The Eleventh Power Residue Symbol

This paper presents an efficient algorithm for computing 11-power residue symbols in the cyclotomic field Q(ζ11), where ζ11 is a primitive 11 root of unity. It extends an earlier algorithm due to Caranay and Scheidler (Int. J. Number Theory, 2010) for the 7-power residue symbol. The new algorithm finds applications in the implementation of certain cryptographic schemes.


Introduction
Quadratic and higher-order residuosity is a useful tool that finds applications in several cryptographic constructions. Examples include [6,13,14,19] for encryption schemes and [1,2,12] for authentication schemes and digital signatures. A central operation therein is the evaluation of a residue symbol of the form without factoring the modulus λ in the cyclotomic field Q(ζp), where ζp is a primitive p th root of unity. For the case p = 2, it is well known that the Jacobi symbol can be computed by combining Euclid's algorithm with quadratic reciprocity and the complementary laws for −1 and 2; see e.g. [10,Chapter 1]. This eliminates the necessity to factor the modulus. In a nutshell, the computation of the Jacobi symbol (︁ a n )︁ 2 proceeds by repeatedly performing 3 steps: (i) reduce a modulo n so that the result (in absolute value) is smaller than n/2, (ii) extract the sign and the powers of 2 for which the symbol is calculated explicitly with the complementary laws, and (iii) apply the reciprocity law resulting in the 'numerator' and 'denominator' of the symbol being flipped. Eventually, the numerator of the symbol becomes ±1 and the algorithm terminates with the value of (︁ a n

Our contributions
This paper takes up the challenge put forward in [3] and presents the first implementation of the Caranay-Scheidler algorithm for the 11 th -power residue symbol. The contributions of this paper are three-fold: We provide explicit conditions for primary algebraic integers in Z[ζ 11 ]; we devise an efficient algorithm for finding a primary associate; and we give explicit complementary laws for a set of four fundamental units and for the special prime 1 − ζ 11 .

Organization
The rest of this paper is organized as follows. In Section 2, we review some basic definitions and known results on cyclotomic fields. Section 3 particularizes to the 11 th cyclotomic field. We establish and prove an efficient criterion for primary cyclotomic integers. We also define a set of four fundamental units and give explicit formulas to find their index. Section 4 is the core of the paper. We present the ingredients and develop the companion algorithms for the computation of the eleventh power residue symbol.

Higher-Order Power Residue Symbols
Throughout this section, p ≤ 13 denotes an odd rational prime.
We follow the approach of Kummer. A central notion is that of primary elements (see [7, p. 158 Definition 2.1. An element α ∈ Z[ζ ] is said to be primary whenever it satisfies · · · ηr er α where 0 ≤ e 0 , e 1 , . . . , er ≤ p − 1 . Moreover, α * is unique up to its sign.
Kummer [7] stated the reciprocity law in 1850 (see also [15,Art. 54]). It is restricted to so-called "regular" primes,¹ which include odd primes p ≤ 13. Although initially formulated for primary primes in Z[ζ ], the reciprocity law readily extends to all primary elements; see [

Complementary laws
The special prime ω and its conjugates are excluded from Kummer's reciprocity law. Moreover, it does not apply to units other than ±1 as they are not primary. For these elements, the p th -power residue symbol is determined through complementary laws, also stated by Kummer [7,8] (see also [15,Art. 55]). The complementary laws rely on the logarithmic differential quotients given by For completeness, we give the complementary laws for ±1 and ζ . Alternatively, they can be obtained directly from the definition of the p th -power residue symbol. The next corollary is a straightforward extension to composite moduli.

The Case p = 11
This section presents results for the special case p = 11. We henceforth assume that ζ := ζ 11 is a primitive 11 th root of unity.

Primary elements
Definition 2.1 explicitly characterizes primary elements. The next proposition specializes it for prime p = 11 in order to have a simple criterion involving only rational integers.
. We observe that rational integers are congruent modulo ω if and only if they are congruent modulo p (in this case 11). We therefore have It remains to look at the third condition, α α ≡ A 0 2 (mod 11). Using matrix notation and defining the Vandermonde matrix )︀ . Hence, noting that ω 10 ∼ 11, the product α α (mod 11) can be put after a little algebra in the form of a degree-9 polynomial in ω: (mod 11) .

Fundamental units
For p = 11, the fundamental_units() function from SageMath [16] provides the set Every unit can be rendered real by multiplying it by some power of ζ . Another set of fundamental units is so given by We now apply Theorem 2.4 to find the index of the fundamental units η i , 1 ≤ i ≤ 4, and of special prime ω.
Plugging all these quantities in the above expression for indπ(η i ) gives the desired result.

Obtaining primary associates
We need to investigate the multiplicative properties of the A k 's. Namely, given α, β ∈ Z[ζ ], how to relate A k (αβ) to Ar(α) and As(β)? We also need to express a k (α n ) as a function of a j (α).
From Lemma 2.2, applied to the case p = 11, we know that every α ∈ Z[ζ ] with α / ≡ 0 (mod ω) has a primary associate of the form α * = ± ζ e0 η where 0 ≤ e 0 , e 1 , e 2 , e 3 , e 4 ≤ 10 and α * is unique up to the sign. First, we observe that the sign does not affect the fact of being primary. Indeed, from Proposition 3.1, it is easily seen that if α * is primary then so is −α * . Second, as shown in the proof of Proposition 3.1, we observe that the condition α / ≡ 0 (mod ω) is equivalent to A 0 (α) / ≡ 0 (mod 11).

A Formulary
In this appendix, we list the general formulas for the logarithmic differential quotients ∆ j (α) and for the quantities a j (α n ).