Fast Deterministic Normal Bases and Circulant Polynomial Determinants

Abstract

Let $\mathsf{E}=\mathbb F_q[x]/(\Gamma)$ be an algebraic extension of degree $n$ over the finite field $\mathbb F_q$, given by a $\Gamma\in\mathbb F_q[x]$ monic and irreducible. It is classical that any such $\mathsf{E}$ contains an element $\beta\in\mathsf{E}$ that is normal over $\mathbb F_q$, i.e., the conjugates $\beta,\beta^q,\ldots,\beta^{q^{n-1}}$ form an $\mathbb F_q$-basis of $\mathsf{E}$. In this paper we give a deterministic algorithm which finds such a normal element using $O_\epsilon((n^2\log q)^{1+\epsilon})+O\,\tilde{}\,(n\log^2 q)$ bit operations, for any $\epsilon>0$. The algorithm works by showing that, for a parameter $t\in\mathbb F_q$, the element $\beta_t=(\theta-t)^{-1}$ is normal except for at most $n(n-1)$ values of $t$. This is established by constructing a "cleared Moore" circulant matrix over $\mathbb F_{q^n}[\mathcal T]$, whose determinant degree at most $n(n-1)$, such that $\beta_t$ is normal if and only the determinant is non-zero at $t\in\mathbb F_q$. For faster computation over the base field, we replace this by an equivalent trace Gram circulant matrix over $\mathbb F_q[\mathcal T]$. A main algorithmic contribution is a fast determinant algorithm for circulant matrices of polynomials, which uses triangular set projection and modular composition techniques to achieve a near-linear cost. Given an $n\times n$ circulant matrix over $\mathbb F_q[t]$ whose entries have degree at most $m>0$, we show how to compute its determinant deterministically with $O_\epsilon((nm\log q)^{1+\epsilon})$ bit operations. We complete the solution by showing how to extend this to finite fields of size less than $n(n-1)$, through an embedding in a low-degree extension field, at poly-logarithmic additional cost.