Académique Documents
Professionnel Documents
Culture Documents
Proposition of Divisibility
(i) (ii) (iii) (iv) (v) Proof : (i) According to the divisibility definition we have : a|b pZ such that b=pa, a|c qZ such that c=qa then bx+cy = pax+qay = (px+qy)a=k`a, obviously k`Z which means a|(bx+cy). (ii) (iii) By the definition. Because a|b then kZ such that b=ka k=b/a. Otherwise, b>0, a>0 k>0 which means k1ba (iv) Because a|b |a| | |b| and b|a |b| | |a|. Since |a|, |b| 0, we have : |b| |a| and |a| |b| |a| = |b| a=b. Summer symester, 2001 Page 1/38 a|b and a|c a|(bx + cy) with x,y Z a|b a|bc with cZ Let a>0 and b>0. Then if a|b ba a|b and b|a a=b a|b and b|c a|c
Theorem 1.2 : Given integers a and b, not both of which are zero, there exists
integers x and y such that : gcd(a, b) = ax+by Proof : Consider S = {au+bv | au+bv > 0 and u, v integers}. Clearly, S is not an empty set. Then, by the Well-Ordering Principle, S contain a smallest element d = ax+by, x and y. We prove that d is gcd(a,b). Taking advantage of Division Theorem, one can obtain two integers q and r such that a=qd+r, where d > r 0. From this equation we have : r = a-qd = a-q(ax+by)=(1-qx)a+(-qy)b Because 1-qx and qy are integers, if r > 0 then r S. It contradicts that d is the smallest element of S while r (less then d) is also an element of S. Therefore, r = 0 (so r is not an element of S), which means d|a. Similarly, we can prove that d|b. Now we must show that no common divisor of a and b is greater than d. Given an arbitrary common divisor e of a and b, it holds that e|a and e|b. According to the proposition of divisibility it is true that e|ax+by = d|e| | d d |e|. The statement is proved. We can deduce from the proof of this theorem the fact that gcd of two integers a, b (not both of them are zero) is always exist.
Corollary 1.1 : If a and b are given integers, not both zero, then the set
T = {ax + by | x, y are integers} is precisely the set of all multiples of d = gcd(a,b). Summer symester, 2001 Page 3/38
Advanced Mathematics for Cryptography Proof : For any x, y Z with d|a, d|b, d|ax+by Because d can be written as d = ax0+by0, for n Z we have : nd = n(ax0+by0) = a(nx0) + b(ny0) T.
Theorem 1.5 : Let a and b be integers, not both zero. Then a and b are relatively
prime iff there exist two integers x and y such that ax + by = 1. Proof : Easy, d = gcd(a,b) is the smallest element of S = {au+bv | au+bv>0; u, v integers}. Because ax + by = 1 then 1 S.In addition 1 is the smallest positive integer then 1 is the smallest element of S. We know that the smallest element of S is gcd(a, b) then d = 1.
Page 4/38
Page 5/38
Page 6/38
Due to gcd(a, b) = d, gcd(a/d, b/d) = 1 (b/d)|(x-x0) k Z such that : x-x0 = kb/d x = x0 + kb/d
Page 7/38
Theorem 3.1 : Every positive integer has the unique prime factorization.
Proof : We must prove two things : (i) (ii) The existence : the prime factorization of a positive integer must exist. The uniqueness : the prime factorizarion of a positive integer must be unique.
Let w is the smallest element of the set S = {n Z+ | n has no prime factorization}. w cannot be prime because if it is prime then it can be prime-factorized. Hence, w must be composite. Let a be a divisor of w. we have : 1 < a, w/a < w Because a and w/a is less than w, a and w/a do not belong to the set S. So, w and w/a can be prime-factorized. Thus w also can be factorized (because w is product of two factorized-capable integers). It is a contradiction since S must be empty. That is, the factorization of a is always exist. The existence is proved. Now we prove the uniqueness of factorization. Assume that an integer a is a smallest elemet of set S = {n Z+ |n has two different factorization}, say : a = p1p2ps = q1q2qt Clearly, p1 | q1q2qt and all qj are prime so qj such that p1 = qj. Then we have a/p = p2p3ps = q1q2..qi-1qi+1qt. It is clear that a/p1 < a and then a/p1 does not belong to S. That means a/p1 has the unique factorization. This statement leads to unique factorization of a (because p1=qj). It contracdicts to hypothesis that a has two factorization. So S must be empty. The uniqueness is proved.
Page 8/38
It is a contradiction here because pi is prime then there are infinite prime numbers.
Theorem 3.3 : For the given composite integer n, n has a prime factor not greater
than
n.
We can apply this fact to Erastothenes sieve algorithm to search for all prime numbers less than a given integer n. Normally, we have n-1 loops but taking advantage of this fact we reduce the number of loops to
n.
Page 9/38
Lecture on 4th and 5th of July, 2001 Congruences And Its Application
Definition (Congruence) : Given three integers a, b, n where n > 0. Then, a is
said to be congruent to b modulo n (denoted as a b mod n) iff n|(a-b).
Proposition 4.3 :
(i) (ii) Proof : (i) forward direction : if we have a* such that aa* 1 (mod n) n|aa* - 1 aa* - 1 = kn aa* - kn =1 gcd(a, n) = 1 a* exists if and only if gcd(a, n) = 1. a* is unique.
Page 10/38
Advanced Mathematics for Cryptography backward direction : if we have gcd(a, n) = 1 then we have : (ii) ax + ny = 1 (x, y Z) ax 1 = ny n | ax - 1 ax 1 (mod n) a* = x
Suppose that we have a* and a** are two arithmetic inverse of a then we have: aa* aa** 1 (mod n) n | aa* - aa** n | a(a* - a**) n|a* - a** (because gcd(a, n) =1) a* a** (mod n)
Lemma 4.1 : Let gcd(a, n) = 1 then ax ay (mod n) implies x y (mod n) How to Solve The Linear Congruence Equation :
ax b (mod n) This equation has no solution if gcd(a, n) is not a divisor of b. Otherwise it equals to following equation : ax/d b/d (mod n/d)
Page 11/38
We can apply Fermat Little Theorem to simplify modulo calculation which relate to power of the integer.
Page 12/38
Lemma 4.2 : (n, ab) = 1 if and only if (a, n) = 1 and (b, n) = 1 where (a, b) = 1.
Proof : First, we prove that if (n, ab) = 1 then we have (a, n) = 1 and (b, n) = 1. Indeed, suppose that (a, n) = d > 1 then d|a, d|n d|ab, d|n (n, ab) d > 1. It contracdicts with hypothesis. Now we prove that if (a, n) = 1, (b, n) = 1 and (a, b) = 1 then (n, ab) = 1. Suppose that (ab, n) = d > 1 d|ab, d|n. Because (a, b) = 1, d must divide either a or b either (a, n) or (b, n) is not less than d. It contradicts with hypothesis that both (a, n) and (b, n) equal to 1. So the Lemma is proved.
Page 13/38
Advanced Mathematics for Cryptography (i) Because p is prime then all integers from 1 to p-1 are relatively prime to n then (p) = p 1. (ii) All integers from 1 to pn 1 are relatively prime to p except those integers are multiple of p. It is easy to figure out that number of such integers is pn-1 then we have (pn) = pn pn-1. (iii) We must count the number of positive integers which are relatively prime to mn and not exceeding mn. In order to do it, we display all positive integers not exceeding mn in the following way : 1 2 3 r m
th
2m + 1
m + 1 2m + 2 m + 3 2m + 3
m + r 2m + r 2m 3m
mn
Consider r row. If gcd(m, r) = d > 1 then d|km + r, that means all numbers in rth row are not relatively prime to m and of course are not relatively prime to mn. So only rows which its indexes are relatively prime to m can contain numbers which are relatively prime to mn. Clearly, there are totally (m) such rows. Now consider rth row where r is relatively prime to m : r, m + r,, (n-1)m + r. This row contains n integers. Now we prove that there are only (n) integers in this row which are relatively prime to n. First consider following sequence : 0, m, 2m,, (n-1)m. We know that (m, n) = 1 then no two integers in this sequence are congruent modulo n. If not, suppose that im jm (mod n) and n > i, j 0 then i j, it is impossible because both i and j are less than n. It states that there are only (n) numbers in this sequence are relatively prime to n. Indeed, suppose that im j (n > i, j 0) then if (j, n) = 1 we have (im, n) = 1 because : x, y Z such that jx + ny = 1 im j im j = kn (k Z) Summer symester, 2001 Page 14/38
If (j, n) = d > 1 then we have (im ,n) > 1 because : d | n, d | j im j = kn im = j + kn d | im gcd(im, n) d > 1
So because no two integers in a sequence of n integers are congruent modulo n then there are exactly (n) numbers in the sequence which are relatively prime to n. We prove that sequence : r, m + r,, (n-1)m + r is also this kind of sequence. Suppose that im + r jm + r (mod n) where i, j are positive integers and less than n n | im + r jm r = im jm im jm i j (mod n) because (m, n) = 1, it is impossible because both i and j are less than n. In conclusion, in rth row there are only (n) numbers which are relatively prime to n. We have already stated that there are (m) such kind of rows then there are totally (m).(n) numbers relatively prime to both m and n. According to Lemma, only such numbers are also relatively prime to mn then we have : (mn) = (m)(n) with (m, n) = 1. (iv) (v) Because p, q are prime then (p, q) = 1 (pq) = (p)(q) = (p-1)(q-1). We can easily get this formula by applying the multiplicative property of function. (note that n can be written in the form of product of power of some prime numbers factorization).
Page 15/38
Advanced Mathematics for Cryptography j. The set of r1, r2,, r(n) is called a reduced residue system modulo n. Now we prove that the set of ar1, ar2,, ar(n) is also a reduced residue system modulo n. Indeed, ari is relatively prime to n because both a and ri are relatively prime to n. Furthermore, if i, j such that ari arj (mod n) ri rj (mod n). It contradicts with the fact that ri and rj belong to reduced residue system modulo n. Because the set of ar1, ar2,, ar(n) is a reduced residue modulo n then the least positive residues of ar1, ar2,, ar(n) must be the integers r1, r2,, r(n) in some orders. Consequently, if we multiply together all terms in each of these reduced residue systems, we get (note a b, c d ab cd) : ar1ar2ar(n) r1r2r(n) (mod n) a(n)r1r2r(n) r1r2r(n) (mod n) a(n) 1 (mod n) because (r1r2r(n), n) = 1
Page 16/38
Advanced Mathematics for Cryptography Encryption : c me (mod n) c is ciphertext and m is message to be encrypted. Decryption : m cd med mk(n) + 1 m{m(n)}k m (mod n). In fact, according to Eulers theorem m and n must be relatively prime but the probability of the event in which m and n are not relatively prime is very small : prob = (n - (n)) / n prob = {pq (p-1)(q-1)}/{pq} prob = {p + q 1}/(pq) prob 2-511 (because |p|,|q| = 512 digits).
Advanced Mathematics for Cryptography .. x0 x1 br (mod mr) Then mi|x0-x1 i. Because m1, m2,, mr are pairwise relatively prime then m1m2mr|(x0-x1) M|x0-x1 x0 x1 (mod M). So the theorem is proved.
Theorem 4.6 : An equation has an integral solution then it has a solution mod pn for
each prime p and a positive integer n.
Theorem 4.7 : If f(x, y) 0 (mod pn) has no solution for some prime p and positive
integer n then f(x, y) = 0 has no solution.
Page 18/38
Then we say that (an, an-1,, a1, a0) is the represetation of integer x in base b. ai is called one digit in base b.
Proposition 5.2 : To add two k-bit integers, it requires at most k bit operations. Propostion 5.3 : To multiply a k-bit integer and a l-bit integer, it requires at most kl
bit operations.
Proposition 5.4: To subtract a k-bit integer from a l-bit integer, it requires at most
max(k, l) bit operations.
Proposition 5.5: To divide a k-bit integer by a l-bit integer (k l), it require at most
kl bit operations.
Definition of Big-O Notation : Let f(n) and g(n) be two functions of positive
integer n which take positive. We say that f(n) = O(g(n)) (or simply f = O(g)) if a constant C , N such that f(n) is always less than Cg(n) for n > N. To generalize, f and g are functions on vector (n1, n2,, nr). We said that f = O(g) if a constant C such that f(n1, n2,, nr) is always less than C.g(n1, n2,, nr).
Page 19/38
lim g
n
is bounded.
Proof : According to the definiton of limit, for positive , N such that n > N
implies :
f ( n) A < g ( n)
Let |A| + = C, then we have : f ( n) < C g ( n ) Because we suppose that both f(n) and g(n) are positive n then :
f (n) Cg (n)
Proposition 5.6:
(i) (ii) (iii) Given f(x) = adxd + + a0 where ad 0, then f = O(xd). log(n) = O(n) > 0. If we have f = O(1) then f is bounded.
Proof :
(i) Let consider :
lim
lx
f ( x) = a d f(x) = O(xd) d x
(ii)
Proposition 5.7: Let n be k-bit integer, let m be l-bit integer then we have :
(i) n + m, require at most max(k, l) bit operations. We call the complexity to compute m + n is O(max{k, l}). (ii) (iii) (iv) Complexity to compute n m is O(max{k, l}). Complexity to compute n*m is O(kl). Complexity to compute n/m is O(kl).
Page 20/38
lim g
n
=0
Page 21/38
Lecture on 12th, 18th, 19th of July, 2001 Groups, Rings, Vector Spaces and Fields
Definition (Group) : A group G is a set with a binary operation, denoted by *,
satisfying : (i) (ii) (iii) (iv) Closure : a*b G for a, b G. Associativity : (a*b)*c = a*(b*c) for a, b, c G. Identity : e G such that : a*e = e*a = a for a G. Inverses : x G such that a*x = x*a = e for a G. We usually denote the inverse of a by a-1.
(i)
Suppose that there are two identity e and e. Follwing condition (iii) we have : e = ee' = e ab = ac a-1(ab) = a-1(ac) (a-1a)b = (a-1a)c eb = ec b = c. ba = ca (ba)a-1 = (ca)a-1 b(aa-1) = c(aa-1) be = ce b = c. cc = c c-1(cc) = c-1c (c-1c)c = e ec = e c = e. Suppose a has two inverses a1, a2 aa1 = aa2 = e a1 = a2 (left cancellation property). (a-1)-1 = a a-1(a-1)-1 = a-1a e = e.
Page 22/38
(vi)
(vii)
Definition (Group Order): The order of a group G, denoted by |G| is the number
of element of G. If n is finite then we call G is a finite group.
Proposition 6.2 : Let G be a group with identity element e, and let H be a subset of
G. Then H is a subgroup of G if and only if the following conditions hold: (i) (ii) (iii) a.b H for all a,b H e H; a-1 H for all a H.
Page 23/38
Propostion 6.3 : Some properties of coset (Given group G and its subgroup H) :
(i) (ii) g Hg since e H ge = g H. If H is finite, H = {h1, h2,, hn} then Hg = {h1g, h2g,, hng} where hig are all distinct. (iii) (iv) H itself is one coset of H since He = H. We can obtain one coset of H from each g G but we cannot claim that we get a different right coset from each element of G.
aa-1 = e H aRa (reflexive). ab-1 H (ab-1) H ba-1 H bRa (symmetric). ab-1 H, bc-1 H ab-1bc-1 H ac-1 H aRb, bRc aRc (transitive).
Now we prove that the equivalence class containing a is a right coset of H. Let consider: gRa ga-1 H Let ga-1 = h for some h H ga-1a = ha g = ha Ha. The theorem is proved.
Page 24/38
Advanced Mathematics for Cryptography Proof : Let k be the numbers of right cosets of H. Because we can form all cosets of H
from equivalence classes (Lemma) then they contain element of G exactly one and size of each is |H| k|H| = |G|.
<a> is ord(a) because aord(a) = e. Following the Langrange theorem we have : order(<a>) | order(G) ord(a) | order(G)
may write n=qk for some q N, and then gn=(gk)q=e. Actually, Eulers theorem can be induced from this fact by considering (Z/nZ)* group (that is, a group contains all number less than n and relatively prime to n, * means 0 does not belong to this group. The binary operation is the multiple operation then reduced by modulo n). The order of this group is (n) so if a (Z/nZ)* or (a, n) = 1 we have a(n) = 1 or a(n) 1 (mod n) in another sense. If p is prime then we have proof of Little Fermat Theorem ap-1 1 (mod p) where p does not divide a.
Corollary 6.2 : A group of prime order is cyclic and has no proper non-trivial
subgroups; any non-identity that generates group.
Proof : Suppose that group G has order of p where p is prime then all subgroup of G
should have order of 1 or p. Thus if a is not indentity element then <a> = G (because the order of <a> is p).
Page 25/38
Advanced Mathematics for Cryptography Proof : Clearly, H K is subgroup of both H and K then if gcd(|H|, |K|) |H K|
Definition (Vector Space) : Given (V, +) is an abelian group. This group is said
to be a vector space over a field F if an binary operation : FxVV (a, v) av such that (a, b F, v, w V): (i) (ii) (iii) (iv) a(v + w) = av + aw (a + b)v = av + bv (ab)v = a(bv) 1v = v (1 is the multiplicative indentity if F)
Definition :
(i) Given a vector space V over a field F then we say S = (v1, v2,, vn) V are
linearly independent if c1v1 + c2v2 + . + cnvn = 0 implies c1 = c2 = c3
=.=cn = 0. Otherwise, we say that S are linearly dependent. (ii) We define a dimension of V (denoted as dimV) as the largest number of linear independent elements in V. Dimension of a vector space can be finite or infinite. (iii) (v1, v2,, vn) V are a basis of V over F if n elements are linearly independent and dimV = n.
Page 26/38
Definition (Extension Field) : Let consider a field K which also contains a field
F then K is automatically a vector space over F. We denote dimK (over F) as [K:F], it is called extension degree of K over F. The field K is said to be an extension field of the field F. If [K:F] is finite then it is called a finite extension. One common way of obtaining extension field is to adjoin an element to F: we say K = F() if K is the field consisting all rational expressions formed using and elements of F.
Page 27/38
Proposition 6.5 There exists only one monic irreducible polynominal f(x) such that
f() = 0 if is algebraic over F ( is called root of f(x)). This monic irreducible polynominal is called minimal polynominal of . Furthermore, if any h(x) F[X] satisfies h() = 0 then f(x)|h(x).
Proof : Assume that f(x) and g(x) which are irreducible polynominal such that f() =
g() = 0. Because f(x) and g(x) are irreducible, they are relatively prime which means u(x), v(x) F[X] such that : f(x)u(x) + g(x)v(x) = 1 Replace x by we have : 0.u(x) + 0.v(x) = 1 It is impossible so such f(x) is unique. 0=1
Proposition 6.6 : If the minimal polynominal, say f(x), of has degree d, then any
element of F() (that is, any rational expression involving powers of and elements of F see definition of extension field) can be expressed as a linear combination of the powers 1, , 2,, d-1. Therefore, those powers of form a basis of F() over F and so the dimension of the extension obtained by adjoining is the same as the degree of the minimal polynominal , [F():F] = deg(f(x)) = d.
Page 28/38
F() and F() are said to be isomorphism. If F() = F(), then we say that F() and F() are automorphism. A very popular result in this topic is that Q( 2 ) and
Definition (Multiple Root): (x-m)r | f(x) (that is, (x-m)r | f(x) and (x-m)r+1 | f(x))
then we say that m is a root of multiplicity r.
Propostion 6.7 If f(x) has a multiple root then gcd(f, f) has a root . Definition (Splitting Field) : A splitting field of f(x) F[X] is the smallest
extension field containing all roots of f. That is, f(x) is splitted into a product of linear polynominals in the splitting fields of f. f(x) = a(x r1)(x r2)(x rn) where ri splitting field of f(x) for any i. The splitting field is unique up to isomorphism, meaning that if any K has same properties, there will be a 1-to-1 corespondence between K and K which preserve addition and multiplication.
Propositon 6.8 Every field should contain one and only one prime field. Definition (Algebraic Closure) : Given a field F. If every polynominal f(x)
F[X] has a root in F then F is said to be algebraic closed. The complex field, C, is the one
Page 29/38
Page 30/38
Finite Field
Theorem 7.1 : Let F be a finite field
(i) (ii) Characteristic of F cannot be zero. If char(F) = p then the order of F is pn for some integer n, where p is prime. There is also one and only one finite field with such order up to isomorphism, denoted by F p n .
Proposition 7.1: Every finite field has a generator. Corollary 7.2: Let <g> = Fq*
(i) (ii) gi is a generator if and only if (i, q-1) = 1 There are (q-1) generators.
Proof : Pending.
Page 31/38
Apply
3
this
3
fact
3
repeatedly,
we
can
show
that
b.
f ( ) = a d d + a d 1 d 1 + ... + a1 + a0 = 0
f ( i ) = a ( i ) d + a d 1 ( i ) d 1 + ... + a 1 i + a 0
f ( i ) = a d ( d ) i + a d 1 ( d 1 ) i + ... + a1 i + a0 f ( i ) = (a d d + a d 1 d 1 + ... + a1 + a 0 ) i = 0
(explaination pending)
q-1. Thus, Xq-1 = (Xord(a))k = (1)k = 1 (where a is an element of Fq) Xq X = 0. Conversely, let q = pn is a prime power and F is a splitting field of f(x) = Xq X over field Fp. We have : f(x) = Xq X f(x) = qXq-1 - 1 f(X) = -1 (because q = 0 in Fp)
Therefore f(x) and f(x) have no common root at all and they have no multiple root. This statement means that f(x) has distinct q root. As we define F as splitting field of f(x) over Fp then F must contain at least q elements. We show that the set of q elements is a field with addition and multiplication operation. If a and b are solutions of f(x), aq = a, bq = b then (a + b)q = aq + bq = a + b (Theorem 7.3) and (ab)q = aqbq = ab. That is both sum of a
Page 32/38
Fp [ X ] f ( x)
, where p is prime
and f(x) is an irreducible polynominal of degree d such that f() = 0. Fp[X]/f(x) means that all operations in such field will be reduced modulo f(x). We know that if f(x) is minimal polynominal of then all elements if vector space Fp() can be written as a linear combination of 1, , 2, 3,..., d-2, d-1. That is 1, , 2, 3,..., d-2, d-1 forms a basis in Fp() over Fp:
a
i =0 i
d 1
f ( ) = d + a d 1 d 1 + ... + a1 + a 0 = 0
d = (a d 1 d 1 + ... + a1 + a 0 )
[Fp():Fp] = d F p ( ) = { ai i | ai F p }
i =0 d 1
where ai Fp
In order to construct a finite field, take following steps : Take an irreducible polynominal f(x) over Fp.
F p d = F [ X ] / f ( x) Operation : given g(x), h(x) F p d g(x) h(x) = {g(x) + h(x)} mod f(x) g(x)h(x) = {g(x)h(x)} mod f(x) g(x)-1 = g(x)-1 mod f(x)
Page 33/38
n 1 i =0
N F n |Fq ( ) = ( ) = q
q
n 1 i =0
Proposition 7.2 :
(i) (ii) (iii) (iv) (v) (vi) (vii) Tr(+) = Tr() + Tr(). Tr(c) = cTr(). Tr(c) = nc. Tr(q) = Tr(). N() = N()N(). N(c) = cnN(). N(c) = cn.
Page 34/38
Bases : basis is a set of n elements in Fq which are linearly independent over Fq.
n
The number of ways to choose a basis of Fq n over Fq is (explaination pending) : (q n 1)(q n q )...(q n q n 1 ) =
q i (q ni 1)
i =0 i =0
n 1
n 1
n ( n 1)
q
n 1 i =0
(q
i =1 n
1)
2
= qn
, q 1 }
n
Definition of dual basis : Let = { 1 , 2 ,..., n } and = { 1 , 2 ,..., n } are two bases of Fq n / Fq . is dual basis of if : Tr(ij) = ij Where ij is Kronecker delta, ij = 1 if i = j and 0 if i j.
Theorem 7.5 :
(i) For every basis of Fq n / Fq , there is one and only one dual basis of . (ii) The dual basis of a normal basis is a normal basis. (iii)The dual basis of a polynominal basis is not a polynominal basis.
Page 35/38
2 q 2
...
q 2
n 1
... ...
n q n
Proof : Fisrt, we prove that if is a basis then A is nonsingular. It is the fact that there
always exists dual basis of . Let be the dual basis of and consider following matrix :
1 q B= 1 ... q n 1 1
2 2q
...
2q
n 1
... n 1 ... nq
n nq
1 q T AB = 1 ... q n 1 1
2 q 2
...
q 2
n 1
1q ... 1q 1 2q ... 2q
n n 1
...
nq
Because ij = ij (Kronecker delta). This implies that A can be inverted or A must be nonsingular. Now we prove that when A is nonsingular then is a basis. Let consider following equation :
c
i =1 i
= 0 where ci Fq
q
n c i i = 0 i =1
c
i =1 n q i
q i
=0 = 0 (because ci Fq ciq = ci )
c
i =1 i
q i
Page 36/38
c
i =1 i
qk i
= 0 if
c
i =1 i
= 0 , where ci Fq holds.
1 q AC = 1 ... q n 1 1
2 q 2
...
q n 1 2
c
i =1 i
= 0 implies ci = 0 i
Theorem 7.6 : Let = {1, , 2 ,..., n 1 } be a polynominal basis, f(x) = Irr(, Fq) an
minimal polynominal of over Fq, f(x) = (x - )(n-1xn-1 + n-2xn-2 ++ 0). Then the dual basis of is {1,2,,n), where : i = i/f(x)
Proof : Pending.
Theorem 7.7 :
(i) There is no a self-dual polynominal ( = ) basis of Fq n over Fq for n 2. (ii) Fq n has one self-dual basis over Fq if and only if q is even or both q and n are odd. (iii)If n is odd or if q is even then there is a self dual normal of Fq n /Fq.
Page 37/38
In order to reduce the number of multiplication operations, we simplify AnBl + BnAl in following way : AnBl + AlBl = (Al + An)(Bl + Bn) AlBl - AnBn Repeat this procedure for multiplication operation of AnBn, AnBl, AlBn, AlBl we can get better performance in comparision with conventional method.
Page 38/38