An algorithm for p-groups

In this section we describe an algorithm which solves the decision version of Random Linear Disequations in polynomial time over groups of the form Zⁿ_p^k, for every fixed prime power p^k.

For better understanding of the main ideas it will be convenient to start with a brief description of an algorithm which works in the case k = 1. This case is – implicitly – also solved in Section 3 of [36]. Here we present a similar method. The principal difference is that here we use polynomials rather than tensor powers. This – actually slight – modification of the approach makes it possible to generalize the algorithm to the case k >1.

For the next few paragraphs we assume that k = 1, i.e., we are working on an instance of Random Linear Disequationsover the groupG=Zⁿp. We choose a basis of G, and fix a primitivepth root of unity ω. Then characters ofG are of the form χ_x, where x∈G and for y ∈ G the value χ_x(y) is ω^x·y, where x·y = Pn

i=1x_iy_i. (Here x_i and y_i are the coordinates of x and y, respectively, in terms of the chosen basis. Note that, as ω^p = 1, it is meaningful to consider x·y as an element of Zp.)

Using this description of characters, we may – and will – assume that the input contains the index x rather than the character χ_x itself. We also consider G as an n-dimensional vector space over the finite field Zp equipped with the scalar product x·y above. The algorithm will distinguish between a nearly uniform distribution over the whole group G and an arbitrary distribution where the probability of any vector orthogonal to a fixed vector 06=u is zero.

We claim that in the case of a distribution of the latter type there exists a polynomial Q∈Zp[x₁, . . . , x_n] of degreep−1. such that for every x which occur with nonzero proba-bility we have Q(x) = 0. Indeed, for any fixed u with the property above, (P

u_ix_i)^p−1−1 is such a polynomial by Fermat’s little theorem.

On the other hand, if the distribution is nearly uniform over the whole group then, for sufficiently large sample size K, with high probability there is no nonzero polynomial Q ∈ Z^p[x1, . . . , xn] of degree at most p−1 such that Q(a⁽ⁱ⁾) = Q(a⁽ⁱ⁾₁ , . . . , a⁽ⁱ⁾n ) = 0 for every vector a⁽ⁱ⁾ from the sample a⁽¹⁾, . . . , a^(K).

This can be seen as follows. Let us consider the vector space W of polynomials of degree at mostp−1 inn variables over the fieldZp. Substituting a vector a= (a₁, . . . , a_n) into polynomials Q is obviously a linear function on W. Therefore for any K1 ≤ K, the polynomials vanishing ata⁽¹⁾, . . . , a^(K1)is a linear subspaceW_K1 ofW. Furthermore, by the Schwartz–Zippel lemma (see Section 2.4), the probability of that a uniformly drawn vector a from Zⁿp is a zero of a particular nonzero polynomial of degree p−1 (or less) is at most (p−1)/p. This implies that with probability proportional to 1/cp, the subspace W_K1+1 is strictly smaller than W_K1 unless W_K1 is zero. From this we infer that, if the sample size K is proportional to p·dimW then with high probability, WK will be zero. Also, we can computeW_K by solving a system ofK linear equations overZp in dimW = ^n+p−1_n

=n^O(p) variables.

As already mentioned in Section 2.4, the key ingredient of the argument above – the Schwartz-Zippel bound on the probability of hitting a nonzero of a polynomial – is also known from coding theory. Namely we can encode such a polynomialQ(x) =Q(x₁, . . . , x_n) with the vector consisting of all the values P(a) = P(a₁, . . . , a_n) taken at all the vectors a= (a1, . . . , an) in Zⁿp. This is a linear encoding of W and the image of W under such an encoding is a well known generalized Reed–Muller code. The relative distance of this code

is 1/p.

We turn to the general case: below we present an algorithm solving Random Linear Disequations in the groupG=Zⁿ_p^k wherek is a positive integer. Like in the casek = 1, the characters of the groupG=Zⁿ_p^k can be indexed by elements ofGwhen we fix a basis of Gand a primitivep^kth root of unityω: χ_x(y) = ω^x·y, where x·yis the sum of the product of the coordinates of x and y in terms of the fixed basis. Again, we can consider x·y as an element of Zp^k. In view of this, it is sufficient to present a method that distinguishes between a nearly uniform distribution overZⁿ_p^k, and an arbitrary one where vectors which are orthogonal to a fixed vector u6= 0 have zero probability.

The method is based on the idea outlined above for the case k = 1 combined with an encoding of elements of Zp^k byk-tuples of elements of Zp. The encoding is the usual base pexpansion, that is, the bijection δ:Pk−1

j=0a_jp^j 7→(a₀, . . . , ak−1). We can extend this map to a bijection between Zⁿ_p^k and Z^knp in a natural way.

Obviously the image underδ of a nearly uniform distribution overZⁿ_p^k is nearly uniform over Z^knp . In the next few lemmas we are going to show that for every 0 6= u ∈Zⁿ_p^k there is a polynomial Q of ”low” degree in kn variables such that for every vector a ∈ Zⁿ_p^k not orthogonal to u, the codeword δ(a) is a zero of Q.

We begin with a polynomial expressing the carry term of addition of two basep digits.

Lemma 9.10. There is a polynomial C(x, y)∈Zp[x, y] of degree at most 2p−2 such that

Using the carry polynomial C(x, y) we can also express the base p digits of sums by polynomials.

Lemma 9.11. For every integer T ≥ 1, there exist polynomials Q_i from the polynomial ring Zp[y_1,0, . . . , y1,k−1, . . . , y_T,0, . . . , yT,k−1], (i = 0, . . . , k−1) with degQ_i ≤ (2p−2)ⁱ such

Proof. The proof is accomplished by induction on k. For k = 1 the statement is obvious:

we can take Q₀ =PT

wherec_t =C_t(a_1,0, . . . , a_t,0). In other words, the 0th digit of the sumsis a linear polynomial in a_t,0, and, for 1 ≤ j ≤ k−1, the jth digit is the (j−1)th digit in the RHS term of the second equation. There we have a sum of 2T −1 terms and each digit of each term is a polynomial of degree at most 2p−2 in the a_t,j. Therefore we can conclude using the inductive hypothesis applied to that (longer) sum.

Recall that we extended δ to Zⁿ_p^k in the natural way. To be specific, for a = (a₁, . . . , a_n) ∈ Zⁿ_p^k we define δ(a)∈ Z^knp as the vector (a_1,0, . . . , an,k−1) ∈ Z^knp where a_i,j is the jth coordinate of δ(ai) ∈ Z^kp. We can express the digits of the scalar products of a vector from Zⁿ_p^k with a fixed one as follows.

Lemma 9.12. For everyu∈Zⁿ_p^k, there exist polynomials Q_i ∈Zp[x_1,0, . . . , xn,k−1] of total degree at most(2p−2)ⁱ, for i= 0, . . . , k−1, such thatδ(a·u) = (Q₀(δ(a)), . . . , Qk−1(δ(a))) for every a ∈Zⁿ_p^k.

Proof. The statement follows from Lemma 9.11 by repeating u_i times the coordinate x_i, and taking the sum of all the terms obtained this way modulo p^k.

In order to simplify notation, for the rest of this subsection we set x_jp+i = x_i,j (j = 0, . . . , k−1, i = 1, . . . , n). For every positive integer D, let Z^Dp[x₁, . . . , x_nk] be the linear subspace of polynomials of Zp[x₁, . . . , x_nk] whose total degree is at most D and partial degrees are at most p−1 in each variable.

Together with Fermat’s little theorem, the previous lemma implies a polynomial char-acterization over Zp of vectors in Zⁿ_p^k that are not orthogonal to a fixed vector u∈Zⁿ_p^k. Lemma 9.13. Let D= (p−1)((2p−2)^k−1)

2p−3 . For everyu∈Zⁿ_p^k, there exists a polynomial Q_u ∈ Z^Dp[x₁, . . . , x_nk] such that for every a∈Zⁿ_p^k, a·u6= 0 mod p^k if and only if Q_u(δ(a)) = 0.

Proof. LetQ=Qk−1

j=0(Q^p−1_j −1), where the polynomialsQ_j come from Lemma 9.12. This polynomial has the required total degree. To ensure that partial degrees are less thanp−1, we replace x^p_i terms with x_i until every partial degree is at most p−1. Let Q_u be the polynomial obtained this way. Then Q_u and Q encode the same function over Z^nkp and hence the polynomial Q_u satisfies the required conditions.

It remains to show that if K is large then with high probability, for a samplea₁, . . . , a_K taken accordingly to a nearly uniform distribution overZ^nkp , there is no nonzero polynomial in Z^Dp [x₁, . . . , x_nk] vanishing at all the points a₁, . . . , a_K where D is as in Lemma 9.13.

Furthermore, we also need an efficient method for demonstrating this.

To this end, for everya ∈Z^nkp , we denote by `<sub>a</sub> the linear function over polynomials in Z<sup>D</sup>p[x<sub>1</sub>, . . . , x<sub>nk</sub>] that satisfies `_a(Q) = Q(a). Deciding whether the zero polynomial is the the only polynomial in Z^Dp[x1, . . . , xnk] such that `ai(Q) = 0 amounts to determining the rank of the theK×∆ matrix whose entries are `_ai(M) whereM runs over the monomials in Z^Dp[x₁, . . . , x_nk]. Here ∆ stands for the dimension of Z^Dp [x₁, . . . , x_nk]. Note that ∆ ≤

kn+D−1 kn

.

The image of the space Z^Dp[x₁, . . . , x_nk] under the linear map L : Q 7→ (`_a(Q))_a∈Znk p is known as a generalized Reed–Muller code with minimal weight at least (p−s)p^nk−r−1 ≤ pnk−dD/(p−1)e, where r, s are integers such that 0 ≤ s < p−1 and Max{D,(p−1)nk} = r(p −1) +s cf. [2]. For K₁ ≤ K, let W_K1 stand for the subspace of polynomials in

Z^Dp[x₁, . . . , x_nk] vanishing at all the points a₁, . . . , a_K1. The minimal weight bound above gives that for K₁ < K,

Pr[W_K1+1 < W_K1|W_K1 6= 0]≥ 1

c ·p^{−dD/(p−1)e}.

Herec is the parameter of near uniformity. The formula above implies that if K =θ(cp^dD/p−1edimZ^Dp [x₁, . . . , x_nk]) = c(pnk)^O((2p)k),

then with probability at least 2/3, W_K will be zero - provided that we have a nearly uniform distribution with parameter c. (In the second bound we have used that D =

(p−1)((2p−2)^k−1)

2p−3 = O((2p)^k). Together with the remark on rank computation this gives the following.

Theorem 9.14. Random Linear Disequations(Zⁿ_p^k, c) can be solved with (one-sided) error probability at most 1/3 in time c(pnk)^O((2p)k). In particular, for every fixed prime power p^k, and for every fixed constant c, Random Linear Disequations(Zⁿ_p^k, c) can be solved in time polynomial in n.

Note that with independent repetitions we can exponentially improve the error proba-bility. Together with the quantum part described in Section 9.2 this implies the following.

Corollary 9.15. Assume that we have a quantum permutation action of the groupG=Zⁿ_p^k on Ψ. Then, for K = (pnk)^θ((2p)k)log ¹ ORBIT-MEMBERK(G,Ψ, ψ

0, ψ

1) can be solved by a quantum algorithm in time K^O(1) with error at most .