[Paper Review] Solving $x^{2^k+1}+x+a=0$ in $\mathbb{F}_{2^n}$ with $\gcd(n,k)=1$

K. H. Kim, Sihem Mesnager|arXiv (Cornell University)|Mar 18, 2019

Coding theory and cryptography10 references4 citations

TL;DR

This paper provides a complete solution to the equation $x^{2^k+1} + x + a = 0$ over $\mathbb{F}_{2^n}$ under the condition $\gcd(n,k) = 1$, explicitly computing all possible roots in terms of $a$ using M"uller-Cohen-Matthews polynomials and Dickson polynomials. The key contribution is a full characterization of when the equation has 0, 1, or 3 solutions, resolving a long-standing open problem in finite field theory and providing explicit formulas for all cases.

ABSTRACT

Let $N_a$ be the number of solutions to the equation $x^{2^k+1}+x+a=0$ in $\GF {n}$ where $\gcd(k,n)=1$. In 2004, by Bluher \cite{BLUHER2004} it was known that possible values of $N_a$ are only 0, 1 and 3. In 2008, Helleseth and Kholosha \cite{HELLESETH2008} have got criteria for $N_a=1$ and an explicit expression of the unique solution when $\gcd(k,n)=1$. In 2014, Bracken, Tan and Tan \cite{BRACKEN2014} presented a criterion for $N_a=0$ when $n$ is even and $\gcd(k,n)=1$. This paper completely solves this equation $x^{2^k+1}+x+a=0$ with only condition $\gcd(n,k)=1$. We explicitly calculate all possible zeros in $\GF{n}$ of $P_a(x)$. New criterion for which $a$, $N_a$ is equal to $0$, $1$ or $3$ is a by-product of our result.

Motivation & Objective

• To completely solve the equation $x^{2^k+1} + x + a = 0$ over $\mathbb{F}_{2^n}$ under the condition $\gcd(n,k) = 1$, which had only partial results in prior work.
• To provide explicit formulas for all possible roots in $\mathbb{F}_{2^n}$, resolving the open problem of characterizing the number and nature of solutions.
• To unify and extend previous results on the number of solutions ($N_a = 0, 1, 3$) by deriving new criteria based on algebraic structure and trace conditions.
• To establish a decomposition of the root-finding problem into two independent subproblems: preimage computation under M"uller-Cohen-Matthews and Dickson polynomials.

Proposed method

• The problem is reduced to the case where $k$ is odd by symmetry, leveraging properties of finite fields and polynomial identities in characteristic 2.
• A key polynomial identity from [3] is used to decompose the root-finding problem into two independent subproblems: solving for preimages under M"uller-Cohen-Matthews (MCM) and Dickson polynomials.
• The MCM preimage problem is solved by relating the MCM polynomial to the Dobbertin polynomial and deriving an explicit solution formula for the affine equation $x^{2^k} + x = b$.
• The Dickson polynomial preimage problem is solved using known properties of Dickson polynomials, particularly the identity $D_k(x + 1/x) = x^k + x^{-k}$.
• The solution is constructed by combining the results from both subproblems, leading to explicit expressions for all roots in terms of $a$, $k$, and $n$.
• Trace conditions are derived to determine whether $T$ or $T'$ lies in $\mathbb{F}_{2^n}$, which directly determines the number of solutions.

Experimental results

Research questions

• RQ1 Under what conditions on $a \in \mathbb{F}_{2^n}^*$ does the equation $x^{2^k+1} + x + a = 0$ have exactly one solution in $\mathbb{F}_{2^n}$ when $\gcd(n,k) = 1$?
• RQ2 When does the equation have three distinct solutions, and what is the explicit form of these solutions?
• RQ3 When does the equation have no solutions, and how can this be characterized algebraically?
• RQ4 Can the roots be expressed in closed form using known special polynomials such as M"uller-Cohen-Matthews and Dickson polynomials?

Key findings

• The equation $x^{2^k+1} + x + a = 0$ has exactly 0, 1, or 3 solutions in $\mathbb{F}_{2^n}$ when $\gcd(n,k) = 1$, confirming earlier conjectures.
• Explicit formulas are provided for all roots in terms of $a$, $k$, and $n$, using M"uller-Cohen-Matthews and Dickson polynomials.
• For odd $k$, the number of solutions depends on whether $T = 1 + \frac{1}{S_{n,k}(R_{k,k'}(a^{-q/2}))}$ is a cube in $\mu_{2^n+1}^*$ or lies in $\mathbb{F}_{2^n}$.
• For even $k$, the number of solutions is determined by whether $T' = 1 + \frac{1}{S_{n,l}(R_{l,l'}(a^{-(q')^2/2}))}$ is a cube in $\mu_{2^n+1}^*$ or lies in $\mathbb{F}_{2^n}$.
• When $k$ is odd and $T \in \mathbb{F}_{2^n}$, the equation has a unique solution given by $\frac{(c + 1/c)^{q-1}}{Y T_k(1/Y)^{2/q}}$ with $c = T^{(q+1)^{-1} \mod 2^n - 1}$ and $Y = T + 1/T$.
• The results recover and generalize previous criteria from Helleseth and Kholosha (2008) and Bracken et al. (2014), unifying them under a single framework.