void MakeMonic(zz_pX& x)
{
if (IsZero(x))
return;
if (IsOne(LeadCoeff(x)))
return;
zz_p t;
inv(t, LeadCoeff(x));
mul(x, x, t);
}
void CanZass(vec_pair_ZZ_pEX_long& factors, const ZZ_pEX& f, long verbose)
{
if (!IsOne(LeadCoeff(f)))
LogicError("CanZass: bad args");
double t;
vec_pair_ZZ_pEX_long sfd;
vec_ZZ_pEX x;
if (verbose) { cerr << "square-free decomposition..."; t = GetTime(); }
SquareFreeDecomp(sfd, f);
if (verbose) cerr << (GetTime()-t) << "\n";
factors.SetLength(0);
long i, j;
for (i = 0; i < sfd.length(); i++) {
if (verbose) {
cerr << "factoring multiplicity " << sfd[i].b
<< ", deg = " << deg(sfd[i].a) << "\n";
}
SFCanZass(x, sfd[i].a, verbose);
for (j = 0; j < x.length(); j++)
append(factors, cons(x[j], sfd[i].b));
}
}
void FindRoot(GF2E& root, const GF2EX& ff)
// finds a root of ff.
// assumes that ff is monic and splits into distinct linear factors
{
GF2EXModulus F;
GF2EX h, h1, f;
GF2E r;
f = ff;
if (!IsOne(LeadCoeff(f)))
Error("FindRoot: bad args");
if (deg(f) == 0)
Error("FindRoot: bad args");
while (deg(f) > 1) {
build(F, f);
random(r);
clear(h);
SetCoeff(h, 1, r);
TraceMap(h, h, F);
GCD(h, h, f);
if (deg(h) > 0 && deg(h) < deg(f)) {
if (deg(h) > deg(f)/2)
div(f, f, h);
else
f = h;
}
}
root = ConstTerm(f);
}
NTL_START_IMPL
void SquareFreeDecomp(vec_pair_ZZ_pX_long& u, const ZZ_pX& ff)
{
ZZ_pX f = ff;
if (!IsOne(LeadCoeff(f)))
Error("SquareFreeDecomp: bad args");
ZZ_pX r, t, v, tmp1;
long m, j, finished, done;
u.SetLength(0);
if (deg(f) == 0)
return;
m = 1;
finished = 0;
do {
j = 1;
diff(tmp1, f);
GCD(r, f, tmp1);
div(t, f, r);
if (deg(t) > 0) {
done = 0;
do {
GCD(v, r, t);
div(tmp1, t, v);
if (deg(tmp1) > 0) append(u, cons(tmp1, j*m));
if (deg(v) > 0) {
div(r, r, v);
t = v;
j++;
}
else
done = 1;
} while (!done);
if (deg(r) == 0) finished = 1;
}
if (!finished) {
/* r is a p-th power */
long p, k, d;
conv(p, ZZ_p::modulus());
d = deg(r)/p;
f.rep.SetLength(d+1);
for (k = 0; k <= d; k++)
f.rep[k] = r.rep[k*p];
m = m*p;
}
} while (!finished);
}
void XGCD(zz_pX& d, zz_pX& s, zz_pX& t, const zz_pX& a, const zz_pX& b)
{
zz_p w;
if (IsZero(a) && IsZero(b)) {
clear(d);
set(s);
clear(t);
return;
}
zz_pX U, V, Q;
U = a;
V = b;
long flag = 0;
if (deg(U) == deg(V)) {
DivRem(Q, U, U, V);
swap(U, V);
flag = 1;
}
else if (deg(U) < deg(V)) {
swap(U, V);
flag = 2;
}
zz_pXMatrix M;
XHalfGCD(M, U, V, deg(U)+1);
d = U;
if (flag == 0) {
s = M(0,0);
t = M(0,1);
}
else if (flag == 1) {
s = M(0,1);
mul(t, Q, M(0,1));
sub(t, M(0,0), t);
}
else { /* flag == 2 */
s = M(0,1);
t = M(0,0);
}
// normalize
inv(w, LeadCoeff(d));
mul(d, d, w);
mul(s, s, w);
mul(t, t, w);
}
void FindRoots(vec_GF2E& x, const GF2EX& ff)
{
GF2EX f = ff;
if (!IsOne(LeadCoeff(f)))
Error("FindRoots: bad args");
x.SetMaxLength(deg(f));
x.SetLength(0);
RecFindRoots(x, f);
}
void FindRoots(vec_ZZ_pE& x, const ZZ_pEX& ff)
{
ZZ_pEX f = ff;
if (!IsOne(LeadCoeff(f)))
LogicError("FindRoots: bad args");
x.SetMaxLength(deg(f));
x.SetLength(0);
RecFindRoots(x, f);
}
void SquareFreeDecomp(vec_pair_GF2EX_long& u, const GF2EX& ff)
{
GF2EX f = ff;
if (!IsOne(LeadCoeff(f)))
Error("SquareFreeDecomp: bad args");
GF2EX r, t, v, tmp1;
long m, j, finished, done;
u.SetLength(0);
if (deg(f) == 0)
return;
m = 1;
finished = 0;
do {
j = 1;
diff(tmp1, f);
GCD(r, f, tmp1);
div(t, f, r);
if (deg(t) > 0) {
done = 0;
do {
GCD(v, r, t);
div(tmp1, t, v);
if (deg(tmp1) > 0) append(u, cons(tmp1, j*m));
if (deg(v) > 0) {
div(r, r, v);
t = v;
j++;
}
else
done = 1;
} while (!done);
if (deg(r) == 0) finished = 1;
}
if (!finished) {
/* r is a square */
long k, d;
d = deg(r)/2;
f.rep.SetLength(d+1);
for (k = 0; k <= d; k++)
IterSqr(f.rep[k], r.rep[k*2], GF2E::degree()-1);
m = m*2;
}
} while (!finished);
}
void ModComp(ZZX& res, const ZZX& g, const ZZX& h, const ZZX& f)
{
assert(LeadCoeff(f) == 1);
ZZX hh = h % f;
ZZX r = to_ZZX(0);
for (long i = deg(g); i >= 0; i--)
r = (r*hh + coeff(g, i)) % f;
res = r;
}
void NormMod(zz_p& x, const zz_pX& a, const zz_pX& f)
{
if (deg(f) <= 0 || deg(a) >= deg(f))
Error("norm: bad args");
if (IsZero(a)) {
clear(x);
return;
}
zz_p t;
resultant(t, f, a);
if (!IsOne(LeadCoeff(f))) {
zz_p t1;
power(t1, LeadCoeff(f), deg(a));
inv(t1, t1);
mul(t, t, t1);
}
x = t;
}
void PlainResultant(ZZ_p& rres, const ZZ_pX& a, const ZZ_pX& b)
{
ZZ_p res;
if (IsZero(a) || IsZero(b))
clear(res);
else if (deg(a) == 0 && deg(b) == 0)
set(res);
else {
long d0, d1, d2;
ZZ_p lc;
set(res);
long n = max(deg(a),deg(b)) + 1;
ZZ_pX u(INIT_SIZE, n), v(INIT_SIZE, n);
ZZVec tmp(n, ZZ_p::ExtendedModulusSize());
u = a;
v = b;
for (;;) {
d0 = deg(u);
d1 = deg(v);
lc = LeadCoeff(v);
PlainRem(u, u, v, tmp);
swap(u, v);
d2 = deg(v);
if (d2 >= 0) {
power(lc, lc, d0-d2);
mul(res, res, lc);
if (d0 & d1 & 1) negate(res, res);
}
else {
if (d1 == 0) {
power(lc, lc, d0);
mul(res, res, lc);
}
else
clear(res);
break;
}
}
}
rres = res;
}
unsigned long to_ulong(const zz_pX& x)
{
unsigned long u;
int i;
static zz_p c;
c = LeadCoeff(x);
static long p;
p = c.modulus();
for (u = 0, i = deg(x); i >= 0; i--) {
GetCoeff(c, x,i);
u = u * p + rep(c);
}
return u;
}
void ResHalfGCD(zz_pX& U, zz_pX& V, vec_zz_p& cvec, vec_long& dvec)
{
long d_red = (deg(U)+1)/2;
if (IsZero(V) || deg(V) <= deg(U) - d_red) {
return;
}
long du = deg(U);
long d1 = (d_red + 1)/2;
if (d1 < 1) d1 = 1;
if (d1 >= d_red) d1 = d_red - 1;
zz_pXMatrix M1;
ResHalfGCD(M1, U, V, d1, cvec, dvec);
mul(U, V, M1);
long d2 = deg(V) - du + d_red;
if (IsZero(V) || d2 <= 0) {
return;
}
M1(0,0).kill();
M1(0,1).kill();
M1(1,0).kill();
M1(1,1).kill();
zz_pX Q;
append(cvec, LeadCoeff(V));
append(dvec, dvec[dvec.length()-1]-deg(U)+deg(V));
DivRem(Q, U, U, V);
swap(U, V);
ResHalfGCD(M1, U, V, d2, cvec, dvec);
mul(U, V, M1);
}
void EDF(vec_ZZ_pEX& factors, const ZZ_pEX& ff, const ZZ_pEX& bb,
long d, long verbose)
{
ZZ_pEX f = ff;
ZZ_pEX b = bb;
if (!IsOne(LeadCoeff(f)))
LogicError("EDF: bad args");
long n = deg(f);
long r = n/d;
if (r == 0) {
factors.SetLength(0);
return;
}
if (r == 1) {
factors.SetLength(1);
factors[0] = f;
return;
}
if (d == 1) {
RootEDF(factors, f, verbose);
return;
}
double t;
if (verbose) {
cerr << "computing EDF(" << d << "," << r << ")...";
t = GetTime();
}
factors.SetLength(0);
RecEDF(factors, f, b, d, verbose);
if (verbose) cerr << (GetTime()-t) << "\n";
}
void GCDMinPolySeq(zz_pX& h, const vec_zz_p& x, long m)
{
long i;
zz_pX a, b;
zz_pXMatrix M;
zz_p t;
a.rep.SetLength(2*m);
for (i = 0; i < 2*m; i++) a.rep[i] = x[2*m-1-i];
a.normalize();
SetCoeff(b, 2*m);
HalfGCD(M, b, a, m+1);
/* make monic */
inv(t, LeadCoeff(M(1,1)));
mul(h, M(1,1), t);
}
void FindRoot(ZZ_pE& root, const ZZ_pEX& ff)
// finds a root of ff.
// assumes that ff is monic and splits into distinct linear factors
{
ZZ_pEXModulus F;
ZZ_pEX h, h1, f;
ZZ_pEX r;
f = ff;
if (!IsOne(LeadCoeff(f)))
LogicError("FindRoot: bad args");
if (deg(f) == 0)
LogicError("FindRoot: bad args");
while (deg(f) > 1) {
build(F, f);
random(r, deg(F));
if (IsOdd(ZZ_pE::cardinality())) {
PowerMod(h, r, RightShift(ZZ_pE::cardinality(), 1), F);
sub(h, h, 1);
}
else {
AbsTraceMap(h, r, F);
}
GCD(h, h, f);
if (deg(h) > 0 && deg(h) < deg(f)) {
if (deg(h) > deg(f)/2)
div(f, f, h);
else
f = h;
}
}
negate(root, ConstTerm(f));
}
void FindRoot(ZZ_p& root, const ZZ_pX& ff)
// finds a root of ff.
// assumes that ff is monic and splits into distinct linear factors
{
ZZ_pXModulus F;
ZZ_pX h, h1, f;
ZZ_p r;
ZZ p1;
f = ff;
if (!IsOne(LeadCoeff(f)))
Error("FindRoot: bad args");
if (deg(f) == 0)
Error("FindRoot: bad args");
RightShift(p1, ZZ_p::modulus(), 1);
h1 = 1;
while (deg(f) > 1) {
build(F, f);
random(r);
PowerXPlusAMod(h, r, p1, F);
sub(h, h, h1);
GCD(h, h, f);
if (deg(h) > 0 && deg(h) < deg(f)) {
if (deg(h) > deg(f)/2)
div(f, f, h);
else
f = h;
}
}
negate(root, ConstTerm(f));
}
void ResIterHalfGCD(ZZ_pXMatrix& M_out, ZZ_pX& U, ZZ_pX& V, long d_red,
vec_ZZ_p& cvec, vec_long& dvec)
{
M_out(0,0).SetMaxLength(d_red);
M_out(0,1).SetMaxLength(d_red);
M_out(1,0).SetMaxLength(d_red);
M_out(1,1).SetMaxLength(d_red);
set(M_out(0,0)); clear(M_out(0,1));
clear(M_out(1,0)); set(M_out(1,1));
long goal = deg(U) - d_red;
if (deg(V) <= goal)
return;
ZZVec tmp(deg(U)+1, ZZ_p::ExtendedModulusSize());
ZZ_pX Q, t(INIT_SIZE, d_red);
while (deg(V) > goal) {
append(cvec, LeadCoeff(V));
append(dvec, dvec[dvec.length()-1]-deg(U)+deg(V));
PlainDivRem(Q, U, U, V, tmp);
swap(U, V);
mul(t, Q, M_out(1,0));
sub(t, M_out(0,0), t);
M_out(0,0) = M_out(1,0);
M_out(1,0) = t;
mul(t, Q, M_out(1,1));
sub(t, M_out(0,1), t);
M_out(0,1) = M_out(1,1);
M_out(1,1) = t;
}
}
void divisor::update() {
bool_t OK = TRUE;
// Check curve's validity
OK = OK && s_hcurve.is_valid_curve();
/* Check if [u, v] belongs to Jacobian of genus 2 curve
It is so if
(1) u is monic
(2) deg(v) < deg(u) <= genus = 2
(3) u | v^2 + v*h - f
*/
OK = OK && IsOne( LeadCoeff(upoly) ); // (1)
OK = OK && ( deg(upoly) <= genus ) && ( deg(vpoly) < deg(upoly) ); // (2)
OK = OK && IsZero(( vpoly*(vpoly + s_hcurve.get_h())
- s_hcurve.get_f() ) % upoly ); // (3)
// Set is_valid flag
is_valid = OK;
}
void SFBerlekamp(vec_ZZ_pX& factors, const ZZ_pX& ff, long verbose)
{
ZZ_pX f = ff;
if (!IsOne(LeadCoeff(f)))
Error("SFBerlekamp: bad args");
if (deg(f) == 0) {
factors.SetLength(0);
return;
}
if (deg(f) == 1) {
factors.SetLength(1);
factors[0] = f;
return;
}
double t;
const ZZ& p = ZZ_p::modulus();
long n = deg(f);
ZZ_pXModulus F;
build(F, f);
ZZ_pX g, h;
if (verbose) { cerr << "computing X^p..."; t = GetTime(); }
PowerXMod(g, p, F);
if (verbose) { cerr << (GetTime()-t) << "\n"; }
vec_long D;
long r;
vec_ZZVec M;
if (verbose) { cerr << "building matrix..."; t = GetTime(); }
BuildMatrix(M, n, g, F, verbose);
if (verbose) { cerr << (GetTime()-t) << "\n"; }
if (verbose) { cerr << "diagonalizing..."; t = GetTime(); }
NullSpace(r, D, M, verbose);
if (verbose) { cerr << (GetTime()-t) << "\n"; }
if (verbose) cerr << "number of factors = " << r << "\n";
if (r == 1) {
factors.SetLength(1);
factors[0] = f;
return;
}
if (verbose) { cerr << "factor extraction..."; t = GetTime(); }
vec_ZZ_p roots;
RandomBasisElt(g, D, M);
MinPolyMod(h, g, F, r);
if (deg(h) == r) M.kill();
FindRoots(roots, h);
FindFactors(factors, f, g, roots);
ZZ_pX g1;
vec_ZZ_pX S, S1;
long i;
while (factors.length() < r) {
if (verbose) cerr << "+";
RandomBasisElt(g, D, M);
S.kill();
for (i = 0; i < factors.length(); i++) {
const ZZ_pX& f = factors[i];
if (deg(f) == 1) {
append(S, f);
continue;
}
build(F, f);
rem(g1, g, F);
if (deg(g1) <= 0) {
append(S, f);
continue;
}
MinPolyMod(h, g1, F, min(deg(f), r-factors.length()+1));
FindRoots(roots, h);
S1.kill();
FindFactors(S1, f, g1, roots);
append(S, S1);
}
swap(factors, S);
}
if (verbose) { cerr << (GetTime()-t) << "\n"; }
if (verbose) {
cerr << "degrees:";
long i;
for (i = 0; i < factors.length(); i++)
cerr << " " << deg(factors[i]);
cerr << "\n";
}
}
// Note: poly is passed by value, not by reference, so the calling routine
// keeps its original polynomial
long evalPolyTopLevel(ZZX poly, long x, long p, long k=0)
{
if (verbose)
cerr << "\n* evalPolyTopLevel: p="<<p<<", x="<<x<<", poly="<<poly;
if (deg(poly)<=2) { // nothing to optimize here
if (deg(poly)<1) return to_long(coeff(poly, 0));
DynamicPtxtPowers babyStep(x, p, deg(poly));
long ret = simplePolyEval(poly, babyStep, p);
totalDepth = babyStep.getDepth(deg(poly));
return ret;
}
// How many baby steps: set k~sqrt(n/2), rounded up/down to a power of two
// FIXME: There may be some room for optimization here: it may be possible
// to choose k as something other than a power of two and still maintain
// optimal depth, in principle we can try all possible values of k between
// the two powers of two and choose the one that goves the least number
// of multiplies, conditioned on minimum depth.
if (k<=0) {
long kk = (long) sqrt(deg(poly)/2.0);
k = 1L << NextPowerOfTwo(kk);
// heuristic: if k>>kk then use a smaler power of two
if ((k==16 && deg(poly)>167) || (k>16 && k>(1.44*kk)))
k /= 2;
}
cerr << ", k="<<k;
long n = divc(deg(poly),k); // deg(p) = k*n +delta
if (verbose) cerr << ", n="<<n<<endl;
DynamicPtxtPowers babyStep(x, p, k);
long x2k = babyStep.getPower(k);
// Special case when deg(p)>k*(2^e -1)
if (n==(1L << NextPowerOfTwo(n))) { // n is a power of two
DynamicPtxtPowers giantStep(x2k, p, n/2, babyStep.getDepth(k));
if (verbose)
cerr << "babyStep="<<babyStep<<", giantStep="<<giantStep<<endl;
long ret = degPowerOfTwo(poly, k, babyStep, giantStep, p, totalDepth);
if (verbose) {
cerr << " degPowerOfTwo("<<poly<<") returns "<<ret<<", depth="<<totalDepth<<endl;
if (ret != polyEvalMod(poly,babyStep[0], p)) {
cerr << " ## recursive call failed, ret="<<ret<<"!="
<< polyEvalMod(poly,babyStep[0], p)<<endl;
exit(0);
}
// cerr << " babyStep depth=[";
// for (long i=0; i<babyStep.size(); i++)
// cerr << babyStep.getDepth(i+1)<<" ";
// cerr << "]\n";
// cerr << " giantStep depth=[";
// for (long i=0; i<giantStep.size(); i++)
// cerr<<giantStep.getDepth(i+1)<<" ";
// cerr << "]\n";
}
return ret;
}
// If n is not a power of two, ensure that poly is monic and that
// its degree is divisible by k, then call the recursive procedure
ZZ topInv; // the inverse mod p of the top coefficient of poly (if any)
bool divisible = (n*k == deg(poly)); // is the degree divisible by k?
long nonInvertibe = InvModStatus(topInv, LeadCoeff(poly), to_ZZ(p));
// 0 if invertible, 1 if not
// FIXME: There may be some room for optimization below: instead of
// adding a term X^{n*k} we can add X^{n'*k} for some n'>n, so long
// as n' is smaller than the next power of two. We could save a few
// multiplications since giantStep[n'] may be easier to compute than
// giantStep[n] when n' has fewer 1's than n in its binary expansion.
long extra = 0; // extra!=0 denotes an added term extra*X^{n*k}
if (!divisible || nonInvertibe) { // need to add a term
// set extra = 1 - current-coeff-of-X^{n*k}
extra = SubMod(1, to_long(coeff(poly,n*k)), p);
SetCoeff(poly, n*k); // set the top coefficient of X^{n*k} to one
topInv = to_ZZ(1); // inverse of new top coefficient is one
}
long t = (extra==0)? divc(n,2) : n;
DynamicPtxtPowers giantStep(x2k, p, t, babyStep.getDepth(k));
if (verbose)
cerr << "babyStep="<<babyStep<<", giantStep="<<giantStep<<endl;
long y; // the value to return
long subDepth1 =0;
if (!IsOne(topInv)) {
long top = to_long(poly[n*k]); // record the current top coefficient
// cerr << ", top-coeff="<<top;
// Multiply by topInv modulo p to make into a monic polynomial
poly *= topInv;
for (long i=0; i<=n*k; i++) rem(poly[i], poly[i], to_ZZ(p));
poly.normalize();
y = recursivePolyEval(poly, k, babyStep, giantStep, p, subDepth1);
if (verbose) {
cerr << " recursivePolyEval("<<poly<<") returns "<<y<<", depth="<<subDepth1<<endl;
if (y != polyEvalMod(poly,babyStep[0], p)) {
cerr << "## recursive call failed, ret="<<y<<"!="
<< polyEvalMod(poly,babyStep[0], p)<<endl;
exit(0);
}
}
y = MulMod(y, top, p); // multiply by the original top coefficient
}
else {
y = recursivePolyEval(poly, k, babyStep, giantStep, p, subDepth1);
if (verbose) {
cerr << " recursivePolyEval("<<poly<<") returns "<<y<<", depth="<<subDepth1<<endl;
if (y != polyEvalMod(poly,babyStep[0], p)) {
cerr << "## recursive call failed, ret="<<y<<"!="
<< polyEvalMod(poly,babyStep[0], p)<<endl;
exit(0);
}
}
}
if (extra != 0) { // if we added a term, now is the time to subtract back
if (verbose) cerr << ", subtracting "<<extra<<"*X^"<<k*n;
extra = MulMod(extra, giantStep.getPower(n), p);
totalDepth = max(subDepth1, giantStep.getDepth(n));
y = SubMod(y, extra, p);
}
else totalDepth = subDepth1;
if (verbose) cerr << endl;
return y;
}
void DDF(vec_pair_ZZ_pX_long& factors, const ZZ_pX& ff, const ZZ_pX& hh,
long verbose)
{
ZZ_pX f = ff;
ZZ_pX h = hh;
if (!IsOne(LeadCoeff(f)))
Error("DDF: bad args");
factors.SetLength(0);
if (deg(f) == 0)
return;
if (deg(f) == 1) {
AddFactor(factors, f, 1, verbose);
return;
}
long CompTableSize = 2*SqrRoot(deg(f));
long GCDTableSize = ZZ_pX_BlockingFactor;
ZZ_pXModulus F;
build(F, f);
ZZ_pXArgument H;
build(H, h, F, min(CompTableSize, deg(f)));
long i, d, limit, old_n;
ZZ_pX g, X;
vec_ZZ_pX tbl(INIT_SIZE, GCDTableSize);
SetX(X);
i = 0;
g = h;
d = 1;
limit = GCDTableSize;
while (2*d <= deg(f)) {
old_n = deg(f);
sub(tbl[i], g, X);
i++;
if (i == limit) {
ProcessTable(f, factors, F, i, tbl, d, verbose);
i = 0;
}
d = d + 1;
if (2*d <= deg(f)) {
// we need to go further
if (deg(f) < old_n) {
// f has changed
build(F, f);
rem(h, h, f);
rem(g, g, f);
build(H, h, F, min(CompTableSize, deg(f)));
}
CompMod(g, g, H, F);
}
}
ProcessTable(f, factors, F, i, tbl, d-1, verbose);
if (!IsOne(f)) AddFactor(factors, f, deg(f), verbose);
}
void resultant(zz_p& rres, const zz_pX& u, const zz_pX& v)
{
if (deg(u) <= NTL_zz_pX_GCD_CROSSOVER || deg(v) <= NTL_zz_pX_GCD_CROSSOVER) {
PlainResultant(rres, u, v);
return;
}
zz_pX u1, v1;
u1 = u;
v1 = v;
zz_p res, t;
set(res);
if (deg(u1) == deg(v1)) {
rem(u1, u1, v1);
swap(u1, v1);
if (IsZero(v1)) {
clear(rres);
return;
}
power(t, LeadCoeff(u1), deg(u1) - deg(v1));
mul(res, res, t);
if (deg(u1) & 1)
negate(res, res);
}
else if (deg(u1) < deg(v1)) {
swap(u1, v1);
if (deg(u1) & deg(v1) & 1)
negate(res, res);
}
// deg(u1) > deg(v1) && v1 != 0
vec_zz_p cvec;
vec_long dvec;
cvec.SetMaxLength(deg(v1)+2);
dvec.SetMaxLength(deg(v1)+2);
append(cvec, LeadCoeff(u1));
append(dvec, deg(u1));
while (deg(u1) > NTL_zz_pX_GCD_CROSSOVER && !IsZero(v1)) {
ResHalfGCD(u1, v1, cvec, dvec);
if (!IsZero(v1)) {
append(cvec, LeadCoeff(v1));
append(dvec, deg(v1));
rem(u1, u1, v1);
swap(u1, v1);
}
}
if (IsZero(v1) && deg(u1) > 0) {
clear(rres);
return;
}
long i, l;
l = dvec.length();
if (deg(u1) == 0) {
// we went all the way...
for (i = 0; i <= l-3; i++) {
power(t, cvec[i+1], dvec[i]-dvec[i+2]);
mul(res, res, t);
if (dvec[i] & dvec[i+1] & 1)
negate(res, res);
}
power(t, cvec[l-1], dvec[l-2]);
mul(res, res, t);
}
else {
for (i = 0; i <= l-3; i++) {
power(t, cvec[i+1], dvec[i]-dvec[i+2]);
mul(res, res, t);
if (dvec[i] & dvec[i+1] & 1)
negate(res, res);
}
power(t, cvec[l-1], dvec[l-2]-deg(v1));
mul(res, res, t);
if (dvec[l-2] & dvec[l-1] & 1)
negate(res, res);
PlainResultant(t, u1, v1);
mul(res, res, t);
}
rres = res;
}
NTL_START_IMPL
void CharPolyMod(ZZX& gg, const ZZX& a, const ZZX& f, long deterministic)
{
if (!IsOne(LeadCoeff(f)) || deg(f) < 1 || deg(a) >= deg(f))
Error("CharPolyMod: bad args");
if (IsZero(a)) {
clear(gg);
SetCoeff(gg, deg(f));
return;
}
long bound = 2 + CharPolyBound(a, f);
long gp_cnt = 0;
zz_pBak bak;
bak.save();
ZZ_pBak bak1;
bak1.save();
ZZX g;
ZZ prod;
clear(g);
set(prod);
long i;
long instable = 1;
for (i = 0; ; i++) {
if (NumBits(prod) > bound)
break;
if (!deterministic &&
!instable && bound > 1000 && NumBits(prod) < 0.25*bound) {
long plen = 90 + NumBits(max(bound, MaxBits(g)));
ZZ P;
GenPrime(P, plen, 90 + 2*NumBits(gp_cnt++));
ZZ_p::init(P);
ZZ_pX G, A, F;
conv(A, a);
conv(F, f);
CharPolyMod(G, A, F);
if (CRT(g, prod, G))
instable = 1;
else
break;
}
zz_p::FFTInit(i);
zz_pX G, A, F;
conv(A, a);
conv(F, f);
CharPolyMod(G, A, F);
instable = CRT(g, prod, G);
}
gg = g;
bak.restore();
bak1.restore();
}
void ResHalfGCD(zz_pXMatrix& M_out, const zz_pX& U, const zz_pX& V, long d_red,
vec_zz_p& cvec, vec_long& dvec)
{
if (IsZero(V) || deg(V) <= deg(U) - d_red) {
set(M_out(0,0)); clear(M_out(0,1));
clear(M_out(1,0)); set(M_out(1,1));
return;
}
long n = deg(U) - 2*d_red + 2;
if (n < 0) n = 0;
zz_pX U1, V1;
RightShift(U1, U, n);
RightShift(V1, V, n);
if (d_red <= NTL_zz_pX_HalfGCD_CROSSOVER) {
ResIterHalfGCD(M_out, U1, V1, d_red, cvec, dvec);
return;
}
long d1 = (d_red + 1)/2;
if (d1 < 1) d1 = 1;
if (d1 >= d_red) d1 = d_red - 1;
zz_pXMatrix M1;
ResHalfGCD(M1, U1, V1, d1, cvec, dvec);
mul(U1, V1, M1);
long d2 = deg(V1) - deg(U) + n + d_red;
if (IsZero(V1) || d2 <= 0) {
M_out = M1;
return;
}
zz_pX Q;
zz_pXMatrix M2;
append(cvec, LeadCoeff(V1));
append(dvec, dvec[dvec.length()-1]-deg(U1)+deg(V1));
DivRem(Q, U1, U1, V1);
swap(U1, V1);
ResHalfGCD(M2, U1, V1, d2, cvec, dvec);
zz_pX t(INIT_SIZE, deg(M1(1,1))+deg(Q)+1);
mul(t, Q, M1(1,0));
sub(t, M1(0,0), t);
swap(M1(0,0), M1(1,0));
swap(M1(1,0), t);
t.kill();
t.SetMaxLength(deg(M1(1,1))+deg(Q)+1);
mul(t, Q, M1(1,1));
sub(t, M1(0,1), t);
swap(M1(0,1), M1(1,1));
swap(M1(1,1), t);
t.kill();
mul(M_out, M2, M1);
}
// Main entry point: Evaluate a cleartext polynomial on an encrypted input
void polyEval(Ctxt& ret, ZZX poly, const Ctxt& x, long k)
// Note: poly is passed by value, so caller keeps the original
{
if (deg(poly)<=2) { // nothing to optimize here
if (deg(poly)<1) { // A constant
ret.clear();
ret.addConstant(coeff(poly, 0));
} else { // A linear or quadratic polynomial
DynamicCtxtPowers babyStep(x, deg(poly));
simplePolyEval(ret, poly, babyStep);
}
return;
}
// How many baby steps: set k~sqrt(n/2), rounded up/down to a power of two
// FIXME: There may be some room for optimization here: it may be possible
// to choose k as something other than a power of two and still maintain
// optimal depth, in principle we can try all possible values of k between
// two consecutive powers of two and choose the one that gives the least
// number of multiplies, conditioned on minimum depth.
if (k<=0) {
long kk = (long) sqrt(deg(poly)/2.0);
k = 1L << NextPowerOfTwo(kk);
// heuristic: if k>>kk then use a smaler power of two
if ((k==16 && deg(poly)>167) || (k>16 && k>(1.44*kk)))
k /= 2;
}
#ifdef DEBUG_PRINTOUT
cerr << " k="<<k;
#endif
long n = divc(deg(poly),k); // n = ceil(deg(p)/k), deg(p) >= k*n
DynamicCtxtPowers babyStep(x, k);
const Ctxt& x2k = babyStep.getPower(k);
// Special case when deg(p)>k*(2^e -1)
if (n==(1L << NextPowerOfTwo(n))) { // n is a power of two
DynamicCtxtPowers giantStep(x2k, n/2);
degPowerOfTwo(ret, poly, k, babyStep, giantStep);
return;
}
// If n is not a power of two, ensure that poly is monic and that
// its degree is divisible by k, then call the recursive procedure
const ZZ p = to_ZZ(x.getPtxtSpace());
ZZ top = LeadCoeff(poly);
ZZ topInv; // the inverse mod p of the top coefficient of poly (if any)
bool divisible = (n*k == deg(poly)); // is the degree divisible by k?
long nonInvertibe = InvModStatus(topInv, top, p);
// 0 if invertible, 1 if not
// FIXME: There may be some room for optimization below: instead of
// adding a term X^{n*k} we can add X^{n'*k} for some n'>n, so long
// as n' is smaller than the next power of two. We could save a few
// multiplications since giantStep[n'] may be easier to compute than
// giantStep[n] when n' has fewer 1's than n in its binary expansion.
ZZ extra = ZZ::zero(); // extra!=0 denotes an added term extra*X^{n*k}
if (!divisible || nonInvertibe) { // need to add a term
top = to_ZZ(1); // new top coefficient is one
topInv = top; // also the new inverse is one
// set extra = 1 - current-coeff-of-X^{n*k}
extra = SubMod(top, coeff(poly,n*k), p);
SetCoeff(poly, n*k); // set the top coefficient of X^{n*k} to one
}
long t = IsZero(extra)? divc(n,2) : n;
DynamicCtxtPowers giantStep(x2k, t);
if (!IsOne(top)) {
poly *= topInv; // Multiply by topInv to make into a monic polynomial
for (long i=0; i<=n*k; i++) rem(poly[i], poly[i], p);
poly.normalize();
}
recursivePolyEval(ret, poly, k, babyStep, giantStep);
if (!IsOne(top)) {
ret.multByConstant(top);
}
if (!IsZero(extra)) { // if we added a term, now is the time to subtract back
Ctxt topTerm = giantStep.getPower(n);
topTerm.multByConstant(extra);
ret -= topTerm;
}
}
static CYTHON_INLINE int ZZX_is_monic(struct ZZX* x)
{
return IsOne(LeadCoeff(*x));
}
void PAlgebraModDerived<type>::mapToSlots(MappingData<type>& mappingData, const RX& G) const
{
assert(deg(G) > 0 && zMStar.getOrdP() % deg(G) == 0);
assert(LeadCoeff(G) == 1);
mappingData.G = G;
mappingData.degG = deg(mappingData.G);
long nSlots = zMStar.getNSlots();
long m = zMStar.getM();
mappingData.maps.resize(nSlots);
mapToF1(mappingData.maps[0],mappingData.G); // mapping from base-G to base-F1
for (long i=1; i<nSlots; i++)
mapToFt(mappingData.maps[i], mappingData.G, zMStar.ith_rep(i), &(mappingData.maps[0]));
REBak bak; bak.save();
RE::init(mappingData.G);
mappingData.contextForG.save();
if (deg(mappingData.G)==1) return;
mappingData.rmaps.resize(nSlots);
if (G == factors[0]) {
// an important special case
for (long i = 0; i < nSlots; i++) {
long t = zMStar.ith_rep(i);
long tInv = InvMod(t, m);
RX ct_rep;
PowerXMod(ct_rep, tInv, G);
RE ct;
conv(ct, ct_rep);
REX Qi;
SetCoeff(Qi, 1, 1);
SetCoeff(Qi, 0, -ct);
mappingData.rmaps[i] = Qi;
}
}
else
{
// the general case: currently only works when r == 1
assert(r == 1);
vec_REX FRts;
for (long i=0; i<nSlots; i++) {
// We need to lift Fi from R[Y] to (R[X]/G(X))[Y]
REX Qi;
long t, tInv=0;
if (i == 0) {
conv(Qi,factors[i]);
FRts=EDF(Qi, FrobeniusMap(Qi), deg(Qi)/deg(G));
// factor Fi over GF(p)[X]/G(X)
}
else {
t = zMStar.ith_rep(i);
tInv = InvMod(t, m);
}
// need to choose the right factor, the one that gives us back X
long j;
for (j=0; j<FRts.length(); j++) {
// lift maps[i] to (R[X]/G(X))[Y] and reduce mod j'th factor of Fi
REX FRtsj;
if (i == 0)
FRtsj = FRts[j];
else {
REX X2tInv = PowerXMod(tInv, FRts[j]);
IrredPolyMod(FRtsj, X2tInv, FRts[j]);
}
// FRtsj is the jth factor of factors[i] over the extension field.
// For j > 0, we save some time by computing it from the jth factor
// of factors[0] via a minimal polynomial computation.
REX GRti;
conv(GRti, mappingData.maps[i]);
GRti %= FRtsj;
if (IsX(rep(ConstTerm(GRti)))) { // is GRti == X?
Qi = FRtsj; // If so, we found the right factor
break;
} // If this does not happen then move to the next factor of Fi
}
assert(j < FRts.length());
mappingData.rmaps[i] = Qi;
}
}
}
void SFCanZass(vec_ZZ_pEX& factors, const ZZ_pEX& ff, long verbose)
{
ZZ_pEX f = ff;
if (!IsOne(LeadCoeff(f)))
LogicError("SFCanZass: bad args");
if (deg(f) == 0) {
factors.SetLength(0);
return;
}
if (deg(f) == 1) {
factors.SetLength(1);
factors[0] = f;
return;
}
factors.SetLength(0);
double t;
ZZ_pEXModulus F;
build(F, f);
ZZ_pEX h;
if (verbose) { cerr << "computing X^p..."; t = GetTime(); }
FrobeniusMap(h, F);
if (verbose) { cerr << (GetTime()-t) << "\n"; }
vec_pair_ZZ_pEX_long u;
if (verbose) { cerr << "computing DDF..."; t = GetTime(); }
NewDDF(u, f, h, verbose);
if (verbose) {
t = GetTime()-t;
cerr << "DDF time: " << t << "\n";
}
ZZ_pEX hh;
vec_ZZ_pEX v;
long i;
for (i = 0; i < u.length(); i++) {
const ZZ_pEX& g = u[i].a;
long d = u[i].b;
long r = deg(g)/d;
if (r == 1) {
// g is already irreducible
append(factors, g);
}
else {
// must perform EDF
if (d == 1) {
// root finding
RootEDF(v, g, verbose);
append(factors, v);
}
else {
// general case
rem(hh, h, g);
EDF(v, g, hh, d, verbose);
append(factors, v);
}
}
}
}
long IsX(const ZZX& a)
{
return deg(a) == 1 && IsOne(LeadCoeff(a)) && IsZero(ConstTerm(a));
}
