Table Of ContentComputational Algebra
Willem de Graaf
ii
Contents
1 Gr¨obner Bases 1
1.1 Gro¨bner bases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.1.1 Polynomial rings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1
1.1.2 Polynomials in one indeterminate . . . . . . . . . . . . . . . . . . . . . 3
1.1.3 Monomial orders . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1.4 Polynomial division for multivariate polynomials . . . . . . . . . . . . 5
1.1.5 Monomial ideals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7
1.1.6 Gro¨bner bases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9
1.1.7 Computing Gro¨bner bases . . . . . . . . . . . . . . . . . . . . . . . . . 10
1.2 Applications of Gro¨bner bases . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
1.2.1 Solving polynomial equations . . . . . . . . . . . . . . . . . . . . . . . 15
1.2.2 Applications of Gro¨bner bases in geometry . . . . . . . . . . . . . . . 20
1.2.3 An application in combinatorics: Alon’s non-vanishing theorem . . . . 24
1.2.4 An application in cryptography: Polly-cracker . . . . . . . . . . . . . . 26
1.2.5 Solving Sudoku . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27
1.3 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28
2 Integer Factorisation 31
2.1 The Miller-Rabin primality test . . . . . . . . . . . . . . . . . . . . . . . . . . 31
2.2 Factorisation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
2.2.1 The method of Fermat . . . . . . . . . . . . . . . . . . . . . . . . . . . 34
2.2.2 The continued fraction method (CFRAC) . . . . . . . . . . . . . . . . 35
2.2.3 The elliptic curve method (ECM) . . . . . . . . . . . . . . . . . . . . . 45
2.2.4 Complexity . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53
2.3 Primality proving with elliptic curves . . . . . . . . . . . . . . . . . . . . . . . 54
2.4 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54
3 Polynomial Factorisation 57
3.1 Some generalities on polynomials . . . . . . . . . . . . . . . . . . . . . . . . . 57
3.2 Berlekamp’s algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60
3.3 The algorithm of Cantor-Zassenhaus . . . . . . . . . . . . . . . . . . . . . . . 63
3.4 Factorisation of polynomials over Q. . . . . . . . . . . . . . . . . . . . . . . . 65
3.4.1 Hensel lifting . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66
3.4.2 Hensel lifting for more factors . . . . . . . . . . . . . . . . . . . . . . . 72
3.5 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73
iv
4 Lattice Basis Reduction 75
4.1 Lattices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75
4.2 Properties of Gram-Schmidt orthogonalisation . . . . . . . . . . . . . . . . . . 76
4.3 Reduced lattice bases. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 78
4.4 The LLL algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
4.4.1 Reduce(k,l) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80
4.4.2 Exchange(k) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81
4.5 The knapsack cryptosystem . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83
4.6 Exercises . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85
Chapter 1
Gr¨obner Bases
The term “Gro¨bner bases” was introduced by Bruno Buchberger
in his 1965 Ph.D. thesis (An algorithm for finding the basis elements of the residue class
ring of a zero dimensional polynomial ideal, University of Innsbruck) under the supervision
of Wolfgang Gro¨bner. However, similar notions in different settings were around before that
date, and have been developed since. In 1900 Gordan appears to have used a very similar
concept. Furthermore, a “Gro¨bner basis theory” for free Lie algebras was developed by
Shirshov in 1962 (Some algorithmic problems for Lie algebras, Sib. Mat. Zh). Also, the
so-called Knuth-Bendix algorithm (Knuth and Bendix, Simple word problems in universal
algebra, 1970) is a similar development in the theory of finitely-presented groups.
In this chapter we describe the theory of Gro¨bner bases, and some of its applications, for
ideals in a polynomial ring.
Throughout we use the notation N = Z .
0
≥
1.1 Gro¨bner bases
1.1.1 Polynomial rings
Throughout k will denote a field, and k[x ,...,x ] will be the polynomial ring in n indeter-
1 n
minates, with coefficients in k. That is
k[x ,...,x ] = c xi1 xin c k .
1 n { i1...in 1 ··· n | i1...in ∈ }
i1X,...,in
Example 1.1.1 In the cases where we have one, two or three indeterminates we also write,
respectively, k[x], k[x,y] and k[x,y,z].
2 Gro¨bner Bases
A more compact notation for the exponents is useful on many occasions. For α =
(α ,...,α ), α N, we define xα = xα1 xαn. Such an element is called a monomial.
1 n i ∈ 1 ··· n
Example 1.1.2 x2yz10 is a monomial, and 2x2y+3yz is a polynomial.
So in general we can write a polynomial as c xα.
α α
Recall that a ring R is said to be commutative if fg = gf for all f,g R. So polynomial
P ∈
rings are commutative.
Definition 1.1.3 Let R be a commutative ring. A subset I R is called an ideal if
⊂
- 0 I;
∈
- if f,g I then also f +g I;
∈ ∈
- if f I and g R then gf I.
∈ ∈ ∈
In this chapter we deal exclusively with polynomial rings k[x ,...,x ]. In such rings we
1 n
have a particular class of examples of ideals, which are described as follows.
Let f ,...,f k[x ,...,x ] and set
1 s 1 n
∈
s
I = g f g k[x ,...,x ] .
i i i 1 n
{ | ∈ }
i=1
X
Thenobviously I is anideal of k[x ,...,x ]. Later wewillsee thatevery idealof k[x ,...,x ]
1 n 1 n
is of this form.
Notation. We will denote the ideal I above with I = f ,...,f , and say that I is
1 s
h i
generated by f ,...,f .
1 s
Fundamental problem: “Given I = f ,...,f and g k[x ,...,x ] decide whether
1 s 1 n
h i ∈
g I.”
∈
Example 1.1.4 Let R = k[x,y,z], f = xyz xy, f = x2y yz and g = yz2 yz. The
1 2
− − −
question is whether g f ,f .
1 2
∈ h i
Observe that
xf zf = x2y+yz2
1 2
− −
so we add f and find
2
xf zf +f = yz2 yz = g
1 2 2
− −
and hence g = xf +(1 z)f f ,f .
1 2 1 2
− ∈ h i
Example 1.1.5 Let I k[x,y,z] be the ideal generated by f = x2yz yz x, f =
1 2
⊂ − −
xy2z xy y, f = xyz2 xy z. Then x2 z2 and y z lie in I. But it certainly is not
3
− − − − − −
obvious.
We see that checking whether g f ,...,f can be a rather complicated thing. But at
1 s
∈ h i
least we know that we have to find h with g = h f . To show that g f ,...,f seems
i i i i 6∈ h 1 si
even more difficult.
P
1.1 Gro¨bner bases 3
1.1.2 Polynomials in one indeterminate
If we are dealing with polynomials in a single indeterminate, then the fundamental problem
has an easy solution.
Lemma 1.1.6 Let I k[x] be an ideal. Then there exists h k[x] with I = h .
⊂ ∈ h i
Proof. Let h be a nonzero element of I, of minimal degree. Let f I. Then f = qh+r
∈
with q,r k[x] and deg(r) < deg(h).
∈
Since r = f qh I we get that r = 0 as h is of minimal degree in I. It follows that
− ∈
f = qh. (cid:3)
Now let I = h k[x] and f k[x]. From the proof of the preceding lemma we get the
h i ⊂ ∈
following procedure to check whether f I:
∈
1) Write f = qh+r with deg(r) < deg(h). (Polynomial division.)
2) If r = 0 then f I otherwise f I.
∈ 6∈
(Note that if I is generated by h, then h is of minimal degree in I.)
We want to find some analogous procedure in the multivariate case. The key remark is
that in the case of one indeterminate we use the degree of a polynomial. In other words, we
use an ordering on the monomials: xm < xn if m < n. We start by generalising that to the
multivariate situation.
1.1.3 Monomial orders
Recall the notation xα = xα1 xαn, where α= (α ,...,α ).
1 ··· n 1 n
Definition 1.1.7 An order on the set xα of the monomials of k[x ,...,x ] is called a
1 n
≤ { }
monomial order if
1) is total, that is, for all α,β we have xα xβ or xβ xα.
≤ ≤ ≤
2) is multiplicative, that is, if xα xβ then xαxγ xβxγ for all γ.
≤ ≤ ≤
3) There are no infinite descending chains xα(1) > xα(2) > ... (in other words, is a well-
≤
ordering).
We identify xα α Nn and Nn by xα α.
{ | ∈ } ↔
So from an order on the set of monomials we get an order on Nn by α < β if xα < xβ.
≤
Then the conditions for to be a monomial order translate to:
≤
1) is total.
≤
2) If α β then α+γ β +γ for all γ.
≤ ≤
3) There are no infinite descending chains.
In the following, when we speak about monomial orders we freely interchange between an
order on the set of monomials and on Nn, whichever is the most convenient.
The following observation is useful.
4 Gro¨bner Bases
Lemma 1.1.8 Set γ = (0,...,0) Nn and let be a monomial order. Then α > γ for all
0 0
∈ ≤
α Nn, α= γ .
0
∈ 6
Proof. If α < γ then α+α < α+γ = α. In the same way we find that (k+1)α < kα. So
0 0
we have constructed an infinite descending set. (cid:3)
Example 1.1.9 (Lexicographical order.) This order is denoted < . By definition, α< β
lex lex
if α < β where i is the minimal index with α = β .
i i i i
6
For example in k[x,y,z] we have
xy2z100 < x2yz
lex
and
xyz < xy3.
lex
The claim is that < is a monomial order.
lex
Proof. 1) It is obvious that it is a total order: if α = β then there is an index i with α = β .
i i
6 6
2) Suppose that α < β and let i be minimal with α = β , and hence α < β . Then i
lex i i i i
6
is also the minimal index with (α+γ) = (β+γ) and
i i
6
(α+γ) = α +γ < β +γ = (β +γ) .
i i i i i i
Therefore (α+γ) < (β +γ).
lex
3) The most difficult thing to show is that there are no infinite descending chains. For
this we use induction on n (i.e., the number of indeterminates).
For n = 1 it is obvious that there are no infinite descending chains (here the order reduces
to the normal degree order).
Assume that there are no infinite descending chains, with respect to < , when there
lex
are n 1 indeterminates. Also suppose that there is an infinite descending chain α(1) >
lex
−
α(2) > ..., with α(i) Nn.
lex
∈
Observe that 0 α(i) α(1) .
1 1
≤ ≤
Hence
α(1)1
α(i) i 1 = C
k
{ | ≥ }
k=0
[
where C = α(i) i 1, α(i) = k .
k 1
{ | ≥ }
So there has to be a k with C infinite. Then we set C = (α ,...,α ) α C .
0 k0 k0 { 2 n | ∈ k0}
But this is an infinite descending chain with respect to the < order on n 1 indetermi-
lex
nates. So we have our contradiction. e − (cid:3)
Example 1.1.10 (Graded lexicographical order.) Notation < .
glex
Define α = α +...+α ; this is the degree of the monomial xα. By definition α < β
1 n glex
| |
if
- α < β
| | | |
- or α = β and α < β.
lex
| | | |
It is obvious that < is a monomial order.
glex
1.1 Gro¨bner bases 5
1.1.4 Polynomial division for multivariate polynomials
As before we write R = k[x ,...,x ]. In this section we fix a monomial order on Nn.
1 n
≤
Let f = c xα k[x ,...,x ], and let α be maximal with respect to with c = 0.
α α ∈ 1 n ≤ α 6
Then xα is called the leading monomial of f, and denoted LM(f), whereas c is called the
α
P
leading coefficient and denoted by LC(f).
With this notation we have the following division algorithm, which is a generalisation of
the division algorithm for polynomials in one indeterminate.
Algorithm 1.1.11 (Polynomial division with remainder)
Given: f ,...,f R, g R.
1 s
∈ ∈
We compute: r R such that g = h f +...+h f +r with h R and no monomial of
1 1 s s i
∈ ∈
r is divisible by an LM(f ).
i
1) Set g¯:= g, r := 0.
2) If g¯= 0 we stop.
3) Write xγ = LM(g¯), c = LC(g¯). If there is an f such that LM(f ) divides xγ then we set
i i
c
g¯:= g¯ xβf
i
− LC(f )
i
where xβLM(f ) = xγ. Otherwise we set
i
g¯:= g¯ cxγ and r := r+cxγ.
−
Return to 2).
Proposition 1.1.12 The algorithm 1.1.11 terminates correctly.
Proof. In every round of the algorithm LM(g¯) decreases. Hence the algorithm terminates
as there are no infinite descending chains.
Not that throughout the execution of the algorithm we have g (g¯ + r) I, where
− ∈
I = f ,...,f . Indeed, this is surely true initially (when g¯= g, r = 0). Assume it holds for
1 s
h i
g¯ and r. If they get replaced by g¯ , r , with
1 1
c
g¯ = g¯ xβf and r = r,
1 i 1
− LC(f )
i
then
c
g (g¯ +r )= g (g¯+r)+ xβf
1 1 i
− − LC(f )
i
so also g (g¯ +r ) I. If on the other hand g¯ = g cxγ and r = r+cxγ then
1 1 1 1 1
− ∈ −
g (g¯ +r ) = g (g¯+r) I.
1 1
− − ∈
So the property continues to hold in the next round of the algorithm. (The property g (g¯+
−
r) I is said to be a loop-invariant of the algorithm.)
∈
So upon termination we have g¯= 0 and g r I and therefore
− ∈
g r = h f +...+h f .
1 1 s s
−
By construction we see that no LM(f ) divides a monomial in r. (cid:3)
i
6 Gro¨bner Bases
Remark 1.1.13 We note that the algorithm, and hence its output, depends strongly on the
chosen monomial order. In the next example we see that there is another element of choice
in the algorithm that can also affect the output.
Example 1.1.14 Let f = xy +1, f = y +1 e g = xy y. We use the monomial order
1 2
−
<=< .
glex
We can perform the algorithm in two ways:
First alternative:
•
1) g¯= xy y, r = 0;
−
2) g¯= g¯ f = y 1;
1
− − −
3) g¯= g¯+f = 0;
2
4) r = 0.
Second alternative:
•
1) g¯= xy y, r = 0;
−
2) g¯= g¯ xf = x y;
2
− − −
3) g¯= g¯+x = y, r = x;
− −
4) g¯= g¯+f = 1;
2
5) g¯= g¯ 1 = 0, r = x+1;
− −
6) r = x+1.
−
Remark 1.1.15 Let G k[x ,...,x ] be a set of polynomials, and f k[x ,...,x ]. Let
1 n 1 n
⊂ ∈
g G, and xα a monomial of f such that LM(g) divides xα. Let xβ be such that xα =
xβ∈LM(g), and set f¯= f c xβg, where c is the coefficient of xα in f. Then we say that f
− LC(g)
reduces to f¯modulo G, and we write f g f¯. Division with remainder can also be described
→
as a maximal sequence of reduction steps. The second alternative of the previous example
becomes
g f2 x y f2 x+1.
→ − − → −
Definition 1.1.16 Let r be the output of Algorithm 1.1.11 with input f ,...,f R, and
1 s
∈
g R. Then r is called a remainder of g modulo f ,...,f .
1 s
∈
So from this example we see that there can be more than one remainder of g modulo
f ,...,f . So the main problem is not solved as easily as in the univariate case. The main
1 s
idea is to find a different generating set G = g ,...,g of the ideal I = f ,...,f , with
1 t 1 s
{ } h i
the property that the remainder of a g R modulo G is unique, and moreover it is zero if
∈
and only if g I. Such a G will be called a Gro¨bner basis.
∈
First we study what happens in a relatively easy case.
