power Residue Symbol

4.1 Obtaining primary associates

We need to investigate the multiplicative properties of the Ak's. Namely, given α,β∈ℤ[ζ], how to relate A_k(αβ) to A_r(α) and A_s(β)? We also need to express ak(αn) as a function of aj(α)

Proposition 4.1

Let α,β∈ℤ[ζ]. Then, for 0 ≤ k ≤ 9,

Ak(αβ)≡∑j=0kkjAj(α)Ak−j(β)mod11.

Proof. Using ζ ¹¹ = 1, the product of α=∑j=110ajζj and β=∑j=110bjζj satisfies αβ=∑ℓ=220cℓζℓ=c11+c12ζ+ ∑j=29(cj+cj+11)ζj+c10ζ10, where cℓ=∑ m+n=ℓ1≤m,n≤10 a_mb_n. Hence, we get

Ak(αβ)≡Ak(c11)+Ak(c12ζ+∑j=29(cj+cj+11)ζj+c10ζ10)≡Ak(c11)+c12+∑j=29(cj+cj+11)jk+c1010k≡Ak(c11)+∑2≤ℓ≤20ℓ≠11cℓℓk(mod11).

Furthermore, Ak(c11)≡Ak(c11(−∑ j=110ζj))≡−c11(∑ j=110jk) (mod 11). So, for k = 0, we get A0(c11)≡c11 (mod 11) and thus A0(αβ)≡∑ 2≤ℓ≤20cℓ (mod 11). For k ≥ 1, we get Ak(c11)≡0 (mod 11), which leads to Ak(αβ)≡∑ 2≤ℓ≤20 ℓ≠11cℓℓk≡∑ 2≤ℓ≤20cℓℓk (mod 11). Therefore, in all cases, we have

Ak(αβ)≡∑2≤ℓ≤20cℓℓk≡∑2≤ℓ≤20(∑m+n=ℓ1≤m,n≤10ambn)ℓk≡∑m=110∑n=110ambn(m+n)k≡∑m=110∑n=110ambn(∑j=0kkjmjnk−j)≡∑j=0kkj∑m=110∑n=110ambnmjnk−j≡∑j=0kkj(∑m=110ammj)(∑n=110bnnk−j)≡∑j=0kkjAj(α)Ak−j(β)(mod11),

which completes the proof.

Corollary 4.2

Let α∈ℤ[ζ] and let n ∈ N. Then

A0(αn)≡A0(α)n ( mod 11)

and, provided that A0(α)≡0 ( mod 11), for 1 ≤ k ≤ 9,

akαn≡∑ℓ=1knℓhk,ℓ(α)(mod11)

where

hk,ℓ(α)={ ak(α) for ℓ=1∑ j=1k−ℓ+1(kj) hk−j,ℓ−1(α)aj(α) for 2≤ℓ≤k .

Proof. This is a direct application of Proposition 4.1.

Proposition 4.3

Let η1=ζ5+ζ−5,η2=ζ+ζ−1,η3=ζ−1(1+ζ+ζ2), and n4=ζ3+ζ−3. Let also α ∈ ℤ[ζ] with A₀(α) ≢ 0 (mod 11) and A₁(α) ≡ 0 (mod 11). If rational integers 0 ≤ e₁, e₂, e₃, e₄ ≤ 10 verify

(2) ∑i=14a2ηiei≡−a2(α)(mod11)∑i=14a4ηi−3a2ηi2ei≡−a4(α)+3a2(α)2(mod11)∑i=14a6ηi−4a4ηia2ηi−3a2ηi3ei≡−a6(α)+4a4(α)a2(α)−a3(α)2+3a2(α)3(mod11)∑i=14a8ηi+5a6ηia2ηi−2a4ηi2+2a4ηia2ηi2−3a2ηi4ei≡−a8(α)−5a6(α)a2(α)+a5(α)a3(α)+2a4(α)2−2a4(α)a2(α)2+a3(α)2a2(α)+3a2(α)4(mod11)

then α⋆=η1e1η2e2η3e3η4e4α is a primary associate of .

Proof. Write E=ε1ε2ε3ε4 and εi=ηiei. Hence, α^* = ε α is an associate of α. It is worth noting that ε is real and thus A1(ε)≡a1(ε)≡0 (mod 11). Proposition 3.1 lists the conditions for α^* being primary. From Proposition 4.1 and Corollary 4.2 (see also Appendix A), we get A0(ε)≡∏ i=14A0(εi)≡∏ i=14A0(ηi)ei (mod 11). Therefore, since A0(ηi)≠0( mod 11), it follows that A₀(α^*) ≡ A₀(ε)A₀(α) ≡ /0 (mod 11). Further, since A1(α)≡A1(ε)≡0 (mod 11), we also have A1(α⋆)≡A0(ε)A1(α)+A1(ε)A0(α)≡0( mod 11).

Likewise, again from Proposition 4.1 and Corollary 4.2, we find after a little algebra a2(ε)≡∑ i=14a2(εi)≡ ∑i=14a2(ηi)ei (mod 11). Consequently, since α^* = ε α, the condition A₂(α^*) ≡ 0 (mod 11) translates into A2(α⋆)≡A0(ε)A2(α)+A2(ε)A0(α)≡0⇔a2(ε)≡A2(ε)A0(ε)≡−A2(α)A0(α)≡−a2(α)(mod 11), that is ∑i=14a2(ηi)ei≡−a2(α)( mod 11).

The calculation for a₄(ε) is more involved and technical. An application of Proposition 4.1 and Corollary 4.2 yields a4(ε)≡∑i=14( a4(ηi)ei+ 3a2(ηi)2ei(ei−1) )+6∑i=13(∑j=i+14a2(ηi)a2(ηj)eiej) (mod 11). In turn, as ∑i=14a2(ηi)ei≡−a2(α) (mod 11), we therefore obtain a4(ε)≡∑i=14(a4(ηi)−3a2(ηi)2)ei+ 3(∑i=14a2(ηi)ei)2≡[ ∑i=14(a4(ηi)−3a2(ηi)2)ei ]+3a2(α)2 (mod 11). The condition A₄(α^*) ≡ 0 (mod 11) so leads to a₄(α) + 6a₂(ε) a₂(α) + a₄(ε) ≡ 0 (mod 11) ⇐⇒ a₄(ε) ≡ −a₄(α) + 6a₂(α)² (mod 11), that is ∑i=14(a4(ηi)−3a2(ηi)2)ei≡−a4(α)+3a2(α)2 (mod 11).

The two remaining relations are proved similarly as a respective consequence of A0(α⋆)A6(α⋆)+A3(α⋆)2≡ 0( mod 11) and A3(α⋆)A5(α⋆)−A0(α⋆)A8(α⋆)≡0( mod 11). Notice that a₃(ε) ≡ a₅(ε) ≡ a₇(ε) ≡ 0 (mod 11). □

From Lemma 2.2, applied to the case p = 11, we know that every α ∈ ℤ[ζ ] with α ≡ /0 (mod ω) has a primary associate of the form

α⋆=±ζe0η1e1η2e2η3e3η4e4α

where 0 ≤ e₀, e₁, e₂, e₃, e₄ ≤ 10 and α* is unique up to the sign. First, we observe that the sign does not affect the fact of being primary. Indeed, from Proposition 3.1, it is easily seen that if α* is primary then so is −α*. Second, as shown in the proof of Proposition 3.1, we observe that the condition α /≡ 0 (mod ω) is equivalent to A₀(α) ≢ 0 (mod 11).

Applying Proposition 4.3 demands that α satisfies A₀(α) ≢ 0 (mod 11) and A₁(α) ≡ 0 (mod 11). It turns out that if A₀(α) ≢ 0 (mod 11) then

α′:=ζ−a1(α)α

satisfies A0(α′)≡A0(ζ−a1(α))A0(α)≡A0(α)≡0( mod 11) and A1(α′)≡A0(ζ−a1(α))A1(α)+A1(ζ−a1(α))A0(α)≡ A1(α)−a1(α)A0(α)≡0( mod 11). Note that AQ(ζ)=A1(ζ)=1.

Putting all together, we therefore obtain an efficient way to compute a primary associate of an element α ∈ ℤ[ζ] with A₀(α) ≢ /0 (mod 11). This is depicted in Algorithm 1. With matrix notation, letting (w₁, w₂, w₃, w₄) denote the right-hand side of (2) (i.e., w₁ = −a₂(α), etc) and replacing the aj(ηi)′s by their respective values, the system of equations (2) can be rewritten as

(e1,e2,e3,e4)M≡(w1,w2,w3,w4) ( mod 11)

and so

(e1,e2,e3,e4)≡(w1,w2,w3,w4)M−1 (mod 11)

where M−1=(−241−3−435−15−5−34−32−31) ( mod 11) .

Algorithm 1: Computing α* and its representation

Input: α∈ℤ[ζ] with A0(α)≡0( mod 11)

α⋆=ζe0η1e1η2e2η3e3η44e4α Output: primary(α) = α* and repr(α) = (e₀, e₁, e₂, e₃, e₄) with α∗=ζe0η1e1η2e2η3e3η4e4α primary

e0←−a1(α)(mod11)

α←ζe0α

w1←−a2(α)( mod 11)

w2←−a4(α)+3a2(α)2( mod 11)

w3←−a6(α)+4a4(α)a2(α)−a3(α)2+3a2(α)3( mod 11)

w4←−a8(α)−5a6(α)a2(α)+a5(α)a3(α)+2a4(α)2−2a4(α)a2(α)2+a3(α)2a2(α)+3a2(α)4( mod 11)

e1←−2w1−4w2+5w3−3w4( mod 11)

e2←4w1+3w2−5w3+2w4( mod 11)

e3←w1+5w2−3w3−3w4( mod 11) e4←−3w1−w2+4w3+w4( mod 11)

α⋆←η1e1η2e2η3e3η4e4α

return [α*, (e₀, e₁, e₂, e₃, e₄)]

4.2 Norm-Euclidean division

The last ingredient for our algorithm is a norm-Euclidean division. For p = 11, the ring ℤ[ζ] is known to be norm-Euclidean, i.e., for all α, λ ∈ ℤ[ζ], there exists some ρ ∈ ℤ[ζ] such that ρ ≡ α (mod λ) and N(ρ) < N(). In [11], Lenstra provides an efficient algorithm for approximating an algebraic number χ∈ℚ(ζ) by an algebraic integer ι ∈ ℤ[ζ] satisfying N(χ−ι)<1. See also [14, Algorithm 5.1] or [3, Algorithm 7.1]. Therefore, if we let χ=αλ=α∏j=210σj(λ)N(λ)∈ℚ(ζ), we obtain l∈ℤ∣ζ] such that N( − ι) < 1, and thus ρ := α − ιλ verifies ρ ≡ α (mod λ) and N(ρ)=N(λ)N(χ−ι)<N(λ). We write ρ = euclid_div(α,λ).

4.3 Our algorithm

The main result is the hendecic reciprocity law.

Theorem 4.4

(Hendecic Reciprocity). Let α and λ be two primary elements in ℤ[ζ ]. Then

[ αλ ]11=[ λα ]11.

Moreover,

[ +1λ ]11=1, [ ζλ ]11=ζN(λ)−111 [ ζ5+ζ−5λ ]11=ζa3(λ)+3a5(λ)+4a7(λ)+4a6(λ)a3(λ)+3a9(λ) [ ζ+ζ−1λ ]11=ζ3a3(λ)+5a5(λ)−2a7(λ)+5a6(λ)a3(λ)+a9(λ)[ ζ−1(1+ζ+ζ2)λ ]11=ζ2a3(λ)−2a5(λ)+3a7(λ)−4a6(λ)a3(λ)−3a9(λ)

[ ζ3+ζ−3λ ]11=ζ4a3(λ)+4a5(λ)+3a7(λ)+a6(λ)a3(λ)−2a9(λ)

and, letting A1(λ)=A1(λ)/A0(λ) mod 12111,

[ 1−ζλ ]11=ζ5a6(λ)a3(λ)−2a6(λ)a5(λ)−A1(λ)−5N(λ)−111−5.

Proof. The first statement is Theorem 2.3 for p = 11. The second statement for units ±1 and ζ is Corollary 2.5 for p = 11; note that ω∤λ because λ is primary.

The last statements are proved in Proposition 3.3 for a primary prime λ. We need to show that Proposition 3.3 remains valid for any primary element λ ∈ ℤ[ζ]. Actually, it is sufficient to consider the case of λ being of the form λ = π₁ π₂ for two primary primes π₁ and π₂. If π₁ and π₂ are primary then Proposition 3.1 tells that a1(πi)≡a2(πi)≡a4(πi)≡a6(πi)+a3(πi)2≡0 (mod 11), i ∈ {1, 2}. Combined with Proposition 4.1, we so obtain for j ∈ {3, 5, 7}, a_j(π₁ π₂) ≡ a_j(π₁) + a_j(π₂) (mod 11). We also obtain a6(π1π2)a3(π1π2)≡a6(π1)a3(π1)+a6(π2)a3(π2)+3a6(π1)a3(π2)+3a6(π2)a3(π1)( mod 11) and a₉(π₁ π₂) ≡

η1=ζ5+ζ−5, It is now easily checked, for a9(π1)+a9(π2)−4a6(π1)a3(π2)−4a6(π2)a3(π1)( mod 11). that a3(π1π2)+3a5(π1π2)+4a7(π1π2)+4a6(π1π2)a3(π1π2)+3a9(π1π2)≡indπ1(η1)+indπ2(η1)≡indπ1π2(η1) (mod 11) where the values of indπ1(η1) and indπ2(η1) are given by Proposition 3.3; and similarly for the other fundamental units η₂ = ζ + ζ ⁻¹, η₃ = ζ ⁻¹(1 + ζ + ζ ²), and η₄ = ζ + ζ ⁻³. The proof for ω = 1 − ζ essentially follows the same lines using a refinement of Proposition 4.1 for A₁(α) mod 121. □

[ αλ ]11.

Theorem 4.4 gives rise to an efficient algorithm for computing the 11^th-power residue symbol It requires α and λ to be co-prime and T(λ) ≢ 0 (mod 11) (as otherwise the symbol is not defined). As a reminder, ω η1=ζ5+ζ−5, η2=ζ+ζ−1, η3=ζ−1(1+ζ+ζ2), η4=ζ3+ζ−3 stands for the special prime 1 − ζ and arefundamental units.

Algorithm 2: Computing [ αλ ]11

Input: α, λ ∈ ℤ[ζ] with gcd(α, λ) ∼ 1 and T(λ) ≢ 0 (mod 11)

[ αλ ]11 Output:

λ^* ← primary(λ)

j ← 0

while N(^*)> 1 do

ρ ← euclid_div(α, λ^*)

s ← 0

while T() ≡ 0 (mod 11) do

S←S+1ρ←ρ÷ω

end

[ ρ*,(e0,e1,e2,e3,e4) ]←[primary(ρ),repr(ρ)]

// ρ⋆=ζe0η1e1η2e2η3e3η4e4ρ j←j+s×indλ⋆(ω)−e0×indχ⋆(ζ)−e1×indλ⋆(η1) −e2×indλ⋆(η2)−e3×indλ⋆(η3)−e4×indλ⋆(η4)( mod 11)

α ← λ^*; λ^* ← ρ*

end

return ζ ^j

Proposition 4.5

Algorithm 2 is correct.

Proof. Clearly, we have [ αλ ]11=[ αλ⋆ ]11=[ euclid_d1v(α,λ⋆)λ⋆ ]11.

Let α(in) and λ⋆(in) (resp. α(out) and λ⋆(out) ) denote the values of α and of λ* when entering (resp. exiting) the outer while-loop. Define ϱ:=euclid−div(α(in),λ⋆(in)) At the end of the inner while-loop, we have ρ⋆= ζe0η1e1η2e2η3e3η4e4ϱω−s and so [ ϱλ⋆ ]11 =[ p⋆λ⋆ ]11⋅ζs⋅indλ⋆(ω)−e0⋅indλ⋆(ζ)−∑ i=14ei⋅indλ⋆(ηi), and wherein indλ⋆(ω),indλ⋆(ζ) and indλ⋆(ηi) are evaluated using Theorem 4.4 and [ ρ⋆λ⋆ ]11=[ λ⋆ρ⋆ ]11 by hendecic reciprocity. The last step of the outer while-loop replaces (α, λ*) with (λ*, ρ*). Since ℤ[ζ] is norm-Euclidean, it follows that the norm of λ* strictly decreases: N(λ⋆(out))=N(ρ⋆)=N(ϱ)/N(ω)s≤N(ϱ)<N(λ⋆(in)). It eventually becomes 1 and the algorithm terminates. □

References

[1] William D. Banks, Daniel Lieman and Igor E. Shparlinski, An extremely small and efficient identification scheme, in: Information Security and Privacy (ACISP 2000) (E. Dawson et al., eds.), Lecture Notes in Computer Science 1841, pp. 378–384, Springer, 2000.10.1007/10718964_31Search in Google Scholar

[2] Éric Brier, Houda Ferradi, Marc Joye and David Naccache, New number-theoretic cryptographic primitives, Journal of Mathematical Cryptology (To appear).10.1515/jmc-2019-0035Search in Google Scholar

[3] Perlas C. Caranay and Renate Scheidler, An efficient seventh power residue symbol algorithm, International Journal of Number Theory 6 (2010), 1831–1853.10.1142/S1793042110003770Search in Google Scholar

[4] Ivan Bjerre Damgård and Gudmund Skovbjerg Frandsen, Eflcient algorithms for the gcd and cubic residuosity in the ring of Eisenstein integers, Journal of Symbolic Computation 39 (2005), 643–652.10.1016/j.jsc.2004.02.006Search in Google Scholar

[5] Koen de Boer and Carlo Pagano, Calculating the power residue symbol and ibeta: Applications of computing the group structure of the principal units of a p-adic number field completion, in: 42nd International Symposium on Symbolic and Algebraic Computation (M. A. Burr et al., eds.), pp. 117–124, ACM, 2017.10.1145/3087604.3087637Search in Google Scholar

[6] Shafi Goldwasser and Silvio Micali, Probabilistic encryption, Journal of Computer and System Sciences 28 (1984), 270–299.10.1016/0022-0000(84)90070-9Search in Google Scholar

[7] Ernst E. Kummer, Allgemeine Reziprozitätsgesetze für beliebig hohe Potenzreste, Monatsberichte der Königlichen Preußischen Akademie der Wissenschaften zu Berlin (1850), 154–165, Reprinted in [17, pages 345–357].Search in Google Scholar

[8] Ernst E. Kummer, Über die Ergänzungssätze zu den allgemeinen Reciprocitätsgesetzen, Journal für die reine und angewandte Mathematik 56 (1859), 270–279, Reprinted in [17, pages 688–697].10.1515/crll.1859.56.270Search in Google Scholar

[9] Franz Lemmermeyer, The Euclidean algorithm in algebraic number fields, Expositiones Mathematicæ 13 (1995), 385–416, Updated version, February 14, 2004.Search in Google Scholar

[10] Franz Lemmermeyer, Reciprocity Laws: From Euler to Eisenstein Springer Monographs in Mathematics, Springer, 2000.10.1007/978-3-662-12893-0Search in Google Scholar

[11] Hendrik W. Lenstra, Jr., Euclid’s algorithm in cyclotomic fields, Journal of the London Mathematical Society (2) 10 (1975), 457–465.10.1112/jlms/s2-10.4.457Search in Google Scholar

[12] Jean Monnerat and Serge Vaudenay, Short undeniable signatures based on group homomorphisms, Journal of Cryptology 24 (2011), 545–587.10.1007/s00145-010-9070-1Search in Google Scholar

[13] Renate Scheidler, A public-key cryptosystem using purely cubic fields, Journal of Cryptology 11 (1998), 109–124.10.1007/s001459900038Search in Google Scholar

[14] Renate Scheidler and Hugh C. Williams, A public-key cryptosystem utilizing cyclotomic fields, Designs, Codes and Cryptography 6 (1995), 117–131.10.1007/BF01398010Search in Google Scholar

[15] Henry J. S. Smith, Report on the Theory of Numbers (Part II) Collected Mathematical Papers (J. W. L. Glaisher, ed.), 1, The Clarendon Press, 1894, pp. 93–162.Search in Google Scholar

[16] The Sage developers, SageMath, the Sage Mathematics Software System (Version 8.6) 2019.Search in Google Scholar

[17] André Weil (ed.), Collected Papers I: Contributions to Number Theory Springer-Verlag, 1975.Search in Google Scholar

[18] André Weilert, Fast computation of the biquadratic residue symbol, Journal of Number Theory 96 (2002), 133–151.10.1016/S0022-314X(02)92783-6Search in Google Scholar

[19] Hugh C. Williams, An M3 public-key encryption scheme, in: Advances in Cryptology – CRYPTO’85 (H. C. Williams, ed.), Lecture Notes in Computer Science 218, pp. 358–368, Springer, 1986.10.1007/3-540-39799-X_26Search in Google Scholar

A Formulary

In this appendix,we list the general formulas for the logarithmic differential quotients Δ_j(α) and for the quantities a_j(αⁿ).

We use Kummer’s notation (cf. Section 2.3) and represent an algebraic integer α=∑ j=110ajζj∈ℤ[ζ] with T(α) ≠0 as α = F( ). The following lemma is useful; it relates F(^k)(1) to A_k().

Lemma A.1. Let a=∑ j=110ajζj∈ℤ[ζ]. Then, letting F(^k) denote the k^th derivative of F, F^(k)(1) ≡ A_k(α) (mod 11) for 0 ≤ k ≤ 9.

Proof. The proof is immediate. From the definition of F, we have F(ev)=∑ j=09evj where b₀ = −a₁₀ and b_j = a_j − a₁₀ for 1 ≤ j ≤ 9. Hence, evaluating F(e^v) at v = 0, we get F(1)=∑ j=09 bj≡−a10+∑ j=19(aj−a10)≡ A0(α)−11α10≡A0(α) (mod 11). Also, for 1≤k≤9,F(k)(1)≡∑ j=19jkbj≡∑ j=19jk(aj−a10)≡Ak(α)− a10∑ j=110jk≡Ak(α)( mod 11). □

We assume that A₀(α) ≢ 0 (mod 11). From Δ1(α)=F′(1)F(1)⇔F′(1)=Δ1(α)F(1), we get by induction F(k)(1)=∑ j=1k(k−1j−1)Δj(α)F(k−j)(1) and therefore

(A1) Δk(α)=F(k)(1)F(1)−∑j=1k−1k−1j−1Δj(α)F(k−j)(1)F(1).

So, using Lemma A.1 and letting a_j := a_j(α), we obtain the successive logarithmic differential quotients modulo 11.

Δ₁(α) ≡ a₁ (mod 11)
Δ2(α)≡−a12+a2( mod 11)
Δ3(α)≡2a13−3a2a1+a3( mod 11)
Δ4(α)≡5a14+a2a12−4a3a1−3a22+a4( mod 11)
Δ5(α)≡2a15−5a2a13−2a3a12−3a22a1−5a4a1+a3a2+a5( mod 11)
Δ6(α)≡a16−3a2a14+a3a13+5a22a12−3a4a12−a3a2a1+5a5a1−3a23−4a4a2+a32+a6(mod11)
Δ7(α)≡5a17−a2a15+4a3a14+a22a13−a4a13+5a3a2a12−2a5a12−3a23a1+a4a2a1−3a32a1+4a6a1+a3a22+a5a2−2a3a4+a7(mod11)
Δ8(α)≡−2a18−3a2a16+a3a15+a22a14−3a4a14−2a3a2a13+5a5a13+4a23a12−a4a2a12+3a32a12+a6a12−2a3a22a1−5a5a2a1−a3a4a1+3a7a1−3a24+2a4a22−a32a2+5a6a2−2a42−a5a3+a8(mod11)
Δ9(α)≡5a19+5a2a17+2a3a16−2a22a15+5a4a15−5a3a2a14−a5a14−5a23a13+a4a2a13−3a32a13+2a6a13+3a3a22a12−4a5a2a12−3a3a4a12−5a7a12−2a24a1+a4a22a1+5a32a2a1−2a6a2a1+3a42a1−4a5a3a1+2a8a1−3a3a23−3a5a22+a3a4a2−3a7a2−5a5a4−a33+4a6a3+a9(mod11)

In order to get Δ₁₁(α) mod 121, we resort on the general relation (A1). We define fj:=fj(α)=Fj(1)F(1) and obtain

Δ11(α)≡11(−5f2f19−2f3f18−f22f17−5f4f17−4f3f2f16+f5f16+5f23f15+4f4f2f15−f32f15−2f6f15−2f3f22f14+3f5f2f14+5f4f3f14+5f7f14−f24f13+4f4f22f13−2f32f2f13+4f6f2f13−3f5f3f13+5f42f13−2f8f13

−3f3f23f12−4f5f22f12+5f4f3f2f12−2f7f2f12−5f33f12−f6f3f12+4f5f4f12−f9f12−f25f1−3f4f23f1+5f32f22f1+4f6f22f1+5f5f3f2f1−f42f2f1+2f8f2f1−5f4f32f1−2f7f3f1+2f6f4f1−f52f1−f10f1+4f3f24+4f5f23−2f4f3f22+4f7f22+4f3f2+4f6f3f2−5f5f4f2−5f9f2+4f5f32+5f42f3−4f8f3+3f7f4+2f6f5)+f11+10f111(mod121).

When α is primary, we have A0(α)≡0 (mod 11) and f1(α)≡f2(α)≡f4(α)≡f3(α)f5(α)−f8(α)≡0 (mod 11). For α=∑ j=110jζj primary, the previous relation then yields

Δ11(α)11≡4f5f32−4f8f3+2f6f5+f11mod12111≡2f6f5+f11mod12111≡2a6a5+A11(α)A0(α)−11a10mod12111≡2a6a5+A11(α)A0(α)mod12111≡2a6a5+f1+5−5a3−a5+a7+a9(mod11)

where A11(α)=∑ j=110j11 and

A1:=A1(α)=A1(α)A0(α)mod12111,

noting that A11(α)−A1(α)≡11(−a2−4a4+2a5−3a6+3a7−a8−a10)≡11(5A0(α)−5A3(α)−A5(α)+ A7(α)+A9(α) )( mod 121).

We now look at the quantities a_j(αⁿ) for n > 1.We write { ni } as a shortcut to j!(nj)=n(n−1)…(n−j+1) and again let aj:=aj(α). The next formulas expand those given by Corollary 4.2.

a1(αn)≡{ n1 }a1( mod 11)
a2(αn)≡{ n1 }a2+{ n2 }a12( mod 11)
a3(αn)≡n1a3+n23a1a2+n3a13(mod11)
a4(αn)≡n1a4+n2(4a1a3+3a22)−n35a12a2+n4a14(mod11)
a5(αn)≡n1a5+n2(5a1a4−a2a3)−n3a1(a1a3−4a22)−n4a13a2+n5a15(mod11)
a6(αn)≡n1a6−n2(5a1a5−4a2a4+a32)+n3(4a12a4+5a1a2a3+4a23)−n4a12(2a1a3−a22)+n54a14a2+n6a16(mod11)
a7(αn)≡n1a7−n2(4a1a6+a2a5−2a3a4)−n3(a12a5+5a1a2a4−4a1a32+5a22a3)+n4a1(2a12a4+a1a2a3−5a23)+n5a13(2a1a3−5a22)−n6a15a2+n7a17(mod11)
a8(αn)≡n1a8−n2(3a1a7+5a2a6−a3a5−2a42)−n3(5a12a6−3a1a2a5−5a1a3a4−a22a4−5a2a32)+n4(a13a5+2a12a2a4+5a12a32+4a1a22a3−5a24)+n5a12(4a12a4−a1a2a3+2a23)+n6a14(a1a3+a22)−n75a16a2+n8a18(mod11)
a9(αn)≡n1a9−n2(2a1a8−3a2a7+4a3a6−5a4a5)+n3(3a12a7−a1a2a6−2a1a3a5−4a1a42+4a22a5−5a2a3a4+5a33)−n4(4a13a6+3a12a2a5+5a12a3a4+2a1a22a4−a1a2a32+5a23a3)+n5a1(5a13a5−5a12a2a4+4a12a32−4a1a22a3−a24)+n6a13(5a12a4−5a1a2a3−5a23)−n7a15(4a1a3−4a22)+n83a17a2+n9a19(mod11)

Received: 2020-06-05

Accepted: 2020-07-01

Published Online: 2020-11-17

This work is licensed under the Creative Commons Attribution 4.0 International License.

The Eleventh Power Residue Symbol

Abstract

1 Introduction

2 Higher-Order Power Residue Symbols

2.1 Basic definitions and notation

Definition 2.1

Lemma 2.2

2.2 Kummer’s reciprocity law

Theorem 2.3

2.3 Complementary laws

Theorem 2.4

Corollary 2.5

3 The Case p = 11

3.1 Primary elements

Proposition 3.1

3.2 Fundamental units

Remark 3.2

Proposition 3.3

4 Computation of the Eleventh Power Residue Symbol

4.1 Obtaining primary associates

Proposition 4.1

Corollary 4.2

Proposition 4.3

4.2 Norm-Euclidean division

4.3 Our algorithm

Theorem 4.4

Proposition 4.5

References

A Formulary

Journal and Issue

Articles in the same Issue