Professional Documents
Culture Documents
Standard Generators of Finite Fields and Their Cyclic Subgroups
Standard Generators of Finite Fields and Their Cyclic Subgroups
Cyclic Subgroups
Frank Lübeck
arXiv:2107.02257v1 [math.AC] 5 Jul 2021
July 7, 2021
Abstract
We define standardized constructions of finite fields, and standard-
ized generators of (multiplicative) cyclic subgroups in these fields.
The motivation is to provide a substitute for Conway polynomials
which can be used by various software packages and in collections of
mathematical data which involve finite fields.
1 Introduction
For each prime number p and n ∈ Z>0 there exists a unique finite field Fpn
of order pn , up to isomorphism. A standard way to compute with such a
field is to specify an irreducible polynomial f ∈ Fp [X] ∼= Z/pZ[X] of degree
n and to use Fpn = Fp [X]/(f ) where each element of the field is represented
by a unique polynomial of degree < n. Roughly (1/n)-th of all polynomials
of degree n over Fp are irreducible, so there are many ways to realize Fpn in
this way.
The first goal of this paper is to define a standardized construction of all
finite fields which fulfills a list of conditions:
(A) it is easy to understand knowing the standard facts about finite fields,
(B) it is easy to (re)-implement (say, given a basic polynomial arithmetic),
(C) it is iterative; that is the construction of a new field makes use of pre-
vious constructions of proper subfields, and all subfields are naturally
and effectively embedded in the new field,
Funded by the Deutsche Forschungsgemeinschaft (DFG, German Research Founda-
∗
1
(D) it is reasonably efficient in practice when implemented with straight
forward algorithms.
The condition (C) means that we construct the algebraic closure F̄p of Fp
by constructing all its finite subfields together with natural embeddings.
The range we have in mind in (D) is n up to a few thousand for smaller
primes, larger for very small primes, and smaller for very large primes.
Our motivation is to provide a reference that could be used in computer
algebra systems, other software packages or in collections of mathematical
data which involve finite fields. A unified description of the field elements
significantly simplifies the exchange and reuse of data.
[This version of this article is meant for discussions and com-
ments are welcome! I’m interested in proposals for improvements
which still fulfill the conditions mentioned above.]
Before getting to the second goal of this paper let us consider three pre-
vious approaches in this direction.
In the classical article [Ste10] Steinitz described (in 1910) the theory of
field extensions as it is taught nowadays in an algebra course. And in §16
he gives a very explicit construction of F̄p (and any of its subfields) which
fulfills our conditions (A) , (B) and (C) above. Here is a sketch. Steinitz
introduces a natural numbering of all polynomials over Fp . For m ∈ Z>1
let fm ∈ Fp [X] be the irreducible polynomial of degree m! with the smallest
number. Then Km = Fp [X]/(fm ) ∼ = Fpm! . It remains for Km ≤ Km+1 to
define the embedding uniquely. Steinitz maps X + (fm ) to the zero of fm
in Km+1 with the smallest number (elements in Km+1 are represented by
unique polynomials of degree < (m + 1)!). Obviously, this definition is not
very practical, because the computations of the polynomials and embeddings
can only be done for very few small m; and fields of moderate size may be only
contained in astronomically big Km . In this article we will extend Steinitz’
definition of numbering and use it in places where certain choices need to be
done.
As second approach to define standardized models for finite fields we
mention the work of Lenstra and de Smit [LS08; Mul13]. A main goal for
them was a variant of our condition (D) , namely to give a description with
good (polynomial time) asymptotic behaviour, but the emphasis was not on
practical implementation. Their construction fulfills (C) and yields a natural
Fp -basis for each finite field which contains the corresponding bases of all
subfields as subsets (which defines natural embeddings). Our construction
will also have this property. Understanding and implementing their construc-
tion needs a background in (algorithmic) number theory (computations in
number fields of characteristic zero).
2
Finally we mention the approach given by Conway polynomials. Origi-
nally defined by Richard Parker these are currently used and available in a
number of computer algebra systems with good support for finite fields like
GAP [Gap], SageMath [Sag], MAGMA [Mag], Macaulay2 [GS] and various
more specialized programs, for example the C-MeatAxe [Rin15]. The Con-
way polynomial Cp,n (X) ∈ Fp [X] is a monic irreducible polynomial of degree
n which is primitive and respects a certain compatibility with the Conway
polynomials which define proper subfields. Primitive means that the residue
class of X in Fp [X]/(Cp,n(X)) ∼ = Fpn generates the multiplicative group of
n
the field, that is it is of order p − 1. The compatibility means that for any
n m
divisor m of n the residue class of X (p −1)/(p −1) is a zero of the Conway
polynomial Cp,m . This also defines the embeddings of the subfields. There
are many sets of polynomials fulfilling these conditions. To get a well defined
set of polynomials there is a further (recursive) condition, namely Cp,n must
be the smallest polynomial with the mentioned properties with respect to
some ordering of polynomials (which we do not define here). We refer to the
introduction of [Jan+95] for more details.
The construction of Conway polynomials somehow fulfills our conditions
(A) (one has to show the existence) and (B) (one needs to compute roots).
Condition (C) is fine for the embeddings, but the constructions of subfields
only give extra constraints for the next polynomial. Unfortunately, condi-
tion (D) is a problem here. There are two basic methods to compute a new
Conway polynomial: either enumerate all monic polynomials of the right
degree and check the conditions, or enumerate all compatible and primitive
polynomials to find the smallest one. Even for moderate parameters both
enumerations can be very time consuming. All systems mentioned above
use a list of precomputed Conway polynomials [Lü09] whose generation took
many years of CPU time. It is almost impossible to compute any further
Conway polynomial Cp,n when n > 1 is not prime.
And there is another fundamental problem: Primitivity can only be
checked if all prime factors of the order pn − 1 of the multiplicative group
are known. These factors are known in many cases thanks to decades long
enormous computational efforts [Cro], but not for the majority of fields we
would like to cover in practice.
A motivation for the definition of Conway polynomials comes from the
following fact: There exist group isomorphisms, which we will call a lift, from
the multiplicative group F̄× ×
p to the subgroup of C consisting of all roots of
unity whose order is not divisible by p. A well defined such lift is explicitly
determined by the Conway polynomials, its restriction to Fpn = Fp [X]/(Cp,n)
is given by X + (Cp,n) 7→ exp( p2πin −1 ).
This explicit lift is for example often used in the modular representation
3
theory of finite groups where the definition of Brauer characters depends on
such a lift. There exists a large collection of highly non-trivial representation
theoretical data in the character table library [Bre20], which includes all the
data from the Atlas of Brauer characters [Jan+95]. These data are stored
with respect to the lift defined by Conway polynomials.
The inverse of a lift is also used in this context, namely for the reduction
of characters in characteristic 0 modulo p. The choice of a lift is equivalent to
the choice of a p-modular system. The Atlas [Jan+95, Appendix 1] contains
tables which describe this map on common irrational numbers with respect
to the lift defined by Conway polynomials.
Another application we are interested in comes from Deligne-Lusztig the-
ory where elements in a torus over a finite field are interpreted as complex
characters of a dual torus via a lift, see [Car93, 3.1].
Now we can describe the second goal of this paper: We want to specify a
well defined lift F̄× ×
p → C for the elements in our standardized finite subfields.
We do this by defining for m ∈ Z>0 with gcd(m, p) = 1 the element ym in a
finite subfield of F̄p which is mapped to exp( 2πim
). Our definition will enable
us to compute ym in practice whenever we know the prime factors of m and
we can construct a field of order pn which contains an element of order m.
(Note that pn − 1 may be much larger than m and that we do not need to
know all prime divisors of pn − 1.)
Content of this article. In Section 2 we recall some basic facts about
finite fields. In Section 3 we define towers of finite fields and explain how to
use them to describe an algebraic closure of Fp . We will extend Steinitz’ idea
to enumerate polynomials and finite field elements. In Section 4 we explain
in more detail how we describe a lift F̄× p → C
×
by specifying appropriate
elements in our standardized fields. The core of the paper is in Section 5
where we define explicit irreducible polynomials of prime degree on which
the setup in Section 3 depends. (In this version of the paper we include
two constructions of the ”generic case”. The one in Subsection 5.4 occurs
in various places in the literature (e.g., [Sho90]) but we did not get this
fast enough in practice; the other in Subsection 5.5 is much simpler and
performs well in the range we tested. We may remove 5.4 in the final version
of this paper.) Section 6 contains the explicit construction of standardized
elements of given order (which define a lift). We have also written a software
package [Lü21], based on GAP [Gap], which implements the constructions
in this paper and which we used to verify (and improve) the practicality
of our descriptions. In Section 7 we collect some remarks concerning this
implementation. Finally, in Section 8 we discuss the question of translating
the values of Brauer characters from one lift to another one.
Complexity considerations. There is a lot of literature which is rele-
4
vant in the context of this article, e.g., on efficient arithmetic in field exten-
sions, irreducibility tests, computation of minimal polynomials, construction
of irreducible polynomials, embeddings of fields. While working on this ar-
ticle and the reference implementation [Lü21] we got the impression that
sophisticated algorithms with good asymptotic complexity do not give vast
improvements in the range we want to consider in practice, say degrees up to
a few thousands. Therefore we do not include statements about asymptotic
complexity here, but just mention what works sufficiently well in our straight
forward implementation.
It will be interesting to see how our definitions can be combined with
other frameworks for lattices of finite fields, e.g., those described in [BCS97]
or in [DFRR19].
Acknowledgements. First I wish to thank Hendrik Lenstra for very
interesting discussions about the standardization of finite fields. In particular
Lenstra convinced me not to publish an article which I had prepared some
years ago. In that draft I proposed a variant of Conway polynomials which
can be computed in practice for all fields Fpn for which the factorization of
pn − 1 is known. But it is much better to separate the construction of the
fields and the definition of standard generators of cyclic subgroups, as we do
in the present article.
Furthermore I thank Wilhelm Plesken for sending me his lecture notes
[Ple15] and for his permission to freely reuse his ideas for this article (e.g.,
our definition of Steinitz numbers, and a sketch of our Section 6 can be found
in these notes).
Finally, I thank Thomas Breuer for useful discussions about Brauer char-
acter values, and for helpful comments on earlier versions of this paper and
the related GAP package.
Remark 2.1. (a) For every prime power q there exists up to isomorphism
exactly one finite field Fq with q elements. It is the splitting field of
the polynomial X q − X over its prime field Fp .
5
′
unique and consists of the zeroes of the polynomial X q − X.
(c) Let Fq′ ≤ Fq be a subfield. This field extension is Galois, the Galois
′
group is cyclic and generated by the map σq′ : Fq → Fq , x 7→ xq (and
of order d if q = (q ′ )d ).
Remark 2.3. (a) All finite fields have a primitive root, and a primitive
root is a primitive element.
(b) Let m, n ∈ Z>1 with gcd(m, n) = 1 and let K, L ≤ F̄q (an algebraic
closure of Fq ) be algebraic extensions of Fq of degree m and n with
primitive elements x, y, respectively. Then KL := K[y] = Fq [x][y] =
Fq [y][x] = L[x] is of degree mn and xy is a primitive element, that is
KL = Fq [xy].
6
r
(b) Assume that r ∤ (q−1). Then for any c ∈ F×q there are (q −q)/(r(q−1))
monic irreducible polynomials of degree r in Fq [X] with constant term
c.
Proof. (a) Each monic irreducible polynomial f ∈ Fq [X] of degree r gen-
erates the field Fqr ∼ = Fq [X]/(f ). Since r is prime, all q r − q elements of
Fqr \ Fq generate Fqr over Fq . So, their minimal polynomials have degree
r and r distinct roots (more precisely, for x ∈ Fqr \ Fq the set of conju-
gates {x, σq (x), . . . , σqr−1(x)} has size r and these all have the same minimal
Qr−1
polynomial i=0 (X − σqi (x))).
Qr−1 i 1+q+q 2 +...+q r−1
(b) The norm map Nqr /q : F× q r → Fq , x 7→ i=0 σq (x) = x
is a surjective homomorphism (the image of a primitive root has order q − 1
because q r − 1 = (q − 1)(1 + q + q 2 + . . . + q r−1 )). The restriction of the
r
norm map to F× q is x 7→ x , hence an automorphism because r ∤ (q − 1).
Therefore, every c ∈ Fq has the same number of preimages under the norm
map in Fqr \ Fq . This shows (b) because the constant term of the minimal
polynomial of x ∈ Fqr \ Fq is (−1)r Nqr /q (x).
Lemma 2.5. (a) Let K be a field of characteristic p. For any a ∈ K the
polynomial X p −X −a ∈ K[X] either has a root in K or it is irreducible.
(b) Let r be a prime and let K be a field. For any a ∈ K the polynomial
X r − a ∈ K[X] either has a zero in K or it is irreducible.
Proof. (a) (Artin-Schreier extensions) Let b be a zero of the polynomial X p −
X −a in a splitting field of this polynomial over K. Since Fp ≤ K (the zeroes
p p
Q
of X − X) we have X − X − a = i∈Fp (X − b − i). The minimal polynomial
Q
of b over K is a partial product i∈I (X − b − i) ∈ K[X], with I ⊆ Fp , say of
size k. Then the coefficient of X k−1 , which is of the form kb + j with j ∈ Fp ,
shows that k = p or b ∈ K and so k = 1.
(b) Let b1 be a zero of X r − a in a splitting field L of this polynomial over
K. Let b2 , . . . , bk ∈ L be the other zeroes of the minimal polynomial of b1
over K. Then we have for b′ := b1 b2 · · · bk ∈ K that (b′ )r = br1 br2 · · · brk = ak .
If k < r then k is prime to r and there exist l, k ′ ∈ Z>0 with kl = 1 + k ′ r.
′
So (b′ )rl = akl = a · ak r . This shows that a has an r-th root in K.
The following observation will be useful for finding elements which do
not have an r-th root in finite fields. For a prime r and integers t ∈ Z≥0 ,
m ∈ Z>0 we write r t ||m, if r t divides m but r t+1 does not divide m.
Lemma 2.6. Let q be a power of a prime p and r 6= p another prime.
(a) The smallest power n such that q n − 1 is divisible by r is the order of
q modulo r. It is a divisor of r − 1.
7
(b) Let r be an odd divisor of q − 1, say r t ||(q − 1). For any n with r i ||n
we have r t+i ||(q n − 1).
(c) Let r = 2 (and so q odd) and 2t ||(q 2 − 1). For any n with 2i ||n we have
2t+i ||(q 2n − 1).
Proof. (a) We have r|(q n − 1) if and only if q n ≡ 1 mod r; and (Z/rZ)× is
cyclic of order r − 1.
(b) Write q n −1 = (q −1)(1+q +q 2 +. . .+q n−1). Since q ≡ 1 mod r we see
that the second factor is ≡ n mod r. This shows the case i = 0, that is r ∤ n.
We now assume that n = r and write q = 1 + rs. Then q j = 1 + j(rs) + cj · r 2
for some integer cj . And so 1 + q + q 2 + . . . + q r−1 ≡ r + r(r−1)
2
rs mod r 2 ≡
r mod r 2 . This shows r||(1 + q + q 2 + . . . + q r−1 ). The general case follows
by induction.
(c) The argument for odd n is the same as in (b). The case n = 2,
q − 1 = (q 2 − 1)(q 2 + 1) is clear because q 2 ≡ 1 mod 4. The general case
4
follows by induction.
F [X1 , . . . , Xi−1 ][Xi ]/(f1 , . . . , fi−1 ) = (F [X1 , . . . , Xi−1 ]/(f1 , . . . , fi−1 ))[Xi ]
is irreducible.
Then the sequence ((Xi , fi ), i = 1, . . . , l) defines a tower of (algebraic)
field extensions over F , that is F = F0 ≤ F1 ≤ . . . ≤ Fl where Fi =
F [X1 , . . . , Xi ]/(f1 , . . . , fi ).
The degree di = [Fi : Fi−1 ] is the degree of the polynomial fi in the
indeterminate Xi .
Remark 3.2. Let ((Xi , fi ), i = 1, . . . , l) be a tower of field extensions for
a sequence of fields F = F0 ≤ F1 ≤ . . . ≤ Fl as in Definition 3.1. Then
the residue class of any polynomial g̃ ∈ F [X1 , . . . , Xl ] modulo (f1 , . . . , fl )
has a unique representative g ∈ F [X1 , . . . , Xl ] where the degree of g in each
variable Xi is smaller than di .
This representative g can be constructed recursively: First consider g̃
as polynomial in Xl and reduce it using the monic polynomial fl until the
degree of g̃ in Xl is smaller than dl . Then proceed in the same way with
8
Xl−1 , . . . , X1 . Since fi ∈ F [X1 , . . . , Xi ], the reductions of powers of Xi will
not enlarge the degree in the previously considered variables Xj , j > i. (The
{fi } form a Gröbner basis of the ideal they generate with respect to the
reverse lexicographic monomial ordering, and we just described the standard
reduction with this Gröbner basis.)
9
Pn−1
x = i=0 (mi mod p)bi . (So, the p-adic expansion of m yields the coefficients
of x with respect to the tower basis.)
10
Remark 3.5. This construction has a number of nice properties:
(b) The representation in (a) does not depend on n. The smallest possible
n has r-part r i if Xr,i occurs in a non-zero monomial of f , but not Xr,j
with j > i.
(c) Each element x ∈ F̄p can be identified by its Steinitz pair (n, m) where
n is the degree of x over Fp and m is the Steinitz number of x as element
of Fpn (see 3.4, note that we use the tower which has the prime divisors
of n in non-decreasing order as relative degrees).
(e) If n = r1l1 · · · rklk , then xn := xr1 ,l1 · · · xrk ,lk is a primitive element of
Fpn = Fp [xn ], see 2.3(b).
(f) We can perform arithmetic in F̄p : Let f¯, ḡ ∈ F̄p with standard repre-
sentatives f, g as in (a). Then f ± g is the standard representative of
f¯ ± ḡ. We get the standard representative of f¯ḡ from f g by reducing it
with the fr,i , starting with the lexicographically largest (r, i), see 3.2.
If f¯ ∈ F×pn the inverse can be computed as f
¯−1 = f¯pn −2 (via repeated
squaring). In large fields it is more efficient to use the extended Eu-
clidean algorithm for the representative f and fr,i , when Xr,i is the
variable with lexicographically largest (r, i) occuring in f (this may
involve further inversions in the coefficient field).
4 Embedding F̄×
p into C
×
11
(a) The exponential map
r r
Q+ → C× , 7→ e2πi s ,
s
induces an isomorphism e : Qp′ /Z → µp′ .
ℓ : F̄×
p → Qp′ /Z.
Remark 4.2. The cyclic group F× pn is the direct product of its (cyclic) Sylow
subgroups. A homomorphism ℓ : F× pn → Qp′ /Z is uniquely determined by
specifying an arbitrary generator yn,r of the Sylow r-subgroup of F× pn such
1 t n
that ℓ(yn,r ) = rt mod Z for each prime r with r ||(p − 1).
Having fixed these yn,r it is easy to compute for each divisor m of pn − 1
1
the element ym ∈ F× pn with ℓ(ym ) = m , provided the prime factorization of
m is known.
For example, for m = pn − 1 = r r tr the element ym ′
Q Q
= P r yn,r (product
over all prime divisors r of m) is a primitive root with ℓ(ym ) = r r1tr mod Z =
′
a
m
mod Z for some a ∈ Z. Let b ∈ Z be the inverse of a mod (pn − 1). Then
ym := (ym ) is the element with ℓ(ym ) = m1 mod Z.
′ b
12
5 Definition of standard extensions of prime
degree
As before let p be a fixed prime. We now define polynomials fr,i ∈ Fp [Xr,j |
1 ≤ j ≤ i] for each prime r and i ∈ Z>0 as explained in Section 3.1. We
distinguish four cases:
• r = p,
• r = 2 and 4 | (p + 1)
In the last case we give two different definitions (in 5.4 and 5.5).
The constructions in 5.1– 5.4 use the ideas of Shoup in [Sho90], and
in addition we follow Plesken [Ple15] and use Steinitz numbers to describe
explicit choices in certain steps.
5.1 Case r = p
In this case we use Artin-Schreier polynomials.
For each l ∈ Z>0 the sequence ((Xp,i , fp,i ), 1 ≤ i ≤ l) defines a tower of field
extensions of degree p over Fp .
Proof. We use Lemma 2.5(a) and induction. It is clear that fp,1 has no zero
in Fp , so fp,1 is irreducible over Fp .
We write Ii for the ideal generated by {fp,j | 1 ≤ j ≤ i} and xp,i for the
residue class of Xp,i in Fi := Fp [Xp,j | 1 ≤ j ≤ i]/Ii .
Now assume i > 1 and that we have shown for 1 ≤ j ≤ i − 1 that fp,j
modulo Ij−1 is irreducible over Fj−1 . We need to show that fp,i modulo Ii−1
has no zero in Fi−1 .
Set y := xp,i−1 and a := ( i−2 p−1
, so that y p − y − a = 0 and
Q
j=1 xp,j )
p p−1
fp,i mod Ii−1 = Xp,i − Xp,i − ay . Each element of Fi−1 has the form
13
We evaluate fp,i mod Ii−1 at x,
z = xp − x − ay p−1 ∈ Fi−1 ,
(d) Return a.
14
Proof and Remarks. The proportion of suitable x in step (a) is (r−1)/r. If
the powering is done with the repeated squaring method this needs O(log q)
multiplications in Fq . This step yields an element a is of order r t .
In step (b) the element a is changed to a primitive power such that z =
t−1
ar is the primitive r-th root of unity with smallest Steinitz number. This
step needs O(r + log q) multiplications in Fq .
Only when t > 1 further adjustments are done in step (c). For each
i+1
i the considered elements bz j are precisely the r-th roots of ar , we find
that one with the smallest Steinitz number and change a accordingly. Note
t−1
that all the time z = ar still holds. Here we need O((t − 2)(r + log q))
multiplications in Fq .
Note that for t > 1 we can find the lexicographically Steinitz-smallest
primitive r t -th root of unity by comparing tr Steinitz numbers which is more
efficient than comparing the Steinitz numbers of r t (1 − 1/r) elements to find
the primitive r t -th root of unity with smallest Steinitz number.
Proposition 5.4. Let r be odd with r | (p − 1), say r t ||(p − 1). Let a ∈
Fp be the lexicographically Steinitz-smallest element of order r t . We define
polynomials in Fp [Xr,i | i ∈ Z>0 ]:
r
fr,1 := Xr,1 −a
r
fr,i := Xr,i − Xr,i−1 for i ≥ 2.
For each l ∈ Z>0 the sequence ((Xr,i , fr,i ), 1 ≤ i ≤ l) defines a tower of field
extensions of degree r over Fp .
Proof. First assume that r is odd.
An r-th root of a has order r t+1 , so it cannot be contained in Fp . There-
fore, by Lemma 2.5(b) the polynomial fr,1 is irreducible over Fp .
Now let Ii be the ideal generated by fr,j with j ≤ i and Fi = Fp [Xr,j |
j ≤ i]/Ii . Let xr,i be the residue class of Xr,i in Fi . Then xr,i has order
r t+i . Since by Lemma 2.6(b) we have r t+i || |Fi − 1| we see by induction and
Lemma 2.5(b) that all polynomials fr,i+1 modulo Ii are irreducible.
In the case r = 2 we assume 4|(p − 1) and so 2||(p + 1). In this case
Lemma 2.6(c) shows that the statement in 2.6(b) remains correct for r = 2.
So, our proof also holds in this case.
15
2t ||(p2 − 1) and a ∈ F×
p2 be the lexicographically Steinitz-smallest element of
t
order 2 in Fp2 (which can be computed by Algorithm 5.3).
Proof. The proof is similar as for Proposition 5.4, now using Lemma 2.6(c).
16
Proposition 5.6. With a as above we define polynomials in K[Xr,i | i ∈
Z>0 ]:
f˜r,1 := Xr,1
r
−a
˜ r
fr,i := Xr,i − Xr,i−1 for i ≥ 2.
For each l ∈ Z>0 the sequence ((Xr,i , f˜r,i ), 1 ≤ i ≤ l) defines a tower of field
extensions of degree r over K.
Proof. The proof is the same as for Proposition 5.4.
Let Ki be the field defined by the tower of field extensions over Fp
((Y, g), (Xr,1, f˜r,1 ), . . . , (Xr,i , f˜r,i )),
so Ki is of degree er i over Fp . We write zj for the residue class of Xr,j
in Ki , and y for the residue class of Y . Furthermore, we write Li for the
subfield of index e in Ki , so Li is of degree r i over Fp . Let Ti : Ki → Li ,
e−1 i
x 7→ x + xq + . . . + xq with q = pr be the trace map.
Proposition 5.7. The element xr,i := Ti (zi ) ∈ Li is a primitive element of
Li (and so it also generates Li over Li−1 if i > 1).
Proof. We have c := zi−1 = zir ∈ Ki−1 if i > 1 or c := a = z1r ∈ K. Let
i
q = pr = |Li |, then σ : Ki → Ki , x 7→ xq generates the Galois group of Ki
over Li . For 0 ≤ j ≤ e − 1 let q j = sj r + tj with sj , tj ∈ Z and 0 ≤ tj < r.
t
Then σ j (zi ) = csj zi j . Note that the order of p modulo r, and so the order of
q modulo r, is e which shows that the tj , 0 ≤ j ≤ e−1, are pairwise different.
We get an equation
e−1
t
X
xr,i = σ j (zi ) = zi + cs1 zit1 + . . . + cse−1 zi e−1 ,
j=0
where the summands on the right hand side are linearly independent over
Ki−1 , in particular xr,i 6= 0. If xr,i was not a primitive element, then xr,i ∈
Li−1 ⊆ Ki−1 and the equation shows that zi is a zero of a polynomial of
degree < r over Ki−1 . But zi has degree r over Ki−1 and so xr,i is a primitive
element.
We remark that in practical computations of xr,i we can use that the
′
order of c is r t+i−1 , so that csj = csj if s′j ≡ sj mod r t+i−1 .
Algorithm 5.8. We construct for i > 0 the field Ki via a tower of field
extensions over Fp leading to the chain Fp ≤ L1 ≤ . . . ≤ Li ≤ Ki . Assume
that we have already constructed the tower of field extensions
((Xr,1 , fr,1), . . . , (Xr,i−1 , fr,i−1), (Y, g))
17
for Ki−1 (this is just ((Y, g)) for i = 1), and that we know the element
zi−1 ∈ Ki−1 written as element with respect to this tower (setting z0 = a in
case i = 1). We construct the tower for Ki .
Remark 5.9. The critical steps in Algorithm 5.8 are (c), (d) and (e). Say, if
r > 1000 is a prime then for many p the index e will be r −1 or a large divisor
of it. So, the mentioned steps for i = 1 involve computations in an Fp -vector
space of dimension > 106 . Shoup [Sho94] describes an asymptotically fast
method to compute the minimal polynomial of xr,i . But is remains unclear
to the author how practical it would be in the range we want to handle. It
is also not clear how to do the rewriting of the elements zi in our step (e)
more efficiently (this is needed for the iteration).
The minimal polynomials fr,i of the xr,i in Algorithm 5.8 look like pretty
random dense polynomials and the xr,i usually have a large order.
18
5.5 Variant 2 for case r 6= p, r ∤ (p − 1)
In this subsection we decribe an alternative to the construction in 5.4 which
avoids the computations in large fields as Ki in Algorithm 5.8. It is also
easier to describe and to implement.
The idea is simply to construct relatively sparse random polynomials and
to check them for irreduciblity. From Lemma 2.4 we know that about 1/r of
all monic polynomials of degree r are irreducible. Of course, we cannot use
truly random polynomials because we want to define a set of recomputable
polynomials. We define a pseudo random number generator which is very
easy to implement and which in practice seems to produce suffiently random
polynomials for our purposes.
Our random number generator SimpleRandomRange(b, s) uses the prime
number m = 232 − 5 and that a = 1347244577 + mZ is a primitive root of
Z/mZ. Its input is an (often large multiprecision) positive integer b and a
seed s in the range 1 ≤ s ≤ m − 1. It returns a (close to uniformly dis-
tributed) integer c in the range 0 ≤ c < b and a new seed. Here is the
pseudo code.
Algorithm 5.10.
SimpleRandomRange(b, s)
m = 4294967291
a = 1347244577
bnd = 100 * b
c = 0
t = 1
while t < bnd
t = t * (m-1)
s = (a * s) mod m
c = c * (m-1) + s -j1 k
c = (b * c) div t (= btc )
return c, s
19
available that checks if the monic polynomial f over K is irreducible. Here is
the pseudo code:
Algorithm 5.11.
FindIrreduciblePolynomial(K, r, a, X)
q = |K|
inc = minimal integer with qinc ≥ 2r
d = 0 (random coeffs up to Xd )
seed = 1 (fix initial seed for reproducible result)
r
f = X + X + a (first polynomial to try)
count = 0
while not IsIrreducible(K, f)
if count modulo r = 0 then
(after any r trials we allow inc more non-zero coefficients)
d = minimum(d+inc, r-1)
f = Xr + a
for j from 1 to d
m, seed = SimpleRandomRange(q, seed)
f = f + SteinitzElement(K, m) Xj
count = count + 1
return f
20
Note that the norm of xr,1 over Fp is 1 ∈ Fp and for i > 1 the norm of
xr,i over Fi−1 is xr,i−1 .
(a) Find minimal divisor k|n such that r t ||(pk −1). If k < n then return the
result of StandardCyclicGeneratorPrimePower(p, k, r) as element of
Fp n .
(c) Case l = n:
(c1) seed = 1
(c2) c, seed = SimpleRandomRange(pn , seed)
(c3) Let x ∈ Fpn be the element with Steinitz number c.
n −1)/r
(c4) If x = 0 or x(p = 1 go back to step (c2).
21
n −1)/r t
(c5) Return yn,p = x(p .
Remark 6.2. The time critical case in this algorithm is step (d2). A practi-
cal method for this step is to first power random elements to find an element
y of order r t . Then compute the discrete logarithm b such that (y r )b = yn/r,r .
This can be done by the Pohlig-Hellman algorithm [PH78] which involves
t − 2 searches through r elements (which can be optimized via Shanks’ al-
gorithm). Now y b is an r-th root of yn/r,r . Finally multiply y b with all r-th
t−1
roots of one (these are the elements (y r )i , 0 ≤ i < r) to find the r-th root
with the smallest Steinitz number. Note that the primes r for which this
case occurs are divisors of the degree of the field over its prime field, and so
loops of length r are acceptable.
We considered modifications of the base case (c) in practice where we
looked for more systematic (not pseudo random) candidate elements x for
step (c4). But similar to our Remark 5.13 we ran into examples where we
had to try many elements or did not find an appropriate element at all in
reasonable time. This problem vanished with our choice of pseudo random
elements.
7 Remarks on implementation
The main purpose of this article is to describe a standardized construction
of finite fields and standardized generators of their cyclic subgroups which
works in practice and could be adopted by various software packages dealing
with finite fields.
Therefore, we publish at the same time as this article an implemention
of the constructions as a GAP [Gap] package called StandardFF [Lü21].
The package allows to construct the finite fields as towers and also as sin-
gle extensions with respect to the standardized primitive elements xn defined
in 3.5(e). The package provides various representations of finite field elements
22
with conversions into each other: representing polynomials (in tower and in
single extension), Steinitz numbers, vectors with respect to the tower basis,
and Steinitz pairs (a pair (d, k) if the element has degree d over the prime
field Fp and its Steinitz number as element of Fpd is k). There are functions
to compute our standardized generators of cyclic subgroups and embeddings
of fields.
The implementation only uses arithmetic of univariate polynomials (rep-
resented as coefficient lists) and contains an irreducibility test as mentioned
after 5.11. We compute minimal polynomials of a field element by computing
its action on some basis and the minimal polynomial of the corresponding
matrix.
For testing purposes we have implemented both variants of the generic
case given in Sections 5.4 and 5.5. We give two examples for Remark 5.9: To
2
construct the fields of order 2107 and 2(107 ) with variant 1 from Section 5.4
our programs needed 8 seconds and 29 hours, respectively. With variant 2
from 5.5 they needed 17 milliseconds and 42 minutes. To construct the field
with 711009 elements with variant 1 took more than one week while variant
2 finished in 24 seconds. From now we only consider the construction with
variant 2.
In further systematic tests we considered the finite fields of order pn in
the following ranges:
• 1 ≤ n ≤ 2000 for p = 2, 3, 5, 7
This includes all 10800 cases for which we know the Conway polynomial.
Due to decades long enormous computational resources used to find factors
of numbers of the form an ± 1, see [Cro], we know the factorization of pn − 1
for 112519 fields in the considered range. These are the only fields for which
we can hope to find (standardized) primitive roots (otherwise we cannot
determine the order of an element in the field).
Our programs can construct all of these 112519 fields Fpn in about 20
hours and it can find all the standardized primitive roots ym ∈ Fpn as de-
scribed in Remark 4.2 in additional 36 hours. (The minimal polynomials of
these ym over their prime field form a substitute for the Conway polynomi-
als with the same compatibility properties.) Computing the ym and their
minimal polynomials just for the fields where we know the Conway polyno-
mial takes less than 5 minutes (while the original computations of the known
Conway polynomials involved many years of CPU time).
23
It is also possible to construct many fields outside the mentioned range
(larger degree or much larger characteristic). The hard cases are when a
large prime divides the degree. And the effort to compute minimal poly-
nomials of the primitive elements xn ∈ Fpn grows like n3 for fixed p in our
implementation.
24
8 Application to Brauer character tables
Let G be a finite group, K be an algebraically closed field and n ∈ Z>0 . A
group homomorphism ρ : G → GLn (K) is called a representation. If K has
characteristic 0 then much information about ρ is encoded in its character
χ : G → K, g 7→ Trace(ρ(g)), a function which is constant on conjugacy
classes. The Trace is the sum of the eigenvalues of the matrix in K.
If K has finite characteristic p then the character as defined above con-
tains much less information about ρ (for example in characteristic 0 we have
χ(1) = n but in characteristic p only χ(1) = n mod p ∈ Fp ). Instead we use
Brauer characters χ̃ which are defined on the elements g ∈ G of order not
divisible by p. Here, χ̃(g) is the sum of the lift of the eigenvalues of ρ(g) to
complex roots of unity. Such a lift is an isomorphism e◦ℓ : F̄× ×
p → µp′ ⊆ C as
we have considered in Section 4. In general the values of a Brauer character
depend on the chosen lift.
A large collection of Brauer characters is contained in the GAP [Gap]
character table library CTblLib [Bre20] which includes all Brauer characters
from the Modular Atlas [Jan+95]. The values are given with respect to a
lift defined by the Conway polynomials: if f (X) ∈ Fp [X] is the Conway
polynomial defining the field with pn elements then the lift restricted to
Fp n ∼= Fp [X]/(f ) is defined by X +(f ) 7→ exp(2πi/(pn −1)). More details can
be found in the Introduction and Appendix 1 of the Modular Atlas [Jan+95].
Our definition of standard generators ym of cyclic groups of order m
in 4.2 and 6.1 yields another lift, where ym is mapped to exp(2πi/m) for all
m ∈ Z>0 .
How can we recompute the values of known Brauer characters with re-
spect to the new lift defined here? The first step is to compute the lifted
eigenvalues from the character tables. This can be done because the men-
tioned Brauer character tables contain the power maps of the group (for each
element one knows the conjugacy class of all its powers) and this yields a Van-
dermonde type system of equations for the multiplicities of the eigenvalues.
If the relevant Conway polynomial is known we can derive the correspond-
ing eigenvalues in characteristic p as elements in the finite fields defined by
Conway polynomials.
The missing step to compute the image of these eigenvalues under our
new lift is an identification of the elements in Conway polynomial generated
fields with elements in the algebraic closure F̄p constructed in 3.1.
Let n|m and f, g ∈ Fp [X] be the Conway polynomials of degrees n and
m, respectively. Then Fp [X]/(f ) is considered as subfield of Fp [X]/(g) by
mapping X + (f ) to (X + (g))a with a = (pm − 1)/(pn − 1). We define
embeddings of the fields Fp [X]/(f ) into our F̄p which commute with these
25
inclusion relations:
Definition 8.1. We define the embedding by induction over the degree of
the field.
Since any field homomorphism maps 1 7→ 1 it is clear how to identify the
zero z1 of a Conway polynomial of degree 1 in the prime field. Now let n > 1
and f ∈ Fp [X] be the Conway polynomial of degree n. Assume that for any
proper divisor m|n we have already defined the image zm ∈ F̄p of the residue
class X + (g) for the Conway polynomial g of degree m.
Then we map X + (f ) to the zero zn of f in our standard field of order pn
which has the smallest Steinitz number among the zeros z which fulfill the
n m
compatibility conditions z (p −1)/(p −1) = zm for all proper divisors m of n.
Our software package StandardFF [Lü21] contains a function Steinitz-
PairConwayGenerator which computes the Steinitz pairs decribing the ele-
ments zn in Definition 8.1.
To compute the image of zn under our new lift we have to find the discrete
logarithm e such that ypen −1 = zn . This can be challenging in large fields,
but in practice we usually only need the image of powers of zn of small order
which can be found much easier.
Our package StandardFF [Lü21] also has a function StandardValues-
BrauerCharacter which recomputes values of Brauer characters with respect
to our new lift, provided the relevant Conway polynomials are known.
We consider two explicit examples: The Brauer character table of the
largest sporadic simple group, the Monster, in characteristic 19 contains sev-
eral Brauer characters for which our function to recompute their values ac-
cording to our new lift fails (because some needed Conway polynomials are
not known and essentially impossible to compute). But in this case one can
check that with any irreducible Brauer character all its Galois conjugate class
functions are also irreducible Brauer characters. In such a case the Brauer
characters are the same for any lift, only the map from a set of concrete
representations to their Brauer character depends on the lift (and here we
cannot compute the permutation of Brauer characters caused by the different
lifts).
Thomas Breuer systematically determined all cases in the CTblLib [Bre20]
library where we cannot recompute the Brauer character values for our new
lift because of missing Conway polynomials, or where a complex character
value cannot be reduced modulo a prime dividing the group order. This
concerns about 50 finite fields for which the Conway polynomial would be
needed. With the construction described in this paper our software only
needs 3 seconds to construct these fields including our standardized primi-
tive roots.
26
As second explicit example we mention the Brauer character table of
the alternating group A18 in characteristic 7. In this case we are able to
recompute all values with respect to our new lift. It turns out that there
are two characters of degree 745459 where the new lift yields class functions
which are not contained in the original table. So, the two different lifts
actually lead to different Brauer character tables.
Finally, we want to illustrate another interesting feature of the construc-
tions in this paper. Say, we have a group element of order 523 and we want to
lift 523-th roots of unity in characteristic 13. Then the smallest field contain-
ing such roots of unity is F13261 . The factorization of 13261 − 1 is not known
and so probably very hard to compute. So, even with our new definition
we have no chance to compute our standardized primitive root of this field.
Nevertheless, for our purpose we only need to construct the field of order
13261 and our standard generator of order 523 in this field. Our programs
can do this in 0.4 seconds.
References
[BCS97] W. Bosma, J. Cannon, and A. Steel. “Lattices of compatibly
embedded finite fields”. In: J. Symbolic Comput. 24.3-4 (1997).
Computational algebra and number theory (London, 1993), pp. 351–
369.
[Bre20] T. Breuer. CTblLib, The GAP Character Table Library, Version
1.3.1.
http://www.math.rwth-aachen.de/~Thomas.Breuer/ctbllib.
GAP package. 2020.
[Car93] R. W. Carter. Finite groups of Lie type. Wiley Classics Library.
Conjugacy classes and complex characters, Reprint of the 1985
original, A Wiley-Interscience Publication. John Wiley & Sons,
Ltd., Chichester, 1993, pp. xii+544.
[Cro] J. Crombie. Factor collection an ± 1.
http://myfactorcollection.mooo.com:8090/.
[DFRR19] L. De Feo, H. Randriam, and E. Rousseau. “Standard lattices of
compatibly embedded finite fields”. In: ISSAC’19—Proceedings
of the 2019 ACM International Symposium on Symbolic and Al-
gebraic Computation. ACM, New York, 2019, pp. 122–130.
[Gap] GAP – Groups, Algorithms, and Programming, Version 4.11.1.
https://www.gap-system.org. The GAP Group, 2021.
27
[GP97] S. Gao and D. Panario. “Tests and Constructions of Irreducible
Polynomials over Finite Fields”. In: Foundations of Computa-
tional Mathematics. Ed. by F. Cucker and M. Shub. Berlin, Hei-
delberg: Springer Berlin Heidelberg, 1997, pp. 346–361.
[GS] D. R. Grayson and M. E. Stillman. Macaulay2, a software system
for research in algebraic geometry.
http://www.math.uiuc.edu/Macaulay2/.
[Jan+95] C. Jansen et al. An atlas of Brauer characters. Vol. 11. Lon-
don Mathematical Society Monographs. New Series. Appendix
2 by T. Breuer and S. Norton, Oxford Science Publications.
The Clarendon Press, Oxford University Press, New York, 1995,
pp. xviii+327.
[Lan02] S. Lang. Algebra. third. Vol. 211. Graduate Texts in Mathemat-
ics. Springer-Verlag, New York, 2002, pp. xvi+914.
[LS08] H. Lenstra and B. de Smit. Standard Models for Finite Fields.
http://damtp.cam.ac.uk/user/na/FoCM/FoCM08/Talks/
Lenstra.pdf. (see also 11.7 in [Mul13]). 2008.
[Lü09] F. Lübeck. Tables of Conway polynomials of finite fields.
http://www.math.rwth-aachen.de/~Frank.Luebeck/data/
ConwayPol/. Lehrstuhl D für Mathematik, RWTH Aachen, 2009.
[Lü21] F. Lübeck. StandardFF: A GAP package for constructing fi-
nite fields. https://github.com/frankluebeck/StandardFF/.
2021.
[Mag] MAGMA – a computational algebra system, Version 2.24.
http://magma.maths.usyd.edu.au/magma/. The Computational
Algebra Group, 2019.
[Mul13] G. L. Mullen, ed. Handbook of finite fields. Discrete Mathematics
and its Applications (Boca Raton). CRC Press, Boca Raton, FL,
2013, pp. xxxvi+1033.
[PH78] S. C. Pohlig and M. E. Hellman. “An improved algorithm for
computing logarithms over GF(p) and its cryptographic signifi-
cance”. In: IEEE Trans. Inform. Theory IT-24.1 (1978), pp. 106–
110.
[Ple15] W. Plesken. Höhere algorithmische Algebra I. Vorlesungsskript
RWTH Aachen. 2015.
28
[Rin15] M. Ringe. The C-MeatAxe, Version 2.4.X.
https://www.math.rwth-aachen.de/~MTX/. Lehrstuhl D für Math-
ematik, RWTH Aachen, 2015.
[Sag] SageMath, the Sage Mathematics Software System, Version 9.0.
https://www.sagemath.org. The Sage Developers, 2020.
[Sho90] V. Shoup. “New algorithms for finding irreducible polynomials
over finite fields”. In: Math. Comp. 54.189 (1990), pp. 435–447.
[Sho94] V. Shoup. “Fast construction of irreducible polynomials over fi-
nite fields”. In: J. Symbolic Comput. 17.5 (1994), pp. 371–391.
[Ste10] E. Steinitz. “Algebraische Theorie der Körper”. In: J. Reine
Angew. Math. 137 (1910), pp. 167–309.
29