• No results found

Finding a square in Z [α]

In document Improving on the Number Field Sieve (sider 24-28)

3.4.1 Exponent maps

On the rational side, we were ”lucky”: Having enough smooth values was suf-ficient for finding a square. Now that we start working in Z[α], we find that things are not so simple. In fact, it turns out that the best we can hope for are necessary conditions. As explained in Section 3.1, we will develop two such criteria and convince ourselves that they together will almost guarantee the ex-istence of a square on the form we want.

The first criterion is reminiscent of what we did on the rational side, we attempt to find certain ”exponents” that sum up to 0. If we try the exact same idea, and use our factorizations of theN(a+bα), we will end up with a setS2 such thatQ

(a,b)∈S2N(a+bα) is a square in Z, but that’s not what we’re after since it turns out not to be sufficient to conclude that Q

(a,b)∈S2(a+bα) is a square inZ[α].

We will still use the exponent of a primepin the factorization ofN(a+bα), but in order to utilize it, we need to associate it not only withp, but with a certain element ofR(p). Recall from Proposition 6 that pdivides N(a+bα) if and only if there is anrin R(p) such thata≡ −br (modp). Thisr will then clearly be unique. Defineep,r :Z[α]→Zby

ep,r : (a+bα)7→

(ordp(N(a+bα)) ifa≡ −br (modp)

0 otherwise.

We trivially observe that

|N(a+bα)|= Y

(p,r)

pep,r(a+bα)

The idea behind this is that ifep,r turned out to be a group homomorphism, we could prove a necessary condition for the squareness property, stated below as Theorem 15. Unfortunately, this is not the case. However, we can still obtain the result by finding a group homomorphism that ”imitates”ep,rin a sense that will become clear. Recall the notion of first degree prime ideals in Z[α] from Chapter 2, specifically that they correspond to pairs (p, r). We want to use this correspondence when finding the mentioned group homomorphism.

Proposition 12. Let P ⊂ Z[α] be a prime ideal. Then there exists a group homomorphismlP :Q[α]→Zsuch that:

1. If 06=β∈Z[α], thenlP(β)≥0.

2. If 06=β∈Z[α], thenlP(β)>0 if and only ifβP.

3. If β∈Q[α], then{P prime ideal|lP(β)6= 0} is a finite set and Y

P prime ideal inZ[α]

N(P)lP(β)=|N(β)|

For a proof of Proposition 12, see [2]. These lp’s have some interesting properties regarding first degree prime ideals that we will exploit.

Lemma 13. Let a, b∈Zbe such that gcd(a, b) = 1. LetP ⊂Z[α] be a prime ideal that is not of first degree. ThenlP(a+bα) = 0.

Proof. Assume lP(a+bα)6= 0. Then, by Proposition 12, part 1, we have that lP(a+bα)>0. Proposition 12, part 2, now gives us thata+P. Consider the projection map

π:Z[α]→Z[α]/P θ7→θ+P =: ¯θ

Sincea+P, we have π(a+bα) = ¯0. Z[α]/P is a finite field, so assume Z[α]/P ∼= Fpk. We claim thatp-b. Assume that p|b. Thenp|bα, sobαP andπ(bα) = ¯0. Now,

π(a) =π(a+bα) =π(a+bα)π(bα) = ¯0−¯0 = ¯0

Hence, aP and p | a. But then gcd(a, b)p > 1, a contradiction. We conclude that p-b and thusb /P, which meansπ(b)6= ¯0. Thenπ(b) has an inverse inZ[α]/P, we define it to be ˆb. This gives us

π(α) =π(bα)π(b)−1= (π(a+bα)π(a))π(b)−1= ¯0−¯aˆb=−¯aˆb, which is an element in Fp. Hence, all linear combinations of powers ofα, i.e. all elements inZ[α], are also mapped to Fp byπ. π is surjective, so we conclude that

Fp∼=π(Z[α]) =Z[α]/P ∼= Fpk

Hence,k= 1 and P is a first degree prime.

This is then used to show thatlp”imitates” ep,r:

Proposition 14. Let a, b∈Zsuch that gcd(a, b) = 1. LetP ⊂Z[α] be a first degree prime ideal corresponding to(p, r). Then lP(a+bα) =ep,r(a+bα).

Proof. Let us start by showing thatlP(a+bα) = 0 if and only ifep,r(a+bα) = 0.

By Proposition 12, part 2, lP(a+bα) 6= 0 ⇐⇒ a+P. By Lemma 7, a+P ⇐⇒ a +br ≡ 0 (modp). By definition, a+br ≡ 0 (modp) ⇐⇒ ep,r(a+bα)6= 0.

We now let a+ be any element of Z[α]. Proposition 12, part 3, states that

Y

Pprime ideal

N(P)lP(a+bα)=|N(a+bα)|

Lemma 13 tells us that the exponent on the left hand side is non-zero only for first degree ideals. We also use our factorization ofN(a+bα) and obtain

Y

P fdpi

N(P)lP(a+bα)= Y

(p,r)

pep,r(a+bα)

Letpbe fixed. Then we are left with Y

We utilize the first part of this proof, that the maps have exactly the same zeroes, and find thatlP(a+bα) = ep,r(a+bα) whereP corresponds to (p, r).

This equality, together withlP(a+bα) = 0 =ep,r(a+bα) for all other first degree prime ideals withN(P) =p, gives us what we wanted to show.

Now we are ready to prove the first necessary condition for squareness in Z[α]: operation inZis written additively, while inQ[α] it is written multiplicatively.

SincelP is a homomorphism, and using Proposition 14, we obtain X

So one method for testing the squareness of our product is the following: For a bunch of primes p and corresponding integers r, check that P

(a,b)∈Sep,r(a+bα)

mod 2 always equals 0. Still, this can only gives us a square inQ[α], and we want a square in Z[α]. But ifγ2 is a square inQ[α], thenf0(α)2γ2is a square inZ[α], see [2]. For the rest of the text, we will ignore this factor for simplicity.

3.4.2 Quadratic characters

The next property that a square inZ[α] has, is related to the Legendre symbol.

InZ, we observe that if there is a prime psuch that

= 1. Hence, the more primespwe test without the corresponding Legendre symbol being equal to −1, the more convinced we should be that l actually is a square inZ. This is the basic idea we want to generalize.

Theorem 16. LetS be a subset ofZ×Zsuch thatQ

LetQ= ker(ω). By definition, we have that Qis the first degree prime ideal corresponding to (q, s). We now observe that

ω

since our assumption was that none of the (a+bs) were congruent to 0 modulo q. Hence, by definition ofQ,Q

(a,b)∈S(a+bα) =γ2is not in Q. Soγ is not in Qeither. This means that we can useγ2andγ as arguments in the map

χQ :Z[α]\Q→ {±1}

θ7→

ω(θ) q

We have that

So we now have another method of convincing ourselves that a given product is a square. Namely, we choose a lot of primesqoutside the factor base, with cor-responding integerss, and check that we never end up withQ

(a,b)∈S

primes is a good estimate for how many such primes we need, see [2]. Note that when we includef0(α)2as a factor, we need to assume thatf0(s)6≡0 (modq) for Theorem 16 to hold.

In document Improving on the Number Field Sieve (sider 24-28)