Note that the below material is well-known among experts.

Let be any prime not dividing . Then modulo is invertible, and modulo , the system has a unique solution. Moreover, for any integer , the system has a unique solution modulo : this is true since is also invertible modulo – for that, it suffices to check that the determinant of is a unit, which it is since it is coprime to . Moreover, if is a solution to over the integers, then modulo is the unique solution of modulo . Hence, if we choose such that bounds all coefficients of the solution , we can recover a solution to over the integers from a solution to modulo , by chosing the unique preimages in .

This opens the question on how to solve modulo . For that, a Hensel-like lifting technique can be used. (In fact, this follows from Bourbaki’s generalization since the Jacobian of the map , equals .) Assume that we have an which satisfies . We want to find with . Write with . As , and as is divisible by , we obtain the linear system . Hence, it suffices to solve linear systems over the prime field to solve over .

This yields the following algorithm:

1. Choose p := 2.
2. Solve A x = b modulo p.
3. If a unique solution exists:
   1. Set e = 0 and lift x to the integers with coordinates in .
   2. Compute c := A*x - b.
   3. If c = 0, return x.
   4. Solve A y = c/p^e modulo p.
   5. Set x := x + y*p^e and e := e + 1.
   6. Adjust x modulo such that all coefficients are in .
   7. Go back to Step 3.2.

   Else:

   1. Choose the next prime p and go back to Step 2.

The only subprogram we need is a linear systems solver for with square over a finite field, which returns information on the number of solutions. (Note that is not divisible by if and only if there is a unique solution.) If more information is known on the matrix , for example its determinant has been already computed, this information can be used as well.

Let us analyze the running time of this algorithm. Denote by the smallest prime not dividing , and by the time the linear system solver over needs to solve a system of size . Let (resp. resp. ) denote the largest absolute value of an coefficient of (resp. resp. ).

Clearly, the number of iterations is in . In each iteration, one linear system over of size has to be solved, and has to be evaluated. The former takes operations, and the latter involves multiplications and additions of integers of size and , and substractions of integers of size and . For simplicity, assume that . Finally, to compute , we need multipliations of integers of size and , and additions which can be neglected. Clearly, the multiplications can also be neglected, since the evaluation of already is slower.

Let denote the time a multiplication of two numbers of size needs. Then inside the main loop, we need time units, and the main loop alltogether needs time units. Finding needs time units (using the Prime Number Theorem).

Assuming that we use a naive Gaussian algorithm as well as naive multiplication, i.e. and , we obtain a total running time of Using fast multiplication, i.e. (using FFT methods), and fast linear system solving, i.e. , where , we obtain a total running time of

Now let us try to eliminate from this expression. Clearly, the the second part, we can use that . To eliminate from the first part, we need to find an upper bound. For that, let us first stick to , the smallest prime not dividing the integer . (Letting be a -matrix yields ; in general, using this notation.) Now is divisible by , whence for we have . Note that for integral , , where denotes the Chebyshev function. Using known bounds on , we get Therefore, becomes true for for every . This shows that eventually holds for , yielding and, thus, . Using the Leibniz formula, .

Finally, we can use some linear algebra to bound in terms of and . First note that , where denotes the identity matrix and denotes the adjungate matrix of . As , we see that it suffices to bound . Now the coefficients of are determinants of matrices with coefficients coming from , whence . Therefore, when assuming that .

This can be combined into the following theorem:

Theorem.

Assuming that and , the above algorithm needs time units to compute the unique solution of using naive arithmetic in , , and naive Gaussian elimination to solve linear systems over . Using fast linear algebra and fast multiplication, we only need time units for any .

□

So I began working this out to see how far I could get. It is rather easy to translate the whole problem into a question on some integers. Namely, assume that is an integer, and we are given integers with . Define the quantity as One can show that this is always a non-negative integer. Now I claim that is either 0, or .

Where does this strange expression comes from? Consider the function field over defined by (In fact, one can do this over any field whose characteristic is coprime to , and which has at least elements. Moreover, over an algebraically closed field , any function field extension which is cyclic of order , where is coprime to the characteristic of , can be written in this form, since this is a Kummer extension.) One can show that this equation is irreducibe if and only if , and that the genus of this function field is given by . This also explains why we must have that , since the genus is always a nonnegative integer.

Now we have a struggle: is it easier to show the claim using some Elementary Number Theory, or using some (advanced?) Algebraic Geometry (considering the geometric side) or Algebraic Number Theory (considering the function field side)? I don’t have any idea how to use the latter two to prove this, but I found an elementary proof.

First, note that if , or in case and , at least five of the terms must be since is not divisible by . Therefore, .

Moreover, if , we have , and therefore and . Hence, Therefore, it suffices to consider the case and .

For , note that implies . Hence, there is nothing to show.

For , let me consider three cases.

1. for some prime ;
2. for some prime ;
3. for two distinct prims .

In all three cases, one can show by analyzing several cases that the claim is true. Thus, we are only interested in the cases where no is of the form , , . Therefore, for all . Since not all ‘s cannot be the same – this would contradict – we must have

Let me demonstrate how to do . (In fact, this case suffices if one does not wants the constant , but one is happy with the constant , since .) Assume that for some prime . Since we must have , with in case . In both cases, we have .

In case , implies . Therefore, . In case , implies . Therefore, we also have This yields The latter inequality is true if and only if If we write , this translates to if , , and if , . Hence, the only cases were the above argument does not work are () and (, ).

In case , we must have and . In that case, , whence In case , since we do by assumption , we obtain , whence since .

The cases and are proven analogously, with a few more case distinctions.

So we are left with the case . Here, one can proceed in a similar, painful way. Or one increases the constant to , since we know that not all ‘s can be , whence one is at least . Hence, which yields the claim.

To sum everything up, we showed the following theorem:

Theorem.

Let be an integer, , and satisfy . Then , defined as satisfies , and if it is strictly larger than zero,

□

As mentioned, if one invests more work, one can actually show . For my preprint though, this is not worth the trouble.

-adic integers and numbers

The -adic numbers.

Let us begin with the -adic numbers. They are a non-achrimedean analogue to the real numbers, whence we want to discuss the real numbers first. There are many different constructions of the real numbers. We pick a certain one, namely construction as a completion of the rational numbers. For that, consider the archimedean distance respectively the archimedean absolute value Recall that a sequence is said to be convergent with limit if for every , there exists some with for all . Note that every convergent series is a Cauchy sequence, i.e. it satisfies But not every Cauchy sequence in converges. One reason to use the real numbers is to add limits of Cauchy sequences, so that every Cauchy sequence (with coefficients in ) converges. More precisely, consider the set of Cauchy sequences, ; this is an -subspace of , the space of all functions (i.e. all sequences). Consider the subspace of sequences converging to ; note that . Therefore, we can consider the quotient ; embeds via the diagonal embedding, i.e. maps to . One quickly checks that is a ring, and that every non-zero element is in fact invertible, i.e. it is a field. Moreover, one quickly checks that the canonical order on extends to ; this allows to define and for in the same manner as for rational numbers. Moreover, one sees that all Cauchy sequences in actually converge.

The -adic numbers can be constructed in a very similar way. Fix a prime number , and condider the -adic valuation on , defined by if are not divisible by . Moreover, set . Then, we can define the -adic absolute value , ; then if, and only if, ; we have that the strict triangle inequality is satisfied; and we have that ; here, are arbitrary. Such absolute values which satisfy the strict triangle inequality are called non-archimedean absolute values.

Remark.

In fact, one can show that these -adic absolute values together with the above Archimedean absolute value are all absolute values on up to equivalence; here, we say that two absolute values are equivalent if there exists some number with for all .

Now let us continue with the -adic numbers. We can define Cauchy sequences and the notion of convergence as above, by replacing by . As above, we obtain that has a completion with respect to which forms a field, denoted by . This is the field of -adic numbers. Also, and extend onto . As opposed to the case of the real numbers, the image of resp. do not change; the reason is that is a discrete valuation, i.e. attains only integers. Actually, this field has several interesting properties, which we want to collect.

Theorem.

1. For every , .
2. The set is a subring of ; denote this subring by .
3. For any , we have that and are both open and closed in . In particular, is both open and closed.
4. We have that
5. The ring is local with maximal ideal , and . In fact, is a discrete valuation ring.
6. The series with converges if, and only if, .
7. Every non-zero element can be written uniquely in the form , where for all , and .
8. For every , .
9. If is equipped with the topology induced by the metric , then is the maximal compact subring of .

Proof.

1. Let , sequences in with , . Then, for every , . Now is a topological ring, and is continuous, whence the result follows from applying .
2. From (a), we see that this set is closed under addition. That it is closed under multiplication is clear, and are contained in it as well.
3. Write with and . Now , and
4. Let be a sequence of elements in which converges with respect to . Then for all as ; as is continuous, .
   Conversely, let and let be a sequence of elements in with . Now is open; therefore, there exists some with for all . Without loss of generality, we can assume that , i.e. all lie in . Moreover, we can assume that for all . We want to construct a sequence in with . For that, write with , where is not divisible by . Let be such that and set ; moreover, write with . Then whence . Therefore, one obtains that .
5. One quickly checks using 1. that is closed under addition. It is clearly also closed under multiplication by elements of , and contains 0; therefore, it is an ideal. Now consider the map ; clearly, , whence is contained in the kernel of this map. But is not contained in the kernel, as ; therefore, contains a copy of . To see that this is everything, let ; let be a sequence in with . Let be such that for all , ; then , whence . But is contained in the copy of .
6. Clearly, if the series converges, we must have that .
   Now, conversely, assume that . We show that with is a Cauchy series. For that, let be given. Choose such that for all , . Now, if with , we have that by 1., what we had to show.
7. First, for any choice of the ‘s and ‘s, we obtain an element in . Now assume that with . Assume that there exists some with , and further assume that is chosen to be minimal under this condition, i.e. for all . Then . Multiplying with gives with . Moreover, , and . But now , whence . But by construction , a contradiction. Therefore, the representations are unique.
   We have to show that every element in can be written in this way. For that, let ; now satisfies ; in particular, . We have to show that we can write with . For that, let be a sequence in with ; without loss of generality, we can assume that for every . Then we also have for every , whence . Therefore, we can choose inductively such that , and we obtain that . Finally, since (which follows from the strict triangle inequality), it follows that .
8. Clearly, ; therefore, using 7., we see that every residue class in is uniquely described by , where . Hence, . Now, as in the proof of 5., we see that injects into , whence this injection is in fact a bijection. Thus .
9. Let be any compact subring of and . If , then for . Hence, is unbounded, a contradiction.
   Hence, it is left to show that is compact. For that, it suffices to show that any sequence in has at least one accumulation point. Let be any sequence in . We claim that for any , there exists some such that contains infinitely many elements of the sequence. For this is clear for any choice of ; hence, assume that this is the case for some . Now ; now there must be some such that infinitely many of the ‘s lie in (otherwise, only finitely many can lie in ); set . We see that is a Cauchy sequence, whence exists. Now by construction, is an accumulation point of . Therefore, is compact.

□

Before we continue, we want to explore another construction of which is completely algebraic. For that, we need the projective limit in the category of rings:

Definition.

Let be a directed set and for every , let be a ring. Assume that for every with there exists a homomorphism such that for all with , we have , and we have . Such a tuple is called a projective system. A projective limit of is a ring together with homomorphisms such that if , which satisfies the following universal property:
If is any other ring and any other family of ring homomorphisms with whenever , there exists a unique homomorphism with for all .

We have the following, classical result:

Theorem.

For every projective system of rings, there exists a projective limit which is unique up to unique isomorphism; i.e., for any two projective limits and there exists a unique isomorphism such that for all .
Moreover, a projective limit can be constructed as where is the restriction of the canonical projection to the subset .

□

Definition.

Let be a projective system. Define the projective limit of it as any projective limit, and denote it by .

Hensel’s Lemma.

Hensel’s Lemma can be formulated in a very algebraic way. All rings in this section are commutative and unitary.

Definition.

Let be a ring and an ideal of . We say that is nilpotent if for some . We say that is a nilideal if every is nilpotent, i.e. if for every there is some with .

Note that in Noetherian rings, nilideals are already nilpotent, since ideals generated by finitely many nilpotent elements are always nilpotent. (Note that our rings are commutative. Otherwise it won’t work.)

Proposition (Hensel's Lemma).

Let be a ring and a nilideal in . Let and such that and . Then there exists a unique with and .

Proof (Part I).

First, assume that both and satisfy and . Using , we see that for some using Taylor expansion. Since is a unit in , there exist some , with . How is nilpotent, whence , i.e. . But this means that , whence . This shows uniqueness.
Moreover, we want to show that it suffices to require that is nilpotent. Cosider the subring of which is the smallest (unitary) subring containing the coefficients of and , and some fixed with . This ring is clearly finitely generated, whence Noetherian, and is a nilideal in as well. Since is Noetherian, is in fact nilpotent. Moreover, since . Hence, it suffices to prove the lemma for instead of .

□

We will complete the proof later. First, let us discuss some implications of this result. Consider the ring and , where . Then clearly is nilpotent in , whence we can apply Hensel’s lemma to this situation. Assume that is a polynomial and with ; if then , there exists a unique with and . Doing this construction for and all , we obtain a sequence of elements with and , i.e. we obtain an element of !

In particular, let be any element with . Consider . Now there exists some with ; therefore, . But this implies that there exists a unique with and . (Since is unique modulo , it follows that is uniquely defined by , i.e. by .) Hence, we have shown that any integer is invertible in if . But how to compute ? We will discuss this later; for now, note that we can use the Extended Euclidean Algorithm to find with ; then , i.e. we can approximate up to arbitrary precision.

What about ? In that case, : if would have an inverse in , say , then we would have , a contradiction. Therefore, we get:

Proposition.

We have that

□

Newton Iteration.

In the last section, we ignored two points: first, how to prove existence in Hensel’s lemma, and second, how to compute this element in a constructive way. We want to fix this now. For this, we describe how Newton’s method works in arbitrary rings!

Let be a polynomial, a nilpotent ideal, and such that and . Fix some with , and consider the sequence We claim that for all ; since is nilpotent, this means that the sequence becomes stationary eventually and gives a root of . Moreover, we claim that , whence for all .

Assume that this is true for some , i.e. we have . Then . Now , whence . To show that , we again use the Taylor expansion; by it, for some . Now , whence . Moreover, . Combining this gives .

Therefore, the proof of Hensel’s lemma is completed. Moreover, we obtained an algorithm to refine an approximation of without using the Extended Euclidean Algorithm: as soon as with is known, we can compute modulo by applying the Newton iteration only times. Moreover, we can start with some intermediate result, say modulo , to compute modulo (with ) in at most iterations (which each need one multiplication and one addition modulo ). This is considerably faster than applying the Extended Euclidean Algorithm for and .

So, What About in ?

Assume that ; then we know that . Consider the polynomial ; clearly, in , and is a unit in . Therefore, we can use the methods from above to compute .

First, we need an approximation of modulo . For that, use the Extended Euclidean Algorithm to compute with ; then satisfies , i.e. .

Set and . Then, by the above, . Hence, this allows to approximate up to an error of in iterations; we only need to perform the Extended Euclidean Algorithm once (to get a starting value), and from that, we can refine the approximation by applying a linear map.

As an example, let us consider in , i.e. , and . Clearly, , whence we get . Hence, . Now and , whence , . We rapidly get Hence, it seems that i.e. we have And indeed: since Note that follows from the fact that , whence converges in (see the theorem); this is a geometric series, whence its value is . Hence, if we multiply by , we obtain .

Finally, let us consider another example, namely in , i.e. , , ; then , i.e. . Hence, we obtain and . We then obtain This can be continued a long time, without seeing any pattern.

One would expect that the sequence of digits evenutally gets (eventually) periodic, as it happens with the decimal expansion of rational numbers. For that, assume that we know , where are coprime and not divisible by , and . Now let be the order of in the multiplicative group ; hence, it is the smallest non-negative rational number with . Then . Now, by the geometric series (as above), whence Moreover, write with such that . Then , and . Set ; then, if we write , we see that We are left to consider the part. In case , the -adic expansion of has finite length, whence adding it does not change the periodicity of . But what if ?

Lemma.

Let , where . Then

Proof.

Clearly, whence adding results in the statement.

□

Therefore, the -adic expansion of is periodic if , with almost all -adic digits being . Now, we can conclude with the fact that the sum of two periodic -adic expansions is periodic.

Conversely, assume that with and ; we claim that . Clearly, without loss of generality, we can assume that . But then, if we set , Hence, we proved:

Proposition.

An element with lies in if, and only if, there exists some such that for all , .

□

Finally, note that the order of 17 in is ; hence, the period length of is probably 616. We would have had to compute a high amount of -adic digits of to see this.

“Given a lattice . How do I find a basis of this lattice?”

(Note that this question is far from being well-posed.) The second question is,

“If is a finite abelian group and , how do I compute the structure of , the subgroup generated by these elements?”

The third question comes up in the description of algorithms, for example of the baby-step giant-step algorithm by D. Shanks, an optimization by D. Terr, and more general algorithms, like the Buchmann-Schmidt algorithm. These algorithms can be described in terms of the first question, making them easier to understand.

We begin with sketching the relation between lattices and finite abelian groups. If is a finite abelian group, and some elements, for example, a set of generators, consider the map This turns out to be a group homomorphism onto . The kernel of , which we will denote by , is called the relation lattice. This is in fact a lattice in of volume note that by the Homomorphism Theorem, . On the other hand, if is a lattice, then is a finite abelian group of elements. Moreover, if the residue class of , the vector consisting of zeroes except a one at the -th position, in is denoted by , then . Therefore, lattices in and finite abelian groups with generators are essentially the same thing.

How is this related to group structure computations? Recall the Smith normal form; this allows to convert a basis of a lattice into another basis, such that if one applies an invertible linear transformation to , this basis is sent to with such that divides , ; then, . Hence, computing the structure of a finite abelian group generated by can be split up in the two parts, (a) computation of a basis of the relation lattice and (b) computation of a Smith normal form of this basis. There exist a lot of algorithms for computation of Smith normal forms; usually, the bottleneck is finding a basis of .

Often, the process of finding a lattice equals determining the relation lattice of a finite abelian group, or something similar. One often has a way to test whether , by computing a unique representation of the residue class ; then, one tries to find two ways of writing the same residue class, but with : then is a non-trivial element of . If one sets , then this means that one seeks for pairs , , where and , such that and .

More generally, assume that is a finite set and is a map such that for all . Our above example, and satisfies this. Moreover, assume that is “mostly injective”, i.e. that implies that one can find such that , , with very little effort. Then one can work with elements with , and try to find two such pairs , with ; then this gives rise to an element of near to .

Which brings us to the subject of explaining algorithms. Consider, for example, Shanks’ baby-step giant-step algorithm. You are given a group element of finite order together with a bound . Then, for the algorithm, one computes , as well as , and compares this elements with the first elements. Any match will result in a multiple of the order of . But why is this the case? One can of course try to prove this; it is actually not very hard, in fact one just needs Fermat’s Little Theorem as well as long division. But one can do better, by visualizing the algorithm in a way which makes the solution looking obvious, and which allows even people who have no understanding of formal mathematics or computer science to immediately realize that the algorithm produces the correct result.

Namely, you might have guessed it, the order of generates the relation lattice . Hence finding the order is equivalent to finding a the smallest positive element in . For this correspondence, we use the pairs with as above. Two pairs with gives a multiple of the order of . Now, the algorithm can be interpreted as translating the set of elements by , , , and checking if a lattice element is contained in any of these translates. If one visualizes this, one immediately sees that this method will eventually find the smallest non-zero element of the lattice. First, this depicts the lattice (gray dots) with its sublattice (black dots), with the set drawn in for :

The next figure depicts the translates of by :

One directly sees that the translates , cover all positive integers, and that every positive integer is contained in exactly one translate. Moreover, one sees that if the first translate contains at most one lattice element, the first translate which contains a lattice element uniquely determines the smallest positive integer. Note that in case is the order of , then one can minimize the number of operations by chosing .

Now let us consider Terr’s modification of the baby-step giant-step algorithm; there, the situation is a bit more complicated. In Terr’s algorithm, the bound from above constantly changes, starting with . Written as pseudo-code, the algorithm looks like this:

1. Let and , and let and .
2. If for some , return .
3. Set , and set .
4. Compute and .
5. Go back to Step 2.

There is no obvious reason why this should work. Note that the test whether means that one translates by the exponent of , which turns out to be . One immediately gets the idea if one draws the first few translates:

This is another tiling of , where every positive integer is contained in exactly one translate. This tiling has the property that the first time occurs for some is when the order of is found, and one no longer has to fix a bound before. The asymptotic complexity of this method is the same as the previous method in case , but in case is chosen the wrong way, the first algorithm will perform worse than the second. Another way to visualize the second agorithm is to depict the set together with , where and , for :

Let be a global field, i.e. an algebraic number field or an algebraic function field with a finite constant field. In the first case, let be the roots of unity and . In the latter case, let be the exact field of constants.

Let be the set of infinite places of . If is a number field, the elements of correspond to embeddings of into up to complex conjugation. Define , and for let be a corresponding embedding. Then define for and if , or otherwise, and define . If is a function field, let , i.e. ; in this case, there exists an element whose poles are exactly the elements of , i.e. are the places of lying above the infinite place of . In all cases, is finite and non-empty.

For a non-archimedean place of , let be the valuation ring and its maximal idea, and denote the discrete valuation by . Then set and , . Define . In the number field case, let , and otherwise .

Denote the set of places of by . The divisor group of is , and for define . This is a homomorphism ; denote its kernel by . For , is a principal divisor; let the group of all these be denoted by . Then is the divisor class group of and its degree zero part.

The support of a divisor is the set . Consider the subgroups then . Moreover, let . The set is a Dedekind domain, whose maixmal ideals correspond to the places in . Moreover, the fractional ideal group is isomorphic to by , in case ; the inverse is given by the restriction of , to . The group of fractional principal ideals equals . The quotient is the ideal class group of . Putting all these things together, we get the following diagram with exact rows and columns: Here, and are essentially defined by the diagram, i.e. are the kernels and cokernels of the respective maps. In the number field case, , and in the function field case, .

A Geometry of Numbers in Global Fields.

Let and . Define If and is the Riemann-Roch space of , then . In particular, the set is finite and invariant under multiplication by elements of ; in case is a function field, is a finite-dimensional -vector space, whose dimension is described by the Riemann-Roch theorem. In the number field case, we can make statements on with Minkowski’s Lattice Point Theorem.

Consider the map Then is a lattice by Dirichlet’s Unit Theorem, and . We get , and is called the unit rank of . This will be the lattice for our -dimensional infrastructure.

Reduced Ideals.

The elements of will be principal reduced fractional ideals, modulo an equivalence relation. We begin by defining minima, which are similar to the ones introduced in the previous post for lattices.

Definition.

Let and . We say that is a minimum of if every with for all satisfies for all . Denote the set of all minima of by .

Using them, we can define reduced ideals:

Definition.

An ideal is said to be reduced if is a minimum. Write for the set of all reduced ideals of . For let .

The equivalence relation we need is defined by for . We then get the following results:

Theorem.

1. We have that is a finite set.
2. In case for some , we get for if, and only if, .
3. We have that acts on by multiplication.
4. The map is a bijection.
5. If and satisfies , then .

□

The proofs of these and the following results or hints to the proofs can be found here. We next construct the map :

Theorem (Infrastructure, Part I).

Fix an ideal . Define and define Then is well-defined and injective.

□

For , write Define and Then is the unrolled version of : if , is the projection, and , , then the following diagram commutes: In particular, is the set from the previous post.

The Reduction Map, -Representations, and the Infrastructure.

We proceed by defining -representations, as giving these is equivalent to give a reduction map. Fix an ideal .

First, define for where is the lexicographic order on .

Definition.

A tuple is said to be an -representation if is a smallest element of with respect to . Denote the set of all -representations by .

One quickly sees that this is well-defined. We have two auxilliary results:

Lemma (Uniqueness).

Let and such that Then for all , i.e. .

□

Lemma (Reduction).

Let . Then there exists a smallest such that . If is minimal with respect to in that , then and .

□

From that, we get the following result:

Theorem (Infrastructure, Part II).

Let . Then the map is a bijection.

□

This allows to equip with a group operation. We will see that the group operation of can be described in a very explicit form. This extends to a broader interpretation of the infrastructure, whence we will do this in the next section.

Before ending this section, we want to state a result which shows that -representations are small.

Theorem.

Let , then , for all and where here, is the genus of in case is a function field, and in case is a number field, denotes the number of places of degree two and is the discriminant of .

□

Therefore, -representations are small.

The Infrastructure and the Divisor Class Group.

Assume for a moment that , or that is a number field. Then we have a short exact sequence and . This means that the divisor class group is covered by copies of , where the copies are indexed by the elements of the divisor class group. If and are in the same ideal class, and differ by a translation, i.e. they give essentially the same infrastructure; in fact, . Hence, one could get the idea to cover by , where ranges over the distinct ideal classes, i.e. by . It turns out that this is indeed the case, and the arithmetic on and turn out to be the same under the bijection we get.

In case is a function field and , we have in general (this is the case if, and only if, ), and does not needs to be surjective. It would be nice to change the above sequence to in any case, but this is not possible with as it is; we have to replace it by something bigger. It turns out that the right replacement is , which is canonically isomorphic to in case . We then get the diagram with exact rows.

The complete result is stated in the following theorem:

Theorem (Infrastructure, Part III).

1. Let be a number field. Then the map where equals , is a bijection.
2. Let be a function field. Then the map is a bijection.

Moreover, is a group homomorphism, where the group structure on is the one induced by the bijection .

□

Finally, we explicitly describe the group operation induced by this bijection on without using the bijection itself.

Theorem.

Let be the bijection from the previous theorem, and let .

1. Set for . There exists a minimal with , and if is a smallest element of with respect to , we get with .
2. Set for . There exists a minimal with , and if is a smallest element of with respect to , we get with .

This shows that the -dimensional infrastructure we defined has a very close connection to the arithmetic of the divisor class group. This connection was first shown for real hyperelliptic curves by H.-G. Rück and S. Paulus, “Real and Imaginary Quadratic Representations of Hyperelliptic Function Fields”. The first relation between the infrastructure of number fields and the Arakelov divisor class group was described by R. Schoof in his paper Computing Arakelov class groups.

What about… Baby Steps?

As I mentioned, there is no known construction for baby steps in general -dimensional infrastructures, but there exists a construction for infrastructures obtained from global fields. I want to describe this construction here.

For and , consider for . There exists a minimal such that . In case , contains exactly one -orbit, which gives a unique element . Otherwise, one has to add an order (lexicographic order as above) to chose an element. In any case, define ; then this gives a function resp. for any . Opposed to the one-dimensional case, this function neither has to be injective nor surjective, as examples below will show.

We begin with a “small” example: the infrastructure of the function field defined by over . The red arrows show , the blue arrows and the green arrows . The small black circles denote usual minima, the larger black circles denote elements of , and the shaded areas denote translates of an fundamental parallelepiped of :

Unfortunately, the second example is too large for WordPress.

-dimensional infrastructures

First, introduce on a lexicographic order as follows: for and , define Note that this choice is rather random and can easily be replaced by other choices.

Assume that is a lattice, a finite set and injective. Consider the projection , and . Defining a function is the same as defining a function which is invariant under , i.e. satisfies for all ; in that case, we can set . Note that the condition translates to .

Hence, we have a discrete set which is invariant under translation by , and we want to define a function satisfying .

Both of the two sections which follow describe one way to obtain such and . The way describes in the second section fits perfectly for all totally real number fields : think of as the image of the ring of integers under all embeddings , i.e. The first section resembles more the general global field situation. The set will consist of a finite set of ideals with bounded norms. The degree map will be the logarithm of the norm, and the ‘s correspond to the degrees of the infinite places.

Constructing a Reduction Map.

In this section, we describe a way to construct a reduction map , given .

The main idea in the following is that if we want to define for , to consider the area and look at all elements . By adding additional (numeric) information to every of these elements, one obtains an order (by comparing the additional information) which hopefully has a largest element, or a finite set of largest elements. From these largest elements, one chooses the largest one with respect to the lexicographic order as .

To make this “additional information” more precise, we consider special functions which should behave in a good way:

Definition.

A function is said to be reduction-inducing if

1. there exist real numbers such that, for and , we have and
2. for every , we have

Note that by this definition, there exist such that for all . Moreover, note that these functions with fixed correspond to functions by for .

Let be a reduction-inducing function. For and , consider Note that since for , and , we see that is finite for every choice of . If , we have , and as we get for . Hence, exists. Then, define .

Let be a constant such that for all , we have Note that since is reduction-inducing, a maximal such exists.

Lemma.

For , we have . For any , if , we have and . In fact, .

Proof.

For the first statement, it suffices to show . But note that if , we would have and hence , a contradiction.

For the second statement, note that . Moreover, for , whence we get . This shows the inequality on . Now clearly , whence . Now , whence . As .

□

Using Minima of Lattices.

In this section, we describe how to obtain and from an -dimensional lattice . We require that for every , we either have for for all . More precisely, consider the map , . We assume that there exists a constant with for all .

In fact, one can replace by any discrete subset with some additional properties which give similar results as Minkowski’s Lattice Point Theorem.

Definition.

A minimum of is an element such that for all with for all , we either have or for all . Denote the set of all minima by .

First, we will show that such minima exist:

Lemma.

Let . Then there exists a minimum of with for all .

Proof.

This follows from the fact that is discrete. For , define As is discrete, is always finite.

In particular, is finite. Assume that is not a minimum (in which case we could choose ). Then there exists some with for some . In that case, . Now either is a minimum, in which case we choose , or it is not. In that case, we can repeat the procedure with instead of . As the size of these sets decreases every step and the sets are finite but non-empty, we eventually must find some which is a minimum.

□

Define on by and consider the map First, if, and only if, . Let

Lemma.

Let . Then, there exists some with and . In particular, .

Here, is the determinant of the lattice , i.e. the volume of one fundamental parallelepiped of .

Proof.

For , consider the set By Minkowski’s Lattice Point Theorem, we have for i.e. Since is closed and discrete, a limit argument shows that this also holds for . By the previous lemma, there exists a minimum of which lies in ; let . Now for as , whence .

Now , whence . Now , whence . Therefore, we get i.e. .

□

Define ; this is a discrete subgroup of . We assume that is a lattice in , i.e. contains a basis of . We can define and such that , if , is the projection. To get an -dimensional infrastructure, we are left to define .

For that, we proceed as in the proof of the second lemma in this section. For , consider Let be minimal with , and let . Then satisfies the properties in the statement of the lemma, i.e. lies near to itself. Moreover, one quickly checks that for all .

Hence, we obtain an -dimensional infrastructure.

Definition.

Let be a lattice. Then, an -dimensional infrastructure is a non-empty finite set together with an injective map and another map satisfying .

Again, as in the one-dimensional case, one can define giant steps: Moreover, one gets the same relation between reduction maps and -representations, whence we define Then the map is a bijection, and we can use this bijection to equip with a group law by

Discrete Infrastructure.

Finite Abelian Groups as Infrastructures.

What about baby steps?

The idea is to consider pairs ; the map , is obviously surjective, but far from being injective. Hence, it would be a good idea to restrict to a subset which makes this map both injective and surjective. We want this subset to contain ; note that is injective and essentially equals by the identification , . We obtain the following definition:

Definition.

A set of -representations of is a set such that is bijective and such that .

But how to obtain such a subset? In fact, we already have all ingredients ready, as the following proposition shows, by relating -representations to reduction maps:

Theorem.

Let be a one-dimensional infrastructure. Let be the set of reduction maps and be the set of -representations for . The map is a bijection, with its inverse given by where , is the projection onto the first component.

□

Now fix one corresponding choice of and , and let , be the associated bijection. Then for all with being the projection. Moreover, using the bijection , becomes a group which we will write additively by , which extends the giant steps.

Finally, let be the map we originally defined for infrastructures, i.e. for . In that case, one can compute the group operation on without having to evalute or , with only computing baby and giant steps and relative distances, i.e. resp. for :

Theorem.

Let and , and let . Then can be computed with one giant step computation and at most baby step computations as follows:

1. Compute and .
2. Compute and .
3. If , set and go to step 2.
4. Return the pair .

□

In the case of infrastructures obtained from global fields, we are also able to describe the group operation in without having to evaluate or . In fact, evaluating or is essentially the discrete logarithm problem, for which so far no general polynomial methods for solving it exist in the case of global fields.

I begin with giving an abstract definition of a one-dimensional infrastructure.

Definition (One-dimensional infrastructure).

Let be a real number. A one-dimensional infrastructure of circumference is a pair , where is a finite set and is an injective map.

If you interpret as a circle of circumference (think of it as folding up the real line, such that two numbers whose difference is an integer multiple of are identified), a one-dimensional infrastructure can be seen as a circle with a finite number of dots on it. The map gives the distance between and some element on the circle, whence is called the distance map.

Now one can define two operations on a one-dimensional infrastructure. Due to Shanks’ nomenclature, these are called baby steps and giant steps. To define a baby step, let . Then consider the set . It is non-empty as and bounded from below. Moreover, it is discrete as is finite; therefore, exists and , say with . In that case, we define . This gives a bijective map which, in case , has no fixed points. If is interpreted as a circle and identified with , will send each point to the “next one” in positive direction on the circle.

To define giant steps, let . For that, note that is naturally a group, whence we can add and . Now , but in general . But we can use a similar trick as in the baby step case: we jump back to the previous point of . For that, define . It is bounded from above, non-empty and discrete, whence exists with , say for ; then we define . This gives a binary operation which is in general not associative.

But even though, we have in general, assuming that is small (here, we identify with its smallest non-negative representant). More precisely, we have with , whence the giant step operation is “almost” associative.

Finite Cyclic Groups as One-dimensional Infrastructures.

Let be a finite cyclic group of order . For , one can write with ; note that is the discrete logarithm of with respect to . Hence, we get the isomorphism induced by . As , we get the injective map , , turning into a one-dimensional infrastructure.

Let ; then we get and , i.e. baby steps are multiplications by the generator and the giant steps equals the group operation. In particular, this provides an example for giant steps being associative.

Therefore, one-dimensional infrastructures can be seen as generalizations of finite cyclic groups.

Remarks.

Finally, we want to sketch some ideas, which will allow generalizing infrastructures to higher dimensions. For that, let be a one-dimensional infrastructure. First, define the map as follows. For , define . Again, is non-empty, bounded from below and discrete, whence exists and , say for some . Define . Then satisfies and for all .

If would be any other map satisfying , one would obtain another giant step function , . In case comes from a finite cyclic group, as above, would again be the group operation. If this is not the case, and could be two distinct binary operations on . If satisfies for all , we would also have

This shows that our choice of is rather random; we could also define with , or chose such that , with some additional condition to rule out ties. Any other arbitrary choice of is also possible, as long as is satisfied. We will later see that our definition of is exactly the one we obtain in a canonical way if we obtain infrastructures from global fields of unit rank one. We call such maps reduction maps.