Large matrix, small rank

Krylov-based algorithms have recently been used (alone, or in combination with other methods) in order to solve systems of linear equations that arise during integer factorization and discrete logarithm computations. Since these include systems over small finite fields, the behaviour of these algorithms in this setting is of interest.Unfortunately, the application of these methods is complicated by the possibility of several kinds of breakdown. Orthogonal vectors can arise when a variant of the Lanczos algorithm is used to generate a basis, and zero-discrepancies can arise during the computation of minimal polynomials of linearly recurrent sequences when Wiedemann's algorithm is applied.Several years ago, Austin Lobo reported experimental evidence that zero-discrepancies are extremely unlikely when a randomized version of Wiedemann's algorithm is applied to solve systems over large fields. With high probability, results are correct if a computation is terminated as soon as such a sequence is detected. Early has consequently been included in recent implementations.In this paper, we analyze the probability of long sequences of zero-discrepancies during computations of minimal polynomials of the linearly recurrent sequences that arise when simple Krylov-based algorithms are used to solve systems over very small finite fields. Variations of these algorithms that incorporate early termination are briefly presented and analyzed in the small field case.

Suppose a distributed storage system containing <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">M</i> files is replicated across <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> servers, and a user wants to privately retrieve one file by accessing the servers such that the identity of the retrieved file is kept secret from any subset of up to <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i> servers, where each file can be viewed as a vector over the <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">q</i>-ary finite field Fq. A scheme designed for this purpose is called a <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i>-private information retrieval (T-PIR) scheme. We consider the problem of explicitly constructing capacity-achieving <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i>-PIR schemes over small finite fields. In this paper, we first provide a general framework for constructing explicit capacity-achieving <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i>-PIR schemes for all parameters, which only relies on an MDS array matrix with a special information set. To construct such an MDS array matrix, we propose a new family of matrices over finite fields, called the generalized minor matrices of the Moore matrix, and establish a series of key identities. By combining favourable properties of generalized minor matrices with our framework, we construct an explicit capacityachieving <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i>-PIR scheme with optimal sub-packetization over the field Fq, as small as possible, for three classes of parameters <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N, T,M</i> ≥ 3. Specifically, the first class of construction works for all <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> = <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">d</i>(2<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">t</i> − 1), <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i> = <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">dt</i>, and the field size <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">q</i> is the least prime power satisfying <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">q^t−1</i> ≥ <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i>. Moreover, this construction generalizes the scheme proposed by Xu and Wang in 2022, which only considers the case of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> = <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">d</i>(2<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">t</i>−1), <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i> = dt with 2<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">^t−1</i> ≥ <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i>. For all <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> = <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">d</i>(2<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">t</i> + 1), <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i> = dt, our second <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i>-PIR scheme is the first explicit construction, and the field size <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">q</i> is the least prime power satisfying <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">q^t</i> ≥ <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i>, which is the smallest field size among all known explicit capacity-achieving <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i>-PIR schemes. Particularly, when 2<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">^t</i> ≥ <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i>, the field size of such constructions can be reduced to 2. In the case of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">N</i> = 4<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">s</i> and <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i> = 2<italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">s</i> + 1, our scheme is the first one to reduce the field size to <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">q</i> = 2. Compared with all known explicitly capacity-achieving <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">T</i>-PIR schemes, the required field of our schemes has the smallest size.

We propose an efficient Adaptive Random Convolutional Network Coding (ARCNC)\nalgorithm to address the issue of field size in random network coding. ARCNC\noperates as a convolutional code, with the coefficients of local encoding\nkernels chosen randomly over a small finite field. The lengths of local\nencoding kernels increase with time until the global encoding kernel matrices\nat related sink nodes all have full rank. Instead of estimating the necessary\nfield size a priori, ARCNC operates in a small finite field. It adapts to\nunknown network topologies without prior knowledge, by locally incrementing the\ndimensionality of the convolutional code. Because convolutional codes of\ndifferent constraint lengths can coexist in different portions of the network,\nreductions in decoding delay and memory overheads can be achieved with ARCNC.\nWe show through analysis that this method performs no worse than random linear\nnetwork codes in general networks, and can provide significant gains in terms\nof average decoding delay in combination networks.\n

Dense matrix-matrix multiplication over small finite fields is a common operation in many application domains, such as cryptography, random numbers, and error correcting codes. This paper shows that FPGAs have the potential to greatly accelerate this time consuming operation, and in particular that systolic array based approaches are both practical and efficient when using large modern devices. A number of finite-field specific architectural optimisations are introduced, allowing n×n matrices to be processed in O(n) cycles, for matrix sizes up to n=350. Comparison with optimised software implementations on a single-core CPU shows that an FPGA accelerator can achieve between 80x and 700x speed-up over a Virtex-7 XC7V200T for GF(2k), but for GF(3) and larger finite fields can provide practical speed-ups of 1000x or more.

Multipoint evaluation is the computational task of evaluating a polynomial given as a list of coefficients at a given set of inputs. Besides being a natural and fundamental question in computer algebra on its own, fast algorithms for this problem are also closely related to fast algorithms for other natural algebraic questions such as polynomial factorization and modular composition. And while nearly linear time algorithms have been known for the univariate instance of multipoint evaluation for close to five decades due to a work of Borodin and Moenck [ 7 ], fast algorithms for the multivariate version have been much harder to come by. In a significant improvement to the state-of-the-art for this problem, Umans [ 25 ] and Kedlaya &amp; Umans [ 16 ] gave nearly linear time algorithms for this problem over field of small characteristic and over all finite fields, respectively, provided that the number of variables n is at most \(d^{o(1)}\) where the degree of the input polynomial in every variable is less than d . They also stated the question of designing fast algorithms for the large variable case (i.e., \(n \notin d^{o(1)}\) ) as an open problem. In this work, we show that there is a deterministic algorithm for multivariate multipoint evaluation over a field \(\mathbb {F}_{q}\) of characteristic p , which evaluates an n -variate polynomial of degree less than d in each variable on N inputs in time \(\begin{equation*} \left((N + d^n)^{1 + o(1)}\text{poly}(\log q, d, n, p)\right), \end{equation*}\) provided that p is at most d o (1) , and q is at most (exp (exp (exp (...(exp ( d ))))), where the height of this tower of exponentials is fixed. When the number of variables is large (e.g., n ∉ d o (1) ), this is the first nearly linear time algorithm for this problem over any (large enough) field. Our algorithm is based on elementary algebraic ideas, and this algebraic structure naturally leads to the following two independently interesting applications: — We show that there is an algebraic data structure for univariate polynomial evaluation with nearly linear space complexity and sublinear time complexity over finite fields of small characteristic and quasipolynomially bounded size. This provides a counterexample to a conjecture of Miltersen [ 21 ] who conjectured that over small finite fields, any algebraic data structure for polynomial evaluation using polynomial space must have linear query complexity. — We also show that over finite fields of small characteristic and quasipolynomially bounded size, Vandermonde matrices are not rigid enough to yield size-depth tradeoffs for linear circuits via the current quantitative bounds in Valiant’s program [ 26 ]. More precisely, for every fixed prime p , we show that for every constant ɛ &gt; 0, and large enough n , the rank of any \(n \times n\) Vandermonde matrix V over the field \(\mathbb {F}_{p^a}\) can be reduced to ( n /exp (Ω (poly(ɛ)log 0.53 n ))) by changing at most n Θ (ɛ) entries in every row of V , provided a ≤ poly(log n ). Prior to this work, similar upper bounds on rigidity were known only for special Vandermonde matrices. For instance, the Discrete Fourier Transform matrices and Vandermonde matrices with generators in a geometric progression [ 9 ].

We consider the problem of establishing reliable unicast connections across a communication network with nonuniform edge capacities. Our goal is to provide instantaneous recovery from single edge failures. With instantaneous recovery, the destination node can decode the packets sent by the source node even if one of the network edges fails, without the need of retransmission or rerouting. It has been recognized that the network coding technique offers significant advantages for this problem over standard solutions such as disjoint path routing and diversity coding. We focus on two cases of practical interest: 1) backup protection of a single flow that can be split into two subflows; and 2) shared backup protection of two unicast flows. We present an efficient network coding algorithm that operates over a small finite field (GF(2)). The small size of the underlying field results in a significant reduction in the computational and communication overhead associated with the practical implementation of the network coding technique. Our algorithm exploits the unique structure of minimum coding networks, i.e., networks that do not contain redundant edges. We also consider the related capacity reservation problem and present an approximation algorithm that finds a solution whose cost is at most two times more than the optimum.

Fast asymmetric encryption and decryption of SimpleMatrix scheme for Internet of Things

For prime powers q &gt; 100 q&gt;100 , we compute new upper and lower bounds on N q ( 4 ) N_q(4) , the maximal number of points on a genus- 4 4 curve over a finite field with q q elements. We determine the exact value of N q ( 4 ) N_q(4) for 17 17 prime powers q q for which the value was previously unknown.

We present a new deterministic factorization algorithm for polynomials over a finite prime fieldF p . As in other factorization algorithms for polynomials over finite fields such as the Berlekamp algorithm, the key step is the “linearization” of the factorization problem, i.e., the reduction of the problem to a system of linear equations. The theoretical justification for our algorithm is based on a study of the differential equationy (p −1)+y p =0 of orderp−1 in the rational function fieldF p(x). In the casep=2 the new algorithm is more efficient than the Berlekamp algorithm since there is no set-up cost for the coefficient matrix of the system of linear equations.

In a surprising recent result, Gupta et al. [GKKS13b] have proved that over ℚ any n O(1)-variate and n-degree polynomial in VP can also be computed by a depth three ∑ ∏ ∑ circuit of size \(2^{O(\sqrt{n} \log^{3/2}n)}\) . Over fixed-size finite fields, Grigoriev and Karpinski proved that any ∑ ∏ ∑ circuit that computes the determinant (or the permanent) polynomial of a n×n matrix must be of size 2Ω(n). In this paper, for an explicit polynomial in VP (over fixed-size finite fields), we prove that any ∑ ∏ ∑ circuit computing it must be of size 2Ω(nlogn). The explicit polynomial that we consider is the iterated matrix multiplication polynomial of n generic matrices of size n×n. The importance of this result is that over fixed-size fields there is no depth reduction technique that can be used to compute all the n O(1)-variate and n-degree polynomials in VP by depth 3 circuits of size 2 o(nlogn). The result of [GK98] can only rule out such a possibility for ∑ ∏ ∑ circuits of size 2 o(n).We also give an example of an explicit polynomial (NW n,ε (X)) in VNP (which is not known to be in VP), for which any ∑ ∏ ∑ circuit computing it (over fixed-size fields) must be of size 2Ω(nlogn). The polynomial we consider is constructed from the combinatorial design of Nisan and Wigderson [NW94], and is closely related to the polynomials considered in many recent papers where strong depth 4 circuit size lower bounds were shown [KSS13,KLSS14,KS13b,KS14].

We determine all permutation polynomials over of the form where, for some that is a power of the characteristic of , we have and all terms of have degrees in . We use this classification to resolve eight conjectures and open problems from the literature, and we list 77 recent results from the literature that follow immediately from the simplest special cases of our result. Our proof makes a novel use of geometric techniques in a situation where they previously did not seem applicable, namely to understand the arithmetic of high‐degree rational functions over small finite fields, despite the fact that in this situation the Weil bounds do not provide useful information.

The authors design the first polynomial time (for an arbitrary and fixed field GF(q)) ( in , delta )-approximation algorithm for the number of zeros of arbitrary polynomial f(x/sub 1/. . . x/sub n/) over GF(q). It gives the first efficient method for estimating the number of zeros and nonzeros of multivariate polynomials over small finite fields other than GF(2) (like GF(3)), the case important for various circuit approximation techniques. The algorithm is based on the estimation of the number of zeros of an arbitrary polynomial f(x/sub 1/. . .,x/sub n/) over GF(q) in the function of the number m of its terms. The bounding ratio is proved to be m/sup (q-1)/log/sup q/. >

We present an algorithm to compute a full set of irreducible representations of a supersolvable group G G over a finite field K K , char ⁡ K ∤ | G | \operatorname {char} K\nmid |G| , which is not assumed to be a splitting field of G G . The main subroutines of our algorithm are a modification of the algorithm of Baum and Clausen (Math. Comp. 63 (1994), 351–359) to obtain information on algebraically conjugate representations, and an effective version of Speiser’s generalization of Hilbert’s Theorem 90 stating that H 1 ( Gal ⁡ ( L / K ) , GL ⁡ ( n , L ) ) H^{1}(\operatorname {Gal}(L/K), \operatorname {GL}(n,L)) vanishes for all n ≥ 1 n\ge 1 .

Let E be an elliptic curve defined over a small finite field Fq, and let p be a prime number. We give a conjectural formula for the probabil ity that the order of the quotient group E(Fqp )/E(Fq) is prime, and compare it with experimental data. The motivation for this study comes from public key cryptography.

Succinct non-interactive arguments (SNARGs) enable verifying \({{\mathsf {NP}}}\) computations with substantially lower complexity than that required for classical \({{\mathsf {NP}}}\) verification. In this work, we give the first lattice-based SNARG candidate with quasi-optimal succinctness (where the argument size is quasilinear in the security parameter). Further extension of our methods yields the first SNARG (from any assumption) that is quasi-optimal in terms of both prover overhead (polylogarithmic in the security parameter) as well as succinctness. Moreover, because our constructions are lattice-based, they plausibly resist quantum attacks. Central to our construction is a new notion of linear-only vector encryption which is a generalization of the notion of linear-only encryption introduced by Bitansky et al. (TCC 2013). We conjecture that variants of Regev encryption satisfy our new linear-only definition. Then, together with new information-theoretic approaches for building statistically-sound linear PCPs over small finite fields, we obtain the first quasi-optimal SNARGs.