Do not require a multiplicative generator for finite field nth_root #35346
Conversation
a45cde5 to
9037785
Compare
Codecov ReportPatch coverage has no change and project coverage change:
Additional details and impacted files@@ Coverage Diff @@
## develop #35346 +/- ##
===========================================
- Coverage 88.62% 88.60% -0.02%
===========================================
Files 2148 2148
Lines 398855 398855
===========================================
- Hits 353480 353423 -57
- Misses 45375 45432 +57 see 27 files with indirect coverage changes Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here. ☔ View full report in Codecov by Sentry. |
9037785 to
0d6e613
Compare
|
(just a detail) It is not quite accurate that |
| # We need an element of order r^k (g^h in Johnston's article) | ||
| # self^x differs from the actual nth root by an element of | ||
| # order dividing r^(k-v) | ||
| gh = K.zeta(r**k) |
There was a problem hiding this comment.
Here is possibly a place where time can be saved even more. Namely computing r**k forgots the factored form of this number and is recomputed in the last line of zeta. Maybe one can tweak zeta so that it also accepts Factorization argument.
Finding a multiplicative generator usually requires factoring the order of the multiplicative group, which can be very expensive. Instead, we only need primitive roots for powers of primes dividing n, where n is a strict divisor of the order of the multiplicative group (usually small).
0d6e613 to
335b7f8
Compare
|
Documentation preview for this PR is ready! 🎉 |
Indeed, I removed that bit from the description text above. |
📚 Description
This patch avoids computing a multiplicative generator in
nth_rootfor finite fields, which usually requires factoring the order of the multiplicative group, which can be very expensive. The following example, included in doctests of this patch, currently does not complete in finite time (instead of a few ms after the change):The issue is well-known to various users. A previous proposal, Trac ticket #28585 was suggesting switching to Adleman-Manders-Miller entirely to fix the same issue.
This patch instead performs minimal changes, keeps the Johnston's algorithm, only modifying how the value of
g^his computed (it seems legit to still call it Johnston's algorithm because it processesr^k-th roots in a single discrete log, using the formula from the article), using the existingzetamethod.📝 Checklist