Main Page   Reference Manual   Compound List   File List  

Theory: The trace of a field element

You probably already heard of the trace of a matrix.  It is defined as the sum of the diagonal elements of a square matrix.  What is so special about that?  Well, as explained by that link, the trace is basis invariant.  Let L : K be a finite field extension, like $\mathbb{F}_{2^m}$ is a field extension of $\mathbb{Z}$2.  Given some linear transformation A: L $\rightarrow$ L you can write that linear transformation in the form of a matrix equation (because it is linear) $A_yx = yx$ after chosing some basis for L that associates L with a vector space.  This equation is linear in x because y is fixed.  We already saw discussed one such basis for our field $\mathbb{F}_{2^m}$, elsewhere: (1, t, t2, t3, ..., tm-1).

Lets work out a simple example using this polynomial basis.  Let m = 4, using reduction polynomial t4 + t + 1.  Let y = t, some element of our field $\mathbb{F}$24.  The linear transformation that sends x $\rightarrow$ yx is then given by, Atx = tx.  The trace of the matrix should be independent of the chosen basis, so that we might as well talk about "the trace of the linear transformation", or even about "the trace of y", for y uniquely determines this transformation.  Multiplying with t means that this transformation sends 1 to t, t to t2, ... and tm-2 to tm-1.  Only the transformation of the last member of our polynomial basis is a little different: tm-1 $\rightarrow$ ttm-1 = tk + 1.  Writing out the matrix for the given example gives therefore,

\[ \begin{pmatrix} 0 & 0 & 0 & 1 \\ 1 & 0 & 0 & 1 \\ 0 & 1 & 0 & 0 \\ 0 & 0 & 1 & 0 \\ \end{pmatrix} \begin{pmatrix} x_0 \\ x_1 \\ x_2 \\ x_3 \end{pmatrix} = t \begin{pmatrix} x_0 \\ x_1 \\ x_2 \\ x_3 \end{pmatrix} \]

where xi is the coefficient corresponding to the basis element ti.

We find that in this case the trace is Tr(At) = Tr(t) = 0 (the sum of the diagonal elements of the matrix).  Please note that Tr(y) is an element of K (being $\mathbb{Z}$2 in our case): adding the diagonal elements (which are all element of K) is still done modulo 2!

The more general matrix (for arbitrary m for which there exists an irreducible trinomial tm + tk + 1 that is used as reduction polynomial) leads to the matrix

\[ \begin{pmatrix} 0 & 0 & 0 & \cdots & & & & \cdots & 0 & 1 \\ 1 & 0 & & & & & & & & 0 \\ 0 & 1 & 0 & & & & & & & 0 \\ 0 & & 1 & 0 & & & & & & \vdots \\ \vdots & & & \ddots & \ddots & & & & & 0 \\ & & & & 1 & 0 & & & & 1 \\ & & & & & 1 & 0 & & & 0 \\ \vdots & & & & & & \ddots & \ddots & & \vdots \\ 0 & & & & & & & 1 & 0 & 0 \\ 0 & \cdots & & & & & \cdots & 0 & 1 & 0 \end{pmatrix} \]

where the lower 1 in the right-most column appears in the k-th row, and hence we can immedeately see that

\[ Tr(t) = \begin{cases} 0 & k \neq m - 1 \\ 1 & k = m - 1 \end{cases} \]

Since libecc forbids values of k > m/2, we can safely assume that in our case the trace of t is always 0.

Lets investigate that this trace is indeed independent of the chosen basis by applying a basis transformation.  The only possible basis transformation happens to be applying Frobenius a number of times.  Lets investigate applying Frobenius once.

The Frobenius map sends 1 $\rightarrow$ 1, t $\rightarrow$ t2, t2 $\rightarrow$ t4 = t + 1 and t3 $\rightarrow$ t6 = t3 + t2.  From which follows that the corresponding matrix is

\[ Frob(x) = \begin{pmatrix} 1 & 1 & 0 & 0 \\ 0 & 0 & 1 & 1 \\ 0 & 1 & 0 & 0 \\ 0 & 0 & 0 & 1 \end{pmatrix} \begin{pmatrix} x_0 \\ x_1 \\ x_2 \\ x_3 \end{pmatrix} = \begin{pmatrix} z_0 \\ z_1 \\ z_2 \\ z_3 \end{pmatrix} \]

the inverse of which is

\[ Frob^{-1}(z) = \begin{pmatrix} 1 & 0 & 1 & 0 \\ 0 & 0 & 1 & 0 \\ 0 & 1 & 0 & 1 \\ 0 & 0 & 0 & 1 \end{pmatrix} \begin{pmatrix} z_0 \\ z_1 \\ z_2 \\ z_3 \end{pmatrix} = \begin{pmatrix} x_0 \\ x_1 \\ x_2 \\ x_3 \end{pmatrix} \]

Applying Frobenius to the equation Atx = tx gives Frob(Atx) = Frob(tx) = t Frob(x), where the last equality holds because that t is a constant.  Furthermore, Frob(Atx) = Frob(At Frob-1(Frob(x))) = Frob(At Frob-1(z)), which brings us to the matrix equation

\[ \begin{pmatrix} 1 & 1 & 0 & 0 \\ 0 & 0 & 1 & 1 \\ 0 & 1 & 0 & 0 \\ 0 & 0 & 0 & 1 \end{pmatrix} \begin{pmatrix} 0 & 0 & 0 & 1 \\ 1 & 0 & 0 & 1 \\ 0 & 1 & 0 & 0 \\ 0 & 0 & 1 & 0 \\ \end{pmatrix} \begin{pmatrix} 1 & 0 & 1 & 0 \\ 0 & 0 & 1 & 0 \\ 0 & 1 & 0 & 1 \\ 0 & 0 & 0 & 1 \end{pmatrix} \begin{pmatrix} z_0 \\ z_1 \\ z_2 \\ z_3 \end{pmatrix} = t \begin{pmatrix} z_0 \\ z_1 \\ z_2 \\ z_3 \end{pmatrix} \]

Working out the matrix multiplication we get

\[ \begin{pmatrix} 1 & 0 & 1 & 0 \\ 0 & 1 & 1 & 1 \\ 1 & 0 & 1 & 1 \\ 0 & 1 & 0 & 1 \end{pmatrix} \begin{pmatrix} z_0 \\ z_1 \\ z_2 \\ z_3 \end{pmatrix} = t \begin{pmatrix} z_0 \\ z_1 \\ z_2 \\ z_3 \end{pmatrix} \]

where the zi are the coefficients relative to the basis (1, t2, t + 1, t3 + t2).  And indeed, still we have Tr(t) = 1 + 1 + 1 + 1 = 0.

More in general, any change of basis can be represented with some non-singular matrix (which means that its determinant is non-zero and thus that it has an inverse).  Let the matrix B represent a change of basis, then the matrix At will change into BAt/B, preserving the value of the determinant (see formula 18 on this page) and the value of the trace (see formula 7 on this page).

The following is not a proof in any way, but it gives things a bit a place, and therefore making it easier to understand more mathematical texts that actually derive and prove things, I hope. 

Consider the linear equation (using some basis)

\[ (A_i - \lambda_iI)x_i = 0 \]

Then $\lambda$i are the eigen values of A and xi are the corresponding eigen vectors.  Note that for a fixed $\lambda$i the above represents the linear transformation (Aixi = $\lambda$ixi). 

For the story about eigen values and corresponding eigen vectors, $\lambda$i has to be an element of the base field K ($\mathbb{F}$2), so we really only have one non-trivial eigen value: 1.  Plugging that value into the equation turns A into the identity matrix and trivally all of the vector space into the corresponding eigen space (that is, every value of x is an eigen vector of the identity matrix with scaling factor 1; what else is new).  But we can also consider values for y = $\lambda$i that are element of L, in that case we simply get the equation Ayx = yx which holds per definition for any value x $\in$ L.  Nevertheless, we can still call y eigen value and related theorems still hold, like that the trace of the matrix is the sum of all its eigen values (now elements of L), and the norm of the matrix (its determinant) is the product of all the eigen values.  Below we assume that the eigen values y $\in$ L and you can forget about the concept of eigen vectors: the equations are trivially true for any x.  This paragraph was just added to take away possible confusion about that.

Obviously (Ay - yI) can't have an inverse when (Ay - yI)x = 0 for every x $\in$ $\mathbb{F}_{2^m}$.  The matrix will be singular therefore, its determinant will be zero and we have Ay - yI = 0.  The determinant is a polynomial in y of degree m and the equation is called the characteristic equation (or polynomial) of Ay; the roots are the eigen values of the matrix. 

If we choose y = t and consider

\[ A_tx = tx \]

or

\[ (A_t - tI)x = 0 \]

then the equation At - tI = 0 must be the minimal polynomial of t (that is, a monomial of degree m): it is the reduction polynomial!  The corresponding At will have eigen values that are precisely the roots of the reduction polynomial.  What are those roots?

We already have one root (per definition): t itself.  It is near impossible to write out t in its complex form, that would result in huge formulas if at all possible to find, but we don't have to do that.  We can express the other roots easily in t by repeatedly applying Frobenius.

For example, let the reduction polynomial be t4 + t + 1 = 0.  Then by replacing each t with its square, the equation still holds: (t2)4 + t2 + 1 = t4t4 + t2 + 1 = (t + 1)2 + t2 + 1 = t2 + 1 + t2 + 1 = 0.  And doing that again, it still holds: (t4)4 + t4 + 1 = (t + 1)4 + t4 + 1 = 0, and so on.  After all, the Frobenius map is an automorphism.  Recall that t is a generator of the field and its order is n = 2m - 1, hence n is the smallest positive integer such that tn = 1 and applying Frobenius m - 1 times will lead necessarily to m different values.  The roots of the reduction polynomial are therefore given by the set (t, t2, t22, ..., t2m-1) and they represent the eigen values of the matrix At in the linear transformation Atx = tx, independent of the basis.  The trace of t is then given by the sum of those eigen values and the detAt is given by the product of those eigen values.

The same story holds for an arbitrary value of y (not zero), and we find

\[ Tr(y) = \sum_{i=0}^{m-1}{y^{2^i}} \]

Also note that $det \vert A_y \vert = \prod_{i=0}^{m-1}{y^{2^i}} = y^{2^m-1} = 1$ which makes us jump of joy because it means that every non-zero y has an inverse, as should be the case for field elements!


The roots of the reduction polynomial are not always linear independent and we can't use them as a basis, but it can be proven that there will always exist some element $\beta$ such that ($\beta$, $\beta$2, $\beta$22, ..., $\beta$2m-1) is linear independent.  Such a basis is called a normal basis

As an example, let the reduction polynomial again be t4 + t + 1.  The set (t, t2, t4, t8) = (t, t2, t + 1, t2 + 1) is clearly not linear independent.  However, we can chose $\beta$ = t3 and find a normal basis (t3, t3 + t2, t3 + t2 + t + 1, t3 + t).  If next we want to find the matrix that corresponds with Atx = tx (multiplication with t) then we have to first figure out how the basis elements are converted. 

t(t3) = t4 = t + 1 = (t3 + t2) + (t3 + t2 + t + 1).
t(t3 + t2) = t3 + t + 1 = (t3) + (t3 + t2) + (t3 + t2 + t + 1).
t(t3 + t2 + t + 1) = t3 + t2 + 1 = (t3) + (t3 + t2 + t + 1) + (t3 + t).
t(t3 + t) = t2 + t + 1 = (t3) + (t3 + t2 + t + 1).

And thus we have

\[ \begin{pmatrix} 0 & 1 & 1 & 1 \\ 1 & 1 & 0 & 0 \\ 1 & 1 & 1 & 1 \\ 0 & 0 & 1 & 0 \end{pmatrix} \begin{pmatrix} x_0 \\ x_1 \\ x_2 \\ x_3 \end{pmatrix} = t \begin{pmatrix} x_0 \\ x_1 \\ x_2 \\ x_3 \end{pmatrix} \]

Note that again Tr(t) = 0, as it should be.  Lets have a look at an element whose trace will not be 0 for change, like t3.  Using the above formula for the trace we can immedeately calculate it.

\[ Tr(t^3) = t^3 + t^6 + t^9 + t^{12} = t^3 + (t^3 + t^2) + (t^3 + t^2 + t + 1) + (t^3 + t) = 1 \]

Note that this is exactly the sum of the normal basis that we used above.

Lets do one more check with a matrix, using this same basis.  The basis elements are converted as follows:

t3(t3) = (t3 + t2).
t3(t3 + t2) = (t3 + t).
t3(t3 + t2 + t + 1) = 1 = (t3) + (t3 + t2) + (t3 + t2 + t + 1) + (t3 + t).
t3(t3 + t) = (t3 + t2 + t + 1).

And thus we have

\[ \begin{pmatrix} 0 & 0 & 1 & 0 \\ 1 & 0 & 1 & 0 \\ 0 & 0 & 1 & 1 \\ 0 & 1 & 1 & 0 \end{pmatrix} \begin{pmatrix} x_0 \\ x_1 \\ x_2 \\ x_3 \end{pmatrix} = t^3 \begin{pmatrix} x_0 \\ x_1 \\ x_2 \\ x_3 \end{pmatrix} \]

and as expected, the trace of this matrix is 1.

We can make an interesting observation here.  A vector relative to a normal basis ($\beta$, $\beta$2, $\beta$22, ..., $\beta$2m-1) allows us to denote every single element of the field of course, otherwise it wasn't a basis.  The zero is always given by the vector (0, 0, 0, ..., 0), and thus it is impossible that the vector (1, 1, 1, ... 1), which corresponds to adding all elements of the normal basis, would be zero as well.  Moreover, adding all elements of a normal basis means adding all the roots of $\vert A_\beta - \beta I \vert = 0$, it is equal to the trace of $\beta$, and a trace is element of the base field and can therefore only be equal to 0 or 1 in our case!  Hence, in order for ($\beta$, $\beta$2, $\beta$22, ..., $\beta$2m-1) to be a normal basis we must have 0 $\neq$ Tr($\beta$) = 1 !

Now consider the following magic.  When $\beta$, in combination with Frobenius, can be used to form a normal basis, then so can $\beta$2 because if you replace $\beta$ with $\beta$2 in the basis you simply get ($\beta$2, $\beta$22, ..., $\beta$2m-1, $\beta$).  Therefore, it must be that Tr($\beta$2) = 1 too.  The inverse is also true, if $\beta$2 can be used to generate a normal basis then so can $\beta$.  Hence, we can conclude that for any arbitrary element y

\[ Tr(y) = Tr(Frob(y)) \]

This result is not too weird, considering that Frobenius is an automorphism that basically just changes the basis - and as we saw before, the trace is not dependent on the basis.

In other words, Tr(y - Frob(y)) = Tr(y) - Tr(Frob(y)) = 0.  And therefore we can conclude that the equation x = y + y2 can only have solutions when Tr(x) = 0 ! Note that Frob(y) = y2 and that, since we are working with characteristic 2, y + y2 = y - y2.

And this is the result I needed to prove Hypothesis 1.

THEOREM 5

Let x $\in$ $\mathbb{F}_{2^m}$.  Then Tr(x) = 0 iff there exists a y $\in$ $\mathbb{F}_{2^m}$ such that x = y + y2.

PROOF

There is another, easy way to prove theorem 5.  Suppose there is a solution to the equation x = y + y2, so that for a given x and y the equation is true.  Then applying Frobenius to both sides (squaring both sides) results again in in an equation that is true of course.  We can repeat squaring both sides precisely m - 1 times at which point the term y2 will turn into y because y2m = y.  If we subsequently add up all those equations we get immedeate proof that the trace of x is 0.

\[ \] \begin{eqnarray*} x &=& y + y^2 \\ x^2 &=& y^2 + y^4 \\ x^4 &=& y^4 + y^8 \\ \vdots \\ x^{2^{m-2}} &=& y^{2^{m-2}} + y^{2^{m-1}} \\ x^{2^{m-1}} &=& y^{2^{m-1}} + y \end{eqnarray*} \[ \]

where the sum of all left-hand-sides is precisely the trace of x and the sum of all right-hand-sides is zero!


Weew, you have no idea how glad I am that I finally got to this point without using sophisticated mathematics!  I worked five days on the above.  Hopefully I reached my goal and you are now reasonably comfortable with Frobenius and traces.  Just for the kicks (and so you appreciate my efforts a bit more), here is the "sophisticated" derivation:

Let G be the Galois group of the Galois extension L/K, then $H^1(G,L) = H^1(G,L^*) = 0$ (Hilbert's theorem 90).  Therefore, if G is cyclic with generator g, this is the same as Norm(x) = 1 $\iff$ x = y/g(y).  And Tr(x) = 0 $\iff$ x = y - g(y).

Also trace (of field elements) is usually explained with Galois theory.  Maybe I'll add a chapter about Galois Theory later to this project.

Copyright © 2002-2004 Carlo Wood.  All rights reserved.