1. Introduction
Generating sequences of pseudorandom numbers is of great importance in applied areas and especially in cryptography and for Monte Carlo methods (for example to compute integrals over the reals). The task of generating streams of pseudorandom numbers is closely related to the study of dynamical systems over finite fields, which have been of great interest recently [bib:FMS16, bib:FMS17, bib:GPOS14, bib:HBM17, bib:OS10degree, bib:OS10length, bib:ost10, bib:OPS10]. More in general, for an interesting survey on open problems in arithmetic dynamics see [benedetto2018current]. Constructions of pseudorandom number generators are studied for example in [bib:eich91, bib:eich92, bib:eich93, bib:EHHW98, bib:EMG09, bib:NS02, bib:NS03, bib:TW06, bib:winterhof10]. This paper focuses on one of the most recent ones, provided in [bib:AGM17]. In a nutshell, [bib:AGM17] provides a new construction of pseudorandom number sequences using the theory of transitive projective maps. From an applied point of view, the interest of this new construction relies on the fact that it costs asymptotically less to compute than the classical Inversive Congruential Generator sequence [bib:AGM17, Section 7] and also achieves the same discrepancy bounds as the ICG (see [bib:AGM17, Section 6]). From a purely mathematical perspective, the theory of Fractional Jumps is intimately connected with different areas of mathematics such as finite projective geometry, field theory, additive and analytic number theory, and can turn it into a very rich area of research.
The main task of this paper is to summarise the theory of the fractional jump (FJ) construction and complete some mathematical aspects which were left open in the previous papers. Finally, we also show that the the compound construction for the Inversive Congruential Generator (ICG) nicely extends to FJs. Also, we leave some open questions at the end of the paper.
Notation
Let be a prime power, a positive integer, and be the finite field of order . Let be the affine space over (for the purposes of this paper, this can be simply identified with ). Let be the projective space of dimension over . Fix the standard projective coordinates on . Let be the group of invertible matrices over and be the group of projective automorphisms of . For the entire paper we fix the canonical decomposition
where
For a group and an element we denote by the order of . Let . We can write as for some . Let us denote by the tuple of rational functions
When we have an tuple of rational functions of degree with the same denominator , we say that is the denominator of . Unless otherwise stated all the logarithms are in basis .
2. The theory of Fractional Jumps
In this section we survey the ingredients needed to construct transitive fractional jumps and give new results on projective primitivity.
2.1. Transitive projective maps
The first ingredient needed is a transitive automorphism of the projective space. We start by recalling the definition of projectively primitive polynomials, which are closely related to transitive projective automorphisms.
Definition 2.1.
A polynomial of degree is said to be projectively primitive if the two following conditions are satisfied:

is irreducible over ,

for any root of in , the class of in the quotient group generates .
Remark 2.2.
Clearly, any primitive polynomial is also projectively primitive.
A characterisation can be derived from [bib:AGM18, Lemma 2] with .
Proposition 2.3.
An irreducible polynomial of degree is projectively primitive if and only if has order .
In [bib:AGM17] transitive projective maps were characterised, we report the result here for completeness.
Theorem 2.4.
[bib:AGM17, Theorem 3.4] Let be an automorphism of with . Then, is transitive on if and only if the characteristic polynomial of is projectively primitive.
Remark 2.5.
Theorem 2.4 also implies that to find a transitive projective automorphism of one can simply fix , where is the companion matrix (or any of its conjugates) of a projectively primitive polynomial .
The following result shows that one can in principle always construct a primitive polynomial from a projectively primitive one.
Theorem 2.6.
A polynomial is projectively primitive if and only if there exists such that is primitive.
Proof.
If there exists such that is primitive, then it is obvious that is projectively primitive. Let us now show the other implication. Let be a root of in its splitting field . We have to find such that has order . Recall that for an element we denote by its reduction in the quotient group .
First, observe that for any , we have that divides because . So if we can find such that has order we are done.
Choose a multiplicative generator of and write for some positive integer . Moreover, assume that the choice of is also such that is minimal. First, observe that all the prime factors of divide as otherwise if is a prime factor of that does not divide , one can rewrite , and is again a generator for , contradicting the minimality of .
We now want to prove that . Suppose the contrary and let be a prime factor of . Consider , if we show that we get the contradiction by the definition of ( is the smallest integer such that ). But this is obvious:
Since we want that has order , we have to select such that is a multiplicative generator of . Write for some , then we can write
Since and are coprime, Dirichlet Theorem on arithmetic progressions applies, therefore we can select such that is a prime larger than . The claim follows by observing that if is a generator for , then is a generator of .
∎
A direct consequence of the result above is that when is small, the problems of finding a primitive polynomial or a projectively primitive one are equivalent.
Corollary 2.7.
Given a monic projectively primitive polynomial over , constructing a primitive polynomial costs operations in .
Proof.
We first factor as a precomputation, which costs less than . Given a monic projectively primitive polynomial and one of its roots , we simply test (for any in ) if has order . The cost is then as follows. Observe that the norm of is given by the degree zero coefficient of , so does not have to be computed. Since lives in , for any , we check if has order in . To do that, we simply compute , where runs over all prime divisors of , which are at most . The total number of operations is then , where is the cost of computing . ∎
We recall now the definition of fractional jump index.
Definition 2.8.
Let be an automorphism of . Let and . The fractional jump index of at is
The absolute fractional jump index of is the quantity
In [bib:AGM17] it is shown that for a transitive projective map, the absolute jump index cannot be larger than
Proposition 2.9 ([bib:AGM17, Corollary 4.3]).
Let be transitive. The absolute jump index of of is less than or equal to .
We can actually prove a stronger result
Theorem 2.10.
Let be transitive. Then .
Proof.
The direction is given by Proposition 2.9. Let us show that . Recall that Let be the largest integer such that there exists a point such that
so that . Observe that we can always choose in because is transitive: in fact, consider the smallest such that (this is possible as is transitive). Then
This forces and therefore .
Set
It is easy to see that is nonempty by the choice of , and is a projective subspace of that intersects , because . We want to show that the dimension of is zero, so it consists only of one point. Consider (that has the same dimension of ) and assume by contradiction that its dimension is greater than or equal to . Then its intersection with is nonempty as
is a projective hyperplane, so let
. Set and observe that for any as , but also by construction, which is a contradiction by the maximality of . This forces which forces . Now, since (each of the conditions imposes an equation), this forces . Therefore . ∎Remark 2.11.
Transitivity is necessary for the result above to hold: consider for example the non transitive map of given by . The absolute jump index is (no point at finite is mapped at infinite).
2.2. Constructing a Transitive Fractional Jump
The fractional jump of a projective map can be formally defined as follows
Definition 2.12.
Let and
The fractional jump of is the map
Remark 2.13.
The fractional jump is clearly welldefined but its definition depends on the point where it is evaluated, which might be an issue if one wants to describe the map globally. Theorem 2.15 ensures that this is not the case.
Obviously, if one starts with a transitive projective automorphism one will get a transitive fractional jump. Interestingly enough, the converse implication is also true, apart from two degenerate cases, see [bib:AGM18, Theorem 2] where this issue is settled. We report the result here for completeness
Theorem 2.14.
Let be an automorphism of and let be its fractional jump. Then, acts transitively on if and only if acts transitively on , unless is prime and , or and , with explicit examples in both cases.
In [bib:AGM17] an explicit global description of a fractional jump was given.
Theorem 2.15 ([bib:AGM17, Section 5] or [bib:AGM18, Theorem 1]).
Let be a transitive automorphism of , and let be its fractional jump. Then, for there exist
of degree such that, if
and  
then if . Moreover, the rational maps can be explicitly computed.
Remark 2.16.
Observe that the datum of a fractional jump
is equivalent to the datum of the vector of degree
polynomials where .3. Fractional Jumps in Practice
In this section we describe some aspects of the practical implementation of fractional jumps.
3.1. Compact description
In this section we give a compact description of a Fractional Jump. We first need an ancillary lemma
Lemma 3.1.
Let be transitive. For , set and set to be the denominator of . Then and for any we have that .
Proof.
First observe that since is transitive we have that:

the characteristic polynomial of is irreducible and equal to the minimal polynomial

is different from 1, as otherwise no point at finite is mapped at infinity and therefore the map cannot be transitive on .
Let be the smallest integer such that . Of course, we can assume . By degree reasons, there exist such that . But this implies that the matrix
has the last row identically zero, so it is not invertible. But since the characteristic polynomial of is irreducible, any matrix in is invertible. This forces . But then the polynomial is zero at and therefore divisible by the minimal polynomial . But since and has degree , we must have , which is a contradiction because has degree . ∎
We are now ready to provide a compact description of a fractional jump.
Theorem 3.2.
Storing a fractional jump requires at most bits.
Proof.
Algorithm 1 produces a fractional jump from a transitive projective automorphism. Now observe that the bit size of is the same as the bit size of , which is . The bit size of is as we were able to use the relation . More in general, the bit size of is as we can use the relation . The process terminates and it is well defined because of Lemma 3.1. Adding everything up we get
∎
3.2. Expected cost of evaluation
Evaluating a fractional jump is a very easy task, as it involves only one inversion in the base field. In this section we compute the expected cost
of evaluating a fractional jump, essentially weighting the computational cost with the probability that a random point in
is selected.Definition 3.3.
Let be a map on . We define the expected cost of computing on to be
where denotes the number of binary operations needed to evaluate at .
We now compute the expected complexity of evaluating a fractional jump sequence in the large field regime, which is the one for which we have the nice discrepancy bounds in [bib:AGM17, Section 8].
Theorem 3.4.
Let be a prime, be a transitive projective automorphism, and be its fractional jump. Suppose that has a representative in having entries in . Suppose that . The expected cost of evaluating a fractional jump is .
Proof.
We want to estimate the average cost of Algorithm
2. As usual, set and for setand
For , by the fact that has small coefficients, evaluating and involves at most sums. Therefore, we have that , where is the cost of an inversion, is the cost of a multiplication in and the cost of an addition in . For and , evaluating and becomes more expensive, as it might involve also multiplications by elements of for each component (the coefficients ). The final cost of evaluating at is then . Since there are elements in and in the union of the rest of the ’s we have that
Since and are all polynomial time operations in , we have that and then
Observe that if one uses Fast Fourier transform for multiplication
[bib:SchStr71] and Schönhage Algorithm for inversions [mullen2013handbook, Remark 11.1.99] we have thatand
Adding two integers modulo simply costs , from which we get the final claim. ∎
Example 3.5.
Fix for example and . One can check with a computer algebra system (for example SAGE [bib:sagemath]) that is a prime number and that is an irreducible polynomial. It follows directly from Definition 3.3 that is projectively primitive and therefore the projective map produced by its companion matrix (see Remark 2.5) verifies the hypothesis of Theorem 2.4, and thus it generates a transitive fractional jump verifying the hypothesis of Theorem 3.4. Computationally it is very easy to produce projectively primitive polynomials, but it would also be interesting to give a systematic way to construct them (such as the one using ArtinSchreier jumps in [bib:AGM18]).
Remark 3.6.
In terms of expected complexity (and whenever the coefficients are carefully chosen) fractional jumps behave better than ICGs, as we are about to explain. In fact, let us now compare the result of Theorem 3.4 for with which is essentially the case of the ICG (see [bib:AGM17, Example 2.4]). Evaluating an ICG having small coefficients costs one inversion whether evaluating a Fractional Jump with small coefficients costs averagely . Notice now that if is a large prime and is relatively small we have that . On the other hand, an ICG only generates one pseudorandom point at each iteration, whether instead the Fractional Jump construction generates pseudorandom points.
3.3. Compound Generator for Fractional Jumps
In this subsection we show that the compound generator construction for the Inversive Congruential Generator easily extends to a fractional jump and provide an example.
Theorem 3.7.
Let and be positive integers and be distinct primes. For any , let be a transitive projective automorphism of and be its fractional jump.
Let and . There exists a transitive map on such that, for any , its reduction modulo is .
Proof.
Let
and be a representative modulo of the inverse of modulo . Set and the map which takes as input an element of and outputs its canonical representative in . Consider the map
where
First observe that is well defined, as it is a sum of well defined maps. We have now to prove that is a bijection. To see this, notice that we have the following diagram
where is the natural reduction of modulo . The diagram is commutative thanks to the choice of , which is zero modulo for any , and modulo is equal to . We want to prove first that is surjective. Let and consider . Since is bijective, there exists such that . By the Chinese Remainder Theorem we can find such that for all . It is now immediate to see that . So is surjective and therefore bijective as is a finite set.
We have now to show that is transitive. To see this, we will show that the order of an element is zero modulo for any , so the claim will follow as the order of at is at most . Suppose that is a positive integer such that , then applying on both sides and using the commutativity of the diagram we have that
from which it follows that must be divisible by as is transitive. ∎
Remark 3.8.
Notice that also other lifts to would be suitable for the compound generator, not only the canonical one .
Example 3.9.
To fix the ideas for our constructions, we produce here a small toy example for and . Let us construct first a transitive projective map over . For this, consider the polynomial and its companion matrix
To compute the fractional jump of we also need the matrices and :
The fractional jump of is then
We now need a projectively primitive polynomial of degree over . We select . Its companion matrix is
Analogously, one computes the fractional jump of obtaining
The compound generator of and is then
where (resp. ) is the obvious map lifting (resp. ) to (resp. ) in . One can check directly that is in fact transitive on .
4. Some ideas to achieve unpredictability from a fractional jump sequence
Since we already have nice (provable) distributional properties of FJs given by the results in [bib:AGM17] (which make Fractional Jumps suitable for Monte Carlo methods for example), in this section we would like to provide some modifications of the fractional jump construction that could be of use for pseudorandom number generation in settings where unpredictability is a critical property (such as cryptography). In this setting we have an opponent observing the stream of pseudorandom numbers and he must not be able to reconstruct the generator, or predict next values of the stream.
Remark 4.1.
We would like to observe that the main issue we encounter when we want to use the basic fractional jump construction for pseudorandom number generation in a cryptographic setting is the following: when the base field is large, on most of the points of we act as rational functions in variables of degree (more precisely in the notation of Theorem 2.14 we act as on all points of , which are . Therefore, for each pseudorandom number we observed, we get a system of linear equations in the coefficients of the rational functions defining . It is therefore expected that in points we can reconstruct by solving a linear system (assuming that all the points in the iteration lie all in , which is a reasonable assumption as it has size comparable with ).
In what follows we describe some constructions which seem to avoid the issue presented in the remark above.
4.1. Secret prime
Here we follow the ideas of [anshel1997zeta]
. Choose two large odd primes
with the property that and if is odd. The designer keeps secret, constructs a secret full orbit fractional jump , and chooses a secret starting point . Consider now the canonical lift . The pseudorandom sequence is then produced as . To avoid the small biases given by the reduction one can use rejection sampling by skipping elements of the sequence that have components that are congruent to or modulo . Of course, should be chosen relatively small compared with .4.2. Forcing jumps
Let be a fractional jump, be a subset of roughly of size , be its complement. Define the map
The designer keeps , , , and , secret and outputs the sequence . If one wants to reconstruct the fractional jump , according to Remark 4.1, one would need to observe at least iterations of . But in this contruction either or is used with probability , therefore in order to reconstruct the attacker has systems to solve, one of which will lead to the reconstruction of . Notice that with this construction the orbit of starting at any point is bounded from below by .
5. Further research
In this section we list some questions arising from the theory of fractional jumps.
Of course, any primitive polynomial is also projectively primitive. Moreover, we saw in Corollary 2.7 that whenever is small, finding a primitive polynomial or a projectively primitive polynomials are equivalent problems.
Question 1.
For a fixed degree (e.g.
Comments
There are no comments yet.