The purpose of this paper is to give an elementary and self-contained proof that one may efficiently compute zeta functions of arbitrary varieties of fixed dimension over finite fields of suitably small characteristic. This is achieved via the p-adic methods developed by Dwork in his proof of the rationality of the zeta

function of a variety over a finite field [Dwork 1960; 1962]. Dwork’s theorem shows that it is in principle possible to compute the zeta function. Our main contribution is to show how Dwork’s trace formula, Bombieri’s degree bound [1978] and a semilinear reduction argument yield an efficient algorithm for doing so. That p-adic methods may be used to efficiently compute zeta functions for small characteristic was first suggested in [Wan 1999; 2008], where Wan gives a simpler algorithm for counting the number of solutions to an equation over a finite field modulo small powers of the characteristic.

The definition of the spaces of modular forms as functions on the upper half plane satisfying a certain equation is very abstract. The definition of the Hecke operators even more so. Nevertheless, one wishes to carry out explicit investigations involving these objects.

We are fortunate that we now have methods available that allow us to transform the vector space of cusp forms of given weight and level into a concrete object, which can be explicitly computed. We have the work of Atkin–Lehner, Birch, Swinnerton-Dyer, Manin, Mazur, Merel, and many others to thank for this (see, e.g., [Birch and Kuyk 1975; Cremona 1997; Mazur 1973; Merel 1994]). For example, we can use the Eichler–Selberg trace formula, as extended in [Hijikata 1974], to compute characteristic polynomials of Hecke operators. Then the method described in [Wada 1971] gives a basis for certain spaces of modular forms. Alternatively, we can compute ⊝-series using Brandt matrices and quaternion algebras as in [Kohel 2001; Pizer 1980], or we can use a closely related geometric method that involves the module of enhanced supersingular elliptic curves [Mestre 1986]. Another related method of Birch [1991] is very fast, but gives only a piece of the full space of modular forms. The power of the modular symbols approach was demonstrated by Cremona in his book [1997], where he systematically computes a large table of invariants of all elliptic curves of conductor up to 1000 (his online tables [Cremona undated] go well beyond 100,000).

In Section 2 we discuss the Miller–Rabin test. This is one of the most efficient probabilistic primality tests. Strictly speaking, the Miller–Rabin test is not a primality test but rather a ‘compositeness test’, since it does not prove the primality of a number. Instead, if n is not prime, the algorithm proves this in all likelihood very quickly. On the other hand, if n happens to be prime, the algorithm merely provides strong evidence for its primality. Under the assumption of the Generalized Riemann Hypothesis one can turn the Miller–Rabin algorithm into a deterministic polynomial time primality test. This idea, due to G. Miller, is also explained.

In Section 3 we describe the deterministic polynomial time primality test that was proposed by M. Agrawal, N. Kayal and N. Saxena in 2002 [Agrawal et al. 2004]. At the moment of this writing, this new test, or rather a more efficient probabilistic version of it, had not yet been widely implemented. In practice, therefore, for proving the primality of a given integer, one still relies on older tests that are either not provably polynomial time or not deterministic. In the remaining two sections we present the two most widely used such tests.

This survey discusses some innocent-looking longstanding unsolved problems: the congruent number problem , and the perfect rational cuboid problem , as applications of algorithmic number theory. These problems are indeed very old; the congruent number problem dates back to the time of the Greeks; and the perfect rational cuboid problem to the time of Euler or earlier. Accordingly, there are a large number of articles attempting to solve the problems with various different approaches, most of which use elementary number theoretic methods.

We take a geometric approach to the problems, by reformulating them as arithmetic questions (e.g., the existence of rational points) on certain curves and surfaces. We first consider the classical congruent number problem and a generalization to arbitrary rational triangles (not necessarily right-angled), and in particular the 2π/3-congruent number problem.

Daniel Shanks [1972] observed that the forms in the principal cycle of reduced binary quadratic forms of positive discriminant exhibit a group-like behavior. This was a surprising phenomenon, because the principal cycle itself constitutes the trivial class of the class group. Shanks called this group-like structure ‘inside’ the neutral element of the class group the infrastructure . He exploited it by designing an efficient algorithm to compute the regulator of a real quadratic number field. Later, H. W. Lenstra [1982] (see also [Schoof 1982]) made Shanks’ observations more precise, introducing a certain topological group and providing a satisfactory framework for Shanks’s algorithm. Both Shanks [1976, Section 1; 1979, 4.4], and Lenstra [1982, section 15] indicated that the infrastructure ideas could be generalized to arbitrary number fields. This was done first by H.Williams and his students [Williams et al. 1983] for complex cubic fields, then by J. Buchmann [1987a; 1987b; 1987c] and by Buchmann and Williams [1989]. Finally Buchmann [1990; 1991] described an algorithm for computing the class group and regulator of an arbitrary number field that, under reasonable assumptions, has a subexponential running time. It has been implemented in the computer algebra packages LiDIA, MAGMA and PARI.

Cryptography protects communications against espionage: an eavesdropper who intercepts a message will be unable to decipher it. This is useful for many types of information: credit-card transactions, medical records, love letters.

Cryptography also protects communications against sabotage: a forger who fabricates or modifies a message will be unable to deceive the receiver. This is useful for alltypes of information. If the receiver does not care about the authenticity of a message, why is he listening to the message in the first place?

This paper explains how cryptography prevents forgery. Section 2 explains how to protect nmessages if the sender and receiver share 128(n + 1)secret bits. Section 3 explains how the sender and receiver can generate many shared secret bits from a short shared secret. Section 4 explains how the sender and receiver can generate a short shared secret from a public conversation. Section 5 explains how the sender can protect a message sent to many receivers, without sharing any secrets.

Our subject arises out of two roots of mathematical thought: fascination with properties of whole numbers and the urge to compute. Number theory and computer science flowered vividly during the last quarter of the twentieth century, and the synergy at their intersection was striking. Algorithmic number theory emerged as an exciting field in its own right, containing deep insights and having surprising applications.

In the fall of 2000 the Mathematical Sciences Research Institute, Berkeley, hosted a one-semester program on algorithmic number theory. Its opening workshop, cosponsored by the Clay Mathematics Institute, featured many foundational and survey talks. During the meeting, it was noted that there was a dearth of sources for newcomers to the field. After the conference, some of the speakers agreed to write articles based on their talks, and we were drafted to edit the volume.

A few authors turned in drafts promptly, some retaining the tutorial focus and tone of the original talks, while others were full-blown tutorials or surveys. Many authors (including the editors) dallied. Additional articles were solicited, to provide more coherence and to incorporate newer results that couldn’t be ignored (most notably, the polynomial-time primality algorithm due to Manindra Agrawal, Neeraj Kayal, and Nitin Saxena). This led to complications that might have been expected for a volume with 20 substantial articles, 15 authors, and 650 pages. These have finally run their course, and we are delighted that the volume is ready to see the light of day.

We do apologize to the authors who responded promptly, and can only hope that they will be compensated by the greater breadth and interest of the volume in which their contributions appear.

The articles in the volume can be loosely categorized as follows. The first two articles are introductory, and are more elementary than their successors—they attempt to entice the reader into pursuing the ideas more deeply. The next eight articles provide surveys of central topics, including smooth numbers, factoring, primality testing, lattices, elliptic curves, algebraic number theory, and fast arithmetic algorithms. The remaining ten articles study specific topics more deeply, including cryptography, computational algebraic number theory, modular forms, and arithmetic geometry.

Although the articles in this volume are surveys in the broadest sense, the word should not be taken to mean an encyclopedic treatment that captures current conventional wisdom. We prefer the term overviews, and the articles have a distinctive and in some cases even nonstandard perspective.

The number field sieve is a factoring algorithm that tries to factor a hard composite number by exploiting factorizations of smooth numbers in a well-chosen algebraic number field. It is similar in nature to the quadratic sieve algorithm, but the underlying number theory is less elementary, and the actual implementation involves a fair amount of optimization of the various parameters.

The key idea of the algorithm, the use of smooth numbers in number rings different from , was proposed in 1988 by Pollard. Many people have contributed theoretical and practical improvements since then. An excellent reference for many of the details left out in this paper is [Lenstra and Lenstra 1993]. It contains complete bibliography of the early years of the number field sieve, as well as original contributions by most of the main developers of the algorithm.

Among the successes of the algorithm are the 2005 factorization of the 663-bit RSA challenge number into a product of two primes of 100 decimal digits each, and the factorization in 2006 of the 275-digit Cunningham number.

This paper presents fast algorithms for several useful arithmetic operations on polynomials, power series, integers, real numbers, and 2-adic numbers.

Each section focuses on one algorithm for one operation, and describes seven features of the algorithm:

• • Input: What numbers are provided to the algorithm? Sections 2, 3, 4, and 5 explain how various mathematical objects are represented as inputs.

• • Output: What numbers are computed by the algorithm?

• • Speed: How many coefficient operations does the algorithm use to perform a polynomial operation? The answer is at most n1+o(1) , where nis the problem size; each section states a more precise upper bound, often using the function μdefined in Section 4.

• • How it works: What is the algorithm? The algorithm may use previous algorithms as subroutines, as shown in (the transitive closure of) Figure 1.

• • The integer case (except in Section 2): The inputs were polynomials (or power series); what about the analogous operations on integers (or real numbers)? What difficulties arise in adapting the algorithm to integers? How much time does the adapted algorithm take?

A latticeis a discrete subgroup of a Euclidean vector space, and geometry of numbersis the theory that occupies itself with lattices. Since the publication of Hermann Minkowski’s Geometrie der Zahlen in 1896, lattices have become a standard tool in number theory, especially in the areas of diophantine approximation, algebraic number theory, and the arithmetic theory of quadratic forms.

The theory of continued fractions, principally developed by Leonhard Euler (1707–1783), is in substance concerned with algorithmic aspects of lattices of rank 2. A significant advance in the algorithmic theory of lattices of general rank occurred in the early 1980’s, with the development of the powerful lattice basis reduction algorithm that came to be called the LLL algorithm [Lenstra et al. 1982]. The LLL algorithm has found numerous applications in both pure and applied mathematics.

In algorithmic number theory, geometry of numbers now plays a role that is comparable to the role that linear programming plays in optimization theory, and that linear algebra plays throughout mathematics. This is due to a similar combination of circumstances: good algorithms are available for solving the basic problems, and many commonly encountered problems reduce to those basic problems. Just as a multitude of problems in mathematics can be linearized, so can many others be addressed by the introduction of a suitable lattice. Typically, this applies to problems that have both a discrete and a continuous component, such as the search for a system of integers that satisfies certain inequalities. Algorithmic number theory abounds in such problems.

This paper illustrates, improves, and unifies a variety of previous results on finding divisors in residue classes (Lenstra, Konyagin, Pomerance, Coppersmith, Howgrave-Graham, Nagaraj), divisors in short intervals (Rivest, Shamir, Coppersmith, Howgrave-Graham), modular roots (H˚astad, Vall´ee, Girault, Toffin, Coppersmith, Howgrave-Graham), highpower divisors (Boneh, Durfee, Howgrave-Graham), and codeword errors beyond half distance (Sudan, Guruswami, Goldreich, Ron, Boneh).

Given a cyclic group G with generator g, and given an element t in G, the discrete logarithm problem is that of computing an integer l with gl = t . The problem of computing discrete logarithms is fundamental in computational algebra, and of great importance in cryptography. In this lecture we shall examine how sometimes the problem may be reduced to the computation of discrete logarithms in smaller groups (though this reduction may not always lead to an easier problem). We give an example of how the reduction may be used profitably in taking “square roots” in cyclic groups of even order. We shall look at several exponential-time algorithms that work in a quite general setting, and we shall discuss the index calculus algorithm for taking discrete logarithms in the multiplicative group of integers modulo a prime.

Our subject combines the ancient charms of number theory with the modern fascination with algorithmic thinking. Newcomers to the field can appreciate this conjunction by studying the many elementary pearls in the subject. The aim here is to describe a few of these gems with the combined goals of providing background for subsequent articles in this volume, and luring the reader into pursuing full-length treatments of the subject, such as [Bach and Shallit 1996; Bressoud and Wagon 2000; Cohen 1993; Crandall and Pomerance 2005; Knuth 1981; von zur Gathen and Gerhard 2003; Shoup 2005].

Many details will be left to the reader, and we will assume that he or she knows (or can look up) basic facts from number theory, algebra, and elementary programming.

We tend to focus more on the mathematics and less on the sometimes fascinating algorithmic details. However, the subject is grounded in, and motivated by, examples; one can learn interesting and surprising things by actually implementing algorithms in number theory. Implementing almost any of the algorithms here in a modern programming language isn’t too hard; we encourage budding number theorists to follow the venerable tradition of their predecessors: write programs and think carefully about the output.

The zeta function contains important arithmetic and geometric information concerning X. It has been studied extensively in connection with the celebrated Weil conjectures [1949].

Both practical applications and theoretical investigations make a good understanding of the zeta function from an algorithmic point of view increasingly important. The aim of this paper is to present a brief introductory account of the various fundamental problems and results in the emerging algorithmic theory of zeta functions. We shall focus on general properties rather than on results that are restricted to special cases. In particular, in most of this paper we do not assume X to be smooth and projective, although in that case one can often say more.

The contents are organized as follows. In Section 2 we review general properties of zeta functions from an algorithmic point of view. A naive effective algorithm for computing the zeta function is given. If the characteristic p is small, one can use Dwork’s p-adic method to obtain a polynomial time algorithm for computing the zeta function in the case that the numbers of variables and defining equations for X are fixed.