libecc: Elliptic Curve Cryptography C++ Library

Main Page Reference Manual Compound List File List

You probably already heard of the trace of a matrix. It is defined as the sum of the diagonal elements of a square matrix. What is so special about that? Well, as explained by that link, the trace is basis invariant. Let L : K be a finite field extension, like $\mathbb{F}_{2^m}$ is a field extension of $\mathbb{Z}$ ₂. Given some linear transformation A: L $\rightarrow$ L you can write that linear transformation in the form of a matrix equation (because it is linear) $A_yx = yx$ after chosing some basis for L that associates L with a vector space. This equation is linear in x because y is fixed. We already saw discussed one such basis for our field $\mathbb{F}_{2^m}$ , elsewhere: (1, t, t², t³, ..., t^m-1).

Lets work out a simple example using this polynomial basis. Let m = 4, using reduction polynomial t⁴ + t + 1. Let y = t, some element of our field $\mathbb{F}$ _2⁴. The linear transformation that sends x $\rightarrow$ yx is then given by, A_tx = tx. The trace of the matrix should be independent of the chosen basis, so that we might as well talk about "the trace of the linear transformation", or even about "the trace of y", for y uniquely determines this transformation. Multiplying with t means that this transformation sends 1 to t, t to t², ... and t^m-2 to t^m-1. Only the transformation of the last member of our polynomial basis is a little different: t^m-1 $\rightarrow$ tt^m-1 = t^k + 1. Writing out the matrix for the given example gives therefore,

$\begin{pmatrix} 0 & 0 & 0 & 1 \\ 1 & 0 & 0 & 1 \\ 0 & 1 & 0 & 0 \\ 0 & 0 & 1 & 0 \\ \end{pmatrix} \begin{pmatrix} x_0 \\ x_1 \\ x_2 \\ x_3 \end{pmatrix} = t \begin{pmatrix} x_0 \\ x_1 \\ x_2 \\ x_3 \end{pmatrix}$

where x_i is the coefficient corresponding to the basis element tⁱ.

We find that in this case the trace is Tr(A_t) = Tr(t) = 0 (the sum of the diagonal elements of the matrix). Please note that Tr(y) is an element of K (being $\mathbb{Z}$ ₂ in our case): adding the diagonal elements (which are all element of K) is still done modulo 2!

The more general matrix (for arbitrary m for which there exists an irreducible trinomial t^m + t^k + 1 that is used as reduction polynomial) leads to the matrix

$\begin{pmatrix} 0 & 0 & 0 & \cdots & & & & \cdots & 0 & 1 \\ 1 & 0 & & & & & & & & 0 \\ 0 & 1 & 0 & & & & & & & 0 \\ 0 & & 1 & 0 & & & & & & \vdots \\ \vdots & & & \ddots & \ddots & & & & & 0 \\ & & & & 1 & 0 & & & & 1 \\ & & & & & 1 & 0 & & & 0 \\ \vdots & & & & & & \ddots & \ddots & & \vdots \\ 0 & & & & & & & 1 & 0 & 0 \\ 0 & \cdots & & & & & \cdots & 0 & 1 & 0 \end{pmatrix}$

where the lower 1 in the right-most column appears in the k-th row, and hence we can immediately see that

$Tr(t) = \begin{cases} 0 & k \neq m - 1 \\ 1 & k = m - 1 \end{cases}$

Since libecc forbids values of k > m/2, we can safely assume that in our case the trace of t is always 0.

Lets investigate that this trace is indeed independent of the chosen basis by applying a basis transformation. The only possible basis transformation happens to be applying Frobenius a number of times. Lets investigate applying Frobenius once.

The Frobenius map sends 1 $\rightarrow$ 1, t $\rightarrow$ t², t² $\rightarrow$ t⁴ = t + 1 and t³ $\rightarrow$ t⁶ = t³ + t². From which follows that the corresponding matrix is

$Frob(x) = \begin{pmatrix} 1 & 1 & 0 & 0 \\ 0 & 0 & 1 & 1 \\ 0 & 1 & 0 & 0 \\ 0 & 0 & 0 & 1 \end{pmatrix} \begin{pmatrix} x_0 \\ x_1 \\ x_2 \\ x_3 \end{pmatrix} = \begin{pmatrix} z_0 \\ z_1 \\ z_2 \\ z_3 \end{pmatrix}$

the inverse of which is

$Frob^{-1}(z) = \begin{pmatrix} 1 & 0 & 1 & 0 \\ 0 & 0 & 1 & 0 \\ 0 & 1 & 0 & 1 \\ 0 & 0 & 0 & 1 \end{pmatrix} \begin{pmatrix} z_0 \\ z_1 \\ z_2 \\ z_3 \end{pmatrix} = \begin{pmatrix} x_0 \\ x_1 \\ x_2 \\ x_3 \end{pmatrix}$

Applying Frobenius to the equation A_tx = tx gives Frob(A_tx) = Frob(tx) = t Frob(x), where the last equality holds because that t is a constant. Furthermore, Frob(A_tx) = Frob(A_t Frob^-1(Frob(x))) = Frob(A_t Frob^-1(z)), which brings us to the matrix equation

$\begin{pmatrix} 1 & 1 & 0 & 0 \\ 0 & 0 & 1 & 1 \\ 0 & 1 & 0 & 0 \\ 0 & 0 & 0 & 1 \end{pmatrix} \begin{pmatrix} 0 & 0 & 0 & 1 \\ 1 & 0 & 0 & 1 \\ 0 & 1 & 0 & 0 \\ 0 & 0 & 1 & 0 \\ \end{pmatrix} \begin{pmatrix} 1 & 0 & 1 & 0 \\ 0 & 0 & 1 & 0 \\ 0 & 1 & 0 & 1 \\ 0 & 0 & 0 & 1 \end{pmatrix} \begin{pmatrix} z_0 \\ z_1 \\ z_2 \\ z_3 \end{pmatrix} = t \begin{pmatrix} z_0 \\ z_1 \\ z_2 \\ z_3 \end{pmatrix}$

Working out the matrix multiplication we get

$\begin{pmatrix} 1 & 0 & 1 & 0 \\ 0 & 1 & 1 & 1 \\ 1 & 0 & 1 & 1 \\ 0 & 1 & 0 & 1 \end{pmatrix} \begin{pmatrix} z_0 \\ z_1 \\ z_2 \\ z_3 \end{pmatrix} = t \begin{pmatrix} z_0 \\ z_1 \\ z_2 \\ z_3 \end{pmatrix}$

where the z_i are the coefficients relative to the basis (1, t², t + 1, t³ + t²). And indeed, still we have Tr(t) = 1 + 1 + 1 + 1 = 0.

More in general, any change of basis can be represented with some non-singular matrix (which means that its determinant is non-zero and thus that it has an inverse). Let the matrix B represent a change of basis, then the matrix A_t will change into BA_t/B, preserving the value of the determinant (see formula 18 on this page) and the value of the trace (see formula 7 on this page).

The following is not a proof in any way, but it gives things a bit a place, and therefore making it easier to understand more mathematical texts that actually derive and prove things, I hope.

Consider the linear equation (using some basis)

$(A_i - \lambda_iI)x_i = 0$

Then $\lambda$ _i are the eigen values of A and x_i are the corresponding eigen vectors. Note that for a fixed $\lambda$ _i the above represents the linear transformation (A_ix_i = $\lambda$ _ix_i).

For the story about eigen values and corresponding eigen vectors, $\lambda$ _i has to be an element of the base field K ( $\mathbb{F}$ ₂), so we really only have one non-trivial eigen value: 1. Plugging that value into the equation turns A into the identity matrix and trivally all of the vector space into the corresponding eigen space (that is, every value of x is an eigen vector of the identity matrix with scaling factor 1; what else is new). But we can also consider values for y = $\lambda$ _i that are element of L, in that case we simply get the equation A_yx = yx which holds per definition for any value x $\in$ L. Nevertheless, we can still call y eigen value and related theorems still hold, like that the trace of the matrix is the sum of all its eigen values (now elements of L), and the norm of the matrix (its determinant) is the product of all the eigen values. Below we assume that the eigen values y $\in$ L and you can forget about the concept of eigen vectors: the equations are trivially true for any x. This paragraph was just added to take away possible confusion about that.

Obviously (A_y - yI) can't have an inverse when (A_y - yI)x = 0 for every x $\in$ $\mathbb{F}_{2^m}$ . The matrix will be singular therefore, its determinant will be zero and we have A_y - yI = 0. The determinant is a polynomial in y of degree m and the equation is called the characteristic equation (or polynomial) of A_y; the roots are the eigen values of the matrix.

If we choose y = t and consider

$A_tx = tx$

$(A_t - tI)x = 0$

then the equation A_t - tI = 0 must be the minimal polynomial of t (that is, a monomial of degree m): it is the reduction polynomial! The corresponding A_t will have eigen values that are precisely the roots of the reduction polynomial. What are those roots?

We already have one root (per definition): t itself. It is near impossible to write out t in its complex form, that would result in huge formulas if at all possible to find, but we don't have to do that. We can express the other roots easily in t by repeatedly applying Frobenius.

For example, let the reduction polynomial be t⁴ + t + 1 = 0. Then by replacing each t with its square, the equation still holds: (t²)⁴ + t² + 1 = t⁴t⁴ + t² + 1 = (t + 1)² + t² + 1 = t² + 1 + t² + 1 = 0. And doing that again, it still holds: (t⁴)⁴ + t⁴ + 1 = (t + 1)⁴ + t⁴ + 1 = 0, and so on. After all, the Frobenius map is an automorphism. If t is a generator of the field and its order is n = 2^m - 1, hence n is the smallest positive integer such that tⁿ = 1, then applying Frobenius m - 1 times will lead necessarily to m different values. The roots of the reduction polynomial are therefore given by the set (t, t², t^2², ..., t^{2^m-1}) and they represent the eigen values of the matrix A_t in the linear transformation A_tx = tx, independent of the basis. If t is not a generator of the field, which is possible when m is non-prime, it might happen that the same eigen value is shared by more than one eigen vector, but in that case we have to add the same eigen value multiple times. Therefore, the trace of t is given by the sum of this set and the detA_t is given by the product of this set.

The same story holds for an arbitrary value of y (not zero), and we find

$Tr(y) = \sum_{i=0}^{m-1}{y^{2^i}}$

Also note that $det \vert A_y \vert = \prod_{i=0}^{m-1}{y^{2^i}} = y^{2^m-1} = 1$ which makes us jump of joy because it means that every non-zero y has an inverse, as should be the case for field elements!

The roots of the reduction polynomial are not always linear independent and we can't use them as a basis, but it can be proven that there will always exist some element $\beta$ such that ( $\beta$ , $\beta$ ², $\beta$ ^2², ..., $\beta$ ^{2^m-1}) is linear independent. Such a basis is called a normal basis.

As an example, let the reduction polynomial again be t⁴ + t + 1. The set (t, t², t⁴, t⁸) = (t, t², t + 1, t² + 1) is clearly not linear independent. However, we can chose $\beta$ = t³ and find a normal basis (t³, t³ + t², t³ + t² + t + 1, t³ + t). If next we want to find the matrix that corresponds with A_tx = tx (multiplication with t) then we have to first figure out how the basis elements are converted.

t(t³) = t⁴ = t + 1 = (t³ + t²) + (t³ + t² + t + 1).
t(t³ + t²) = t³ + t + 1 = (t³) + (t³ + t²) + (t³ + t² + t + 1).
t(t³ + t² + t + 1) = t³ + t² + 1 = (t³) + (t³ + t² + t + 1) + (t³ + t).
t(t³ + t) = t² + t + 1 = (t³) + (t³ + t² + t + 1).

And thus we have

$\begin{pmatrix} 0 & 1 & 1 & 1 \\ 1 & 1 & 0 & 0 \\ 1 & 1 & 1 & 1 \\ 0 & 0 & 1 & 0 \end{pmatrix} \begin{pmatrix} x_0 \\ x_1 \\ x_2 \\ x_3 \end{pmatrix} = t \begin{pmatrix} x_0 \\ x_1 \\ x_2 \\ x_3 \end{pmatrix}$

Note that again Tr(t) = 0, as it should be. Lets have a look at an element whose trace will not be 0 for change, like t³. Using the above formula for the trace we can immediately calculate it.

$Tr(t^3) = t^3 + t^6 + t^9 + t^{12} = t^3 + (t^3 + t^2) + (t^3 + t^2 + t + 1) + (t^3 + t) = 1$

Note that this is exactly the sum of the normal basis that we used above.

Lets do one more check with a matrix, using this same basis. The basis elements are converted as follows:

t³(t³) = (t³ + t²).
t³(t³ + t²) = (t³ + t).
t³(t³ + t² + t + 1) = 1 = (t³) + (t³ + t²) + (t³ + t² + t + 1) + (t³ + t).
t³(t³ + t) = (t³ + t² + t + 1).

And thus we have

$\begin{pmatrix} 0 & 0 & 1 & 0 \\ 1 & 0 & 1 & 0 \\ 0 & 0 & 1 & 1 \\ 0 & 1 & 1 & 0 \end{pmatrix} \begin{pmatrix} x_0 \\ x_1 \\ x_2 \\ x_3 \end{pmatrix} = t^3 \begin{pmatrix} x_0 \\ x_1 \\ x_2 \\ x_3 \end{pmatrix}$

and as expected, the trace of this matrix is 1.

We can make an interesting observation here. A vector relative to a normal basis ( $\beta$ , $\beta$ ², $\beta$ ^2², ..., $\beta$ ^{2^m-1}) allows us to denote every single element of the field of course, otherwise it wasn't a basis. The zero is always given by the vector (0, 0, 0, ..., 0), and thus it is impossible that the vector (1, 1, 1, ... 1), which corresponds to adding all elements of the normal basis, would be zero as well. Moreover, adding all elements of a normal basis means adding all the roots of $\vert A_\beta - \beta I \vert = 0$ , it is equal to the trace of $\beta$ , and a trace is element of the base field and can therefore only be equal to 0 or 1 in our case! Hence, in order for ( $\beta$ , $\beta$ ², $\beta$ ^2², ..., $\beta$ ^{2^m-1}) to be a normal basis we must have 0 $\neq$ Tr( $\beta$ ) = 1 !

Now consider the following magic. When $\beta$ , in combination with Frobenius, can be used to form a normal basis, then so can $\beta$ ² because if you replace $\beta$ with $\beta$ ² in the basis you simply get ( $\beta$ ², $\beta$ ^2², ..., $\beta$ ^{2^m-1}, $\beta$ ). Therefore, it must be that Tr( $\beta$ ²) = 1 too. The inverse is also true, if $\beta$ ² can be used to generate a normal basis then so can $\beta$ . Hence, we can conclude that for any arbitrary element y

$Tr(y) = Tr(Frob(y))$

This result is not too weird, considering that Frobenius is an automorphism that basically just changes the basis - and as we saw before, the trace is not dependent on the basis.

In other words, Tr(y - Frob(y)) = Tr(y) - Tr(Frob(y)) = 0. And therefore we can conclude that the equation x = y + y² can only have solutions when Tr(x) = 0 ! Note that Frob(y) = y² and that, since we are working with characteristic 2, y + y² = y - y².

And this is the result I needed to prove Hypothesis 1.

THEOREM 5

Let x $\in$ $\mathbb{F}_{2^m}$ . Then Tr(x) = 0 iff there exists a y $\in$ $\mathbb{F}_{2^m}$ such that x = y + y².

PROOF

There is another, easy way to prove theorem 5. Suppose there is a solution to the equation x = y + y², so that for a given x and y the equation is true. Then applying Frobenius to both sides (squaring both sides) results again in in an equation that is true of course. We can repeat squaring both sides precisely m - 1 times at which point the term y² will turn into y because y^{2^m} = y. If we subsequently add up all those equations we get immedeate proof that the trace of x is 0.

$\] \begin{eqnarray*} x &=& y + y^2 \\ x^2 &=& y^2 + y^4 \\ x^4 &=& y^4 + y^8 \\ \vdots \\ x^{2^{m-2}} &=& y^{2^{m-2}} + y^{2^{m-1}} \\ x^{2^{m-1}} &=& y^{2^{m-1}} + y \end{eqnarray*} \[$

where the sum of all left-hand-sides is precisely the trace of x and the sum of all right-hand-sides is zero!

Weew, you have no idea how glad I am that I finally got to this point without using sophisticated mathematics! I worked five days on the above. Hopefully I reached my goal and you are now reasonably comfortable with Frobenius and traces. Just for the kicks (and so you appreciate my efforts a bit more), here is the "sophisticated" derivation:

Let G be the Galois group of the Galois extension L/K, then $H^1(G,L) = H^1(G,L^*) = 0$ (Hilbert's theorem 90). Therefore, if G is cyclic with generator g, this is the same as Norm(x) = 1 $\iff$ x = y/g(y). And Tr(x) = 0 $\iff$ x = y - g(y).

Also trace (of field elements) is usually explained with Galois theory. Maybe I'll add a chapter about Galois Theory later to this project.

A week after I wrote the above, I found emperically an extremely fast way to find the trace of an element of $\mathbb{F}_{2^m}$ . I showed this method on an IRC channel on 10 December 2004 and posted it to the sci.math news group on 11 December 2004. I managed to find a prove for it on 18 December 2004 (see below). Unfortunately, then I found a (yet unpublished) article on the net that proved the same thing (theorem 7 of On the Number of Trace-One Elements in Polynomial Bases for F_2ⁿ).

Although we found this independently, and although the other article will probably not be published before 2005, I suppose I can't publish it myself anymore; too bad.

THEOREM 6

Let t^j $\in$ $\mathbb{F}_{2^m}$ with reduction polynomial t^m + t^k₀ + t^k₁ + $\cdots$ + t^k_n + 1, where each k_i < m / 2. Then the trace of t^j is 1 iff j is odd and there exists an i such that j = m - k_i, or when j = 0 and m is odd.

Please give me credit if you use it anywhere.

PROOF

We start this proof with a repetion of the theory of eigenvalues and the trace, but slightly more rigorous because we need that to understand how the eigenvalues of a power of t relates to the eigenvalues of t.

Let $\mathbb{F}_{2^m}$ be the degree m extension field of $\mathbb{F}$ ₂. Then $\mathbb{F}_{2^m}$ = $\mathbb{F}$ ₂[t]/(r(t)) where r(t) is an irreducible polynomial of degree m over $\mathbb{F}$ ₂. The element $\alpha$ = t is a root of r(t) in $\mathbb{F}_{2^m}$ , and { 1, $\alpha$ , $\alpha$ ², ..., $\alpha$ ^m-1 } is a basis for $\mathbb{F}_{2^m}$ over $\mathbb{F}$ ₂, called the polynomial basis. The trace of an element x $\in$ $\mathbb{F}_{2^m}$ was shown before to be $Tr(x) = \sum_{i=0}^{m-1}{x^{2^i}}$ .

Simultaneously, $\mathbb{F}_{2^m}$ is a vector space V of dimension m over $\mathbb{F}$ ₂. And the element x can be considered to be a linear transformation x: V $\rightarrow$ V, representing multiplication with x, carrying any element y to xy. Using the polynomial basis, let T be the matrix that carries any element y to ty. Thus, Ty = ty for any vector y $\in$ V and where t is the special element as defined by the reduction map. Then T has the general form

$\begin{pmatrix} 0 & 1 & 0 & 0 & \cdots & 0 \\ 0 & 0 & 1 & 0 & \cdots & 0 \\ 0 & 0 & 0 & 1 & \ddots & \vdots \\ 0 & \vdots & \vdots & \ddots & \ddots & 0 \\ 0 & 0 & 0 & 0 & 0 & 1 \\ r_0 & r_1 & r_2 & r_3 & \cdots & r_{m-1} \\ \end{pmatrix}$

where the r_i $\in$ $\mathbb{F}$ ₂ are the coefficients of the reduction polynomial r(t) = t^m + r_m-1t^m-1 + ... + r₁ t + r₀. Note that always r₀ = 1 or the reduction polynomial would not be irreducible.

Also note that the trace of this matrix (the sum of the diagonal elements), and thus of t, equals r_m-1 (a well-known fact, as is proven for example by Bhargav (lemma 3.2)), Tr(t) = r_m-1.

The characteristic polynomial of a linear transformation T is defined as f(e) = det(T - eI), where I is the identity matrix. Obviously it has coeficients in $\mathbb{F}$ ₂, the ground field of V. The equation f(e) = 0 has a solution if and only if (T - eI)(v) = 0 for some nonzero vector v; in general, for any linear transformation A, det(A) = 0 if and only if Av = 0 is satisfied by a nonzero vector v. We are taking the special case of A = (T - eI). Now note that (e, v) is an eigenvalue - eigenvector pair of T if and only if Tv = ev, which is true if and only if (T - eI)(v) = 0. e is an eigenvalue of T if and only if f(e) = 0, where f is the above mentioned characteristic polynomial.

Now let T again be the matrix that carries an element y to ty. Then we will show that the characteristic polynomial of T, f(e), is precisely the reduction polynomial r and thus e will be an eigenvalue of T if and only if r(e) = 0, and the eigenvalues of T turn out to be the roots of the reduction polynomial.

The characteristic polynomial of T is det(T - eI) is

It is easy to see that this determinant is the reduction polynomial because it is equal to

$-e \left| \begin{matrix} -e & 1 & 0 & \cdots & 0 \\ 0 & -e & 1 & \ddots & \vdots \\ \vdots & \vdots & \ddots & \ddots & 0 \\ 0 & 0 & 0 & -e & 1 \\ r_1 & r_2 & r_3 & \cdots & r_{m-1} - e \end{matrix} \right| - 1 \cdot \left| \begin{matrix} 0 & 1 & 0 & \cdots & 0 \\ 0 & -e & 1 & \ddots & \vdots \\ \vdots & \vdots & \ddots & \ddots & 0 \\ 0 & 0 & 0 & -e & 1 \\ r_0 & r_2 & r_3 & \cdots & r_{m-1} - e \end{matrix} \right|$

and the second underdeterminant can be worked out to

$\left| \begin{matrix} 0 & 1 & 0 & \cdots & 0 \\ 0 & -e & 1 & \ddots & \vdots \\ \vdots & \vdots & \ddots & \ddots & 0 \\ 0 & 0 & 0 & -e & 1 \\ r_0 & r_2 & r_3 & \cdots & r_{m-1} - e \end{matrix} \right| = -1 \cdot \left| \begin{matrix} 0 & 1 & \ddots & \vdots \\ \vdots & \ddots & \ddots & 0 \\ 0 & 0 & -e & 1 \\ r_0 & r_3 & \cdots & r_{m-1} - e \end{matrix} \right| = \cdots = (-1)^{m-3} \left| \begin{matrix} 0 & 1 \\ r_0 & r_{m-1} - e \end{matrix} \right| = (-1)^{m-2} r_0$

and thus

$\left| \begin{matrix} -e & 1 & 0 & 0 & \cdots & 0 \\ 0 & -e & 1 & 0 & \cdots & 0 \\ 0 & 0 & -e & 1 & \ddots & \vdots \\ 0 & \vdots & \vdots & \ddots & \ddots & 0 \\ 0 & 0 & 0 & 0 & -e & 1 \\ r_0 & r_1 & r_2 & r_3 & \cdots & r_{m-1} - e \end{matrix} \right| = -e \left| \begin{matrix} -e & 1 & 0 & \cdots & 0 \\ 0 & -e & 1 & \ddots & \vdots \\ \vdots & \vdots & \ddots & \ddots & 0 \\ 0 & 0 & 0 & -e & 1 \\ r_1 & r_2 & r_3 & \cdots & r_{m-1} - e \end{matrix} \right| + (-1)^{m-1} r_0$

then use this formula recursively to find that this is equal to

$(-1)^2 e^2 \left| \begin{matrix} -e & 1 & \ddots & \vdots \\ \vdots & \ddots & \ddots & 0 \\ 0 & 0 & -e & 1 \\ r_2 & r_3 & \cdots & r_{m-1} - e \end{matrix} \right| -e (-1)^{m-2} r_1 + (-1)^{m-1} r_0 = \cdots = (-1)^{m-1} r(e)$

Ok, almost equal then. However, in our case with characteristic 2, the -1 is congruent 1 and in any case the equation r(e) = 0 remains the equation that needs to be satisfied in order for e to be an eigenvalue of T.

We already have one root of the characteristic polynomial of T therefore, because r(t) = 0 by definition. As was shown before, the other roots of the reduction polynomial can be obtained by applying Frobenius m - 1 times and we find that the eigenvalues of T are e $\in$ { t, t², t⁴, ..., t^{2^m-1} }. Note that the eigenvector v that belongs to a given eigenvalue e is (1 e e² e³ ... e^m-1)^T (and any vector that can be obtained by multiplying this vector with a non-zero scalar of course; there will be 2^m - 1 different vectors that satisfy Tv = ev).

The trace of a linear transformation T is known to be equal to the sum of the eigenvalues of T. So, we find again that $Tr(t) = \sum_{i=0}^{m-1}{t^{2^i}}$ . Note that the norm of T (its determinant) is known to be equal to the product of the eigenvalues of T. And thus we have T = $\prod_{i=0}^{m-1}{t^{2^i}}$ = t^{(2^m-1)} = 1.

Now we are ready to look new things.

Consider the matrix Tⁿ, then it is obvious that this matrix will have the exact same eigenvectors as T; for the eigenvalue-eigenvector pair (e, v) of T we find that Tⁿ v = eⁿ v and thus v is an eigenvector of Tⁿ with eigenvalue eⁿ.

From this we can conclude that the trace of tⁿ equals the sum $Tr(t^n) = \sum_{i=0}^{m-1}{(t^{2^i})^n} = \sum_{i=0}^{m-1}{t^{2^in}} = \sum_{i=0}^{m-1}{(t^n)^{2^i}}$ . Note that when t is a generator of the field so that any x $\in$ $\mathbb{F}_{2^m}$ can be written as a power of t, then we arrive again at the general formula for the trace of a field element $Tr(x) = \sum_{i=0}^{m-1}{x^{2^i}}$ . If the field is not primitive (t is not a generator), then we just have to find some generator g and use (g, g², g³, ..., g^m-1) as basis and will get the same result. And while we're at it, also note that Tⁿ = $\prod_{i=0}^{m-1}{(g^{2^i})^n}$ = Tⁿ = 1.

We found above that the eigenvalues of T are precisely the roots of the reduction polynomial. That means that we can write the reduction polynomial as

r(t) = (t - e₁)(t - e₂) $\cdots$ (t - e_m)

Where the e_i, the m eigenvalues of T, are the zeros. Expanding and using induction, we see that

r(t) = t^m - S₁t^m-1 + S₂t^m-2 + $\cdots$ + (-1)^mS_m

Or, since we have characteristic 2,

r(t) = t^m + S₁t^m-1 + S₂t^m-2 + $\cdots$ + S_m

where the S_i are the Elementary Symmetric Polynomials of the m variables e₁, e₂, ..., e_m.

Moreover, using the fact that $Tr(t^n) = \sum_{i=0}^{m-1}{(t^{2^i})^n}$ , we can write

Tr(tⁿ) = N_n

where the N_n are the Newton Symmetric Polynomials of the m variables e₁, e₂, ..., e_m.

If we restrict ourselfs to reduction polynomials of the form t^m + t^k₀ + t^k₁ + $\cdots$ + t^k_n + 1, where each k_i $\le$ m / 2, then the first floor((m - 1) / 2) ESP's are zero.

Using the fact that the characteristic of the field is 2, the relationship between NSP's and ESP's becomes

$N_n = nS_n + \sum_{i=1}^{n-1} S_iN_{n-i}$

From this we see immediately that, since S_i = 0 for all i $\le$ floor((m - 1) / 2), also N_i = 0 for all i $\le$ floor((m - 1) / 2). Whence the sum $\sum_{i=1}^{n-1} S_iN_{n-i}$ is zero for any value n < m.

For example, when m = 6 (even m is most critical) then only the first two ESP's and NSP's are garanteed zero: S₁ = S₂ = N₁ = N₂ = 0. And the sum exists of a maximum number of terms when n is maximum, n = m - 1 = 5, resulting in the sum $\sum_{i=1}^{n-1} S_iN_{n-i}$ = S₁N₄ + S₂N₃ + S₃N₂ + S₄N₁ = 0.

In other words, again remembering that the characteristic is 2, we find that for any 0 < n < m

$Tr(t^n) = N_n = \begin{cases} 0 & \text{ n is even } \\ S_n & \text{ n is odd } \end{cases}$

This doesn't cover n = 0, but we already know that Tr(1) = 1 iff m is odd.

QED

Theory: The trace of a field element

THEOREM 6

PROOF