Cyclotomic fast Fourier transform

The cyclotomic fast Fourier transform is a type of fast Fourier transform algorithm over finite fields. This algorithm first decomposes a discrete Fourier transform into several circular convolutions. This then derives the discrete Fourier transform results from the circular convolution results. When applied to a discrete Fourier transform over $\mathrm{G}\mathrm{F}(2^m)$, this algorithm has a very low multiplicative complexity. In practice, since there usually exist efficient algorithms for circular convolutions with specific lengths, this algorithm is very efficient.

Background

The discrete Fourier transform over finite fields finds widespread application in the decoding of error-correcting codes such as BCH codes and Reed–Solomon codes. Generalized from the complex field, a discrete Fourier transform of a sequence $\{f_i{\}}_0^{N-1}$ over a finite field $\mathrm{G}\mathrm{F}(p^m)$ is defined as $$F_j=\sum _{i=0}^{N-1}{f}_i{\alpha }^{ij},0\le j\le N-1,$$ where $\alpha$ is the N-th primitive root of 1 in $\mathrm{G}\mathrm{F}(p^m)$. If the polynomial representation of $\{f_i{\}}_0^{N-1}$ can defined as $$f(x)=f_0+f_{1}x+f_2{x}^2+\cdots +f_{N-1}{x}^{N-1}=\sum _0^{N-1}{f}_i{x}^i,$$ it is easy to see that $F_j$ is simply $f({\alpha }^j)$. That is, the discrete Fourier transform of a sequence converts it to a polynomial evaluation problem.

Written in matrix format, $$\mathbf{𝐅}=\left[\begin{array}{c}{F}_0\\ F_1\\ ⋮\\ F_{N-1}\end{array}\right]=\left[\begin{array}{cccc}{\alpha }^0& {\alpha }^0& \cdots & {\alpha }^0\\ {\alpha }^0& {\alpha }^1& \cdots & {\alpha }^{N-1}\\ ⋮& ⋮& \ddots & ⋮\\ {\alpha }^0& {\alpha }^{N-1}& \cdots & {\alpha }^{(N-1)(N-1)}\end{array}\right]\left[\begin{array}{c}{f}_0\\ f_1\\ ⋮\\ f_{N-1}\end{array}\right]={ℱ}\mathbf{𝐟}.$$

Direct evaluation of the discrete Fourier transform has an $O(N^2)$ complexity. Fast Fourier transforms are just efficient algorithms evaluating the above matrix-vector product.

Algorithm

First, define a linearized polynomial over $\mathrm{G}\mathrm{F}(p^m)$ as $$L(x)=\sum _i{l}_i{x}^{p^i},l_i\in \mathrm{G}\mathrm{F}(p^m).$$ Here $L(x)$ is called linearized, because $L(x_1+x_2)=L(x_1)+L(x_2)$, which comes from the fact that for elements $x_1,x_2\in \mathrm{G}\mathrm{F}(p^m)$ and $(x_1+x_2{)}^p=x_1^p+x_2^p$.

Notice that $p$ is invertible modulo $N$ because $N$ must divide the order $p^m-1$ of the multiplicative group of the field $\mathrm{G}\mathrm{F}(p^m)$. So, the elements $\{0,1,2,\dots ,N-1\}$ can be partitioned into $l+1$ cyclotomic cosets modulo $N$: $$\begin{array}{rl}& \{0\},\\ & \{k_1,p{k}_1,p^2{k}_1,\dots ,p^{m_1-1}{k}_1\},\\ & \dots ,\\ & \{k_l,p{k}_l,p^2{k}_l,\dots ,p^{m_l-1}{k}_l\},\end{array}$$ where $k_i=p^{m_i}{k}_i(\mathrm{mod}N)$. Therefore, the input to the Fourier transform can be rewritten as $$f(x)=\sum _{i=0}^l{L}_i(x^{k_i}),L_i(y)=\sum _{t=0}^{m_i-1}{y}^{p^t}{f}_{p^t{k}_{i}modN}.$$

In this way, the polynomial representation is decomposed into a sum of linear polynomials. Hence, $F_j$ is given by $$F_j=f({\alpha }^j)=\sum _{i=0}^l{L}_i({\alpha }^{j{k}_i})$$. Expanding ${\alpha }^{j{k}_i}\in \mathrm{G}\mathrm{F}(p^{m_i})$ with the proper basis $\{{\beta }_{i,0},{\beta }_{i,1},\dots ,{\beta }_{i,m_i-1}\}$ yields ${\alpha }^{j{k}_i}=\sum _{s=0}^{m_i-1}{a}_{ijs}{\beta }_{i,s}$, where $a_{ijs}\in \mathrm{G}\mathrm{F}(p)$. By the property of the linearized polynomial $L_i(x)$, this yields $$F_j=\sum _{i=0}^l\sum _{s=0}^{m_i-1}{a}_{ijs}\left(\sum _{t=0}^{m_i-1}{\beta }_{i,s}^{p^t}{f}_{p^t{k}_{i}modN}\right).$$

This equation can be rewritten in matrix form as $\mathbf{𝐅}=\mathbf{𝐀}\mathbf{𝐋}\mathrm{\Pi }\mathbf{𝐟}$, where $\mathbf{𝐀}$ is an $N\times N$ matrix over $\mathrm{G}\mathrm{F}(p)$ that contains the elements $a_{ijs}$, $\mathbf{𝐋}$ is a block diagonal matrix, and $\mathrm{\Pi }$ is a permutation matrix regrouping the elements in $\mathbf{𝐟}$ according to the cyclotomic coset index.

Note that if the normal basis $\{{\gamma }_i^{p^0},{\gamma }_i^{p^1},\cdots ,{\gamma }_i^{p^{m_i-1}}\}$ is used to expand the field elements of $\mathrm{G}\mathrm{F}(p^{m_i})$, the i-th block of $\mathbf{𝐋}$ is given by: $${\mathbf{𝐋}}_i=\left[\begin{array}{cccc}{\gamma }_i^{p^0}& {\gamma }_i^{p^1}& \cdots & {\gamma }_i^{p^{m_i-1}}\\ {\gamma }_i^{p^1}& {\gamma }_i^{p^2}& \cdots & {\gamma }_i^{p^0}\\ ⋮& ⋮& \ddots & ⋮\\ {\gamma }_i^{p^{m_i-1}}& {\gamma }_i^{p^0}& \cdots & {\gamma }_i^{p^{m_i-2}}\\ \end{array}\right],$$ which is a circulant matrix. It is well known that a circulant matrix-vector product can be efficiently computed by convolutions. Hence, it is successful to reduce the discrete Fourier transform into short convolutions.

Complexity

When applied to a characteristic-2 field $\mathrm{G}\mathrm{F}(2^m)$, the matrix $\mathbf{𝐀}$ is just a binary matrix. Only addition is used when calculating the matrix-vector product of $\mathrm{A}$ and $\mathrm{L}\mathrm{\Pi }\mathrm{f}$. It has been shown that the multiplicative complexity of the cyclotomic algorithm is given by $O(n({\log }_{2}n{)}^{{\log }_2\frac{3}{2}})$, and the additive complexity is given by $O(n^2/({\log }_{2}n{)}^{{\log }_2\frac{8}{3}})$.