# Patent

## Title
Public key cryptography computing device

## Abstract

According to an embodiment, a computing device includes a receiving unit, a calculating unit, a solving unit, a selecting unit, and a determining unit. The receiving unit is configured to receive pieces of input data indicative of elements of a subgroup of a multiplicative group in a finite field and pieces of first additional data for identifying conjugates of the respective pieces of input data. The elements are represented by traces. The calculating unit is configured to calculate a coefficient of an equation based on the pieces of input data. The solving unit is configured to obtain solutions of the equation. The selecting unit is configured to select one of the solutions as a result of computation, based on the first additional data. The determining unit is configured to determine second additional data for identifying a conjugate of the selected result of computation based on the first additional data.

## Background
CROSS-REFERENCE TO RELATED APPLICATIONS
This application is based upon and claims the benefit of priority from Japanese Patent Application No. 2012-059235, filed on Mar. 15, 2012; the entire contents of which are incorporated herein by reference.
FIELD
Embodiments described herein relate generally to a computing device.
BACKGROUND
A public key cryptography technique ensures secure communication without sharing a key in advance. This technique has a problem of increasing size of the cryptosystem. Under the circumstance, a proposed method employs an algebraic torus so as to compress the size of the cryptosystem in the public key cryptography. Representation of elements of the algebraic torus includes trace representation, projective representation, and extension field representation. The trace representation is known to use an exponentiation algorithm, but multiplication is assumed not to be available. Therefore, the public key cryptography with algebraic torus has employed the trace representation for input and output in respective steps of key generation, encryption, and decryption. The public key cryptography has employed the projective representation or the extension field representation for computation. In view of this, there is a need for a conversion (representation conversion) between the respective representations before and after the computation.
However, such a conventional technique increases in calculation amount in the representation conversion depending on a combination of representations before and after the conversion. This may considerably increase the amount of calculation including representation conversion and computation.



BRIEF DESCRIPTION OF THE DRAWINGS
FIG. 1 is a block diagram illustrating a computing device according to a first embodiment;
FIG. 2 is a flowchart of a computation according to the first embodiment;
FIG. 3 is a block diagram illustrating a computing device according to a second embodiment; and
FIG. 4 is a diagram of a hardware configuration of the computing device.



DETAILED DESCRIPTION
According to an embodiment, a computing device includes a receiving unit, a coefficient calculating unit, a solving unit, a selecting unit, a determining unit, and an output unit. The receiving unit is configured to receive a plurality of pieces of input data indicative of elements of a subgroup of a multiplicative group in a finite field and a plurality of pieces of first additional data for identifying conjugates of the respective pieces of input data. The elements are represented by traces. The coefficient calculating unit is configured to calculate a coefficient of an equation based on the pieces of input data. The equation has a solution that is a possible value as a result of a predetermined computation performed on the pieces of input data. The solving unit is configured to obtain a plurality of solutions of the equation having the calculated coefficient. The selecting unit is configured to select one of the solutions as the result of the predetermined computation, based on the pieces of first additional data. The determining unit is configured to determine second additional data for identifying a conjugate of the selected result of the predetermined computation, based on the pieces of first additional data. The output unit is configured to output the selected result of the predetermined computation and the second additional data.
A computing device according to a preferred embodiment of the present invention will be described in detail below by referring to the accompanying drawings.
First Embodiment
FIG. 1 is a block diagram illustrating an exemplary configuration of a computing device 100 according to a first embodiment. As illustrated in FIG. 1, the computing device 100 includes a receiving unit 101, a coefficient calculating unit 102, a solving unit 103, a selecting unit 104, a determining unit 105, and an output unit 106.
The receiving unit 101 receives input data to be used for computation. For example, the receiving unit 101 receives multiple pieces of input data, which are used for computation, and additional data (first additional data) for each piece of input data. The pieces of input data are elements of a subgroup of a multiplicative group in a finite field (an algebraic torus in a finite field representation), which are expressed by their traces. Hereinafter, a element g of an algebraic torus in the trace representation will be written as a trace Tr(g). The additional data is used to identify conjugates of each corresponding input data.
The coefficient calculating unit 102 calculates a coefficient of an equation (polynomial) that has a solution that is a possible value of a result of a predetermined computation where multiple pieces of input data are used. Hereinafter, as an example of the predetermined computation, a multiplicative process of multiple pieces of input data will be described. However, the computation is not limited to this process. For example, a similar method may be applicable to multiplicative processes that include a multiplicative process where the Frobenius map is applied for one of the multiple pieces of input data and another process for the other piece of input data. Alternatively, a similar method may be applicable to multiplicative processes where the Frobenius map is applied for the multiple pieces of input data.
The solving unit 103 obtains multiple solutions of the polynomial that has the calculated coefficient. The solving unit 103 is able to solve the polynomial to obtain its solution (root) with any conventional algorithm. For example, the quadratic formula, the cubic formula, Berlekamp's algorithm to obtain a solution in the finite field, or a similar algorithm may be used. Multiple solutions include not only a solution that expresses an actual result of a computation (such as a multiplicative process) for multiple pieces of input data, but also a solution other than the solution.
The selecting unit 104 selects one of the multiple solutions, as a result of the computation, based on the received additional data.
The determining unit 105 uses multiple pieces of additional data for the respective pieces of input data so as to determine additional data (second additional data) that is used to identify a conjugate of the solution selected as a result of the computation.
The output unit 106 outputs the selected solution (the result of the computation) and additional data for this solution.
Next, the computation executed by the computing device 100 according to the first embodiment, which is configured as described above, will be described by referring to FIG. 2. FIG. 2 is a flowchart of an entire computation according to the first embodiment.
The receiving unit 101 receives input of multiple pieces of input data (traces in other words) to be multiplied, and additional data for each trace (step S101). The coefficient calculating unit 102 calculates a coefficient of a polynomial that has a solution (root) as a possible value of a result of the multiplication (multiplication value in other words) of multiple traces (step S102). The solving unit 103 obtains a solution of the polynomial that has the calculated coefficient (step S103).
The selecting unit 104 selects a solution to be output as a result of the multiplication (which is also referred to as multiplication value) of multiple traces, from the obtained multiple solutions, using the received additional data (step S104).
On the other hand, the determining unit 105 uses the received, additional data to determine additional data for the selected solution (multiplication value) (step S105). The step S102 to the step S104, and the step S105 do not need to be executed in the order illustrated in FIG. 2. These steps may be executed in reverse order, and may be executed concurrently.
The output unit 106 outputs the selected multiplication value, and the determined additional data for the multiplication value (step S106), and then exits the computation.
In the following description, the computation will be described in more detail. First, relevant mathematical background for computation in an algebraic torus according to this embodiment will be described. Let Fpm be a finite field where an algebraic torus Tn is defined. Here, assume that p is a prime, and n and m are positive integers. Fpm denotes a finite field where the number of elements is pm. An algebraic torus Tn (Fpm) is a group where the number of elements is Φn(pm). Here, Φn(X) is an nth cyclotomic polynomial (polynomial dividing a circumference equally by n). A trace representation of the algebraic torus Tn(Fpm) is expressed by a combination of φ(n) elements of Fpm. Here, φ(x) is an Euler function. A trace representation of a subgroup G± in an algebraic torus is expressed by a combination of φ(n)/2 elements of Fpm.
Exemplary subgroups G± for n=4 and n−6 will be described as follows.
A trace representation of an element g of the algebraic torus Tn(Fpm) is expressed by traces Tr(g) and Tr(gpm+1). A trace map Tr is a map expressed in Equation (1) below.




  
    
      
        
          Tr
          ⁡
          
            (
            g
            )
          
        
        =
        
          
            ∑
            i
          
          ⁢
          
            
              π
              i
            
            ⁡
            
              (
              g
              )
            
          
        
      
    
    
      
        (
        1
        )
      
    
  




Here, the Frobenius map π is expressed, as π: x→xpm where i=0, 1, . . . , and n−1. Tr(g) is an element of Fpm. A polynomial expressed in Expression (2) below, which has the element g and Frobenius conjugates of the element, g as its roots, is called a characteristic polynomial.




  
    
      
        
          ∏
          i
        
        ⁢
        
          
        
        ⁢
        
          {
          
            X
            -
            
              
                π
                i
              
              ⁡
              
                (
                g
                )
              
            
          
          }
        
      
    
    
      
        (
        2
        )
      
    
  




The characteristic polynomial is an expression of degree n, which has a coefficient Fpm. If n=2, then, the characteristic polynomial is expressed as X2−Tr(g)X+1. If n=4, then the characteristic polynomial is expressed in Expression (3) below.

X4−Tr(g)X3+{Tr(gpm+1)+2}X2−Tr(g)X+1  (3)

If n=6, then the characteristic polynomial is expressed in Expression (4) below.

X6−Tr(g)X5+{Tr(gpm+1)+Tr(g)+3}X4−{Tr(g2)+2Tr(g)+2}X3+ . . . +1  (4)

Here, Tr(g)2=2Tr(gpm+1)+Tr(g2)+2Tr(g)+6. The quadratic coefficient of X is equal to the quartic coefficient of X, and the linear coefficient of X is equal to the quintic coefficient of X. Accordingly, the coefficients of the characteristic, polynomial are determined by the traces Tr(g) and Tr(gpm−1). Obtaining a root of the characteristic polynomial yields the element g and the conjugates of the element g in the extension field representation.
Next, a description will be given of the subgroup G±. The subgroup G± is a group where the number of elements is pm±√{square root over (pm+1)}+1. If m is an odd number, and n=4 and p=2 or n=6 and p=3, the subgroup G± is a subgroup of the algebraic torus Tn(Fpm).
The trace representation of the element g of the subgroup G± is expressed by the trace Tr(g). Since the element g of the subgroup G± is calculated as




  
    
      T
      ⁢
      
        
      
      ⁢
      
        r
        ⁡
        
          (
          
            g
            
              
                p
                m
              
              +
              2
            
          
          )
        
      
    
    =
    
      T
      ⁢
      
        
      
      ⁢
      
        r
        (
        
          g
          
            
              p
              
                m
                +
                2
              
            
          
        
        )
      
    
  
  ,




the coefficient of the characteristic polynomial is determined by the trace Tr(g) only.

Note that the trace map and the exponentiation of an exponent, which, is the exponentiation of the characteristic p, are exchanged.
When the trace representation is combined with the element g and the additional data, which is used to identify the conjugate of the element g, the trace Tr(g) is uniquely converted to the element g in the extension field representation by obtaining a root of the characteristic polynomial with the trace Tr(g).
To identify n conjugates, two-bit additional data is used for n=4, log2(6)-bit additional data is used for n=6, and log2(n)-bit additional data is generally used.
Next, a multiplication method in the trace representation will be described. The multiplication in the trace representation means calculating the multiplication value Tr(gh) and the additional data for the multiplication value Tr(gh), from the trace Tr(g), the additional data for the trace Tr(g), the trace Tr(h), and the additional data for Tr(h), without converting them to the extension field representation g and h.
Assume that the coefficients of the characteristic polynomial are determined by Tr(g) only. As for the subgroup of the algebraic torus Tn(Fpm), n possible multiplication values of Tr(πi(g)h) exist. Accordingly; the selecting unit 104 simply selects an appropriate multiplication value from n possible values using the additional data input.
In view of this, the coefficient calculating unit 102 first calculates coefficients of a polynomial, which has a root that is a possible value of the multiplication value, from Tr(g) and Tr(h). Then, the solving unit 103 obtains a root of the polynomial, and the selecting unit 104 selects the multiplication value from the obtained roots. Thus, the multiplication of Tr(g) and Tr(h) is configured.
The polynomial is an expression of degree n, which has a coefficient Fpm, and is simply solved with Fpm to obtain a root. On the other hand, the characteristic polynomial is also an expression of degree n, which has a coefficient Fpm. However, the characteristic polynomial needs to be solved in the large extension field F(pm)n to obtain a root for the element g of the algebraic torus Tn(Fpm). As the space of the solutions of the equation is narrower, the multiplication in the trace representation is faster than the case where the multiplication is performed after the conversion to the extension field representation.
If n=2, then the polynomial that has a roof that is a possible value of the multiplication value of the element g and the element h of the algebraic torus Tn(Fpm) is expressed as follows:

{Y=Tr(gh)}{Y−Tr(π(g)h)}=Y2−Tr(g)Tr(h)Y+{Tr(g)2+Tr(h)2−4}

The coefficients of (n−1) of Y are Tr(gh)+Tr(π(g)h)+ . . . +Tr(πn−1(g)h)=Tr(g)Tr(h), regardless of the value of n. As for a constant term, use of gpm+1=1 and hpm−1=1 yields Tr(gh)Tr(π(g)h)=Tr(g2)+Tr(h2). A recurrence equation of the trace obtained by the characteristic polynomial yields Tr(g2)=Tr(g)2−2 and Tr(h2)=Tr(h)2−2. Accordingly, the polynomial described above is obtained.
In view of this, the coefficient of the polynomial that has a root that is a possible value of the multiplication value is determined by the traces Tr(g) and Tr(h) only. Then, obtaining the root of the polynomial yields the possible value of the multiplication value.
In the following description, an exemplary recurrence equation will be described. Substituting g into X in the characteristic polynomial for n=2, X2−Tr(g)X+1=0, gives g2−Tr(g)g+1=0. The trace representation of this equation is expressed as Tr(g2)−Tr(g)2+2=0. Here, Tr(1)=2 is used. Accordingly, a recurrence equation, Tr(g2)=Tr(g)2−2, is obtained. Similarly, a recurrence equation is generally expressed as Tr(gi+1)=Tr(gi)Tr(g)−Tr(gi−1).
If n=4, the polynomial that has a root, that is a possible value of the multiplication value of the element g and the element h of the subgroup G± of the algebraic torus is expressed in Equation (5) below.




  
    
      
        
          
            
              {
              
                Y
                -
                
                  Tr
                  ⁡
                  
                    (
                    gh
                    )
                  
                
              
              }
            
            ⁢
            
              {
              
                Y
                -
                
                  Tr
                  ⁡
                  
                    (
                    
                      
                        π
                        ⁡
                        
                          (
                          g
                          )
                        
                      
                      ⁢
                      h
                    
                    )
                  
                
              
              }
            
            ⁢
            
              {
              
                Y
                -
                
                  Tr
                  ⁡
                  
                    (
                    
                      
                        
                          π
                          2
                        
                        ⁡
                        
                          (
                          g
                          )
                        
                      
                      ⁢
                      h
                    
                    )
                  
                
              
              }
            
            ⁢
            
              {
              
                Y
                -
                
                  Tr
                  ⁡
                  
                    (
                    
                      
                        
                          π
                          3
                        
                        ⁡
                        
                          (
                          g
                          )
                        
                      
                      ⁢
                      h
                    
                    )
                  
                
              
              }
            
          
          =
          
            
              Y
              4
            
            -
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              ⁢
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
              ⁢
              
                Y
                3
              
            
            +
            
              
                
                  d
                  2
                
                ⁡
                
                  (
                  
                    g
                    ,
                    h
                  
                  )
                
              
              ⁢
              
                Y
                2
              
            
            +
            
              
                
                  d
                  3
                
                ⁡
                
                  (
                  
                    g
                    ,
                    h
                  
                  )
                
              
              ⁢
              Y
            
            +
            
              
                d
                4
              
              ⁡
              
                (
                
                  g
                  ,
                  h
                
                )
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              d
              2
            
            ⁡
            
              (
              
                g
                ,
                h
              
              )
            
          
          =
          
            
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                2
              
              ⁢
              
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
                
                  
                    2
                    ⁢
                    
                      p
                      m
                    
                  
                
              
            
            +
            
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                
                  
                    2
                    ⁢
                    
                      p
                      m
                    
                  
                
              
              ⁢
              
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
                
                  
                    2
                    ⁢
                    
                      p
                      m
                    
                  
                
              
            
            +
            
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                
                  
                    2
                    ⁢
                    
                      p
                      m
                    
                  
                
              
              ⁢
              
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
                2
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              d
              3
            
            ⁡
            
              (
              
                g
                ,
                h
              
              )
            
          
          =
          
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              ⁢
              
                Tr
                ⁡
                
                  (
                  
                    h
                    3
                  
                  )
                
              
            
            +
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    3
                  
                  )
                
              
              ⁢
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
            
            +
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    
                      
                        p
                        m
                      
                      +
                      2
                    
                  
                  )
                
              
              ⁢
              
                Tr
                ⁡
                
                  (
                  
                    h
                    
                      
                        p
                        m
                      
                      +
                      2
                    
                  
                  )
                
              
            
            +
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    
                      
                        2
                        ⁢
                        
                          p
                          m
                        
                      
                      +
                      1
                    
                  
                  )
                
              
              ⁢
              
                Tr
                ⁡
                
                  (
                  
                    h
                    
                      
                        2
                        ⁢
                        
                          p
                          m
                        
                      
                      +
                      1
                    
                  
                  )
                
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              d
              4
            
            ⁡
            
              (
              
                g
                ,
                h
              
              )
            
          
          =
          
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              4
            
            +
            
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
              4
            
            +
            
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                2
              
              ⁢
              
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
                
                  2
                  ⁢
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
              
            
            +
            
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                
                  2
                  ⁢
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
              
              ⁢
              
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
                2
              
            
            +
            
              
                {
                
                  
                    
                      Tr
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    2
                  
                  +
                  
                    
                      Tr
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                    2
                  
                
                }
              
              ⁢
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                
                  
                    2
                    ⁢
                    
                      p
                      m
                    
                  
                
              
              ⁢
              
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
                
                  
                    2
                    ⁢
                    
                      p
                      m
                    
                  
                
              
            
          
        
      
    
    
      
        (
        5
        )
      
    
  




Here, the recurrence equation of the trace obtained by the characteristic polynomial yields Tr(g3)=Tr(g2)Tr(g)+Tr(gpm+1)Tr(g)+Tr(g). Due to Tr(g2)=Tr(g)2 and




  
    
      T
      ⁢
      
        
      
      ⁢
      
        r
        ⁡
        
          (
          
            g
            
              
                p
                m
              
              +
              1
            
          
          )
        
      
    
    =
    
      T
      ⁢
      
        
      
      ⁢
      
        
          r
          (
          g
          )
        
        
          
            p
            
              m
              +
              2
            
          
        
      
    
  
  ,




Tr(g3) is calculated from the trace Tr(g) only. Tr(h3) is also calculated similarly. The sum and the product of Tr(gpm+2) and Tr(g2pm+1) are expressed in Equation (6) below.





  
    
      
        
          
            
              
                
                  T
                  ⁢
                  
                    
                  
                  ⁢
                  
                    r
                    ⁡
                    
                      (
                      
                        g
                        
                          
                            p
                            m
                          
                          +
                          2
                        
                      
                      )
                    
                  
                
                +
                
                  T
                  ⁢
                  
                    
                  
                  ⁢
                  
                    r
                    ⁡
                    
                      (
                      
                        g
                        
                          
                            2
                            ⁢
                            
                              p
                              m
                            
                          
                          +
                          1
                        
                      
                      )
                    
                  
                
              
              =
              
                T
                ⁢
                
                  
                
                ⁢
                
                  r
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ⁢
                T
                ⁢
                
                  
                
                ⁢
                
                  
                    r
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
              
            
          
        
        
          
            
              
                T
                ⁢
                
                  
                
                ⁢
                
                  r
                  ⁡
                  
                    (
                    
                      g
                      
                        
                          p
                          m
                        
                        +
                        2
                      
                    
                    )
                  
                
                ⁢
                T
                ⁢
                
                  
                
                ⁢
                
                  r
                  ⁡
                  
                    (
                    
                      g
                      
                        
                          2
                          ⁢
                          
                            p
                            m
                          
                        
                        +
                        1
                      
                    
                    )
                  
                
              
              =
              
                
                  T
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      r
                      ⁡
                      
                        (
                        
                          g
                          3
                        
                        )
                      
                    
                    
                      
                        2
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                
                +
                
                  T
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      r
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    4
                  
                
                +
                
                  T
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      r
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    2
                  
                
                +
                
                  T
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      r
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    
                      
                        2
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                
              
            
          
        
      
    
    
      
        (
        6
        )
      
    
  




Tr(gpm+2) and Tr(g2pm−1) are calculated from the trace Tr(g) only, Tr(hpm+2) and Tr(h2pm+1) are also calculated similarly.
Accordingly, the coefficient of the polynomial that has a root that is a possible value of the multiplication value is determined by the traces Tr(g) and Tr(h) only. Then, obtaining the root of the polynomial yields the possible value of the multiplication value.
If n=6, then the polynomial that has a root that is a possible value of the multiplication value of the element g and the element h of the subgroup G± of the algebraic torus is expressed in Equation (7) to Equation (12) below.




  
    
      
        
          
            {
            
              Y
              -
              
                Tr
                ⁡
                
                  (
                  gh
                  )
                
              
            
            }
          
          ⁢
          
            {
            
              Y
              -
              
                Tr
                ⁡
                
                  (
                  
                    
                      π
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    ⁢
                    h
                  
                  )
                
              
            
            }
          
          ⁢
          
            {
            
              Y
              -
              
                Tr
                ⁡
                
                  (
                  
                    
                      
                        π
                        2
                      
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    ⁢
                    h
                  
                  )
                
              
            
            }
          
          ⁢
          
            {
            
              Y
              -
              
                Tr
                ⁡
                
                  (
                  
                    
                      
                        π
                        3
                      
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    ⁢
                    h
                  
                  )
                
              
            
            }
          
          ⁢
          
            {
            
              Y
              -
              
                Tr
                ⁡
                
                  (
                  
                    
                      
                        π
                        4
                      
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    ⁢
                    h
                  
                  )
                
              
            
            }
          
          ⁢
          
            {
            
              Y
              -
              
                Tr
                ⁡
                
                  (
                  
                    
                      
                        π
                        5
                      
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    ⁢
                    h
                  
                  )
                
              
            
            }
          
        
        =
        
          
            Y
            6
          
          -
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
            ⁢
            
              Y
              5
            
          
          +
          
            
              
                d
                2
              
              ⁡
              
                (
                
                  g
                  ,
                  h
                
                )
              
            
            ⁢
            
              Y
              4
            
          
          +
          
            
              
                d
                3
              
              ⁡
              
                (
                
                  g
                  ,
                  h
                
                )
              
            
            ⁢
            
              Y
              3
            
          
          +
          
            
              
                d
                4
              
              ⁡
              
                (
                
                  g
                  ,
                  h
                
                )
              
            
            ⁢
            
              Y
              2
            
          
          +
          
            
              
                d
                5
              
              ⁡
              
                (
                
                  g
                  ,
                  h
                
                )
              
            
            ⁢
            Y
          
          +
          
            
              d
              6
            
            ⁡
            
              (
              
                g
                ,
                h
              
              )
            
          
        
      
    
    
      
        (
        7
        )
      
    
  
  
    
      
        
          
            d
            2
          
          ⁡
          
            (
            
              g
              ,
              h
            
            )
          
        
        =
        
          
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              2
            
            ⁢
            
              {
              
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
                +
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
              
              }
            
          
          +
          
            
              {
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                +
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
              
              }
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              {
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                -
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
              
              }
            
            ⁢
            
              {
              
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
                -
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
              
              }
            
          
        
      
    
    
      
        (
        8
        )
      
    
  
  
    
      
        
          
            d
            3
          
          ⁡
          
            (
            
              g
              ,
              h
            
            )
          
        
        =
        
          
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              3
            
            ⁢
            
              {
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      2
                    
                    )
                  
                
                -
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
                -
                1
              
              }
            
          
          +
          
            
              {
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      2
                    
                    )
                  
                
                -
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                -
                1
              
              }
            
            ⁢
            
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
              3
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              {
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      
                        
                          p
                          m
                        
                        +
                        2
                      
                    
                    )
                  
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      
                        
                          p
                          m
                        
                        +
                        1
                      
                    
                    )
                  
                
              
              }
            
            ⁢
            
              {
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      2
                    
                    )
                  
                
                -
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
              
              }
            
          
          +
          
            
              {
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      2
                    
                    )
                  
                
                -
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
              
              }
            
            ⁢
            
              {
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      
                        
                          p
                          m
                        
                        +
                        2
                      
                    
                    )
                  
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      
                        
                          2
                          ⁢
                          
                            p
                            m
                          
                        
                        +
                        1
                      
                    
                    )
                  
                
              
              }
            
          
          +
          
            
              {
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      
                        
                          p
                          m
                        
                        +
                        2
                      
                    
                    )
                  
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      2
                    
                    )
                  
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
              
              }
            
            ⁢
            
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
          
          +
          
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
            ⁢
            
              {
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      
                        
                          p
                          m
                        
                        +
                        2
                      
                    
                    )
                  
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      2
                    
                    )
                  
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
              
              }
            
          
          -
          
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
            ⁢
            
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
        
      
    
    
      
        (
        9
        )
      
    
  
  
    
      
        
          
            d
            4
          
          ⁡
          
            (
            
              g
              ,
              h
            
            )
          
        
        =
        
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          -
          
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
          
          -
          
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
              3
            
          
          +
          
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              3
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              {
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  3
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      
                        
                          p
                          m
                        
                        +
                        2
                      
                    
                    )
                  
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      
                        
                          2
                          ⁢
                          
                            p
                            m
                          
                        
                        +
                        1
                      
                    
                    )
                  
                
              
              }
            
          
          +
          
            
              {
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  3
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      
                        
                          p
                          m
                        
                        +
                        2
                      
                    
                    )
                  
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      
                        
                          2
                          ⁢
                          
                            p
                            m
                          
                        
                        +
                        1
                      
                    
                    )
                  
                
              
              }
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
            ⁢
            
              {
              
                
                  -
                  
                    
                      Tr
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                    3
                  
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      
                        
                          p
                          m
                        
                        +
                        2
                      
                    
                    )
                  
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      
                        
                          p
                          m
                        
                        +
                        1
                      
                    
                    )
                  
                
              
              }
            
          
          +
          
            {
            
              
                -
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  2
                
              
              +
              
                Tr
                ⁡
                
                  (
                  
                    g
                    
                      
                        2
                        ⁢
                        
                          p
                          m
                        
                      
                      +
                      2
                    
                  
                  )
                
              
              +
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      
                        
                          2
                          ⁢
                          
                            p
                            m
                          
                        
                        +
                        1
                      
                    
                    )
                  
                
                ⁢
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
              
              +
              
                
                  {
                  
                    
                      Tr
                      ⁡
                      
                        (
                        
                          g
                          
                            
                              p
                              m
                            
                            +
                            2
                          
                        
                        )
                      
                    
                    +
                    
                      Tr
                      ⁡
                      
                        (
                        
                          g
                          
                            
                              p
                              m
                            
                            +
                            1
                          
                        
                        )
                      
                    
                  
                  }
                
                ⁢
                
                  {
                  
                    
                      Tr
                      ⁡
                      
                        (
                        
                          h
                          
                            
                              p
                              m
                            
                            +
                            2
                          
                        
                        )
                      
                    
                    +
                    
                      Tr
                      ⁡
                      
                        (
                        
                          h
                          
                            
                              2
                              ⁢
                              
                                p
                                m
                              
                            
                            +
                            1
                          
                        
                        )
                      
                    
                  
                  }
                
              
              -
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  3
                
                ⁢
                
                  {
                  
                    
                      Tr
                      ⁡
                      
                        (
                        
                          h
                          
                            
                              p
                              m
                            
                            +
                            2
                          
                        
                        )
                      
                    
                    +
                    
                      Tr
                      ⁡
                      
                        (
                        
                          h
                          
                            
                              2
                              ⁢
                              
                                p
                                m
                              
                            
                            +
                            1
                          
                        
                        )
                      
                    
                  
                  }
                
              
              -
              
                
                  {
                  
                    
                      Tr
                      ⁡
                      
                        (
                        
                          g
                          
                            
                              p
                              m
                            
                            +
                            2
                          
                        
                        )
                      
                    
                    +
                    
                      
                        Tr
                        (
                        )
                      
                      ⁢
                      
                        g
                        
                          
                            2
                            ⁢
                            
                              p
                              m
                            
                          
                          +
                          1
                        
                      
                    
                  
                  }
                
                ⁢
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  3
                
              
              +
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ⁢
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      4
                    
                    )
                  
                
              
              +
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      4
                    
                    )
                  
                
                ⁢
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
              
              +
              
                
                  {
                  
                    
                      -
                      
                        Tr
                        ⁡
                        
                          (
                          g
                          )
                        
                      
                    
                    +
                    
                      Tr
                      ⁡
                      
                        (
                        
                          g
                          2
                        
                        )
                      
                    
                  
                  }
                
                ⁢
                
                  {
                  
                    
                      Tr
                      ⁡
                      
                        (
                        
                          h
                          
                            
                              p
                              m
                            
                            +
                            2
                          
                        
                        )
                      
                    
                    +
                    
                      Tr
                      ⁡
                      
                        (
                        
                          h
                          
                            
                              2
                              ⁢
                              
                                p
                                m
                              
                            
                            +
                            1
                          
                        
                        )
                      
                    
                  
                  }
                
              
              +
              
                
                  {
                  
                    
                      Tr
                      ⁡
                      
                        (
                        
                          g
                          
                            
                              p
                              m
                            
                            +
                            3
                          
                        
                        )
                      
                    
                    +
                    
                      Tr
                      ⁡
                      
                        (
                        
                          g
                          
                            
                              3
                              ⁢
                              
                                p
                                m
                              
                            
                            +
                            1
                          
                        
                        )
                      
                    
                  
                  }
                
                ⁢
                
                  {
                  
                    
                      -
                      
                        Tr
                        ⁡
                        
                          (
                          h
                          )
                        
                      
                    
                    +
                    
                      Tr
                      ⁡
                      
                        (
                        
                          h
                          2
                        
                        )
                      
                    
                  
                  }
                
              
              +
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
                ⁢
                
                  {
                  
                    
                      Tr
                      ⁡
                      
                        (
                        
                          h
                          4
                        
                        )
                      
                    
                    -
                    
                      Tr
                      ⁡
                      
                        (
                        
                          h
                          
                            
                              3
                              ⁢
                              
                                p
                                m
                              
                            
                            +
                            3
                          
                        
                        )
                      
                    
                  
                  }
                
              
              -
              
                Tr
                ⁡
                
                  (
                  
                    h
                    
                      
                        3
                        ⁢
                        
                          p
                          m
                        
                      
                      +
                      1
                    
                  
                  )
                
              
            
            }
          
          +
          
            
              {
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      4
                    
                    )
                  
                
                -
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      
                        
                          p
                          m
                        
                        +
                        2
                      
                    
                    )
                  
                
                -
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      
                        
                          3
                          ⁢
                          
                            p
                            m
                          
                        
                        +
                        1
                      
                    
                    )
                  
                
              
              }
            
            ⁢
            
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
          
          +
          
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              3
            
            ⁢
            
              
                Tr
                ⁡
                
                  (
                  
                    h
                    2
                  
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
          
          +
          
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    2
                  
                  )
                
              
              
                
                  2
                  ⁢
                  
                    p
                    m
                  
                
              
            
            ⁢
            
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
              2
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
          
        
      
    
    
      
        (
        10
        )
      
    
  
  
    
      
        
          
            d
            5
          
          ⁡
          
            (
            
              g
              ,
              h
            
            )
          
        
        =
        
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  3
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  3
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  4
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  4
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  4
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  4
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  3
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  3
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  3
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    k
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  4
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  4
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  4
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  4
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            Tr
            ⁡
            
              (
              
                g
                
                  
                    2
                    ⁢
                    
                      p
                      m
                    
                  
                  +
                  2
                
              
              )
            
          
          +
          
            Tr
            ⁡
            
              (
              
                h
                
                  
                    p
                    m
                  
                  +
                  2
                
              
              )
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  6
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  5
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              (
              )
            
            ⁢
            
              h
              
                
                  p
                  m
                
                +
                4
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    4
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    4
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    4
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    4
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    4
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
        
      
    
    
      
        (
        11
        )
      
    
  
  
    
      
        
          
            d
            6
          
          ⁡
          
            (
            
              g
              ,
              h
            
            )
          
        
        =
        
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  3
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  3
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  3
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  3
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  3
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  4
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  4
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  4
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  4
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  4
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  4
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  3
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  3
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  3
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  3
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  4
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  4
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  5
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  6
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    4
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    4
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  5
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  5
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    6
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    4
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  5
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  5
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    4
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    4
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      
                        p
                        m
                      
                      +
                      1
                    
                    ⁢
                    
                      
                    
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  3
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  3
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    4
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    4
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    4
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    4
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    6
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    5
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    4
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    4
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      5
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      5
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  2
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    4
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    4
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      p
                      m
                    
                    +
                    1
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  3
                
                )
              
            
          
          +
          
            Tr
            ⁡
            
              (
              
                g
                6
              
              )
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  3
                
                )
              
            
          
          +
          
            Tr
            ⁡
            
              (
              
                h
                6
              
              )
            
          
          +
          
            2
            ⁢
            
              Tr
              ⁡
              
                (
                
                  h
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
        
      
    
    
      
        (
        12
        )
      
    
  




Here, Tr(g2)=Tr(g)2+Tr(gpm−1)+Tr(g) and Tr(gpm+1)=Tr(g)√{square root over (pm+1)}. Accordingly, Tr(g2) is calculated from the trace Tr(g) only. Tr(h2) is also calculated similarly.
As for a cubic term, the sum and the product of Tr(gpm+2) and Tr(g2pm+1) are expressed in Equation (13) below.




  
    
      
        
          
        
        ⁢
        
          
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    
                      
                        p
                        m
                      
                      +
                      2
                    
                  
                  )
                
              
              +
              
                Tr
                ⁡
                
                  (
                  
                    g
                    
                      
                        2
                        ⁢
                        
                          
                        
                        ⁢
                        
                          p
                          m
                        
                      
                      +
                      1
                    
                  
                  )
                
              
            
            =
            
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ⁢
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        
                      
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
              
              +
              
                Tr
                ⁡
                
                  (
                  
                    g
                    2
                  
                  )
                
              
              +
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
            
          
          ⁢
          
            

          
          ⁢
          
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    
                      
                        p
                        m
                      
                      +
                      2
                    
                  
                  )
                
              
              ⁢
              
                Tr
                ⁡
                
                  (
                  
                    g
                    
                      
                        2
                        ⁢
                        
                          
                        
                        ⁢
                        
                          p
                          m
                        
                      
                      +
                      1
                    
                  
                  )
                
              
            
            =
            
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                
                  3
                  ⁢
                  
                    
                      3
                      ⁢
                      
                        
                      
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
              
              +
              
                Tr
                ⁡
                
                  (
                  
                    g
                    5
                  
                  )
                
              
              +
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      2
                    
                    )
                  
                
                
                  
                    3
                    ⁢
                    
                      
                    
                    ⁢
                    
                      p
                      m
                    
                  
                
              
              +
              
                Tr
                ⁡
                
                  (
                  
                    g
                    4
                  
                  )
                
              
              +
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                
                  
                    3
                    ⁢
                    
                      
                    
                    ⁢
                    
                      p
                      m
                    
                  
                
              
              +
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
            
          
        
      
    
    
      
        (
        13
        )
      
    
  




Tr(gpm+2) and Tr(g2pm+1) are calculated from the trace Tr(g) only. The reason is that a recurrence equation of the trace obtained by the characteristic polynomial yields

Tr(g5)=Tr(g)Tr(g4)−{Tr(gpm+1)+Tr(g)}{Tr(g)3+Tr(g)}+{Tr(g2)Tr(g)−1}Tr(g2).

Tr(hpm+2) and Tr(h2pm+1) are calculated similarly.

As for a quartic term, the sum and the product of Tr(gpm+3) and Tr(g3pm+1) are expressed in Equation (14) below.




  
    
      
        
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
            +
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        
                      
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          =
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            +
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    2
                  
                  )
                
              
              ⁢
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                
                  
                    3
                    ⁢
                    
                      
                    
                    ⁢
                    
                      p
                      m
                    
                  
                
              
            
            -
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            -
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        
                      
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        
                      
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          =
          
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    4
                  
                  )
                
              
              
                
                  3
                  ⁢
                  
                    
                  
                  ⁢
                  
                    p
                    m
                  
                
              
            
            +
            
              Tr
              ⁡
              
                (
                
                  g
                  7
                
                )
              
            
            +
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              
                3
                ⁢
                
                  
                    3
                    ⁢
                    
                      
                    
                    ⁢
                    
                      p
                      m
                    
                  
                
              
            
            +
            
              Tr
              ⁡
              
                (
                
                  g
                  5
                
                )
              
            
            +
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              
                
                  3
                  ⁢
                  
                    
                  
                  ⁢
                  
                    p
                    m
                  
                
              
            
            +
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
          
        
      
    
    
      
        (
        14
        )
      
    
  




Tr(gpm+3) and Tr(g2pm+1) are calculated from the trace Tr(g) only. The reason is that a recurrence equation of the trace obtained by the characteristic polynomial yields

Tr(g7)=Tr(g){Tr(g6)+Tr(g2)}−{Tr(gpm+1)+Tr(g)}{Tr(g)5+Tr(g)3}+{Tr(g2)Tr(g)−1}Tr(g4)Tr(g)

Tr(hpm+1) and Tr(h3pm+1) are calculated similarly.

As for a quintic term, the sum and the product of Tr(gpm+4) and Tr(g4pm+1), and, the sum and the product of Tr(g2pm+3) and Tr(g3pm+2) are expressed in Equation (15) below.




  
    
      
        
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    4
                  
                
                )
              
            
            +
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          =
          
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
            +
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    2
                  
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
            +
            
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                3
              
              ⁢
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                
                  
                    3
                    ⁢
                    
                      p
                      m
                    
                  
                
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    4
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      4
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          =
          
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    5
                  
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
            +
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              9
            
            +
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    4
                  
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
            +
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    2
                  
                  )
                
              
              3
            
            +
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              3
            
            +
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          =
          
            
              -
              
                Tr
                ⁡
                
                  (
                  
                    g
                    
                      
                        p
                        m
                      
                      +
                      3
                    
                  
                  )
                
              
            
            -
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            -
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    2
                  
                
                )
              
            
            -
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            +
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              ⁢
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      2
                    
                    )
                  
                
                
                  
                    3
                    ⁢
                    
                      p
                      m
                    
                  
                
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
          
          =
          
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    5
                  
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
            +
            
              Tr
              ⁡
              
                (
                
                  g
                  6
                
                )
              
            
            +
            
              Tr
              ⁡
              
                (
                
                  g
                  7
                
                )
              
            
            +
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              
                3
                ⁢
                
                  
                    3
                    ⁢
                    
                      p
                      m
                    
                  
                
              
            
            +
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    2
                  
                  )
                
              
              
                
                  2
                  ⁢
                  
                    p
                    m
                  
                
              
            
            +
            
              Tr
              ⁡
              
                (
                g
                )
              
            
          
        
      
    
    
      
        (
        15
        )
      
    
  




Tr(gpm+4) and Tr(g4pm+1), and, Tr(g2pm+3) and Tr(g3pm+2) are calculated from the trace Tr(g) only. Tr(hpm+4) and Tr(h4pm+1), and, Tr(h2pm+3) and Tr(h3pm+2) are calculated similarly.
As for a sextic term, the sum and the product of Tr(gpm+5) and Tr(g5pm+1) are expressed in Equation (16) below.




  
    
      
        
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    5
                  
                
                )
              
            
            +
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      5
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          =
          
            
              -
              
                Tr
                ⁡
                
                  (
                  
                    g
                    
                      
                        p
                        m
                      
                      +
                      2
                    
                  
                  )
                
              
            
            -
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
            -
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    3
                  
                
                )
              
            
            -
            
              Tr
              ⁢
              
                (
                
                  g
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    2
                  
                
                )
              
            
            +
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    4
                  
                  )
                
              
              ⁢
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                
                  
                    3
                    ⁢
                    
                      p
                      m
                    
                  
                
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      p
                      m
                    
                    +
                    5
                  
                
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                
                  g
                  
                    
                      5
                      ⁢
                      
                        p
                        m
                      
                    
                    +
                    1
                  
                
                )
              
            
          
          =
          
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    2
                  
                  )
                
              
              
                3
                ⁢
                
                  
                    3
                    ⁢
                    
                      p
                      m
                    
                  
                
              
            
            +
            
              Tr
              ⁡
              
                (
                
                  g
                  11
                
                )
              
            
            +
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    5
                  
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
            +
            
              Tr
              ⁡
              
                (
                
                  g
                  7
                
                )
              
            
            +
            
              Tr
              ⁡
              
                (
                
                  g
                  4
                
                )
              
            
            +
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
          
        
      
    
    
      
        (
        16
        )
      
    
  




Tr(gpm+5) and Tr(gpm+1) are calculated from the trace Tr(g) only. The reason is that a recurrence equation of the trace obtained, by the characteristic polynomial yields

Tr(g11)=Tr(g){Tr(g10)+Tr(g2)3}−{Tr(gpm+1)+Tr(g)}{Tr(g)9+Tr(g)7}+{Tr(g2)Tr(g)−1}Tr(g8)Tr(g5)

Tr(hpm5) and Tr(h5pm+1) are calculated similarly.

The description above illustrates that the trace multiplication is possible. The procedure described above is summarized below.
The receiving unit 101 receives the trace Tr(g) and its additional data, and the trace Tr(h) and its additional data, as input. The coefficient calculating unit 102 calculates the coefficients d1(g, h)=Tr(g)Tr(h), d2(g, h), . . . , and dn(g, h) of the polynomial that has a root that is a possible value of the multiplication value, from, the trace Tr(g) and Tr(h). The solving unit 103 obtains a root of the above-described polynomial. The selecting unit 104 uses the additional data for the trace Tr(g) and the additional data for the trace Tr(h) in order to select one multiplication value from the n obtained roots. The determining unit 105 uses the additional data for the trace Tr(g) and the additional data for the trace Tr(h) to determine the additional data for the multiplication value.
Various methods may be employed to determine the additional data. The simplest example is a method to allocate the value of the additional data in ascending order or descending order, like 0, 1, 2, and n−1, depending on the magnitude relationship of conjugates in the extension field representation or the projective representation.
Among the conjugates in the extension field representation or the projective representation, let the smallest element be the basic element. This basic element raised to the poser of {pm}i may be the value of the additional data. In other case of the characteristic p=2, 3, the value of the additional data may be determined using values of {0, 1} or {0, 1, 2} of any element in the normal basis. The reason is that a quadratic equation and a cubic equation can be respectively solved by simple substitution of any element in the normal basis.
A quartic equation, which is a product of two quadratics, can be solved by solving a quadratic equation twice to obtain the solution. A sextic equation, which is a product of two cubics or a product of three quadratics, can be solved by solving a quadratic equation once and solving a cubic equation once to obtain the solution in any case.
Next, an example of selecting the multiplication value by the selecting unit 104 and determining the additional data for the multiplication value by the determining unit 105 will be described. First, the case of n=2 will be described.
If n=2, then the characteristic polynomial with respect to the element g of the algebraic torus Tn(Fpm) is expressed as follows.

X2−Tr(g)X+1

When the characteristic polynomial is equal to zero, and solving with respect to X, the extension field representation is expressed in Equation (17) below, using the trace and the additional data.




  
    
      
        g
        ,
        
          
            g
            
              p
              *
            
          
          =
          
            
              (
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ,
                ±
              
              )
            
            =
            
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                2
              
              ⁢
              
                
              
              ±
              
                
                  
                    
                      
                        Tr
                        ⁡
                        
                          (
                          g
                          )
                        
                      
                      2
                    
                    4
                  
                  -
                  1
                
              
            
          
        
      
    
    
      
        (
        17
        )
      
    
  




The results of multiplication after expansion are expressed in Equation (18) and Equation (19) below. It is necessary to note the double-sign correspondence.




  
    
      
        
          
            (
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              ,
              ±
            
            )
          
          ⁢
          
            (
            
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
              ,
              ±
            
            )
          
        
        =
        
          
            
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  2
                
                ⁢
                
                  
                
                ⁢
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  2
                
              
              ±
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  2
                
                ⁢
                
                  
                    
                      
                        
                          Tr
                          ⁡
                          
                            (
                            h
                            )
                          
                        
                        2
                      
                      4
                    
                    -
                    1
                  
                
              
            
            ±
            
              
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
                2
              
              ⁢
              
                
                  
                    
                      
                        Tr
                        ⁡
                        
                          (
                          g
                          )
                        
                      
                      2
                    
                    4
                  
                  -
                  1
                
              
            
          
          +
          
            
              
                
                  
                    
                      Tr
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    2
                  
                  4
                
                -
                1
              
            
            ⁢
            
              
                
                  
                    
                      Tr
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                    2
                  
                  4
                
                -
                1
              
            
          
        
      
    
    
      
        (
        18
        )
      
    
  
  
    
      
        
          
            (
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              ,
              ±
            
            )
          
          ⁢
          
            (
            
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
              ,
              ∓
            
            )
          
        
        =
        
          
            
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  2
                
                ⁢
                
                  
                
                ⁢
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  2
                
              
              ∓
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  2
                
                ⁢
                
                  
                    
                      
                        
                          Tr
                          ⁡
                          
                            (
                            h
                            )
                          
                        
                        2
                      
                      4
                    
                    -
                    1
                  
                
              
            
            ±
            
              
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
                2
              
              ⁢
              
                
                  
                    
                      
                        Tr
                        ⁡
                        
                          (
                          g
                          )
                        
                      
                      2
                    
                    4
                  
                  -
                  1
                
              
            
          
          -
          
            
              
                
                  
                    
                      Tr
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    2
                  
                  4
                
                -
                1
              
            
            ⁢
            
              
                
                  
                    
                      Tr
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                    2
                  
                  4
                
                -
                1
              
            
          
        
      
    
    
      
        (
        19
        )
      
    
  




The traces are expressed in Equation (20) and Equation (21) below.




  
    
      
        
          Tr
          ⁡
          
            (
            
              
                (
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  ,
                  ±
                
                )
              
              ⁢
              
                (
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  ,
                  ±
                
                )
              
            
            )
          
        
        =
        
          2
          [
          
            
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                2
              
              ⁢
              
                
              
              ⁢
              
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
                2
              
            
            +
            
              
                
                  
                    
                      
                        Tr
                        ⁡
                        
                          (
                          g
                          )
                        
                      
                      2
                    
                    4
                  
                  -
                  1
                
              
              ⁢
              
                
                  
                    
                      
                        Tr
                        ⁡
                        
                          (
                          h
                          )
                        
                      
                      2
                    
                    4
                  
                  -
                  1
                
              
            
          
          ]
        
      
    
    
      
        (
        20
        )
      
    
  
  
    
      
        
          Tr
          ⁡
          
            (
            
              
                (
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  ,
                  ±
                
                )
              
              ⁢
              
                (
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  ,
                  ∓
                
                )
              
            
            )
          
        
        =
        
          2
          ⁡
          
            [
            
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  2
                
                ⁢
                
                  
                
                ⁢
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  2
                
              
              -
              
                
                  
                    
                      
                        
                          Tr
                          ⁡
                          
                            (
                            g
                            )
                          
                        
                        2
                      
                      4
                    
                    -
                    1
                  
                
                ⁢
                
                  
                    
                      
                        
                          Tr
                          ⁡
                          
                            (
                            h
                            )
                          
                        
                        2
                      
                      4
                    
                    -
                    1
                  
                
              
            
            ]
          
        
      
    
    
      
        (
        21
        )
      
    
  




When the polynomial is equal to zero, solving this equation where its root is a possible value of the multiplication value with respect to Y yields Equation (22) below.




  
    
      
        
          Tr
          ⁡
          
            (
            gh
            )
          
        
        ,
        
          
            Tr
            ⁡
            
              (
              
                
                  g
                  
                    p
                    *
                  
                
                ⁢
                h
              
              )
            
          
          =
          
            2
            [
            
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  2
                
                ⁢
                
                  
                
                ⁢
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  2
                
              
              ±
              
                
                  
                    
                      
                        
                          Tr
                          ⁡
                          
                            (
                            g
                            )
                          
                        
                        2
                      
                      4
                    
                    -
                    1
                  
                
                ⁢
                
                  
                    
                      
                        
                          Tr
                          ⁡
                          
                            (
                            h
                            )
                          
                        
                        2
                      
                      4
                    
                    -
                    1
                  
                
              
            
            ]
          
        
      
    
    
      
        (
        22
        )
      
    
  




Accordingly, the selecting unit 104 simply selects a multiplication value with “+” in the case where the additional data for the trace Tr(g) and the additional data for the trace Tr(h) have the same sign, and selects a multiplication value with “−” in the case where the signs are different.
As for the additional data for the multiplication value, the extension field representation is expressed in Equation (23) below, using the trace and the additional data.




  
    
      
        qh
        ,
        
          
            
              q
              
                p
                m
              
            
            ⁢
            
              h
              
                p
                m
              
            
          
          =
          
            
              (
              
                
                  Tr
                  ⁡
                  
                    (
                    gh
                    )
                  
                
                ,
                ±
              
              )
            
            =
            
              
                
                  Tr
                  ⁡
                  
                    (
                    gh
                    )
                  
                
                2
              
              ±
              
                
                  
                    
                      
                        Tr
                        ⁡
                        
                          (
                          gh
                          )
                        
                      
                      2
                    
                    4
                  
                  -
                  1
                
              
            
          
        
      
    
    
      
        (
        23
        )
      
    
  




In the case where it is assumed to be Tr(gh)=Tr((Tr(g), ±)(Tr(h), ±)), the extension field representation is expressed in Equation (24) below.




  
    
      
        
          (
          
            
              Tr
              ⁡
              
                (
                gh
                )
              
            
            ,
            ±
          
          )
        
        =
        
          
            
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                2
              
              ⁢
              
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
                2
              
            
            +
            
              
                
                  
                    
                      
                        
                          Tr
                          ⁡
                          
                            (
                            g
                            )
                          
                        
                        2
                      
                      4
                    
                    -
                    1
                  
                
                ⁢
                
                  
                    
                      
                        
                          Tr
                          ⁡
                          
                            (
                            h
                            )
                          
                        
                        
                          2
                          ⁢
                          
                            
                          
                        
                      
                      4
                    
                    -
                    1
                  
                
              
              ±
              
                
                  
                    
                      
                        
                          
                            
                              
                                
                                  
                                    
                                      Tr
                                      ⁡
                                      
                                        (
                                        g
                                        )
                                      
                                    
                                    2
                                  
                                  4
                                
                                ⁢
                                
                                  {
                                  
                                    
                                      
                                        
                                          Tr
                                          ⁡
                                          
                                            (
                                            h
                                            )
                                          
                                        
                                        2
                                      
                                      4
                                    
                                    -
                                    1
                                  
                                  }
                                
                              
                              +
                            
                          
                        
                        
                          
                            
                              
                                2
                                ⁢
                                
                                  
                                    Tr
                                    ⁡
                                    
                                      (
                                      g
                                      )
                                    
                                  
                                  2
                                
                                ⁢
                                
                                  
                                    Tr
                                    ⁡
                                    
                                      (
                                      h
                                      )
                                    
                                  
                                  2
                                
                                ⁢
                                
                                  
                                    
                                      
                                        
                                          Tr
                                          ⁡
                                          
                                            (
                                            g
                                            )
                                          
                                        
                                        2
                                      
                                      4
                                    
                                    -
                                    1
                                  
                                
                                ⁢
                                
                                  
                                    
                                      
                                        
                                          Tr
                                          ⁡
                                          
                                            (
                                            h
                                            )
                                          
                                        
                                        2
                                      
                                      4
                                    
                                    -
                                    1
                                  
                                
                              
                              +
                            
                          
                        
                      
                    
                  
                  
                    
                      
                        
                          
                            
                              Tr
                              ⁡
                              
                                (
                                h
                                )
                              
                            
                            2
                          
                          4
                        
                        ⁢
                        
                          {
                          
                            
                              
                                
                                  Tr
                                  ⁡
                                  
                                    (
                                    g
                                    )
                                  
                                
                                2
                              
                              4
                            
                            -
                            1
                          
                          }
                        
                      
                    
                  
                
              
            
          
          =
          
            
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  2
                
                ⁢
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  2
                
              
              +
              
                
                  
                    
                      
                        
                          
                            Tr
                            ⁡
                            
                              (
                              g
                              )
                            
                          
                          2
                        
                        4
                      
                      -
                      1
                    
                  
                  ⁢
                  
                    
                      
                        
                          
                            Tr
                            ⁡
                            
                              (
                              h
                              )
                            
                          
                          2
                        
                        4
                      
                      -
                      1
                    
                  
                
                ⁢
                
                  
                
                ±
                
                  
                    
                      {
                      
                        
                          
                            
                              
                                
                                  
                                    Tr
                                    ⁡
                                    
                                      (
                                      g
                                      )
                                    
                                  
                                  2
                                
                                ⁢
                                
                                  
                                    
                                      
                                        
                                          Tr
                                          ⁡
                                          
                                            (
                                            h
                                            )
                                          
                                        
                                        2
                                      
                                      4
                                    
                                    -
                                    1
                                  
                                
                              
                              +
                            
                          
                        
                        
                          
                            
                              
                                
                                  Tr
                                  ⁡
                                  
                                    (
                                    h
                                    )
                                  
                                
                                2
                              
                              ⁢
                              
                                
                                  
                                    
                                      
                                        Tr
                                        ⁡
                                        
                                          (
                                          g
                                          )
                                        
                                      
                                      2
                                    
                                    4
                                  
                                  -
                                  1
                                
                              
                            
                          
                        
                      
                      }
                    
                    2
                  
                
              
            
            =
            
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  2
                
                ⁢
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  2
                
              
              +
              
                
                  
                    
                      
                        
                          
                            Tr
                            ⁡
                            
                              (
                              g
                              )
                            
                          
                          2
                        
                        4
                      
                      -
                      1
                    
                  
                  ⁢
                  
                    
                      
                        
                          
                            Tr
                            ⁡
                            
                              (
                              h
                              )
                            
                          
                          2
                        
                        4
                      
                      -
                      1
                    
                  
                
                ±
                
                  {
                  
                    
                      
                        
                          
                            
                              
                                Tr
                                ⁡
                                
                                  (
                                  g
                                  )
                                
                              
                              2
                            
                            ⁢
                            
                              
                                
                                  
                                    
                                      Tr
                                      ⁡
                                      
                                        (
                                        h
                                        )
                                      
                                    
                                    2
                                  
                                  4
                                
                                -
                                1
                              
                            
                          
                          +
                        
                      
                    
                    
                      
                        
                          
                            
                              Tr
                              ⁡
                              
                                (
                                h
                                )
                              
                            
                            2
                          
                          ⁢
                          
                            
                              
                                
                                  
                                    
                                      Tr
                                      ⁡
                                      
                                        (
                                        g
                                        )
                                      
                                    
                                    2
                                  
                                  4
                                
                                -
                                1
                              
                              ⁢
                              
                                
                              
                            
                          
                        
                      
                    
                  
                  }
                
              
            
          
        
      
    
    
      
        (
        24
        )
      
    
  




The determining unit 105 simply determines the additional data for Tr(gh) as “+” in the case where both of the additional data for the trace Tr(g) and the additional data for the trace Tr(h) are “+”, and determines that as “−” in the case where the both of them are “−”. The other multiplication value is expressed in Equation (25) below.




  
    
      
        
          (
          
            
              Tr
              ⁡
              
                (
                
                  
                    g
                    
                      p
                      m
                    
                  
                  ⁢
                  h
                
                )
              
            
            ,
            ±
          
          )
        
        =
        
          
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              2
            
            ⁢
            
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
              2
            
          
          -
          
            
              
                
                  
                    
                      
                        Tr
                        ⁡
                        
                          (
                          g
                          )
                        
                      
                      2
                    
                    4
                  
                  -
                  1
                
              
              ⁢
              
                
                  
                    
                      
                        Tr
                        ⁡
                        
                          (
                          h
                          )
                        
                      
                      2
                    
                    4
                  
                  -
                  1
                
              
            
            ±
            
              {
              
                
                  
                    
                      
                        
                          
                            Tr
                            ⁡
                            
                              (
                              g
                              )
                            
                          
                          2
                        
                        ⁢
                        
                          
                            
                              
                                
                                  Tr
                                  ⁡
                                  
                                    (
                                    h
                                    )
                                  
                                
                                2
                              
                              4
                            
                            -
                            1
                          
                        
                      
                      -
                    
                  
                
                
                  
                    
                      
                        
                          Tr
                          ⁡
                          
                            (
                            h
                            )
                          
                        
                        2
                      
                      ⁢
                      
                        
                          
                            
                              
                                Tr
                                ⁡
                                
                                  (
                                  g
                                  )
                                
                              
                              2
                            
                            4
                          
                          -
                          1
                        
                      
                    
                  
                
              
              }
            
          
        
      
    
    
      
        (
        25
        )
      
    
  




Since the additional data for the trace Tr(g) and the additional data for the trace Tr(h) differ from each other, the determining unit 105 may simply determine the additional data for the trace Tr(h) as the additional data for Tr(gh).
In the course of the discussion above, it is important to clearly specify how to determine two square roots. For example, with respect to a specific number of 5, when an equation yet √{square root over (52)}=5 holds, an equation √{square root over ((−5)2)}=5 should hold, and √{square root over ((−5)2)}=−5 should not hold. With, respect to an element of a finite field, when determining √{square root over (α2)}, for example, the smaller one of α and −α is selected.
Next, the case of n=4 will be described. Solving the equation of “the characteristic polynomial for n=4 is equal to zero” with respect to X yields extension field representations of an element g and Frobenius conjugates of the element g, using the trace and the additional data. A quartic characteristic polynomial is factored into two quadratics. Then, these two quadratic equations are solved twice. Note that the formula for the solution is not available because the characteristic p=2.
The characteristic polynomial is factored into Equation (26) below. Here, the trace map Tr4/2 is a map where π in the trace map Tr is replaced with π2. The sum with respect to i in the map is i=0, 1, . . . , and n/2−1.

{X2+Tr4/2(g)X+1}{X2+Tr4/2(g)pmX+1}  (26)

With respect to the first term described above, change of variables with X=Tr4/2(g)X′ yields the equation expressed in Equation (27) below. The solutions of the equation expressed in Equation (27) are obtained with no calculation cost in a normal basis. These two solutions are bit inversions, which may be distinguished with one bit.




  
    
      
        
          
            X
            
              ′
              ⁢
              
                
              
              ⁢
              2
            
          
          +
          
            X
            ′
          
          +
          
            1
            
              
                Tr
                
                  4
                  /
                  2
                
              
              ⁡
              
                (
                g
                )
              
            
          
        
        =
        0
      
    
    
      
        (
        27
        )
      
    
  




To solve the equation above, Tr4/2(g) needs to be obtained in advance. An equation where the solutions are Tr4/2(g) and Tr4/2(g)pm is expressed in Equation (28) below.




  
    
      
        
          
            Z
            2
          
          +
          
            T
            ⁢
            
              
            
            ⁢
            
              r
              ⁡
              
                (
                g
                )
              
            
            ⁢
            Z
          
          +
          
            T
            ⁢
            
              
            
            ⁢
            
              
                r
                ⁡
                
                  (
                  g
                  )
                
              
              
                
                  2
                  ⁢
                  
                    p
                    m
                  
                
              
            
          
        
        =
        0
      
    
    
      
        (
        28
        )
      
    
  




With respect to the equation above, change of variables with Z=Tr(g)Z′ yields the equation expressed in Equation (29) below. The solutions of the equation expressed in Equation (29) are also obtained with no calculation cost in a normal basis. These two solutions are bit inversions, which may be distinguished with one bit.




  
    
      
        
          
            Z
            
              ′
              ⁢
              
                
              
              ⁢
              2
            
          
          +
          
            Z
            ′
          
          +
          
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              
                
                  2
                  ⁢
                  
                    p
                    m
                  
                
              
            
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              
                2
                ⁢
                
                  
                
              
            
          
        
        =
        0
      
    
    
      
        (
        29
        )
      
    
  




Accordingly, the extension field representations of the element g and the Frobenius conjugates of the element g are expressed in Equation (30) below.




  
    
      
        g
        ,
        
          g
          
            p
            m
          
        
        ,
        
          g
          
            p
            
              2
              ⁢
              m
            
          
        
        ,
        
          
            g
            
              p
              
                3
                ⁢
                m
              
            
          
          =
          
            
              (
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ,
                
                  (
                  
                    
                      i
                      1
                    
                    ,
                    
                      i
                      2
                    
                  
                  )
                
              
              )
            
            =
            
              
                (
                
                  
                    
                      
                        i
                        2
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              ⁢
              
                (
                
                  
                    
                      
                        i
                        1
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              ⁢
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
            
          
        
      
    
    
      
        (
        30
        )
      
    
  




Here, the vector on the right side where the first component is i1 expresses the solution of the above-described equation with respect to Z′, and is the element of Fp2m. The vector on the left side where the first component is i2 expresses the solution of the above-described equation with respect to X′, and is the element of Fp4m. Each of i1 and i2 may be zero or one. Let (i1, i2)ε{0, 1}×{0, 1} be the additional data for Tr(g). The extension field representations of an element h and Frobenius conjugates of the element h are handled similarly.
The result of multiplication after expansion is expressed in Equation (31) below. Here, the notation for h is similar to the notation for g described above. Note that multiplication of an element of an extension field is commutative.




  
    
      
        
          
            (
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              ,
              
                (
                
                  
                    i
                    1
                  
                  ,
                  
                    i
                    2
                  
                
                )
              
            
            )
          
          ⁢
          
            (
            
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
              ,
              
                (
                
                  
                    j
                    1
                  
                  ,
                  
                    j
                    2
                  
                
                )
              
            
            )
          
        
        =
        
          
            (
            
              
                
                  
                    i
                    2
                  
                
              
              
                
                  ⋮
                
              
            
            )
          
          ⁢
          
            (
            
              
                
                  
                    i
                    1
                  
                
              
              
                
                  ⋮
                
              
            
            )
          
          ⁢
          
            (
            
              
                
                  
                    j
                    2
                  
                
              
              
                
                  ⋮
                
              
            
            )
          
          ⁢
          
            (
            
              
                
                  
                    j
                    1
                  
                
              
              
                
                  ⋮
                
              
            
            )
          
          ⁢
          
            Tr
            ⁡
            
              (
              g
              )
            
          
          ⁢
          
            Tr
            ⁡
            
              (
              h
              )
            
          
        
      
    
    
      
        (
        31
        )
      
    
  




When the polynomial is equal to zero, solving this equation where its root is a possible value of the multiplication value yields the possible value of the multiplication value. The quartic polynomial described above is then factored into two quadratics. These two quadratic equations are solved twice. Note that the equation for the solution is not available because the characteristic p=2. The polynomial described above is factored into Equation (32) below.




  
    
      
        
          {
          
            
              
                
                  
                    
                      
                        
                          Y
                          2
                        
                        +
                        
                          
                            (
                            
                              
                                
                                  
                                    
                                      
                                        
                                          Tr
                                          
                                            4
                                            /
                                            2
                                          
                                        
                                        ⁡
                                        
                                          (
                                          g
                                          )
                                        
                                      
                                      ⁢
                                      
                                        
                                          Tr
                                          
                                            4
                                            /
                                            2
                                          
                                        
                                        ⁡
                                        
                                          (
                                          h
                                          )
                                        
                                      
                                    
                                    +
                                  
                                
                              
                              
                                
                                  
                                    
                                      
                                        
                                          Tr
                                          
                                            4
                                            /
                                            2
                                          
                                        
                                        ⁡
                                        
                                          (
                                          g
                                          )
                                        
                                      
                                      
                                        p
                                        m
                                      
                                    
                                    ⁢
                                    
                                      
                                        
                                          Tr
                                          
                                            4
                                            /
                                            2
                                          
                                        
                                        ⁡
                                        
                                          (
                                          h
                                          )
                                        
                                      
                                      
                                        p
                                        m
                                      
                                    
                                  
                                
                              
                            
                            )
                          
                          ⁢
                          Y
                        
                        +
                      
                    
                  
                  
                    
                      
                        
                          
                            Tr
                            ⁡
                            
                              (
                              g
                              )
                            
                          
                          2
                        
                        +
                        
                          
                            Tr
                            ⁡
                            
                              (
                              h
                              )
                            
                          
                          2
                        
                        +
                      
                    
                  
                
              
            
            
              
                
                  
                    (
                    
                      
                        
                          
                            
                              
                                
                                  Tr
                                  
                                    4
                                    /
                                    2
                                  
                                
                                ⁡
                                
                                  (
                                  g
                                  )
                                
                              
                              ⁢
                              
                                
                                  
                                    Tr
                                    
                                      4
                                      /
                                      2
                                    
                                  
                                  ⁡
                                  
                                    (
                                    h
                                    )
                                  
                                
                                
                                  p
                                  m
                                
                              
                            
                            +
                          
                        
                      
                      
                        
                          
                            
                              
                                
                                  Tr
                                  
                                    4
                                    /
                                    2
                                  
                                
                                ⁡
                                
                                  (
                                  g
                                  )
                                
                              
                              
                                p
                                m
                              
                            
                            ⁢
                            
                              
                                Tr
                                
                                  4
                                  /
                                  2
                                
                              
                              ⁡
                              
                                (
                                h
                                )
                              
                            
                          
                        
                      
                    
                    )
                  
                  
                    
                      2
                      ⁢
                      
                        p
                        
                          m
                          ⁢
                          
                            
                          
                        
                      
                    
                  
                
              
            
          
          }
        
        ⁢
        
          

        
        ⁢
        
          {
          
            
              
                
                  
                    Y
                    2
                  
                  +
                  
                    
                      (
                      
                        
                          
                            
                              
                                
                                  
                                    Tr
                                    
                                      4
                                      /
                                      2
                                    
                                  
                                  ⁡
                                  
                                    (
                                    g
                                    )
                                  
                                
                                ⁢
                                
                                  
                                    
                                      Tr
                                      
                                        4
                                        /
                                        2
                                      
                                    
                                    ⁡
                                    
                                      (
                                      h
                                      )
                                    
                                  
                                  
                                    p
                                    
                                      m
                                      ⁢
                                      
                                        
                                      
                                    
                                  
                                
                              
                              +
                            
                          
                        
                        
                          
                            
                              
                                
                                  
                                    Tr
                                    
                                      4
                                      /
                                      2
                                    
                                  
                                  ⁡
                                  
                                    (
                                    g
                                    )
                                  
                                
                                
                                  p
                                  
                                    m
                                    ⁢
                                    
                                      
                                    
                                  
                                
                              
                              ⁢
                              
                                
                                  Tr
                                  
                                    4
                                    /
                                    2
                                  
                                
                                ⁡
                                
                                  (
                                  h
                                  )
                                
                              
                            
                          
                        
                      
                      )
                    
                    ⁢
                    Y
                  
                  +
                
              
            
            
              
                
                  
                    
                      Tr
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    2
                  
                  +
                  
                    
                      Tr
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                    2
                  
                  +
                  
                    
                      (
                      
                        
                          
                            
                              
                                
                                  
                                    Tr
                                    
                                      4
                                      /
                                      2
                                    
                                  
                                  ⁡
                                  
                                    (
                                    g
                                    )
                                  
                                
                                ⁢
                                
                                  
                                    Tr
                                    
                                      4
                                      /
                                      2
                                    
                                  
                                  ⁡
                                  
                                    (
                                    h
                                    )
                                  
                                
                              
                              +
                            
                          
                        
                        
                          
                            
                              
                                
                                  
                                    Tr
                                    
                                      4
                                      /
                                      2
                                    
                                  
                                  ⁡
                                  
                                    (
                                    g
                                    )
                                  
                                
                                
                                  p
                                  m
                                
                              
                              ⁢
                              
                                
                                  
                                    Tr
                                    
                                      4
                                      /
                                      2
                                    
                                  
                                  ⁡
                                  
                                    (
                                    h
                                    )
                                  
                                
                                
                                  p
                                  
                                    m
                                    ⁢
                                    
                                      
                                    
                                  
                                
                              
                            
                          
                        
                      
                      )
                    
                    
                      
                        
                          2
                          ⁢
                          
                            p
                            m
                          
                        
                      
                      ⁢
                      
                        
                      
                    
                  
                
              
            
          
          }
        
      
    
    
      
        (
        32
        )
      
    
  




To obtain the root of the above-described polynomial; Tr4/2(g)Tr4/2(h)+Tr4/2(g)pmTr4/2(h)pm and Tr4/2(g)Tr4/2(h)pm+Tr4/2(g)pmTr4/2(h) needs to be obtained in advance. An equation where these are the solutions is expressed in Equation (33) below.




  
    
      
        
          
            W
            2
          
          +
          
            T
            ⁢
            
              
            
            ⁢
            
              r
              ⁡
              
                (
                g
                )
              
            
            ⁢
            T
            ⁢
            
              
            
            ⁢
            
              r
              ⁡
              
                (
                h
                )
              
            
            ⁢
            W
          
          +
          
            T
            ⁢
            
              
            
            ⁢
            
              
                r
                ⁡
                
                  (
                  g
                  )
                
              
              2
            
            ⁢
            T
            ⁢
            
              
            
            ⁢
            
              
                r
                ⁡
                
                  (
                  h
                  )
                
              
              
                
                  2
                  ⁢
                  
                    p
                    m
                  
                
              
            
          
          +
          
            T
            ⁢
            
              
            
            ⁢
            
              
                r
                ⁡
                
                  (
                  g
                  )
                
              
              
                
                  2
                  ⁢
                  
                    p
                    m
                  
                
              
            
            ⁢
            T
            ⁢
            
              
            
            ⁢
            
              
                r
                ⁡
                
                  (
                  h
                  )
                
              
              2
            
          
        
        =
        0
      
    
    
      
        (
        33
        )
      
    
  




With respect to the above-described equation, change of variables with W=Tr(g)Tr(h)W′ yields the equation expressed in Equation (34) below. The solutions of the equation expressed in Equation (34) are also obtained with no calculation cost in a normal basis. These two solutions are bit inversions, which may be distinguished with one bit.




  
    
      
        
          
            W
            
              ′
              ⁢
              
                
              
              ⁢
              2
            
          
          +
          
            W
            ′
          
          +
          
            
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  2
                
                ⁢
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  
                    
                      2
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
              
              +
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      2
                      ⁢
                      
                        p
                        
                          m
                          ⁢
                          
                            
                          
                        
                      
                    
                  
                
                ⁢
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  2
                
              
            
            
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                2
              
              ⁢
              
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
                2
              
            
          
        
        =
        0
      
    
    
      
        (
        34
        )
      
    
  




With respect to the first term of the above-described polynomial with respect to Y, change of variables with

Y=(Tr4/2(g)Tr4/2(h)+Tr4/2(g)pmTr4/2(h)pm)Y′

yields the equation expressed in Equation (35) below. The solutions of the equation expressed in Equation (35) are also obtained with no calculation cost in a normal basis. These two solutions are bit inversions, which may be distinguished with one bit.





  
    
      
        
          
            Y
            
              ′
              ⁢
              
                
              
              ⁢
              2
            
          
          +
          
            Y
            ′
          
          +
          
            
              
                
                  
                    
                      
                        
                          Tr
                          ⁡
                          
                            (
                            g
                            )
                          
                        
                        2
                      
                      ⁢
                      
                        
                          Tr
                          ⁡
                          
                            (
                            h
                            )
                          
                        
                        2
                      
                    
                    +
                  
                
              
              
                
                  
                    
                      (
                      
                        
                          
                            Tr
                            
                              4
                              /
                              2
                            
                          
                          ⁡
                          
                            (
                            g
                            )
                          
                        
                        +
                        
                          
                            
                              Tr
                              
                                4
                                /
                                2
                              
                            
                            ⁡
                            
                              (
                              h
                              )
                            
                          
                          
                            p
                            m
                          
                        
                        +
                        
                          
                            
                              
                                Tr
                                
                                  4
                                  /
                                  2
                                
                              
                              ⁡
                              
                                (
                                g
                                )
                              
                            
                            
                              p
                              m
                            
                          
                          ⁢
                          
                            
                              Tr
                              
                                4
                                /
                                2
                              
                            
                            ⁡
                            
                              (
                              h
                              )
                            
                          
                        
                      
                      )
                    
                    
                      
                        2
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                
              
            
            
              
                (
                
                  
                    
                      
                        Tr
                        
                          4
                          /
                          2
                        
                      
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    ⁢
                    
                      
                        Tr
                        
                          4
                          /
                          2
                        
                      
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                  
                  +
                  
                    
                      
                        
                          Tr
                          
                            4
                            /
                            2
                          
                        
                        ⁡
                        
                          (
                          g
                          )
                        
                      
                      
                        p
                        m
                      
                    
                    ⁢
                    
                      
                        
                          Tr
                          
                            4
                            /
                            2
                          
                        
                        ⁡
                        
                          (
                          h
                          )
                        
                      
                      
                        p
                        m
                      
                    
                  
                
                )
              
              2
            
          
        
        =
        0
      
    
    
      
        (
        35
        )
      
    
  




Accordingly, the possible value of the multiplication value is expressed in Equation (36) below.




  
    
      
        
          Tr
          ⁡
          
            (
            gh
            )
          
        
        ,
        
          Tr
          ⁡
          
            (
            
              
                g
                
                  p
                  m
                
              
              ⁢
              h
            
            )
          
        
        ,
        
          Tr
          ⁡
          
            (
            
              
                g
                
                  p
                  
                    2
                    ⁢
                    m
                  
                
              
              ⁢
              h
            
            )
          
        
        ,
        
          

        
        ⁢
        
          
            Tr
            ⁡
            
              (
              
                
                  g
                  
                    p
                    
                      3
                      ⁢
                      m
                    
                  
                
                ⁢
                h
              
              )
            
          
          =
          
            
              (
              
                
                  
                    
                      l
                      2
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              (
              
                
                  
                    
                      l
                      1
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
          
        
      
    
    
      
        (
        36
        )
      
    
  




Here, the vector on the right side, which is represented by l1, expresses the solution of the above-described equation with respect to W′, and is the element of Fpm. The vector on the left side, which is represented by l2, expresses the solution of the above-described equation with respect to Y′, and is the element of Fpm. Each of l1 and l2 may be zero or one. In the case where a given (l1, l2) expresses the multiplication value Tr(gh), the extension field representation of the multiplication value is expressed in Equation (37) below, using the multiplication value and the additional data.




  
    
      
        
          (
          
            
              Tr
              ⁡
              
                (
                gh
                )
              
            
            ,
            
              (
              
                
                  k
                  1
                
                ,
                
                  k
                  2
                
              
              )
            
          
          )
        
        =
        
          
            (
            
              
                
                  
                    k
                    2
                  
                
              
              
                
                  ⋮
                
              
            
            )
          
          ⁢
          
            (
            
              
                
                  
                    k
                    1
                  
                
              
              
                
                  ⋮
                
              
            
            )
          
          ⁢
          
            (
            
              
                
                  
                    l
                    2
                  
                
              
              
                
                  ⋮
                
              
            
            )
          
          ⁢
          
            (
            
              
                
                  
                    l
                    1
                  
                
              
              
                
                  ⋮
                
              
            
            )
          
          ⁢
          
            Tr
            ⁡
            
              (
              g
              )
            
          
          ⁢
          
            Tr
            ⁡
            
              (
              h
              )
            
          
        
      
    
    
      
        (
        37
        )
      
    
  




Here, the vector that is represented by k2 expresses the solution of the equation with respect to Z′, and is the element of Fp2m. The vector that is represented by k2 expresses the solution of the equation with respect to X′, and is the element of Fp4m. Each of k1 and k2 may be zero or one. (k1, k2)ε{0, 1}×{0, 1} is the additional data for Tr(gh). The relation between an input of (i1, i2, j1, j2) and an output of (k1, k2, l1, l2) is expressed in Equation (38) below.




  
    
      
        
          
            gh
            
              
                Tr
                
                  4
                  /
                  2
                
              
              ⁡
              
                (
                gh
                )
              
            
          
          ⁢
          
            
              
                Tr
                
                  4
                  /
                  2
                
              
              ⁡
              
                (
                gh
                )
              
            
            
              Tr
              ⁡
              
                (
                gh
                )
              
            
          
          ⁢
          
            
              Tr
              ⁡
              
                (
                gh
                )
              
            
            
              
                
                  
                    Tr
                    
                      4
                      /
                      2
                    
                  
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ⁢
                
                  
                    Tr
                    
                      4
                      /
                      2
                    
                  
                  ⁡
                  
                    (
                    h
                    )
                  
                
              
              +
              
                
                  
                    
                      Tr
                      
                        4
                        /
                        2
                      
                    
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    p
                    m
                  
                
                ⁢
                
                  
                    
                      Tr
                      
                        4
                        /
                        2
                      
                    
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  
                    p
                    m
                  
                
              
            
          
          ⁢
          
            
              
                
                  
                    Tr
                    
                      4
                      /
                      2
                    
                  
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ⁢
                
                  
                    Tr
                    
                      4
                      /
                      2
                    
                  
                  ⁡
                  
                    (
                    h
                    )
                  
                
              
              +
              
                
                  
                    
                      Tr
                      
                        4
                        /
                        2
                      
                    
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    p
                    m
                  
                
                ⁢
                
                  
                    
                      Tr
                      
                        4
                        /
                        2
                      
                    
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  
                    p
                    m
                  
                
              
            
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              ⁢
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
            
          
        
        =
        
          
            
              g
              
                
                  Tr
                  
                    4
                    /
                    2
                  
                
                ⁡
                
                  (
                  g
                  )
                
              
            
            ⁢
            
              
                
                  Tr
                  
                    4
                    /
                    2
                  
                
                ⁡
                
                  (
                  g
                  )
                
              
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
            
            ⁢
            
              h
              
                
                  Tr
                  
                    4
                    /
                    2
                  
                
                ⁡
                
                  (
                  h
                  )
                
              
            
            ⁢
            
              
                
                  Tr
                  
                    4
                    /
                    2
                  
                
                ⁡
                
                  (
                  h
                  )
                
              
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
            
            ⁢
            
              (
              
                
                  
                    
                      k
                      2
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              (
              
                
                  
                    
                      k
                      1
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              (
              
                
                  
                    
                      l
                      2
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              (
              
                
                  
                    
                      l
                      1
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
          
          =
          
            
              (
              
                
                  
                    
                      i
                      2
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              (
              
                
                  
                    
                      i
                      1
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              (
              
                
                  
                    
                      j
                      2
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              (
              
                
                  
                    
                      j
                      1
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
          
        
      
    
    
      
        (
        38
        )
      
    
  




The solution of the equation with respect to W′ is expressed in Equation (39) below, using Tr4/2(g) and Tr4/2(h). Here, the addition symbol (+) denotes addition of the element of the finite field.




  
    
      
        
          
            (
            
              
                
                  
                    l
                    1
                  
                
              
              
                
                  ⋮
                
              
            
            )
          
          =
          
            
              
                (
                
                  
                    
                      
                        i
                        1
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              ⁢
              
                (
                
                  
                    
                      
                        j
                        1
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
            
            +
            
              
                (
                
                  
                    
                      
                        
                          i
                          1
                        
                        _
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              ⁢
              
                (
                
                  
                    
                      
                        
                          j
                          1
                        
                        _
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            (
            
              
                
                  
                    l
                    1
                  
                
              
              
                
                  ⋮
                
              
            
            )
          
          =
          
            
              
                (
                
                  
                    
                      
                        i
                        1
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              ⁢
              
                (
                
                  
                    
                      
                        
                          j
                          1
                        
                        _
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
            
            +
            
              
                (
                
                  
                    
                      
                        
                          i
                          1
                        
                        _
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              ⁢
              
                (
                
                  
                    
                      
                        
                          j
                          1
                        
                        _
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
            
          
        
      
    
    
      
        (
        39
        )
      
    
  




The solution of the equation with respect to Y′ is expressed in Equation (40) below, using g and h.




  
    
      
        
          
            (
            
              
                
                  
                    l
                    2
                  
                
              
              
                
                  ⋮
                
              
            
            )
          
          ⁢
          
            (
            
              
                
                  
                    l
                    1
                  
                
              
              
                
                  ⋮
                
              
            
            )
          
        
        =
        
          
            
              (
              
                
                  
                    
                      i
                      2
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              (
              
                
                  
                    
                      i
                      1
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              (
              
                
                  
                    
                      j
                      2
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              (
              
                
                  
                    
                      j
                      1
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
          
          +
          
            
              
                (
                
                  
                    
                      
                        i
                        2
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              
                p
                m
              
            
            ⁢
            
              (
              
                
                  
                    
                      
                        i
                        1
                      
                      _
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              
                (
                
                  
                    
                      
                        j
                        2
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              
                p
                m
              
            
            ⁢
            
              (
              
                
                  
                    
                      
                        j
                        1
                      
                      _
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
          
          +
          
            
              (
              
                
                  
                    
                      
                        i
                        2
                      
                      _
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              (
              
                
                  
                    
                      i
                      1
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              (
              
                
                  
                    
                      
                        j
                        2
                      
                      _
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              (
              
                
                  
                    
                      j
                      1
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
          
          +
          
            
              
                (
                
                  
                    
                      
                        
                          i
                          2
                        
                        _
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              
                p
                m
              
            
            ⁢
            
              (
              
                
                  
                    
                      
                        i
                        1
                      
                      _
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              
                (
                
                  
                    
                      
                        
                          j
                          2
                        
                        _
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              
                p
                m
              
            
            ⁢
            
              (
              
                
                  
                    
                      
                        j
                        1
                      
                      _
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
          
        
      
    
    
      
        (
        40
        )
      
    
  




Tr4/2(gh) and Tr4/2(gh)pm are expressed in Equation (41) below, using g and h.




  
    
      
        
          
            
              (
              
                
                  
                    
                      k
                      1
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              (
              
                
                  
                    
                      l
                      2
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              (
              
                
                  
                    
                      l
                      1
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
          
          =
          
            
              
                (
                
                  
                    
                      
                        i
                        2
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              ⁢
              
                (
                
                  
                    
                      
                        i
                        1
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              ⁢
              
                (
                
                  
                    
                      
                        j
                        2
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              ⁢
              
                (
                
                  
                    
                      
                        j
                        1
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
            
            +
            
              
                (
                
                  
                    
                      
                        
                          i
                          2
                        
                        _
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              ⁢
              
                (
                
                  
                    
                      
                        i
                        1
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              ⁢
              
                (
                
                  
                    
                      
                        
                          j
                          2
                        
                        _
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              ⁢
              
                (
                
                  
                    
                      
                        j
                        1
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              (
              
                
                  
                    
                      k
                      1
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              (
              
                
                  
                    
                      l
                      2
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
            ⁢
            
              (
              
                
                  
                    
                      l
                      1
                    
                  
                
                
                  
                    ⋮
                  
                
              
              )
            
          
          =
          
            
              
                
                  (
                  
                    
                      
                        
                          i
                          2
                        
                      
                    
                    
                      
                        ⋮
                      
                    
                  
                  )
                
                
                  p
                  m
                
              
              ⁢
              
                (
                
                  
                    
                      
                        
                          i
                          1
                        
                        _
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              ⁢
              
                
                  (
                  
                    
                      
                        
                          j
                          2
                        
                      
                    
                    
                      
                        ⋮
                      
                    
                  
                  )
                
                
                  p
                  m
                
              
              ⁢
              
                (
                
                  
                    
                      
                        
                          j
                          1
                        
                        _
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
            
            +
            
              
                
                  (
                  
                    
                      
                        
                          
                            i
                            2
                          
                          _
                        
                      
                    
                    
                      
                        ⋮
                      
                    
                  
                  )
                
                
                  p
                  m
                
              
              ⁢
              
                (
                
                  
                    
                      
                        
                          i
                          1
                        
                        _
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              ⁢
              
                
                  (
                  
                    
                      
                        
                          
                            j
                            2
                          
                          _
                        
                      
                    
                    
                      
                        ⋮
                      
                    
                  
                  )
                
                
                  p
                  m
                
              
              ⁢
              
                (
                
                  
                    
                      
                        
                          j
                          1
                        
                        _
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
            
          
        
      
    
    
      
        (
        41
        )
      
    
  




Accordingly, k2, k1, and l2 are expressed in Equation (42) below.




  
    
      
        
          
            (
            
              
                
                  
                    k
                    2
                  
                
              
              
                
                  ⋮
                
              
            
            )
          
          =
          
            
              
                (
                
                  
                    
                      
                        i
                        2
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              ⁢
              
                (
                
                  
                    
                      
                        j
                        2
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
            
            
              
                
                  (
                  
                    
                      
                        
                          i
                          2
                        
                      
                    
                    
                      
                        ⋮
                      
                    
                  
                  )
                
                ⁢
                
                  (
                  
                    
                      
                        
                          j
                          2
                        
                      
                    
                    
                      
                        ⋮
                      
                    
                  
                  )
                
              
              +
              
                
                  (
                  
                    
                      
                        
                          
                            i
                            2
                          
                          _
                        
                      
                    
                    
                      
                        ⋮
                      
                    
                  
                  )
                
                ⁢
                
                  (
                  
                    
                      
                        
                          
                            j
                            2
                          
                          _
                        
                      
                    
                    
                      
                        ⋮
                      
                    
                  
                  )
                
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            (
            
              
                
                  
                    k
                    1
                  
                
              
              
                
                  ⋮
                
              
            
            )
          
          =
          
            
              
                {
                
                  
                    
                      (
                      
                        
                          
                            
                              i
                              2
                            
                          
                        
                        
                          
                            ⋮
                          
                        
                      
                      )
                    
                    ⁢
                    
                      (
                      
                        
                          
                            
                              j
                              2
                            
                          
                        
                        
                          
                            ⋮
                          
                        
                      
                      )
                    
                  
                  +
                  
                    
                      (
                      
                        
                          
                            
                              
                                i
                                2
                              
                              _
                            
                          
                        
                        
                          
                            ⋮
                          
                        
                      
                      )
                    
                    ⁢
                    
                      (
                      
                        
                          
                            
                              
                                j
                                2
                              
                              _
                            
                          
                        
                        
                          
                            ⋮
                          
                        
                      
                      )
                    
                  
                
                }
              
              ⁢
              
                (
                
                  
                    
                      
                        i
                        1
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              ⁢
              
                (
                
                  
                    
                      
                        j
                        1
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
            
            
              
                
                  
                    
                      
                        {
                        
                          
                            
                              (
                              
                                
                                  
                                    
                                      i
                                      2
                                    
                                  
                                
                                
                                  
                                    ⋮
                                  
                                
                              
                              )
                            
                            ⁢
                            
                              (
                              
                                
                                  
                                    
                                      j
                                      2
                                    
                                  
                                
                                
                                  
                                    ⋮
                                  
                                
                              
                              )
                            
                          
                          +
                          
                            
                              (
                              
                                
                                  
                                    
                                      
                                        i
                                        2
                                      
                                      _
                                    
                                  
                                
                                
                                  
                                    ⋮
                                  
                                
                              
                              )
                            
                            ⁢
                            
                              (
                              
                                
                                  
                                    
                                      
                                        j
                                        2
                                      
                                      _
                                    
                                  
                                
                                
                                  
                                    ⋮
                                  
                                
                              
                              )
                            
                          
                        
                        }
                      
                      ⁢
                      
                        (
                        
                          
                            
                              
                                i
                                1
                              
                            
                          
                          
                            
                              ⋮
                            
                          
                        
                        )
                      
                      ⁢
                      
                        (
                        
                          
                            
                              
                                j
                                1
                              
                            
                          
                          
                            
                              ⋮
                            
                          
                        
                        )
                      
                    
                    +
                  
                
              
              
                
                  
                    
                      {
                      
                        
                          
                            
                              (
                              
                                
                                  
                                    
                                      i
                                      2
                                    
                                  
                                
                                
                                  
                                    ⋮
                                  
                                
                              
                              )
                            
                            
                              p
                              m
                            
                          
                          ⁢
                          
                            
                              (
                              
                                
                                  
                                    
                                      j
                                      2
                                    
                                  
                                
                                
                                  
                                    ⋮
                                  
                                
                              
                              )
                            
                            
                              p
                              m
                            
                          
                        
                        +
                        
                          
                            
                              (
                              
                                
                                  
                                    
                                      
                                        i
                                        2
                                      
                                      _
                                    
                                  
                                
                                
                                  
                                    ⋮
                                  
                                
                              
                              )
                            
                            
                              p
                              m
                            
                          
                          ⁢
                          
                            
                              (
                              
                                
                                  
                                    
                                      
                                        j
                                        2
                                      
                                      _
                                    
                                  
                                
                                
                                  
                                    ⋮
                                  
                                
                              
                              )
                            
                            
                              p
                              m
                            
                          
                        
                      
                      }
                    
                    ⁢
                    
                      (
                      
                        
                          
                            
                              
                                i
                                1
                              
                              _
                            
                          
                        
                        
                          
                            ⋮
                          
                        
                      
                      )
                    
                    ⁢
                    
                      (
                      
                        
                          
                            
                              
                                j
                                1
                              
                              _
                            
                          
                        
                        
                          
                            ⋮
                          
                        
                      
                      )
                    
                  
                
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            (
            
              
                
                  
                    l
                    2
                  
                
              
              
                
                  ⋮
                
              
            
            )
          
          =
          
            
              
                
                  
                    
                      
                        {
                        
                          
                            
                              (
                              
                                
                                  
                                    
                                      i
                                      2
                                    
                                  
                                
                                
                                  
                                    ⋮
                                  
                                
                              
                              )
                            
                            ⁢
                            
                              (
                              
                                
                                  
                                    
                                      j
                                      2
                                    
                                  
                                
                                
                                  
                                    ⋮
                                  
                                
                              
                              )
                            
                          
                          +
                          
                            
                              (
                              
                                
                                  
                                    
                                      
                                        i
                                        2
                                      
                                      _
                                    
                                  
                                
                                
                                  
                                    ⋮
                                  
                                
                              
                              )
                            
                            ⁢
                            
                              (
                              
                                
                                  
                                    
                                      
                                        j
                                        2
                                      
                                      _
                                    
                                  
                                
                                
                                  
                                    ⋮
                                  
                                
                              
                              )
                            
                          
                        
                        }
                      
                      ⁢
                      
                        (
                        
                          
                            
                              
                                i
                                1
                              
                            
                          
                          
                            
                              ⋮
                            
                          
                        
                        )
                      
                      ⁢
                      
                        (
                        
                          
                            
                              
                                j
                                1
                              
                            
                          
                          
                            
                              ⋮
                            
                          
                        
                        )
                      
                    
                    +
                  
                
              
              
                
                  
                    
                      {
                      
                        
                          
                            
                              (
                              
                                
                                  
                                    
                                      i
                                      2
                                    
                                  
                                
                                
                                  
                                    ⋮
                                  
                                
                              
                              )
                            
                            
                              p
                              m
                            
                          
                          ⁢
                          
                            
                              (
                              
                                
                                  
                                    
                                      j
                                      2
                                    
                                  
                                
                                
                                  
                                    ⋮
                                  
                                
                              
                              )
                            
                            
                              p
                              m
                            
                          
                        
                        +
                        
                          
                            
                              (
                              
                                
                                  
                                    
                                      
                                        i
                                        2
                                      
                                      _
                                    
                                  
                                
                                
                                  
                                    ⋮
                                  
                                
                              
                              )
                            
                            
                              p
                              m
                            
                          
                          ⁢
                          
                            
                              (
                              
                                
                                  
                                    
                                      
                                        j
                                        2
                                      
                                      _
                                    
                                  
                                
                                
                                  
                                    ⋮
                                  
                                
                              
                              )
                            
                            
                              p
                              m
                            
                          
                        
                      
                      }
                    
                    ⁢
                    
                      (
                      
                        
                          
                            
                              
                                i
                                1
                              
                              _
                            
                          
                        
                        
                          
                            ⋮
                          
                        
                      
                      )
                    
                    ⁢
                    
                      (
                      
                        
                          
                            
                              
                                j
                                1
                              
                              _
                            
                          
                        
                        
                          
                            ⋮
                          
                        
                      
                      )
                    
                  
                
              
            
            
              
                
                  (
                  
                    
                      
                        
                          i
                          1
                        
                      
                    
                    
                      
                        ⋮
                      
                    
                  
                  )
                
                ⁢
                
                  (
                  
                    
                      
                        
                          j
                          1
                        
                      
                    
                    
                      
                        ⋮
                      
                    
                  
                  )
                
              
              +
              
                
                  (
                  
                    
                      
                        
                          
                            i
                            1
                          
                          _
                        
                      
                    
                    
                      
                        ⋮
                      
                    
                  
                  )
                
                ⁢
                
                  (
                  
                    
                      
                        
                          
                            j
                            1
                          
                          _
                        
                      
                    
                    
                      
                        ⋮
                      
                    
                  
                  )
                
              
            
          
        
      
    
    
      
        (
        42
        )
      
    
  




Next, the case of n=6 will be described. In the case of n=6, when the characteristic polynomial is equal to 0, solving it with respect to X yields extension field representations of an element g and Frobenius conjugates elements of the element g, using the trace and the additional data. A sextic characteristic polynomial is factored into three quadratics. Then the quadratic equation is solved once, and then the cubic equation is solved once. Note that the cubic formula is not available because the characteristic p=3. The characteristic polynomial is factored as shown in Equation (43) below.

{X2−Tr6/3(g)X+1}{X2−Tr6/3(g)pmX+1}{X2−Tr6/3(g)p2mX+1}  (43)

Solving x2−Tr6/3(g)X−1=0 with respect to X yields the solution expressed in Equation (44) below.

X=−Tr6/3(g)±√{square root over (Tr6/3(g)2−1)}  (44)

To calculate X, which is described above, Tr6/3(g) needs to be obtained in advance. An equation where the solutions are Tr6/3(g), Tr6/3(g)pm, and Tr6/3(g)p2m is expressed in Equation (45) below.




  
    
      
        
          
            Z
            3
          
          -
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              Z
              2
            
          
          +
          
            
              {
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      2
                      ⁢
                      
                        
                      
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
              
              }
            
            ⁢
            Z
          
          -
          
            {
            
              
                Tr
                ⁡
                
                  (
                  
                    g
                    2
                  
                  )
                
              
              -
              1
            
            }
          
        
        =
        0
      
    
    
      
        (
        45
        )
      
    
  




With respect to the equation described above, change of variables with




  Z
  =
  
    
      
        -
        
          
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              5
            
            -
            
              
                TR
                ⁡
                
                  (
                  g
                  )
                
              
              
                
                  2
                  ⁢
                  
                    
                      3
                      ⁢
                      
                        
                      
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
                +
                2
              
            
            -
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              
                3
                +
                
                  
                    3
                    ⁢
                    
                      
                    
                    ⁢
                    
                      p
                      m
                    
                  
                
              
            
            +
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              
                3
                ⁢
                
                  
                    3
                    ⁢
                    
                      
                    
                    ⁢
                    
                      p
                      m
                    
                  
                
              
            
          
        
      
      /
      
        
          Tr
          ⁡
          
            (
            g
            )
          
        
        
          2
          ⁢
          
            
          
          ⁢
          
            Z
            ′
          
        
      
    
    -
    
      
        {
        
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            
              
                3
                ⁢
                
                  
                
                ⁢
                
                  p
                  m
                
              
            
          
          +
          
            Tr
            ⁡
            
              (
              g
              )
            
          
        
        }
      
      /
      
        Tr
        ⁡
        
          (
          g
          )
        
      
    
  




yields the equation expressed in Equation (46) below. The solutions of the equation expressed in Equation (46) are also obtained with no calculation cost in a normal basis. The three solutions are expressed such that zero is replaced with one, one is replaced with two, and two is replaced with zero, one another. Thus, the three solutions are distinguished with {0, 1, 2}.





  
    
      
        
          
            Z
            
              ′
              ⁢
              
                
              
              ⁢
              3
            
          
          +
          
            Z
            ′
          
          +
          
            
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  5
                
                -
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      2
                      ⁢
                      
                        
                          3
                          ⁢
                          
                            p
                            m
                          
                        
                      
                    
                    +
                    2
                  
                
                -
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    3
                    +
                    
                      
                        3
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                
                +
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    3
                    ⁢
                    
                      
                        3
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                
              
            
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              3
            
          
        
        =
        0
      
    
    
      
        (
        46
        )
      
    
  




The extension field representations of Tr6/3(g), Tr6/3(g)pm, and Tr6/3(g)p2m are expressed in Equation (47) below.




  
    
      
        
          
            Tr
            
              6
              /
              3
            
          
          ⁡
          
            (
            g
            )
          
        
        ,
        
          
            
              Tr
              
                6
                /
                3
              
            
            ⁡
            
              (
              g
              )
            
          
          
            p
            m
          
        
        ,
        
          
            
              
                Tr
                
                  6
                  /
                  3
                
              
              ⁡
              
                (
                g
                )
              
            
            
              p
              
                2
                ⁢
                m
              
            
          
          =
          
            
              -
              
                
                  
                    
                      
                        
                          
                            
                              Tr
                              ⁡
                              
                                (
                                g
                                )
                              
                            
                            5
                          
                          -
                          
                            
                              Tr
                              ⁡
                              
                                (
                                g
                                )
                              
                            
                            
                              
                                2
                                ⁢
                                
                                  
                                    3
                                    ⁢
                                    
                                      p
                                      m
                                    
                                  
                                
                              
                              +
                              2
                            
                          
                          -
                        
                      
                    
                    
                      
                        
                          
                            
                              Tr
                              ⁡
                              
                                (
                                g
                                )
                              
                            
                            
                              3
                              +
                              
                                
                                  3
                                  ⁢
                                  
                                    p
                                    m
                                  
                                
                              
                            
                          
                          +
                          
                            
                              Tr
                              ⁡
                              
                                (
                                g
                                )
                              
                            
                            
                              3
                              ⁢
                              
                                
                                  3
                                  ⁢
                                  
                                    p
                                    m
                                  
                                
                              
                            
                          
                        
                      
                    
                  
                
                
                  
                    (
                    
                      
                        
                          
                            i
                            1
                          
                        
                      
                      
                        
                          ⋮
                        
                      
                    
                    )
                  
                  ⁢
                  
                    
                      Tr
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    2
                  
                
              
            
            -
            
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
              
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
            
          
        
      
    
    
      
        (
        47
        )
      
    
  




Here, the vector that is represented by i1 expresses the solution of the above-described equation with respect to Z′, and is the element of Fp3m. The extension field representations of g and gp3m are expressed in Equation (48) below.

g,gp3m=−Tr6/3(g)±√{square root over (Tr6/3(g)2−1)}  (48)

Accordingly, the extension field representations of the element g and the Frobenius conjugates of the element g are expressed in Equation (49) below.




  
    
      
        g
        ,
        
          g
          
            p
            m
          
        
        ,
        
          
            g
            
              p
              
                2
                ⁢
                m
              
            
          
          ⁢
          
            g
            
              p
              
                3
                ⁢
                m
              
            
          
        
        ,
        
          
            
              g
              
                p
                
                  4
                  ⁢
                  m
                
              
            
            ⁢
            
              g
              
                p
                
                  5
                  ⁢
                  m
                
              
            
          
          =
          
            
              (
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ,
                
                  (
                  
                    
                      i
                      1
                    
                    ,
                    ±
                  
                  )
                
              
              )
            
            =
            
              
                
                  
                    
                      
                        
                          
                            
                              Tr
                              ⁡
                              
                                (
                                g
                                )
                              
                            
                            5
                          
                          -
                          
                            
                              Tr
                              ⁡
                              
                                (
                                g
                                )
                              
                            
                            
                              
                                2
                                ⁢
                                
                                  
                                    3
                                    ⁢
                                    
                                      p
                                      m
                                    
                                  
                                
                              
                              +
                              2
                            
                          
                          -
                        
                      
                    
                    
                      
                        
                          
                            
                              Tr
                              ⁡
                              
                                (
                                g
                                )
                              
                            
                            
                              3
                              +
                              
                                
                                  3
                                  ⁢
                                  
                                    p
                                    m
                                  
                                
                              
                            
                          
                          +
                          
                            
                              Tr
                              ⁡
                              
                                (
                                g
                                )
                              
                            
                            
                              3
                              ⁢
                              
                                
                                  3
                                  ⁢
                                  
                                    p
                                    m
                                  
                                
                              
                            
                          
                        
                      
                    
                  
                
                
                  
                    (
                    
                      
                        
                          
                            i
                            1
                          
                        
                      
                      
                        
                          ⋮
                        
                      
                    
                    )
                  
                  ⁢
                  
                    
                      Tr
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    2
                  
                
              
              +
              
                
                  
                    
                      
                        Tr
                        ⁡
                        
                          (
                          g
                          )
                        
                      
                      
                        
                          3
                          ⁢
                          
                            p
                            m
                          
                        
                      
                    
                    +
                    
                      Tr
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                  
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                
                ±
                
                  
                    
                      
                        {
                        
                          
                            
                              
                                
                                  
                                    
                                      
                                        
                                          Tr
                                          ⁡
                                          
                                            (
                                            g
                                            )
                                          
                                        
                                        5
                                      
                                      -
                                      
                                        
                                          Tr
                                          ⁡
                                          
                                            (
                                            g
                                            )
                                          
                                        
                                        
                                          
                                            2
                                            ⁢
                                            
                                              
                                                3
                                                ⁢
                                                
                                                  p
                                                  m
                                                
                                              
                                            
                                          
                                          +
                                          2
                                        
                                      
                                      -
                                    
                                  
                                
                                
                                  
                                    
                                      
                                        
                                          Tr
                                          ⁡
                                          
                                            (
                                            g
                                            )
                                          
                                        
                                        
                                          3
                                          +
                                          
                                            
                                              3
                                              ⁢
                                              
                                                p
                                                m
                                              
                                            
                                          
                                        
                                      
                                      +
                                      
                                        
                                          Tr
                                          ⁡
                                          
                                            (
                                            g
                                            )
                                          
                                        
                                        
                                          3
                                          ⁢
                                          
                                            
                                              3
                                              ⁢
                                              
                                                p
                                                m
                                              
                                            
                                          
                                        
                                      
                                    
                                  
                                
                              
                            
                            
                              
                                (
                                
                                  
                                    
                                      
                                        i
                                        1
                                      
                                    
                                  
                                  
                                    
                                      ⋮
                                    
                                  
                                
                                )
                              
                              ⁢
                              
                                
                                  Tr
                                  ⁡
                                  
                                    (
                                    g
                                    )
                                  
                                
                                2
                              
                            
                          
                          +
                          
                            
                              
                                
                                  Tr
                                  ⁡
                                  
                                    (
                                    g
                                    )
                                  
                                
                                
                                  
                                    3
                                    ⁢
                                    
                                      p
                                      m
                                    
                                  
                                
                              
                              +
                              
                                Tr
                                ⁡
                                
                                  (
                                  g
                                  )
                                
                              
                            
                            
                              Tr
                              ⁡
                              
                                (
                                g
                                )
                              
                            
                          
                        
                        }
                      
                      2
                    
                    -
                    1
                  
                
              
            
          
        
      
    
    
      
        (
        49
        )
      
    
  




The solution of the above-described equation with respect to X is the element of Fp6m, and distinguished with “±”. i1 may be zero, one, or two. Let (i1, i2)ε{0, 1, 2}×{+, −} be the additional data for Tr(g). The extension field representations of the element h and the Frobenius conjugates of the element h are handled similarly.
Assume that i1 expresses Tr6/3(g), and j1 expresses Tr6/3(h), the results of multiplication after expansion are expressed in Equation (50) below. It is necessary to note the double-sign correspondence.




  
    
      
        
          
            
              (
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ,
                
                  (
                  
                    
                      i
                      1
                    
                    ,
                    ±
                  
                  )
                
              
              )
            
            ⁢
            
              (
              
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
                ,
                
                  (
                  
                    
                      j
                      1
                    
                    ,
                    ±
                  
                  )
                
              
              )
            
          
          =
          
            
              
                
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  ⁢
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                
                ∓
                
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  ⁢
                  
                    
                      
                        
                          
                            Tr
                            
                              6
                              /
                              3
                            
                          
                          ⁡
                          
                            (
                            h
                            )
                          
                        
                        2
                      
                      -
                      1
                    
                  
                
              
              ∓
              
                
                  
                    Tr
                    
                      6
                      /
                      3
                    
                  
                  ⁡
                  
                    (
                    h
                    )
                  
                
                ⁢
                
                  
                    
                      
                        
                          Tr
                          
                            6
                            /
                            3
                          
                        
                        ⁡
                        
                          (
                          g
                          )
                        
                      
                      2
                    
                    -
                    1
                  
                
              
            
            +
            
              
                
                  
                    
                      
                        Tr
                        
                          6
                          /
                          3
                        
                      
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    2
                  
                  -
                  1
                
              
              ⁢
              
                
                  
                    
                      
                        Tr
                        
                          6
                          /
                          3
                        
                      
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                    2
                  
                  -
                  1
                
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              (
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ,
                
                  (
                  
                    
                      i
                      1
                    
                    ,
                    ±
                  
                  )
                
              
              )
            
            ⁢
            
              (
              
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
                ,
                
                  (
                  
                    
                      j
                      1
                    
                    ,
                    ∓
                  
                  )
                
              
              )
            
          
          =
          
            
              
                
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  ⁢
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                
                ±
                
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  ⁢
                  
                    
                      
                        
                          
                            Tr
                            
                              6
                              /
                              3
                            
                          
                          ⁡
                          
                            (
                            h
                            )
                          
                        
                        2
                      
                      -
                      1
                    
                  
                
              
              ±
              
                
                  
                    Tr
                    
                      6
                      /
                      3
                    
                  
                  ⁡
                  
                    (
                    h
                    )
                  
                
                ⁢
                
                  
                    
                      
                        
                          Tr
                          
                            6
                            /
                            3
                          
                        
                        ⁡
                        
                          (
                          g
                          )
                        
                      
                      2
                    
                    -
                    1
                  
                
              
            
            -
            
              
                
                  
                    
                      
                        Tr
                        
                          6
                          /
                          3
                        
                      
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    2
                  
                  -
                  1
                
              
              ⁢
              
                
                  
                    
                      
                        Tr
                        
                          6
                          /
                          3
                        
                      
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                    2
                  
                  -
                  1
                
              
            
          
        
      
    
    
      
        (
        50
        )
      
    
  




When the polynomial is equal to zero, solving this equation where its root is a possible value of the multiplication value yields the possible value of the multiplication value. A sextic polynomial above is factored into three quadratics. The quadratic equation is solved once and then the cubic equation is solved once. Note that the cubic formula is not available because the characteristic p=3. The polynomial above is factored into Equation (51) to Equation (53) below.




  
    
      
        
          
            {
            
              Y
              -
              
                Tr
                ⁡
                
                  (
                  gh
                  )
                
              
            
            }
          
          ⁢
          
            {
            
              Y
              -
              
                Tr
                ⁡
                
                  (
                  
                    
                      g
                      
                        p
                        
                          3
                          ⁢
                          m
                        
                      
                    
                    ⁢
                    h
                  
                  )
                
              
            
            }
          
        
        =
        
          
            Y
            2
          
          -
          
            
              
                Tr
                
                  3
                  /
                  1
                
              
              ⁡
              
                [
                
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  ⁢
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                
                ]
              
            
            ⁢
            Y
          
          +
          
            Tr
            ⁡
            
              (
              
                g
                2
              
              )
            
          
          +
          
            Tr
            ⁡
            
              (
              
                h
                2
              
              )
            
          
          +
          
            
              Tr
              
                3
                /
                1
              
            
            ⁡
            
              [
              
                
                  
                    Tr
                    
                      6
                      /
                      3
                    
                  
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ⁢
                
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  
                    
                      p
                      m
                    
                    ⁢
                    
                      
                        3
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                
              
              ]
            
          
          +
          
            
              Tr
              
                3
                /
                1
              
            
            ⁡
            
              [
              
                
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      p
                      m
                    
                    ⁢
                    
                      
                        3
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                
                ⁢
                
                  
                    Tr
                    
                      6
                      /
                      3
                    
                  
                  ⁡
                  
                    (
                    h
                    )
                  
                
              
              ]
            
          
        
      
    
    
      
        (
        51
        )
      
    
  
  
    
      
        
          
            {
            
              Y
              -
              
                Tr
                ⁡
                
                  (
                  
                    
                      g
                      
                        p
                        m
                      
                    
                    ⁢
                    h
                  
                  )
                
              
            
            }
          
          ⁢
          
            {
            
              Y
              -
              
                Tr
                ⁡
                
                  (
                  
                    
                      g
                      
                        p
                        
                          4
                          ⁢
                          m
                        
                      
                    
                    ⁢
                    h
                  
                  )
                
              
            
            }
          
        
        =
        
          
            Y
            2
          
          -
          
            
              
                Tr
                
                  3
                  /
                  1
                
              
              ⁡
              
                [
                
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  ⁢
                  
                    
                      
                        Tr
                        
                          6
                          /
                          3
                        
                      
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                    
                      p
                      
                        2
                        ⁢
                        m
                      
                    
                  
                
                ]
              
            
            ⁢
            Y
          
          +
          
            Tr
            ⁡
            
              (
              
                g
                2
              
              )
            
          
          +
          
            Tr
            ⁡
            
              (
              
                h
                2
              
              )
            
          
          +
          
            
              Tr
              
                3
                /
                1
              
            
            ⁡
            
              [
              
                
                  
                    Tr
                    
                      6
                      /
                      3
                    
                  
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ⁢
                
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
              
              ]
            
          
          +
          
            
              Tr
              
                3
                /
                1
              
            
            ⁡
            
              [
              
                
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      p
                      
                        2
                        ⁢
                        m
                      
                    
                    ⁢
                    
                      
                        3
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                
                ⁢
                
                  
                    Tr
                    
                      6
                      /
                      3
                    
                  
                  ⁡
                  
                    (
                    h
                    )
                  
                
              
              ]
            
          
        
      
    
    
      
        (
        52
        )
      
    
  
  
    
      
        
          
            {
            
              Y
              -
              
                Tr
                ⁡
                
                  (
                  
                    
                      g
                      
                        p
                        
                          2
                          ⁢
                          m
                        
                      
                    
                    ⁢
                    h
                  
                  )
                
              
            
            }
          
          ⁢
          
            {
            
              Y
              -
              
                Tr
                ⁡
                
                  (
                  
                    
                      g
                      
                        p
                        
                          5
                          ⁢
                          m
                        
                      
                    
                    ⁢
                    h
                  
                  )
                
              
            
            }
          
        
        =
        
          
            Y
            2
          
          -
          
            
              
                Tr
                
                  3
                  /
                  1
                
              
              ⁡
              
                [
                
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  ⁢
                  
                    
                      
                        Tr
                        
                          6
                          /
                          3
                        
                      
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                    
                      p
                      m
                    
                  
                
                ]
              
            
            ⁢
            Y
          
          +
          
            Tr
            ⁡
            
              (
              
                g
                2
              
              )
            
          
          +
          
            Tr
            ⁡
            
              (
              
                h
                2
              
              )
            
          
          +
          
            
              Tr
              
                3
                /
                1
              
            
            ⁡
            
              [
              
                
                  
                    Tr
                    
                      6
                      /
                      3
                    
                  
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ⁢
                
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  
                    
                      p
                      
                        2
                        ⁢
                        m
                      
                    
                    ⁢
                    
                      
                        3
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                
              
              ]
            
          
          +
          
            
              Tr
              
                3
                /
                1
              
            
            ⁡
            
              [
              
                
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
                ⁢
                
                  
                    Tr
                    
                      6
                      /
                      3
                    
                  
                  ⁡
                  
                    (
                    h
                    )
                  
                
              
              ]
            
          
        
      
    
    
      
        (
        53
        )
      
    
  




Here, this may be expressed in, for example, Equation (54).




  
    
      
        
          
            T
            ⁢
            
              
            
            ⁢
            
              r
              
                3
                /
                1
              
            
            ⁢
            
              ⌊
              
                T
                ⁢
                
                  
                
                ⁢
                
                  
                    r
                    
                      6
                      /
                      3
                    
                  
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ⁢
                T
                ⁢
                
                  
                
                ⁢
                
                  
                    
                      r
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  
                    
                      p
                      
                        2
                        ⁢
                        m
                      
                    
                    ⁢
                    
                      
                        3
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                
              
              ⌋
            
          
          +
          
            T
            ⁢
            
              
            
            ⁢
            
              r
              
                3
                /
                1
              
            
            ⁢
            
              ⌊
              
                T
                ⁢
                
                  
                
                ⁢
                
                  
                    
                      r
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
                ⁢
                T
                ⁢
                
                  
                
                ⁢
                
                  
                    r
                    
                      6
                      /
                      3
                    
                  
                  ⁡
                  
                    (
                    h
                    )
                  
                
              
              ⌋
            
          
        
        =
        
          
            T
            ⁢
            
              
            
            ⁢
            
              
                
                  r
                  
                    3
                    /
                    1
                  
                
                ⁡
                
                  [
                  
                    T
                    ⁢
                    
                      
                    
                    ⁢
                    
                      
                        r
                        
                          6
                          /
                          3
                        
                      
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    ⁢
                    T
                    ⁢
                    
                      
                    
                    ⁢
                    
                      
                        
                          r
                          
                            6
                            /
                            3
                          
                        
                        ⁡
                        
                          (
                          h
                          )
                        
                      
                      
                        p
                        m
                      
                    
                  
                  ]
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
          
          +
          
            T
            ⁢
            
              
            
            ⁢
            
              
                r
                ⁡
                
                  (
                  g
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
          
          +
          
            T
            ⁢
            
              
            
            ⁢
            
              
                r
                ⁡
                
                  (
                  h
                  )
                
              
              
                
                  3
                  ⁢
                  
                    p
                    m
                  
                
              
            
          
          +
          
            T
            ⁢
            
              
            
            ⁢
            
              r
              ⁡
              
                (
                g
                )
              
            
          
          +
          
            T
            ⁢
            
              
            
            ⁢
            
              r
              ⁡
              
                (
                h
                )
              
            
          
        
      
    
    
      
        (
        54
        )
      
    
  




Namely, in the case where the polynomial that has a root that is a possible value of the multiplication value is factored into three quadratics, Tr3/1[Tr6/3(g)Tr6/3(h)], Tr3/1[Tr6/3(g)Tr6/3(h)pm], and Tr3/1[Tr6/3(g)Tr6/3(h)p2m] need to be obtained in advance, in order to obtain the root. The equations that have these solutions are expressed in Equation (55) and Equation (56).




  
    
      
        
          
            W
            3
          
          -
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            ⁢
            
              
            
            ⁢
            
              Tr
              ⁡
              
                (
                h
                )
              
            
            ⁢
            
              W
              2
            
          
          +
          
            
              {
              
                
                  
                    
                      Tr
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    
                      
                        3
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                  ⁢
                  
                    
                      Tr
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                    
                      
                        3
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                
                +
                
                  
                    Tr
                    ⁡
                    
                      (
                      
                        g
                        2
                      
                      )
                    
                  
                  ⁢
                  
                    
                      Tr
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                    
                      
                        3
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                
                +
                
                  
                    
                      Tr
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    
                      
                        3
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                  ⁢
                  
                    Tr
                    ⁡
                    
                      (
                      
                        h
                        2
                      
                      )
                    
                  
                
                +
                
                  
                    Tr
                    ⁡
                    
                      (
                      
                        g
                        2
                      
                      )
                    
                  
                  ⁢
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                
                +
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  ⁢
                  
                    Tr
                    ⁡
                    
                      (
                      
                        h
                        2
                      
                      )
                    
                  
                
                +
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  ⁢
                  
                    
                      Tr
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                    
                      
                        3
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                
                +
                
                  
                    
                      Tr
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    
                      
                        3
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                  ⁢
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                
                +
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  ⁢
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                
              
              }
            
            ⁢
            W
          
          +
          c
        
        =
        0
      
    
    
      
        (
        55
        )
      
    
  
  
    
      
        c
        =
        
          -
          
            {
            
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      
                        2
                        +
                        
                          p
                          m
                        
                      
                    
                    )
                  
                
                ⁢
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      
                        2
                        +
                        
                          p
                          m
                        
                      
                    
                    )
                  
                
              
              +
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      
                        
                          2
                          ⁢
                          
                            p
                            m
                          
                        
                        +
                        1
                      
                    
                    )
                  
                
                ⁢
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      
                        
                          2
                          ⁢
                          
                            p
                            m
                          
                        
                        +
                        1
                      
                    
                    )
                  
                
              
              -
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                3
              
              -
              
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
                3
              
              +
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      
                        2
                        +
                        
                          p
                          m
                        
                      
                    
                    )
                  
                
                ⁢
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
              
              +
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
                ⁢
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      
                        2
                        +
                        
                          p
                          m
                        
                      
                    
                    )
                  
                
              
              +
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      
                        2
                        +
                        
                          p
                          m
                        
                        +
                        1
                      
                    
                    )
                  
                
                ⁢
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
              
              +
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
                ⁢
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      
                        
                          2
                          ⁢
                          
                            p
                            m
                          
                        
                        +
                        1
                      
                    
                    )
                  
                
              
              +
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  3
                
                ⁢
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      2
                    
                    )
                  
                
              
              +
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      2
                    
                    )
                  
                
                ⁢
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  3
                
              
              -
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      
                        2
                        +
                        
                          p
                          m
                        
                      
                    
                    )
                  
                
                ⁢
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
              
              -
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ⁢
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      
                        2
                        +
                        
                          p
                          m
                        
                      
                    
                    )
                  
                
              
              -
              
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      
                        
                          2
                          ⁢
                          
                            p
                            m
                          
                        
                        +
                        1
                      
                    
                    )
                  
                
                ⁢
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
              
              -
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ⁢
                
                  Tr
                  ⁡
                  
                    (
                    
                      h
                      
                        
                          2
                          ⁢
                          
                            p
                            m
                          
                        
                        +
                        1
                      
                    
                    )
                  
                
              
              -
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
                ⁢
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
              
              +
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
                ⁢
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
              
              +
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ⁢
                
                  
                    Tr
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                  
                    
                      3
                      ⁢
                      
                        p
                        m
                      
                    
                  
                
              
              -
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ⁢
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
              
            
            }
          
        
      
    
    
      
        (
        56
        )
      
    
  




As described above, the sum and the product of Tr(gpm+2) and Tr(g2pm+1) may be calculated from Tr(g). Namely, they may be obtained by calculating the solution of the quadratic equation expressed in Equation (57) below.




  
    
      
        
          
            V
            2
          
          -
          
            
              {
              
                
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  ⁢
                  
                    
                      Tr
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    
                      
                        3
                        ⁢
                        
                          
                        
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    
                      g
                      2
                    
                    )
                  
                
                +
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
              
              }
            
            ⁢
            V
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            
              3
              ⁢
              
                
                  3
                  ⁢
                  
                    
                  
                  ⁢
                  
                    p
                    m
                  
                
              
            
          
          +
          
            Tr
            ⁡
            
              (
              
                g
                5
              
              )
            
          
          +
          
            
              Tr
              ⁡
              
                (
                
                  g
                  2
                
                )
              
            
            
              
                3
                ⁢
                
                  
                
                ⁢
                
                  p
                  m
                
              
            
          
          +
          
            Tr
            ⁡
            
              (
              
                g
                4
              
              )
            
          
          +
          
            
              Tr
              ⁡
              
                (
                g
                )
              
            
            
              
                3
                ⁢
                
                  
                
                ⁢
                
                  p
                  m
                
              
            
          
          +
          
            Tr
            ⁡
            
              (
              g
              )
            
          
        
        =
        0
      
    
    
      
        (
        57
        )
      
    
  




Tr(hpm+2) and Tr(h2pm+1) may be handled similarly. Change of variables in the cubic equation with respect to W is made such that the solution is obtained with no calculation cost in a normal basis. With respect to W, let b be the linear coefficient. Change of variables with W=−√{square root over (●)}/{Tr(g)2Tr(h)2W′}−b/{Tr(g)Tr(h)} yields the equation expressed in Equation (58) below. The three solutions are expressed such that, zero is replaced with one, one is replaced with two, and two is replaced with zero, one another. Thus, the three solutions are distinguished with {0, 1, 2}.




  
    
      
        
          
            
              
                W
                ′3
              
              +
              
                W
                ′
              
              +
              
                
                  •
                
                
                  
                    
                      Tr
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    3
                  
                  ⁢
                  
                    
                      Tr
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                    3
                  
                
              
            
            =
            0
          
          ⁢
          
            

          
          ⁢
          •
        
        =
        
          
            b
            3
          
          -
          
            
              
                 
                Trg
                )
              
              2
            
            ⁢
            
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
              2
            
            ⁢
            
              b
              2
            
          
          -
          
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              3
            
            ⁢
            
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
              3
            
            ⁢
            c
          
        
      
    
    
      
        (
        58
        )
      
    
  




The extension field representations of




  
    
      
        
          
        
        ⁢
        
          
            
              
                Tr
                
                  3
                  /
                  1
                
              
              ⁡
              
                [
                
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  ⁢
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      h
                      )
                    
                  
                
                ]
              
            
            ,
            
              
                Tr
                
                  3
                  /
                  1
                
              
              ⁡
              
                [
                
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  ⁢
                  
                    
                      
                        Tr
                        
                          6
                          /
                          3
                        
                      
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                    
                      p
                      m
                    
                  
                
                ]
              
            
            ,
            
              

            
            ⁢
            
              
            
            ⁢
            and
          
          ⁢
          
            

          
          ⁢
          
            
              
                
                  Tr
                  
                    3
                    /
                    1
                  
                
                ⁡
                
                  [
                  
                    
                      
                        Tr
                        
                          6
                          /
                          3
                        
                      
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    ⁢
                    
                      
                        
                          Tr
                          
                            6
                            /
                            3
                          
                        
                        ⁡
                        
                          (
                          h
                          )
                        
                      
                      
                        p
                        
                          2
                          ⁢
                          m
                        
                      
                    
                  
                  ]
                
              
              ⁢
              
                
              
              ⁢
              are
              ⁢
              
                
              
              ⁢
              expressed
              ⁢
              
                
              
              ⁢
              in
              ⁢
              
                
              
              ⁢
              Equation
              ⁢
              
                
              
              ⁢
              
                (
                59
                )
              
              ⁢
              
                
              
              ⁢
              
                below
                .
                
                  

                
                ⁢
                
                  
                    Tr
                    
                      3
                      /
                      1
                    
                  
                  ⁡
                  
                    [
                    
                      
                        
                          Tr
                          
                            6
                            /
                            3
                          
                        
                        ⁡
                        
                          (
                          g
                          )
                        
                      
                      ⁢
                      
                        
                      
                      ⁢
                      
                        
                          Tr
                          
                            6
                            /
                            3
                          
                        
                        ⁡
                        
                          (
                          h
                          )
                        
                      
                    
                    ]
                  
                
              
            
            ,
            
              
                Tr
                
                  3
                  /
                  1
                
              
              ⁢
              
                ⌊
                
                  
                    
                      Tr
                      
                        6
                        /
                        3
                      
                    
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                  ⁢
                  
                    
                  
                  ⁢
                  
                    
                      
                        Tr
                        
                          6
                          /
                          3
                        
                      
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                    
                      p
                      m
                    
                  
                
                ⌋
              
            
            ,
            
              
                
                  Tr
                  
                    3
                    /
                    1
                  
                
                ⁢
                
                  ⌊
                  
                    
                      
                        Tr
                        
                          6
                          /
                          3
                        
                      
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    ⁢
                    
                      
                    
                    ⁢
                    
                      
                        
                          Tr
                          
                            6
                            /
                            3
                          
                        
                        ⁡
                        
                          (
                          h
                          )
                        
                      
                      
                        p
                        
                          2
                          ⁢
                          m
                        
                      
                    
                  
                  ⌋
                
              
              =
              
                
                  -
                  
                    
                      •
                    
                    
                      
                        (
                        
                          
                            
                              
                                l
                                1
                              
                            
                          
                          
                            
                              ⋮
                            
                          
                        
                        )
                      
                      ⁢
                      
                        
                          Tr
                          ⁡
                          
                            (
                            g
                            )
                          
                        
                        2
                      
                      ⁢
                      
                        
                          Tr
                          ⁡
                          
                            (
                            h
                            )
                          
                        
                        2
                      
                    
                  
                
                -
                
                  b
                  
                    
                      Tr
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    ⁢
                    
                      Tr
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                  
                
              
            
          
        
      
    
    
      
        (
        59
        )
      
    
  




Here, the vector that is represented by l1 expresses the solution of the above-described equation with respect to W′, and is the element of Fp3m. The possible values of the multiplication values Tr(gh) and Tr(g33mh) are expressed in Equation (60) below.




  
    
      
        
          Tr
          ⁡
          
            (
            gh
            )
          
        
        ,
        
          
            Tr
            ⁡
            
              (
              
                
                  g
                  
                    p
                    
                      3
                      ⁢
                      m
                    
                  
                
                ⁢
                h
              
              )
            
          
          =
          
            
              -
              
                
                  Tr
                  
                    3
                    /
                    1
                  
                
                ⁡
                
                  [
                  
                    
                      
                        Tr
                        
                          6
                          /
                          3
                        
                      
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    ⁢
                    
                      
                    
                    ⁢
                    
                      
                        Tr
                        
                          6
                          /
                          3
                        
                      
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                  
                  ]
                
              
            
            ±
            
              
                
                  
                    
                      
                        
                          
                            Tr
                            
                              3
                              /
                              1
                            
                          
                          ⁡
                          
                            [
                            
                              
                                
                                  Tr
                                  
                                    6
                                    /
                                    3
                                  
                                
                                ⁡
                                
                                  (
                                  g
                                  )
                                
                              
                              ⁢
                              
                                
                              
                              ⁢
                              
                                
                                  Tr
                                  
                                    6
                                    /
                                    3
                                  
                                
                                ⁡
                                
                                  (
                                  h
                                  )
                                
                              
                            
                            ]
                          
                        
                        2
                      
                      -
                    
                  
                
                
                  
                    
                      
                        
                          
                            Tr
                            
                              3
                              /
                              1
                            
                          
                          ⁡
                          
                            [
                            
                              
                                
                                  Tr
                                  
                                    6
                                    /
                                    3
                                  
                                
                                ⁡
                                
                                  (
                                  g
                                  )
                                
                              
                              ⁢
                              
                                
                              
                              ⁢
                              
                                
                                  Tr
                                  
                                    6
                                    /
                                    3
                                  
                                
                                ⁡
                                
                                  (
                                  h
                                  )
                                
                              
                            
                            ]
                          
                        
                        
                          
                            3
                            ⁢
                            
                              p
                              m
                            
                          
                        
                      
                      -
                    
                  
                
                
                  
                    
                      
                        
                          Tr
                          ⁡
                          
                            (
                            g
                            )
                          
                        
                        2
                      
                      -
                      
                        
                          Tr
                          ⁡
                          
                            (
                            h
                            )
                          
                        
                        2
                      
                    
                  
                
              
            
          
        
      
    
    
      
        (
        60
        )
      
    
  




Accordingly, the possible value of the multiplication value is expressed in Equation (61) below.




  
    
      
        
          Tr
          ⁡
          
            (
            gh
            )
          
        
        ,
        
          Tr
          ⁡
          
            (
            
              
                g
                
                  p
                  m
                
              
              ⁢
              h
            
            )
          
        
        ,
        
          Tr
          ⁡
          
            (
            
              
                g
                
                  p
                  
                    2
                    ⁢
                    m
                  
                
              
              ⁢
              h
            
            )
          
        
        ,
        
          Tr
          ⁢
          
            (
            
              
                g
                
                  p
                  
                    3
                    ⁢
                    m
                  
                
              
              ⁢
              h
            
            )
          
        
        ,
        
          Tr
          ⁢
          
            (
            
              
                g
                
                  p
                  
                    4
                    ⁢
                    m
                  
                
              
              ⁢
              h
            
            )
          
        
        ,
        
          
            Tr
            ⁢
            
              (
              
                
                  g
                  
                    p
                    
                      5
                      ⁢
                      m
                    
                  
                
                ⁢
                h
              
              )
            
          
          =
          
            
              -
              
                
                  •
                
                
                  
                    (
                    
                      
                        
                          
                            l
                            1
                          
                        
                      
                      
                        
                          ⋮
                        
                      
                    
                    )
                  
                  ⁢
                  
                    
                      Tr
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    2
                  
                  ⁢
                  
                    
                      Tr
                      ⁡
                      
                        (
                        h
                        )
                      
                    
                    2
                  
                
              
            
            +
            
              b
              
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
                ⁢
                
                  Tr
                  ⁡
                  
                    (
                    h
                    )
                  
                
              
            
            +
            
              
                l
                2
              
              ⁢
              
                
                  
                    
                      
                        
                          
                            {
                            
                              
                                
                                  •
                                
                                
                                  
                                    (
                                    
                                      
                                        
                                          
                                            l
                                            1
                                          
                                        
                                      
                                      
                                        
                                          ⋮
                                        
                                      
                                    
                                    )
                                  
                                  ⁢
                                  
                                    
                                      Tr
                                      ⁡
                                      
                                        (
                                        g
                                        )
                                      
                                    
                                    2
                                  
                                  ⁢
                                  
                                    
                                      Tr
                                      ⁡
                                      
                                        (
                                        h
                                        )
                                      
                                    
                                    2
                                  
                                
                              
                              +
                              
                                b
                                
                                  
                                    Tr
                                    ⁡
                                    
                                      (
                                      g
                                      )
                                    
                                  
                                  ⁢
                                  
                                    Tr
                                    ⁡
                                    
                                      (
                                      h
                                      )
                                    
                                  
                                
                              
                            
                            }
                          
                          2
                        
                        +
                      
                    
                  
                  
                    
                      
                        
                          
                            {
                            
                              
                                
                                  •
                                
                                
                                  
                                    (
                                    
                                      
                                        
                                          
                                            l
                                            1
                                          
                                        
                                      
                                      
                                        
                                          ⋮
                                        
                                      
                                    
                                    )
                                  
                                  ⁢
                                  
                                    
                                      Tr
                                      ⁡
                                      
                                        (
                                        g
                                        )
                                      
                                    
                                    2
                                  
                                  ⁢
                                  
                                    
                                      Tr
                                      ⁡
                                      
                                        (
                                        h
                                        )
                                      
                                    
                                    2
                                  
                                
                              
                              +
                              
                                b
                                
                                  
                                    Tr
                                    ⁡
                                    
                                      (
                                      g
                                      )
                                    
                                  
                                  ⁢
                                  
                                    Tr
                                    ⁡
                                    
                                      (
                                      h
                                      )
                                    
                                  
                                
                              
                            
                            }
                          
                          
                            
                              3
                              ⁢
                              
                                p
                                m
                              
                            
                          
                        
                        -
                        
                          
                            Tr
                            ⁡
                            
                              (
                              g
                              )
                            
                          
                          2
                        
                        -
                        
                          
                            Tr
                            ⁡
                            
                              (
                              h
                              )
                            
                          
                          2
                        
                      
                    
                  
                
              
            
          
        
      
    
    
      
        (
        61
        )
      
    
  




In the case where a given (l1, l2) expresses the multiplication value Tr(gh), the extension field representation of the multiplication value is expressed in Equation (62) below, using the multiplication value and the additional data.




  
    
      
        
          (
          
            
              Tr
              ⁡
              
                (
                gh
                )
              
            
            ,
            
              (
              
                
                  k
                  1
                
                ,
                
                  k
                  2
                
              
              )
            
          
          )
        
        =
        
          
            
              
                
                  
                    
                      
                        
                          Tr
                          ⁡
                          
                            (
                            gh
                            )
                          
                        
                        5
                      
                      -
                      
                        
                          Tr
                          ⁡
                          
                            (
                            gh
                            )
                          
                        
                        
                          
                            2
                            ⁢
                            
                              
                                3
                                ⁢
                                
                                  p
                                  m
                                
                              
                            
                          
                          +
                          2
                        
                      
                      -
                    
                  
                
                
                  
                    
                      
                        
                          Tr
                          ⁡
                          
                            (
                            gh
                            )
                          
                        
                        
                          3
                          +
                          
                            
                              3
                              ⁢
                              
                                p
                                m
                              
                            
                          
                        
                      
                      +
                      
                        
                          Tr
                          ⁡
                          
                            (
                            gh
                            )
                          
                        
                        
                          3
                          ⁢
                          
                            
                              3
                              ⁢
                              
                                p
                                m
                              
                            
                          
                        
                      
                    
                  
                
              
            
            
              
                (
                
                  
                    
                      
                        k
                        1
                      
                    
                  
                  
                    
                      ⋮
                    
                  
                
                )
              
              ⁢
              
                
                  Tr
                  ⁡
                  
                    (
                    gh
                    )
                  
                
                2
              
            
          
          +
          
            
              
                
                  Tr
                  ⁡
                  
                    (
                    gh
                    )
                  
                
                
                  
                    3
                    ⁢
                    
                      p
                      m
                    
                  
                
              
              +
              
                Tr
                ⁡
                
                  (
                  gh
                  )
                
              
            
            
              Tr
              ⁡
              
                (
                gh
                )
              
            
          
          +
          
            
              k
              2
            
            ⁢
            
              
                
                  
                    {
                    
                      
                        
                          
                            
                              
                                
                                  
                                    
                                      Tr
                                      ⁡
                                      
                                        (
                                        gh
                                        )
                                      
                                    
                                    5
                                  
                                  -
                                  
                                    
                                      Tr
                                      ⁡
                                      
                                        (
                                        gh
                                        )
                                      
                                    
                                    
                                      
                                        2
                                        ⁢
                                        
                                          
                                            3
                                            ⁢
                                            
                                              p
                                              m
                                            
                                          
                                        
                                      
                                      +
                                      2
                                    
                                  
                                  -
                                
                              
                            
                            
                              
                                
                                  
                                    
                                      Tr
                                      ⁡
                                      
                                        (
                                        gh
                                        )
                                      
                                    
                                    
                                      3
                                      +
                                      
                                        
                                          3
                                          ⁢
                                          
                                            p
                                            m
                                          
                                        
                                      
                                    
                                  
                                  +
                                  
                                    
                                      Tr
                                      ⁡
                                      
                                        (
                                        gh
                                        )
                                      
                                    
                                    
                                      3
                                      ⁢
                                      
                                        
                                          3
                                          ⁢
                                          
                                            p
                                            m
                                          
                                        
                                      
                                    
                                  
                                
                              
                            
                          
                        
                        
                          
                            (
                            
                              
                                
                                  
                                    k
                                    1
                                  
                                
                              
                              
                                
                                  ⋮
                                
                              
                            
                            )
                          
                          ⁢
                          
                            
                              Tr
                              ⁡
                              
                                (
                                gh
                                )
                              
                            
                            2
                          
                        
                      
                      +
                      
                        
                          
                            
                              Tr
                              ⁡
                              
                                (
                                gh
                                )
                              
                            
                            
                              
                                3
                                ⁢
                                
                                  p
                                  m
                                
                              
                            
                          
                          +
                          
                            Tr
                            ⁡
                            
                              (
                              gh
                              )
                            
                          
                        
                        
                          Tr
                          ⁡
                          
                            (
                            gh
                            )
                          
                        
                      
                    
                    }
                  
                  2
                
                -
                1
              
            
          
        
      
    
    
      
        (
        62
        )
      
    
  




On the other hand, the input is expressed in Equation (63) below.




  
    
      
        
          
            (
            
              
                Tr
                ⁡
                
                  (
                  g
                  )
                
              
              ,
              
                (
                
                  
                    i
                    1
                  
                  ,
                  
                    i
                    2
                  
                
                )
              
            
            )
          
          ⁢
          
            (
            
              
                Tr
                ⁡
                
                  (
                  h
                  )
                
              
              ,
              
                (
                
                  
                    j
                    1
                  
                  ,
                  
                    j
                    2
                  
                
                )
              
            
            )
          
        
        =
        
           
          
            [
            
              
                
                  
                    
                      
                        
                          
                            
                              Tr
                              ⁡
                              
                                (
                                g
                                )
                              
                            
                            5
                          
                          -
                          
                            
                              Tr
                              ⁡
                              
                                (
                                g
                                )
                              
                            
                            
                              
                                2
                                ⁢
                                
                                  
                                    3
                                    ⁢
                                    
                                      p
                                      m
                                    
                                  
                                
                              
                              +
                              2
                            
                          
                          -
                        
                      
                    
                    
                      
                        
                          
                            
                              Tr
                              ⁡
                              
                                (
                                g
                                )
                              
                            
                            
                              3
                              +
                              
                                
                                  3
                                  ⁢
                                  
                                    p
                                    m
                                  
                                
                              
                            
                          
                          +
                          
                            
                              Tr
                              ⁡
                              
                                (
                                g
                                )
                              
                            
                            
                              3
                              ⁢
                              
                                
                                  3
                                  ⁢
                                  
                                    p
                                    m
                                  
                                
                              
                            
                          
                        
                      
                    
                  
                
                
                  
                    (
                    
                      
                        
                          
                            i
                            1
                          
                        
                      
                      
                        
                          ⋮
                        
                      
                    
                    )
                  
                  ⁢
                  
                    
                      Tr
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    2
                  
                
              
              +
              
                
                  
                    
                      Tr
                      ⁡
                      
                        (
                        g
                        )
                      
                    
                    
                      
                        3
                        ⁢
                        
                          p
                          m
                        
                      
                    
                  
                  +
                  
                    Tr
                    ⁡
                    
                      (
                      g
                      )
                    
                  
                
                
                  Tr
                  ⁡
                  
                    (
                    g
                    )
                  
                
              
              +
              
                
                  i
                  2
                
                ⁢
                
                  

                
                ⁢
                
                   
                  
                    
                      
                        
                          {
                          
                            
                              
                                
                                  
                                    
                                      
                                        
                                          
                                            Tr
                                            ⁡
                                            
                                              (
                                              gh
                                              )
                                            
                                          
                                          5
                                        
                                        -
                                        
                                          
                                            Tr
                                            ⁡
                                            
                                              (
                                              gh
                                              )
                                            
                                          
                                          
                                            
                                              2
                                              ⁢
                                              
                                                
                                                  3
                                                  ⁢
                                                  
                                                    p
                                                    m
                                                  
                                                
                                              
                                            
                                            +
                                            2
                                          
                                        
                                        -
                                      
                                    
                                  
                                  
                                    
                                      
                                        
                                          
                                            Tr
                                            ⁡
                                            
                                              (
                                              gh
                                              )
                                            
                                          
                                          
                                            3
                                            +
                                            
                                              
                                                3
                                                ⁢
                                                
                                                  p
                                                  m
                                                
                                              
                                            
                                          
                                        
                                        +
                                        
                                          
                                            Tr
                                            ⁡
                                            
                                              (
                                              gh
                                              )
                                            
                                          
                                          
                                            3
                                            ⁢
                                            
                                              
                                                3
                                                ⁢
                                                
                                                  p
                                                  m
                                                
                                              
                                            
                                          
                                        
                                      
                                    
                                  
                                
                              
                              
                                
                                  (
                                  
                                    
                                      
                                        
                                          k
                                          1
                                        
                                      
                                    
                                    
                                      
                                        ⋮
                                      
                                    
                                  
                                  )
                                
                                ⁢
                                
                                  
                                    Tr
                                    ⁡
                                    
                                      (
                                      gh
                                      )
                                    
                                  
                                  2
                                
                              
                            
                            +
                            
                              
                                
                                  
                                    Tr
                                    ⁡
                                    
                                      (
                                      gh
                                      )
                                    
                                  
                                  
                                    
                                      3
                                      ⁢
                                      
                                        p
                                        m
                                      
                                    
                                  
                                
                                +
                                
                                  Tr
                                  ⁡
                                  
                                    (
                                    gh
                                    )
                                  
                                
                              
                              
                                Tr
                                ⁡
                                
                                  (
                                  gh
                                  )
                                
                              
                            
                          
                          }
                        
                        2
                      
                      -
                      1
                    
                  
                  ]
                
                ×
                
                  
                    \[
                    ⁢
                    NOBREAK
                    ]
                  
                  [
                  
                    
                      
                        
                          
                            
                              
                                
                                  
                                    Tr
                                    ⁡
                                    
                                      (
                                      h
                                      )
                                    
                                  
                                  5
                                
                                -
                                
                                  
                                    Tr
                                    ⁡
                                    
                                      (
                                      h
                                      )
                                    
                                  
                                  
                                    
                                      2
                                      ⁢
                                      
                                        
                                          3
                                          ⁢
                                          
                                            p
                                            m
                                          
                                        
                                      
                                    
                                    +
                                    2
                                  
                                
                                -
                              
                            
                          
                          
                            
                              
                                
                                  
                                    Tr
                                    ⁡
                                    
                                      (
                                      h
                                      )
                                    
                                  
                                  
                                    3
                                    +
                                    
                                      
                                        3
                                        ⁢
                                        
                                          p
                                          m
                                        
                                      
                                    
                                  
                                
                                +
                                
                                  
                                    Tr
                                    ⁡
                                    
                                      (
                                      h
                                      )
                                    
                                  
                                  
                                    3
                                    ⁢
                                    
                                      
                                        3
                                        ⁢
                                        
                                          p
                                          m
                                        
                                      
                                    
                                  
                                
                              
                            
                          
                        
                      
                      
                        
                          (
                          
                            
                              
                                
                                  j
                                  1
                                
                              
                            
                            
                              
                                ⋮
                              
                            
                          
                          )
                        
                        ⁢
                        
                          
                            Tr
                            ⁡
                            
                              (
                              h
                              )
                            
                          
                          2
                        
                      
                    
                    +
                    
                       
                      
                        
                          
                            
                              
                                Tr
                                ⁡
                                
                                  (
                                  h
                                  )
                                
                              
                              
                                
                                  3
                                  ⁢
                                  
                                    p
                                    m
                                  
                                
                              
                            
                            +
                            
                              Tr
                              ⁡
                              
                                (
                                h
                                )
                              
                            
                          
                          
                            Tr
                            ⁡
                            
                              (
                              h
                              )
                            
                          
                        
                        +
                        
                          
                            j
                            2
                          
                          ⁢
                          
                            
                              
                                
                                  {
                                  
                                    
                                      
                                        
                                          
                                            
                                              
                                                
                                                  
                                                    Tr
                                                    ⁡
                                                    
                                                      (
                                                      gh
                                                      )
                                                    
                                                  
                                                  5
                                                
                                                -
                                                
                                                  
                                                    Tr
                                                    ⁡
                                                    
                                                      (
                                                      gh
                                                      )
                                                    
                                                  
                                                  
                                                    
                                                      2
                                                      ⁢
                                                      
                                                        
                                                          3
                                                          ⁢
                                                          
                                                            p
                                                            m
                                                          
                                                        
                                                      
                                                    
                                                    +
                                                    2
                                                  
                                                
                                                -
                                              
                                            
                                          
                                          
                                            
                                              
                                                
                                                  
                                                    Tr
                                                    ⁡
                                                    
                                                      (
                                                      gh
                                                      )
                                                    
                                                  
                                                  
                                                    3
                                                    +
                                                    
                                                      
                                                        3
                                                        ⁢
                                                        
                                                          p
                                                          m
                                                        
                                                      
                                                    
                                                  
                                                
                                                +
                                                
                                                  
                                                    Tr
                                                    ⁡
                                                    
                                                      (
                                                      gh
                                                      )
                                                    
                                                  
                                                  
                                                    3
                                                    ⁢
                                                    
                                                      
                                                        3
                                                        ⁢
                                                        
                                                          p
                                                          m
                                                        
                                                      
                                                    
                                                  
                                                
                                              
                                            
                                          
                                        
                                      
                                      
                                        
                                          (
                                          
                                            
                                              
                                                
                                                  k
                                                  1
                                                
                                              
                                            
                                            
                                              
                                                ⋮
                                              
                                            
                                          
                                          )
                                        
                                        ⁢
                                        
                                          
                                            Tr
                                            ⁡
                                            
                                              (
                                              gh
                                              )
                                            
                                          
                                          2
                                        
                                      
                                    
                                    +
                                    
                                      
                                        
                                          
                                            Tr
                                            ⁡
                                            
                                              (
                                              gh
                                              )
                                            
                                          
                                          
                                            
                                              3
                                              ⁢
                                              
                                                p
                                                m
                                              
                                            
                                          
                                        
                                        +
                                        
                                          Tr
                                          ⁡
                                          
                                            (
                                            gh
                                            )
                                          
                                        
                                      
                                      
                                        Tr
                                        ⁡
                                        
                                          (
                                          gh
                                          )
                                        
                                      
                                    
                                  
                                  }
                                
                                2
                              
                              -
                              1
                            
                          
                        
                      
                      ]
                    
                  
                
              
            
          
        
      
    
    
      
        (
        63
        )
      
    
  




Accordingly, it is assumed that the expression of the above output is equal to the expression of multiplication calculated from the input, and the output of (k1, k2, l1, l2) is calculated from, the input of (i1, i2, j1, j2).
Thus, the computing device according to the first embodiment operates in the trace representation, without conversion to, for example, the projective representation or the extension field representation. This makes it possible to reduce the entire amount of calculation.
Second Embodiment
In the second embodiment, a multiplication method in the case where all of the coefficients of the characteristic polynomial have been preliminarily determined will be described.
FIG. 3 is a block diagram illustrating an exemplary configuration of an computing device 100-2 according to a second embodiment. As illustrated in FIG. 3, the computing device 100-2 includes the receiving unit 101, a coefficient calculating unit 102-2, the solving unit 103, the selecting unit 104, the determining unit 105, and the output unit 106.
In the second embodiment, a function of the coefficient calculating unit 102-2 is a different from that of the first embodiment. Configurations and functions are otherwise similar to those in FIG. 1, which is the block diagram illustrating the computing device 100 according to the first embodiment. In view of this, like reference numerals designate units corresponding to or identical to the units according to the first embodiment, and such configurations and functions will not be further elaborated here.
The coefficient calculating unit 102-2 uses a coefficient of a predetermined characteristic polynomial to calculate a coefficient of a polynomial that has a root that is a possible value of the multiplication value. This point is different from the coefficient calculating unit 102 according to the first embodiment. A calculation method for a coefficient according to this embodiment will be described below.
Assume that, the characteristic polynomial expressed in Equation (64) below is given. The norm of the element g in an algebraic torus Tn(Fpm) is one. This yields a constant term.

Xn−Tr(g)Xn−1+a2(g)Xn−2+a3(g)Xn−3+ . . . +an−1(g)X+(−1)n  (64)

The polynomial expressed in Equation (65) below has a root that is a possible value of the multiplication value. The coefficient of this polynomial is calculated from the coefficient of the characteristic polynomial.

Yn−Tr(g)Tr(h)Yn−1+d2(g,h)Yn−2+d3(g,h)Yn−3+ . . . +dn−1(g,h)Y+dn(g,h)  (65)

With respect to d2(g, h), for example, in the case of n=2, an equation d2 (g, h)=a2(g)Tr(h2)+Tr(g2)a2(h) holds. In the case of n=3, an equation d2(g, h)=a2(g)Tr(h2)+Tr(g2)a2(h)+a2(g)a2(h) holds. If n=4, then an equation d2(g, h)=a2(g)Tr(h2)+Tr(g2)a2(h)+a2(g)a2(h)+2a2(g)+2a2(h)=12 holds. Here, ai(g) and di(g, h) are expressed in Equation (66). Similarly di(h) is expressed.




  
    
      
        
          
            
              a
              i
            
            ⁡
            
              (
              g
              )
            
          
          =
          
            
              
                (
                
                  -
                  1
                
                )
              
              i
            
            ⁢
            
              
                ∑
                
                  
                    s
                    ⋐
                    
                      {
                      
                        0
                        ,
                        
                          
                        
                        ⁢
                        ...
                        ⁢
                        
                          
                        
                        ,
                        
                          n
                          -
                          1
                        
                      
                      }
                    
                  
                  ,
                  
                    
                      
                      S
                      
                    
                    =
                    i
                  
                
                
                  
                
              
              ⁢
              
                
              
              ⁢
              
                
                  ∏
                  
                    j
                    ∈
                    S
                  
                  
                    
                  
                
                ⁢
                
                  
                
                ⁢
                
                  g
                  
                    
                      (
                      
                        p
                        m
                      
                      )
                    
                    j
                  
                
              
            
          
        
        ⁢
        
          

        
        ⁢
        
          
            
              d
              i
            
            ⁡
            
              (
              
                g
                ,
                h
              
              )
            
          
          =
          
            
              
                (
                
                  -
                  1
                
                )
              
              i
            
            ⁢
            
              
                ∑
                
                  
                    S
                    ⋐
                    
                      {
                      
                        0
                        ,
                        ...
                        ⁢
                        
                          
                        
                        ,
                        
                          n
                          -
                          1
                        
                      
                      }
                    
                  
                  ,
                  
                    
                      
                      S
                      
                    
                    =
                    i
                  
                
                
                  
                
              
              ⁢
              
                
              
              ⁢
              
                
                  ∏
                  
                    j
                    ∈
                    S
                  
                  
                    
                  
                
                ⁢
                
                  
                
                ⁢
                
                  Tr
                  ⁡
                  
                    (
                    
                      
                        g
                        
                          
                            (
                            
                              p
                              m
                            
                            )
                          
                          j
                        
                      
                      ⁢
                      h
                    
                    )
                  
                
              
            
          
        
      
    
    
      
        (
        66
        )
      
    
  




Accordingly, the coefficient calculating unit 102-2 calculates di(g, h) from di(g), di(h), Tr(gi), and Tr(hi), using the coefficient of the characteristic polynomial and the recurrence equation of the trace obtained from the characteristic polynomial. This calculates the coefficient of the polynomial that has a root that is a possible value of the multiplication value.
The solving unit 103 solves the above-described polynomial to obtain its root. The selecting unit 104 selects one multiplication value from the obtained n roots, using the additional data corresponding to the coefficient of the characteristic, polynomial with respect to the element g and the additional data corresponding to the coefficient of the characteristic polynomial with respect to the element h. The determining unit 105 uses the additional data corresponding to the coefficient of the characteristic polynomial with respect to the element g and the additional data corresponding to the coefficient of the characteristic polynomial with respect to the element h, and determines the additional data for the multiplication value.
As described above, the first embodiment and the second embodiment allow the computation in the trace representation without conversion of the representation. This makes it possible to reduce the entire amount of calculation.
Next, a hardware configuration, of a computing device according to the first embodiment or the second embodiment will be described by referring to FIG. 4. FIG. 4 is an explanatory diagram illustrating a hardware configuration of the computing device according to the first embodiment or the second embodiment.
The computing device according to the first embodiment or the second embodiment includes a control unit such as a central processing unit (CPU) 51, a storage unit such as a read only memory (ROM) 52 and a random access memory (RAM) 53, a communication I/F 54 to connect a network for communication, and a bus 61 to couple to respective units.
The computation program executed in the computing device according to the first embodiment or the second embodiment is preliminarily embedded in a ROM 52 or a similar storage to provide.
The computation program executed in the computing device according to the first embodiment or the second embodiment may be configured to be provided as a computer program product that is in an installable file format or an executable file format and is recorded on a recording medium from which a computer is able to read the program. The recording medium, includes a compact disk read only memory (CD-ROM), a flexible disk (FD), a compact disk recordable (CD-R), and a digital versatile disk (DVD).
The computation program executed in the computing device according to the first embodiment or the second embodiment may be further configured to be stored in a computer connected to a network such as the Internet so as to be provided as a downloadable file over the network. Alternatively, the computation program executed in the computing device according to the first embodiment or the second embodiment may be configured to be provided or distributed through a network such as the Internet.
With the computation program executed in the computing device according to the first embodiment or the second embodiment, a computer may serve as respective units (the receiving unit, the coefficient calculating unit, the solving unit, the selecting unit, the determining unit, and the output unit) of the above-described computing device. A CPU 51 in the computer reads the computation program from the storage medium from which the computer is able to read the program. Then the computation program is loaded and executed on a main storage unit.
While certain embodiments nave been described, these embodiments have been presented by way of example only, and are not intended to limit the scope of the inventions. Indeed, the novel embodiments described herein may be embodied in a variety of other forms; furthermore, various omissions, substitutions and changes in the form of the embodiments described herein may be made without departing from, the spirit of the inventions. The accompanying claims and their equivalents are intended to cover such forms or modifications as would fall within the scope and spirit of the inventions.

## Claims

1. A public key cryptography device for reducing computation time when converting between representations of a file, comprising:
at least one processor; and
a memory storing instructions, which, when executed by the at least one processor configure the processor to:
receive, via a hardware interface, a plurality of pieces of input data for public key cryptography indicative of elements of a subgroup of a multiplicative group in a finite field and a plurality of pieces of first additional data for identifying conjugates of the respective pieces of input data, the elements being represented by traces;
calculate a coefficient of an equation based on the pieces of input data, the equation having a solution that is a possible value as a result of a predetermined computation performed on the pieces of input data;
obtain a plurality of solutions of the equation having the coefficient by performing a bit inversion in memory;
select one of the solutions as the result of the predetermined computation, based on the pieces of first additional data;
determine second additional data for identifying a conjugate of the result of the predetermined computation, based on the pieces of first additional data; and
output the selected result of the predetermined computation and the second additional data to facilitate converting between representations of a file for public key encryption.

2. The device according to claim 1, wherein a coefficient of characteristic polynomial is used for the pieces of input data and the pieces of input data to calculate the coefficient of the equation.

3. The according to claim 1, wherein
each of the pieces of first additional data indicates an order of value in the corresponding piece of input data and the corresponding conjugate, and
the selected solution is determined based on a combination of orders indicated by the pieces of first additional data.