J. Symbolic Computation (2002) 11, 1–14

Polynomial Factorization Algorithms over Number
FieldsXavier-François Roblot
roblot@euler.univ-lyon1.fr
Institut Girard Desargues, Université Claude Bernard, Lyon, FRANCE
This research was conducted while the author was a memberof the Laboratoire A2X, Université Bordeaux I, FRANCE(Received 14 June 2002)

The aim of this paper is to describe two new factorization algorithms for polynomials.
The first factorizes polynomials modulo the prime ideal of a number field. The second
factorizes polynomials over a number field.

1. Introduction
Factorization algorithms over Q[X] and Fp [X] are key tools of computational number
theory. Many algorithms over number fields rely on the possibility of factoring polynomials in those fields. Because of the recent development of relative methods in computational
number theory, see for example (Cohen et al. 1998, Daberkow and Pohst 1995), efficient
generalizations of factorization algorithms to the relative case are necessary. The aim of
this paper is to describe two new such algorithms.
The first algorithm factors polynomials modulo a prime ideal of a number field. It
generalizes the algorithm of Berlekamp over Fp . The second factors polynomials over anumber field. Note that there already exist algorithms performing this task, see (Trager
1976, Weinberger and Rothschild 1976, Lenstra 1982, Geddes et al. 1992). In fact, themethod described in this paper can be viewed as a combination of the methods of Lenstra(1982) and Weinberger and Rothschild (1976).
Notations and definitions are given in the first section. The second section is devoted
to the factorization modulo a prime ideal, and the third to the description of the factorization algorithm over a number field. In the last section we give an example, several
applications and some comparison timings.
2. Notations and definitions
Let K be a number field. Let dK and OK denote respectively its discriminant andits ring of integers. Let (r1 , r2 ) be the signature of K and N its absolute degree, so
N = r1 + 2r2 .
Let σ1 , ..., σN be the embeddings of K into C with the usual convention: σ1 , ..., σr1 are
0747–7171/90/000000 + 00 $03.00/0

c 2002 Academic Press Limited

2

X.-F. Roblot

real, and σr1 +1 , ..., σN are complex with σ r1 +i = σr1 +r2 +i for 1 ≤ i ≤ r2 . The field K
can be embedded in RN in the following way. An element θ ∈ K is sent to the vector
whose first r1 components are σi (θ) for 1 ≤ i ≤ r1 , and last 2r2 components are the pairs(<σj (θ) + =σj (θ), <σj (θ) − =σj (θ)) for 1 ≤ j ≤ r2 . This embedding maps the ring ofintegers (or any fractional ideal of K) to a lattice in RN , i.e., a free additive subgroup of
RN of maximal rank. From now on, we identify K with its image in RN . Thus, the squareof the Euclidean distance on RN yields a quadratic form on K, the so-called T2 -norm,
defined byNX|σi (θ)|2 .
T2 (θ) :=i=1

Let n ≥ 1 be an integer and let L be a lattice in Rn , see (Conway and Sloane 1988).
Denote by B = {b1 , ..., bn } a basis of the lattice L. The fundamental domain of B is11
DB := (x1 b1 , ..., xn bn ) where − < xi ≤ for all i .
2
2
The origin is the only point of L contained in this domain and every point x ∈ Rn canbe uniquely written as x = y + l where l ∈ L and y ∈ DB . The volume of the lattice
V (L) is defined to be the volume of the fundamental domain. It does not depend on the
choice of the basis. The defect of orthogonality of the basis B is defined by
n
Q
|bi |
,
δB := i=1
V (L)where |.| denotes the length. This defect is ≥ 1 by Hadamard’s inequality, and in fact it
is equal to 1 if and only if the basis is orthogonal. For an LLL-reduced basis B of L, as
defined in (Lenstra et al. 1982), one gets
δB ≤ 2n(n−1)/4 .
Finally, for a vector x ∈ Rn , we denote by bxe the vector of Zn that one obtains byrounding each component of x to the nearest integer (with the convention that m + 21
rounds to m + 1 for m ∈ Z).
3. Factorization of polynomials modulo a prime ideal
Let p be a prime ideal of K dividing the rational prime p. Let Fp denote the residual
field
OK
Fp :=
.
p
This field is isomorphic to the finite field Fq where q := N p is the absolute norm of p.
Let S(X) be a polynomial with coefficients in Fp . The following method factors S using
a generalization of the method of Berlekamp (1970) as described in (Cohen 1993, section
3.4). Another method to factorize polynomials over finite fields can be found in (Cantor
and Zassenhaus 1981).
The first step is to compute a polynomial S0 (X) that is monic, square-free, and divisible
exactly by the same irreducible factors as S(X). We include the algorithm to do so forthe sake of completeness and refer the reader to (Cohen 1993, section 3.4.2) for the proofof its validity.

Polynomial Factorization Algorithms over Number Fields

3

Algorithm 3.1. Squarefree factorization of a polynomial S(X) ∈ Fp [X].
1. Set T0 ← S and S0 ← 1.
2. If T0 is constant, output S0 and terminate the algorithm.
3. Set T ← GCD(T0 , T00 ), V ← T0 /T and k ← 0.
4. If V is constant, it is of the formX
T (X) =
tj X j ,
p|j

P

j/p

then set T0 ← p|j tj X
and go to step 2.
5. Set k ← k + 1. If p divides k then set T ← T /V and k ← k + 1.
6. Set W ← GCD(T, V ), A ← V /W , V ← W and T ← T /V . If A is not constantthen set S0 ← S0 A. Go to step 4.
We now assume without loss of generality that S is a monic square-free polynomial.
Let m denote its degree. The key result is the following theorem of Berlekamp (1970).
Theorem 3.2. Let
S(X) =gY

Si (X)

i=1

be the irreducible factorization of S. Then, for any A(X) ∈ Fp [X] of degree < m, thefollowing assertions are equivalent:(i) There exist elements αi ∈ Fp such that A(X) ≡ αi (mod Si ) for all i.
(ii) The polynomial A satisfies A(X)q ≡ A(X) (mod S).
(Recall that q is the absolute norm of p).
Using the Chinese Remainder Theorem, one easily proves that there exists for each gtuple (αi )i ∈ Fp g a unique polynomial A(X) satisfying assertion (i). Hence the solutionsof theorem 3.2 span an Fp -vector space of dimension g.
m−1
PNow, let A(X) :=ai X i satisfy the conditions of the theorem. Then the coefficients
i=0

of A satisfy
ai =

m−1
X

aj ri,j ,j=0where the ri,j ’s are defined by
X jq =m−1
Xri,j X i(mod S).

i=0

Thus the computation of a basis of the solutions of theorem 3.2 boils down to thekernel computation of the matrix R − Im where R is the matrix with entries ri,j , and Im
is the identity matrix of dimension m. Note that the number of irreducible factors of S isexactly the rank of this kernel. Therefore, if this rank is 1, the polynomial S is irreducible
and the factorization is done. Hence, we suppose from now on that the polynomial S is
reducible and we let g denote the number of irreducible factors of S, so g ≥ 2.

4

X.-F. Roblot

Assume that we can find a solution A(X) such that α1 6= α2 (with the notation of thetheorem 3.2). Then S1 (X) divides A(X)−α1 but S2 (X) does not. Therefore, the GCD of
A(X)−α1 and S(X) yields a non-trivial factor of S. And we may repeat this process until
S(X) is broken into g factors which are then known to be irreducible. Unfortunately, thedrawback of the above method is that we need to find such a polynomial A(X) and thecorresponding element α1 . And this is definitely a hard task when the field Fp is large.
We use instead the following method.
Proposition
3.3. Let (Ai )i be a basis of the solutions of theorem 3.2, and let A(X) :=
P
b
A
(X)
be
a random linear combination of the Ai ’s. If p = 2, setiiiD(X) := A(X) + A(X)2 + A(X)4 + ... + A(X)q/2 ;otherwise set
D(X) := A(X)(q−1)/2 − 1.
Then the GCD of S(X) and D(X) yields a non-trivial factorization of S with a probabilityof a least 4/9.
Proof. For each i, let αi be the element of Fp such that Si divides A(X) − αi . First,
suppose that p = 2 and set B(X) := X + X 2 + X 4 + ... + X q/2 . Then B(X)(B(X) + 1) =X q + X and the field Fp is the disjoint union of the set of the q/2 roots of B(X) and theset of the q/2 roots of B(X) + 1. Denote by R the set of roots of B(X). ThenY
D(X) =(A(X) − ρ).
ρ∈R

Thus the GCD of S(X) and D(X) is equal to a constant if and only if none of the αi ’s
are in R. This event has a probability of 1/2g . On the other hand, the GCD of S(X) andD(X) is equal to S(X) if and only if all the αi ’s belong to R. And, this event has also aprobability of 1/2g . Hence, this GCD is non-trivial with a probability of 1−1/2g−1 ≥ 1/2.
The case where p is an odd prime is similar, with R being the set of square elements

g of
q−1
×
Fp . Then the GCD of S(X) and D(X) is non-trivial with a probability of 1 − 2q
−
g

q+1
≥ 4/9. 2
2q
Putting all these results together, we obtain the following probabilistic algorithm.
Algorithm 3.4. Factorization of a polynomial S(X) ∈ Fp [X].
1. Using algorithm 3.1, compute a monic square-free polynomial S0 with the same
irreducible factors as S.
P
2. Compute the coefficients ri,j such that X jq = i ri,j X i (mod S0 ) and set R ←(ri,j )i,j .
3. Compute the kernel of the matrix R−Im and denote its rank by g. If g > 1, computealso a basis A1 (X), ..., Ag (X) of the solutions of theorem 3.2.
Set F ← {S0 (X)} and k ← 1.
4. If k = g then go to step 6.
Let b1 , ..., bg be random elements of Fp . Set
A(X) ←

gX
i=1

bi Ai (X).

Polynomial Factorization Algorithms over Number Fields

5

Set also
D(X) ← A(X) + A(X)2 + ... + A(X)q/2
if q is even, orD(X) ← A(X)(q−1)/2 − 1otherwise. Set G ← ∅.
5. Pick up a polynomial B(X) ∈ F and set F ← F \ {B(X)}. Compute C(X) ←GCD(B(X), D(X)). If 0 < deg C < deg B, then set G ← G ∪ {C(X), B(X)/C(X)},and set k ← k + 1. Otherwise, set G ← G ∪ {B(X)}. Finally, if F =6 ∅ then go tostep 5; otherwise set F ← G and go back to step 4.
6. For each polynomial Si (X) ∈ F, compute the greatest positive integer ei such that
Si (X)ei divides S(X). Output the factorization
S(X) = sgY

Si (X)ei

i=1

where s is the leading coefficient of S, and terminate the algorithm.
4. Factorization of polynomials over a number field
We first recall how one factorizes polynomials over Q as explained in (Cohen 1993,
section 3.5). Let S(X) be a polynomial with rational coefficients. Without loss of generality, we can assume that S is a square-free polynomial with coefficients in Z. To simplify
the description of the method, we also assume that S is monic. In order to factor S,
one first factors it modulo a “well-chosen” rational prime number p. Then, using a result of Mignotte (1974), one computes an explicit bound C on the absolute value ofthe coefficients of any non-trivial divisor of S(X). Finally, one uses Hensel lemma tolift this factorization modulo pe where pe > 2C. Then every factor of S in Q[X] is thelift of a divisor of S modulo pe where the lift is chosen with coefficients in the interval] − pe /2, pe /2]. Therefore, one recovers all the factors of S in Q[X] from the factors of S
modulo pe (and in particular all the irreducible factors).
Similarly, the steps for the relative algorithm are the following. Given a polynomial
S(X) with coefficients in a number field K, we first find a square-free polynomial with thesame irreducible factors and with integral coefficients. We factor this polynomial modulo
a “well-chosen” prime ideal p of K. Then, using a generalization of Mignotte’s bounds, we
compute a bound for the T2 -norm of the coefficients of any non-trivial factor of S(X), andlift this factorization using Hensel lemma. Eventually, we recover the irreducible factors
in K[X] from this lifted factorization. Note that this final step is not as straightforward
as in the absolute case.
Let S(X) be a polynomial with coefficients in K. If S is not square-free, we may
also replace S by S/GCD(S, S 0 ), that is, a square-free polynomial with exactly the same
irreducible factors.
We now assume without loss of generality that S is a square-free polynomial, andmultiplying if necessary this polynomial by some well-chosen element in K × , we can also
assume that it has coefficients in OK , and that its leading coefficient is a rational integers. However, we cannot talk of factorization in this ring since OK may not be principal.
Let p be a prime ideal of K such that p does divide neither the discriminant of S nor

6

X.-F. Roblot

its leading coefficient s. The reduction of S modulo p is a square-free polynomial of thesame degree. We use the result of the last section to obtain the factorization
S(X) ≡ sgY

Si (X) (mod p).

i=1

If g = 1 then the polynomial S is irreducible modulo p, therefore it is also irreducible in
K[X] and the factorization is done. From now on, assume that S is reducible, so g ≥ 2.
We need to lift this factorization modulo pe where the value of the exponent e will be
discussed below. As we said before, we use Hensel lifting which is a classic result that canbe found in any textbook about algebraic number theory. We refer to (Cohen 1993) foran algorithmic version. We only quote here the result. Note that this theorem is provedin a more general case in (Pohst and Zassenhaus 1989).
Theorem 4.1. Let S be a square-free polynomial in OK [X], and let p be a prime idealof K such that p does divide neither the discriminant of S nor its leading term. Let
S(X) ≡ sgY

Si (X)(mod p)i=1denote the irreducible factorization of S in Fp [X]. Then, for every integer e ≥ 1, there
exist polynomials Si,e (X) ∈ OK [X] such that
S(X) ≡ sg
Y

Si,e (X) (mod pe )i=1

and Si,e (X) ≡ Si (X) (mod p). Furthermore, these polynomials are unique modulo pe .
In order to find a suitable value for the exponent e, we need to know more about thesize of the T2 -norm of the coefficients of a divisor of S. This theorem is a generalizationof a result of Mignotte (1974).
Theorem 4.2. Let S(X) =mP

si X i with leading coefficient s = sm ∈ Z \ {0}. Define

i=0

T2 (S) :=mP

T2 (si ). Then, for every monic divisor D(X) := X l +

i=0

l−1
P

dj X j of S(X) in

j=0

K[X], we have
T2 (dj ) ≤ T2 (S)


 
2
l−1
l−1
+
j
j−1

for 0 ≤ j ≤ n − 1.
Proof. For each embedding σ of K into C, the monic polynomial σ(D) divides thepolynomial σ(S) in C[X] and its leading term is smaller (in absolute value) than theleading term of S. Thus, by Mignotte’s bounds, it follows that




l−1
l−1
|σ(dj )| ≤|σ(S)| +
|s|
j
j−1

Pm
2 1/2
where |σ(S)| :=. Now, using the fact that |s| ≤ |σ(S)|, squaring thisi=0 |σ(si )|expression, and summing over all the embeddings of K gives the result. 2

Polynomial Factorization Algorithms over Number Fields

7

Denote by C an upper bound for the T2 -norm of every coefficient of such a non-trivial
divisor of S. We use this bound by means of the following two results.
Proposition 4.3. Let π be a non-zero element of pe where e ≥ 1. Then
T2 (π) ≥ N q 2e/N .
Proof. The inequality between arithmetic mean and geometric mean gives
!1/N
N
N
Y
1 X
2
2
|σi (π)| ≥|σi (π)|N i=1i=1or equivalently T2 (π) ≥ N |NK/Q (π)|2/N . Since π is a non-zero element of pe , its norm isdivisible by q e and the result follows. 2
Corollary 4.4. Let e be an positive integer such thate≥

N log(4s2 C/N )
2
log q

e
and denote by D(X)
any monic divisor of S(X) modulo pe . Then there exists at moste
one polynomial D(X) ∈ OK [X] with leading coefficient s, and such that D(X) ≡ s D(X)(mod pe ) and D divides S in K[X].
e
Proof. Let δe be any coefficient of D(X)and let δ be the corresponding coefficient ofee
D(X). Then δ ≡ s δ (mod p ), and T2 (δ) < s2 C since s−1 D satisfies the condition of
proposition 4.2. To prove the corollary, it is enough to prove that there exists at most one
algebraic integer in OK satisfying these two conditions. Now, suppose that δ 0 is anotheralgebraic integer which satisfies these conditions. Set π := δ − δ 0 . Then, π ∈ pe andT2 (π) < 4s2 C ≤ N q 2e/N , thus π = 0 by the proposition. Therefore δ = δ 0 and the result
is proved. 2
Let e be an integer satisfying the hypothesis of the corollary. We need to be able toe of S modulo pe . In
compute, if it exists, the polynomial D corresponding to a divisor D
order to do so, we need to work with a larger exponent e. We use the following procedure
given in (Lenstra 1982).
Proposition 4.5. Let B be a basis of a lattice L in RN . Then, the fundamental domainof B contains a ball centered on the origin of radius
mB
RB >
2δB
where mB is the minimum length of the elements of B.
In particular, if B is an LLL-reduced basis of pe , then every element θ ∈ OK that does
not belong to the fundamental domain of B satisfies
T2 (θ) >N q 2e/N.
4 4N (N −1)/4

8

X.-F. Roblot

Let e be an integer such thate>2
N log(s C/N ) +



2

log q



N (N −1)
+1
4

log 4
.

(†)

e be a monic divisor of
Let B denote an LLL-reduced basis (for the T2 -norm) of pe . Let De
S modulo p . With the notations of 4.4, we want to compute (if it exists) the polynomialeD(X) congruent to s D(X)
modulo pe dividing S. Assume D exists, let δe be a lift in OKe and let δ be the corresponding coefficient of D. Then δ is the onlyof any coefficient of D,
algebraic integer congruent to s δe contained in the fundamental domain of B. Indeed, anyother algebraic integer δ 0 congruent to s δe modulo pe is outside the fundamental domain,and so must satisfies T2 (δ 0 ) > s2 C by proposition 4.5 and inequality (†). Thus, we havee This point can beδ = s δe − λ where λ is the point of the lattice that is the closest to s δ.
computed in the following way. Fix an integral basis Ω := {ω1 , ..., ωN } of K, and let M
e := (de1 , ..., deN ) ∈ ZN be
be the matrix expressing the Z-basis B with respect to Ω. Let dP
Psuch that s δe = i dei ωi . Then λ = i li ωi where l = (l1 , ..., lN ) is given byjme .
l = M M −1 d
We are now ready to give the complete algorithm.

Algorithm 4.6. Factorization of a polynomial S(X) ∈ K[X].
1. Set S0 ← S/GCD(S, S 0 ), and U ← d S0 where d is a non-zero element of K suchthat d S0 (X) ∈ OK [X] and the leading term u of U is a rational integer. Let p be aprime ideal of K that does divide neither the discriminant of U nor its leading termu. Note that prime ideals can be computed using algorithm 6.2.9 of Cohen (1993).
2. Let e be an integer satisfying (†). Compute the factorization
U (X) ≡ ugY

Ui (X)(mod p)i=1

by algorithm 3.4. If g > 1 then lift this factorization modulo pe using Hensel’s
ei denote the factors obtained. Otherwise, i.e. if g = 1, set F ←lemma, and let U−1{u U }, and go to step 6.
e1 , ..., Ueg } and3. Compute an LLL-reduced basis B of the ideal pe . Set r ← 1, E ← {UF ← ∅.
e
4. For every product D(X):= E1 (X)...Er (X) of r (distinct) elements of E, computee modulo pe using the method explained above.
the polynomial D congruent to u D
If D(X) divides U (X), then remove from E the factors Ei , set F ← F ∪ {D̂}
where D̂ is the monic polynomial obtained by dividing D by its leading term andset U ← d (U/D) where d is a non-zero element of K such that d (U/D) ∈ OK [X]
and its leading term u is a rational integer.
In any case, if there exist products of r (remaining) elements of E that has not beentested, redo this step.
5. Set r ← r + 1. If r ≤ (deg U )/2 then go back to step 4. If deg U ≥ 1, then set
F ← F ∪ {u−1 U }.
6. For every Si ∈ F, compute the greatest integer ei such that Si (X)ei divides S(X).

Polynomial Factorization Algorithms over Number Fields

9Output the factorization
S(X) = shY

Si (X)eii=1

with s the leading term of S, and terminate the algorithm.
Remark 4.1. If one is only interested in the factorization in K[X], but not in thefactorization in Fp [X], then one can choose a prime ideal p of degree 1. Then the residue
field Fp is isomorphic to Fp , with pZ = p ∩ Z, and one can use a standard factorization
algorithm in Fp [X]. Furthermore, if p is also unramified, one can also avoid the use ofHensel’s lemma by computing directly the p-adic factorization in the complete field Kp(isomorphic to Qp ) with the precision pe . Algorithms to compute factorization in Qp are
given in (Böffgen 1987, Böffgen and Reichert 1987, Ford et al. 2002).
Remark 4.2. Several improvements to this algorithm are possible including a relative
version of van Hoeij (2002), see (Belabas et al. 2002), and the use of the method describedin (Fieker and Friedrichs 2000) to replace the use of an real LLL algorithm by an (usuallyfaster and, in anyway, stabler) integral one.

5. Implementation and Applications
The two preceding algorithms have been programmed in the number theory package
PARI (Batut et al. 2002). Polynomial factorization algorithms over number fields are also
implemented in other number theory packages e.g., KANT (Pohst et al. 2002), SIMATH(Zimmer et al. 1998) using the method described in (Pohst and Zassenhaus 1989), or
more general purpose packages such as MAGMA (Cannon et al. 2002).
5.1. An Example
Let K := Q(α) where α is a root of X 3 − X 2 − 9X + 8. We want to factorize in thisfield the polynomial
S(X) = X 3 + (6α − 9)X + (5α2 − 33α + 13)X − 5α + 30.
With the notations of theorem 4.2, we have T2 (S) = 29 362, and thus C = 88 089 is anupper bound for the T2 -norm of the coefficients of any non-trivial monic divisor of S in
K[X]. The prime ideal p is chosen to be the only prime ideal above 5 of residual degree
2. Using algorithm 3.4, one finds
S(X) ≡ X(X + 2)(X + α + 4)

(mod p).

Inequality (†) tells us that the exponent e has to be greater than 6. By Hensel’s lemma,
we lift the factorization modulo p7 and obtain the following factors
e 1 (X) = X + 390100α + 24260,De 2 (X) = X + 530α + 366362,
D
e 3 (X) = X + α + 390619.
D10

X.-F. Roblot

We compute an LLL-reduced basis B for the T2 -norm of p7 . The matrix of this basis overthe integral basis {1, α, α2 } is−4055 18544789
−5 1139 −1651  .
M =
140 −642 −647
With the notations of corollary 4.4, we compute the polynomial D1 (X) = X − 2271 −579α + 338α2 , and its constant term has a T2 -norm of 10 687 724 which is larger than C.
Thus D1 (X) cannot be a divisor of S. For the same reason, we find that the polynomial
D2 cannot divides S. However, the last polynomial is D3 (X) = X + α − 6 and it does
divide S(X). We obtain
S(X) = (X + α − 6)(X 2 + (−3 + 5α)X − 5).
Finally, we know that this second factor is irreducible since, otherwise, its factorizatione 1 and D
e 2 . Therefore, this is the complete factorization of S
will be given by the lift of D
in K[X].
The defect of orthogonality of the LLL-reduced basis B given by M is δB ' 1.094 andthe value of mB is approximately 5 573.6. Thus, the fundamental domain of this basis
contains a ball centered on the origin of radius RB ≥ 2 546 and every algebraic integerof K which is not contained in this domain has a T2 -norm greater than 6 486 381.
5.2. Applications of the polynomial factorization over a number field
We use the following notations: K := Q(α) and L := Q(β) are two number fields whereα (resp. β) is the root of the irreducible integral polynomials A(X) (resp. B(X)).
5.2.1. Subfield test
The field K is conjugate to a subfield of L if and only if the polynomial A has a linear
factor in L[X]. If it is so, this factor gives also an expression of α (up to isomorphism)
as a polynomial in β. Now, if α and β are known as complex numbers, one can test if
K ⊂ L (not only up to isomorphism) by computing a precise enough value of the rootof this linear factor.
5.2.2. Relative minimal polynomial
If K is known to be conjugate to a subfield of L, then the irreducible factors of B(X) in
K[X] are the minimal polynomials over K of the conjugates of β by the Q-isomorphismsof K. Once again, it is possible to find exactly which is the minimal polynomial of β over
K by using complex approximations.
5.2.3. Field automorphisms
Every linear factor in the factorization of B(X) in L[X] yields a Q-automorphism of L,
and this automorphism is explicitly expressed as a polynomial in β (note that one always
obtains the trivial factor X − β corresponding to the identity automorphism). Similarly,
if one factors in L[X] the relative minimal polynomial BK (X) of β over a subfield K,
then one obtains explicitly all the K-automorphisms of L.

Polynomial Factorization Algorithms over Number Fields

11

5.2.4. Galois closure and Galois group
Assume that the polynomial B splits totally over L[X]. Then L/Q is a Galois extension.
In a similar way, if the factorization of BK in L[X] has only linear factors, then L/K is a
Galois extension. Conversely, if the polynomial B (resp. BK ) does not split completely,
then the extension is not Galois, and any root θ of a non-linear factor of B (resp. BK )yields an new extension L(θ)/Q (resp. L(θ)/K) that is contained in the Galois closure ofL/Q (resp. L/K). By factoring B (resp. BK ) in this new field, one can test if this field
is indeed the Galois closure. If not, one has to consider the field generated over L(θ) bya root of any non-linear factor. Using this method, one obtains finally the Galois closureof L, and may even be able to recover its Galois group by a close look at the factors
encountered, especially when this group is solvable, see (Landau and Miller 1985).
5.2.5. n-th roots of an algebraic number
Let θ be an algebraic number in K, and let n ≥ 2 be an integer. Then, one obtains
all the n-th roots of θ in K by factoring the polynomial X n − θ in K[X]. In particular,when θ = 1, one can use this method, or a refined version as described in the algorithm
4.9.10 of Cohen (1993), to compute all the roots of unity contained in K.
5.3. Applications of polynomial factorization modulo a prime ideal
We keep the same notations. We assume also from now on that K is a subfield of L.
5.3.1. Relative Dedekind Criterion
Let p be a prime ideal of K, and let θ be an algebraic integer of L such that L = K(θ).
This criterion tells us if the order OK [θ] is p-maximal (recall that this order is said to be
p-maximal, if p does not divide the index (OL : OK [θ])). Furthermore, if it this order is
not p-maximal, then the criterion defines a new order O0 , strictly larger than OK [θ]. We
quote the result without proof, and refer to (Roblot 1997) for the proof. We also refer
the reader to theorem 6.1.4 of Cohen (1993) for the absolute version of the criterion. We
denote by T (X) the minimal polynomial of θ over K.
Theorem 5.1. Let τ be an element of K such that vp (τ ) = −1 and vq (τ ) ≥ 0 for any
prime ideal q 6= p. For any P (X) ∈ OK [X], let P denote its reduction modulo p. Let
T (X) =rY

Ti (X)ei

i=1

be the irreducible factorization of T in Fp [X]. Let g(X) :=any lift of T /g of the same degree. We defineQ

i Ti (X), and let h(X) bef (X) := τ (g(X)h(X) − T (X)) ∈ OK [X].
(i) The order OK [θ] is p-maximal if and only if GCD(f , g, h) = 1.
(ii) Let U (X) be any lift of T /GCD(f , g, h) of the same degree. Define the following
modulee := OK [θ] + U (θ)p−1 OK [θ].
O

12

X.-F. Roblot

e is an order of L containing OK [θ], and (O : OK [θ]) = pm where m is theThen, O
degree of GCD(f , g, h).
5.3.2. Decomposition of prime ideals
As above, let θ be an algebraic integer such that L = K(θ), and let T (X) denote its
minimal polynomial over K. Let p be a prime ideal of K. If p does not divide the index(OL : OK [θ]), then the decomposition of p in L is given by the factorization of T (X)
modulo p. More precisely, one has the following theorem which is proved in (Pohst andZassenhaus 1989).
Theorem 5.2. Let
T (X) ≡rY

Ti (X)ei(mod p)i=1

be the irreducible factorization of T in Fp [X], where the polynomials Ti (X) are monic
and belong to OK [X]. Then, there exist exactly r prime ideals Pi dividing pOL , and theseprime ideals are given by
Pi := pOL + Ti (θ)OL .
Furthermore, the ramification index (resp. the residual degree) of Pi over p is ei (resp.
the degree of the polynomial Ti ).
5.3.3. The relative Round 4 algorithm
The absolute Round 4 algorithm is used to compute the maximal order of a p-adic
fields. It is also used to compute the ring of integers of a number field as a Z-module. It
is described in (Ford 1978, Ford 1987, Ford and Letard 1994, Böffgen 1987, Böffgen andReichert 1987, Ford et al. 2002). Since this algorithm deals only with p-adic computations,
one can generalize this algorithm to the relative case using p-adic computations. However,this is a difficult and complicated algorithm, thus we will not give any details here andthe interested reader can refer to (Roblot 1997).
5.4. Comparison timings
We have compared the implementation in PARI (v. 2.2.4) of the algorithm describedin section 4 to the algorithm available in KASH (v. 2.2) (Pohst et al. 2002) which uses anorm-based factorization. We have considered random polynomials over random number
fields of various degrees. These were constructed in the following way.
We take the polynomials defining the number fields as random monic irreducible polynomials with integral coefficients in the interval [−5; 5]. For T such a polynomial of degreen, let K be the number field defined by one of its roots, OK be the ring of integers of Kand {ω1 = 1, . . . , ωn } be an integral basis of OK .
Now, we choose a random integer t in [2, 6], and produce t random polynomials in
OK [X] of degree between 1 and 7 with coefficientsλ1 ω 1 + · · · λn ω n ∈ O K
where the λi ’s are random integers in the interval ] − 500; 500[. Multiplying these tpolynomials together gives us the polynomial we want to factorize.

Polynomial Factorization Algorithms over Number Fields

13

For 2 ≤ n ≤ 7, we have constructed in this way 10 random polynomials over 15 random
number fields of degree n, and factorized these polynomials using the two packages. The
corresponding timings are given in the following table. Note that the computation timeof the new algorithm is largely dominated by the LLL-reduction step when the degree ofthe number field is large.
The computation were performed on a Pentium III with 1000MHz and 1GB of RAM
running Linux 2.4.3.
n
2
3
4

KANT
7.1s
20s
39s

PARI
2.7s
6.5s
13s

n
5
6
7

KANT
80s
136s
279s

PARI
38s
63s
206s

References
Batut, C., Belabas, K., Bernardi, D., Cohen, H., Olivier, M. (2002). Number theory package PARI,
v.2.2.4 (development). http://www.parigp-home.de/.
Belabas, K., Hanrot, G., Zimmermann, P. (2002) A relative version of van Hoeij algorithm, work inprogress with a pilot implementation in PARI/GP.
Berlekamp, E. (1970). Factoring polynomials over large finite fields. Math. Comp. 24, 713–735.
Böffgen, R. (1987). Der Algorithmus von Ford/Zassenhaus zur Berechnung von Ganzheitsbasen in
Polynomalgebren. Ann. Univ. Saraviensis, Ser. Math. 1, 60–129.
Böffgen, R., Reichert, M. A. (1987). Computing the decomposition of primes p and p-adic absolutevalues in semi-simple algebras over Q. J. Symb. Comp. 4, 3–10.
Cannon, J. et al. (2002). The Magma Computational Algebra System for Algebra, Number Theory andGeometry, v.2.9. http://magma.maths.usyd.edu.au/magma/.
Cantor, D. G., Zassenhaus, H. (1981). A new algorithm for factoring polynomials over finite fields. Math.
Comp. 36, 587–592.
Cohen, H. (1993). A Course in Computational Algebraic Number Theory, volume 138 of Graduate Texts
in Math. Springer-Verlag.
Cohen, H., Diaz y Diaz, F., Olivier, M. (1998). Computing ray class groups, conductors and discriminants.
Math. Comp. 67, 773–795.
Conway, J., Sloane, N. (1988). Sphere Packing, Lattices and Groups, volume 290 of Grundlehren dermath. Wiss., Springer-Verlag.
Daberkow, M., Pohst, M. (1995). Computations with relative extensions of number fields with anapplication to the construction of Hilbert class fields. In Proc. ISAAC’95.
Fieker, C., Friedrichs, C. (2000). On reconstruction of algebraic numbers. In Algorithmic number theory
ANTS-IV (Leiden), Lecture Notes in Comp. Sci. 1838, Springer, 285–296
Ford, D. (1978). On the Computation of the Maximal Order in a Dedekind Domain. PhD thesis, Ohio
State University.
Ford, D. (1987). The construction of maximal orders over a Dedekind domain. J. Symb. Comp. 4,
69–75.
Ford, D., Letard, P. (1994). Implementing the Round Four maximal order algorithm. Sém. Th. Nombresde Bordeaux 6, 39–80.
Ford, D., Pauli, S., Roblot, X.-F. (2002). A fast algorithm for polynomial factorization over Qp , toappear in Journal de Théorie des Nombres de Bordeaux.
Geddes, K., Czapor, S., Labahn, G. (1992). Algorithms for Computer Algebra. Kluwer Academic Press.
van Hoeij, M. (2002). Factoring polynomials and the knapsack problem, to appear in Journal of Number
Theory.
Landau, S., Miller, G. L. (1985). Solvability by radicals is in polynomial time. J. Comput. Syst. Sci.
30, 179–208.
Lenstra, A. K. (1982). Factoring polynomials over algebraic number fields. LN in Comp. Sci. 144,
32–39.
Lenstra, A. K., Lenstra, H. W., Lovász, L. (1982). Factoring polynomials with rational coefficients.
Math. Ann. 261, 515–534.
Mignotte, M. (1974). An inequality about factors of polynomials. Math. Comp. 28, 1153–1157.
Pohst, M., Zassenhaus, H. (1989). Algorithmic Algebraic Number Theory. Cambridge Univ. Press.
Pohst, M. et al. (2002). Number theory package KANT, v.2.2. http://www.math.tu-berlin.de/~kant/.

14

X.-F. Roblot

Roblot, X.-F. (1997). Algorithmes de Factorisation dans les Extensions Relatives et Applications de laConjecture de Stark à la Construction des Corps de Classes de Rayon. PhD thesis, Laboratoire
A2X, Université Bordeaux I.
Trager, B. (1976). Algebraic factoring and rational function integration. In Proc. of SYMSAC’76,
219–226.
Weinberger, P.J., Rothschild, L.P. (1976). Factoring polynomials over algebraic number fields. ACM
Transactions on Math. Software 2, 335–350.
Zimmer, H. G. et al. (1998). Number theory package SIMATH. http://www.math.uni-sb.de/~simath/.