P-schemes and Deterministic Polynomial Factoring over
Finite Fields

Thesis by

arXiv:1706.10028v2 [cs.CC] 23 Sep 2017

Zeyu Guo
In Partial Fulfillment of the Requirements for the
degree of
Doctor of Philosophy

CALIFORNIA INSTITUTE OF TECHNOLOGY
Pasadena, California

2017
Defended May 22

ii

© 2017
Zeyu Guo
ORCID: 0000-0001-7893-4346
All rights reserved

iii

ACKNOWLEDGEMENTS
I would like to thank my advisor, Chris Umans, for his patient guidance and continual
encouragement throughout my graduate studies. His passion, enthusiasm, and
dedication for research are truly inspiring. I am very fortunate to have such a great
teacher as my advisor.
I am indebted to Michael Aschbacher, who taught me a graduate algebra course, and
Matthias Flach, who taught me a course on algebraic number theory. The knowledge
I learned from their courses is crucial for the work presented in this thesis.
I also want to thank Leonard Schulman, Anand Kumar Narayanan, Manuel Arora,
and Jenish Mehta for many helpful conversations. In particular, I am grateful to
Manuel Arora for explaining to me his work on m-schemes.
Finally, I want to thank my family and friends for their continual support and
encouragement.

iv

ABSTRACT
We introduce a family of mathematical objects called P-schemes, where P is a poset
of subgroups of a finite group G. A P-scheme is a collection of partitions of the
right coset spaces H\G, indexed by H ∈ P, that satisfies a list of axioms. These
objects generalize the classical notion of association schemes [BI84] as well as the
notion of m-schemes [IKS09].
Based on P-schemes, we develop a unifying framework for the problem of deterministic factoring of univariate polynomials over finite fields under the generalized
Riemann hypothesis (GRH). More specifically, our results include the following:
• We show an equivalence between m-schemes as introduced in [IKS09] and
P-schemes in the special setting that G is a multiply transitive permutation
group and P is a poset of pointwise stabilizers, and therefore realize the theory
of m-schemes as part of the richer theory of P-schemes.
• We give a generic deterministic algorithm that computes the factorization
of the input polynomial f (X) ∈ Fq [X] given a “lifted polynomial” f˜(X)
of f (X) and a collection F of “effectively constructible” subfields of the
splitting field of f˜(X) over a certain base field. It is routine to compute
f˜(X) from f (X) by lifting the coefficients of f (X) to a number ring. The
algorithm then successfully factorizes f (X) under GRH in time polynomial
in the size of f˜(X) and F, provided that a certain condition concerning Pschemes is satisfied, for P being the poset of subgroups of the Galois group G
of f˜(X) defined by F via the Galois correspondence. By considering various
choices of G, P and verifying the condition, we are able to derive the main
results of known (GRH-based) deterministic factoring algorithms [Hua91a;
Hua91b; Rón88; Rón92; Evd92; Evd94; IKS09] from our generic algorithm
in a uniform way.
• We investigate the schemes conjecture in [IKS09] and formulate analogous
conjectures associated with various families of permutation groups, each
of which has applications on deterministic polynomial factoring. Using a
technique called induction of P-schemes, we establish reductions among
these conjectures and show that they form a hierarchy of relaxations of the
original schemes conjecture.

v
• We connect the complexity of deterministic polynomial factoring with the
complexity of the Galois group G of f˜(X). Specifically, using techniques
from permutation group theory, we obtain a (GRH-based) deterministic factoring algorithm whose running time is bounded in terms of the noncyclic
composition factors of G. In particular, this algorithm runs in polynomial
√
time if G is in Γk for some k = 2O( log n) , where Γk denotes the family
of finite groups whose noncyclic composition factors are all isomorphic of
subgroups of the symmetric group of degree k. Previously, polynomial-time
algorithms for Γk were known only for bounded k.
• We discuss various aspects of the theory of P-schemes, including techniques
of constructing new P-schemes from old ones, P-schemes for symmetric
groups and linear groups, orbit P-schemes, etc. For the closely related theory
of m-schemes, we provide explicit constructions of strongly antisymmetric
homogeneous m-schemes for m ≤ 3. We also show that all antisymmetric
homogeneous orbit 3-schemes have a matching for m ≥ 3, improving a result
in [IKS09] that confirms the same statement for m ≥ 4.
In summary, our framework reduces the algorithmic problem of deterministic
polynomial factoring over finite fields to a combinatorial problem concerning Pschemes, allowing us to not only recover most of the known results but also discover
new ones. We believe progress in understanding P-schemes associated with various
families of permutation groups will shed some light on the ultimate goal of solving
deterministic polynomial factoring over finite fields in polynomial time.

vi

TABLE OF CONTENTS

Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . . . . .
Abstract . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Table of Contents . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter I: Introduction . . . . . . . . . . . . . . . . . . . . . . . . .
1.1 Previous work . . . . . . . . . . . . . . . . . . . . . . . . .
1.2 Main results . . . . . . . . . . . . . . . . . . . . . . . . . .
1.3 Outline of the thesis. . . . . . . . . . . . . . . . . . . . . . .
1.4 Notations and preliminaries . . . . . . . . . . . . . . . . . .
Chapter II: P-schemes . . . . . . . . . . . . . . . . . . . . . . . . .
2.1 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . .
2.2 P-schemes . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.3 m-schemes . . . . . . . . . . . . . . . . . . . . . . . . . . .
2.4 Orbit P-schemes and m-schemes . . . . . . . . . . . . . . .
2.5 Strongly antisymmetric homogeneous m-schemes for m ≤ 3 .
Chapter III: The P-scheme algorithm . . . . . . . . . . . . . . . . .
3.1 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . .
3.2 Algorithmic preliminaries . . . . . . . . . . . . . . . . . . .
3.3 Reduction to computing an idempotent decomposition of ŌF
3.4 Main algorithm . . . . . . . . . . . . . . . . . . . . . . . . .
3.5 Compatibility and invariance test . . . . . . . . . . . . . . .
3.6 Regularity test . . . . . . . . . . . . . . . . . . . . . . . . .
3.7 Strong antisymmetry test . . . . . . . . . . . . . . . . . . . .
3.8 Constructing a collection of number fields . . . . . . . . . .
3.9 Putting it together . . . . . . . . . . . . . . . . . . . . . . .
Chapter IV: Constructing number fields . . . . . . . . . . . . . . . .
4.1 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . .
4.2 Adjoining roots of polynomials . . . . . . . . . . . . . . . .
4.3 Reduction to primitive group actions . . . . . . . . . . . . .
4.4 Other techniques of constructing number fields . . . . . . . .
Chapter V: The generalized P-scheme algorithm . . . . . . . . . . .
5.1 Preliminaries . . . . . . . . . . . . . . . . . . . . . . . . . .
5.2 Algorithmic preliminaries . . . . . . . . . . . . . . . . . . .
5.3 Reduction to computing an idempotent decomposition of RF
5.4 Producing a P-scheme of double cosets C . . . . . . . . . . .
5.5 Testing local constantness of ramification indices . . . . . . .
5.6 Testing local constantness of inertia degrees . . . . . . . . .
5.7 A P-collection C˜ induced from C and auxiliary elements . . .
5.8 (C, D)-separated P-collections . . . . . . . . . . . . . . . .
5.9 Producing an ordinary P-scheme . . . . . . . . . . . . . . .

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

iii
iv
vi
1
1
3
8
10
14
15
18
22
32
38
44
49
55
58
61
65
67
70
74
75
79
80
86
89
94
100
106
114
117
123
126
128
129
131
136

vii
5.10 Putting it together . . . . . . . . . . . . . . . . . . . . . . . . .
Chapter VI: Constructing new P-schemes from old ones . . . . . . . . .
6.1 Basic operations on P-schemes . . . . . . . . . . . . . . . . . .
6.2 Induction of P-schemes . . . . . . . . . . . . . . . . . . . . . .
6.3 Schemes conjectures . . . . . . . . . . . . . . . . . . . . . . . .
6.4 Extension to the closure of a subgroup system . . . . . . . . . .
6.5 Restricting to a subset . . . . . . . . . . . . . . . . . . . . . . .
6.6 Primitivity of homogeneous m-schemes . . . . . . . . . . . . . .
6.7 Direct products and wreath products . . . . . . . . . . . . . . . .
Chapter VII: Symmetric groups and linear groups . . . . . . . . . . . . .
7.1 The natural action of a symmetric group . . . . . . . . . . . . .
7.2 Self-reduction of discreteness . . . . . . . . . . . . . . . . . . .
7.3 The actions of symmetric groups on k-subsets or partitions . . .
7.4 The natural actions of linear groups . . . . . . . . . . . . . . . .
Chapter VIII: Groups with restricted noncyclic composition factors . . . .
8.1 Proof of the main theorem . . . . . . . . . . . . . . . . . . . . .
8.2 The O’Nan-Scott theorem for finite primitive permutation groups
8.3 Almost simple type . . . . . . . . . . . . . . . . . . . . . . . . .
8.4 Affine type . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
8.5 Diagonal type . . . . . . . . . . . . . . . . . . . . . . . . . . .
8.6 Product type and twisted wreath type . . . . . . . . . . . . . . .
8.7 Future research . . . . . . . . . . . . . . . . . . . . . . . . . . .
Bibliography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Appendix A: A unifying definition of P-schemes . . . . . . . . . . . . .
Appendix B: Proofs omitted from Chapter III . . . . . . . . . . . . . . .
Appendix C: Proofs omitted from Chapter V . . . . . . . . . . . . . . . .
Appendix D: List of algorithms . . . . . . . . . . . . . . . . . . . . . . .
List of notations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .
Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.
.

139
146
148
153
159
162
168
171
174
180
182
185
188
193
200
203
207
211
214
222
225
229
231
238
242
250
273
275
280

1
Chapter 1

INTRODUCTION
We are interested in the problem of deterministic univariate polynomial factoring
over finite fields: given a univariate polynomial f of degree n ∈ N+ over a finite
field Fq , our goal is to deterministically compute a factorization of f over Fq
f (X) = c ·

k
Y

fi (X),

i=1

where c ∈ Fq is the leading coefficient of f and each factor fi is irreducible over Fq .
This is called the complete factorization of f over Fq . It is unique up to the order
of the factors fi , since Fq [X] is a unique factorization domain. In addition, we are
also interested in the more moderate goal of deterministically computing a proper
factorization of f , i.e., factoring f into more than one factors where each factor is
allowed to be reducible.
1.1

Previous work

Univariate polynomial factoring over finite fields has been extensively studied over
the years as one of the most fundamental problems in computer algebra and a common subroutine of many algorithms in coding theory, cryptography, computational
number theory, etc. We review the previous work on this problem, with emphasis
on deterministic factoring algorithms. For a detailed survey, see [GP01].
A truly polynomial-time factoring algorithm is required to factorize a degree-n
polynomial f (X) ∈ Fq [X] in time (n log q)O(1) , since it takes O(n log q) bits to
describe f . If randomness is allowed, such algorithms are well known: Berlekamp
[Ber70] described a randomized algorithm that (completely) factorizes a univariate
polynomial over Fq in polynomial time. The same paper also gave a deterministic
reduction from the problem of factoring f to the problem of finding the roots of
certain other polynomials that split into n linear factors over Fp , where p = char(Fq ).
More efficient randomized algorithms were discovered since then [CZ81; GS92;
KS98; Uma08; KU11]. The current best known running time has the exponent 3/2
in n, as achieved by [KU11] based on the technique of fast modular composition.
On the other hand, despite much effort, factoring polynomials over finite fields in
deterministic polynomial time remains a long-standing open problem. Berlekamp

2
[Ber67] gave the first deterministic algorithm for the general problem, whose running time is polynomial in n and q (instead of n and log q). His aforementioned paper
[Ber70] gave a deterministic algorithm that runs in time polynomial in n, log q and
p = char(Fq ). Deterministic algorithms with running time (n log q)O(1) p1/2 were
given in [Sho90; BKS15]. Unfortunately, the p1/2 -dependence on the characteristic p of the field remains the best known for unconditional deterministic factoring
algorithms, even if we only consider quadratic polynomials. Faster algorithms are
known when p − 1 is assumed to be a smooth number [Gat87; Rón89; Sho91].
In addition, there are deterministic algorithms for special polynomials based on
the theory of elliptic curves or abelian varieties [Sch85; Pil90]. Finally, the paper [Iva+12] also unconditionally obtained some positive results on deterministic
polynomial factoring in certain special cases.
A lot more is known if one accepts the generalized Riemann hypothesis (GRH):
a deterministic polynomial-time algorithm that factorizes polynomials of the form
X n −a ∈ Fp [X] under GRH was given in [AMM77]. Several GRH-based deterministic algorithms were proposed since then. These algorithms factorize a polynomial
f (X) ∈ Fp [X] using the auxiliary information of a lifted polynomial, i.e., a polynomial f˜(X) ∈ Z[X] satisfying f˜(X) mod p = f (X). Huang [Hua91a; Hua91b]
proved that a polynomial f (X) ∈ Fp [X] can be deterministically factorized in polynomial time under GRH provided that the Galois group of the lifted polynomial is
abelian.1 This was generalized in [Evd92] to the case of solvable Galois groups.
For a general Galois group G, the work [Rón92] provided a deterministic algorithm
that runs in time polynomial in |G| and the size of the input under GRH. In general,
however, the cardinality of G may be as large as n!, as attained by the symmetric
group of degree n. Thus the algorithm in [Rón92] may take exponential time.
In a different approach, Rónyai [Rón88] showed that a polynomial f (X) ∈ Fq [X]
of degree n can be factorized deterministically in time (nn log q)O(1) under GRH.
The algorithm proceeds by manipulating tensor powers of the ring Fq [X]/(f (X)),
and does not need a lifted polynomial of f . Building on Rónyai’s work, Evdokimov
[Evd94] showed that the problem can be solved in quasipolynomial time by presenting a deterministic (nlog n log q)O(1) -time algorithm under GRH. Evdokimov’s
algorithm remains the best known result on GRH-based deterministic polynomial
factoring, although the O(log n) exponent of the running time was later improved
1

In addition, p is assumed to be a “regular” prime in [Hua84; Hua91a; Hua91b] and also in
[Rón92]. This condition can be removed. See Section 5.3 for a discussion.

3
by a certain constant factor [CH00; IKS09; Gua09; Aro13].
Efforts were made to understand the combinatorics behind Rónyai’s and Evdokimov’s algorithms [CH00; Gao01], culminating in the work [IKS09] that proposed
the notion of m-schemes together with an algorithm that subsumes those in [Rón88;
Evd94] (see also the follow-up work [Aro13; Aro+14]). An m-scheme, parametrized
by m ∈ N+ , is a collection of partitions of sets that satisfies a list of axioms. It
was shown in [IKS09] that whenever the algorithm fails to produce a proper factorization, there always exists an m-scheme satisfying strict combinatorial properties.
Evdokimov’s result can then be interpreted as the fact that such an m-scheme does
not exist for sufficiently large m = O(log n). Finally, a conjecture on m-schemes,
known as the schemes conjecture, was proposed in [IKS09], whose affirmative
resolution would imply a polynomial-time factoring algorithm under GRH.
Role of GRH. GRH asserts that all nontrivial zeros of Dirichlet L-functions are
on the line Re(z) = 1/2. As noted in [Rón92], the known GRH-based algorithms
(including our work) only need a consequence of GRH that finite fields can be
efficiently constructed, and their kth power non-residues2 can be efficiently found.
Formally, for all the statements made under GRH throughout this thesis, we may
use the following hypothesis instead.
Hypothesis (∗). There exists a deterministic algorithm that given a prime number p
and an integer d ∈ N+ , constructs3 the finite field Fpd in time polynomial in d log p.
In addition, given any prime factor k dividing pd − 1, a kth power non-residue of
Fpd can be found deterministically in time polynomial in k and d log p.
See [Hua91b; LMO79] for the proof that Hypothesis (∗) holds under GRH. By
[Bha+17], it holds even under a weaker version of GRH, which asserts that all
nontrivial zeros of Dirichlet L-functions are in the strip Re(z) ∈ [ 12 − , 12 + ] for
some constant  < 1/2.
1.2

Main results

In this thesis, we introduce a family of mathematical objects called P-schemes,
generalizing the classical notion of association schemes [BI84] as well as the notion
of m-schemes [IKS09]. Based on P-schemes, we develop a unifying framework for
deterministic univariate polynomial factoring over finite fields under GRH.
2

× k
For a prime factor k of q − 1, an element x ∈ F×
q is a kth power residue of Fq if x ∈ (Fq ) .
Otherwise it is a kth power non-residue.
3
By constructing Fpd , we mean finding its structure constants in some Fp -basis. See [Len90].

4
P-schemes. Roughly speaking, given a finite group G and a poset P of subgroups
of G, a P-scheme is collection of partitions,
C = {CH : H ∈ P},
satisfying certain constraints, where each CH is a partition of the right coset space
H\G = {Hg : g ∈ G}. The formal definition is given in Definition 2.4. We also
define various properties of P-schemes, including antisymmetry, strong antisymmetry, discreteness, and homogeneity. These properties play important roles in our
polynomial factoring algorithms.
When G is chosen to be a symmetric group and P is a poset of stabilizer subgroups
(with respect to the natural action of G), we recover the notion of m-schemes
[IKS09]:
Theorem 1.1 (informal). Suppose G = Sym(S) acts naturally on a finite set S
and P consists of the (pointwise) stabilizers GT for all subsets T ⊆ S satisfying
1 ≤ |T | ≤ m. Then a P-scheme C is equivalent to an m-scheme Π on S. Moreover, C is antisymmetric (resp. strongly antisymmetric, discrete on Gx for x ∈ S,
homogeneous on Gx for x ∈ S) iff Π has the corresponding property.
This result in fact holds as long as G is k-transitive for sufficiently large k. See
Theorem 2.1 for the formal statement.
In this way, we regard the theory of m-schemes [IKS09; Aro13; Aro+14] as part of
the richer theory of P-schemes. The advantage of adopting the notion of P-schemes
is that these objects capture not only the combinatorial structure of m-schemes but
also the information provided by the group G and the poset P, which allows us
to carry out both the Galois-theoretic/group-theoretic approach [Hua91a; Hua91b;
Evd92; Rón92] and the combinatorial approach [Evd94; IKS09] of deterministic
polynomial factoring in a uniform way.
A unifying framework for deterministic polynomial factoring. The theory of Pschemes is applied to deterministic polynomial factoring as follows. For simplicity,
assume f is a degree-n polynomial that is defined over a prime field Fp and factorizes
into n distinct linear factors over Fp . Let f˜(X) ∈ Z[X] be an irreducible lifted
polynomial of f , defined as follows:
Definition 1.1 (lifted polynomial). A lifted polynomial of a degree-n polynomial
f (X) ∈ Fp [X] is a polynomial f˜(X) ∈ Z[X] of degree n satisfying f˜ mod p = f .

5
An irreducible lifted polynomial of f is a lifted polynomial of f that is irreducible
over Q.
Let L be the splitting field of f˜(X) over Q and let G = Gal(L/Q). By Galois
theory, we have a one-to-one correspondence between the subgroups of G and the
subfields of L
H = Gal(L/K) ←→ K = LH ,
where LH denotes the fixed subfield of H.
In Chapter 3, we design a generic algorithm, which we refer to as the P-scheme
algorithm, that deterministically factorizes f under GRH given f and f˜. The generic
part of the algorithm is a subroutine that uses f˜ to construct a poset of subfields of
L, which in turn corresponds to a poset P of subgroups of G by Galois theory. We
then prove that the algorithm always produces the complete factorization (resp. a
proper factorization) of f under GRH, unless a combinatorial condition regarding Pschemes fails to hold.4 Therefore the problem of deterministic polynomial factoring
reduces to the problem of verifying this combinatorial condition about P-schemes.
By choosing various posets P and verifying the condition, we recover the main
results of the previous work [Hua91a; Hua91b; Rón88; Rón92; Evd92; Evd94;
IKS09] using the P-scheme algorithm. Our algorithm thus provides a unifying
framework for deterministic polynomial factoring over finite fields.
The generalized P-scheme algorithm. The P-scheme algorithm above is subject to the condition that the input polynomial is defined over a prime field Fp and
factorizes into distinct linear factors over Fp . In Chapter 5, we extend it to the generalized P-scheme algorithm that works for arbitrary polynomials f (X) ∈ Fq [X].
The results obtained from the P-scheme algorithm are then proved in full generality.
Several new ideas and a significant amount of work are required in the development
of the generalized P-scheme algorithm. See Chapter 5 for the details.
Constructing new P-schemes from old ones. We develop various techniques
of constructing new P-schemes from old ones, including restriction, induction,
extension, etc. These techniques are useful for investigating the existence of certain
P-schemes, allowing us to reduce one case to another.
4

The condition requires all strongly antisymmetric P-schemes to be discrete (resp. inhomogeneous) on Gx , where x is a root of f˜ in L. See Theorem 3.9 for the formal statement.

6
In particular, using induction of P-schemes, we show that for finite groups H ⊆ G
and a poset P of subgroups of H, a P-scheme with various properties (antisymmetry,
strong antisymmetry, etc.) can be used to construct a P 0 -scheme with the same
properties, where P 0 is a certain poset of G. Intuitively, this means polynomial
factoring “becomes easier” if the Galois group G is replaced by a subgroup H. We
make this intuition rigorous regarding the schemes conjecture proposed in [IKS09].
See below for a more detailed discussion.
In addition, we define the direct product and the wreath product of P-schemes,
generalizing the corresponding operations of permutation groups and association
schemes [SS98; Bai04]. We also define the direct product and the wreath product of
m-schemes. A consequence of these operations is that either the schemes conjecture
in [IKS09] holds, or it has infinitely many counterexamples.
Schemes conjectures for families of permutation groups. The work [IKS09]
proposed a combinatorial conjecture on m-schemes, called the schemes conjecture,
whose positive resolution would imply a deterministic polynomial-time factoring
algorithm under GRH. Proving this conjecture appears to be difficult. However,
as noted in Theorem 1.1 above, an m-scheme is essentially a P-scheme in the
(worst) case of symmetric groups, with respect to a poset P of pointwise stabilizers.
This observation suggests that one should first formulate and attack the analogous
conjectures for “less complex” Galois groups.
For each family G of finite permutation groups, we formulate an analogous conjecture, called the schemes conjecture for G. Like the original schemes conjecture,
the schemes conjecture for G also implies a deterministic polynomial-time factoring
algorithm under GRH, provided that that Galois group of the lifted polynomial f˜,
as a permutation group on the set of roots of f˜, is a member of G. Moreover, we
show that these conjectures form a hierarchy of relaxations of the original schemes
conjecture in [IKS09]. More specifically, for two families of finite permutation
groups G and G 0 such that every member of G is (permutation isomorphic to) a
subgroup of member in G 0 , the schemes conjecture for G is implied by that for G 0 .
The worst case occurs when G is the family of symmetric groups, which yields (a
slight relaxation of) the original schemes conjecture. We hope progress on this
hierarchy of conjectures will shed some light on the original schemes conjecture
and pave the way for solving deterministic polynomial factoring over finite fields in
polynomial time under GRH.

7
Galois groups with restricted noncyclic composition factors. Using our framework of P-schemes, we design a GRH-based deterministic factoring algorithm that
completely factorizes a polynomial f using a lifted polynomial f˜, such that the
running time of the algorithm is controlled by the noncyclic composition factors5 of
the Galois group of f˜. More specifically, we have
Theorem 1.2 (informal). Under GRH, there exists a deterministic algorithm that
given f (X) ∈ Fq [X] and a lifted polynomial6 f˜ of f with the Galois group G,
completely factorizes f in time polynomial in k(G)log k(G) , r(G) and the size of the
input, where k(G) (resp. r(G)) is the maximum degree (resp. maximum order) of
the alternating groups (resp. classical groups) among the composition factors of G.
See Theorem 8.2 for the formal statement. Now fix k ∈ N+ and consider the family
of finite groups whose noncyclic composition factors are all isomorphic to subgroups
of Sym(k). This family is commonly denoted by Γk in the literature, and plays a
significant role in graph isomorphism testing [Luk82; Mil83], asymptotic group
theory [BCP82; Pyb93; PS97] and computational group theory [Luk93; Ser03]. It
is known that a classical group of order r lies in Γk only if r = k O(log k) [Coo78].
So Theorem 1.2 implies
Theorem 1.3 (informal). Under GRH, there exists a deterministic algorithm that
given f (X) ∈ Fq [X] of degree n and a lifted polynomial f˜ of f , completely factorizes
f in time polynomial in n, log q and k log k , where k is the smallest positive integer
such that the Galois group of f˜ is in Γk .
See Theorem 8.3 for the formal statement. It refines and generalizes the main
results of [Hua91a; Hua91b; Evd92; Rón92; Evd94]. Note that the algorithm
√
runs in polynomial time under GRH provided that k = 2O( log n) . Previously,
polynomial-time factoring algorithms for Γk were known only for bounded k under
GRH [Evd92; BCP82].
Other results. Finally, we list some other results obtained in this thesis.
5

Recall that a composition factor of a finite group is a finite simple group, and by the classification
of finite simple groups (CFSG) it is isomorphic to one of the following groups: a cyclic group of
prime order, an alternating group, a classical group, an exceptional group of Lie type, or one of the
26 sporadic simple groups.
6
For a general (not necessarily prime) finite field Fq , we use a more general definition of lifted
polynomials (Definition 5.1) instead of Definition 1.1.

8
1. The schemes conjecture in [IKS09] asserts that if a homogeneous antisymmetric orbit m-schemes on a set S has no matching, then m = O(1) (see
Chapter 2 for the definition of matchings). Currently, the best known upper
bound for m is m ≤ c log |S| + O(1), where c = log212 = 0.5578 · · · . We
consider the analogous problem for a general linear group GL(V ) over a finite field Fq acting naturally on S = V − {0}, and show that for this new
problem, we have a slightly improved bound m ≤ c0 log |S| + O(1) where
4
c0 = 4 log q+log
≤ 0.5273 · · · (Theorem 7.5). In addition, we consider the
12
analogous problems for the groups GL(V ), ΓL(V ), PGL(V ), and PΓL(V ),
and show that these problems are equivalent, in the sense that the optimal values of m for them differ from each other by at most a constant (Theorem 7.4).
2. We generalize the notion of orbit schemes in [IKS09], or what we call orbit
m-schemes, to the notion of orbit P-schemes. We also prove that an orbit
m-scheme associated with a group K is antisymmetric iff the order of K is
coprime to 1, 2, . . . , m (Lemma 2.16), which in turn shows that a result of
[Rón88; IKS09] on antisymmetric m-schemes is tight (cf. Lemma 2.17 and
Example 2.2).
3. The paper [IKS09] showed that the schemes conjecture is true when restricted
to orbit schemes, by proving that all antisymmetric homogeneous orbit mschemes on a set of cardinality greater than one have a matching for m ≥ 4.
We prove that the later statement in fact holds for m ≥ 3 (Theorem 6.6).
1.3

Outline of the thesis.

Basic notations and preliminaries are given in the next section, and additional
preliminaries are given at the beginning of subsequent chapters.
Chapter 2 introduces definitions and develops basic results about P-schemes: we
first define P-schemes and their various properties. After reviewing the notion of
m-schemes in [IKS09] and their connection with association schemes, we prove
the formal version of Theorem 1.1 above. Then we investigate the notion of orbit
schemes in [IKS09], and extend it to our framework of P-schemes. Finally, some
concrete examples of strongly antisymmetric homogeneous m-schemes are given for
small m.
The rest of the thesis is divided into two parts: Chapters 3–5 constitute the algorithmic part of the thesis, whereas Chapters 6–8 focus on further development of the
theory of P-schemes. The latter is mostly algorithm-free, except that Section 8.1

9
contains an algorithm that depends on Section 4.2, Section 4.3, and Theorem 5.9.
The dependencies among chapters are roughly illustrated in Figure 1.1.
Chapter 2

Chapter 4

Chapter 3

Chapter 6

Chapter 5

Chapter 7

Chapter 8
Figure 1.1: Dependencies among chapters
In Chapter 3, we develop the P-scheme algorithm, and use it to reprove the main
results of [Hua91a; Hua91b; Rón88; Rón92; Evd94; IKS09]. As mentioned above,
the results in Chapter 3 are subject to the condition that the input polynomial is
defined over a prime field Fp and factorizes into distinct linear factors over Fp .
The P-scheme algorithm requires a subroutine that constructs a collection of number
fields. In Chapter 4, we discuss various ways of implementing this subroutine and
survey techniques of constructing number fields in the literature [Len83; Lan84;
Lan85; LM85; Evd92].
In Chapter 5, we develop the generalized P-scheme algorithm where the condition
about the input polynomial is no longer needed. The results in Chapter 3 are then
proved in full generality.
Chapter 6 develops various techniques of constructing new P-schemes from old
ones. In Section 6.3, we formulate the schemes conjectures for families of finite
permutation groups and show that these conjectures form a hierarchy of relaxations
of the schemes conjecture proposed in [IKS09]. Our result that an antisymmetric
homogeneous orbit m-scheme on a set of cardinality n > 1 has a matching for
m ≥ 3 is proved in Section 6.6, where we also discuss primitivity of m-schemes.

10
Chapter 7 discusses the (non-)existence of certain P-schemes for symmetric groups
and linear groups. In particular, we review the result in [Aro13] on m-schemes
(based on the work of [Evd94; IKS09], and independently discovered in [Gua09]),
and interpret it as a result about P-schemes with respect to the natural action of
symmetric groups. We also extend it to a more general result about P-schemes
with respect to standard actions of symmetric groups. The analysis employs a
technical “self-reduction lemma” proven in Section 7.2, which is also heavily used
in Chapter 8. Some results about P-schemes for linear groups are also given.
Finally, in Chapter 8, we describe our deterministic factoring algorithm for Galois
groups with restricted noncyclic composition factors. More specifically, we give the
algorithm and its analysis in Section 8.1, assuming a statement about P-schemes for
primitive permutation groups (Theorem 8.4). The rest of Chapter 8 then focuses on
verifying this statement.
1.4

Notations and preliminaries

Denote by N+ the set of positive integers. For k ∈ N+ , we denote by [k] the set
{1, 2, . . . , k}. For two sets A and B, write A − B for the set difference {x : x ∈
A and x 6∈ B}.7 The cardinality of a finite set S is denoted by |S|. Denote by log
the logarithmic function with base 2.
A partition of a finite set S is a set P of nonempty subsets of S satisfying S =
`
`
denotes the disjoint union. Each B ∈ P is called a block of P .
B∈P B, where
For two partitions P and P 0 of S, we say P refines P 0 , or P is a refinement of P 0 , if
every block in P 0 is a disjoint union of blocks in P . We say the refinement is proper
if P 6= P 0 . Denote by 0S the coarsest partition of S, i.e. the one consisting of a
single block S. Denote by ∞S the finest partition of S, i.e., ∞S = {{x} : x ∈ S}.
For T ⊆ S and a partition P of S, define P |T := {B ∩ T : B ∈ S} − {∅} which
is a partition of T , called the restriction of P to T . For a set S and k ∈ N+ , define
the set S (k) := {(x1 , . . . , xk ) ∈ S k : xi 6= xj for i 6= j} consisting of k-tuples of
distinct elements.
Write f ◦ g for the composition of two functions f and g, from right to left. We note
that this is the common convention, although group theorists often use the opposite
convention gf . For a function f and a subset T of the domain of f , denote by f |T
the restriction of f to T . For a field K, denote the characteristic of K by char(K).
7

This is often denoted by A \ B. We use A − B to avoid confusion with a right coset space
H\G.

11
A polynomial is monic if its leading coefficient is one. For two polynomials
f (X), g(X) ∈ Fq [X] over a finite field Fq that are not both zero, define their greatest common divisor gcd(f, g) to be the unique monic polynomial h(X) ∈ Fq [X] of
the greatest degree that divides both f and g. It is well defined since Fq [X] is a
unique factorization domain, and can be computed efficiently from f and g using
the Euclidean algorithm [GG13].
Basic notations about groups. All groups in this thesis are finite. Write e for
the identity element of a group. For a group G, a subgroup H of G, and g ∈ G,
write gH for the left coset {gh : h ∈ H} and Hg for the right coset {hg : h ∈ H}.
Write G/H for the left coset space {gH : g ∈ G} and H\G for the right coset
space {Hg : g ∈ G} For two subgroups H, K of G and g ∈ G, write HgK for the
double coset {hgh0 : h ∈ H, h0 ∈ K}, and write H\G/K for the double coset space
{HgK : g ∈ G}. Define [G : H] := |G|/|H|, called the index of H in G. Write
hH1 , . . . , Hk i for the join of subgroups H1 , . . . , Hk , i.e., the subgroup generated by
H1 , . . . , Hk . Write hg1 , . . . , gk i for the subgroup generated by the group elements
g1 , . . . , gk .
A subquotient of a group G is a quotient group of a subgroup of G. Two subgroups
H and H 0 are said to be conjugate in G if H 0 = gHg −1 for some g ∈ G. A subgroup
H is said to be normal in G or a normal subgroup of G if gHg −1 = H for all g ∈ G.
Write H E G for H being normal in G. Define the normalizer of H in G to be
NG (H) := {g ∈ G : gHg −1 = H}. We have H E NG (H), and indeed NG (H) is
the unique maximal subgroup of G with this property. The center of G, denoted by
Z(G), is the subgroup {g ∈ G : gh = hg for all h ∈ G}. A subgroup H of G is
maximal if H 6= G and there exists no subgroup H 0 of G satisfying H ( H 0 ( G.
For a finite set S, denote by Sym(S) and Alt(S) the symmetric group and the
alternating group on S respectively. We also write Sym(n) and Alt(n) when
S = [n]. Permutations are often written in the cycle notation, where (a1 a2 · · · an )
denotes the cyclic permutation sending ai to ai+1 for 1 ≤ i < n and an to a1 .
For a group G, denote by Aut(G) the automorphism group of G, i.e., the group
of invertible homomorphisms ρ : G → G where the group operation is defined by
composition. For g ∈ G, the map τg : G → G sending h ∈ G to ghg −1 is an
automorphism of G, called an inner automorphism of G. Define Inn(G) := {τg :
g ∈ G}, called the inner automorphism group of G, which is a normal subgroup
of Aut(G). Define Out(G) := Aut(G)/Inn(G), called the outer automorphism

12
group of G.
Group actions. Let G be a group and S be a finite set. A (left) group action or
an action of G on S is a function ϕ : G × S → S satisfying (1) ϕ(e, x) = x for all
x ∈ S and (2) ϕ(g, ϕ(h, x)) = ϕ(gh, x) for all x ∈ S and g, h ∈ G. We also say G
acts on S and S is a G-set. We usually denote ϕ(g, x) as g x when ϕ is clear from the
context. For T ⊆ S, write g T for the set {g x : x ∈ T }. Again, we note that group
theorists commonly adopt the right action convention xgh = (xg)h instead of our
left action convention. One can switch between the two conventions by taking the
inverse map g 7→ g −1 .
Given a G-set S, the elements of G act as permutations of S. This gives a group
homomorphism ρ : G → Sym(S), called a permutation representation of G on
S. The action of G on S is faithful if ρ is injective. The image ρ(G) is called a
permutation group on S. When the action is faithful and clear from the context, we
usually just say G is a permutation group on S.
Orbits and stabilizers. For a G-set S, the orbit or G-orbit of an element x ∈ S
is Gx := {g x : g ∈ G}. The set S is a disjoint union of its G-orbits. The stabilizer
of x ∈ S is Gx := {g ∈ G : g x = x}. For T ⊆ S, define the pointwise stabilizer
GT := {g ∈ G : g x = x for all x ∈ T }
and the setwise stabilizer
G{T } := {g ∈ G : g T = T }.
For T = {x1 , . . . , xk } ⊆ S we also write Gx1 ,...,xk for GT . Let S G := {x ∈ S :
g
x = x for all g ∈ G} be the set of fixed points of G.
An action of G on a set S is transitive if it has only one orbit. It is semiregular
if Gx is trivial for all x ∈ S. A group action is regular if it is both transitive and
semiregular. For k ∈ N+ , an action of G on S induces an action on S (k) via
g

(x1 , . . . , xk ) = (g x1 , . . . , g xk ),

called the diagonal action of G on S (k) . For 1 ≤ k ≤ |S|, we say the action of G
on S is k-transitive if the corresponding diagonal action of G on S (k) is transitive.
We say it is (k + 1/2)-transitive if it is k-transitive, and in addition for all T ⊆ S
of cardinality k, either the GT -orbit of every x ∈ S − T contains more than one
element, or |S − T | = 1. A (k + 1)-transitive action is also (k + 1/2)-transitive.
For more discussion about half transitivity, see [Wie64].

13
G-modules and G-invariant elements. Given a group G, an abelian group A is
called a G-module if it has an action of G compatible with its abelian group structure,
i.e., g x + g y = g (x + y) for x, y ∈ A and g ∈ G. The set of fixed points AG is a
subgroup of A, known as the subgroup of G-invariant elements of A. Suppose in
addition that A is a ring (resp. field) and the action of G respects the multiplication
of A as well, then AG is a subring (resp. subfield) of A, called the fixed subring
(resp. fixed subfield) of A corresponding to G.

14
Chapter 2

P-SCHEMES
We introduce the notion of P-schemes in this chapter, which plays a central role
throughout the thesis. A P-scheme is a combinatorial structure associated with a
group G and a conjugation-closed poset P of subgroups of G. Roughly speaking, it
contains a collection of partitions of right coset spaces H\G for H ∈ P, and these
partitions satisfy various consistency properties.
For every permutation group G, we define the integers d(G), d0 (G) ∈ N+ in terms
of P-schemes associated with G, and show that they are bounded by the minimum
base size of G. We will see in Chapter 3 that d(G) and d0 (G) are closely related to
deterministic polynomial factoring.
The work [IKS09] proposed the notion of m-schemes as a “higher-order” generalization of association schemes that are central in the field of algebraic combinatorics
[BI84]. We show P-schemes are further generalization of m-schemes: an m-scheme
arises as a P-scheme associated with a symmetric group, or more generally with a
multiply transitive group action.
Other results in this chapter include:
• We define orbit P-schemes, generalizing the notion of orbit m-schemes in
[IKS09]. We also provide a simple and exact criterion for antisymmetry of
orbit m-schemes. Using this criterion, we give examples of antisymmetric
homogeneous orbit m-schemes on finite sets S for m up to ` − 1, where `
is the least prime factor of |S|. This result matches the upper bound m < `
established by Rónyai [Rón88] for arbitrary antisymmetric homogeneous mschemes. We reproduce Rónyai’s argument and extend it to P-schemes.
• We also provide examples of m-schemes for small values of m. In particular, for m ≤ 3, we give explicit constructions of m-schemes satisfying the
properties of strong antisymmetry and homogeneity that are closely related to
deterministic polynomial factoring.
Outline of the chapter. Preliminaries are given in Section 2.1. In Section 2.2, we
define the notion of P-schemes and its various properties. We also define d(G) and

15
d0 (G) in terms of P-schemes. In Section 2.3, we review the notion of m-schemes
and prove the equivalence between m-schemes and a certain kind of P-schemes.
We also discuss the connection between m-schemes and association schemes. In
Section 2.4, we define orbit m-schemes as well as orbit P-schemes. An exact
criterion of antisymmetry is given for orbit m-schemes. Then we discuss Rónyai’s
upper bound for m for antisymmetric homogeneous m-schemes and extend it to
P-schemes. Finally, in Section 2.5, we describe explicit constructions of strongly
antisymmetric homogeneous m-schemes for m ≤ 3.
2.1

Preliminaries

Let G be a group. A partially ordered set or poset of subgroups of G is simply a set
of subgroups of G, partially ordered by inclusion. All posets of subgroups in this
thesis are assumed to be conjugation-closed, and we give the following definition
for such posets.
Definition 2.1 (subgroup system). A poset P of subgroups of G is called a subgroup
system over G if it is closed under conjugation in G, i.e., gHg −1 ∈ P for all H ∈ P
and g ∈ G.
We introduce P-schemes in next section, each associated with a subgroup system
P. While the definitions are formulated for general subgroup systems, those arising
from the factoring algorithms have special forms. In particular, the following kind
of subgroup systems are frequently used in the algorithms.
Definition 2.2 (system of stabilizers). Suppose G is a finite group acting on a finite
set S. For m ∈ N, let Pm be the set of pointwise stabilizers for nonempty subsets
T ⊆ S of cardinality up to m:
Pm := {GT : T ⊆ S, 1 ≤ |T | ≤ m}.
Then Pm is a subgroup system over G, called the system of stabilizers of depth m
(with respect to the action of G on S).

Left and inverse right translation. Let H be a subgroup of G. There is an action
of G on the right coset space H\G defined by
g

Hh = Hhg −1

for Hh ∈ H\G and g ∈ G,

16
called the action of G on H\G by inverse right translation. More generally, for a
subgroup G0 ⊆ G, we have the action of G0 on H\G by inverse right translation,
defined by restricting the previous action of G to G0 .
We also have an action of the normalizer NG (H) on H\G defined by
g

Hh = Hgh for Hh ∈ H\G and g ∈ NG (H),

called the action of NG (H) on H\G by left translation.
It is easy to see that they are indeed well defined group actions. For example,
we check that for left translation, the coset g Hh = Hgh is independent of the
representative h of Hh: Suppose a different representative h0 is chosen such that
Hh = Hh0 , then we have gh0 (gh)−1 = gh0 h−1 g −1 ∈ gHg −1 = H for g ∈ NG (H)
and hence Hgh = Hgh0 .
For any h ∈ G, it holds that Hgh = Hh iff g ∈ H. So the action of NG (H) on
H\G induces a semiregular action of NG (H)/H on H\G, defined by gH Hh = Hgh,
called the action of NG (H)/H on H\G by left translation.
Equivalent actions and permutation isomorphic actions. Let G be a group and
let S, T be G-sets. We say the actions of G on S and T are equivalent if there exists
a bijective map λ : S → T satisfying λ(g x) = g (λ(x)) for all x ∈ S and g ∈ G.
And λ is said to be an equivalence between the two actions.
More generally, suppose φ : G → H is a group isomorphism, S is a G-set, and T
is an H-set. We say the action of G on S is permutation isomorphic to the action
of H on T (with respect to φ) if there exists a bijective map λ : S → T satisfying
λ(g x) = φ(g) (λ(x)) for all x ∈ S and g ∈ G.
The following lemma states that any transitive group action is equivalent to the
action on a right coset space by inverse right translation.
Lemma 2.1. Let G be a group acting transitively on a set S. For any x ∈ S,
the map λx : S → Gx \G sending g x to Gx g −1 for g ∈ G is well defined and is
an equivalence between the action of G on S and that on Gx \G by inverse right
translation.
Proof. As the action of G on S is transitive, for any y ∈ S we can choose g ∈ G
−1 0
−1
such that y = g x. Suppose g, g 0 are two such choices. We have g g x = g y = x

17
and hence g −1 g 0 ∈ Gx . So Gx g −1 = Gx g 0−1 . Therefore λx is well defined. It is
−1
surjective since any coset Gx g ∈ Gx \G is the image of g x for a representative g
of Gx g. And it is injective since Gx g −1 = Gx g 0−1 implies g −1 g 0 ∈ Gx and hence
−1 0
g0
x = g(g g ) x = g x. Finally we check that for any y = g x and h ∈ G, it holds that
λx (h y) = λx (hg x) = Gx (hg)−1 = (Gx g −1 )h−1 = h (λ(y))
as desired.
Corollary 2.1 (orbit-stabilizer theorem). Let S be a G-set for a finite group G. Then
|Gx| = |G|/|Gx | for any x ∈ S.
Projections and conjugations. We define the following two kinds of maps between right coset spaces H\G for various subgroups H ⊆ G:
• (projection) for H ⊆ H 0 ⊆ G, define the projection πH,H 0 : H\G → H 0 \G
to be the map sending Hg ∈ H\G to H 0 g ∈ H 0 \G, and
• (conjugation) for H ⊆ G and g ∈ G, define the conjugation cH,g : H\G →
gHg −1 \G to be the map sending Hh ∈ H\G to (gHg −1 )gh ∈ gHg −1 \G.
Lemma 2.2. The maps πH,H 0 and cH,g are well defined and satisfy the following
properties:
• The maps πH,H 0 are surjective and cH,g are bijective.
• cH 0 ,g ◦ πH,H 0 = πgHg−1 ,gH 0 g−1 ◦ cH,g .
• (transitivity) πH 0 ,H 00 ◦ πH,H 0 = πH,H 00 and cgHg−1 ,g0 ◦ cH,g = cH,g0 g .
• (G-equivariance) πH,H 0 (g Hh) = g πH,H 0 (Hh) and cH,g0 (g Hh) = g cH,g0 (Hh)
with respect to the action of G on H\G by inverse right translation.
Proof. The proof is straightforward from the definitions. We check cH 0 ,g ◦ πH,H 0 =
πgHg−1 ,gH 0 g−1 ◦ cH,g and leave the rest to the reader: For Hh ∈ H\G, we have
cH 0 ,g ◦ πH,H 0 (Hh) = cH 0 ,g (H 0 h) = (gH 0 g −1 )gh
and
πgHg−1 ,gH 0 g−1 ◦ cH,g (Hh) = πgHg−1 ,gH 0 g−1 ((gHg −1 )gh) = (gH 0 g −1 )gh
as desired.

18
Note that for g ∈ NG (H), the map cH,g is the permutation of H\G sending each
Hh to g Hh with respect to the action of NG (H) on H\G by left translation.
2.2 P-schemes
We start with the definition of a P-collection, which is a collection of partitions of
right coset spaces.
Definition 2.3 (P-collection). Let P be a subgroup system over a finite group G.
A P-collection C is a family {CH : H ∈ P} indexed by P where each CH is a
partition of H\G.
We are now ready to define the central object of this thesis.
Definition 2.4 (P-scheme). A P-collection C = {CH : H ∈ P} is a P-scheme if it
has the following properties:
• (compatibility) for H, H 0 ∈ P with H ⊆ H 0 and x, x0 ∈ H\G in the same
block of CH , the images πH,H 0 (x) and πH,H 0 (x0 ) are in the same block of CH 0 .
• (invariance) for H ∈ P and g ∈ G, the map cH,g : H\G → gHg −1 \G maps
any block of CH to a block of CgHg−1 .
• (regularity) for H, H 0 ∈ P with H ⊆ H 0 , any block B ∈ CH , B 0 ∈ CH 0 , the
number of x ∈ B satisfying πH,H 0 (x) = y is a constant when y ranges over
the elements of B 0 .
It is worth noting that in a P-scheme, the partition of H\G for some H ∈ P
determines the partitions of H 0 \G for all H 0 ∈ P containing H:
Lemma 2.3. Let C = {CH : H ∈ P} be a P-scheme. For H, H 0 ∈ P with H ⊆ H 0 ,
the blocks of CH 0 are exactly the images of the blocks of CH under πH,H 0 .
Proof. Let B 0 be a block of CH 0 . By compatibility, B 0 is a union of πH,H 0 (B) for
one or more blocks B ∈ CH . Assume πH,H 0 (B) ( B 0 for some B ∈ CH and choose
y ∈ πH,H 0 (B), y 0 ∈ B 0 − πH,H 0 (B). Then we have |{x ∈ B : πH,H 0 (x) = y}| > 0
but |{x ∈ B : πH,H 0 (x) = y 0 }| = 0, which contradicts regularity.
In particular, if P has the property that all minimal subgroups in P are conjugate
in G, then by invariance and Lemma 2.3, the partition for one of the minimal

19
subgroups determines the whole P-scheme. For instance, this holds if P is a system
of stabilizers Pm with respect to an m-transitive group action.
Remark. Besides the set-theoretic definition of P-schemes given in Definition 2.4,
there also exists an equivalent “algebraic” or ring-theoretic definition of P-schemes.
It formulates the three defining properties (compatibility, invariance, and regularity)
in a unifying way as closedness of rings under three kinds of maps, respectively:
inclusions, conjugations, and trace maps. The interested reader is referred to Appendix A for further discussion.
Next we define some optional properties of P-schemes.
Homogeneity and discreteness. Recall that for a finite S, we denote by 0S the
coarsest partition of S and ∞S the finest partition of S.
Definition 2.5. A P-scheme C = {CH : H ∈ P} is homogeneous on a subgroup
H ∈ P if CH = 0H\G , and otherwise inhomogeneous on H. It is discrete on H if
CH = ∞H\G , and otherwise non-discrete on H.
We will see in Chapter 3 that homogeneity (resp. discreteness) of P-schemes is
closely related to whether or not the factoring algorithm always produces a proper
factorization (resp. the complete factorization) of the input polynomial.
Symmetry and antisymmetry. Invariance of P-schemes states that maps cH,g :
Hh 7→ (gHg −1 )gh always send blocks to blocks. When g ∈ NG (H), the map cH,g
is a permutation of H\G, and we can impose on a P-scheme the constraint that
cH,g always sends a block to itself. Alternatively, we may require cH,g to always
send a block to a different block when it is not the trivial permutation. These two
constraints are captured by symmetry and antisymmetry of P-schemes, respectively.
Definition 2.6. A P-scheme C = {CH : H ∈ P} is symmetric if for H ∈ P and
g ∈ NG (H), the permutation cH,g of H\G maps every block of CH to itself. And C
is antisymmetric if for H ∈ P and g in NG (H) but not in H, the permutation cH,g
maps every block of CH to a different block.
Symmetry (resp. antisymmetry) is equivalent to the property that for all H ∈ P,
elements in each (NG (H)/H)-orbit of H\G belong to the same block (resp. distinct
blocks) of CH , where NG (H)/H acts on H\G by left translation.

20
As will be seen in Chapter 3, antisymmetry of P-schemes is important for deterministic polynomial factoring [Rón88; Rón92; Evd94; IKS09]. For now we show
that an antisymmetric P-scheme is discrete on H for any H ∈ P provided that P
contains the trivial subgroup of G.
Lemma 2.4. Suppose P is a subgroup system over a finite group G that contains
the trivial subgroup {e}. For H ∈ P, all antisymmetric P-schemes are discrete on
H.
Proof. Let C = {CH : H ∈ P} be an antisymmetric P-scheme. As NG ({e}) = G
acts transitively on {e}\G by left translation, we have C{e} = ∞{e}\G by antisymmetry. Now consider an arbitrary subgroup H ∈ P. By Lemma 2.3, we have
CH = {π{e},H (B) : B ∈ C{e} } = ∞H\G . So C is discrete on H.
On the other hand, symmetry of P-schemes plays no role in polynomial factoring
as far as we know, and we only discuss it within this chapter.
Strong antisymmetry. We introduce another property called strong antisymmetry, which is a strengthening of antisymmetry define above. It is based on an
idea introduced by Evdokimov [Evd94] which leads to his quasipolynomial-time
factoring algorithm.
Antisymmetry states that no nontrivial permutation of blocks arises from a conjugation cH,g where g ∈ NG (H): For such a map cH,g and a block B ∈ CH , either
the image cH,g (B) is a different block, or cH,g is the identity map. We strengthen
this property by considering permutations arising from compositions of not only
conjugations, but also projections and their inverses. Of course, a projection πH,H 0
is not invertible whenever H ( H 0 . Nevertheless, it is possible that the restriction
of πH,H 0 to some block B ∈ CH maps B bijectively to some block B 0 ∈ CH 0 , in
which case the inverse map (πH,H 0 |B )−1 is well defined.
Definition 2.7. A P-scheme C = {CH : H ∈ P} is strongly antisymmetric if for
any sequence of subgroups H0 , . . . , Hk ∈ P, B0 ∈ CH0 , . . . , Bk ∈ CHk , and maps
σ1 , . . . , σk satisfying
• σi is a bijective map from Bi−1 to Bi ,
• σi is of the form cHi−1 ,g |Bi−1 , πHi−1 ,Hi |Bi−1 , or (πHi ,Hi−1 |Bi )−1 ,

21
• H0 = Hk and B0 = Bk ,
the composition σk ◦ · · · ◦ σ1 is the identity map on B0 = Bk .
In other words, no nontrivial permutation could be obtained by composing maps of
the form cHi−1 ,g |Bi−1 , πHi−1 ,Hi |Bi−1 , or (πHi ,Hi−1 |Bi )−1 .
A strongly antisymmetric P-scheme is indeed antisymmetric: Assume C = {CH :
H ∈ P} is not antisymmetric, then there exist H ∈ P, g ∈ NG (H)−H and B ∈ CH
such that cH,g (B) = B. Let σ1 be the map cH,g |B : B → cH,g (B) = B. It sends
x ∈ B to gH x with respect to the action of NG (H)/H on H\G by left translation.
As this action is semiregular and gH ∈ NG (H)/H is not the identity element, the
map σ1 is a nontrivial permutation of B. So C is not strongly antisymmetric.
d(G) and d0 (G). For every finite permutation group G, we define d(G), d0 (G) ∈
N+ which are closely related to deterministic polynomial factoring, as will be seen
in Chapter 3.
Definition 2.8. Let G be a finite permutation group on a finite set S. For m ∈ N+ ,
let Pm be the system of stabilizers of depth m with respect to this action. Define
d(G), d0 (G) ∈ N+ as follows.
• Define d(G) to be the smallest integer m ∈ N+ such that all strongly antisymmetric Pm -schemes are discrete on Gx for all x ∈ S.
• If G acts transitively on S and |S| > 1, define d0 (G) to be the smallest integer
m ∈ N+ such that all strongly antisymmetric Pm -schemes are inhomogeneous
on Gx for all x ∈ S. Otherwise let d0 (G) = 1.
We have 1 ≤ d0 (G) ≤ d(G) ≤ max{|S| − 1, 1} for any finite permutation group G
on a finite set S. The first two inequalities are obvious and the last one follows from
Lemma 2.4 and the fact that any g ∈ G fixing |S| − 1 elements of S is the identity.
A better upper bound for d(G) is given by the minimal base size of G.
Definition 2.9 (base). Let G be a finite permutation group on a finite set S. A base
of G is a set B ⊆ S for which GB equals the trivial subgroup {e}. The minimal
base size of G, denoted by b(G), is the minimum cardinality of a base of G.
By Lemma 2.4, we have

22
Lemma 2.5. d(G) ≤ max{b(G), 1} for any finite permutation group G.
We also prove the following bound in latter chapters based on the work of [Evd94;
IKS09; Gua09; Aro13].
Lemma 2.6. There exists an absolute constant c > 0 such that d(G) ≤ c log n+O(1)
for any finite permutation group G on a set of cardinality n ∈ N+ .
The best known upper bound for c is log212 = 0.55788 . . . , proved by [Gua09;
Aro13]. See Section 7.1 for more details.
2.3 m-schemes
The paper [IKS09] proposed the notion of m-schemes. In this section, we present
their definition and show that it is generalized by the notion of P-schemes: roughly
speaking, an m-scheme could be regarded as a P-scheme where P is a system of
stabilizers with respect to an m-transitive group action.
We use the following notations:
Let S be a finite set and let m ∈ N+ . Define an m-collection on S to be a collection
of partitions P1 , . . . , Pm of S (1) , . . . , S (m) respectively.
For k ∈ [m], the symmetric group Sym(k) acts on the set S (k) by permuting
the k coordinates, i.e., for g ∈ Sym(k) and x = (x1 , . . . , xk ) ∈ S (k) , we have
g
x = (y1 , . . . , yk ) where yg i = xi , or equivalently yi = xg−1 i .
For 1 < k ≤ m and i ∈ [k], let πik : S (k) → S (k−1) be the projection omitting the
kth coordinate. More generally, for a proper subset T of [k], let πTk : S (k) → S (k−r)
be the projection omitting the coordinates whose indices are in T .
For k ∈ [m] and g ∈ Sym(k), let ckg be the permutation of S (k) sending x to g x, with
respect to the above action of Sym(k) on S (k) .
Definition 2.10 (m-scheme [IKS09]). An m-collection Π = {P1 , . . . , Pm } on S is
an m-scheme if it has the following properties:
• (compatibility) for 1 < k ≤ m, i ∈ [k] and elements x, x0 ∈ S (k) in the same
block of Pk , the elements πik (x), πik (x0 ) are in the same block of Pk−1 .
• (invariance) for k ∈ [m] and g ∈ Sym(k), the permutation ckg of S (k) sends
blocks of Pk to blocks.

23
• (regularity) for 1 < k ≤ m, i ∈ [k] and blocks B ∈ Pk , B 0 ∈ Pk−1 , the
number of x ∈ B satisfying πik (x) = y is a constant when y ranges over the
elements of B 0 .
Furthermore, we say Π is symmetric (resp. antisymmetric) if for all k ∈ [m] and
g ∈ Sym(k) − {e}, the permutation ckg of S (k) sends every block of Pk to itself
(resp. a different block). And Π is said to be homogeneous if P1 equals the coarsest
partition 0S .
We also introduce the following definitions which did not appear in [IKS09].
Definition 2.11. An m-scheme Π = {P1 , . . . , Pm } on S is said to be discrete if P1
equals the finest partition ∞S . It is said to be strongly antisymmetric if no nontrivial
permutation of any block of Pk for any k ∈ [m] can be obtained by composing maps
of the form cig |B , πTi |B , or (πTi |B )−1 , where B is a block of Pi .
Remark. The parameter m is allowed to be arbitrarily large in our definition. Nevertheless, the sets S (k) for k = |S| + 1, . . . , m are empty and hence the corresponding
partitions Pk contain no information. By discarding these partitions and replacing
m with min{m, |S|}, we may assume m ≤ |S|.
The connection of m-schemes with P-schemes
Given a finite set S and m ∈ N+ , let G be a group acting m0 -transitively on S
where m0 := min{m, |S|}.1 Choose P = Pm to be the system of stabilizers of
depth m with respect to this action (see Definition 2.2). We prove that for such G
and P, every P-scheme gives rise to an m-scheme on S, and (under an additional
assumption), there is a one-to-one correspondence between m-schemes on S and
P-schemes, with various properties (symmetry, antisymmetry, etc.) preserved.
For k ∈ [m0 ] and x = (x1 , . . . , xk ) ∈ S (k) , let Tx = {x1 , . . . , xk }. The stabilizer
Gx with respect to the diagonal action of G on S (k) equals the pointwise stabilizer
GTx with respect to the action of G on S, and therefore Gx = GTx ∈ P. As the
action of G on S (k) is transitive (which follows from m0 -transitivity of G on S), by
Lemma 2.1, we have an equivalence of group actions
λx : S (k) → Gx \G
1

In particular, we can take G = Sym(S) acting naturally on S, which is |S|-transitive.

24
between the diagonal action of G on S (k) and the action on Gx \G by inverse right
translation. It sends g x to Gx g −1 for g ∈ G. We use these maps λx to construct an
m-scheme on S from a P-scheme, and vice versa.
From a P-scheme to an m-scheme. We construct an m-scheme on S from a
P-scheme as follows.
Definition 2.12. Given a P-scheme C = {CH : H ∈ P}, define an m-collection
Π(C) = {P1 , . . . , Pm } on S as follows: for each k ∈ [m0 ] where m0 = min{m, |S|},
pick x = (x1 , . . . , xk ) ∈ S (k) , and define Pk = {λ−1
x (B) : B ∈ CGx }. For
0
m < k ≤ m, the partition Pk is a partition of the empty set S (k) and is unique.
Lemma 2.7. Π(C) as defined above is independent of the choices of elements x and
is an m-scheme. It is symmetric (resp. antisymmetric, strongly antisymmetric) if C
is symmetric (resp. antisymmetric, strongly antisymmetric). And it is homogeneous
(resp. discrete) iff C is homogeneous on Gx (resp. discrete on Gx ) for x ∈ S.
Proof. We may assume m ≤ |S|. Fix k ∈ [m] and we show that Pk does not
depend on the choice of x ∈ S (k) . Consider two elements x, x0 ∈ S (k) . Choose
h ∈ G such that x0 = h x. Such h exists since G acts transitively on S (k) . Then
Gx0 = hGx h−1 and we have the conjugation cGx ,h : Gx \G → Gx0 \G sending Gx g
to Gx0 hg. We check that λx0 = cGx ,h ◦ λx . This holds since for y = g x0 ∈ S (k) , we
have λx0 (y) = Gx0 g −1 and
g

cGx ,h ◦ λx (y) = cGx ,h ◦ λx ( x0 ) = cGx ,h ◦ λx (gh x) = cGx ,h (Gx (gh)−1 ) = Gx0 g −1 .
−1
−1
−1
So λ−1
x0 = λx ◦ cGx ,h = λx ◦ cGx0 ,h−1 . As C is invariant, the conjugation cGx0 ,h−1
sends blocks of CGx0 to blocks of CGx . So the two partitions {λ−1
x (B) : B ∈ CGx }
−1
and {λx0 (B) : B ∈ CGx0 } are identical, i.e., the elements x and x0 define the same
partition Pk .

Next we check that Π(C) is an m-scheme. For 1 < k ≤ m, consider the elements
x ∈ S (k) and x0 ∈ S (k−1) as picked in Definition 2.12. Let x̄ = πik (x) ∈ S (k−1) so
that Gx ⊆ Gx̄ . Choose h ∈ G, satisfying x0 = h x̄ so that Gx0 = hGx̄ h−1 . Then the
following diagram commutes:
S (k)

πik

λx 0

λx

Gx \G

S (k−1)

cGx̄,h ◦πGx ,Gx̄

Gx0 \G .

25
To see this, note that for any y = g x ∈ S (k) where g ∈ G, we have
cGx̄,h ◦ πGx ,Gx̄ ◦ λx (y) = cGx̄,h ◦ πGx ,Gx̄ (Gx g −1 ) = cGx̄,h (Gx̄ g −1 ) = Gx0 hg −1 ,
and
λx0 ◦ πik (y) = λx0 ◦ πik (g x) = λx0

g


gh−1 0
(πik (x)) = λx0 (g x̄) = λx0 (
x ) = Gx0 hg −1 ,

as desired. Also note that the maps λx and λx0 are bijections, sending blocks
to blocks. Compatibility and regularity of Π(C) then follow from compatibility,
regularity, and invariance of C.
For k ∈ [m], τ ∈ Sym(k) and x = (x1 , . . . , xk ) ∈ S (k) , let x0 = ckτ (x) ∈ S (k) .
Choose h ∈ G such that x = h x0 . Then Gx = hGx0 h−1 . We also have Gx = Gx0
since they are both the pointwise stabilizer GT with respect to the action of G on S,
where T = {x1 , . . . , xk }. So h ∈ NG (Gx ). We claim that the following diagram
commutes:
ckτ

S (k)
λx

S (k)
λx

Gx \G

cGx ,h

Gx \G .

To see this, note that for any y = g x ∈ S (k) where g ∈ G, we have cGx ,h ◦ λx (y) =
cGx ,h (Gx g −1 ) = Gx hg −1 , and
λx ◦ ckτ (y) = λx ◦ ckτ (g x) = λx

g


−1
g
(ckτ (x)) = λx ( x0 ) = λx (gh x) = Gx hg −1 ,

as desired. Invariance of Π(C) then follows from invariance of C. So Π(C) is an
m-scheme.
The previous diagram also shows that if C is symmetric (resp. antisymmetric) then
so is Π(C). Suppose a nontrivial permutation of some block of Pk for some k ∈ [m]
can be obtained by composing maps of the form cig |B , πTi |B , or (πTi |B )−1 , then using
the two diagrams above, we also obtain a nontrivial permutation of some block of
Gx \G (where x ∈ S (k) is as chosen in Definition 2.12) by composing conjugations,
projections, and their inverses (restricted to blocks). Therefore, if C is strongly
symmetric, so is Π(C).
Finally, for any x ∈ S, the partition P1 of S is constructed using the bijection
λx : S → Gx \G and the partition CGx of Gx \G. Therefore Π(C) is homogeneous
(resp. discrete) iff C is homogeneous on Gx (resp. discrete on Gx ).

26
From an m-scheme to a P-scheme. Conversely, we could also construct a Pscheme from an m-scheme on S. Here we need an additional assumption that
m 6= |S| − 1 and G acts min{|S|, m + 1/2}-transitively on S.2
Lemma 2.8. Assume m 6= |S| − 1 and G acts min{|S|, m + 1/2}-transitively on
S. For T, T 0 ⊆ S of cardinality at most m, we have GT = GT 0 iff T = T 0 . And the
normalizer NG (GT ) of GT is the setwise stabilizer G{T } .
Proof. The assumption implies that set of elements in S fixed by GT (resp. GT 0 ) is
precisely T (resp. T 0 ). So GT = GT 0 implies T = T 0 . The other direction is trivial.
For g ∈ G, we have gGT g −1 = Gg T . So g ∈ NG (GT ) iff GT = Gg T , which holds
iff T = g T by the first part. So NG (T ) = G{T } .
Definition 2.13. Assume m 6= |S| − 1 and G acts min{|S|, m + 1/2}-transitively
on S. Given an m-scheme Π = {P1 , . . . , Pm } on S, define a P-collection C(Π) =
{CH : H ∈ P} as follows: For H ∈ P, pick T ⊆ S of cardinality k ∈ [m] such that
H = GT . By Lemma 2.8, such a set T is unique. Pick x = (x1 , . . . , xk ) ∈ S (k) such
that T = {x1 , . . . , xk }. Then Gx = GT = H and we have the map λx : S (k) →
H\G. Define CH = {λx (B) : B ∈ Pk }.
Lemma 2.9. C(Π) as defined above is independent of the choices of elements x and
is a P-scheme. It is symmetric (resp. antisymmetric, strongly antisymmetric) if Π
is symmetric (resp. antisymmetric, strongly antisymmetric). And it is homogeneous
on Gx (resp. discrete on Gx ) for x ∈ S iff Π is homogeneous (resp. discrete).
Proof. Fix H = GT ∈ P and we show that CH does not depend on the choices
of x. Consider two elements x = (x1 , . . . , xk ), x0 = (x01 , . . . , x0k ) ∈ S (k) such
that T = {x1 , . . . , xk } = {x01 , . . . , x0k }. Then there exists ρ ∈ Sym(k) such that
ckρ (x0 ) = x. We check that λx0 = λx ◦ ckρ : For any y = g x0 ∈ S (k) where g ∈ G, we
have λx0 (y) = Hg −1 and
g

g
λx ◦ ckρ (y) = λx ◦ ckρ ( x0 ) = λx (ckρ (x0 )) = λx (g x) = Hg −1
as desired. As Π is invariant, the map ckρ sends blocks to blocks. Therefore
{λx (B) : B ∈ Pk } = {λx0 (B) : B ∈ Pk }. So the two elements x and x0 define the
same partition CH .
2

Recall that a group action of G on S is (k + 1/2)-transitive if it is k-transitive, and in addition
for all T ⊆ S of cardinality k, either the GT -orbit of every x ∈ S − T contains more than one
element, or |S − T | = 1.

27
Next we check that C(Π) is a P-scheme. Consider a projection πH,H 0 : H\G →
H 0 \G where H, H 0 ∈ P and H ⊆ H 0 . Then there exist T 0 ⊆ T ⊆ S such that
H = GT , H 0 = GT 0 . We may assume |T | = |T 0 | + 1 by decomposing πH,H 0 into the
composition of more projections if necessary. Let k = |T | and pick x = (x1 , . . . , xk )
such that T = {x1 , . . . , xk }. Choose the unique i ∈ [k] such that xi 6∈ T 0 . Let
x0 = πik (x). Then H = GT = Gx and H 0 = GT 0 = Gx0 . We claim that the
following diagram commutes:
S (k)

πik

S (k−1)
λx 0

λx

H\G

πH,H 0

H 0 \G .

To see this, note that for any y = g x ∈ S (k) where g ∈ G, we have πH,H 0 ◦ λx (y) =
πH,H 0 (Hg −1 ) = H 0 g −1 , and
λx0 ◦ πik (y) = λx0 ◦ πik (g x) = λx0

g


g
(πik (x)) = λx0 ( x0 ) = H 0 g −1 ,

as desired. And λx , λx0 are bijections that send blocks to blocks. Compatibility and
regularity of C(Π) then follow from those of Π.
Now consider a conjugation cH,h : H\G → H 0 \G for H ∈ P and h ∈ G, where
H 0 = hHh−1 . Choose x ∈ S (k) for some k ∈ [m] such that H = Gx . Let x0 = h x
so that H 0 = Gx0 . Then the following diagram commutes:
S (k)
λx 0

λx

H\G

cH,h

H 0 \G .

To see this, note that for any y = g x0 ∈ S (k) where g ∈ G, we have λx0 (y) = H 0 g −1
and
cH,h ◦ λx (y) = cH,h ◦ λx (gh x) = cH,h (H(gh)−1 ) = H 0 g −1 ,
as desired. So C(Π) is invariant. Therefore C(Π) is a P-scheme.
Now we prove the claim that strongly antisymmetry is preserved. Assume that a
map τ : B1 → B2 between blocks B1 , B2 ∈ CH for some H = GT ∈ P is obtained
by composing conjugations, projections and their inverses (restricted to blocks). Let
k = |T |. By the two diagrams above, we can obtain a map τ 0 : B10 → B20 between
blocks B10 , B20 ∈ Pk by composing maps of the form cig |B , πTi |B , or (πTi |B )−1 , such

28
that the following diagram commutes
B10

τ0

λx0

λx

B1

B20

τ

B2

for some x, x0 ∈ S (k) . We showed in the beginning that there exists ρ ∈ Sym(k)
satisfying λx0 = λx ◦ ckρ . By replacing τ 0 with ckρ ◦ τ 0 , B20 with ckρ (B20 ), and λ0x with
λx , we may assume x = x0 . Then if B1 = B2 and τ is a nontrivial permutation of
B1 , we also know that B10 = B20 and τ 0 is a nontrivial permutation of B10 . Therefore,
if Π is strongly antisymmetric, so is C(Π). The claim for antisymmetry is proved
in the same way, except that we only consider maps τ arising from conjugations but
not projections. And if B1 6= B2 for such τ , we also get a map τ 0 : B10 → B20 arising
from ckτ0 for some τ0 ∈ Sym(k) such that B10 6= B20 . So symmetry is also preserved.
Finally, for any x ∈ S, the partition CGx of Gx \G is constructed using the bijection
λx : S → Gx \G and the partition P1 . Therefore C(Π) is homogeneous on Gx (resp.
discrete on Gx ) iff Π is homogeneous (resp. discrete).
The maps C 7→ Π(C) and Π 7→ C(Π) are inverse to each other by construction.
So Lemma 2.7 and Lemma 2.9 together establish the one-to-one correspondence
between P-schemes and m-schemes on S.
Theorem 2.1. Suppose m 6= |S| − 1 and G is a finite group acting min{|S|, m +
1/2}-transitively on S, and P = Pm is the system of stabilizers of depth m with
respect to this action. The map C 7→ Π(C) in Definition 2.12 is a one-to-one
correspondence between P-schemes and m-schemes on S, with the inverse map
Π 7→ C(Π) as defined in Definition 2.13. And Π(C) is symmetric (resp. antisymmetric, strongly antisymmetric, homogeneous, discrete) iff C is symmetric (resp.
antisymmetric, strongly antisymmetric, homogeneous on Gx for x ∈ S, discrete on
Gx for x ∈ S).
Remark. The unpleasant assumption m 6= |S| − 1 in Theorem 2.1 is due to the
technical fact that when T ⊆ S has cardinality |S| − 1, the pointwise stabilizer GT
fixes not only T but also the whole set S. This assumption is needed if we want
the correspondence in Theorem 2.1 to preserve antisymmetry and homogeneity:
Suppose G is a permutation group on S and |S| = ` is a prime number. Then
for m = ` − 1, there exists an antisymmetric homogeneous m-scheme on S (see

29
Example 2.2 in Section 2.4). On the other hand, note that P = Pm contains the
trivial subgroup GS = {e}. So by Lemma 2.4, all antisymmetric P-schemes are
discrete on Gx for any x ∈ S.
Matchings. The papers [IKS09; Aro+14] formulated the idea of [Evd94] with a
notion called a matching. We use the more general definition in [Aro+14] (where it
is called a generalized matching).
Definition 2.14 (matching). Let Π = {P1 , . . . , Pm } be an m-scheme on S. A block
B ∈ Pk for some k ∈ [m] is called a matching of Π if there exist two distinct
proper subsets T, T 0 of [k] of the same cardinality such that πTk (B) = πTk 0 (B) and
|B| = |πTk (B)|.
The work [IKS09; Aro+14] designed algorithms leading to m-schemes with no
matching. Now we explain the connection between this property and strong antisymmetry of m-schemes.
Given a matching B ∈ Pk of Π, let T, T 0 ⊆ [k] be as in Definition 2.14 and let k 0 :=
k − |T |. Then B 0 := πTk (B) = πTk 0 (B) is a block of Pk0 . We have two maps πTk |B
and πTk 0 |B from B to B 0 , both of which are bijective by the condition |B| = |πTk (B)|.
Moreover πTk |B 6= πTk 0 |B as they omit different subsets of coordinates and the k
coordinates of elements in S (k) are all distinct. So πTk 0 |B ◦ (πTk |B )−1 is a nontrivial
permutation of B 0 . We conclude:
Lemma 2.10. A strongly antisymmetric m-scheme has no matching.
So our definition of strong antisymmetry of m-schemes (or that of P-schemes by
Lemma 2.7) subsumes the property that no matching exists.
We will use strong antisymmetry instead of (non-existence of) matchings throughout
this thesis. The advantage of this comes from transitivity: Suppose x ∈ H\G is sent
to a different element y ∈ H\G by a map τ that is a composition of conjugations,
projections and their inverses (restricted to blocks), then x and y belong to different
blocks by strong antisymmetry. Suppose we also separate y from another element
z ∈ H\G in the same way. Then since the set of maps we consider are closed under
composition, we get a map sending x to z and hence are able to separate them as
well. The analyses in Chapter 7 and Chapter 8 crucially exploit this property.

30
The connection of m-schemes with association schemes
As shown in [IKS09; Aro+14], m-schemes are closely related to the notion of
association schemes [BI84].
Definition 2.15. An association scheme on a finite set S is a partition P of S × S
such that
• 1S := {(x, x) : x ∈ S} is a block of P ,
• for a block g ∈ P , the set g ∗ := {(y, x) : (x, y) ∈ B} is also a block, and
• for every triple of blocks g, g 0 , g 00 ∈ P , there exists an integer cgg0 ,g00 ≥ 0
such that for any (x, y) ∈ g, the number of z ∈ S satisfying (x, z) ∈ g 0 and
(z, y) ∈ g 00 is cgg0 ,g00 .
An association scheme P is symmetric if g = g ∗ for all g ∈ P , and antisymmetric
S
if g 6= g ∗ for all g ∈ P − {1S }. The integer c1g,g
∗ is called the valency of g.
We can obtain a homogeneous 3-scheme from an association scheme and vice versa
using the following constructions.
Definition 2.16. For a finite set S and a partition P of S × S such that 1S ∈ P ,
define the partition P 0 of S (3) such that two elements (x1 , x2 , x3 ), (x01 , x02 , x03 ) ∈ S (3)
are in the same block of P 0 iff (xi , xj ) and (x0i , x0j ) are in the same block of P
for all 1 ≤ i, j ≤ 3. And define a 3-collection Π(P ) = {P1 , P2 , P3 } on S by
choosing P1 = S, P2 = P − {1S }, P3 = P 0 . Conversely, given a 3-collection
Π = {P1 , P2 , P3 } on S, define a partition P (Π) of S × S by P (Π) := P2 ∪ {1S }
Lemma 2.11 ([IKS09; Aro+14]). If P is an association scheme, then Π(P ) is a
homogeneous 3-scheme. Conversely, if Π is a homogeneous 3-scheme, then P (Π)
is an association scheme.
By construction, this gives a one-to-one correspondence between association
schemes on S and equivalent classes of homogeneous 3-schemes on S, where
two homogeneous 3-schemes {P1 , P2 , P3 } and {P10 , P20 , P30 } on S are said to be
equivalent if P1 = P10 and P2 = P20 .
In addition, we obviously have
Lemma 2.12. If Π is symmetric (resp. antisymmetric), so is P (Π).

31
Next we discuss the relation between symmetry and antisymmetry of an association
scheme P and those of Π(P ). Obviously, for Π(P ) to be symmetric (resp. antisymmetric), it is necessary that P is also symmetric (resp. antisymmetric). The exact
condition is given as follows.
Lemma 2.13. The 3-scheme Π(P ) is symmetric iff P is the trivial association
∗
scheme {1S , S × S − 1S }. It is antisymmetric iff P is antisymmetric and cgg,g = 0
for all g ∈ P − {1S }.
Proof. The trivial association scheme P = {1S , S × S − 1S } gives rise to the
3-scheme Π(P ) = {0S , 0S (2) , 0S (3) } which is symmetric. Suppose P 6= {1S , S ×
S − 1S }. Let g1 and g2 be two distinct blocks in P − {1S }. If g1 = g2∗ then P is
not symmetric and hence neither is Π(P ). So assume g1 6= g2∗ . Fix x ∈ S. Then
(x, y) ∈ g1 and (x, z) ∈ g2 for some y, z ∈ S − {x}, and y 6= z. Consider the
element t = (x, y, z) ∈ S (3) . Let h = (1 2 3) ∈ Sym(3) so that h t = (z, x, y).
We have π33 (t) = (x, y) ∈ g1 and π33 (h t) = (z, x) ∈ g2∗ 6= g1 . By compatibility of
Π(P ), the elements t and h t are in different blocks. So Π(P ) is not symmetric.
∗

Suppose Π(P ) is antisymmetric, then so is P . We check that cgg,g = 0 for all
∗
g ∈ P − {1S }. Assume to the contrary that cgg,g > 0 for some g ∈ P − {1S }.
Fix (x, y) ∈ g ∗ . Then there exists z ∈ S such that (x, z), (z, y) ∈ g. Then for
t = (x, y, z) ∈ S (3) and h = (1 2 3) ∈ Sym(3), we have πi3 (t), πi3 (h t) ∈ g ∗ for all
1 ≤ i ≤ 3. It follows by definition that t and h t are in the same block, contradicting
antisymmetry of Π(P ).
∗

Conversely, suppose P is antisymmetric and cgg,g = 0 for all g ∈ P − {1S }. To
prove Π(P ) is antisymmetric, it suffices to show that for any t = (x, y, z) ∈ S (3)
and h ∈ Sym(3), the elements t and h t are in different blocks. First assume h is a
transposition, e.g., (1 2) (the other cases are symmetric). Then π33 (t) = (x, y) and
π33 (h t) = (y, x) are in different blocks by antisymmetry of P , and the claims follows
by compatibility of Π(P ). Next assume h is a 3-cycle, e.g., (1 2 3) (the other case is
symmetric), so that h t = (z, x, y). Let g be the block in P − {1S } containing (y, x),
∗
so that (x, y) ∈ g ∗ . As cgg,g = 0, either (x, z) or (z, y) is not in g. If (x, z) 6∈ g, we
have π33 (t) = (x, y) ∈ g ∗ and π33 (h t) = (z, x) 6∈ g ∗ . If (x, z) ∈ g but (z, y) 6∈ g,
we have π23 (t) = (x, z) ∈ g and π23 (h t) = (z, y) 6∈ g. In either case t and h t are in
different blocks by compatibility of Π(P ).
Example 2.1. Let S be a finite dimensional vector space over a finite field Fq where
char(Fq ) 6∈ {2, 3}. Let P be the partition of S × S such that (x, y) and (x0 , y 0 ) are in

32
the same block iff x − y = x0 − y 0 , which is an association scheme [BI84]. We check
that P satisfies the condition of Lemma 2.13, and hence Π(P ) is antisymmetric.
For any (x, y) 6∈ 1S , we have x − y 6= y − x since x 6= y and char(Fq ) 6= 2, and
therefore (x, y) and (y, x) are in different blocks. So P is antisymmetric. Then we
∗
∗
check that cgg,g = 0 for all g ∈ P − {1S }. Assume to the contrary that cgg,g > 0 for
some g ∈ P − {1S }. Fix (x, y) ∈ g ∗ and choose z ∈ S such that (x, z), (z, y) ∈ g.
Then x − z = z − y = y − x, implying 3(x − z) = 0. This is impossible since
x 6= z and char(Fq ) 6= 3.
The antisymmetric 3-scheme Π(P ) in Example 2.1 is not strongly antisymmetric:
For any distinct x, y ∈ S, let B ∈ P − {1S } be the block containing t = (x, y).
Then π12 |B and π22 |B are bijections from B to S sending t to y and x, respectively.
So π12 |B ◦ (π22 |B )−1 is a permutation of the unique block S ∈ 0S sending x to y.
We do not know any example of an association scheme P for which Π(P ) is strongly
antisymmetric. The following lemma gives a sufficient condition for the existence
of such an association scheme.
Lemma 2.14. Suppose P is an antisymmetric association scheme satisfying (1)
∗
cgg,g = 0 for all g ∈ P − {1S }, and (2) for all blocks g ∈ P and g 0 , g 00 ∈ P − {1S },
either cgg0 ,g00 = 0 or cgg0 ,g00 > 1. Then Π(P ) is strongly antisymmetric.
Proof. By Lemma 2.13, the 3-scheme Π(P ) is antisymmetric. And (2) implies
that none of the projections πi2 and πi3 are invertible even restricted to blocks
of S (2) and S (3) respectively. Strong antisymmetry of Π(P ) then follows from
antisymmetry.
In general, strongly antisymmetric 3-schemes do exist. See Example 2.4 in Section 2.5.
2.4

Orbit P-schemes and m-schemes

An important family of m-schemes called orbit schemes, or what we call orbit mschemes, was proposed and studied in [IKS09]. The blocks of such m-schemes are
orbits of group actions.
Definition 2.17 (orbit m-scheme [IKS09]). Given a finite set S, m ∈ N+ , and a
group K ⊆ Sym(S) acting naturally on K, for each k ∈ [m], define the partition
Pk of S (k) to be the partition into K-orbits with respect to the diagonal action of

33
K on S (k) . The m-collection Π = {P1 , . . . , Pm } is called the orbit m-scheme on S
associated with the group K.
This is indeed an m-scheme:
Theorem 2.2 ([IKS09]). The m-collection Π in Definition 2.17 is an m-scheme on
S.
We define orbit P-schemes in a similar way, except that the subgroup K of Sym(S)
is now replaced with a subgroup of G, and the diagonal actions on S (k) , k ∈ [m] are
replaced with the actions on right coset spaces by inverse right translation.
Definition 2.18 (orbit P-scheme). Let P be a subgroup system over a finite group
G, and let K be a subgroup of G. For H ∈ P, define the partition CH of H\G to be
the partition into K-orbits, with respect to the action of K on H\G by inverse right
translation. The P-collection C = {CH : H ∈ P} is called the orbit P-scheme
associated with the group K.
This construction indeed yields a P-scheme:
Theorem 2.3. The P-collection C in Definition 2.18 is a P-scheme.
Proof. Let K act on each right coset space H\G by inverse right translation. For
H, H 0 ∈ P with H ⊆ H 0 , g ∈ K and x ∈ H\G, we have πH,H 0 (g x) = g (πH,H 0 (x))
by Lemma 2.2. Therefore if x, x0 ∈ H\G are in the same block of CH (i.e., the
same K-orbit of H\G), then πH,H 0 (x) and πH,H 0 (x0 ) are in the same block of CH 0
(i.e., the same K-orbit of H 0 \G). So C is compatible.
Similarly, for H ∈ P, h ∈ G, g ∈ K and x ∈ H\G, we have cH,h (g x) = g (cH,h (x))
by Lemma 2.2. Therefore if x, x0 ∈ H\G are in the same block of CH , then cH,h (x)
and cH,h (x0 ) are in the same block of CgHg−1 . So C is invariant.
For H 0 ∈ P and y, y 0 ∈ H 0 \G in the same block B of CH 0 , choose g ∈ K such that
y 0 = g y. As g ∈ K, we have g B = B. For H ∈ P with H ⊆ H 0 and x ∈ H\G,
we have x ∈ B and πH,H 0 (x) = y iff g x ∈ g B = B and πH,H 0 (g x) = g (πH,H 0 (x)) =
−1
g
y = y 0 . So the map x 7→ g x is a one-to-one correspondence between B ∩ πH,H
0 (y)
−1
0
and B ∩ πH,H 0 (y ), and hence the two sets have the same cardinality. So C is
regular.

34
The connection between Definition 2.17 and Definition 2.18 is given by the following
lemma.
Lemma 2.15. For a finite set S, m ∈ N+ , and a subgroup K ⊆ Sym(S), let
P = Pm be the system of stabilizers of depth m with respect to the natural action
of Sym(S) on S, and let C = {CH : H ∈ P} be the orbit P-scheme associated
with K. Then the orbit m-scheme associated with K is exactly Π(C) as defined in
Definition 2.12.
Proof. We may assume m ≤ |S|. Let G be the symmetric group Sym(S) acting
naturally on S. Suppose Π(C) = {P1 , . . . , Pm } where Pk is a partition of S (k)
for k ∈ [m]. By Definition 2.12, each partition Pk is given by Pk = {λ−1
x (B) :
B ∈ CGx } for some x = (x1 , . . . , xk ) ∈ S (k) , where λx : S (k) → Gx \G is an
equivalence between the diagonal action of G on S (k) and the action on Gx \G by
inverse right translation. It follows that Pk is the partition into K-orbits with respect
to the diagonal action, since CGx is the partition into K-orbits with respect to the
action by inverse right translation.
Antisymmetry of orbit m-schemes. We prove a simple and exact criterion for
antisymmetry of orbit m-schemes.
Lemma 2.16. The orbit m-scheme on S associated with K ⊆ Sym(S) is antisymmetric iff the order of K is coprime to 1, 2, . . . , m.
Proof. Let Π = {P1 , . . . , Pm } be the orbit m-scheme on S associated with K.
Suppose the order of K is divisible by an integer k satisfying 1 < k ≤ m. We may
assume that k is a prime integer. By Cauchy’s theorem (see, e.g., [Lan02]), the group
K contains an element g of order k. The element g, as a permutation of S, has at least
one k-cycle (x1 x2 · · · xk ). Consider the element x = (x1 , . . . , xk ) ∈ S (k) , and let
B be the block of Pk containing x. By definition, the element g x = (g x1 , . . . , g xk ) =
(x2 , . . . , xk , x1 ) is also in B. On the other hand, let h = (1 2 · · · k)−1 ∈ Sym(k).
The permutation ckh of S (k) sends x = (x1 , . . . , xk ) to y = (y1 , . . . , yk ) defined
by yi = xh−1 i for i ∈ [k]. So ckh (x) = (x2 , . . . , xk , x1 ) ∈ B. Therefore Π is not
antisymmetric.
Conversely, assume Π is not antisymmetric. Then for some integer k satisfying 1 <
k ≤ min{m, |S|}, h ∈ Sym(k) − {e}, and some element x = (x1 , . . . , xk ) ∈ S (k)
lying in a block B of Pk , we have ckh (x) ∈ B, i.e., ckh (x) = g x for some g ∈ K with

35
respect to the diagonal action of K on S (k) . As the permutation ckh of S (k) sends x
to y = (y1 , . . . , yk ) defined by yi = xh−1 i for i ∈ [k], we see g xi = xh−1 i for i ∈ [k].
Then g preserves the set T := {x1 , . . . , xk } and restricts to a nontrivial permutation
g|T ∈ Sym(T ) of T . Let e be the order of g|T . Then e is not coprime to some
integer t where t ≤ |T | ≤ m. The order of K is a multiple of the order of g, which
is a multiple of e. So the order of K is not coprime to t either.
Example 2.2. Let S be a finite set satisfying |S| > 1. Let K be a subgroup of
Sym(S) generated by a single |S|-cycle so that it acts regularly on S. Denote by `
the least prime factor of |S|. Let Π be the orbit m-scheme on S associated with K
where m is an integer satisfying 1 ≤ m < `. Then Π is homogeneous since K acts
transitively on S. The order of K is |S|, which is coprime to 1, . . . , ` − 1. So Π is
also antisymmetric by Lemma 2.16 and the fact m ≤ ` − 1.
Upper bound of m for antisymmetric homogeneous m-schemes. Let S be a
finite set satisfying |S| > 1, and let ` be the least prime factor of |S|. For m ≥ `,
the orbit m-schemes on S in Example 2.2 are still homogeneous but no longer
antisymmetric. Indeed, an argument of Rónyai [Rón88] shows that for m ≥ `, even
general m-schemes on S cannot be both homogeneous and antisymmetric. This was
reproduced in [IKS09] and we present it here.
Lemma 2.17 ([Rón88; IKS09]). Let S be a finite set satisfying |S| > 1, and let ` be
the least prime factor of |S|. There exists no antisymmetric homogeneous m-scheme
on S for m ≥ `.
Proof. Assume to the contrary that such an m-scheme Π = {P1 , . . . , Pm } exists.
The group Sym(`) acts on S (`) by g x = ckg (x). By antisymmetry of Π, this action
induces a semiregular action on the set of blocks in P` . Let B1 , . . . , Bk ∈ P` be
a complete set of representatives for the Sym(`)-orbits, i.e., each orbit contains
exactly one Bi . Then we have
k
X

|Bi | =

i=1

|S|(|S| − 1) · · · (|S| − ` + 1)
|S (`) |
=
|Sym(`)|
`!

Let π be the projection from S (`) to S sending (x1 , . . . , x` ) to x1 . By regularity
and homogeneity of Π, for each i ∈ [k], the cardinality of Bi ∩ π −1 (y) is a constant
di ∈ N+ independent of y ∈ S. Then
k
X
i=1

di =

k
X
|Bi |
i=1

|S|

=

(|S| − 1) · · · (|S| − ` + 1)
.
`!

36
As |S| is a multiple of `, none of the factors |S| − 1, . . . , |S| − ` + 1 of the numerator
is divisible by the prime number ` appeared in the denominator. This contradicts
P
the integrality of ki=1 di .
The condition m ≥ ` in Lemma 2.17 is tight, since Example 2.2 shows that antisymmetric homogeneous m-schemes exist for m = ` − 1.
Rónyai’s result can be extended to P-schemes in the case that P is a system of
stabilizers with respect to a transitive group action.
Lemma 2.18. Let G be a finite group acting transitively on a set S of cardinality
n > 1. Let P = Pm be the corresponding system of stabilizers of depth m for some
m ≥ `, where ` is the least prime factor of n. Then for any x ∈ S, there exists no
antisymmetric P-scheme that is homogeneous on Gx . In particular, d0 (G) < `.
Lemma 2.18 can be easily proven using a technique called the induction of Pschemes, to be discussed in Chapter 6. It allows us to reduce to the case G = Sym(S).
The claim then follows immediately, since by Lemma 2.7, for G = Sym(S), the
existence of an antisymmetric P-scheme homogeneous on Gx implies the existence
of an antisymmetric homogeneous m-scheme on S, which contradicts Lemma 2.17.
For now, we just provide a direct proof.
Proof of Lemma 2.18. Assume to the contrary that C = {CH : H ∈ P} is an
antisymmetric P-scheme that is homogeneous on Gx for some x ∈ S. As C is
invariant and G acts transitively on S (and hence all one-point stabilizers Gx are
conjugate in G), we know C is homogeneous on Gx for all x ∈ S.
Consider the set S (`) equipped with two actions: the diagonal action of G and
the action of Sym(`) permuting the ` coordinates. The latter action is defined by
g
(x1 , . . . , x` ) = (xg−1 1 , . . . xg−1 ` ) for g ∈ Sym(`) and (x1 , . . . , x` ) ∈ S (`) . Note that
these two actions commute with each other and combine to an action of G × Sym(`)
on S (`) . For z ∈ S (`) , we have g Gz = G g z for all g ∈ Sym(`) and hence the action
of Sym(`) permutes the G-orbits within the (G × Sym(`))-orbit (G × Sym(`))z.
Now fix z ∈ S (`) . We have the bijection λz : Gz → Gz \G which is an equivalence
between the action of G on the G-orbit Gz and the action on Gz \G by inverse
right translation. We also have a semiregular action of NG (Gz )/Gz on Gz \G by
left translation. This gives a injective group homomorphism φ : NG (Gz )/Gz ,→
Sym(Gz \G), and we denote its image by N . Then |N | = |NG (Gz )/Gz |.

37
Let H be the subgroup of Sym(`) fixing Gz setwisely, i.e., H = {g ∈ Sym(`) :
g
Gz = Gz}. The action of H ⊆ Sym(`) on S (`) restricts to an action on Gz
and hence we have a group homomorphism H → Sym(Gz). It is injective since
elements in Gz ⊆ S (`) have distinct coordinates. Now, identifying Gz with Gz \G
via λz , we have an action of H on Gz \G as well, defined by g λz (x) = λz (g x) for
x ∈ Gz. This gives an injective group homomorphism φ0 : H ,→ Sym(Gz \G).
We claim that φ0 (H) ⊆ N . To see this, pick any g ∈ H. We have g Gz e = Gz h0 for
−1
some h0 ∈ G, or equivalently g z = h0 z. Then for any h ∈ G, we have

g −1 
 −1

g
−1
−1
g
Gz h = λz (h z) = λz (h z) = λz h (g z) = λz ((h0 h) z) = Gz h0 h.
In particular, for any h ∈ Gz , we have g Gz h = Gz h0 h and other other hand
g
Gz h = g Gz e = Gz h0 . So h0 hh−1
0 ∈ Gz . Therefore h0 ∈ NG (Gz ). Furthermore,
note that h0 Gz ∈ NG (Gz )/Gz sends any Gz h ∈ Gz \G to Gz h0 h = g Gz h by left
translation. So φ0 (g) = φ(h0 Gz ) ∈ N . Therefore φ0 (H) ⊆ N , as desired.
By antisymmetry, the action of N on Gz \G induces a semiregular action on the
set of blocks of CGz , which induces a semiregular action of φ0 (H) on the set of
blocks of CGz . Let B1 , . . . , Bk ∈ CGz be a complete set of representatives for the
φ0 (H)-orbits. Then we have
k
X
i=1

|Bi | =

|Gz \G|
|Gz|
=
.
0
|φ (H)|
|H|

Choose x ∈ S such that Gz ⊆ Gx . By regularity and homogeneity on Gx , for
−1
each i ∈ [k], the cardinality of Bi ∩ πG
(y) is a constant di ∈ N+ independent
z ,Gx
of y ∈ Gx \G, and hence |Bi | is a multiple of |Gx \G| = n. Therefore |Gz| is a
multiple of n · |H|.
By the orbit-stabilizer theorem, the number of G-orbits contained in (G × Sym(`))z
is |Sym(`)|/|H|, and these G-orbits all have the same cardinality |Gz|. So
|(G × Sym(`))z| =

|Sym(`)|
· |Gz|,
|H|

which is a multiple of n · |Sym(`)| = n`! since |Gz| is a multiple of n · |H|. As
this holds for arbitrary z ∈ S (`) , we know |S (`) | = n(n − 1) · · · (n − ` + 1) is also a
multiple of n`!. But this is not possible since n − 1, . . . , n − ` + 1 are not divisible
by the prime number `.

38
Strongly antisymmetric homogeneous m-schemes for m ≤ 3

2.5

In this section, we give examples of strongly antisymmetric homogeneous mschemes on a finite set S where |S| > 1 and m ∈ {1, 2, 3}.
The case m = 1. For all finite sets S, there exists a unique homogeneous 1-scheme
Π = {P1 } on S, given by P1 = 0S . It is obviously antisymmetric since Sym(1)
is the trivial group. And it is also strongly antisymmetric since there exists no
projection πik for m = 1.
The case m = 2. We discuss the following explicit construction of orbit 2schemes.
Example 2.3. Let q be a prime power of the form q = 4k + 3 for some k ∈ N.3 The
×
multiplicative group F×
q is a cyclic group of order 4k + 2. Denote by χ2 : Fq → C
the unique nontrivial quadratic character of F×
q , which sends quadratic residues to 1
and non-residues to −1. Its kernel Ker(χ2 ) is the unique subgroup of F×
q of index
×
two. For u ∈ Fq and v ∈ Fq , denote by φu,v the affine linear transformation of Fq
sending x ∈ Fq to ux + v. Define K by
K := {φu,v : u ∈ Ker(χ2 ), v ∈ Fq }.
Then K is a subgroup of Sym(Fq ).4 Let Π = {P1 , P2 } be the orbit 2-scheme on Fq
associated with the subgroup K.
The partitions P1 and P2 are given as follows: as K acts transitively on Fq , we have
(2)
P1 = 0Fq and Π is homogeneous. For (a, b) ∈ Fq , we have φ1,b (a − b, 0) = (a, b)
and φ1,b ∈ K, and hence (a, b) and (a − b, 0) are in the same block of P2 . Two
(2)
elements (c, 0), (d, 0) ∈ Fq are in the same block iff g c = d for some g ∈ K0 ,
where K0 is the stabilizer of 0 ∈ Fq . As K0 = {φu,0 : u ∈ Ker(χ2 )}, we see
that (c, 0) and (d, 0) are in the same block iff χ2 (c) = χ2 (d). We conclude that P2
contains two blocks B+1 and B−1 , where
Bs = {(a, b) ∈ F(2)
q : χ2 (a − b) = s}
for s = ±1.
3

In particular, we may choose q to be a prime number. By Dirichlet’s theorem on arithmetic
progressions [Neu99], there exist infinitely many prime numbers of the form 4k + 3.
4
The group K is also a subgroup of the general affine group AGL1 (q) and is isomorphic to a
semidirect product Fq o Ker(χ2 ).

39
The order of K is q(q−1)/2 = (4k+3)(2k+1) which is odd. So Π is antisymmetric
by Lemma 2.16. For every y ∈ Fq , the number of elements in B+1 (or B−1 ) mapped
to y by the projection π12 (or π22 ) is (q − 1)/2, which is greater than one when q > 3.
Therefore when q > 3, the two projections π12 and π22 restricted to B1 (or B2 ) are
not invertible, and hence Π is strongly antisymmetric. We conclude:
Lemma 2.19. The orbit 2-scheme Π in Example 2.3 is homogeneous and antisymmetric. It is strongly antisymmetric when q > 3.
We remark that the partition P := P2 ∪ {1Fq } of Fq × Fq (where 1Fq = {(a, a) :
a ∈ Fq }) is actually an antisymmetric association scheme on Fq . It is known as an
association scheme of Paley tournaments [ER63; BI84; BCN89], or more generally
a cyclotomic scheme [BCN89].
Recall that for an association scheme P on a set S, blocks g, g 0 , g 00 ∈ P , and
(x, y) ∈ g, we use cgg0 ,g00 to denote the number of z ∈ S satisfying (x, z) ∈ g 0 and
(z, y) ∈ g 00 . When P is antisymmetric and has only three blocks, the quantities
cgg0 ,g00 only depend on n.5 We state it formally for the cases g, g 0 , g 00 6= 1S .
Lemma 2.20. Let P be an antisymmetric association scheme on a set S of cardinality
n containing only three blocks 1S , g and g ∗ . Then for u, v, w ∈ {g, g ∗ }, we have

(n + 1)/4 if u∗ = v = w,
cuv,w =
(n − 3)/4 otherwise.
∗

Proof. From the basic properties of association schemes, we have cgg,g = cgg∗ ,g∗ ,
P
∗
∗
∗
cgg,g = cgg,g∗ = cgg∗ ,g = cgg∗ ,g∗ = cgg∗ ,g = cgg,g∗ , and w∈P cuv,w = (n − 1)/2 for
u, v ∈ {g, g ∗ }.6 Also note that cuv,1S equals one when u = v and zero otherwise.
The claim then follows by simple calculations.
In particular, Lemma 2.20 applies to the association scheme P = P2 ∪ {1Fq } above.
This is used in the next example for the proof of strong antisymmetry.
5

This is a folklore result. Such an association scheme is equivalent to a doubly regular tournament. See, e.g., [RB72].
6
See, e.g., [BI84, Section II.2, Proposition 2.2] and note that g, g ∗ have the same valency
(n − 1)/2.

40
The case m = 3. We have noted that for P2 as defined in Example 2.3, the partition
P = P2 ∪ {1Fq } of Fq × Fq is an antisymmetric association scheme on Fq . Thus
by Lemma 2.11, we have a homogeneous 3-scheme Π(P ). Unfortunately, Π(P ) is
not necessarily antisymmetric: there may exist distinct elements a, b, c ∈ Fq such
(3)
that χ2 (a − b) = χ2 (b − c) = χ2 (c − a), and the block containing (a, b, c) ∈ Fq is
preserved by the 3-cycles in Sym(3).
However, it is possible to modify Π(P ) to get an explicit construction of strongly
antisymmetric homogeneous 3-schemes. The idea is to use a nontrivial cubic
character besides the quadratic character χ2 .
Example 2.4. Let q be a prime power of the form 36k + 11 or 36k + 23 for some
k ∈ N.7 The congruence is chosen so that q − 1 is divisible by 2 but not by 3 or 4,
and q 2 − 1 is divisible by 3 but not by 9. In particular, the condition q ≡ 3 mod 4 in
Example 2.3 still holds. Define a 3-collection Π = {P1 , P2 , P3 } on Fq as follows:
P1 and P2 are constructed in the same way as in Example 2.3, i.e., P1 = 0Fq and P2
contains two blocks, B+1 and B−1 , where
Bs = {(a, b) ∈ F(2)
q : χ2 (a − b) = s}
×
for s = ±1, and χ2 : F×
q → C is the unique nontrivial quadratic character of Fq .

To construct P3 , we consider the quadratic extension Fq2 of Fq . Its multiplicative
2
group F×
q 2 is a cyclic group of order q −1 which is divisible by 3. Choose a nontrivial
2
cubic character χ3 : F×
q 2 → C. Let ω be a primitive third root of unity in Fq so that
(3)
1 + ω + ω 2 = 0. For (a, b, c) ∈ Fq , we have a + ωb + ω 2 c = (a − c) + ω(b − c)
which is nonzero since ω 6∈ Fq . So a + ωb + ω 2 c ∈ F×
q 2 . We define a function s on
(3)
Fq by

χ (a + ωb + ω 2 c) if χ (a − b) = χ (b − c) = χ (c − a),
3
2
2
2
s(a, b, c) :=
1
otherwise.
(3)

For (a, b, c) ∈ Fq , call the quadruple
(χ2 (a − b), χ2 (b − c), χ2 (c − a), s(a, b, c))
(3)

the signature of (a, b, c). Choose the partition P3 of Fq such that two triples
(3)
(a, b, c), (a0 , b0 , c0 ) ∈ Fq are in the same block iff they have the same signature.
7

Again, by Dirichlet’s theorem on arithmetic progressions [Neu99], there exist infinitely many
such q.

41
Lemma 2.21. The 3-collection Π in Example 2.4 is an antisymmetric homogeneous
3-scheme on Fq . It is strongly antisymmetric when q > 11.
Proof. We first check that Π is an antisymmetric 3-scheme.
(3)

For compatibility, we need to verify that if (a, b, c), (a0 , b0 , c0 ) ∈ Fq are in the same
block of P3 , then their images under πi3 are in the same block of P2 , i = 1, 2, 3. This
follows by construction.
For invariance and antisymmetry, we need to show that for any g ∈ Sym(3) − {e},
(3)
the signature of (a, b, c) ∈ Fq determines that of g (a, b, c), and they are different.
We note that χ2 (−1) = −1 since |F×
q | = q − 1 is not divisible by 4, and χ3 (ω) is a
2
primitive third root of unity in C since |F×
q 2 | = q − 1 is not divisible by 9.
Suppose g is a transposition, e.g., the one sending (a, b, c) to (b, a, c) (the other cases
are symmetric). Then the signature of g (a, b, c) is
(χ2 (b − a), χ2 (a − c), χ2 (c − b), s(b, a, c))
= (−χ2 (a − b), −χ2 (c − a), −χ2 (b − c), s(b, a, c)).
When χ2 (a − b), χ2 (b − c), χ2 (c − a) are not all equal, we have s(b, a, c) = 1.
Otherwise
s(b, a, c) = χ3 (b + ωa + ω 2 c) = χ3 (ω)χ3 (a + ω −1 b + ω −2 c).
The automorphism x 7→ xq of Fq2 fixes a, b, c ∈ Fq and exchanges ω with ω −1 . So
χ3 (a + ω −1 b + ω −2 c) = χ3 ((a + ωb + ω 2 c)q ) = χq3 (a + ωb + ω 2 c). We see that in
(3)
this case, the signature of (a, b, c) ∈ Fq determines that of g (a, b, c). And they are
different since χ2 (b − a) = −χ2 (a − b) 6= χ2 (a − b).
Suppose g is a 3-cycle, e.g., the one sending (a, b, c) to (b, c, a) (the other case
is symmetric). Then the signature of g (a, b, c) is (χ2 (b − c), χ2 (c − a), χ2 (a −
b), s(b, c, a)). When χ2 (a − b), χ2 (b − c), χ2 (c − a) are not all equal, we have
s(b, c, a) = 1. Otherwise
s(b, c, a) = χ3 (b + ωc + ω 2 a) = χ3 (ω 2 )χ3 (a + ωb + ω 2 c) 6= s(a, b, c).
So again the signature of g (a, b, c) is determined by and different from that of (a, b, c).
To prove regularity, let K be the subgroup {φu,v : u ∈ Ker(χ2 ), v ∈ Fq } of Sym(Fq )
as in Example 2.3, and let Π0 = {P10 , P20 , P30 } be the orbit 3-scheme on Fq associated
with K. Then P1 = P10 and P2 = P20 . We claim that P3 is a coarsening of P30 , i.e.,

42
each block B of P3 is a disjoint union of a collection I of blocks in P30 . Assume the
(2)
claim holds. Then for such a block B, an element y ∈ Fq , and a projection πi3 , we
have
X
|B 0 ∩ (πi3 )−1 (y)|.
|B ∩ (πi3 )−1 (y)| =
B 0 ∈I

As Π is regular, it follows that Π is also regular. So it remains to prove the claim.
0

(3)

The blocks of P30 are K-orbits. So it suffices to show that for (a, b, c) ∈ Fq and
φu,v ∈ K, the elements (a, b, c) and φu,v (a, b, c) = (ua + v, ub + v, uc + v) have the
same signature. We have
χ2 ((ua + v) − (ub + v)) = χ2 (u)χ2 (a − b) = χ2 (a − b)
2
since u ∈ (F×
q ) . Similarly χ2 ((ub + v) − (uc + v)) = χ2 (b − c) and χ2 ((uc + v) −
(ua + v)) = χ2 (c − a). Also note that F×
q is contained in the kernel of χ3 ,8 and
hence χ3 (u) = 1. Therefore

χ3 ((ua + v) + ω(ub + v) + ω 2 (uc + v))
= χ3 (u(a + ωb + ω 2 c) + v(1 + ω + ω 2 ))
= χ3 (u(a + ωb + ω 2 c))
= χ3 (a + ωb + ω 2 c)
and hence s(a, b, c) = s(ua + v, ub + v, uc + v), as desired.
Homogeneity holds since P1 = 0Fq . Next we show that Π is strongly antisymmetric
when q > 11. To prove this, it suffice to show that the projections πi2 and πi3 are
not invertible even restricted to each block. For πi2 this holds when q > 3, as shown
in the proof of Lemma 2.19. For πi3 we only need to check that the cardinalities of
blocks of P3 are greater than the cardinality q(q − 1)/2 of blocks of P2 . Let (a, b, c)
(3)
be an element of Fq and let B be the block of P3 containing it. Let (u, v, w, t)
be the signature of B. By Lemma 2.20, if u, v, w are not all equal, the cardinality
of B is (q(q − 1)/2)((q − 3)/4) > q(q − 1)/2. If u = v = w, the block B
and two other blocks, whose signatures are (u, v, w, χ3 (ω)t) and (u, v, w, χ23 (ω)t)
respectively, are permuted by 3-cycles in Sym(3), and their disjoint union has
cardinality (q(q − 1)/2)((q + 1)/4) by Lemma 2.20. So
|B| =

1 q(q − 1) q + 1
q(q − 1)
·
·
>
3
2
4
2

as desired.
8

Otherwise the intersection of F×
q with the kernel has order (q − 1)/3, which is impossible as 3
does not divide q − 1.

43
Unlike Example 2.19, the 3-schemes constructed in Example 2.4 are not orbit mschemes. In fact, we prove in Theorem 6.6 later that no strongly antisymmetric
homogeneous orbit m-schemes on S exist if |S| > 1 and m ≥ 3. It strengthens the
result in [IKS09] that no such m-schemes exist for m ≥ 4.
For m ≥ 4, there are no known examples of strongly antisymmetric homogeneous
m-schemes on S (where |S| > 1), even for general m-schemes. It is conjectured
in [IKS09] that such m-schemes do not exist for m ≥ C where C is an absolute
constant. An affirmative solution to this conjecture would imply a polynomial-time
deterministic factoring algorithm under GRH. See Theorem 6.2. Currently the best
known upper bound for m is O(log |S| + 1) [Evd94; IKS09; Gua09; Aro13]. See
Theorem 7.1.

44
Chapter 3

THE P-SCHEME ALGORITHM
In this chapter, we present a generic deterministic factoring algorithm called the
P-scheme algorithm, based on the notion of P-schemes introduced in Chapter 2.
A univariate polynomial over a finite field is said to be square-free if it has no repeated
factors, and completely reducible over Fq if it factorizes into linear factors over Fq .
For simplicity, the algorithm in this chapter assumes that the input polynomial
satisfies the following condition:
Condition 3.1. The input polynomial is defined over a prime field Fp . In addition,
it is square-free and completely reducible over Fp .
This assumption is commonly made in the literature (see, e.g., [Rón88; Evd94;
CH00; IKS09; Aro13; Aro+14]) and is justified by standard reductions [Ber70;
Yun76; Knu98]. Specifically, Berlekamp [Ber70] reduced the problem of completely factoring an arbitrary polynomial over a finite field to the problem of finding
roots of certain other polynomials in Fp . The latter problem further reduces to
the problem of completely factoring polynomials satisfying Condition 3.1 by the
technique of square-free factorization [Yun76; Knu98]. Alternatively, we develop
an algorithm that works for arbitrary polynomials over finite fields in Chapter 5
without using these reductions.
Overview of the P-scheme algorithm
The P-scheme algorithm consists of three parts:
1. reducing to the problem of computing an “ idempotent decomposition” of a
certain ring,
2. computing idempotent decompositions of rings associated with a poset of
number fields,
3. constructing the poset of number fields used in the previous part.
Now we elaborate on each part.

45
Reduction to computing an idempotent decomposition. It is well known that
computing a factorization of f is equivalent to finding zero divisors of the ring
Fp [X]/(f (X)) [Rón88; Evd94; IKS09]. We focus on special zero divisors called
idempotent elements or simply idempotents,1 i.e., those elements x satisfying x2 = x.
Two idempotents x, y are said to be orthogonal if xy = 0. It can be shown that the
problem of factoring f reduces to decomposing the unity of the ring Fp [X]/(f (X))
into a sum of nonzero mutually orthogonal idempotent elements, called an idempotent decomposition.
Definition 3.1. An idempotent decomposition of a ring R is a set I of nonzero
P
mutually orthogonal idempotent elements of R satisfying x∈I x = 1.
On the other hand, recall that our algorithm uses a lifted polynomial f˜(X) ∈ Z[X]
of f , as mentioned in the introduction. Furthermore, we may assume f˜ is an
irreducible lifted polynomial (see Definition 1.1) by running the factoring algorithm
for rational polynomials [LLL82] to factorize f˜ into the irreducible factors over
Q. See Section 3.9 for more discussion. The polynomial f˜ defines a number field
F := Q[X]/(f˜(X)). We show that, since f is square-free and completely reducible
over Fp , the ring Fp [X]/(f (X)) is naturally isomorphic to ŌF := OF /pOF , where
OF is the ring of integers of the field F . Therefore the problem reduces to that of
computing an idempotent decomposition of the ring ŌF .
Computing idempotent decompositions for a poset of number fields. Denote
by L the splitting field of f˜ over Q and G the Galois group of f˜ over Q, i.e.,
G = Gal(L/Q). Conceptually, replacing Fp [X]/(f (X)) with ŌF allows us to use
the information provided by the Galois group G. By the work of Rónyai [Rón92],
a zero divisor a 6= 0 (or, in our language, an idempotent decomposition) of ŌF
can be found efficiently if an efficiently computable nontrivial automorphism of the
ring ŌF is given. The Galois group G naturally provides automorphisms of ŌF , at
least when F is Galois over Q. Moreover, these automorphisms can be efficiently
computed thanks to the efficient polynomial factoring algorithms for number fields
[Len83; Lan85]. Using this idea, Rónyai [Rón92] gave a polynomial-time factoring
algorithm for the case that F is Galois over Q.
When F is not Galois over Q, not every automorphism in G restricts to an automorphism of F or ŌF . One of our key observations is that F may still admit a
1

Strictly speaking, we need to exclude the unity of the ring which is the only idempotent element
that is not a zero divisor.

46
L
G

H
F
NG (H)/H

NG (H)
F0

Q
Figure 3.1: The tower of fields and Galois groups. Denote by L the splitting field
of f˜ over Q and regard F as a subfield of L.
nontrivial automorphism group, from which we can compute a partial factorization
of f . Indeed, we regard F as a subfield of L and let H be the subgroup of G
fixing F . Then the automorphism group of F is isomorphic to NG (H)/H. The
corresponding fixed subfield F 0 = F NG (H)/H is the smallest subfield of F such that
F/F 0 is Galois. See Figure 3.1 for an illustration.
In the worst case, we may have NG (H) = H and then the automorphism group of
F is trivial. However, an extension K of F may still have a nontrivial automorphism group, and hence a nontrivial idempotent decomposition may be obtained
for ŌK := OK /pOK instead of ŌF , where OK is the ring of integers of K. For
example, suppose G is the symmetric group Sym(n) permuting the n roots of
f˜. We identify F with Q(α) for some root α of f˜, and then H is the stabilizer
Gα . Let β be a root of f˜ different from α. Then the automorphism group of
K = F (β) = Q(α, β) is NG (Gα,β )/Gα,β , which is nontrivial as NG (Gα,β ) contains
the permutations swapping α and β. Another example is the case that K equals the
splitting field L of f˜. In this case, the automorphism group of K is just G.
Motivated by the above observation, we design the algorithm so that it computes
idempotent decompositions not only for the number field F , but also simultaneously
for a poset of subfields of L. Moreover, we compute homomorphisms between
these fields, which induce homomorphisms between the rings ŌK . Using these
homomorphisms, we show that the idempotent decompositions can be properly
refined, unless some consistency constraints between them are satisfied.

47
The connection with P-schemes is as follows: by Galois theory, the poset of subfields
used by the algorithm corresponds to a poset P of subgroups of G. Suppose a field
K in the former poset is associated with a subgroup H. It can be shown that
an idempotent decomposition of ŌK corresponds to a partition of the coset space
H\G. These partitions for various H ∈ P altogether form a P-collection. Then the
consistency constraints between the idempotent decompositions are just the defining
properties of P-schemes in disguise, i.e. compatibility, regularity, and invariance. In
addition, we incorporate in our algorithm Rónyai’s technique [Rón92] as mentioned
above as well as its extension by Evdokimov [Evd94]. They are characterized by
antisymmetry and strongly antisymmetry of P-schemes respectively.
The main part of the algorithm has the following structure: it constructs the rings
ŌK and the homomorphisms between them, and then maintains the idempotent
decompositions of these rings and iteratively refines them. Each time it calls a
subroutine corresponding to some property of P-schemes in attempt to obtain a
refinement. Either the property is already satisfied, or strictly finer idempotent
decompositions are obtained by the subroutine. The algorithm terminates when
the decompositions cannot be properly refined any more, in which case we are
guaranteed to have a strongly antisymmetric P-scheme. This gives the following
result.
Theorem 3.1 (informal). Under GRH, there exists a deterministic algorithm that
given a poset P ] of subfields of L corresponding to a poset P of subgroups of G,
outputs idempotent decompositions of ŌK for K ∈ P ] corresponding to a strongly
antisymmetric P-scheme. The running time is polynomial in the size of the input.
Suppose F is in the poset P ] , corresponding to a group H ∈ P. Then in the
strongly antisymmetric P-scheme produced by the algorithm, the partition of H\G
translates into an idempotent decomposition of the ring ŌF . In particular, it follows
from the reduction in the first part of the algorithm that if all strongly antisymmetric
P-schemes are discrete (resp. inhomogeneous) on H, then we always obtain the
complete factorization (resp. a proper factorization) of f .
Constructing a collection of number fields. Theorem 3.1 is a generic result, as
we may feed it any poset P ] of subfields of L and get a strongly antisymmetric
P-scheme, where P is the corresponding poset of subgroups of G. To obtain an
actual factoring algorithm, we need to construct such a poset. More precisely, we
construct a collection F of number fields that are representatives of isomorphism

48
classes of those in P ] , i.e., isomorphic fields in P ] are represented by the same
element in F. The posets P and P ] are determined once F is given.
Let H be the subgroup of G fixing F . The collection F of number fields should
satisfy the following two constraints: (1) F contains the field F , so that we can
convert the partition on H\G in the P-scheme into a factorization of f , and (2)
all strongly antisymmetric P-schemes are discrete (resp. inhomogeneous) on H,
so that the algorithm always produces the complete factorization (resp. a proper
factorization) of f . In addition, we want to bound the running time spent in
constructing the fields in P ] , which controls the running time of the whole algorithm.
We give various settings of F in which the two constraints above are satisfied. One
of them is to choose F = {F, L}, where L is the splitting field of f˜. In another
setting, we choose F so that P is a system of stabilizers of depth m for sufficiently
large m ∈ N+ . They lead to factoring algorithms with various running time.
For simplicity, we only state the results that F can be constructed in certain amount
of time (see Section 3.8). The proofs are deferred to Chapter 4, where we give a
more comprehensive investigation on the problem of constructing number fields.
Summary. The actual factoring algorithm combines the three parts above in the
opposite order: we first construct a collection F of number fields which determines
the posets P and P ] . Then we run the algorithm in Theorem 3.1 to obtain a collection
of idempotent decompositions corresponding to a strongly antisymmetric P-scheme.
Finally we extract a factorization of f from the idempotent decomposition of ŌF .
This yields the main result of this chapter:
Theorem 3.2 (informal). Suppose there exists a deterministic algorithm that given
a polynomial g(X) ∈ Z[X] irreducible over Q, constructs in time T (g) a collection
F of subfields of the splitting field L of g over Q such that
• F = Q[X]/(g(X)) is in F, and
• all strongly antisymmetric P-schemes are discrete (resp. inhomogeneous) on
Gal(L/F ) ∈ P, where P is the subgroup system associated with F.
Then under GRH, there exists a deterministic algorithm that given f (X) ∈ Fp [X]
satisfying Condition 3.1 and an irreducible lifted polynomial f˜(X) ∈ Z[X] of f ,
outputs the complete factorization (resp. a proper factorization) of f over Fp in time
polynomial in T (f˜) and the size of the input.

49
We show that many results achieved by known factoring algorithms [Hua91a;
Hua91b; Rón88; Rón92; Evd94; IKS09] can be derived from Theorem 3.2. Thus
the P-scheme algorithm provides a unifying approach to polynomial factoring over
finite fields.
Outline of the chapter. Notations and mathematical preliminaries are given in
Section 3.1, and algorithmic preliminaries are given in Section 3.2. We reduce
the problem of factoring f to that of computing an idempotent decomposition of
ŌF in Section 3.3. In Section 3.4, we give the main body of the algorithm that
computes idempotent decompositions corresponding to a strongly antisymmetric
P-scheme, and use it to prove Theorem 3.1. The next three sections (Section 3.5,
3.6 and 3.7) describe three subroutines used by this algorithm. In Section 3.8 we
state some results on constructing a collection F of number fields using f˜. Finally,
in Section 3.9, we combine the results developed in the previous sections to prove
Theorem 3.2, and use it to derive the main results in [Hua91a; Hua91b; Rón88;
Rón92; Evd94; IKS09].
3.1

Preliminaries

We first review basic notations and facts in algebra. They are standard and can be
found in various textbooks, e.g., [Lan02; AM69; Mar77]. Then we discuss splitting
of prime ideals in number field extensions. Finally, for the certain rings ŌK , we
establish a one-to-one correspondence between their idempotent decompositions
and the partitions of certain right coset spaces.
All rings are assumed to be commutative rings with unity.
Ideals. Recall that a subset I of a ring R is an ideal of R if (1) I is a subgroup of
the underlying additive abelian group of R, and (2) R·I = {ra : r ∈ R, a ∈ I} ⊆ I.
For x ∈ R, denote by (x), xR or Rx the ideal {rx : r ∈ R} of R generated by x.
An ideal of R is proper if it is a proper subset of R. Let I be a proper ideal of I.
We say I is prime if I 6= R and ab ∈ I implies a ∈ I or b ∈ I for any a, b ∈ R.
And I is maximal if I 6= R and there exists no ideal I 0 of R satisfying I ( I 0 ( R.
A proper ideal I is prime (resp. maximal) iff the quotient ring R/I is an integral
domain (resp. a field). In particular, maximal ideals are prime. For an ideal I0
of R, the map I 7→ I/I0 is a one-to-one correspondence between the ideals of R
containing I0 and the ideals of R/I0 , and it preserves primality and maximality.

50
If m1 , . . . , mk and m are maximal ideals of R and i=1 mi ⊆ m, then m = mi for
T
some i ∈ [k].2 In particular, if ki=1 mi = 0, then m1 , . . . , mk are the only maximal
ideals of R.
Tk

Two ideals I, I 0 of R are coprime if I + I 0 = R. In particular, distinct maximal
ideals are always coprime. For pairwise coprime ideals I1 , . . . , Ik , it holds that
Tk
Qk
I
=
i
i=1
i=1 Ii . We also have
Lemma 3.1 (Chinese remainder theorem). Suppose I1 , . . . , Ik are pairwise coprime
ideals of R. Then the ring homomorphism
φ : R/

k
\
i=1

sending x +

Tk

i=1 Ii

Ii →

k
Y

R/Ii

i=1

to (x + I1 , . . . , x + Ik ) is an isomorphism.

Semisimple rings. A (commutative) ring is semisimple if it is isomorphic to a finite
product of fields. The following lemma provides a characterization of semisimple
rings.
Lemma 3.2. A ring R is semisimple iff it has finitely many maximal ideals m1 , . . . ,
Q
T
mk and ki=1 mi = 0, in which case R is isomorphic to ki=1 R/mi via the map
x 7→ (x + m1 , . . . , x + mk ).
Qk
Proof. Suppose R ∼
= i=1 Fi is semisimple where each Fi is a field. For i ∈ [k],
let πi : R → Fi be the ith projection and mi be its kernel. Then R/mi ∼
= Fi
Tk
and hence each mi is a maximal ideal of R. Moreover we have i=1 mi = 0 and
hence m1 , . . . , mk are the only maximal ideals. Conversely, suppose R has finitely
T
many maximal ideals m1 , . . . , mk and ki=1 mi = 0. Then by the Chinese remainder
Q
theorem, the map R → ki=1 R/mi sending x ∈ R to (x + m1 , . . . , x + mk ) is a ring
isomorphism. Each direct factor R/mi is a field, and hence R is semisimple.
The semisimple rings considered in this chapter are all semisimple Fp -algebras, i.e.
semisimple rings that are also Fp -algebras.
Idempotent elements. An element x of a ring is an idempotent element (or just an
idempotent) if x2 = x. Two idempotents x, y are orthogonal if xy = 0. A nonzero
idempotent x is primitive if it cannot be written as a sum of two nonzero orthogonal
2

See [AM69, Proposition 1.11] for a more general statement for prime ideals.

51
idempotents. As already stated in Definition 3.1, an idempotent decomposition of
a ring R is a set I of nonzero mutually orthogonal idempotents of R satisfying
P
x∈I x = 1. We say such an idempotent decomposition is proper if |I| > 1 and
complete if all idempotents in I are primitive.
Lemma 3.3. Let R be a semisimple ring. For every maximal ideal m of R, there
exists a unique primitive idempotent δm ∈ R satisfying δm ≡ 1 (mod m) and δm ≡ 0
(mod m0 ) for all maximal ideals m0 6= m. Two elements δm and δm0 are orthogonal
iff m 6= m0 . Furthermore
• the map m 7→ δm is a one-to-one correspondence between the maximal ideals
of R and the primitive idempotents of R, and
P
• the map B 7→ m∈B δm is a one-to-one correspondence between the sets of
maximal ideals of R and the idempotents of R.
Q
Proof. This is clear from the isomorphism R ∼
= m∈S R/m, where S denotes the
set of all the maximal ideals of R.
We also need the following lemma.
Lemma 3.4. Suppose φ : R0 → R is a ring homomorphism between two semisimple
rings R, R0 . Let δ, δ 0 be idempotents of R and R0 respectively satisfying φ(δ 0 )δ = δ.
Then φ induces a ring homomorphism from R0 /(1 − δ 0 ) to R/(1 − δ) sending
x + (1 − δ 0 ) to φ(x) + (1 − δ) for x ∈ R0 .
Proof. It suffices to show that φ(1 − δ 0 ) is in the ideal (1 − δ) of R, which holds
since (1 − φ(δ 0 ))(1 − δ) = 1 − φ(δ 0 ) − δ + φ(δ 0 )δ = 1 − φ(δ 0 ) = φ(1 − δ 0 ).
Finitely generated modules and free modules. A subset S of an R-module M
P
generates M if x∈S Rx = M . And M is finitely generated if it is generated by
a finite subset S. A basis of M over R, or an R-basis of M , is a subset S ⊆ M
P
generating M for which the sum M = x∈S Rx is a direct sum. We say M is free
(over R) if it admits an R-basis. The rank of a finitely generated free module over R
is the cardinality of any R-basis of it, which is finite and independent of the choice
of the basis.

52
Number fields. Elements in the algebraic closure Q̄ of Q are called algebraic
numbers. An algebraic number is integral or an algebraic integer if it is a root of a
monic polynomial in Z[X]. The set of algebraic integers is a subring of Q̄, denoted
by A. A number field is a finite degree field extension of Q in Q̄. For a number field
K, the subring OK := A ∩ K is called the ring of integers of K. It is embedded in
the Q-vector space K as a lattice of rank [K : Q].
Suppose K/K0 is a number field extension. We say α ∈ K is a primitive element
of K over K0 if K = K0 (α). Primitive elements always exist for any number field
extension by the primitive element theorem.
Galois theory. Let K/K0 be a field extension. The set of automorphisms of K
fixing K0 is a group, called the automorphism group of K over K0 , and is denoted
by Aut(K/K0 ). We say K is Galois over K0 if |Aut(K/K0 )| = [K : K0 ], in
which case Aut(K/K0 ) is also called the Galois group of K over K0 and denoted
by Gal(K/K0 ).
Theorem 3.3 (fundamental theorem of Galois theory). Let K/K0 be a Galois
extension. Then for any intermediate field K0 ⊆ E ⊆ K, the extension K/E is also a
Galois extension. Furthermore, the map E 7→ Gal(K/E) is an inclusion-reversing
one-to-one correspondence between the poset of intermediate fields K0 ⊆ E ⊆ K
and the poset of subgroups of Gal(K/K0 ), with the inverse map H 7→ K H .
Given a Galois extension K/K0 , two subfields E, E 0 between K and K0 are conjugate over K0 if there exists an isomorphism τ0 : E → E 0 fixing K0 . Such an
isomorphism always extends to an automorphism τ ∈ Gal(K/K0 ) of K. The
corresponding Galois groups Gal(K/E) and Gal(K/E 0 ) satisfy Gal(K/E 0 ) =
τ Gal(K/E)τ −1 . So conjugate subfields of K over K0 correspond to conjugate
subgroups in Gal(K/K0 ).
Now we restrict to number field extensions. Let K/K0 be a number field extension.
There exists a unique minimal number field that contains K and is Galois over K0 ,
called the Galois closure of K/K0 . For a polynomial f (X) ∈ K0 [X] with roots
α1 , . . . , αk ∈ Q̄, the number field K 0 = K0 (α1 , . . . , αk ) is called the splitting field
of f over K0 and is Galois over K0 . We also write Gal(f /K0 ) for the corresponding
Galois group Gal(K 0 /K0 ), called the Galois group of f over K0 . If f is the minimal
polynomial of a primitive element of K over K0 , the splitting field of f over K0 is
exactly the Galois closure of K/K0 .

53
Suppose K/K0 is a Galois extension with the Galois group G. If x ∈ K is an
algebraic integer, so is g x for any g ∈ G since Z ⊆ K0 is fixed by G. So the action
of G on K restricts to an action on OK .
Splitting of prime ideals. The ring of integers of a number field is an example of
a Dedekind domain [AM69; Mar77]. An ideal of a Dedekind domain is a nonzero
prime ideal iff it is a maximal ideal, and hence these two notions are interchangeable.
By convention, we use the notion of (nonzero) prime ideals instead of maximal
ideals.
Let K be a number field. It follows from the theory of Dedekind domains [Mar77]
that the ideal pOK of OK splits uniquely (up to the ordering) into a product of prime
ideals of OK :
k
Y
pOK =
Pi .
i=1

For i ∈ [k], the quotient ring OK /Pi is a finite field extension of degree di ∈ N+
P
over Fp , and ki=1 di = [K : Q]. We say P1 , . . . , Pk are the prime ideals of OK
lying over p. If P1 . . . , Pk are distinct and OK /Pi ∼
= Fp for all i ∈ [k] (and hence
k = [K : Q]), we say p splits completely in K. It is known that if p splits completely
in K, then it also splits completely in any subfield of the Galois closure of K/Q.
See, e.g., [Mar77, Chapter 4]. We also need the following result that identifies the
set of prime ideals lying over p with a right coset space in the case that p splits
completely in a Galois extension containing K.
Theorem 3.4. Let L be a Galois extension of Q such that p splits completely in L,
and let G = Gal(L/Q). Fix a prime ideal Q0 of OL lying over p. For any subgroup
H ⊆ G and the corresponding fixed subfield K = LH , the map Hg 7→ g Q0 ∩ OK is
a one-to-one correspondence between the right cosets in H\G and the prime ideals
of OK lying over p.3
See, e.g., [Mar77, Theorem 33]. As the prime ideals of OK lying over p are
exactly those containing pOK , we get the following correspondence by passing to
the quotient ring ŌK := OK /pOK .
Corollary 3.1. Let L, G, Q0 be as in Theorem 3.4. For any subgroup H ⊆ G and
the corresponding fixed subfield K = LH , the map Hg 7→ (g Q0 ∩ OK )/pOK is
3

Note that this map is well defined: for another representative hg ∈ G of Hg where h ∈ H, we
h
have hg Q0 ∩ OK = (g Q0 ∩ OK ) = g Q0 ∩ OK since OK is fixed by H.

54
a one-to-one correspondence between the right cosets in H\G and the prime (and
maximal) ideals of ŌK .
Idempotent decompositions vs. partitions of a right coset space. Suppose p
splits completely into a product of prime ideals P1 , . . . , Pk in a number field K.
Then P1 /pOK , . . . , Pk /pOK are the prime (and maximal) ideals of ŌK . As the
intersection of these ideals equals pOK /pOK = 0, the ring ŌK is semisimple by
Lemma 3.2. The prime ideals Pi /pOK correspond to the primitive idempotents of
ŌK by Lemma 3.3 and also to the cosets in a right coset space by Corollary 3.1. We
combine them and establish a correspondence between the idempotent decompositions of ŌK and the partitions of a certain right coset space.
For a number field extension L/K, the inclusion OK ,→ OL induces a map
iK,L : ŌK → ŌL
with the kernel (pOL ∩ OK )/pOK . As pOL ∩ OK = pOK ,4 this map is injective,
which identifies ŌK with a subring of ŌL . Also note that if L/Q is a Galois
extension with the Galois group G, the action of G on OL induces an action
on ŌL and permutes the maximal ideals of ŌL . These observations are used in
Definition 3.2 below.
Fix the following notations: let L be a Galois extension of Q with Gal(L/Q) = G
and suppose p splits completely in L. For a nonzero prime ideal Q of OL lying
over p, define Q̄ := Q/pOL which is a prime (and hence maximal) ideal of ŌL , and
let δQ̄ be the primitive idempotent of ŌL satisfying δQ̄ ≡ 1 (mod Q̄) and δQ̄ ≡ 0
(mod Q̄0 ) for all maximal ideals Q̄0 6= Q̄ of ŌL (cf. Lemma 3.3).
Definition 3.2. Suppose H is a subgroup of G and K = LH . Fix a prime ideal Q0
of OL lying over p. Then
• for an idempotent decomposition I of ŌK , define P (I) to be the partition of
−1
H\G such that Hg, Hg 0 ∈ H\G are in the same block iff g (iK,L (δ)) ≡
g 0−1
(iK,L (δ)) (mod Q̄0 ) holds for all δ ∈ I, and
• for a partition P of H\G, define I(P ) to be the
Pidempotent decomposition

g
−1
of ŌK consisting of the idempotents δB := iK,L
g∈G:Hg∈B δQ̄0 , where B
ranges over the blocks in P .5
4

To see this, note that if x ∈ pOL ∩ OK , then x/p ∈ OL ∩ K = OK .
P
We show in the proof of Lemma 3.5 that g∈G:Hg∈B g δQ̄0 does lie in the image of iK,L , and
hence δB is well defined.
5

55
We have the following lemma, whose proof is routine and can be found in Appendix B.
Lemma 3.5. The partitions P (I) and the idempotent decompositions I(P ) are well
defined. And for any idempotent decomposition I of ŌK , the idempotents δ ∈ I
correspond one-to-one to the blocks of P (I) via the map δ 7→ Bδ := {Hg ∈ H\G :
g −1
(iK,L (δ)) ≡ 1 (mod Q̄0 )} with the inverse map B 7→ δB .
Now we are ready to establish the following correspondence.
Lemma 3.6. The map I 7→ P (I) is a one-to-one correspondence between the
idempotent decompositions of ŌK and the partitions of H\G, with the inverse map
P 7→ I(P ).
Proof. Note I(P ) = {δB : B ∈ P } by definition and P (I) = {Bδ : δ ∈ I} by
Lemma 3.5. So I = I(P (I)) by Lemma 3.5. Also note the map B 7→ δB is
injective, and hence the map P 7→ I(P ) is also injective. So P = I(P (I)).
3.2

Algorithmic preliminaries

In this section, we present some basic procedures used in the factoring algorithm,
mostly related to number fields. Standard references include [Len92; Coh93].
Let A be an R-algebra that is a free R-module of finite rank. In the factoring
algorithm, we represent such an algebra by maintaining an R-basis B = {b1 , . . . , bd }
of it. The structure constants of A in the basis B are the constants cijk ∈ R defined by
P
bi bj = dk=1 cijk bk . Given these structure constants, arithmetic operations of A can
be performed in polynomial time, provided that the those of R can also be performed
in polynomial time. In the discussion below, we use the phrase “computing A” for
the task of computing the structure constants of A in the R-basis B associated with
A. And by “computing a” for a ∈ A we mean computing the constants ci ∈ R
P
satisfying a = di=1 ci bi . The interesting cases of R to us are Z, Q, and Fp .
Now let R0 be an R-algebra and let A0 be an R0 -algebra that is a free R0 -module of
finite rank. Let φ : A → A0 be an R-linear map. We use the phrase “computing
φ” for the task of computing φ(bi ) ∈ A0 for all bi ∈ B, in terms of the coefficients
of φ(bi ) in the R0 -basis B 0 associated with A0 . The interesting cases to us are (1)
R = R0 ∈ {Z, Q, Fp }, (2) R = Z, R0 = Q and φ is an inclusion that embeds a
lattice in a vector space over Q, and (3) R = Z, R0 = Z/pZ ∼
= Fp , and φ is a
quotient map from a lattice to a vector space over Fp .

56
The size of an object used in the algorithm is the number of bits used to encode this
object.
Encoding a number field. Let K be a number field of degree d ∈ N+ over Q. We
encode K using a primitive element α ∈ K over Q, or more precisely, the minimal
polynomial g(X) ∈ Q[X] of α over Q. Given g(X), we compute Q[X]/(g(X))
in the standard Q-basis {1 + (g(X)), X + (g(X)), . . . , X d−1 + (g(X))} and use it
to represent K. This is justified by the isomorphism Q[X]/(g(X)) ∼
= K sending
X + (g(X)) to α.
Computing ŌK . Given K and a prime number p, we want to compute the Fp algebra ŌK = OK /pOK . It is natural to first compute the ring of integers OK and
then pass to the quotient ring ŌK . Unfortunately, computing a Z-basis of OK in K
is in general as hard as finding the largest square factor of a given integer [Chi89;
0
Len92]. We overcome the difficulty by working with a subring OK
⊆ OK instead
0
of OK such that [OK : OK ] is finite and coprime to p. Such a subring is called a
p-maximal order of K, which can be efficiently computed:
Theorem 3.5. There exists a polynomial-time algorithm that given K and p, com0
0
putes a p-maximal order OK
of K together with the inclusion OK
,→ K.
0
in place of OK thanks to the
See, e.g., [Coh93, Chapter 6]. We may use OK
following lemma.
0
0
0
Lemma 3.7. For a p-maximal order OK
of K, the ring homomorphism OK
/pOK
→
0
OK /pOK = ŌK induced from the inclusion OK ,→ OK is an isomorphism.
0
Proof. To show surjectivity, it suffices to show that OK
and pOK span OK over Z.
0
Note that n1 := [OK : OK ] is coprime to p and n2 := [OK : pOK ] is a power of p.
0
The index of the lattice spanned by OK
and pOK in OK divides both n1 and n2 and
hence equals one, as desired.
0
On the other hand, note that OK and OK
are both lattices of rank [K : Q]. So ŌK
0
0
and OK /pOK are both vector spaces of dimension [K : Q] over Fp . Therefore the
0
0
map OK
/pOK
→ ŌK is an isomorphism.

This provides a method of computing the Fp -algebra ŌK :

57
Lemma 3.8. There exists a polynomial-time algorithm ComputeQuotientRing that
0
given K and p, computes the quotient ring ŌK , a p-maximal order OK
, the inclusion
0
0
0
OK ,→ K, and the quotient map π : OK → ŌK sending x ∈ OK to x + pOK .
0
0
Proof. Compute OK
and the inclusion OK
,→ K using Theorem 3.5. In particular
0
the structure constants cijk ∈ Z of OK in some Z-basis {b1 , . . . , bd } are computed,
0
0
where d = [K : Q]. The structure constants of OK
/pOK
in the Fp -basis {b1 +
0
0
pOK , . . . , bd + pOK } are simply cijk mod p. By Lemma 3.7, they are also the
structure constants of ŌK in the Fp -basis {b1 + pOK , . . . , bd + pOK }. The map π
is specified by the data π(bi ) = bi + pOK .
0
Note that in addition to ŌK , we also compute the auxiliary data of OK
and the
0
to ŌK and K. They are used for the algorithms in Lemma 3.9 and
maps from OK
Lemma 3.11 below.

Computing the residue of an algebraic integer modulo p. We need an algorithm
computing the image of an algebraic integer α ∈ OK in ŌK , where α is given as an
element of K.
Lemma 3.9. There exists a polynomial-time algorithm ComputeResidue that takes
the following data as the input
• a number fields K, a prime number p, and α ∈ OK given as an element of K,
• the outputs of ComputeQuotientRing (see Lemma 3.8) on the inputs (K, p),
0
0
i.e., the quotient ring ŌK , a maximal p-orders OK
, the inclusion OK
,→ K,
0
and the quotient map OK
→ ŌK ,
and computes α + pOK ∈ ŌK .
The proof of Lemma 3.9 can be found in Appendix B.
Computing embeddings of number fields. Embeddings of a number field in
another can be computed efficiently, thanks to the polynomial-time factoring algorithms for number fields [Len83; Lan85].
Theorem 3.6 ([Len83; Lan85]). There exists a polynomial-time algorithm that given
a number field K and a polynomial g(X) ∈ K[X], factorizes g(X) into irreducible
factors over K.

58
Let K, K 0 be number fields and suppose K is encoded with a primitive element
α ∈ K whose minimal polynomial is g(X) ∈ Q[X]. Each embedding φ of K in
K 0 is determined by the image φ(α) ∈ K 0 which is a root of g(X). These roots can
be enumerated by factoring g(X) over K 0 using Theorem 3.6. So we have:
Lemma 3.10. There exists a polynomial-time algorithm ComputeEmbeddings that
given number fields K and K 0 , computes all the embeddings of K in K 0 .
Computing induced ring homomorphisms between ŌK . Let φ : K ,→ K 0 be an
embedding of number fields, which restricts to an inclusion OK ,→ OK 0 . By passing
to the quotient rings ŌK and ŌK 0 , we obtain a ring homomorphism φ̄ : ŌK → ŌK 0 .
And we say the map φ̄ is induced from φ. The following lemma states that φ̄ can be
efficiently computed from φ and some auxiliary data.
Lemma 3.11. There exists a polynomial-time algorithm ComputeRingHom that
takes the following data as the input
• number fields K, K 0 , an embedding φ : K → K 0 , and a prime number p,
• the outputs of ComputeQuotientRing (see Lemma 3.8) on the inputs (K, p)
and (K 0 , p) respectively,6
and computes the ring homomorphism φ̄ : ŌK → ŌK 0 induced from φ.
The proof of Lemma 3.11 can be found in Appendix B.
Reduction to computing an idempotent decomposition of ŌF

3.3

Now we start describing the P-scheme algorithm. Fix the following notations in the
remaining sections:
• f (X): the input polynomial in Fp [X] to be factorized, which is square-free
and completely reducible over Fp ,
• f˜(X): an irreducible lifted polynomial of f (X) in Z[X],
• F : the number field Q[X]/(f˜(X)),
• L: the splitting field of f˜ over Q,
6
0
OK
0

0
0
0
That is, the quotient rings ŌK , ŌK 0 , the maximal p-orders OK
, OK
0 , the inclusions OK ,→ K,
0
0
,→ K 0 , and the quotient maps OK
→ ŌK , OK
0 → ŌK 0 .

59
• G: the Galois group Gal(L/Q) = Gal(f˜/Q),
• Q0 : a fixed prime ideal of OL lying over p.
In this section, we reduce the problem of factoring f to that of computing an
idempotent decomposition of ŌF . For simplicity, we first assume that f˜ is a monic
polynomial, and then remove the assumption at the end of this section.
Ring isomorphism between Fp [X]/(f (X)) and ŌK . Let α := X + (f˜(X)) ∈ F
which is a root of f˜. As f˜(X) ∈ Z[X] is monic, we know α ∈ OF . Define the ring
homomorphism τ̃ : Fp [X] → ŌF by letting τ̃ (X) = α+pOF , which is well defined
since ŌF is an Fp -algebra. Moreover, we have τ̃ (f (X)) = f˜(α) + pOF = 0. So τ̃
induces a ring homomorphism τ : Fp [X]/(f (X)) → ŌK sending X + (f (X)) to
α + pOF .
Let f1 , . . . , fn be the monic irreducible factors of f over Fp . As fi are irreducible
and distinct, the ring Fp [X]/(f (X)) is semisimple with the maximal ideals (fi (X)),
i = 1, . . . , n. Then ŌF is also semisimple. Indeed, we have the following lemma:
Lemma 3.12. The map τ : Fp [X]/(f (X)) → ŌF is a ring isomorphism, and p
splits completely in F .
Proof. The second claim follows from the first since Fp [X]/(f (X)) has n distinct maximal ideals. To prove the first claim, note that the ring homomorphism
Fp [X]/(f (X)) → Z[α]/pZ[α] sending X to α + pZ[α] is an isomorphism. So it
suffices to show that the natural inclusion Z[α] ,→ OF induces an isomorphism
Z[α]/pZ[α] → ŌF .
For i ∈ [n], choose f˜i (X) ∈ Z[X] that lifts the factor fi (X) ∈ Fp [X] of f ,
and define the ideal Pi of Z[α] to be the one generated by f˜i (α) and p. As
Tn
Z[α]/pZ[α] ∼
= Fp [X]/(f (X)) is semisimple, we have i=1 Pi = pZ[α]. By
[AM69, Theorem 5.10], for each i ∈ [n], we may choose a prime ideal Qi of
OF lying over p such that Qi ∩ Z[α] = Pi . Then we have
!
n
n
\
\
pOF ∩ Z[α] ⊆
Qi ∩ Z[α] =
Pi = pZ[α].
i=1

i=1

So the map Z[α]/pZ[α] → ŌF is injective. It is in fact an isomorphism since
Z[α]/pZ[α] and ŌF are both vector spaces of dimension n over Fp .

60
Extracting a factorization from an idempotent decomposition. Let IF be an
idempotent decomposition of ŌF . By Lemma 3.12, the set τ −1 (IF ) = {τ −1 (δ) :
δ ∈ IF } is an idempotent decomposition of Fp [X]/(f (X)). Given δ ∈ IF , we can
extract a factor gδ (X) of f (X) by
gδ (X) := gcd(f (X), hδ (X)),
where hδ (X) ∈ Fp [X] is a nonzero polynomial of degree at most n lifting 1 −
τ −1 (δ) ∈ Fp [X]/(f (X)). The factor gδ (X) is the product of the monic irreducible
factors fi (X) satisfying τ −1 (δ) ≡ 1 (mod fi (X)). As f (X) = f˜(X) mod p is
monic and the elements τ −1 (δ) form an idempotent decomposition of the ring
Fp [X]/(f (X)), we have the equality
Y
f (X) =
gδ (X).
δ∈I

This gives the following algorithm that computes a factorization of f from IF :
Algorithm 1 ExtractFactors
Input: p, f , f˜, F , ŌF , idempotent decomposition IF of ŌF ,
p-maximal order OF0 of F and maps OF0 ,→ F , OF0 → ŌF
Output: factorization of f
1: α ← X + (f˜(X)) ∈ F
2: call ComputeResidue to compute α + pOF ∈ ŌF
3: compute the ring homomorphism τ : Fp [X]/(f (X)) → ŌF sending X +
(f (X)) to α + pOF
4: for δ ∈ IF do
5:
compute nonzero hδ (X) ∈ Fp [X] of degree at most n lifting 1 − τ −1 (δ)
6:
gδ (X) ← gcd(f (X), hδ (X))
Q
7: return the factorization f (X) = δ∈IF gδ (X)
For the purpose of computing the map τ , the input contains some auxiliary data
(e.g., a p-maximal order OF0 and the related maps) other than the idempotent decomposition IF . For now we note that the auxiliary data can be prepared in polynomial
time using the subroutines in Section 3.2. Then we have:
Theorem 3.7. The algorithm ExtractFactors computes the factorization f (X) =
Q
δ∈IF gδ (X) in polynomial time. In particular, it computes the complete factorization (resp. a proper factorization) of f (X) in polynomial time iff the idempotent
decomposition IF of ŌF is complete (resp. proper).

61
Proof. The algorithm clearly runs in polynomial time: Line 1 is implemented by
factoring f˜ over F using Theorem 3.6. The loop in Lines 4–6 iterates |IF | ≤ n times.
Line 5 is implemented by solving a system of linear equations over Fp and Line 6 by
the Euclidean algorithm. The fact that the factorization is complete (resp. proper)
iff IF is complete (resp. proper) follows from the fact that τ : Fp [X]/(f (X)) → ŌF
is a ring isomorphism.
Therefore the problem of computing the complete factorization (resp. a proper)
factorization of f reduces to the problem of computing the complete (resp. a
proper) idempotent decomposition of ŌF .
The reduction for non-monic polynomials. After a slight change, the above
reduction also works for a possibly non-monic polynomial f˜. We explain it now.
Suppose c ∈ Z − {0} is the leading coefficient of f˜. Its residue c̄ := c mod p ∈ Fp
is nonzero since deg(f˜) = deg(f ) = n. Define f˜0 (X) := cn−1 · f˜(X/c) ∈ Z[X]
and f 0 (X) := f˜(X) mod p ∈ Fp [X]. The polynomials f˜0 and f 0 are monic, and
f 0 (X) = c̄n−1 · f (X/c̄). Let α be a root of f˜ in F as before. Then α0 := cα is a root
of f˜0 and hence is in OF .
Run the algorithm ExtractFactors above except that f , f˜ and α are replaced with
Q
g 0 (X)
f 0 , f˜0 and α0 respectively. Then we obtain a factorization f 0 (X) =
δ∈IF

where the factors
factorization

gδ0 (X)

δ

∈ Fp [X] are monic. Substituting X with c̄X, we obtain a
Y

f (X) = c̄ ·

gδ (X)

δ∈IF
0

with the monic factors gδ (X) := c̄− deg(gδ ) · gδ0 (c̄X) ∈ Fp [X]. Theorem 3.7 then
holds for f and f˜.
3.4

Main algorithm

We present the main body of the P-scheme algorithm in this section. Its input
contains a collection of number fields that are isomorphic to subfields of L. In
order to avoid duplicate data, we assume that these number fields are mutually
non-isomorphic. This is formalized by the following definition:
Definition 3.3 ((Q, g)-subfield system). Let g(X) be a polynomial in Q[X] with the
splitting field L(g) over Q. Let F be a collection of number fields such that (1) the
fields in F are mutually non-isomorphic, and (2) each field K 0 ∈ F is isomorphic
to a subfield of L(g). We say F is a (Q, g)-subfield system.

62
Given a (Q, g)-subfield system, we define a subgroup system over Gal(g/Q) as
follows.
Definition 3.4. Let g(X) be a polynomial in Q[X] with the splitting field L(g) over
Q. Let F be a (Q, g)-subfield system. Define P ] to be the poset of subfields of L(g)
that includes all the fields isomorphic to those in F:
P ] := {K 0 ⊆ L(g) : K 0 ∼
= K for some K ∈ F}.
By Galois theory, it corresponds to a poset P of subgroups of Gal(g/Q), given by

P := H ⊆ Gal(g/Q) : (L(g))H ∈ P ]
which is closed under conjugation in Gal(g/Q), and hence is a subgroup system
over Gal(g/Q). We say P and P ] are associated with F.
The pseudocode of the algorithm is given in Algorithm 2 below. Its input is the
prime number p and a (Q, f˜)-subfield system F. We fix P to be the subgroup
system over G = Gal(f˜/Q) associated with F.
The algorithm outputs, for every K ∈ F, the ring ŌK and an idempotent decom0
and
position IK of ŌK , together with the auxiliary data of a p-maximal order OK
0
0
the related maps OK ,→ K, OK → ŌK . We will see below that the idempotent
decompositions IK altogether determine a P-collection, which is guaranteed to be
a strongly antisymmetric P-scheme when the algorithm terminates.
The first half (Lines 1–7) of the algorithm is the preprocessing stage, where we
compute ŌK for K ∈ F and the ring homomorphisms between them that are induced
from the field embeddings. For each K ∈ F, we also initialize the idempotent
decomposition IK of ŌK to be the trivial one containing only the unity of ŌK .
The second half (Lines 8–12) is the “refining” stage. To understand it, we need to
associate a P-collection C with the idempotent decompositions IK . By Lemma 3.12,
we know p splits completely in F . So it also splits completely in every subfield of
L. In particular, for a field K in P ] or F, the quotient ring ŌK is semisimple.
For each H ∈ P, we define a partition CH of the coset space H\G as follows: Let
K be the unique field in F isomorphic to LH . Fix an isomorphism τH : K → LH ,
which induces a ring isomorphism τ̄H : ŌK → ŌLH . Define IH := τ̄H (IK ), which
is an idempotent decomposition of ŌLH . By Definition 3.2, it corresponds to a

63
Algorithm 2 ComputePscheme
Input: prime number p, (Q, f˜)-subfield system F
Output: for each K ∈ F: ŌK , idempotent decomposition IK of ŌK ,
0
0
0
p-maximal order OK
of K and maps OK
,→ K, OK
→ ŌK
1:

for K ∈ F do
0
2:
call ComputeQuotientRing to compute ŌF , a p-maximal order OK
of K
0
0
and maps OK
,→ K, OK
→ ŌK
IK ← {1}, where 1 denotes the unity of ŌK

3:

for (K, K 0 ) ∈ F 2 do
5:
call ComputeEmbeddings to compute all the embeddings from K to K 0
6:
for embedding φ : K ,→ K 0 do
7:
call ComputeRingHom to compute φ̄ : ŌK → ŌK 0 induced from φ
4:

8:
9:
10:
11:
12:
13:

repeat
call CompatibilityAndInvarianceTest
call RegularityTest
call StrongAntisymmetryTest
until IK remains the same in the last iteration for all K ∈ F
0
0
0
→ ŌK for K ∈ F
,→ K, OK
and the maps OK
return ŌK , IK , OK

partition P (IH ) of H\G.7 And we define
CH := P (IH ).
Finally, define the P-collection C by
C := {CH : H ∈ P}.

We call several subroutines to update IK in Lines 9–11, whose effects can be
understood in terms of C:
Lemma 3.13. There exists a subroutine CompatibilityAndInvarianceTest that
updates IK in time polynomial in log p and the size of F so that the partitions
CH ∈ C are refined, and at least one partition CH is properly refined if C is not
compatible or invariant.
7

Definition 3.2 is made with respect to a fixed prime ideal Q0 of OL lying over p. This ideal is
chosen at the beginning of Section 3.3.

64
Lemma 3.14. There exists a subroutine RegularityTest that updates IK in time
polynomial in log p and the size of F so that the partitions CH ∈ C are refined, and
at least one partition CH is properly refined if C is compatible but not regular.
Lemma 3.15. Under GRH, there exists a subroutine StrongAntisymmetryTest
that updates IK in time polynomial in log p and the size of F so that the partitions
CH ∈ C are refined, and at least one partition CH is properly refined if C is a
P-scheme, but not strongly antisymmetric.
We will describe these subroutines and prove the lemmas above in the next three
sections. For now we just assume them and prove the main result of this section:
Theorem 3.8 (Theorem 3.1 restated). Under GRH, the algorithm ComputePscheme
runs in time polynomial in the size of the input, and when it terminates, the Pcollection C is a strongly antisymmetric P-scheme.
Proof. We first analyze the running time. As each field K ∈ F is encoded by a
P
rational polynomial of degree [K : Q], the total degree N := K∈F [K : Q] is
bounded by the size of F. The loops in Lines 1–3 and Lines 4–7 iterate |F| ≤ N
and |F 2 | ≤ N 2 times respectively. For each (K, K 0 ) ∈ F 2 , there are at most [K : Q]
embeddings from K to K 0 , and hence the inner loop in Lines 6–7 iterates at most
[K : Q] times for each fixed (K, K 0 ).
For the loop in Lines 8–12, we consider K ∈ F and pick H ∈ P so that LH is
isomorphic to K. By Lemma 3.5, the number of idempotents in IK equals the
number of blocks in CH , and this number increases every time IK is changed by the
subroutines. On the other hand, the number of idempotents in IK is at most [K : Q].
So the loop in Lines 8–12 iterates O(N ) times. The claim about the running time
easily follows.
Finally, note that the algorithm exits the loop in Lines 8–12 after an iteration iff all
of the idempotent decompositions IK remain the same in that iteration, in which
case C is already a strongly antisymmetric P-scheme by Lemma 3.13, Lemma 3.14
and Lemma 3.15.
Remark. The input of the the algorithm contains F whose size may be much greater
than that of f and f˜. Therefore, the polynomiality of this algorithm in the size of
its input does not imply that polynomial factoring over finite fields can be solved in

65
(deterministic) polynomial time. It does suggest, however, that the total degree of
the fields in F over Q is the bottleneck of our factoring algorithm.
3.5

Compatibility and invariance test

The subroutine CompatibilityAndInvarianceTest is given in Algorithm 3. It
has the effect of properly refining at least one partition in C, unless C is compatible
and invariant.
Algorithm 3 CompatibilityAndInvarianceTest
1:
2:
3:
4:
5:
6:

for (K, K 0 ) ∈ F 2 and embedding φ : K 0 ,→ K do
for (δ, δ 0 ) ∈ IK × IK 0 do
if φ̄(δ 0 )δ 6∈ {0, δ} then
. φ̄ : ŌK 0 → ŌK is induced from φ
IK ← IK − {δ}
IK ← IK ∪ {φ̄(δ 0 )δ, (1 − φ̄(δ 0 ))δ}
return

This subroutine attempts to find a ring homomorphisms φ̄ : ŌK 0 → ŌK (induced
from a field embedding φ : K 0 → K) and idempotents δ ∈ IK , δ 0 ∈ IK 0 such that
φ̄(δ 0 )δ equals neither δ nor zero. If such δ, δ 0 , and φ̄ are found, the subroutine updates
IK by replacing δ ∈ IK with two new idempotents φ̄(δ 0 )δ and (1 − φ̄(δ 0 ))δ, neither
of which is zero. It has the effect of splitting each block Bτ̄H (δ) ∈ CH = P (IH )
corresponding to τ̄H (δ) ∈ IH (see Lemma 3.5) into two blocks, where H ranges
over the subgroups in P satisfying LH ∼
= K. After the update, the subroutine halts.
Now we prove Lemma 3.13 as promised before.
Proof of Lemma 3.13. Polynomiality of the running time is straightforward. To
prove the rest of the claim, we assume that no proper refinement is made, i.e. for
all K, K 0 ∈ F, δ ∈ IK , δ 0 ∈ IK 0 and field embeddings φ : K 0 ,→ K, we have
φ̄(δ 0 )δ ∈ {0, δ}. Then we show that C is compatible and invariant.
For H ∈ P, the isomorphism τH identifies LH ∈ P with a field K ∈ F. So the
condition above can be reformulated as follows: for all H, H 0 ∈ P, δ ∈ IH , δ 0 ∈ IH 0
0
and field embeddings φ : LH ,→ LH , we have φ̄(δ 0 )δ ∈ {0, δ}.
Now consider H, H 0 ∈ P satisfying H ⊆ H 0 and elements Hg, Hg 0 ∈ H\G in
the same block B ∈ CH = P (IH ). We want to show that πH,H 0 (Hg) = H 0 g and
πH,H 0 (Hg 0 ) = H 0 g 0 are in the same block of CH 0 . By Lemma 3.5, there exists an

66
idempotent δ ∈ IH for which
−1

B = {Hh ∈ H\G : h (iLH ,L (δ)) ≡ 1

(mod Q̄0 )}

(3.1)

holds, where iLH ,L : ŌLH ,→ ŌL is induced from the natural inclusion LH ,→ L.
P
0
Choose φ to be the natural inclusion LH ,→ LH . As δ = δ0 ∈IH 0 φ̄(δ 0 )δ, there
exists an idempotent δ 0 ∈ IH 0 such that φ̄(δ 0 )δ 6= 0. By assumption, we have
φ̄(δ 0 )δ = δ. Again by Lemma 3.5, the set B 0 given by
B 0 = {H 0 h ∈ H 0 \G :

h−1

(iLH 0 ,L (δ 0 )) ≡ 1

(mod Q̄0 )}

(3.2)

is a block of CH 0 = P (IH 0 ). We claim that H 0 g, H 0 g 0 ∈ B 0 . To see this, note that as
Hg ∈ B , we have
g −1

−1

(iLH ,L (φ̄(δ 0 )δ)) = g (iLH ,L (δ)) ≡ 1

(mod Q̄0 ).

(3.3)

g −1

It implies
(iLH ,L (φ̄(δ 0 ))) ≡ 1 (mod Q̄0 ). Note that iLH 0 ,L = iLH ,L ◦ φ̄. So
−1
we have g (iLH 0 ,L (δ 0 )) ≡ 1 (mod Q̄0 ) and hence H 0 g ∈ B 0 . Similarly, we have
H 0 g 0 ∈ B 0 . So H 0 g and H 0 g 0 are in the same block of CH 0 , as desired. Therefore C
is compatible.
Next consider H, H 0 ∈ P satisfying H 0 = hHh−1 for some h ∈ G and elements
Hg, Hg 0 ∈ H\G in the same block B of CH . We want to show that cH,h (Hg) =
H 0 hg and cH,h (Hg 0 ) = H 0 hg 0 are in the same block of CH 0 . Again by Lemma 3.5,
there exists an idempotent δ ∈ IH for which (3.1) holds. Choose φ to be the
0
0
−1
isomorphism LH → LH sending x ∈ LH to h x ∈ LH . So φ̄ sends x ∈ ŌLH 0 to
h−1
x ∈ ŌLH , or more pedantically, to
 −1

h
0
i−1
(i
(x))
∈ LH .
H
H
L ,L
L ,L
P
Again, as δ = δ0 ∈IH 0 φ̄(δ 0 )δ, there exists an idempotent δ 0 ∈ IH 0 such that φ̄(δ 0 )δ 6=
0. By assumption, we have φ̄(δ 0 )δ = δ. By Lemma 3.5, the set B 0 given by (3.2) is
a block of CH 0 = P (IH 0 ). We claim that H 0 hg, H 0 hg 0 ∈ B 0 . To see this, note that
(3.3) holds since Hg ∈ B. It implies that
(hg)−1

(iLH 0 ,L (δ 0 )) =

g −1

(iLH ,L (φ̄(δ 0 ))) ≡ 1

(mod Q̄0 )

and hence H 0 hg ∈ B 0 . Similarly, we have H 0 hg 0 ∈ B 0 . So H 0 hg and H 0 hg 0 are in
the same block of CH 0 , as desired. As cH,h is bijective, it maps blocks to blocks.
Therefore C is invariant.

67
3.6

Regularity test

In this section we implement the subroutine RegularityTest. It has the effect of
properly refining at least one partition in C if C is compatible, invariant, but not
regular.
A similar algorithm was proposed in [Evd94; Gao01] based on generalizations of
the Euclidean algorithm for polynomials over rings. We take an alternative approach
developed in [IKS09; Iva+12] based on a “free module test”:
Lemma 3.16 ([IKS09; Iva+12]). There exists an algorithm FreeModuleTest that
given a semisimple Fp -algebra A and a finitely generated A-module M , returns
a zero divisor a of A in polynomial time, such that a is zero only if M is a free
A-module.
For completeness, we prove Lemma 3.16 in Appendix B. In addition, we need the
following subroutine.
Lemma 3.17. There exists an algorithm SplitByZeroDivisor that given
• a semisimple Fp -algebra R, an idempotent decomposition I of R, and an
idempotent γ ∈ I,
• the ring R̄ := R/(1 − γ), the quotient map π : R → R̄, and a zero divisor
a 6= 0 of R̄,
replaces γ ∈ I with two nonzero idempotents γ1 , γ2 satisfying γ = γ1 + γ2 in
polynomial time.
The proof of Lemma 3.17 can be found in Appendix B as well. The subroutine
RegularityTest is then implemented in Algorithm 4 below.
The subroutine enumerates (K, K 0 ) ∈ F 2 , the ring homomorphisms φ̄ : ŌK 0 → ŌK
(induced from the field embeddings φ : K 0 → K), and the idempotents δ ∈ IK ,
δ 0 ∈ IK 0 satisfying φ̄(δ 0 )δ = δ. Line 3 and Line 4 compute the quotient rings
A = ŌK 0 /(1 − δ 0 ), M = ŌK /(1 − δ) and the corresponding quotient maps. They
are quotient rings of semisimple rings and hence also semisimple. By Lemma 3.4,
the map φ̄ induces a ring homomorphism φδ,δ0 : A → M sending u + (1 − δ 0 ) to
φ̄(u) + (1 − δ) for u ∈ ŌK 0 , which we compute at Line 5. It gives M an A-algebra
structure, and in particular an A-module structure. Then we call FreeModuleTest

68
Algorithm 4 RegularityTest
1:
2:
3:
4:
5:
6:
7:
8:
9:

for (K, K 0 ) ∈ F 2 and embedding φ : K 0 ,→ K do
for (δ, δ 0 ) ∈ IK × IK 0 satisfying φ̄(δ 0 )δ = δ do
compute A = ŌK 0 /(1 − δ 0 ) and the quotient map ŌK 0 → A
compute M = ŌK /(1 − δ) and the quotient map ŌK → M
compute φδ,δ0 : A → M sending u + (1 − δ 0 ) to φ̄(u) + (1 − δ) for
u ∈ ŌK 0 , making M an A-algebra and hence an A-module
call FreeModuleTest with the input A and M to obtain a ∈ A
if a 6= 0 then
call SplitByZeroDivisor to update IK 0 using the zero divisor a
return

at Line 6 which returns a zero divisor a of A by Lemma 3.16. If a 6= 0, we call
SplitByZeroDivisor (with the input R = ŌK 0 , I = IK 0 , γ = δ 0 , R̄ = A, the
quotient map ŌK 0 → A, and the zero divisor a) to update IK 0 , so that δ 0 is replaced
with two nonzero idempotents by Lemma 3.17. After the update, the subroutine
halts.
Proof of Lemma 3.14. The subroutine obviously runs in time polynomial in log p
and the size of F. To prove the rest of the lemma, it suffices to show that a zero
divisor a 6= 0 of A is always found in Line 6 if C is compatible but not regular.
So assume C is compatible but not regular. Then there exist H, H 0 ∈ P satisfying
H ⊆ H 0 , B ∈ CH , B 0 ∈ CH 0 and H 0 g, H 0 g 0 ∈ B 0 such that
(3.4)

−1
−1
0
0 0
|πH,H
6 |πH,H
0 (H g) ∩ B| =
0 (H g ) ∩ B|.

By Lemma 3.5, there exist δ ∈ IH and δ 0 ∈ IH 0 such that
−1

B = {Hh ∈ H\G : h (iLH ,L (δ)) ≡ 1

(mod Q̄0 )}

and
B 0 = {H 0 h ∈ H 0 \G :

h−1

(iLH 0 ,L (δ 0 )) ≡ 1

(mod Q̄0 )}.
0

By (3.4) and compatibility of C, we have πH,H 0 (B) ⊆ B 0 . Let φ : LH ,→ LH be
the natural inclusion, which induces a ring homomorphism φ̄ : ŌLH 0 → ŌLH . We
claim that φ̄(δ 0 )δ = δ holds: assume to the contrary that it does not hold. Then
there exists a maximal ideal m of ŌL such that
iLH ,L (δ) ≡ 1

(mod m)

and iLH ,L (φ̄(δ 0 )) = iLH 0 ,L (δ 0 ) ≡ 0

(mod m).

69
h

Choose h ∈ G such that m = Q̄0 . Then we have
h−1

(iLH ,L (δ)) ≡ 1

(mod Q̄0 )

and

h−1

(iLH 0 ,L (δ 0 )) ≡ 0

(mod Q̄0 ).

It follows that Hh ∈ B and πH,H 0 (Hh) = H 0 h 6∈ B 0 . But this contradicts
πH,H 0 (B) ⊆ B 0 . So φ̄(δ 0 )δ = δ holds.
Define A := ŌLH 0 /(1 − δ 0 ) and M := ŌLH /(1 − δ). Let φδ,δ0 : A → M be the ring
homomorphism sending u + (1 − δ 0 ) to φ̄(u) + (1 − δ) for u ∈ ŌLH 0 , making M an
A-algebra and hence an A-module. We claim that M is not free over A. Assume to
the contrary that M is a free A-module. Denote its rank over A by k ∈ N+ . Define
P := (g Q0 ∩ OLH 0 )/pOLH 0 ⊆ ŌLH 0

and P0 := P/(1 − δ 0 ) ⊆ A,

which are maximal ideals of ŌLH 0 and of A respectively. Then M/P0 M is a free
A/P0 -module of rank k. On the other hand, we have the isomorphism
M/P0 M ∼
= ŌLH /(φ̄(P)ŌLH + (1 − δ)ŌLH ).
It follows from the Chinese remainder theorem that M/P0 M is isomorphic to
Q
m∈S ŌLH /m where S denotes the set of the maximal ideals of ŌLH containing
both φ̄(P) and 1 − δ. As p splits completely in LH , each direct factor ŌLH /m is
isomorphic to Fp . So M/P0 M is a vector space of dimension |S| of Fp . On the other
0
hand, as p splits completely in LH , we have A/P0 ∼
= Fp . So rank k of M/P0 M
over A/P0 equals |S|.
By Corollary 3.1, the maximal ideals of ŌLH are of the form by PHh := (h Q0 ∩
OLH )/pOLH which correspond one-to-one to the cosets Hh ∈ H\G. Each maximal
ideal PHh contains φ̄(P) iff P is contained in
φ̄−1 (PHh ) = (h Q0 ∩ OLH 0 )/pOLH 0 ,
which, again by Corollary 3.1, holds iff H 0 g = H 0 h. And PHh contains 1 − δ iff
iLH ,L (1 − δ) ∈ h Q0 , which holds iff Hh ∈ B. So we have
−1
0
k = |S| = |{Hh ∈ B : H 0 g = H 0 h}| = |πH,H
0 (H g) ∩ B|.
−1
0 0
But the same proof shows k = |πH,H
0 (H g ) ∩ B|. This is a contradiction to (3.4).
Therefore M is not free over A.
0

Identify LH (resp. LH ) with a field in F using the isomorphism τH (resp. τH 0 )
chosen in Section 3.4. By Lemma 3.16, the subroutine is guaranteed to find a
nonzero element a ∈ A in Line 6. It then updates an idempotent decomposition IK 0
and properly refines some partition in C by Lemma 3.17, as desired.

70
3.7

Strong antisymmetry test

In this section, we implement the subroutine StrongAntisymmetryTest, which
has the effect of properly refining at least one partition in C if C is a P-scheme, but
not a strongly antisymmetric P-scheme.
This subroutine is based on an algorithm developed in [Rón92]:
Lemma 3.18 ([Rón92]). Under GRH, there exists an algorithm Automorphism
that given a ring A isomorphic to a finite product of Fp and a nontrivial ring
automorphism σ of A, returns a zero divisor a 6= 0 of A in polynomial time.
For completeness, we provide a proof of Lemma 3.18 in Appendix B.
The subroutine StrongAntisymmetryTest is implemented in Algorithm 5 below.
Algorithm 5 StrongAntisymmetryTest
construct an edge-labeled directed graph G = (V, E) where V = {(K, δ) :
K ∈ F, δ ∈ IK } and E = ∅
2: for (K, δ) ∈ V do
3:
compute AK,δ := ŌK /(1 − δ) and the quotient map ŌK → AK,δ

1:

for ((K, δ), (K 0 , δ 0 )) ∈ V 2 and φ : K 0 ,→ K satisfying φ̄(δ 0 )δ = δ do
5:
compute φδ,δ0 : AK 0 ,δ0 → AK,δ sending x + (1 − δ 0 ) to φ̄(x) + (1 − δ)
6:
if φδ,δ0 is invertible then
7:
E ← E ∪ {e, e0 }, where the edge e is from (K 0 , δ 0 ) to (K, δ) with label
φδ,δ0 , and e0 is from (K, δ) to (K 0 , δ 0 ) with label φ−1
δ,δ 0
4:

8:
9:
10:
11:
12:

search an nontrivial automorphism σ of AK,δ for some (K, δ) ∈ V that is a composition of maps in L := {φδ,δ0 : there exists an edge e ∈ E with label φδ,δ0 }
if σ is found at Line 8 then
call Automorphism on (AK,δ , σ) to obtain a zero divisor a 6= 0 of AK,δ
call SplitByZeroDivisor to update IK using a
return

The subroutine first constructs an edge-labeled directed graph G = (V, E), where
the vertex set is
V := {(K, δ) : K ∈ F, δ ∈ IK }
and each edge is labeled by a certain ring isomorphism to be determined later.
Initially the edge set E is empty. For every vertex (K, δ) ∈ V , we compute the ring
AK,δ := ŌK /(1 − δ) and the quotient map ŌK → AK,δ at Line 3.

71
Then we enumerate ((K, δ), (K 0 , δ 0 )) ∈ V 2 and φ : K 0 ,→ K for which φ̄(δ 0 )δ = δ
holds, and for each of them, we compute a ring homomorphism
φδ,δ0 : AK 0 ,δ0 → AK,δ
that sends x + (1 − δ 0 ) to φ̄(x) + (1 − δ) for x ∈ ŌK 0 . The map φδ,δ0 is well defined
by Lemma 3.4. If φδ,δ0 is an isomorphism (i.e., invertible), we add to E an edge e
from (K 0 , δ 0 ) to (K, δ) with label φδ,δ0 , and also an edge e0 from (K, δ) to (K 0 , δ 0 )
with label φ−1
δ,δ 0 .
Next, at Line 8, we search a nontrivial automorphism σ of AK,δ , (K, δ) ∈ V , such
that σ is a composition of maps in L, where
L := {φδ,δ0 : there exists an edge e ∈ E with label φδ,δ0 }.
We sketch a way of implementing this step in time polynomial in log p and the size
of F: note that the edges whose labels compose into a nontrivial automorphism
form a cycle of G. So by computing the strongly connected components of G and
restricting to each of them, we reduce to the case that G is strongly connected.
Fix a vertex (K0 , δ0 ) ∈ V . For every (K, δ) ∈ V , compute a ring isomorphism
ψK,δ : AK0 ,δ0 → AK,δ that is a composition of maps in L. These isomorphisms
exist since we assume G is strongly connected, and they can be computed by, e.g.,
the breadth-first search algorithm. Then we may find a nontrivial automorphism σ,
if it exists, by enumerating the maps φδ,δ0 : AK 0 ,δ0 → AK,δ in L and checking if the
automorphism
−1
φδ,δ0 ◦ ψK 0 ,δ0 ◦ ψK,δ
: AK,δ → AK,δ
of AK,δ is nontrivial.
Finally, if a nontrivial automorphism σ of some ring AK,δ is successfully found,
we use it to update IK as follows: run the algorithm Automorphism on the input
(AK,δ , σ) to obtain a zero divisor a 6= 0 of ∈ AK,δ . Then call SplitByZeroDivisor
(with the input R = ŌK , I = IK , γ = δ, R̄ = AK,δ , the quotient map ŌK →
AK,δ , and the zero divisor a) to update IK , so that δ is replaced with two nonzero
idempotents by Lemma 3.17.
Now we analyze the subroutine. For H ⊆ G and B ∈ CH , there exists a unique
idempotent δ = δB ∈ IH satisfying
−1

B = {Hh ∈ H\G : h (iLH ,L (δ)) ≡ 1

(mod Q̄0 )}.

72
See Definition 3.2 and Lemma 3.5. Write ALH ,δ for the ring ŌLH /(1 − δ). The
maximal ideals of ALH ,δ are of the form m/(1 − δ) where m is a maximal ideal of
ŌLH containing 1 − δ. By Corollary 3.1, the map
Hg 7→ mHg := (g Q0 ∩ OLH )/pOLH
is a one-to-one correspondence between the right cosets in H\G and the maximal
ideals of ŌK . And mHg contains 1 − δ iff iLH ,L (1 − δ) ∈ g Q0 , which holds iff
Hg ∈ B. We conclude that the map
Hg 7→ mHg /(1 − δ)
is a one-to-one correspondence between the right cosets in B and the maximal ideals
of ALH ,δ .
We also need the following technical lemma.
Lemma 3.19. Suppose H, H 0 ∈ P, B ∈ CH , B 0 ∈ CH 0 , τ : B → B 0 , and
0
φ : LH → LH are in one following cases:
0

1. H ⊆ H 0 , τ = πH,H 0 |B : B → B 0 , and φ : LH → LH is the natural inclusion.
0

2. H 0 = hHh−1 for some h ∈ G, τ = cH,h |B : B → B 0 , and φ : LH → LH
−1
sends x to h x.
Let δ := δB ∈ IH and δ 0 := δB 0 ∈ IH 0 (see Definition 3.2). Let φ̄ : ŌLH 0 → ŌLH be
induced from φ. Then φ̄(δ 0 )δ = δ holds, so that the ring homomorphism
φδ,δ0 : ALH 0 ,δ0 → ALH ,δ
sending x + (1 − δ 0 ) to φ̄(x) + (1 − δ) is well defined by Lemma 3.4. Moreover, for
Hg ∈ B, we have
0
φ−1
δ,δ 0 (mHg /(1 − δ)) = mτ (Hg) /(1 − δ ).

Finally, the map φδ,δ0 is an isomorphism if τ is a bijection.
Proof. We claim that for any Hg ∈ H\G, it holds that φ̄−1 (mHg ) = mτ (Hg) . Fix
Hg ∈ H\G. Note that φ̄−1 (mHg ) is a prime (and hence maximal) ideal of ŌLH 0 .
Therefore to prove the claim, it suffices to show φ̄(mτ (Hg) ) ⊆ mHg . In the first case
of the lemma, we have τ (Hg) = πH,H 0 (Hg) = H 0 g, and
mHg = (g Q0 ∩ OLH )/pOLH

and mτ (Hg) = mH 0 g = (g Q0 ∩ OLH 0 )/pOLH 0 .

73
0

As φ : LH → LH is the natural inclusion, we have φ(mτ (Hg) ) ⊆ mHg , as desired.
In the second case, we have τ (Hg) = cH,h (Hg) = H 0 hg, and
and mτ (Hg) = mH 0 hg = (hg Q0 ∩ OLH 0 )/pOLH 0 .

mHg = (g Q0 ∩ OLH )/pOLH
0

−1

As φ : LH → LH sends x to h x, again we have φ(mτ (Hg) ) ⊆ mHg . This proves
the claim.
Next we prove φ̄(δ 0 )δ = δ. As ŌLH is semisimple, it suffices to show that for any
maximal ideal mHg containing φ̄(δ 0 ) also contains δ. Fix Hg ∈ H\G such that
φ̄(δ 0 ) ∈ mHg . Then δ 0 is contained in φ̄−1 (mHg ) = mτ (Hg) . As δ 0 = δB 0 , we have
τ (Hg) 6∈ B 0 and hence Hg 6∈ B. Finally, as δ = δB , we have δ ∈ mHg , as desired.
0
The next claim that φ−1
δ,δ 0 (mHg /(1 − δ)) = mτ (Hg) /(1 − δ ) follows directly from
φ̄−1 (mHg ) = mτ (Hg) . Now assume τ is a bijection. The kernel of φδ,δ0 is
\
\
\
0
φ−1
mH 0 g /(1 − δ 0 ) = 0.
(m
/(1
−
δ))
=
m
/(1
−
δ
)
=
Hg
τ (Hg)
δ,δ 0
Hg∈B

Hg∈B

H 0 g∈B 0

So φδ,δ0 is injective. Also note that the dimension of ALH ,δ (resp. ALH 0 ,δ0 ) over Fp
equals its number of maximal ideals, which is |B| (resp. |B 0 |). As τ is bijective, we
have |B| = |B 0 |. So τ is an isomorphism.
Now we are ready to prove Lemma 3.15, as promised.
Proof of Lemma 3.15. Assume C is a P-scheme but not a strongly antisymmetric
P-scheme. By Lemma 3.18, it suffices to show that some maps in L compose into
a nontrivial automorphism of AK,δ for some (K, δ) ∈ V .
As C is not strongly antisymmetric, there exist k ∈ N+ , subgroups H0 , . . . , Hk ∈ P,
blocks B0 ∈ CH0 , . . . , Bk ∈ CHk , and maps σ1 , . . . , σk satisfying
• σi is a bijective map from Bi−1 to Bi ,
• σi is of the form cHi−1 ,g |Bi−1 , πHi−1 ,Hi |Bi−1 , or (πHi ,Hi−1 |Bi )−1 ,
• H0 = Hk and B0 = Bk ,
and the composition τ := σk ◦ · · · ◦ σ1 is a nontrivial permutation of B0 = Bk .
Let δi := δBi ∈ IHi and ALHi ,δi := ŌLHi /(1 − δi ) for 0 ≤ i ≤ k. By Lemma 3.19,
for i ∈ [k], there exists a ring isomorphism ψi : ALHi ,δi → ALHi−1 ,δi−1 such that
ψi−1 (mHi−1 g /(1 − δi−1 )) = mσi (Hi−1 g) /(1 − δi )

74
holds for all Hi−1 g ∈ Bi−1 . Moreover, for i ∈ [k], the map ψi is in one of the
following two cases:
• ψi sends x + (1 − δi ) to φ̄i (x) + (1 − δi−1 ) for x ∈ ŌLHi , where φi is an
embedding of LHi in LHi−1 .
• ψi−1 sends x + (1 − δi−1 ) to φ̄i (x) + (1 − δi ) for x ∈ ŌLHi−1 , where φi is an
embedding of LHi−1 in LHi .
Here the first case occurs when σi is of the form cHi−1 ,g |Bi−1 or πHi−1 ,Hi |Bi−1 , and
the second one occurs when σi is of the form (πHi ,Hi−1 |Bi )−1 .
Consider the automorphism σ := ψ1 ◦ · · · ◦ ψk of ALHk ,δk = ALH0 ,δ0 . We have
σ −1 (mH0 g /(1 − δ0 )) = mτ (H0 g) /(1 − δ0 )
for all H0 g ∈ B0 . As τ is a nontrivial permutation of B0 , there exists H0 g ∈ B0
satisfying τ (H0 g) 6= H0 g and hence mH0 g /(1 − δ0 ) 6= mτ (H0 g) /(1 − δ0 ). So σ is a
nontrivial automorphism.
Finally, identifying each field LHi with a field Ki ∈ F using the isomorphisms
τHi : Ki → LHi , we see that the ring isomorphisms ψi are identified with maps in
L, and they compose into a nontrivial automorphism of AK0 ,τ̄ −1 (δ0 ) . Here K0 is the
Hi

unique field in F isomorphic to LH0 and τ̄H−1i (δ0 ) ∈ IK0 . The lemma follows.
3.8

Constructing a collection of number fields

The last ingredient of the P-scheme algorithm is a subroutine that constructs a
(Q, g)-subfield system given a polynomial g(X) ∈ Q[X] irreducible over Q.
This subroutine can be implemented in various ways, leading to algorithms with
different running time. We mention two results of this kind: computing the splitting
field of g, and computing a (Q, g)-subfield system whose associated subgroup system
is a system of stabilizers. For simplicity, we only state the results, deferring the
proofs and the algorithms to Chapter 4 where we discuss the problem of constructing
number fields in depth.
Computing the splitting field of a polynomial. The splitting of a polynomial
over Q can be effectively constructed by the following lemma.

75
Lemma 3.20. There exists a deterministic algorithm that given a polynomial g(X) ∈
Q[X] irreducible over Q, computes its splitting field L(g) over Q in time polynomial
in [L(g) : Q] and the size of g.
The proof is deferred to Chapter 4.
System of stabilizers. We also have an algorithm that computes a (Q, g)-subfield
system whose associated subgroup system is a system of stabilizers:
Lemma 3.21. There exists a deterministic algorithm that given a polynomial g(X) ∈
Q[X] irreducible over Q and a positive integer m ≤ deg(g), computes a (Q, g)subfield system F, such that the subgroup system associated with F is the system of
stabilizers of depth m over G(g/Q) with respect to the action of Gal(g/Q) on the set
of roots of g in L(g), where L(g) denotes the splitting field of g over Q. Moreover,
the algorithm runs in time polynomial in (deg(g))m and the size of g.
The proof is again deferred to Chapter 4.
3.9

Putting it together

We combine the results in previous sections to obtain the P-scheme algorithm. The
pseudocode is given in Algorithm 6 below.
Algorithm 6 PschemeAlgorithm
Input: f (X) ∈ Fp [X] and its irreducible lifted polynomial f˜(X) ∈ Z[X]
Output: factorization of f
1: call ComputeNumberFields to compute a (Q, f˜)-subfield system F such that
(1) F = Q[X]/(f˜(X)) ∈ F, and (2) for some H ∈ P satisfying LH ∼
= F , all
strongly antisymmetric P-schemes are discrete (resp. inhomogeneous) on H,
where P is the subgroup system over G = Gal(f˜/Q) associated with F
2: call ComputePscheme on the input (p, F) to obtain IK for K ∈ F
3: call ExtractFactors to extract a factorization of f from IF , and output it
The subroutine ComputeNumberFields at Line 1 is the generic part of the algorithm
and can be implemented in various ways. It is supposed to compute a (Q, f˜)-subfield
system F such that F ∈ F, and the associated subgroup system P over G satisfies
a certain combinatorial property (see Theorem 3.9 below). The latter condition is
used to show that the factoring algorithm always produces the complete factorization
(resp. a proper factorization) of f .

76
The algorithm ComputePscheme (see Section 3.4) at Line 2 takes the input (p, F)
and outputs data that includes the idempotent decompositions IK for K ∈ F.
Finally, we call the subroutine ExtractFactors (see Section 3.3) at Line 3 to
extract a factorization of f from IF .
The following theorem is the main result of this chapter.
Theorem 3.9 (Theorem 3.2 restated). Suppose there exists a deterministic algorithm
that given a polynomial g(X) ∈ Z[X] irreducible over Q, constructs a (Q, g)subfield system F in time T (g) such that
• Q[X]/(g(X)) is in F, and
• for some H ∈ P satisfying (L(g))H ∼
= Q[X]/(g(X)), all strongly antisymmetric P-schemes are discrete (resp. inhomogeneous) on H, where P is the
subgroup system over Gal(g/Q) associated with F, and L(g) is the splitting
field of g over Q.
Then under GRH, there exists a deterministic algorithm that given a polynomial
f (X) ∈ Fp [X] satisfying Condition 3.1 and an irreducible lifted polynomial f˜(X) ∈
Z[X] of f , outputs the complete factorization (resp. a proper factorization) of f
over Fp in time polynomial in T (f˜) and the size of the input.
Proof. Consider the algorithm PschemeAlgorithm above and implement the subroutine ComputeNumberFields using the hypothetical algorithm in the theorem.
Choose g = f˜. By Theorem 3.8, the P-collection C = {CH : H ∈ P} defined by
CH = P (τ̄H (IK )) is a strongly antisymmetric P-scheme. By the second condition
in the theorem, we have CH = ∞H\G (resp. CH 6= 0H\G ) for some H ∈ P satisfying LH ∼
= F . So the corresponding idempotent decomposition IF is complete
(resp. proper). By Theorem 3.7, the algorithm outputs the complete factorization
(resp. a proper factorization) of f over Fp .
The subroutine ComputeNumberFields runs in time T (f˜). In particular, the size
of F is bounded by T (f˜). The claim about the running time then follows from
Theorem 3.8 and Theorem 3.7.
By Theorem 3.9 and Lemma 3.21, we have a deterministic factoring algorithm whose
running time is related to the notations d(G) and d0 (G) introduced in Definition 2.8:

77
Corollary 3.2. Under GRH, there exists a deterministic algorithm that, given a
polynomial f (X) ∈ Fp [X] of degree n ∈ N+ satisfying Condition 3.1 and an irreducible8 lifted polynomial f˜(X) ∈ Z[X] of f , computes the complete factorization
0
(resp. a proper factorization) of f over Fp in time polynomial in nd(G) (resp. nd (G) )
and the size of the input, where G is the permutation group Gal(f /Q) acting on the
set of roots of f˜.
The unifying framework via the P-scheme algorithm. The P-scheme algorithm
and the underlying notion of P-schemes provide a unifying framework for deterministic polynomial factoring over finite fields. To illustrate this point, we show that
the main results achieved by known factoring algorithms [Hua91a; Hua91b; Rón88;
Rón92; Evd94; IKS09] can be easily derived from Theorem 3.9 or Corollary 3.2 for
the special case that the input polynomial satisfies Condition 3.1 (the general case
is solved in Chapter 5).
Suppose we want to factorize f (X) ∈ Fp [X] given a (possibly reducible) lifted
polynomial f˜(X) ∈ Z[X] of f . We reduce to the case that the lifted polynomial
is irreducible as follows: first use the factoring algorithm for rational polynomials
[LLL82] to factorize f˜ into its irreducible factors f1 (X), . . . , fk (X) ∈ Q[X] over Q
in polynomial time. By Gauss Lemma (see [Lan02, Section IV.2]), we may assume
each factor f˜i (X) lies in Z[X]. Then the problem of factoring f (X) is reduced
to the problem of factoring each fi (X) := f˜(X) mod p ∈ Fp [X] with the aid of
its irreducible lifted polynomial f˜i (X). Moreover, for i ∈ [k], the Galois group
Gal(f˜i (X)/Q) is a quotient group of Gal(f˜/Q), and hence |Gal(f˜i (X)/Q)| ≤
|Gal(f˜(X)/Q)|.
So assume f˜ is irreducible over Q. Choose F = {F, L} where F = Q[X]/(f˜(X))
and L is the splitting field of f˜ over Q. Compute F in time polynomial in [L :
Q] = Gal(f˜(X)/Q) and the size of f˜ using Lemma 3.20. By Lemma 2.4, all
antisymmetric P-schemes are discrete on H for all H ∈ P since the trivial subgroup
{e} is in P. Therefore by Theorem 3.9 and the reduction above, we have
Theorem 3.10 ([Rón92]). Under GRH, there exists a deterministic algorithm that,
given a polynomial f (X) ∈ Fp [X] satisfying Condition 3.1 and a lifted polynomial
f˜(X) ∈ Z[X] of f , computes the complete factorization of f over Fp in time
polynomial in |Gal(f˜/Q)| and the size of the input.
8

The assumption that f˜ is irreducible is not necessary, and can be avoided by adapting
Lemma 3.21. We omit the details.

78
Now assume f˜ is irreducible over Q and Gal(f˜/Q) is abelian. Then Gal(f˜/Q)
acts regularly on the set of roots of f˜. So we have |Gal(f˜/Q)| = deg(f ). Then
Theorem 3.10 gives
Corollary 3.3 ([Hua91a; Hua91b]). Under GRH, there exists a deterministic algorithm that, given a polynomial f (X) ∈ Fp [X] satisfying Condition 3.1 and a lifted
polynomial of f with an abelian Galois group, computes the complete factorization
of f over Fp in polynomial time.
Suppose only the polynomial f is known. Let n = deg(f ). We may lift f to a
degree-n polynomial f˜(X) ∈ Z[X] such that all coefficients of f˜ are in the interval
[0, p − 1]. So the size of f˜ is O(n log p). Reduce to the case that f˜ is irreducible
over Q as above. As Gal(f˜/Q) is a subgroup of Sym(n), we derive the following
theorem from Theorem 3.10.
Theorem 3.11 ([Rón88; Rón92]). Under GRH, there exists a deterministic algorithm that, given a polynomial f (X) ∈ Fp [X] of degree n ∈ N+ that satisfies
Condition 3.1, computes the complete factorization of f in time polynomial in n!
and log p.
Alternatively, Theorem 3.11 can be derived from Corollary 3.2 by noting d(G) ≤
n − 1 (where G = Gal(f˜/Q)). Similarly, using the bound d(G) = O(log n) in
Lemma 2.6, we derive the following theorem from Corollary 3.2.
Theorem 3.12 ([Evd94; IKS09]). Under GRH, there exists a deterministic algorithm
that, given a polynomial f (X) ∈ Fp [X] of degree n ∈ N+ satisfying Condition 3.1,
computes the complete factorization of f over Fp in time polynomial in nlog n and
log p.
By Corollary 3.2 and Lemma 2.18, we have
Theorem 3.13 ([Rón88; IKS09]). Under GRH, there exists a deterministic algorithm that, given a polynomial f (X) ∈ Fp [X] of degree n > 1 satisfying Condition 3.1, computes a proper factorization of f over Fp in time polynomial in n` and
log p, where ` is the least prime factor of n.
In latter chapters, we also prove (and generalize) the main result of [Evd92] using
the P-scheme algorithm. It states that polynomial factoring over finite fields can be
solved in deterministic polynomial time under GRH given a lifted polynomial that
has a solvable Galois group. For more details, see Theorem 4.3 and Theorem 5.13.

79
Chapter 4

CONSTRUCTING NUMBER FIELDS
In this chapter, we discuss the problem of constructing number fields using a polynomial g(X) ∈ Q[X] irreducible over Q. In particular, we prove Lemma 3.20 and
Lemma 3.21 as promised before.
In fact, we consider the more general problem of constructing relative number fields,
which we explain now.
Relative number fields. Recall that a number field K is encoded using the minimal
polynomial h(X) ∈ Q[X] of a primitive element α of K over Q, i.e., K = Q(α).
Suppose K0 is a number field encoded in this way. A relative number field K
over K0 is a number field containing K0 , encoded by the minimal polynomial
h(X) ∈ K0 [X] of a primitive element α of K over K0 (i.e. K = K0 (α)). We
regard K as a K0 -algebra by maintaining its structure constants in the standard
K0 -basis
{1 + (h(X)), X + (h(X)), . . . , X d−1 + (h(X))},
where d = [K : K0 ]. Note that when K0 = Q, this this the usual way we encode a
number field.
Given a number field K0 , we discuss various techniques of constructing relative
number fields over K0 given a polynomial g(X) ∈ K0 [X] irreducible over K0 . In
particular, we discuss the technique of adjoining roots of polynomials and use it to
prove Lemma 3.20 and Lemma 3.21.
Motivated by the P-scheme algorithm in Chapter 2, we consider the problem of
constructing a collection of (relative) number fields using g(X), such that for the
associated subgroup system P, all strongly antisymmetric P-schemes are discrete
(resp. inhomogeneous) on a distinguished subgroup H ∈ P. We describe a reduction of this problem to the case that the Galois group of g(X) is a primitive
permutation group. The idea was essentially introduced in [LM85], leading to a
polynomial-time algorithm that determines if a given rational polynomial is solvable.1 It was also used in [Evd92] to obtain to a polynomial-time factoring algorithm
1

A rational polynomial g(X) ∈ Q[X] is solvable if its roots are expressible in the field operations
and radicals. It is equivalent to the solvability of the Galois group Gal(g/Q).

80
for f (X) ∈ Fp [X], provided that a solvable polynomial f˜(X) ∈ Z[X] lifting f (X)
is given. We reproduce the main result of [Evd92] for the case that f satisfies
Condition 3.1. For the general case, see Chapter 5.
We note that most results in this chapter are essentially known in the literature,
except that we state them in a relative setting or in the terminology of P-schemes.
In particular, the discussion about algebraic numbers in Section 4.1 follows [WR76],
and the techniques of constructing number fields are mostly folklore or from [Lan84;
LM85; Evd92].
Outline of the chapter. Notations and preliminaries are given in Section 4.1. In
particular, we define the complexity of a subgroup system, which is used to bound
the size of a collection of (relative) number fields and the running time of the
algorithms. This notion also plays a role in subsequent chapters. In Section 4.2, we
discuss the technique of constructing (relative) number fields by adjoining roots of
a polynomial, and use it to prove Lemma 3.20 and Lemma 3.21. In Section 4.3, we
establish the reduction to primitive Galois groups and use it to prove the main result
of [Evd92] for the special case that f (X) ∈ Fp [X] satisfies Condition 3.1. Finally,
we discuss some other techniques in Section 4.4. These techniques are not directly
used in the thesis, but may still have their own interest.
4.1

Preliminaries

Let K and K 0 be relative number fields over a number field K0 . We say an embedding
(resp. isomorphism) τ : K → K 0 is an embedding (resp. isomorphism) over K0 if
τ is K0 -linear, i.e., τ (ax) = aτ (x) for all a ∈ K0 and x ∈ K. By choosing x = 1,
we see that this is equivalent to τ (a) = a for all a ∈ K0 . We write K ∼
=K0 K 0 for
the statement that K is isomorphic to K 0 over K0 .
(K0 , g)-subfield systems and the associated subgroup systems. We generalize
the notion of (Q, g)-subfield systems (Definition 3.3) and the associated subgroup
systems (Definition 3.4) as follows:
Definition 4.1 ((K0 , g)-subfield system). Let K0 be a number field. Let g(X) be
a polynomial in K0 [X] with the splitting field L over K0 . Let F be a collection
of relative number fields over K0 such that (1) the fields in F are mutually nonisomorphic over K0 , and (2) each field K 0 ∈ F is isomorphic to a subfield of L over
K0 . We say F is a (K0 , g)-subfield system.

81
Definition 4.2. Let g(X) be a polynomial in K0 [X] with the splitting field L over
K0 . Let F be a (K0 , g)-subfield system. Define P ] to be the poset of subfields of L
that includes all the fields isomorphic to those in F over K0 :
P ] := {K 0 ⊆ L : K 0 ∼
=K0 K for some K ∈ F}.
By Galois theory, it corresponds to a poset P of subgroups of Gal(g/K0 ), given by

P := H ⊆ Gal(g/K0 ) : LH ∈ P ] ,
which is closed under conjugation in Gal(g/K0 ), and hence is a subgroup system
over Gal(g/K0 ). We say P and P ] are associated with F.
The complexity of a subgroup system. The size of a (K0 , g)-subfield system F
is primarily controlled by the total degree of the fields in F over K0 , which is the
number of coefficients in K0 we need to maintain. We relate this quantity to the
complexity of a subgroup system, defined as follows.
Definition 4.3 (complexity of a subgroup system). Suppose P is a subgroup system
over a finite group G. Then G acts on P by conjugation, i.e., g ∈ G sends H ∈ P
to gHg −1 ∈ P. Let P0 ⊆ P be a complete set of representatives of the G-orbits
under this action. Define the complexity of P to be
c(P) :=

X

[G : H].

H∈P0

As conjugate subgroups have the same order, the complexity c(P) is well defined.
And we have
Lemma 4.1. For a (K0 , g)-subfield system F, the total degree of the fields in F over
K0 equals c(P), where P is the subgroup system associated with F.
Proof. Conjugate subgroups correspond to conjugate subfields under the Galois
correspondence. So for K ∈ F there exists a unique subgroup H ∈ P0 satisfying
LH ∼
=K0 K. And the map K 7→ H is a one-to-one correspondence between F and
P0 . Finally note that [K : K0 ] = [G : H] for H corresponding to K.
The following lemma bounds the complexity of a system of stabilizers.

82
Lemma 4.2. Let G be a finite group acting on a finite set S. Let m ∈ N+ and
m0 = min{|S|, m}. Let P be the system of stabilizers of depth m0 with respect to
the action of G on S. Then
0

m Y
k


X
m0
c(P) ≤
(|S| − i) = O |S|
.
k=1 i=1

Proof. Replacing m with m0 does not change P. So we may assume m = m0 ≤ |S|.
When |S| ≥ 2, we have
m k−1
m
X
Y
X
(|S| − i) ≤
|S|k = O (|S|m ) .
k=1 i=0

k=1

The same holds trivially when |S| = 1.
P Qk
Next we prove c(P) ≤ m
k=1
i=1 (|S| − i). Let P0 ⊆ P be as in Definition 4.3. It
suffices to find an injective map
τ:

a
H∈P0

since the cardinality of
P Qk
is m
k=1
i=1 (|S| − i).

`

H∈P0

H\G ,→

m
a

S (k) ,

k=1

H\G is c(P), whereas the cardinality of

`m

k=1

S (k)

For each k ∈ [m], the group G acts diagonally on S (k) . For each H ∈ P0 , we
pick k = k(H) ≤ m and x = x(H) ∈ S (k) such that H = Gx with respect to the
diagonal action. By Lemma 2.1, we have an injective map H\G → S (k) whose
image is the G-orbit of x. These maps altogether give the map τ . To show τ is
injective, it suffices to show that for different H, H 0 ∈ P0 , the coset spaces H\G
and H 0 \G are mapped to different G-orbits. Assume to the contrary that they are
mapped to the the same G-orbit O. So x(H), x(H 0 ) ∈ O. Then k(H) = k(H 0 ) and
x(H 0 ) = g (x(H)) for some g ∈ G. But then we have
H 0 = Gx(H 0 ) = Gg x(H) = gGx(H) g −1 = gHg −1 ,
which is a contradiction to the choice of P0 . So τ is injective.
Algebraic numbers. The fields in a (K0 , g)-subfield system F are encoded by
polynomials in K0 [X]. So to bound the size of F, we also need to bound the size
of the coefficients of these polynomials, which are algebraic numbers in K0 . This
is closely related to the following definition, introduced in [WR76].

83
Definition 4.4. For an algebraic number α, define kαk to be the greatest absolute
value of i(α) ∈ C where i ranges over the embeddings of Q(α) in C.2
For algebraic numbers α, β, we clearly have kα + βk ≤ kαk + kβk and kα · βk ≤
kαk · kβk.
The following lemma relates the size of an algebraic number α ∈ K0 (i.e., the
number of bits used to encode α in K0 ) to kαk.
Lemma 4.3. Suppose K0 is a number field encoded by a polynomial h(X) ∈ Q[X]
irreducible over Q of degree n and size s0 . Let α be an algebraic number in K0 of
size s. Let D be the smallest positive integer such that Dα is an algebraic integer.
Then s is polynomial in log kαk, log D and s0 . Conversely, log kαk and log D are
polynomial in s and s0 .
Pn
Proof. Suppose h(X) =
i=0 ci Xi where n = deg(h) and ci ∈ Q for all i.
By substituting X with X/k for some large enough k ∈ N+ and clearing the
denominators, we may assume h(X) ∈ Z[X] and cn = 1. Both the encoding of h
and that of α use at least n coefficients in Q. So we have s, s0 ≥ n.
The algebraic number α ∈ K0 is encoded by the constants d0 , . . . , dn−1 ∈ Q
satisfying
n−1
X
α=
di β i ,
(4.1)
i=0

Pn−1
|di |kβki . It was shown in
where β is a root of h in K0 . So we have kαk ≤ i=0
P
[WR76] that kβk ≤ n−1
i=0 |ci |. And we clearly have log |ci | ≤ s0 and log |di | ≤ s
for 0 ≤ i ≤ n − 1. It follows that log kαk is polynomial in s and s0 .
Let D0 ∈ N+ be the least common multiple of the denominators of di . As h(X) ∈
Z[X] and cn = 1, we know β is an algebraic integer. Then D0 α is also an algebraic
integer by (4.1). So D is bounded by D0 . It follows that log D is polynomial in s
and s0 . Then the second claim of the lemma is proved.
For the first claim, it suffices to show that the size of each di is polynomial in log kαk,
log D and s0 . This follows from [WR76, Section 7 and Lemma 8.3].
The following lemma relates the size of the minimal polynomial of an algebraic
number α over a number field K0 to kαk.
2

kαk is called the size of α in [WR76]. We reserve the term size (of an object) for the number
of bits used to encode an object in an algorithm.

84
Lemma 4.4. Suppose K0 is a number field encoded by a rational polynomial
irreducible over Q of size s0 (let s0 = 1 if K0 = Q). Let α be an algebraic number,
and let D be the smallest positive integer such that Dα is an algebraic integer. Let
h(X) ∈ K0 [X] be the minimal polynomial of α whose size is s and degree is n.
Then s is polynomial in log kαk, log D, s0 and n. Conversely, log kαk and log D
are polynomial in s and s0 .
P
Proof. We clearly have n ≤ s. Suppose h(X) = ni=0 ci X i , where ci ∈ K0 and
Pn−1
cn = 1. It was as shown in [WR76] that kαk ≤
i=0 kci k. It follows from
Lemma 4.3 that log kαk is polynomial in s and s0 .
Note that for sufficiently large k ∈ N+ that is polynomial in s and s0 , the coefficients
of the polynomial k n h(X/k) are all algebraic integers. It follows that kα is an
algebraic integer (cf. [AM69, Corollary 5.4]). So D is bounded by k and hence is
polynomial in s and s0 . Then the second claim of the lemma is proved.
For the first claim, we may assume α is an algebraic integer by replacing α with Dα
and ci with Dn−i ci . Then any conjugate α0 of α over Q is also an algebraic integer,
and kα0 k = kαk. For 0 ≤ i ≤ n − 1, the coefficient ci of h is (up to sign) given by
the ith elementary symmetric polynomial in a subset of conjugates of α over Q. It
follows from Lemma 4.3 that the size of each ci is polynomial in log kαk, log D, s0
and n. So s is polynomial in log kαk, log D, s0 and n as well.
Finding a primitive element over Q. Suppose K0 = Q(α) is a number field
encoded by the minimal polynomial of a primitive element α over Q, and K = K0 (β)
is a relative number field over K0 , encoded by the minimal polynomial of a primitive
element β over K0 . We would like to represent K directly in the form Q(γ), encoded
by the minimal polynomial of a primitive element γ over Q. The first step is to
find such an element γ, which can be achieved using a constructive version of the
primitive element theorem (see, e.g., [Wae91]). For completeness, we give the
details as follows.
Lemma 4.5. Suppose K0 is a number field and α, β are algebraic numbers. Let
d = [K0 (α, β) : K0 ]. Then kα + β is a primitive element of K0 (α, β) over K0 for
some integer k ∈ [1, d + 1].
Proof. Consider a “bad” nonzero integer k for which K0 (kα+β) is a proper subfield
of K0 (α, β). Let L be the Galois closure of K0 (α, β)/K0 . Then by the fundamental

85
theorem of Galois theory, there exists an automorphism φ of L fixing K0 (kα + β)
but not K0 (α, β). Then either φ(α) 6= α or φ(β) 6= β. As φ fixes kα + β, we
have kφ(α) + φ(β) = φ(kα + β) = kα + β, from which we see that actually
φ(α) 6= α and φ(β) 6= β both hold. Then k is determined by φ(α) and φ(β) via
k = (φ(β) − β)/(α − φ(α)). So the number of bad choices of k is bounded by
the number of (φ(α), φ(β)) where φ ranges over the automorphisms of L fixing K0 .
The later is the cardinality of the orbit of (α, β) under the action of Gal(L/K0 ). By
the orbit-stabilizer theorem, it equals
[Gal(L/K0 ) : Gal(L/K0 (α, β))] = [K0 (α, β) : K0 ] = d.
So there are at most d bad choices of k. The lemma follows since [1, d + 1] contains
more than d integers.
This gives an efficient algorithm of finding a primitive element over Q:
Lemma 4.6. There exists a polynomial-time algorithm that given a number field K0
and a relative number field K over K0 , find a primitive element γ of K over Q and
its minimal polynomial h(X) ∈ Q[X] over Q.
Proof. Suppose K0 is encoded by a polynomial g(X) ∈ Q[X] irreducible over Q,
and K is encoded by a polynomial g 0 (X) ∈ K0 [X] irreducible over K0 . Then we
are explicitly given a root α of g(X) and a root β of g 0 (X) in K, and K = Q(α, β).
Enumerate the integers k ∈ [1, d + 1], where d = [K : Q]. For each k, we compute
γ = kα + β ∈ K, and then compute its minimal polynomial h(X) ∈ Q[X] over Q
by solving linear equations over Q. This step runs in polynomial time by Lemma 4.4.
Output γ and h whenever deg(h) = [K : Q]. By Lemma 4.5, a primitive element γ
is guaranteed to be found.
By computing a primitive element over Q, we can efficiently turn a relative number
field into an ordinary number field:
Corollary 4.1. There exists a polynomial-time algorithm that given a number field
K0 and a relative number field K over K0 , computes an ordinary number field K 0 ,
a Q-basis B of K, and an isomorphism φ : K → K 0 encoded by φ(x) ∈ K 0 for
x ∈ B.

86
Proof. Find a primitive element γ of K over Q and its minimal polynomial
h(X) ∈ Q[X] over Q using Lemma 4.6. Compute K 0 := Q[X]/(h(X)) and
B = {1, γ, γ 2 , . . . , γ d−1 }, where d = [K : Q]. Then compute the isomorphism
φ : K → K 0 , which sends γ i to X i + (h(X)) for i = 0, 1, . . . , d − 1.
As an application, we generalize Lemma 3.10 to obtain an efficient algorithm that
computes embeddings of relative number fields over a given number field.
Lemma 4.7. There exists a polynomial-time algorithm ComputeRelEmbeddings
that given a number field K0 and relative number fields K and K 0 over K0 , computes
all the embeddings of K in K 0 over K0 .
Proof. Identify K and K 0 with ordinary number fields using Corollary 4.1. Run the
algorithm ComputeEmbeddings in Lemma 3.10 to compute all the embeddings of
K in K 0 , and ignore those not fixing K0 .
4.2

Adjoining roots of polynomials

One of the most basic techniques of constructing number fields is adjoining roots of
polynomials. It can be efficiently performed by the following lemma.
Lemma 4.8. There exists a polynomial-time algorithm AdjoinRoot that given a
number field K0 , a relative number field K over K0 , and a polynomial h(X) ∈ K[X]
irreducible over K, computes the relative number field K 0 = K(α) over K0 (up to
isomorphism over K0 ), where α is an arbitrary root of h(X). Moreover, suppose K
is encoded by the minimal polynomial of a primitive element β ∈ K over K0 . Then
K 0 is encoded by the minimal polynomial of an element of the form β + kα over K0 ,
where 1 ≤ k ≤ [K 0 : K0 ] + 1.
Proof. Form the K-algebra K 00 := K[X]/(h(X)) which is a field. We need to
encode K 00 as a relative number field over K0 . Let α := X + (h(X)) ∈ K 00 which is
a root of h(X). Then α and β are explicitly known in K 00 . Let d := [K 00 : K0 ] + 1.
By Lemma 4.5, there exists k ∈ [1, d+1] such that γ = β +kα is a primitive element
of K 00 over K0 . Compute such an element γ by enumerating k and checking if the
degree of the minimal polynomial of γ over K0 equals d. Once γ is found, compute
the relative number field K 0 := K0 [X]/(g(X)) over K0 , where g(X) is the minimal
polynomial of γ over K0 . It is isomorphic to K 00 = K(α) over K0 via the K0 -linear
map sending X + (g(X)) to γ.

87
By repeatedly adjoining roots, we obtain an algorithm that computes the splitting
field of a given irreducible polynomial over a number field K0 . See Algorithm 7.
Algorithm 7 SplittingField
Input: number field K0 and g(X) ∈ K0 [X] irreducible over K0
Output: the splitting field of g over K0 as a relative number field over K0
1: K ← K0 , regarded as a relative number field over K0
2: factorize g over K
3: while g has an irreducible non-linear factor over K do
4:
pick an irreducible non-linear factor g0 of g over K
5:
run AdjoinRoot on (K0 , K, g0 ) to obtain K 0
6:
K ← K0
7:
factorize g over K
8:

return K

Line 2 and Line 7 are implemented using the polynomial-time factoring algorithms
for number fields [Len83; Lan85].3 And we have
Lemma 4.9. Given a number field K0 and a polynomial g(X) ∈ K0 [X] irreducible
over K0 , the algorithm SplittingField computes the splitting field K of g over
K0 in time polynomial in [K : K0 ] and the size of the input.
Proof. The algorithm initializes K to K0 and keeps adjoining roots of g to K until
it contains all these roots. The resulting field K is by definition the splitting field
of g over K0 . At most t := log[K : K0 ] intermediate fields are constructed other
than K0 . By induction and Lemma 4.8, each intermediate field is encoded by the
minimal polynomial of a primitive element k1 α1 + · · · + ks αs over K0 where s ≤ t,
all αi are roots of g and 1 ≤ ki ≤ [K : K0 ] + 1. The claim about the running time
then follows from Lemma 4.4 and Lemma 4.8.
Choosing K0 = Q proves Lemma 3.20. Similarly, we have an algorithm constructing a (K0 , g)-subfield system whose associated subgroup system is a system
of stabilizers. See Algorithm 8 below.
Again, Line 8 is implemented using the polynomial-time factoring algorithms for
number fields [Len83; Lan85]. The condition at Line 11 is checked using the
algorithm ComputeRelEmbeddings in Lemma 4.7.
3

Here we factorize g over the relative number field K. It can be reduced to the problem of
factoring polynomials over an ordinary number field by Corollary 4.1.

88
Algorithm 8 Stabilizers
Input: number field K0 , m ∈ N, and g(X) ∈ K0 [X] irreducible over K0
Output: (K0 , g)-subfield system F
1: if m = 0 then
2:
return ∅
3:

12:

m ← min(deg(g), m)
F ← {K0 [X]/(g(X))}
for i ← 2 to m do
Fold ← F
for K ∈ Fold do
factorize g over K
for irreducible non-linear factor g0 of g over K do
run AdjoinRoot on (K0 , K, g0 ) to obtain K 0
if K 0 is non-isomorphic to all fields in F over K0 then
F ← F ∪ {K 0 }

13:

return F

4:
5:
6:
7:
8:
9:
10:
11:

We have the following lemma.
Lemma 4.10. Given a number field K0 , an integer m ∈ N, and a polynomial g(X) ∈
K0 [X] irreducible over K0 , the algorithm Stabilizers computes a (K0 , g)-subfield
system F, such that the subgroup system P associated with F is the system of
stabilizers of depth m over G(g/K0 ) with respect to the action of Gal(g/K0 ) on the
set of roots of g in L, where L denotes the splitting field of g over K0 . Moreover, the
algorithm runs in time polynomial in c(P) and the size of the input.
Proof. If m = 0, the algorithm simply returns F = ∅. It replaces m with
min(deg(g), m) at Line 3, which does not change the desired subgroup system.
So we may assume m ≤ deg(g). The condition at Line 11 guarantees that the fields
in F are mutually non-isomorphic over K0 . For k ∈ [m], let Pk be the the system
of stabilizers of depth k over G(g/K0 ) with respect to the action of Gal(g/K0 ) on
the set of roots of g in L, and let Pk] be the corresponding poset of subfields of L
determined by the Galois correspondence. Then Pk] consists of the fields of the form
K0 (α1 , . . . , αi ), where i ∈ [k] and α1 , . . . , αi are roots of g in L.
We want to show that at the end of the algorithm, the subgroup system P associated
with F equals Pm . And it suffices to prove that for k ∈ [m], after the kth iteration

89
of the loop in Lines 5–12, every field in F is isomorphic to some field in Pk] over
K0 and vice versa. This follows from a simple induction on k.
Denote by d the maximum degree of the fields in F over K0 . Then d and |F| are
bounded by c(P). By induction and Lemma 4.8, each field in F is encoded by
the minimal polynomial of a primitive element k1 α1 + · · · + ks αs over K0 where
s ≤ m ≤ deg(g), all αi are roots of g, and 1 ≤ ki ≤ d + 1. The claim about the
running time then follows from Lemma 4.4 and Lemma 4.8.
By Lemma 4.2, the complexity c(P) of the subgroup system P in Lemma 4.10 is
0
bounded by (deg(g))m , where m0 = min{deg(g), m}. Lemma 3.21 then follows
by choosing K0 = Q.
4.3

Reduction to primitive group actions

Suppose K0 is a number field, g(X) ∈ K0 [X] is irreducible over K0 , and L is
the splitting field of g over K0 . The Galois group Gal(g/K0 ) = Gal(L/K0 ) acts
faithfully and transitively on the set of roots of g in L, and hence is a transitive
permutation group on this set.
Motivated by Theorem 3.9, we are interested in the problem of constructing a
(K0 , g)-subfield system F such that all strongly antisymmetric P-schemes are discrete (resp. inhomogeneous) on H, where P is the subgroup system over Gal(g/K0 )
associated with F, and H is a subgroup in P satisfying LH ∼
=K0 K0 [X]/(g(X)).
In this section, we describe a reduction, based on the work [LM85; Evd92], that
reduces the problem to the special case that Gal(g/K0 ) is a primitive permutation
group.
Definition 4.5 (primitive permutation group). Suppose G is a permutation group
on a finite set S. A nonempty subset B of S is called a set of imprimitivity4 of G if
for all g ∈ G, either g B = B or B ∩ g B = ∅. A set of imprimitivity is trivial if it
is a singleton or the whole set S. We say G is primitive if it only has trivial sets of
imprimitivity. Otherwise G is imprimitive.
It is well known that for transitive permutation groups, primitivity is equivalent to
maximality of stabilizers.
4

A set of imprimitivity is also called a block by some authors. We reserve the term block to
denote a set in a partition instead.

90
Lemma 4.11. Let S be a finite set where |S| > 1, and let x ∈ S. A transitive
permutation group G on S is primitive iff Gx is maximal in G.
See, e.g., [Wie64] for the proof of Lemma 4.11. We also need the following result,
proved in [LM85].
Theorem 4.1 ([LM85]). There exists a polynomial-time algorithm Tower that given
a number field K0 and a polynomial g(X) ∈ K0 [X] irreducible over K0 ,5 computes
a tower of relative number fields over K0
K0 ⊆ K1 ⊆ · · · ⊆ Kk−1 ⊆ Kk
together with the inclusions Ki−1 ,→ Ki and the polynomials gi (X) ∈ Ki−1 [X]
irreducible over Ki−1 for i ∈ [k], such that Kk ∼
=K0 K0 [X]/(g(X)), and the
following conditions are satisfied for i ∈ [k]:
1. Ki is isomorphic to Ki−1 [X]/(gi (X)) over Ki−1 , and
2. the Galois group Gi := Gal(Li /Ki−1 ) acts primitively on the set of roots of
gi in Li , where Li is the Galois closure of Ki /Ki−1 .
For i ∈ [k], let Hi := Gal(Li /Ki ) ⊆ Gi . See Figure 4.1 for an illustration. Note
that the first condition above is equivalent to Ki = Ki−1 (α) for some root αi of
gi in Li . So Hi is the stabilizer of αi . Then the second condition is equivalent to
maximality of Hi in Gi .
The following theorem is the main result of this section.
Theorem 4.2. Suppose there exists an algorithm PrimitiveAction that, given
a number field K0 and a polynomial g(X) ∈ K0 [X] irreducible over K0 with
Gal(g/K0 ) acting primitively on the set of roots of g in L, where L is the splitting
field of g over K0 , computes a (K0 , g)-subfield system in time T (K0 , g). Then there
exists an algorithm GeneralAction that given K0 and g as above, but without the
assumption that Gal(g/K0 ) acts primitively on S, computes
• a (K0 , g)-subfield system F, and,
5

The paper [LM85] presented their algorithm only for K0 = Q, but it easily extends to a general
base field K0 .

91
Hk
Kk

Lk
Gk
Kk−1
···

H2
K2

L2
G2
K1

L1
H1

G1
K0

Figure 4.1: The tower of fields and Galois groups in Theorem 4.1
• a tower of relative number fields K0 ⊆ K1 ⊆ · · · ⊆ Kk−1 ⊆ Kk over K0
and gi (X) ∈ Ki−1 [X] for i ∈ [k] satisfying the conditions in Theorem 4.1,
such that Kk ∼
=K0 K0 [X]/(g(X)) and the sizes of the polynomials gi are
polynomial in the size of the input
P
in time polynomial in ki=1 T (Ki−1 , gi ) and the size of the input. Moreover, if for
each i ∈ [k], the (Ki−1 , gi )-subfield system Fi computed by PrimitiveAction on
the input (Ki−1 , gi ) satisfies
1. Ki−1 [X]/(gi (X)) ∈ Fi ,
2. All strongly antisymmetric P-schemes are discrete (resp. inhomogeneous) on
H, where P is the subgroup system over Gal(gi /Ki−1 ) associated with Fi and
H is a subgroup in P whose fixed subfield is isomorphic to Ki over Ki−1 .
Then F satisfies
1. K0 [X]/(g(X)) ∈ F,
2. All strongly antisymmetric P-schemes are discrete (resp. inhomogeneous) on
H, where P is the subgroup system over Gal(g/K0 ) associated with F and
H is a subgroup in P satisfying LH ∼
=K0 K0 [X]/(g(X)).
See Algorithm 9 for the pseudocode of the algorithm GeneralAction. It proceeds
as follows: maintain F, which initially only contains K0 [X]/(g(X)). Then we

92
call the algorithm Tower to compute a tower K0 ⊆ K1 ⊆ · · · ⊆ Kk−1 ⊆ Kk
and gi (X) ∈ Ki−1 [X] for i ∈ [k] as in Theorem 4.1. Next, run the hypothetical
algorithm PrimitiveAction in Theorem 4.2 on (Ki−1 , gi ) for each i ∈ [k] to obtain
a (Ki−1 , gi )-subfield system Fi . For i ∈ [k], add the fields in Fi to F, but encode
them as relative number fields over K0 (using Lemma 4.6). In addition, avoid adding
fields to F that are isomorphic to some existent field K ∈ F over K0 , so that all the
fields in F are mutually non-isomorphic over K0 . After all Fi are processed, output
F.
Algorithm 9 GeneralAction
Input: number field K0 and g(X) ∈ K0 [X] irreducible over K0
Output: (K0 , g)-subfield system F
1: F ← {K0 [X]/(g(X))}
2: run Tower on (K0 , g) to obtain a tower K0 ⊆ K1 ⊆ · · · ⊆ Kk−1 ⊆ Kk and
gi (X) ∈ Ki−1 [X] irreducible over Ki−1 for i ∈ [k]
3: for i ← 1 to k do
4:
run PrimitiveAction on (Ki−1 , gi ) to obtain Fi
5:
for K ∈ Fi do
6:
compute a relative number field K 0 over K0 such that K 0 ∼
= K0 K
0
7:
if K is non-isomorphic to all fields in F over K0 then
8:
F ← F ∪ {K 0 }
9:

return F

The proof of Theorem 4.2 is based on the following lemma.
Lemma 4.12. Let k ∈ N+ and Gk ⊆ Gk−1 ⊆ · · · ⊆ G1 ⊆ G0 be a chain of
finite groups. For i ∈ [k], let Ni be a subgroup of Gi that is normal in Gi−1 ,
πi : Gi−1 → Gi−1 /Ni be the corresponding quotient map, and Pi be a subgroup
system over Gi−1 /Ni that contains Gi /Ni . Define
P = {gπi−1 (H)g −1 : 1 ≤ i ≤ k, H ∈ Pi , g ∈ G0 },
which is a subgroup system over G0 and contains πi−1 (Gi /Ni ) = Gi for all i ∈ [k].
Then we have
1. If for all i ∈ [k], all strongly antisymmetric Pi -schemes are discrete on Gi /Ni ,
then all strongly antisymmetric P-schemes are discrete on Gk .

93
2. If for some i ∈ [k], all strongly antisymmetric Pi -schemes are inhomogeneous
on Gi /Ni , then all strongly antisymmetric P-schemes are inhomogeneous on
Gk .
The same holds if strong antisymmetry is replaced by antisymmetry.
We defer the proof of Lemma 4.12 to Section 6.1.
Proof of Theorem 4.2. The claims about Ki and gi follow from Theorem 4.1. Use
the following notations for i ∈ [k]:
• Li : the splitting field of gi over Ki−1 , which is a subfield of L.
• Gi := Gal(Li /Ki−1 ) and Ni := Gal(L/Li ).
• πi : the natural projection Gal(L/Ki−1 ) → Gal(L/Ki−1 )/Ni ∼
= Gi .
• Pi : the subgroup system over Gi associated with Fi .
Then by construction, the subgroup system over Gal(L/K0 ) associated with F is
P := {gπi−1 (H)g −1 : 1 ≤ i ≤ k, H ∈ Pi , g ∈ G}.
Assume the conditions on Fi in Theorem 4.2 are satisfied. Then for all i ∈ [k],
all strongly antisymmetric Pi -schemes are discrete (resp. inhomogeneous) on
Gal(Li /Ki ) ∈ Pi . Applying Lemma 4.12 to the chain
Gal(L/Kk ) ⊆ Gal(L/Kk−1 ) ⊆ · · · ⊆ Gal(L/K1 ) ⊆ Gal(L/K0 )
and Ni , πi , Pi , we conclude that all strongly antisymmetric P-schemes are discrete
(resp. inhomogeneous) on the subgroup Gal(L/Kk ) ∈ P. And the corresponding
fixed subfield Kk is isomorphic to K0 [X]/(g(X)) over K0 , as desired.
The total running time of the algorithm PrimitiveAction and the total size of Fi
P
are both bounded by ki=1 T (Ki−1 , gi ). The other operations take time polynomial
in the total size of Fi and the size of the input. The claim about the running time
follows.
As an application, we prove the main result of [Evd92] for the special case that the
input polynomial satisfies Condition 3.1 (i.e., it is defined over Fp , square free, and
complete reducible over Fp ).

94
Theorem 4.3 ([Evd92]). Under GRH, there exists a deterministic polynomial-time
algorithm that, given a polynomial f (X) ∈ Fp [X] satisfying Condition 3.1 and a
lifted polynomial f˜(X) ∈ Z[X] of f whose Galois group Gal(f˜/Q) is solvable,
computes the complete factorization of f over Fp .
The proof relies on the following bound for the orders of primitive solvable permutation groups, proved by Pálfy [Pál82].
Theorem 4.4 ([Pál82]). Let G be a primitive solvable permutation group on a set
of cardinality n ∈ N+ . Then |G| ≤ 24−1/3 nc for a constant c = 3.24399 . . . .
Proof of Theorem 4.3. As in Section 6, we factorize f˜ into its irreducible factors
f1 (X), . . . , fk (X) ∈ Z[X] over Q in polynomial time using the factoring algorithm
in [LLL82]. The Galois groups Gal(f˜i (X)/Q) are quotient groups of Gal(f˜/Q),
and hence are solvable as well. By replacing f˜(X) with f˜i (X) and f (X) with
fi (X) := f˜i (X) mod p ∈ Fp [X] for each i ∈ [k], we reduce to the case that f˜ is
irreducible over Q.
Let L be the splitting field of f˜ over Q. When Gal(f˜/Q) acts primitively on
the set of roots of f˜ in L, its order is bounded by a polynomial in deg(f ) by
Theorem 4.4. Then by Theorem 4.9, we can construct F in polynomial time such
that Q[X]/(f˜(X)) ∈ F and all strongly antisymmetric P-schemes are discrete on
H, where P is the subgroup system over Gal(f˜/Q) associated with F and H is a
subgroup in P satisfying LH ∼
= Q[X]/(f˜(X)). By Theorem 4.2, we also have a
polynomial-time algorithm of constructing such F in the general case. The theorem
then follows from Theorem 3.9.
In Chapter 5, we prove a generalization of Theorem 4.3 (see Theorem 5.13), which
implies the main result of [Evd92] in its general form. In particular, the assumption
that f˜ satisfies Condition 3.1 is no longer required.
4.4

Other techniques of constructing number fields

In this section, we survey some other techniques of constructing number fields.
While we do not use these techniques directly in the thesis, they are worth mentioning
because of their own interest and their applications to other problems [Lan84; LM85;
Len92; Coh93].

95
Taking the compositum of number fields. Note that the fields computed in
the two algorithms SplittingField and Stabilizers in Section 4.2 are (up to
isomorphism over K0 ) compositums of conjugates of the field K0 [X]/(g(X)). The
general problem of constructing the compositum of (relative) number fields is solved
by the following lemma.
Lemma 4.13. There exists a polynomial-time algorithm that given a number field
K0 and relative number fields K, L over K0 , constructs all the compositums K 0 L0
up to isomorphism over K0 where K 0 (resp. L0 ) ranges over the conjugates of K
(resp. L) over K0 in the algebraic closure K̄0 of K0 .6
Proof. Take the irreducible polynomial g(X) ∈ K0 [X] that encodes L, i.e., L ∼
= K0
K0 [X]/(g(X)). Factorize g(X) into irreducible polynomials g1 (X), . . . , gk (X)
over K. Then compute and output the fields K[X]/(g1 (X)), . . . , K[X]/(gk (X)).
To see that this gives the desired output, note that we may fix K = K 0 as fields
are constructed only up to isomorphism over K0 . Let α1 , . . . , αn be the roots of g
in K̄0 , where n = deg(g). Then the conjugates of L in K̄0 over K0 are precisely
K0 (α1 ), . . . , K0 (αn ). For i ∈ [n], there exists a unique ji ∈ [k] such that αi is the root
of gji , and the compositum of K and K0 (αi ) is just K(αi ) ∼
=K0 K[X]/(gji (X)).
Taking the intersection of number fields. The intersection of two number fields
can be computed efficiently, as shown in [LM85].
Theorem 4.5 ([LM85]). There exists a polynomial-time algorithm that given
• number fields K = Q(α), K 0 = Q(β) encoded by the minimal polynomials
of primitive elements α ∈ K and β ∈ K 0 over Q respectively, and
• the minimal polynomial h0 (X) ∈ K[X] of β over K,7
computes the number field K ∩ K 0 up to isomorphism.
The algorithm in [LM85] also extends to relative number fields. We omit the details.
6

Here K and L are embedded in K̄0 via some K0 -linear embeddings. The choices of these
embeddings do not matter as we construct K 0 L0 for all the conjugates K 0 and L0 over K0 .
7
The polynomial h0 is needed for the problem to be well defined.

96
Adjoining a square root of the discriminant. Suppose K is a relative number
field over K0 encoded by the minimal polynomial h(X) ∈ K0 [X] of a primitive
element α ∈ K over K0 . Let L be the Galois closure of K/K0 and let G =
Gal(L/K0 ). Then G acts on the set S of roots of h in L and hence can be identified
with a subgroup of Sym(S).
Suppose S = {α1 , . . . , αn }. Define the discriminant of h to be
∆h :=

Y

(αi − αj )2 .

1≤i<j≤n

We have g ∆h = ∆h for all g ∈ G. So ∆h ∈ LG = K0 .
√
√
Q
Now consider the subfield K00 := K0 ( ∆h ) of L, where ∆h := 1≤i<j≤n (αi −αj )
√
is a square root of ∆h in L. A permutation g ∈ G fixes ∆h precisely when g is an
even permutation of S, which implies
Gal(L/K00 ) = G ∩ Alt(S).
With this observation, we have
Lemma 4.14. There exists a polynomial-time algorithm that given a number field
K0 and a relative number field K over K0 encoded by h(X) ∈ K0 [X], computes
LG∩Alt(S) up to isomorphism over K0 , where L is the Galois closure of K/K0 ,
G = Gal(L/K0 ), and S is the set of roots of h in L.
√
Proof. We have LG∩Alt(S) = K0 ( ∆h ) by the above discussion. Let n = deg(h).
Then discriminant ∆h satisfies the identity
∆h = (−1)n(n−1)/2 Res(h, h0 ),
where Res(h, h0 ) denotes the resultant of h and its derivative h0 . and is given by
the determinant of the Sylvester matrix associated with h and h0 [Lan02]. Thus
we can compute ∆h in polynomial time. Then we test if ∆h is a square in K0
√
by factoring X 2 − ∆h over K0 . If ∆h is a square, we have K0 ( ∆h ) = K0 and
correspondingly G ⊆ Alt(S). In this case we just output K0 . Otherwise we output
K0 [X]/(X 2 − ∆h ).
Remark. The technique above was used in [Lan84] for the determination of the
Galois groups of number field extensions. It is not clear, however, if it helps for
the problem of polynomial factoring over finite fields. We note that replacing K0

97
√
with K00 = K0 ( ∆h ) and K with K00 K has the effect of reducing the Galois group
G to G ∩ Alt(S), but the order of G is reduced by at most a factor of two. This
does not help in the case that G = Sym(S) and P is a system of stabilizers of
depth m ≤ |S| − 2 (with respect to the natural action of G): As both Sym(S)
and Alt(S) are k-transitive for k = |S| − 2, P-schemes for Sym(S) and those for
Alt(S) both correspond to m-schemes on S (see Theorem 2.1), and hence they are
the equivalent.
Computing the fixed subfield of the automorphism group. The following
lemma gives a characterization of the fixed subfield of an automorphism subgroup.
Lemma 4.15. Suppose K/K0 is a field extension and α is a primitive element of K
over K0 . For a subgroup U ⊆ Aut(K/K0 ), the field K U is generated by elementary
symmetric polynomials in the elements g α (indexed by g ∈ U ) over K0 .
Proof. Let K 0 be the subfield of K generated by elementary symmetric polynomials
in g α, g ∈ U over K0 . We obviously have K 0 ⊆ K U . By Galois theory, it holds that
[K : K U ] = |U | (see, e.g., [Lan02, Section VI.1, Theorem 1.8]). So it suffices to
prove [K : K 0 ] ≤ |U |.
Q
Consider the polynomial φ(X) = g∈U (X − g α). The coefficients of φ(X) are,
up to sign, given by elementary symmetric polynomials in g α, g ∈ U and hence
φ(X) ∈ K 0 [X]. As φ(α) = 0, the minimal polynomial of α over K 0 divides φ(X),
and its degree is at most deg(φ) = |U |. So we have [K 0 (α) : K 0 ] ≤ |U |. The claim
follows by noting that K 0 (α) = K.
Lemma 4.15 provides a method of computing the fixed subfield of the automorphism
group Aut(K/K0 ):
Theorem 4.6. There exists a polynomial-time algorithm that given a number field K0
and a relative number field K over K0 , computes the fixed subfield K Aut(K/K0 ) ⊆ K.
Proof. Suppose K is encoded by the minimal polynomial of a primitive element α
over K0 . We compute all the automorphisms of K in Aut(K/K0 ) using Lemma 4.7.
Then we adjoining to K0 the first k elementary symmetric functions in g α, g ∈
Aut(K/K0 ) where k = |Aut(K/K0 )|. The resulting field is exactly K Aut(K/K0 ) by
Lemma 4.15.

98
More generally, given K0 , K and a subgroup U ⊆ Aut(K/K0 ) of automorphisms
of K, the same proof shows that K U can be constructed in polynomial time.
Now suppose L is a Galois extension of K0 that contains K. Let G = Gal(L/K0 )
and H = Gal(L/K). Then Aut(K/K0 ) is identified with NG (H)/H, and we have
K Aut(K/K0 ) = K NG (H)/H = LNG (H) . So Theorem 4.6 states that LNG (H) can be
constructed in polynomial time given K = LH and K0 . In the context of polynomial
factoring using the P-scheme algorithm, this means that we can efficiently enlarge
a subgroup system P by including the normalizers NG (H) of H ∈ P.
A natural question arising from this observation is whether adding the normalizers
(or more generally subgroups between NG (H) and H) to the subgroup system helps a
P-scheme algorithm obtain the complete factorization (resp. a proper factorization).
By Theorem 3.9, this reduces to the question whether it helps for proving all strongly
antisymmetric P-schemes are discrete (resp. inhomogeneous) on a distinguished
subgroup H ∈ P.
For discreteness of strongly antisymmetric P-schemes, we give an affirmative answer in general: we show that for some subgroup system P and H ∈ P, there
exist strongly antisymmetric P-schemes that are not discrete on H, but adding
normalizers to the subgroup system rules out their existence.
Example 4.1. Choose a finite group G and a subgroup H ⊆ G such that NG (H) is a
proper normal subgroup of G.8 Choose P = {gHg −1 : g ∈ G} which is a subgroup
system over G. Define a P-collection C = {CH 0 : H 0 ∈ P} as follows: the group
NG (H) acts on H\G by left translation g Hh = Hgh and H\G is partitioned into
NG (H)-orbits. Choose a complete set of representatives B ⊆ H\G for these orbits.
Define CH = {g B : g ∈ NG (H)}. For any other subgroup H 0 in P, choose g ∈ G
such that H 0 = gHg −1 , and define CH 0 = {cH,g (B) : B ∈ CH }. It is easy to
see that C is a well defined strongly antisymmetric P-scheme. Moreover, it is not
discrete on H since NG (H) does not act transitively on H\G.
Now define P 0 = P ∪ {NG (H)} which is also a subgroup system over G. We claim
that any antisymmetric P 0 -schemes C 0 must be discrete on any subgroup in P 0 . To
see this, note that C 0 is discrete on NG (H) ∈ P 0 since NG (H) is normal in G. Then
C 0 is also discrete on all the other subgroups H 0 ∈ P 0 by compatibility, and the claim
follows. In particular, it is impossible to extend C to an antisymmetric P 0 -scheme.
8

For example, we may choose G to be the semidirect product (K × K) o C2 , where K is a
nontrivial finite group and C2 permutes the two direct factors of K × K. Let H = K × {e}. Then
NG (H) = K × K E G.

99
Despite the example above, adding normalizers to the subgroup system seems not
helpful for attacking the most difficult cases in polynomial factoring: for a subgroup
system P over a finite group G, define
P+ = {U : H ⊆ U ⊆ NG (H), H ∈ P},
which is also a subgroup system over G. For several important families of permutation groups, we show that if P is the corresponding system of stabilizers of
certain depth m (where m is not too large), any P-scheme C can be extended to a
P+ -scheme C 0 with antisymmetry and strong antisymmetry preserved. In particular,
if C is not discrete or inhomogeneous on some subgroup H ∈ P, then neither is C 0 .
Lemma 4.16. Let S be a finite set and let G be Sym(S) or Alt(S) acting naturally
on S. Let P be the system of stabilizers of depth m over G with respect to this action
where m < |S|/2. Then any P-scheme C can be extended to a P+ -scheme C 0 such
that C 0 is antisymmetric (resp. strongly antisymmetric) if so is C.
Lemma 4.17. Let V be a finite dimensional vector space over a finite field and let G
be GL(V ) acting naturally on S := V − {0}. Let P be the system of stabilizers of
depth m over G with respect to this action where m < dimF V . Then any P-scheme
C can be extended to a P+ -scheme C 0 such that C 0 is antisymmetric (resp. strongly
antisymmetric) if so is C.
We defer the proofs of Lemma 4.16 and Lemma 4.17 to Section 6.4 . There we
define the closure Pcl of a subgroup system P, and then show that P-schemes can
always be extended to Pcl -schemes with antisymmetry and strong antisymmetry
preserved. Lemma 4.16 and Lemma 4.17 then follow immediately once we verify
that Pcl = P+ in these cases.

100
Chapter 5

THE GENERALIZED P-SCHEME ALGORITHM
In Chapter 3, we developed the P-scheme algorithm that factorizes polynomials
satisfying Condition 3.1, i.e., they are defined over a prime field Fp , square-free, and
completely reducible over Fp . In this chapter, we extend this algorithm to factorize
general polynomials f (X) ∈ Fq [X] over a finite field Fq of characteristic p. The
generality is reflected in the following three aspects: (1) Fq may be a non-prime
field, (2) the degrees of the irreducible factors of f may be greater than one, and (3)
the multiplicities of the irreducible factors of f may be greater than one.
Motivation. Techniques like Berlekamp’s reduction [Ber70], square-free factorization [Yun76; Knu98] and distinct-degree factorization [CZ81] were commonly
used in literature to reduce the problem to the special case that the input polynomial
satisfies Condition 3.1. However, these reductions do not preserve the information
of the lifted polynomial f˜ employed by the P-scheme algorithm. Therefore, it is
desirable to avoid these reductions and extend the P-scheme algorithm to the general
setting instead.
As a concrete example, consider the following polynomial f˜(X) ∈ Z[X] irreducible
over Q, taken from [KM00]:
f˜(X) =X 14 + 28X 11 + 28X 10 − 28X 9 + 140X 8 + 360X 7 + 147X 6
+ 196X 5 + 336X 4 − 546X 3 − 532X 2 + 896X + 823.
For p = 43, the reduced polynomial f (X) = f˜(X) mod p has seven distinct linear
factors and one irreducible factor of degree 7 over Fp :
f (X) =(X + 2)(X + 4)(X + 9)(X + 19)(X + 23)(X + 30)(X + 42)
(X 7 + 14X 4 + 15X 3 + 31X 2 + 15X + 38).
The standard way of factoring f over Fp is first applying distinct-degree factorization
[CZ81] to obtain a partial factorization f = f0 f1 , where
f0 (X) = (X + 2)(X + 4)(X + 9)(X + 19)(X + 23)(X + 30)(X + 42)
is the product of the linear factors and satisfies Condition 3.1. Then we factorize
f0 over Fp . To achieve this goal deterministically, we pick a lifted polynomial

101
f˜0 (X) ∈ Z[X] of f , which we may assume to be irreducible, and run the P-scheme
algorithm in Chapter 3. Suppose the (Q, f˜)-subfield system in the algorithm is
constructed by Lemma 3.21 and the associated subgroup system P is the system of
stabilizers of depth m, where m ∈ N+ is sufficiently large. In the worst case, the
action of Gal(f˜0 /Q) on the set of roots of f˜ is permutation isomorphic to the natural
action of the symmetric group Sym(7) on [7]. Then we need m ≥ 3 to obtain a
proper factorization of f , since by Theorem 2.1 and Lemma 2.19, there exists a
strongly antisymmetric P-scheme homogeneous on a stabilizer if m ≤ 2.1
On the other hand, the action of the Galois group of f˜ on the set of roots of f˜ is
permutation isomorphic to the action of the wreath product2 C7 o C2 on [7] × [2],
where C7 permutes [7] cyclically and C2 permutes the two copies of [7]. This
action has a base of size two, which suggests that choosing m = 2 is sufficient
for completely factoring f , provided that we have a generalization of Theorem 3.2
that employs the polynomial f˜. The goal of this chapter is to establish such a
generalization.
The example above generalizes to an infinite family of instances: for every k ∈ N+ ,
there exists f˜(X) ∈ Z[X] irreducible over Q of degree 2k such that the action of the
Galois group on the set of roots of f˜ is permutation isomorphic to the action of Ck oC2
on [k] × [2].3 And for such f˜, there exists infinitely many prime numbers p such
that f (X) = f˜(X) mod p has k distinct linear factors and one irreducible factor of
degree k.4 Using the generalized P-scheme algorithm developed in this chapter,
it is sufficient to choose m = 2 in order to completely factorize f˜ mod p, leading
to a polynomial-time factoring algorithm for such instances (f, f˜). On the other
hand, using distinct-degree factorization and the P-scheme algorithm in Chapter 3,
the best known general upper bound for m is O(log k) (see Theorem 3.12), and the
resulting algorithm takes superpolynomial time.
Lifted polynomial. To formulate the main result of this chapter, we first need
to generalize the notion of lifted polynomials (see Definition 1.1). Recall that
a lifted polynomial of f (X) ∈ Fp [X] is a polynomial f˜(X) ∈ Z[X] of degree
1

For the same reason, one needs to choose m ≥ 3 if the m-scheme algorithm [IKS09] is used.
For the definition of the wreath product of groups, see Definition 6.11.
3
Shafarevich’s theorem on solvable Galois groups [Sha54; ILF97] implies that the existence of
integral polynomials realizing the family of groups Ck o C2 as Galois groups. For an algorithm
explicitly computing such a polynomial, see [KM00].
4
This follows from Chebotarëv’s density theorem. See, e.g., [Neu99].
2

102
deg(f ) satisfying f˜(X) mod p = f (X). For the general case Fq = Fpd , we fix
the following notations: assume Fq is encoded by a monic irreducible polynomial
h(Y ) ∈ Fp [Y ] of degree d, i.e., it is identified with Fp [Y ]/(h(Y )) via an isomorphism ψ0 : Fp [Y ]/(h(Y )) → Fq which we can efficiently compute. Lift h to a
monic polynomial h̃(Y ) ∈ Z[Y ] of degree d which is necessarily irreducible over
Q. Define A0 := Z[Y ]/(h̃(Y )) and K0 := Q[Y ]/(h̃(Y )). Composing ψ0 with the
natural projection A0 → Fp [Y ]/(h(Y )) sending x to x mod p, we obtain a surjective ring homomorphism ψ̃0 : A0 → Fq . Finally extend ψ̃0 to the ring A0 [X] by
applying it to each coefficient:
ψ̃0 : A0 [X] → Fq [X].
With these notations, we generalize the definition of lifted polynomials as follows.
Definition 5.1 (lifted polynomial). Suppose f (X) ∈ Fq [X] is a polynomial of
degree n ∈ N+ . A lifted polynomial of f (with respect to h̃ and ψ0 ) is a polynomial
f˜(X) ∈ A0 [X] of degree n satisfying ψ̃0 (f˜) = f . An irreducible lifted polynomial
of f is a lifted polynomial of f that is irreducible over K0 .
Given f (X) ∈ Fq [X], we can choose a lifted polynomial f˜ of f efficiently. Furthermore, we argue that f˜ can be assumed to be irreducible over K0 . To see this, we
need the following lemma.
Lemma 5.1. There exists a polynomial-time algorithm that given p and a polynomial f˜(X) ∈ A0 [X] satisfying ψ̃0 (f˜) 6= 0, computes an integer D satisfying
D ≡ 1 (mod p) and a factorization of D · f˜ into irreducible factors f˜i over K0 .
Furthermore all of the factors f˜i (X) are in A0 [X].
The proof can be found in Appendix C. Compute D and fi using the lemma above.
We have ψ̃0 (D · f˜) = ψ̃0 (f˜) = f since D ≡ 1 (mod p). So the polynomials ψ̃0 (f˜i )
are factors of f , and we have reduced the problem to factoring each ψ̃0 (f˜i ) ∈ Fq [X]
using its irreducible lifted polynomial f˜i .
The discussion above justifies the assumption that an irreducible lifted polynomial
f˜ of f is given, with respect to h̃ and ψ0 . The notations h̃, ψ0 , A0 , and K0 are fixed
throughout this chapter.
Main result. The main result of this chapter is a generalization of Theorem 3.2:

103
Theorem 5.1 (informal). Suppose there exists a deterministic algorithm that given a
polynomial g(X) ∈ A0 [X] irreducible over K0 , constructs in time T (g) a collection
F of subfields of the splitting field L of g over K0 such that
• F = K0 [X]/(g(X)) is in F, and
• all strongly antisymmetric P-schemes are discrete on Gal(L/F ) ∈ P, where
P is the subgroup system associated with F.
Then under GRH, there exists a deterministic algorithm that given f (X) ∈ Fq [X]
and an irreducible lifted polynomial f˜(X) ∈ A0 [X] of f , outputs the complete
factorization of f over Fq in time polynomial in T (f˜) and the size of the input.
See Theorem 5.9 for the formal statement. For simplicity, here we only state the
result for computing the complete factorization of f . The results for computing a
proper factorization are slightly more complicated to state, and we refer the reader
to Section 5.10 for details.
Overview of the generalized P-scheme algorithm
Recall that a P-scheme algorithm in Chapter 3 consists of three parts: (1) a reduction
to the problem of computing an idempotent decomposition of the ring ŌF , where
F = Q[X]/(f˜(X)), (2) computing idempotent decompositions for a collection
of number fields, and (3) constructing the collection of number fields used in the
previous part. The factoring algorithm in this chapter has the same structure but with
some differences: we generalize the reduction in Part (1), where F now denotes the
number field K0 [X]/(f˜(X)). And in Part (3), we construct a collection of relative
number fields over K0 instead of ordinary number fields. The main difference is in
Part (2), which we now explain.
P-schemes of double cosets. In Chapter 3, we proved that for a subfield K of the
splitting field L of f˜, G the Galois group of f˜, and H = Gal(L/K), an idempotent
decomposition of the ring ŌK corresponds to a partition of the right coset space
H\G. The crucial condition for this claim to hold is that p splits completely in the
splitting field L of f˜, which in turn relies on the assumption that f is square-free
and completely reducible over the field of definition. In general, one can prove that
an idempotent decomposition of ŌK corresponds to a partition of the double coset
space H\G/DQ0 instead of the right coset space H\G, where DQ0 ⊆ G is known

104
as the decomposition group (of a fixed prime ideal Q0 of OL over K0 ). For the
special case studied in Chapter 3, the decomposition group DQ0 is trivial, and hence
the double coset space H\G/DQ0 coincides with the right coset space H\G.
To address the general case, we define the notion of P-collections (resp. P-schemes)
of double cosets, generalizing (ordinary) P-collections (resp. P-schemes). Various
properties including (strong) antisymmetry, discreteness and homogeneity can be
extended to P-schemes of double cosets. In addition, as the rings ŌK are not
necessarily semisimple in general, we replace them with the rings RK , defined by

RK := x ∈ ŌK /Rad(ŌK ) : xp = x ,
where Rad(ŌK ) denotes the radical of ŌK . These rings have the advantage of
being finite products of Fp , so that we can directly use the results in Chapter 3. Then
we generalize the algorithm in Chapter 3 to compute a collection of idempotent
decompositions of the rings RK so that they correspond to a strongly antisymmetric
P-schemes of double cosets.
In addition, we introduce the following notations concerning partitions of double
coset spaces: for every double coset HgDQ0 ∈ H\G/DQ0 where H ⊆ G, we
associate two positive integers f (HgDQ0 ) and e(HgDQ0 ), called the inertia degree
and the ramification index of HgDQ0 respectively.5 Then we say a partition P of
H\G/DQ0 has locally constant inertia degrees (resp. ramification indices) if for
every block B in P , all the double cosets in B have the same inertia degree (resp.
ramification index). We design efficient algorithms that force the partitions in a Pcollection of double cosets to have locally constant inertia degrees and ramification
indices. These algorithms may be regarded as the analogues of distinct-degree
factorization [CZ81] and square-free factorization [Yun76; Knu98] that factorize a
polynomial according to the degrees and the multiplicities of the irreducible factors.
The discussion above is summarized by the following theorem, which generalizes
Theorem 3.1 in Chapter 3.
Theorem 5.2 (informal). Under GRH, there exists a deterministic algorithm that
given a poset P ] of number fields between K0 and L corresponding to a poset
P of subgroups of G, outputs idempotent decompositions of RK for K ∈ P ]
5

These names come from the fact that f (HgDQ0 ) (resp. e(HgDQ0 )) is the inertia degree
(resp. ramification index) of the prime ideal of OLH lying over p corresponding to HgDQ0 . See
Definition 5.2 for details.

105
corresponding to a strongly antisymmetric P-scheme of double cosets C with respect
to DQ0 . Moreover, all the partitions in C have locally constant inertia degrees and
ramification indices. The running time is polynomial in the size of the input.
From a P-scheme of double cosets to an ordinary P-scheme. Theorem 5.2 is
still not enough for proving our main result (Theorem 5.1), since the algorithm in
Theorem 5.2 only produces a strongly antisymmetric P-scheme of double cosets
rather than an (ordinary) P-scheme. While strongly antisymmetric P-schemes of
double cosets are interesting objects, we do not know if their existence implies the
existence of strongly antisymmetric (ordinary) P-schemes.
To overcome this problem, we strengthen the algorithm by maintaining not only
idempotent decompositions of a collection of rings RK , but also elements in rings
of the form ŌK or (ŌK /Rad(ŌK )) ⊗Fq Fqi , i ∈ N+ . More specifically, we compute
auxiliary elements sδ ∈ ŌK (resp. tδ ∈ (ŌK /Rad(ŌK )) ⊗Fq Fqi ) for number
fields K and idempotents δ. Then we define a P-collection C˜ based on these
auxiliary elements and the P-scheme of double cosets C computed in Theorem 5.2.
Moreover, we describe subroutines that properly refines the partitions in C unless C˜
is a strongly antisymmetric P-scheme. This allows us to strengthen Theorem 5.2
so that the algorithm produces a strongly antisymmetric (ordinary) P-scheme C˜ in
addition to a P-scheme of double cosets. See Theorem 5.8 for the formal statement.
Our main result (Theorem 5.1) then follows easily.
Outline of the chapter. Notations and mathematical preliminaries are given in
Section 5.1, and algorithmic preliminaries are given in Section 5.2. In Section 5.3,
we reduce the problem of factoring f to that of computing an idempotent decomposition of RF . In Section 5.4, we give (a preliminary version of) the main body of the
algorithm that computes idempotent decompositions corresponding to a strongly
antisymmetric P-scheme of double cosets. This P-scheme also has the property
that all of its partitions have locally constant inertia degrees and ramification indices,
as guaranteed by the subroutines described in Section 5.5 and Section 5.6.
The next three sections address the problem of producing an (ordinary) P-scheme
from the above P-scheme of double cosets. More specifically, in Section 5.7, we
give a subroutine that computes the auxiliary elements sδ and tδ , and use these
˜ In Section 5.8, we introduce a property about
elements to define a P-collection C.
P-collections called (C, D)-separatedness, and use it to give a criterion for C˜ being
a strongly antisymmetric P-scheme. In Section 5.9, we modify the algorithm in

106
Section 5.4 to produce a strongly antisymmetric P-scheme, based on the results in
Section 5.7 and Section 5.8.
Finally, in Section 5.10, we combine the results in previous sections to obtain the
generalized P-scheme algorithm, and use it to prove the main result of this chapter
(Theorem 5.1). Using the algorithm, we also obtain generalizations of the main
results in [Hua91a; Hua91b; Rón88; Rón92; Evd92; Evd94; IKS09].
5.1

Preliminaries

For a number field K, denote by ŌK the quotient ring OK /pOK . For K0 =
Q[Y ]/(h̃(Y )), we have
Lemma 5.2. The ideal pOK0 is a prime ideal of OK0 . And ŌK0 ∼
= Fq .
Proof. Let Ȳ := Y + (h̃(Y )) ∈ OK0 . Consider the ring homomorphism i :
Fp [Y ]/(h(Y )) → ŌK0 sending Y +(h(Y )) to Ȳ +pOK0 . Clearly i is a nonzero map
since i(1) = 1. As Fp [Y ]/(h(Y )) is a field, the map i is injective. As Fp [Y ]/(h(Y ))
and ŌK0 both have dimension deg(h) over Fp , the map i is an isomorphism. So
ŌK0 ∼
= Fp [Y ]/(h(Y )) ∼
= Fq and pOK0 is prime.
In the following, we give some notations and facts from algebraic number theory.
The proofs can be found in standard references like [Neu99].
Splitting of prime ideals. Let K be a finite extension of K0 . The ideal pOK splits
in the unique way into a product of prime ideals of OK , up to the ordering:
pOK =

k
Y
i=1

e(P )
Pi i

=

k
\

e(Pi )

Pi

,

i=1

where P1 , . . . , Pk are distinct and e(Pi ) ∈ N+ . We say P1 , . . . , Pk are the prime
ideals of OK lying over p. For i ∈ [k], define κPi := OK /Pi which is a finite field,
called the residue field of Pi . The inclusion OK0 ,→ OK induces an embedding of
ŌK0 ∼
= Fq in κPi , making κPi an extension field of ŌK0 . Let f (Pi ) := [κPi : ŌK0 ].
We call e(Pi ) and f (Pi ) the ramification index and the inertia degree of Pi (over
pOK0 ) respectively. It holds that
k
X
i=1

e(Pi )f (Pi ) = [K : K0 ].

107
Vector spaces Pi /Pi+1 . We also use the following facts implicitly:
For a number field K, i ∈ N and a nonzero prime ideal P of OK , the abelian group
Pi /Pi+1 is an one-dimensional vector space over the field κP = OK /P, where the
scalar multiplication is defined by
(u + P) · (v + Pi+1 ) = uv + Pi+1

for u ∈ OK , v ∈ Pi .

For i, j ∈ N and u ∈ Pi − Pi+1 , the map
x + Pj+1 7→ ux + Pi+j+1
is an isomorphism from Pj /Pj+1 to Pi+j /Pi+j+1 , both regarded as vector spaces
over κP . In particular, for i, j ∈ N and u ∈ Pi − Pi+1 , we have uj ∈ Pij − Pij+1 .
Now suppose K, K 0 are finite extensions of K0 and K ⊆ K 0 . And P, Q are prime
ideals of OK and OK 0 respectively, both lying over p, such that Q ∩ OK = P.
Then e(P) divides e(Q) and f (P) divides f (Q). And for i ∈ N, the inclusion
0
0
OK ,→ OK 0 induces an inclusion Pi /Pi+1 ,→ Qi /Qi +1 where i0 = i · e(Q)/e(P).
The decomposition group and the inertia group. Let L/K0 be a Galois extension
of number fields with the Galois group G = Gal(L/K0 ). Let P be a prime ideal of
OL lying over p. The group
DP := {g ∈ G : g P = P} ⊆ G
is called the decomposition group of P over K0 . And the group
IP := {g ∈ G : g x ≡ x (mod P) for all x ∈ OL }
is a normal subgroup of DP , called the inertia group of P over K0 . Each automorphism g ∈ DP of L restricts to an automorphism of OL fixing OK0 and satisfying
g
P = P, and hence induces an automorphism ḡ of the residue field κP fixing ŌK0 ,
defined by
ḡ
(x + P) = g x + P.
The map π : g 7→ ḡ is a surjective group homomorphism from DP to Gal(κP /ŌK0 )
whose kernel is precisely IP , i.e, we have a short exact sequence
π

1 → IP → DP →
− Gal(κP /ŌK0 ) → 1.
The Galois group Gal(κP /ŌK0 ) is cyclic and is generated by the Frobenius automorphism x 7→ xq of κP over ŌK0 ∼
= Fq .

108
The wild inertia group. Let L, G and P be as above. The group
WP := {g ∈ G : g x ≡ x (mod P2 ) for all x ∈ OL }.
is a normal subgroup of IP , called the wild inertia group of P over K0 .
Choose πL ∈ P − P2 . We have a group homomorphism IP → κ×
P sending g ∈ IP
×
g
2
to the unique element cg ∈ κP satisfying πL + P = cg (πL + P2 ). This map is
independent of the choice of πL , and its kernel is precisely WP . It is also known
that WP is a p-group. See [Neu99, Section II.10].
In our factoring algorithm, the group G is a subgroup of Sym(n) where n is the
degree of the input polynomial f (X) ∈ Fq [X]. We can always assume p > n,
since the case p ≤ n is solved in polynomial time by Berlekamp’s algorithm in
[Ber70]. Under this assumption, the p-subgroup WP of G is trivial, and hence the
map IP → κ×
P above is injective. In particular, the inertia group IP is cyclic.
Prime ideals vs. double cosets. We have the following generalization of Theorem 3.4, which gives a one-to-one correspondence between prime ideals lying over
p and double cosets. See [Neu99] for its proof.
Theorem 5.3. Let L/K0 be a Galois extension of number fields and let G =
Gal(L/K0 ). Fix a prime ideal Q0 of OL lying over p. For any subgroup H ⊆ G
and the corresponding fixed subfield K = LH , the map HgDQ0 7→ g Q0 ∩ OK is a
one-to-one correspondence between the double cosets in H\G/DQ0 and the prime
ideals of OK lying over p.6 Moreover, for g ∈ G and the prime ideal P = g Q0 ∩ OK
corresponding to HgDQ0 , define
n(P) := |{Hh ∈ H\G : HhDQ0 = HgDQ0 }|.
Then
e(P) = |{Hh ∈ H\G : HhIQ0 = HgIQ0 }|

and

f (P) =

n(P)
.
e(P)

Motivated by Theorem 5.3, we define the ramification index and the inertia degree
of a double coset:
6

Note that this map is well defined: for another representative hgh0 ∈ G of HgDQ0 , where
0
h
h ∈ H and h0 ∈ DQ0 , we have hgh Q0 ∩ OK = hg Q0 ∩ OK = (g Q0 ∩ OK ) = g Q0 ∩ OK since
h0
Q0 = Q0 and OK is fixed by H.

109
Definition 5.2. Let G be a finite group, H, D subgroups of G, and I a normal
subgroup of D. Define the ramification index of a double coset HgD ∈ H\G/D
with respect to (D, I) to be
e(HgD) := |{Hh ∈ H\G : HhI = HgI}|,
which is well defined.7 And define the inertia degree of HgD with respect to (D, I)
to be
|{Hh ∈ H\G : HhD = HgD}|
f (HgD) :=
.
e(HgD)
Suppose L/K0 is a Galois extension of number fields with the Galois group G. Fix
a prime ideal Q0 of OL lying over p. Let H be a subgroup of G and K = LH .
Then by Theorem 5.3, the ramification index (resp. inertia degree) of a double coset
HgDQ0 ∈ H\G/DQ0 with respect to (DQ0 , IQ0 ) is precisely the ramification index
(resp. inertia degree) of the corresponding prime ideal g Q0 ∩ OK of OK .
We also introduce the following notations concerning partitions of a double coset
space.
Definition 5.3. Let G, H, D, I be as in Definition 5.2. We say a partition P
of H\G/D has locally constant ramification indices (resp. inertia degrees) with
respect to (D, I) if for every B ∈ P , all the double cosets in B have the same
ramification index (resp. inertia degree) with respect to (D, I). For such a partition
P and any B ∈ P , denote by e(B) (resp. f (B)) the ramification index (resp. inertia
degree) of any double coset in B.
Radicals of rings and polynomials. Let A be a (commutative) ring. An element
x ∈ A is nilpotent if xk = 0 for some k ∈ N+ . The radical (or nilradical) of A,
denoted by Rad(A), is the ideal consisting of the nilpotent elements of A. It equals
the intersection of all the prime ideals of A (see [AM69]).
Let g(X) ∈ Fq [X] be a non-constant polynomial with the following factorization
k
Y
g(X) = c ·
(gi (X))mi
i=1
7

To see that e(HgD) is well defined, consider two representatives g and g 0 of HgD. Then
g 0 = sgt for some s ∈ H and t ∈ D. Note that HhtI = HhIt for all h ∈ G. It follows that the map
Hh 7→ Hht is a bijection from {Hh ∈ H\G : HhI = HgI} to {Hh ∈ H\G : HhI = Hg 0 I}.

110
over Fq , where c ∈ Fq is the leading coefficient of g and g1 , . . . , gk are distinct monic
irreducible polynomials over Fq . Define the radical Rad(g) of g to be the monic
Q
polynomial ki=1 gi (X) ∈ Fq [X]. For A = Fq [X]/(g(X)), the ideal of A generated
by Rad(g) + (g(X)) ∈ A is precisely Rad(A).
The ring RK . Suppose K is a finite extension of K0 and pOK splits into the
product of prime ideals
k
Y
e(P )
pOK =
Pi i ,
i=1

where P1 , . . . , Pk are distinct. The radical of ŌK is given by
!
k
k
\
\
Rad(ŌK ) =
Pi /pOK =
Pi /pOK .
i=1

i=1

By the Chinese remainder theorem, we have the isomorphism
ŌK /Rad(ŌK ) →

k
Y
i=1

OK /Pi =

k
Y

κPi ,

i=1

sending x + Rad(ŌK ) ∈ ŌK /Rad(ŌK ) to (x̃ mod P1 , . . . , x̃ mod Pk ), where
x̃ ∈ OK is an arbitrary element lifting x ∈ ŌK . In particular, the ring ŌK /Rad(ŌK )
is semisimple.
Define RK to be the subring of ŌK /Rad(ŌK ) consisting of elements fixed by the
Frobenius automorphism x 7→ xp over Fp , i.e.,

RK := x ∈ ŌK /Rad(ŌK ) : xp = x .
Q
The isomorphism ŌK /Rad(ŌK ) → ki=1 κPi above identifies RK with the subring
Qk
Qk
F
of
p
i=1 κPi . So RK is a finite product of copies of Fp and in particular is
i=1
semisimple.
Observe that the map m 7→ (m/Rad(ŌK )) ∩ RK is a one-to-one correspondence
between the maximal ideals of ŌK and those of RK . Combining this fact with
Theorem 5.3, we obtain
Lemma 5.3. Let L, G, Q0 be as in Theorem 5.3. For any subgroup H ⊆ G and the
corresponding fixed subfield K = LH , the map
HgDQ0 7→

(g Q0 ∩ OK )/pOK
∩ RK
Rad(ŌK )

is a one-to-one correspondence between the double cosets in H\G/DQ0 and the
maximal ideals of RK .

111
Idempotent decompositions vs. partitions of a double coset space. In the
following, we establish a one-to-one correspondence between the idempotent decompositions of RK and the partitions of a certain double coset space.
For a number field extension L/K, the inclusion OK ,→ OL induces an inclusion
ŌK ,→ ŌL . So we may regard ŌK as a subring of ŌL . Note that Rad(ŌL ) ∩ ŌK =
Rad(ŌK ). Passing to the quotient rings yields an inclusion ŌK /Rad(ŌK ) ,→
ŌL /Rad(ŌL ). Restricting to the subring RK , we obtain an inclusion
iK,L : RK ,→ RL .
Also note that if L/K0 is a Galois extension with the Galois group G, the action of
G on OL induces an action on RL that permutes the maximal ideals of RL .
Fix the following notations: let L be a Galois extension of K0 with the Galois group
G = Gal(L/K0 ). For a (nonzero) prime ideal Q of OL lying over p, define
Q̄ :=

Q/pOL
∩ RL ,
Rad(ŌL )

which is a maximal ideal of RL , and let δQ̄ be the primitive idempotent of ŌL
satisfying δQ̄ ≡ 1 (mod Q̄) and δQ̄ ≡ 0 (mod Q̄0 ) for all maximal ideal Q̄0 6= Q̄
of ŌL . Finally, fix a prime ideal Q0 of OL lying over p.
Definition 5.4. Suppose H is a subgroup of G and K = LH . Then
• for an idempotent decomposition I of RK , define P (I) to be the partition of
−1
H\G/DQ0 where HgDQ0 , Hg 0 DQ0 are in the same block iff g (iK,L (δ)) ≡
g 0−1
(iK,L (δ)) (mod Q̄0 ) holds for all δ ∈ I, and
• for a partition P of H\G/DQ0 , define I(P ) to be the idempotent decomposition of RK consisting of the idempotents


X
g
−1 
δQ̄0  ,
δB := iK,L
gDQ0 ∈G/DQ0 :HgDQ0 ∈B

where B ranges over the blocks in P .
We have the following two lemma, whose proof is similar to that of Lemma 3.5 and
and can be found in Appendix C.

112
Lemma 5.4. The partitions P (I) and the idempotent decompositions I(P ) are well
defined. And for any idempotent decomposition I of ŌK , the idempotents δ ∈ I
correspond one-to-one to the blocks of P (I) via the map
−1

δ 7→ Bδ := {HgDQ0 ∈ H\G/DQ0 : g (iK,L (δ)) ≡ 1

(mod Q̄0 )}

with the inverse map B 7→ δB .
Now we are ready to establish the following correspondence.
Lemma 5.5. The map I 7→ P (I) is a one-to-one correspondence between the
idempotent decompositions of RK and the partitions of H\G/DQ0 , with the inverse
map P 7→ I(P ).
Proof. Note I(P ) = {δB : B ∈ P } by definition and P (I) = {Bδ : δ ∈ I} by
Lemma 5.4. So I = I(P (I)) by Lemma 5.4. Also note the map B 7→ δB is
injective, and hence the map P 7→ I(P ) is also injective. So P = I(P (I)).
P-collections and P-schemes of double cosets. Let G be a finite group and
D ⊆ G a subgroup. We generalize projections and conjugations introduced in
Chapter 2 so that they are defined between double coset spaces:
D
• (projection) for H ⊆ H 0 ⊆ G, define the projection πH,H
0 : H\G/D →
0
0
H \G/D to be the map sending HgD ∈ H\G/D to H gD ∈ H 0 \G/D, and

• (conjugation) for H ⊆ G and g ∈ G, define the conjugation cD
H,g : H\G/D →
gHg −1 \G/D to be the map sending HhD ∈ H\G/D to (gHg −1 )ghD ∈
gHg −1 \G/D.
Next we define P-collections and P-schemes of double cosets.
Definition 5.5. Let P be a subgroup system over a finite group G. Then a Pcollection of double cosets with respect to a subgroup D of G is a family C = {CH :
H ∈ P} indexed by P where each CH is a partition of H\G/D. Moreover, C is a
P-scheme of double cosets with respect to D if it has the following properties:
• (compatibility) for H, H 0 ∈ P with H ⊆ H 0 and x, x0 ∈ H\G/D in the same
D
D
0
block of CH , the images πH,H
0 (x) and πH,H 0 (x ) are in the same block of CH 0 .

113
−1
• (invariance) for H ∈ P and g ∈ G, the map cD
H,g : H\G/D → gHg \G/D
maps any block of CH to a block of CgHg−1 .

• (regularity) for H, H 0 ∈ P with H ⊆ H 0 , B ∈ CH , B 0 ∈ CH 0 , the number of
D
x ∈ B satisfying πH,H
0 (x) = y is a constant when y ranges over the elements
of B 0 .
We also define the following optional properties for a P-scheme of double cosets C
with respect to D:
• (homogeneity and discreteness) C is homogeneous on H ∈ P if CH = 0H\G/D ,
and otherwise inhomogeneous on H. It is discrete on H if CH = ∞H\G/D ,
and otherwise non-discrete on H.
• (antisymmetry) C is antisymmetric if for H ∈ P, g ∈ NG (H), B ∈ CH and
D
HgD ∈ B, either cD
H,g (HgD) = HgD or cH,g (HgD) 6∈ B.
• (strong antisymmetry) C is strongly antisymmetric if for any sequence of
subgroups H0 , . . . , Hk ∈ P, B0 ∈ CH0 , . . . , Bk ∈ CHk , and maps σ1 , . . . , σk
satisfying
– σi is a bijective map from Bi−1 to Bi ,
−1
D
D
– σi is of the form cD
Hi−1 ,g |Bi−1 , πHi−1 ,Hi |Bi−1 , or (πHi ,Hi−1 |Bi ) ,

– H0 = Hk and B0 = Bk ,
the composition σk ◦ · · · ◦ σ1 is the identity map on B0 = Bk .
The notions of P-collections and P-schemes introduced in Chapter 2 correspond to
the special case that D is trivial.
Extension of scalars of ŌK /Rad(ŌK ). In Section 5.7–5.8, we need a family of
rings AK,i that are obtained from ŌK /Rad(ŌK ) via “extension of scalars”, whose
definitions are given below.
Let K be a finite extension of K0 . The inclusion A0 ⊆ OK0 ,→ OK induces
an embedding of Fq ∼
= A0 /pA0 in ŌK /Rad(ŌK ), endowing ŌK /Rad(ŌK ) the
structure of an Fq -algebra. For i ∈ N+ , we define the tensor product
AK,i := (ŌK /Rad(ŌK )) ⊗Fq Fqi ,

114
which is an Fqi -algebra and is spanned by tensors a ⊗ b over Fq where a ∈
ŌK /Rad(ŌK ) and b ∈ Fqi (see [AM69] for the definition of tensor products of
rings). Intuitively, the ring AK,i is obtained from ŌK /Rad(ŌK ) by extending the
scalars from Fq to Fqi . And ŌK /Rad(ŌK ) is naturally identified with a subring of
AK,i via a 7→ a ⊗ 1. As ŌK /Rad(ŌK ) is semisimple, so is AK,i .8 The Frobenius
automorphism x 7→ xq of ŌK /Rad(ŌK ) over Fq induces an automorphism of AK,i
over Fqi sending a ⊗ b to aq ⊗ b. We denote this automorphism by σK,i .
The following lemma is also needed, whose proof is deferred to Appendix C.
Lemma 5.6. For any maximal ideal m of ŌK /Rad(ŌK ), the group hσK,i i generated
by σK,i acts transitively on the set of the maximal ideal of AK,i containing m.
Suppose K, K 0 are extensions of K0 and K ⊆ K 0 . Then the inclusion OK ,→ OK 0
induces an embedding ι : ŌK /Rad(ŌK ) ,→ ŌK 0 /Rad(ŌK 0 ), which in turn induces
a ring homomorphism ι0 : AK,i ,→ AK 0 ,i sending a ⊗ b to ι(a) ⊗ b. The map ι0
is injective since Fqi is a flat Fq -module (see, e.g., [AM69, Proposition 2.19 and
Exercise 2.4]). This allows us to regard AK,i as a subring of AK 0 ,i . Note that
ι0 ◦ σK,i = σK 0 ,i ◦ ι0 .
Finally, suppose L/K0 is a finite Galois extension with the Galois group G. The
action of G on L induces an action on ŌL /Rad(ŌL ), which in turn induces an
action on AL,i via g (a ⊗ b) := g a ⊗ b. This action commutes with σL,i .9
5.2

Algorithmic preliminaries

In this section, we discuss some basic procedures used in the algorithm.
Computation of radicals, and square-free factorization. We need to compute
the radical of a finite dimensional (commutative) Fp -algebra. This problem was
studied in [FR85; Rón90] and solved in polynomial time in the more general setting
of associative algebras. We state their result but restrict to the special case of
commutative algebras.
8

We use the fact that Fqd ⊗Fq Fqi is semisimple for d, i ∈ N+ : suppose Fqd ∼
= Fq [X]/(g(X))
∼
where g(X) ∈ Fq [X] is irreducible over Fq . Then Fqd ⊗Fq Fqi = Fqi [X]/(g(X)) ∼
=
Qk
j=1 Fq i [X]/(gj (X)) where g1 , . . . , gk are the irreducible factors of g over Fq i .
9
This follows from the fact that the action of G on ŌL /Rad(ŌL ) respects the multiplication and
hence commutes with the automorphism x 7→ xq .

115
Theorem 5.4 ([FR85; Rón90]). There exists a polynomial-time algorithm that given
a finite dimensional (commutative) Fp -algebra A, computes an Fp -basis of Rad(A)
in A.
See, e.g., [Rón90, Theorem 2.7].
Next we discuss the problem of computing the radical of a nonzero polynomial
g(X) ∈ Fq [X]. This is solved via square-free factorization.
Definition 5.6. A square-free factorization of a nonzero polynomial g(X) ∈ Fq [X]
over Fq is a factorization
k
Y
g(X) = c ·
(gi (X))mi ,
i=1

where c ∈ Fq is the leading coefficient of g and the factors g1 (X), . . . , gk (X) ∈
Fq [X] are monic, square-free, and pairwise coprime.
Theorem 5.5 ([Yun76; Knu98]). There exists a polynomial-time algorithm that
computes a square-free factorization of a given nonzero polynomial g(X) ∈ Fq [X].
Given the square-free factorization g(X) = c ·
is simply the product of gi (X). So we have

mi
i=1 (gi (X)) ,

Qk

the radical Rad(g)

Corollary 5.1. There exists a polynomial-time algorithm that given a nonzero polynomial g(X) ∈ Fq [X], computes its radical Rad(g).
Alternatively, we can compute Rad(g) by computing the radical of Fq [X]/(g(X))
and then its generator. The details are left to the reader.
Computation of annihilators. Let R be a (commutative) ring. For a set S ⊆ R,
define the annihilator AnnR (S) of S to be the ideal
AnnR (S) := {r ∈ R : rs = 0 for all s ∈ S}
of R. When S is a singleton {s}, we also write AnnR (s) instead of AnnR ({s}) and
call it the annihilator of s.
When R is an finite dimensional Fp -algebra, we can efficiently compute the annihilator AnnR (s) of an element s ∈ R by solving the system of Fp -linear equations
given by xs = 0. Similarly, when S is an Fp -subspace of R (in particular, when S

116
is an ideal of R), we can compute AnnR (S) efficiently given R and an Fp -basis B
of S by solving the system of Fp -linear equations xs = 0, where s ranges over the
basis B.
Computation of various rings and ring homomorphisms. The algorithm uses
relative number fields over K0 rather than ordinary number fields, i.e., every number
field is an extension of K0 and is encoded as a K0 -algebra K0 [X]/(g(X)) where
g(X) ∈ K0 [X] is irreducible over K0 .
Given a relative number field K over K0 , we can identify K0 with an ordinary
number field K̃ by Corollary 4.1. It allows us to efficiently compute a p-maximal
0
order OK
as well as the quotient ring ŌK as in Chapter 3. We can also efficiently
compute the rings ŌK /Rad(ŌK ) and RK , which are used in the generalized Pscheme algorithm developed in this chapter. This is summarized by the following
lemma, whose proof is deferred to Appendix C.
Lemma 5.7. There exists a polynomial-time algorithm ComputeRings that given p
and a relative number field K over K0 , computes the following data
0
0
,→ K,
of K and the inclusion OK
• a p-maximal order OK
0
→ ŌK ,
• ŌK and the quotient map OK

• ŌK /Rad(ŌK ) and the quotient map ŌK → ŌK /Rad(ŌK ),
• RK and the inclusion RK ,→ ŌK /Rad(ŌK ),
0
where ŌK , ŌK /Rad(ŌK ), and RK are encoded as algebras over Fp and OK
is
encoded as an algebra over Z.

Suppose K and K 0 are relative number fields over K0 and φ : K → K 0 is a field
embedding over K0 . The map φ induces a ring homomorphism φ̄ : ŌK → ŌK 0
sending x + pOK ∈ ŌK to φ(x) + pOK 0 . As the image of an nilpotent element
(resp. an element fixed by the automorphism x 7→ xp ) under φ̄ is also nilpotent
(resp. fixed by x 7→ xp ), the map φ̄ induces a ring homomorphism ŌK /Rad(ŌK ) →
ŌK 0 /Rad(ŌK 0 ), and we denote this map by φ̂. Finally, the map φ̂ restricts to a ring
homomorphism RK → RK 0 , which we denote by φ̃. The maps φ̄, φ̂ and φ̃ can be
efficiently computed from φ (and some auxiliary data) by the following lemma.

117
Lemma 5.8. There exists a polynomial-time algorithm ComputeRingHoms that
given p, relative number fields K, K 0 over K0 , a field embedding φ : K → K 0
over K0 , and the outputs of ComputeRings (see Lemma 5.7) on the inputs (K, p)
and (K 0 , p) respectively, computes the maps φ̄ : ŌK → ŌK 0 , φ̂ : ŌK /Rad(ŌK ) →
ŌK 0 /Rad(ŌK 0 ) and φ̃ : RK → RK 0 .
See Appendix C for its proof.
5.3

Reduction to computing an idempotent decomposition of RF

Now we start describing the generalized P-scheme algorithm. It is always implicitly
assumed that the prime number p, h̃(Y ) ∈ Z[Y ] and h(Y ) = h̃(Y ) mod p ∈ Fp [Y ]
are known to the algorithm, so that Fp [Y ]/(h(Y )), A0 = Z[Y ]/(h̃(Y )) and K0 =
Q[X]/(h̃(Y )) are also known. And Fp [Y ]/(h(Y )) is identified with a finite field Fq
via an isomorphism ψ0 : Fp [Y ]/(h(Y )) → Fq that we can efficiently compute.
In addition, we fix the following notations in the remaining sections:
• f (X): the input polynomial in Fq [X] to be factorized,
• f˜(X): an irreducible lifted polynomial of f (X) in A0 [X],
• F : the number field K0 [X]/(f˜(X)),
• L: the splitting field of f˜ over K0 ,
• G: the Galois group Gal(L/K0 ) = Gal(f˜/K0 ),
• Q0 : a fixed prime ideal of OL lying over p.
In this section, we reduce the problem of factoring f to computing an idempotent
decomposition of ŌF , generalizing the result in Section 3.3. For simplicity, we
assume that f˜ is a monic polynomial, and remove this assumption at the end of this
section.
Ring homomorphisms τ and τ̄ . Let α := X + (f˜(X)) ∈ F , which is a root of f˜
in F . As f˜(X) is a monic polynomial in A0 [X] and A0 ⊆ OK0 , we have α ∈ OF
(see [AM69, Corollary 5.4]).
Consider the natural inclusion A0 [X]/(f˜(X)) = A0 [α] ,→ OF . Taking the quotients
of both sides of this map mod p and identify A0 /pA0 = Fp [Y ]/(h(Y )) with Fq via

118
ψ0 , we obtain a ring homomorphism
τ : Fq [X]/(f (X)) → ŌF .
Let g := Rad(f ). Then the radical of Fq [X]/(f (X)) is generated by g(X)+(f (X)).
we obtain a ring homomorphism
τ̄ : Fq [X]/(g(X)) → ŌF /Rad(ŌF ),
which sends an element h(X) + (g(X)) to τ (h(X)) + Rad(ŌF ). Note that both
Fq [X]/(g(X)) and ŌF /Rad(ŌF ) are semisimple rings.
We can efficiently compute τ̄ by the following lemma.
Lemma 5.9. There exists a polynomial-time algorithm that given f , f˜, F and the
outputs of ComputeRings (see Lemma 5.7) on the input (F, p), computes the Fq algebra Fq [X]/(g(X)) (encoded in the standard Fq -basis {1, X, . . . , X deg(g)−1 })
and the map τ̄ : Fq [X]/(g(X)) → ŌF /Rad(ŌF ).
Proof. Compute g using Corollary 5.1 and form the Fq -algebra Fq [X]/(g(X)). To
compute τ̄ , we first compute α = X+(f˜(X)) ∈ F and Ȳ := Y +(h̃(Y )) ∈ K0 ⊆ F .
Then compute α + pOF , Ȳ + pOF ∈ ŌF by identifying F with an ordinary number
field (see Corollary 4.1) and running the algorithm ComputeResidue in Lemma 3.9
on α, Ȳ ∈ F . Next, compute τ : Fq [X]/(f (X)) → ŌF as the unique Fp -linear
map sending X + (f (X)) to α + pOF and Y + (h(Y )) ∈ Fp [Y ]/(h(Y )) ∼
= Fq to
Ȳ + pOF . Finally compute τ̄ from τ by passing to the quotients modulo radicals
using the given map ŌF → ŌF /Rad(ŌF ).
Extracting a factorization from an idempotent decomposition. We extract a
factorization of f from an idempotent decomposition of RF . This is achieved by the
algorithm ExtractFactorsV2 below (see Algorithm 10), extending the algorithm
in Section 3.3.
The algorithm first computes g = Rad(f ), the ring Fq [X]/(g(X)), and the map τ̄
at Line 1 using Lemma 5.9. It also maintains an idempotent decomposition I of the
ring Fq [X]/(g(X)) which initially only contains the unity.
The loop in Lines 3–8 enumerates idempotents δ 0 ∈ IF . For each δ 0 , we compute an
ideal J = τ̄ −1 ((1 − δ 0 )ŌF /Rad(ŌF )) of Fq [X]/(g(X)) and an element δ0 ∈ J satisfying (1−δ0 )J = {0} by solving systems of linear equations. As Fq [X]/(g(X)) is

119
Algorithm 10 ExtractFactorsV2
Input: f , f˜, F , the outputs of ComputeRings (see Lemma 5.7) on the input (F, p),
and an idempotent decomposition IF of RF
Output: factorization of f
1: compute g = Rad(f ), Fq [X]/(g(X)) and τ̄ : Fq [X]/(g(X)) → ŌF /Rad(ŌF )
2: I ← {1}, where 1 denotes the unity of Fq [X]/(g(X))
3: for δ 0 ∈ IF do
4:
J ← τ̄ −1 ((1 − δ 0 )ŌF /Rad(ŌF ))
5:
compute δ0 ∈ J satisfying (1 − δ0 )J = {0}
6:
for δ ∈ I satisfying δ0 δ 6∈ {0, δ} do
7:
I ← I − {δ}
8:
I ← I ∪ {δ0 δ, (1 − δ0 )δ}
9:
10:
11:
12:
13:

for δ ∈ I do
compute nonzero hδ (X) ∈ Fq [X] of degree at most deg(g) lifting 1 − δ
gδ (X) ← gcd(f (X), (hδ (X))n )
. n = deg(f )
Qk δ
compute a square-free factorization gδ (X) = i=1 gδ,i (X)
Q Qδ
gδ,i (X)
return the factorization f (X) = δ∈I ki=1

semisimple, the element δ0 is the unique idempotent of Fq [X]/(g(X)) that generates
J. And we use it to refine I.
The loop in Lines 9–12 extracts, for each idempotent δ ∈ I, a monic factor gδ of
Qδ
gδ,i (X) for
f . Furthermore, we compute a square-free factorization gδ (X) = ki=1
each factor gδ . Finally, the algorithm returns the factorization
f (X) =

kδ
YY

gδ,i (X).

δ∈I i=1

The following theorem is the main result of this section.
Theorem 5.6. The algorithm ExtractFactorsV2 computes a factorization of f
over Fq in polynomial time, such that
1. the factorization is complete if IF is a complete idempotent decomposition,
2. the factorization is proper if IF is a proper idempotent decomposition, and
3. at least one factor in the factorization is irreducible over Fq if IF contains a
primitive idempotent.

120
Analysis of the algorithm. To prove Theorem 5.6, we introduce the following
notations: let S (resp. SF ) denote the set of the maximal ideals of Fq [X]/(g(X))
(resp. ŌF /Rad(ŌF )). For a maximal ideal m of ŌF /Rad(ŌF ), the preimage
τ̄ −1 (m) is a prime (and hence maximal) ideal of Fq [X]/(g(X)). So we obtain a map
π : SF → S,
sending m to τ −1 (m). It can be shown that π is surjective.10
Q
Suppose f (X) = ki=1 (fi (X))mi where f1 , . . . , fk are distinct monic irreducible
factors of f over Fq . For i ∈ [k], let mi be the (maximal) ideal of Fq [X]/(g(X))
generated by fi (X) + (g(X)). Then we have
S = {m1 , . . . , mk }

and

g(X) =

k
Y

fi (X).

i=1

The proof of Theorem 5.6 is based on the following lemma.
Lemma 5.10. Let I be the idempotent decomposition of Fq [X]/(g(X)) given at the
end of the algorithm ExtractFactorsV2. Define the partition P of S by
P := {Bδ : δ ∈ I},

where Bδ := {m ∈ S : δ ≡ 1

(mod m)}

and the partition P 0 of SF by
P 0 := {Bδ0 : δ ∈ IF },

where Bδ0 := {m ∈ SF : δ ≡ 1

(mod m)}.

Then P is the coarsest common refinement of the partitions {π(B), S − π(B)},
where B ranges over the blocks in P 0 . Moreover, for each δ ∈ I, the polynomial gδ
in the algorithm is given by
gδ (X) =

Y

(fi (X))mi .

i∈[k]:mi ∈Bδ

Proof. For the last claim, it suffices to prove, for all i ∈ [k], that hδ is divisible by
fi iff mi ∈ Bδ . By the choice of hδ , it holds for all i ∈ [k] that hδ is divisible by fi
iff 1 − δ ∈ mi . The claim then follows from the definition of Bδ .
For the first claim, it suffices to show that for every δ 0 ∈ IF enumerated at Line 3 and
δ0 computed at Line 5 in the same iteration, it holds that Bδ0 ∈ {π(Bδ0 0 ), S −π(Bδ0 0 )}.
10

To prove this, it suffices to show that any prime ideal of A0 [X]/(f˜(X)) = A0 [α] ⊆ OF is
contained in a prime ideal of OF , which follows from [AM69, Theorem 5.10].

121
We claim that Bδ0 = S − π(Bδ0 0 ). As the ideal J computed at Line 4 is generated
T
by δ0 , this claim is equivalent to J = m∈π(B 0 0 ) m. Note that for m ∈ SF , it holds
δ
that 1 − δ 0 ∈ m iff m ∈ Bδ0 0 by the definition of Bδ0 0 . So we have
\

(1 − δ 0 )ŌF /Rad(ŌF ) =

m

m∈Bδ0 0

and hence

J = τ̄ −1 


\

m =

m∈Bδ0 0

\

\

τ̄ −1 (m) =

m∈Bδ0 0

π(m) =

m∈Bδ0 0

\

m

m∈π(Bδ0 0 )

as desired.
We also need the following lemma.
Lemma 5.11. π : SF → S is bijective if f is square-free, i.e., mi = 1 for i ∈ [k].
Proof. Suppose pOF splits into the product of prime ideals by
pOF =

`
Y

e(Pi )

Pi

,

i=1

where P1 , . . . , P` are distinct prime ideals lying over p. For j ∈ [`], let m0j :=
Pj /pOF
. Then SF = {m01 , . . . , m0` }. Let n = deg(f ). Assume f is square-free.
Rad(ŌF )
Then we have
k
X
i=1

deg(fi ) =

k
X
i=1

mi deg(fi ) = n =

`
X

e(Pj )f (Pj ).

(5.1)

j=1

Fix i ∈ [k]. We know π −1 (i) 6= ∅ since π is surjective. Consider j ∈ π −1 (i).
As τ̄ (mi ) ⊆ m0j , the map τ̄ : Fq [X]/(g(X)) → ŌF /Rad(ŌF ) induces a field
embedding
Fq [X]/(g(X))
ŌF /Rad(ŌF )
,→
.
mi
m0j
The left hand side is isomorphic to Fq [X]/(fi (X)) whereas the right hand side is
isomorphic to OF /Pj = κPj . Therefore deg(fi ) divides f (Pj ).
Note that e(Pj ) ≥ 1 holds for all j ∈ [`]. It follows from (5.1) that in fact e(Pj ) = 1
holds for all j ∈ [`]. Moreover, for all i ∈ [k], the set π −1 (i) contains only one
element ji ∈ [`], and deg(fi ) = f (Pji ). In particular, the map π is bijective.

122
Now we are ready to prove Theorem 5.6.
Proof of Theorem 5.6. Polynomiality of the algorithm is straightforward. Suppose
IF is a complete idempotent decomposition of RF . It is also a complete idempotent decomposition of ŌF /Rad(ŌF ) since the maximal ideals of ŌF /Rad(ŌF )
correspond one-to-one to those of RF via m 7→ m ∩ RF . So the partition P 0 in
Lemma 5.10 is ∞SF . By Lemma 5.10 and surjectivity of π, the partition P equals
Q
∞S , and the algorithm outputs the complete factorization f (X) = i∈[k] (fi (X))mi .
Similarly, if IF contains a primitive idempotent δ. Then P 0 contains a singleton Bδ0 .
By Lemma 5.10, the partition P contains a singleton π(Bδ0 ), and algorithm outputs a
factorization of f (X) in which the irreducible factors fi (X) appear mi times, where
i is the unique index in [k] satisfying π(Bδ0 ) = {mi }.
Finally, suppose IF is a proper idempotent decomposition of RF , and hence a proper
idempotent decomposition of ŌF /Rad(ŌF ). Then P 0 6= 0SF . If π is bijective, then
by Lemma 5.10, we have P 6= 0S , and the algorithm outputs a proper factorization
of f . Now suppose π is not bijective. Then f is not square-free by Lemma 5.11.
As we compute a square-free factorization for each gδ , the algorithm still outputs a
proper factorization of f .
The reduction for non-monic polynomials. The same trick in Section 3.3 can
be applied to make the above reduction work for a possibly non-monic polynomial
f˜: let c ∈ A0 be the leading coefficient of f˜(X) ∈ A0 [X], and let c̄ := ψ̃0 (c) ∈
n−1
˜0
· f˜(X/c) ∈ A0 [X] and
F×
q . Compute the monic polynomials f (X) := c
f 0 (X) := c̄n−1 f (X/c̄n−1 ) ∈ Fq [X]. Run the algorithm ExtractFactorsV2 on f 0
and f˜0 instead of f and f˜, and obtain a factorization of f 0 . Finally, we recover a
factorization of f from that of f 0 by substituting X with c̄X in each factor.
Remark. The reduction in this section exploits the well known connection between
factorization of polynomials over finite fields and the splitting of prime ideals in
number field extensions, which dates back to the classical work of Kummer and
Dedekind (see, e.g., [Neu99, Proposition I.8.3]). The Kummer-Dedekind theorem,
however, requires the map Fq [X]/(f (X)) → ŌF to be an isomorphism. For this
reason, known factoring algorithms that use an irreducible lifted polynomial f˜
often assume p is regular with respect to f˜. See, e.g., [Hua84; Hua91a; Hua91b;
Rón92].11 This assumption is not needed in our algorithm. The key observation
11

We say p is regular with respect to f˜ if pA0 [α] is coprime to the conductor of A0 [α]. See

123
is that we can always employ the surjective map π from the set of prime ideals of
ŌF /Rad(ŌF ) to that of Fq [X]/(g(X)), where g = Rad(f ). In algebro-geometric
terminology, the map π is interpreted as the morphism of reduced affine schemes
π : Spec(ŌF )red → Spec(A0 [α]/pA0 [α])red
induced from the morphism Spec OF → Spec A0 [α]. The latter morphism is known
as the normalization of Spec A0 [α] (see [Har77, Exercise II.3.8]).
5.4

Producing a P-scheme of double cosets C

In this section, we present an algorithm that computes the idempotent decompositions of a collection of rings RK corresponding to a P-scheme of double cosets.
It extends the algorithm in Section 3.4 and serves as (a preliminary version) of the
main body of the generalized P-scheme algorithm.
The pseudocode of the algorithm is given in Algorithm 11 below. Its input is a
(K0 , f˜)-subfield system F (see Definition 4.1). The algorithm outputs, for every
K ∈ F, an idempotent decomposition IK of the ring RK , together with some
auxiliary data.
We fix P to be the subgroup system over G = Gal(f˜/K0 ) associated with F, i.e.,

P := H ⊆ G : LH ∼
=K0 K for some K ∈ F .
The first half (Lines 1–7) of the algorithm is the preprocessing stage: for each
K ∈ F, we run ComputeRings (see Lemma 5.7) on (K, p) which returns the
following data:
0
0
• a p-maximal order OK
of K and the inclusion OK
,→ K,
0
• ŌK and the quotient map OK
→ ŌK ,

• ŌK /Rad(ŌK ) and the quotient map ŌK → ŌK /Rad(ŌK ),
• RK and the inclusion RK ,→ ŌK /Rad(ŌK ).
For (K, K 0 ) ∈ F, we also compute all the embeddings φ from K to K 0 and
the corresponding ring homomorphisms φ̄ : ŌK → ŌK 0 , φ̂ : ŌK /Rad(ŌK ) →
[Hua84] for the exact formulation of this condition. We remark that the journal version [Hua91a]
(and [Hua91b; Rón92]) assumes the stronger condition that p is coprime to the discriminant of f˜.

124
Algorithm 11 ComputeDoubleCosetPscheme
Input: (K0 , f˜)-subfield system F
Output: for every K ∈ F: the outputs of ComputeRings (see Lemma 5.7) on
the input (K, p), and an idempotent decomposition IK of RK
1:

for K ∈ F do
2:
call ComputeRings on (K, p)
3:
IK ← {1}, where 1 denotes the unity of RK
for (K, K 0 ) ∈ F 2 do
5:
call ComputeRelEmbeddings to compute all the embeddings from K to K 0
over K0
4:

for embedding φ : K ,→ K 0 over K0 do
call ComputeRingHoms on p, K, K 0 and φ to compute φ̄, φ̂ and φ̃

6:
7:
8:
9:
10:
11:
12:
13:
14:
15:

repeat
call CompatibilityAndInvarianceTestV2
call RegularityTestV2
call StrongAntisymmetryTestV2
call RamificationIndexTest
call InertiaDegreeTest
until IK remains the same in the last iteration for all K ∈ F
return the outputs of ComputeRings on the input (K, p) and IK for K ∈ F

ŌK 0 /Rad(ŌK 0 ) and φ̃ : RK → RK 0 . Moreover, for each K ∈ F, we initialize the
idempotent decomposition IK of RK to be the trivial one containing only the unity
of RK .
The second half (Lines 8–14) of the algorithm refines the idempotent decompositions
IK for K ∈ F. To analyze it, we associate a P-collection C of double cosets with
these idempotent decompositions. For each H ∈ P, define a partition CH of the
coset space H\G/DQ0 as follows: Let K be the unique field in F isomorphic to
LH over K0 . Fix an isomorphism τH : K → LH over K0 , which induces a ring
isomorphism τ̃H : RK → RLH . Define IH := τ̃H (IK ), which is an idempotent
decomposition of RLH . By Definition 5.4, it corresponds to a partition P (IH ) of
H\G/DQ0 .12 And we define
CH := P (IH ).
12

Definition 5.4 is made with respect to a fixed prime ideal Q0 of OL lying over p. This ideal is
chosen at the beginning of Section 5.3.

125
Finally, define
C := {CH : H ∈ P},
which is a P-collection of double cosets (with respect to DQ0 ).
The subroutines in Lines 9–11 extend those in Section 3.5, 3.6, and 3.7 respectively:
Lemma 5.12. There exists a subroutine CompatibilityAndInvarianceTestV2
that updates IK in time polynomial in log p and the size of F so that the partitions
CH ∈ C are refined. Moreover, at least one partition CH is properly refined if C is
not compatible or invariant.
Lemma 5.13. There exists a subroutine RegularityTestV2 that updates IK in
time polynomial in log p and the size of F so that the partitions CH ∈ C are refined.
Moreover, at least one partition CH is properly refined if C is compatible but not
regular.
Lemma 5.14. Under GRH, there exists a subroutine StrongAntisymmetryTestV2
that updates IK in time polynomial in log p and the size of F so that the partitions
CH ∈ C are refined. Moreover, at least one partition CH is properly refined if C is
a P-scheme of double cosets, but not strongly antisymmetric.
The proofs of Lemma 5.12–5.14 (and the corresponding subroutines) are almost
the same as those of Lemma 3.13–3.15 in Chapter 3. For this reason, we only list
the changes that need to be made rather than describe the complete proofs and the
subroutines.
Proof sketch of Lemma 5.12–5.14. We make the following changes to the proofs of
Lemma 3.13–3.15 and the corresponding subroutines:
each quotient ring ŌK is replaced with the ring RK , which is still isomorphic
to a finite product of copies of Fp . A maximal ideal P of ŌK is replaced with
the maximal ideal (P/Rad(ŌK )) ∩ RK of RK . The subroutines enumerate field
embeddings over K0 instead of arbitrary field embeddings. For each field embedding
φ : K → K 0 over K0 , we use the ring homomorphism φ̃ : RK → RK 0 in place
of φ̄ : ŌK → ŌK 0 . The ring isomorphisms τ̄H : ŌK → ŌLH are replaced with
τ̃H : RK → RLH .
A right coset Hg is replaced with a double coset HgDQ0 , and a right coset space
DQ0
H\G is replaced with H\G/DQ0 . A projection πH,H 0 is replaced with πH,H
0 , and a
DQ0
conjugation cH,g is replaced with cH,g (see Definition 5.5).

126
Finally, instead of applying Corollary 3.1, Lemma 3.5, and Lemma 3.6 from Chapter 3, we apply Lemma 5.3, Lemma 5.4, and Lemma 5.5, respectively. The details
are left to the reader.
In addition, the subroutines at Line 12 and Line 13 properly refine the partitions in
C unless they all have locally constant ramification indices and inertia degrees:
Lemma 5.15. There exists a subroutine RamificationIndexTest that updates IK
in time polynomial in log p and the size of F so that the partitions CH ∈ C are refined.
Moreover, at least one partition CH is properly refined unless all the partitions in C
have locally constant ramification indices (with respect to (DQ0 , IQ0 )).
Lemma 5.16. There exists a subroutine InertiaDegreeTest that updates IK in
time polynomial in log p and the size of F so that the partitions CH ∈ C are refined.
Moreover, at least one partition CH is properly refined unless all the partitions in C
have locally constant inertia degrees (with respect to (DQ0 , IQ0 )).
Lemma 5.15 and Lemma 5.16 are proved in Section 5.5 and Section 5.6, respectively.
Combining Lemma 5.12–5.16 yields the main result of this section:
Theorem 5.7 (Theorem 5.2 restated). Under the assumption of GRH, the algorithm
ComputeDoubleCosetPscheme runs in time polynomial in log p and the size of F,
and when it terminates, C is a strongly antisymmetric P-scheme of double cosets
(with respect to DQ0 ). Moreover, all the partitions in C have locally constant
ramification indices and inertia degrees (with respect to (DQ0 , IQ0 )).
5.5

Testing local constantness of ramification indices

In this section, we describe the subroutine RamificationIndexTest that properly
refines at least one partition in C unless all the partition have locally constant
ramification indices.
The pseudocode of the subroutine is given in Algorithm 12 above. We enumerate
K ∈ F and i = 1, 2, . . . , [K : K0 ]. For each K and i, we compute an ideal J of
ŌK /Rad(ŌK ), defined to be the image of AnnŌK (Rad(ŌK )i ) under the quotient
map ŌK → ŌK /Rad(ŌK ). We also compute an element δ0 ∈ J ∩RK ⊆ RK , satisfying (1−δ0 )J = {0}. As ŌK /Rad(ŌK ) and RK are semisimple, and m 7→ m∩RK
is a one-to-one correspondence between the maximal ideals of ŌK /Rad(ŌK ) and
those of RK , we know δ0 is the unique idempotent of ŌK /Rad(ŌK ) (resp. RK )
that generates J (resp. J ∩ RK ). Then we use δ0 to refine IK .

127
Algorithm 12 RamificationIndexTest
1:
2:
3:
4:
5:
6:
7:

for K ∈ F do
for i ← 1 to [K : K0 ] do
J ← the image of AnnŌK (Rad(ŌK )i ) ⊆ ŌK in ŌK /Rad(ŌK )
find δ0 ∈ J ∩ RK satisfying (1 − δ0 )J = {0}
for δ ∈ IK satisfying δ0 δ 6∈ {0, δ} do
IK ← IK − {δ}
IK ← IK ∪ {δ0 δ, (1 − δ0 )δ}

Next we prove Lemma 5.15.
Proof of Lemma 5.15. The claim about the running time is straightforward. Suppose there exists H ∈ P such that CH does not have locally constant ramification
indices. Choose B ∈ CH and g, g 0 ∈ G such that HgDQ0 , Hg 0 DQ0 ∈ B and
e(HgDQ0 ) < e(Hg 0 DQ0 ).
By Theorem 5.3 and Definition 5.2, the ideal pOLH splits into the product of prime
ideals h Q0 ∩ OLH by
Y
e(HhDQ0 )
h
.
pOLH =
Q0 ∩ OLH
HhDQ0 ∈H\G/DQ0


For HhDQ0 ∈ H\G/DQ0 , define PHhDQ0 := h Q0 ∩ OLH /pOLH , which is a
maximal ideal of ŌLH . By the Chinese remainder theorem, we have
Y
ŌLH ∼
ŌLH /Pe(x)
=
x .
x∈H\G/DQ0

And Rad(ŌLH ) =

Q

x∈H\G/DQ0

Px . So for i ∈ N, we have

AnnŌLH (Rad(ŌLH )i ) =

Y

Pxmax{0,e(x)−i} .

(5.2)

x∈H\G/DQ0

Choose i = e(HgDQ0 ) and let J be the image of AnnŌLH (Rad(ŌLH )i ) in the
quotient ring ŌLH /Rad(ŌLH ). Let δ0 be the unique idempotent of ŌLH /Rad(ŌLH )
that generates J. It follows from (5.2) that
δ0 ≡ 1

(mod PHgDQ0 /Rad(ŌLH )) and δ0 ≡ 0

(mod PHg0 DQ0 /Rad(ŌLH )).

Therefore
g −1

(iLH ,L (δ0 )) ≡ 1

(mod Q̄0 ) and

g 0−1

(iLH ,L (δ0 )) ≡ 0

(mod Q̄0 ), (5.3)

128
where iLH ,L : RLH ,→ RL is the inclusion induced from the natural inclusion
OLH ,→ OL .
On the other hand, by Lemma 5.4, the block B ∈ CH corresponds to an idempotent
δ = δB ∈ IH . And
h−1
(iLH ,L (δ)) ≡ 1 (mod Q̄0 )
holds for all h ∈ G satisfying HhDQ0 ∈ B. In particular, it holds for h = g and
h = g 0 . It follows from (5.3) that δ0 δ 6∈ {0, δ}.
Identifying LH with a field K ∈ F using the isomorphism τH : K → LH over K0
chosen in Section 5.4, we see that the subroutine is guaranteed to find an idempotent
δ ∈ IK satisfying δ0 δ 6∈ {0, δ} at Line 5. The lemma follows.
5.6

Testing local constantness of inertia degrees

In this section, we describe the subroutine InertiaDegreeTest that properly refines
at least one partition in C unless all the partition have locally constant inertia degrees.
Algorithm 13 InertiaDegreeTest
1:

for K ∈ F do
2:
for i ← 1 to [K : K0 ] do
i
3:
J ← the ideal of ŌK /Rad(ŌK ) generated by {xp − x : x ∈
ŌK /Rad(ŌK )}

4:
5:
6:
7:

find δ0 ∈ J ∩ RK satisfying (1 − δ0 )J = {0}
for δ ∈ IK satisfying δ0 δ 6∈ {0, δ} do
IK ← IK − {δ}
IK ← IK ∪ {δ0 δ, (1 − δ0 )δ}

The pseudocode of the subroutine is given in Algorithm 13. We enumerate
K ∈ F and i = 1, 2, . . . , [K : K0 ]. For each K and i, we compute an ideal
i
J of ŌK /Rad(ŌK ), generated by the elements xp − x, where x ranges over
ŌK /Rad(ŌK ). Note that J is just the Fp -linear subspace of ŌK /Rad(ŌK ) spanned
i
by xp − x where x ranges over an Fp -basis of ŌK /Rad(ŌK ). So it can be efficiently computed. We also compute an element δ0 ∈ J ∩ RK ⊆ RK satisfying
(1 − δ0 )J = {0}. As in Algorithm 12, it is the unique idempotent of ŌK /Rad(ŌK )
(resp. RK ) that generates J (resp. J ∩ RK ). Then we use δ0 to refine IK .
Next we prove Lemma 5.16.

129
Proof of Lemma 5.16. The claim about the running time is straightforward. Suppose there exists H ∈ P such that CH does not have locally constant inertia
degrees. Choose B ∈ CH and g, g 0 ∈ G such that HgDQ0 , Hg 0 DQ0 ∈ B and
f (HgDQ0 ) > f (Hg 0 DQ0 ).

For HhDQ0 ∈ H\G/DQ0 , define PHhDQ0 := h Q0 ∩ OLH /pOLH , which is a
maximal ideal of ŌLH . By Theorem 5.3, Definition 5.2, and the Chinese remainder
theorem, we have
Y
ŌLH /Rad(ŌLH ) ∼
ŌLH /PHhDQ0
=
HhDQ0 ∈H\G/DQ0

and each factor ŌLH /PHhDQ0 is an extension field of Fp of degree f (HhDQ0 ).
Choose i = f (Hg 0 DQ0 ) and let J be the ideal of ŌLH /Rad(ŌLH ) generated by
i
xp − x where x ranges over ŌLH /Rad(ŌLH ). Let δ0 be the unique idempotent of
ŌLH /Rad(ŌLH ) that generates J. Note that we have
i

xp 6≡ x (mod PHgDQ0 /Rad(ŌLH )) for some x ∈ ŌLH /Rad(ŌLH ),
and
i

xp ≡ x (mod PHg0 DQ0 /Rad(ŌLH )) for all x ∈ ŌLH /Rad(ŌLH ).
So J is contained in PHg0 DQ0 but not in PHgDQ0 . It follows that
δ0 ≡ 1

(mod PHgDQ0 /Rad(ŌLH )) and δ0 ≡ 0

(mod PHg0 DQ0 /Rad(ŌLH )).

Then (5.3) in the proof of Lemma 5.15 holds. The rest of the proof follows the proof
of Lemma 5.15.
5.7

A P-collection C˜ induced from C and auxiliary elements

The idempotent decompositions IK produced in Section 5.4 define a P-scheme of
double cosets C rather than an (ordinary) P-scheme. Section 5.7–5.9 are devoted to
˜ In particular, this section focuses on the definition of C˜
turning it to a P-scheme C.
as a P-collection.
We assume p > deg(f ) in Section 5.7–5.9. As mentioned in Section 5.1, this
assumption implies that the wild inertia group WQ0 ⊆ G of Q0 over K0 is trivial.
Suppose the partitions in C all have locally constant ramification indices and inertia
degrees (with respect to (DQ0 , IQ0 )). Then for K ∈ F and δ ∈ IK , the (nonempty)
set of maximal ideals P of OK satisfying
δ≡1

(mod P̄)

where P̄ :=

P/pOK
∩ RK
Rad(ŌK )

130
all have the same ramification index e(P) and the same inertia degree f (P). We
denote e(P) by eδ and f (P) by fδ . Note that eδ and fδ are coprime to p by
Theorem 5.3 and the assumption p > deg(f ).
Recall that for a finite extension K of K0 and i ∈ N+ , we denote by AK,i the ring
˜ we need an auxiliary collection of elements
(ŌK /Rad(ŌK )) ⊗Fq Fqi . To define C,
in rings ŌK or AK,i . We call such a collection of elements an I-advice:
Definition 5.7. Suppose I = {IK : K ∈ F} is a collection of idempotent decompositions of the rings RK , K ∈ F, that defines to a P-collection of double
cosets C (with respect to DQ0 ), such that all the partitions in C have locally constant
ramification indices and inertia degrees (with respect to (DQ0 , IQ0 )). An I-advice
{S, T } consists of the following data:
• S = {sδ : δ ∈ IK , eδ > 1}, where each sδ ∈ S is an element of ŌK such
that sδ ∈ m − m2 for all the maximal ideals m of ŌK satisfying δ ≡ 1
(mod m/Rad(ŌK )).
• T = {tδ : δ ∈ IK , fδ > 1}, where each tδ ∈ T is an element of AK,fδ such
that tδ 6∈ m for all the maximal ideals m of AK,fδ satisfying δ ≡ 1 (mod m),
and σK,fδ (tδ ) = ξ · tδ , where ξ ∈ Fqfδ is a primitive fδ th root of unity.13
An I-advice can be computed from I by the following lemma. Its proof is deferred
to Appendix C.
Lemma 5.17. Under GRH, there exists a subroutine ComputeAdvice that given
I = {IK : K ∈ F} as in Definition 5.7, either properly refines some idempotent
decomposition IK ∈ I, or computes eδ , fδ for K ∈ F, δ ∈ IK and an I-advice.14
Moreover, the subroutine runs in time polynomial in log p and the size of F.
We also need the following notations: recall that for H ∈ P, we chose an isomorphism τH : K → LH over K0 where K is the unique field in F isomorphic to LH
over K0 . The induced isomorphism ŌK ∼
= ŌLH identifies each sδ ∈ S (where S is
as in Definition 5.7) with an element in ŌLH , which we denote by sδ,H . Similarly,
we identify each tδ ∈ T with an element in ALH ,fδ , denoted by tδ,H .
13

We regard δ ∈ RK ⊆ ŌK /Rad(ŌK ) as an element of AK,fδ via δ 7→ δ ⊗ 1, and ξ ∈ Fqfδ as
an element of AK,fδ via ξ 7→ 1 ⊗ ξ.
14
We need to compute the rings AK,fδ before computing the elements tδ ∈ AK,fδ . These rings
will be computed before the call of the subroutine ComputeAdvice. See Section 5.9.

131
Next we define a P-collection C˜ using I and an I-advice:
Definition 5.8. Let I = {IK : K ∈ F} be as in Definition 5.7 and {S, T } be
an I-advice. Let C = {CH : H ∈ P} be the P-collection of double cosets with
respect to DQ0 associated with I (see Section 5.4). For H ∈ P, let K be the
unique field in F isomorphic to LH over K0 , and define the partition C̃H of H\G
so that Hg, Hg 0 ∈ H\G are in the same block of C̃H iff the following conditions
are satisfied:
1. HgDQ0 and Hg 0 DQ0 are in the same block B of CH .
2. Let δ be the unique idempotent in IK such that τ̃H (δ) = δB (see Definition 5.4),
where B ∈ CH is as in the previous condition. If eδ > 1, the order of the
unique element c in κ×
Q0 satisfying
g −1

sδ,H + I = c · (g

0−1

sδ,H + I)

is coprime to eδ , where I = (Q0 /pOL )e(Q0 )/eδ +1 .
3. Let δ ∈ IK be as in the previous condition. Let m0 be an arbitrary maximal
Q0 /pOL
. If fδ > 1, the order of the unique element
ideal of AL,fδ containing Rad(
ŌL )
×
c in (AL,fδ /m0 ) satisfying
g −1

tδ,H + m0 = c · (g

0−1

tδ,H + m0 )

is coprime to fδ .
Define C˜ = {C̃H : H ∈ P}, which is a P-collection. We say C˜ is the P-collection
associated with I and {S, T }.
We check that C˜ is well defined:
Lemma 5.18. The P-collection C˜ in Definition 5.8 is well defined.
The proof of Lemma 5.18 is routine and can be found in Appendix C.
5.8 (C, D)-separated P-collections
We continue the discussion in the previous section. Our goal is to compute I =
{IK : K ∈ F} and an I-advice {S, T } such that the associated P-collection C˜
is a strongly antisymmetric P-scheme. To achieve this goal, we introduce another
property of P-collections called (C, D)-separatedness:

132
Definition 5.9. Let P be a subgroup system over a finite group G, and let C =
{CH : H ∈ P} be a P-collection of double cosets with respect to a subgroup D of
G. We say a P-collection C˜ = {C̃H : H ∈ P} is (C, D)-separated if the following
conditions are satisfied:
1. All the partitions C̃H ∈ C˜ are invariant under the action of D by inverse right
translation, i.e. for all B ∈ C̃H and g ∈ D, the set g B = {Hhg −1 : Hh ∈ B}
is also in C̃H .
2. For H ∈ P, the map πH : H\G → H\G/D sending Hg ∈ H\G to HgD
maps each block of C̃H bijectively to a block of CH .
It is worth noting that if C˜ is (C, D)-separated, then all the partitions in C automatically have locally constant ramification indices and inertia degrees:
Lemma 5.19. Suppose C˜ = {C̃H : H ∈ P} is a (C, D)-separated P-collection
where P, C, D are as in Definition 5.9. Let I be a normal subgroup of D. Then
all the partitions in C have locally constant ramification indices and inertia degrees
with respect to (D, I).
Proof. Fix H ∈ P, B ∈ CH , and B̃ ∈ C̃H such that πH (B̃) = B, where πH is as in
Definition 5.9. Let D0 be a subgroup of D. Consider arbitrary HgD0 , Hg 0 D0 ∈ B
and lift them to Hg, Hg 0 ∈ B̃ respectively. Choose h1 , . . . , hk ∈ D0 such that the
D0 -orbit of Hg is {Hgh1 , . . . , Hghk } and the cosets Hghi are all distinct. We claim
Hg 0 h1 , . . . , Hg 0 hk are also distinct. Assume to the contrary that Hg 0 hi1 = Hg 0 hi2
holds for distinct i1 , i2 ∈ [k]. Then Hg 0 hi1 and Hg 0 hi2 are in the same block of
C̃H . It follows by the first condition in Definition 5.9 that Hghi1 and Hghi2 are
also in the same block. But Hghi1 6= Hghi2 and they are both mapped to HgD by
πH , contradicting the second condition in Definition 5.9. This proves the claim. So
the cardinality of the D0 -orbit of any Hg ∈ H\G only depends on the block in CH
containing HgD. In particular, this holds for D0 = D and D0 = I. The lemma then
follows from Definition 5.2.
The following lemma provides a criterion for a (C, D)-separated P-collection to be
a strongly antisymmetric P-scheme.
Lemma 5.20. Let P be a subgroup system over a finite group G, and let C =
{CH : H ∈ P} be a P-scheme of double cosets with respect to D ⊆ G. Suppose

133
C˜ = {C̃H : H ∈ P} is a compatible, invariant, (C, D)-separated P-collection.
Then it is actually a P-scheme. Moreover, if C is antisymmetric (resp. strongly
˜
antisymmetric), so is C.
Proof. For the first claim, we just need to show C˜ is regular. Consider H, H 0 ∈ P
with H ⊆ H 0 . Let πH : H\G → H\G/D be the map sending Hg ∈ H\G to HgD,
and define πH 0 similarly. Then the following diagram commutes.
H\G

πH,H 0

πH 0

πH

H\G/D

H 0 \G

D
πH,H
0

H 0 \G/D

For B ∈ C̃H and B 0 ∈ C̃H 0 containing πH,H 0 (B), we need to show the map
−1
πH,H 0 |B : B → B 0 has the constant degree, i.e., the cardinality of πH,H
0 (y) ∩ B is
0
˜
independent of y ∈ B . As C is (C, D)-separated, the map πH sends B bijectively to
πH (B) ∈ CH , and similarly πH 0 sends B 0 bijectively to πH 0 (B 0 ) ∈ CH 0 . The claim
then follows from regularity of C.
Note that the conjugations also commute with the maps πH , i.e., πhHh−1 ◦ cH,h =
˜
cD
H,h ◦ πH for H ∈ P and h ∈ G. Assume C is not strongly antisymmetric. Then
there exists a nontrivial permutation τ of a block B ∈ C̃H for some H ∈ P that
arises as a composition of maps σi : Bi−1 → Bi , i = 1 . . . , k where Bi is a block
of C̃Hi , Hi ∈ P, and σi is of the form cHi−1 ,h |Bi−1 (where h ∈ G), πHi−1 ,Hi |Bi−1 ,
or (πHi ,Hi−1 |Bi )−1 (see Definition 2.7). As the maps πHi |Bi : Bi → πHi (Bi ) are
bijective and commute with projections and conjugations, we see τ 0 := σk0 ◦ · · · ◦ σ10
is a nontrivial permutation of πH (B) ∈ CH , where each map σi0 := πHi |Bi ◦ σi ◦
D
D
−1
(πHi−1 |Bi−1 )−1 is of the form cD
Hi−1 ,h |Bi−1 , πHi−1 ,Hi |Bi−1 , or (πHi ,Hi−1 |Bi ) . So C is
not strongly antisymmetric. The proof of antisymmetry is the same except that we
only consider maps σi that are conjugations.
We need to compute I = {IK : K ∈ F} and an I-advice {S, T } such that
the associated P-collection C˜ is (C, DQ0 )-separated. The following lemma states
that for P-collections arising from Definition 5.8, the first condition of (C, DQ0 )separatedness is in fact automatic.
Lemma 5.21. Let I, {S, T }, C and C˜ be as in Definition 5.8. Then all the partitions
in C˜ are invariant under the action of DQ0 by inverse right translation.

134
To prove it, we need the following observation.
Q0 /pOL
Lemma 5.22. Let m0 be a maximal ideal of AL,fδ containing Rad(
. For all
ŌL )
x ∈ AL,fδ , ω ∈ IP , and σ ∈ DQ0 such that the image of σ in Gal(κQ0 /ŌK0 ) is
the Frobenius automorphism x 7→ xq over Fq , it holds that ω x ≡ x (mod m0 ) and
σ
x ≡ σL,fδ (x) (mod m0 ).

Proof. By bilinearity, we may assume x = a ⊗ b where a ∈ ŌL /Rad(ŌL ) and
Q0 /pOL
b ∈ Fqfδ . As ω ∈ IP , it holds that ω a ≡ a (mod Rad(
) and hence ω (a ⊗ b) ≡
ŌL )
Q0 /pOL
a ⊗ b ≡ a ⊗ b (mod m0 ). Similarly, we have σ a ≡ aq (mod Rad(
) by definition
ŌL )
σ
σ
q
and hence (a ⊗ b) ≡ a ⊗ b ≡ a ⊗ b ≡ σL,fδ (a ⊗ b) (mod m0 ).
ω

Now we are ready to prove Lemma 5.21.
Proof of Lemma 5.21. Consider H ∈ P and Hg, Hg 0 in the same block of C̃H . Fix
h ∈ DQ0 . We prove Hgh−1 , Hg 0 h−1 are also in the same block by verifying the
three conditions in Definition 5.8. Let B be the block of CH containing both HgDQ0
and Hg 0 DQ0 . The first condition in Definition 5.8 obviously holds for Hgh−1 and
Hg 0 h−1 since Hgh−1 DQ0 = HgDQ0 ∈ B and Hg 0 h−1 DQ0 = Hg 0 DQ0 ∈ B.
Let K be the field in F isomorphic to LH over K0 . Let δ be the idempotent in IK
satisfying τ̃H (δ) = δB (see Definition 5.4). Suppose eδ > 1. By Definition 5.8, the
order of the unique element c in κ×
Q0 satisfying
g −1

sδ,H + I = c · (g

0−1

sδ,H + I)

is coprime to eδ , where I = (Q0 /pOL )e(Q0 )/eδ +1 . We have h I = I since h ∈ DQ0 .
Therefore
0−1
hg −1
sδ,H + I = h c · (hg sδ,H + I),
where h c ∈ κ×
Q0 has the same order as c. So the second condition in Definition 5.8
is satisfied by Hgh−1 and Hg 0 h−1 .
Q0 /pOL
. By
Now suppose fδ > 1. Let m0 be a maximal ideal of AL,fδ containing Rad(
ŌL )
×
Definition 5.8, the order of the unique element c in (AL,fδ /m0 ) satisfying
g −1

tδ,H + m0 = c · (g

0−1

tδ,H + m0 )

is coprime to fδ . Fix σ ∈ DQ0 whose image in Gal(κQ0 /ŌK0 ) is the Frobenius
automorphism x 7→ xq over Fq . Choose ω ∈ IQ0 and i ∈ Z such that h = ωσ i . By

135
Lemma 5.22, we have
hg −1

tδ,H ≡
≡

ωσ i g −1

(

g −1

tδ,H ) ≡

σ i g −1

(

−1

i
tδ,H ) ≡ σL,f
(g tδ,H ) ≡
δ

−1

(ξ i · tδ,H ) ≡ ξ i · g tδ,H

g −1


i
(tδ,H )
σL,f
δ

(mod m0 ),

where ξ is the primitive fδ th root of unity satisfying σK,fδ (tδ ) = ξ · tδ as in Defini0−1
0−1
tion 5.7. The same argument shows hg tδ,H ≡ ξ i · g tδ,H (mod m0 ). It follows
that
0−1
hg −1
tδ,H + m0 = c · (hg tδ,H + m0 ).
So the third condition in Definition 5.8 is also satisfied by Hgh−1 and Hg 0 h−1 .
We also show that P-collections arising from Definition 5.8 always satisfy a weakening of the second condition of (C, DQ0 )-separatedness, where bijectivity is replaced
by injectivity:
Lemma 5.23. Let I, {S, T }, C and C˜ be as in Definition 5.8. Then for H ∈ P, the
map πH : H\G → H\G/DQ0 sending Hg ∈ H\G to HgDQ0 maps each block of
C̃H injectively to a block of CH .
Proof. Consider H ∈ P and g ∈ G and h ∈ DQ0 such that Hg 6= Hgh−1 . We want
to prove that Hg and Hgh−1 are in different blocks of C̃H .
Let B be the block of CH containing HgDQ0 = Hgh−1 DQ0 . Let K be the field in
F isomorphic to LH over K0 . Let δ be the idempotent in IK satisfying τ̃H (δ) = δB
(see Definition 5.4). Fix σ ∈ DQ0 whose image in Gal(κQ0 /ŌK0 ) is the Frobenius
automorphism x 7→ xq over Fq .
As we assume p > deg(f ), the wild inertia group WQ0 ⊆ G of Q0 over K0 is trivial.
So IQ0 is a cyclic group of order e(Q0 ). Fix a generator ω of IQ0 . By Theorem 5.3
and Definition 5.2, we know eδ is the smallest positive integer k satisfying Hgω −k =
Hg, and fδ is the smallest positive integer k satisfying Hgσ −k IQ0 = HgIQ0 .
So there exist unique i ∈ {0, . . . , fδ − 1} and j ∈ {0, . . . , eδ − 1} such that
Hgh−1 = Hgσ −i ω −j . As Hg 6= Hgh−1 , we have (i, j) 6= (0, 0). By replacing h
with ω j σ i if necessary, we may assume h = ω j σ i .
First assume i 6= 0. Then fδ > 1. Let m0 be a maximal ideal of AL,fδ containing
Q0 /pOL
. As shown in the proof of Lemma 5.21, we have
Rad(ŌL )
hg −1

−1

tδ,H ≡ ξ i · g tδ,H

(mod m0 ),

136
where ξ is a primitive fδ th root of unity. The order of ξ i is fδ / gcd(fδ , i) > 1 and is
a divisor of fδ . So the third condition in Definition 5.8 is not satisfied by Hg and
Hgh−1 . It follows that Hg and Hgh−1 are in different blocks of C̃H , as desired.
Now assume i = 0 and j 6= 0. Then eδ > 1. Let me = Q0 /pOL and k = e(Q0 )/eδ .
−1
As shown in the proof of Lemma 5.18, we have g sδ,H ∈ mke − mk+1
. Choose
e
×
πL ∈ me − m2e . We have a group homomorphism IQ0 → κQ0 sending g ∈ IQ0
g
2
2
to the unique element cg ∈ κ×
Q0 satisfying πL + me = cg (πL + me ). This map is
injective since its kernel is WQ0 = {e}. In particular, we know cω is a primitive
×
e(Q0 )th root of unity in κ×
Q0 . Choose c ∈ κQ0 such that
g −1

sδ,H + mk+1
= c(πLk + mk+1
),
e
e

−1

which exists since g sδ,H and πLk are both in mke − mk+1
. Then we have
e
hg −1

sδ,H + mk+1
=
e

ω j g −1

(

sδ,H + mk+1
)=
e

ωj

(c(πLk + mk+1
))
e
−1

k
k+1
g
= c · cjk
) = cjk
sδ,H + mk+1
).
ω · (πL + me
ω ·(
e
×
The order of cjk
ω ∈ κQ0 is e(Q0 )/ gcd(e(Q0 ), jk) = eδ / gcd(eδ , j) > 1, which is a
divisor of eδ . So the second condition in Definition 5.8 is not satisfied by Hg and
Hgh−1 . It follows that Hg and Hgh−1 are in different blocks of C̃H , as desired.

In the next section, we give subroutines that refine the idempotent decompositions
IK so that C˜ is eventually a compatible, invariant, (C, D)-separated P-collection,
and hence a strongly antisymmetric P-scheme.
5.9

Producing an ordinary P-scheme

We modify the algorithm ComputeDoubleCosetPscheme in Section 5.4 so that a
(C, DQ0 )-separated strongly antisymmetric P-scheme is produced.
The pseudocode of the modified algorithm is given in Algorithm 14. Again, the
algorithm takes a (K0 , f˜)-subfield system F as the input, and outputs for every
K ∈ F an idempotent decomposition IK of the ring RK , together with some
auxiliary data.
The first half (Lines 1–10) of the algorithm is the preprocessing stage: we compute
the same data as in the algorithm ComputeDoubleCosetPscheme. In addition,
for K ∈ F, we compute the inclusion Fq ,→ ŌK /Rad(ŌK ) at Line 4, endowing

137

Algorithm 14 ComputeOrdinaryPscheme
Input: (K0 , f˜)-subfield system F
Output: for every K ∈ F: the outputs of ComputeRings (see Lemma 5.7) on
the input (K, p), and an idempotent decomposition IK of RK
1:
2:
3:
4:
5:
6:

for K ∈ F do
call ComputeRings on (K, p)
IK ← {1}, where 1 denotes the unity of RK
compute the inclusion Fq ,→ ŌK /Rad(ŌK )
for i ← 1 to [K : K0 ] do
compute AK,i and the inclusions ŌK /Rad(ŌK ) ,→ AK,i , Fqi ,→ AK,i

for (K, K 0 ) ∈ F 2 do
8:
call ComputeRelEmbeddings to compute all the embeddings from K to K 0
over K0
7:

9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:

for embedding φ : K ,→ K 0 over K0 do
call ComputeRingHoms on p, K, K 0 and φ compute φ̄, φ̂ and φ̃
repeat
repeat
repeat
call CompatibilityAndInvarianceTestV2
call RegularityTestV2
call StrongAntisymmetryTestV2
call RamificationIndexTest
call InertiaDegreeTest
until IK remains the same in the last iteration for all K ∈ F
call ComputeAdvice on I = {IK : K ∈ F}
until IK remains the same in the last iteration for all K ∈ F
call SurjectivityTest
call RingHomTest
until IK remains the same in the last iteration for all K ∈ F
return the outputs of ComputeRings on the input (K, p) and IK for K ∈ F

138
ŌK /Rad(ŌK ) the structure of an Fq -algebra.15 And for 1 ≤ i ≤ [K : K0 ],
we compute the ring AK,i = ŌK /Rad(ŌK ) ⊗Fq Fqi together with the inclusions
ŌK /Rad(ŌK ) ,→ AK,i , Fqi ,→ AK,i defined by a 7→ a ⊗ 1 and b 7→ 1 ⊗ b
respectively.
The second half (Lines 11–24) of the algorithm refines the idempotent decompositions IK for K ∈ F. The loop in Lines 13–19 is the same as in the algorithm
ComputeDoubleCosetPscheme. It produces idempotent decompositions IK that
define a strongly antisymmetric P-scheme of double cosets C = {CH : H ∈ P}
with respect to DQ0 , in which all the partitions have locally constant ramification
indices and inertia degrees (with respect to (DQ0 , IQ0 )). After that, we call the
subroutine ComputeAdvice in Lemma 5.17 on I = {IK : K ∈ F} at Line 20. It
either properly refines some IK or returns an I-advice. In the former case, we start
over from Line 13.
So assume an I-advice {S, T } is returned at Line 20. Let C˜ = {C̃H : H ∈ P} be
the P-collection associated with I and {S, T }. Next we need two new subroutines,
SurjectivityTest and RingHomTest:
Lemma 5.24. Under GRH, there exists a subroutine SurjectivityTest that updates IK in time polynomial in log p and the size of F so that the partitions CH ∈ C
are refined. Moreover, at least one partition CH is properly refined unless for all
H ∈ P, the map πH : H\G → H\G/DQ0 sending Hg ∈ H\G to HgDQ0 maps
each block of C̃H surjectively to a block of CH .
Lemma 5.25. Under GRH, there exists a subroutine RingHomTest that updates
IK in time polynomial in log p and the size of F so that the partitions CH ∈ C
are refined. Moreover, at least one partition CH is properly refined unless C˜ is
compatible and invariant.
The proofs of the above two lemmas are the most technical part of this chapter. We
defer them to Appendix C.
We run these two subroutines and repeat, until no idempotent decomposition IK is
properly refined in the last iteration. By Lemma 5.21, Lemma 5.23, Lemma 5.24,
15

To achieve this, we compute the image Ȳ of Y + (h̃(Y )) ∈ OK0 ⊆ OK in ŌK by Lemma 3.9.
Then compute the map Fp [Y ]/(h(Y )) → ŌK sending Y + (h(Y )) to Ȳ , and compose it with the
isomorphism ψ0−1 : Fq → Fp [Y ]/(h(Y )) and the quotient map ŌK → ŌK /Rad(ŌK ).

139
and Lemma 5.25, the resulting P-collection C˜ is a compatible, invariant, (C, DQ0 )separated P-collection. Also note that C is a strongly antisymmetric P-scheme of
double cosets with respect to DQ0 . It follows from Lemma 5.20 that C˜ is a strongly
antisymmetric (C, DQ0 )-separated P-scheme. We conclude
Theorem 5.8. Under GRH, the algorithm ComputeOrdinaryPscheme runs in time
polynomial in log p and the size of F, and when it terminates, C is a strongly
antisymmetric P-scheme of double cosets (with respect to DQ0 ), and C˜ is a (C, DQ0 )separated strongly antisymmetric P-scheme.
5.10

Putting it together

We combine the results in previous sections to obtain the generalized P-scheme
algorithm. For simplicity, we first focus on computing the complete factorization
of the input polynomial f . The problem of computing a proper factorization of f is
discussed later in this section.
The algorithm takes a polynomial f (X) ∈ Fq [X] and an irreducible lifted polynomial f˜(X) ∈ A0 [X] as the input, and outputs the complete factorization of f . Its
pseudocode is given in Algorithm 15 below.
Algorithm 15 GeneralizedPschemeAlgorithm
Input: f (X) ∈ Fq [X] and its irreducible lifted polynomial f˜(X) ∈ A0 [X]
Output: factorization of f
1: if p ≤ deg(f ) then run Berlekamp’s algorithm in [Ber70] to compute the
complete factorization of f , output it and halt
2: call ComputeRelNumberFields to compute a (K0 , f˜)-subfield system F such
that (1) F = K0 [X]/(f˜(X)) ∈ F, and (2) for some H ∈ P satisfying LH ∼
=K
0

F , all strongly antisymmetric P-schemes are discrete on H, where P is the
subgroup system over G = Gal(f˜/K0 ) associated with F
3: call ComputeOrdinaryPscheme on F to obtain IK for K ∈ F
4: call ExtractFactorsV2 to extract a factorization of f from IF , and output it
Line 1 checks whether p > deg(f ) holds. If p ≤ deg(f ), we just run Berlekamp’s
algorithm in [Ber70] to compute the complete factorization of f in time polynomial
in p and deg(f ), output it, and halt. This step justifies the assumption p > deg(f )
made in Section 5.7–5.9.
The subroutine ComputeRelNumberFields at Line 2 is the generic part of the
algorithm. It is supposed to compute a (K0 , f˜)-subfield system F such that F ∈ F,

140
and the associated subgroup system P over G satisfies a certain combinatorial
property (see Theorem 5.9 below). The algorithm ComputeOrdinaryPscheme (see
Section 5.4) at Line 3 takes the input F and outputs data that includes the idempotent
decomposition IF of RF . Finally, we call the subroutine ExtractFactorsV2 (see
Section 5.3) at Line 4 to extract a factorization of f from IF .
The following theorem is the main result of this chapter.
Theorem 5.9. Suppose there exists a deterministic algorithm that given a polynomial
g(X) ∈ K0 [X] irreducible over K0 , constructs a (K0 , g)-subfield system F in time
T (g) such that
• K0 [X]/(g(X)) is in F, and
• for some H ∈ P satisfying (L(g))H ∼
=K0 K0 [X]/(g(X)), all strongly antisymmetric P-schemes are discrete on H, where P is the subgroup system over
Gal(g/K0 ) associated with F, and L(g) is the splitting field of g over K0 .
Then under GRH, there exists a deterministic algorithm that given a polynomial
f (X) ∈ Fq [X] and an irreducible lifted polynomial f˜(X) ∈ A0 [X] of f , outputs
the complete factorization of f over Fq in time polynomial in T (f˜) and the size of
the input.
Proof. Consider the algorithm GeneralizedPschemeAlgorithm above and implement the subroutine ComputeRelNumberFields using the hypothetical algorithm
in the theorem. The case p ≤ deg(f ) is solved by Berlekamp’s algorithm in [Ber70].
So assume p > deg(f ). Choose g = f˜. By Theorem 5.8, the P-collection C =
{CH : H ∈ P} defined by CH = P (τ̃H (IK )) is a strongly antisymmetric P-scheme
of double cosets with respect to DQ0 , and the P-collection C˜ = {C̃H : H ∈ P} associated with the collection of idempotent decompositions I = {IK : K ∈ F} and
the I-advice produced by the algorithm ComputeOrdinaryPscheme is a (C, DQ0 )separated strongly antisymmetric P-scheme. By the second condition in the theorem, we have C̃H = ∞H\G (and hence CH = ∞H\G/DQ0 ) for some H ∈ P
satisfying LH ∼
=K0 F . So the idempotent decomposition IF is complete. By
Theorem 5.6, the algorithm outputs the complete factorization of f over Fq .
The subroutine ComputeRelNumberFields runs in time T (f˜). In particular, the
size of F is bounded by T (f˜). The claim about the running time then follows from
Theorem 5.8 and Theorem 5.6.

141
By Theorem 5.9 and Lemma 4.10, we have the following partial generalization of
Corollary 3.2.
Corollary 5.2. Under GRH, there exists a deterministic algorithm that, given a
polynomial f (X) ∈ Fq [X] of degree n ∈ N+ and an irreducible16 lifted polynomial
f˜(X) ∈ A0 [X] of f , computes the complete factorization of f over Fq in time
polynomial in nd(G) and the size of the input, where G is the permutation group
Gal(f /K0 ) acting on the set of roots of f˜.
The unifying framework via the generalized P-scheme algorithm. In the following, we use Theorem 5.9 and Corollary 5.2 to derive generalizations of the main
results in [Hua91a; Hua91b; Rón88; Rón92; Evd92; Evd94; IKS09] in a uniform
way.
Given a polynomial f (X) ∈ Fq [X] and a (possibly reducible) lifted polynomial
f˜(X) ∈ A0 [X] of f . We reduce to the case that the lifted polynomial is irreducible
as follows: using Lemma 5.1, we compute an integer D satisfying D ≡ 1 (mod p)
and a factorization of D · f˜ into irreducible factors f˜1 , . . . , f˜k ∈ A0 [X] over K0 .
Then we have
k
Y
ψ̃0 (fi )(X)
f (X) =
i=1

and the problem of factoring f (X) is reduced to the problem of factoring each
ψ̃0 (fi ) ∈ Fq [X] with the aid of its irreducible lifted polynomial f˜i (X) (see the discussion after Lemma 5.1). Moreover, for i ∈ [k], the Galois group Gal(f˜i (X)/K0 )
is a quotient group of Gal(f˜/K0 ), and hence |Gal(f˜i (X)/K0 )| ≤ |Gal(f˜(X)/K0 )|.
So assume f˜ is irreducible over K0 . We choose F = {F, L} where F =
K0 [X]/(f˜(X)) and L is the splitting field of f˜ over K0 . Compute F in time
polynomial in [L : K0 ] = Gal(f˜(X)/K0 ) and the size of f˜ using Lemma 4.9. By
Lemma 2.4, all antisymmetric P-schemes are discrete on H for all H ∈ P since the
trivial subgroup {e} is in P. Therefore by Theorem 5.9 and the reduction above,
we have the following generalization of Theorem 3.10.
Theorem 5.10. Under GRH, there exists a deterministic algorithm that, given a
polynomial f (X) ∈ Fq [X] and a lifted polynomial f˜(X) ∈ A0 [X] of f , computes
the complete factorization of f over Fq in time polynomial in |Gal(f˜/K0 )| and the
size of the input.
16

The assumption that f˜ is irreducible is not necessary, and can be avoided by adapting
Lemma 4.10. We omit the details.

142
Note |Gal(f˜/K0 )| = deg(f ) when f˜ is irreducible over K0 and Gal(f˜/K0 ) is
abelian. So we have the following generalization of Corollary 3.3.
Corollary 5.3. Under GRH, there exists a deterministic algorithm that, given a
polynomial f (X) ∈ Fq [X] and a lifted polynomial f˜(X) ∈ A0 [X] of f such
that Gal(f˜/K0 ) is abelian, computes the complete factorization of f over Fq in
polynomial time.
Suppose only the polynomial f is known. Let n = deg(f ). We can efficiently
compute a lifted polynomial f˜(X) ∈ A0 [X] of f whose size is polynomial in n and
log q.17 Reduce to the case that f˜ is irreducible over K0 as above. As Gal(f˜/K0 ) is
a subgroup of Sym(n), we have the following generalization of Theorem 3.11.
Theorem 5.11. Under GRH, there exists a deterministic algorithm that, given a
polynomial f (X) ∈ Fq [X] of degree n ∈ N+ , computes the complete factorization
of f in time polynomial in n! and log q.
Now suppose we lift f to f˜, reduce to the case that f˜ is irreducible over K0 , but
compute F using Lemma 4.10 instead. By Corollary 5.2 and Lemma 2.6, we have
the following generalization of Theorem 3.12.
Theorem 5.12. Under GRH, there exists a deterministic algorithm that, given a
polynomial f (X) ∈ Fq [X] of degree n ∈ N+ , computes the complete factorization
of f over Fq in time polynomial in nlog n and log q.
We also have the following theorem that generalizes Theorem 4.3 and the main result
of [Evd92]. The proof is the same as that of Theorem 4.3, except that Theorem 5.9
is used instead of Theorem 3.9, and the base field Q is replaced by K0 .
Theorem 5.13. Under GRH, there exists a deterministic polynomial-time algorithm
that, given a polynomial f (X) ∈ Fq [X] and a lifted polynomial f˜(X) ∈ A0 [X] of
f whose Galois group Gal(f˜/K0 ) is solvable, computes the complete factorization
of f over Fq .
17

We also need to choose h̃(Y ) ∈ Z[Y ], h(Y ) = h̃(Y ) mod p ∈ Fp [Y ] and ψ0 :
Fp [Y ]/(h(Y )) → Fq first, so that A0 = Z[Y ]/(h̃(Y )), K0 = Q[Y ]/(h̃(Y )) and the notion of
lifted polynomials are defined. The isomorphism ψ0 can be efficiently computed by [Len91].

143
Computing a proper factorization of f . Unlike the special case considered in
Chapter 3, replacing discreteness by inhomogeneity in the second condition of Theorem 5.9 does not automatically yield an algorithm computing a proper factorization
of f . The reason is that even if a (C, DQ0 )-separated P-scheme C˜ is inhomogeneous
on a subgroup H ∈ P, the corresponding P-scheme of double cosets C may still be
homogeneous on H. In fact, this is always the case when H\G/DQ0 is a singleton,
or equivalently, when DQ0 acts transitively on H\G by inverse right translation.
Still, by adapting the condition, we obtain some results on computing a proper
factorization of f :
• We formulate a new condition on P-schemes and use it to obtain algorithms
computing one irreducible factor of f . See Theorem 5.14 and Corollary 5.4.
• We formulate conditions on P that involve not only ordinary P-schemes
but also P-schemes of double cosets, and these conditions can be used for
computing the complete factorization as well as a proper factorization. See
Theorem 5.14.
• Finally, we prove a generalization of Lemma 2.18 for P-schemes of double
cosets, and use it to prove a generalization of Theorem 3.13. See Theorem 5.15.
First, we introduce the following definition.
Definition 5.10. For a P-scheme (resp. P-scheme of double cosets) C = {CH :
H ∈ P} and H ∈ P, we say C has a singleton on H if the partition CH has a block
that is a singleton.
The following theorem is a variant of Theorem 5.9 with weakened conditions on the
subgroup system P.
Theorem 5.14. Suppose there exists a deterministic algorithm that, given a polynomial g(X) ∈ K0 [X] irreducible over K0 , constructs a (K0 , g)-subfield system F in
time T (g) such that
• K0 [X]/(g(X)) is in F, and
• for some H ∈ P satisfying (L(g))H ∼
=K0 K0 [X]/(g(X)), all strongly antisymmetric P-schemes of double cosets C with respect to DQ0 that admit a

144
(C, DQ0 )-separated strongly antisymmetric P-scheme are discrete (resp. are
inhomogeneous, have a singleton) on H,18 where P is the subgroup system
over Gal(g/K0 ) associated with F, and L(g) is the splitting field of g over
K0 .
Then under GRH, there exists a deterministic algorithm that, given a polynomial
f (X) ∈ Fq [X] and an irreducible lifted polynomial f˜(X) ∈ A0 [X] of f , outputs
the complete factorization (resp. a proper factorization, an irreducible factor) of f
over Fq in time polynomial in T (f˜) and the size of the input.
Proof. The proof is the almost same as that of Theorem 5.9. The second condition
in the theorem are used to show CH = ∞DQ0 (resp. CH 6= 0DQ0 , CH has a singleton)
for some H ∈ P satisfying LH ∼
=K0 K0 [X]/(f˜(X)), and hence the corresponding
idempotent decomposition is complete (resp. is proper, has a singleton). Then apply
Theorem 5.6. The details are left to the reader.
Observe that if a P-scheme of double cosets C has a singleton on H, then a (C, DQ0 )separated P-scheme also has a singleton on H. So we have the following corollary,
which is an analogue of Theorem 5.9.
Corollary 5.4. Suppose there exists a deterministic algorithm that, given a polynomial g(X) ∈ K0 [X] irreducible over K0 , constructs a (K0 , g)-subfield system F in
time T (g) such that
• K0 [X]/(g(X)) is in F, and
• for some H ∈ P satisfying (L(g))H ∼
=K0 K0 [X]/(g(X)), all strongly antisymmetric P-schemes have a singleton on H, where P is the subgroup system
over Gal(g/K0 ) associated with F and L(g) is the splitting field of g over K0 .
Then under GRH, there exists a deterministic algorithm that, given a polynomial
f (X) ∈ Fq [X] and an irreducible lifted polynomial f˜(X) ∈ A0 [X] of f , outputs an
irreducible factor of f over Fq in time polynomial in T (f˜) and the size of the input.
Finally, we give a generalization of Theorem 3.13:
18

Here DQ0 is the decomposition group of a fixed prime ideal Q0 of OL(g) lying over p. Different
choices of Q0 lead to conjugate subgroups and hence do not matter.

145
Theorem 5.15. Under GRH, there exists a deterministic algorithm that, given a
polynomial f (X) ∈ Fq [X] of degree n ∈ N+ that has k > 1 irreducible factors
over Fq , computes a proper factorization of f in time polynomial in n` and log q,
where ` is the least prime factor of k.
To prove Theorem 5.15, we need the following generalization of Lemma 2.18, whose
proof is deferred to Appendix C.
Lemma 5.26. Let G be a finite group acting transitively on a set S. Let D be a
subgroup of G and let k be the number of D-orbits in S. Suppose k > 1. Let ` ∈ N+
be the least prime factor of k. Let P = Pm be the system of stabilizers of depth m
for some m ≥ ` (with respect to the action of G on S). Then for any x ∈ S and any
P-scheme of double cosets C with respect to D that is homogeneous on Gx , there
exists no antisymmetric (C, D)-separated P-scheme.
Proof of Theorem 5.15. We may assume the irreducible factors of f over Fq are all
distinct and have the same degree d, since otherwise a proper factorization of f can be
found by square-free factorization [Yun76; Knu98] or distinct-degree factorization
[CZ81]. Compute d as the smallest positive integer for which the automorphism
d
x 7→ xq fixes Fq [X]/(f (X)). Then compute k = n/d and `.
As in the proof of Theorem 5.11, we choose a lifted polynomial f˜ ∈ A0 [X] of f
whose size is polynomial in n and log q, and reduce to the case that f˜ is irreducible
over K0 . Use Lemma 4.10 to compute F so that the associated subgroup system P
is the system of stabilizers of depth ` with respect to the action of Gal(f˜/K0 ) on
the set of roots of f˜ in L. This step takes time polynomial in c(P) and the size of f˜,
which is polynomial in n` and log q. The theorem then follows from Theorem 5.14
and Lemma 5.26.
Remark. We may also derive Theorem 5.15 from Theorem 3.13 by reducing to the
case that f satisfies Condition 3.1: by square-free factorization, we may assume f
is square-free. Compute the subring R of Fq [X]/(f (X)) fixed by the Frobenius
automorphism x 7→ xp over Fp . Then find an element z ∈ R such that the minimal
polynomial g of z over Fp is a degree-k polynomial satisfying Condition 3.1. Such
an element z exists if p ≥ k. Then reduce to the problem of computing a proper
factorization of g over Fp . We leave the details to the reader.

146
Chapter 6

CONSTRUCTING NEW P-SCHEMES FROM OLD ONES
In the previous chapters, we developed a framework for polynomial factoring whose
correctness relies on combinatorial properties of P-schemes. Motivated by it, we
continue our study on P-schemes in this chapter and also in subsequent chapters.
Techniques introduced in this chapter have a common theme, namely constructing
new P-schemes from old ones. Such techniques include
• Inverse right translation on the set of P-schemes.
• Restriction of P-schemes to a subgroup, and its analogue for m-schemes.
• Passing to quotient groups.
• Induction of P-schemes.
• Extension of P-schemes to the closure of P.
• Restriction of m-schemes to a subset, and its generalization for P-schemes.
• Constructing primitive m-schemes from a general one.
• Direct products and wreath products.
The first three of them are introduced in Section 6.1. We use them to prove
Lemma 4.12, as promised in Chapter 4.
In Section 6.2, we discuss the induction of P-schemes. For G0 ⊆ G and a subgroup
system P over G, this operation produces a P-scheme from a P 0 -scheme, where
P 0 is a certain subgroup system over G0 . We apply this operation in Section 6.3 to
establish reductions among a family of conjectures concerning P-schemes, whose
resolution would imply that polynomial factoring over finite fields can be solved in
deterministic polynomial time under GRH if an irreducible lifted polynomial with
a special Galois group is given. See below for a more detailed discussion on these
conjectures.
The rest of the above list is discussed in Section 6.4–6.7. In particular, we discuss
primitivity of homogeneous m-schemes in Section 6.6. By exploiting the connection

147
between homogeneous primitive orbit m-schemes and primitive permutation groups,
we prove that for m ≥ 3, every antisymmetric homogeneous orbit m-scheme on a
finite set S where |S| > 1 has a matching. Previously this was known for m ≥ 4, as
proved in [IKS09].
Schemes conjectures. The work [IKS09] proposed a conjecture on m-schemes
called the schemes conjecture.
Conjecture (schemes conjecture). There exists a constant m ∈ N+ such that every
antisymmetric homogeneous m-scheme on a finite set S where |S| > 1 has a
matching.
Assuming this conjecture (and GRH), polynomial factorization over finite fields can
be solved in deterministic polynomial time, as shown in [IKS09]. We reprove this
result in Section 6.3 using a P-scheme algorithm.
For each family G of finite permutation groups, we also formulate an analogous
conjecture, called the schemes conjecture for G, in terms of the notation d(G)
introduced in Definition 2.8.
Conjecture (schemes conjecture for G). There exists a constant m ∈ N+ such that
d(G) ≤ m for all G ∈ G.
We show that assuming this conjecture (and GRH), a polynomial f over finite fields
can be factorized in deterministic polynomial time if we are also given an irreducible
lifted polynomial f˜ of f whose Galois group is in G (as a permutation group on the
set of roots of f˜).
Using induction of P-schemes, we establish reductions among these conjectures for
various families G, so that the schemes conjecture for G reduces to that for G 0 if the
permutation groups in G are “less complex” than those in G 0 . In particular, all these
conjectures reduce to the one for the family of symmetric groups, and the latter turns
out to be equivalent to (a slight relaxation of) the original schemes conjecture. In
summary, the schemes conjectures for various families of finite permutation groups
form a hierarchy of relaxations of the original schemes conjecture.
Therefore, in order to prove the original schemes conjecture, it is necessary to prove
our analogous conjectures for families of less complex permutation groups. On the
other hand, one may hope that progress on the latter would shed some light on the

148
original conjecture. We will follow this approach in subsequent chapters and prove
some nontrivial results.
6.1

Basic operations on P-schemes

In this section, we introduce some basic operations on P-schemes, including inverse
right translation, restriction, and passing to quotient groups. We then use them to
prove Lemma 4.12.
Inverse right translation of P-schemes. Let P be a subgroup system over a finite
group G. For each H ∈ P, the group G acts on H\G by inverse right translation
g
Hh = Hhg −1 . This action induces an action of G on the set of partitions of H\G,
defined by g P = {g B : B ∈ P } for a partition P of H\G. Then G also acts on the
set of P-collections by inverse right translation:
Definition 6.1. The action of G on the set of P-collections by inverse right translation is defined as follows: for a P-collection C = {CH : H ∈ P} and g ∈ G, define
g
C = {g CH : H ∈ P}.
Lemma 6.1. For a P-scheme C and g ∈ G, the P-collection g C is also a P-scheme.
Moreover, if C is antisymmetric (resp. strongly antisymmetric), so is g C.
Proof. This follows in a straightforward manner from G-equivariance of projections
and conjugations (see Lemma 2.2).
So G also acts on the set of P-schemes by inverse right translation, which preserves
antisymmetry and strong antisymmetry.
Restriction to a subgroup. We define the restriction of a subgroup system P over
G and that of P-collections to a subgroup of G.
Definition 6.2 (restriction). Let P be a subgroup system over a finite group G. For
a subgroup G0 of G, define
P|G0 := {H ∈ P : H ⊆ G0 },
which is a subgroup system over G0 , called the restriction of P to G0 .
Let C = {CH : H ∈ P} be a P-collection. For H ∈ P|G0 , regard H\G0 as a subset
of H\G in the obvious way. Then the partition CH of H\G restricts to a partition

149
of H\G0 , denoted by CH |G0 . Define
C|G0 := {CH |G0 : H ∈ P|G0 }
which is a P|G0 -collection, called the restriction of C to G0 .
Next we show that when C is P-scheme, its restriction C|G0 to a subgroup G0 is a
P|G0 -scheme. Moreover, antisymmetry and strong antisymmetry are preserved by
restriction.
Lemma 6.2. Let P be a subgroup system over a finite group G. For a subgroup
G0 of G and a P-scheme C, the restriction C|G0 is a P|G0 -scheme. Moreover, if C is
antisymmetric (resp. strongly antisymmetric), so is C|G0 .
Proof. We have projections πH,H 0 and conjugations cH,g defined between coset
spaces H\G for various subgroups H ⊆ G. And we also have projections and
0
0
conjugations between coset spaces H\G0 for H ⊆ G0 . We use πH,H
0 and cH,g for
the latter maps to distinguish them from the former.
For each H ∈ P|G0 , we have a projection πH,G0 : H\G → G0 \G. This allows us to
partition H\G into “fibers” of πH,G0 , i.e., preimages of elements in G0 \G:
H\G =

a

−1
πH,G
0 (y).

y∈G0 \G

We say x ∈ H\G is in the y-fiber if πH,G0 (x) = y, and y is called the index of x.
Note that the subset H\G0 ⊆ H\G is precisely the y-fiber with y = G0 e ∈ G0 \G.
Consider H, H 0 ∈ P|G0 and a map τ : H\G → H 0 \G that is either a projection
πH,H 0 , or a conjugation cH,g for some g ∈ G0 satisfying H 0 = gHg −1 . We claim
πH,G0 = πH 0 ,G0 ◦ τ , i.e., the map τ preserves the indices of elements. This can be
checked directly: for Hh ∈ H\G, we have πH,G0 (Hh) = G0 h. If τ = πH,H 0 , we
have πH 0 ,G0 ◦ τ (Hh) = πH 0 ,G0 (H 0 h) = G0 h. And if τ = cH,g with g ∈ G0 , we have
πH 0 ,G0 ◦ τ (Hh) = πH 0 ,G0 (H 0 gh) = G0 gh = G0 h. So the claim holds.
This means the map τ is also fibered over G0 \G such that its “y-fiber” τy := τ |π−1 0 (y)
H,G
maps the y-fiber of H\G to the y-fiber of H 0 \G. Setting y = G0 e gives us the map
0
0
τy : H\G0 → H 0 \G0 that is either the projection πH,H
0 , or the conjugation cH,g .
From this observation it is easy to see that compatibility, invariance, and regularity
of C|G0 follows from the corresponding properties of C: fix y = G0 e. Assume to the

150
0
contrary that C|G0 does not satisfy compatibility. Then some projection τy = πH,H
0
maps two elements in the same block of CH |G0 into different blocks of CH 0 |G0 . But
then τ = πH,H 0 also maps these two elements that are in the same block of CH into
different blocks of CH 0 , contradicting compatibility of C. Invariance is proved in the
same way except that we consider conjugations instead of projections. For regularity,
0
0
0
0
0
note that for each projection πH,H
0 : H\G → H \G and blocks B ∈ CH |G0 , B ∈
CH 0 |G0 , we have B = B̃ ∩ (H\G0 ), B 0 = B̃ 0 ∩ (H\G0 ) where B̃ ∈ CH , B̃ 0 ∈ CH 0 .
0−1
−1
−1
0
And for z ∈ B 0 we have πH,H
0 (z) ∩ B = πH,H 0 (z) ∩ B̃ ∩ (H\G ) = πH,H 0 (z) ∩ B̃.
Regularity of C|G0 then follows from regularity of C.

Now assume C|G0 is not antisymmetric. Then for some H ∈ P|G0 and g ∈ NG0 (H),
the map c0H,g restricts to a nontrivial permutation of some block B ∈ CH |G0 . Then
we have g ∈ NG (H) and cH,g restricts to a nontrivial permutation of B̃, where B̃ is
the block of CH satisfying B̃ ∩ (H\G0 ) = B. So C is not antisymmetric.
Finally, assume C|G0 is not strongly antisymmetric. Then there exists a nontrivial
permutation τ of a block B ∈ CH |G0 for some subgroup H ∈ P|G0 such that τ is
a composition of maps σi : Bi−1 → Bi , i = 1 . . . , k, where each Bi is a block of
0
,
|
CHi |G0 , Hi ∈ P|G0 , and σi is of the form c0Hi−1 ,g |Bi−1 (where g ∈ G0 ), πH
i−1 ,Hi Bi−1
−1
0
0
or (πHi ,Hi−1 |Bi ) (see Definition 2.7). Each block Bi is of the form B̃i ∩ (Hi \G )
0
| )−1 , we know
for some B̃i ∈ CHi . In the case that σi is of the form (πH
i ,Hi−1 Bi
0−1
−1
|πH
(z) ∩ Bi | = |πH
(z) ∩ B̃i | = 1 for all z ∈ Bi−1 . So (πHi ,Hi−1 |Bi )−1 is
i ,Hi−1
i ,Hi−1
well defined. Then τ = τ̃ |B for the nontrivial permutation τ = σk · · · ◦ σ1 of the
block B̃ = B̃0 ∈ CH , where each map σ̃i is of the form cHi−1 ,g |B̃i−1 , πHi−1 ,Hi |B̃i−1 ,
or (πHi ,Hi−1 |B̃i )−1 . So C is not strongly antisymmetric.
Next we describe the analogue of Definition 6.2 for m-schemes.
Definition 6.3. Let Π = {P1 , . . . , Pm } be an m-scheme on a finite set S. For
(x1 , . . . , xk ) ∈ S (k) where k < m, define the (m − k)-collection
0
Π|x1 ,...,xk := {P10 , . . . , Pm−k
}

on the set S − {x1 , . . . , xk }, where Pi0 is the partition of S (i) such that two elements
(y1 , . . . , yi ), (y10 , . . . , yi0 ) are in the same block of S (i) iff (x1 , . . . , xk , y1 , . . . , yi ) and
(x1 , . . . , xk , y10 , . . . , yi0 ) are in the same block of S (i+k) .
We also have the analogue of Lemma 6.2 for m-schemes.

151
Lemma 6.3. The (m−k)-collection Π|x1 ,...,xk in Definition 6.2 is an (m−k)-scheme.
Moreover, if Π is antisymmetric (resp. strongly antisymmetric), so is Π|x1 ,...,xk . And
if Π does not have a matching, neither does Π|x1 ,...,xk .
The proof is straightforward by definition. Indeed, if we view Π as a P-scheme via
Definition 2.12 and Definition 2.13, where P is the system of stabilizers of depth m
with respect to the natural action of G = Sym(S) on S. Then Π|x1 ,...,xk is simply
the restriction of this P-scheme to the subgroup Gx1 ,...,xk . We leave the details to
the reader.
Passing to quotient groups. Let G be a finite group and let N be a normal in G.
Write Ḡ for G/N and φ for the quotient map G → Ḡ.
For a subgroup H ⊆ Ḡ, the group G acts on H\Ḡ by inverse right translation
(through its quotient group Ḡ). The stabilizer of He ∈ H\Ḡ is φ−1 (H). So by
Lemma 2.1, we have an equivalence between the action of G on H\Ḡ and that on
φ−1 (H)\G, given by the bijection λHe : H\Ḡ → φ−1 (H)\G sending Hφ(g) to
φ−1 (H)g for g ∈ G.
Let P be a subgroup system over Ḡ. Define P̃ = {φ−1 (H) : H ∈ P}, which is a
subgroup system over G. By identifying H\Ḡ with φ−1 (H)\G via λHe for H ∈ P,
we see that a P-scheme over Ḡ is equivalent to a P̃-scheme over G. This is made
formal by the following lemma.
Lemma 6.4. Let P and P̃ be as above. For a P-collection C = {CH : H ∈ P},
define the P̃-collection C 0 = {Cφ0 −1 (H) : H ∈ P} by choosing
Cφ0 −1 (H) = {λHe (B) : B ∈ CH }.
Then C 7→ C 0 is a one-to-one correspondence between P-schemes over Ḡ and P̃schemes over G. Moreover, C is antisymmetric (resp. strongly antisymmetric) iff
C 0 is antisymmetric (resp. strongly antisymmetric). And C is homogeneous (resp.
discrete) on a subgroup H ∈ P iff C 0 is homogeneous (resp. discrete) on φ−1 (H).
Proof. We check that the maps λHe commute with conjugations and projections:
write πH,H 0 and cH,g for conjugations and projections between coset spaces of Ḡ
0
0
and write πH,H
0 and cH,g for those between coset spaces of G. Then we always have
λH 0 e ◦ πH,H 0 = πφ0 −1 (H),φ−1 (H 0 ) ◦ λHe

152
for H, H 0 ∈ P, H ⊆ H 0 , and
λH 0 e ◦ cH,φ(g) = c0φ−1 (H),g ◦ λHe .
for H, H 0 ∈ P, g ∈ G, H 0 = φ(g)Hφ(g)−1 . Also note that the maps λHe are
bijections. The lemma then follows easily by definition.
We conclude this section by proving Lemma 4.12 using the results developed above.
First we prove the following lemma.
Lemma 6.5. Let k ∈ N+ and Gk ⊆ Gk−1 ⊆ · · · ⊆ G1 ⊆ G0 be a chain of finite
groups. Let P be a subgroup system over G0 . We have:
1. If for all i ∈ [k], all strongly antisymmetric P|Gi−1 -schemes are discrete on
Gi , then all strongly antisymmetric P-schemes are discrete on Gk .
2. If for some i ∈ [k], all strongly antisymmetric P|Gi−1 -schemes are inhomogeneous on Gi , then all strongly antisymmetric P-schemes are inhomogeneous
on Gk .
The same holds if strong antisymmetry is replaced by antisymmetry.
Proof. Assume that there exists a strongly antisymmetric P-scheme C = {CH :
H ∈ P} that is not discrete on Gk . Then there exist two different elements
x, x0 ∈ Gk \G lying in the same block of CGk . Pick the greatest integer i ∈ [k]
satisfying πGk ,Gi−1 (x) = πGk ,Gi−1 (x0 ). Such i exists as πGk ,G0 (x) = πGk ,G0 (x0 ). Let
y = πGk ,Gi (x) and y 0 = πGk ,Gi (x0 ). Then (1) y 6= y 0 by maximality of i and the
fact that x 6= x0 , (2) y, y 0 are in the same block of CGi by compatibility of C and the
fact that x, x0 are in the same block of CGk , and (3) πGi ,Gi−1 (y) = πGi ,Gi−1 (y 0 ) since
πGi ,Gi−1 (y) = πGk ,Gi−1 (x) and πGi ,Gi−1 (y 0 ) = πGk ,Gi−1 (x0 ).
Suppose πGi ,Gi−1 (y) = πGi ,Gi−1 (y 0 ) = Gi−1 g. By replacing C with g C (with respect
to the action of Gk on the set of P-schemes by inverse right translation) and
applying Lemma 6.1, we may assume Gi−1 g = Gi−1 e. Then we can write y = Gi h
and y 0 = Gi h0 for some h, h0 ∈ Gi−1 . By Lemma 6.2, the restriction C|Gi−1 =
{CH |Gi−1 : H ∈ P|Gi−1 } is a strongly antisymmetric P|Gi−1 -scheme. As y, y 0 are
in the same block of CGi , they are also in the same block of CGi |Gi−1 . As y 6= y 0 ,
we know C|Gi−1 is not discrete on Gi . This proves the first claim of the lemma.

153
For the second claim, assume to the contrary that it does not hold. Choose i ∈ [k]
such all strongly antisymmetric P|Gi−1 -schemes are inhomogeneous on Gi . Let
C = {CH : H ∈ P} be a strongly antisymmetric P-scheme that is homogeneous
on Gk . By compatibility, we know C is homogeneous on Gi . Then C|Gi−1 is
also homogeneous on Gi . It is also strongly antisymmetric by Lemma 6.2, which
contradicts the assumption.
The proof for antisymmetry is the same.
Now we are ready to prove Lemma 4.12. For convenience, we restate the lemma.
Lemma 6.6. Let k ∈ N+ and Gk ⊆ Gk−1 ⊆ · · · ⊆ G1 ⊆ G0 be a chain of
finite groups. For i ∈ [k], let Ni be a subgroup of Gi that is normal in Gi−1 ,
πi : Gi−1 → Gi−1 /Ni be the corresponding quotient map, and Pi be a subgroup
system over Gi−1 /Ni that contains Gi /Ni . Define
P = {gπi−1 (H)g −1 : 1 ≤ i ≤ k, H ∈ Pi , g ∈ G0 },
which is a subgroup system over G0 and contains πi−1 (Gi /Ni ) = Gi for all i ∈ [k].
Then we have
1. If for all i ∈ [k], all strongly antisymmetric Pi -schemes are discrete on Gi /Ni ,
then all strongly antisymmetric P-schemes are discrete on Gk .
2. If for some i ∈ [k], all strongly antisymmetric Pi -schemes are inhomogeneous
on Gi /Ni , then all strongly antisymmetric P-schemes are inhomogeneous on
Gk .
The same holds if strong antisymmetry is replaced by antisymmetry.
Proof. Fix i ∈ [k]. By Lemma 6.4 and the definition of P, if all strongly antisymmetric Pi -schemes are discrete (resp. inhomogeneous) on Gi /Ni , then all strongly
antisymmetric P|Gi−1 -schemes are discrete (resp. inhomogeneous) on Gi . The
same holds if strong antisymmetry is replaced by antisymmetry. The lemma now
follows from Lemma 6.5.
6.2

Induction of P-schemes

Let G be a finite group and let G0 be a subgroup of G. Let P be a subgroup system
over G and let
P 0 = {G0 ∩ H : H ∈ P},

154
which is a subgroup system over G0 . In this section, we show that every P 0 -scheme
induces a P-scheme in a way that preserves antisymmetry and strong antisymmetry.
To achieve it, we need the following lemma.
Lemma 6.7. Given g1 , . . . , gk ∈ G such that {g1−1 , . . . , gk−1 } is a complete set of
representatives of H\G/G0 , there exists a bijection
k
a
φ:
(G0 ∩ gi Hgi−1 )\G0 → H\G
i=1

defined as follows: For g ∈ G, define the map
φH,g : (G0 ∩ gHg −1 )\G0 → H\G
sending (G0 ∩ gHg −1 )h to Hg −1 h for h ∈ G0 . The maps φH,g are well defined. For
i ∈ [k], the restriction of φ to (G0 ∩ gi Hgi−1 )\G0 is φH,gi .
Proof. Consider the action of G0 on H\G by inverse right translation. For i ∈ [k], let
Oi = {Hgi−1 g −1 : g ∈ G0 } be the G0 -orbits of Hgi−1 ∈ H\G. Then {O1 , . . . , Ok }
`
is the partition of H\G into the G0 -orbits, i.e., H\G = ki=1 Oi . Fix i ∈ [k]. The
stabilizer of Hgi−1 is G0 ∩ gi Hgi−1 . So by Lemma 2.1, we have an equivalence of
actions of G0
λHgi−1 : Oi → (G0 ∩ gi Hgi−1 )\G0
h

sending (Hgi−1 ) = Hgi−1 h−1 to (G0 ∩ gi Hgi−1 )h−1 for h ∈ G0 . The inverse of this
map is exactly φH,gi . As we are allowed to choose gi to be any g ∈ G, all the maps
φH,g are well defined.
For each H ∈ P, the subgroups G0 ∩ gHg −1 are in P 0 for all g ∈ G. By Lemma 6.7,
we can combine partitions of G0 ∩ gi Hgi−1 \G0 , i = 1, . . . , k, into a partition of
H\G. This leads to the following definition.
0
Definition 6.4 (induction). Let G, G0 , P and P 0 be as above. Let C 0 = {CH
:H∈
P 0 } be a P 0 -scheme. For H ∈ P, choose g1 , . . . , gk ∈ G such that {g1−1 , . . . , gk−1 }
is a complete set of representatives of H\G/G0 . Define the partition CH of H\G by
n
o
CH = φH,gi (B) : i ∈ [k], B ∈ CG0 0 ∩gi Hg−1 ,
i

where the maps φH,gi are as in Lemma 6.7, i.e., each φH,gi sends (G0 ∩ gi Hgi−1 )h
to Hgi−1 h for h ∈ G0 . Define the P-collection C = {CH : H ∈ P}, called the
induction of C 0 to P.

155
The P-collection C constructed as above is indeed a P-scheme:
Theorem 6.1. The P-collection C in Definition 6.4 is a well defined P-scheme, which
does not depend on the choices of the elements gi . Moreover, if C 0 is antisymmetric
(resp. strongly antisymmetric), so is C.
Proof. Fix H ∈ P. It follows from Lemma 6.7 that CH is indeed a partition of
H\G. We need to show that CH is independent of the choices of the elements
g1 , . . . , gk . So consider g10 , . . . , gk0 ∈ G such that {g10−1 , . . . , gk0−1 } is a complete set
of representatives of H\G/G0 as well. We want to show
o
n
0
CH = φH,gi0 (B) : i ∈ [k], B ∈ CG0 ∩g0 Hg0−1 .
i

i

As the right hand side is also a partition of H\G, it suffices to show that φH,gi0 (B) ∈
CH for i ∈ [k] and B ∈ CG0 0 ∩g0 Hg0−1 . Fix i and B. Choose j ∈ [k] such that
i
i
Hgj−1 G0 = Hgi0−1 G0 . And choose g ∈ G0 such that Hgj−1 = Hgi0−1 g −1 . We have
the conjugation
cG0 ∩gi0 Hgi0−1 ,g : (G0 ∩ gi0 Hgi0−1 )\G0 → (G0 ∩ gj Hgj−1 )\G0
sending (G0 ∩ gi0 Hgi0−1 )h to (G0 ∩ gj Hgj−1 )gh for h ∈ G0 . By invariance of C 0 , the
set cG0 ∩gi0 Hgi0−1 ,g (B) is a block of CG0 0 ∩g Hg−1 . So φH,gj ◦ cG0 ∩gi0 Hgi0−1 ,g (B) is a block
j
j
of CH . We claim
φH,gj ◦ cG0 ∩gi0 Hgi0−1 ,g = φH,gi0 ,
which holds since
φH,gj ◦ cG0 ∩gi0 Hgi0−1 ,g ((G0 ∩ gi0 Hgi0−1 )h) = φH,gj ((G0 ∩ gj Hgj−1 )gh) = Hgj−1 gh
= Hgi0−1 h = φH,gi0 ((G0 ∩ gi0 Hgi0−1 )h)
for h ∈ G0 . It follows that φH,gi0 (B) ∈ CH , as desired. So CH does not depend on
the choices of g1 , . . . , gk .
Next we prove that C is a P-scheme. To prove compatibility, consider H, H 0 ∈ P
satisfying H ⊆ H 0 . For g ∈ G, the following diagram commutes:
(G0 ∩ gHg −1 )\G0

πG0 ∩gHg−1 ,G0 ∩gH 0 g−1

φH 0 ,g

φH,g

H\G

(G0 ∩ gH 0 g −1 )\G0

πH,H 0

H 0 \G .

156
For B ∈ CH , we want to show that πH,H 0 (B) is contained in a block of CH 0 . Note
πH,H 0 (B) = πH,H 0 ◦ φH,g (B̃) = φH 0 ,g (y) ◦ πG0 ∩gHg−1 ,G0 ∩gH 0 g−1 (B̃).
Here πG0 ∩gHg−1 ,G0 ∩gH 0 g−1 (B̃) is contained in a block of CG0 0 ∩gH 0 g−1 by compatibility
of C 0 , and hence πH,H 0 (B) is contained in a block of CH 0 . It follows that C is
compatible.
For regularity, consider H, H 0 as above and B ∈ CH . Choose B 0 ∈ CH 0 containing
πH,H 0 (B). We claim that πH,H 0 |B : B → B 0 has constant degree, i.e., the number of
preimages |(πH,H 0 |B )−1 (y)| is independent of the choices of y ∈ B 0 . Choose g ∈ G
and B̃ ∈ CG0 0 ∩gHg−1 such that B = φH,g (B̃). Let B̃ 0 = πG0 ∩gHg−1 ,G0 ∩gH 0 g−1 (B̃).
Then B 0 = φH 0 ,g (B̃ 0 ). By regularity of C 0 , the map πG0 ∩gHg−1 ,G0 ∩gH 0 g−1 |B̃ : B̃ → B̃ 0
has constant degree. The claim follows by noting that φH,g |B̃ : B̃ → B and
φH 0 ,g |B̃ 0 : B̃ 0 → B 0 are bijective. So C is regular.
For invariance, consider H, H 0 ∈ P and h ∈ G satisfying H 0 = hHh−1 . For g ∈ G,
we have G0 ∩gHg −1 = G0 ∩gh−1 H 0 (gh−1 )−1 , and the following diagram commutes
(G0 ∩ gHg −1 )\G0

id

φH 0 ,gh−1

φH,g

H\G

(G0 ∩ gHg −1 )\G0

cH,h

H 0 \G ,

where id denotes the identity map. It follows that cH,h maps blocks of CH to blocks
of CH 0 . So C is invariant.
Now assume C is not strongly antisymmetric and we prove that C 0 is not either. By
definition, there exists a nontrivial permutation τ = σk ◦ · · · ◦ σ1 of a block B ∈ CH
for some H ∈ P such that each σi : Bi−1 → Bi is a map of the form πHi−1 ,Hi |Bi−1 ,
(πHi ,Hi−1 |Bi )−1 , or cHi−1 ,h |Bi−1 , and Bi ∈ CHi , Hi ∈ P, B = B0 = Bk , H = H0 =
Hk (see Definition 2.7).
By the two diagrams above, we can choose gi ∈ G and B̃i ∈ CG0 0 ∩g Hg−1 for
i

i

−1
0 ≤ i ≤ k, and choose σ̃i : B̃i−1 → B̃i of the form πG0 ∩gi−1 Hi−1 gi−1
,G0 ∩gi Hi gi−1 |B̃i−1 ,
−1
−1 |
(πG0 ∩gi Hi gi−1 ,G0 ∩gi−1 Hi−1 gi−1
B̃i ) , or the identity map on B̃i for i ∈ [k], such that
φHi ,gi (B̃i ) = Bi and σi ◦ φHi−1 ,gi−1 |B̃i−1 = φHi ,gi |B̃i ◦ σ̃i for i ∈ [k].1 Define
τ̃ := σ̃k ◦ · · · ◦ σ̃1 which is a map from B̃0 to B̃k . Then the following diagram

1

For the case that σi = (πHi ,Hi−1 |Bi )−1 , we choose σ̃i = (πG0 ∩gi Hi g−1 ,G0 ∩gi−1 Hi−1 g−1 |B̃i )−1 ,
i
i−1
which is well defined since φHi−1 ,gi−1 and φHi ,gi are bijective.

157
commutes.
B̃0

τ̃

B̃k
φH,gk |B̃

φH,g0 |B̃

0

B

k

τ

B

We have Hg0−1 G0 = Hgk−1 G0 , since otherwise the image of φH,g0 and that of φH,gk
would be disjoint (see Lemma 6.7). So Hg0−1 = Hgk−1 g −1 for some g ∈ G0 . The
first part of the proof shows that φH,g0 ◦ cG0 ∩gk Hg−1 ,g = φH,gk . By composing τ̃
k
with cG0 ∩gk Hg−1 ,g , we may assume gk = g0 and B̃k = B̃0 . Then as τ is a nontrivial
k
permutation of B and φH,g0 |B̃0 : B̃0 → B is bijective, we know τ̃ is a nontrivial
permutation of B̃0 . So C is not strongly antisymmetric.
The proof for antisymmetry is the same except that we only consider maps τ that
are conjugations.
Corollary 6.1. Let G, G0 , P, P 0 be as above and let H be a subgroup in P.
1. Suppose all antisymmetric P-schemes are discrete on H. Then all antisymmetric P 0 -schemes are discrete on G0 ∩ gHg −1 for all g ∈ G.
2. Suppose all antisymmetric P-schemes are inhomogeneous on H, and G0 acts
transitively on H\G by inverse right translation. Then all antisymmetric
P 0 -schemes are inhomogeneous on G0 ∩ gHg −1 for all g ∈ G.
The same claims hold if antisymmetry is replaced with strong antisymmetry.
Proof. We prove the claims by contrapositive. For the first claim, suppose C 0 =
0
0
0
0
0
−1
{CH
0 : H ∈ P } is an antisymmetric P -scheme that is not discrete on G ∩ gHg
for some g ∈ G. Choose B ∈ CG0 0 ∩gHg−1 that is not a singleton. By Theorem 6.4,
the induced P-scheme C = {CH 0 : H 0 ∈ P} is antisymmetric. Moreover, we know
C is not discrete on H since the block φH,g (B) ∈ CH is not a singleton.
0
0
For the second claim, suppose C 0 = {CH
∈ P 0 } is an antisymmetric P 0 0 : H
scheme that is homogeneous on G0 ∩ gHg −1 for some g ∈ G. By Theorem 6.4, the
induced P-scheme C = {CH 0 : H 0 ∈ P} is antisymmetric. As G0 acts transitively
on H\G, the double coset space H\G/G0 has only one double coset Hg −1 G0 , which
implies that φH,g : G0 ∩ gHg −1 \G → H\G is surjective. As C 0 is homogeneous on
G0 ∩ gHg −1 , we know C is homogeneous on H .

The proof for strong antisymmetry is the same.

158
Now let S be a finite G-set and let G0 be a subgroup of G. Fix m ∈ N+ and let
P = {GT : 1 ≤ |T | ≤ m} be the system of stabilizers of depth m with respect to
the action of G on S. Then P 0 is exactly the system of stabilizers of depth m with
respect to the action of G0 on S restricted from that of G. Therefore we have:
Corollary 6.2. Let G be a finite group acting on a finite set S, G0 a subgroup of G,
and m ∈ N+ . Let P (resp. P 0 ) be the system of stabilizers of depth m over G (resp.
G0 ) with respect to the action of G (resp. G0 ) on S.
1. Suppose all antisymmetric P-schemes are discrete on Gx for all x ∈ S. Then
all antisymmetric P 0 -schemes are discrete on G0x for all x ∈ S.
2. Suppose all antisymmetric P-schemes are inhomogeneous on Gx0 for some
x0 ∈ S, and G0 acts transitively on S. Then all antisymmetric P 0 -schemes are
inhomogeneous on G0x for all x ∈ S.
The same claims hold if antisymmetry is replaced with strong antisymmetry.
In particular, we see d(G) and d0 (G) (cf. Definition 2.8) are monotone with respect
to inclusion of permutation groups:
Corollary 6.3. Let G be a finite permutation group on a finite set S, and let G0 be
a subgroup of G on S. Then d(G0 ) ≤ d(G) and d0 (G0 ) ≤ d0 (G).
We also mention the following variant of Corollary 6.2, which allows G0 ⊆ G to act
on a proper subset of S.
Corollary 6.4. Let G be a finite group acting on a finite set S, G0 a subgroup of G,
and m ∈ N+ . Let T a subset of S such that the action of G0 on S fixes T setwisely
and S − T pointwisely. Let P (resp. P 0 ) be the system of stabilizers of depth m over
G (resp. G0 ) with respect to the action of G (resp. G0 ) on S (resp. T ). Suppose all
antisymmetric P-schemes are discrete on Gx for all x ∈ S. Then all antisymmetric
P 0 -schemes are discrete on G0x for all x ∈ T . The same claims hold if antisymmetry
is replaced with strong antisymmetry.
Proof. If S = T , the claim holds by Corollary 6.2. So assume S 6= T . Let P 00
be the system of stabilizers of depth m over G0 with respect to the action of G0
on S. Then P 00 = P 0 ∪ {G}. A P 0 -scheme C always extends to a P 00 -scheme
C 0 := C ∪ {CG }, where CG is the only partition of the singleton G\G, and such an

159
extension clearly preserves antisymmetry and strong antisymmetry. The claim then
follows from Corollary 6.2.
6.3

Schemes conjectures

We investigate the following conjecture proposed in [IKS09], known as the schemes
conjecture.
Conjecture 6.1 (schemes conjecture). There exists a constant m ∈ N+ such that
every antisymmetric homogeneous m-scheme on a finite set S where |S| > 1 has a
matching.
It was shown in [IKS09] that this conjecture is true for orbit m-schemes with m = 4.
We improve this result in Section 6.6 by showing that one can even choose m = 3.
For general m-schemes, antisymmetric homogeneous m-schemes with no matching
do exist for m = 1, 2, 3 (see Section 2.5) but no counterexamples are known for
m ≥ 4.
The following theorem was proved in [IKS09].
Theorem 6.2. Assuming GRH and the schemes conjecture, there exists a deterministic polynomial-time algorithm that computes the complete factorization of a given
polynomial f (X) ∈ Fq [X] over a finite field Fq .
We reprove this theorem using the machinery of P-schemes. First note that by
Lemma 2.10, an m-scheme with a matching is not strongly antisymmetric. So we
can replace the schemes conjecture by the following variant, which is implied by
the original one.
Conjecture 6.2. There exists a constant m ∈ N+ such that every strongly antisymmetric m-scheme on a finite set S where |S| > 1 is inhomogeneous.
We also need the following simple lemma whose proof is deferred to Section 6.5. It
shows that inhomogeneity in Conjecture 6.2 can be replaced by discreteness.
Lemma 6.8. Suppose there exists a strongly antisymmetric m-scheme on a finite
set S that is not discrete, where m ∈ N+ and |S| > 1. Then for some finite set
T satisfying 1 < |T | ≤ |S|, there exists a strongly antisymmetric homogeneous
m-scheme on T .
Now we complete the proof of Theorem 6.2.

160
Proof of Theorem 6.2. First assume that Fq = Fp is a prime field and f is square-free
and completely reducible over Fp . Fix the constant m ∈ N+ as guaranteed by the
schemes conjecture, and let n = deg(f ). The algorithm first lifts f to f˜(X) ∈ Z[X]
of degree n such that all coefficients of f˜ are between zero and p. We can assume f˜ is
irreducible over Q using the factoring algorithm for rational polynomials [LLL82].
Let S be the set of roots of f˜ in its splitting field. The Galois group Gal(f˜/Q) of f˜
is then a permutation group on S.
Run the P-scheme algorithm in Chapter 3 that we used to prove Corollary 3.2. By
Corollary 3.2, it suffices to prove d(Gal(f˜/Q)) ≤ m. Assume to the contrary that
d(Gal(f˜/Q)) > m. By Corollary 6.3, we have d(Sym(S)) > m, where Sym(S)
acts naturally on S. Then by Lemma 2.7, there exists a strongly antisymmetric nondiscrete m-scheme on S. By Lemma 6.8, for some finite set T satisfying |T | > 1,
there exists a strongly antisymmetric homogeneous m-scheme on T . But this is a
contradiction to Conjecture 6.2 and hence to the schemes conjecture.
For general f and Fq , we either reduce to the previous case using Berlekamp’s reduction [Ber70] and square-free factorization [Yun76; Knu98], or run the generalized
P-scheme algorithm in Chapter 5 and apply Corollary 5.2 instead.
Schemes conjectures for a family of permutation groups. In the proof of Theorem 6.2, we reduce to the case of the full symmetric group Sym(S) and then apply
the schemes conjecture. On the other hand, if the Galois group G is “less complex”
than Sym(S), we expect that the schemes conjecture can be replaced with a more
moderate assumption. Formalizing this intuition leads to a hierarchy of conjectures,
which we explain now.
Let G be a family of finite permutation groups. We formulate a conjecture for G as
follows.
Conjecture 6.3 (schemes conjecture for G). There exists a constant m ∈ N+ such
that d(G) ≤ m for all G ∈ G.
By Corollary 3.2 and Corollary 5.2, assuming this conjecture (and GRH) guarantees
a polynomial-time factoring algorithm for the case that the Galois group G is in G
as a permutation group:
Theorem 6.3. Assuming GRH and the schemes conjecture for G, there exists a
deterministic polynomial-time algorithm that given a polynomial f (X) ∈ Fq [X]

161
and an irreducible2 lifted polynomial f˜ of f , computes the complete factorization
of f over Fq , provided that the Galois group of f˜, as a permutation group on the set
of roots of f˜, is permutation isomorphic to some group in G.
There exist reductions among these schemes conjectures defined for various families
G. To formulate them, we need the following notation: for two families G and G 0 ,
write G  G 0 if any permutation group G ∈ G is permutation isomorphic to a
subgroup of some permutation group G0 ∈ G 0 (where action of this subgroup is
restricted from that of G0 ). Then we have
Theorem 6.4. The schemes conjecture for G is implied by that for G 0 if G  G 0 .
Proof. This follows directly from Corollary 6.3.
In particular, all these conjectures are subsumed by that for the family of symmetric
groups {Sym(n) : n ∈ N+ }, where each symmetric group Sym(n) acts naturally on
[n]. The latter is equivalent to Conjecture 6.2 by the connection between m-schemes
and P-schemes (see Theorem 2.1).
Therefore, the conjectures for different families of finite permutation groups form a
hierarchy, partially ordered by the relation , and Conjecture 6.2 is the most difficult
one. One possible approach to the schemes conjecture is first relaxing it to those for
simpler permutation groups which may be easier to prove. We will prove results in
the same spirit in subsequent chapters.
Finally, we note that the schemes conjecture hold for the family of primitive solvable
permutation groups, or more generally for primitive permutation groups G not
involving Alt(d) (i.e., Alt(d) is not isomorphic to a subquotient of G), where d is a
constant.
Theorem 6.5. The schemes conjecture for G is true if G is the family of primitive
solvable permutation groups, or the family of primitive permutation groups G not
involving Alt(d), where d ∈ N+ is a constant.
Proof. Let G be a primitive permutation group. Seress [Ser96] proved b(G) ≤ 4
when G is solvable. More generally, it was shown in [GSS98] that there exists a
2

The assumption that f˜ is irreducible is not necessary, and can be avoided by adapting
Lemma 4.10. We omit the details.

162
function g(·) such that b(G) ≤ g(d) if G does not involve Alt(d). The theorem then
follows from Lemma 2.5.
Remark. The schemes conjectures in this section are formulated in terms of discreteness of P-schemes and are used for complete factorization. One can also formulated
conjectures in terms of inhomogeneity and use them for proper factorization. We
leave the details to the reader. To establish reductions between these conjectures (in
terms of inhomogeneity rather than discreteness), one needs to restrict to families
of transitive permutation groups as transitivity is required in Corollary 6.2.
6.4

Extension to the closure of a subgroup system

Suppose P, P 0 are subgroup systems over a finite group G and P ⊆ P 0 . We can
construct a P-scheme from a P 0 -scheme by simply discarding the partitions of H\G
for H ∈ P 0 − P. Conversely, we want to know if a P-scheme can be extended
to a P 0 -scheme. In this section, we show that this is possible in some cases by
formulating the notion of the closure Pcl of a subgroup system P and proving that
P-scheme can always be extended to a Pcl -scheme. As an application, we prove
Lemma 4.16 and Lemma 4.17 as promised before.
Definition 6.5 (closure). Let P be a subgroup system over a group G. Denote by
Pcl the set of subgroups H of G satisfying the following conditions:
1. P contains a subgroup H 0 ⊆ H, and the set of such subgroups has a unique
maximal element (with respect to inclusion), denoted by uP (H), or simply
u(H) when there is no confusion.
2. u(H) is a normal subgroup of H.
Then Pcl is a subgroup system3 over G containing P, called the closure of P.
The usage of the term closure is justified by the obvious fact P ⊆ Pcl and the next
lemma.
Lemma 6.9. (Pcl )cl = Pcl .
Proof. Consider H ∈ (Pcl )cl . Write H 0 = uPcl (H) and H 00 = uP (H 0 ). We show
that H ∈ Pcl and uP (H) = H 00 .
3

It is easy to see that Pcl is closed under conjugation in G, so it is indeed a subgroup system
over G.

163
We first verify that H 00 is normal in H. By definition, we know H 0 is normal in H.
Then for any g ∈ H, we have
H 00 = uP (H 0 ) = uP (gH 0 g −1 ) = guP (H 0 )g −1 = gH 00 g −1 .
So H 00 is normal in H.
Next we show that H 00 is the unique maximal element in P subject to H 00 ⊆ H.
Assume to the contrary that there exists an element U ( H 00 in P ⊆ Pcl that is a
subgroup of H. As H 0 is the unique maximal element in Pcl subject to H 0 ⊆ H, we
have U ⊆ H 0 . Furthermore, as H 00 is the unique maximal element in P subject to
H 00 ⊆ H 0 , we have U ⊆ H 00 , contradicting the assumption U ( H 00 .
By definition, we have H ∈ Pcl and uP (H) = H 00 .
We show that a P-scheme can always be extended to a Pcl -scheme where antisymmetry and strong antisymmetry are preserved.
Lemma 6.10. Let P be a subgroup system over a group G and let C = {CH :
0
H ∈ P} be a P-scheme. There exists a unique Pcl -scheme C 0 = {CH
: H ∈ Pcl }
0
extending C (i.e., CH = CH for H ∈ P), given by
0
CH
= {πu(H),H (B) : B ∈ Cu(H) }.

Moreover, if C is antisymmetric (resp. strongly antisymmetric), so is C 0 . And C 0 is
not discrete on H ∈ Pcl if C is antisymmetric and not discrete on u(H).
Proof. We have u(H) ∈ P ⊆ Pcl for H ∈ Pcl . It follows from Lemma 2.3 that C 0
as defined above is the only possible one extending C.
0
Then we check that C 0 is indeed well defined, i.e., for H ∈ Pcl , the set CH
=
{πu(H),H (B) : B ∈ Cu(H) } is indeed a partition of H\G. For two blocks B1 , B2 ∈
Cu(H) , we prove that πu(H),H (B1 ) and πu(H),H (B2 ) are either identical or disjoint.
Suppose there exist u(H)g1 ∈ B1 and u(H)g2 ∈ B2 satisfying πu(H),H (u(H)g1 ) =
πu(H),H (u(H)g2 ), i.e., Hg1 = Hg2 . Then g2 g1−1 ∈ H ⊆ NG (u(H)). Note that
cu(H),g2 g1−1 (u(H)g1 ) = u(H)g2 . So by invariance of C, we have cu(H),g2 g1−1 (B1 ) =
B2 . Then by Lemma 2.2, we have

πu(H),H (B2 ) = πu(H),H ◦ cu(H),g2 g1−1 (B1 ) = cH,g2 g1−1 ◦ πu(H),H (B1 ) = πu(H),H (B1 )
as desired. So C 0 is well defined. Moreover, we have u(H) = H for H ∈ P. It
follows that C 0 does extend C.

164
Next we show that C 0 is a Pcl -scheme. For H, H 0 ∈ Pcl with H ⊆ H 0 , we have
u(H) ⊆ H 0 and hence u(H) ⊆ u(H 0 ) by the unique maximality of u(H 0 ). By
transitivity of projections (see Lemma 2.2), the following diagram commutes:
u(H)\G

πu(H),u(H 0 )

πu(H 0 ),H 0

πu(H),H

H\G

u(H 0 )\G

πH,H 0

H 0 \G

To show compatibility, consider y, y 0 ∈ H\G lying in the same block B ∈
0
CH
. Choose B̃ ∈ Cu(H) satisfying πu(H),H (B̃) = B and choose x, x0 ∈ B̃
satisfying πu(H),H (x) = y, πu(H),H (x0 ) = y 0 . By compatibility of C, the elements πu(H),u(H 0 ) (x) and πu(H),u(H 0 ) (x0 ) lie in the same block of Cu(H 0 ) . Then
0
πu(H 0 ),H 0 ◦ πu(H),u(H 0 ) maps x and x0 into the same block of CH
0 by the definition of C 0 . By commutativity of the diagram above and the facts πu(H),H (x) = y,
0
πu(H),H (x0 ) = y 0 , we see that πH,H 0 (y) and πH,H 0 (y 0 ) lie in the same block of CH
0.
So C 0 is compatible.
0
. Then πH,H 0 (B) is contained in a unique
For regularity, let B be a block of CH
0
0
0
block B of CH 0 by compatibility of C . Lift B to a block B̃ ∈ Cu(H) along πu(H),H ,
and let B̃ 0 = πu(H),u(H 0 ) (B̃) ∈ Cu(H 0 ) . By regularity of C, the map πu(H),u(H 0 ) |B̃ :
B̃ → B̃ 0 has constant degree, i.e., the number of preimages |(πu(H),u(H 0 ) |B̃ )−1 (y)|
is independent of the choices of y ∈ B̃ 0 . We show that πu(H),H |B̃ (and similarly
πu(H)0 ,H 0 |B̃ 0 ) also has constant degree. Consider y, y 0 ∈ B. As πu(H),H (B̃) = B,
there exists x, x0 ∈ B̃ satisfying πu(H),H (x) = y and πu(H),H (x0 ) = y 0 . Note
that all the elements in (πu(H),H |B̃ )−1 (y) (resp. (πu(H),H |B̃ )−1 (y 0 )) are of the form
cu(H),g (x) (resp. cu(H),g (x0 )) for some g ∈ H since H ⊆ NG (u(H)). And we have
cu(H),g (x) ∈ B̃ iff cu(H),g (x0 ) ∈ B̃ for g ∈ H by invariance of C. It follows that
|(πu(H),H |B̃ )−1 (y)| = |(πu(H),H |B̃ )−1 (y 0 )|. So πu(H),H |B̃ (and similarly πu(H)0 ,H 0 |B̃ 0 )
has constant degree. Then πH,H 0 |B also has constant degree by the commutativity
of the diagram above. So C 0 is regular.

For invariance, note that for H, H 0 ∈ Pcl with H 0 = gHg −1 , we have u(H 0 ) =
gu(H)g −1 . And the following diagram commutes by Lemma 2.2:
u(H)\G

cu(H),g

πu(H 0 ),H 0

πu(H),H

H\G

u(H 0 )\G

cH,g

H 0 \G

165
0
For a block B of CH
, lift it to a block B̃ of Cu(H) . Then cH,g (B) = πu(H 0 ),H 0 ◦
cu(H),g (B̃) by the commutativity of the diagram above. Note that cu(H),g (B̃) is a
0
block of Cu(H 0 ) by invariance of C. So cH,g (B) is a block of CH
0 by definition.
Therefore C 0 is invariant.

Now assume C 0 is not strongly antisymmetric and we prove that C is not either.
By definition, there exists a nontrivial permutation τ = σk ◦ · · · ◦ σ1 of a block
0
B ∈ CH
for some H ∈ Pcl such that each σi : Bi−1 → Bi is a map of the
0
form cHi−1 ,g |Bi−1 , πHi−1 ,Hi |Bi−1 , or (πHi ,Hi−1 |Bi )−1 , and Bi ∈ CH
, Hi ∈ Pcl ,
i
B = B0 = Bk , H = H0 = Hk (see Definition 2.7). By the two diagrams above, we
can lift each Bi to B̃i ∈ Cu(Hi ) for 0 ≤ i ≤ k and lift each σi to a map σ̃i : B̃i−1 → B̃i
of the form cu(Hi−1 ),g |B̃i−1 , πu(Hi−1 ),u(Hi ) |B̃i−1 , or (πu(Hi ),u(Hi−1 ) |B̃i )−1 respectively,
i.e., πu(Hi ),Hi (B̃i ) = Bi and σi ◦ πu(Hi−1 ),Hi−1 |B̃i−1 = πu(Hi ),Hi |B̃i ◦ σ̃i .4 Then
τ̃ := σ̃k ◦ · · · ◦ σ̃1 is a map from B̃0 to B̃k lifting τ . Note that πu(H),H (B̃0 ) =
πu(H),H (B̃k ) = B. So cu(H),g (B̃k ) = B̃0 for some g ∈ H. By composing τ̃ with
cu(H),g (and noting that cH,g is the identity map), we may assume B̃k = B̃0 . So τ̃ is
a permutation of B̃0 . Moreover τ̃ is nontrivial since it lifts τ . So C is not strongly
antisymmetric. The proof for antisymmetry is the same except that we only consider
maps τ that are conjugations.
Finally, to prove the last claim, assume C is antisymmetric and C 0 is discrete on
H ∈ Pcl . We prove that C is discrete on u(H). Consider distinct elements x, x0 ∈
u(H)\G and let y = πu(H),H (x), y 0 = πu(H),H (x0 ). If y 6= y 0 , they are in different
0
0
.
and hence x, x0 are in different blocks of Cu(H) by the definition of CH
blocks of CH
So assume y = y 0 . Then x = u(H)g, x0 = u(H)g 0 for some g, g 0 ∈ G satisfying
Hg = Hg 0 , i.e., g 0 g −1 ∈ H ⊆ NG (u(H)). As x0 = cu(H),g0 g−1 (x), the elements x
and x0 are in different blocks of Cu(H) by antisymmetry of C. So C is discrete on
u(H), as desired.
Recall that for a subgroup system P over a finite group G, we let P+ = {H : H 0 ⊆
H ⊆ NG (H 0 ), H 0 ∈ P} which is also a subgroup system over G (see Section 4.4).
Clearly Pcl ⊆ P+ . We show that equality holds if P is join-closed.
Lemma 6.11. Let P be a subgroup system that is join-closed, i.e., hH, H 0 i ∈ P for
all H, H 0 ∈ P. Then Pcl = P+ .
4

For the case that σi = (πHi ,Hi−1 |Bi )−1 , we lift πHi ,Hi−1 |Bi to πu(Hi ),u(Hi−1 ) |B̃i . As C is
antisymmetric, both πu(Hi−1 ),Hi−1 |B̃i−1 and πu(Hi ),Hi |B̃i are bijective. So πu(Hi ),u(Hi−1 ) |B̃i is also
bijective and its inverse is well defined.

166
Proof. Consider H ∈ P+ . We prove H ∈ Pcl by verifying the conditions in
Definition 6.5.
Choose a maximal element H 0 ∈ P subject to H 0 ⊆ H. Such an element exists by the
definition of P+ . We first show that H 0 is unique. Assume to the contrary that there
exists another maximal element H 00 ⊆ H in P different from H 0 . Then hH 0 , H 00 i )
H 0 is also a subgroup of H and lies in P by join-closedness, contradicting maximality
of H 0 . So H 0 is unique.
Next we prove H 0 is normal in H. Assume to the contrary that there exists g ∈ H
such that gH 0 g −1 6= H 0 . As gH 0 g −1 ⊆ gHg −1 = H and gH 0 g −1 ∈ P, the join
hH 0 , gH 0 g −1 i ) H 0 is also a subgroup of H and lies in P by join-closedness, again
contradicting maximality of H 0 .
As an application, we consider a system of stabilizers with respect to the natural
action of a symmetric group or an alternating group.
Lemma 6.12. Let S be a finite G-set where G is Sym(S) or Alt(S) acting naturally
on S. Let P = Pm be the corresponding system of stabilizers of depth m, where
m < |S|/2. Then P 0 := P ∪ {G} is join-closed.
Proof. Note P 0 = {GT : 0 ≤ T ≤ m}. Let T and T 0 be subsets of S of cardinality
at most m. We show that hGT , GT 0 i ∈ P 0 . Obviously we have hGT , GT 0 i ⊆ GT ∩T 0 .
First assume G = Sym(S). We have GT ∼
= Sym(S − T ), GT 0 ∼
= Sym(S − T 0 )
and GT ∩T 0 ∼
= Sym(S − (T ∩ T 0 )) by restricting to the subsets S − T , S − T 0
and S − (T ∩ T 0 ) respectively. The group Sym(S − (T ∩ T 0 )) is generated by
transpositions (x y) with x, y ∈ S − (T ∩ T 0 ). We claim that every such (x y) is
contained in hGT , GT 0 i. This is obvious if x and y are both in S − T or S − T 0 . So
we assume x ∈ T − T 0 and y ∈ T 0 − T . As m < |S|/2, the set S − (T ∪ T 0 ) is not
empty. Pick z ∈ S − (T ∪ T 0 ). Then (x y) = (y z)(x z)(y z)−1 ∈ hGT , GT 0 i since
y, z ∈ S − T and x, z ∈ S − T 0 . So hGT , GT 0 i = GT ∩T 0 ∈ P 0 .
Next assume G = Alt(S). If |S| ≤ 4, one can directly verify that hGT , GT 0 i equals
G, GT or GT 0 . So assume |S| ≥ 5. Note that GT ∩T 0 ∼
= Alt(S − (T ∩ T 0 )) is
generated by 3-cycles (x y z) with x, y, z ∈ S − (T ∩ T 0 ). We claim that every
such (x y z) is contained in hGT , GT 0 i. This is obvious if x, y, z are all in S − T or
S −T 0 . So we assume x, y ∈ T −T 0 and z ∈ T 0 −T (the other cases are symmetric).
Pick w ∈ S − (T ∪ T 0 ) and let (w z u) be a 3-cycle for some u ∈ S − T − {z, w}.

167
Then (x y z) = (w z u)(x y w)(w z u)−1 ∈ hGT , GT 0 i since w, z, u ∈ S − T and
x, y, w ∈ S − T 0 . So again hGT , GT 0 i = GT ∩T 0 ∈ P 0 .
Corollary 6.5. Let S be a finite G-set where G is Sym(S) or Alt(S) acting naturally
on S. Let P = Pm be the corresponding system of stabilizers of depth m, where
m < |S|/2. Then Pcl = P+ .
Proof. Let P 0 = P ∪ {G}. Then by Lemma 6.12, we have P+ ⊆ P+0 = Pcl0 =
Pcl ∪ {G}. If G ∈ P, we have Pcl ∪ {G} = Pcl and hence P+ ⊆ Pcl . On the other
hand, if G 6∈ P, none of the groups in P is normal in G, and hence G 6∈ P+ . So we
still have P+ ⊆ Pcl .
Remark. The condition m < |S|/2 is necessary: suppose |S| ≥ 6 is even and
let m = |S|/2. Partition S into S1 and S2 of the same cardinality m. When
G = Sym(S) (resp. G = Alt(S)), the subgroup hGS1 , GS2 i is the product of two
copies of the symmetric group (resp. alternating group) of degree m. It is a proper
subgroup of G but stabilizes no element of S. Therefore hGS1 , GS2 i 6∈ Pm ∪ {G}.
Indeed, we have hGS1 , GS2 i ∈ (Pm )+ −(Pm )cl since GS1 ⊆ hGS1 , GS2 i ⊆ NG (GS1 )
whereas both GS1 and GS2 are maximal among subgroups of hGS1 , GS2 i in Pm .
Lemma 4.16 now follows from Lemma 6.10 and Corollary 6.5.
We also consider the case G = GL(V ) with the natural action on a vector space V .
Lemma 6.13. Let V be a finite dimensional vector space over a finite field F . Let
P = Pm be the system of stabilizers of depth m with respect to the natural action of
G := GL(V ) on S := V − {0}, where m < dimF V . Then Pcl = P+ .
Proof. Consider H ∈ P+ and we prove that H ∈ Pcl . Choose H 0 ∈ P such that
H 0 ⊆ H ⊆ NG (H 0 ). It suffices to show that H 0 is the unique maximal element in
P subject to H 0 ⊆ H. Assume to the contrary that there exists another maximal
element H 00 ⊆ H in P. As m < dimF V , we have H 0 = GV 0 and H 00 = GV 00 for
some proper linear subspaces V 0 , V 00 of V . As H 00 6⊆ H 0 , we have V 0 6⊆ V 00 . Also
note that V − (V 0 ∪ V 00 ) 6= ∅ since
|V 0 ∪ V 00 | = |V 0 | + |V 00 | − |V 0 ∩ V 00 | < 2|V |/|F | ≤ |V |.
Pick v ∈ V 0 − V 00 and v 0 ∈ V − (V 0 ∪ V 00 ). Choose g ∈ H 00 = GV 00 sending v to
v 0 which is possible since v, v 0 6∈ V 00 . As g ∈ H 00 ⊆ H ⊆ NG (H 0 ) = NG (GV 0 ), we
have g V 0 = V 0 . But g v = v 0 6∈ V 0 , and we get a contradiction.

168
Lemma 4.16 now follows from Lemma 6.10 and Lemma 6.13.
6.5

Restricting to a subset

Suppose Π = {P1 , . . . , Pm } is an m-scheme on a finite set S and T is a subset
of S. Then we can restrict Π to T and obtain an m-collection on T , denote by
ΠkT .5 In this section, we investigate this operation and use it to prove Lemma 6.8 in
Section 6.2. We also discuss its generalization for P-schemes, where P is a system
of stabilizers.
Definition 6.6. Let Π = {P1 , . . . , Pm } be an m-collection on a finite set S, where
m ∈ N+ . For a subset T of S, define the m-collection ΠkT := {P10 , . . . , Pm0 } on T ,
where Pk0 := Pk |T (k) is the restriction of Pk to T (k) ⊆ S (k) for k ∈ [m].
Lemma 6.14. Suppose Π = {P1 , . . . , Pm } is an m-scheme on S and T ⊆ S is a
disjoin union of blocks in P1 . Then ΠkT is also an m-scheme. Moreover, if Π is
antisymmetric (resp. strongly antisymmetric), so is ΠkT . And if Π does not have a
matching, neither does ΠkT .
Proof. By compatibility of Π, for k ∈ [m] and B ∈ Pk , either B ⊆ T (k) or
B ∩ T (k) = ∅, and hence T (k) is a disjoint union of blocks of Pk . Then the various
properties of ΠkT (compatibility, regularity, etc.) follow from those of Π in a
straightforward manner.
In particular, suppose Π = {P1 , . . . , Pm } is a strongly antisymmetric m-scheme on
S that is not discrete. Let T be a block of P1 such that |T | > 1. Then ΠkT is a
strongly antisymmetric homogeneous m-scheme on T . Lemma 6.8 now follows.
Next we discuss the analogue of Lemma 6.14 for P-schemes. Let G be a finite group
acting on a finite set S. Let P = Pm be the corresponding system of stabilizers
of depth m over G for some m ∈ N+ . By Lemma 2.1, for x ∈ S, we have an
equivalence of group actions
λx : Gx → Gx \G
between the action of G on the G-orbit Gx and that on Gx \G by inverse right
translation. It sends g x to Gx g −1 for g ∈ G.
5

It should not be confused with the notation Π|x1 ,...,xk in Definition 6.3, which is an (m − k)scheme on S − {x1 , . . . , xk }.

169
Definition 6.7. Let m, G and P be as above. Let C = {CH : H ∈ P} be a Pscheme. Let T be a subset of S such that for z ∈ T , the set λz (Gz ∩ T ) is a disjoint
union of blocks in CGz . Moreover, define G0 to be the setwise stabilizer G{T } and
suppose it satisfies the following conditions:
1. For U, U 0 ⊆ T satisfying 1 ≤ |U |, |U 0 | ≤ m and G0U ⊆ G0U 0 , we have
GU ⊆ GU 0 .
2. For k ∈ [m] and x ∈ T (k) , we have G0 x = Gx ∩ T (k) .
Let P 0 be the system of stabilizers of depth m over G0 with respect to the action
of G0 on T (restricted from the action of G on S). We define a P 0 -collection
0
C 0 = {CH
: H ∈ P 0 } as follows:
For H ∈ P 0 , choose a nonempty subset U ⊆ T of cardinality at most m such
that H = G0U . Identify G0U \G0 with a subset of GU \G via the injective map
0
iU : G0U \G0 ,→ GU \G sending G0U g to GU g for g ∈ G0 .6 Then define CH
to be the
0
0
restriction of CGU to GU \G .
The assumption that λz (Gz ∩ T ) is a disjoint union of blocks in CGz for all z ∈ T is
the analogue of the assumption in Lemma 6.14 that T is a disjoint union of blocks
in P1 . If G acts transitively on S, we have Gz = S, in which case this assumption
is equivalent to that λz (T ) is a disjoint union of blocks in CGz for some z ∈ T .
Note that we also need two additional conditions on G0 . They are satisfied in the
following important cases.
Example 6.1. Suppose G is the full symmetric group Sym(S) acting naturally on
S. The image of the permutation representation G0 → Sym(T ) is Sym(T ). In
this case the two conditions in Definition 6.7 are satisfied for any subset T of S
whose cardinality greater than m + 1.7 Indeed, if we view the P-scheme C as an
m-scheme by Theorem 2.1, the construction of C 0 from C is precisely the restriction
of an m-scheme to the subset T (see Definition 6.6).
Example 6.2. Suppose S = V − {0} where V is a finite dimensional vector space
over a finite field F . Let G be the general linear group GL(V ) acting naturally on
6

This is indeed a well defined injective map by Lemma 2.1. Let G0 act on GU \G by inverse
right translation and let O be the G0 -orbit of GU e. The stabilizers of GU e is G0U . So we have a
bijection O → G0U \G0 whose inverse (composed with O ,→ GU \G) is iU .
7
The first condition does not hold for |T | ≤ m + 1: if U, U 0 ⊆ T are different subsets of
cardinality |T | − 1, we have G0U = G0U 0 = G0T , but GU 6= GU 0 unless T = S.

170
S. Let T = V 0 − {0} ⊆ S where V 0 is a linear subspace of V . The image of the
permutation representation G0 → Sym(T ) is isomorphic to GL(V 0 ). It is easy to
verify that in this case the two conditions in Definition 6.7 are also satisfied.
We prove the following generalization of Lemma 6.14.
Lemma 6.15. The P 0 -collection C 0 is a well defined P 0 -scheme. Moreover, if C is
antisymmetric (resp. strongly antisymmetric), so is C 0 .
0
Proof. In Definition 6.7 we define each CH
by picking U ⊆ T of cardinality at most
0
m satisfying H = GU . Here the group GU and the map iU do not depend on the
choice of U by the first condition in Definition 6.7. So C 0 is well defined.

For H, H 0 ∈ P 0 satisfying H ⊆ H 0 , we pick nonempty subsets U, U 0 ⊆ T of
cardinality at most m such that H = G0U and H 0 = G0U 0 . Then GU ⊆ GU 0 by the
first condition in Definition 6.7. And the following diagram commutes.
G0U \G0

πG0

U

,G0 0
U

iU 0

iU

GU \G

G0U 0 \G0

πGU ,G

U0

GU 0 \G

For H, H 0 ∈ P 0 and g ∈ G0 satisfying H 0 = gHg −1 , we pick a nonempty subset
U ⊆ T of cardinality at most m such that H = G0U , and let U 0 = g U ⊆ T . Then
H 0 = G0U 0 = gG0U g −1 and GU 0 = gGU g −1 . And the following diagram commutes.
G0U \G0

cG0

U

,g

iU 0

iU

GU \G

G0U 0 \G0

cGU ,g

GU 0 \G

Let U be a nonempty subset of T of cardinality at most m. We claim iU maps
each block of CG0 0 to a block of CGU . The rest of the proof focuses on this claim.
U
Combining it with the two diagrams above, we can derive the various properties
of C 0 (compatibility, regularity, invariance, antisymmetry and strong antisymmetry)
from the corresponding properties of C in a straightforward manner.
Let B be a block of CG0 U and B 0 be the block of CGU containing iU (B). Assume
to the contrary that iU (B) 6= B 0 . Choose GU g −1 , GU g 0−1 ∈ GU \G, represented by
g −1 , g 0−1 ∈ G respectively, such that GU g −1 ∈ iU (B) and GU g 0−1 ∈ B 0 −iU (B). We

171
0
may assume g ∈ G0 and hence g z ∈ g T = T for all z ∈ T . Also note B = i−1
U (B )
by construction. So from GU g 0−1 ∈ B 0 − iU (B) we know GU g 0−1 6∈ iU (G0U \G0 ).
0

Assume there exists z ∈ U such that g z 6∈ T . As GU g −1 and GU g 0−1 are in the
same block B 0 of CGU , by compatibility of C we know πGU ,Gz (GU g −1 ) = Gz g −1
and πGU ,Gz (GU g 0−1 ) = Gz g 0−1 are in the same block of CGz . On the other hand,
0
we have Gz g −1 = λz (g z) ∈ λz (Gz ∩ T ) and Gz g 0−1 = λz (g z) 6∈ λz (Gz ∩ T ) since
0
g
z ∈ Gz ∩ T , g z 6∈ T and λz : Gz → Gz \G is a bijection. But this contradicts the
assumption that λz (Gz ∩ T ) is a disjoint union of blocks of CGz .
0

Now assume g z ∈ T for all z ∈ U . Suppose U = {x1 , . . . , xk }, where xi are
0
distinct and ordered in an arbitrary way. Let x = (x1 , . . . , xk ) ∈ T (k) . Then g x is in
0
00
Gx ∩ T (k) and hence in G0 x by the second condition in Definition 6.7. So g x = g x
for some g 00 ∈ G0 . Then g 0−1 g 00 ∈ Gx = GU . So GU g 0−1 = GU g 00−1 = iU (G0U g 00−1 ),
contradicting the fact GU g 0−1 6∈ iU (G0U \G0 ) above. This proves the claim that iU
maps each block of CG0 0 to a block of CGU .
U

Primitivity of homogeneous m-schemes

6.6

The notion of primitivity is important for permutation groups as well as association
schemes. In this section, we extend it to homogeneous m-schemes. As an application, we show that every antisymmetric homogeneous orbit m-scheme on a finite
set S has a matching if |S| > 1 and m ≥ 3.
Definition 6.8 (primitivity). Let Π = {P1 , . . . , Pm } be a homogeneous m-scheme
on a finite set S. For B ∈ P2 , denote by GB the simple graph8 on the vertex set S
such that there exists an edge between two distinct vertices u, v iff (u, v) or (v, u)
is in B. We say Π is primitive if GB is connected for all B ∈ P2 . Otherwise Π is
imprimitive.
The reader familiar with primitivity of association schemes (see, e.g., [CGS78])
may recognize that when m ≥ 3, Definition 6.8 simply defines Π = {P1 , . . . , Pm }
to be primitive iff P (Π0 ) is primitive, where Π0 denotes the homogeneous 3scheme {P1 , P2 , P3 } and P (Π0 ) is the corresponding association scheme (see Definition 2.16).
Remark. Our definition of primitivity coincides with the notion of primitivity at
level 2 introduced in the full version of [IKS09]. The same paper also generalizes
8

A simple graph is an undirected graph without loops or multiple edges.

172
the notion of primitivity to higher levels. We will not discuss their generalization in
this thesis, but refer the interested reader to [IKS09] for further details.
Restricting to a connected component. We note that restricting a homogeneous
m-scheme to a connected component yields another homogeneous m-scheme:
Lemma 6.16. Let Π = {P1 , . . . , Pm } be a homogeneous m-scheme on a finite set
S where m ≥ 3. For each B ∈ P2 and a connected component T ⊆ S of GB , the
m-collection ΠkT (see Definition 6.6) is a homogeneous m-scheme on T . Moreover,
if Π is antisymmetric (resp. strongly antisymmetric), then so is ΠkT . And if Π has
no matching, then neither does ΠkT .
Proof. Let T ⊆ S be as in the lemma. It is well known that there exist blocks
B1 , . . . , Bk ∈ P2 such that the union of these blocks and 1S = {(x, x) : x ∈ S}
yields an equivalence relation ∼ on S, and T is one of its equivalence classes (see,
e.g., [CGS78]).
For k ∈ [m], define the equivalence relation ∼k on S (k) such that (x1 , . . . , xk ) ∼k
(y1 . . . , yk ) iff xi ∼ yi for all i ∈ [k]. These equivalence relations are respected by the
maps πik and ckg . The various properties of ΠkT then follow from the corresponding
properties of Π in a straightforward manner.
Primitivity of homogeneous orbit m-schemes. The next lemma states that primitivity of homogeneous orbit m-schemes is equivalent to primitivity of the associated
permutation group.
Lemma 6.17. A homogeneous orbit m-scheme on a finite set S associated with
K ⊆ Sym(S) is primitive iff K is a primitive permutation group on S.
Proof. Let Π = {P1 , . . . , Pm } be a homogeneous orbit m-scheme associated with
a group K ⊆ Sym(S). Then K acts transitively on S. The graphs GB for B ∈ P2
are known as the non-diagonal (undirected) orbital graphs. The lemma then follows
from Definition 6.8 and the well known fact that a transitive permutation group is
primitive iff every non-diagonal orbital graph is connected [Hig67].
In general, we can obtain a primitive orbit m-scheme from a possibly imprimitive
one by restricting to a minimal set that is a connected component:

173
Lemma 6.18. Let Π = {P1 , . . . , Pm } be a homogeneous orbit m-scheme on S
associated with K ⊆ Sym(S), where |S| > 1. Let T be a minimal subset of S
such that T is a connected component of GB for some B ∈ P2 . Let K 0 be the
image of the permutation representation K{T } → Sym(T ). Then ΠkT is a primitive
homogeneous orbit m-scheme on T , and is the orbit m-scheme associated with K 0 .
Proof. As already noted, for B ∈ P2 and any connected component T 0 of GB ,
there exist blocks B1 , . . . , Bk ∈ P2 such that the union of these blocks and 1S =
{(x, x) : x ∈ S} yields an equivalence relation on S where T 0 is an equivalence
class [CGS78]. Primitivity of Π then follows from minimality of T .
Choose B ∈ P2 such that T is a connected component of GB . Note that for g ∈ K
and (u, v) ∈ S (2) , the edge (u, v) is in GB iff (g u, g v) is in GB . So for g ∈ K, the
set g T is a connected component of GB . It follows that T is a set of imprimitivity
of K, i.e., g T ∩ T = ∅ or g T = T for all g ∈ K.
Consider k ∈ [m] and x, y ∈ T (k) in the same block of Pk |T (k) ∈ ΠkT . There exists
g ∈ K sending x to y. As T is a set of imprimitivity of K, we have g T = T and
hence g ∈ K 0 . So ΠkT is the orbit m-scheme on T associated with K 0 .
Antisymmetric homogeneous orbit m-schemes for m ≥ 3. As an application,
we prove that for m ≥ 3, an antisymmetric homogeneous orbit m-scheme Π on a
finite set S where |S| > 1 always has a matching. In particular, it is not strongly
antisymmetric by Lemma 2.10. The same claim for m ≥ 4 was proved in [IKS09].
Note that strongly antisymmetric homogeneous orbit m-schemes on sets S where
|S| > 1 do exist for m = 1 and m = 2 (see Section 2.5).
We need the following result from finite group theory.
Lemma 6.19. Let G be a primitive solvable permutation group on a finite set S.
The set S can be identified with a finite dimensional vector space V over a finite
field F such that G acts on it as a subgroup of the general affine group
AGL(V ) = {φg,u : g ∈ GL(V ), u ∈ V },
where φg,u sends x ∈ V to g x + u. Moreover, the group G contains the translation
φe,u : x 7→ x + u for all u ∈ V .
See [Sup76, Section I.4] for its proof. We have

174
Theorem 6.6. Let Π = {P1 , . . . , Pm } be an antisymmetric homogeneous orbit mscheme on a finite set S associated with a group K ⊆ Sym(S), where m ≥ 3 and
|S| > 1. Then Π has a matching.
Proof. We may assume m = 3. Assume to the contrary that Π has no matching. Let
T be a minimal subset of S such that T is a connected component of GB for some
B ∈ P2 . Let K 0 be the image of the permutation representation K{T } → Sym(T ).
By Lemma 6.16 and Lemma 6.18, the m-scheme ΠkT is the orbit m-scheme on
T associated with K 0 which is antisymmetric, homogeneous, primitive and has no
matching. By replacing Π with ΠkT , S with T , and K with K 0 , we may assume Π
is primitive. Then K is a primitive permutation group on S by Lemma 6.17. Also
note that |K| is odd by Lemma 2.16. It follows by the Odd Order Theorem [FT63]
that K is solvable. We conclude that K is a primitive solvable permutation group
on S of odd order.
By Lemma 6.19, we can identify S with a finite dimensional vector space V over a
finite field F , and K with a subgroup of AGL(V ) acting on V that contains all the
translations φe,u , u ∈ V . Moreover, we have char(F ) 6= 2 since |K| is odd.
Choose v ∈ V − {0}. Let x = (0, v, 2v) ∈ S (3) , y = π33 (x) = (0, v) ∈ S (2) and
z = π13 (x) = (v, 2v) ∈ S (2) . Let B = Kx ∈ P3 , B 0 = π33 (B) = Ky ∈ P2 and
B 00 = π13 (B) = Kz ∈ P2 . We claim that B together with the maps π33 |B : B → B 0 ,
π13 |B : B → B 00 is a matching of Π, which contradicts the assumption. To see this,
note that the translation φe,v : x 7→ x + v is in K and sends y to z. So B 0 = B 00 . We
also need to prove |B| = |B 0 |. By the orbit-stabilizer stabilizer theorem, it suffices
to show Kx = Ky , which holds since 2v lies on the affine line spanned by 0 and v,
and K acts affine linearly on V . The claim follows.
Remark. The first half of our proof basically follows [IKS09] which reduces to the
case that K is primitive solvable. In [IKS09], the proof is completed by a result of
Seress [Ser96] that bounds the minimal base size of primitive solvable permutation
groups of odd order. This result allows them to prove the theorem for m ≥ 4.
We substitute it with the more elementary fact in Lemma 6.19, and use the above
argument to prove the theorem for m ≥ 3.
6.7

Direct products and wreath products

We describe two more techniques of constructing new P-schemes (resp. mschemes) from old ones, namely the direct product and the wreath product. They

175
extend the direct product and the wreath product of association schemes (see, e.g.,
[SS98]). As an application, we show that either the schemes conjecture (Conjecture 6.1) is true, or there exist infinitely many counterexamples.
Direct products. Suppose P and P 0 are subgroup systems over finite groups G
and G0 respectively. Define
P × P 0 := {H × H 0 : H ∈ P, H 0 ∈ P 0 }
which is a subgroup system over G × G0 . For H ∈ P and H 0 ∈ P 0 , we have a
bijection
φH,H 0 : H\G × H 0 \G0 → (H × H 0 )\(G × G0 )
sending (Hg, H 0 g 0 ) to (H × H 0 )(g, g 0 ) for g ∈ G and g 0 ∈ G0 . Then we define the
direct product of a P-collection and a P 0 -collection as follows.
Definition 6.9. For a P-collection C = {CH : H ∈ P} and a P 0 -collection
0
00
0
: H ∈ P 0 }, define the (P × P 0 )-collection C × C 0 = {CH×H
C 0 = {CH
0 : H ×H ∈
P × P 0 } by
00
0
0
0
CH×H
0 = {φH,H 0 (B × B ) : B ∈ CH , B ∈ CH 0 },

called the direct product of C and C 0 .
We have
Lemma 6.20. The direct product C × C 0 is a (P × P 0 )-scheme if C is a P-scheme
and C 0 is a P 0 -scheme. Moreover, if C and C 0 are antisymmetric (resp. strongly
antisymmetric), so is C × C 0 .
0
00
Proof. Write πH,H 0 (resp. πH,H
0 , πH,H 0 ) for a projection between coset spaces of
subgroups in G (resp. G0 , G × G0 ). Similarly write cH,g (resp. c0H,g , c00H,g ) for
a conjugation between coset spaces of subgroups in G (resp. G0 , G × G0 ). For
H = H1 × H2 , H 0 = H10 × H20 ∈ P × P 0 satisfying H ⊆ H 0 , we have H1 ⊆ H10 ,
H2 ⊆ H20 and
00
0
πH
0
0 ◦ φH1 ,H2 (x, y) = φH 0 ,H 0 (πH1 ,H 0 (x), πH ,H 0 (y))
1 ×H2 ,H1 ×H2
2
1
2
1
2

for all x ∈ H1 \G and y ∈ H2 \G0 . Similarly, for H1 × H2 ∈ P × P 0 and (g, g 0 ) ∈
G × G0 , we have
c00H1 ×H2 ,(g,g0 ) ◦ φH1 ,H2 (x, y) = φgH1 g−1 ,g0 H2 g0−1 (cH1 ,g (x), c0H2 ,g0 (y))

176
for all x ∈ H1 \G and y ∈ H2 \G0 . The various properties of C × C 0 (compatibility,
regularity, invariance, antisymmetry, and strong antisymmetry) then follow from
those of C and C 0 in a straightforward manner.
Similarly, we define the direct product of m-schemes:
Definition 6.10. Let Π = {P1 , . . . , Pm } and Π0 = {P10 , . . . , Pm0 } be m-schemes
on finite sets S and S 0 respectively, where m ∈ N+ . Define the m-collection
Π × Π0 = {P100 , . . . , Pm00 } on S × S 0 in the following way: for k ∈ [m], two elements
z = ((x1 , y1 ), . . . , (xk , yk )), z 0 = ((x01 , y10 ), . . . , (x0k , yk0 )) ∈ (S × S 0 )(k) are in the
same block of Pk00 iff the following conditions are satisfied:
1. For i, j ∈ [k], it holds that xi = xj iff x0i = x0j , and yi = yj iff yi0 = yj0 .
2. Omit a minimal subset T of coordinates in [k] such that all xi are distinct,
and so are all x0i . Let k 0 = k − |T |. Suppose the remaining x-coordinates of
z and z 0 are xi1 , . . . , xik0 and x0i1 , . . . , x0ik0 respectively. Then (xi1 , . . . , xik0 )
and (x0i1 , . . . , x0ik0 ) are in the same block of Pk0 .9
3. The previous condition holds with x-coordinates replaced by y-coordinates
and Pk0 replaced by Pk0 0 .
We have the following analogue of Lemma 6.20 whose proof is left to the reader.
Lemma 6.21. The m-collection Π × Π0 is an m-scheme on S × S 0 . Moreover, if
Π and Π0 are antisymmetric (resp. strongly antisymmetric), so is Π × Π0 . And if Π
and Π0 have no matching, neither does Π × Π0 .
Remark. The connection between Definition 6.9 and Definition 6.10 is as follows.
Given m ∈ N+ , let P (resp. P 0 , P 00 ) be the system of stabilizers of depth m over
G = Sym(S) (resp. G0 = Sym(S 0 ), G00 = Sym(S × S 0 )) with respect to the
natural action of G on S (resp. G0 on S 0 , G00 on S × S 0 ). Let P̃ be the system of
stabilizers of depth m with respect to the product action of G × G0 on S × S 0 .10
Then P̃ ⊆ P × P 0 .11 So we obtain a P̃-scheme C˜ from C × C 0 . Using induction of
9

The order of these coordinates does not matter by invariance of Π. Under the previous condition,
the choice of T does not matter either.
10

(g,g 0 )

g0

The product action is defined by
(x, x0 ) = (g x, x0 ) for (g, g 0 ) ∈ G × G0 and (x, x0 ) ∈
S × S0.
11
To see this, note that for a subset U ⊆ S × S 0 whose projections to S and S 0 are U1 and U2 ,
respectively, we have (G × G0 )U = GU1 × G0U2 .

177
P̃-schemes, we obtain a P 00 -scheme C 00 (see Definition 6.4). Using the connection
between m-schemes and P-schemes (see Theorem 2.1), we see that the construction
of C 00 from C and C 0 corresponds to a construction of an m-scheme on S × S 0 from
those on S and S 0 . This is exactly Definition 6.10.
It is obvious that the direct product also preserves homogeneity and discreteness.
By taking iterated direct products, we can construct infinitely many antisymmetric
homogeneous m-schemes with no matching if there exists a single one. As an
application, we know that either the schemes conjecture (Conjecture 6.1) is true, or
there exist infinitely many counterexamples.12
Corollary 6.6. For any m ∈ N+ , there exist either infinitely many antisymmetric
homogeneous m-schemes with no matching or none.
Wreath products. There exists another operation of P-schemes and m-schemes
called the wreath product. While this operation is interesting on its own, we do not
need it anywhere else in this thesis, except that it provides an alternative proof of
Corollary 6.6. For this reason, we only give the definitions as well as the statements,
and leave the proofs to the reader.
We first define the wreath product of groups.
Definition 6.11. Let G and G0 be groups and let Ω be a G0 -set. Let GΩ be the
group consisting of all the functions f : Ω → G. Its group operation is defined by
(f f 0 )(x) = f (x)f 0 (x). Define the wreath product G o G0 as the group consisting of
all the pairs (f, g) ∈ GΩ × G0 , with its group operation defined by
g

(f, g)(f 0 , g 0 ) = (f · f 0 , gg 0 )
−1

for (f, g), (f 0 , g 0 ) ∈ G o G0 , where g f 0 : Ω → G sends x ∈ Ω to f 0 (g x). In other
words, the group G o G0 is the semidirect product G oϕ G0 where ϕ : G0 → Aut(GΩ )
sends g ∈ G0 to the automorphism f 7→ g f of GΩ . For convenience, we identify GΩ
and G0 with subgroups of G o G0 and write (f, g) ∈ G o G0 as f g.
Use the following notations: let G and G0 be finite groups and let Ω be a finite
G0 -set. For a family H = {Hx : x ∈ Ω} of subgroups of G indexed by Ω and a
subgroup H 0 of G0 satisfying the following condition:
Hx = G for all x ∈ Ω not fixed by G0 ,
12

(6.1)

This claim also holds for the variant of the schemes conjecture (Conjecture 6.2) for the same
reason.

178
write H o H 0 for the subset
{f g : f (x) ∈ Hx for all x ∈ Ω, g ∈ H 0 }
of G o G, which is a subgroup of G o G by (6.1). Suppose P and P 0 are subgroup
systems over finite groups G and G0 respectively. Define P o P 0 to be the poset of
subgroups of GoG0 consisting of the subgroups HoH 0 for all H = {Hx ∈ P : x ∈ Ω}
and H 0 ∈ P 0 satisfying (6.1). Then P o P 0 is a subgroup system over G o G0 .
For H = {Hx ∈ P : x ∈ Ω} and H 0 ∈ P 0 satisfying (6.1), we have a bijection
!
Y
φH,H 0 :
Hx \G × H 0 \G0 → (H o H 0 )\(G o G0 )
x∈Ω

Q
defined as follows: for f ∈ x∈Ω Hx \G whose x-factor is fx ∈ Hx \G, pick gx ∈ G
such that fx = Hx gx . Then define f 0 : Ω → G sending x ∈ Ω to gx . Define φH,H 0
such that it sends (f, Hg 0 ) to (H o H 0 )f 0 g 0 for g 0 ∈ G0 . It can be shown that φH,H 0
is a well defined bijection. Finally, we define the wreath product of a P-collection
and a P 0 -collection as follows.
Definition 6.12. For a P-collection C = {CH : H ∈ P} and a P 0 -collection
0
00
0
0
C 0 = {CH
: H ∈ P 0 }, define the (P oP 0 )-collection CoC 0 = {CHoH
0 : HoH ∈ P oP }
by
(
!
!
)
Y
00
0
0
0
CHoH 0 = φH,H 0
Bx × B : Bx ∈ CHx for x ∈ Ω, B ∈ CH 0 ,
x∈Ω

where H = {Hx : x ∈ Ω}. We call C o C 0 the wreath product of C and C 0 .
We have
Lemma 6.22. The wreath product C o C 0 is a (P o P 0 )-scheme if C is a P-scheme
and C 0 is a P 0 -scheme. Moreover, if C and C 0 are antisymmetric (resp. strongly
antisymmetric), then so is C o C 0 .
Similarly, we define the wreath product of m-schemes:
Definition 6.13. Let Π = {P1 , . . . , Pm } and Π0 = {P10 , . . . , Pm0 } be m-schemes
on finite sets S and S 0 respectively, where m ∈ N+ . Define the m-collection
Π o Π0 = {P100 , . . . , Pm00 } on S × S 0 in the following way: for k ∈ [m], two elements
z = ((x1 , y1 ), . . . , (xk , yk )), z 0 = ((x01 , y10 ), . . . , (x0k , yk0 )) ∈ (S × S 0 )(k) are in the
same block of Pk00 iff the following conditions are satisfied:

179
1. For i, j ∈ [k], it holds that yi = yj iff yi0 = yj0 .
2. For i ∈ [k], let Ti be set of indices j ∈ [k] satisfying yi = yj . Suppose
Ti = {i1 , . . . , i` }, ordered in an arbitrary way. Then (xi1 , . . . , xi` ) and
(x0i1 , . . . , x0i` ) are in the same block of P` .
3. Omit a minimal subset T of coordinates in [k] such that all yi are distinct. Let
k 0 = k −|T |. Suppose the remaining y-coordinates of z and z 0 are yi1 , . . . , yik0
and yi01 , . . . , yi0k0 respectively. Then (yi1 , . . . , yik0 ) and (yi01 , . . . , yi0k0 ) are in the
same block of Pk0 0 .
We have the following analogue of Lemma 6.22.
Lemma 6.23. The m-collection Π o Π0 is an m-scheme on S × S 0 . Moreover, if Π
and Π0 are antisymmetric (resp. strongly antisymmetric), then so is Π o Π0 . And if Π
and Π0 have no matching, then neither does Π o Π0 .
Remark. The connection between Definition 6.12 and Definition 6.13 is as follows.
Given m ∈ N+ , let P (resp. P 0 , P 00 ) be the system of stabilizers of depth m over
G = Sym(S) (resp. G0 = Sym(S 0 ), G00 = Sym(S × S 0 )) with respect to the natural
action of G on S (resp. G0 on S 0 , G00 on S ×S 0 ). Let P̃ be the system of stabilizers of
depth m with respect to the imprimitive wreath product action of G o G0 on S × S 0 .13
Then P̃ ⊆ P o P 0 .14 So we obtain a P̃-scheme C˜ from C o C 0 . Using induction of
P̃-schemes, we obtain a P 00 -scheme C 00 (see Definition 6.4). Using the connection
between m-schemes and P-schemes (see Theorem 2.1), we see that the construction
of C 00 from C and C 0 corresponds to a construction of an m-scheme on S × S 0 from
those on S and S 0 . This is exactly Definition 6.13.

13

(f,g)

g

0

g

The imprimitive wreath product action is defined by
(x, x0 ) = (f ( x ) x, x0 ) for (f, g) ∈
0
0
0
G o G and (x, x ) ∈ S × S .
14
To see this, consider a subset U ⊆ S × S 0 . For x0 ∈ S 0 , let Ux0 = {x ∈ S : (x, x0 ) ∈ S 0 }
and Hx0 = GUx0 . Let H = {Hx0 : x0 ∈ S 0 } and let U 0 be the projection of U to S 0 . Then
(G o G0 )U = H o G0U 0 . Moreover, if x0 ∈ S 0 is not fixed by G0U 0 , then x0 6∈ U 0 and hence Ux0 = ∅,
which implies Hx0 = G.

180
Chapter 7

SYMMETRIC GROUPS AND LINEAR GROUPS
Let G be a finite permutation group. Motivated by the P-scheme algorithms
developed in Chapter 3 and Chapter 5, we are interested in the problem of bounding
the integer d(G), introduced in Definition 2.8.
In this chapter, we study this problem for symmetric groups and linear groups with
various special group actions.
Symmetric groups. For convenience, we introduce the following notation:
Definition 7.1. For n ∈ N+ , define dSym (n) := d(G), where G is the symmetric
group Sym(S) acting naturally on a finite set S of cardinality n.1
Note that dSym (n) is nondecreasing in n by Corollary 6.4. The best known general
upper bound for dSym (n) is


2
dSym (n) ≤
log n + O(1),
log 12
proven in [Gua09; Aro13] in different notations, based on the work of [Evd94;
IKS09]. In Section 7.1, we review this result and interpret it as a result about
P-schemes.
In Section 7.3, we study the more general action of Sym(S) on the set of k-subsets
of S, where 1 ≤ k ≤ |S|, and that on (an orbit of) the set of partitions of S. These
actions are called the standard action of symmetric groups, and play an important
role in the study of minimal base sizes of primitive permutation groups (see, e.g.,
[LS99]). Our results for these group actions will be used in Chapter 8.
Linear groups. Let V be a vector space of dimension n ∈ N+ over a finite
field Fq . We have the general linear group GL(V ) consisting of all the invertible
linear transformations of V over Fq . It is a subgroup of the general semilinear
group ΓL(V ), which consists of all the invertible semilinear transformations of
V . Here we say a map φ : V → V is a semilinear transformation of V if
1

Clearly dSym (n) only depends on n but not on S.

181
φ(x + y) = φ(x) + φ(y) and φ(cx) = τφ (c)φ(x) hold for all x, y ∈ V and c ∈ Fq ,
where τφ is an automorphism of the field Fq . We have the natural action of GL(V )
and that of ΓL(V ) on V − {0}, defined in the obvious way.
Denote by PV the projective space associated with V , i.e., PV is the set of equivalence classes of V − {0} where x, y ∈ V − {0} are equivalent iff x = cy for
×
some c ∈ F×
q . Define the projective linear group PGL(V ) := GL(V )/Fq and the
×
projective semilinear group PΓL(V ) := ΓL(V )/F×
q , where Fq is identified with
the subgroup of the scalar linear transformations of GL(V ) (resp. ΓL(V )) so that
c ∈ F×
q sends x ∈ V to cx. The natural action of GL(V ) (resp. ΓL(V )) on V − {0}
induces an action of PGL(V ) (resp. PΓL(V )) on PV , called the natural action of
PGL(V ) (resp. PΓL(V )) on PV . Finally, when V = Fnq , we also use the notations
GLn (q), ΓLn (q), PGLn (q), and PΓLn (q).
We call the above groups GL(V ), ΓL(V ), PGL(V ), and PΓL(V ) linear groups.
In Section 7.4, we investigate d(G) for the natural action of a linear group G. For
convenience, we introduce the following notations:
Definition 7.2. Let V be a vector space of dimension n ∈ N+ over a finite field
Fq . Define dGL (n, q) := d(G), where G is the permutation group GL(V ) acting
naturally on V − {0}. Similarly define dΓL (n, q), dPGL (n, q), and dPΓL (n, q) by
choosing G to be the permutation group ΓL(V ), PGL(V ), PΓL(V ) acting naturally
on V − {0}, PV , PV , respectively.2
We show that the problems of bounding dGL (n, q) dΓL (n, q), dPGL (n, q), and
dPΓL (n, q) are all equivalent: an upper bound f (n, q) for any one of them implies an upper bound f (n, q) + O(1) for the others. So it suffices to investigate just
one of them.
Finally, we prove a bound

dGL (n, q) ≤

log q
log q + (log 12)/4


n + O(1),

slightly improving the trivial bounds.
Self-reduction. The results in Section 7.3 and Section 7.4 require a technique
called self-reduction of discreteness, which we introduce in Section 7.2. It reduces
discreteness of a strongly antisymmetric P-scheme to discreteness of its restrictions
2

Clearly these definitions only depend on n and q but not on V .

182
to stabilizer subgroups. In many cases, such a reduction greatly simplifies the
problem. Our results in Chapter 8 also rely heavily on this technique.
7.1

The natural action of a symmetric group

We introduce the following notations about m-schemes:
Definition 7.3. For n ∈ N+ , let m(n) (resp. m0 (n)) be the smallest positive integer
such that any non-discrete antisymmetric m(n)-scheme (resp. m0 (n)-scheme) on
[n] has a matching (resp. is not strongly antisymmetric).
It is easy to see that m(n) and m0 (n) are nondecreasing in n. We also have
dSym (n) ≤ m0 (n) ≤ m(n) by Lemma 2.7 and Lemma 2.10.


It was proven [Gua09] and independently in [Aro13] that m(n) ≤ log212 log n +
O(1). We review the proof of this bound, starting from the following lemma:
Lemma 7.1. Let Π = {P1 , . . . , Pm } be an antisymmetric m-scheme on a finite set
S where m ≥ 3. Suppose B ∈ P1 satisfies |B| ≥ 3. Let x be an element of B so
0
} is an (m − 1)-scheme on S − {x} (see Definition 6.3).
that Π|x = {P10 , . . . , Pm−1
Then at least one of the two conditions is satisfied.
1. There exists B 0 ∈ P10 contained in B satisfying |B 0 | ≤ (|B| − 1)/4.
2. There exist distinct elements y, z ∈ B − {x} such that for the (m − 2)-scheme
00
Π|x,y = {P100 , . . . , Pm−2
} on S − {x, y}, the block B 00 of P100 containing z
satisfies |B 00 | ≤ (|B| + 1)/12. Furthermore, (x, y), (y, z), and (z, x) are in
the same block of P2 .
Proof. By replacing Π with ΠkB , we may assume Π is homogeneous and S = B.
By antisymmetry, we know |P2 | is even. If |P2 | ≥ 4, there exists B1 ∈ P2 of
cardinality at most |B|(|B| − 1)/4. Let B 0 := {y ∈ B : (x, y) ∈ B1 }. Then B 0 is a
block of P10 by definition, and its cardinality is |B1 |/|B| ≤ (|B| − 1)/4 by regularity
of Π. And the first condition is met.
So assume |P2 | = 2. Then P2 contains two blocks B1 and B2 of the same cardinality
|B|(|B| − 1)/2. Choose y ∈ B − {x} such that (x, y) ∈ B1 . Such an element
y exists by regularity and homogeneity of Π. By Lemma 2.11 and Lemma 2.12,
we have an antisymmetric association scheme P (Π) = P2 ∪ {1B } that has three
blocks. By Lemma 2.20, the number of elements z ∈ B − {x, y} satisfying

183
(y, z), (z, x) ∈ B1 is precisely (|B| + 1)/4 > 0. The cardinality of the set T :=
{(a, b, c) : (a, b), (b, c), (c, a) ∈ B1 } is then |B1 |·(|B|+1)/4. Choose z ∈ B−{x, y}
such that (x, y, z) ∈ T . Let B10 , B20 , and B30 be the blocks of P3 containing (x, y, z),
(y, z, x) and (z, x, y) respectively, which are all subsets of T . They have the
same cardinality by invariance of Π, and are distinct by antisymmetry of Π. So
|B10 | ≤ |T |/3 = |B1 | · (|B| + 1)/12. By regularity of Π, the cardinality of the set
{u ∈ S − {x, y} : (x, y, u) ∈ B10 } is |B10 |/|B1 | ≤ (|B| + 1)/12, and this set is
exactly the block B 00 of P100 containing z by definition. So the second condition is
satisfied.
Lemma 7.1 implies the following recursive relation:
Lemma 7.2. For n ≥ 3,
 




n−1
n+1
m(n) ≤ max m
+ 1, m
+2 .
4
12
The inequality also holds for m0 (·) in replaced of m(·).
Proof. Let Π = {P1 , . . . , Pm } be a non-discrete antisymmetric m-scheme on a
finite set S of cardinality n, where m ≥ 3. Also assume
 




n−1
n+1
m ≥ max m
+ 1, m
+2 .
4
12
We want to show that Π has a matching.
Choose B ∈ P1 such that |B| > 1. Let x be an element of B and suppose
0
Π|x = {P10 , . . . , Pm−1
}. Then Π|x is an antisymmetric (m − 1)-scheme on S − {x}.
Note that ΠkB is a homogeneous antisymmetric m-scheme on B by Lemma 6.14,
which implies |B| ≥ 3. Then either of the two conditions in Lemma 7.1 is satisfied.
If the first condition is satisfied, there exists B 0 ∈ P10 contained in B satisfying
|B 0 | ≤ (|B| − 1)/4 ≤ (n − 1)/4. If |B 0 | > 1, we see (Π|x )kB 0 is a non-discrete
antisymmetric (m − 1)-scheme on B 0 . It has a matching since m − 1 ≥ m((n −
1)/4) ≥ m(|B 0 |). So Π also has a matching by Lemma 6.3 and Lemma 6.14. On
the other hand, if |B 0 | = 1, we let y be the unique element in B 0 and let B1 be the
block of P2 containing (x, y). Note that |B 0 | = |B1 |/|B|, which implies |B1 | = |B|.
As x, y ∈ B, we have π12 (B1 ) = π22 (B1 ) = B. Then B1 is a matching of Π.
Next assume the second condition is satisfied. So there exist distinct elements y, z ∈
00
B−{x} such that for the (m−2)-scheme Π|x,y = {P100 , . . . , Pm−2
} on S−{x, y}, the

184
cardinality of the block B 00 of P100 containing z is at most (|B| + 1)/12 ≤ (n + 1)/12.
Furthermore, (x, y), (y, z), and (z, x) are in the same block B0 of P2 . If |B 00 | > 1,
we see (Π|x,y )kB 00 is a non-discrete antisymmetric (m − 2)-scheme on B 00 . It has
a matching since m − 2 ≥ m((n + 1)/12) ≥ m(|B 00 |). So Π also has a matching
by Lemma 6.3 and Lemma 6.14. On the other hand, if |B 00 | = 1, we let B00
be the block of P3 containing (x, y, z). We have π13 (B00 ) = π33 (B00 ) = B0 since
(x, y), (y, z) ∈ B0 . Also note that |B 00 | = |B00 |/|B0 |, which implies |B0 | = |B00 |.
So B00 is a matching of Π.
This proves the inequality for m(·). The proof for m0 (·) is similar, and we leave it
to the reader.
Theorem 7.1 ([Gua09; Aro13]). For all n ∈ N+ ,


2
m(n) ≤
log n + O(1).
log 12
More generally, an antisymmetric m-scheme Π = {P1 , . . . , Pm } on a finite set S
always has a matching if P1 has a block B ofcardinality
k > 1 and m ≥ m(k). In

particular it holds for sufficiently large m = log212 log k + O(1).
Proof. Note m(1) = 1 and m(2) = 2. The first claim then follows from Lemma 7.2
and a simple induction. The second claim follows by considering ΠkB and applying
Lemma 6.14.
Theorem 7.1 implies a bound for dSym (n), and also a bound for d(G) by Corollary 6.3, where G is an arbitrary permutation group on a set of cardinality n:
+
Corollary 7.1. Let G
 be apermutation group on a set of cardinality n ∈ N . Then
d(G) ≤ dSym (n) ≤ log212 log n + O(1).

We conclude this section with the following technical lemma, which is used later in
the proof of Theorem 7.5.
Lemma 7.3. Let G be a permutation group on a finite set S, and let P be the
corresponding system of stabilizers of depth m where 1 ≤ m ≤ |S|. Let C = {CH :
H ∈ P} be a strongly antisymmetric P-scheme. Suppose C is non-discrete on Gx
for some x ∈ S. Then there exists (x1 , . . . , xm ) ∈ S (m) such that CGx1 ,...,xm has a
log 12
2
block of cardinality at least 2( 4 )m −O(m) .

185
Proof. Let P 0 be the system of stabilizers of depth m with respect to the natural
0
action of G0 := Sym(S) on S. Let C 0 = {CH
: H ∈ P} be the induction of C
0
to P (see Definition 6.4), which is strongly antisymmetric by Lemma 6.1 and is
non-discrete on G0x for x ∈ S in the lemma since C is non-discrete on Gx . Assume
the lemma holds for Sym(S), P 0 , and an m-tuple (y1 , . . . , ym ) ∈ S (m) , i.e., there
log 12
2
exists B 0 ∈ CG0 0y ,...,y of cardinality at least 2( 4 )m −O(m) . By Definition 6.4, we
m
1
know B 0 is of the form φG0y1 ,...,ym ,g (B), where g ∈ G0 , φG0y1 ,...,ym ,g is an injection
from (G ∩ gG0y1 ,...,ym g −1 )\G to G0y1 ,...,ym \G0 , and B is a block of CG∩gG0y1 ,...,ym g−1 .
Let xi = g yi for i ∈ [m]. Then G ∩ gG0y1 ,...,ym g −1 = Gx1 ,...,xm . So (x1 , . . . , xm ) and
B ∈ CGx1 ,...,xm satisfy the condition in the lemma.
Thus we may assume G = Sym(S) and it acts naturally on S. By Lemma 2.12, it
suffices to show that for any non-discrete strongly antisymmetric m-scheme Π =
log 12
2
{P1 , . . . , Pm } on S, the partition Pm has a block of cardinality at least 2( 4 )m −cm ,
where c = O(1). We prove this claim by induction on m. The case m = 1 is
trivial. For m > 1, assume the claim for m0 < m. 
Let B0 be a block of P1 of
cardinality k > 1. By Theorem 7.1, we have m ≤ log212 log k + c0 for some
log 12

0

c0 = O(1), or equivalently k ≥ 2 2 (m−c ) . Choose x ∈ B0 and consider the
0
} on S − {x}. It is strongly
(m − 1)-scheme Π-scheme Π0 := Π|x = {P10 , . . . , Pm−1
antisymmetric by Lemma 6.3. Let B1 be a block of P10 contained in B0 , which
exists by compatibility of Π and the fact k > 1. If |B1 | = 1, we have seen in
the proof of Lemma 7.2 that Π has matching, contradicting the assumption that
Π is strongly antisymmetric. So |B1 | > 1. By Lemma 6.14, the homogeneous
00
} on B1 is strongly antisymmetric. By the
(m − 1)-scheme Π0 kB1 = {P100 , . . . , Pm−1
(m−1)
00
induction hypothesis, the partition Pm−1
has a block B 0 ⊆ B1
of cardinality at
log 12
2 −c(m−1)
(m−1)
0
0
0
(
)
least 2 4
. And B is also a block of Pm−1 ∈ Π by definition and
compatibility of Π0 . Then Pm ∈ Π has a block B containing (x, x1 , . . . , xm−1 ) for
all (x1 , . . . , xm−1 ) ∈ B 0 . By regularity of Π, we have
|B| = |B0 ||B 0 | ≥ 2

log 12
(m−c0 )
2

log 12
log 12
2
2
· 2( 4 )(m−1) −c(m−1) ≥ 2( 4 )m −cm

for sufficiently large c = O(1).
7.2

Self-reduction of discreteness

In this section, we prove a “self-reduction” lemma, which states that discreteness of
a strongly antisymmetric P-scheme is implied by discreteness of its restrictions to
stabilizer subgroups.
We need the following technical lemma.

186
Lemma 7.4. Suppose G is a finite group, P is a subgroup system over G, and
C = {CH : H ∈ P} is a P-scheme. Suppose H0 , H1 , H2 are subgroups in P such
that H0 ⊆ H1 ∩ H2 and C|H1 , C|H2 are both discrete on H0 . For i = 0, 1, 2, let Bi
be the block of CHi containing Hi e ∈ Hi \G. Then (πH0 ,H2 )|B0 ◦ (πH0 ,H1 |B0 )−1 is a
well-defined bijection from B1 to B2 sending H1 e ∈ H1 \G to H2 e ∈ H2 \G.
Proof. Note that πH0 ,H1 |B0 is a surjective map from B0 to B1 sending H0 e to
H1 e, and πH0 ,H2 |B0 is a surjective map from B0 to B2 sending H0 e to H2 e. So
it suffices to prove that these two maps are injective. The set B0 ∩ (H0 \H1 )
contains H0 e and is a block of CH0 |H1 ∈ C|H1 by the definition of restriction
(Definition 6.2). By discreteness of C|H1 on H0 , this set is just the singleton {H0 e}.
On the other hand, the set H0 \H1 ⊆ H0 \G is precisely the preimage of H1 e
under πH0 ,H1 : H0 \G → H1 \G. So B0 ∩ (H0 \H1 ) is the preimage of H1 e under
πH0 ,H1 |B0 : B0 → B1 . By regularity of C, the map πH0 ,H1 |B0 is injective. Similarly
πH0 ,H2 |B0 is also injective.
The bijection in Lemma 7.4 can be used to separate elements in a strongly antisymmetric P-scheme:
Lemma 7.5. Let G be a finite group acting on a finite set S, and let x ∈ S. Let P
be a subgroup system over G such that Gx ∈ P, and let C = {CH : H ∈ P} be
0
a P-scheme. Suppose y = g x and z = g x in S satisfy (1) Gy , Gz , Gy,z ∈ P and
(2) C|Gy and C|Gz are both discrete on Gy,z . Then there exists a bijection between
blocks of CGx sending Gx g −1 to Gx g 0−1 that can be written as a composition of
conjugations, projections and their inverses between blocks of CGx , CGy , CGz and
CGy,z . In particular, if C is strongly antisymmetric, then Gx g −1 and Gx g 0−1 are in
different blocks of CGx .
Proof. Let B0 (resp. B1 , B2 ) be the block of CGy,z (resp. CGy , CGz ) containing Gy,z e
(resp. Gy e, Gz e). By Lemma 7.4, the map πGy,z ,Gz |B0 ◦(πGy,z ,Gy |B0 )−1 is a bijection
from B1 to B2 sending Gy e to Gz e. Let B10 and B20 be the blocks of CGx containing
Gx g −1 and Gx g 0−1 respectively. We have the conjugations cGx ,g |B10 : B10 → B1
sending Gx g −1 to Gy e and cGz ,g0−1 |B2 : B2 → B20 sending Gz e to Gx g 0−1 . Then the
map
cGz ,g0−1 |B2 ◦ πGy,z ,Gz |B0 ◦ (πGy,z ,Gy |B0 )−1 ◦ cGx ,g |B10
is a bijection from B10 to B20 sending Gx g −1 to Gx g 0−1 .

187
This provides a way of proving discreteness of a strongly antisymmetric P-scheme
using discreteness of its restrictions to stabilizers. For example, if C is strongly
antisymmetric and the conditions in Lemma 7.5 hold for all pairs (y, z) ∈ Gx × Gx,
then C is discrete on Gx . In fact, we only need to verify the conditions for a subset
of pairs that form a connected graph:
Lemma 7.6 (self-reduction lemma). Let G be a finite group acting on a finite set
S, and let x ∈ S. Let P be a subgroup system over G such that Gx ∈ P, and let
C = {CH : H ∈ P} be a strongly antisymmetric P-scheme. Suppose R is a subset
of S × S satisfying the following conditions:
1. For all (y, z) ∈ R, it holds that (1) Gy , Gz , Gy,z ∈ P and (2) C|Gy and C|Gz
are both discrete on Gy,z .
2. Let GR be the undirected graph on S such that {y, z} is an edge iff (y, z) ∈ R
or (z, y) ∈ R. Then Gx is contained in a connected component of GR (in
particular, this condition is satisfied if GR is connected).
Then C is discrete on Gx .
Proof. For y ∈ S, denote by By the block of CGy containing Gy e ∈ Gy \G. For
(y, z) ∈ S × S, write y ∼ z if there exists a bijection τ : By → Bz sending Gy e to
Gz e such that τ is a composition of maps of the form πH,H 0 |B or (πH,H 0 |B )−1 (where
H, H ∈ P and B is block of CH ). Then ∼ is an equivalence relation on S. By the
first condition and Lemma 7.4, we have y ∼ z for all (y, z) ∈ R. And by the second
condition, we have y ∼ z for all (y, z) ∈ Gx × Gx.
0

Consider any g, g 0 ∈ G and let y = g x, z = g x ∈ Gx. Let τ : By → Bz be a
bijection sending Gy e to Gz e as above. Let B and B 0 be the blocks of CGx containing
Gx g −1 and Gx g 0−1 respectively. We have the conjugations cGx ,g |B : B → By
sending Gx g −1 to Gy e and cGz ,g0−1 |Bz : Bz → B 0 sending Gz e to Gx g 0−1 . Then the
map
cGz ,g0−1 |Bz ◦ τ ◦ cGx ,g |B
is a bijection from B to B 0 sending Gx g −1 to Gx g 0−1 . In particular, if Gx g −1 6=
Gx g 0−1 , then B 6= B 0 by strong antisymmetry of C. As g, g 0 ∈ G are arbitrary, we
know C is discrete on Gx .

188
The actions of symmetric groups on k-subsets or partitions

7.3

Let S be a finite set of cardinality n, and let G = Sym(S). For k ∈ [n], the natural
action of G on S induces a (transitive) action of G on the set of k-subsets (i.e.,
subsets of cardinality k) of S. Similarly, it induces an action of G on (an orbit of)
the set of partitions P of S, given by g P := {g B : B ∈ P }.
In these cases, we expect to have a bound d(G) = O(log n) as we have in Section 7.1.
Let S 0 be the underlying set on which G acts. The naive approach is to embed G
in Sym(S 0 ) and apply Corollary 7.1. In general, however, the cardinality of S 0

is much larger than n. For example, we have |S 0 | = nk for the action of G
on the set of k-subsets of S, and hence Corollary 7.1 only implies the bound
d(G) = O(log |S 0 |) = O(k log n). The same problem exists for the action of G on
an orbit of the set of partitions of S, in which case |S 0 | is the number of partitions
of S into subsets with prescribed cardinalities.
In this section, we extend the result in Section 7.1 and show that in the above cases,
we have d(G) ≤ dSym (n)+O(1) = O(log n). In fact, we prove more general criteria
for a subgroup system P over G (or more generally, over a subgroup H ⊆ G) to have
the property that all strongly antisymmetric P-schemes are discrete on all x ∈ S 0 .3
It is possible to design a subgroup system P of complexity |S 0 |O(1) nO(log n) that
satisfies these criteria. An algorithm of constructing the corresponding collection
of number fields will be given in Chapter 8.
The action of Sym(S) on the set of k-subsets of S. Suppose S is a finite set of
cardinality n and consider the action of G = Sym(S) on the set S 0 of k-subsets of
S. We say two elements x, y ∈ S 0 are adjacent if there exists g ∈ G sending x to
y and g is a transposition (i.e. 2-cycle) on S. The following technical lemma is
needed:
Lemma 7.7. For all adjacent x, y ∈ S and z ∈ Gx y adjacent to y, it holds that
|Gx,y z| ≤ n.
Proof. Choose h ∈ Gx that sends y to z. As x and y are adjacent, we know x = h x
and z = h y are also adjacent. Let u = x ∩ y (as the intersection of two k-subsets).
As x and y are adjacent, there exist distinct elements a, b ∈ S such that x = u ∪ {a}
and y = u ∪ {b}. Then Gx,y fixes u setwisely as well as a, b. If b 6∈ z, we have
3

To derive d(G) ≤ dSym (n) + O(1), we only need the case H = G. The more general setting
H ⊆ G is needed for applications in Chapter 8.

189
z = u ∪ {c} for some c ∈ S since y and z are adjacent. In this case, as Gx,y fixes the
subset u of z of cardinality k − 1 setwisely, we have |Gx,y z| ≤ |S| = n, as desired.
Next assume b ∈ z. Since x and z are adjacent, we have z = (x − {b0 }) ∪ {b}
for some b0 ∈ x. As Gx,y fixes x setwisely as well as a, b ∈ S, the elements
in Gx,y z are of the form (x − {b00 }) ∪ {b} where b00 ∈ x. In this case we have
|Gx,y z| ≤ |x| = k ≤ n.
We state a criterion for a subgroup system P over a subgroup H ⊆ G to have the
property that all strongly antisymmetric P-schemes are discrete on all x ∈ S 0 .
Theorem 7.2. Let G, n, and S 0 be as above, and let H be a subgroup of G. Suppose
P is a subgroup system over H satisfying the following conditions:
1. Hx , Hx,y ∈ P for all x, y ∈ S 0 .
2. H{x,y}∪T ∈ P for all x, y, z ∈ S 0 and T ⊆ Hx,y z satisfying |Hx,y z| ≤ n and
1 ≤ |T | ≤ dSym (n).
Then all strongly antisymmetric P-schemes are discrete on Hx for all x ∈ S 0 .
Proof. Let C = {CH : H ∈ P} be a strongly antisymmetric P-scheme. We
want to prove that C is discrete on Hx for all x ∈ S 0 . As G is generated by
transpositions on S, by Lemma 7.6, we just need to verify for all adjacent x, y ∈ S 0
that (1) Hx , Hy , Hx,y ∈ P, and (2) C|Hx and C|Hy are discrete on Hx,y . Fix adjacent
x, y ∈ S 0 . Note that (1) follows from the first condition in the theorem.
So it remains to prove that C|Hx is discrete on Hx,y (the claim for C|Hy is symmetric).
This is trivial if x = y. So assume x 6= y. we claim that for all z, w ∈ Hx y ⊆
Gx y, there exists a sequence of elements u0 , . . . , ut ∈ Gx y such that u0 = z,
ut = w, and ui−1 , ui are adjacent for i ∈ [t]. This follows from the fact that
Gx ∼
= Sym(x) × Sym(S − x) is generated by transpositions on S. Let P 0 := P|Hx
and C 0 := C|Hx . By Lemma 7.6 and the previous claim, it remains to show that for all
adjacent z, w ∈ Gx y, it holds that (a) (Hx )z , (Hx )w , (Hx )z,w ∈ P 0 , or equivalently
Hx,z , Hx,w , Hx,z,w ∈ P, and (b) C 0 |(Hx )z and C 0 |(Hx )w are discrete on (Hx )z,w . Fix
such z, w ∈ Gx y. Note that z and w are adjacent to x since y is adjacent to x. It
follows from Lemma 7.7 that |Hx,z w| ≤ |Gx,z w| ≤ n. Then (a) follows from the
two conditions in the theorem.

190
It remains to show that C 0 |(Hx )z is discrete on (Hx )z,w (the claim for C 0 |(Hx )w is
symmetric). Let P 00 := P 0 |(Hx )z . By the second condition of the theorem and
the fact |Hx,z w| ≤ n, we have H{x,z}∪T ∈ P 00 for all T ⊆ Hx,z w satisfying
1 ≤ |T | ≤ dSym (n). This means that P 00 contains the system of stabilizers of
depth dSym (n) with respect to the action of Hx,z on Hx,z w. By Corollary 6.3 and
the fact |Hx,z w| ≤ n, we see all strongly antisymmetric P 00 -schemes are discrete
on (Hx,z )w = (Hx )z,w . Finally, note that C 0 |(Hx )z is strongly antisymmetric by
Lemma 6.3, and hence discrete on (Hx )z,w , as desired.
Choosing H = G in Theorem 7.2, we obtain
Corollary 7.2. d(G) ≤ dSym (n) + 2.
The action of Sym(S) on the set of partitions of S. Suppose S is a finite set of
cardinality n and consider the action of G = Sym(S) on an orbit S 0 of the set of
partitions of S. We prove an analogue of Theorem 7.2 for this case. The following
notations are needed: again, we call two elements x, y ∈ S 0 adjacent if there exists
g ∈ G sending x to y and g is a transposition on S. For x, y, z ∈ S 0 , write y ∼x z if
there exists g ∈ Gx sending y to z such that either (1) g is a transposition on S fixing
all the blocks of x setwisely, or (2) x − y 6= x − z, and g exchanges two blocks of x
while fixing the other blocks of x pointwisely.
We also need the following technical lemma:
Lemma 7.8. For all adjacent x, y ∈ S 0 and z ∈ Gx y satisfying y ∼x z, it holds
that |Gx,y z| ≤ 4n.
Proof. We may assume x 6= y. As x and y are adjacent, there exists a transposition
(a b) of S sending x to y where a ∈ B1 , b ∈ B2 and B1 , B2 are distinct blocks of x.
So we have
y = (x − {B1 , B2 }) ∪ {(B1 − {a}) ∪ {b}, (B2 − {b}) ∪ {a}}.

(7.1)

Fix h ∈ Gx sending y to z such that either (1) h is a transposition on S fixing all
the blocks of x setwisely, or (2) x − z 6= x − y and h exchanges two blocks of x
while fixing the other blocks of x pointwisely. We claim that in either case, h fixes
at least one of B1 and B2 pointwisely. This is obvious in Case (1). And in Case (2),
if h fixes neither B1 nor B2 pointwisely, it exchanges B1 and B2 . But then we have
x − y = x − z = {B1 , B2 }, contradicting the assumption.

191
So assume h fixes B1 pointwisely (the other case is symmetric). Consider arbitrary
w = g z ∈ Gx,y z where g ∈ Gx,y . We have
−1

0

w = gh(a b) x = gh(a b)(gh) x = (a

b0 )

x,

where a0 = gh a and b0 = gh b. So w is determined by the pair (a0 , b0 ).
There are at most n choices of b0 ∈ S. Now consider the number of choices of
a0 . Note that a0 = gh a = g a since h fixes B1 pointwisely. As {a} ∈ y|B1 , we see
{a0 } ∈ g y|g B1 = y|g B1 . As g fixes x and y, it fixes x − y = {B1 , B2 } setwisely. So
g
B1 ∈ {B1 , B2 }. It follows that {a0 } is in y|B1 or y|B2 . By (7.1), we see {a0 } equals
{a}, {b}, B1 − {a} or B2 − {b}. So the number of choices of a0 is at most four.
Therefore |Gx,y z| ≤ 4n.
We have following criterion for a subgroup system P over a subgroup H ⊆ G
to have the property that all strongly antisymmetric P-schemes are discrete on all
x ∈ S 0.
Theorem 7.3. Let G, n, and S 0 be as above, and let H be a subgroup of G. Suppose
P is a subgroup system over H satisfying the following conditions:
1. Hx , Hx,y ∈ P for all x, y ∈ S 0 .
2. H{x,y}∪T ∈ P for all x, y, z ∈ S 0 and T ⊆ Hx,y z satisfying |Hx,y z| ≤ 4n and
1 ≤ |T | ≤ dSym (4n).
Then all strongly antisymmetric P-schemes are discrete on Hx for all x ∈ S 0 .
Proof. Let C = {CH : H ∈ P} be a strongly antisymmetric P-scheme. We
want to prove that C is discrete on Hx for all x ∈ S 0 . As G is generated by
transpositions on S, by Lemma 7.6, we just need to verify for all adjacent x, y ∈ S 0
that (1) Hx , Hy , Hx,y ∈ P, and (2) C|Hx and C|Hy are discrete on Hx,y . Fix adjacent
x, y ∈ S 0 . Note that (1) follows from the first condition in the theorem. So it
remains to prove that C|Hx is discrete on Hx,y (the claim for C|Hy is symmetric).
This obviously holds if x = y. So assume x 6= y.
We claim that for all z, w ∈ Hx y ⊆ Gx y, there exists a sequence of elements
u0 , . . . , ut ∈ Gx y such that u0 = z, ut = w and ui−1 ∼x ui for i ∈ [t]. To see this,
note that we can choose distinct elements u0 , . . . , ut such that u0 = z, ut = w, and
for i ∈ [t], ui−1 is sent to ui by some gi ∈ Gx such that gi is in either of the following
two cases:

192
1. gi is a transposition on S fixing the blocks of x setwisely, or
2. gi exchanges two blocks of x while fixing the other blocks of x pointwisely.
This is because Gx is generated by such permutations gi . Furthermore, if gi is in
the latter case, we may assume x − ui−1 6= x − ui . To see this, note that ui−1 and
ui are adjacent to x since y is adjacent to x. So there exist transpositions (a b)
and (a0 b0 ) on S sending x to ui−1 and ui respectively. Choose B1 , B2 , B10 , B20 ∈ x
such that a ∈ B1 , b ∈ B2 , a0 ∈ B10 and b0 ∈ B20 . Then x − ui−1 = {B1 , B2 } and
x − ui = {B10 , B20 }. Suppose x − ui−1 = x − ui . Then by exchanging a0 with b0 and
B10 with B20 if necessary, we may assume a, a0 ∈ B1 and b, b0 ∈ B2 . So we have
ui−1 = x − {B1 , B2 } ∪ {(B1 − {a}) ∪ {b}, (B2 − {b}) ∪ {a}}
and
ui = x − {B1 , B2 } ∪ {(B1 − {a0 }) ∪ {b0 }, (B2 − {b0 }) ∪ {a0 }}.
0

If a = a0 . Then ui = (b b ) ui−1 and we may replace gi by (b b0 ) ∈ Gx which is in the
first case above. Similarly, if b = b0 , we may replace gi by (a a0 ) ∈ Gx . Finally, if
0
a 6= a0 and b 6= b0 , we insert u0i = (a a ) ui−1 into the sequence between ui−1 and ui ,
0
so that ui = (b b ) u0i . It follows that we may always assume ui−1 ∼x ui for all i ∈ [t].
Let P 0 := P|Hx and C 0 := C|Hx . By Lemma 7.6 and the previous paragraph, it
suffices to show, for all z, w ∈ Gx y satisfying z ∼x w, that (a) Hx,z , Hx,w , Hx,z,w ∈
P 0 , and (b) C 0 |(Hx )z and C 0 |(Hx )w are discrete on (Hx )z,w . Fix such z, w ∈ Gx y. Note
that z and w are adjacent to x since y is adjacent to x. It follows from Lemma 7.8
that |Hx,z w| ⊆ |Gx,z w| ≤ 4n. Then (a) follows from the two conditions in the
theorem.
It remains to show that C 0 |(Hx )z is discrete on (Hx )z,w (the claim for C 0 |(Hx )w is
symmetric). Let P 00 := P 0 |(Hx )z . By the second condition of the theorem and
the fact |Hx,z w| ≤ 4n, we have H{x,z}∪T ∈ P 00 for all T ⊆ Hx,z w satisfying
1 ≤ |T | ≤ dSym (4n). This means that P 00 contains the system of stabilizers of depth
dSym (4n) with respect to the action of Hx,z on Hx,z w. By Corollary 6.3 and the
fact |Hx,z w| ≤ 4n, we see all strongly antisymmetric P 00 -schemes are discrete on
(Hx )z,w . Finally note that C 0 |(Hx )z is strongly antisymmetric by Lemma 6.3, and
hence is discrete on (Hx )z,w , as desired.
Note dSym (4n) ≤ dSym (n) + O(1) by Lemma 7.2 and Theorem 2.1. Choosing
H = G in Theorem 7.3, we obtain

193
Corollary 7.3. d(G) ≤ dSym (4n) + 2 ≤ dSym (n) + O(1).
7.4

The natural actions of linear groups

In this section, we show that dGL (n, q), dΓL (n, q), dPGL (n, q), dPΓL (n, q) are equal
up to an additive constant. In addition, we prove an upper bound for dGL (n, q),
slightly improving the trivial bounds.
Equivalence between various linear groups. We have the following theorem.
Theorem 7.4. For f1 , f2 ∈ {dGL , dΓL , dPGL , dPΓL }, there exists a constant c ∈ N
such that f1 (n, q) ≤ f2 (n, q) + c holds for all n ∈ N+ and prime powers q. And if
f2 = dGL , choosing c = 6 suffices.
We break Theorem 7.4 into six inequalities, corresponding to the the arrows in the
following diagram.
GL(V )
ΓL(V )

PGL(V )

PΓL(V )

Fix n ∈ N+ , a prime power q and a vector space V of dimension n over Fq from
now on. By Lemma 6.3 and the facts GLn (q) ⊆ ΓLn (q) and PGLn (q) ⊆ PΓLn (q),
we have
Lemma 7.9. dGL (n, q) ≤ dΓL (n, q) and dPGL (n, q) ≤ dPΓL (n, q).
In the other direction, we have
Lemma 7.10. dΓL (n, q) ≤ dGL (n, q) + 2.
Proof. Let G = ΓL(V ), S = V − {0}, and m = dGL (n, q) + 2 ≥ 3. Let P be
the system of stabilizers of depth m over G with respect to the natural action of G
on S. Let C be a strongly antisymmetric P-scheme. Fix x ∈ S. We want to show
that C is discrete on Gx . Let α be an element in F×
q not contained in any proper
subfield of Fq . By Lemma 2.3, it suffices to show that C is discrete on Gx,αx . Let
G act diagonally on S × S and let O be the G-orbit of (x, αx). By Lemma 7.6, it
suffices to prove, for all u, v ∈ O, that (1) Gu , Gv , Gu,v ∈ P and (2) C|Gu and C|Gv
are discrete on Gu,v .

194
Fix u, v ∈ O. Note we have u = (y, βy) and v = (z, γz) for some y, z ∈ S and
β, γ ∈ F×
q . And β, γ are not contained in any proper subfield of Fq . Let g ∈ Gu .
Then g sends βy to τg (β)y = βy where τg is the automorphism of F×
q determined
by g. So β is in the subfield fixed by the cyclic group generated by τg . As β is not in
any proper subfield of Fq , we conclude that τg is the identity. So Gu ⊆ GL(V ). We
have Gu = Gy,βy , Gv = Gz,γz , and Gu,v = Gy,βy,z,γz = Gy,βy,z . As m ≥ 3, these
subgroups are all in P.
It remains to prove that C|Gu is discrete on Gu,v (the claim for C|Gv is symmetric).
Let P 0 be the system of stabilizers of depth m−2 over Gu with respect to the action of
Gu on S. As Gu ⊆ GL(V ), we have d(Gu ) ≤ dGL (n, q) = m − 2 by Corollary 6.3.
So all strongly antisymmetric P 0 -schemes are discrete on (Gu )z = Gu,v . Also note
P 0 ⊆ P|Gu since Gu = Gy,βy . It follows that all strongly antisymmetric P|Gu schemes are discrete on Gu,v . As C|Gu is strongly antisymmetric by Lemma 6.2, it
is discrete on Gu,v , as desired.
Similarly, we have
Lemma 7.11. dPΓL (n, q) ≤ dPGL (n, q) + 4.
Proof. Let G = PΓL(V ), S = PV , and m = dGL (n, q) + 4 ≥ 5. Let P be the
system of stabilizers of depth m over G with respect to the natural action of G on S.
Let C be a strongly antisymmetric P-scheme. By Lemma 7.6, it suffices to prove,
for all (w, w0 ) ∈ S (2) , that C|Gw is discrete on Gw,w0 . Fix (w, w0 ) ∈ S (2) . Again by
Lemma 7.6, it suffices to prove, for all (x, x0 ) ∈ (Gw w0 )(2) , that C|Gw,x is discrete
on Gw,x,x0 (note Gw,x , Gw,x0 , Gw,x,x0 ∈ P since m ≥ 3).
Fix (x, x0 ) ∈ (Gw w0 )(2) . Choose representatives w̃, x̃, x̃0 ∈ V − {0} of w, x and x0
respectively. Note that w̃, x̃ and x̃0 are pairwise linearly independent over Fq since
w, x, x0 are distinct. Let α be an element in F×
q not contained in any proper subfield
of Fq . Define ỹ = w̃ + αx̃ 6= 0 and let y be the element in S represented by ỹ.
Consider the diagonal action of Gw,x on S 2 and let O be the orbit of (x0 , y) under
this action. We have (Gw,x )(x0 ,y) = Gw,x,x0 ,y ∈ P|Gx since m ≥ 4. By Lemma 2.3,
it suffices to prove that C|Gw,x is discrete on (Gw,x )(x0 ,y) . Let G0 = Gw,x . Applying
Lemma 7.6 to the action of G0 on O, we see that it suffices to prove for all u, v ∈ O
that (1) G0u , G0v , G0u,v ∈ P|G0 and (2) C|G0u and C|G0v are discrete on G0u,v .
Fix u = (x01 , y1 ) = g1 (x0 , y) and v = (x02 , y2 ) = g2 (x0 , y) in O, where g1 , g2 ∈ G0 .
Lift g1 to g̃1 ∈ ΓL(V ). As g1 ∈ Gx , we have g̃1 x̃ = cx̃ for unique c ∈ F×
q . Define

195
x̃01 = g̃1 x̃0 and ỹ1 = g̃1 ỹ so that they are representatives of x01 and y1 respectively.
Consider arbitrary g ∈ G0u = Gw,x,x01 ,y1 . We claim g ∈ PGL(V ). To see this, lift g
to g̃ ∈ ΓL(V ). Note that ỹ1 = g̃1 (w̃ + αx̃) = g̃1 w̃ + α1 g̃1 x̃ where α1 = τg̃1 (α) and
g̃1
g̃1
τg̃1 is the automorphism of F×
q determined by g̃1 . Here w̃ and x̃ are collinear with
w̃ and x̃ respectively since g1 ∈ Gw,x . And g̃1 w̃, g̃1 x̃ are linearly independent over Fq
since w̃ and x̃ are linearly independent. As g ∈ Gw,x,x0 ,y1 , we see that g̃ scales g̃1 w̃,
g̃1
x̃ and ỹ1 = g̃1 w̃ + α1 g̃1 x̃. Therefore τg̃ (α1 ) = α1 , where τg̃ is the automorphism
of F×
q determined by g̃. So α1 is in the subfield fixed by the cyclic group generated
by τg̃ . But α1 = τg̃1 (α) is not in any proper subfield of Fq . It follows that τg̃ is
the identity. So we have g̃ ∈ GL(V ) and hence g ∈ PGL(V ). We conclude that
G0u = PGL(V )w,x,x01 ,y1 , and similarly G0v = PGL(V )w,x,x02 ,y2 . Moreover, observe
that g̃ above scales w̃ and x̃ by the same factor since g fixes y1 . So it also scales any
vector in the span of w̃ and x̃ over Fq . We know ỹ1 is in this span and by the same
argument, so is ỹ2 . So g fixes y2 . This shows G0u,v = PGL(V )w,x,x01 ,y1 ,x02 . We then
have G0u , G0v , G0u,v ∈ P|G0 since m ≥ 5.
It remains to prove that C|G0u is discrete on G0u,v (the claim for C|G0v is symmetric). Let
P 0 be the system of stabilizers of depth m−4 over G0u with respect to the action of G0u
on S. As G0u ⊆ PGL(V ), we have d(G0u ) ≤ dPGL (n, q) = m − 4 by Corollary 6.3.
So all strongly antisymmetric P 0 -schemes are discrete on (G0u )x02 = G0u,v . Also note
P 0 ⊆ P|G0u since G0u = Gw,x,x01 ,y1 . It follows that all strongly antisymmetric P|G0u schemes are discrete on G0u,v . As C|G0u is strongly antisymmetric by Lemma 6.2, it
is discrete on G0u,v , as desired.
It remains to show the equivalence between GL(V ) and PGL(V ). To achieve this,
we need a lemma about pointwise stabilizers of the natural action of PGL(V ) on
PV . Let T be a subset of PV . For each x ∈ T , choose a representative x̃ ∈ V − {0}.
Call a subset of T dependent if the corresponding set of representatives are linearly
dependent over Fq . Clearly, this definition does not depend on the choices of the
representatives. Define the relation ∼T on T such that x ∼T y iff there exists a
minimal dependent subset of T containing both x and y. It is easy to show that
this is an equivalence relation.4 So it defines a partition of T into the equivalence
classes.5
4

To prove transitivity of ∼T , consider x, y, z ∈ T such that x ∼T y and y ∼T z. Then x and y
(resp. y and z) are in a dependent subset T1 (resp. T2 ) of T . Then T1 ∪ T2 is a dependent set. We
obtain a minimal dependent set containing x and z by removing elements in T1 ∪ T2 − {x, z}.
5
In the language of matroid theory, the dependent sets define a matroid on T , and the equivalent
classes are known as the connected components of this matroid.

196
Let π denote the quotient map GL(V ) → PGL(V ). We have
Lemma 7.12. Suppose T is a subset of PV and T1 , . . . , Tk ⊆ T are the equivalent
classes with respect to ∼T . For i ∈ [k], let Vi be the subspace of V spanned by (the
representatives of) the elements in Ti . Then g ∈ GL(V ) is sent to an element of
PGL(V )T under π iff g restricts to a scalar linear transformation on each Vi .
Proof. Suppose g ∈ GL(V ) restricts to a scalar linear transformation on each Vi .
Then obviously π(g) fixes each Ti pointwisely. So π(g) ∈ PGL(V )T . Conversely,
suppose π(g) ∈ PGL(V )T . Then for every x ∈ T and its representative x̃ ∈
g
V − {0}, there exists a unique scalar cx ∈ F×
q such that x̃ = cx x̃. We need to show
that for x, y in the same equivalence class Ti , it holds that cx = cy . By definition,
there exists a minimal dependent subset of T containing both x and y. So we can
write
X
x̃ =
cv ṽ,
c v ∈ F×
q for all ṽ ∈ I,
ṽ∈I

where I is a finite set of linearly independent vectors ṽ ∈ Vi , each ṽ represents an
element v ∈ Ti , and ỹ ∈ I. As x̃ and all ṽ ∈ I are scaled by g, they are scaled by
the same factor. So cx = cy , as desired.
In one direction, we have
Lemma 7.13. dGL (n, q) ≤ dPGL (n, q).
Proof. Assume n > 1 as otherwise dGL (n, q) = dPGL (n, q) = 1. Fix m ∈ N+ and
let P (resp. P 0 ) be the system of stabilizers of depth m over GL(V ) (resp. PGL(V ))
with respect to the natural action of GL(V ) on V − {0} (resp. PGL(V ) on PV ).
Fix x ∈ PV and let x̃ be a representative of x̃ in V − {0}. Suppose C is a strongly
antisymmetric P-scheme that is not discrete on GL(V )x̃ . We prove that there exists
a strongly antisymmetric P 0 -scheme that is not discrete on PGL(V )x .
Define P 00 = {π −1 (H) : H ∈ P 0 } which is a subgroup system over GL(V ). We
claim P 00 ⊆ Pcl (see Definition 6.5). Consider H = PGL(V )T ∈ P 0 , where
T ⊆ PV satisfies 1 ≤ |T | ≤ m. Let T1 , . . . , Tk ⊆ T be the equivalence classes
with respect to ∼T . For i ∈ [k], let Vi be the subspace of V spanned by (the
representatives of) the elements in Ti . And let W be the subspace of V spanned by
P
(the representatives of) those in T , i.e., W = ki=1 Vi . Let H 0 := GL(V )W . Note
that H 0 = GL(V )B for any basis B of W over Fq , and dimFq W ≤ |T | = m. So
H 0 ∈ P. We claim H 0 = uP (π −1 (H)) and π −1 (H) ⊆ NGL(V ) (H 0 ).

197
By Lemma 7.12, the group π −1 (H) consists of g ∈ GL(V ) that restricts to a scalar
linear transformation on each Vi . So π −1 (H) fixes W setwisely. Therefore we have
H 0 ⊆ π −1 (H) ⊆ NGL(V ) (H 0 ). Suppose H 00 is another subgroup in P contained in
π −1 (H). It has the form GL(V )W 0 where W 0 is a subspace of V . If W 6⊆ W 0 , there
exists a representative ỹ ∈ V − {0} of some y ∈ T such that ỹ 6∈ W 0 . Then there
exists g ∈ GL(V ) that fixes W 0 pointwisely but sends ỹ to a vector ỹ 0 such that ỹ and
ỹ 0 are not collinear. Such an element g is in H 00 but not in π −1 (H), contradicting
the assumption H 00 ⊆ π −1 (H). So W ⊆ W 0 and hence H 00 ⊆ H 0 . Therefore H 0 is
the unique maximal subgroup in P contained in π −1 (H), i.e., H 0 = uP (π −1 (H)).
By definition, we have π −1 (H) ∈ Pcl . So P 00 ⊆ Pcl .
Note that GL(V )x̃ = uP (π −1 (PGL(V )x )). By Lemma 6.10, the existence of C
implies that there exists a strongly antisymmetric Pcl -scheme that is not discrete
on π −1 (PGL(V )x ). As P 00 ⊆ Pcl , there also exists a strongly antisymmetric P 00 scheme that is not discrete on π −1 (PGL(V )x ). Finally, by Lemma 6.4, there exists a
strongly antisymmetric P 0 -scheme that is not discrete on PGL(V )x , as desired.
In the other direction, we have
Lemma 7.14. dPGL (n, q) ≤ dGL (n, q) + 2.
Proof. Fix m ∈ N+ and let P (resp. P 0 ) be the system of stabilizers of depth
m + 2 (resp. m) over PGL(V ) (resp. GL(V )) with respect to the natural action
of PGL(V ) on PV (resp. GL(V ) on V − {0}). Suppose there exists a strongly
antisymmetric P-scheme C that is not discrete on PGL(V )x for some x ∈ PV , i.e.,
dPGL (n, q) > m + 2. We prove that there exists a strongly antisymmetric P 0 -scheme
that is not discrete on GL(V )y for some y ∈ V − {0}, i.e., dGL (n, q) > m.
By Lemma 6.2 and Lemma 7.6, there exists u, v ∈ PV such that the P|PGL(V )u collection C|PGL(V )u is a strongly antisymmetric P|PGL(V )u -scheme and is not discrete on PGL(V )u,v . Let ũ be a representative of u in V − {0}. The map π :
GL(V ) → PGL(V ) restricts to a map π|GL(V )ũ : GL(V )ũ → PGL(V )u . The latter
map is surjective (and in fact bijective) since every element in PGL(V )u can be lifted
to an element in GL(V )ũ . Define P 00 := {(π|GL(V )ũ )−1 (H) : H ∈ P|PGL(V )u },
which is a subgroup system over GL(V )ũ . By Lemma 6.4, there exists a strongly
antisymmetric P 00 -scheme C 0 that is not discrete on (π|GL(V )ũ )−1 (PGL(V )u,v ).
Let P̃ be the system of stabilizers of depth m over GL(V )ũ with respect to the
action of GL(V )ũ on V − {0} restricted from that of GL(V ). We claim that

198
P̃ ⊆ P 00 . Consider arbitrary H ∈ P̃. It has the form H = GL(V ){ũ}∪T , where
1 ≤ |T | ≤ m. Let W be the subspace of V spanned by ũ and the elements in
T . Extend {ũ} to an Fq -basis B = {ũ, x1 , . . . , xk } of W . Then k ≤ m. Let
w = ũ + x1 + · · · + xk ∈ V − {0}. Let B 0 = B ∪ {w} and let B̄ 0 be the subset of
PV consisting of the elements represented by those in B 0 . Then |B̄ 0 | ≤ m + 2 and
u ∈ B̄ 0 . So PGL(V )B̄ 0 ∈ P|PGL(V )u . As B is a basis of W , the set B̄ 0 is a minimal
dependent subset and hence is the only equivalence class with respect to ∼B̄ 0 . So
π −1 (PGL(V )B̄ 0 ) consists of the elements in GL(V ) that restricts to scalar linear
transformations on W . Then (π|GL(V )ũ )−1 (PGL(V )B̄ 0 ) consists of the elements in
GL(V ) that fixes W pointwisely, i.e., (π|GL(V )ũ )−1 (PGL(V )B̄ 0 ) = GL(V ){ũ}∪T =
H. By definition, we have H ∈ P 00 . So P̃ ⊆ P 00 .
Recall that C 0 is a strongly antisymmetric P 00 -scheme that is not discrete on the
subgroup (π|GL(V )ũ )−1 (PGL(V )u,v ). Let ṽ be a representative of v in V −{0}. Then
GL(V )ũ,ṽ = (GL(V )ũ )ṽ ∈ P̃ ⊆ P 00 . Note GL(V )ũ,ṽ ⊆ (π|GL(V )ũ )−1 (PGL(V )u,v ).
By Lemma 2.3, we know C 0 is not discrete on GL(V )ũ,ṽ . As P̃ ⊆ P 00 , there exists a
strongly antisymmetric P̃-scheme that is not discrete on GL(V )ũ,ṽ = (GL(V )ũ )ṽ .
By Corollary 6.2, there exists a strongly antisymmetric P 0 -scheme that is not discrete
on GL(V )ṽ , as desired.
Theorem 7.4 now follows from Lemma 7.9, Lemma 7.10, Lemma 7.11, Lemma 7.13,
and Lemma 7.14.
Upper bounds for dGL (n, q). It is easy to see that we have two upper bounds for
dGL (n, q):




1. dGL (n, q) ≤ log212 log(q n − 1) + O(1) = 2loglog12q n + O(1). This follows
from Corollary 7.1.
2. dGL (n, q) ≤ n. This follows from Lemma 2.5 and the fact that the natural
action of GLn (q) has a base of size n.
The first bound is asymptotically better if q ∈ {2, 3}. Otherwise the second one is
better. Now we prove another upper bound that slightly improves both of the two
bounds above.


log q
Theorem 7.5. dGL (n, q) ≤ log q+(log 12)/4 n + O(1).

199
Proof. Let G = GLn (q) and S = Fnq − {0}. Fix a positive integer m ≤ n. Let P
be the system of stabilizers of depth m with respect to the natural action of G on S.
Suppose there exists a strongly antisymmetric P-schemeC = {CH : H ∈ P} that is
log q
not discrete on Gx for some x ∈ S. We prove that m ≤ log q+(log
n + O(1).
12)/4
By Lemma 7.3, there exists a subset T = {x1 , . . . , xm } ⊆ S of cardinality m
log 12
2
such that CGT has a block B of cardinality at least 2( 4 )m −O(m) . We claim that
the elements xi in T may be assumed to be linearly independent: if they are not,
replace T by a set T 0 of cardinality m such that (1) the elements in T 0 are linearly
independent, and (2) the subspace spanned by T 0 contains the one spanned by T .
Then replace B with a block B 0 of CGT 0 such that πGT 0 ,GT (B 0 ) = B. We have
|B 0 | ≥ |B|. This proves the claim.
Note that NG (GT ) is the setwise stabilizer of subspace spanned by T . Therefore
NG (GT )/GT ∼
= GLm (q). By antisymmetry, the group NG (GT )/GT acts semiregularly on the set of blocks of CGT . So we have
log 12
2
|GT \G| ≥ |NG (GT )/GT | · |B| ≥ 2( 4 )m −O(m) ·

m−1
Y

(q m − q i ).

i=0

On the other hand, note that GT is the stabilizer of u := (x1 , . . . , xm ) ∈ S (m)
under the diagonal action of G on S (m) . By the orbit-stabilizer theorem, we have
|GT \G| = |Gu|, which is the number of m-tuples of linearly independent vectors
Q
n
i
in V − {0}. Therefore |GT \G| = m−1
i=0 (q − q ). So we have
log 12
2
2( 4 )m −O(m) ·

m−1
Y

m

i

(q − q ) ≤

i=0

m−1
Y

(q n − q i ).

i=0

Solving the inequality yields the desired bound.
As q ≥ 2, we have log q + (log 12)/4 < (log 12)/2.
So Theorem 7.5 is indeed an

2 log q
improvement of the bound dGL (n, q) ≤ log 12 n + O(1) above.

200
Chapter 8

GROUPS WITH RESTRICTED NONCYCLIC COMPOSITION
FACTORS
In this chapter, we consider the problem of factoring a polynomial f (X) ∈ Fq [X]
using a lifted polynomial f˜ where the Galois group of f˜ has restricted noncyclic
composition factors.
Simple groups, composition factors, and CFSG. To formally state our result,
we first review some definitions and facts in group theory. A simple group is a
nontrivial group whose only normal subgroups are the trivial group and the group
itself. A composition series of a group G is a finite chain of subgroups
{e} = H0 ⊆ H1 ⊆ · · · ⊆ Hk = G
such that for every i ∈ [k], Hi−1 is a maximal normal subgroup of Hi , so that
Hi /Hi−1 is simple. Such a series always exists when G is finite. The groups
Hi /Hi−1 are called the composition factors of G. It is a consequence of the JordanHölder theorem that the set of the composition factors of G does not depend on the
choice of composition series (see, e.g., [Lan02]).
Now suppose G is a finite group. The composition factors of G are finite simple
groups, which are classified by the classification of finite simple groups (CFSG):
Theorem 8.1 (classification of finite simple groups). A finite simple group is isomorphic to one of the following groups: a cyclic group of prime order, an alternating
group Alt(n) (n ≥ 5), a classical group, an exceptional group of Lie type, or one
of the 26 sporadic simple groups.
See, e.g., [GLS94]. We do not describe these families of finite simple groups,
except mentioning that a finite simple group is a classical group if it has one of the
following forms (see, e.g., [KL90]):
PSLn (q), PSUn (q), PSpn (q) (n even), PΩ±
n (q) (n even), Ωn (q) (n odd).
We denote by k(G) the maximum degree of the alternating groups that appear as
noncyclic composition factors of G, and let k(G) = 1 if such alternating groups do

201
not exist. Similarly, denote by r(G) the maximum order of the classical groups that
appear as noncyclic composition factors of G, and let r(G) = 1 if such classical
groups do not exist.
Main result. Let Fq , A0 and K0 be as in Chapter 5. The main result of this chapter
is a GRH-based deterministic algorithm that factorizes f (X) ∈ Fq [X] using a lifted
polynomial f˜(X) ∈ A0 [X], such that the running time of the algorithm is controlled
by k(G) and r(G), where G = Gal(f˜/K0 ) is the Galois group of f˜ over K0 .
Theorem 8.2. Under GRH, there exists a deterministic algorithm that, given a
polynomial f (X) ∈ Fq [X] of degree n ∈ N+ and a lifted polynomial f˜(X) ∈ A0 [X]
of f with the Galois group G := Gal(f˜/K0 ) over K0 , computes the complete
factorization of f over Fq in time polynomial in n, log q, k(G)log k(G) and r(G).
For k ∈ N+ , denote by Γk the family of finite groups whose noncyclic composition
factors are all isomorphic to subgroups of Sym(k). It is known that a classical
group H is isomorphic to a subgroup of Sym(k) only if |H| = k O(log k) [Coo78].
Therefore we have
Theorem 8.3. Under GRH, there exists a deterministic algorithm that, given a
polynomial f (X) ∈ Fq [X] of degree n ∈ N+ and a lifted polynomial f˜(X) ∈ A0 [X]
of f , computes the complete factorization of f over Fq in time polynomial in n, log q
and k log k , where k is the smallest positive integer satisfying Gal(f˜/K0 ) ∈ Γk . In
√
particular, the algorithm runs in polynomial time if k = 2O( log n) .
Table 8.1: Known deterministic polynomial-time factoring algorithms for Γk
k

Reference

4

[Evd92]

O(1)

[Evd92] + [BCP82]

√
O( log n)

2

n

Our result
Goal

By Theorem 8.3, we have a deterministic polynomial-time algorithm that given
f˜(X), completely factorizes f (X) under GRH , provided that Gal(f˜/K0 ) ∈ Γk for
√
some k = 2O( log n) (note that achieving k = n would fully resolve the problem of
deterministic polynomial factoring under GRH). Previously, such an algorithm was

202
known only for bounded k: for k ≤ 4 this follows directly from the deterministic
polynomial-time factoring algorithm for solvable Galois groups [Evd92] (see Theorem 4.3 and Theorem 5.13). For k = O(1), it follows from the proof in [Evd92]
together with the bound in [BCP82] for the orders of primitive permutation groups.
See Table 8.1 for a summary.
Overview of the proof. We prove Theorem 8.2 using the generalized P-scheme
algorithm in Chapter 5. If the input polynomial f is assumed to satisfy Condition 3.1,
we may also use the simpler algorithm in Chapter 3. These algorithms reduce the
problem of factoring f to the one of constructing a collection of (relative) number
fields such that the associated subgroup system P has the property that all strongly
antisymmetric P-schemes are discrete on a certain subgroup (see Theorem 3.9 and
Theorem 5.9).
We further reduce the latter problem to the case that the Galois group Gal(f˜/K0 ) is
a primitive permutation group on the set of roots of f˜, using Theorem 4.2 and some
facts from group theory. Next we consider the following special kind of subgroup
systems.
Definition 8.1. Let G be a finite permutation group on a finite set S. For N ∈ N+ ,
define the subgroup system PG,N over G by
(
)
∅=
6 U ⊆ S, x ∈ S, U 0 ⊆ GU x
PG,N := GU ∪U 0 :
.
0
|S||U | , |GU x||U | ≤ N
We prove a sufficient condition for a subgroup system PG,N over a primitive permutation group to have the desired property:
Theorem 8.4. Let G be a primitive permutation group on a finite set S. For sufficiently large N = poly(k(G)dSym (k(G)) , r(G), |S|) ≥ |S|, all strongly antisymmetric
PG,N -schemes are discrete on Gx ∈ PG,N for all x ∈ S.
It is easy to see that the complexity c(PG,N ) of PG,N is polynomial in N . We modify
the algorithm in Lemma 4.10 to construct a collection of (relative) number fields in
time polynomial in n, log q and c(PG,N ) such that the associated subgroup system
is precisely PG,N . Theorem 8.2 then follows from Theorem 8.4.
Finally, to prove Theorem 8.4, we apply the O’Nan-Scott theorem [LPS88] in permutation group theory, which states that a finite primitive permutation group is in

203
exactly one of the following five categories: almost simple type, affine type, diagonal type, product type, and twisted wreath type. We prove Theorem 8.4 by verifying
it in these five cases separately.
Outline of the chapter. In Section 8.1, we derive Theorem 8.2 from Theorem 8.4
using an algorithm that constructs the collection of (relative) number fields corresponding to PG,N . The rest of the chapter focuses on the proof of Theorem 8.4:
Section 8.2 describes the O’Nan-Scott theorem [LPS88] and the five categories of
primitive permutation groups. In Sections 8.3–8.6, we prove Theorem 8.4 for primitive permutation groups of almost simple type, affine type, diagonal type and product
type respectively. We also address twisted wreath type at the end of Section 8.6
by reducing to the case of product type using an argument in [Pra90]. Finally, we
discuss possible directions for future research in Section 8.7.
8.1

Proof of the main theorem

We start by describing an algorithm SubgroupSystem that computes a (K0 , g)subfield system F given a number field K0 , an integer N ∈ N+ , and a polynomial
g(X) ∈ K0 [X] irreducible over K0 , such that the subgroup system associated with
F is exactly PG,N , where G = Gal(g/K0 ).
The pseudocode is given in Algorithm 16. First compute the greatest integer
d ∈ {0, . . . , deg(g)} subject to deg(g)d ≤ N . Run the algorithm Stabilizers
in Lemma 4.10 on the input (K0 , d, g) to obtain a (K0 , g)-subfield system F 0 , and
let F = F 0 . Next enumerate K ∈ F 0 and the irreducible factors g0 of g over
K. For each (K, g0 ), let d0 be the greatest integer in {0, . . . , deg(g0 )} subject to
0
deg(g0 )d ≤ N , run the algorithm Stabilizers on the input (K, d0 , g0 ) to obtain a
(K, g0 )-subfield system F 00 , and add the fields in F 00 to F.1
The following lemma states that the subgroup system associated with F is precisely
PG,N .
Lemma 8.1. Given a number field K0 , an integer N ∈ N+ , and a polynomial
g(X) ∈ K0 [X] irreducible over K0 , the algorithm SubgroupSystem computes
a (K0 , g)-subfield system F, such that the subgroup system associated with F is
precisely PG,N over G := Gal(g/K0 ), where G is regarded as a permutation group
1

We add a field to F only if it is non-isomorphic to all fields in F over K0 , so that the fields in
F are always mutually non-isomorphic over K0 .

204
Algorithm 16 SubgroupSystem
Input: number field K0 , N ∈ N+ , and g(X) ∈ K0 [X] irreducible over K0
Output: (K0 , g)-subfield system F
1: d ← max{i ∈ N : 0 ≤ i ≤ deg(g), deg(g)i ≤ N }
2: run Stabilizers on (K0 , d, g) to compute a (K0 , g)-subfield system F 0
3: F ← F 0
4: for K ∈ F 0 do
5:
factorize g over K
6:
for irreducible factor g0 of g over K do
7:
d0 ← max{i ∈ N : 0 ≤ i ≤ deg(g0 ), deg(g0 )i ≤ N }
8:
run Stabilizers on (K, d0 , g0 ) to compute a (K, g0 )-subfield system
F 00
9:
for K 0 ∈ F 00 do
10:
compute a relative number field K̃ 0 over K0 such that K̃ 0 ∼
=K0 K 0
11:
if K̃ 0 is non-isomorphic to all fields in F over K0 then
12:
F ← F ∪ {K̃ 0 }
13:

return F

on the set of roots of g in the splitting field of g over K0 . Moreover, the algorithm
runs in time polynomial in c(PG,N ) = N O(1) and the size of the input.
Proof. Let S be the set of roots of g in the splitting field of g over K0 . Let
d = max{i ∈ N : 0 ≤ i ≤ deg(g), deg(g)i ≤ N }. By definition, the subgroup
system PG,N consists of the pointwise stabilizers GU ∪U 0 , such that U is a nonempty
subset of S of cardinality at most d, and U 0 is a subset of a GU -orbit O ⊆ S satisfying
0
|O||U | ≤ N .
Note that when we fix U 0 = ∅, the groups GU ∪U 0 = GU are precisely those in the
system of stabilizers of depth d with respect to the action of G on S. We construct
the corresponding fields by running the algorithm Stabilizers on (K0 , d, g).
Next consider the groups GU ∪U 0 where U 0 6= ∅. We enumerate K = LGU and
the irreducible factor g0 of g over K. By Galois theory, the set of roots of g0 is a
GU -orbit O ⊆ S. Let d0 = max{i ∈ N : 0 ≤ i ≤ deg(g0 ), deg(g0 )i ≤ N }. We run
the algorithm Stabilizers on (K, d0 , g0 ) to construct the fields corresponding to
the subgroups (GU )U 0 = GU ∪U 0 , where U 0 ⊆ O and 1 ≤ |U 0 | ≤ d0 . Moreover, all
the groups GU and the GU -orbits in S are enumerated. It follows that the subgroup

205
system associated with F is precisely PG,N .
Finally, the fact c(PG,N ) = N O(1) and the claim about the running time follow from
Lemma 4.2 and Lemma 4.10.
We also need the following lemma, which states that restricting to a subgroup does
not increase the quantities k(G)log k(G) and r(G) by much.
Lemma 8.2. Let G be a permutation group on a finite set S, and let G0 be a
0
subquotient of G. Then k(G0 )log k(G ) and r(G0 ) are polynomial in k(G)log k(G) , r(G)
and |S|.
Proof. Let H 0 be a noncyclic composition factor G0 . Then H 0 is isomorphic to a
subquotient of a noncyclic composition factor H of G, i.e., there exists a subgroup
H 00 of H and a normal subgroup N of H 00 such that H 0 ∼
= H 00 /N . Fix such H, H 00
0
and N . We want to prove (1) if H 0 is an alternating group Alt(k 0 ), then k 0 log k is
polynomial in k(G)log k(G) , r(G) and |S|, and (2) if H 0 is a classical group, then |H 0 |
is polynomial in k(G)log k(G) , r(G) and |S|.
By CFSG, the group H is either an alternating group or a group of Lie type (i.e.
a classical group or an exceptional group of Lie type). First assume H is an
alternating group of degree k ≤ k(G). If H 0 is also an alternating group, its degree
0
k 0 is obviously bounded by k. So k 0 log k ≤ k(G)log k(G) . Now consider the case that
H 0 is a classical group of the form PSLn (q), PSUn (q), PSpn (q), PΩ±
n (q), or Ωn (q)
2
over a finite field Fq for some n ∈ N+ . We have |H 0 | = q Θ(n ) . Denote by µ(T )
the minimal degree of a faithful permutation representation of a finite group T . It
was proven in [KP00] that if T̄ is a quotient group of T with no nontrivial abelian
normal subgroup, then µ(T̄ ) ≤ µ(T ). As H 0 ∼
= H 00 /N is simple and noncyclic, we
have
µ(H 0 ) = µ(H 00 /N ) ≤ µ(H 00 ) ≤ µ(H) ≤ k.
On the other hand, it was shown in [Coo78] that µ(H 0 ) = q Θ(n) (see also [KL90,
Table 5.2.A]). So we have n = O(log k/ log q) and
2

|H 0 | = q Θ(n ) = k O(log k/ log q) = k(G)O(log k(G)) .
Next assume H is a group of Lie type over a finite field Fq , and has Lie rank `.2 Then
2
|H| = q Θ(` ) [KL90, Table 5.1.A]. It is also known that H has a faithful projective
2

Each finite simple group of Lie type has an associated Lie rank. See, e.g., [KL90, Section 5.1].

206
linear representation H ,→ PGLd (F̄q ) of degree d = O(`), where F̄q is the algebraic
closure of Fq (see [KL90, Proposition 5.4.13]). As H is finite, this also holds for
some finite field F in place of F̄q . Identify H 00 ⊆ H with a subgroup of PGLd (F ).
Then H 0 ∼
= H 00 /N is a subquotient of PGLd (F ), and hence also a subquotient of
GLd (F ). Choose the largest s ∈ N+ such that H 0 has a subquotient isomorphic to
Alt(s). Then Alt(s) is isomorphic to a subquotient of GLd (F ). On the other hand,
it is known that Alt(s) has a finite preimage in GLd (F ) only if s = O(d) [DM96,
Theorem 5.7A]. So we have s = O(d) = O(`).
Suppose H is a classical group. If H 0 = Alt(s), we have slog s = `O(log `) =
|H|O(1) = r(G)O(1) . And if H 0 is a classical group, we have the obvious bound
|H 0 | ≤ |H| ≤ r(G).
Finally, suppose H is an exceptional group of Lie type. Then s = O(`) = O(1). In
the case H 0 = Alt(s), we have slog s = O(1). So assume H 0 is a classical group of
0
0
the form PSLn (q 0 ), PSUn (q 0 ), PSpn (q 0 ), PΩ±
n (q ) or Ωn (q ) over a finite field Fq for
some n ∈ N+ . It is easy to see that H 0 has a subquotient isomorphic to an alternating
group of degree Ω(n) (see, e.g., [LS03, Proposition 16.4.4]). So s = Ω(n), which
2
implies n = O(1). Then µ(H 0 ) = q 0Θ(n) = q 0Θ(n ) = |H 0 |Θ(1) . On the other hand,
we see above that µ(H 0 ) ≤ µ(H) since H 0 is a subquotient of H and is a noncyclic
simple group. For the same reason, we have µ(H) ≤ µ(G) ≤ |S|. It follows that
|H 0 | = |S|O(1) .
Now we are ready to prove Theorem 8.2 under the assumption of Theorem 8.4.
Proof of Theorem 8.2. The first step is to reduce to the case that f˜ is irreducible
over K0 , as in Chapter 5: Let p = char(Fq ). Using Lemma 5.1, we compute an
integer D satisfying D ≡ 1 (mod p) and a factorization of D · f˜ into irreducible
Q
factors f˜1 , . . . , f˜k ∈ A0 [X] over K0 . Then we have f (X) = ki=1 ψ̃0 (fi )(X). The
Galois groups Gal(f˜i (X)/K0 ) are quotient groups of G = Gal(f˜/K0 ). So the set
of the composition factors of each f˜i is a subset of that of G. By replacing f˜(X)
with f˜i (X) and f (X) with ψ̃0 (fi ) ∈ Fq [X] for each i ∈ [k], we reduce to the case
that f˜ is irreducible over K0 .
Choose sufficiently large N = poly(k(G)log k(G) , r(G), deg(f )) ≥ deg(f ). Assume
for a moment that the value of N is known to the algorithm. First consider the
case that G acts primitively on the set of roots of f˜. We compute a (K0 , f˜)subfield system F using the algorithm SubgroupSystem above. By Lemma 8.1,

207
the associated subgroup system P over G equals PG,N . Then by Theorem 8.4 and
the fact dSym (k(G)) = O(log k(G)) (see Corollary 7.1), all strongly antisymmetric
P-schemes are discrete on Gx ∈ P for all roots x of f˜.
Now consider the general case, where the action of G may be imprimitive. We
run the algorithm GeneralAction in Theorem 4.2 to compute F, as well as a
tower of relative number fields K0 ⊆ K1 ⊆ · · · ⊆ Kk−1 ⊆ Kk over K0 and
gi (X) ∈ Ki−1 [X] for i ∈ [k], such that
1. Ki is isomorphic to Ki−1 [X]/(gi (X)) over Ki−1 , and
2. the Galois group Gi := Gal(Li /Ki−1 ) acts primitively on the set of roots of
gi in Li , where Li is the Galois closure of Ki /Ki−1 .
We implement the algorithm PrimitiveAction required in Theorem 4.2 using
the algorithm SubgroupSystem. The latter has an extra parameter N , which is
chosen as above. For i ∈ [k], let Fi be the (Ki−1 , gi )-subfield system computed
by SubgroupSystem on the input (Ki−1 , N, gi ), and let Pi be the associated subgroup system over Gi . Note that the groups Gi are subquotients of G. Then
by Theorem 8.4, Lemma 8.1, and Lemma 8.2, for all i ∈ [k], all strongly antisymmetric Pi -schemes are discrete on (Gi )x for all roots x of gi , provided that
N = poly(k(G)log k(G) , r(G), deg(f )) is sufficiently large. In this case, by Theorem 4.2, all strongly antisymmetric P-schemes are discrete on Gx ∈ P for all roots
x of f˜, where P is the subgroup system associated with F.
Finally, we run the generalized P-scheme algorithm in Chapter 5 using the (K0 , f˜)subfield system F computed above, so that f˜ is completely factorized by Theorem 3.9. If f satisfies Condition 3.1, we may also use the simpler algorithm in
Chapter 3 and apply Theorem 3.9 instead.
The above algorithm assumes that the value of a sufficiently large integer N is
known. We may avoid this assumption by running the algorithm multiple times,
where N is initially a constant and is doubled each time, until f is completely
factorized. It only causes an extra factor of O(log N ) in the running time.
8.2

The O’Nan-Scott theorem for finite primitive permutation groups

The O’Nan-Scott theorem for finite primitive permutation groups [LPS88] is one
of the most influential theorems in permutation group theory. In this section, we
describe this theorem and the related definitions.

208
We start with the notion of the socle of a finite group:
Definition 8.2 (socle). The socle of a finite group G, denoted by soc(G), is the
subgroup generated by the minimal (nontrivial) normal subgroups of G.
Next we define the five categories of finite primitive permutation groups appeared
in the O’Nan-Scott theorem.
Almost simple type. Let T be a noncyclic finite simple group, so that its center
Z(T ) is trivial. We identify T with the inner automorphism group Inn(T ) ⊆ Aut(T )
via the isomorphism sending g ∈ T to the conjugation h 7→ ghg −1 (this map is
indeed an isomorphism since its kernel equals Z(T ) and hence is trivial).
We say a finite group is almost simple if it is isomorphic to a group G satisfying
T ⊆ G ⊆ Aut(T ) for some noncyclic finite simple group T . It is known that in this
case T = soc(G) holds.
A finite permutation group of almost simple type is simply a finite primitive permutation group that is also almost simple as an abstract group:
Definition 8.3 (almost simple type). A finite permutation group is said to be of
almost simple type if it is primitive and almost simple.
Affine type. Finite permutation groups of affine type are primitive groups arising
as subgroups of general affine groups that contain all the translations:
Definition 8.4 (affine type). A finite permutation group is said to be of affine type if
it is primitive and permutation isomorphic to a subgroup G of a general affine group
AGL(V ) acting naturally on a finite-dimensional vector space V over a prime field
Fp , and G contains the subgroup of translations V ] := {x 7→ x + u : u ∈ V } ⊆
AGL(V ).
For example, Lemma 6.19 states that finite primitive solvable permutation groups
are of affine type.
Diagonal type. Let T be a noncyclic finite simple group and let k ≥ 2 be an
integer. Consider the subgroup A of Aut(T )k , defined by
A := {(a1 , . . . , ak ) ∈ Aut(T )k : ai Inn(T ) = aj Inn(T ) for all i, j ∈ [k]}.

209
The group Sym(k) acts on A by permuting the k coordinates, sending (a1 , . . . , ak ) ∈
A to (aπ−1 (1) , . . . , aπ−1 (k) ). So we can form the semidirect product
W := A o Sym(k).
Also define the subgroups M, D ⊆ W by
M := Inn(T )k ⊆ A ⊆ W
and
D := {(a, . . . , a)π : a ∈ Aut(T ), π ∈ Sym(k)} ⊆ W.
Then W acts on the right coset space D\W by inverse right translation. Permutation
groups of diagonal type arise as subgroups of W :
Definition 8.5 (diagonal type). A finite permutation group is said to be of diagonal
type if it is primitive and is permutation isomorphic to a group G satisfying M ⊆
G ⊆ W acting on D\W by inverse right translation, where D, M, W are as above.
Example 8.1 (holomorph of a noncyclic finite simple group). Let T be a noncyclic
finite simple group. We may form the semidirect product Hol(T ) := T o Aut(T )
with respect to the natural action of Aut(T ) on T . The group Hol(T ) is called the
holomorph of T . By identifying T (as a set) with the left coset space Hol(T )/Aut(T )
via the bijection T → Hol(T )/Aut(T ) sending g ∈ T to gAut(T ), we see that the
action of Hol(T ) on Hol(T )/Aut(T ) by left translation is equivalent to its action
on the set T defined by hg h0 = h g h0 for h, h0 ∈ T , g ∈ Aut(T ). By the following
lemma, this is an example of finite primitive permutation groups of diagonal type.
Lemma 8.3. Hol(T ) is a finite primitive permutation group of diagonal type on T .3
Proof. The action of Hol(T ) on T is obviously transitive. It is faithful since
Hol(T )e = Aut(T ) acts faithfully on T . To prove that Hol(T ) is primitive, we
want to show that Aut(T ) is maximal in Hol(T ). Consider any group G satisfying
Aut(T ) ⊆ G ⊆ Hol(T ). The kernel of G under the quotient map Hol(T ) → Aut(T )
is a normal subgroup of T , and hence is either {e} or T . So G equals either Aut(T )
or Hol(T ). Therefore Hol(T ) acts primitively on T .
3

Lemma 8.3 holds more generally for any group G satisfying T o Inn(T ) ⊆ G ⊆ Hol(T ).
In an alternative formulation of the O’Nan-Scott theorem, such a group G is said to have type HS
(holomorph of a simple group). See, e.g., [PLN97]. We do not use this notation in the thesis.

210
Now define the groups D, M, W, A as above with respect to T and k = 2. For
g ∈ T , denote by τg ∈ Inn(T ) the conjugation by g which sends x ∈ T to
gxg −1 . Define the map ρ : Hol(T ) → A via ρ(gh) = (τg h, h) for g ∈ T ,
h ∈ Aut(T ). It is straightforward to check that ρ is a well defined injective group
homomorphism and M ⊆ ρ(Hol(T )). The action of A on D\W by inverse right
translation thus induces an action of Hol(T ) on D\W , which is transitive since
M ⊆ ρ(Hol(T )). The stabilizer of De ∈ D\W with respect to this action is
ρ−1 (D ∩ A) = Aut(T ) ⊆ Hol(T ), which is exactly the stabilizer of e ∈ T with
respect to the action of Hol(T ) on T . By Lemma 2.1, the action of Hol(T ) on T
and that on D\W are equivalent. The lemma follows by definition.
Product type. Let H be a primitive permutation group on a finite set Γ of almost
simple type or diagonal type. Let k ≥ 2 be an integer. Define the wreath product
W := H o Sym(k) = H k o Sym(k),
where Sym(k) permutes the k factors of H k . The group W has a natural primitive
wreath product action on Γk where H k acts coordinatewise and Sym(k) permutes
the coordinates. Also define
M := soc(H)k ⊆ W.
Permutation groups of product type arise as subgroups of W :
Definition 8.6 (product type). A finite permutation group is said to be of product type
if it is primitive and is permutation isomorphic to a group G satisfying M ⊆ G ⊆ W
acting on Γk via the primitive wreath product action, where M, W, Γ, k are as above.
Twisted wreath type. Let T be a noncyclic finite simple group. Let P be a
transitive permutation group on [k] where k ≥ 2. Denote by Map(P, T ) the set of
the maps from P to T . Suppose ϕ : P1 → Aut(T ) is a group homomorphism from
the stabilizer P1 of 1 ∈ [k] to Aut(T ). Define
B := {f ∈ Map(P, T ) : f (pq −1 ) = ϕ(q) (f (p)) for all p ∈ P, q ∈ P1 },
which is a group under coordinatewise multiplication. The group P acts on B via
(p f )(px) = f (x), or equivalently
(p f )(x) = f (p−1 x)

for all p, x ∈ P, f ∈ B.

211
It is easy to check that this is a well defined action.4 So we can form the semidirect
product G := B o P with respect to this action. The group G is also called the
twisted wreath product with respect to the data (T, P, ϕ), denoted by T twrϕ P
[Neu63; DM96].
Finite permutation groups of twisted wreath type are defined as follows.
Definition 8.7 (twisted wreath type). A finite permutation group is said to be of
twisted wreath type if it is primitive and is permutation isomorphic to a group
G = T twrϕ P acting on the left coset space G/P via left translation, where T , P ,
and ϕ are as above.
The O’Nan-Scott theorem. Now we are ready to state the O’Nan-Scott theorem
for finite primitive permutation groups [LPS88].
Theorem 8.5 (O’Nan-Scott theorem). A finite primitive permutation group is of
exactly one of the following types: almost simple type, affine type, diagonal type,
product type, and twisted wreath type.
Schreier conjecture. We conclude this section by mentioning the fact that the
outer automorphism group of every finite simple group is solvable. This is known
as the Schreier conjecture, and is now known to be true as a result of CFSG. See,
e.g., [DM96].
Theorem 8.6. The outer automorphism group Out(T ) of every finite simple group
T is solvable.
8.3

Almost simple type

In this section, we prove Theorem 8.4 for finite primitive permutation groups of
almost simple type. Our proof is based on the work on the minimal base sizes of
such permutation groups, including the work on Pyber’s base size conjecture, and
the constant bounds for non-standard actions.
Pyber’s base size conjecture. Recall that a base of a permutation group G on
a finite set S is a subset T ⊆ S satisfying GT = {e}, and the minimal base size
b(G) is the minimum cardinality of a base of G. By the orbit-stabilizer theorem, we
4

For example, the map p f is indeed in B for p ∈ P and f ∈ B since (p f )(p0 q −1 ) =
ϕ(q)
ϕ(q) p
f (p−1 p0 q −1 ) =
(f (p−1 p0 )) =
(( f )(p0 )) for all p0 ∈ P and q ∈ P1 .

212
have the lower bound b(G) ≥ log |G|/ log |S|. Pyber’s base size conjecture [Pyb93]
asserts that this is asymptotically tight if G is primitive:
Conjecture 8.1 (Pyber’s base size conjecture). Let G be a finite primitive permutation group on a finite set S. Then b(G) = Θ(log |G|/ log |S|).
There has been extensive work on Pyber’s conjecture [Ser96; GM98; GSS98; LS02;
Ben05; Faw13; LS14; BS15]. Recently, Duyan, Halasi, and Maróti announced a
proof of this conjecture [DHM16].
We only need the special case of the conjecture for almost simple type, which is
verified in [Ben05].
Theorem 8.7 ( [Ben05]). Let G be a finite primitive permutation group of almost
simple type on a finite set S. Then b(G) = Θ(log |G|/ log |S|).
Bounds for non-standard actions. We also need a result on non-standard actions
of primitive permutation groups of almost simple type. Recall that an action of a
symmetric group Sym(n) is standard if it is equivalent to the action on the set of
k-subsets of [n] for some k ∈ [n], or the action on an orbit of the set of partitions of
[n], induced from the natural action of Sym(n) on [n] (see Chapter 7). And we say an
action of Alt(n) on a finite set S is standard if it is restricted from a standard action
of Sym(n) on S. Analogously, one can define standard actions of a classical group
which, roughly speaking, are actions that permute subspaces (or pairs of subspaces
of complementary dimension) of the natural module. See [LS99; Bur07] for the
rigorous definition. Finally, an action of a primitive permutation group of almost
simple type is non-standard if it is not a standard action.
It was conjectured in [Cam92; CK93] that the minimal base sizes of non-standard
actions are bounded by an absolute constant c ∈ N. This conjecture was proved
by Liebeck and Shalev [LS99].5 We state the following weaker form of this result,
where we do not distinguish standard and non-standard actions of classical groups.
This weaker form is sufficient for our goal.
Theorem 8.8. Let G be a finite primitive permutation group G of almost simple
type, and let T = soc(G). Then one of the following holds:
5

In addition, a chain of papers [Bur07; BLS09; BOW10; BGS11] shows that the minimum
possible value of the constant c is 7.

213
1. G is permutation isomorphic to a symmetric group or an alternating group
with a standard action.
2. T is a classical simple group.
3. b(G) ≤ c, where c ∈ N is some absolute constant.
See [LS99, Theorem 1.3] for the original statement.
Proof of Theorem 8.4 for almost simple type. Now we are ready to prove Theorem 8.4 for a primitive permutation group G of almost simple type. In fact, we
prove it in the following general form which applies to any subgroup H ⊆ G.
Lemma 8.4. Let G be a primitive permutation group of almost simple type on a
finite set S, and let H be a subgroup of G on S. Then for sufficiently large N =
poly(k(G)dSym (k(G)) , r(G), |S|) ≥ |S|, all strongly antisymmetric PH,N -schemes are
discrete on Hx ∈ PH,N for all x ∈ S.
Proof. Let T = soc(G) and P = PH,N . Consider the three cases in Theorem 8.8.
First assume G is permutation isomorphic to a symmetric group Sym(k) or an
alternating group Alt(k) with a standard action. Note k ≤ k(G). We have Hx,y ∈ P
for all x, y ∈ S provided N ≥ |S|2 . We also have H{x,y}∪U ∈ P for all x, y, z ∈ S
and U ⊆ Hx,y z satisfying |Hx,y z| ≤ k and 1 ≤ |U | ≤ dSym (k), provided that
N = k(G)Ω(dSym (k(G))) is sufficiently large. The lemma holds by Theorem 7.2 in
this case.
Next assume T is a classical simple group. Then |T | ≤ r(G). It is also known by
CFSG that |Out(T )| = O(log |T |) (see [Con+85]) and hence |G| ≤ |Aut(T )| =
|T |O(1) = r(G)O(1) . By Lemma 2.5 and Theorem 8.7, we have
d(H) ≤ b(H) ≤ b(G) = Θ(log |G|/ log |S|)
and hence |S|d(G) = |G|Θ(1) = r(G)O(1) . It follows that for sufficiently large
N = r(G)Ω(1) , the subgroup system P contains the system of stabilizers of depth
d(H). So the lemma also holds in this case.
Finally, in the last case of Theorem 8.8, we have d(H) ≤ b(H) ≤ b(G) ≤ c, and
the lemma holds for N ≥ |S|c .
Choosing H = G in Lemma 8.4, we have

214
Corollary 8.1. Theorem 8.4 holds for finite primitive permutation groups of almost
simple type.
8.4

Affine type

In this section, we prove Theorem 8.4 for finite primitive permutation groups of
affine type. The following definitions are needed.
Definition 8.8 (irreducible / primitive linear group). A group H ⊆ GL(V ) is said to
be an irreducible linear group on V if H does not fixes any subspace W ⊆ V other
than {0} and V . And H ⊆ GL(V ) is said to be a primitive linear group on V if it is
L
an irreducible linear group, and V cannot be written as a direct sum V = ki=1 Vi
such that k > 1 and H permutes the direct summands Vi .
The following fact is well known (see, e.g., [Sup76, Section I.4]).
Lemma 8.5. Let G be a finite primitive permutation group G of affine type on a
vector space V over a prime field Fp . Then the stabilizer G0 ⊆ GL(V ) of the origin
0 ∈ V is an irreducible linear group on V .
We prove Theorem 8.4 for affine type by studying the stabilizer of the origin. In
the following, we first discuss the case that this stabilizer is a primitive linear group
(over Fp ), and then the case of (possibly imprimitive) irreducible linear groups.
Primitive linear groups. Our analysis is based on the work [LS02; LS14] on
bases of primitive linear groups. We start with the following definitions.
Definition 8.9 (fully deleted permutation module [KL90]). Fix a finite field Fq and
k ∈ N+ . Define
E(k, q) := {(a, . . . , a) : a ∈ Fq } ⊆ Fkq ,
M (k, q) := {(a1 , . . . , ak ) ∈ Fkq : a1 + · · · + ak = 0},
U (k, q) := M (k, q)/(M (k, q) ∩ E(k, q)).
Let Sym(k) act on Fkq by permuting the k coordinates, which induces an action on
U (k, q). We call U (k, q) the fully deleted permutation module for Sym(k) over Fq .
Definition 8.10 (tensor product of linear groups). Let V1 , . . . , Vk be vector spaces
over a finite field Fq . Let G1 , . . . , Gk be finite groups where Gi ⊆ GL(Vi ) for i ∈ [k].

215
Define an action of G1 × · · · × Gk on the tensor product U := V1 ⊗ · · · ⊗ Vk (over
Fq ) by letting
(g1 ,...,gk )
a1 ⊗ · · · ⊗ ak = g 1 a1 ⊗ · · · ⊗ g k ak
and extending to all tensors multilinearly. This gives a linear representation ρ :
G1 × · · · × Gk → GL(U ). Write g1 ⊗ · · · ⊗ gk for ρ(g1 , . . . , gk ) ∈ GL(U ). And
write G1 ⊗ · · · ⊗ Gk for ρ(G1 × · · · × Gk ) ⊆ GL(U ), called the tensor product of
G1 , . . . , Gk (over Fq ).
We need the following structure theorem in [LS14] on primitive linear groups. See
[LS14, Theorem 1] for a more detailed statement.
Theorem 8.9 ([LS14]). Let p be a prime number, V a finite-dimensional vector
space over Fp , and G a primitive linear group on V . Choose the largest power q of p
such that V can be identified with a vector space V (q) over Fq and G ⊆ ΓL(V (q)).
Let H := G ∩ GL(V (q)) act on V (q). Then there exists an absolute constant
C ∈ N+ such that either b(H) ≤ C, or V (q) can be identified with a tensor product
over Fq
s
t
O
O
V (q) =
U (ki , q) ⊗ W0 ⊗
Wj ,
i=1

j=1

where ki ≥ 56 and U (ki , q) is the fully deleted permutation module for Sym(ki ) over
Fq for i ∈ [s], and Wj is vector space of dimension dj ∈ N+ over Fq for 0 ≤ j ≤ t.
Moreover, in the latter case, the group H is a subgroup of
s
O
i=1

Sym(ki ) ⊗ D0 ⊗

t
O

Dj

j=1

acting on V (q) that satisfies the following conditions:
1. For i ∈ [s], the group Sym(ki ) acts faithfully on U (ki , q) (see Definition 8.9).7
2. D0 ⊆ GL(W0 ) acts on W0 and b(D0 ) ≤ C.
3. For j ∈ [t], the group Dj acting on Wj is the normalizer in GL(Wj ) of one
1/2
of the quasisimple classical groups SLdj (qj ), SUdj (qj ), Spdj (qj ), Ωdj (qj ) ⊆
6

The condition ki ≥ 5 is implicit in [LS14]. If ki < 5, we may always remove the factor U (ki , q)
by replacing W0 with U (ki , q) ⊗ W0 (see [LS02, Lemma 3.3]).
7
We regard Sym(k) as a subgroup of GL(U (k, q)) via the faithful linear representation
Sym(k) ,→ GL(U (k, q)).

216
GLdj (qj ).8 Here Fqj is a subfield of Fq , and we identify GLdj (qj ) with a
subgroup GL(Wj0 ) ⊆ GL(Wj ) for some vector space Wj0 ⊆ Wj over Fqj by
fixing an Fqj -basis of Wj0 that is also an Fq -basis of Wj .
N
N
(∞)
(∞)
4. H contains the group si=1 Alt(ki ) ⊗ {e} ⊗ tj=1 Dj , where Dj denotes
the last term in the derived series of Dj .
The following lemma implies that the group Dj in Definition 8.9 for each j ∈ [t] is
a subgroup of F×
q GLdj (qj ). For its proof, see [KL90, Proposition 4.5.1].
Lemma 8.6. Suppose Fq0 ⊆ Fq , and G ⊆ GLd (q) is one of the quasisimple
1/2
classical groups SLd (q0 ), SUd (q0 ), Spd (q0 ), Ωd (q0 ) ⊆ GLd (q0 ) ⊆ GLd (q). Then
NGLd (q) (G) ⊆ F×
q GLd (q0 ).
For convenience, we also make the following definition.
Definition 8.11 (primary tensor). Use the notations in Theorem 8.9 and assume
b(G) > C. So W is identified with the tensor product
s
O
i=1

U (ki , q) ⊗ W0 ⊗

t
O

Wj

j=1

over Fq by Theorem 8.9. We say an element x ∈ V − {0} is a primary tensor if x is
a pure tensor, i.e., x = u1 ⊗ · · · ⊗ us ⊗ w0 ⊗ w1 ⊗ · · · ⊗ wt , where ui ∈ U (ki , q)
for i ∈ [s] and wj ∈ Wj for 0 ≤ j ≤ t, and in addition,
1. for i ∈ [s], ui ∈ U (ki , q) is represented by an element in M (ki , q) ⊆ Fkqii (see
Definition 8.9) that has exactly two nonzero coordinates, and
0
0
2. for j ∈ [t], wj ∈ Wj has the form wj = cwj0 where c ∈ F×
q and wj ∈ Wj (see
Definition 8.9).

In addition, for two primary tensors x, y ∈ V − {0}, we write x ∼ y if x and y
can be written as tensor products of vectors satisfying the above conditions and they
differ at no more than one vector ui or wj . In other words, we can write
x = u1 ⊗ · · · ⊗ us ⊗ w 0 ⊗ · · · ⊗ w t
8

For the definitions of these classical groups, see, e.g., [KL90; Asc00]. A group G is quasisimple
if it equals its commutator subgroup and its inner automorphism group is simple, or equivalently, if
it is a perfect central extension of a simple group [Asc00].

217
and either
y = u1 ⊗ · · · ⊗ ui−1 ⊗ u0i ⊗ ui+1 ⊗ · · · ⊗ us ⊗ w0 ⊗ · · · ⊗ wt
for some i ∈ [s] and u0i ∈ U (ki , q), or
y = u1 ⊗ · · · ⊗ us ⊗ w0 ⊗ · · · ⊗ wj−1 ⊗ wj0 ⊗ wj+1 ⊗ · · · ⊗ wt
for some 0 ≤ j ≤ t and wj ∈ Wj , so that the vectors ui (resp. u0i ) and wj (resp. wj0 )
satisfy the above defining conditions of primary tensors.
Note that in Definition 8.11, a vector space M (ki , q) is spanned by vectors with
exactly two nonzero coordinates, and Wj is spanned by vectors in Wj0 over Fq . So
any x ∈ V can be written as a finite sum of primary tensors. Also note that for any
two primary tensors x, y ∈ V −{0}, there exists a finite sequence of primary tensors
x0 , . . . , xk ∈ V − {0} such that x0 = x, xk = y, and xi−1 ∼ xi for all i ∈ [k].
Now we are ready to prove the following analogue of Theorem 8.4 for subgroups of
primitive linear groups over Fp .
Lemma 8.7. Let G be a primitive linear group on a vector space V over Fp as
in Theorem 8.9, and let G0 be a subgroup of G on V . Then for sufficiently large
N = poly(r(G), |V |) ≥ |V |, all strongly antisymmetric PG0 ,N -schemes are discrete
on G0x ∈ PG0 ,N for all x ∈ V .
Proof. Use the notations in Theorem 8.9. Fix α ∈ F×
q that does not lie in any proper
subfield of Fq . First assume b(H) ≤ C. Let B ⊆ V be a base of H of cardinality
at most C. Pick a nonzero element z ∈ B. Then B ∩ {αz} is a base of G since
Gz,αz ⊆ G ∩ GL(V (q)) = H. So d(G) ≤ b(G) ≤ C + 1. Then for N ≥ |V |C+1 , all
strongly antisymmetric PG0 ,N -schemes are discrete on G0x ∈ PG0 ,N for all x ∈ V ,
as desired.
Ns
Nt
So assume b(H) > C. Then we have V (q) =
i=1 U (ki , q) ⊗ W0 ⊗
j=1 Wj
Ns
Nt
and H ⊆ i=1 Sym(ki ) ⊗ D0 ⊗ j=1 Dj as in Theorem 8.9. Let P = PG0 ,N and
let C be a strongly antisymmetric P-scheme. Let N ≥ |V |4 so that G0x,y,z,w ∈ P
for all x, y, z, w ∈ V . Fix x ∈ V . We want to prove that C is discrete on G0x . By
Lemma 2.3, it suffices to prove that C is discrete on G0x,αx .
Consider the diagonal action of G0 on V × V , and let O be the G0 -orbit of (x, αx).
The elements in O are of the form (y, βy), where y ∈ V and β ∈ F×
q is a conjugate

218
of α, i.e., β = g α for some g ∈ Gal(Fq /Fp ). Also note that for any distinct y, z ∈ V ,
the difference z −y can be written as a finite sum of primary tensors. By Lemma 7.6,
it suffices to prove, for all distinct y, z ∈ V whose difference z − y is a primary
0
0
tensor and conjugates β, γ ∈ F×
q of α, that C|G0y,βy is discrete on Gy,βy,z,γz = Gy,βy,z .
Fix such y, z, β, γ.
0
0
Let H 0 = G0 ∩ H. Then G0y,βy = Hy0 and G0y,βy,z = Hy,z
= Hy,z−y
. So we want
0
to prove that C|Hy0 is discrete on Hy,z−y . Note that every element in the Hy0 -orbit of
z − y is a primary tensor. As noted after Definition 8.11, for any two primary tensors
u, v ∈ V −{0}, there exists a finite sequence of primary tensors x1 , . . . , xk ∈ V −{0}
such that x1 = u, xk = v, and xi−1 ∼ xi for all i ∈ [k]. Again by Lemma 7.6,
it suffices to prove, for all primary tensors u, v ∈ V − {0} satisfying u ∼ v, that
0
0
0
0
C|Hy,u
is discrete on Hy,u,v
(note Hy,u
= G0y,βy,u , Hy,u,v
= G0y,βy,u,v ∈ P). Fix such
u, v. Suppose u = u1 ⊗ · · · ⊗ us ⊗ w0 ⊗ · · · ⊗ wt where ui ∈ U (ki , q) for i ∈ [s]
and wj ∈ Wj for 0 ≤ j ≤ t satisfy the conditions in Definition 8.11.

First consider the case that v has the form
v = u1 ⊗ · · · ⊗ ur−1 ⊗ u0r ⊗ ur+1 ⊗ · · · ⊗ us ⊗ w0 ⊗ · · · ⊗ wt ,
where r ∈ [s] and u0r ∈ U (kr , q) is represented by a vector ũ0r ∈ M (kr , q) with
0
v|. We prove a bound on n.
exactly two nonzero coordinates. Let n := |Hy,u
0
. By Theorem 8.9, we may write g = g1 ⊗ · · · ⊗ gs ⊗
Consider an element g ∈ Hy,u
h0 ⊗ · · · ⊗ ht where gi ∈ Sym(ki ) for i ∈ [s] and hj ∈ Dj for 0 ≤ j ≤ t. As g fixes
u, we know gr ∈ Sym(kr ) sends ur to cur for some c ∈ F×
q . As kr ≥ 5 and ũr has
exactly two nonzero coordinates, either gr fixes ũr and c = 1, or gr swaps the two
nonzero coordinates of ũr and c = −1. From g u = u, it is easy to see that
g

g

v = c−1 (u1 ⊗ · · · ⊗ ur−1 ⊗ r u0r ⊗ ur+1 · · · ⊗ us ⊗ w0 ⊗ · · · ⊗ wt ).

So c and gr u0r determine g v. The number of possible values of gr u0r is bounded by
0
|Sym(kr )u0r | ≤ |Sym(kr )ũ0r | ≤ kr2 . It follows that n = |Hy,u
v| ≤ 2kr2 . Also note
that |V | ≥ |U (kr , q)| ≥ q kr −2 and hence kr = O(log |V |). Let N ≥ ndSym (n) =
0
|V |O(1) . Then P|Hy,u
contains the system of stabilizers of depth dSym (n) with respect
0
0
0
0
to the action of Hy,u on Hy,u
v. So C|Hy,u
is discrete on Hy,u,v
, as desired.
Next consider the case that v has the form
v = u1 ⊗ · · · ⊗ us ⊗ w00 ⊗ w1 ⊗ · · · ⊗ wt

219
for some w00 ∈ Wr . Let B ⊆ W0 be a base of D0 of cardinality at most C, which
exists by Theorem 8.9. For any subset T of W0 , define
T̃ := {u1 ⊗ · · · ⊗ us ⊗ a ⊗ w1 ⊗ · · · ⊗ wt : a ∈ T } ⊆ V.
0
)B̃ where gi ∈ Sym(ki ) for
Consider g = g1 ⊗ · · · ⊗ gs ⊗ h0 ⊗ · · · ⊗ ht ∈ (Hy,u
i ∈ [s] and hj ∈ Dj for 0 ≤ j ≤ t. As g fixes every element in B̃, we see h0 ∈ D0
−1
scales every element in B by the same factor c ∈ F×
q . Then c h0 ∈ (D0 )B = {e}
and hence h0 = c. Therefore h0 scales every element in W0 by the factor c.
0
0
0
0
)W̃0 . Also note that Hy,u
)B̃ = (Hy,u
)W̃0 . It follows that (Hy,u
So g ∈ (Hy,u
0
0
. Let N ≥ |V |C+3 so that
)W̃0 is normal in Hy,u
fixes W̃0 setwisely. So (Hy,u
0
0 , we know C|H 0
is
(Hy,u
)W̃0 = H{y,βy,u}∪B̃ ∈ P. By antisymmetry of C|Hy,u
y,u
0
0
0
discrete on (Hy,u )W̃0 . By Lemma 2.3, it is also discrete on Hy,u,v ⊇ (Hy,u )W̃0 , as
desired.

Finally, consider the case that v has the form
v = u1 ⊗ · · · ⊗ us ⊗ w0 ⊗ · · · ⊗ wr−1 ⊗ wr0 ⊗ wr+1 ⊗ · · · ⊗ wt
for some 0 ≤ r ≤ t and wr0 ∈ Wr such that wr0 = c0 wr00 for some c0 ∈ F×
q and
0
v| ≤ qrdr . To see this, consider g = g1 ⊗ · · · ⊗ gs ⊗
wr00 ∈ Wr0 . We claim that |Hy,u
0
where gi ∈ Sym(ki ) for i ∈ [s] and hj ∈ Dj for 0 ≤ j ≤ t.
h0 ⊗ · · · ⊗ ht ∈ Hy,u
hr
0
wr = c1 wr for
By Lemma 8.6, we have hr ∈ F×
q GL(Wr ). As g fixes u, we have
×
some c1 ∈ Fq . Then it is easy to see that
g

v = c−1
1 (u1 ⊗ · · · ⊗ us ⊗ w0 ⊗ · · · ⊗ wr−1 ⊗
= u1 ⊗ · · · ⊗ us ⊗ w0 ⊗ · · · ⊗ wr−1 ⊗

hr

c−1
1 hr

wr0 ⊗ wr+1 ⊗ · · · ⊗ wt )

wr0 ⊗ wr+1 ⊗ · · · ⊗ wt .

0
0
×
0
0
As hr ∈ F×
q GL(Wr ), we may write hr = c2 hr for some c2 ∈ Fq and hr ∈ GL(Wr ).
−1
−1
0
Note that h0r = c−1
2 hr ∈ GL(Wr ) ⊆ GL(Wr ) sends wr to c2 c1 wr . Then c2 c1 ∈
−1
−1
0
0
F×
qr . Therefore c1 hr = c1 c2 hr ∈ GL(Wr ). It follows that
0
|Hy,u
v| ≤ |GL(Wr0 )wr0 | = |GL(Wr0 )wr00 | ≤ |Wr0 | = qrdr
0
as claimed. Let V 0 ⊆ V be the vector space over Fq spanned by the elements in Hy,u
v.
0
Let B ⊆ Hy,u
v be an Fq -basis of V 0 . Then |B| = dimFq V 0 ≤ dimFq Wr = dr .
2
d
d2
0
Note qr r = |Dr |O(1) = r(H)O(1) = r(G)O(1) . Let N ≥ qr r ≥ |Hy,u
v|dr , so that
0
P|Hy,u
contains the system of stabilizers of depth dr with respect to the action of
0
0
0
0
0
Hy,u on Hy,u
v. Then (Hy,u
)V 0 = (Hy,u
)B ∈ P. Note that Hy,u
fixes V 0 setwisely,
0
0
0 , we know C|H 0
and hence (Hy,u
)V 0 is normal in Hy,u
. By antisymmetry of C|Hy,u
y,u
0
0
0
is discrete on (Hy,u )V 0 . By Lemma 2.3, it is also discrete on Hy,u,v ⊇ (Hy,u )V 0 , as
desired.

220
Irreducible linear groups. Next we extend Lemma 8.7 to irreducible linear groups
over Fp . For a group G ⊆ GL(V ) and a subspace W ⊆ V , the setwise stabilizer
G{W } acts on W , which gives a linear representation πW : G{W } → GL(W ). Write
G|W for its image πW (G{W } ) ⊆ GL(W ).
We need the following lemma, whose proof can be found in, e.g., [Sup76, Section IV.15].
Lemma 8.8. Let G be an irreducible linear group on a finite-dimensional vector
space V 6= {0}. Then there exists a nonzero subspace W ⊆ V such that G|W is a
primitive linear group on W , and G permutes the subspaces in the set {g W : g ∈ G}.
We have the following generalization of Lemma 8.7.
Lemma 8.9. Let G be an irreducible linear group on a vector space V over Fp , and
let G0 be a subgroup of G on V . Then for sufficiently large N = poly(r(G), |V |) ≥
|V |, all strongly antisymmetric PG0 ,N -schemes are discrete on G0x ∈ PG0 ,N for all
x∈V.
Proof. Assume V 6= {0} as otherwise the claim is trivial. By Lemma 8.8, we
may choose a nonzero subspace W ⊆ V such that G|W is a primitive linear group
on W , and G permutes the subspaces in the set SW := {g W : g ∈ G}. Note
|SW | = log |V |/ log |W | = O(log |V |). We claim r(G|W ) = poly(r(G), |V |). To
see this, consider a classical group H that is a composition factor of G{W } . The
group G permutes the subspaces in SW , which gives a permutation representation
ρ : G → Sym(SW ). Then H is either a composition factor of ρ(G{W } ) or that
of Ker(ρ) ∩ G{W } = Ker(ρ). In the former case, the group H is a subquotient of
Sym(SW ). And Lemma 8.2 implies that |H| = r(H) is polynomial in |SW |log |SW | =
|V |O(1) . In the latter case, we have |H| ≤ r(G) since Ker(ρ) E G. So in either case,
we have r(G|W ) ≤ r(G{W } ) = poly(r(G), |V |).
Let P = PG0 ,N . Let N ≥ |V |3 so that G0x,y,z ∈ P for all x, y, z ∈ V . Suppose
C = {CH : H ∈ P} is a strongly antisymmetric P-scheme. We want to show that
all strongly antisymmetric P-schemes are discrete on G0x for all x ∈ V . Note that
for any x, y ∈ V , we may choose a sequence of elements z0 , . . . , zt ∈ S such that
z0 = x, zt = y, and for all i ∈ [t], the vector zi − zi−1 is in g W for some g ∈ G. By
Lemma 7.6, it suffices to prove, for all x, y ∈ V and g ∈ G satisfying x − y ∈ g W ,
that C|G0x is discrete on G0x,y . Fix such x, y ∈ V and g ∈ G.

221
0

Let z = y − x. Note that G0x,y = G0x,z . Every element in G0x z is in a subspace g W
0
for some g 0 ∈ G. Consider distinct u, v ∈ G0x z that are in the same subspace g W .
0
Pick h, h0 ∈ G0x such that u = h z and v = h z. We claim that G0x,y h−1 , G0x,y h0−1 ∈
G0x,y \G0x are in different blocks of CG0x,y |G0x . By Lemma 7.5, it suffices to show that
C|G0x,u and C|G0x,v are discrete on G0x,u,v . We only prove it for C|G0x,u as the claim for
C|G0x,v is symmetric.
0

Note that G0x,u is a subgroup of G{g0 W } since u ∈ g W and G permutes the subspaces
in the set SW . Define
0

P 0 := {(G0x,u |g0 W )B : B ⊆ g W, (G0x,u )B ∈ P},
which is a subgroup system over G0x,u |g0 W . By Lemma 6.4, it suffices to show
that all strongly antisymmetric P 0 -schemes are discrete on (G0x,u |g0 W )v . Let N 0 :=
bN/|V |2 c. Then P 0 contains the subgroup system PG0x,u |g0 ,N 0 with respect to the
W

0

faithful action of G0x,u |g0 W on g W . Note that G0x,u |g0 W is a subgroup of G|g0 W
and the latter is a primitive linear group since G|W is a primitive linear group.
Also note G|g0 W ∼
= G|W and hence r(G|g0 W ) = r(G|W ) = poly(r(G), |V |). Applying Lemma 8.7 to G0x,u |g0 W ⊆ G|g0 W , we see that all strongly antisymmetric
PG0x,u |g0 ,N 0 -schemes are discrete on (G0x,u |g0 W )v , and hence all strongly antisymW
metric P 0 -schemes are discrete on (G0x,u |g0 W )v , as desired. This proves the claim
that G0x,y h−1 and G0x,y h0−1 are in different blocks of CG0x,y |G0x given that u = h z and
0
0
v = h z are distinct elements in the same subspace g W .
Consider an arbitrary block {G0x,y g1−1 , . . . , G0x,y gs−1 } of CG0x,y |G0x of cardinality s ∈
N+ . By the claim just proved, the elements g1 z, . . . , gs z are in distinct subspaces in
the set SW . So s ≤ |SW | = O(log |V |). Therefore we have m(s) = O(log s) =
O(log log |V |) by Theorem 7.1 (see Definition 7.3 for the definition of m(·)). Choose
the largest m ∈ N satisfying |G0x z|m ≤ N . By definition, the subgroup system
P|G0x contains the system of stabilizers of depth m over G0x (with respect to the
action of G0x on G0x z). Lemma 2.7 and Theorem 6.1 then imply the existence of
a strongly antisymmetric m-scheme Π = {P1 , . . . , Pm } on G0x z such that P1 has
a block of cardinality s. Note |G0x z| ≤ |SW | · |W |. And we have |SW |m(s) =
(log |V |)O(log log |V |) = |V |O(1) and |W |m(s) = |W |O(log |SW |) = |V |O(1) . Then for
sufficiently large N = |V |Ω(1) , we have
|G0x z|m(s) ≤ (|SW | · |W |)m(s) ≤ N,
and hence m ≥ m(s). Theorem 7.1 then forces s = 1. So C|G0x is discrete on
G0x,z = G0x,y , as desired.

222
Now we are ready to prove Theorem 8.4 for finite primitive permutation groups of
affine type.
Lemma 8.10. Theorem 8.4 holds for finite primitive permutation groups of affine
type.
Proof. Let G be a finite primitive permutation groups of affine type on a vector
space V over a prime field Fp . Then the stabilizer G0 ⊆ GL(V ) of the origin
0 ⊆ V is an irreducible linear group by Lemma 8.5. Let V ] ⊆ G be the group of
translations. Then G ∼
= V ] o G0 and hence r(G0 ) ≤ r(G).
Let C be a strongly antisymmetric PG,N -scheme. By Lemma 7.6, it suffices to prove
for all x, y ∈ V that C|Gx is discrete on Gx,y . Fix such x, y ∈ V . By invariance of
C and the fact that G acts transitively on V , we may assume x = 0. So we want
to show that C|G0 is discrete on G0,y . This follows from Lemma 8.9 applied to the
irreducible linear group G0 on V and the subgroup system PG,N |G0 over G0 .
8.5

Diagonal type

In this section, we verify Theorem 8.4 for a finite primitive permutation group G
of diagonal type. By Definition 8.5, we may assume G is a permutation group
satisfying M ⊆ G ⊆ W and acting on a set S := D\W by inverse right translation,
where
A = {(a1 , . . . , ak ) ∈ Aut(T )k : ai Inn(T ) = aj Inn(T ) for all i, j ∈ [k]},
W = A o Sym(k),
M = Inn(T )k ⊆ A ⊆ W,
D = {(a, . . . , a)π : a ∈ Aut(T ), π ∈ Sym(k)} ⊆ W
for a noncyclic finite simple group T and an integer k ≥ 2. The cardinality of S is
|W |/|D| = |T |k−1 .
Let x0 denote the element De ∈ S, so that Gx0 = D ∩ G. It is a consequence of
CFSG that every finite simple group is generated by at most two elements ([AG84]).
So we can choose r, s ∈ Inn(T ) − {e} that generate Inn(T ) ∼
= T . For g ∈ Inn(T ),
define ag := (g, e, . . . , e) ∈ M ⊆ G. We have the following lemma.
Lemma 8.11. For U = {x0 , ar x0 , as x0 , ars x0 }, it holds that WU = Sym(k)1 .
Proof. Note that
−1
−1
WU = D ∩ ar Da−1
r ∩ as Das ∩ ars Dars

223
from which it is straightforward to see Sym(k)1 ⊆ WU .
For the other direction, consider g = (a, . . . , a)π ∈ D ⊆ WU , where a ∈ Aut(T )
and π ∈ Sym(k). We have
π
−1
−1
a−1
r gar = ar (a, . . . , a)πar = ar (a, . . . , a) ar π ∈ D

(8.1)

since a−1
r WU ar ⊆ D.
First assume k > 2. Suppose π sends 1 to i ∈ [k]. Note that all coordinates of ar
(resp. π ar ) are identity except that the first (resp. ith) coordinate is r 6= e. As k > 2
π
−1
and a−1
r (a, . . . , a) ar π ∈ D, we must have i = 1 and r ar = a. So π ∈ Sym(k)1 .
−1
The same argument using the fact a−1
s WU as ⊆ D implies s as = a. Then a
commutes with hr, si = Inn(T ). Note that the isomorphism T ∼
= Inn(T ) sending
h ∈ T to the inner automorphism x 7→ hxh−1 is an equivalence between the action
of Aut(T ) on T and that on Inn(T ) by conjugation. So a fixes T pointwisely, which
implies a = e. Then we have g = π ∈ Sym(k)1 , as desired.
−1
Next assume k = 2. If π = e, we have a−1
r gar = (r ar, a) ∈ D by (8.1).
So r−1 ar = a, and the same argument using the fact a−1
s WU as ⊆ D implies
−1
s as = a. Again we conclude that a commutes with hr, si = Inn(T ), which
implies a = e ∈ Sym(k)1 . Now consider the case π 6= e, i.e., π = (1 2) ∈ Sym(2).
Note that the proof for the previous case π = e shows WU ∩ A = {e}. Therefore

|WU | = [WU : WU ∩ A] ≤ [W : A] = |Sym(k)| = 2.
The lemma is trivial if |WU | = 1. So assume |WU | = 2. Then WU = {e, g}, where
g = (a, a)π is as above. By (8.1), we have (r−1 a, ar)π ∈ D. So ara−1 = r−1 .
−1
The same argument using the facts a−1
s WU as ⊆ D and ars WU ars ⊆ D implies
asa−1 = s−1 and arsa−1 = (rs)−1 = s−1 r−1 . On the other hand, we have
arsa−1 = (ara−1 )(asa−1 ) = r−1 s−1 . So r commutes with s. Then T = hr, si is
abelian, contradicting the assumption that T is a noncyclic finite simple group.
We prove Theorem 8.4 for a finite primitive permutation group G of diagonal type
in the following general form that applies to any subgroup H ⊆ G.
Lemma 8.12. Let G be a finite primitive permutation group of diagonal type on
S = D\W as above, and let H be a subgroup of G on S. Then for sufficiently
large N = poly(|S|) ≥ |S|, all strongly antisymmetric PH,N -schemes are discrete
on Hx ∈ PH,N for all x ∈ S.

224
Proof. Let P = PH,N . By choosing N ≥ |S|2 , we may assume Hx,y ∈ P for
all x, y ∈ S. Let C = {CH 0 : H 0 ∈ P} be a strongly antisymmetric P-scheme.
Define Z to be the set of elements g ∈ M = Inn(T )k such that g has exactly one
coordinate different from the identity. Note that g ∈ Z iff g −1 ∈ Z, and the elements
in Z generate M . Also note that M acts transitively on S. Then by Lemma 7.6,
it suffices to show that for all x ∈ S and g ∈ Z, the P-scheme C|Hx is discrete on
Hx,g x ∈ P|Hx . Fix x ∈ S and g ∈ Z. As M acts transitively on S, there exists
−1
h ∈ M sending x to x0 . Let y := h (g x) = hgh x0 . By invariance of C, it suffices
to show that C|Hx0 is discrete on Hx0 ,y ∈ P|Hx0 .
0

Let g 0 := hgh−1 , so that y = g x0 . Note g 0 ∈ Z. Suppose the ith coordinate of g 0 is
different from the identity. Choose U = {x0 , ar x0 , as x0 , ars x0 } as in Lemma 8.11,
and let U 0 := (1 i) U . As (1 i) ⊆ D fixes x0 , we have x0 ∈ U 0 . By Lemma 8.11, we
have
HU 0 = Sym(k)i ∩ H = Sym(k)i ∩ Hx0 .
(8.2)
Note g 0 ∈ NG (Sym(k)i ), and hence
Sym(k)i = g 0 Sym(k)i g 0−1 ⊆ g 0 Dg 0−1 = g 0 Wx0 g 0−1 = Wy .
0

So HU 0 ⊆ Hx0 ,y . We have HU 0 ∈ P provided that N ≥ |S||U | = |S|O(1) . By
Lemma 2.3, it suffices to prove that C|Hx0 is discrete on HU 0 . By Lemma 7.6, it
suffices to show, for all h, h0 ∈ Hx0 , that (1) Hh U 0 ∪h0 U 0 ∈ P|Hx0 and (2) C|Hh 0 is
U
discrete on Hh U 0 ∪h0 U 0 . Fix h, h0 ∈ Hx0 . We have Hh U 0 ∪h0 U 0 ∈ P|Hx0 provided that
N ≥ |S||

h

0

U 0 ∪h U 0 |

= |S|O(1) .

So it remains to prove that C|Hh 0 is discrete on Hh U 0 ∪h0 U 0 . Write h = bπ and
U
h0 = b0 π 0 where b, b0 ∈ A and π, π 0 ∈ Sym(k). As h ∈ Hx0 ⊆ D, the k coordinates
of b are equal. So b commutes with Sym(k). By (8.2), we have
Hh U 0 = h(Sym(k)i ∩ Hx0 )h−1 = Sym(k)π i ∩ Hx0 .
Similarly, we have Hh0 U 0 = Sym(k)π0 i ∩ Hx0 and
Hh U 0 ∪h0 U 0 = Sym(k)π i,π0 i ∩ Hx0 .
Let n := [Hh U 0 : Hh U 0 ∪h0 U 0 ]. We have
n ≤ [Sym(k)π i : Sym(k)π i,π0 i ] ≤ k.
Also note k = log |S|/ log |T | + 1 = O(log |S|). Consider the action of Hh U 0
on Hh U 0 ∪h0 U 0 \Hh U 0 by inverse right translation. Each one-point stabilizer with

225
respect to this action is a pointwise stabilizer of a set S 0 ⊆ S of cardinality at
0
most |U 0 | = O(1). Choose sufficiently large N ≥ n|U |dSym (n) = k O(log k) = |S|O(1)
so that P|Hh 0 contains the system of stabilizers of depth dSym (n) with respect to
U
this action. Then all strongly antisymmetric P|Hh 0 -schemes, including C|Hh 0 , are
U
U
discrete on Hh U 0 ∪h0 U 0 , as desired.
Choosing H = G in Lemma 8.12, we have
Corollary 8.2. Theorem 8.4 holds for finite primitive permutation groups of diagonal
type.
8.6

Product type and twisted wreath type

In this section, we verify Theorem 8.4 for finite primitive permutation groups of
product type and those of twisted wreath type.
Product type. Suppose G is a finite primitive permutation group of product type.
By Definition 8.6, there exist an integer k ≥ 2 and a primitive permutation group
H on a finite set Γ that is of almost simple type or diagonal type such that G
is a subgroup of W := H o Sym(k) = H k o Sym(k) acting on S := Γk , and
M := soc(H)k ⊆ W is a subgroup of G.
We prove Theorem 8.4 for a finite primitive permutation group G of product type
in the following general form that applies to any subgroup G0 ⊆ G.
Lemma 8.13. Let G be a finite primitive permutation group of product type on
S as above. Let G0 be a subgroup of G on S. Then for sufficiently large N =
poly(k(G)dSym (k(G)) , r(G), |S|) ≥ |S|, all strongly antisymmetric PG0 ,N -schemes
are discrete on G0x ∈ PG0 ,N for all x ∈ S.
Proof. Let P = PG0 ,N . Choose N ≥ |S|3 so that G0x,y,z ∈ P for all x, y, z ∈ S.
Suppose C = {CH : H ∈ P} is a strongly antisymmetric P-scheme. Fix x ∈ S.
We prove that C is discrete on G0x . Note that for any y, z ∈ S, we may choose a
sequence of elements y0 , . . . , yt ∈ S such that y0 = y, yt = z, and for all i ∈ [t],
the elements yi−1 , yi ∈ S = Γk differ at exactly one coordinate. By Lemma 7.6,
it suffices to prove, for all y, z ∈ S differing at exactly one coordinate, that C|G0y is
discrete on G0y,z . Fix such y, z ∈ S. Also note that all elements in G0y z differ from
y at exactly one coordinate. In particular, we have |G0y z| ≤ k|Γ|.

226
Consider u, v ∈ G0y z differing from y at the same coordinate whose index is denoted
0
by i ∈ [k]. Pick g, g 0 ∈ G0y such that u = g z and v = g z. We claim that
G0y,z g −1 , G0y,z g 0−1 ∈ G0y,z \G0y are in different blocks of CG0y,z |G0y ∈ P|G0y . By
Lemma 6.3 and Lemma 7.5, it suffices to verify that C|G0y,u and C|G0y,v are discrete
on G0y,u,v . We only prove it for C|G0y,u since the claim for C|G0y,v is symmetric. Note
that C|G0y,u is a strongly antisymmetric P|G0y,u -scheme by Lemma 6.3. We show that
in fact all strongly antisymmetric P|G0y,u -schemes are discrete on G0y,u,v . As G0y,u
fixes y and u which differ at the ith coordinate, the image of G0y,u under the quotient
map H o Sym(k) → Sym(k) is contained in Sym(k)i . Define
P := {(g1 , . . . , gk )π ∈ G0y,u : gi = e} ⊆ G0y,u .
Then P is a normal subgroup of G0y,u . Suppose v = (v1 , . . . , vk ) ∈ S = Γk . Define
S 0 := {(v1 , . . . , vi−1 , vi0 , vi+1 , . . . , vk ) ∈ S : vi0 ∈ Γ}.
The action of G0y,u on S restricts to an action on S 0 which factors through Ḡ :=
G0y,u /P . And the action of Ḡ on S 0 is permutation isomorphic to H 0 on Γ, where
H 0 ⊆ H is defined by
H 0 := {g ∈ H : (g1 , . . . , gk )π ∈ G0y,u , gi = g}.
Let N 0 = bN/|S|2 c. Note PG0y,u ,N 0 ⊆ P|G0y,u . By Lemma 6.4, we just need to prove
that all strongly antisymmetric PḠ,N 0 -schemes are discrete on Ḡv . Equivalently,
we want to prove all strongly antisymmetric PH 0 ,N 0 -schemes (defined with respect
to the action of H 0 on Γ) are discrete on Hv0 i . Note H 0 ⊆ H where H is a
primitive permutation group of almost simple type or diagonal type on Γ. If H
is of almost simple type, we have k(H) = k(soc(H)) ≤ k(G) by Theorem 8.6
and similarly r(H) = r(soc(H)) ≤ r(G). It follows from Lemma 8.4 that all
strongly antisymmetric PH 0 ,N 0 -schemes are discrete on Hv0 i for sufficiently large
N = poly(k(G)dSym (k(G)) , r(G), |S|). If H is of diagonal type, then we apply
Lemma 8.4 instead to conclude that all strongly antisymmetric PH 0 ,N 0 -schemes are
discrete on Hv0 i for sufficiently large N = poly(|Γ|). So C|G0y,u is discrete on G0y,u,v .
Therefore G0y,z g −1 and G0y,z g 0−1 are in different blocks of CG0y,z |G0y , as claimed.
Consider an arbitrary block {G0y,z g1−1 , . . . , G0y,z gs−1 } of CG0y,z |G0y of cardinality s ∈
N+ . By the claim just proved, the elements g1 z, . . . , gs z differ from y at distinct
coordinates. So s ≤ k. Then m(s) = O(log s) = O(log k) by Theorem 7.1 (see
Definition 7.3 for the definition of m(·)). Choose the largest m ∈ N satisfying

227
|G0y z|m ≤ N . By definition, the subgroup system P|G0y contains the system of
stabilizers of depth m over G0y (with respect to the action of G0y on G0y z). Lemma 2.7
and Theorem 6.1 then imply the existence of a strongly antisymmetric m-scheme
Π = {P1 , . . . , Pm } on G0y z such that P1 has a block of cardinality s. Note |G0y z| ≤
k|Γ|, |S| = |Γ|k , and k = log |S|/ log |Γ| ≤ log |S|. Then for sufficiently large
N = |S|Ω(1) , we have
|G0y z|m(s) = (k|Γ|)O(log k) ≤ N
and hence m ≥ m(s). Theorem 7.1 then forces s = 1. So C|G0y is discrete on G0y,z ,
as desired.
Choosing G0 = G in Lemma 8.13, we have
Corollary 8.3. Theorem 8.4 holds for finite primitive permutation groups of product
type.
Twisted wreath type. Suppose G is a finite primitive permutation group of twisted
wreath type. By Definition 8.7, we may assume G = B o P acting on S := G/P
by left translation, where
• T is a noncyclic finite simple group,
• P ⊆ Sym(k) is a transitive permutation group on [k] for some integer k ≥ 2,
• ϕ is a group homomorphism from P1 to Aut(T ),
• B is the group {f ∈ Map(P, T ) : f (pq −1 ) = ϕ(q) (f (p)) for all p ∈ P, q ∈ P1 }
under coordinatewise multiplication, and
• P acts on B via (p f )(x) = f (p−1 x) for p, x ∈ P , f ∈ B.
It turns out that G can be embedded in a finite primitive permutation group of
product type on S. This is explained in [Pra90, Section 3.6]. We provide a detailed
proof of this fact.
Lemma 8.14. Let G be a finite primitive permutation group of twisted wreath type
on S = G/P as above. Then G is permutation isomorphic to a subgroup of a finite
primitive permutation group Hol(T ) o P of product type on S.

228
Proof. Identifying S = G/P with the set B via the bijection B → G/P sending
g ∈ B to gP ∈ G/P , we may regard G = B oP as a permutation group on the set B
where B ⊆ G acts on B by left translation and P ⊆ G acts by (p f )(x) = f (p−1 x) for
p, x ∈ P , f ∈ B. Pick g1 , . . . , gk ∈ P such that gi 1 = i ∈ [k]. Then g1 , . . . , gk form
a complete set of representatives of P/P1 . We further regard G as a permutation
group on T k by identifying the set B with T k via the bijection B → T k sending
f ∈ B to (f (g1 ), . . . , f (gk )) ∈ T k .
The holomorph Hol(T ) of T is a primitive permutation group of diagonal type on
T where the action is defined by hg h0 = h g h0 for h, h0 ∈ T and g ∈ Aut(T ) (see
Example 8.1 and Lemma 8.3). Denote by G0 the wreath product Hol(T ) o P acting
faithfully on the set T k by the primitive wreath product action, i.e., Hol(T )k acts on
T k coordinatewisely and P ⊆ Sym(k) permutes the k coordinates. We claim that
G is permutation isomorphic to a subgroup of G0 on T k . To see this, note that a
permutation f ∈ B ⊆ G of T k is the same as the permutation (f (g1 ), . . . , f (gk )) ∈
T k E Hol(T )k E G0 . Now consider π ∈ P ⊆ G and we show that it is also a
permutation in G0 . For i ∈ [k], the permutations π −1 gi and gπ−1 i of [k] both send 1
−1

to π i, and hence π −1 gi P1 = gπ−1 i P1 . So we can choose h1 , . . . , hk ∈ P1 such that
π −1 gi = gπ−1 i h−1
i holds for all i ∈ [k]. We claim that π ∈ P ⊆ G, as a permutation
k
of T , equals (ϕ(h1 ), . . . , ϕ(hk ))π ∈ G0 . This is because for f ∈ B, we have
(ϕ(h1 ),...,ϕ(hk ))π

(ϕ(h1 ),...,ϕ(hk )) 





f gπ−1 1 , . . . , f gπ−1 k
 



−1
−1
= f gπ−1 1 h−1
,
.
.
.
,
f
g
h
π
1
k k

(f (g1 ), . . . , f (gk )) =

= (f (π −1 g1 ), . . . , f (π −1 gk ))
= ((π f )(g1 ), . . . , (π f )(g1 ))
= π (f (g1 ) . . . , f (gk )).
Here π in the last equation acts as an element of G, whereas (ϕ(h1 ), . . . , ϕ(hk ))π
is an element of G0 . It follows that G = B o P is permutation isomorphic to a
subgroup of G0 on T k . As G acts primitively on T k , so does G0 . By definition, the
group G0 is a finite primitive permutation group of product type on T k . The lemma
follows.
For the groups G = T twrϕ P and G0 = Hol(T ) o P in Lemma 8.14, we have
k(G) = k(G0 ) and r(G) = r(G0 ) by Theorem 8.6. Then by Lemma 8.13 and
Lemma 8.14, we have

229
Corollary 8.4. Theorem 8.4 holds for finite primitive permutation groups of twisted
wreath type.
8.7

Future research

In this section, we suggest some possible directions for future research.
Dependence on classical groups. As we have shown, the running time of the
factoring algorithm in this chapter is controlled by the alternating groups and the
classical groups among the composition factors of the Galois group. Nevertheless,
the exact relation between the running time and the classical groups is not fully
investigated. The bound we use for classical simple groups is simply the group
order r(G), and a natural problem is to improve this bound. In the case of the
natural action of a general linear group G := GLn (q) on S := Fnq − {0}, it yields
2
the bound r(G) = |PSLn (q)| = q O(n ) . Note that Corollary 3.2 or Corollary 5.2
2
gives the same bound |S|d(GLn (q)) = |S|dGL (n,q) = q O(n ) if we use the trivial
O(n) bound for dGL (n, q) (see Section 7.4). This observation suggests that proving
dGL (n, q) = o(n) is possibly the first step towards a faster factoring algorithm for
classical groups.
Factoring algorithms and P-schemes for various permutation groups. The
main results of this chapter demonstrate that the problem of deterministic polynomial
factoring may be much easier when the Galois group has a relatively simple structure.
In particular, the results are obtained for Galois groups with restricted composition
factors. It is an interesting problem to see if similar results can be obtained for other
families of permutation groups under possibly different restrictions.
A related problem is proving the schemes conjectures (Conjecture 6.3) for more
general families of permutation groups. As we observed in Section 6.3, proving
these conjectures for various permutation groups are intermediate steps towards
proving the original schemes conjecture in [IKS09].
Connections with association schemes. Another approach is to exploit the connections between our notion of P-schemes and association schemes. For example,
by drawing connections between m-schemes [IKS09] and association schemes, the
work [Aro+14] gave a factoring algorithm that finds a nontrivial factor of a reducible polynomial f (X) ∈ Fq [X] of prime degree n in time poly(log q, nr+log ` )
p
under GRH, provided that n − 1 has an r-smooth divisor s satisfying s ≥ n/` + 1.

230
We have shown that P-schemes generalize m-schemes, in the sense that an mschemes is essentially a P-scheme with P chosen to be the system of stabilizers
of depth m over a multiply transitive group (see Theorem 2.1). Thus it is a curious question if the theory of association schemes can find more applications in
deterministic polynomial factoring within our framework of P-schemes.

231

BIBLIOGRAPHY
[AMM77] L. Adleman, K. Manders, and G. Miller. “On taking roots in finite
fields”. In: Proceedings of the 18th Annual Symposium on Foundations
of Computer Science. 1977, pp. 175–178.
[Aro13]

M. Arora. “Extensibility of association schemes and GRH-based deterministic polynomial factoring”. PhD thesis. Universitäts-und Landesbibliothek Bonn, 2013.

[Aro+14]

M. Arora, G. Ivanyos, M. Karpinski, and N. Saxena. “Deterministic
polynomial factoring and association schemes”. In: LMS Journal of
Computation and Mathematics 17.01 (2014), pp. 123–140.

[Asc00]

M. Aschbacher. Finite Group Theory. Cambridge University Press,
2000.

[AG84]

M. Aschbacher and R. Guralnick. “Some applications of the first cohomology group”. In: Journal of Algebra 90.2 (1984), pp. 446–460.

[AM69]

M. F. Atiyah and I. G. Macdonald. Introduction to Commutative Algebra. Addison-Wesley, 1969.

[BCP82]

L. Babai, P. J. Cameron, and P. P. Pálfy. “On the orders of primitive
groups with restricted nonabelian composition factors”. In: Journal of
Algebra 79.1 (1982), pp. 161–168.

[Bai04]

R. A. Bailey. Association Schemes: Designed Experiments, Algebra
and Combinatorics. Vol. 84. Cambridge University Press, 2004.

[BI84]

E. Bannai and T. Ito. Algebraic Combinatorics. Benjamin/Cummings,
1984.

[Ben05]

C. Benbenisty. “On actions of primitive groups”. PhD thesis. Hebrew
University, 2005.

[Ber67]

E. R. Berlekamp. “Factoring polynomials over finite fields”. In: Bell
System Technical Journal 46.8 (1967), pp. 1853–1859.

[Ber70]

E. R. Berlekamp. “Factoring polynomials over large finite fields”. In:
Mathematics of Computation 24.111 (1970), pp. 713–735.

[Bha+17]

V. Bhargava, G. Ivanyos, R. Mittal, and N. Saxena. “Irreducibility and
r-th root finding over finite fields”. In: arXiv preprint arXiv:1702.00558
(2017).

[BKS15]

J. Bourgain, S. Konyagin, and I. Shparlinski. “Character sums and
deterministic polynomial root finding in finite fields”. In: Mathematics
of Computation 84.296 (2015), pp. 2969–2977.

232
[BCN89]

A. E. Brouwer, A. M. Cohen, and A. Neumaier. Distance-Regular
Graphs. Springer-Verlag, 1989.

[Bur07]

T. C. Burness. “On base sizes for actions of finite classical groups”. In:
Journal of the London Mathematical Society 75.3 (2007), pp. 545–562.

[BGS11]

T. C. Burness, R. M. Guralnick, and J. Saxl. “On base sizes for symmetric groups”. In: Bulletin of the London Mathematical Society 43.2
(2011), pp. 386–391.

[BLS09]

T. C. Burness, M. W. Liebeck, and A. Shalev. “Base sizes for simple
groups and a conjecture of Cameron”. In: Proceedings of the London
Mathematical Society 98.1 (2009), pp. 116–162.

[BOW10]

T. C. Burness, E. A. O’brien, and R. A. Wilson. “Base sizes for sporadic simple groups”. In: Israel Journal of Mathematics 177.1 (2010),
pp. 307–333.

[BS15]

T. Burness and Á. Seress. “On Pyber’s base size conjecture”. In: Transactions of the American Mathematical Society 367.8 (2015), pp. 5633–
5651.

[Cam92]

P. J. Cameron. “Some open problems on permutation groups”. In:
Groups, Combinatorics and Geometry 165 (1992), pp. 340–351.

[CGS78]

P. J. Cameron, J.-M. Goethals, and J. J. Seidel. “The Krein condition,
spherical designs, Norton algebras and permutation groups”. In: Indagationes Mathematicae (Proceedings). Vol. 81. 1. 1978, pp. 196–206.

[CK93]

P. J. Cameron and W. M. Kantor. “Random permutations: some grouptheoretic aspects”. In: Combinatorics, Probability and Computing 2.03
(1993), pp. 257–262.

[CZ81]

D. G. Cantor and H. Zassenhaus. “A new algorithm for factoring polynomials over finite fields”. In: Mathematics of Computation 36.154
(1981), pp. 587–592.

[CH00]

Q. Cheng and M. A. Huang. “Factoring polynomials over finite fields
and stable colorings of tournaments”. In: Proceedings of the 4th Algorithmic Number Theory Symposium. 2000, pp. 233–245.

[Chi89]

A. L. Chistov. “The complexity of constructing the ring of integers of
a global field”. In: Doklady Akademii Nauk SSSR. Vol. 306. 5. 1989,
pp. 1063–1067.

[Coh93]

H. Cohen. A Course in Computational Algebraic Number Theory.
Springer, 1993.

[Con+85]

J. H. Conway, R. T. Curtis, S. P. Norton, and R. A. Parker. ATLAS of
Finite Groups. Oxford University Press, 1985.

233
[Coo78]

B. N. Cooperstein. “Minimal degree for a permutation representation
of a classical group”. In: Israel Journal of Mathematics 30.3 (1978),
pp. 213–235.

[DM96]

J. D. Dixon and B. Mortimer. Permutation Groups. Vol. 163. Springer,
1996.

[DHM16]

H. Duyan, Z. Halasi, and A. Maróti. “A proof of Pyber’s base size
conjecture”. In: arXiv preprint arXiv:1611.09487 (2016).

[ER63]

P. Erdős and A. Rényi. “Asymmetric graphs”. In: Acta Mathematica
Hungarica 14.3-4 (1963), pp. 295–315.

[Evd92]

S. A. Evdokimov. “Factorization of solvable polynomials over finite
fields and the generalized Riemann hypothesis”. In: Journal of Soviet
Mathematics 59.3 (1992), pp. 842–849.

[Evd94]

S. A. Evdokimov. “Factorization of polynomials over finite fields in
subexponential time under GRH”. In: Proceedings of the 1st Algorithmic Number Theory Symposium. 1994, pp. 209–219.

[Faw13]

J. B. Fawcett. “The base size of a primitive diagonal group”. In: Journal
of Algebra 375 (2013), pp. 302–321.

[FT63]

W. Feit and J. Thompson. “Solvability of groups of odd order”. In:
Pacific Journal of Mathematics 13.3 (1963), pp. 775–787.

[FR85]

K. Friedl and L. Rónyai. “Polynomial time solutions of some problems
of computational algebra”. In: Proceedings of the 17th Annual ACM
Symposium on Theory of Computing. 1985, pp. 153–162.

[Gao01]

S. Gao. “On the deterministic complexity of factoring polynomials”.
In: Journal of Symbolic Computation 31.1 (2001), pp. 19–36.

[Gat87]

J. von zur Gathen. “Factoring polynomials and primitive elements for
special primes”. In: Theoretical Computer Science 52.1 (1987), pp. 77–
89.

[GG13]

J. von zur Gathen and J. Gerhard. Modern Computer Algebra. Cambridge University Press, 2013.

[GP01]

J. von zur Gathen and D. Panario. “Factoring polynomials over finite
fields: A survey”. In: Journal of Symbolic Computation 31.1-2 (2001),
pp. 3–17.

[GS92]

J. von zur Gathen and V. Shoup. “Computing Frobenius maps and
factoring polynomials”. In: Computational Complexity 2.3 (1992),
pp. 187–224.

[GM98]

D. Gluck and K. Magaard. “Base sizes and regular orbits for coprime
affine permutation groups”. In: Journal of the London Mathematical
Society 58.3 (1998), pp. 603–618.

234
[GSS98]

D. Gluck, Á. Seress, and A. Shalev. “Bases for primitive permutation
groups and a conjecture of Babai”. In: Journal of Algebra 199.2 (1998),
pp. 367–378.

[GLS94]

D. Gorenstein, R. Lyons, and R. Solomon. The Classification of the
Finite Simple Groups. American Mathematical Society, 1994.

[Gua09]

Y. Guan. “Factoring polynomials and Grobner bases”. PhD thesis.
Clemson University, 2009.

[Har77]

R. Hartshorne. Algebraic Geometry. Springer, 1977.

[Hig67]

D. G. Higman. “Intersection matrices for finite permutation groups”.
In: Journal of Algebra 6.1 (1967), pp. 22–42.

[Hua84]

M. A. Huang. “Factorization of polynomials over finite fields and factorization of primes in algebraic number fields”. In: Proceedings of the
16th Annual ACM Symposium on Theory of Computing. 1984, pp. 175–
182.

[Hua91a]

M. A. Huang. “Factorization of polynomials over finite fields and decomposition of primes in algebraic number fields”. In: Journal of Algorithms 12.3 (1991), pp. 482–489.

[Hua91b]

M. A. Huang. “Generalized Riemann hypothesis and factoring polynomials over finite fields”. In: Journal of Algorithms 12.3 (1991), pp. 464–
481.

[ILF97]

V. V. Ishkhanov, B. B. Lur’e, and D. K. Faddeev. The Embedding
Problem in Galois Theory. American Mathematical Society, 1997.

[Iva+12]

G. Ivanyos, M. Karpinski, L. Rónyai, and N. Saxena. “Trading GRH for
algebra: algorithms for factoring polynomials and related structures”.
In: Mathematics of Computation 81.277 (2012), pp. 493–531.

[IKS09]

G. Ivanyos, M. Karpinski, and N. Saxena. “Schemes for deterministic
polynomial factoring”. In: Proceedings of the International Symposium
on Symbolic and Algebraic Computation. 2009, pp. 191–198.

[KS98]

E. Kaltofen and V. Shoup. “Subquadratic-time factoring of polynomials
over finite fields”. In: Mathematics of Computation 67.223 (1998),
pp. 1179–1197.

[KU11]

K. S. Kedlaya and C. Umans. “Fast polynomial factorization and
modular composition”. In: SIAM Journal on Computing 40.6 (2011),
pp. 1767–1802.

[KL90]

P. B. Kleidman and M. W. Liebeck. The Subgroup Structure of the
Finite Classical Groups. Vol. 129. Cambridge University Press, 1990.

[KM00]

J. Klüners and G. Malle. “Explicit Galois realization of transitive
groups of degree up to 15”. In: Journal of Symbolic Computation
30.6 (2000), pp. 675–716.

235
[Knu98]

D. Knuth. The Art of Computer Programming, Volume Two, Seminumerical Algorithms. Addison-Wesley, 1998.

[KP00]

L. G. Kovács and C. E. Praeger. “On minimal faithful permutation
representations of finite groups”. In: Bulletin of the Australian Mathematical Society 62.02 (2000), pp. 311–317.

[LMO79]

J. C. Lagarias, H. L. Montgomery, and A. M. Odlyzko. “A bound for the
least prime ideal in the Chebotarev density theorem”. In: Inventiones
Mathematicae 54.3 (1979), pp. 271–296.

[Lan84]

S. Landau. “Polynomial time algorithms for Galois groups”. In: Proceedings of the International Symposium on Symbolic and Algebraic
Computation. 1984, pp. 225–236.

[Lan85]

S. Landau. “Factoring polynomials over algebraic number fields”. In:
SIAM Journal on Computing 14.1 (1985), pp. 184–195.

[LM85]

S. Landau and G. L. Miller. “Solvability by radicals is in polynomial time”. In: Journal of Computer and System Sciences 30.2 (1985),
pp. 179–208.

[Lan02]

S. Lang. Algebra. Springer, 2002.

[Len90]

H. W. Lenstra Jr. “Algorithms for finite fields”. In: Number Theory and
Cryptography. 1990, pp. 76–85.

[Len91]

H. W. Lenstra Jr. “Finding isomorphisms between finite fields”. In:
Mathematics of Computation (1991), pp. 329–347.

[Len92]

H. W. Lenstra Jr. “Algorithms in algebraic number theory”. In: Bulletin
of the American Mathematical Society 26.2 (1992), pp. 211–244.

[Len83]

A. K. Lenstra. “Factoring polynomials over algebraic number fields”.
In: Computer Algebra (1983), pp. 245–254.

[LLL82]

A. K. Lenstra, H. W. Lenstra Jr., and L. Lovász. “Factoring polynomials
with rational coefficients”. In: Mathematische Annalen 261.4 (1982),
pp. 515–534.

[LPS88]

M. W. Liebeck, C. E. Praeger, and J. Saxl. “On the O’Nan-Scott theorem
for finite primitive permutation groups”. In: Journal of the Australian
Mathematical Society (Series A) 44.03 (1988), pp. 389–396.

[LS99]

M. W. Liebeck and A. Shalev. “Simple groups, permutation groups,
and probability”. In: Journal of the American Mathematical Society
12.2 (1999), pp. 497–520.

[LS02]

M. W. Liebeck and A. Shalev. “Bases of primitive linear groups”. In:
Journal of Algebra 252.1 (2002), pp. 95–113.

[LS14]

M. W. Liebeck and A. Shalev. “Bases of primitive linear groups II”.
In: Journal of Algebra 403 (2014), pp. 223–228.

236
[LS03]

A. Lubotzky and D. Segal. Subgroup Growth. Birkhäuser, 2003.

[Luk82]

E. M. Luks. “Isomorphism of graphs of bounded valence can be tested
in polynomial time”. In: Journal of Computer and System Sciences
25.1 (1982), pp. 42–65.

[Luk93]

E. M. Luks. “Permutation groups and polynomial-time computation”.
In: Groups and Computation. Vol. 11. DIMACS series in Discrete
Mathematics and Theoretical Computer Science. 1993, p. 139.

[Mar77]

D. A. Marcus. Number Fields. Springer, 1977.

[Mil83]

G. L. Miller. “Isomorphism of k-contractible graphs. A generalization
of bounded valence and bounded genus”. In: Information and Control
56.1 (1983), pp. 1–20.

[Mum99]

D. Mumford. The Red Book of Varieties and Schemes. Springer, 1999.

[Neu99]

J. Neukirch. Algebraic Number Theory. Springer-Verlag, 1999.

[Neu63]

B. H. Neumann. “Twisted wreath products of groups”. In: Archiv der
Mathematik 14.1 (1963), pp. 1–6.

[Pál82]

P. P. Pálfy. “A polynomial bound for the orders of primitive solvable
groups”. In: Journal of Algebra 77.1 (1982), pp. 127–137.

[Pil90]

J. Pila. “Frobenius maps of abelian varieties and finding roots of unity in
finite fields”. In: Mathematics of Computation 55.192 (1990), pp. 745–
763.

[Pra90]

C. E. Praeger. “The inclusion problem for finite primitive permutation groups”. In: Proceedings of the London Mathematical Society 3.1
(1990), pp. 68–88.

[PLN97]

C. E. Praeger, C. H. Li, and A. C. Niemeyer. “Finite transitive permutation groups and finite vertex-transitive graphs”. In: Graph Symmetry.
Springer, 1997, pp. 277–318.

[Pyb93]

L. Pyber. “Asymptotic results for permutation groups”. In: Groups and
Computation. Vol. 11. DIMACS series in Discrete Mathematics and
Theoretical Computer Science. 1993, pp. 197–219.

[PS97]

L. Pyber and A. Shalev. “Asymptotic results for primitive permutation
groups”. In: Journal of Algebra 188.1 (1997), pp. 103–124.

[RB72]

K. B. Reid and E. Brown. “Doubly regular tournaments are equivalent
to skew Hadamard matrices”. In: Journal of Combinatorial Theory,
Series A 12.3 (1972), pp. 332–338.

[Rón88]

L. Rónyai. “Factoring polynomials over finite fields”. In: Journal of
Algorithms 9.3 (1988), pp. 391–400.

[Rón89]

L. Rónyai. “Factoring polynomials modulo special primes”. In: Combinatorica 9.2 (1989), pp. 199–206.

237
[Rón90]

L. Rónyai. “Computing the structure of finite algebras”. In: Journal of
Symbolic Computation 9.3 (1990), pp. 355–373.

[Rón92]

L. Rónyai. “Galois groups and factoring polynomials over finite fields”.
In: SIAM Journal on Discrete Mathematics 5.3 (1992), pp. 345–365.

[Sch85]

R. Schoof. “Elliptic curves over finite fields and the computation of
square roots mod p”. In: Mathematics of Computation 44.170 (1985),
pp. 483–494.

[SS98]

K. See and S. Y. Song. “Association schemes of small order”. In:
Journal of Statistical Planning and Inference 73.1 (1998), pp. 225–
271.

[Ser96]

Á. Seress. “The minimal base size of primitive solvable permutation
groups”. In: Journal of the London Mathematical Society 53.2 (1996),
pp. 243–255.

[Ser03]

Á. Seress. Permutation Group Algorithms. Vol. 152. Cambridge University Press, 2003.

[Sha54]

I. R. Shafarevich. “Construction of fields of algebraic numbers with
given solvable Galois group”. In: Izvestiya Rossiiskoi Akademii Nauk,
Seriya Matematicheskaya 18.6 (1954), pp. 525–578.

[Sho90]

V. Shoup. “On the deterministic complexity of factoring polynomials over finite fields”. In: Information Processing Letters 33.5 (1990),
pp. 261–267.

[Sho91]

V. Shoup. “Smoothness and factoring polynomials over finite fields”.
In: Information Processing Letters 38.1 (1991), pp. 39–42.

[Sup76]

D. A. Suprunenko. Matrix Groups. 45. American Mathematical Society, 1976.

[Uma08]

C. Umans. “Fast polynomial factorization and modular composition in
small characteristic”. In: Proceedings of the 40th Annual ACM Symposium on Theory of Computing. 2008, pp. 481–490.

[Wae91]

B. L. van der Waerden. Algebra, Vols. I, II. Springer, 1991.

[WR76]

P. J. Weinberger and L. P. Rothschild. “Factoring polynomials over algebraic number fields”. In: ACM Transactions on Mathematical Software
(TOMS) 2.4 (1976), pp. 335–350.

[Wie64]

H. Wielandt. Finite Permutation Groups. Academic Press, 1964.

[Yun76]

D. Y.Y. Yun. “On square-free decomposition algorithms”. In: Proceedings of the 3rd ACM Symposium on Symbolic and Algebraic Computation. 1976, pp. 26–35.

238
Appendix A

A UNIFYING DEFINITION OF P-SCHEMES
We present an alternative ring-theoretic definition of P-schemes, such that the three
defining properties (compatibility, invariance, regularity) are given in a unifying
way.
Ring IndG K. Let G be a finite group and K be an arbitrary field of characteristic
zero. Define IndG K to be the set of all the functions φ : G → K. We make it into
a commutative ring by defining addition and multiplication entry-wisely. Let G act
on it by (g φ)(gh) = φ(h), or equivalently
(g φ)(h) = φ(g −1 h)
for g, h ∈ G and φ ∈ IndG K.
For a subgroup H ⊆ G, the subring (IndG K)H of H-invariant elements consists
of functions φ : G → K taking a constant value on each right coset in H\G. So
(IndG K)H is identified with the commutative ring consisting of all the functions
from H\G to K where addition and multiplication are defined entry-wisely.
We define inclusions, conjugations and trace maps between (IndG K)H for various
subgroups H ⊆ G:
0

• (inclusion) for H ⊆ H 0 ⊆ G, the ring (IndG K)H is a subring of (IndG K)H .
0
Define the map iH,H 0 : (IndG K)H ,→ (IndG K)H to be the natural inclusion.
0

• (conjugation) for g ∈ G and H 0 = gHg −1 , define c∗H,g : (IndG K)H →
−1
(IndG K)H to be the map sending φ to g φ.
0

• (trace map) for H ⊆ H 0 , define TrH,H 0 : (IndG K)H → (IndG K)H to be the
P
map sending φ to gH∈H 0 /H g φ.
Note that trace maps are indeed well defined: as φ ∈ (IndG K)H is fixed by H, the
function g φ depends only on the left coset gH, and the image TrH,H 0 (φ) does lie in
0
(IndG K)H , since for h ∈ H 0 we have

h
X
X
X
h
g 
hg
g
TrH,H 0 (φ) = 
φ =
φ=
φ = TrH,H 0 (φ).
gH∈H 0 /H

gH∈H 0 /H

gH∈H 0 /H

239
The third equality holds since if g ranges over a complete set of representatives for
H 0 /H, so does hg.
Subring RP associated with a partition P . For a subgroup H ⊆ G and a
partition P of H\G, define RP as the subring of (IndG K)H consisting of functions
φ : H\G → K taking a constant value on each block B of P .
The connection between these subrings and P-schemes is described by the following
theorem.
Theorem A.1. For a P-collection C = {CH : H ∈ P},
• C is compatible iff iH,H 0 (RCH 0 ) ⊆ RCH holds for all H, H 0 ∈ P with H ⊆ H 0 ,
• C is invariant iff c∗H,g (RCH 0 ) ⊆ RCH holds for all H, H 0 ∈ P, g ∈ G with
H 0 = gHg −1 , and
• C is regular iff TrH,H 0 (RCH ) ⊆ RCH 0 holds for all H, H 0 ∈ P with H ⊆ H 0 .
Proof. Make every ring (IndG K)H as well as RCH into a K-algebra by defining
scalar multiplication of K entry-wisely. Note that maps iH,H 0 , c∗H,g and TrH,H 0 are
K-linear. For H ∈ G and B ∈ CH , define the function δB : H\G → K by

1 x ∈ B,
δB (x) =
0 x 6∈ B.
Then RCH is spanned by the functions δB over K where B ∈ CH . So by Klinearity, we have iH,H 0 (RCH 0 ) ⊆ RCH iff iH,H 0 (δB ) ∈ RCH for all B ∈ CH 0 , and
similar claims hold for c∗H,g and TrH,H 0 .
Suppose C is compatible. Fix H, H 0 ∈ P with H ⊆ H 0 , and we check iH,H 0 (δB ) ∈
RCH for all B ∈ CH 0 , i.e., the function iH,H 0 (δB ) takes a constant value on each block
of CH for all B ∈ CH 0 . By definition, its value at Hh ∈ H\G equals δB (H 0 h) =
δB (πH,H 0 (Hh)), which equals one if πH,H 0 (Hh) ∈ B and zero otherwise. The claim
follows by compatibility of C.
Conversely, assume C is not compatible, i.e., for some H, H 0 ∈ P with H ⊆ H 0 ,
B ∈ CH , B 0 ∈ CH 0 and elements Hh, Hh0 ∈ B, we have H 0 h = πH,H 0 (Hh) ∈ B 0
but H 0 h0 = πH,H 0 (Hh0 ) 6∈ B 0 . We show that iH,H 0 (δB 0 ) 6∈ RCH . By definition, we
have (iH,H 0 (δB 0 ))(Hh) = δB 0 (H 0 h) = 1 but (iH,H 0 (δB 0 ))(Hh0 ) = δB 0 (H 0 h0 ) = 0.

240
So the value of iH,H 0 (δB 0 ) is not a constant on the block B. Therefore iH,H 0 (δB 0 ) 6∈
RCH .
The proof for invariance is similar. Suppose C is invariant. Fix H, H 0 ∈ P, g ∈ G
with H 0 = gHg −1 , and we check c∗H,g (δB ) ∈ RCH for all B ∈ CH 0 , i.e., the function
c∗H,g (δB ) takes a constant value on each block of CH for all B ∈ CH 0 . By definition,
−1
we have c∗H,g (δB ) = g δB with respect to the action of G on IndG K defined at the
beginning, where δB is regarded as an element of IndG K. Then for Hh ∈ H\G,
we have
−1

(c∗H,g (δB ))(Hh) = (g δB )(h) = δB (gh) = δB (H 0 gh) = δB (cH,g (Hh))
which equals one if cH,g (Hh) ∈ B and zero otherwise. The claim follows by
invariance of C.
Conversely, assume C is not invariant, i.e., for some for H, H 0 ∈ P, g ∈ G with
H 0 = gHg −1 , B ∈ CH , B 0 ∈ CH 0 and elements Hh, Hh0 ∈ B, we have H 0 gh =
cH,g (Hh) ∈ B 0 but H 0 gh0 = cH,g (Hh0 ) 6∈ B 0 . We show that c∗H,g (δB 0 ) 6∈ RCH .
By definition, we have (c∗H,g (δB 0 ))(Hh) = δB 0 (H 0 gh) = 1 but (c∗H,g (δB 0 ))(Hh0 ) =
δB 0 (H 0 gh0 ) = 0. So the value of c∗H,g (δB 0 ) is not a constant on the block B. Therefore
c∗H,g (δB 0 ) 6∈ RCH .
Now suppose C is regular. Fix H, H 0 ∈ P with H ⊆ H 0 , and we check TrH,H 0 (δB ) ∈
RCH 0 for all B ∈ CH , i.e., the map TrH,H 0 (δB ) takes a constant value on each block
P
of CH 0 for all B ∈ CH . By definition, we have TrH,H 0 (δB ) = gH∈H 0 /H g δB with
respect to the action of G on IndG K defined at the beginning, where δB is regarded
as an element of IndG K. Then for H 0 h ∈ H 0 \G, we have
(TrH,H 0 (δB ))(H 0 h) =

X
gH∈H 0 /H

(g δB )(h) =

X

−1

(g δB )(h) =

Hg∈H\H 0

X

δB (gh)

Hg∈H\H 0

= |{Hg ∈ H\H 0 : Hgh ∈ B}|
= |{Hg ∈ H\G : Hgh ∈ B, πH,H 0 (Hgh) = H 0 h}|
= |{Hg ∈ H\G : Hg ∈ B, πH,H 0 (Hg) = H 0 h}|,
which counts the number of elements in B mapped to H 0 h by πH,H 0 . By regularity,
this value is a constant when H 0 h ranges over a block of CH 0 , as desired.
Conversely, assume C is not regular, i.e., for some H, H 0 ∈ P with H ⊆ H 0 ,
B ∈ CH , B 0 ∈ CH 0 , and H 0 h, H 0 h0 ∈ B 0 , the number of elements in B mapped
to H 0 h is different from the number of those mapped to H 0 h0 . As shown in

241
the previous paragraph, these two numbers are precisely (TrH,H 0 (δB ))(H 0 h) and
(TrH,H 0 (δB ))(H 0 h0 ) respectively. So the value of TrH,H 0 (δB ) is not a constant on
the block B 0 . Therefore TrH,H 0 (δB ) 6∈ RCH 0 .
By Theorem A.1, we have the following alternative definition for P-schemes, which
is equivalent to the original one (Definition 2.4).
Definition A.1 (P-scheme, alternative definition). A P-collection C = {CH : H ∈
P} is a P-scheme if it has the following properties:
• (compatibility) iH,H 0 (RCH 0 ) ⊆ RCH holds for all H, H 0 ∈ P with H ⊆ H 0 .
• (invariance) c∗H,g (RCgHg−1 ) ⊆ RCH holds for all H ∈ P and g ∈ G.
• (regularity) TrH,H 0 (RCH ) ⊆ RCH 0 holds for all H, H 0 ∈ P with H ⊆ H 0 .
Remark. The reader familiar with the notion of affine schemes [Mum99] may recognize the right coset space H\G as (the underlying set of) the affine scheme associated
with the commutative ring (IndG K)H . More generally, each a partition P of H\G
determines a quotient set of H\G which is (the underlying set of) the affine scheme
associated with the subring RP . It is known that the language of affine schemes and
that of commutative rings are equivalent.1 Theorem A.1 is a manifestation of this
equivalence.
Therefore in principle, statements and proofs about P-schemes may be carried
out either set-theoretically or ring-theoretically. We stick to the more elementary
set-theoretic language in this thesis.

1

Formally, this is known as the fact that the category of affine schemes is anti-equivalent to the
category of commutative rings. See, e.g., [Mum99, Section II.2, Corollary 1].

242
Appendix B

PROOFS OMITTED FROM CHAPTER III
This chapter contains proofs that are omitted from Chapter 3.
Lemma 3.5. The partitions P (I) and the idempotent decompositions I(P ) are well
defined. And for any idempotent decomposition I of ŌK , the idempotents δ ∈ I
correspond one-to-one to the blocks of P (I) via the map δ 7→ Bδ := {Hg ∈ H\G :
g −1
(iK,L (δ)) ≡ 1 (mod Q̄0 )} with the inverse map B 7→ δB .
Proof. We first show that P (I) and I(P ) are well defined. For P (I) we note that
g −1
(iK,L (δ)) depends only on the coset Hg, since iK,L (δ) ∈ iK,L (ŌK ) is fixed by
−1
0−1
H. The relation g (iK,L (δ)) ≡ g (iK,L (δ)) (mod Q̄0 ) for all δ ∈ I is obviously
an equivalence relation on H\G, and hence defines a partition of H\G.
P
For I(P ), we fix B ⊆ H\G and show that t := g∈G:Hg∈B g δQ̄0 does lie in the
image of iK,L so that δB = i−1
K,L (t) is well defined. By Corollary 3.1, each coset
x = Hg corresponds to a maximal ideal Px := (g Q0 ∩ OK )/pOK of ŌK . By
Lemma 3.3, there exists a unique idempotent δ of ŌK satisfying δ ≡ 1 (mod Px )
for x ∈ B, and δ ≡ 0 (mod Px ) for x 6∈ B. It follows that for g ∈ G, the residue
g
of iK,L (δ) modulo Q̄0 equals one if Hg ∈ B and zero otherwise. The same holds
g
for t by definition: for g ∈ G, the residue of t modulo Q̄0 equals one if Hg ∈ B
and zero otherwise. As all the maximal ideals of the semisimple ring ŌL have the
g
form Q̄0 where g ∈ G, we have t = iK,L (δ), as desired. Furthermore, by choosing
P
B = H\G and t = iK,L (1) = 1, we see that g∈G g δQ̄0 = 1. It follows that I(P )
is a well defined idempotent decomposition of ŌK .
For the second claim, we first check that the sets Bδ form a partition of H\G and
the map δ 7→ Bδ is injective. To see this, note that if an element Hg lies in both
−1
−1
Bδ and Bδ0 for distinct δ, δ 0 ∈ I, then g (iK,L (δ)) ≡ g (iK,L (δ 0 )) ≡ 1 (mod Q̄0 )
−1
by definition. But then g (iK,L (δδ 0 )) ≡ 1 (mod Q̄0 ), contradicting the fact that
δδ 0 = 0. So the sets Bδ are disjoint and the map δ 7→ Bδ is injective. Furthermore,
each Hg ∈ H\G lies in at least one set Bδ since
g −1

X g−1
δ∈I

(iK,L (δ)) ≡

!!
iK,L

X
δ∈I

δ

≡1

(mod Q̄0 ).

(B.1)

243
So the sets Bδ form a partition of H\G.

P
g
−1
Fix B ∈ P (I) and let δ = δB = iK,L
g∈G:Hg∈B δQ̄0 . It remains to verify that
Bδ = B. For Hh ∈ H\G, we have
h−1

h−1 g

X

(iK,L (δ)) =

δQ̄0 .

g∈G:Hg∈B
−1

Note that the residue of h g δQ̄0 modulo Q̄0 equals one if h = g, and zero otherwise.
−1
So the residue of h (iK,L (δ)) modulo Q̄0 equals one if Hh ∈ B and zero otherwise.
It follows by definition that Bδ = B.
Lemma 3.9. There exists a polynomial-time algorithm ComputeResidue that takes
the following data as the input
• a number fields K, a prime number p, and α ∈ OK given as an element of K,
• the outputs of ComputeQuotientRing (see Lemma 3.8) on the inputs (K, p),
0
0
,→ K,
, the inclusion OK
i.e., the quotient ring ŌK , a maximal p-orders OK
0
and the quotient map OK → ŌK ,
and computes α + pOK ∈ ŌK .
0
Proof. Let d = [K : Q]. Suppose the structure constants of K and OK
are given
0
respectively.
in the Q-basis B of K and the Z-basis B 0 = {x1 , . . . , xd } of OK
Then we may assume the structure constants of ŌK is given in the Fp -basis {x1 +
pOK , . . . , xd + pOK } of ŌK . The goal is computing the constants c1 , . . . , cd ∈ Fp
determined by
d
X
α + pOK =
ci (xi + pOK ).
(B.2)
i=1

Note that B is also a Q-basis of K. The change-of-basis matrix M from B 0 to B is
0
given by the inclusion OK
,→ K, whose entries are rational numbers of polynomial
−1
size. So the entries of M are also rational numbers of polynomial size. We apply
M −1 and write α in the basis B 0 :
0

α=

d
X

ri xi ,

ri ∈ Q.

i=1

For i ∈ [d], write ri in the form ai /bi where ai , bi are coprime integers and bi > 0.
Let m be the least common multiple of all the denominators bi . Then we have

244
0
mα = i=1 mri xi with the coefficients mri ∈ Z. So mα ∈ OK
⊆ OK . Passing to
the quotient ring ŌK , we obtain

Pd

mα + pOK =

d
X

c0i (xi + pOK ),

c0i = mri mod p ∈ Fp .

i=1

Suppose m = pe m0 where e ∈ N, m0 ∈ Z and p - m0 . We claim e = 0. Assume to
the contrary that e > 0. For some i0 ∈ [d], we have pe |bi0 but pe+1 - bi0 . Then p - ai0
since ai0 , bi0 are coprime. So p - mri0 . Then c0i0 6= 0 and hence mα + pOK 6= 0.
But as α + pOK ∈ ŌK , we have mα + pOK ∈ mŌK = 0, which is a contradiction.
So e = 0 and p - m. Let s be the multiplicative inverse of m mod p ∈ Fp . We
compute s and let ci = sc0i for i ∈ [d], which satisfy (B.2).
Lemma 3.11. There exists a polynomial-time algorithm ComputeRingHom that
takes the following data as the input
• number fields K, K 0 , an embedding φ : K → K 0 , and a prime number p,
• the outputs of ComputeQuotientRing (see Lemma 3.8) on the inputs (K, p)
and (K 0 , p) respectively,1
and computes the ring homomorphism φ̄ : ŌK → ŌK 0 induced from φ.
0
is given in the
Proof. Let d = [K : Q]. Suppose the structure constants of OK
0
Z-bases {x1 , . . . , xd } of OK . Then we may assume the structure constants of ŌK
is given in the Fp -bases {x1 + pO, . . . , xd + pO} of ŌK .

For i ∈ [d], we need to compute φ̄(xi + pOK ) ∈ ŌK 0 . Note that φ̄(xi + pOK ) =
0
φ(xi ) + pOK 0 . First compute φ(xi ) ∈ K 0 using the inclusion OK
,→ K and the
embedding φ : K → K 0 given in the input. Here φ(xi ) is actually in OK 0 since xi ∈
0
OK
⊆ OK . Use the algorithm ComputeResidue to compute φ(xi ) + pOK 0 ∈ ŌK 0 ,
and we are done.
Lemma 3.16 ([IKS09; Iva+12]). There exists an algorithm FreeModuleTest that
given a semisimple Fp -algebra A and a finitely generated A-module M , returns
a zero divisor a of A in polynomial time, such that a is zero only if M is a free
A-module.
1
0
OK
0

0
0
0
That is, the quotient rings ŌK , ŌK 0 , the maximal p-orders OK
, OK
0 , the inclusions OK ,→ K,
0
0
,→ K 0 , and the quotient maps OK
→ ŌK , OK
0 → ŌK 0 .

245
Proof. We maintain a submodule N of M that is free over A. Initially N equals
{0} and we iteratively enlarge it. Each time we pick x ∈ M − N and check if the
sum N + Ax is a direct sum, i.e., if N ∩ Ax = {0}. If so, we replace N with
N + Ax. Otherwise we find a nonzero element y ∈ N ∩ Ax and a ∈ A satisfying
y = ax, and return a. Note that in the latter case, the element a is indeed a zero
divisor: otherwise a would be invertible and hence x = a−1 y is in N , contradicting
the assumption x 6∈ N .
If N eventually becomes M , we conclude that M is free over A, in which case we
return zero. The algorithm clearly runs in polynomial time.
Lemma 3.17. There exists an algorithm SplitByZeroDivisor that given
• a semisimple Fp -algebra R, an idempotent decomposition I of R, and an
idempotent γ ∈ I,
• the ring R̄ := R/(1 − γ), the quotient map π : R → R̄, and a zero divisor
a 6= 0 of R̄,
replaces γ ∈ I with two nonzero idempotents γ1 , γ2 satisfying γ = γ1 + γ2 in
polynomial time.
Proof. We pick an element ã ∈ R lifting a, i.e., π(ã) = a. Compute the ideal (ã)
of R generated by ã. As R is semisimple, we have (ã) = (γ 0 ) for some idempotent
γ 0 of R. Compute γ 0 by solving a system of linear equations using the fact that γ 0 is
the unique element in (ã) satisfying γ 0 x = x for all x ∈ (ã). Finally we replace γ
with γ 0 γ and (1 − γ 0 )γ. It remains to show that γ 0 γ 6∈ {0, γ}.
Note that π(γ 0 ) ∈ R̄ generates the ideal (a) of R̄, and hence π(γ 0 ) is also a nonzero
zero divisor of R̄. But π(γ 0 ) = γ 0 + (1 − γ) = γ 0 γ + (1 − γ). So γ 0 γ 6= 0. It
also follows that γ 0 γ 6= γ since otherwise we would have π(γ 0 ) = γ 0 γ + (1 − γ) =
γ + (1 − γ) = 1 + (1 − γ), which is the unity of R̄ and not a zero divisor.
Lemma 3.18 ([Rón92]). Under GRH, there exists an algorithm Automorphism
that given a ring A isomorphic to a finite product of Fp and a nontrivial ring
automorphism σ of A, returns a zero divisor a 6= 0 of A in polynomial time.
To prove Lemma 3.18, we need the following lemma.

246
Lemma B.1 ([Rón92; Iva+12]). There exists an algorithm IteratedExp that, given
a semisimple Fp -algebra A, a prime number ` 6= p, and elements x, y in the
multiplicative group A× of order nx and ny respectively such that nx , ny are powers
of ` and nx ≥ ny , returns a zero divisor of the form xk − y ∈ A, k ∈ N, in time
polynomial in log |A| and `. In particular, zero is returned only if y is a power of x.
Proof. The algorithm is as follows: try to find k ∈ {0, . . . , ` − 1} such that xk − y
is a zero divisor. If such an integer k is found, simply return xk − y. Otherwise
raise x to its `th power and repeat.
To analyze the algorithm, note that there exists a maximal ideal m of A such that the
order of x + m ∈ (A/m)× is nx , and the order of y + m ∈ (A/m)× , which we denote
0
by n0y , divides ny . Then xnx /ny + m and y + m are both primitive n0y -th roots of
0
unity in (A/m)× ∼
= Fp . Then there exists k ∈ {0, . . . , ` − 1} such that xknx /ny − y
is in m and hence is a zero divisor. Such a zero divisor is guaranteed to be found
0
when x is raised to xnx /ny (or earlier).
Proof of Lemma 3.18. For x, y ∈ A linearly independent over Fp , at least one element in the set {y − cx : c ∈ Fp } is a nonzero zero divisor. If p ≤ dimFp A, we
can find such an element in polynomial time by choosing x, y and enumerating c.
So assume p > dimFp A. In this case, the pseudocode of the algorithm is given in
Algorithm 17. Here id denotes the identity map on A.
The loop in Lines 2–6 of the algorithm computes the powers σ n of σ for n = 1, 2, . . .
and tries to find z ∈ A satisfying σ n (z) 6= z. The loop exits either when such an
element z is found, or when the condition σ n = id is satisfied. In the former case,
the algorithm returns the zero divisor σ n (z) − z 6= 0, and in the latter case, the
algorithm proceeds. Note that initially n = 1 and we have σ 6= id by assumption.
Q
By assumption, we may identify A with a product m
i=1 Fp where m = dimFp A.
For i ∈ [m], let δi be the element of A whose ith coordinate is one and the other
components are zero. So δ1 , . . . , δm are the primitive idempotents of A. The
automorphism σ of A permutes these primitive idempotents, i.e., it is associated
with a permutation π of [m] such that σ(δi ) = δπ(i) for i ∈ [m]. By Fp -linearity of σ
(which is automatic since Fp is a prime field), we know σ sends (x1 , . . . , xm ) ∈ A
to (xπ−1 (1) , . . . , xπ−1 (m) ).
Let H be the cyclic group generated by π, and it acts on [m]. Assume the H-orbits
of [m] do not have the same cardinality. We claim that in this case a zero divisor

247
Algorithm 17 Automorphism
Input: ring A isomorphic to a finite product of Fp , automorphism σ 6= id of A
Output: zero divisor a 6= 0 of A
1: n ← 1
2: repeat
3:
find z ∈ A satisfying σ n (z) 6= z
4:
if σ n (z) − z is a zero divisor of A then
5:
return σ n (z) − z
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:

until σ n = id
compute the least prime factor ` of n
σ ← σ n/`
compute Fpd , where d is the smallest positive integer satisfying `|pd − 1
compute A ⊗ Fpd and the inclusion i : A ,→ A ⊗ Fpd sending t ∈ A to t ⊗ 1
compute the automorphism σ ⊗ 1 of A ⊗ Fpd sending t ⊗ u ∈ A to σ(t) ⊗ u
pick an `th power non-residue γ of Fpd
d
ξ ← γ (p −1)/`
compute a nonzero element x ∈ A ⊗ Fpd satisfying (σ ⊗ 1)(x) = ξx
if x is a not zero divisor of A ⊗ Fpd then
k ← the largest factor of pd − 1 coprime to `
call IteratedExp with the input A ⊗ Fpd , `, γ k , and xk to obtain a zero
divisor b of A ⊗ Fpd
x←b

choose a ∈ A − {0} such that i(a) is in the ideal (x) of A ⊗ Fpd
20: return a

19:

σ n (z) − z 6= 0 is returned at Line 5 for some n ≤ m. To see this, suppose O1
and O2 are two H-orbits of distinct cardinalities n1 , n2 ≤ m respectively. We may
assume n1 ≤ n2 . Then σ n1 fixes all elements in O1 but not all in O2 . So σ n1 6= id.
If the loop returns a (nonzero) zero divisor at Line 5 in the nth iteration for some
n < n1 then we are done. Otherwise, an element z satisfying σ n1 (z) − z 6= 0 is
found at Line 3 in the n1 th iteration. Note that for any i ∈ O1 , the ith coordinate
of σ n1 (z) − z is a zero, and hence σ n1 (z) − z is annihilated by δi . It follows that
σ n1 (z) − z is a zero divisor and is returned at Line 5.
So assume all the H-orbits of [m] have the same cardinality and the algorithm
reaches Line 7. Then the order of σ equals n. Line 8 replaces σ with its (n/`)th

248
power where ` is the least prime factor of n. Then the order of σ becomes the prime
number `. Note that ` < p since n ≤ m < p.
At Line 9, we compute the finite field Fpd where d is the smallest positive integer
satisfying `|pd − 1. Equivalently, the integer d is the (multiplicative) order of p in the
group (Z/`Z)× . So we have d ≤ |(Z/`Z)× | = ` − 1. Under GRH (or Hypothesis
(∗) in the introduction), the field Fpd can be computed in deterministic polynomial
time. It is the smallest extension of Fp containing the primitive `th roots of unity.
At Line 10, we compute the Fpd -algebra A ⊗ Fpd (where the tensor product is
taken over Fp ) and the inclusion i : A ,→ Fpd sending t ∈ A to t ⊗ 1. Suppose
P
{b1 , . . . , bm } is an Fp -basis of A and bi bj = m
k=1 cijk bk where cijk ∈ Fp , then
A ⊗ Fpd can be defined as an Fpd -algebra in the Fpd -basis {b1 ⊗ 1, . . . , bm ⊗ 1}
Pm
satisfying (bi ⊗ 1)(bj ⊗ 1) =
k=1 cijk (bk ⊗ 1). It follows from the universal
property of tensor products that this definition does not depend on the choice of the
Q
basis. See, e.g., [AM69]. In particular, identify A with m
i=1 Fp and then A ⊗ Fpd
Qm
is simply i=1 Fpd .
At Line 11, we compute Fpd -linear automorphism σ⊗1 of A⊗Fpd sending t⊗u ∈ A
to σ(t) ⊗ u. It follows from the universal property of tensor products that such an
automorphism exists and is unique. At Line 12, we pick an `th power non-residue γ
of Fpd , which be done in deterministic polynomial time under GRH (or Hypothesis
d
(∗) in the introduction). Then at Line 13, we compute ξ = γ (p −1)/` , which is a
primitive `th root of unity.
At Line 14, we compute a nonzero element x ∈ A ⊗ Fpd satisfying (σ ⊗ 1)(x) = ξx.
We claim that such an element x exists. To see this, note that as σ has order `, the
permutation π of [m] associated with σ has an `-cycle (i1 i2 · · · i` ). Then we can
Q
−j
choose x to be the element in A ⊗ Fpd = m
for
i=1 Fpd whose ij th coordinate is ξ
j ∈ [`] and remaining coordinates are zero.
If the element x is a zero divisor of A ⊗ Fpd , the preimage of the ideal (x) of A ⊗ Fpd
in A under the map i is strictly between {0} and A. In this case, we compute a
nonzero element a in it (or equivalently, an element a satisfying i(a) ∈ (x)) at Line
19 and return it. Note that a is guaranteed to be a zero divisor of A.
On the other hand, if x is not a zero divisor of A ⊗ Fpd , we replace it with a zero
divisor b 6= 0 in Lines 16–18: suppose pd − 1 = k`e where k is coprime to `. We
compute k at Line 16. As γ ∈ Fpd is an `th power non-residue, the order of γ k
is `e = (pd − 1)/k. As x is not a zero divisor, we have xk ∈ (A ⊗ Fpd )× and its

249
order divides `e . Also note that σ ⊗ 1 fixes γ k (by Fpd -linearity) and sends xk to
ξ k xk 6= xk . So xk is not a power of γ k . By Lemma B.1, a zero divisor b 6= 0 of
A ⊗ Fpd is obtained at Line 17 and we assign its value to x. Then we obtain the zero
divisor a 6= 0 of A and return it at Line 19 as before.

250
Appendix C

PROOFS OMITTED FROM CHAPTER V
This chapter contains proofs that are omitted from Chapter 5.
Lemma 5.1. There exists a polynomial-time algorithm that given p and a polynomial f˜(X) ∈ A0 [X] satisfying ψ̃0 (f˜) 6= 0, computes an integer D satisfying
D ≡ 1 (mod p) and a factorization of D · f˜ into irreducible factors f˜i over K0 .
Furthermore all of the factors f˜i (X) are in A0 [X].
Proof. Factorize f˜ into irreducible factors g1 , . . . , gk over K0 using polynomial
factoring algorithms for number fields [Len83; Lan85]. Note that coefficients of
each factor gi lie in K0 = Q[Y ]/(h̃(Y )) but not necessarily in A0 = Z[Y ]/(h̃(Y )).
Here a coefficient α ∈ K0 is represented by a unique polynomial rα (Y ) ∈ Q[Y ] of
degree at most deg(h̃) − 1 such that α = rα (Y ) + (h̃(Y )). And α ∈ A0 holds iff
the coefficients of rα (Y ) are all integers.
For each factor gi , use rα , where α ranges over coefficients of gi , to compute
the smallest ei ∈ Z and Di ∈ N+ coprime to p such that all the coefficients of
pei Di gi are in A0 . Compute an integer D ∈ N+ such that D is a multiple of
Qk
ei
˜
i=1 Di and D ≡ 1 (mod p). Compute fi := p Di gi for i = 2, . . . , k and
Q
f˜1 = (pe1 D/ ki=2 Di )g1 . Then the polynomials f˜i (X) are all in A0 [X].
It remains to show that the product of f˜i equals D · f˜, which reduces to proving
Pk
ei
i=1 ei = 0. Note that for all i ∈ [k], the polynomial p Di gi (X) is in A0 [X] but not
in pA0 [X], since otherwise we may replace ei with ei −1, contradicting the minimality of ei . The ideal pA0 [X] is a prime ideal of A0 [X], since A0 [X]/pA0 [X] ∼
= Fq [X]
is an integral domain. Therefore
!
!
k
k
k
Y
Y
Y
pei Di gi (X) =
pei ·
Di · f˜(X)
i=1

is not in pA0 [X] either. So
!
k
Y
p−ei ·
i=1

i=1

i=1

≤ 0. Rewrite the equation above as
!
!
k
k
Y
Y
pei Di gi (X) =
Di · f˜(X).

Pk

i=1 ei

i=1

i=1

As ψ̃0 (f˜) 6= 0, we have f˜(X) 6∈ pA0 [X]. And the integers Di are coprime to p and
P
hence not in pA0 [X] either. The equation above then implies ki=1 ei ≥ 0.

251
Remark. An alternative way of proving i=1 ei = 0 is to consider the localization
of A0 at the prime ideal pA0 and apply Gauss Lemma (see [Lan02, Section IV.2]).
We leave the details to the reader.
Pk

Lemma 5.4. The partitions P (I) and the idempotent decompositions I(P ) are well
defined. And for any idempotent decomposition I of ŌK , the idempotents δ ∈ I
correspond one-to-one to the blocks of P (I) via the map
−1

δ 7→ Bδ := {HgDQ0 ∈ H\G/DQ0 : g (iK,L (δ)) ≡ 1

(mod Q̄0 )}

with the inverse map B 7→ δB .
Proof. We first show that P (I) and I(P ) are well defined. For P (I) we note
−1
that g (iK,L (δ)) mod Q0 depends only on the double coset HgDQ0 since H
fixes iK,L (δ) ∈ iK,L (RK ) and DQ0 fixes any element modulo Q̄0 . The relation
0−1
g −1
(iK,L (δ)) ≡ g (iK,L (δ)) (mod Q̄0 ) for all δ ∈ I is obviously an equivalence
relation on H\G/DQ0 , and hence defines a partition of H\G/DQ0 .
For I(P ), we fix B ⊆ H\G/DQ0 and first show that
X

t :=

g

δQ̄0

gDQ0 ∈G/DQ0 :HgDQ0 ∈B

is well defined and does not depend on the choices of the representatives g. Note
that for h ∈ DQ0 , the primitive idempotents δQ̄0 and h δQ̄0 correspond to the same
h
maximal ideal Q̄0 = Q̄0 and hence are equal (see Lemma 3.3). So δQ̄0 is fixed by
DQ0 . It follows that t is well defined.
Next we prove t ∈ iK,L (RK ) so that δB = i−1
K,L (t) is well defined. By Lemma 5.3,
each double coset x = HgDQ0 corresponds to a maximal ideal
Px :=

(g Q0 ∩ OK )/pOK
∩ RK
Rad(ŌK )

of RK . Let δ be the idempotent of RK satisfying δ ≡ 1 (mod Px ) for x ∈ B,
and δ ≡ 0 (mod Px ) for x 6∈ B (see Lemma 3.3). It follows that iK,L (δ) ≡ 1
g
g
(mod Q̄0 ) if HgDQ0 ∈ B and iK,L (δ) ≡ 0 (mod Q̄0 ) if HgDQ0 6∈ B. By
g
g
definition, we also have t ≡ 1 (mod Q̄0 ) if HgDQ0 ∈ B and t ≡ 0 (mod Q̄0 )
if HgDQ0 6∈ B. So t = iK,L (δ), as desired. Furthermore, by choosing B =
P
H\G/DQ0 and t = iK,L (1) = 1, we see that g∈G/DQ g δQ̄0 = 1. It follows that
0
I(P ) is a well defined idempotent decomposition of RK .

252
For the second claim, we first check that the sets Bδ form a partition of H\G/DQ0
and the map δ 7→ Bδ is injective. To see this, note that if a double coset HgDQ0
−1
−1
lies in both Bδ and Bδ0 for distinct δ, δ 0 ∈ I, then g (iK,L (δ)) ≡ g (iK,L (δ 0 )) ≡ 1
−1
(mod Q̄0 ) by definition. But then g (iK,L (δδ 0 )) ≡ 1 (mod Q̄0 ), contradicting the
fact that δδ 0 = 0. So the sets Bδ are disjoint and the map δ 7→ Bδ is injective.
Furthermore, each HgDQ0 ∈ H\G/DQ0 lies in at least one set Bδ since
g −1

X g−1

(iK,L (δ)) ≡

δ∈I

!!
iK,L

X

δ

≡1

(mod Q̄0 ).

(C.1)

δ∈I

So the sets Bδ form a partition of H\G/DQ0 .
Fix B ∈ P (I) and let δ = δB . It remains to verify that Bδ = B. For h ∈ G, we
have
X
h−1
h−1 g
(iK,L (δ)) =
δQ̄0 .
gDQ0 ∈G/DQ0 :HgDQ0 ∈B
−1

Note that the residue of h g δQ̄0 modulo Q̄0 equals one if hDQ0 = gDQ0 , and zero
−1
otherwise. So the residue of h (iK,L (δ)) modulo Q̄0 equals one if HhDQ0 ∈ B
and zero otherwise. It follows by definition that Bδ = B.
Lemma 5.6. For any maximal ideal m of ŌK /Rad(ŌK ), the group hσK,i i generated
by σK,i acts transitively on the set of the maximal ideal of AK,i containing m.
Proof. Let A = ŌK /Rad(ŌK ) and H = hσK,i i. Equivalently, we want to prove
that H acts transitively on the set of the maximal ideals of AK,i /mAK,i , where the
action is induced from that on AK,i .
We have a short exact sequence
0 → m → A → A/m → 0,
which by [AM69, Proposition 2.18] induces an exact sequence
m ⊗Fq Fqi → AK,i → (A/m) ⊗Fq Fqi → 0.
Also note that the image of m ⊗Fq Fqi in AK,i is mAK,i . Then we have
AK,i /mAK,i ∼
= (A/m) ⊗Fq Fqi .
So we want to prove that H acts transitively on the set of the maximal ideals of
(A/m) ⊗Fq Fqi .

253
Suppose m1 , . . . , mk are maximal ideals of (A/m) ⊗Fq Fqi that form an H-orbit, and
P
δ1 , . . . , δk are the corresponding primitive idempotents. Define t := ki=1 δi which
is a nonzero idempotent fixed by H. It suffices to prove t = 1.
Note that we have the exact sequence
τ

0 → (A/m)H → A/m →
− A/m,
where τ sends x ∈ A to xq − x. It induces a sequence
τ0

0 → (A/m)H ⊗Fq Fqi → (A/m) ⊗Fq Fqi −
→ (A/m) ⊗Fq Fqi ,
where τ 0 sends x ∈ (A/m) ⊗Fq Fqi to σK,i (x) − x. This sequence is exact since Fqi
is a flat Fq -module (see, e.g., [AM69, Proposition 2.19 and Exercise 2.4]). So we
have
((A/m) ⊗Fq Fqi )H ∼
= (A/m)H ⊗Fq Fqi ∼
= Fq ⊗Fq Fqi ∼
= Fq i
and the only nonzero idempotent it contains is 1. It follows that t = 1, as desired.
Lemma 5.7. There exists a polynomial-time algorithm ComputeRings that given p
and a relative number field K over K0 , computes the following data
0
0
,→ K,
of K and the inclusion OK
• a p-maximal order OK
0
• ŌK and the quotient map OK
→ ŌK ,

• ŌK /Rad(ŌK ) and the quotient map ŌK → ŌK /Rad(ŌK ),
• RK and the inclusion RK ,→ ŌK /Rad(ŌK ),
0
where ŌK , ŌK /Rad(ŌK ), and RK are encoded as algebras over Fp and OK
is
encoded as an algebra over Z.

Proof. First use Corollary 4.1 to compute an ordinary number field K̃ isomorphic
to K and an isomorphism φ : K → K̃ in some Q-basis of K. Apply Lemma 3.8
0
0
0
to K̃ and p to compute ŌK , OK
as well as the maps OK
,→ K̃ and OK
→ ŌK .
0
−1
0
Compose OK ,→ K̃ with φ to obtain the map OK ,→ K.
Next we compute an Fp -basis B = {x1 , . . . , xs } of the radical Rad(ŌK ) ⊆ ŌK
using Theorem 5.4. Extend B to an Fp -basis B 0 = {x1 , . . . , xs , y1 , . . . , yt } of ŌK .
Compute ckij ∈ Fp for i, j ∈ [t], k ∈ [s] and dkij ∈ Fp for i, j, k ∈ [t] such that
yi yj =

s
X
k=1

ckij xk

+

t
X
k=1

dkij yk

for i, j ∈ [t].

254
Then the structure constants of ŌK /Rad(ŌK ) are given by dkij in the Fp -basis
{y1 + Rad(ŌK ), . . . , yt + Rad(ŌK )} of ŌK /Rad(ŌK ) since
(yi + Rad(ŌK ))(yj + Rad(ŌK )) =

t
X

dkij yk + Rad(ŌK )

k=1

holds for i, j ∈ [t]. The map ŌK → ŌK /Rad(ŌK ) is given in the basis B 0 which
sends each xi to zero and each yi to yi + Rad(ŌK ).
Finally, we compute an Fp -basis of RK in ŌK /Rad(ŌK ) by solving the system of Fp linear equations given by xp = x. It also gives the inclusion RK ,→ ŌK /Rad(ŌK ).
The structure constants of RK can be computed from those of ŌK /Rad(ŌK ).
Lemma 5.8. There exists a polynomial-time algorithm ComputeRingHoms that
given p, relative number fields K, K 0 over K0 , a field embedding φ : K → K 0
over K0 , and the outputs of ComputeRings (see Lemma 5.7) on the inputs (K, p)
and (K 0 , p) respectively, computes the maps φ̄ : ŌK → ŌK 0 , φ̂ : ŌK /Rad(ŌK ) →
ŌK 0 /Rad(ŌK 0 ) and φ̃ : RK → RK 0 .
Proof. To compute the map φ̄, we identify K and K 0 with ordinary number fields
and apply Lemma 3.11: compute isomorphisms τ : K → K̃ and τ 0 : K 0 → K̃ 0
using Corollary 4.1 where K̃ and K̃ 0 are ordinary number fields. Compute the
0
0
0
0
0
0
0
,→ K̃, OK
maps OK
0 ,→ K̃ by composing OK ,→ K, OK 0 ,→ K with τ and τ
respectively. And compute the field embedding φ0 = τ 0 ◦ φ ◦ τ −1 from K̃ to K̃ 0 .
Now use Lemma 3.11 to obtain the map φ̄.
The map φ̂ : ŌK /Rad(ŌK ) → ŌK 0 /Rad(ŌK 0 ) induced from φ̄ sends x +
Rad(ŌK ) ∈ ŌK /Rad(ŌK ) to φ̄(x) + Rad(ŌK 0 ). We can efficiently compute φ̂
from φ̄ since the quotient maps ŌK → ŌK /Rad(ŌK ) and ŌK 0 → ŌK 0 /Rad(ŌK 0 )
are given.
Finally, we restrict φ̂ to φ̂|RK : RK → ŌK 0 /Rad(ŌK 0 ) using the given inclusion
RK ,→ ŌK /Rad(ŌK ). Then compute φ̃ : RK → RK 0 from φ̂|RK by lifting along
the given inclusion RK 0 ,→ ŌK 0 /Rad(ŌK 0 ).
Lemma 5.17. Under GRH, there exists a subroutine ComputeAdvice that given
I = {IK : K ∈ F} as in Definition 5.7, either properly refines some idempotent
decomposition IK ∈ I, or computes eδ , fδ for K ∈ F, δ ∈ IK and an I-advice.
Moreover, the subroutine runs in time polynomial in log p and the size of F.

255
Proof. See Algorithm 18 for the pseudocode of the subroutine. It enumerates
K ∈ F, δ ∈ IK and computes eδ , fδ , sδ (if eδ > 1) and tδ (if fδ > 1).
Algorithm 18 ComputeAdvice
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:

for K ∈ F do
for δ ∈ IK do
J ← {x ∈ ŌK : x + Rad(ŌK ) ∈ (1 − δ)(ŌK /Rad(ŌK ))}
compute eδ as the smallest i ∈ N+ such that J i = J i+1
i
compute fδ as the smallest i ∈ N+ such that x 7→ xq fixes ŌK /J
if eδ > 1 then
find sδ ∈ J − J 2
U ← the image of AnnŌK (seδδ −1 ) in ŌK /Rad(ŌK )
U ← U ∩ δRK
compute δ0 ∈ U satisfying (1 − δ0 )U = {0}
if δ0 δ 6∈ {0, δ} then
IK ← IK − {δ}
IK ← IK ∪ {δ0 δ, (1 − δ0 )δ}
return
if fδ > 1 then
find a primitive fδ th root of unity ξ ∈ Fqfδ
find nonzero tδ ∈ δAK,fδ satisfying σK,fδ (tδ ) = ξtδ
U ← tδ AK,fδ ∩ RK
find δ0 ∈ U satisfying (1 − δ0 )U = {0}
if δ0 δ 6∈ {0, δ} then
IK ← IK − {δ}
IK ← IK ∪ {δ0 δ, (1 − δ0 )δ}
return

Fix K ∈ F and δ ∈ IK . We compute the ideal J of ŌK , which is defined to be
the preimage of the ideal of ŌK /Rad(ŌK ) generated by 1 − δ (under the natural
quotient map). Then J is the product of the maximal ideals m of ŌK satisfying
δ ≡ 1 (mod m/Rad(ŌK )). Note that for any such m, we have
ŌK ) m ) m2 ) · · · ) meδ = meδ +1
and ŌK /m ∼
= Fqfδ . So we can compute eδ as the smallest positive integer i such
i
that J = J i+1 , and compute fδ as the smallest positive integer i such that the
i
automorphism x 7→ xq fixes ŌK /J.

256
Suppose eδ > 1. Choose sδ to be an element in J 2 − J. So we have sδ ∈ m for all
the maximal ideals m of ŌK satisfying δ ≡ 1 (mod m/Rad(ŌK )), and sδ 6∈ m̃2
for some maximal ideal m̃ of them.
Next compute the image of AnnŌK (seδδ −1 ) in ŌK /Rad(ŌK ) and let U be its intersection with δRK , which is an ideal of RK . Choose an element δ0 in U such
that (1 − δ0 )U = 0. Then δ0 is the unique idempotent of RK that generates U . If
δ0 δ 6∈ {0, δ}, we use δ0 to properly refine IK and return.
As sδ ∈ m̃ − m̃2 , we have seδδ −1 ∈ m̃eδ −1 − m̃eδ and hence AnnŌK (seδδ −1 ) ⊆ m̃. So
we have δ0 ∈ U ⊆ m̃/Rad(ŌK ). But we also have δ ≡ 1 (mod m̃/Rad(ŌK )). It
follows that δ0 δ 6= δ.
On the other hand, assume sδ ∈ m̃02 for some maximal ideal m̃0 of ŌK satisfying
δ ≡ 1 (mod m̃0 /Rad(ŌK )). We claim δ0 δ 6= 0, in which case the subroutine
properly refines IK and returns. To see this, note that seδδ −1 ∈ m̃02(eδ −1) ⊆ m̃0eδ
since 2(eδ − 1) ≥ eδ . Then AnnŌK (sδeδ −1 ) 6⊆ m̃0 . Let δ 0 be the idempotent of
ŌK /Rad(ŌK ) that generates the image of AnnŌK (seδδ −1 ) in ŌK /Rad(ŌK ). Then
δ 0 6∈ m̃0 /Rad(ŌK ). Note that δ0 = δδ 0 6∈ m̃0 /Rad(ŌK ). So δ0 δ = δ0 6= 0, as
desired.
Now suppose fδ > 1. We pick a primitive fδ th root of unity ξ in Fqfδ which exists
since fδ divides |F×
| = q fδ − 1.1 This step can be done efficiently assuming
q fδ
GRH. Choose tδ to be a nonzero element in δAK,fδ satisfying σK,fδ (tδ ) = ξtδ . We
claim that such an element always exists. To see this, note that the quotient map
AK,fδ → AK,fδ /(1 − δ) is injective when restricting to δAK,fδ . So it suffices to show
that there exists a nonzero element t ∈ AK,fδ /(1 − δ) satisfying σK,fδ (t) + (1 − δ) =
ξt + (1 − δ). This follows from the argument used in the proof of Lemma 3.18.
Next compute the ideal U = tδ AK,fδ ∩ RK of RK , and choose an element δ0 in U
satisfying (1 − δ0 )U = 0. Then δ0 is the unique idempotent of RK that generates
U . If δ0 δ 6∈ {0, δ}, we use δ0 to properly refine IK and return.
Assume there exists a maximal ideal m0 of AK,fδ satisfying δ ≡ 1 (mod m0 ) and
tδ ∈ m0 . Then tδ AK,fδ ⊆ m0 and hence U ⊆ m0 . As δ 6∈ m0 , we have δ0 δ 6= δ. We
claim δ0 δ is nonzero, and hence the subroutine properly refines IK and returns. As
δ0 ∈ tδ AK,fδ ⊆ δAK,fδ . We have δ0 δ = δ0 , which generates the ideal U of RK . So
it suffices to prove U 6= {0}. As tδ 6= 0, there exists a maximal ideal m of AK,fδ
that does not contain tδ . Let m0 = m ∩ RK , which is a maximal ideal of RK . Let δ 0
1

We use the fact that fδ is coprime to p, which in turn relies on the assumption p > deg(f ).

257
be the primitive idempotent of RK corresponding to m0 , i.e., δ 0 ≡ 1 (mod m0 ) and
δ 0 ≡ 0 (mod m00 ) for all the maximal ideals m00 6= m0 of RK . We claim δ 0 ∈ U , or
−i
equivalently, δ 0 ∈ tδ AK,fδ . For i ∈ Z, we have σK,f
(tδ ) = ξ −i tδ 6∈ m and hence
δ
i
(m). By Lemma 5.6 and the choice of δ 0 , the maximal ideals of AK,fδ
tδ 6∈ σK,f
δ
i
not containing δ 0 are exactly those of the form σK,f
(m), i ∈ Z. It follows that
δ
δ 0 ∈ tδ AK,fδ , as desired.
The claim about the running time is straightforward.
Lemma 5.18. The P-collection C˜ in Definition 5.8 is well defined.
Proof. First note that each element sδ,H (resp. tδ,H ) is fixed by H and hence
0−1
−1
0−1
g −1
sδ,H , g sδ,H (resp. g tδ,H , g tδ,H ) only depend on the cosets Hg and Hg 0 . Fix
H ∈ P and K ∈ F as in Definition 5.8. Fix B ∈ CH and g, g 0 ∈ G such that
HgDQ0 , Hg 0 DQ0 ∈ B. Let δ be the unique idempotent in IK such that τ̃H (δ) = δB .
Then eδ = e(B) and fδ = f (B).
Suppose e(δ) > 1. By Definition 5.7, we have sδ,H ∈ m − m2 for all the maximal
ideals m of ŌLH satisfying τ̃H (δ) ≡ 1 (mod m/Rad(ŌLH )). Consider the maximal
ideal
mg,H = (g Q0 ∩ OLH )/pOLH
of ŌLH . As τ̃H (δ) = δB and HgDQ0 ∈ B, we have
τ̃H (δ) ≡ 1

(mod mg,H /Rad(ŌLH )).

Therefore sδ,H ∈ mg,H − m2g,H . So sδ,H + m2g,H is a nonzero element in mg,H /m2g,H .
Let mg be the maximal ideal g Q0 /pOL of ŌL , and let k = e(Q0 )/eδ . Using the
natural inclusion
mg,H /m2g,H ,→ mkg /mk+1
g ,
we see sδ,H + mk+1
is a nonzero element in mkg /mk+1
g
g . Let me := Q0 /pOL , so
−1
that g me = mg . Then g sδ,H + mk+1
is a nonzero element in mke /mk+1
. The same
e
e
g 0−1
k
k
k+1
argument shows that
sδ,H + me is a nonzero element in me /me as well. As
mke /mk+1
is an one-dimensional vector space over ŌL /me ∼
= κQ0 , we see that there
e
×
exists a unique scalar c ∈ κQ0 satisfying
g −1

sδ,H + mk+1
= c · (g
e

0−1

sδ,H + mk+1
).
e

Note mk+1
= (Q0 /pOL )e(Q0 )/eδ +1 . We see that the second condition in Definie
tion 5.8 is well defined.

258
Now suppose f (δ) > 1. By Definition 5.7, we have tδ,H 6∈ m for all the maximal
ideals m of ALH ,fδ satisfying τ̃H (δ) ≡ 1 (mod m). As τ̃H (δ) = δB , HgDQ0 ∈ B
Q0 /pOL
and Rad(
⊆ m0 , we have
ŌL )
τ̃H (δ) ≡ 1

(mod g m0 ).

−1

So tδ,H 6∈ g m0 . Then g tδ,H + m0 is a nonzero element in AL,fδ /m0 . The same
0−1
argument shows that g tδ,H + m0 is a nonzero element in AL,fδ /m0 as well. It
follows that there exists a unique scalar c ∈ (AL,fδ /m0 )× satisfying
g −1

tδ,H + m0 = c · (g

0−1

(C.2)

tδ,H + m0 ).

We also check that Definition 5.8 is independent of the choice of m0 : Let m00
Q0 /pOL
be another maximal ideal of AL,fδ containing Rad(
. By Lemma 5.6, we have
ŌL )
i
i
0
m0 = σL,fδ (m0 ) for some i ∈ Z. Let σ = σL,fδ . Then (C.2) is equivalent to
 0−1

−1
σ(g tδ,H ) + m00 = σ(c) · σ(g tδ,H ) + m00

(C.3)

where σ(c) ∈ (AL,fδ /m00 )× . Also note that
−1

−1

σ(g tδ,H ) = g (σ(tδ,H )) =
0−1

g −1

−1

(ξ i tδ,H ) = ξ i g tδ,H .

0−1

and similarly σ(g tδ,H ) = ξ i g tδ,H . Substituting them in (C.3) and canceling
ξ i + m00 on both sides, we obtain
g −1

tδ,H + m00 = σ(c) · (g

0−1

tδ,H + m00 ).

Note that σ(c) and c have the same order. We see that choosing m00 instead of m0
does not affect the definition.
Finally, it is easy to see that the conditions in Definition 5.8 are equivalence relations
on H\G. So they do define a partition CH on H\G.
Lemma 5.24. Under GRH, there exists a subroutine SurjectivityTest that updates IK in time polynomial in log p and the size of F so that the partitions CH ∈ C
are refined. Moreover, at least one partition CH is properly refined unless for all
H ∈ P, the map πH : H\G → H\G/DQ0 sending Hg ∈ H\G to HgDQ0 maps
each block of C̃H surjectively to a block of CH .
To prove Lemma 5.24, we first prove the following lemma, generalizing Lemma B.1:

259
Lemma C.1. There exists an algorithm SplitByExp that, given a semisimple Fp algebra A, m ∈ N+ , and nonzero elements x, y ∈ A satisfying the following
conditions
• x and y generate the same ideal of A
• Let nx (resp. ny ) be the smallest positive integer such that xnx (resp. y ny ) is
an idempotent. Then ny divides nx and all the prime factors of nx divide m
returns an element z = xk − y ∈ A satisfying zA ( xA in time polynomial in m
and log |A|, where k ∈ N.
Proof. We find k ∈ N such that xk − y satisfies the requirement. Let I = AnnA (x).
By replacing A, x, and y with A/I, x + I and y + I respectively, we reduce to
the case x, y ∈ A× , and the goal is to find k ∈ N such that z = xk − y is a zero
divisor. In addition, we find the smallest d ∈ N+ such that the ideal J generated
d
by {xp − x : x ∈ A} is a proper ideal of A. By replacing A with A/J, we may
assume J = {0}. Then A is a finite product of copies of Fpd .
Enumerate the prime factors ` of m. For each `, compute e` ∈ N and f` ∈ N+ such
that pd − 1 = `e` f` and f` is coprime to `. Let nx,` and ny,` be the order of xf` and
y f` respectively. Then nx,` , ny,` are powers of ` and ny,` |nx,` . Use the algorithm in
Lemma B.1 (applied to xf` and y f` ) to compute k` ∈ N such that xk` f` − y f` is a zero
divisor. If xk` f` − y f` 6= 0, we use Lemma 3.17 to find an idempotent γ 6∈ {0, 1}
of A and solve the problem recursively on the quotient ring A/(1 − γ). So assume
xk` f` = y f` . Then the order of xk` /y divides f` and hence is coprime to `.
Compute k` and e` for all the prime factors ` of m as above. Use the extended
Euclidean algorithm to find k ∈ N satisfying k ≡ k` (mod `e` ) for all `. Then k is
the desired integer.
e

We claim xk = y. To see this, note that for each `, we have xk /y = (xk` /y) · xt` `
e
for some t ∈ Z. As the orders of xk` /y and xt` ` are both coprime to `, so is the
order of xk /y. Therefore the order of xk /y is coprime to m. But the orders of xk
and y are only divisible by prime factors of m. So xk /y = 1, as desired.
The pseudocode of the subroutine SurjectivityTest is given in Algorithm 19. It
enumerates K ∈ F and δ ∈ IK . For each K and δ, a set S of ideals of AK,fδ is
computed. And for each I ∈ S, we find δ0 ∈ I ∩ RK satisfying (1 − δ0 )(I ∩ RK ) =

260
{0}, which is the unique idempotent of RK that generates the ideal I ∩ RK of RK .2
If δ0 δ 6∈ {0, δ}, we use δ0 to refine IK and return.
Fix K ∈ F and δ ∈ IK . The corresponding set S is computed as follows: first
assume fδ > 1. We compute the largest factor r of q fδ − 1 coprime to fδ , so that
all the prime factors of (q fδ − 1)/r divide fδ . Compute an element γ ∈ F×
of
q fδ
order (q fδ − 1)/r, which can be done efficiently assuming GRH.3 By the second
condition in Definition 5.7, the element δtrδ generates the ideal δAK,fδ of AK,fδ ,
and so does δγ. We call the subroutine SplitByExp in Lemma C.1 on the input
(AK,fδ , fδ , δγ, δtrδ ) to obtain x ∈ AK,fδ , and add the ideal xAK,fδ to S.
Next assume eδ > 1. Compute the preimage J of (1 − δ)(ŌK /Rad(ŌK )) under the
quotient map ŌK → ŌK /Rad(ŌK ). Then J is the product of the maximal ideals
m of ŌK satisfying δ ≡ 1 (mod m/Rad(ŌK )). Find δ 0 ∈ AnnŌK (J eδ ) satisfying
(1 − δ 0 )AnnŌK (J eδ ) = {0}, so that δ 0 is the unique idempotent of ŌK generating
0
.
AnnŌK (J eδ ). Lift δ 0 sδ ∈ ŌK to s̃ ∈ OK
We claim s̃eδ ∈ pOK : this is equivalent to (δ 0 sδ )eδ = δ 0 seδδ = 0. By the first
condition in Definition 5.7, we have seδδ ∈ meδ for all the maximal ideals m of ŌK
satisfying δ ≡ 1 (mod m/Rad(ŌK )). And by the definition of J, it holds that
δ 0 ∈ mk for all the maximal ideals m of ŌK satisfying δ ∈ m/Rad(ŌK ) and k ∈ N.
It follows that δ 0 seδδ = 0 and hence s̃eδ ∈ pOK .
Compute the image s of s̃eδ /p ∈ OK in ŌK /Rad(ŌK ). This is done by first
computing s̃eδ + OK ∈ ŌK using Lemma 3.9 and then computing s using the
quotient map ŌK → ŌK /Rad(ŌK ). Next compute the largest factor r0 of q fδ − 1
coprime to eδ , so that all the prime factors of (q fδ − 1)/r0 divide eδ . Compute an
element µ ∈ F×
of order (q fδ − 1)/r0 , which can be done efficiently assuming
q fδ
0
GRH. By the first condition in Definition 5.7, the element sr generates the ideal
δAK,fδ of AK,fδ , and so does δµ.4 We call the subroutine SplitByExp on the input
0
(AK,fδ , eδ , δµ, sr ) to obtain y ∈ AK,fδ , and add the ideal yAK,fδ to S. In addition,
if fδ > 1, we enumerate i = 0, 1, . . . , fδ − 1 and for each i, we add the ideal of
i
AK,fδ generated by y and σK,f
(x) to S, where x ∈ AK,fδ is computed in the case
δ
fδ > 1 above.
2

Here RK is regarded as a subring of AK,fδ via the inclusions RK ,→ ŌK /Rad(ŌK ) and
ŌK /Rad(ŌK ) ,→ AK,fδ .
3
For example, we can achieve this by computing an `th power non-residue γ` for each prime
factor ` of fδ . By raising γ` to its r` th power, where r` is the largest factor of q fδ − 1 coprime to `,
we may assume the order of γ` is (q fδ − 1)/r` . Then let γ be the product of all γ` .
4
We let AK,fδ = ŌK /Rad(ŌK ) if fδ = 1.

261

Algorithm 19 SurjectivityTest
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:

for K ∈ F do
for δ ∈ IK do
S←∅
if fδ > 1 then
r ← the largest factor of q fδ − 1 coprime to fδ
compute γ ∈ F×
of order (q fδ − 1)/r
q fδ
call SplitByExp on (AK,fδ , fδ , δγ, δtrδ ) to obtain x ∈ AK,fδ
S ← S ∪ {xAK,fδ }
if eδ > 1 then
J ← the preimage of δ(ŌK /Rad(ŌK )) in ŌK
find δ 0 ∈ AnnŌK (J eδ ) satisfying (1 − δ 0 )AnnŌK (J eδ ) = {0}
0
lift δ 0 sδ ∈ ŌK to s̃ ∈ OK
compute the image s of s̃eδ /p in ŌK /Rad(ŌK )
r0 ← the largest factor of q fδ − 1 coprime to eδ
compute µ ∈ F×
of order (q fδ − 1)/r0
q fδ
0
call SplitByExp on (AK,fδ , eδ , δµ, sr ) to obtain y ∈ AK,fδ
S ← S ∪ {yAK,fδ }
if fδ > 1 then
for i ← 0 to fδ − 1 do
i
S ← S ∪ {yAK,fδ + σK,f
(x)AK,fδ }
δ
for I ∈ S do
find δ0 ∈ I ∩ RK satisfying (1 − δ0 )(I ∩ RK ) = {0}
if δ0 δ 6∈ {0, δ} then
IK ← IK − {δ}
IK ← IK ∪ {δ0 δ, (1 − δ0 )δ}
return

262
Now we prove Lemma 5.24.
Proof of Lemma 5.24. Assume for some H ∈ P, B ∈ CH , and B̃ ∈ C̃H , the map
πH : Hh 7→ HhDQ0 maps B̃ to a proper subset of B. Let K be the field in F
isomorphic to LH over K0 . Let δ be the idempotent in IK satisfying τ̃H (δ) = δB
(see Definition 5.4). We show that in the corresponding iteration of the loop in Lines
3–27, we compute a set S that contains an ideal I of AK,fδ such that the unique
idempotent δ0 ∈ RK generating I ∩ RK satisfies δ0 δ 6∈ {0, δ}. Consequently, some
partition in C is properly refined.
Choose g, g 0 ∈ G such that HgDQ0 ∈ B − πH (B̃) and Hg 0 ∈ B̃. Let m0 be an
Q0 /pOL
. Fix σ ∈ DQ0 whose image in
arbitrary maximal ideal of AL,fδ containing Rad(
ŌL )
Gal(κQ0 /ŌK0 ) is the Frobenius automorphism x 7→ xq over Fq .
We necessarily have fδ > 1 or eδ > 1. First assume fδ > 1. Let γ ∈ F×
be of
q fδ
order (q fδ − 1)/r, where r is the largest factor of q fδ − 1 coprime to fδ . Consider
an element x ∈ ALH ,fδ of the form x = (δB γ)k − δB trδ,H = δB (γ k − trδ,H ) such
that xALH ,fδ ( δB ALH ,fδ , where k ∈ N. Let δ0 be the unique idempotent of
RLH generating xALH ,fδ ∩ RLH . The assumption xALH ,fδ ( δB ALH ,fδ implies
δ0 δB = δ0 and δ0 6= δB . If δ0 6= 0, by identifying K with LH via the isomorphism
τH : K → LH , we see the ideal added to S at Line 8 is used in Lines 24–26 to
properly refine IK . So assume δ0 = 0, or equivalently xALH ,fδ ∩ RLH = {0}.
Consider arbitrary h ∈ G, and let δ1 be the primitive idempotent of RLH correh
sponding to the maximal ideal Q̄0 ∩ RLH . Then a maximal ideal m of RL satisfies
h0
δ1 ≡ 1 (mod m) iff m = Q̄0 for some h0 ∈ Hh. This follows from Lemma 5.3
and the fact that DQ0 fixes Q̄0 setwisely. So a maximal ideal m0 of AL,fδ satisfies
h0
δ1 ≡ 1 (mod m0 ) iff m0 ⊇ Q̄0 for some h0 ∈ Hh. As xALH ,fδ ∩ RLH = {0}, we
h0
have δ1 6∈ xALH ,fδ . So for some h0 ∈ Hh and a maximal ideal m0 ⊇ Q̄0 of AL,fδ ,
0−1
−1
0−1
we have x ∈ m0 ∩ ALH ,fδ , and hence h x = h x ∈ h m0 ⊇ Q̄0 . By Lemma 5.6,
0−1
−i0
we have h m0 = σL,f
(m0 ) for some i0 ∈ Z. Therefore
δ
−1

(C.4)

i0
σL,f
(h x) ∈ m0 .
δ
−1

−1

i0
Suppose the element h above satisfies HhDQ0 ∈ B. Then σL,f
(h δB ) = h δB ≡
δ
1 (mod m0 ). As x = δB (γ k − trδ,H ), (C.4) implies
−1

ξ i0 r h (trδ,H ) =

h−1

−1

i0
i0
(σL,f
(trδ,H )) = σL,f
(h (trδ,H )) ≡ γ k
δ
δ

(mod m0 ),

263
where ξ is the primitive fδ th root of unity satisfying σK,fδ (tδ ) = ξ · tδ as in Definition 5.7. Choosing h to be g and g 0 respectively and using the fact r is coprime to
fδ , we see that there exists an unique integer i ∈ {0, . . . , fδ − 1} satisfying
−1

ξ ir g (trδ,H ) ≡ g

0−1

(trδ,H )

(C.5)

(mod m0 ).

As
−1

ξ ir g (trδ,H ) ≡

g −1

i −1

−1

i
i
(g (trδ,H )) ≡ σ g (trδ,H )
(trδ,H )) ≡ σL,f
(σL,f
δ
δ

(mod m0 ),

and r is coprime to fδ , we see that i is the unique integer in {0, . . . , fδ − 1} such
that the order of the element c in (AL,fδ /m0 )× satisfying
σ i g −1

tδ,H + m0 = c · (g

0−1

tδ,H + m0 )

is coprime to fδ . So for all ω ∈ IQ0 , the third condition in Definition 5.8 is
0
satisfied by Hgσ −i ω −1 and Hg 0 , and is not satisfied by Hgσ −i ω −1 and Hg 0 for
i0 ∈ {0, . . . , fδ − 1} − {i}. In particular, if eδ = 1, then Hgσ −i and Hg 0 are in the
same block B̃ by Definition 5.8, contradicting the assumption HgDQ0 6∈ πH (B̃).
So the subroutine properly refines IK if fδ > 1 and eδ = 1.
Next assume eδ > 1. Consider the ideal yAK,fδ of AK,fδ added to S at Line 18, and
let δ0 be the idempotent of RK generating yAK,fδ ∩ RK . Note yAK,fδ ( δAK,fδ .
So δ0 δ = δ0 6= δ. If δ 6= 0, we properly refine IK using δ0 in Lines 24–26. So
assume δ0 = 0, or equivalently yAK,fδ ∩ RK = {0}. Using the isomorphism
τH : K → LH , we regard y as an element of ALH ,fδ . So the assumption becomes
yALH ,fδ ∩ RLH = {0}.
Let c be the unique element in κ×
Q0 satisfying
σ i g −1

sδ,H + I = c · (g

0−1

(C.6)

sδ,H + I),

where I = (Q0 /pOL )e(Q0 )/eδ +1 (see Definition 5.8), and i is the unique integer in
{0, . . . , fδ − 1} satisfying (C.5) above (if fδ = 1, we let σ i be the identity). Then
the element s̃ computed at Line 13 (regarded as an element of OL ) satisfies
σ i g −1

e(Q0 )/eδ +1

s̃ + Q0

= c · (g

0−1

e(Q0 )/eδ +1

s̃ + Q0

)

and hence
σ i g −1

e(Q0 )+1

(s̃eδ ) + Q0

= ceδ · (g

0−1

e(Q0 )+1

(s̃eδ ) + Q0

).

264
e(Q )

e(Q )+1

We have p ∈ Q0 0 − Q0 0
and it is fixed by G. So the element s computed at
Line 14 (regarded as an element of ŌL /Rad(ŌL )) satisfies
σ i g −1

where m =

s + m = ceδ · (g

0−1

(C.7)

s + m),

Q0 /pOL
.
Rad(ŌL )

Fix a generator ω of IQ0 . The proof of Lemma 5.23 shows that
ωσ i g −1

i −1

(C.8)

sδ,H + I = c0 (σ g sδ,H + I)

for some primitive eδ th root of unity c0 ∈ κ×
Q0 .
If fδ = 1, we have ALH ,fδ = ŌLH /Rad(ŌLH ), and its maximal ideals correspond
one-to-one to those of RLH . So yALH ,fδ ∩ RLH = {0} implies y = 0. Note that y is
0
of the form δB µ` −sr where ` ∈ N, r0 is the largest factor of q fδ −1 coprime to eδ , and
−1
0−1
µ is an element in F×
of order (q fδ − 1)/r0 . We have g δB , g δB ≡ 1 (mod m)
q fδ
−1

0−1

g −1

0

g 0−1

0

since HgDQ0 , Hg 0 DQ0 ∈ B. As g y = g y = 0, we have
(sr ) ≡
(sr )
0
(mod m). Combining it with (C.7), we see cr is an eδ th root of unity. On the other
0
hand, we know c0 is a primitive eδ th root of unity, and so is c0r since r0 is coprime
0
0
to eδ . Therefore there exists j ∈ {0, . . . , eδ − 1} such that (c0r )j cr = 1. Then the
order of c0j c divides r0 , and hence is coprime to eδ . On the other hand, by (C.6) and
(C.8), we have
0−1
ω j σ i g −1
sδ,H + I = c0j c · (g sδ,H + I).
So by Definition 5.8 and the fact Hg 0 ∈ B̃, we have Hgσ −i ω −j ∈ B̃. But this is a
contradiction to the assumption HgDQ0 6∈ πH (B̃).
Next consider the case fδ > 1 (and eδ > 1). Let x, y ∈ ALH ,fδ be as above. We
claim that there exists i0 ∈ {0, . . . , fδ − 1} such that
0

yALH ,fδ + σLi H ,fδ (x)ALH ,fδ ( δB ALH ,fδ .

(C.9)

To see this, choose a maximal ideal m1 of ALH ,fδ containing y but not δB , which
exists since yALH ,fδ ( δB ALH ,fδ . Let m01 = m1 ∩ RLH . As xALH ,fδ ∩ RLH = {0},
there exists a maximal ideal m2 ⊇ m01 of ALH ,fδ containing x. By Lemma 5.6, there
0
0
exists i0 ∈ Z such that σLi H ,fδ (m2 ) = m1 and hence σLi H ,fδ (x) ⊆ m1 . As σLfδH ,fδ
fixes δB ALH ,fδ , we may assume i0 ∈ {0, . . . , fδ − 1}. As m1 contains both y and
0
σLi H ,fδ (x), but not δB , the claim follows.
0

Let I = yALH ,fδ + σLi H ,fδ (x)ALH ,fδ ( δB ALH ,fδ . Let δ0 be the idempotent of RK
generating I ∩ RK . As I ( δB ALH ,fδ , we have δ0 δ = δ0 6= δ. If δ0 6= 0, we see

265
it is used in Lines 24–26 to properly refine IK . So assume δ0 = 0, or equivalently
0
I ∩ RK = {0}. Let x0 = σLi H ,fδ (x). Then there exists i1 , i2 ∈ Z such that
−1

i1
i1
(
(g y), σL,f
σL,f
δ
δ
0

g −1 0

i2
(g
x ), σL,f
δ

0−1

g 0−1 0

i2
(
y), σL,f
δ

x ) ∈ m0 .

0

As y = δB µ` − sr and x0 = σLi H ,fδ (γ k − trδ,H ), we have
i1
σL,f
δ

and
i1
σL,f
δ

g−1



g −1

r0



(s ) ≡

i2
σL,f
δ

g0−1


(s )
r0

 0−1


g
i2
r
(t
)
(trδ,H ) ≡ σL,f
δ,H
δ

(mod m0 )

(mod m0 ).

(C.10)

(C.11)

As σL,fδ (tδ,H ) = ξ · tδ,H and G commutes with σL,fδ , (C.11) implies
−1

ξ (i1 −i2 )r g (trδ,H ) ≡ g

0−1

(trδ,H )

(mod m0 ).

On the other hand, we know i is the unique integer in {0, . . . , fδ − 1} satisfying
i2
(C.5). So i1 − i2 ≡ i (mod fδ ). Let s0 = σL,f
(s). Then by (C.10), Lemma 5.22
δ
and the fact that G commutes with σL,fδ , we have
σ i g −1

0

(s0r ) ≡

g 0−1

On the other hand, as σL,fδ fixes m =
σ i g −1 0

0

(s0r )

Q0 /pOL
Rad(ŌL )

(mod m0 ).
setwisely, (C.7) implies
g 0−1 0

i2
s + m = σL,f
(ceδ ) · (
δ

s + m).

i2
It follows that σL,f
(c) is an eδ th root of unity. So c is also an eδ th root of unity, as
δ
in the case eδ > 1, fδ = 1. The same proof in the case eδ > 1, fδ = 1 then shows
that there exists j ∈ {0, . . . , eδ − 1} such that Hgσ −i ω −j ∈ B̃, which contradicts
the assumption HgDQ0 6∈ πH (B̃).

Lemma 5.25. Under GRH, there exists a subroutine RingHomTest that updates
IK in time polynomial in log p and the size of F so that the partitions CH ∈ C
are refined. Moreover, at least one partition CH is properly refined unless C˜ is
compatible and invariant.
We need the following notation: suppose K, K 0 are extensions of K0 and φ : K 0 ,→
K is an embedding of K 0 in K over K0 . Recall that φ induces a homomorphism
of Fq -algebras φ̂ : ŌK 0 /Rad(ŌK 0 ) → ŌK /Rad(ŌK ). Also suppose ψ is an
embedding of Fqi in Fqj over Fq where i, j ∈ N+ . Then φ̂ and ψ determine a

266
homomorphism of Fq -algebras AK 0 ,i → AK,j sending a⊗b ∈ AK 0 ,i to φ̂(a)⊗ψ(b) ∈
AK,j for a ∈ ŌK 0 /Rad(ŌK 0 ) and b ∈ Fqi . We denote this map by φ̂ ⊗Fq ψ.
The pseudocode of the subroutine RingHomTest is given in Algorithm 20. It
enumerates (K, K 0 ) ∈ F 2 , embeddings φ : K 0 ,→ K over K0 , and (δ, δ 0 ) ∈ IK ×IK 0
such that φ̃(δ 0 )δ = δ. For each (K, K 0 , φ, δ, δ 0 ), a set S of ideals of AK,fδ is
computed. And for each I ∈ S, we find δ0 ∈ I ∩ RK satisfying (1 − δ0 )(I ∩ RK ) =
{0}, which is the unique idempotent of RK that generates the ideal I ∩ RK of RK .
If δ0 δ 6∈ {0, δ}, we use δ0 to refine IK and return.
Fix (K, K 0 , φ, δ, δ 0 ). The corresponding set S is computed as follows: Note we
have fδ0 |fδ and eδ0 |eδ . First assume fδ > 1. Compute the largest factor r of
q fδ − 1 coprime to fδ . Then compute an element γ ∈ F×
of order (q fδ − 1)/r,
q fδ
which can be done efficiently assuming GRH. Call the subroutine SplitByExp
in Lemma C.1 on (AK,fδ , fδ , δγ, δtrδ ) to obtain x ∈ AK,fδ . Also perform the
following computation if fδ0 > 1: compute an embedding ψ : Fqfδ0 → Fqfδ over Fq
deterministically in polynomial time using Lenstra’s algorithm [Len91]. Compute
t = (φ̂ ⊗Fq ψ)(tδ0 ) ∈ AK,fδ . By Definition 5.7 and the fact φ̃(δ 0 )δ = δ, we
have δtr AK,fδ = δAK,fδ . Call the subroutine SplitByExp on (AK,fδ , fδ , δγ, δtr )
i
to obtain x0 ∈ AK,fδ . Then add the ideal x0 AK,fδ + σK,f
(x)AK,fδ to S for all
δ
i ∈ {0, 1, . . . , fδ − 1}.
If eδ0 > 1, we perform the following computation: first compute the preimage J of
(1 − δ)(ŌK /Rad(ŌK )) under the quotient map ŌK → ŌK /Rad(ŌK ). Then J is
the product of the maximal ideals m of ŌK satisfying δ ≡ 1 (mod m/Rad(ŌK )).
e /e
Compute u ∈ AnnŌK (J eδ ) such that uφ̄(sδ0 ) − sδδ δ0 ∈ J eδ /eδ0 +1 . We claim such
u exists: by the Chinese remainder theorem, it suffices to show, for each maximal
ideal m of ŌK containing J, that
e /eδ0

uφ̄(sδ0 ) ≡ sδδ

(mod meδ /eδ0 +1 )

has a solution in ŌK . Fix such m. We have sδ ∈ m − m2 by Lemma 5.17 and
e /e
hence sδδ δ0 ∈ meδ /eδ0 − meδ /eδ0 +1 . Let m0 = φ̄−1 (m). By Lemma 5.17 and the fact
φ̃(δ 0 )δ = δ, we have sδ0 ∈ m0 − m02 and hence φ̄(sδ0 ) ∈ meδ /eδ0 − meδ /eδ0 +1 . The
claim follows by noting meδ /eδ0 /meδ /eδ0 +1 is an one-dimensional vector space over
ŌK /m. Next compute
ū := u + Rad(ŌK ) ∈ ŌK /Rad(ŌK ).
Compute the largest factor r0 of q fδ − 1 coprime to eδ , so that all the prime factors
of (q fδ − 1)/r0 divide eδ . And compute an element µ ∈ F×
of order (q fδ − 1)/r0 ,
q fδ

267

Algorithm 20 RingHomTest
1:
2:
3:
4:
5:
6:
7:
8:
9:
10:
11:
12:
13:
14:
15:
16:
17:
18:
19:
20:
21:
22:
23:
24:
25:
26:
27:
28:
29:
30:
31:

for (K, K 0 ) ∈ F 2 do
for embedding φ : K 0 ,→ K over K0 do
for (δ, δ 0 ) ∈ IK × IK 0 satisfying φ̃(δ 0 )δ = δ do
S←∅
if fδ > 1 then
r ← the largest factor of q fδ − 1 coprime to fδ
compute γ ∈ F×
of order (q fδ − 1)/r
q fδ
call SplitByExp on (AK,fδ , fδ , δγ, δtrδ ) to obtain x ∈ AK,fδ
if fδ0 > 1 then
compute an embedding ψ : Fqfδ0 → Fqfδ over Fq
t ← (φ̂ ⊗Fq ψ)(tδ0 ) ∈ AK,fδ
call SplitByExp on (AK,fδ , fδ , δγ, δtr ) to obtain x0 ∈ AK,fδ
for i ← 0 to fδ − 1 do
i
S ← S ∪ {x0 AK,fδ + σK,f
(x)AK,fδ }
δ
if eδ0 > 1 then
J ← the preimage of (1 − δ)(ŌK /Rad(ŌK )) in ŌK
e /e
compute u ∈ AnnŌK (J eδ ) such that uφ̄(sδ0 )−sδδ δ0 ∈ J eδ /eδ0 +1
ū ← u + Rad(ŌK ) ∈ ŌK /Rad(ŌK )
r0 ← the largest factor of q fδ − 1 coprime to eδ
compute µ ∈ F×
of order (q fδ − 1)/r0
q fδ
0
call SplitByExp on (AK,fδ , eδ , δµ, ūr ) to obtain y ∈ AK,fδ
S ← S ∪ {yAK,fδ }
if fδ > 1 then
for i ← 0 to fδ − 1 do
i
S ← S ∪ {yAK,fδ + σK,f
(x)AK,fδ }
δ
for I ∈ S do
find δ0 ∈ I ∩ RK satisfying (1 − δ0 )(I ∩ RK ) = {0}
if δ0 δ 6∈ {0, δ} then
IK ← IK − {δ}
IK ← IK ∪ {δ0 δ, (1 − δ0 )δ}
return

268
0

which can be done efficiently assuming GRH. Note that ūr AK,fδ = δAK,fδ .5 Call
0
the subroutine SplitByExp on the input (AK,fδ , eδ , δµ, ūr ) to obtain y ∈ AK,fδ , and
add the ideal yAK,fδ to S. In addition, if fδ > 1, we enumerate i = 0, 1, . . . , fδ − 1,
i
(x) to S, where
and for each i we add the ideal of AK,fδ generated by y and σK,f
δ
x ∈ AK,fδ is computed in the case fδ > 1 above.
Now we prove Lemma 5.25.
Proof of Lemma 5.25. Assume the algorithm does not properly refine any IK . We
prove that C˜ is compatible and invariant. Fix H, H 0 ∈ P and a map φ∗ : H\G →
H 0 \G that is either a projection πH,H 0 (with H ⊆ H 0 ) or a conjugation cH,h (with
H 0 = hHh−1 ). Consider g, g 0 ∈ G for which Hg, Hg 0 ∈ H\G are in the same
block of C̃H . We want to show that φ∗ (Hg), φ∗ (Hg 0 ) ∈ H 0 \G are in the same block
of C̃H 0 .
Let B be the block of CH containing both HgDQ0 and Hg 0 DQ0 . Let φ̄∗ :
DQ0
DQ0
∗
∗
H\G/DQ0 → H 0 \G/DQ0 be the map πH,H
0 if φ = πH,H 0 , or cH,h if φ = cH,h . As
C is compatible and invariant, there exists B 0 ∈ CH 0 containing both φ̄∗ (HgDQ0 )
0
and φ̄∗ (Hg 0 DQ0 ). Let K (resp. K 0 ) be the field in F isomorphic to LH (resp. LH )
over K0 . Let δ (resp. δ 0 ) be the idempotent in IK (resp. IK 0 ) satisfying τ̃H (δ) = δB
(resp. τ̃H 0 (δ 0 ) = δB 0 ). Let m0 be an arbitrary maximal ideal of AL,fδ containing
0
Q0 /pOL
. Fix an embedding ψ : Fqfδ0 → Fqfδ over Fq . Let φ : LH ,→ LH be the
Rad(ŌL )
−1
natural inclusion if φ∗ = πH,H 0 , or the map x 7→ h x if φ∗ = cH,h . Finally, let
s = φ̄(sδ0 ,H 0 ) if eδ0 > 1, and let t = (φ̂ ⊗Fq ψ)(tδ0 ,H 0 ) if fδ0 > 1.
We claim that the following two conditions are satisfied:
1. If eδ0 > 1, the order of the unique element c in κ×
Q0 satisfying
g −1

s + I 0 = c · (g

0−1

s + I 0)

is coprime to eδ0 , where I 0 = (Q0 /pOL )e(Q0 )/eδ0 +1 .
2. If fδ0 > 1, the order of the unique element c in (AL,fδ /m0 )× satisfying
g −1

t + m0 = c · (g

is coprime to fδ0 .
5

Again, we let AK,fδ = ŌK /Rad(ŌK ) if fδ = 1.

0−1

t + m0 )

269
To see this claim implies that φ∗ (Hg) and φ∗ (Hg 0 ) are in the same block of C̃H 0 ,
pick ḡ, ḡ 0 ∈ G such that H 0 ḡ = H 0 φ∗ (Hg) and H 0 ḡ 0 = H 0 φ∗ (Hg 0 ). Then c ∈ κ×
Q0
−1
in the first condition is also the unique element satisfying ḡ sδ0 ,H 0 + I 0 = c ·
0−1
(ḡ sδ0 ,H 0 + I 0 ). And c ∈ (AL,fδ /m0 )× in the second condition is also the unique
−1
0−1
Q0 /pOL
element satisfying ḡ tδ0 ,H 0 + m00 = c · (ḡ tδ0 ,H 0 + m00 ), where m00 ⊇ Rad(
is
ŌL )
the preimage of m0 under id ⊗Fq ψ : AL,fδ0 → AL,fδ , and id is the identity map
on ŌL /Rad(ŌL ). It follows by Definition 5.8 that φ∗ (Hg) and φ∗ (Hg 0 ) are in the
same block assuming if these two conditions are satisfied.
The rest of the proof focuses on verifying the above two conditions. First as0
sume fδ0 > 1. Suppose x = (δB γ)k − δB trδ,H and x0 = (δB γ)k − δB tr satisfy xALH ,fδ , x0 ALH ,fδ ( δB ALH ,fδ , where k, k 0 ∈ N. Then there exists i ∈
{0, . . . , fδ − 1} such that
Ii := x0 ALH ,fδ + σLi H ,fδ (x)ALH ,fδ ( δB ALH ,fδ .
This follows from the same argument in the proof of Lemma 5.24 that shows the
existence of i0 ∈ {0, . . . , fδ − 1} satisfying (C.9). We may also assume Ii ∩ RLH =
{0}: otherwise, by identifying K with LH using the isomorphism τH , we see the
subroutine finds an idempotent δ0 of RK at Line 23 satisfying δ0 δ 6∈ {0, δ}, and
properly refines IK .
By Lemma 5.6 and the assumption Ii ∩ RLH = {0}, we know there exist i1 , i2 ∈ Z
such that
g −1 0

i1
σL,f
(
δ

−1

g 0−1 0

i1 +i g
i2
x ), σL,f
( x), σL,f
(
δ
δ

i2 +i g
x ), σL,f
(
δ

0−1

x) ∈ m0 .

(C.12)

By Definition 5.7, there exist primitive fδ th roots of unity ξ, ξ 0 ∈ Fqfδ satisfying
σL,fδ (tδ,H ) = ξ · tδ,H and σL,fδ (t) = ξ 0 · t. As x = δB γ k − δB trδ,H and x0 =
0
δB γ k − δB tr , (C.12) implies
g −1

(trδ,H ) ≡ ξ (i2 −i1 )r g

0−1

(trδ,H )

(mod m0 )

(C.13)

and
g −1

(tr ) ≡ ξ (i2 −i1 )r g

0−1

(tr )

(mod m0 ).

(C.14)

On the other hand, as HgDQ0 , Hg 0 DQ0 ∈ B, we know from Definition 5.8 that
−1
the order of the unique element c ∈ (AL,fδ /m0 )× satisfying g tδ,H + m0 = c ·
0−1
(g tδ,H + m0 ) is coprime to fδ . As r is coprime to fδ , we see from (C.13) that
−1
0−1
i2 − i1 is divisible by fδ . Then (C.14) becomes g (tr ) ≡ g (tr ) (mod m0 ). So the

270
−1

order of the unique element c ∈ (AL,fδ /m0 )× satisfying g t + m0 = c · (g
is coprime to fδ , as desired.

0−1

t + m0 )

Next assume eδ0 > 1. Let ū be the element computed at Line 18 and regard it as
an element of ŌLH /Rad(ŌLH ) by identifying K with LH using the isomorphism
0
τH . Suppose y = (δB µ)` − ūr satisfies yALH ,fδ ( δB ALH ,fδ , where ` ∈ N. We
may assume yALH ,fδ ∩ RLH = {0}, since otherwise the idempotent δ0 generating
yALH ,fδ ∩ RLH satisfies δ0 δ 6∈ {0, δ} and is used to properly refine IK .
If eδ0 > 1 and fδ = 1, the ring ALH ,fδ is just ŌLH /Rad(ŌLH ), and we have y = 0
−1
0−1
in this case. So g y = g y = 0, which implies
g −1

0

(ūr ) ≡

g 0−1

0

(ūr )

(mod

−1

Q0 /pOL
).
Rad(ŌL )

(C.15)

0−1

Q0 /pOL
g
Let c1 , c2 ∈ κ×
respectively.
ū and g ū modulo Rad(
Q0 be the residues of
ŌLH )
r0
0
Then (c2 /c1 ) = 1. So the order of c2 /c1 divides r , which is coprime to eδ . By
Definition 5.8, the order of the unique element c ∈ κ×
Q0 satisfying
g −1

sδ,H + I = c · (g

0−1

sδ,H + I)

is coprime to eδ (and hence to eδ0 ), where I = (Q0 /pOL )e(Q0 )/eδ +1 . Then we have
 0−1

g −1 e /e 0
g
eδ /eδ0
δ δ
0
eδ /eδ0
0
sδ,H + I = c
·
sδ,H + I
(C.16)
and the order of ceδ /eδ0 is coprime to eδ0 . By the definition of ū, we may rewrite
(C.16) as
0−1
−1
c1 (g s) + I 0 = c2 ceδ /eδ0 · (g s + I 0 ).
As the order of c2 /c1 and that of ceδ /eδ0 are coprime to eδ0 , the second condition
above is satisfied.
Finally, assume eδ0 > 1 and fδ > 1. Then there exists j ∈ {0, . . . , fδ − 1} such that
Ij0 := yALH ,fδ + σLi H ,fδ (x)ALH ,fδ ( δB ALH ,fδ ,
where x = δB γ k − δB trδ,H is as above. Again we may assume Ij0 ∩ RLH = {0} since
otherwise IK is properly refined. Then there exist i1 , i2 ∈ Z such that
−1

−1

i1 +j g
i1
i2
σL,f
(g y), σL,f
( x), σL,f
(g
δ
δ
δ

0−1

i2 +j g
y), σL,f
(
δ

0−1

x) ∈ m0 .

As x = δB γ k − δB trδ,H and σL,fδ (tδ,H ) = ξ · tδ,H , again we conclude that i2 − i1 is
divisible by fδ . As the order of σLH ,fδ on δB ALH ,fδ is fδ , we may assume i1 = i2 .
0
As y = (δB µ)` − ūr , we have
g−1 0 
g0−1 0 
i1
i1
r
σL,f
(ū
)
≡
σ
(ūr )
(mod m0 ).
L,fδ
δ

271
As σL,fδ fixes every maximal ideal of ŌL /Rad(ŌL ) setwisely, and
m0 ∩ (ŌL /Rad(ŌL )) =

Q0 /pOL
,
Rad(ŌL )

we see (C.15) still holds. The rest of the proof is the same as in the case eδ0 > 1,
fδ = 1.
Lemma 5.26. Let G be a finite group acting transitively on a set S. Let D be a
subgroup of G and let k be the number of D-orbits in S. Suppose k > 1. Let ` ∈ N+
be the least prime factor of k. Let P = Pm be the system of stabilizers of depth m
for some m ≥ ` (with respect to the action of G on S). Then for any x ∈ S and any
P-scheme of double cosets C with respect to D that is homogeneous on Gx , there
exists no antisymmetric (C, D)-separated P-scheme.
Proof. Assume to the contrary that there exist x ∈ S, a P-scheme of double
cosets C = {CH : H ∈ P} with respect to D that is homogeneous on Gx , and
an antisymmetric (C, D)-separated P-scheme C˜ = {C̃H : H ∈ P}. As G acts
transitively on S, we know C is homogeneous on Gx for all x ∈ S.
Fix x0 ∈ S and consider the bijection λx0 : S → Gx0 \G sending g x0 to Gx0 g −1 .
It is an equivalence between the action of G on S and that on Gx0 \G by inverse
right translation. Let B0 be a block of C̃Gx0 and define T := λ−1
x0 (B0 ) ⊆ S. As C
is homogeneous on Gx0 and C˜ is (C, D)-separated, we know T is a complete set of
representatives of the D-orbits in S, and hence |B0 | = |T | = k.
The group G acts diagonally on S (`) . And Sym(`) acts on S (`) by permuting the
coordinates. As the two actions commute, we know Sym(`) permutes the G-orbits
in S (`) . Fix z ∈ T (`) and let Hz be the subgroup of Sym(`) fixing Gz setwisely.
Using the bijection λz : Gz → Gz \G, the action of Hz on Gz induces an action
on Gz \G. In the proof of Lemma 2.18, we showed that the latter action induces a
semiregular action on the set of the blocks of C̃Gz .
Let Uz := T (`) ∩ Gz. Suppose z = (z1 , . . . , z` ). For g ∈ G, the element g z is in Uz
iff λx0 (g zi ) ∈ λx0 (T ) = B0 for all i ∈ [`]. Fix i ∈ [`] and choose gi ∈ G satisfying
gi
x0 = zi . Then cx0 ,gi : Gx0 \G → Gzi \G sends B0 to a block Bi ∈ C̃Gzi . Also note
that cx0 ,gi ◦ λx0 = λzi . So λx0 (g zi ) ∈ B0 is equivalent to λzi (g zi ) ∈ Bi . As
λzi (g zi ) = Gzi g −1 = πGz ,Gzi (Gz g −1 ) = πGz ,Gzi ◦ λz (g z),
we see that λz (Uz ) consists of the elements x ∈ Gz \G satisfying πGz ,Gzi (x) ∈ Bi
˜ the set λz (Uz ) is a disjoint union of blocks of
for all i ∈ [`]. By compatibility of C,

272
˜ the cardinality of these blocks are all divisible
C̃Gz . Moreover, by regularity of C,
by |B0 | = k.
Note that the action of Hz on Gz fixes the set Uz setwisely. So the semiregular
action of Hz on the set of the blocks of C̃Gz restricts to a semiregular action on
the subset of the blocks in λz (Uz ). By the previous paragraph, we know |Uz | is a
multiple of k|Hz |.
The set T (`) is a disjoint union of subsets of the form Uz where z ∈ T (`) . The group
Sym(`) permutes these subsets. By the orbit-stabilizer theorem, each Sym(`)-orbit
O is a disjoint union of |Sym(`)|/|Hz | subsets of the same cardinality |Uz |, where
z is an arbitrary element in O. So
|O| =

|Sym(`)|
· |Uz |
|Hz |

which is a multiple of k`! by the previous paragraph. It follows that |T (`) | =
k(k − 1) · · · (k − ` + 1) is a multiple of k`!. But this is impossible since none of the
factors k − 1, . . . , k − ` + 1 are divisible by the prime number `.

273
Appendix D

LIST OF ALGORITHMS
Name

Reference

Page

ComputeQuotientRing

Lemma 3.8

57

ComputeResidue

Lemma 3.9

57

ComputeEmbeddings

Lemma 3.10

58

ComputeRingHom

Lemma 3.11

58

ExtractFactors

Algorithm 1, Theorem 3.7

60

ComputePscheme

Algorithm 2, Theorem 3.8

63

CompatibilityAndInvarianceTest

Algorithm 3, Lemma 3.13

65

FreeModuleTest

Lemma 3.16

67

SplitByZeroDivisor

Lemma 3.17

67

RegularityTest

Algorithm 4, Lemma 3.14

68

StrongAntisymmetryTest

Algorithm 5, Lemma 3.15

70

PschemeAlgorithm

Algorithm 6, Theorem 3.9

75

Automorphism

Algorithm 17, Lemma 3.18

247

Table D.1: Algorithms and subroutines in the P-scheme algorithm
Name

Reference

Page

AdjoinRoot

Lemma 4.8

86

SplittingField

Algorithm 7, Lemma 4.9

87

Stabilizers

Algorithm 8, Lemma 4.10

88

Tower

Theorem 4.1

90

GeneralAction

Algorithm 9, Theorem 4.2

92

SubgroupSystem

Algorithm 16, Lemma 8.1

204

Table D.2: Algorithms for constructing number fields

274
Name

Reference

Page

ComputeRelEmbeddings

Lemma 4.7

86

ComputeRings

Lemma 5.7

116

ComputeRingHoms

Lemma 5.8

117

ExtractFactorsV2

Algorithm 10, Theorem 5.6

119

ComputeDoubleCosetPscheme1

Algorithm 11, Theorem 5.7

124

CompatibilityAndInvarianceTestV2

Lemma 5.12

125

RegularityTestV2

Lemma 5.13

125

StrongAntisymmetryTestV2

Lemma 5.14

125

RamificationIndexTest

Algorithm 12, Lemma 5.15

127

InertiaDegreeTest

Algorithm 13, Lemma 5.16

128

ComputeOrdinaryPscheme

Algorithm 14, Theorem 5.8

137

GeneralizedPschemeAlgorithm

Algorithm 15, Theorem 5.9

139

ComputeAdvice

Algorithm 18, Lemma 5.17

255

SplitByExp

Lemma C.1

259

SurjectivityTest

Algorithm 19, Lemma 5.24

261

RingHomTest

Algorithm 20, Lemma 5.25

267

Table D.3: Algorithms and subroutines in the generalized P-scheme algorithm

1

The subroutine ComputeDoubleCosetPscheme is not actually used in the generalized Pscheme algorithm, but only serves as a preliminary version of ComputeOrdinaryPscheme.

275

LIST OF NOTATIONS

N+ .

set of positive integers.

[k].

set {1, 2, . . . , k}.

A − B. set difference {x : x ∈ A and x 6∈ B}.
|S|.

cardinality of S.

log. logarithmic function with base 2.
`
Si . disjoint union of sets Si .
0S .

coarsest partition of a set S.

∞S .

finest partition of a set S.

S (k) . set of k-tuples of distinct elements from S.
f ◦ g. composition of functions f and g, from right to left.
char(K). characteristic of a field K.
gcd(f, g). greatest common divisor of polynomials f and g.
e.

identity element of a group.

gH.

left coset {gh : h ∈ H}.

Hg.

right coset {hg : h ∈ H}.

G/H. left coset space {gH : g ∈ G}.
H\G. right coset space {Hg : g ∈ G}.
HgK. double coset {hgh0 : h ∈ H, h0 ∈ K}.
H\G/K. double coset space {HgK : g ∈ G}.
[G : H]. index of a subgroup H in G.
hH1 , . . . , Hk i. join of subgroups H1 , . . . , Hk .
hg1 , . . . , gk i. subgroup generated by g1 , . . . , gk .
H E G. H is a normal subgroup of G.
NG (H). normalizer of H in G.
Z(G). center of G.

276
(a1 a2 · · · an ). permutation sending ai to ai+1 for 1 ≤ i < n and an to a1 .
Sym(S), Sym(n). symmetric group.
Alt(S), Alt(n). alternating group.
Aut(G). automorphism group of a group G.
Inn(G). inner automorphism group of a group G.
Out(G). outer automorphism group of a group G.
g

x.

alias for the element ϕ(g, x) where ϕ is a group action.

g

T.

set {g x : x ∈ T }.

Gx.

G-orbit {g x : g ∈ G} of an element x.

Gx .

stabilizer of an element x.

GT .

pointwise stabilizer of a set T .

G{T } . setwise stabilizer of a set T .
Gx1 ,...,xk . pointwise stabilizer of {x1 , . . . , xk }.
S G.

set of fixed points of G in a set S.

AG .

subgroup (resp. subring, subfield) of G-invariant elements of the abelian
group (resp. ring, field) A.

Pm .

system of stabilizers of depth m.

λx .

the map from a G-orbit S containing x to Gx \G sending g x to Gx g −1 .

πH,H 0 . projection from H\G to H 0 \G.
cH,g . conjugation from H\G to gHg −1 \G.
d(G), d0 (G). See Definition 2.8.
b(G). minimal base size of a permutation group G.
πik .

projection from S (k) to S (k−1) omitting the kth coordinate.

πTk .

projection from S (k) to S (k−1) omitting the coordinates with indices in T .

ckg .

permutation of S (k) sending x to g x.

Π(C). m-scheme constructed from a P-scheme C (see Definition 2.12).
C(Π). P-scheme constructed from an m-scheme Π (see Definition 2.13).
1S .

block {(x, x) : x ∈ S} of an association scheme on S.

277
cgg0 ,g00 . See Definition 2.15.
Π(P ). 3-collection constructed from a partition P (see Definition 2.16).
P (Π). partition constructed from a 3-collection Π (see Definition 2.16).
(x), xR, Rx. ideal of a ring R generated by x.
OK .

ring of integers of a number field K.

Aut(K/K0 ). automorphism group of a field extension K/K0 .
Gal(K/K0 ). Galois group of a Galois extension K/K0 .
Gal(f /K0 ). Galois group of K/K0 where K is the splitting field of f over K0 .
ŌK .

quotient ring OK /pOK .

iK,L . inclusion ŌK ,→ ŌL in Chapter 3, or RK ,→ RL in Chapter 5.
P (I). See Definition 3.2 and Definition 5.4.
I(P ). See Definition 3.2 and Definition 5.4.
δB .

See Definition 3.2 and Definition 5.4.

Bδ .

See Lemma 3.5 and Lemma 5.4.

0
OK
.

a p-maximal order of K.

φ̄.

ring homomorphism ŌK → ŌK 0 induced from an embedding φ : K ,→ K 0 .

P ].

poset of subfields corresponding to P via Galois correspondence.

τH .

fixed isomorphism K → LH (which is K0 -linear in Chapter 5).

∼
=K0 . isomorphism over a field K0 .
c(P). complexity of a subgroup system P.
kαk. greatest absolute value of i(α) where i ranges over embeddings Q(α) ,→ C.
P+ .

subgroup system {U : H ⊆ U ⊆ NG (H), H ∈ P}.

h̃, ψ0 , A0 , K0 . See Chapter 5.
κP .

residue field of P.

e(P). ramification index of P over pOK0 .
f (P). inertia degree of P over pOK0 .
DP .

decomposition group of P over K0 .

278
IP .

inertia group of P over K0 .

WP .

wild inertia group of P over K0 .

e(HgD). ramification index of a double coset HgD.
f (HgD). inertia degree of a double coset HgD.
Rad(A). radical of a ring A.
Rad(g). radical of a polynomial g.

RK . ring x ∈ ŌK /Rad(ŌK ) : xp = x .
D
0
πH,H
0 . projection from H\G/D to H \G/D.
−1
cD
H,g . conjugation from H\G/D to gHg \G/D.

A ⊗Fq B. tensor product of A and B over Fq .
AK,i . ring (ŌK /Rad(ŌK )) ⊗Fq Fqi .
σK,i . automorphism of AK,i sending a ⊗ b to aq ⊗ b.
AnnR (S). annihilator of S in R.
φ̂.

ring homomorphism ŌK /Rad(ŌK ) → ŌK 0 /Rad(ŌK 0 ) induced from φ :
K ,→ K 0 .

φ̃.

ring homomorphism RK → RK 0 induced from φ : K ,→ K 0 .

eδ , fδ . See Section 5.7.
P|H . restriction of a subgroup system P to H.
C|H .

restriction of a P-collection C to H.

Π|x1 ,...,xk . See Definition 6.3.
Pcl .

closure of a subgroup system P.

ΠkT . restriction of an m-collection Π to a subset T .
AGL(V ). general affine group on V .
G o G0 . wreath product of groups G and G0 .
dSym (n). alias for d(G) where G = Sym(S) acts naturally on S, |S| = n.
GL(V ), GLn (q). general linear group.
ΓL(V ), ΓLn (q). general semilinear group.
PGL(V ), PGLn (q). projective linear group.

279
PΓL(V ), PΓLn (q). projective semilinear group.
dGL (n, q), dΓL (n, q), dPGL (n, q), dPΓL (n, q). See Definition 7.2.
m(n), m0 (n). See Definition 7.3.
PG,N . See Definition 8.1.
soc(G). socle of a finite group G.
Hol(G). holomorph of a group G.
Map(S, T ). set of all maps from the set S to the set T .
T twrϕ P . twisted wreath product with respect to the data (T, P, ϕ).
U (k, q). fully deleted permutation module for Sym(k) over Fq .
G1 ⊗ · · · ⊗ Gk . tensor product of the linear groups Gi .
g1 ⊗ · · · ⊗ gk . image of (g1 , . . . , gk ) in G1 ⊗ · · · ⊗ Gk .

INDEX

action, 12

of a P-collection of double
cosets, 112

affine scheme, 123, 241

of an m-collection, 22

A

affine type, 208, 214

complete

algebraic integer, 52

factorization, 1

algebraic number, 52

idempotent decomposition, 51

almost simple group, 208

completely reducible, 44

almost simple type, 208, 211

complexity of a subgroup system, 81

annihilator, 115

composition factor, 200

antisymmetry

composition series, 200

of a P-scheme, 19

conjugate

of a P-scheme of double cosets,
113

subfield, 52
subgroup, 11

of an m-scheme, 23

conjugation, 17, 112

association scheme, 30

coprime ideals, 50

automorphism group

cyclotomic scheme, 39

of a field extension, 52
of a group, 11

D
decomposition group, 107

B

Dedekind domain, 53

base, 21

depth, 15

basis of a free module, 51

diagonal action, 12

block, 10

diagonal type, 209, 222
direct product

C
(C, D)-separatedness, 132

of P-collections, 175

center of a group, 11

of m-schemes, 176
discreteness

CFSG, 200
Chinese remainder theorem, 50

of a P-scheme, 19

classical group, 200

of a P-scheme of double cosets,
113

classification of finite simple groups,
see CFSG

of an m-scheme, 23

closure, 99, 162

discriminant of a polynomial, 96

compatibility

double coset, 11

of a P-collection, 18, 241

doubly regular tournament, 39
280

281
E

H

equivalent actions, 16

having a singleton, 143

exceptional group of Lie type, 200

holomorph, 209
homogeneity

F

of a P-scheme, 19

faithful action, 12

of a P-scheme of double cosets,
113

finitely generated module, 51
fixed

of an m-scheme, 23

subfield, 13
subring, 13
flat module, 114, 253
free module, 51
Frobenius automorphism, 107
fully deleted permutation module,
214
fundamental theorem of Galois
theory, 52
G
Galois closure, 52
Galois extension, 52
Galois group, 52
Galois theory, 52
general
affine group, 173

I
I-advice, 130
ideal, 49
idempotent, 45, 50
idempotent decomposition, 45, 51
imprimitive
m-scheme, 171
permutation group, 89
imprimitive wreath product action,
179
index of a subgroup, 11
induction of a P-scheme, 154
inertia degree
of a double coset, 109
of a prime ideal, 106

linear group, 180

inertia group, 107

semilinear group, 180

inner automorphism, 11

generalized P-scheme algorithm, 139

integral, 52

generalized Riemann hypothesis, see
GRH

invariance
of a P-collection, 18, 241

G-module, 13

of a P-collection of double
cosets, 113

G-orbit, see orbit

of an m-collection, 22

G-invariant, 13

great common divisor, 11
GRH, 3

inverse right translation, 16
of P-schemes, 148

group action, see action

irreducible lifted polynomial, 5, 102

G-set, 12

irreducible linear group, 214

282
number field, 52

J
join, 11
join-closed, 165
Jordan-Hölder theorem, 200

O
O’Nan-Scott theorem, 211
Odd Order Theorem, 174
orbit, 12

K
k-transitive, 12

P-scheme, 33

(k + 1/2)-transitive, 12

m-scheme, 33
orbit-stabilizer theorem, 17

L
left coset, 11
left translation, 16
Lie rank, 205

orbital graph, 172
orthogonal idempotents, 45, 50
outer automorphism group, 12

lifted polynomial, 5, 102

P

linear group, 181

Paley tournament, 39

locally constant

partially ordered set, see poset

inertia degrees, 109

partition, 10

ramification indices, 109

P-collection, 18

lying over, 53, 106
M
matching, 29
maximal ideal, 49
maximal subgroup, 11
m-collection, 22
minimal base size, 21
monic polynomial, 11
m-scheme, 22

of double cosets, 112
permutation group, 12
permutation isomorphic actions, 16
permutation representation, 12
p-maximal order, 56
pointwise stabilizer, 12
poset, 15
power
non-residue, 3
residue, 3

N

primary tensor, 216

natural action of linear groups, 181,
193

prime ideal, 49
primitive

nilpotent, 109

m-scheme, 171

nilradical, see radical of a ring

association scheme, 171

non-standard action, 212

idempotent, 50

normal subgroup, 11

linear group, 214

normalization, 123

permutation group, 89

normalizer, 11

primitive element, 52

283
primitive element theorem, 52, 84
primitive wreath product action, 210
product type, 210, 225
projection, 17, 112
projective
linear group, 181
semilinear group, 181
space, 181
proper
factorization, 1, 143
ideal, 49
idempotent decomposition, 51
refinement, 10
P-scheme, 18, 241
of double cosets, 112
P-scheme algorithm, 75
Pyber’s base size conjecture, 212
Q
quasisimple group, 215
R
radical
of a polynomial, 110
of a ring, 109
ramification index
of a double coset, 109
of a prime ideal, 106
rank of a module, 51
refinement, 10
regular action, 12
regularity
of a P-collection, 18, 241
of a P-collection of double
cosets, 113
of a prime, 122
of an m-collection, 23

relative number field, 79
residue field, 106
restriction
of a P-collection, 149
of a partition, 10
of a subgroup system, 148
of an m-collection to a subset,
168
right coset, 11
ring of integers, 52
S
scalar linear transformation, 181
schemes conjecture, 147, 159
for permutation groups, 147, 160
Schreier conjecture, 211
self-reduction of discreteness, 185
semilinear transformation, 180
semiregular action, 12
semisimple
algebra, 50
ring, 50
set of fixed points, 12
set of imprimitivity, 89
setwise stabilizer, 12
simple group, 200
size, 56
socle, 208
splitting field, 52
splitting of prime ideals, 53, 106
complete splitting, 53
sporadic simple group, 200
square-free, 44
square-free factorization, 44, 115
stabilizer, 12
standard action, 180, 188, 212
strong antisymmetry

284
of a P-scheme, 20
of a P-scheme of double cosets,
113
of an m-scheme, 23
structure constants, 3, 55
subfield system, 61, 80
subgroup system, 15
subquotient, 11
symmetry
of a P-scheme, 19
of an m-scheme, 23
system of stabilizers, 15
T
tensor product of linear groups, 214

transitive action, 12
twisted wreath type, 211, 227
U
unique factorization domain, 1, 11
V
valency, 30
W
wild inertia group, 108
wreath product
of P-schemes, 178
of m-schemes, 178
of groups, 177

