\documentclass[12pt]{article}
\voffset=-0.05\textheight
\textheight=1.1\textheight
\hoffset=-0.04\textwidth
\textwidth=1.08\textwidth

\bibliographystyle{amsplain}
\usepackage{graphicx}
\usepackage{psfrag}
\usepackage[all]{xy}
\usepackage{fancybox}
\include{macros}
\title{Factoring Primes in Rings of Integers}
\author{William A. Stein {\sf (was@math.harvard.edu)}}
\begin{document}
\maketitle
\begin{center}
\shadowbox{
\includegraphics[width=20em]{spec.eps}}\\
A diagram from \cite{lenstras:nfs}.
\end{center}

\begin{tabular}{lr}
{\begin{minipage}{4in}
``The obvious mathematical breakthrough would be development of an easy
way to factor large prime numbers.''
\mbox{ }\hfill --{Bill Gates, {\em The Road Ahead}, pg. 265}
\end{minipage}}
&
\begin{minipage}{2in}
\mbox{}\vspace{3ex}
\includegraphics[width=1in]{gates.eps}
\end{minipage}
\\
\end{tabular}

\section{Introduction}
A {\em prime ideal} of a commutative ring $R$ is an 
ideal~$\p$ such that $R/\p$ is an integral domain,
and an ideal~$\p$ is {\em maximal} if $R/\p$ is a field.
Let $K=\Q(\alpha)$ be a number field, and let $\O_K$ be the ring of
all elements of~$K$ that are integral over~$\Z$.  As you know, $\O_K$
is a Dedekind domain.

In order to employ our geometric intuition, 
we may view $\O_K$ as a one-dimensional ``scheme'' 
$$
  X = \Spec(\O_K) = \{\text{ all prime ideals of $\O_K$ }\}
$$
``over''
$$
  Y=\Spec(\Z) = \{ (0) \} \union \{ p\Z : p \in\Z \text{ is prime }\}.
$$ 
There is a natural map $f:X\ra Y$ that sends a prime ideal $\p\in X$ to
$\p\intersect \Z\in Y$.   For much more on this point of view,
see \cite[Ch.~2]{eisenbud_harris:geometry}.

Ideals were originally introduced by Kummer because in rings of integers
of number fields ideals factor uniquely as products of primes ideals,
which is something that is not true for general algebraic integers.
(The failure of unique factorization for algebraic integers was
used by Liouville to ``destroy'' Lam\'{e}'s purported 1847 ``proof''
of Fermat's Last Theorem.)

If $p\in\Z$ is a prime number, then the
ideal $p\O_K$ of $\O_K$ factors uniquely as a product $\prod
\p_i^{e_i}$, where the $\p_i$ are maximal ideals of $\O_K$.
Viewed {\em geometrically}, the decomposition of $p\O_K$ into prime ideals
in $\O_K$ is the same as the fiber $f^{-1}(p\Z)$ (plus 
ramification data).  We are concerned with how to compute
$f^{-1}(p\Z)$ in practice.

\begin{example}
The following \magma{} session shows the commands needed to compute 
the factorization of $p\O_K$ in \magma{} for~$K$ the number field
defined by a root of $x^5+7x^4+3x^2-x+1$.
\begin{verbatim}
> K<a> := NumberField(x^5+7*x^4+3*x^2-x+1);
> OK := MaximalOrder(K);
> I := 2*OK;
> Factorization(I);
[
<Principal Prime Ideal of OK
Generator:
[2, 0, 0, 0, 0], 1>
]
> Factorization(Discriminant(OK));
[ <5, 1>, <353, 1>, <1669, 1> ]
> J := 5*OK;
> Factorization(J);
[
<Prime Ideal of OK
Two element generators:
[5, 0, 0, 0, 0]
[2, 1, 0, 0, 0], 1>,
<Prime Ideal of OK
Two element generators:
[5, 0, 0, 0, 0]
[3, 1, 0, 0, 0], 2>,
<Prime Ideal of OK
Two element generators:
[5, 0, 0, 0, 0]
[2, 4, 1, 0, 0], 1>
]
> [K!OK.i : i in [1..5]];
[ 1, a, a^2, a^3, a^4 ]
\end{verbatim}
Thus $2\O_K$ is already a prime ideal, and 
$$ 
  5\O_K = (5,2+a)\cdot(5,3+a)^2\cdot(5,2+4a+a^2).
$$
Notice that in this example $\O_K=\Z[a]$.  But be warned---in general,
one can not find an~$a$ such that $\O_K=\Z[a]$ (see Example~\ref{ex:dedekind}
below).  When $\O_K=\Z[a]$
it is very easy to factor $p\O_K$, as we will see below.  
The following factorization gives a hint as to why:
$$
  x^5+7x^4+3x^2-x+1 \con (x+2)\cdot (x+3)^2 \cdot (x^2+4x+2)\pmod{5}.
$$

The exponent~$2$ of $(5,3+a)^2$ in the factorization of $5\O_K$ above
suggests ``ramification'',
in the sense that the cover $X\ra Y$ has less points (counting their ``size'', i.e.,
their residue class degree) in its fiber over~$5$ than
it has generically.  Here's a suggestive picture:
\begin{center}
\psfrag{p1}{$(5,2+4a+a^2)$}
\psfrag{p2}{$(5,3+a)^2$}
\psfrag{p3}{$(5,2+a)$}
\psfrag{p}{$5\Z$}
\psfrag{q1}{$2\O_K$}
\psfrag{q}{$2\Z$}
\psfrag{zero}{$(0)$}
\psfrag{r}{$3\Z$}
\psfrag{s}{$7\Z$}
\psfrag{t}{$11\Z$}
\shadowbox{\includegraphics[width=30em]{cover1.eps}}

Diagram of $\Spec(\O_K) \ra \Spec(\Z)$
\end{center}

\end{example}

\section{A Method that Usually Works}
Suppose $\alpha\in\O_K$ is such that $K=\Q(\alpha)$, and let
$g(x)$ be the minimal polynomial of~$\alpha$.  Then
$\Z[\alpha]\subset \O_K$, and we have a diagram of schemes
$$\xymatrix{
  {(??)\, }\ar@{^(->}[r]\ar[d]               &{\Spec(\O_K)}\ar[d]  \\
{\bigcup\Spec((\Z/p\Z)[x]/(\overline{g}_i^{e_i}))\,}\ar@{^(->}[r] \ar[d]
         &{\Spec(\Z[\alpha])}\ar[d] \\%\ar@{=}[r] & \Spec(\Z[x]/g(x))\\
{\Spec(\Z/p\Z)\,}\ar@{^(->}[r]&{\Spec(\Z)}
}$$
where $\overline{g} = \prod_i \overline{g}_i^{e_i}$
is the factorization of the image of $g$ in $(\Z/p\Z)[x]$.

The cover $\Spec(\Z[\alpha])\ra \Spec(\Z)$ is easy to understand
because it is defined by the single
equation $g(x)$.  To give a maximal ideal $\p$ of $\Z[\alpha]$ 
such that $f(\p) = p\Z$ is the same as giving a homomorphism
$\Z[x]/(g) \ra \Fbar_p$, which is in turn the same as giving
a root of~$g$  in $\Fbar_p$ (an allowed place where $x$ can go).   
If the index of $\Z[\alpha]$ in $\O_K$ is coprime to~$p$, 
then the primes $\p_i$ in the factorization of $p\O_K$
don't decompose further going from $\Z[\alpha]$ to $\O_K$,
so we are done (the homomorphisms $\Z[\alpha]\ra\Fpbar$ are
in bijection with the homomorphisms $\O_K\ra\Fpbar$).  
We formalize this in the following theorem:
\begin{theorem}\label{thm:fac1}
Let $g(x)$ denote
the minimal polynomial of~$\alpha$ over~$\Q$.
Let $p$ be a prime number that does not divide $[\O_K:\Z[\alpha]]$.
Suppose that
$$
 \overline{g} = \prod_{i=1}^t \overline{g}_i^{e_i} \in (\Z/p\Z)[x]
$$
with the $\overline{g}_i$ distinct monic irreducible
polynomials.  
Let 
$
  \p_i = (p,g_i(\alpha))
$
with $g_i\in\Z[x]$ any polynomial whose 
image is $\overline{g}_i$ in $(\Z/p\Z)[X]$.
Then
$$
  p\O_K = \prod_{i=1}^t \p_i^{e_i}.
$$
Geometrically, 
$$
  f^{-1}(p\Z) = \{\p_1,\p_2,\ldots, \p_t\},
$$
(with multiplicities $e_i$).
\end{theorem}



\section{Method that Always Works}
Unfortunately, there are numbers fields $K$ such that $\O_K$
is not of the form $\Z[\alpha]$ for any $\alpha\in K$.
Even worse, Dedekind found a field~$K$
such that $2\mid [\O_K : \Z[\alpha]]$ for {\em all} $\alpha\in \O_K$,
so Theorem~\ref{thm:fac1} can not be used to factor~$2$
(see Example~\ref{ex:dedekind} below).

I looked in a large handful of algebraic number theory books, and
found only one (see \cite[\S6.2]{cohen:course_ant}) that reports
on how to solve the general problem of computing the maximal ideals of
$\O_K$ over a given prime~$p$.  In general, this appears to be a
surprising problem, in the sense that the algorithms to solve it are
much more sophisticated than Theorem~\ref{thm:fac1}.  However,
these complicated algorithms all run very quickly in practice.

For simplicity we consider the following slightly easier problem,
whose solution contains the key ideas.  Let $\O$ be any {\em order} in
$\O_K$, i.e., a subring of $\O_K$ such that the additive abelian group
$\O_K/\O$ is finite.  Let $[\O_K : \O] = \#(\O_K/\O)$.
\begin{problem}
For any prime $p\in\Z$, compute the set of maximal ideals of~$\O$ that
contain~$p$.
\end{problem}

\hd{Solution (sketch).}

{\sf 
Let $K=\Q(\theta)$ be a number field given
by an algebraic integer $\theta$ as root of its
minimal monic polynomial~$F$ of degree~$n$.
We assume that an order $\O$ has been 
given by a basis $\omega_1,\ldots,\omega_n$
and that $\O$ that contains $\Z[\theta]$.

Given a prime number $p\in\Z$, the following ({\em sketch} of an) algorithm
computes the primes $\p_i\in\Spec(\O)$ lying over $p$, i.e., the
maximal ideals $\p_i$ of $\O$ that contain~$p$.  Each of the following
steps can be carried out very efficiently using little more
than linear algebra over $\F_p$.  The details are in \cite[\S6.2.5]{cohen:course_ant}.
\begin{enumerate}
\item{} [Check if easy] If $p\nmid \disc(\Z[\theta]) / \disc(\O)$ then
by a slight modification of Theorem~\ref{thm:fac1}, we
easily factor~$p\O$.
\item{} [Compute radical] Using linear algebra over the finite field 
$\F_p$,  compute a basis for $I/p\O$, where~$I$ is the radical of $p\O$.
(The {\em radical} of $p\O$ is the ideal of elements $x\in\O$ such that $x^m\in p\O$ 
for some positive integer~$m$.)
\item{} [Compute quotient] 
Compute an $\F_p$ basis of 
$$
  A = \O/I = (\O/p\O)/(I/p\O).
$$
\item{} [Decompose] Decompose~$A$ as a product $A \isom \prod \F_p[x]/g_i(x)$ of fields.
\item{} [Compute the maximal ideals] Each maximal ideal $\p_i$ lying over~$p$ 
is the kernel of $\O \ra A \ra F_p[x]/g_i(x)$.
\end{enumerate}
}



\section{Essential Discriminant Divisors}
\begin{definition}
A prime $p$ is an {\em essential discriminant
divisor} if $p\mid [\O_K : \Z[\alpha]]$ for 
{\em every} $\alpha\in\O_K$.
\end{definition}

\begin{example}[Dedekind]\label{ex:dedekind}
Let $K=\Q(\theta)$ be the cubic field defined by the polynomial
$f = x^3 + x^2 - 2x+8$.  We will use MAGMA, which implements the algorithm
described in the previous section, to show that~$2$ is an essential
discriminant divisor for~$K$.
\begin{verbatim}
> K := NumberField(x^3 + x^2 - 2*x + 8);
> OK := MaximalOrder(K);
> Factorization(2*OK);
[
<Prime Ideal of OK
Basis:
[2 0 0]
[0 1 0]
[0 0 1], 1>,
<Prime Ideal of OK
Basis:
[1 0 1]
[0 1 0]
[0 0 2], 1>,
<Prime Ideal of OK
Basis:
[1 0 1]
[0 1 1]
[0 0 2], 1>
]
\end{verbatim}
Thus $2\O_K=\p_1\p_2\p_3$ with the $\p_i$ distinct and 
$\O_K/\p_i\isom \F_2$.  If $\O_K=\Z[\alpha]$
for some $\alpha\in\O_K$ with minimal polynomial~$g$, then 
$\overline{g}(x)\in\F_2[x]$ must be a product of three {\em distinct} 
linear factors, which is impossible.
\end{example}


\bibliography{biblio}
\end{document}

\section{Preparation Notes}
(not part of actual lecture notes)
\begin{itemize}
\item Pages 78--82 of Marcus discusses the naive algorithm for factoring
primes, which works great for primes that are not ``essential discriminant
divisors''.  He says nothing about what to do with essential divisors.

\item Cohn, pages 86--? also discusses the naive algorithm.  Lemma 10.44c on
page 95 gives a sufficient condition for a prime~$p$ to be an
essential discriminant divisor, and gives an example of a number field
and an essential prime.  Are there unramified primes that always
divide the index $[\O:\Z[\alpha]]$.

\item It is easy to type a harmless-looking degree $20$ polynomial
like $x^{20}+35x^{15}+17x^{14}+3x-19$ into a number theory package
(e.g., PARI, MAGMA) and ask to construct the corresponding maximal
order then factor primes, but that will takes too long (PARI can do it
in under 10 minutes).  If you understand something about the
algorithms, you'll realize that it is vastly better to construct the
order $\Z[\alpha]$ ($\alpha$ root of poly) and hope that $p\nmid
\disc(\alpha)$.  If $p\mid \disc(\alpha)$, then things can be much
more complicated, but you can still get useful information.

\item 
\begin{verbatim}
> time K := SplittingField(NumberField(x^4+2*x+7));
Time: 188.070
\end{verbatim}


\end{itemize}



%Frequently (at least in my research on modular
%Galois representations), one is given a subring~$R$ of $O_K$ by a list
%of a few (hundred!) generators,~$K$ has large degree over~$\Q$, and
%one must find all primes in~$R$ of small residue characteristic, which
%amounts to factoring all small primes~$p$ in~$R$; we quickly run into
%trouble if we try to only work with rings of the form $\Z[\alpha]$.

Maybe (but probably not) tell this story:
Taylor and Wiles proved Fermat's last theorem by proving that
certain elliptic curves are modular, and they did this by proving
that certain Galois representations are modular.  Modularity of
Galois representations is still a field of very active research,
both from a theoretical and computational angle.  Talk about how
often the primes one needs to compute to list the interesting
mod-$\ell$ Galois representations often appear, in practice to
{\em not} fall under the above theorem.


The following is basically copied from page 129 of Frohlich-Taylor.
Maybe state and prove a simplified version in actual lecture.  How many
of these words would make sense to your students?: 
{\small
\begin{theorem}
Let $L=K(\alpha)$ denote a separable extension of~$K$;
suppose that $\alpha\in\O_L$ and let $g(X)$ denote
the minimal polynomial of~$\alpha$ over~$K$.
Let $\p$ denote a prime ideal of~$\O_K$ and assume that
$k=\O_K/\p$ is perfect.  Suppose that on taking residue
classes mod~$\p$, $\overline{g}(X) = \prod_{i=1}^t \overline{g}_i(X)$
with the $\overline{g}_i$ distinct monic irreducible
polynomials in $k[X]$.  Then
\begin{enumerate}
\item $\p$ does not ramify in $L$;
\item $\O_K[\alpha]_\p = \O_{L,\p}$;
\item Let $\mathfrak{P}_i = (\p,g_i(\alpha))$ with $g_i\in\O_K[X]$
any polynomial whose image is $\overline{g}_i$ in $k[X]$; 
then the $\mathfrak{P}_i$ are the distinct prime ideals above
$\p$ and $\p\O_L = \prod_{i=1}^t \mathfrak{P}_i$.
\end{enumerate}
\end{theorem}
Generalization: The theorem can be easily extended to the case where
$\overline{g}$ has repeated factors, $\overline{g} = \prod \overline{g}_i^{e_i}$, provided one supposes that $\p\nmid[\O_L : \O_K[\alpha]]$. 
The definition of $\mathfrak{P}_i$ remains unaltered and one then
shows that $\p\O_L = \prod\mathfrak{P}_i^{e_i}$.
}
\item We want to compute $p\O_K = \prod_{i=1}^t \p_i^{e_i}.$
We know that $I_p = \prod_{i=1}^g \p_i$.  Set for any $j\geq 0$:
$$
  K_j = I_p^j + p\O.
$$
It is clear that the valuation at $\p_i$ of $K_j$
is equal to $\min(e_i,j)$, hence
$$
  K_j = \prod_{i=1}^g \p_i^{\min(e_i,j)}.
$$
It is also clear that $K_{j-1} \mid K_j$.  Hence, if we set
$$
 J_j = \frac{K_j}{K_{j-1}},
$$
then $J_j$ is an integral ideal, and in fact
$J_j = \prod_{e_i \geq j} \p_i$, so in particular
$J_{j+1}\mid J_j$.  Finally, if we define
$$
  H_j = \frac{J_j}{J_{j+1}},
$$
we have 
$$
  H_j = \prod_{e_i = j} \p_i.
$$
In other words, if we set $e=\max_i(e_i)$, we have
$$
  p\O = \prod_{j=1}^e H_j^j,
$$
and the $H_j$ are pairwise coprime and are products
of disinct maximal ideals.  To find the splitting of $p\O$,
it is of course sufficient to find the splitting of each
$H_j$.

Since $H_j$ is a product of distinct maximal ideals, i.e.,
is squarefree, the $\F_p$-algebra (or Artinian ring) $\O/H_j$ is separable.
By the primitive element theorem there exists 
$\overline{\alpha}_j\in \O/H_j$ such that $\O/H_j = \F_p[\overline{\alpha}_j]$.
Let $\overline{h}_j$ be the characteristic polynomial of $\overline{\alpha}_j$
over $\F_p$, and $h_j$ be any pullback in $\Z[X]$.  Then if
$$
 h(x) \con \prod_{i=1}^{g_j} q_{i,j}(x)\pmod{p}
$$
is the factorization modulo~$p$ of $h_j$, then the
ideals 
$$
  \q_{i,j} = H_j + q_{i,j}(\alpha_j)\O
$$
are maximal and that 
$$
  H_j = \prod_{i=1}^{g_j} \q_{i,j}
$$
is the desired decomposition of $H_j$ into a product of prime ideals.
