    The Algebraic Theory of Fractional Jumps

In this paper we start by briefly surveying the theory of Fractional Jumps and transitive projective maps. Then, we give an efficient construction of a fractional jump of a projective map and we extend the compound generator construction for the Inversive Congruential Generator to Fractional jump sequences. In addition, we provide new results on the absolute jump index, on projectively primitive polynomials, and on the explicit description of fractional jump generators.

Authors

09/19/2019

A fractional Traub method with (2α+1)th-order of convergence and its stability

Some fractional Newton methods have been proposed in order to find roots...
02/04/2020

On the two-phase fractional Stefan problem

The classical Stefan problem is one of the most studied free boundary pr...
03/11/2018

Fractional L-intersecting families

Let L = {a_1/b_1, ... , a_s/b_s}, where for every i ∈ [s], a_i/b_i∈ [0,1...
07/03/2020

Fractional Covers of Hypergraphs with Bounded Multi-Intersection

Fractional (hyper-)graph theory is concerned with the specific problems ...
08/12/2020

A nonlinear system related to investment under uncertainty solved using the fractional pseudo-Newton method

A nonlinear algebraic equation system of two variables is numerically so...
03/05/2019

Low discrepancy sequences failing Poissonian pair correlations

M. Levin defined a real number x that satisfies that the sequence of the...
10/04/2018

Randen - fast backtracking-resistant random generator with AES+Feistel+Reverie

Algorithms that rely on a pseudorandom number generator often lose their...
This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

1. Introduction

Generating sequences of pseudorandom numbers is of great importance in applied areas and especially in cryptography and for Monte Carlo methods (for example to compute integrals over the reals). The task of generating streams of pseudorandom numbers is closely related to the study of dynamical systems over finite fields, which have been of great interest recently [bib:FMS16, bib:FMS17, bib:GPOS14, bib:HBM17, bib:OS10degree, bib:OS10length, bib:ost10, bib:OPS10]. More in general, for an interesting survey on open problems in arithmetic dynamics see [benedetto2018current]. Constructions of pseudorandom number generators are studied for example in [bib:eich91, bib:eich92, bib:eich93, bib:EHHW98, bib:EMG09, bib:NS02, bib:NS03, bib:TW06, bib:winterhof10]. This paper focuses on one of the most recent ones, provided in [bib:AGM17]. In a nutshell, [bib:AGM17] provides a new construction of pseudorandom number sequences using the theory of transitive projective maps. From an applied point of view, the interest of this new construction relies on the fact that it costs asymptotically less to compute than the classical Inversive Congruential Generator sequence [bib:AGM17, Section 7] and also achieves the same discrepancy bounds as the ICG (see [bib:AGM17, Section 6]). From a purely mathematical perspective, the theory of Fractional Jumps is intimately connected with different areas of mathematics such as finite projective geometry, field theory, additive and analytic number theory, and can turn it into a very rich area of research.

The main task of this paper is to summarise the theory of the fractional jump (FJ) construction and complete some mathematical aspects which were left open in the previous papers. Finally, we also show that the the compound construction for the Inversive Congruential Generator (ICG) nicely extends to FJs. Also, we leave some open questions at the end of the paper.

Notation

Let be a prime power, a positive integer, and be the finite field of order . Let be the affine space over (for the purposes of this paper, this can be simply identified with ). Let be the projective space of dimension over . Fix the standard projective coordinates on . Let be the group of invertible matrices over and be the group of projective automorphisms of . For the entire paper we fix the canonical decomposition

 Pn=U∪H,

where

 U ={[X0:…:Xn]∈Pn:Xn≠0}≅An, H ={[X0:…:Xn]∈Pn:Xn=0}≅Pn−1.

For a group and an element we denote by the order of . Let . We can write as for some . Let us denote by the -tuple of rational functions

 (f1,…fn)=(m1,n+1+∑nj=1m1,jxjmn+1,n+1+∑nj=1mn,jxj,…,mn,n+1+∑nj=1mn,jxjmn+1,n+1+∑nj=1mn,jxj).

When we have an -tuple of rational functions of degree with the same denominator , we say that is the denominator of . Unless otherwise stated all the logarithms are in basis .

2. The theory of Fractional Jumps

In this section we survey the ingredients needed to construct transitive fractional jumps and give new results on projective primitivity.

2.1. Transitive projective maps

The first ingredient needed is a transitive automorphism of the projective space. We start by recalling the definition of projectively primitive polynomials, which are closely related to transitive projective automorphisms.

Definition 2.1.

A polynomial of degree is said to be projectively primitive if the two following conditions are satisfied:

1. is irreducible over ,

2. for any root of in , the class of in the quotient group generates .

Remark 2.2.

Clearly, any primitive polynomial is also projectively primitive.

A characterisation can be derived from [bib:AGM18, Lemma 2] with .

Proposition 2.3.

An irreducible polynomial of degree is projectively primitive if and only if has order .

In [bib:AGM17] transitive projective maps were characterised, we report the result here for completeness.

Theorem 2.4.

[bib:AGM17, Theorem 3.4] Let be an automorphism of with . Then, is transitive on if and only if the characteristic polynomial of is projectively primitive.

Remark 2.5.

Theorem 2.4 also implies that to find a transitive projective automorphism of one can simply fix , where is the companion matrix (or any of its conjugates) of a projectively primitive polynomial .

The following result shows that one can in principle always construct a primitive polynomial from a projectively primitive one.

Theorem 2.6.

A polynomial is projectively primitive if and only if there exists such that is primitive.

Proof.

If there exists such that is primitive, then it is obvious that is projectively primitive. Let us now show the other implication. Let be a root of in its splitting field . We have to find such that has order . Recall that for an element we denote by its reduction in the quotient group .

First, observe that for any , we have that divides because . So if we can find such that has order we are done.

Choose a multiplicative generator of and write for some positive integer . Moreover, assume that the choice of is also such that is minimal. First, observe that all the prime factors of divide as otherwise if is a prime factor of that does not divide , one can rewrite , and is again a generator for , contradicting the minimality of .

We now want to prove that . Suppose the contrary and let be a prime factor of . Consider , if we show that we get the contradiction by the definition of ( is the smallest integer such that ). But this is obvious:

 γq−1=αN(q−1)/p=(ge)(q−1)/p=(ge/p)(q−1)=1.

Since we want that has order , we have to select such that is a multiplicative generator of . Write for some , then we can write

 (λα)N=gsNαN=gsNμ=gsN+e.

Since and are coprime, Dirichlet Theorem on arithmetic progressions applies, therefore we can select such that is a prime larger than . The claim follows by observing that if is a generator for , then is a generator of .

A direct consequence of the result above is that when is small, the problems of finding a primitive polynomial or a projectively primitive one are equivalent.

Corollary 2.7.

Given a monic projectively primitive polynomial over , constructing a primitive polynomial costs operations in .

Proof.

We first factor as a precomputation, which costs less than . Given a monic projectively primitive polynomial and one of its roots , we simply test (for any in ) if has order . The cost is then as follows. Observe that the norm of is given by the degree zero coefficient of , so does not have to be computed. Since lives in , for any , we check if has order in . To do that, we simply compute , where runs over all prime divisors of , which are at most . The total number of -operations is then , where is the cost of computing . ∎

We recall now the definition of fractional jump index.

Definition 2.8.

Let be an automorphism of . Let and . The fractional jump index of at is

 JP,Ψ=min{k≥1:Ψk(P)∈U}.

The absolute fractional jump index of is the quantity

 JΨ=max{JP,Ψ:P∈U}.

In [bib:AGM17] it is shown that for a transitive projective map, the absolute jump index cannot be larger than

Proposition 2.9 ([bib:AGM17, Corollary 4.3]).

Let be transitive. The absolute jump index of of is less than or equal to .

We can actually prove a stronger result

Theorem 2.10.

Let be transitive. Then .

Proof.

The direction is given by Proposition 2.9. Let us show that . Recall that Let be the largest integer such that there exists a point such that

 {Ψ(¯¯¯¯P),Ψ2(¯¯¯¯P),…ΨL(¯¯¯¯P)}⊆H,

so that . Observe that we can always choose in because is transitive: in fact, consider the smallest such that (this is possible as is transitive). Then

 {Ψ(P′),Ψ2(P′),…ΨL+ℓ(P′)}⊆H.

This forces and therefore .

Set

 T={P∈Pn:Ψi(P)∈H∀i∈{1,…,L}}.

It is easy to see that is non-empty by the choice of , and is a projective subspace of that intersects , because . We want to show that the dimension of is zero, so it consists only of one point. Consider (that has the same dimension of ) and assume by contradiction that its dimension is greater than or equal to . Then its intersection with is non-empty as

is a projective hyperplane, so let

. Set and observe that for any as , but also by construction, which is a contradiction by the maximality of . This forces which forces . Now, since (each of the conditions imposes an equation), this forces . Therefore . ∎

Remark 2.11.

Transitivity is necessary for the result above to hold: consider for example the non transitive map of given by . The absolute jump index is (no point at finite is mapped at infinite).

2.2. Constructing a Transitive Fractional Jump

The fractional jump of a projective map can be formally defined as follows

Definition 2.12.

Let and

 π:An⟶U
 (x1,…,xn)↦[x1,…,xn,1].

The fractional jump of is the map

 ψ:An→An
 x↦π−1ΨJπ(x)π(x).
Remark 2.13.

The fractional jump is clearly well-defined but its definition depends on the point where it is evaluated, which might be an issue if one wants to describe the map globally. Theorem 2.15 ensures that this is not the case.

Obviously, if one starts with a transitive projective automorphism one will get a transitive fractional jump. Interestingly enough, the converse implication is also true, apart from two degenerate cases, see [bib:AGM18, Theorem 2] where this issue is settled. We report the result here for completeness

Theorem 2.14.

Let be an automorphism of and let be its fractional jump. Then, acts transitively on if and only if acts transitively on , unless is prime and , or and , with explicit examples in both cases.

In [bib:AGM17] an explicit global description of a fractional jump was given.

Theorem 2.15 ([bib:AGM17, Section 5] or [bib:AGM18, Theorem 1]).

Let be a transitive automorphism of , and let be its fractional jump. Then, for there exist

 a(i)1,…,a(i)n,b(i)∈Fq[x1,…,xn]

of degree such that, if

 U1 ={x∈An:b(1)(x)≠0}, Ui ={x∈An:b(i)(x)≠0, and b(j)(x)=0,∀j∈{1,…,i−1}}, for i∈{2,…,n+1}, and f(i) =(a(i)1b(i),…,a(i)nb(i)), for i∈{1,…,n+1},

then if . Moreover, the rational maps can be explicitly computed.

Remark 2.16.

Observe that the datum of a fractional jump

is equivalent to the datum of the vector of degree

polynomials where .

3. Fractional Jumps in Practice

In this section we describe some aspects of the practical implementation of fractional jumps.

3.1. Compact description

In this section we give a compact description of a Fractional Jump. We first need an ancillary lemma

Lemma 3.1.

Let be transitive. For , set and set to be the denominator of . Then and for any we have that .

Proof.

First observe that since is transitive we have that:

• the characteristic polynomial of is irreducible and equal to the minimal polynomial

• is different from 1, as otherwise no point at finite is mapped at infinity and therefore the map cannot be transitive on .

Let be the smallest integer such that . Of course, we can assume . By degree reasons, there exist such that . But this implies that the matrix

 N=(j−1∑k=1λkMk)−Mj=M((j−1∑k=1λkMk−1)−Mj−1)

has the last row identically zero, so it is not invertible. But since the characteristic polynomial of is irreducible, any matrix in is invertible. This forces . But then the polynomial is zero at and therefore divisible by the minimal polynomial . But since and has degree , we must have , which is a contradiction because has degree . ∎

We are now ready to provide a compact description of a fractional jump.

Theorem 3.2.

Storing a fractional jump requires at most bits.

Proof.

Algorithm 1 produces a fractional jump from a transitive projective automorphism. Now observe that the bit size of is the same as the bit size of , which is . The bit size of is as we were able to use the relation . More in general, the bit size of is as we can use the relation . The process terminates and it is well defined because of Lemma 3.1. Adding everything up we get

 n+1∑i=1(n+1)(n+2−i)⌈log(q)⌉=⌈log(q)⌉(n+1)2(n+2)/2.

3.2. Expected cost of evaluation

Evaluating a fractional jump is a very easy task, as it involves only one inversion in the base field. In this section we compute the expected cost

of evaluating a fractional jump, essentially weighting the computational cost with the probability that a random point in

is selected.

Definition 3.3.

Let be a map on . We define the expected cost of computing on to be

 E[ψ]=q−n∑x∈FnqCost(ψ,x),

where denotes the number of binary operations needed to evaluate at .

We now compute the expected complexity of evaluating a fractional jump sequence in the large field regime, which is the one for which we have the nice discrepancy bounds in [bib:AGM17, Section 8].

Theorem 3.4.

Let be a prime, be a transitive projective automorphism, and be its fractional jump. Suppose that has a representative in having entries in . Suppose that . The expected cost of evaluating a fractional jump is .

Proof.

We want to estimate the average cost of Algorithm

2. As usual, set and for set

 U(i)={x∈An(Fq):b(i)(x)≠0,and b(1)(x)=b(2)(x)=⋯=b(i−1)(x)=0},

and

 E[ψ]=q−nn+1∑i=1∑x∈U(i)Cost(ψ,x).

For , by the fact that has small coefficients, evaluating and involves at most sums. Therefore, we have that , where is the cost of an inversion, is the cost of a multiplication in and the cost of an addition in . For and , evaluating and becomes more expensive, as it might involve also multiplications by elements of for each component (the coefficients ). The final cost of evaluating at is then . Since there are elements in and in the union of the rest of the ’s we have that

 E[ψ]=O(I(q)+nM(q)+n2S(q)+I(q)+(n+n2)M(q)+n2S(q)q).

Since and are all polynomial time operations in , we have that and then

 E[ψ]=O(I(q)+nM(q)+n2S(q)).

Observe that if one uses Fast Fourier transform for multiplication

[bib:SchStr71] and Schönhage Algorithm for inversions [mullen2013handbook, Remark 11.1.99] we have that

 I(q)=M(q)loglog(q)

and

 M(q)=log(q)loglog(q)logloglog(q).

Adding two integers modulo simply costs , from which we get the final claim. ∎

Example 3.5.

Fix for example and . One can check with a computer algebra system (for example SAGE [bib:sagemath]) that is a prime number and that is an irreducible polynomial. It follows directly from Definition 3.3 that is projectively primitive and therefore the projective map produced by its companion matrix (see Remark 2.5) verifies the hypothesis of Theorem 2.4, and thus it generates a transitive fractional jump verifying the hypothesis of Theorem 3.4. Computationally it is very easy to produce projectively primitive polynomials, but it would also be interesting to give a systematic way to construct them (such as the one using Artin-Schreier jumps in [bib:AGM18]).

Remark 3.6.

In terms of expected complexity (and whenever the coefficients are carefully chosen) fractional jumps behave better than ICGs, as we are about to explain. In fact, let us now compare the result of Theorem 3.4 for with which is essentially the case of the ICG (see [bib:AGM17, Example 2.4]). Evaluating an ICG having small coefficients costs one inversion whether evaluating a Fractional Jump with small coefficients costs averagely . Notice now that if is a large prime and is relatively small we have that . On the other hand, an ICG only generates one pseudorandom point at each iteration, whether instead the Fractional Jump construction generates -pseudorandom points.

3.3. Compound Generator for Fractional Jumps

In this subsection we show that the compound generator construction for the Inversive Congruential Generator easily extends to a fractional jump and provide an example.

Theorem 3.7.

Let and be positive integers and be distinct primes. For any , let be a transitive projective automorphism of and be its fractional jump.

Let and . There exists a transitive map on such that, for any , its reduction modulo is .

Proof.

Let

 vi=ℓ∏j=1j≠ipj

and be a representative modulo of the inverse of modulo . Set and the map which takes as input an element of and outputs its canonical representative in . Consider the map

 ψ:Rn ⟶Rn x ↦ℓ∑i=1ui¯¯¯¯ψi(x)

where

 ¯¯¯¯ψi(x)=Li(ψi(xmodpi)).

First observe that is well defined, as it is a sum of well defined maps. We have now to prove that is a bijection. To see this, notice that we have the following diagram

 Rnψ−−−−→Rnπi⏐⏐↓πi⏐⏐↓Fnpiψi−−−−→Fnpi

where is the natural reduction of modulo . The diagram is commutative thanks to the choice of , which is zero modulo for any , and modulo is equal to . We want to prove first that is surjective. Let and consider . Since is bijective, there exists such that . By the Chinese Remainder Theorem we can find such that for all . It is now immediate to see that . So is surjective and therefore bijective as is a finite set.

We have now to show that is transitive. To see this, we will show that the order of an element is zero modulo for any , so the claim will follow as the order of at is at most . Suppose that is a positive integer such that , then applying on both sides and using the commutativity of the diagram we have that

 πi(ψd(¯¯¯x))=ψdi(πi(¯¯¯x))=πi(¯¯¯x),

from which it follows that must be divisible by as is transitive. ∎

Remark 3.8.

Notice that also other lifts to would be suitable for the compound generator, not only the canonical one .

Example 3.9.

To fix the ideas for our constructions, we produce here a small toy example for and . Let us construct first a transitive projective map over . For this, consider the polynomial and its companion matrix

 M=⎛⎜⎝003−1030−10⎞⎟⎠.

To compute the fractional jump of we also need the matrices and :

 M2=⎛⎜⎝0−300−3−310−3⎞⎟⎠M3=⎛⎜⎝301331033⎞⎟⎠.

The fractional jump of is then

 ψ1(x1,x2)=⎧⎪ ⎪ ⎪⎨⎪ ⎪ ⎪⎩(2x2,x1−3x2)if x2≠0(0,2x1+2)if x2=0 and x1≠3 (0,0)if x=(3,0)

We now need a projectively primitive polynomial of degree over . We select . Its companion matrix is

 M=⎛⎜⎝001−1020−10⎞⎟⎠.

Analogously, one computes the fractional jump of obtaining

 ψ2(x1,x2)=⎧⎪ ⎪ ⎪⎨⎪ ⎪ ⎪⎩(−1x2,x1−2x2)if x2≠0(0,−1x1+1)if x2=0 and x1≠2 (0,0)if x=(2,0)

The compound generator of and is then

 ψ:R2⟶R2
 ψ(x1,x2)=6⋅L1(ψ1(x1mod5,x2mod5))+10⋅L2(ψ2(x1mod3,x2mod3))

where (resp. ) is the obvious map lifting (resp. ) to (resp. ) in . One can check directly that is in fact transitive on .

4. Some ideas to achieve unpredictability from a fractional jump sequence

Since we already have nice (provable) distributional properties of FJs given by the results in [bib:AGM17] (which make Fractional Jumps suitable for Monte Carlo methods for example), in this section we would like to provide some modifications of the fractional jump construction that could be of use for pseudorandom number generation in settings where unpredictability is a critical property (such as cryptography). In this setting we have an opponent observing the stream of pseudorandom numbers and he must not be able to reconstruct the generator, or predict next values of the stream.

Remark 4.1.

We would like to observe that the main issue we encounter when we want to use the basic fractional jump construction for pseudorandom number generation in a cryptographic setting is the following: when the base field is large, on most of the points of we act as rational functions in variables of degree (more precisely in the notation of Theorem 2.14 we act as on all points of , which are . Therefore, for each pseudorandom number we observed, we get a system of linear equations in the coefficients of the rational functions defining . It is therefore expected that in points we can reconstruct by solving a linear system (assuming that all the points in the iteration lie all in , which is a reasonable assumption as it has size comparable with ).

In what follows we describe some constructions which seem to avoid the issue presented in the remark above.

4.1. Secret prime q

Here we follow the ideas of [anshel1997zeta]

. Choose two large odd primes

with the property that and if is odd. The designer keeps secret, constructs a secret full orbit fractional jump , and chooses a secret starting point . Consider now the canonical lift . The pseudorandom sequence is then produced as . To avoid the small biases given by the reduction one can use rejection sampling by skipping elements of the sequence that have components that are congruent to or modulo . Of course, should be chosen relatively small compared with .

4.2. Forcing jumps

Let be a fractional jump, be a subset of roughly of size , be its complement. Define the map

 ϕ(x)={ψ(x)if x∈Tψ(ψ(x))if x∈Tc

The designer keeps , , , and , secret and outputs the sequence . If one wants to reconstruct the fractional jump , according to Remark 4.1, one would need to observe at least iterations of . But in this contruction either or is used with probability , therefore in order to reconstruct the attacker has systems to solve, one of which will lead to the reconstruction of . Notice that with this construction the orbit of starting at any point is bounded from below by .

5. Further research

In this section we list some questions arising from the theory of fractional jumps.

Of course, any primitive polynomial is also projectively primitive. Moreover, we saw in Corollary 2.7 that whenever is small, finding a primitive polynomial or a projectively primitive polynomials are equivalent problems.

Question 1.

For a fixed degree (e.g.