Prime Numbers

6.6 Research problems 317
be determined,
z = γ ×− γ,
where ×− denotes negacyclic convolution, and z is the signal consisting
of the zj coefficients. But we know how to do negacyclic convolution via
fast transform methods. Writing
d−1
Γk = γjα j α −2kj ,
j=0
one can establish the weighted-convolution identity
d−1
−n 1
zn = α Γ
d
k=0
2 kα +2nk .
The deconvolution idea, then, is simple: Given the signal z to be squarerooted,
transform this last equation above to obtain the Γ2 k , then assign
one of 2d−1 distinct choices of sign for the respective ± Γ2 k , k ∈ [1,d−1],
then solve for γj via another transform. This negacyclic deconvolution
procedure will result in a correct square root γ of γ 2 . The research question
is this: Since we know that number fields based on f(x) =x d + 1 are
easily handled in many other ways, can this deconvolution approach be
generalized? How about f(x) =x d + c, orevenmuchmoregeneralf?
It is also an interesting question whether the transforms above need to
be floating-point ones (which does, in fact, do the job at the expense of
the high precision), or whether errorless, pure-integer number-theoretical
transforms can be introduced.
(3) For any of these various ideas, a paramount issue is how to avoid the rapid
growth of coefficient sizes. Therefore one needs to be aware that a squareroot
procedure, even if it is numerically sound, has to somehow keep
coefficients under control. One general suggestion is to combine whatever
square-rooting algorithm with a CRT; that is, work somehow modulo
many small primes simultaneously. In this way, machine parallelism may
be possible as well. As we intimated in text, ideas of Couveignes and
Montgomery have brought the square-root obstacle down to a reasonably
efficient phase in the best prevailing NFS implementations. Still, it would
be good to have a simple, clear, and highly efficient scheme that generalizes
not just to cases of parity on the degree d, but also manages somehow to
control coefficients and still avoid CRT reconstruction.