Prime Numbers

2.3 Squares and roots 103
simply computes the desired root r = x (p+1)/2 mod f (using polynomial-mod
operations). Note finally that the special cases p ≡ 3, 5, 7 (mod 8) can also
be ferreted out of any of these algorithms, as was done in Algorithm 2.3.8, to
improve average performance.
The complexity of Algorithm 2.3.9 is O(ln 3 p) bit operations (assuming
naive arithmetic), which is asymptotically better than the worst case of
Algorithm 2.3.8. However, if one is loath to implement the modified powering
ladder for the F p 2 arithmetic, the asymptotically slower algorithm will usually
serve. Incidentally, there is yet another, equivalent, approach for square
rooting by way of Lucas sequences (see Exercise 2.31).
It is very interesting to note at this juncture that there is no known fast
method of computing square roots of quadratic residues for general composite
moduli. In fact, as we shall see later, doing so is essentially equivalent to
factoring the modulus (see Exercise 6.5).
2.3.3 Finding polynomial roots
Having discussed issues of existence and calculation of square roots, we now
consider the calculation of roots of a polynomial of arbitrary degree over
a finite field. We specify the finite field as Fp, but much of what we say
generalizes to an arbitrary finite field.
Let g ∈ Fp[x] be a polynomial; that is, it is a polynomial with integer
coefficients reduced (mod p). We are looking for the roots of g in Fp, andso
we might begin by replacing g(x) withthegcdofg(x) andx p − x, sinceas
we have seen, the latter polynomial is the product of x − a as a runs over
all elements of Fp. Ifp>deg g, one should first compute x p mod g(x) via
Algorithm 2.1.5. If the gcd has degree not exceeding 2, the prior methods we
have learned settle the matter. If it has degree greater than 2, then we take a
further gcd with (x + a) (p−1)/2 − 1forarandoma ∈ Fp. Any particular b = 0
in Fp is a root of (x + a) (p−1)/2 − 1 with probability 1/2, so that we have a
positive probability of splitting g(x) into two polynomials of smaller degree.
This suggests a recursive algorithm, which is what we describe below.
Algorithm 2.3.10 (Roots of a polynomial over Fp).
Given a nonzero polynomial g ∈ Fp[x], with p an odd prime, this algorithm returns
the set r of the roots (without multiplicity) in Fp of g.Thesetr is assumed global,
augmented as necessary during all recursive calls.
1. [Initial adjustments]
r = {}; // Root list starts empty.
g(x) =gcd(x p − x, g(x)); // Using Algorithm 2.2.1.
if(g(0) == 0) { // Check for 0 root.
r = r ∪{0};
g(x) =g(x)/x;
}
2. [Call recursive procedure and return]