Keywords: numbers, multiplication

Avant, je ne savais pas que la beauté avait un sens. Je l'acceptais comme telle, comme une réalité sans rime ni raison. J'étais dans l'ignorance. A présent, je sais, ou plus exactement, je commence à savoir. Cette herbe me paraît beaucoup plus belle maintenant que je sais pourquoi elle est herbe, par quelle alchimie du soleil, de la pluie et de la terre elle est devenue ce qu'elle est.» Martin Eden, Jack London.

En premier lieu, je remercie mes directeurs de thèse Jérémie Detrey et Emmanuel Thomé. Ils m'ont proposé un sujet de thèse passionnant, qui m'a été très enrichissant, que cela soit d'un point de vue théorique ou méthodologique. J'ai compris beaucoup de choses sur la science en général grâce à ce sujet. Par ailleurs, mes directeurs de thèse m'ont beaucoup aidé à clarifier, formaliser, rendre intelligible, les contributions que j'ai pu apporter à mon sujet de thèse. Ils ont su me laisser la liberté nécessaire pour être créatif et avoir de bonnes idées, et ils ont su m'aider à aller jusqu'au bout de la rédaction.

En second lieu, je remercie tous les membres de mon jury de thèse de s'être intéressé à mon travail et de l'avoir évalué. Je remercie Daniel Augot et Clément Pernet pour avoir accepté d'être rapporteurs, et d'avoir relu mon manuscrit. Je remercie Sylvie Boldo et Natacha Portier pour avoir accepté d'être membre de mon jury de thèse. Je remercie également Hugues Randriambololona d'avoir accepté de venir à ma soutenance.

Je remercie tous mes collègues de l'équipe CARAMBA. En particulier, je remercie tous mes cobureaux: Laurent, Hamza, Simon, Sandra, Aude, Kevin. Ils ont participé à de longs débats dont le niveau de trollitude sera inscrit dans les annales. Les matchs de ping-pong avec Laurent et Hamza ont été marquants. Je remercie spécialement Laurent pour sa disponibilité et sa connaissance très fine des subtilités administratives. Je remercie les doctorants, stagiaires et post-doctorants du pique-nique des doctorants pour ces longues discussions du mercredi midi. La partie de Diplomacy qu'on a organisée ensemble sur plusieurs semaines est un souvenir mémorable, qui aura brisé toute confiance entre nous et fait du LORIA un lieu de complot permanent. Je remercie les membres de l'équipe PESTO, en particulier Ludovic, Eric, Joseph, Alicia, Catalin et Ivan, avec lesquels j'ai eu de longues discussions, des parties de coinche, de go, d'échecs,... Enfin, je remercie Aurélien, Hugo, Jordi et Paul pour ces séances d'escalade à Casabloc ou au mur du SUAPS.

Je remercie les amis qui m'ont soutenu et qui ont été disponible pendant ma thèse. Je remercie Razvan et Dorian en particulier pour les discussions mathématiques, les échanges d'énigmes (à base de schtroumpfs entre autres) et leur passion des sciences. Je remercie spécialement Claire pour sa patience et pour avoir partagé ces quatre années avec moi. Elle m'a permis de sortir de mon quotidien et je n'aurais sans doute pas pleinement profité de ma thèse sans elle. Je remercie toute ma famille pour avoir été un soutien moral indéfectible. Je remercie mes parents qui ont toujours été là pour moi. C'est grâce à eux que j'ai acquis très tôt la passion des sciences et des mathématiques en particulier. Cette thèse n'aurait jamais existé sans leurs efforts permanents. Enfin, je remercie toutes les personnes avec lesquelles j'ai noué des liens d'amitié forts et qui m'ont permis de m'ouvrir pendant ma thèse à de nombreux domaines, en philosophie, en littérature, en économie, en politique... Ces quatre années auront marqué ma vie et changé ce que j'étais sur le plan intellectuel et humain, et je remercie donc tous ceux que j'ai rencontrés pendant cette période et qui m'ont fait progresser.

Résumé en français

De nombreux problèmes de calcul formel utilisent la multiplication comme brique de base dans les algorithmes qui permettent leur résolution. Par exemple, des problèmes de théorie algorithmique des nombres nécessitent souvent de savoir multiplier rapidement de grands entiers. La recherche de grands nombres premiers, le pgcd de polynômes, requièrent des algorithmes efficaces pour multiplier des polynômes ou des grands entiers. Des problèmes tels que le logarithme discret modulo un nombre premier p utilisent souvent la multiplication modulo p comme une brique de base. Cette thèse présente des algorithmes permettant de calculer le produit de différents objets mathématiques, tels que les grands entiers, les polynômes, les matrices... Les algorithmes permettant la résolution de ces problèmes peuvent être rangés en deux catégories: les algorithmes asymptotiquement rapides et les algorithmes efficaces pour de petites tailles (polynômes de petits degrés, matrices de petites dimensions). Par exemple, si on considère des polynômes de degré d à coefficients dans un anneau R, trouver un algorithme efficace quand d croît est un problème de la première catégorie, tandis que trouver le meilleur algorithme quand d est fixé est un problème de la seconde catégorie. Ces problèmes sont tous les deux reliés, comme on peut l'illustrer avec l'exemple de la multiplication d'entiers ou de matrices.

La première amélioration de l'algorithme naïf qui multiplie des entiers de n bits avec une complexité quadratique, donc en O(n 2 ), a été établie en 1962, bien que Kolmogorov avait conjecturé en 1952 que la complexité quadratique était optimale. Cette première amélioration est due à Karatsuba et Ofman [START_REF] Karatsuba | Multiplication of multidigit numbers on automata[END_REF]. Leur méthode transforme deux entiers de n bits a et b en polynômes A et B de longueur 2, obtenus en coupant a et b en deux moitiés. Ainsi, A = a 0 + a 1 X et B = b 0 + b 1 X, avec A(2 n/2 ) = a, B(2 n/2 ) = b et la taille en bits de a 0 , a 1 , b 0 , b 1 est approximativement n/2. Karatsuba et Ofman ont réduit le problème de la multiplication d'entiers de n-bits à la multiplication de polynômes linéaires avec des coefficients de n/2 bits. Le produit A • B nécessite, pour son calcul, quatre multiplications utilisant l'algorithme naïf : a 0 b 0 , a 1 b 0 , a 0 b 1 , a 1 b 1 . Avec l'amélioration de Karatsuba et Ofman, les coefficients du produit A • B peuvent être calculés avec trois multiplications non scalaires (on ne compte pas les multiplications par un élément de l'anneau de base) : a 0 b 0 , (a 0 + a 1 )(b 0 + b 1 ), a 1 b 1 . On obtient les formules suivantes :

a 0 b 0 = a 0 b 0 , a 0 b 1 + a 1 b 0 = (a 0 + a 1 )(b 0 + b 1 ) -a 0 b 0 -a 1 b 1 , a 1 b 1 = a 1 b 1 .
Ces formules sont optimales si le nombre de multiplications non scalaires impliquées dans leur expression est minimal. L'algorithme de Karatsuba et Ofman peut être utilisé pour améliorer la complexité binaire de la multiplication de deux entiers de n bits en l'appliquant de façon récursive : au lieu d'une complexité en O(n 2 ) avec l'algorithme naïf, ils obtiennent O(n log 2 3 ). Il est iii courant de se référer à l'algorithme de Karatsuba et Ofman comme "l'algorithme de Karatsuba". En conséquence, c'est ce qu'on fait dans la suite. Il est clair que, étant donné un degré d > 1, trouver des formules similaires à Karatsuba pour calculer le produit de polynômes de degré d améliore la complexité du produit d'entiers. Par exemple, dans [START_REF] Toom | The complexity of a scheme of functional elements realizing the multiplication of integers[END_REF], les entiers sont découpés en trois parties, et la multiplication d'entiers se réduit au problème de multiplier des polynômes de degré deux, ce qu'on peut réaliser en cinq multiplications. La complexité est alors O(n log 3 5 ). De manière générale, on peut déduire d'un ensemble de formules pour un produit de polynômes un algorithme pour le produit d'entiers. En réalité, les algorithmes de Karatsuba et de Toom-Cook peuvent être compris comme des cas particuliers de deux problèmes.

La première manière de les voir est comme une application de la méthode d'interpolation de Lagrange. En effet, étant donné un polynôme de degré d avec des coefficients dans un corps R contenant d + 1 points distincts, on peut retrouver les coefficients du polynôme à partir de ses évaluations en d + 1 points distincts du corps R, en utilisant l'interpolation de Lagrange. Par exemple, l'algorithme de Karatsuba peut être compris comme l'évaluation de A • B en 0, 1 et le point particulier ∞ (l'évaluation en ∞ donne le terme dominant d'un polynôme), étant donné que

A(0) • B(0) = a 0 b 0 , A(1) • B(1) = (a 0 + a 1 )(b 0 + b 1 ) et A(∞) • B(∞) = a 1 b 1 .
L'algorithme de Toom-Cook peut être compris comme l'évaluation de A • B en 0, -1, 1, 2 et ∞.

La seconde manière de les voir est, étant donné des polynômes de degré d avec leurs coefficients dans un corps R, comme des formules minimisant le nombre de multiplications non scalaires requises pour calculer leur produit. Ces multiplications non scalaires ne sont pas nécessairement des évaluations du produit A•B en certains points. De plus, on peut aussi considérer le problème spécifique sur un corps fini F q avec q < d + 1, ce qui implique qu'on ne peut pas utiliser l'interpolation de Lagrange comme ci-dessus (car on n'a pas d + 1 points distincts dans F q ). On a une approximation du nombre minimal de multiplications non scalaires requises pour le calcul d'un produit de polynômes de degré d via la notion de "rang bilinéaire" d'une "application bilinéaire" représentant le produit de polynômes. On définit plus tard ces notions. Cependant, on peut décrire comment on obtient le rang bilinéaire pour l'exemple du produit de polynômes de degré d à coefficients dans F 2 . On formule le problème en termes de matrices. Les coefficients du produit de polynômes de degré deux sont vus comme cinq formes bilinéaires :

        a 0 a 1 a 2     ,     b 0 b 1 b 2         → a 0 b 0 ,         a 0 a 1 a 2     ,     b 0 b 1 b 2         → a 1 b 0 +a 0 b 1 ,         a 0 a 1 a 2     ,     b 0 b 1 b 2         → a 2 b 0 +a 1 b 1 +a 0 b 2 ,         a 0 a 1 a 2     ,     b 0 b 1 b 2         → a 2 b 1 + a 1 b 2 et         a 0 a 1 a 2     ,     b 0 b 1 b 2         → a 2 b 2 .
Ces formes bilinéaires sont représentées, dans la base canonique, par les matrices

    1 0 0 0 0 0 0 0 0     ,     0 1 0 1 0 0 0 0 0     ,     0 0 1 0 1 0 1 0 0     ,     0 0 0 0 0 1 0 1 0     ,     0 0 0 0 0 0 0 0 1     .
v Le cardinal de l'ensemble minimal de matrices M i de rang un telles que chacune des matrices précédentes est une combinaison linéaire des M i définit le rang bilinéaire du produit. Par exemple, à partir des six matrices

M 0 =     1 0 0 0 0 0 0 0 0     , M 1 =     1 1 0 1 1 0 0 0 0     , M 2 =     0 0 0 0 1 0 0 0 0     , M 3 =     1 1 1 1 1 1 1 1 1     , M 4 =     0 0 0 0 0 0 0 0 1     , M 5 =     0 0 0 0 1 1 0 1 1     ,
représentant les multiplications non scalaires a 0 b 0 , (a 0 + a 1 )(b 0 + b 1 ),

a 1 b 1 , (a 0 + a 1 + a 2 )(b 0 + b 1 + b 2 ), a 2 b 2 et (a 1 + a 2 )(b 1 + b 2 )
, on déduit des formules permettant le calcul des coefficients du produits de polynômes de degré deux utilisant six multiplications. On peut prouver qu'il n'existe pas d'ensemble de matrices de rang un de cardinal cinq permettant de calculer les coefficients de ce produit sur F 2 . Ainsi, le rang bilinéaire du produit de polynômes de degré deux sur F 2 est six. En ce sens, les formules obtenues à partir des M i sont optimales au sens du rang bilinéaire.

Le produit de n'importe quel objet mathématique (matrices, polynômes) peut être compris comme une application bilinéaire. Trouver des formules optimales (au sens du rang bilinéaire) pour évaluer des applications bilinéaires est un problème appartenant à un domaine appelé "théorie de la complexité algébrique" [START_REF] Bürgisser | Algebraic Complexity Theory[END_REF][START_REF] Brockett | On the optimal evaluation of a set of bilinear forms[END_REF][START_REF] Strassen | Gaussian elimination is not optimal[END_REF][START_REF] Jájá | Optimal evaluation of pairs of bilinear forms[END_REF]. Trouver des algorithmes optimaux pour le calcul du produit de matrices ou de polynômes sont des problèmes importants de complexité algébrique : la complexité du produit de matrices a été étudiée dans [START_REF] Strassen | Gaussian elimination is not optimal[END_REF][START_REF] Coppersmith | Computational algebraic complexity editorial matrix multiplication via arithmetic progressions[END_REF][START_REF] Gall | Powers of tensors and fast matrix multiplication[END_REF] et la complexité du produit de polynômes dans [START_REF] Karatsuba | Multiplication of multidigit numbers on automata[END_REF][START_REF] Toom | The complexity of a scheme of functional elements realizing the multiplication of integers[END_REF][START_REF] Schönhage | Schnelle Multiplikation großer Zahlen[END_REF][START_REF] Harvey | Even faster integer multiplication[END_REF].

Pour le produit de matrices, le premier résultat est apparu en 1969 : Strassen [START_REF] Strassen | Gaussian elimination is not optimal[END_REF] a proposé des formules améliorant le coût du produit de deux matrices 2 × 2, ce qui, appliqué récursivement sur des matrices de dimensions plus larges, donne une complexité binaire en O(n log 2 7 ) au lieu de O(n log 2 8 ) = O(n 3 ) (algorithme naïf). Pour un produit de matrices a 0,0 a 0,1

a 1,0 a 1,1 et b 0,0 b 0,1 b 1,0 b 1,1 ,
Strassen a proposé d'utiliser les multiplications non scalaires suivantes : π 0 = (a 0,0 + a 1,1 )(b 0,0 + b 1,1 ), π 1 = (a 1,0 + a 1,1 )b 0,0 , π 2 = a 0,0 (b 0,1 -b 1,1 ), π 3 = a 1,1 (b 1,0 -b 0,0 ), π 4 = (a 0,0 + a 0,1 )b 1,1 , π 5 = (a 1,0 -a 0,0 )(b 0,0 + b 0,1 ), π 6 = (a 0,1 -a 1,1 )(b 1,0 + b 1,1 ).

Les formules correspondantes sont :

a 0,0 b 0,0 + a 0,1 b 1,0 = π 0 + π 3 -π 4 + π 6 , a 0,0 b 0,1 + a 0,1 b 1,1 = π 2 + π 4 , a 1,0 b 0,0 + a 1,1 b 1,0 = π 1 + π 3 , a 1,0 b 0,1 + a 1,1 b 1,1 = π 0 -π 1 + π 2 + π 5 .
Si on note par ω l'exposant matriciel, c'est-à-dire la quantité telle que O(n ω ) est la meilleure borne supérieure asymptotique de la complexité arithmétique du produit de matrices n×n sur C, de nombreuses contributions [START_REF] Coppersmith | Computational algebraic complexity editorial matrix multiplication via arithmetic progressions[END_REF][START_REF] Cohn | Group-theoretic algorithms for matrix multiplication[END_REF][START_REF] Cohn | A group-theoretic approach to fast matrix multiplication[END_REF][START_REF] Gall | Powers of tensors and fast matrix multiplication[END_REF][START_REF] Stothers | On the complexity of matrix multiplication[END_REF][START_REF] Williams | Multiplying matrices faster than Coppersmith-Winograd[END_REF] ont permis d'améliorer les bornes supérieures sur ω. La meilleure borne à ce jour est due à Williams et Le Gall [START_REF] Williams | Multiplying matrices faster than Coppersmith-Winograd[END_REF][START_REF] Gall | Powers of tensors and fast matrix multiplication[END_REF] et est égale à 2.3729, bien que la borne proposée par Coppersmith et Winograd [START_REF] Coppersmith | Computational algebraic complexity editorial matrix multiplication via arithmetic progressions[END_REF], égale à 2.376, est souvent prise comme référence. Dans [START_REF] Cohn | Group-theoretic algorithms for matrix multiplication[END_REF], il est conjecturé que ω = 2. Cependant, aucun des algorithmes proposés ci-dessus ne sont utilisés en pratique et on utilise encore largement l'algorithme naïf, sauf pour des matrices de grandes tailles, auquel cas on applique l'algorithme de Strassen. De manière générale, on peut utiliser une formule permettant de multiplier des matrices de tailles fixes pour multiplier des matrices de tailles quelconques, en appliquant cette formule de façon récursive. Ceci explique l'intérêt de chercher des formules optimales pour des tailles légèrement plus grandes que celles du produit de matrices 2 × 2 par 2 × 2 (idéalement le produit de matrices 3 × 3 par 3 × 3). Smirnov décrit dans [START_REF] Smirnov | The bilinear complexity and practical algorithms for matrix multiplication[END_REF] des algorithmes qui peuvent être utilisés en pratique pour des matrices de plus grande taille. On peut remarquer que, la plupart du temps, des algorithmes meilleurs que celui de Strassen sont inconnus. Par exemple, on ne sait toujours pas si le nombre minimal de multiplications nécessaires pour le calcul du produit de deux matrices 3 × 3 à coefficients dans C est égal à 23 (Laderman [START_REF] Laderman | A noncommutative algorithm for multiplying 3 × 3 matrices using 23 multiplications[END_REF] a été le premier à proposer un algorithme en 23 multiplications), bien que Bläser a prouvé dans [START_REF] Bläser | On the complexity of the multiplication of matrices of small formats[END_REF] que 19 est une borne inférieure sur le rang de ce produit. La borne proposée par Bläser est un cas spécial d'une borne plus générale pour n'importe quel produit de matrices m × n par n × m. Cette borne a été améliorée par Landsberg [START_REF] Landsberg | New lower bounds for the rank of matrix multiplication[END_REF] en utilisant de la géométrie algébrique [START_REF] Landsberg | An introduction to geometric complexity theory[END_REF].

Le principal obstacle à la recherche de formules optimales est le fait que le calcul du rang bilinéaire d'une application bilinéaire est NP-difficile [START_REF] Håstad | Tensor rank is NP-complete[END_REF]. La méthode des moindres carrés semble être l'une des plus populaires [START_REF] Smirnov | The bilinear complexity and practical algorithms for matrix multiplication[END_REF] pour approcher ce problème. Une autre manière de faire consiste à utiliser des éléments de la géométrie algébrique [START_REF] Bernardi | General tensor decomposition, moment matrices and applications[END_REF] et à trouver une généralisation de la décomposition des matrices en valeurs propres pour des tenseurs d'ordre trois. Cependant, ces méthodes ne fonctionnent par pour des applications bilinéaires sur des corps finis : elles supposent qu'on travaille sur des corps de caractéristique zéro comme C pour la méthode des moindres carrés ou un corps algébriquement clos pour les méthodes à base de géométrie algébrique. Dans notre contexte, on se concentre sur la recherche de formules optimales pour une application bilinéaire sur un corps fini. Sur un corps fini, le nombre de formules possibles impliquant r multiplications non scalaires est fini. Par conséquent, on peut utiliser des méthodes de recherche exhaustive pour trouver le rang bilinéaire d'une application bilinéaire, ainsi que toutes les formules optimales.

Pour le produit de polynômes sur des corps finis, il existe une méthode originale utilisant des courbes algébriques [START_REF] Chudnovsky | Algebraic complexities and algebraic curves over finite fields[END_REF], qui a permis d'améliorer les bornes supérieures sur le rang bilinéaire du produit de polynômes ou le produit d'éléments d'un corps fini de petite caractéristique. En particulier, la complexité bilinéaire de cette stratégie a été décrite dans [START_REF] Randriambololona | Bilinear complexity of algebras and the Chudnovsky-Chudnovsky interpolation method[END_REF][START_REF] Ballet | On the tensor rank of multiplication in any extension of F 2[END_REF][START_REF] Pieltant | New uniform and asymptotic upper bounds on the tensor rank of multiplication in extensions of finite fields[END_REF] et dépend du rang bilinéaire du produit d'éléments dans F q d [y]/ (y ) , où d et sont des entiers positifs. Ainsi, il devrait être possible d'améliorer ces bornes pour des petites valeurs de d et avec des méthodes à base de recherche exhaustive, puisque le produit d'éléments de F q d [y]/ (y ) est une application bilinéaire.

Montgomery propose dans [START_REF] Montgomery | Five, six, and seven-term Karatsuba-like formulae[END_REF] un algorithme pour calculer de telles décompositions pour le cas particulier de polynômes de petit degré sur des corps finis. L'auteur énumère toutes les formules possibles d'une certaine forme, en utilisant le fait que, sur un corps fini, le nombre de formules optimales possibles est fini. Il obtient alors de nouvelles formules pour le produits de polynômes de degrés cinq, six et sept à coefficients dans F 2 . Dans [START_REF] Oseledets | Optimal Karatsuba-like formulae for certain bilinear forms in GF(2)[END_REF], Oseledets propose une approche heuristique pour résoudre le problème du rang bilinéaire pour le produit de polynômes à coefficients dans F 2 . L'auteur utilise une formalisation de ce problème en termes d'espaces vectoriels et se restreint à des formules présentant certaines symétries. Plus tard, Barbulescu et al. développent dans [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF] ce formalisme et calculent le rang bilinéaire pour différentes applications bilinéaires, telles que le produit court ou le produit médian sur un corps fini. Leur algorithme permet de générer toutes les formules optimales pour n'importe quelle application bilinéaire sur un corps fini. Ce travail est la source principale d'inspiration de la première partie de cette thèse. Le but de la première partie est d'améliorer le temps requis pour trouver toutes les formules optimales pour une application bilinéaire donnée, et de prouver des bornes inférieures sur le rang bilinéaire, en particulier pour le produit de matrices et le produit court sur F 2 .

L'amélioration qu'on propose à l'algorithme décrit dans [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF] utilise le groupe constitué des automorphismes stabilisant une application bilinéaire, ainsi que la notion de "tige" d'un espace vectoriel de formes bilinéaires. Plus spécifiquement, on calcule toutes les formules optimales pour le produit court de polynômes P et Q modulo X 5 et le produit de matrices 3 × 2 par 2 × 3. Ce dernier produit était hors d'atteinte en pratique avec la méthode proposé dans [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF]. On prouve, en particulier, que l'ensemble des formules optimales pour ce produit matriciel est unique à l'action d'un élément du groupe d'automorphismes près. Bien que fournir une analyse de complexité suffisamment fine de notre approche est difficile (elle implique des propriétés intrinsèques aux applications bilinéaires qu'on considère, dont l'impact sur la complexité finale est difficile à quantifier), on a des arguments théoriques pour expliquer pourquoi cette approche est plus rapide que [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF].

Lorsque d est grand, les multiplications scalaires ne sont plus négligeables. Alors, même dans des corps tels que le corps complexe C, dans lequel on a toujours d + 1 points distincts, la complexité de l'évaluation en d + 1 points distincts est un problème qui doit être pris en compte lorsque d croît. Par conséquent, pour le produit de polynômes de degré d avec d grand, il faut regarder comment choisir au mieux les d + 1 points tels qu'on obtient la meilleure complexité. Ce problème est relié à la complexité asymptotique de la multiplication d'entiers, par le biais de la substitution de Kronecker. Plusieurs améliorations ont été réalisées pour la complexité binaire de la multiplication d'entiers, en particulier par Schönhage, Strassen, Fürer, Harvey, van der Hoeven et Lecerf [START_REF] Schönhage | Schnelle Multiplikation großer Zahlen[END_REF][START_REF] Fürer | Faster integer multiplication[END_REF][START_REF] Harvey | Even faster integer multiplication[END_REF]. Ces améliorations reposent sur la complexité de la multiplication de polynômes de grand degré et sur le schéma d'évaluation-interpolation. Cependant, leur optimalité est toujours une question ouverte.

L'algorithme naïf ou l'amélioration de Karatsuba et Ofman permettent d'avoir un algorithme avec une complexité polynomiale pour multiplier des entiers. L'algorithme de Toom-Cook a la même propriété. Le premier algorithme réalisant une complexité dite quasi-linéaire est celui de Schönhage et Strassen [START_REF] Schönhage | Schnelle Multiplikation großer Zahlen[END_REF][START_REF] Schönhage | Asymptotically fast algorithms for the numerical multiplication and division of polynomials with complex coeficients[END_REF] : leur algorithme multiplie des entiers de n bits avec une complexité binaire égale à O(n • log n • log (2) n). L'algorithme de Schönhage-Strassen utilise la transformée de Fourier rapide (FFT pour Fast Fourier Transform) pour évaluer rapidement un polynôme en les puissances d'une racine primitive de l'unité [59, §8]. De plus, la complexité est obtenue via un choix adéquat d'un anneau R dans lequel cette évaluation doit être réalisée. Concrètement, le choix R = Z/ (2 e + 1) , avec e une puissance de deux, amène à une complexité en O(n • log n • log log n), tandis que d'autres choix naturels pour R, tels que R = C, amènent à une complexité moins bonne.

En 2007, M. Fürer observe que l'anneau R = C[x]/ (x P + 1) , avec P une puissance de deux bien choisie, est particulièrement intéressant [START_REF] Fürer | Faster integer multiplication[END_REF]. En utilisant cet anneau R, il est possible d'exploiter une FFT avec une grande base pour obtenir une complexité en O(n • log n • 2 O(log * n) ) (ce qui s'oppose à la FFT en base deux qui était utilisée dans l'algorithme de Schönhage-Strassen). La notation log * représente le logarithme itéré (voir §6.6). Le résultat de Fürer a été une amélioration surprenante de la complexité de Schönhage-Strassen, qui était considérée comme la meilleure pendant 35 ans. Une extension récente du travail de Fürer, proposée dans [START_REF] De | Fast integer multiplication using modular arithmetic[END_REF], remplace le corps C dans la définition de R par un anneau p-adique et atteint la même complexité asymptotique. Cette variante p-adique permet de mettre de côté les problèmes de précision qu'on a dans C. Harvey, van der Hoeven et Lecerf dans [START_REF] Harvey | Even faster integer multiplication[END_REF], et plus tard Harvey et van der Hoeven dans [START_REF] Harvey | Faster integer multiplication using plain vanilla FFT primes[END_REF] ont proposé de nouveaux algorithmes et une analyse de complexité plus fine permettant d'obtenir une expression plus explicite de la complexité binaire, c'est-à-dire O(n • log n • 8 log * n ) et O(n • log n • 4 log * n ) conjecturalement. Ils montrent aussi qu'une analyse de l'algorithme original de Fürer permet d'arriver à O(n • log n • 16 log * n ). Très récemment, dans [START_REF] Harvey | Faster integer multiplication using short lattice vectors[END_REF], Harvey et Van der Hoeven semblent avoir montré qu'on peut arriver à une complexité en O(n • log n • 4 log * n ) sans faire appel à aucune conjecture de théorie des nombres. Cependant, ces algorithmes, qui réalisent une borne asymptotique similaire à celle obtenue par Fürer, sont surtout perçus, pour l'instant, comme des résultat n'ayant qu'une valeur théorique.

On décrit dans la deuxième partie de cette thèse un algorithme atteignant une complexité en O(n•log n•4 log * n ) et reposant sur une conjecture qui peut être vue comme une version explicite de la conjecture de Bateman-Horn [START_REF] Bateman | A heuristic asymptotic formula concerning the distribution of prime numbers[END_REF], appuyée par des expériences numériques. Plus précisément, cette conjecture se formule de la façon suivante.

Hypothèse 8.5. Soit λ ≥ 2 un entier. Pour tout nombre réel R tel que 2 λ ≤ R ≤ 2 2λ , il existe un premier généralisé de Fermat p = r 2 λ + 1 tel que R ≤ r < λ 2.5 R.

Le concept clé de notre algorithme est l'utilisation d'une chaîne de premiers généralisés de Fermat (de la forme r 2 λ + 1) pour gérer les appels récursifs. Cette variante est différente de la stratégie proposée dans [START_REF] Harvey | Even faster integer multiplication[END_REF]. Notre travail peut être compris comme étant une généralisation d'un rapport proposé par Fürer [START_REF] Fürer | On the complexity of integer multiplication[END_REF] (en 1989), qui proposait un algorithme reposant sur l'hypothèse qu'il existe une infinité de premiers de Fermat. Cependant, cette hypothèse est très probablement fausse, et donc notre approche permet de réparer ce problème.

Cette thèse est organisée de la façon suivante.

• Dans la Partie I on présente le travail qui a été réalisé sur la recherche de formules optimales et décrit dans [START_REF] Covanov | Improved method to find optimal formulae for bilinear maps[END_REF]. Dans le Chapitre 1, on présente les outils théoriques et le cadre formel de cette partie de la thèse, qui a déjà été introduit dans [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF]. Dans le Chapitre 2, on présente l'état de l'art, avec entre autres les algorithmes proposés dans [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF] et [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF]. On décrit les aspects théoriques et algorithmiques de notre amélioration dans le Chapitre 3, On applique cette amélioration à des exemples tels que ceux du produit court et du produit matriciel dans le Chapitre 4. On décrit dans le Chapitre 5 comment calculer certains précalculs requis dans le Chapitre 3.

• Dans la Partie II, on présente le travail décrit dans [START_REF] Covanov | Fast integer multiplication using generalized Fermat primes[END_REF], relatif à la recherche d'un algorithme asymptotiquement optimal pour la multiplication de grands entiers, basé sur la transformée de Fourier rapide et la stratégie de Fürer [START_REF] Fürer | Faster integer multiplication[END_REF]. Dans Chapitre 6, on décrit la transformée de Fourier rapide et, en particulier, l'algorithme de Cooley-Tukey. Dans le Chapitre 7, on décrit l'algorithme de Fürer, basé sur la transformée de Fourier rapide, et permettant de multiplier des entiers de n bits en O(n

• log 2 n • 2 O(log * n)

Introduction

Various problems of symbolic computation use the multiplication as a building block in the algorithms that are developed to solve them. For example, problems in algorithmic number theory often require fast multiplication of large integers. The search of large primes or the computation of digits of π are such problems. The computation of resultants, gcd of polynomials, require efficient algorithms to multiply polynomials. Problems such as the discrete logarithm modulo a prime p often use the multiplication modulo p as a building block. This thesis presents algorithms to compute the product of various mathematical objects, such as large integers, polynomials, matrices... The algorithms solving these problems can be decomposed into two families: algorithms that are asymptotically fast and algorithms that are efficient for small sizes.

For instance, considering the polynomials of degree d over a ring R, finding an efficient algorithm when d grows falls into the first family, whereas finding the best algorithm when d is fixed falls in the second family. These problems are actually related, which is illustrated by the problem of integer multiplication and matrix multiplication.

The first improvement to the schoolbook algorithm multiplying n-bit integers with a quadratic complexity, i.e. with a complexity equal to O(n 2 ), has been established in 1962, although Kolmogorov conjectured in 1952 that the quadratic complexity was optimal. This first improvement is due to Karatsuba and Ofman [START_REF] Karatsuba | Multiplication of multidigit numbers on automata[END_REF]. They transform two n-bit integers a and b into polynomials A and B of length two, obtained by splitting a and b into two halves. Thus, A = a 0 + a 1 X and B = b 0 + b 1 X, where A(2 n/2 ) = a and B(2 n/2 ) = b and the bit-length of a 0 , a 1 , b 0 , b 1 is roughly n/2. Karatsuba and Ofman reduce the problem of the multiplication of n-bit integers to the problem of the multiplication of linear polynomials whose coefficients have size n/2. The product A • B requires, to be computed, four multiplications using the schoolbook algorithm: a 0 b 0 , a 1 b 0 , a 0 b 1 , a 1 b 1 . With Karatsuba and Ofman's improvement, the coefficients of the product A • B can be retrieved from the computation of the three following non-scalar multiplications (multiplications by an element of the base ring are not taken into account): a 0 b 0 , (a 0 + a 1 )(b 0 + b 1 ), a 1 b 1 . We have the following formulas:

a 0 b 0 = a 0 b 0 , a 0 b 1 + a 1 b 0 = (a 0 + a 1 )(b 0 + b 1 ) -a 0 b 0 -a 1 b 1 , a 1 b 1 = a 1 b 1 .
These formulas are optimal if the number of non-scalar multiplications involved in their expression is minimal. In particular, Karatsuba and Ofman's algorithm can be used to improve the asymptotic binary complexity of the multiplication of two n-bit integers by applying it recursively: instead of O(n 2 ) with the naive schoolbook algorithm, they obtain O(n log 2 3 ). It is common to refer to Karatsuba and Ofman's algorithm as "Karatsuba's algorithm". Therefore, we do it in the following.

xiii Then, it is clear that, given a degree d > 1, finding the minimal amount of multiplications to compute the product of polynomials of degree d leads to even better complexities. For example, in [START_REF] Toom | The complexity of a scheme of functional elements realizing the multiplication of integers[END_REF], the integers are split into three parts, and the integer multiplication is reduced to the problem of multiplying polynomials of length three, which is realized via five multiplications. The complexity is then O(n log 3 5 ). One deduces from a set of formulas for a product of polynomials an algorithm for the product of integers. In fact, Karatsuba and Toom-Cook's algorithms can be seen as special cases of two problems.

The first way to see it is as an application of Lagrange interpolation method. Given a polynomial of degree d with coefficients lying in a field R containing d + 1 distinct points, one can recover the coefficients of the polynomial from its evaluations at d + 1 distinct points of the field R, using Lagrange interpolation. For example, Karatsuba's algorithm can be seen as the evaluation of A • B at 0, 1 and the special point ∞ (the evaluation in ∞ gives the dominant term of a polynomial), since

A(0) • B(0) = a 0 b 0 , A(1) • B(1) = (a 0 + a 1 )(b 0 + b 1 ) and A(∞) • B(∞) = a 1 b 1 .
Toom-Cook's algorithm can be seen as the evaluation of A • B at 0, -1, 1, 2 and ∞.

The second way to see it is, given polynomials of degree d with coefficients lying in a field R, as the formulas minimizing the quantity of non-scalar multiplications required to compute their product. These non-scalar multiplications do not necessarily correspond to an evaluation of the product A • B at some points. Moreover, one can also consider the specific problem in a field F q with q < d + 1, which implies that one cannot use the Lagrange interpolation as above (we do not have d + 1 distinct points in F q ). We can approach the minimal number of non-scalar multiplications necessary for the computation of a product of polynomials of degree d by the "bilinear rank" of the "bilinear map" representing the product of polynomials. We define later more formally these notions. However, we can describe how to obtain the bilinear rank for the example of product of polynomials of degree d over F 2 . We formulate the problem in terms of matrices. The coefficients of the product of polynomials of degree two are given by the five bilinear forms:

        a 0 a 1 a 2     ,     b 0 b 1 b 2         → a 0 b 0 ,         a 0 a 1 a 2     ,     b 0 b 1 b 2         → a 1 b 0 +a 0 b 1 ,         a 0 a 1 a 2     ,     b 0 b 1 b 2         → a 2 b 0 +a 1 b 1 +a 0 b 2 ,         a 0 a 1 a 2     ,     b 0 b 1 b 2         → a 2 b 1 + a 1 b 2 and         a 0 a 1 a 2     ,     b 0 b 1 b 2         → a 2 b 2 .
These bilinear forms can be represented in the canonical basis by the matrices

    1 0 0 0 0 0 0 0 0     ,     0 1 0 1 0 0 0 0 0     ,     0 0 1 0 1 0 1 0 0     ,     0 0 0 0 0 1 0 1 0     ,     0 0 0 0 0 0 0 0 1     .
The cardinality of the minimal set of rank-one matrices M i such that each one of the previous matrices is a linear combination of the M i 's gives the bilinear rank of the product. For example, xv from the six matrices

M 0 =     1 0 0 0 0 0 0 0 0     , M 1 =     1 1 0 1 1 0 0 0 0     , M 2 =     0 0 0 0 1 0 0 0 0     , M 3 =     1 1 1 1 1 1 1 1 1     , M 4 =     0 0 0 0 0 0 0 0 1     , M 5 =     0 0 0 0 1 1 0 1 1     , representing the non-scalar multiplications a 0 b 0 , (a 0 +a 1 )(b 0 +b 1 ), a 1 b 1 , (a 0 +a 1 +a 2 )(b 0 +b 1 +b 2 ), a 2 b 2 and (a 1 + a 2 )(b 1 + b 2 )
, we deduce formulas to compute the coefficients of the product of polynomials of degree 2 using 6 multiplications. One can prove that there is no set of rank-one matrices of cardinality 5 allowing one to compute the coefficients of this product over F 2 . Thus, the bilinear rank of the product of polynomials of degree two over F 2 is six. In that sense, the formulas obtained with the M i 's are optimal for the bilinear rank.

The product of any mathematical objects (matrices, polynomials,...) can described as a bilinear map. Finding optimal formulas (for the bilinear rank) for evaluating bilinear maps is a problem of an area called "algebraic complexity theory" [START_REF] Bürgisser | Algebraic Complexity Theory[END_REF][START_REF] Brockett | On the optimal evaluation of a set of bilinear forms[END_REF][START_REF] Strassen | Gaussian elimination is not optimal[END_REF][START_REF] Jájá | Optimal evaluation of pairs of bilinear forms[END_REF]. Finding optimal algorithms for the computation of the product of matrices or polynomials are important problems of the algebraic complexity theory: the complexity of the matrix product has been well studied in [START_REF] Strassen | Gaussian elimination is not optimal[END_REF][START_REF] Coppersmith | Computational algebraic complexity editorial matrix multiplication via arithmetic progressions[END_REF][START_REF] Gall | Powers of tensors and fast matrix multiplication[END_REF] and the complexity of polynomial multiplication in [START_REF] Karatsuba | Multiplication of multidigit numbers on automata[END_REF][START_REF] Toom | The complexity of a scheme of functional elements realizing the multiplication of integers[END_REF][START_REF] Schönhage | Schnelle Multiplikation großer Zahlen[END_REF][START_REF] Harvey | Even faster integer multiplication[END_REF].

For the product of matrices, the first result came in 1969: Strassen [START_REF] Strassen | Gaussian elimination is not optimal[END_REF] proposed formulas improving on the cost of the product of two matrices 2 × 2, which, when applied recursively on large matrices, leads to a binary complexity O(n log 2 7 ) instead of O(n log 2 8 ) = O(n 3 ). For a product of matrices a 0,0 a 0,1

a 1,0 a 1,1 and b 0,0 b 0,1 b 1,0 b 1,1 ,
Strassen proposed the following non-scalar products:

π 0 = (a 0,0 + a 1,1 )(b 0,0 + b 1,1 ), π 1 = (a 1,0 + a 1,1 )b 0,0 , π 2 = a 0,0 (b 0,1 -b 1,1 ), π 3 = a 1,1 (b 1,0 -b 0,0 ), π 4 = (a 0,0 + a 0,1 )b 1,1 , π 5 = (a 1,0 -a 0,0 )(b 0,0 + b 0,1 ), π 6 = (a 0,1 -a 1,1 )(b 1,0 + b 1,1 ).
The associated formulas are:

a 0,0 b 0,0 + a 0,1 b 1,0 = π 0 + π 3 -π 4 + π 6 , a 0,0 b 0,1 + a 0,1 b 1,1 = π 2 + π 4 , a 1,0 b 0,0 + a 1,1 b 1,0 = π 1 + π 3 , a 1,0 b 0,1 + a 1,1 b 1,1 = π 0 -π 1 + π 2 + π 5 .
actually equal to two. However, it appears that none of these algorithms are practical and the naive algorithm is still widely in use, although one prefers Strassen's algorithm to multiply large matrices. When the size of the matrices to multiply is very large, we call Strassen's algorithm recursively, which explains the need to search optimal formulas for a matrix product slightly larger than the product of matrices 2 × 2 by 2 × 2 (ideally the product of matrices 3 × 3 by 3 × 3). Smirnov describes in [START_REF] Smirnov | The bilinear complexity and practical algorithms for matrix multiplication[END_REF] practical algorithms for matrices of higher dimensions. Thus, one can notice that, most of the time, algorithms for matrix multiplication better than the Strassen's algorithm are unknown. For example, it is still unknown whether the minimal number of multiplications involved in the computation of the product of two matrices 3 × 3 with coefficients in C is equal to 23 or not (Laderman [40] was the first to propose an algorithm with 23 multiplications), although Bläser proved in [START_REF] Bläser | On the complexity of the multiplication of matrices of small formats[END_REF] that 19 is a lower bound. The bound proposed by Bläser is a special case of a more general bound on any product of matrices of formats m × n and n × m. It has been improved by Landsberg [START_REF] Landsberg | New lower bounds for the rank of matrix multiplication[END_REF] by using algebraic geometry [START_REF] Landsberg | An introduction to geometric complexity theory[END_REF].

The main obstacle to finding optimal formulas is the fact that computing the bilinear rank of a bilinear map is known to be NP-hard [START_REF] Håstad | Tensor rank is NP-complete[END_REF]. The least-squares method seems to be one of the most popular [START_REF] Smirnov | The bilinear complexity and practical algorithms for matrix multiplication[END_REF] to approach this problem. Another way to decompose a bilinear map consists in using ingredients from algebraic geometry [START_REF] Bernardi | General tensor decomposition, moment matrices and applications[END_REF] and in finding a generalization of the singular value decomposition of matrices to general tensors. However, these methods do not work for bilinear maps over a finite field: they work on field of characteristic zero as C for the least-squares method or an algebraically closed field for the methods using geometry. In our context, we focus on finding optimal formulas of a bilinear map over a finite field. On a finite field, the possible formulas involving r non-scalar multiplications is finite. Therefore, we can use exhaustive search methods to find the bilinear rank of a bilinear map, and all the optimal formulas.

For the product of polynomials over finite fields, there exists an original method using algebraic curves [START_REF] Chudnovsky | Algebraic complexities and algebraic curves over finite fields[END_REF], improving on the bilinear of the product of polynomials or the product of two elements of a finite field. In particular, the bilinear complexity of this strategy has been bounded in [START_REF] Randriambololona | Bilinear complexity of algebras and the Chudnovsky-Chudnovsky interpolation method[END_REF][START_REF] Ballet | On the tensor rank of multiplication in any extension of F 2[END_REF][START_REF] Pieltant | New uniform and asymptotic upper bounds on the tensor rank of multiplication in extensions of finite fields[END_REF] and depends on the bilinear rank of the product of elements in F q d [y]/ (y ) , where d and are positive integers. Thus, it should be possible to improve this bound for small values of d and with exhaustive search methods, since the multiplication of elements of F q d [y]/ (y ) is a bilinear map. [START_REF] Montgomery | Five, six, and seven-term Karatsuba-like formulae[END_REF] an algorithm to compute such a decomposition for the particular case of polynomials of small degree over a finite field. The author enumerates all possible formulas of some form, taking advantage of the fact that, on a finite field, the number of possible optimal formulas is finite. Then, he gets new formulas for the multiplication of polynomials of degree five, six and seven over F 2 . In [START_REF] Oseledets | Optimal Karatsuba-like formulae for certain bilinear forms in GF(2)[END_REF], Oseledets proposes a heuristic approach to solve the bilinear rank problem for the polynomial product over F 2 . The author uses a formalization of the problem in terms of vector spaces and looks at formulas with some symmetries. Later, Barbulescu et al. propose in [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF] a unified framework, developing the use of the vector spaces formalism, and compute the bilinear rank of different applications, such as the short product or the middle product over a finite field. Their algorithm allows one to generate all the possible optimal formulas of any bilinear map over a finite field. This work is the main inspiration of the first part of this thesis. In this part, we improve the time required to find all the optimal formulas for a given bilinear map, and to establish lower bounds for the bilinear rank, in particular for the matrix multiplication and short product over F 2 .

Montgomery proposes in

The improvement to the algorithm presented in [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF] that we describe relies on the automorphism group stabilizing a bilinear map, and on the notion of "stem" of a vector space associated to such a bilinear map. Specifically, we compute all the decompositions for the short product of xvii polynomials P and Q modulo X 5 and the product of 3 × 2 by 2 × 3 matrices. The latter problem was out of reach with the method used in [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF]. We prove, in particular, that the set of possible decompositions for this matrix product is essentially unique, up to the action of the automorphism group. Although it is difficult to obtain a sharp complexity analysis of our approach (it involves intrinsic properties of particular bilinear maps, whose impact in the final complexity is difficult to quantify), we give theoretical arguments explaining why our approach is better than [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF].

When d is large, the scalar multiplications are not negligible anymore. Thus, even in fields as the complex field C, in which we always have d + 1 distinct points, the complexity of the evaluation at d + 1 points is a problem to consider when d grows. Therefore, for product of polynomials when d is large, we study how to choose d + 1 points so that we have the best complexity. This problem is related to establishing the asymptotic binary complexity of the multiplication of integers, via Kronecker-substitution. Several improvements have been achieved for the binary complexity of the multiplication of integers, in particular by Schönhage, Strassen, Fürer, Harvey, van der Hoeven and Lecerf [START_REF] Schönhage | Schnelle Multiplikation großer Zahlen[END_REF][START_REF] Fürer | Faster integer multiplication[END_REF][START_REF] Harvey | Even faster integer multiplication[END_REF]. These improvements rely on the complexity of the multiplication of polynomials of large degree and on an evaluation-interpolation scheme. However, their optimality is still an open question.

The naive algorithm or Karatsuba and Ofman's improvement leads to a polynomial-time algorithm to multiply integers. Toom-Cook's algorithm falls also into this category. The first algorithm to achieve what is called quasi-linear complexity is Schönhage and Strassen's [START_REF] Schönhage | Schnelle Multiplikation großer Zahlen[END_REF][START_REF] Schönhage | Asymptotically fast algorithms for the numerical multiplication and division of polynomials with complex coeficients[END_REF]: their algorithm multiply n-bit integers with a binary complexity equal to O(n • log n • log (2) n). The Schönhage-Strassen algorithm uses the fast Fourier transform (FFT) as a means to quickly evaluate a polynomial at the powers of a primitive root of unity [59, §8]. Moreover, the complexity is obtained by an appropriate choice of a ring R in which this evaluation is to be carried out. Namely, the choice R = Z/ (2 e + 1) , for e a suitable power of two, yields the complexity O(n•log n• log log n), while other natural choices for R, such as R = C, appear to yield inferior performance at the time.

In 2007, M. Fürer observes that the ring R = C[x]/ (x P + 1) , for P a suitable power of two, is particularly interesting [START_REF] Fürer | Faster integer multiplication[END_REF]. Using this ring R, it is possible to take advantage of large-radix FFT to obtain the improved complexity O(n • log n • 2 O(log * n) ) (in contrast, radix-2 FFT is sufficient for the Schönhage-Strassen algorithm). The notation log * denotes the iterated logarithm (see §6.6). Fürer's result was an acclaimed improvement on the complexity of the Schönhage-Strassen algorithm, which had remained unbeaten for 35 years. An early extension of Fürer's work, proposed in [START_REF] De | Fast integer multiplication using modular arithmetic[END_REF], replaces the field C in the definition of R by a p-adic ring and reaches an identical asymptotic complexity. This p-adic variant can be expected to ease precision issues for potential implementations. Harvey, van der Hoeven and Lecerf in [START_REF] Harvey | Even faster integer multiplication[END_REF], and later Harvey and van der Hoeven in [START_REF] Harvey | Faster integer multiplication using plain vanilla FFT primes[END_REF] propose new algorithms and a sharper analysis that makes the expression of the complexity more explicit, namely

O(n•log n•8 log * n ) and even O(n•log n•4 log * n ) conjecturally.
In comparison, they also show that a careful analysis of Fürer's original algorithm reaches the complexity O(n • log n • 16 log * n ). Very recently, in [START_REF] Harvey | Faster integer multiplication using short lattice vectors[END_REF], Harvey and Van der Hoeven seem to have proven that there exists an algorithm with a complexity in O(n • log n • 4 log * n ), multiplying integers without using any conjecture of number theory. However, these algorithms achieving a bound similar to the one obtained by Fürer are, as it stands, perceived as theoretical results.

Hypothesis 8.5. Let λ ≥ 2 be an integer. For any real number R such that 2 λ ≤ R ≤ 2 2λ , there exists a generalized Fermat prime p = r 2 λ + 1 such that R ≤ r < λ 2.5 R.

The key concept of our algorithm is the use of a chain of generalized Fermat primes (of the form r 2 λ + 1) to handle recursive calls. This variant differs from the strategy proposed in [START_REF] Harvey | Even faster integer multiplication[END_REF]. Some lineage can be drawn between our work and an early article by Fürer [START_REF] Fürer | On the complexity of integer multiplication[END_REF] (from 1989), which is dependent on the assumption that there exist infinitely many Fermat primes. The latter assumption, however, is widely believed to be wrong, so our variant fills a gap here. This thesis is organized as follows.

• In Part I we present the work that has been done on finding optimal formulas, and described in [START_REF] Covanov | Improved method to find optimal formulae for bilinear maps[END_REF]. In Chapter 1, we present the theoretical tools and the framework for this part of the thesis, corresponding to the framework introduced in [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF]. In Chapter 2, we present the state of the art, such as the algorithm proposed in [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF] and [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF]. We describe the theoretical and algorithmic aspects of our improvement in Chapter 3, We apply this improvement to examples such as the short product and the matrix product in Chapter 4.

We describe in Chapter 5 how to realize some precomputations required by Chapter 3.

• In Part II, we present the work described in [START_REF] Covanov | Fast integer multiplication using generalized Fermat primes[END_REF] related to the search of an asymptotically optimal algorithm for the multiplication of large integers, based on the fast Fourier transform and on the Fürer's strategy [START_REF] Fürer | Faster integer multiplication[END_REF]. In Chapter 6, we describe the fast Fourier transform and, in particular the Cooley-Tukey algorithm. In Chapter 7, we describe the Fürer's algorithm, based on the fast Fourier transform, and allowing one to multiply n-bit

integers in O(n • log 2 n • 2 O(log * n) ).
n • 4 log * n ).
In Chapter 10, we discuss the practical aspects of an implementation of the integer multiplication algorithm using generalized Fermat primes.

Notations

K Field a, b, . . . Elements of a vector space over K a, b, . . .

Elements of K A, B Polynomials over K M, N Matrices over K L(K m ; K) Linear forms from K m to K L(K m , K n ; K) Linear forms from K m × K n to K M m,n (K) m × n matrices over K Φ, Ψ Bilinear form of any rank φ, ψ
Bilinear form of rank one

T, W, V Subspaces of L(K m , K n ; K) GL(K m ) × GL(K n ) Couples of invertible matrices σ Element of GL(K m ) × GL(K n ) Chapter 1
From bilinear maps to vector spaces

In this chapter, we recall the definition of the bilinear rank of a bilinear map. We choose the characterization given by de Groote [START_REF] De Groote | Lectures on the Complexity of Bilinear Problems[END_REF] or Bürgisser et al. [START_REF] Bürgisser | Algebraic Complexity Theory[END_REF]Ch. 14]. The algorithms that are detailed in the following chapters use vector spaces generated by matrices. These vector spaces are obtained from bilinear maps such as the short product or the matrix product.

1.1 Bilinear rank

Bilinear forms

Let K be a field. We denote by L(K m ; K) the vector space of linear forms from K m to K and by L(K m , K n ; K) the vector space of bilinear forms from K m × K n to K.

Definition 1.1 (Rank-one bilinear form). Let Φ ∈ L(K m , K n ; K). We say that Φ is a rank-one bilinear form if there exist two linear forms α ∈ L(K m ; K) and β ∈ L(K n ; K) such that Φ can be written as Φ : (a, b) → α(a) • β(b).

Definition 1.2 (Bilinear rank of bilinear forms). The bilinear rank of a bilinear form Φ, denoted by rk(Φ), is defined as the minimal number of rank-one bilinear forms φ i such that Φ can be written as a linear combination of the φ i 's. Then, a family (φ i ) i of cardinality rk(Φ) generating Φ is said to be an optimal decomposition of Φ.

Thus, the bilinear rank of a bilinear form Φ is a number defined by the minimal size of a decomposition of the form

Φ(a, b) = 0≤i<r α i (a 0 , . . . , a m-1 )β i (b 0 , . . . , b n-1 ).
For i ∈ {0, . . . , m -1} and j ∈ {0, . . . , n -1}, we denote by e i,j the bilinear forms e i,j : (a, b) → a i b j . The e i,j 's have rank one and form the canonical basis of L(K m , K n ; K). This implies that any bilinear form can be expressed as a linear combination of bilinear forms of rank one and, consequently, the bilinear rank is well defined.

We have a matrix equivalent of Definition 1.2. Indeed, for any bilinear form Φ ∈ L(K m , K n ; K), there exists a matrix

M ∈ M m,n (K) such that Φ(a, b) = a T • M • b for any a ∈ K m and b ∈ K n .
It is shown in [START_REF] Bürgisser | Algebraic Complexity Theory[END_REF]Ch. 14] that the usual linear algebraic rank of a bilinear form (which is the rank of the corresponding matrix M ) coincides with its bilinear rank.

There is a one-to-one correspondence between rank-one bilinear forms and rank-one matrices. Thus, the number of rank-one matrices gives the number of rank-one bilinear forms. The rankone matrices are the set of matrices that can be obtained as a product X • Y T of two non-zero column matrices X ∈ M m,1 , Y ∈ M n,1 . There are (#K m -1) nonzero matrices X ∈ M m,1 and

(#K n -1) nonzero matrices Y ∈ M n,1 . If X • Y T = X • Y
T , there exists λ ∈ K -{0} such that X = λX and Y = 1 λ Y . Therefore, there are

(#K m -1)(#K n -1) (#K -1)
distinct bilinear forms of rank one.

Example 1.3 (Bilinear forms of L(K 2 , K 2 ; K)). When K = F 2 , there are (2 2 -1) 2 = 9 bilinear forms of rank one in L(K 2 , K 2 ; K). Their matrix representations in the canonical basis are

1 0 0 0 , 0 1 0 0 , 0 0 1 0 , 0 0 0 1 , 1 1 1 1 , 1 1 0 0 , 1 0 1 0 , 0 1 0 1
, and 0 0 1 1 .

Any bilinear form Φ ∈ L(K 2 , K 2 ; K) can be decomposed in the basis {e 0,0 , e 1,0 , e 0,1 , e 1,1 }:

Φ = 0,0 • e 0,0 + 1,0 • e 1,0 + 0,1 • e 0,1 + 1,1 • e 1,1 .
Consequently, the matrix representation of Φ in the canonical basis is

0,0 0,1 1,0 1,1 .

Bilinear maps

We denote by L(K m , K n ; K ) the vector space of bilinear maps from K m × K n to K . Any bilinear map Φ from K m × K n to K can also be seen as an element of L(K m , K n ; K) , whose coordinates are bilinear forms, denoted by (Φ k ) 0≤k< . We consider in the following chapters various examples of bilinear maps given by classical products:

• the product of polynomials of m and n terms, of m+n-1 terms (in this case = m+n-1),

• the short product, which is the product of polynomials modulo X ,

• the circulant product, which is the product of polynomials modulo X -1, and

• the matrix product (p, q, r), which is the product of matrices p × q by q × r.

Example 1.4 (Short product of polynomials modulo X 3 ). We describe in this example the matrices associated to the coefficients of the short product of two polynomials modulo X 3 .

Let A and B be the polynomials

A = a 0 + a 1 X + a 2 X 2 and B = b 0 + b 1 X + b 2 X 2 . We denote by C the polynomial A • B mod X 3 : C = a 0 b 0 + (a 0 b 1 + a 1 b 0 )X + (a 0 b 2 + a 1 b 1 + a 2 b 0 )X 2 .
We represent A and B as vectors of

K 3 denoted by a =     a 0 a 1 b 2     and b =     b 0 b 1 b 2     , respectively.
Let Φ 0 , Φ 1 and Φ 2 be the bilinear forms defined as

Φ 0 : (a, b) → a 0 b 0 , Φ 1 : (a, b) → a 0 b 1 + a 1 b 0 , Φ 2 : (a, b) → a 0 b 2 + a 1 b 1 + a 2 b 0 .
With respect to the canonical basis (e i ) 0≤i<3 of K 3 , the matrices M k , representations of the Φ k 's, are

M 0 =     1 0 0 0 0 0 0 0 0     , M 1 =     0 1 0 1 0 0 0 0 0     , M 2 =     0 0 1 0 1 0 1 0 0     .

Multiplicative complexity and bilinear rank

We are interested in the intrinsic time required for an algorithm, whose input is

a =     a 0 . . . a m-1     ∈ K m and b =     b 0 . . . b n-1     ∈ K n ,
to compute Φ(a, b).

We consider straight-line arithmetic programs, which consist in a sequence of instructions f i ← u i 3 v i , for i ∈ {0, . . . , s}, where 3 is an arithmetic operation among {+, -, ×, ÷} and where u i and v i either belong to K ∪ {indeterminates} or are previously computed f j 's (for j < i). A straight-line arithmetic program is said to compute a subset S ⊂ L(K m , K n ; K) if for any Φ ∈ S there exists f i ∈ {f 0 , . . . , f s } such that f i can be expressed as the evaluation of Φ in the indeterminates that are used in the straight-line program.

In the straight-line arithmetic programs, the indeterminates are representing the linear forms a → a i and b → b i .

Φ : (a, b) →     a 0 b 0 a 0 b 1 + a 1 b 0 a 1 b 1     .
Thus, Φ can be seen as an element of L(K 2 , K 2 ; K) 3 , whose coordinates are the 3 bilinear forms

Φ 0 : (a, b) → a 0 b 0 , Φ 1 : (a, b) → a 0 b 1 + a 1 b 0 , and Φ 2 : (a, b) → a 1 b 1 .
The straight-line arithmetic program formed by the sequence

f 0 ← a 0 × b 0 f 1 ← a 1 × b 0 f 2 ← a 0 × b 1 f 3 ← a 1 × b 1 f 4 ← f 1 + f 2 computes the set {Φ 0 , Φ 1 , Φ 2 }.
One can prove (see e.g. [START_REF] De Groote | Lectures on the Complexity of Bilinear Problems[END_REF]) that, for a straight-line program computing a set of bilinear forms, we can assume that each instruction f i ← u i 3 v i is either 1. an addition or subtraction, 2. a scalar multiplication (u i ∈ K or v i ∈ K) or 3. multiplication of two linear forms in a and b (u i ∈ L(K m+n ; K) and v i ∈ L(K m+n ; K)).

We do not consider divisions: in [START_REF] Bürgisser | Algebraic Complexity Theory[END_REF]Ch. 7], it is shown that divisions do not help for the computation of a set of quadratic polynomials and, in particular, bilinear forms. It follows that we obtain, from the straight-line program computing a bilinear map Φ, a decomposition of the form

Φ = 0≤i<t α i (a 0 , . . . , a m-1 , b 0 , . . . , b n-1 )β i (a 0 , . . . , a m-1 , b 0 , . . . , b n-1 )c i ,
where α i and β i are linear forms of L(K m+n ; K) and c i ∈ K .

Definition 1.6 (Multiplicative complexity). The multiplicative complexity of a bilinear map Φ = (Φ 0 , . . . , Φ -1 ) is the smallest number of non-scalar multiplications involved in a straight-line program computing {Φ 0 , . . . , Φ -1 }. We ignore scalar multiplications, additions and subtractions because their cost is considered as negligible. We denote this multiplicative complexity by L(Φ).

Ideally, for a bilinear map Φ, we would like to compute exactly L(Φ). To simplify the combinatorics of this computation, and its computational complexity, we approximate this number with the bilinear rank, denoted by rk(Φ). Definition 1.7 (Bilinear rank of bilinear maps). The rank of a bilinear map Φ is the smallest integer r such that there exist r rank-one bilinear forms (φ i ) 0≤i<r and r vectors

c i ∈ K such that Φ = 0≤i<r φ i • c i .
Thus, the bilinear rank is a number defined by the minimal size of a decomposition of the form

Φ(a, b) = 0≤i<t α i (a 0 , . . . , a m-1 )β i (b 0 , . . . , b n-1 )c i .
Definition 1.7 is an extension of Definition 1.2 to bilinear maps. When = 1, the rank of a bilinear map Φ = (Φ 0 ) is the bilinear rank of the bilinear form Φ 0 as defined in Definition 1.2. Proposition 1.8 (Bounds on the bilinear rank [START_REF] Bürgisser | Algebraic Complexity Theory[END_REF]Ch. 14]). The bilinear rank of any bilinear map Φ satisfies L(Φ) ≤ rk(Φ) ≤ 2L(Φ).

Proof. Since the decomposition of a bilinear map Φ in terms of rank-one bilinear forms is a special case of its decomposition in terms of products of linear forms α i , β i ∈ L(K m+n ; K), we have L(Φ) ≤ rk(Φ).

There exist α i , β i ∈ L(K m+n ; K) and vectors Using the fact that Φ is a bilinear map, the sum of the quadratic terms is zero. Thus, we get the following equality:

c i ∈ K such that Φ(a, b) = 0≤i<L(Φ)
Φ(a, b) = 0≤i<L(Φ) α i (a 0 , . . . , a m-1 , 0, . . . , 0)β i (0, . . . , 0, b 0 , . . . , b n-1 )c i + 0≤i<L(Φ) α i (0, . . . , 0, b 0 , . . . , b n-1 )β i (a 0 , . . . , a m-1 , 0, . . . , 0)c i .
Thus, we have a bilinear decomposition of length 2L(Φ), which implies that rk(Φ) ≤ 2L(Φ).

Consequently, the bilinear rank is no larger than twice the multiplicative complexity of a bilinear map. In Example 1.9, we describe a bilinear map for which the multiplicative complexity and the bilinear rank are distinct. Moreover, the notion of bilinear rank extends a well known mathematical invariant, which is the rank of a matrix.

Example 1.9 (Difference between multiplicative complexity and bilinear complexity). The product of matrices 2 × 2 by 2 × 3 is an example of product for which the multiplicative complexity and the bilinear rank are different in a field of characteristic different from 2. Indeed, Waksman proposed in [START_REF] Waksman | On winograd's algorithm for inner products[END_REF] formulas allowing one to compute the product with 10 multiplications, whereas the bilinear rank is proved to be 11 in [START_REF] Hopcroft | On minimizing the number of multiplications necessary for matrix multiplication[END_REF]. For a ∈ M 2,2 and b ∈ M 2,3 , let

Φ : (a, b) →            a 0,0 b 0,0 + a 0,1 b 1,0 a 0,0 b 0,1 + a 0,1 b 1,1 a 0,0 b 0,2 + a 0,1 b 1,2 a 1,0 b 0,0 + a 1,1 b 1,0 a 1,0 b 0,1 + a 1,1 b 1,1 a 1,0 b 0,2 + a 1,1 b 1,2            . Let Φ 0 , . . . , Φ 9 be Φ 0 = 1 2 (a 0,0 + b 1,0 )(a 0,1 + b 0,0 ), Φ 1 = 1 2 (a 0,0 + b 1,1 )(a 0,1 + b 0,1 ), Φ 2 = 1 2 (a 0,0 + b 1,2 )(a 0,1 + b 0,2 ), Φ 3 = (a 1,0 + b 1,0 )(a 1,1 + b 0,0 ), Φ 4 = 1 2 (a 1,0 + b 1,1 )(a 1,1 + b 0,1 ), Φ 5 = (a 1,0 + b 1,2 )(a 1,1 + b 0,2 ), Φ 6 = 1 2 (a 0,0 -b 1,0 )(-a 0,1 + b 0,0 ), Φ 7 = 1 2 (a 0,0 -b 1,1 )(-a 0,1 + b 0,1 ), Φ 8 = 1 2 (a 0,0 -b 1,2 )(-a 0,1 + b 0,2 ), Φ 9 = 1 2 (a 1,0 -b 1,1 )(-a 1,1 + b 0,1 ).
We have

Φ(a, b) =            Φ 0 + Φ 6 Φ 1 + Φ 7 Φ 2 + Φ 8 -Φ 0 + Φ 1 + Φ 3 -Φ 4 + Φ 6 -Φ 7 + Φ 9 Φ 4 + Φ 9 Φ 1 -Φ 2 -Φ 4 + Φ 5 -Φ 7 + Φ 8 + Φ 9            .
Example 1.10 (Karatsuba formulas for the multiplication of linear polynomials [START_REF] Karatsuba | Multiplication of multidigit numbers on automata[END_REF]). The bilinear map Φ for the multiplication of linear polynomials is an element of L(K 2 , K 2 ; K) 3 whose coordinates are the 3 bilinear forms

Φ 0 : (a, b) → a 0 b 0 , Φ 1 : (a, b) → a 0 b 1 + a 1 b 0 , and
Φ 2 : (a, b) → a 1 b 1 .

A linear algebra problem

Let Ψ ∈ L(K 2 , K 2 ; K) be such that Ψ : (a, b) → (a 0 + a 1 )(b 0 + b 1 ). Then, since

Φ 1 = Ψ -Φ 0 -Φ 2 , we can rewrite Φ as Φ =     Φ 0 Φ 1 Φ 2     = Φ 0 •     1 -1 0     + Ψ •     0 1 0     + Φ 2 •     0 -1 1     .
The bilinear forms Φ 0 , Ψ and Φ 2 all have rank one. Thus, we can deduce that the bilinear rank of Φ is at most 3. Actually, one can show that the bilinear rank of Φ is equal to 3.

A linear algebra problem

The approach of [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF] to the computation of the rank of a bilinear map Φ = (Φ 0 , . . . , Φ -1 ) formulates the problem in terms of vector spaces: the algorithm considers the subspace T = Span({Φ 0 , . . . , Φ -1 }) ⊂ L(K m , K n ; K) rather than the bilinear map Φ = (Φ 0 , . . . , Φ -1 ). There is no loss of generality to prefer the vector space formalism rather than the bilinear map formalism. In both cases, the computation of the rank of bilinear map [START_REF] Håstad | Tensor rank is NP-complete[END_REF] is NP-hard. However, in [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF] the authors show that we have a lower combinatorial complexity using their formalism. Consequently, we choose this formalism as well, and we need to extend the definition of the rank to subspaces of L(K m , K n ; K). Notation 1.11. For T a subspace of L(K m , K n ; K), we denote by S m,n,r (T ) the set of subspaces V ⊂ L(K m , K n ; K) spanned by a free family of rank-one bilinear forms of size r and such that T ⊂ V .

When T = Span(∅), S m,n,r (T ) is the set of subspaces V ⊂ L(K m , K n ; K) spanned by a free family of rank-one bilinear forms of size r and we denote it simply by S m,n,r .

When m and n are clear from the context, these sets are simply denoted by S r (T ) and S r , respectively.

We use Notation 1.11 to define the rank of a subspace T ∈ L(K m , K n ; K) in Definition 1.12. Definition 1.12 (Bilinear rank of a subspace of L(K m , K n ; K)). Let T be a subspace of L(K m , K n ; K). The bilinear rank of T , denoted by rk(T ), is the smallest r such that S r (T ) = ∅. The set S rk(T ) (T ) is called the set of optimal decompositions of T .

If T = Span({Φ 0 , . . . , Φ -1 }), each Φ i can be represented by a matrix M i in the canonical basis. Thus, if T has rank r, there exists a set of r matrices N i ∈ M m,n (K) of rank one such that ∀i ∈ {0, . . . , -1} , M i ∈ Span(N 0 , . . . , N r-1 ), which is the matrix equivalent of Definition 1.12.

Example 1.13 (Subspace for the short product of polynomials modulo X 3 ). We describe in this example the subspace of L(K 3 , K 3 ; K) associated to the short product of two polynomials modulo X 3 . We describe elements of L(K 3 , K 3 ; K) as matrices of M 3,3 in the canonical basis, as it has been done in Example 1.4.

The bilinear map Φ corresponding to the short product is defined as the application

Φ :         a 0 a 1 a 2     ,     b 0 b 1 b 2         →     a 0 b 0 a 0 b 1 + a 1 b 0 a 0 b 2 + a 1 b 1 + a 2 b 0     .
Thus, the subspace

Span         1 0 0 0 0 0 0 0 0     ,     0 1 0 1 0 0 0 0 0     ,     0 0 1 0 1 0 1 0 0        
is the matrix representation of the subspace T of L(K 3 , K 3 ; K) corresponding to Φ. Our aim is to compute its rank in the sense of Definition 1.12.

Proposition 1.14. The rank of a subspace T ∈ L(K m , K n ; K) is bounded as follow

dim(T ) ≤ rk(T ) ≤ m • n.
Proof. The first inequality comes from the fact that a basis of rank-one bilinear forms generating a subspace containing T has necessarily a size no smaller than dim(T ). The second inequality comes from the fact that the cardinality of a basis of a subspace of L(K m , K n ; K) is bounded by the cardinality of the canonical basis {e i,j } i,j .

We need to prove that finding all the optimal formulas in the sense of the bilinear rank for a bilinear map Φ ∈ L(K m , K n ; K) is equivalent to computing S r (T ). This can be rephrased as the fact that Definition 1.7 and Definition 1.12 coincide, which is stated in the following proposition.

Proposition 1.15 (Rank of a bilinear map and rank of a matrix space). Let Φ = (Φ 0 , . . . , Φ -1 ) be a bilinear map and T = Span(Φ 0 , . . . , Φ -1 ) ⊂ L(K m , K n ; K). We have rk(Φ) = rk(T ).

Proof. If r bilinear forms φ i of rank one span a vector space containing T , each coordinate of Φ is a linear combination of these bilinear forms and, consequently, there exist r vectors c i ∈ K such that

Φ = 0≤i<r φ i • c i .
Conversely, the bilinear forms of such a decomposition generate a vector space that contains T .

RP-automorphisms

We adapt the automorphism group defined in [START_REF] Bürgisser | Algebraic Complexity Theory[END_REF]Def. 14.11] to the case of subspaces of L(K m , K n ; K), which we introduced in Section 1.2. We describe in this section the rankpreserving group of automorphisms σ acting on subspaces T ⊂ L(K m , K n ; K), also referred to as the RP-automorphisms group.

Definition 1.16. An element σ = (µ, ν) ∈ GL(K m ) × GL(K n ) acts on L(K m , K n ; K) via Φ • σ : (a, b) → Φ(µ(a), ν(b)).
When m = n, we have the transposition τ acting on any Φ ∈ L(K m , K m ; K), via

Φ • τ : (a, b) → Φ(b, a).
We denote by RPA m,n the smallest group containing GL(K m ) × GL(K n ) and, if m = n, the transposition τ . Its elements are called RP-automorphisms.

Proposition 1.17. The action of RPA m,n is a group action and its elements are all invertible.

Proof. For σ = (µ, ν), σ = (µ , ν ) ∈ GL(K m ) × GL(K n ) and Φ ∈ L(K m , K n ; K), we have ∀a, b, ((Φ • σ) • σ )(a, b) = (Φ • σ)(µ (a), ν (b)) = Φ(µ(µ (a)), ν(ν (b))) = (Φ •(σ • σ ))(a, b).
It works as well if σ or σ is the element τ . Thus, the action that we defined is indeed a group action. Since all the elements of RPA m,n are invertible, we have automorphisms.

Proposition 1.18 (RP-automorphisms preserve the rank). Let σ ∈ RPA m,n .

• For any Φ ∈ L(K m , K n ; K), we have rk(Φ • σ) = rk(Φ).

• For any subspace T ⊂ L(K m , K n ; K), we also have rk(T • σ) = rk(T ).

Proof. First, let φ ∈ L(K m , K n ; K) of rank one. There exist α ∈ L(K m ; K) and β ∈ L(K n ; K)

such that φ : (a, b) → α(a) • β(b). There exist µ ∈ GL(K m ) and ν ∈ GL(K n ) such that φ • σ : (a, b) → α(µ(a)) • β(ν(b)). Since α • µ ∈ L(K m ; K) and β • ν ∈ L(K n ; K), φ • σ is a rank-one bilinear form.
Since the RP-automorphisms in Definition 1.16 preserve the rank of rank-one bilinear forms, by linearity and by definition of the rank of a bilinear form, it preserves the rank of any bilinear form. For any subspace T ⊂ L(K m , K n ; K) and any σ ∈ GL(K m ) × GL(K n ), we have

rk(T • σ) = rk(T ).
Proposition 1.19 (Action of RPA m,n ). The elements of RPA m,n are the only automorphisms of L(K m , K n ; K) preserving the rank.

Proof. In both cases m = n and m = n, a proof with the formalism of tensors of order 3 can be found in [START_REF] Burichenko | On symmetries of the Strassen algorithm[END_REF].

Remark 1.20. The group GL(K m ) × GL(K n ) is isomorphic to the group GL m (K) × GL n (K), acting on matrices M via M • (X, Y ) = X T • M • Y, for any (X, Y ) ∈ GL(K m ) × GL(K n ).
Thus, we often consider elements of GL(K m ) × GL(K n ) as elements of GL m (K) × GL n (K) and conversely. Definition 1.21 (RP-isomorphic spaces). Let W and W be two subspaces of L(K m , K n ; K). We say that W and W are RP-isomorphic if there exists σ ∈ RPA m,n such that W = W •σ.

Example 1.22 (Action of RPA 2,2 ). Let us consider the subspace V ⊂ L(K 2 , K 2 ; K) generated by the bilinear forms represented by the matrices M 1 and M 2 defined as

M 1 = 1 0 0 0 and M 2 = 0 1 0 0 . We take σ = (X, Y ) such that X = Y = 0 1 1 0 . Then, the subspace V = V • σ is generated by M 1 and M 2 , with M 1 = X T • M 1 • Y = 0 0 0 1 and M 2 = X T • M 2 • Y = 0 0 1 0 .
Since we will often refer to subgroups of RPA m,n stabilizing elements of L(K m , K n ; K) in the following, we define the notion of set-wise stabilizer.

Definition 1.23 (Set-wise stabilizer). For a subset T ⊂ L(K m , K n ; K), we denote by Stab(T ) the subgroup of RPA m,n stabilizing T :

Stab(T ) = {σ ∈ RPA m,n | T • σ = T } .
We use the same notation for a subspace T ⊂ L(K m , K n ; K).

In the rest of this work, we often refer to the "stabilizer" of a given set T . Each time, we exclusively mean the set-wise stabilizer of T , which is, in general, different from the point-wise stabilizer of T . Indeed, the point-wise stabilizer of T is defined as

{σ ∈ RPA m,n | ∀Φ ∈ T , Φ • σ = Φ}.
Example 1.24 (Stabilizer for the short product modulo X 3 ). We describe in this example an element of the stabilizer of the subspace T generated by the bilinear forms

Φ 0 = a 0 b 0 , Φ 1 = a 1 b 0 + a 0 b 1 , and Φ 2 = a 2 b 0 + a 1 b 1 + a 0 b 2 ,
which are represented by the matrices

M 0 =     1 0 0 0 0 0 0 0 0     , M 1 =     0 1 0 1 0 0 0 0 0     , and M 2 =     0 0 1 0 1 0 1 0 0     . Let (X, Y ) be the couple (X, Y ) =         1 0 0 0 1 0 1 0 1     ,     1 0 0 1 1 0 0 1 1         .
We have

M 2 • (X, Y ) = X T • M 2 • Y = M 0 + M 1 + M 2 ∈ T. Similarly, M 1 • (X, Y ) = M 0 + M 1 ∈ T and M 0 • (X, Y ) = M 0 ∈ T . Thus, (X, Y ) ∈ Stab(T ).
A full description of the stabilizer for this particular example can be found in Section 4.1.1.

In our algorithms, we often use subgroups of RPA m,n in the following context:

• we have a set S of subspaces of L(K m , K n ; K),
• we have a subgroup H of RPA m,n stabilizing S, which means that for any σ ∈ H and V ∈ S, V • σ ∈ S, and

• we need to enumerate one representative per equivalence class given by the group relation. Chapter 2

A review of existing exhaustive search algorithms

The main obstacle to finding optimal formulas (for the bilinear rank) is the fact that the decomposition of bilinear maps is NP-hard [START_REF] Håstad | Tensor rank is NP-complete[END_REF]. In terms of methods, the least-squares method seems to be one of the most popular ones [START_REF] Smirnov | The bilinear complexity and practical algorithms for matrix multiplication[END_REF]. Another way to decompose a bilinear map consists in using ingredients from geometry [START_REF] Bernardi | General tensor decomposition, moment matrices and applications[END_REF] and in finding a generalization of the singular value decomposition for matrices to general tensors. However, these methods are essentially used over an algebraically closed field K (e.g. K = C) and are not meant to produce all the possible decompositions for a bilinear map. In our context, we need a method for computing a rank decomposition over a finite field not necessarily algebraically closed. Montgomery proposes in [START_REF] Montgomery | Five, six, and seven-term Karatsuba-like formulae[END_REF] an algorithm to compute such a decomposition for the product of polynomials of small degree over a finite field. The author enumerates all possible formulas of some form, taking advantage of the fact that, on a finite field, the number of possible optimal formulas is bounded. This allows him to find new formulas for the multiplication of polynomials of 5, 6 and 7 terms over F 2 . It introduces the formalism of vector spaces and proposes an algorithm solving the bilinear rank problem by looking for symmetric formulas. In [START_REF] Oseledets | Optimal Karatsuba-like formulae for certain bilinear forms in GF(2)[END_REF], Oseledets proposes a heuristic approach to solve the bilinear rank problem for the polynomial product over F 2 and considers other products, such as the short product and the circulant product. The idea of Montgomery and Oseledets is to use the vector space formalism to search exhaustively for all the optimal formulas for products over a finite field. Later, Barbulescu et al. proposed in [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF] an improvement on the exhaustive search of optimal formulas for a bilinear map, in a framework using the vector space formalism. In this chapter, we describe these algorithms, which allow one to prove lower bounds on the bilinear rank of bilinear maps.

Mongtomery's Algorithm

Montgomery proposes in [START_REF] Montgomery | Five, six, and seven-term Karatsuba-like formulae[END_REF] a first attempt at finding new formulas for the product of polynomials A and B of n-terms over a finite field K. We denote by a and b the vectors of K n representing the polynomials A and B in the canonical basis.

Henceforth, we describe the algorithm for the special case K = F 2 . The ideas that are described can be adapted to finite fields of larger characteristic, although the computational cost make them not practical in this case.

The algorithm starts with the set of all the rank-one bilinear forms of L(K n , K n ; K), which has (2 n -1) 2 elements. The product of polynomials of n-terms is represented by the bilinear map Φ n ∈ L(K n , K n ; K 2n-1 ) with

Φ n : (a, b) →                   a 0 b 0 a 1 b 0 + a 0 b 1 . . . a n-2 b 0 + • • • + a 0 b n-2 a n-1 b 0 + • • • + a 0 b n-1 a n-1 b 1 + • • • + a 1 b n-1 . . . a n-1 b n-1                  
.

We denote by T n the vector space spanned by the coefficients of Φ n .

Example 2.1 (Subspace representing Φ 3 ). The subspace T 3 corresponding to Φ 3 is

T 3 = Span         1 0 0 0 0 0 0 0 0     ,     0 1 0 1 0 0 0 0 0     ,     0 0 1 0 1 0 1 0 0     ,     0 0 0 0 0 1 0 1 0     ,     0 0 0 0 0 0 0 0 1         .
Exhaustive search of formulas for the product of polynomials. Taking the formalism proposed in Chapter 1 into account, the general algorithmic strategy Montgomery proposes to compute the bilinear rank of the bilinear map representing a polynomial product of degree n -1 is stated as follows:

1. compute the set of rank-one matrices of M n , of cardinality (2 n -1) 2 ;

2. start with the known lower bound r = 2n -1 on the bilinear rank;

3. compute all the (2 n -1) 2 r sets of r rank-one matrices;

4. select the sets generating a vector space containing T n ;

5. if no such set is found at the previous step, increment r and return to Step 2; 6. r is the bilinear rank and the selected sets produce optimal formulas for the polynomial product.

The strategy described previously actually produces all the optimal formulas for the bilinear decomposition of Φ n . For n = 5, we are led to increase r until 13. There are 2.1 • 10 8 ways to select 13 rank-one matrices among (2 n -1) 2 rank-one bilinear forms. For n = 6 or n = 7, we have roughly 1.0 • 10 15 and 2.5 • 10 24 possibilities, which is too large to be enumerated.

Thus, Montgomery adapts this algorithm to find at least one set of optimal formulas for the product of n-terms polynomials. He proposes three constraints on the set S of bilinear forms of rank one that are selected:

1. for each bilinear form Φ ∈ S, the corresponding matrix M in the canonical basis should be symmetric: M = M T ;

2. S contains the bilinear forms given by the coefficients

a 0 b 0 , a n-1 b n-1 and (a 0 + • • • + a n-1 )(b 0 + • • • + b n-1 ); 3. S should satisfy S • σ = S where σ ∈ GL(K n ) × GL(K n
) is represented by the pair (P, P ) with P ∈ GL n (F 2 ) the matrix

0 0 1 0 0 1 0 0            
because the vector space T also satisfies T • σ = T .

For n = 6, the lower bound on the size of a decomposition with the given constraints is 17. The first and the second constraints lead to sets S containing the 3 bilinear forms given by the coefficients a 0 b 0 , a 5 b 5 and (a 0

+ • • • + a 6 )(b 0 + • • • + b 6
) and 14 bilinear forms among the (2 6 -1) -3 = 60 remaining rank-one bilinear forms represented by a symmetric matrix. Among the 60 matrices, 6 are invariant under the action of σ and 54 are not, which gives 27 pairs of bilinear forms (φ, ψ) such that φ = ψ • σ. Thus, for i an even integer in {0, . . . , 6}, where 6 is the number of invariant matrices under the action of σ, the third constraint splits the 14 bilinear forms required in S into i bilinear forms invariant under the action of σ and (14 -i)/2 pairs of bilinear forms (φ, ψ) such that φ = ψ • σ. The search is clearly not exhaustive.

We have to enumerate

0≤i≤6, i even 6 i • 27 (17 -3 -i)/2 = 6.6 • 10 6
possible sets.

Exhaustive search for any bilinear map

We describe in this section how to generalize the previous approach. In [START_REF] Oseledets | Optimal Karatsuba-like formulae for certain bilinear forms in GF(2)[END_REF], Oseledets develops the idea of Montgomery and generalizes it to any kind of bilinear map. The naive algorithms that are described in this section can be considered as a reformulation of Oseledets' exhaustive search. However, the author proposes also heuristics to decompose certain bilinear maps given by the product of polynomials modulo X n (short product) and the product modulo X n -1 (circulant product). We work over a finite field K. We consider a bilinear map

Φ ∈ L(K m , K n ; K ), represented by the subspace T ⊂ L(K m , K n ; K) of dimension .
General strategy for computing the bilinear rank. The algorithmic strategy we use to compute the bilinear rank of a bilinear map is stated as follows:

• start with the known lower bound r = on the bilinear rank;

• compute S r (T );

• if S r (T ) = ∅, increment r and return to the previous step;

• r is the bilinear rank and S r (T ) the set of optimal decompositions. The general strategy requires an algorithm to compute S r (T ). The algorithms that are considered require a test to determine whether, for V a subspace of L(K m , K n ; K) of dimension r, we have V ∈ S r : we denote this test by HasRankOneBasis. A naive method to perform this test is described in Algorithm 1. We could think of other methods based on solving bilinear systems, but it does not seem efficient in our applications. However, an optimized version of this algorithm is used for particular bilinear maps (product of 2 × 3 by 3 × 2 matrices for example described in Section 4. 3.3).

This method assumes that we have computed the the set G m,n S m,n,1 of rank-one bilinear forms of L(K m , K n ; K) up to a multiplicative factor. This set has cardinality

c m,n = #G m,n = (#K m -1)(#K n -1) (#K -1) 2 .
Algorithm 1 HasRankOneBasis (naive method)

Input: A subspace V ⊂ L(K m , K n ; K), G m,n Output: Boolean indicating whether V ∈ S dim(V ) 1: H ← G m,n ∩ V G m,n is the set of rank-one bilinear forms of L(K m , K n ; K) 2: if dim(Span(H)) = dim(V ) then 3:
return true 4: else 5:

return false 6: end if
The naive version of HasRankOneBasis computes the set of rank-one bilinear forms of a vector space V and computes the dimension of the vector space generated by this space. Consequently, the complexity is given by c m,n membership tests to V (which can be realized as a Gauss reduction of a bilinear form of G m,n by a matrix given by a basis of V ). Generically, the cost of Algorithm HasRankOneBasis is thus O(mn

• dim(V ) • c m,n ).

Naive algorithms

The first method that comes to mind is to compute the cm,n r possible sets of r bilinear forms and to test whether T is contained in their span. Algorithm 2 is a proposed formalisation of this algorithm.

Algorithm 2 IterativeExhaustiveSearch

Input: T ⊂ L(K m , K n ; K) of dimension , G m,n , an integer r Output: S r (T ) S ← ∅ for V ⊂ G m,n such that #V = r do if dim(Span(V)) = r and T ⊂ Span(V) then S ← S ∪ {Span(V)} end if end for return S Algorithm 3 RecursiveExhaustiveSearch Input: T ⊂ L(K m , K n ; K) of dimension , G m,n , an integer r Output: S r (T ) 1: function ExpandSubspace(V, H, r) 2:
if dim V = r and T ⊂ V then

for i ∈ {0, . . . , #H -1} do H = {φ i | i ∈ [0, #H -1]} 7: H ← {φ i+1 , . . . , φ #H-1 } 8: S ← S ∪ ExpandSubspace(V ⊕ Span(φ i ), H , r) 9:
end for 10:

return S 11:

end if 12: end function 13: return ExpandSubspace(Span(∅), G m,n , 0, r) Algorithm IterativeExhaustiveSearch and RecursiveExhaustiveSearch can be considered as respectively the iterative and the recursive version of the same strategy. The recursive calls in RecursiveExhaustiveSearch can be represented with a tree in which each node at depth k corresponds to a vector space V i0,i1,...,i k-1 of dimension k generated by a basis of rank-one bilinear forms φ i0 , φ i1 , . . . , φ i k-1 . For example, assuming that the initial set of rank-one bilinear forms is {φ 0 , φ 1 , φ 2 , φ 3 }, we would obtain generically for r = 3 the tree given in Figure 2.2. The cost of IterativeExhaustiveSearch and RecursiveExhaustiveSearch is smaller than the cost of cm,n r inclusion tests. The inclusion test T ⊂ V is computed with a basis of T formed by vectors of K m+n , whose elements are reduced via Gauss reduction by a matrix of M r,m+n representing a basis of V . Thus, the whole cost is smaller than the cost of cm,n r Gauss reductions of a vector of K m+n by a matrix of M r,m+n .

#G 1 subspaces #G 2 subspaces #G 3 subspaces Span(∅) V0 V1 V2 V3 V0,1 V0,2 V0,3 V1,2 V1,3 V2,3 V0,1,2 V0,1,3 V0,2,3 V1,2,3
Algorithm RecursiveExhaustiveSearch can be improved by taking into account the fact that, in Figure 2.1, we may have V 0,1 = V 0,2 . In this scenario, the recursive call corresponding to the node V 0,3 is facultative. Algorithm ImprovedRecursiveExhaustiveSearch takes into account this observation.

Algorithm 4 ImprovedRecursiveExhaustiveSearch

Input: T ⊂ L(K m , K n ; K) of dimension , G m,n , an integer r Output: S r (T ) 1: function ExpandSubspace(V, H, d, r) 2:
if d = r and dim V = r and T ⊂ V then

for i ∈ {0, . . . , #H -1} do H = {φ i | i ∈ [0, #H -1]} 7: H ← {φ i+1 , . . . , φ #H-1 } mod φ i Gauss reduction modulo φ i 8: S ← S ∪ ExpandSubspace(V ⊕ Span(φ i ), H , d + 1, r) 9:
end for 10:

return S 11:

end if 12: end function 13: return ExpandSubspace(Span(∅), G m,n , 0, r)
The refinement is the Gauss reduction on Line 7. The set H is a subset of H of vectors that form a set of representatives for the classes given by the Gauss reduction modulo φ i . More specifically, the elements of H are represented as vectors of K m+n and we reduce these vectors by a vector φ i , seen as a matrix of M 1,m+n .

Example 2.2 (Gauss reduction). Taking m = n = 2, we show in this example how the bilinear forms φ 0 , φ 1 , φ 2 and φ 3 , seen as the elements of

F 2+2 2 = F 4 2
(1, 0, 0, 0), (1, 1, 0, 0), (1, 1, 0, 1) and (0, 1, 1, 0), respectively, are reduced row-wise by the element represented by the 1 × 4 matrix 1 0 1 0 .

In this scenario we obtain from the set H = {φ 0 , . . . , φ 3 } the set H = {(0, 0, 1, 0), (0, 1, 1, 0), (0, 1, 1, 1)}.

In the presented version, the cardinality of H decreases at each call due to this modulo relation.

The algorithms BDEZ and BDEZStab that follow use the same strategy as ImprovedRecur-siveExhaustiveSearch. Their cost is different because the test on Line 2 is not the same (it uses HasRankOneBasis) and the initial call to ExpandSubspace takes different parameters.

Oseledets' heuristics

For certain bilinear maps, Oseledets proposes to use the presence of some rank-one bilinear forms in the initial vector space T , during the exhaustive search process. Indeed, he observes that for a vector space V such that V ∈ S r (T ), if U is a subspace of T generated by rank-one bilinear forms, then we can construct V via a partial exhaustive search. Montgomery already considers with a similar idea the case of the polynomial product in [START_REF] Montgomery | Five, six, and seven-term Karatsuba-like formulae[END_REF]. Indeed, he is looking for sets of rank-one bilinear forms containing

• a 0 b 0 , which is the coefficient of [X 0 ] in the polynomial product A(X) • B(X), • a n-1 b n-1 , which is the coefficient of [X 2n-2 ] and • (a 0 + • • • + a n-1 )(b 0 + • • • + b n-1 ), which is the sum of the coefficients of the [X i ]'s.
The idea is the following, assuming that the estimated rank of a subspace T is r, as in the general strategy:

• find the rank-one bilinear forms in T and denote their span by U ;

• enumerate all subspaces W ∈ S r-dim(U ) and test whether U ⊕ W contains T . Proposition 2.3. Let T be a subspace of dimension of L(K m , K n ; K), and let r ≥ be an integer. Let U ⊂ T be the subspace containing all the rank-one bilinear forms of T . For any V ∈ S r (T ), there exists

W ∈ S r-dim(U ) such that T ⊂ U ⊕ W . Proof. Let V ∈ S r (T ). Then U ⊂ V .
Let B be a basis of V of rank-one bilinear forms. Let U be a basis of U of rank-one bilinear forms. We can complete U with elements of B and obtain a new basis of V containing U. The elements added to U form a free family generating a subspace W ∈ S r-dim(U ) .

Moreover, Oseledets proposes a heuristic, in the case where the exhaustive search is too expensive. The idea is to take a bilinear form Φ of T , find rank-one bilinear forms generating Φ, and add these rank-one bilinear forms to the bases enumerated during the search, which is not exhaustive anymore.

Example 2.4. For the product of polynomial of degree 2, the bilinear form represented by

    0 1 0 1 0 0 0 0 0    
is in the target T . It can be decomposed as a sum of the matrices

    0 1 0 0 0 0 0 0 0     and     0 0 0 1 0 0 0 0 0     .
The search then consists in finding complements of

Span         1 0 0 0 0 0 0 0 0     ,     0 0 0 1 0 0 0 0 0     ,     0 1 0 0 0 0 0 0 0     ,     0 0 0 0 0 0 0 0 1     ,     1 1 1 1 1 1 1 1 1         .
Of course, this heuristic may lead to an overestimation of the rank.

The BDEZ Algorithm (Barbulescu, Detrey, Estibals, Zimmermann)

We describe in this section the algorithm [2, Alg. 1], which is an improvement of the recursive algorithm RecursiveExhaustiveSearch. It computes S r (T ) for a given subspace T ⊂ L(K m , K n ; K) of dimension .

In order to get all the vector spaces V ∈ S r such that T ⊂ V , we compute the vector spaces W ∈ S r-such that T ⊕ W ∈ S r . In other terms, instead of enumerating all the elements of S r , we rather enumerate complementary subspaces of T in S r-. This restriction can be done thanks to Proposition [2, Prop. 1], reformulated as Proposition 2.5 using the notations of Chapter 1.

Proposition 2.5. Let T be a subspace of dimension of L(K m , K n ; K), and let r ≥ be an integer. For any V ∈ S r (T ), there exists W ∈ S r-such that T ⊕ W = V .

Proof. Let B be a basis of V composed of rank-one bilinear forms. We define inductively a sequence of subspaces (W i ) 0≤i≤r-, such that for any i we have W i ∈ S i , as follows.

• The set W 0 is the null subspace and satisfies

T ⊕ W 0 = T ⊂ V and dim T ⊕ W 0 = . • For i ∈ {1, . . . , r -}, assuming that T ⊕ W i-1 ⊂ V and dim (T ⊕ W i-1 ) = + i -1, there exists φ ∈ B such that φ ∈ T ⊕ W i-1 (otherwise T ⊕ W i-1 = V and dim V ≤ r -1, which is a contradiction). Then, we define W i as W i = W i-1 ⊕ Span (φ). The subspace W i satisfies T ⊕ W i ⊂ V , dim (T ⊕ W i ) = + i and W i ∈ S i .
Taking W = W r-, Proposition 2.5 is proved.

Algorithm BDEZ can be described as a a recursive optimized version of RecursiveExhaus-tiveSearch. It constructs all the sets of cardinality r -of independent bilinear forms of rank one. The input of BDEZ is: a target T of dimension , the set of rank-one bilinear forms up to a multiplicative factor and an integer r (r is a lower bound on the rank of T , as explained in the global strategy).

Algorithm 5 BDEZ

Input: T ⊂ L(K m , K n ; K) of dimension , G m,n , an integer r Output: S r (T ) 1: function ExpandSubspace(V, H, d, r) 2:
if d = r and dim V = r and HasRankOneBasis(V ) then

S ← ∅

6:

for i ∈ {0, . . . , #H -1} do H = {φ i | i ∈ [0, #H -1]} 7: H ← {φ i+1 , . . . , φ #H-1 } mod φ i Gauss reduction modulo φ i 8: S ← S ∪ ExpandSubspace(V ⊕ Span(φ i ), H , d + 1, r) 9:
end for 10:

return S 11:

end if 12: end function 13: return ExpandSubspace(T, G mod T, , r)

Gauss reduction of G modulo a basis of T This algorithm is represented by a tree in which each node at depth k corresponds to a vector space T ⊕ W i0,i1,...,i k-1 of dimension k generated by a basis of T and rank-one bilinear forms φ i0 , φ i1 , . . . , φ i k-1 . For example, assuming that the initial set of rank-one bilinear forms is {φ 0 , φ 1 , φ 2 , φ 3 } and ignoring the reduction computed on Line 7, we would obtain generically for r -= 3 the tree given in Figure 2.2.

#G 1 subspaces #G 2 subspaces #G 3 subspaces T T ⊕ W0 T ⊕ W1 T ⊕ W2 T ⊕ W3 T ⊕ W0,1 T ⊕ W0,2 T ⊕ W0,3 T ⊕ W1,2 T ⊕ W1,3 T ⊕ W2,3 T ⊕ W0,1,2 T ⊕ W0,1,3 T ⊕ W0,2,3 T ⊕ W1,2,3

Improving on BDEZ using RP-automorphisms

We present in this section, with kind permission from the authors, an unpublished improvement [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF] to Algorithm BDEZ. We use the RP-automorphisms defined in Chapter 1.

The algorithmic improvement comes from the fact that, for any target space T ⊂ L(K m , K n ; K) of dimension and any integer r ≥ , we have ∀σ ∈ Stab(T ), S r (T ) • σ = S r (T ), because σ preserves the rank (see Proposition 1.18). Thus, we can restrict our interest to the computation of the quotient S r (T )/ Stab(T ) instead of S r (T ).

In order to enumerate the elements of S r (T ), it is sufficient to obtain a set of representatives of S r (T )/ Stab(T ) , from which one can recover the whole orbits through the group action of Stab(T ). Moreover, we can compute S r (T )/ Stab(T ) faster than S r (T ). Thus, we adapt our general strategy to this idea.

General strategy for computing the bilinear rank using RP-automorphisms The new algorithmic strategy we are considering is stated as follows, for a target subspace T ⊂ L(K m , K n ; K) of dimension and the associated subgroup Stab(T ) of RP-automorphisms stabilizing T :

• start with the known lower bound r = on the bilinear rank;

• compute a set of representatives of S r (T )/ Stab(T ) (the set S r (T ) up to the action of Stab(T ));

• if S r (T )/ Stab(T ) = ∅, increment r and return to the previous step;

• recover S r (T ) using the action of Stab(T );

• r is the bilinear rank and S r (T ) the set of optimal decompositions.

Algorithm BDEZStab is a recursive approach for the computation of a set of representatives of S r (T )/ Stab(T ) . The input of BDEZStab is: a target subspace T of dimension , the set of rank-one bilinear forms of L(K m , K n ; K) up to a multiplicative factor, the group Stab(T ) and an integer r ≥ .

Algorithm 6 BDEZStab

Input: T ⊂ L(K m , K n ; K), the stabilizer Stab(T ), an integer r Output: A set of representatives of S r (T )/ Stab(T )

1: function ExpandSubspace(V, H, U, d, r) V ⊂ L(K m , K n ; K), H ⊂ G, U ⊂ Stab(T ), r ∈ N 2:
if d = r and dim V = r and HasRankOneBasis(V ) then O ← H/ U φ and φ lie in the same orbit if

V ⊕ Span(φ) = (V ⊕ Span(φ )) • σ 7: for i ∈ {0, . . . , #O -1} do O = {O i | i ∈ {0, . . . , #O -1}} 8: φ ← Representative(O i ) Choose a representative of the orbit O i 9: U ← Stab (V ⊕ Span({φ})) ∩ U 10: H ← ∪ j≥i O j 11: S ← S ∪ ExpandSubspace(V, H , U , d + 1, r) 12:
end for 13:

return S 14:

end if 15: end function 16: return ExpandSubspace(T, G, Stab(T ), , r) On Line 6, we split the set H into orbits and we have a basis of V forming a dim(V ) × mn matrix M . We proceed as follow:

1. if H is not empty, pick an element φ of H, Figure 2.3 describes this recursive approach using a tree and illustrates how some branches are pruned, relying on Proposition 2.6. We assume that the initial set of rank-one bilinear forms is {φ 0 , φ 1 , φ 2 , φ 3 } and that we have

σ ∈ Stab(T ) such that σ(φ 0 ) = φ 1 , σ(φ 1 ) = φ 0 , σ(φ 2 ) = φ 3 and σ(φ 3 ) = φ 2 .
Proposition 2.6. Let T and V be subspaces of L(K m , K n ; K) such that V ∈ S r (T ). Then, given a bilinear form φ of rank one, if V satisfies V ∩ ({φ} • Stab(T )) = ∅, there exists an element V in the equivalence class of V for the action of Stab(T ) and such that φ ∈ V .

Proof. There exists σ ∈ Stab(T ) such that φ • σ ∈ V . We can then take V = V •(σ -1 ), which meets all the conditions. The particularity of BDEZStab is that, instead of enumerating all the elements of H as in BDEZ, we restrict ourselves to one element per equivalence class for the action of U ⊂ Stab(V ).

We use in particular the fact that the additional computations such as stabilizers on Line 9 are negligible, compared to the speed-up obtained by pruning branches in BDEZ. Heuristically, BDEZStab is faster than BDEZ by a factor # Stab (T ). This method constitutes the state of the art for the current work: our contribution is compared to the performance of this algorithm. Chapter 3

T T ⊕ W0 T ⊕ W2 T ⊕ W1 T ⊕ W3 T ⊕ W0,1 T ⊕ W0,2 T ⊕ W0,3 T ⊕ W1,2 T ⊕ W1,3 T ⊕ W2,3 T ⊕ W0,1,2 T ⊕ W0,1,3 T ⊕ W0,2,3 T ⊕ W1,2,3 σ σ σ

A new algorithm using coverings

Our contribution consists in reducing the number of vector spaces W that we need to enumerate in order to find those that satisfy T ⊕ W ∈ S r , where T is the vector space corresponding to a bilinear map. To this effect, we restrict ourselves to vector spaces W satisfying some properties intrinsic to T . In this chapter, the definition and theoretical aspects of the set of vector spaces that satisfy these properties are treated. We give several examples, such as the short product, the circulant product and the matrix product, in Chapter 4.

Intermediate algorithms

Algorithms ImprovedRecursiveExhaustiveSearch and BDEZ, presented in Section 2.2.3 and 2.2.4, can be seen as two extreme cases of a more general set of strategies. Indeed, ImprovedRecur-siveExhaustiveSearch and BDEZ are both associated to a tree whose leaves are labeled by cm,n d elements (not necessarily distinct) of S d , d being a positive integer. In the case of ImprovedRecur-siveExhaustiveSearch, d = r where r is a candidate for the rank of a bilinear map Φ represented by the subspace T . In the case of BDEZ, d = r -, where is the dimension of T . Both algorithms call ExpandSubspace, but with different inputs.

Between RecursiveExhaustiveSearch and BDEZ, we can define intermediate algorithms, involving a parameter k ∈ {0, . . . , }, consisting in enumerating W ∈ S r-+k and then selecting the subspaces, which satisfy

T + W ∈ S r .
At first sight, since #S r-+k > #S r-, BDEZ should be preferred to any of those intermediate algorithms. However, for vector spaces T associated to specific bilinear maps, there exists a positive integer k such that any V ∈ S r (T ) can be decomposed as

V = T + W
where W ∈ S r-+k and T ∩ W satisfies some property, intrinsic to T , such as containing a particular subspace F of dimension k, or in broader generality containing one subspace F i among a finite set {F 0 , . . . , F g-1 } that is determined by T . Later on in this work, we will make this notion more precise and call such a finite set a stem. It allows one to compute a covering of S r (T ), which is why we use this abuse of terminology.

Our main contribution uses the fact that, for a well chosen subspace F ⊂ T of dimension k, we may have

#S r-+k (F ) ≥ #S r-. (3.1)
Thus, for specific T 's, for which we know a set of subspaces F i satisfying the Inequality 3.1 along with an algorithm computing the sets S r-+k (F i ) faster than S r-, we are able to deduce the set S r (T ) faster than BDEZ. Note that this method relies on the knowledge of the subspaces F i , which form, in fact, the so-called stem, as defined formally in the next section. Thus, the complexity of our method is difficult to establish, as it takes into account the algebraic specificities of the bilinear maps that are considered, such as the short product or the matrix product.

Coverings of optimal decompositions

First, our strategy consists in constructing, for any r ≥ , g sets {E i,r } i that are g subsets of S r-+ki , where k i is a non negative integer, satisfying some property described in Definition 3.1.

Definition 3.1 (Covering of a vector space). Let T be a subspace of

GL(K m ) × GL(K n ) of dimension . Let (E i,r
) 0≤i<g be a family of subsets parameterized by an integer r ≥ and where E i,r ⊂ S r-+ki , k i being a positive integer, for all i ∈ {0, . . . , g -1},. Then, (E i,r ) 0≤i<g is said to be a covering of T if and only if, for any vector space W ∈ S r-such that T ⊕ W ∈ S r , there exist an index i ∈ {0, . . . , g -1}, a subspace V ∈ E i,r , and an

RP-automorphism σ ∈ Stab(T ) such that T + (V • σ) = T ⊕ W .
Proposition 3.2. Given T as above and a covering (E i,r ) 0≤i<g of T , then, for any r ≥ , we have

S r (T ) ⊂ {T + V | ∃i ∈ {0, . . . , g -1} , V ∈ E i,r • Stab(T )}.
Proof. Let V ∈ S r (T ). By Proposition 2.5, there exists W ∈ S r-such that T ⊕ W = U . Then, by Definition 3.1, there exist an index i ∈ {0, . . . , g -1}, a subspace V ∈ E i,r , and an

RP-automorphism σ ∈ Stab(T ) such that T + (V • σ) = T ⊕ W . Taking V = V • σ, we thus have U = T + V and V ∈ E i,r
• Stab(T ), which proves the inclusion.

Thus, assuming that we have a method for computing the E i,r 's, we are able to cover the whole set S r (T ). For example, the family composed of the single set E 0,r = S r-/ Stab(T ) is a covering of T and an algorithm is known for its enumeration (namely, BDEZStab). We describe below how we construct the E i,r 's that we use in practice.

Definition 3.3 (Stem of a vector space). For a vector space T , a family (F i ) 0≤i<g of g subspaces F i ⊂ T of dimension k i is said to be a stem of T if and only if, for any basis B of T , there exist i ∈ {0, . . . , g -1}, an RP-automorphism σ ∈ Stab(T ) and a free family

F ⊂ B of size k i such that Span(F) • σ = F i .
Proposition 3.4. For a vector space T , a stem of T given by g subspaces F i ⊂ T , and g

subgroups U i ⊂ Stab(T ) ∩ Stab(F i ), the set of E i,r 's, such that E i,r is a set of representatives of the quotient S r-+ki (F i )/ U i , is a covering of T .
Proof. Let W ∈ S r-be such that T ⊕ W ∈ S r . Take a basis W of W , and complete it into a basis of T ⊕ W using rank-one bilinear forms, denoted by {ψ i } 0≤i< . For all i ∈ {0, . . . , -1}, write ψ i = t i + w i , with t i ∈ T and w i ∈ W .

The t i 's are linearly independent. Otherwise, there would exist coefficients

(λ i ) 0≤i< such that -1 i=0 λ i t i = 0, whence -1 i=0 λ i ψ i = -1
i=0 λ i w i , which would then contradict the fact that {ψ i } 0≤i< completes W into a basis of T ⊕ W .

Consequently, B = {t i } 0≤i< is a free family of vectors of T and, as dim(T ) = , B is a basis of T . Then, by Definition 3.3, there exist an index i ∈ {0, . . . , g -1}, a subset F ⊂ B of size

k i = dim(F i ), and an RP-automorphism σ ∈ Stab(T ) such that Span(F) • σ = F i . Let V = W ⊕Span(F). Writing F = {t i } i∈I , with I ⊂ {0, . . . , -1}, we define F = {ψ i } i∈I . Since ψ i = t i + w i and Span(F ) ∈ S ki , we have V = W ⊕ Span(F) = W ⊕ Span(F ) ∈ S r-+ki . Now, consider V = V • σ = (W ⊕ Span(F))
• σ: we also have V ∈ S r-+ki , as RPautomorphisms preserve the bilinear rank, and

F i = Span(F) • σ ⊂ V , whence V ∈ S r-+ki (F i ).
Finally, let V ∈ E i,r be a representative of the equivalence class of V in the quotient set S r-+ki (F i )/ U i : there exists an RP-automorphism γ ∈ U i such that V = V • γ. We then have

T + (V • γ -1 • σ -1 ) = T + (V • σ -1 ) = T + V = T + (W ⊕ Span(F)) = T ⊕ W
where the last equality comes from the fact that Span(F) ⊂ T . Finally, as γ -1 • σ -1 ∈ Stab(T ), this proves the result.

Given T and a stem of T , we can derive a new algorithm that computes S r (T ) via the computation of some intermediate sets

E i,r = S r-+ki (F i )/ U i for i ∈ {0, . . . , g -1}.
Example 3.5 (Two examples of stems). For any vector space T , let B be a basis of T . There exists a subset of B generating T (namely, B): {T } is a stem of T . There exists also a subset of B generating Span(∅) (namely, ∅): {Span(∅)} is a stem of T .

• An enumeration algorithm that uses {T } as a stem amounts to computing S r (T )/ Stab(T ) .

In this case, we did not decompose the original problem into simpler problems.

• If the stem chosen is the set {Span(∅)}, this is equivalent to enumerate a set of representatives of the quotient S r-(Span(∅))/ Stab(T ) . For this purpose, no better methods than BDEZStab is known.

Thus, BDEZStab can be seen as an approach derived from the stem {Span(∅)}. We propose here other strategies that are derived from stems, given by sets of subspaces F i ⊂ T of dimension k i . The enumeration of a set S r-+ki (F i ) is interesting in practice if its cardinality is less than #S r-. However, its cost depends also on the algorithms used for the computation of quotients and stabilizers and on how large k i is, which is detailed below.

No automatic method is known to determine, how to choose a stem for a given vector space T : we have to provide a stem for each T . This task has to be done by hand specifically for each bilinear map. In Chapter 4, we provide examples of such families for several bilinear maps.

Let F i be a basis of F i . Our strategy assumes that we have a finite representation of a group U i such that U i ⊂ Stab(T )∩Stab(F i ). In Proposition 3.4, the larger the groups U i are, the smaller the E i,r 's are. And we prefer to keep the E i,r 's as small as possible, since it gives smaller sets to enumerate. Thus, this should lead us to choose U i = Stab(T ) ∩ Stab(F i ). However, in practice, the method used in our implementation is specialized to the choice

U i = Stab(T ) ∩ Stab(F i ) ⊂ Stab(T )∩Stab(F i ) (we have Stab(F i ) ⊂ Stab(F i ))
because only in this case do we have a practical algorithm to enumerate a set of representatives for the quotient S r-+ki (F i )/ U i . Chapter 3. A new algorithm using coverings Notation 3.6. For a free family F of k bilinear forms and a positive integer d, we let

Sd+k (F) = S d+k (Span(F))/ Stab(F) .
In order to enumerate sets of the form S r-+ki (F i )/ Stab(T ) ∩ Stab(F i ) , we adopt a three-step strategy.

Remark 3.7. This strategy requires the precomputation of a set of representatives of the quotient S r-+ki/GL(K m ) × GL(K n ) .

Chapter 5 describes how to compute such a set. We may also precompute the quotient

S r-+ki/RPA m,n ,
which is smaller. It should be used in an optimized implementation. In our applications, it is not the main obstacle and the loss can often be recovered if the vector space of a bilinear map is invariant under the action of the transposition. However, there is a practical limit on their dimension k i , due to the precomputations that are used in our method and that constitute a bottleneck. Assuming that

# S d/GL(K d ) × GL(K d ) behaves as (d!) 1.1 over F 2 (which is an empirical estimate), storing a set of representatives of S d/GL(K d ) × GL(K d )
for d = 13 would require 15 terabytes for instance. Consequently, given the largest "d" for which we are able to compute in practice

S d/GL(K m ) × GL(K n ) ,
we have a practical constraint on how large the r-+k i 's may be: we should have r-+k i ≤ d for all i.

The first step consists in computing Sr-+ki (F i ) and is detailed in Section 3.3. The second step applies the action of the left transversal

Stab(F i )/ Stab(T ) ∩ Stab(F i ) ,
which can be computed using the algorithms proposed in [START_REF] Holt | Handbook of computational group theory[END_REF] for example. The third step consists in calling HasRankOneBasis for each element of the previous set.

We describe in Algorithm CoveringSetsMethod the global strategy to find optimal formulas for T in the sense of the bilinear rank, that is, to enumerate S r (T ) given a stem. We assume that we are given a subspace T and a set of g free families F 0 , . . . , F g-1 of T such that {Span(F i )} i forms a stem of T .

Algorithm 7 CoveringSetsMethod

Input: T, {F i } 0≤i<g , S r-+ki/GL(K m ) × GL(K n ) 0≤i<g , r Output: S r (T ) 1: S ← ∅ 2: for i ∈ {0, . . . , g -1} do 3: Q ← Sr-+ki (F i ), obtained from S r-+ki/GL(K m ) × GL(K n ) See Algorithm 8 in 3.3 4: L ← Stab(F i )/ Stab(T ) ∩ Stab(F i )
use e.g. [START_REF] Holt | Handbook of computational group theory[END_REF] 5:

for σ ∈ L, W ∈ Q do 6:
if

HasRankOneBasis(T + (W • σ)) then 7: S ← S ∪ {T + (W • σ)} 8:
end if

9:
end for 10: end for

11: return V ∈S V • Stab(T )
The computation of the quotient Q on Line 3 of CoveringSetsMethod is detailed in Section 3.3.

Enumerating the elements of Sr-+k (F)

In this section, T is a vector space of dimension . For Ψ 0 , . . . , Ψ k-1 bilinear forms of L(K m , K n ; K), Algorithm 8 explains how to compute a set of representatives of the quotient

Sr-+k ({Ψ 0 , . . . , Ψ k-1 }) = S r-+k (Span({Ψ 0 , . . . , Ψ k-1 }))/ Stab({Ψ 0 , . . . , Ψ k-1 }) , which is required in Algorithm CoveringSetsMethod of Section 3.2.

Algorithm 8 IntermediateSetViaQuotientComputation

Input: Ω a set of representatives of S r-+k/GL(K m ) × GL(K n ) , {Ψ 0 , . . . , Ψ k-1 } Output: One representative per orbit of Sr-+k ({Ψ 0 , . . . , Ψ k-1 }), defined as above

1: Q ← ∅ 2: for W ∈ Ω do 3: for {{Φ 0 , . . . , Φ k-1 } ⊂ W | ∀t, rk(Φ t ) = rk(Ψ t )}/ Stab(W ) do See Algorithm 9 4: if ∃σ ∈ GL(K m ) × GL(K n ), {Φ 0 , . . . , Φ k-1 } • σ = {Ψ 0 , . . . , Ψ k-1 } then 5: Q ← Q ∪ {W • σ} 6: end if 7:
end for 8: end for 9: return Q Correctness of Algorithm 8. By construction, any element of Q is an element of S r-+k ({Ψ 0 , . . . , Ψ k-1 }).

• First, we prove that any orbit of Sr-+k ({Ψ 0 , . . . , Ψ k-1 }) has a representative in Q.

Let W be a representative of an orbit in Sr-+k ({Ψ 0 , . . . ,

Ψ k-1 }). There exist σ ∈ Stab({Ψ 0 , . . . , Ψ k-1 }) and W ∈ Q such that W • σ = W . Thus, we have {Ψ 0 , . . . , Ψ k-1 } • σ -1 ⊂ W and the set Ψ 0 • σ -1 , . . . , Ψ k-1 • σ -1 satisfies the predicate on Line 4. Any σ such that {Ψ 0 , . . . , Ψ k-1 } • σ -1 • σ = {Ψ 0 , . . . , Ψ k-1 } satisfies σ ∈ σ • Stab({Ψ 0 , . . . , Ψ k-1 }), which means that an element of W • σ • Stab({Ψ 0 , . . . , Ψ k-1 }) = W • Stab({Ψ 0 , . . . , Ψ k-1 })
is included in the list returned by Algorithm 8. Thus, the list returned contains at least one representative per orbit of Sr-+k ({Ψ 0 , . . . , Ψ k-1 }).

• In the following, we prove that each orbit of Sr-+k ({Ψ 0 , . . . , Ψ k-1 }) has a unique representative in Q.

Assume that there exist W, W ∈ Q and γ ∈ Stab({Ψ 0 , . . . ,

Ψ k-1 }) such that W = W • γ. By construction, there exists W 0 , W 0 ∈ S r-+k and σ, σ ∈ GL(K m ) × GL(K n ) such that W = W 0 • σ and W = W 0 • σ . Then W 0 = W 0 • σ • γ -1 • σ -1 , whence W 0 = W 0 as on Line 2 of Algorithm 8 we enumerate only one representative of each orbit of S r-+k/GL(K m ) × GL(K n ) . Thus, σ • γ -1 • σ -1 ∈ Stab(W 0 ). Still by construction, there exists {Φ 0 , . . . , Φ k-1 } and {Φ 0 , . . . , Φ k-1 } ⊂ W 0 such that {Φ 0 , . . . , Φ k-1 } • σ = {Ψ 0 , . . . , Ψ k-1 } and {Φ 0 , . . . , Φ k-1 } • σ = {Ψ 0 , . . . , Ψ k-1 }.
Then,

{Φ 0 , . . . , Φ k-1 } = {Ψ 0 , . . . , Ψ k-1 } • σ -1 = {Ψ 0 , . . . , Ψ k-1 } • γ -1 • σ -1 = {Φ 0 , . . . , Φ k-1 } • σ • γ -1 • σ -1
and {Φ 0 , . . . , Φ k-1 } is in the same orbit as {Φ 0 , . . . , Φ k-1 } under the action of Stab(W 0 ), which is contradictory with the definition of the quotient on Line 3.

On Line 3 of Algorithm 8, we select all tuples of size k of elements Φ 0 , . . . , Φ k-1 such that rk(Φ i ) = rk(Ψ i ) for any i ∈ {0, . . . , k -1}. The different tuples are enumerated up to the action of Stab(W ). We proceed like described in Algorithm EnumerateTuples. We use a backtracking algorithm, similar to BDEZ, for which the recursive depth is bounded by k.

The number of recursive calls is bounded by #W for this algorithm. Consequently, the complexity is bounded by (#W ) k , without taking into account the gain due to the use of RPautomorphisms. The algorithms described in [START_REF] Holt | Handbook of computational group theory[END_REF] allows one to compute the orbits on Line 6. In our applications, k and dim(W ) are small.

Testing the predicate of Line 4 of Algorithm 8 is a problem generalizing the problem of [START_REF] Bürgisser | Algebraic Complexity Theory[END_REF]Ch. 19] and [START_REF] Jájá | Optimal evaluation of pairs of bilinear forms[END_REF]: given two pairs (M 0 , M 1 ) and (N 0 , N 1 ) of (M m,n ) 2 , determine whether there exists two invertible matrices X and Y such that

(X T M 0 Y, X T M 1 Y ) = (N 0 , N 1 )
. This can be done by computing a Weierstrass-Kronecker canonical form for (M 0 , M 1 ). When we consider more than 2 matrices, for example 3 matrices

(M 0 , M 1 , M 2 ) sent on (N 0 , N 1 , N 2 ), we compute (X, Y ) such that (M 0 , M 1 ) is sent on (N 0 , N 1
) and we compose it with elements of (Stab M 0 ∩ Stab M 1 )/ Stab M 2 , computed with the algorithms proposed in [START_REF] Holt | Handbook of computational group theory[END_REF] for example. The complexity for finding all the RP-automorphisms σ in IntermediateSetViaQuotientComputation is bounded by the cardinality of S r-+k (which is comparable to BDEZ) by construction, and is hard to estimate more precisely. In our applications, it appears to be negligible compared to BDEZ.

Algorithm 9 EnumerateTuples

Input: k, W , Stab(W ), Ψ 0 , . . . , Ψ k-1 Output: One representative per orbit of {{Φ 0 , . . . , Φ k-1 } ⊂ W | ∀t, rk(Φ t ) = rk(Ψ t )}/ Stab(W ) function RecursiveEnumeration(Φ, C, i, U ) C is a partition of the non zero elements of W , U is a subgroup of Stab(W ) if i = k then return Φ else S ← ∅ C ← O∈C {O/ U } for j ∈ {0, . . . , #C -1} do C = {O j | j ∈ [0, #C -1]} Φ[i] ← Representative(O j ) if rk(Φ[i]) = rk(Ψ i ) then S ← S ∪ RecursiveEnumeration(t, {O j , . . . , O #C -1 } , i + 1, U ∩ Stab(Φ[i])) end if end for return S end if end function C ← {{Φ ∈ W | Φ = 0}} Φ ← ( )
Empty vector of size k return RecursiveEnumeration(Φ, C, 0, Stab(W ))

Chapter 4

Application to examples of bilinear maps

An implementation in Magma V2.21-3 [START_REF] Bosma | The Magma algebra system. I. The user language[END_REF] of the algorithms BDEZ, BDEZStab and the new method has been done and is available at the address http://karancode.gforge.inria.fr.

We provide in this section the stems corresponding to certain bilinear maps and we compare the timings obtained for them, using different algorithms. Our Magma implementation of the algorithm is clearly slower than the original C version described in [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF]. However, since we are interested in the speed-up obtained from our work, we need a fair approach. We show in particular that Algorithm BDEZStab, although it has not been written in a multi-threaded version and in C, improves considerably on the timings estimated in [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF]. The new algorithm described in Chapter 3 is denoted by CoveringSetsMethod: compared to Algorithm BDEZStab, it constitutes a huge speed-up on particular instances of the bilinear rank problem. All the timings presented in this section have been done on a single core 3.3 GHz Intel Core i5-4590.

We need a few notations to denote the various bilinear maps we are interested in:

• MatProd (p,q,r) denotes the product of matrices p × q by q × r,

• ShProd denotes the product of polynomials modulo X ,

• CircProd the product of polynomials modulo X -1.

We describe in Table 4.1 timings for various bilinear maps and the implementations of BDEZ and BDEZStab. The number of tests represents the number of calls to HasRankOneBasis.

It is possible to estimate the time it would take to obtain a result for a bilinear rank problem out of reach for BDEZ or BDEZStab. We denote by N t the number of calls to HasRankOneBasis in these algorithms when the input r is equal to + t. ( is the dimension of the vector space T corresponding to the bilinear map). Since when r is too large, BDEZ is too expensive, there is a practical limit on the known values of N t , t being a positive integer. We consider the ratio Nt Nt-1 to estimate N t+1 . Assuming that this ratio decreases with t, which seems to hold empirically, we have

N t+1 ≤ N t N t-1 • N t , (4.1)
t being a positive integer of {1, . . . , r -}. Thus, we are able to predict timings for bilinear maps indicated in Table 4.1 via to this assumption, which allows us to compare Algorithm BDEZ to other approaches for problems of larger sizes. We estimate the number of tests by computing

N t • N t N t-1 r--t
where r -is the difference rk(T ) -dim(T ) for T representing a bilinear map and t is the largest integer for which we are able to compute N t . The time can be estimated with a similar technique. We observe that the speed-up seems to match with # Stab(T ), as expected. The estimated values in Table 4.1 relying on BDEZStab have not been effectively done because the implementation of CoveringSetsMethod allowed us to obtain more results, more efficiently. The estimations rely on the heuristic given by the Inequality 4.1. In the global strategy, we were increasing progressively the lower bound r on the rank, before running BDEZ, BDEZStab or CoveringSetsMethod. For r < rk(T ), the time spent in those algorithms is negligible, because of the exponential growth of their complexity.

It is not clear how to estimate timings for our approach CoveringSetsMethod beyond what has been done and reported in Table 4.1. However, for the set of bilinear maps for which Cov-eringSetsMethod allows one to compute all the optimal formulas, we observe a clear speed-up compared to BDEZStab. For example, in order to compute the bilinear rank of bilinear maps of larger degrees using this method, we need to be able to compute and store all the elements of S 10/GL(K 10 ) × GL(K 10 ) for ShProd 6 (and even more for other bilinear maps), which has not been done yet and requires an optimized implementation of the algorithm described in Chapter 5, combined with a classification of its orbits.

Henceforth, we describe how we computed optimal formulas for bilinear maps given in Table 4.1 via our approach. We provide some technical details, specific to each bilinear map, necessary for an implementation.

Application to the short product

Structure of the short product

Let be a positive integer, let Φ be the bilinear map Φ ∈ L(K , K ; K ) defined by the short product

Φ :     a 0 . . . a -1     ,     b 0 . . . b -1     →     c 0 . . . c -1     such that 0≤i< c i X -1-i = ( 0≤i< a i X i )( 0≤i< b i X -1-i ) mod X . Let T be
M (m 0 , . . . , m -1 ) = m 0 m 1 m -1 0 m 1 0 0 m 0            
, in the canonical basis. This matrix is an upper triangular Toeplitz matrix.

Let N be the matrix M (0, . . . , 1, 0). The matrix N is a nilpotent matrix such that ∀j ∈ {0, . . . , -1} , M (0, . . . , 0, 1, 0, . . . , 0 j zeros

) = N -1-j ,
and N = 0. The elements of the algebra K[N ] are the upper triangular Toeplitz matrices and

K[N ] ∼ = K[X]/(X ).
We provide in Theorem 4.1 a useful property describing the action of Stab(T ) on T . Proof.

• First, we prove that, for any element M ∈ T of rank , there exists R ∈ K[X] a polynomial of degree at most -1 such that R(0) = 0 and R(N ) = M , and that

∃N 1 ∈ Stab(T ), I • N 1 = R(N ).
Any element in the orbit of I has rank and any element of rank in T is associated to a polynomial R ∈ K[X] evaluated in N of degree -1 such that R(0) = 0. It remains to prove that the orbit of I corresponds exactly to the set of rank-elements. Given R ∈ K[X] such that R(0) = 0, we denote by N 1 (R) the element (I, R(N )). This element is in Stab(T ) because, for any S, we have R(N )S(N ) = (RS mod X )(N ), which is a polynomial evaluated in N of degree at most -1. We have:

I • N 1 (R) = (I) T • I • R(N ) = R(N ).
• We prove that, for any element M ∈ T of rank -1, there exists R ∈ K[X] a polynomial of degree at most -1 such that R(0) = 0, R (0) = 0 and R(N ) = M , and that

∃N 2 ∈ Stab(I) ∩ Stab(T ), N • N 2 = R(N ).
An element of the orbit of N is an element of rank -1 and an element of rank -1 in T is associated to a polynomial R ∈ K[X] evaluated in N of degree at most -1 such that R(0) = 0 and R (0) = 0. It remains to prove that N can mapped to any element of rank -1 via the action of Stab(I) ∩ Stab(T ). Let e be the vector (0, • • • , 0, 1), such that R(N )•e corresponds to the last colum of R(N ). We have R(N ) -1 e = 0. Thus, let P (N ) be the matrix whose columns are given by the tuple (R(N ) -1 • e , R(N ) -2 • e , . . . , R(N ) • e , e ). We have R(N )P (N ) = (0, R(N ) -1 • e , . . . , R(N ) 2 •e , R(N )•e ) = R(N ) and P (N )N = (0, R(N ) -1 •e , R(N ) -2 •e , . . . , R(N )• e ). Consequently, we have R(N )P (N ) = P (N )N and P (N ) -1 R(N )P (N ) = N . We take N 2 (R) = (P (N )

T , P (N ) -1 ):

N • N 2 (R) = R(N ) and N 2 (R) ∈ Stab(I) ∩ Stab(T ).
• Let (Ψ, Ψ ) be a couple of elements of T such that rk(Ψ) = and rk(Ψ ) = -1. Let (P, P ) be the corresponding matrices. According to the previous points, there exist

N 1 ∈ Stab(T ) such that I •N 1 = P and N 2 ∈ Stab(T )∩Stab(I) such that N •N 2 = P •N -1 1 . Consequently, we have (I, N ) = (P • N -1 1 • N -1 2 , P • N -1 1 • N - 1
2 ). • We prove that we have Stab(I) ∩ Stab(N ) ⊂ Stab(T ) and that, for any

N 3 ∈ Stab(I) ∩ Stab(N ), there exists R ∈ K[X] a polynomial of degree at most -1 such that R(0) = 0 and N 3 = ((R(N ) -1 ) T , R(N )).
Let N 3 ∈ Stab(I) ∩ Stab(N ). Since N 3 ∈ Stab(I), there exists P ∈ GL such that N 3 = ((P -1 ) T , P ) and, since N 3 ∈ Stab(N ), P -1 N P = N . We have P N = N P .

Multiplying a matrix by N on the left shifts the rows upward and multiplying N on the right shifts the columns on the right. Therefore, denoting by p ij the coefficients of P , with p 00 = 0 and p i0 = 0 for i ≥ 1, we have ∀(i, j) ∈ {1, . . . , -1} × {0, . . . , -1} , p i,j = p i+1,j+1 .

More particularly, P is equal to the evaluation in N of a polynomial R such that R(0) = 0, from which we deduce that

N 3 = ((R(N ) -1 ) T , R(N )) and N 3 ∈ Stab(T ).
Given the form of the elements of Stab(I) ∩ Stab(N ), its cardinality is equal to the number of polynomials R of degree at most -1 such that R(0) = 0, which is #K -1 (K -1).

Combining with the fact that there are #K -1 (K -1)

• #K -2 (K -1) couples (Ψ, Ψ ) of elements of T such that rk(Ψ) = and rk(Ψ ) = -1, we have # Stab(T ) = #K 3 -4 (#K - 1) 3 .

Stem of the short product

We consider in this section the example of the short product

Φ : (A, B) -→ A • B mod X =        a -1 b 0 + • • • + a 0 b -1 . . . a 1 b 0 + a 0 b 1 a 0 b 0       
we denote by Φ 0 , . . . , Φ -1 the bilinear forms such that ∀i ≥ 0, Φ i (A, B) = j∈{0,..., -1-i} a j b j+i and by T the subspace Span(Φ 0 , . . . , Φ -1 ).

In order to produce a covering of the vector spaces W satisfying T ⊕ W ∈ S r (T ) that we compute with CoveringSetsMethod, we need a stem of T . This stem is given in Proposition 4.2. Proof. We first observe that for any Φ ∈ Span(Φ -1-i , . . . , Φ -1 ), rk(Φ) ≤ i + 1. Therefore, any element of rank in T has a nonzero coordinate over Φ 0 in its decomposition over the basis (Φ 0 , . . . , Φ -1 ) and, reciprocally, any element having a nonzero coordinate over Φ 0 has rank . Thus, a basis B of T necessarily contains an element of rank denoted by Ψ. The element Ψ has a nonzero coordinate over Φ 0 , when we decompose it over {Φ 0 , . . . , Φ -1 }. Similarly, there exist Ψ ∈ B and λ ∈ K for which Ψ -λΨ has rank -1.

We then use Theorem 4.1 to find an element σ ∈ Stab(T ) such that

(Ψ • σ, Ψ • σ) = (Φ 0 , Φ 1 ) or (Ψ • σ, (Ψ -λΨ ) • σ) = (Φ 0 , Φ 1 ), which concludes.
We give in Table 4.2 the cardinality of coverings of S r (T ) given by Proposition 4.2 for the example T :

set cardinality S 2 (Span(∅)) = S 2 980
S 3 (Span(Φ 0 )) 28
S 4 (Span(Φ 0 , Φ 1 )) 6
Table 4.2: Comparison of the cardinality for = 3 of three coverings of T for K = F 2 .

We recall that we need to compute the set Q = Sr-+2 ({Φ 0 , Φ 1 }) for a given integer r. If we take = 3, we can represent Φ 0 and Φ 1 by the matrices

I =     1 0 0 0 1 0 0 0 1     and N =     0 1 0 0 0 1 0 0 0     .
Thus, for a given couple (M 0 , M 1 ) of matrices representing bilinear forms of a subspace W ∈ S r-+2/GL(K ) × GL(K ) , we are looking for invertible matrices X and Y such that

X T M 0 Y = I and X T M 1 Y = N,

Algorithm 10 IntermediateSetViaQuotientComputation (Short product)

Input: S r-+2/GL(K ) × GL(K ) Output: One representative per orbit of Q, defined as above

1: Q ← ∅ 2: for W ∈ S , ,r-+2/GL(K ) × GL(K ) do 3: for Ψ ∈ {Φ ∈ W | rk(Φ) = }/ Stab(W ) do 4:
Let σ such that Ψ • σ = I We obtain σ via a Gauss reduction 5:

W ← W • σ 6: for Ψ ∈ {Φ ∈ W | rk(Φ) = -1}/ Stab(W ) ∩ Stab(I) do 7: if ∃σ ∈ Stab(I), Ψ • σ = N then
Using that N and Ψ are similar

8: Q ← Q ∪ {W • σ • σ } 9:
end if

10:
end for 11:

end for 12: end for 13: return Q which is done in Algorithm 10. As it is precised on Line 4 of Algorithm 10, we find X and Y such that X T M 0 Y = I via Gauss reduction. Then, we need to check whether X T M 1 Y and N are similar or not ((X T M 1 Y ) should be the null matrix for this purpose), as done on Line 7 of Algorithm 10. In terms of complexity, we do not have explicit bounds. However, we can state that the complexity depends linearly on #Sr-+2/GL(K ) × GL(K ) and on the number of pairs of bilinear forms (Φ, Ψ) per element of S r-+2/GL(K ) × GL(K ) such that rk(Φ) = and rk(Ψ) = -1.

We managed to obtain all the elements of S r (T ), where T is the vector space generated by the bilinear forms associated to ShProd for = 4 and = 5 and r = rk(T ). The last column of Table 4.4 describes the number of equivalence classes of vector spaces in S r (T ), with respect to the group Stab(T ).

map

Example 4.3 (Example of a minimal set of non-scalar products for the short product modulo X 5 ). The matrices

         1 0 1 1 0 1 0 1 1 0 0 0 0 0 0 1 0 1 1 0 0 0 0 0 0          ,          0 0 0 0 0 1 0 0 1 0 0 0 0 0 0 1 0 0 1 0 0 0 0 0 0          ,          1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0          ,          0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0          ,          0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0          ,          0 1 1 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0          ,          0 1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0          ,          0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0          ,          1 0 1 0 0 0 0 0 1 0 1 0 1 0 1 0 0 0 0 0          ,          0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0          ,          0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0         
generate, in the canonical basis, the coefficients of Φ.

4.2 A stem of the optimal decompositions for the circulant product modulo (X 5 -1)

We present in this section how to find, with our approach, optimal decompositions of the polynomial product modulo (X 5 -1) over F 2 . We denote by T the target space spanned by the coefficients Φ i of the bilinear map

Φ : (A, B) → A • B mod (X 5 -1) =          Φ 0 Φ 1 Φ 2 Φ 3 Φ 4          =          a 4 b 1 + a 3 b 2 + a 2 b 3 + a 1 b 4 + a 0 b 0 a 4 b 2 + a 3 b 3 + a 2 b 4 + a 1 b 0 + a 0 b 1 a 4 b 3 + a 3 b 4 + a 2 b 0 + a 1 b 1 + a 0 b 2 a 4 b 4 + a 3 b 0 + a 2 b 1 + a 1 b 2 + a 0 b 3 a 4 b 0 + a 3 b 1 + a 2 b 2 + a 1 b 3 + a 0 b 4         
.

The subspace T has the following structure:

T = Span(φ) ⊕ H,
where φ = Φ 0 + Φ 1 + Φ 2 + Φ 3 + Φ 4
and H is a hyperplane containing all the bilinear forms of T of rank 4. For any ψ ∈ H such that ψ = 0, we have rk(ψ + φ) = 5.

Moreover, the action of Stab(T ) on H -{0} is transitive (observed empirically), which means that all the elements of rank 4 are in the same orbit. Consequently, it is also transitive on Span(φ) ⊕ H and all the elements of rank 5 are in the same orbit. We deduce from Proposition 4.4 that we need algorithms to compute the following sets:

• S 6 (Span(Φ 4 )) and

• S 9 (H).
Of course, using the stabilizer of T , we reduce our problem to the computation of

• S6 ({Φ 4 }) and • S 9 (H)/ Stab(H) (any element V ∈ E 1 satisfies T ⊂ V + Span(φ) ∈ S 10 ).
The particularity of our strategy for the circulant product is that, in order to compute E 1 , we propose a stem of H.

Span(U) • σ = Span(Φ 0 + Φ 1 + Φ 2 + Φ 3 ).
Proof. Any non zero element of H has rank 4 and is in the orbit of Φ 0 + Φ 1 + Φ 2 + Φ 3 for the action of Stab(H).

Thus, we deduce the set S 9 (H)/ Stab(H) from the enumeration of We have in Table 4.5 the timings the procedure described in Section 3.3. The set S 10 (T ) contains 2,025 elements divided in 9 equivalence classes of solutions. Interestingly, the set {Φ 0 } does not correspond to any element of S 10 (T ). It means that, for a basis B of bilinear forms of rank one containing φ and generating a subspace of S 10 (T ), the coordinate of the elements of rank 4 on φ is zero.

S6 ({Φ 0 + Φ 1 + Φ 2 + Φ 3 }). F d #

Application to matrix products

We denote by Φ p,q,r the bilinear map corresponding to the p × q by q × r matrix product:

Φ p,q,r : M p,q (K) × M q,r (K) -→ M p,r (K) (A, B) -→ A • B .
We denote by Φ i,j the bilinear forms such that Φ i,j (A, B) is the coefficient (i, j) of Φ p,q,r (A, B) for i ∈ {0, . . . , p -1} , j ∈ {0, . . . , r -1}. The elements Φ i,j satisfy Φ i,j (A, B) = 0≤h<q a i,h b h,j . The bilinear map Φ p,q,r is represented by a subspace of L(K pq , K qr ; K) denoted by T p,q,r = Span((Φ i,j ) i,j ).

In order to represent the elements of T p,q,r in terms of matrices of M pq,qr , we need an order on the a i,h 's and b h,j 's.

• For the a i,h 's, we fix the following order:

a i,h ≤ a i ,h if i ≤ i or i = i and h ≤ h , which
is the row-major order.

• For the b h,j 's, we fix the following order: b h,j ≤ b h ,j if j ≤ j or j = j and h ≤ h , which is the column-major order.

Then, in the bases of M p,q and M q,r given by the a i,h 's and b h,j 's ordered as above, the elements of T p,q,r can be represented as matrices of M pq,qr divided in blocks of size q × q equal to I q the identity matrix of M q,q . Consequently, this space is isomorphic to M p,r ⊗I q and all the elements of T p,q,r have a rank which is multiple of q.

Example 4.6 (Matrix representation of elements of T 2,2,2 ). The elements of T 2,2,2 are represented by matrices of M 4,4 spanned by

      1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0       ,       0 0 1 0 0 0 0 1 0 0 0 0 0 0 0 0       ,       0 0 0 0 0 0 0 0 1 0 0 0 0 1 0 0       ,       0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 1       , corresponding to the coefficients a 0,0 b 0,0 + a 0,1 b 1,0 , a 0,0 b 0,1 + a 0,1 b 1,1 , a 1,0 b 0,0 + a 1,1 b 1,0 and a 1,0 b 0,1 + a 1,1 b 1,1
, respectively. The previous matrices can also be expressed as

1 0 0 0 ⊗ I 2 , 0 1 0 0 ⊗ I 2 , 0 0 1 0 ⊗ I 2 , 0 0 0 1 ⊗ I 2 , respectively.
Let (e i ), (f h ) and (g j ) be the canonical bases of K p , K q and K r . The subspace T p,q,r can be easily characterized with the tensor notation: it is generated by the vectors, for i ∈ {0, . . . , p -1} , j ∈ {0, . . . , r -1},

Φ i,j = 0≤h<q e i ⊗ f h ⊗ f h ⊗ g j .
Theorem 4.7. Stabilizer of the matrix product For the group action M • (X, Y ) → X T M Y , the subgroup stabilizing the vector space T p,q,r can be described as the group given by the pairs (P ⊗ R T , Q ⊗ (R -1 )) for P ∈ GL p , R ∈ GL q , and Q ∈ GL r .

Proof. We denote by T p,q,r the vector space given by the product of matrices p × q by q × r, which is isomorphic to M p,r ⊗ I q (we do not use the canonical basis for this representation). For the group action M • (X, Y ) → X T M Y , we want to prove that the subgroup stabilizing the vector space T p,q,r is isomorphic to Stab(M p,r ) ⊗ Stab(I q ).

Let (X, Y ) be a pair of invertible matrices such that X T T p,q,r Y = T p,q,r . For any i ∈ {0, . . . , p -1} and j ∈ {0, . . . , q -1}, we denote by M i,j the matrix X T • (e i,j ) • Y , where e i,j is the canonical basis of M p,r . Denoting by X i,h the q × q blocks of X and Y ,j the q × q blocks of Y , we have M i,j = (X i,h Y j, ) h, for any i and j. Consequently, since X T • (e i,j ) • Y ∈ T p,q,r , we have ∀i, j, h, , X i,h Y j, ∈ Span({I q }).

(4.2)

Let (i, h) such that X i,h is not null and j any integer in {0, . . . , q -1}. We have the inclusion

X i,h • Span({Y j,0 , . . . , Y j,q-1 }) ⊂ Span({I q })
and, since Y is invertible, we even have the equality. Thus, for any (i, h) such that X i,h is not null, we have shown that X i,h is invertible. We have the same property for the blocks of Y .

Combining the fact that the blocks of X and Y that are not null are invertible and Equation (4.2), we can conclude that the stabilizer of T p,q,r is generated by matrices (X, Y ) such that there exists g ∈ GL q satisfying X T ∈ GL p ⊗g and Y ∈ GL r ⊗g -1 .

Corollary 4.8. The elements of T p,q,r of a given rank lie in the same orbit under the action of Stab(T p,q,r ).

Example 4.9 (Action of the stabilizer of T 2,2,2 ). The stabilizer of T 2,2,2 is generated by the following elements of GL(K 4 ) × GL(K 4 ):

            1 0 1 0 0 1 0 1 0 0 1 0 0 0 0 1       ,       1 0 0 0 0 1 0 0 0 0 1 0 0 0 0 1             ,             0 0 1 0 0 0 0 1 1 0 0 0 0 1 0 0       ,       1 0 0 0 0 1 0 0 0 0 1 0 0 0 0 1             ,             1 1 0 0 0 1 0 0 0 0 1 1 0 0 0 1       ,       1 1 0 0 0 1 0 0 0 0 1 1 0 0 0 1             ,             0 1 0 0 1 0 0 0 0 0 0 1 0 0 1 0       ,       0 1 0 0 1 0 0 0 0 0 0 1 0 0 1 0             ,             1 0 0 0 0 1 0 0 0 0 1 0 0 0 0 1       ,       1 0 1 0 0 1 0 1 0 0 1 0 0 0 0 1             ,             1 0 0 0 0 1 0 0 0 0 1 0 0 0 0 1       ,       0 0 1 0 0 0 0 1 1 0 0 0 0 1 0 0             .
The vector space of T 2,2,2 is isomorphic to M 2,2 ⊗ I 2 . Thus the elements of T 2,2,2 have rank 0, 2 or 4.

Via the action of Stab(T 2,2,2 ), all the elements of rank 2 can all be mapped to the element

      1 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0       .
Similarly, via the action of Stab(T 2,2,2 ), all the elements of rank 4 can all be mapped to the element

      1 0 0 0 0 1 0 0 0 0 1 0 0 0 0 1       .

Decomposition of the matrix product (3, 2, 3)

The rank of this bilinear map is known [START_REF] Hopcroft | On minimizing the number of multiplications necessary for matrix multiplication[END_REF]: it has rank 15. However, all the optimal formulas are not known. The target subspace of L(K 6 , K 6 ; K) considered is denoted by

T = Span({Φ i,j | i, j ∈ {0, 1, 2}}).
The elements of T can be represented as matrices of M 6,6 divided in blocks of size 2 × 2 equal to

δ 0 0 δ , δ ∈ K.
We produce a stem of T given by five subspaces of T .

Proposition 4.10 (Stem of the matrix product). The set

C = {Span({Φ 0,0 +Φ 1,1 +Φ 2,2 }), Span({Φ 0,0 +Φ 1,1 , Φ 0,1 +Φ 2,2 }), Span({Φ 0,0 +Φ 1,1 , Φ 1,1 +Φ 2,2 }), Span({Φ 0,0 + Φ 1,1 , Φ 2,2 }), Span({Φ 0,0 , Φ 1,1 , Φ 2,2 })}
is a stem of T : for any basis B of T , there exists U ⊂ B and σ ∈ Stab(T ) such that

Span(U) • σ ∈ C.
Proof. Let B be a basis of T .

• If there exists an element Φ of rank 6 in B, then there exists σ ∈ Stab(T ) such that

Φ 0,0 + Φ 1,1 + Φ 2,2 ∈ B • σ.
Otherwise, any element Φ of B has rank smaller or equal to 4 and we have to distinguish two cases.

• If there exists an element Φ of rank 4, there exists σ such that Φ 0,0 + Φ 1,1 ∈ B • σ and, consequently, there exists another element Φ ∈ B of rank 2 or 4 whose coordinate over Φ 2,2 in the basis (Φ i,j ) i,j is not null: we need to look at the possible orbits in which Φ is included under the action of the subgroup of Stab(T ) preserving the fact that Φ is in the orbit of Φ 0,0 + Φ 1,1 . We can prove that there exist 3 such orbits and that there exists σ ∈ Stab(T ) and U ⊂ B of cardinality 2 such that

U • σ =                {Φ 0,0 + Φ 1,1 , Φ 0,1 + Φ 2,2 } or {Φ 0,0 + Φ 1,1 , Φ 1,1 + Φ 2,2 } or {Φ 0,0 + Φ 1,1 , Φ 2,2 }.
• All the elements of B have rank 2 and there exists U ⊂ B and σ ∈ Stab(T ) such that

U • σ = {Φ 0,0 , Φ 1,1 , Φ 2,2 }.
In conclusion, we consider 5 intermediate sets:

• S7 ({Φ 0,0 +Φ 1,1 +Φ 2,2 }), set of subspaces containing the diagonal element Φ 0,0 +Φ 1,1 +Φ 2,2 , • S8 ({Φ 0,0 + Φ 1,1 , Φ 0,1 + Φ 2,2 }), set of subspaces containing Φ 0,0 + Φ 1,1 and Φ 0,1 + Φ 2,2 , • S8 ({Φ 0,0 + Φ 1,1 , Φ 1,1 + Φ 2,2 }), set of subspaces containing Φ 0,0 + Φ 1,1 and Φ 1,1 + Φ 2,2 ,
• S8 ({Φ 0,0 + Φ 1,1 , Φ 2,2 }), set of subspaces containing Φ 0,0 + Φ 1,1 and Φ 2,2 ,

• S9 ({Φ 0,0 , Φ 1,1 , Φ 2,2 }), set of subspaces containing Φ 0,0 , Φ 1,1 and Φ 2,2 .

Moreover, being able to decompose a matrix product of larger dimensions requires to improve on the theoretical aspect of our strategy, since the size of the required set

S 15/GL(K 9 ) × GL(K 9 )
is expected to be too large, based on the apparent exponential growth of the progression of the sets described in Table 5.2.

As described in Section 3.3, we need to precompute the quotients

S 6+k/GL(K 6+k ) × GL(K 6+k )
for k ∈ {1, 2, 3}, and we prove that we can restrict ourselves to subspaces containing at least one element of rank 6. The techniques for computing theses subsets are described in Chapter 5.

The sets returned by IntermediateSetViaQuotientComputation in Section 3.3, are computed in 1.6 • 10 5 seconds. They are defined as the following sets: We describe in Table 4.6 how we apply our method to the sets In conclusion, we are able to decompose Φ 3,2,3 over F 2 and to give all the possible optimal decompositions. We have a speed-up of 10 4 compared to our implementation of Algorithm BDEZStab. Although the rank of this bilinear map was already known thanks to Hopcroft and Kerr [START_REF] Hopcroft | On minimizing the number of multiplications necessary for matrix multiplication[END_REF], determining all the possible optimal decompositions was not a well studied problem to our knowledge. Furthermore, we obtain an alternative proof over K = F of the fact that the bilinear rank of Φ 3,2,3 is 15.

• {Φ 0,0 + Φ 1,1 + Φ 2,2 }, • {Φ 0,0 + Φ 1,1 , Φ 0,1 + Φ 2,2 }, • {Φ 0,0 + Φ 1,1 , Φ 1,1 + Φ 2,2 }, • {Φ 0,0 + Φ 1,1 , Φ 2,2 }. F d #
We prove with our algorithm that there is only one class of equivalence of vector spaces W ∈ S 6,6,15 containing T , for the group action induced by Stab(T ). It is interesting to note that this is also the case for T 2,2,2 . We do not have this kind of result for the short product for example.

The matrices

           0 0 0 0 0 0 1 1 1 1 0 0 0 0 0 0 0 0 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0            ,            0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0            ,            0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 0 0 0 0 0 0 0 0 1 1 0            ,            0 0 1 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 0 0 0 0 0 0 0 0 1 1 1            ,            1 0 1 1 0 1 1 0 1 1 0 1 0 0 0 0 0 0 1 0 1 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0            ,            0 0 0 0 0 1 1 1 1 0 0 0 0 0 0 1 1 1 1 0 1 1 1 1 0 0 0 0 0 0            ,            0 0 1 1 1 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0            ,            0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 1            ,            0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 1 0 0 1 0 1 0            ,            1 0 1 0 0 0 1 0 1 0 0 0 1 0 1 0 0 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0            ,            0 0 0 1 0 1 0 0 0 1 0 1 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0            ,           
0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0

1 1 1 1 1 1 0 0 0 0 0 0            ,            0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 1 1 0 1 0 1 1 1 0 1 0 1 1 1 0 1            ,            0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 1 0 0 0 0 0 0 0 0 0 0 0 0            ,            0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0 0 0 1 0 0 0           
form a set of non-scalar products leading to optimal formulas for the matrix product. We retrieve all the subspaces of S 15 (T ) via the action of the group Stab(T ).

Using the Hamming weight for the matrix product

We describe in this section a trick allowing one to speed-up the execution of our approach for the matrix product. However, this part is technical and can be skipped on a first read.

We still denote by T the subspace of L(K 6 , K 6 ; K) corresponding to the coefficients of the product of 3 × 2 by 2 × 3 matrices. We remind the stem of T that we consider: the set

C = {Span({Φ 0,0 +Φ 1,1 +Φ 2,2 }), Span({Φ 0,0 +Φ 1,1 , Φ 0,1 +Φ 2,2 }), Span({Φ 0,0 +Φ 1,1 , Φ 1,1 +Φ 2,2 }), Span({Φ 0,0 + Φ 1,1 , Φ 2,2 }), Span({Φ 0,0 , Φ 1,1 , Φ 2,2 })}.
We define the following sets:

• E 0 = S 7 (Span(Φ 0,0 + Φ 1,1 + Φ 2,2 )), • E 1 = S 8 (Span(Φ 0,0 + Φ 1,1 , Φ 0,1 + Φ 2,2 )), • E 2 = S 8 (Span(Φ 0,0 + Φ 1,1 , Φ 1,1 + Φ 2,2 )), • E 3 = S 8 (Span(Φ 0,0 + Φ 1,1 , Φ 2,2 )) and • E 4 = S 9 (Span(Φ 0,0 , Φ 1,1 , Φ 2,2 )).
In theory, we have to enumerate the elements of the sets S7 ({Φ 0,0

+ Φ 1,1 + Φ 2,2 }), S8 ({Φ 0,0 + Φ 1,1 , Φ 0,1 +Φ 2,2 }), S8 ({Φ 0,0 +Φ 1,1 , Φ 1,1 +Φ 2,2 }), S8 ({Φ 0,0 +Φ 1,1 , Φ 2,2 }) and S9 ({Φ 0,0 , Φ 1,1 , Φ 2,2 }),
denoted by Ẽ0 , Ẽ1 , Ẽ2 , Ẽ3 and Ẽ4 , respectively. However, one should notice that, given

V ∈ S 15 (T ) such that ∃W ∈ Ẽ4 , σ ∈ Stab({Φ 0,0 , Φ 1,1 , Φ 2,2 }), V = T + W • σ,
it may happen that there exists W ⊂ V such that

V = T + W and ∃σ ∈ Stab(T ), W • σ =                        S 7 (Span(Φ 0,0 + Φ 1,1 + Φ 2,2 )) or S 8 (Span(Φ 0,0 + Φ 1,1 , Φ 0,1 + Φ 2,2 )) or S 8 (Span(Φ 0,0 + Φ 1,1 , Φ 1,1 + Φ 2,2 )) or S 8 (Span(Φ 0,0 + Φ 1,1 , Φ 2,2 ))
.

In other terms, the V 's corresponding to the 5 sets to enumerate do not form a partition of S 15 (T ).

Thus, we propose, if possible, to enumerate a subset of E 4 , rather than the whole set, without losing exhaustivity. The strategy that is proposed is related to the notion of Hamming weight of the elements Φ 0,0 , Φ 1,1 and Φ 2,2 . Definition 4.11 (Hamming weight for S d ). Let W ∈ S d and B = (ψ 0 , . . . , ψ d-1 ) a basis of rank-one bilinear forms of W . Any x ∈ W has a unique decomposition over B:

x = t λ t • ψ t .
We define its Hamming weight over B as

H B (x) = #{t ∈ {0, . . . , d -1} | λ t = 0}.
We can extend the definition of the Hamming weight to any subset S of W :

H B (S) = min({#I | I ⊂ {0, . . . , d -1} , S ⊂ Span((ψ t ) t∈I )}).
The Hamming weight over some basis has a useful property related to the bilinear rank stated in Lemma 4.12.

Lemma 4.12. Let W ∈ S d and B a basis of W composed of rank-one bilinear forms. For any subset S of W , we have rk(Span(S)) ≤ H B (S).

Proof. Clear from the definition of the rank of a set S given in Definition 1.12.

We describe in Theorem 4.13 what is the subset of Ẽ4 that we consider.

Theorem 4.13. Let W be a subspace such that W ∈ Ẽ4 and T + W ∈ S 15 and let B be a basis of W composed of rank-one bilinear forms. Let Ẽ be the subset of elements W ∈ Ẽ4 such that

H B (Φ 0,0 + Φ 1,1 + Φ 2,2 ) = H B (Φ 0,0 ) + H B (Φ 1,1 ) + H B (Φ 2,2 ) and H B (Φ 0,0 + Φ 1,1 + Φ 2,2 ) > 6.
We obtain all the elements of S 15 (T ) via the enumeration of Ẽ0 , Ẽ1 , Ẽ2 , Ẽ3 and Ẽ .

We prove Theorem 4.13 within 2 steps:

1. We prove in Lemma 4.14 that if H B (Φ 0,0

+ Φ 1,1 + Φ 2,2 ) = H B (Φ 0,0 ) + H B (Φ 1,1 ) + H B (Φ 2,2
), a subspace V obtained as V = T + W • σ can also be obtained as

V = T + W • σ, with W ∈ Ẽ0 , Ẽ1 or Ẽ3 . 2. Otherwise, if H B (Φ 0,0 + Φ 1,1 + Φ 2,2 ) = H B (Φ 0,0 ) + H B (Φ 1,1 ) + H B (Φ 2,2
), it remains to prove that we do not lose in generality if we assume that H B (Φ 0,0 + Φ 1,1 + Φ 2,2 ) > 6, which is done in Lemma 4.15.

Lemma 4.14. Let W ∈ S 9 and let V = T + W . We assume that T + W ∈ S 15 (T ) and Span({Φ 0,0 , Φ 1,1 , Φ 2,2 }) ⊂ W . Let B be a basis of rank-one bilinear forms of

W . If H B (Φ 0,0 + Φ 1,1 + Φ 2,2 ) = H B (Φ 0,0 ) + H B (Φ 1,1 ) + H B (Φ 2,2 ), there exists W ⊂ W such that V = T + W and there exists σ ∈ Stab(T ) such that W • σ ∈ E 0 , E 1 or E 3 .
Proof. We have by hypothesis

H B (Φ 0,0 + Φ 1,1 + Φ 2,2 ) < H B (Φ 0,0 ) + H B (Φ 1,1 ) + H B (Φ 2,2
). Thus, there exist two elements Ψ ∈ B and Φ ∈ {Φ 0,0 , Φ 1,1 , Φ 2,2 } such that the coordinate of Φ on Ψ is not zero and the coordinates of Φ 0,0 + Φ 1,1 + Φ 2,2 on Ψ is zero. By considering the vector space W = Span(B -{Ψ}), we have W ∈ S 8 . Moreover, we have W = Span({Ψ}) ⊕ W = Span({Φ})⊕W and T +(Span({Φ})⊕W ) =⊂ T +W . Thus, dim(T +W ) = dim(T +W ) = 15.

Consequently, dim(T ∩ W ) = 2.
If there exists in T ∩ W two elements Φ 1 and Φ 2 of rank smaller or equal to 4 such that

Φ 1 + Φ 2 = Φ 0,0 + Φ 1,1 + Φ 2,2 , then ∃σ ∈ Stab(T ), W • σ ∈      S 8 (Span(Φ 0,0 + Φ 1,1 , Φ 0,1 + Φ 2,2 )) or S 8 (Span(Φ 0,0 + Φ 1,1 , Φ 2,2 )) . Otherwise, there exists W ⊂ W such that ∃σ ∈ Stab(T ), W • σ ∈ S 7 (Span(Φ 0,0 + Φ 1,1 + Φ 2,2 ))
and T + W ∈ S 15 , which concludes. Lemma 4.15. Let V ∈ S 15 (T ). The subspace V satisfies hypotheses H1 and H2 state as follows.

H1: For any W ⊂ V such that there exists σ ∈ Stab(T ) satisfying W •σ ∈ S 9 (Span(Φ 0,0 , Φ 1,1 , Φ 2,2 ))

and T + W ∈ S 15 , we have, for any basis B of rank-one bilinear forms of W ,

H B (Φ 0,0 + Φ 1,1 + Φ 2,2 ) = H B (Φ 0,0 ) + H B (Φ 1,1 ) + H B (Φ 2,2 ).
H2: There do not exist W ⊂ V and σ ∈ Stab(T ) such that W • σ ∈ E 0 , E 1 , E 2 or E 3 and V = T + W (in other terms, V can not be obtained via the enumeration of Ẽ0 , Ẽ1 , Ẽ2 or Ẽ3 ).

Then, there exists W ⊂ V and σ ∈ Stab(T ) such that W • σ ∈ S 9 (Span(Φ 0,0 , Φ 1,1 , Φ 2,2 )), T + W ∈ S 15 , and W has a basis B of rank-one bilinear forms such that

H B •σ (Φ 0,0 + Φ 1,1 + Φ 2,2 ) > 6.
Proof. Let W ∈ S 6 be such that T ⊕ W ∈ S 15 . Take a basis W of W , and complete it into a basis B of T ⊕ W using 9 rank-one bilinear forms, denoted by {ψ i } 0≤i<9 . For all i ∈ {0, . . . , 8}, write ψ i = Φ i + Ψ i , with Φ i ∈ T and Ψ i ∈ W . The Φ i 's form a basis of T . In our context, we

• If Ψ 1 has rank three, using the action of Stab(Φ 0,0 + Φ 1,1 ) ∩ Stab(T ), we are brought to one possibility satisfying the good shape: Ψ 1 = Φ 0,0 .

• If Ψ 1 has rank 6, because of its shape, it is necessarily equal to Φ 0,0 + Φ 0,1 + Φ 1,0 .

In the second case, there exists σ ∈ Stab(T ) such that B • σ = (Φ 0,0 , Ψ 1 , Ψ 2 , Ψ 3 ). There exists i ∈ {1, . . . , 3} such that the coordinates of Ψ i in the basis (Φ 0,0 , Φ 1,1 , Φ 0,1 , Φ 1,0 ) have the following shape:

(λ 0 , 1, λ 2 , λ 3 ).

We can assume that i = 1. Then, there exists

σ ∈ Stab(T ) such that B • σ = (Φ 0,0 , Φ 1,1 , Ψ 2 , Ψ 3 ).
It may seem that we have a stem of 3 sets given by S 9 (Span(Φ 0,0 +Φ 1,1 , Φ 0,0 )), S 9 (Span(Φ 0,0 + Φ 1,1 , Φ 0,0 + Φ 1,0 + Φ 0,1 )) and S 9 (Span(Φ 0,0 , Φ 1,1 )). Actually the first and the third sets are equal.

Thus, we compute the following sets, corresponding to the quotient Q computed with Inter-mediateSetViaQuotientComputation in Section 3.3: We obtained a speed-up of 10 9 compared to our implementation of BDEZStab, and we found 1,096,452 elements of S 11 (T ), divided in 196 equivalence classes of solutions with respect to the action of Stab(T ). The computations described in Table 4.8 used an improved Step 3 for the family {Φ 0,0 +Φ 1,1 , Φ 0,0 }: we select a subset of the transversal that is applied. This improvement takes into account two facts. First, the quotient Stab({Φ 0,0 , Φ 1,1 })/ Stab(T ) ∩ Stab({Φ 0,0 , Φ 1,1 }) can be represented by the set of representatives given by the pairs of the form

• S9 ({Φ 0,0 + Φ 1,1 , Φ 0,0 + Φ 0,1 + Φ 1,0 }), • S9 ({Φ 0,0 + Φ 1,1 , Φ 0,0 }). F d # Sd ({F}) tests step 1 (s) step 2 (s) step 3 (s) sol.        Φ 0,0 + Φ 1,1 , Φ 0,0 + Φ 0,1 +Φ 1,0        9 139 5.0 • 10 4 8.4 • 10 4 3.2 • 10 -1 7.3 • 10 44 Φ 0,0 + Φ 1,1 , Φ 0,0 9
P T 0 0 I , P -1 0 0 I , P ∈ GL 3 .
In particular, we know the action of such a pair on a matrix M ∈ M 6,6 composed of four block M 0,0 , M 1,0 , M 0,1 , M 1,1 gives P M 0,0 P -1 P M 0,1

M 1,0 P -1 M 1,1 .
Second, given a subspace W of S9 ({Φ 0,0 + Φ 1,1 , Φ 0,0 }), there exists two elements φ 0 , φ 1 ∈ T + W of rank one such that T + W = W ⊕ Span({φ 0 , φ 1 }). Thus, we have two non zero elements Ψ 0 and Ψ 1 in T such that there exist Ψ 0 , Ψ 1 ∈ W satisfying

Ψ 0 = φ 0 + Ψ 0 and Ψ 1 = φ 1 + Ψ 1 .
The elements Ψ 0 and Ψ 1 have a non zero coordinate at Φ 0,1 or Φ 0,1 over the basis

{Φ 0,0 , Φ 1,0 , Φ 0,1 , Φ 1,1 }.
Thus, we keep the elements W • σ such that W ∈ S9 ({Φ 0,0 + Φ 1,1 , Φ 0,0 }) and σ ∈ Stab(T ) ∩ Stab({Φ 0,0 + Φ 1,1 , Φ 0,0 }) for which there exist Φ 0 , Φ 1 ∈ W • σ for which their matrix representation in M 6,6 is composed of four blocks M 0,0 , M 1,0 , M 0,1 , M 1,1 such that rk(M 0,0 ) ≤ 1 and rk(M 1,1 ) ≤ 1.

Chapter 5

Algorithm for the precomputation required in the new method

In this section, we propose an approach for computing the set S m,n,d/GL(K m ) × GL(K n ) , required by the algorithm described in Section 3.3. Its cost is at least exponential in d, m and n and difficult to estimate precisely.

Representation of elements of Ω d

First, we describe how we represent elements of S m,n,d and we prove that, given the knowledge of Ω d , we can deduce the elements of S m,n,d/GL(K m ) × GL(K n ) for any m and n from this precomputation.

Let W be an element of S m,n,d . There exist d rank-one bilinear forms φ t : (a, b) → α t (a) • β t (b) such that W = Span (φ t ) t∈{0,...,d-1} . In the canonical basis of K m and K n , we represent α t and β t as matrices of M 1,m and M 1,n . Thus, there exist two matrices U ∈ M d,m and V ∈ M d,n , whose rows are given by the linear forms α t and β t respectively, and W can be represented by the pair (U, V ). Such a representation is not unique (for example, any permutation of the rows of (U, V ) gives a valid representation). In particular, for a pair of matrices (U, V ) representing some vector space W , there exists

σ = µ × ν in GL(K m ) × GL(K n ) such that the pair of matrices U , V , such that (U , V ) = (U • µ, V • ν) represents W • σ,
M 1 =     1 1 0 0 0 0 0 0 0 0 0 0     , M 2 =     0 0 0 0 0 0 0 0 1 0 0 0     , M 3 =     0 0 0 0 1 0 0 0 0 0 0 0     , M 4 =     0 0 0 0 0 1 0 0 0 0 0 0     , M 5 =     0 0 0 0 0 0 1 0 0 0 0 0     , M 6 =     0 0 0 0 0 0 0 1 0 0 0 0     . The couple of matrices (U, V ) associated to W is            1 0 0 0 0 1 0 1 0 0 1 0 0 1 0 0 1 0            ,            1 1 0 0 1 0 0 0 1 0 0 0 0 1 0 0 0 0 1 0 0 0 0 1            .
Assuming that we have a representation of the elements of

S d,d,d/GL(K d ) × GL(K d ) in terms of pairs of matrices (U, V ) ∈ M d,d × M d,

Method for the computation of a set of representatives of the quotient

Our strategy consists in deducing Ω d from the computation of Ω d-1 . Algorithm 11 describes this strategy: for each vector space W of Ω d-1 , we extend it to a vector space of L(K d , K d ; K) by adding a zero-column to the corresponding U and V matrices, and we consider the vector spaces W ⊕ Span(φ) that can be obtained by adding an element φ of rank one. We remove from the set of W ⊕ Span(φ) the vector spaces that are RP-isomorphic via an isomorphism test. We determine whether two vector spaces W and W are RP-isomorphic if there exists a basis of W of rank-one bilinear forms such that the corresponding couple of matrices (U , V ) in reduced column echelon form is equal to (U, V ). The complexity of this approach depends on the number of bases of rank-one bilinear forms of W , which, compared to d, is not large generically. However, there are degenerate cases for which the nomber of bases is very large (exponential in d 2 ). These cases require specific code to recognize them and to treat them separately. We denote by Extend the algorithm transforming a set of subspaces of L(K d-1 , K d-1 ; K) into subspaces of L(K d , K d ; K) with zero-padding.

Algorithm 11 IterativeQuotientsComputation

Input: Ω d-1 , a set G of rank-one bilinear forms Output:

Ω d 1: Ω d-1 ← Extend(Ω d-1 )
We compute extensions of elements of

Ω d-1 in L(K d , K d ; K) 2: L ← ∅ 3: for W ∈ Ω d-1 do 4: H ← G/ Stab W 5: for h ∈ H do 6: L ← L ∪ {W ⊕ Span(h)} 7:
end for 8: end for

9: return L/ GL(K d ) × GL(K d )
We remove RP-isomorphic vector spaces in L

The naive algorithm which checks for each pair of elements of the set L whether or not they are RP-isomorphic, computed in Line 9 of Algorithm 11, can be improved. Indeed, we propose to compute invariants for the group action induced by GL(K d )×GL(K d ) and to compare subspaces having the same invariants. For example, for W ∈ S d,d,d , we consider the polynomial

P W = 0≤t≤d p W,t X t such that ∀t ≥ 0, p W,t = #{φ ∈ W | rk(φ) = t}.
Therefore, for any σ ∈ GL(K d ) × GL(K d ), P W •σ = P W .

In Algorithm 11 we regroup the vector spaces of L which have the same invariants. For two subspaces W and W having the same invariants, we need to explain how we decide whether they are RP-isomorphic or not. We describe the procedure in Algorithm IsomorphismTest.

Algorithm 12 IsomorphismTest

Input: W and W in S d Output: true if and only if W and W are RP-isomorphic 1: We represent W by a pair (U , V ) in column echelon form 2: for B ⊂ W , basis of rank-one bilinear forms do

3:

We represent W by a pair (U, V ) in column echelon form given by the basis B if The column echelon form of

(U • σ, V • σ) is equal to (U , V ) then 6:
return true

7:
end if

8:
end for 9: end for 10: return false Thus, for a vector space W ∈ S d and H ⊂ W the set of rank-one bilinear forms in W , the complexity of IsomorphismTest is given by #H d , an approximation of the number of possible bases of rank-one bilinear forms, times d! times the cost of a Gauss reduction of two matrices of M d,d . If #H is too large, we apply the idea given in Section 5.3.

Improvement to the strategy using classification of vector spaces

This section is dedicated to a classification of the elements of Ω d which allows one to improve the isomorphism test and the computation of a stabilizer depending on the type. Proof. Let e 0 , . . . , e d-1 be a basis of K d . We consider α j ∈ L(K d ; K) such that α j (e k ) = 0 for k = j and α j (e j ) = 1, and

β ∈ L(K d ; K) such that β(e 0 ) = 1 and β(e k ) = 0 for k ≥ 1. Let W = Span(α 0 • β, α 1 • β, . . . , α d-1 • β).
Any φ ∈ W of rank one can be decomposed with a linear form α ∈∈ L(K d ; K) and the linear form already defined β: φ = α • v. Thus, we have all the possible bases by considering

(α 0 • σ)β, (α 1 • σ)v, . . . , (α d-1 • σ)β for σ ∈ GL(d, K).
According to Section 5.1, the complexity of testing whether two vector spaces W and W are RP-isomorphic depends on the number of bases of W of bilinear forms of rank one. The proposition 5.3 implies that by using the procedure described in Section 5.1, we possibly have to enumerate # GL(d, K) bases, which is too large for our applications.

However, it appears that the number of bases per W ∈ Ω d is, in general, smaller than # GL(d, K) by an order of magnitude. Moreover, we can deduce directly that a vector space having # GL(d, K) bases has a stabilizer RP-isomorphic to GL(d, K), given as a set of generators. Thus, it is possible to adapt our strategy to vector spaces having a lot of bases and to compute directly a set of generators. Definition 5.4. Let W ∈ Ω d , E a subspace of W and H be the set of elements of W of rank one.

We say that E is a left (respectively right) degenerate space if

• it is generated by elements h ∈ H,

• there exists α ∈ L(K d ; K) (respectively β) such that for any Φ ∈ H ∩ E, there exists

β ∈ L(K d ; K) (respectively α) such that Φ(a, b) = α(a) • β(b),
• its dimension is maximal over all subspaces having the two previous properties.

The definition of a degenerate space permits to restrict the number of bases considered, since two left (or right) degenerate spaces of the same dimension are trivially RP-isomorphic. Therefore, in order to check the existence of a transformation σ such that W = W • σ for W and W two elements of S d,d,d , it is interesting to check for a σ mapping a degenerate space onto another degenerate space. Proposition 5.5. Let W and W two elements of Ω d . If there exists a unique left (respec-tively right) degenerate space E ∈ W and if W and W are RP-isomorphic, then there exists a unique left (respectively right) degenerate space E ∈ W such that dim E = dim E. Thus, by using the proposition 5.5, we can restrict the search of a σ mapping a vector space W onto another one W by considering the elements sending the unique degenerate space of W (if it is unique) on the unique degenerate space of W .

It should be possible to take into account the case of several degenerate spaces. However, trying to establish the optimal strategy in that case goes beyond the scope of the current work.

Example 5.6. We give here an example of two vector spaces W and W of L(K 3 , K 4 ; K) containing a left degenerate space of dimension 4. The vector space W is generated by the bilinear forms represented by the matrices

M 0 =     1 0 0 0 0 0 0 0 0 0 0 0     , M 1 =     0 0 0 0 0 1 0 0 0 0 0 0     , M 2 =     0 0 0 0 0 0 0 0 1 0 0 0     , M 3 =     0 0 0 0 0 0 0 0 0 1 0 0     , M 4 =     0 0 0 0 0 0 0 0 0 0 1 0     , M 5 =     0 0 0 0 0 0 0 0 0 0 0 1     .
and the vector space W is generated by

N 0 =     1 1 0 0 0 0 0 0 0 0 0 0     , N 1 =     0 0 0 0 0 0 0 0 1 0 0 0     , N 2 =     0 0 0 0 1 0 0 0 0 0 0 0     , N 3 =     0 0 0 0 0 1 0 0 0 0 0 0     , N 4 =     0 0 0 0 0 0 1 0 0 0 0 0     , N 5 =     0 0 0 0 0 0 0 1 0 0 0 0     .
These vector spaces are RP-isomorphic and any isomorphism σ such that W

• σ = W satisfies Span(M 2 , M 3 , M 4 , M 5 ) • σ = Span(N 2 , N 3 , N 4 , N 5 ).
The vector spaces Span(M 2 , M 3 , M 4 , M 5 ) and Span(N 2 , N 3 , N 4 , N 5 ) are degenerate spaces of dimension 4.

We improve on the algorithm given by IsomorphismTest for vector spaces W and W containing degenerate spaces E and E , respectively, such that E is the unique degenerate space of dimension dim(E) of W .

Algorithm 13 IsomorphismTestDegenerate

Input: W and W in S d , E and E degenerate spaces of W and W respectively Output: true if and only if W and W are RP-isomorphic 1: We represent W by a pair (U , V ) in column echelon form such that the dim(E) first rows of U and V form a basis of E 2: for B ⊂ W , basis of rank-one bilinear forms containing a basis of E do 3:

We represent W by a pair (U, V ) in column echelon form given by the basis B such that the dim(E) first rows of U and V form a basis of E if The column echelon form of

(U • σ, V • σ) is equal to (U , V ) then 6:
return true

7:
end if

8:
end for 9: end for 10: return false Since we fixed the dim(E) first rows of U and V in IsomorphismTestDegenerate, if H is the set of rank-one bilinear forms of W , the complexity is reduced to

#H d-dim(E) times (d -dim(E))!
times the cost of a Gauss reduction.

Experimental results

We have been able to compute Ω d for i ∈ {1, . . . , 8} and K = F 2 with an implementation in Magma V2.21-3 [START_REF] Bosma | The Magma algebra system. I. The user language[END_REF] 1 .

We observe in Table 5.1 that it is more likely that a vector space Ω d has d bilinear forms of rank one rather than 2 d -1, although we have d! possible bases in the first scenario and d! • 2 d -1 d in the second one: the most common scenario is the nicer one in terms of computation. This is why it is interesting to consider the notion of degenerate space introduced in Section 5.3, which allows one to have a specific strategy for the rare cases where the number of possible basis is too large.

In Table 5.2, we give the time required to compute each Ω i with our method, its cardinality, and we compare it with a theoretical upper bound. We observe that an upper bound on #Ω d with the good order of magnitude is hard to obtain. Indeed, we are only able to say that #Ω d is bounded by the quantity

#K d -1 #K -1 2 • #Ω d-1 ,
corresponding to the number of possible rank-one bilinear forms that we add to elements of Ω d-1 to obtain an element of Ω i . This formula leads recursively to the following bound:

#Ω d ≤ 1 (#K -1) d   t∈{1,...,d} (#K t -1)   2 .
This upper bound differs by a huge factor from the true cardinality of Ω d and cannot consequently be used in a complexity analysis. set We provide in Figure 5.1 how subspaces of Ω 3 over F 2 are related to Ω 2 and Ω 1 by using its poset structure. We represent an element of Ω d by a couple of matrices (U, V ) of M

#elts of Ω 2 N #elts of Ω 6 N #elts of Ω 7 N 1
d=1 d=2 d=3 1 0 1 0 , 1 0 0 1 1 0 0 1 , 1 0 0 1 1 0 0 1 , 1 0 1 0     1 0 0 1 0 0 1 0 0     ,     1 0 0 0 1 0 0 0 1         1 0 0 0 1 0 0 0 1     ,     1 0 0 0 1 0 0 0 1         1 0 0 1 0 0     ,     1 0 0 1 0 0 1 0 0         1 0 0 1 0 0 0 1 0     ,     1 0 0 0 1 0 0 0 1         1 0 0 1 0 0 0 1 0     ,     1 0 0 0 1 0 1 0 0         1 0 0 0 1 0 0 0 1     ,     1 0 0 1 0 0 0 1 0         1 0 0 0 1 0 1 1 0     ,     1 0 0 0 1 0 0 0 1         1 0 0 0 1 0 1 1 0     ,     1 0 0 0 1 0 1 1 0         1 0 0 0 1 0 0 0 1     ,     1 0 0 0 1 0 1 1 0    
Ω 1 Ω 2 Ω 3 Ω 4 Ω 5 Ω 6 Ω 7 Ω 8 cardinality 1

Fast Fourier Transform

In this chapter, we describe the paradigm used to multiply large integers. This paradigm relies on the evaluation-interpolation scheme. The methods described in this chapter imply transforming integers into polynomials and, then, multiplying polynomials. We have some freedom about the choice of the ring of the coefficients of the polynomials and on their degrees.

Integers to polynomials

Let a and b be non negative integers to be multiplied. Let n be an upper bound on the bit-length of these integers. Standard substitution techniques (see e.g. [START_REF] Bernstein | Multidigit multiplication for mathematicians[END_REF]) allow one to compute c via the computation of the product C(x) = A(x)B(x), where A and B are univariate polynomials related to a and b. Polynomials are taken over some well-chosen ring R. (In this chapter, we do not explicitly fix a choice for R.)

We obtain the polynomials A and B using the representation of a and b. Assuming that we have their radix-2 representation, a and b can be seen as sequences of elements in {0, 1}. We have a = Let η = 2 t be a power of two. We have

a = 0≤i< n/t   0≤j<t a it+j 2 j   η i and b = 0≤i< n/t   0≤j<t b it+j 2 j   η i .
Via zero-padding on a and b, we can assume that there is no constraint on t = log 2 η except to be less than n. Denoting by ãi and bi the integers 0≤j<t a it+j 2 j and 0≤j<t b it+j 2 j , we consider the polynomials

A(X) = 0≤i<n/t ãi X i and B(X) = 0≤i<n/t bi X i .
A procedure allowing one to multiply the polynomials A, B ∈ Z[X] produces a polynomial

C = A • B satisfying C(η) = A(η) • B(η) = a • b = c.
The length of A and B is n/t . Thus, the length of C is 2 n/t -1.

We denote by N the smallest power of two such that 2 n/t -1 ≤ N . The integer N is an upper bound on the length of the polynomial C. In practice it may be interesting to consider that N is not a power of two, as it has been studied for example in [START_REF] Van Der Hoeven | The truncated fourier transform and applications[END_REF]. From an asymptotic point of view in the deterministic multi-tape Turing model, we are allowed to restrict the problem to the case where N is a power of two. Assuming that the coefficients of C are represented in radix 2, we have a procedure computing a radix-2 representation of c from that of C in O(n).

A procedure to multiply the polynomials A and B is required. We see A and B as elements of R[X] for some ring R for which the elements have a finite representation on a binary machine. For example, the ring R can be Z/ 2 k Z for some positive integer k, or C, the complex field, with finite precision. The main constraint on R is to allow one to represent correctly the coefficients of C. For the example given by the ring Z/ 2 k Z , it is required for 2 k to be larger than all the coefficients of C. This constraint can be summarized via the following inequality:

2 k ≥ N + 1 2 η 2 .
We prefer to use the inequality 6.1

2 k ≥ N η 2 , (6.1)
which is allowed because N is a power of two.

Reciprocally, Kronecker and Schönhage proposed in [START_REF] Kronecker | Grundzüge einer arithmetischen theorie der algebraischen grössen[END_REF][START_REF] Schönhage | Asymptotically fast algorithms for the numerical multiplication and division of polynomials with complex coeficients[END_REF] to multiply polynomials by transforming them into integers. Thus, the complexity of multiplication of polynomials is related to the complexity of the multiplication of integers. We refer to this method as "Kronecker substitution".

We can describe the algorithm as follows. Let A and B be polynomials of Z[X] of length N/2, with coefficients bounded by η = 2 t . Then, we consider the integers a and b such that a = A(2 k ) and b = B(2 k ), where 2 k = N • η 2 . We compute c = a • b. We read the coefficients of C from c by splitting c into pieces of bit-length k.

For example, if we multiply 1+X by X +X 2 , we obtain, in radix two with the least significant bit at the left, the integers When we split c into pieces of bit-length four, we obtain a polynomial C equal to C = (0000) + (1000)X + (0100)X 2 + (1000)X 3 + (0000)X 4 = X + 2X 2 + X 3 .

Evaluation-Interpolation

We describe how to compute the product of two polynomials A, B ∈ R[X]. For large degrees, we use the evaluation-interpolation scheme. The principle is to use the fact that for two sequences (x i ) and (y i ) of N elements of R, such that the x i 's are distinct, there exists exactly one polynomial C of degree at most N -1 such that C(x i ) = y i (by hypothesis, the ring R contains N distinct elements). This polynomial C can be obtained via the Lagrange interpolation. Using this fact, a polynomial C such that C = A • B can be computed via 3 steps:

1. compute the evaluation of A and B on N points x i ;

compute the point-wise products

A(x i ) • B(x i ); 3. compute C as the unique polynomial such that C(x i ) = A(x i ) • B(x i ).
This general strategy used to multiply polynomials is called the evaluation-interpolation scheme. Such a strategy is described in Algorithm 14, where we highlight the possibility of computing the product C(x) = A(x)B(x) by multipoint evaluation and interpolation if the ring R in which computations take place provides a nice and sufficiently large set of interpolation points. Reinterpret C as a polynomial in Z.

14:

return c = C(η). 15: end function The procedure followed by Algorithm 14 is in fact quite general, and can be applied to a wider range of bilinear operations than just integer multiplication. For example, one can adapt this algorithm to multiply polynomials or power series in various rings, or to compute other operations such as middle products or dot products. The last example of the dot product is archetypal of the situation where results of the MultiEvaluation step (as e.g. Â in Algorithm 14) are used more than once. The conditions on R that are used to guard against possible overflow must be adjusted accordingly. For example, if R is chosen with the form Z/ 2 m Z , the bound given by the inequality 6.1 implies that 2 m should be larger than N η 2 .

Discrete Fourier Transform

We now discuss how multi-evaluation can be performed efficiently. This depends first and foremost on the number of evaluation points N and on the ring R. FFT algorithms are specialpurpose algorithms adapted to evaluation points chosen among roots of unity in R. In order to allow R to be a non-integral ring, we need the following definition. Definition 6.1. Let N ≥ 1 be an integer, and R be a ring of characteristic zero or characteristic coprime to N , containing an N -th root of unity ω. We say that ω is a principal

N -th root of unity if ∀i ∈ [[1, N -1]], N -1 j=0 ω ij = 0.
The notion of principal root of unity is stricter than the classical notion of primitive root, and provides the suitable generalization to non-integral rings. For example in C × C, the element (1, i) is a primitive 4-th root of unity but not a principal 4-th root of unity.

Using the set of powers of ω as a set of evaluation points, we define the discrete Fourier transform (DFT) as follows. Definition 6.2 (Discrete Fourier Transform (DFT)). Let R be a ring with ω a principal N -th root of unity. The DFT of length N and base root ω over R is the ring morphism DFT N,w defined as:

R[X]/ (X N -1) → R[X]/ (X -1) × R[X]/ (X -ω) × • • • × R[X]/ (X -ω N -1 )
P → (P (1), P (ω), . . . , P (ω N -1 )).

We customarily write a DFT of length N of a polynomial P as the polynomial P of degree less than N -1 defined as

P = DFT N,ω (P ) = P (1) + P (ω)X + • • • + P (ω N -1 )X N -1 .
The DFT of a polynomial P can be understood as the product of a Vandermonde matrix

V (ω) =             1 1 1 • • • 1 1 ω ω 2 • • • ω N -1 1 ω 2 ω 4 • • • ω 2(N -1) . . . . . . . . . . . . 1 ω N -2 ω 2(N -2) • • • ω (N -2)(N -1) 1 ω N -1 ω 2(N -1) • • • ω (N -1)(N -1)             with the vector        P 0 P 1 . . . P N -1       
given by the coefficients of P . The discrete Fourier Transform is convenient because the inverse of a DFT is also a DFT scaled by 1/N (see e.g. [59, §8]). Proposition 6.3. Let P be a polynomial with coefficients in R and ω a principal root of unity of R. We have DFT N,ω -1 (DFT N,ω (P )) = N • P .

Proof. Let M be the matrix

V (ω -1 ) • V (ω). The coefficient (i, j) of M is 0≤k<N ω (-i+j)k
. By definition of a principal root of unity, if i = j, this coefficient is zero. Otherwise, it is equal to N . Thus, M is a diagonal matrix equal to N times the identity matrix.

Chapter 6. Fast Fourier Transform

Algorithm 15 General Cooley-Tukey FFT of order

N = N 1 N 2 1: Input: A = N -1 i=0 a i X i ∈ R[X]/ (X N -1) and ω a principal N -th root of unity. Let ω 1 = ω N2 and ω 2 = ω N1 . 2: Output: Â = DFT N,ω (A) = A(1) + A(ω)X + • • • + A(ω N -1 )X N -1 3: function LargeRadixCooleyTukeyFFT(A,N 1 ,N 2 ,ω) 4: Let (B j (X)) j ∈ R[X] N2 be such that A(X) = j<N2 B j (X N2 )X j ∀j, deg B j ≤ N 1 5:
for j ∈ {0, . . . , N 2 -1} do 6:

Bj ← DFT N1,ω1 (B j ) w 1 = w N2 is a principal N 1 -st root 7:
Bj ← Bj (ω j X)

8:
end for 9:

Let (S i (Y )) i ∈ R[Y ] N1 be such that j Bj (X)Y j = i S i (Y )X i ∀i, deg S i ≤ N 2 10: for i ∈ {0, . . . , N 1 -1} do 11: Ŝi (Y ) ← DFT N2,ω2 (S i ) w 2 = w N1 is a principal N 2 -nd root 12:
end for 13:

return i<N1 Ŝi (X N1 )X i 14: end function

• "radix-two FFT": For a length N = 2 k , compute N 2 = 2 transforms of length N 1 =
2 k-1 (often called "butterflies"), then recurse with two transforms of length 2. We use the notation RadixTwoCooleyTukeyFFT(N, ω, A) for this algorithm. The radix-two Cooley Tukey has a particular form, described in Algorithm 16, using the fact that ω N/2 = -1.

• "large-radix FFT": More generally, for a length N = 2 uq+r with r < u, and q > 0, compute N 2 = N/2 u transforms of length N 1 = 2 u , then recurse with transforms of length N 2 = N/2 u . When all recursive calls are unrolled, we see that the computation is based on transforms of length 2 u (or 2 r at the very end of the recursion). Those are done with RadixTwoCooleyTukeyFFT. We use the notation LargeRadixCooleyTukeyFFT(A, N, ω, 2 u ) for this algorithm.

It is clear that the latter approach specializes to the former when u = 1.

Algorithm 16 Radix-two Cooley-Tukey FFT of order N = 2 u 1:

Input: A = N -1 i=0 a i X i ∈ R[X]/ (X N -1)
and ω a principal N -th root of unity.

2: Output: Â = DFT N,ω (A) = A(1) + A(ω)X + • • • + A(ω N -1 )X N -1 3: function RadixTwoCooleyTukeyFFT(A,N ,ω) 4: if N = 2 then 5: return a 0 + a 1 + (a 0 -a 1 )X 6: else 7: B 0 ← a 0 + a 2 X + • • • + a N -2 X N/2-1 8: B 1 ← a 1 + a 3 X + • • • + a N -1 X N/2-1 9: B0 ← RadixTwoCooleyTukeyFFT(B 0 , N/2, ω 2 ) 10: B1 ← RadixTwoCooleyTukeyFFT(B 1 , N/2, ω 2 ) 11: B1 ← B1 (ωX) 12: Let (S i (Y )) i ∈ R[Y ] N/2 be such that B0 (X) + B1 (X)Y = 0≤i<N/2 S i (Y )X i 13: for 0 ≤ i < N/2 do 14: Ŝi (Y ) ← RadixTwoCooleyTukeyFFT(S i , 2, -1) 15:
end for 16:

return 0≤i<N/2 Ŝi (X N/2 )X i 17:
end if 18: end function For N = 16, we can illustrate RadixTwoCooleyTukeyFFT by a butterfly diagram given in Figure 6.1. We order the A i 's in the bitreverse order, which is the order obtained in RadixTwoCoo-leyTukeyFFT after the reordering obtained by the successive application of lines 7 and 8.

The complexity of Algorithm 16 requires to count:

• the additions and subtractions,

• the multiplications,

• the memory accesses.

Denoting by L(N ) the additions and subtractions in RadixTwoCooleyTukeyFFT, we have Denoting by C(N ) the multiplications in RadixTwoCooleyTukeyFFT, we have

L(N ) = N + 2L(N/2) if N > 2,
C(N ) = N/2 + 2C(N/2)
if N > 2, corresponding to computation of B1 (ωX) on Line 11 of RadixTwoCooleyTukeyFFT ( B1 being a polynomial of degree N/2), and C(2) = 0. The resolution of the recursive equation leads to C(N ) = N 2 (log 2 N -1). In RadixTwoCooleyTukeyFFT, the algorithmic aspects related to the storage of the roots of unity are not detailed. If we store the powers of ω in an array of length N , depending on how this storage is done, the distance between roots of unity may impact the complexity. Since transforms of sizes 2 or 4 imply less than 1 multiplication by a root of unity on a multitape Turing machine, we go to transforms of size 8 to give an example. We compute N/8 transforms of size 8. ). Thus, we have to store the roots of unity so that the distance between high powers of a root of unity should be small. Two solutions are possible.

A A0 A8 A4 A12 A2 A10 A6 A14 A1 A9 A5 A13 A3 A11 A7 A15 • • • • • • • • • • • • • • • • ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ • • • • • • • • • • • • • • • • ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ • • • • • • • • • • • • • • • • ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ ⊗ • • • • • • • • • • • • • • • • Â0 Â1 Â2 Â3 Â4 Â5 Â6 Â7 Â8 Â9 Â10 Â11 Â12 Â13 Â14 Â15 ω 0 ω 4 ω 0 ω 4 ω 0 ω 4 ω 0 ω 4 ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ⊕ ω 0 ω 2 ω 4 ω 6 ω 0 ω 2 ω 4 ω 6 ω 0 ω 1 ω 2 ω 3
• We store them in an array of length N . For each recursive call, we assume that we construct an array of length N/2 containing the powers of ω 2 .

• Alternatively, we precompute an array of size N + N/2 + N/4 + • • • + 2 containing the N powers of ω, then the N/2 powers of ω 2 , . . ., the two powers of -1.

In both cases, the cost of the memory accesses is O(N log 2 N ), because the cost of enumerating the N/2 k -th roots of unity, for some k ≤ log 2 N , is equal to O(2 k ).

Complexity of integer multiplication

Notation 6.6. We denote by M(n) the cost of the multiplication of two n-bit integers in the deterministic multitape Turing model [START_REF] Papadimitriou | Computational complexity[END_REF], also called bit complexity.

By combining the evaluation-interpolation scheme of §6.1 with FFT-based multi-evaluation and interpolation as in §6.4, we obtain quasi-linear integer multiplication algorithms. We identify several tasks whose costs contribute to the bit complexity of such algorithms.

• conversion of the input integers to polynomials in R[X];

• multiplications by roots of unity in the FFT computation;

• linear operations in the FFT computation (additions, etc);

• point-wise products of elements of R. Recursive calls to the integer multiplication algorithm are of course possible;

• recovery of the resulting integer from the computed polynomial.

Algorithm 14 chooses η a power of two so that the first and last steps above have linear complexity (at least provided that elements in R are represented in a straightforward way). If we go into more detail, M(n) then expresses as

M(n) = O(C(N ) • K FFT (R)) + O(N • K PW (R)),
with the following notations.

• K FFT (R) denotes the cost for the multiplications by powers of ω in R that occur within the FFT computation.

• K PW (R) denotes the binary cost for the point-wise products in R.

The costs K PW (R) and K FFT (R) are not necessarily equal.

Choice of the base ring

Depending on R, the bit complexity estimates of §6.5 can be made more precise. Some rings have special principal roots of unity that allow faster operations (multiplication in R) than others. Several choices for R are discussed in [START_REF] Schönhage | Schnelle Multiplikation großer Zahlen[END_REF]. We describe their important characteristics when the goal is to multiply two n-bit integers. We denote by log * the iterated logarithm function, defined recursively by log * x = 0 for any real number x ≤ 1, and by log * x = 1 + log * (log x) for x ≥ 1.

During the FFT, the cost of linear operations such as additions, subtractions or memory accesses is

O(N t log 2 N ) = O(m log 2 m).
Since 2 2t/N is a principal 2N -th principal root of unity in Z/ (2 e + 1)Z , all the multiplications in RadixTwoCooleyTukeyFFT are multiplications by powers of two: on a binary machine, this cost is linear. Thus, the cost of the multiplications during the FFT is also O(m log 2 m). The difficult part is concentrated in the point-wise product of the evaluation-interpolation scheme.

We can summarize the procedure as follows.

1. Two elements x and y of R are decomposed in Z/ 2 k Z and Z/ (2 e + 1)Z : we obtain polynomials to multiply over two different rings;

2. we compute the products in Z/ 2 k Z using Karatsuba's algorithm: since k ≈ log 2 m, we multiply polynomials of length N and whose coefficients have bit-length k, which has a cost O( √ m log 2 m) log 2 3 = o(m log 2 m) if we use Kronecker-substitution and Karatsuba's algorithm;

3. we compute the products in Z/ (2 e + 1)Z by calling recursively the Schönhage-Strassen algorithm;

4. we recompose the two products in R.

The cost of the decomposition and the recomposition is linear, using the Bézout identity

(2 e + 1) -2 k • 2 e-k = 1.
We precise in the following how to choose the parameters t, k and e such that the complexity of the product modulo (2 m + 1) is O(m log m log (2) m).

• In [START_REF] Schönhage | Schnelle Multiplikation großer Zahlen[END_REF], the parameters are chosen as follows:

t is the largest power of two such that t ≤ √ m;

-k = log 2 N ; -e = 2t; -R = Z/ 2 k (2 e + 1) Z . First, note that N = m/t ≥ √ m and that N | 2t. Second, since N (2 2t + 1) > N • 2 2t
, all the coefficients of the product modulo X N + 1 of two polynomials of length N and whose coefficients have bit-length at most t can be represented in the ring R.

Denoting by C(m) the complexity of the multiplication of two elements of Z/ (2 m + 1)Z , this leads to the equation

C(m) = O(m log 2 m) + N C(2t).
For m ≥ 4, there exists a constant d such that

C(m) m log 2 m ≤ d + C(2t) t log 2 m ≤ d + C(2t) 2t log 2 t = d + C(2t) (2t log 2 2t) 1 -1 log 2 2t . (6.2)
First, we have the following intermediate bound on

C(m) m log 2 m : ∀m ≥ 4, C(m) m log 2 m ≤ d + 2 C(2t) 2t log 2 2t = O(2 log (2) 2 m ) = O(log 2 m). (6.3)
For m < 4, we have C(m) m log 2 m = O(1), which means that we have the bound above for any m.

Returning to Equation (6.2), we have for m ≥ 4,

C(m) m log 2 m ≤ d + C(2t) t log 2 m ≤ d + C(2t) (2t log 2 2t) 1 -1 log 2 2t ≤ d + C(2t) 2t log 2 2t 1 + 2 log 2 2t
.

Thus, reusing the intermediate bound obtained in Equation (6.3), there exists a constant

d such that C(m) m log 2 m ≤ d + C(2t) 2t log 2 2t
.

By developing the recursive equation, we have

C(m) m log 2 m = O(log (2)
2 m)

and we obtain the complexity

C(m) = O(m • log 2 m • log (2)
2 m). It follows that the multiplication of two n-bit integers, for n ≤ m 2 , using the Schönhage-Strassen algorithm has cost of O(n

• log 2 n • log (2) 2 n).
• In [START_REF] Schönhage | Asymptotically fast algorithms for the numerical multiplication and division of polynomials with complex coeficients[END_REF], Schönhage proposes an alternative avoiding the use of the CRT. We can summarize the choice for the parameters as follows:

t is the largest power of two such that t ≤ √ m log 2 m; k = 0; e is the least integer such that 2 e ≥ N 2 2t and that N | e; -R = Z/ (2 e + 1) Z .

Note that we have e ≤ 2t + N + log 2 N ≤ 2t + 2N .

Still denoting by C(m) the complexity of the multiplication of two elements of Z/ (2 m + 1)Z , we have the equation

C(m) = O(m log 2 m) + N C(e).
For m ≥ 4, there exists a constant d such that

C(m) m log 2 m ≤ d + C(e) t log 2 m ≤ d + C(e) e log 2 e 2(t + N ) log 2 2(t + N ) t log 2 m . (6.4)
We have

2(t + N ) log 2 2(t + N ) t log 2 m = 2 log 2 t log 2 m + 2 log 2 (2 + 2N/t) log 2 m + 2 N log 2 t t log 2 m + 2 N log 2 (2 + 2N/t) t log 2 m = 2 log 2 t log 2 m + O 1 log 2 m = 1 + O log (2)
2 m log 2 m .

We obtain the following equation:

C(m) m log 2 m ≤ d + C(e) e log 2 e 1 + O log (2) 2 m log 2 m . (6.5)
There exists m 0 such that for m ≥ m 0 , O log

2 m log 2 m ≤ 1. We obtain the following intermediate bound:

C(m) m log 2 m ≤ d + 2 C(e) e log 2 e ≤ O(2 log (2) 2 m ) = O(log 2 m). (6.6)
We inject the bound of Equation (6.6) into Equation (6.5):

C(m) m log 2 m ≤ d + C(e) e log 2 e 1 + O log (2) 2 m log 2 m = O(log (2)
2 m) +

C(e) e log 2 e . (

By developping the previous inequality, we obtain

C(m) m log 2 m ≤ O(log (2)
2 m) 2 .

By injecting again the bound obtained for C(m) m log 2 m into Equation (6.5), we obtain the wanted result.

• It is often considered, as in [START_REF] Gaudry | A GMP-based implementation of Schönhage-Strassen's large integer multiplication algorithm[END_REF], that it is sufficient to take -N the largest power of two such that N ≤ √ m;

-k = 0;
e minimal such that e ≥ 2t + log 2 N and that N | e;

-R = Z/ (2 e + 1) Z .

For practical implementations, these parameters can be chosen. However, they do not correspond to an algorithm with an asymptotic complexity equal to the complexity of Schonhage-Strassen algorithm. Indeed, since N divides e and, consequently, 2t, we have e = 2t+N ≥ 2t+t = 3t. We denote by C(m) the complexity of the multiplication algorithm using recursively these parameters to multiply m-bit integers. There exists a constant d such that

C(m) ≥ dm log 2 m + N C(3t).
We denote by L(m) the solution of

L(m) = dm log 2 m + N L(3t).
L(m) is a lower bound on the cost C(m) of the algorithm multiplying integers without CRT. We have

L(m) ≥ dm log 2 m + 3 2 dm log 2 m + • • • + 3 2 log (2) 2 m
dm log 2 m.

There exists

d such that L(m) ≥ d m(log 2 m) 1+log 2 ( 3 2 )
, which is not the correct complexity. In the literature [START_REF] Gaudry | A GMP-based implementation of Schönhage-Strassen's large integer multiplication algorithm[END_REF][START_REF] Zur Gathen | Modern Computer Algebra[END_REF][START_REF] Knuth | The art of computer programming[END_REF], this detail is not covered.

The latter point implies that among powers of ω N , some enjoy particularly easy operations. When N is clear from the context, ω N is simply denoted by ω.

We consider a radix-2 λ+1 Cooley-Tukey FFT described by Algorithm 17. The key observation is that the "inner" transforms of length 2 λ+1 that are computed on Line 14 within the recursion involve multiplications by roots of unity which are then multiplications by powers of ω K = x ∈ R, and therefore inexpensive, since they can done via negacyclic shifts. We can count the few remaining expensive multiplications that occur within the recursion when N ≥ 2 λ+1 . Those correspond to the scaling operation Bk ← Bk (ω k X) on Line 15 of Algorithm 17. Their count E(N ) satisfies

E(N ) = 2 λ+1 E N 2 λ+1 + N, (7.1)
because we have K = N/2 λ+1 polynomials of degree J = 2 λ+1 that are composed with a power of ω (K • J = N multiplications) followed by J "outer" transforms of size K on Line 19. It follows that E(N ) = N ( log 2 λ+1 N -1).

Algorithm 17 Radix-2 λ+1 Cooley-Tukey FFT of order N , a power of two

1: Input: A = N -1 i=0 a i X i ∈ R[X]/ (X N -1)
and ω a principal N -th root of unity.

2: Output: Â = DFT N,ω (A) = A(1) + A(ω)X + • • • + A(ω N -1 )X N -1 3: function LargerRadixCooleyTukeyFFT(A,N ,λ,ω) 4: if N ≤ 2 then 5: return a 0 + a 1 + (a 0 -a 1 )X 6: else 7: J ← 2 8: if N ≥ 2 λ+1 then 9: J ← 2 λ+1 10: end if 11: K ← N/J 12:
for 0 ≤ k < K do 13:

Let B k be the polynomial given by the coefficients (a jK+k ) 0≤j<J 14:

Bk ← RadixTwoCooleyTukeyFFT(B k , J, ω K ) 15: Bk ← Bk (ω k X) 16:
end for 17:

Let (S j (Y )) j ∈ R[Y ] J be such that 0≤k<K Bk (X)Y k = 0≤j<J S j (Y )X j 18:
for 0 ≤ j < J do 19:

Ŝj (Y ) ← LargerRadixCooleyTukeyFFT(S j , K, λ, ω J ) 20:
end for 21:

return 0≤j<J Ŝj (X J )X j 22: end if 23: end function
We describe elements of C with a fixed precision. To multiply n-bit integers, Fürer selects λ = log

(2)
2 n and proves that precision O(log 2 n) is sufficient for the coefficients of the elements of R that occur in the computation. The integers to be multiplied are split into pieces of 2 2λ-1 bits. Each piece of 2 2λ-1 bits is then transformed into a polynomial of length 2 λ-1 whose coefficients are encoded on 2 λ bits. These polynomials are seen as elements of R. Moreover, the transform length is N = 4n/(log 2 n) 2 . Since we need to have 2 λ+1 | 2N , we should have n ≥ 2 10 . This decomposition is described in Algorithm 18 (FurerComplexMul).

Algorithm 18 Multiplication of integers with Fürer's algorithm

1: Input: a and b two n-bit integers, where n is a power of two and n ≥ 2 10 2: Output:

a • b mod (2 2n + 1) = a • b 3: function FurerComplexMul(a,b,n) 4: Let λ = log (2) 2 n , η = 2 2 2λ-1 , N = 2n/ log 2 η = 2n/2 2λ-1 , 5: Let R = C[x]/ (x 2 λ + 1)
, and ω = ω 2N as in §7.1.

6:

Let A 0 (X) ∈ Z[X] with non negative coefficients less than η be such that A 0 (η) = a; define B 0 (X) likewise.

7:

Let Ã(X, x) ∈ C[X, x] be such that Ã(X, 2 2 λ ) = A 0 (X). Define B likewise.

8:

Map à and B to polynomials A and B in R[X]/ (X N + 1)

9: Â ← LargerRadixCooleyTukeyFFT(A(ωX), N, λ, ω 2 )
computes Half-DFT N,ω (A)

10:

B ← LargerRadixCooleyTukeyFFT(B(ωX), N, λ, ω 2 )) computes Half-DFT N,ω (B) 11:
Ĉ ← PointwiseProduct( Â, B)

12: C ← 1 N LargerRadixCooleyTukeyFFT( Ĉ(ω -1 X), N, λ, ω -2 ) computes Half-IFT N,ω ( Ĉ) 13: Lift C to C ∈ C[X, x] 14:
return C(η, 2 λ ) 15: end function

Precision of the modular ring and complexity analysis

We show in this section that there exists in R = C[x]/ (x 2 λ + 1) a principal root of unity ω(x) such that the coefficients of ω are all in R, when λ ≥ 1. Consequently, we can represent, using this principal root of unity, all the coefficients of the elements of R used in Fürer's algorithm assuming that they live in R. When λ = 0, the proposed construction does not work. We describe the precision required to store elements of R assuming that the coefficients are in R and we describe the complexity analysis given by Fürer in [START_REF] Fürer | Faster integer multiplication[END_REF].

From a complex ring to real ring

First, we need an explicit expression of a polynomial obtained by Lagrange interpolation at the points (ζ 2j+1 ) 0≤j<2 λ . Therefore, we give the expression of the corresponding Lagrange basis.

Lemma 7.1. The Lagrange polynomial basis ( j ) 0≤j<2 λ corresponding to the evaluation points (ζ 2j+1 )) 0≤j<2 λ (i.e., evaluation in the R j 's) is given by

j = 1 2 λ 2 λ -1 t=0 x ζ 2j+1 t .
Proof. For any j ∈ 0, . . . , 2 λ -1 ,

j = f (x) f (ζ 2j+1 )(x -ζ 2j+1 ) , with f (x) = 2 λ -1 k=0 (x -ζ 2k+1 ) = x 2 λ + 1. Note that (ζ 2j+1 ) 2 λ = (ζ 2 λ ) 2j+1 = (-1) 2j+1 = -1. Thus, we have f (x) = 1 + x 2 λ = 1 - x ζ 2j+1 2 λ and f (ζ 2j+1 ) = - 2 λ ζ 2j+1 . Therefore, j = 1 2 λ x ζ 2j+1 2 λ -1 x ζ 2j+1 -1 = 1 2 λ 2 λ -1 t=0 x ζ 2j+1 t .
We suppose that we have N such that 2 λ | N . Let σ = exp(iπ/N ) ∈ C: it is a principal 2N -th root of unity and ζ = σ N/2 λ . Let ω ∈ R such that ω maps to σ 2j+1-2 λ in R j . In other words,

ω(ζ 2j+1 ) = σ 2j+1-2 λ = σ 2j+1 σ 2 λ .
Then, ω is a 2N -th principal root of unity if and only if 1 -2 λ is odd, since ω N = 1 if and only if if 1-2 λ is odd. We want to show that the coefficients of ω are real. For this purpose, we compute explicitly these coefficients. Using Lagrange interpolation to compute ω = 0≤j<2 λ σ 2j+1-2 λ j , we have an explicit expression of its coefficients with the lemma above. Proposition 7.2. For λ ≥ 1, the ω ∈ R is a principal 2N -th root of unity and, for all k ∈ Z,

ω k =        (-x) k = (-1) k + k /2 x k mod 2 λ if k = k N/2 λ , and
1 2 λ 2 λ -1 t=0 sin k2 λ π N sin kπ N -tπ 2 λ
x t otherwise.

Proof.

• Since ω maps to a principal 2N -th root of unity in each R j , then ω is also a principal

2N -th root of unity in R ∼ = 2 λ -1 j=0 R j .
• Assume k = k N/2 λ . Then, in each R j , we have

ω(ζ 2j+1 ) k = σ 2j+1 σ 2 λ k = (σ N/2 λ ) 2j+1 σ N k = (-ζ 2j+1 ) k ≡ (-x) k (mod x -ζ 2j+1 ).
Therefore, in R, we have ω k = (-x) k = (-1) k x k = (-1) k + k /2 λ x k mod 2 λ , as x 2 λ = -1.

• If k is not divisible by N/2 λ , we compute ω k by Lagrange interpolation:

ω k = 2 λ -1 j=0 ω(ζ 2j+1 ) k j = 2 λ -1 j=0 σ k(2j+1) σ k2 λ j = 1 2 λ σ k2 λ 2 λ -1 j=0 2 λ -1 t=0 σ k ζ t 2j+1 x t = 1 2 λ σ k2 λ 2 λ -1 t=0 σ k ζ t σ k ζ t 2 λ+1 -1 σ k ζ t 2 -1 x t ,
where the last equality comes from the fact that (σ k /ζ t )2 = 1, for all 0 ≤ t < 2 λ . Indeed, let us assume that there exists 0 ≤ t < 2 λ such that (σ k /ζ t ) 2 = 1. Then, since ζ = σ N/2 λ , we have σ 2k-2tN/2 λ = 1. As σ is a principal 2N -th root of unity, we obtain 2k ≡ 2tN/2 λ (mod 2N ), whence k ≡ tN/2 λ (mod N ) and, finally, k ≡ 0 (mod N/2 λ ), which contradicts the assumption that k is not divisible by N/2 λ . Finally, since ζ is a 2 λ+1 -st root of unity, we can rewrite ω k as

ω k = 1 2 λ σ k2 λ 2 λ -1 t=0 σ k ζ t σ k2 λ+1 -1 σ k ζ t 2 -1 x t = 1 2 λ 2 λ -1 t=0 σ k2 λ -σ -k2 λ σ k ζ t -σ k ζ t -1 x t = 1 2 λ 2 λ -1 t=0 Im(σ k2 λ ) Im σ k ζ t x t = 1 2 λ 2 λ -1 t=0 sin k2 λ π N sin kπ N -tπ 2 λ x t .
Given the expression of ω k , we observe that its coefficients are all real.

Corollary 7.3. For all k ∈ Z, ω k ∈ R[x]/(x 2 λ + 1).

Norm

In this section, we compute the L 1 -norm of the roots of unity ω k defined in Section 7.2.1.

Definition 7.4. The L 1 -norm of an element A = j a j x j ∈ R[x]/ (x 2 λ + 1) is defined as

A 1 = 0≤j<2 λ |a j |.
This norm is used to determine how many bits of precision are required to represent the coefficients of the roots of unity that we consider. In Fürer's article, the norm that is used is the L 2 -norm and it is bounded by 2 λ .

Lemma 7.5. For all A ∈ R[x]/ (x 2 λ + 1)

, A • x 1 = A 1 . Proof. Writing A = 2 λ -1 t=0 , we have A • x = 2 λ -1 t=1 a t-1 x t + a 2 λ -1 x 2 λ = 2 λ -1 t=1 a t-1 x t -a 2 λ -1 , since x 2 λ = -1. Therefore, A • x 1 = 2 λ -1 t=0 |a t | = A 1 .
Consider ω defined as in Section 7.2.1. We want to bound the L 1 -norm of the ω k 's. We use the previous proposition to reduce the problem to the set of ω k 's for which k ∈ 0, . . . , N/2 λ -1 . Proposition 7.6. For all k ∈ Z, let k 0 = k mod (N/2 λ ), with 0 ≤ k 0 < N/2 λ . Then,

ω k 1 = ω k0 1 =        1 if k 0 = 0, and
1 2 λ 2 λ -1 t=0 sin k02 λ π N sin k0π N + tπ 2 λ otherwise. Proof. Let k ∈ Z. Write k = k 1 N/2 λ + k 0 , with k 1 = k2 λ /N and k 0 = k mod (N/2 λ ) = k -k 1 N/2 λ .
Then, according to Proposition 7.2, ω k = (-1) k1 ω k0 and, by Lemma 7.5, we obtain

ω k 1 = ω k0 1 =        1 if k 0 = 0, and
1 2 λ 2 λ -1 t=0 sin k02 λ π N sin k0π N -tπ
Since 0 ≤ k 0 < N/2 λ by construction, sin(k 0 2 λ π/N ) ≥ 0. Furthermore, for all t ∈ 1, . . . , 2 λ -1 , we have -1 < k 0 /N -t/2 λ < 0, and

sin k 0 π N - tπ 2 λ = sin tπ 2 λ - k 0 π N = sin (2 λ -t)π 2 λ + k 0 π N .
Additionally, for t = 0, we have

sin k 0 π N - tπ 2 λ = sin k 0 π N .
Finally, the result follows from the fact that, for k 0 = 0, ( ω k 1 ).

2 λ -1 t=0 1 sin k0π N -tπ 2 λ = 2 λ -1 t=1 1 sin (2 λ -t)π 2 λ + k0π N + 1 sin k0π N = 2 λ -1 t=0 1 sin k0π N + tπ
We have n(λ) = 2 π λ log 2 + O(1).

Proof. In the following, we assume that λ ≥ 1. First, we show that the root of unity having the largest L 1 -norm is the one for which k = N 2 λ+1 . We group the terms of index j and 2 λ -1 -j. We want the k for which the sum

1 sin( k 0 π N + tπ 2 λ ) + 1 sin( (t+1)π 2 λ - k 0 π N )
is maximal.

For t ∈ 0, . . . , 2 λ -1 , we define the function f t (u) for -1 2 < u < 1 2 as

f t : u → cos(uπ) sin t + 1 2 + u π 2 λ + cos(uπ) sin t + 1 2 -u π 2 λ .
Then, for all 0 < k 0 < N/2 λ , we have

ω k0 1 = 1 2 λ 2 λ-1 -1 t=0 f t k 0 2 λ N - 1 2 .
We let g t be

g t : u → cos(uπ) sin t + 1 2 + u π 2 λ .
We have f t (u) = g t (u) + g t (-u).

Thus, f t is an even function and f t (0) = 0. We will prove that it is the only zero for u ∈] -1 2 , 1 2 [ and that it is a maximum. We restrict the problem to the interval ]0, 1 2 [ by using the fact that f t is an even function.

We want to prove that, for u ∈]0, 1 2 [, we have

0 ≥ f t (u) -f t (0) = 2 cos(uπ) cos( uπ 2 λ ) sin 2 t + 1 2 π 2 λ -2 sin 2 t + 1 2 π 2 λ -sin 2 uπ 2 λ sin t + 1 2 + u π 2 λ sin t + 1 2 -u π 2 λ sin t + 1 2 π 2 λ
.

Denoting by h t the function

h t : u → cos(uπ) cos( uπ 2 λ ) + sin 2 uπ 2 λ sin 2 t + 1 2 π 2 λ -1,
we have

f t (u) -f t (0) = 2 sin 2 t + 1 2 π 2 λ h t (u) sin t + 1 2 + u π 2 λ sin t + 1 2 -u π 2 λ sin t + 1 2 π 2 λ
and, therefore, we only need to prove that for u ∈]0, 1 2 [, h t (u) ≤ 0. Since sine is an increasing function on ]0, π/2[, we have h t (u) ≤ h 0 (u) for any u ∈]0, 1/2[.

We observe that h 0 (0) = 0 and h 0 (1/2) = 0. Thus, if we prove that the sign of h 0 is constant on ]0, 1/2[ and that it is increasing on ]1/2 -, 1/2[, we prove that it is negative on this interval. To do that, we prove that h 0 has at most one zero in this interval, which implies that h 0 has no zero in the same interval.

We have Consequently, h 0 (u) < 0 on ]0, 1/2[. Thus, the power of ω having the largest L 1 norm is the N 2 λ+1 -th power. We have

∀u ∈]0, 1/2[, h 0 (u) = -π sin(uπ) cos uπ 2 λ - π 2 λ sin uπ 2 λ cos(uπ) + 2π 2 λ cos uπ 2 λ sin uπ 2 λ sin 2 π
ω N 2 λ+1 1 = 1 2 λ-1 2 λ-1 -1 t=0 1 sin( π 2 λ+1 + tπ 2 λ ) = 1 2 λ-1 2 λ-1 -1 t=1 1 sin( π 2 λ+1 + tπ 2 λ ) + 1 2 λ-1 1 sin(π/2 λ+1 )
.

We use the fact that the function sin(x) grows with x for x ∈ [0; π/2] to compare the sum with an integral:

2 λ -1 t=0 1 2 λ sin( (t+1)π 2 λ -π 2 λ+1 ) ≤ 1 2 λ-1 2 λ-1 -1 t=1 t t-1 1 sin( π 2 λ+1 + uπ 2 λ ) du + 1 2 λ-1 1 sin(π/2 λ+1 ) ≤ 1 2 λ-1 π/2-π/2 λ+1 π/2 λ+1 2 λ π sin(x) dx + 1 2 λ-1 1 sin(π/2 λ+1 ) ≤ 2 π log 1 -sin(π/2 λ+1 ) 1 + sin(π/2 λ+1 ) -log 1 -cos(π/2 λ+1 ) 1 + cos(π/2 λ+1 ) + 1 2 λ-1 1 sin(π/2 λ+1 ) ≤ 2 π   log sin 2 1 2 (π/2 -π/2 λ+1 ) cos 2 1 2 (π/2 -π/2 λ+1 ) -log   sin 2 (π/2 λ+2 ) cos 2 (π/2 λ+2 )     + 1 2 λ-1 1 2 π π 2 λ+1 ≤ 2 π log(tan(π/4)) + log(cos(π/2 λ+2 )) -log(sin(π/2 λ+2 ))) + 2 ≤ 2 π 0 -log 2 π • π 2 λ+1 + 2 ≤ 2 π λ log (2) + 2.
The expression 1 2 λ is a simple upper bound on the dominant term of the previous sum. Fürer's bound of the L 2 norm of the root of unity was 2 λ , which means that we have an exponentially better bound.

Precision

We need to be able to estimate the number of bits required to store the elements of R and to represent correctly the coefficients of the product C of the polynomials A and B in Algorithm 18. We use the same error analysis as in [START_REF] Fürer | Faster integer multiplication[END_REF]. As in [START_REF] Fürer | Faster integer multiplication[END_REF], in a practical implementation, we can assume that we use integer arithmetic and an appropriate scale with a power of two at each steps of the FFT. More details about this appropriate scale are given below.

We compute fast Fourier transforms over the ring R = R[x]/ (x 2 λ + 1) . We represent the elements of R as polynomials with real coefficients with fixed precision. We want to determine the numerical precision needed for these coefficients. First, we start with integer coefficients of bit-length 2 λ . We apply two Half-DFTs, followed by a point-wise product, and then an inverse Half-DFT. At the end, the absolute error should be less than 1/2 and the precision, denoted by S, follows.

Thus, we do the computations with S bits of precision, where S has to be determined. The coefficients are stored on S bits and we denote by V the number of bits before the binary point. The quantity S -V is the number of bits after the binary point. During the algorithm, V varies.

For a given step of Fürer's algorithm, V is uniform for the set of elements that are involved in the following computations, except for the principal roots of unity. Thus, V can be thought as a static data at each step of Fürer's algorithm (each level of the FFT butterflies, point-wise product, first step of Half-DFT, last step of inverse of Half-DFT).

As it has been said, we suppose that we use integer arithmetic. For an element Z ∈ Z, we denote its representation on a binary machine by Z and we let the error be

(Z) = Z -Z. Elements Z ∈ R are represented as Z = m Z 2 -E Z , where m Z ∈ Z is such that m Z ≤ 2 S and E Z ∈ N is such that S -E Z
is the number of bits before the binary point. We have the following arithmetic, for elements Z and Z such that E Z = E Z for the addition:

Z + Z = m Z + m Z 2 2 -E Z +1 and Z • Z = m Z • m Z 2 S 2 -E Z -E Z +S .
We consider that an addition or subtraction doubles the absolute value and increases V by one. However, multiplications by powers of x do not introduce errors: the maximum of the absolute values of the coefficients of A • x -A • x is the same as for A -A for any A ∈ R.

The fact that the roots of unity in R have coefficients in R and that their L 1 -norm is bounded by n(λ) allows us to have a better precision than in [START_REF] Fürer | Faster integer multiplication[END_REF]. Fürer bounds the infinity norm of its root of unity by one. We need the same result.

Lemma 7.8 (L 2 -norm of roots of unity). The L 2 -norm of ω is ω 2 = 1.
Proof. The proof is the same as in [START_REF] Fürer | Faster integer multiplication[END_REF]:

• the value of ω(x) at all the principal 2 λ+1 -st roots of unity is a complex number of absolute value one;

• the polynomial B ∈ R whose coefficients are these values has L 2 -norm equal to

√ 2 λ ;
• the coefficients of ω(x) are obtained via Half-DFT -1 2 λ ,ζ (B);

• √ 2 λ Half-DFT -1
2 λ ,ζ is a unitary matrix: it preserves the L 2 -norm.

Corollary 7.9. We have ω k ∞ ≤ 1 for any k ≥ 0.

Fürer shows in [START_REF] Fürer | Faster integer multiplication[END_REF] that the precision S required to represent these coefficients is greater than

9 + 2 λ+1 + 4λ + log (2) 2 (2N ) + 5 log 2 N ∼ 5 log 2 N + 2 λ+1 .
We do not prove this result because we obtain a better bound below: we obtain

1 + log 2 15 + log 2 N (2 + 3 log 2 n(λ) log 2 2 λ ) + λ + 2 λ+1 + log 2 (L + 1) + log (2) 2 N ∼ (2 + o(1)) log 2 N + 2 λ+1 .
We use exactly the same error analysis as Fürer. However, whereas Fürer used 2 λ as an upper bound on the L 1 -norm of his principal roots of unity of C[x]/ x 2 λ + 1 , we use a more precise bound, namely ñ(λ), defined as the least power of two greater than or equal to n(λ). Furthermore, since he works over C, he has an additional factor two. We need to reexpress the lemmas proved by Fürer in [START_REF] Fürer | Faster integer multiplication[END_REF] with ñ(λ), over R. The bound that we obtain is a direct consequence of this injection.

As in [START_REF] Fürer | Faster integer multiplication[END_REF], we say that, at some stage of an algorithm, we have a value bound v and an error bound e, if the coefficients r of elements of R involved in the computations of this stage satisfy

|r| ≤ v and | (r)| ≤ e.
Given ω k , according to Corollary 7.9, 1 is a value bound on the coefficients of ω k and 2 -S is an error bound on the coefficients of ω k .

The bounds that are used are always powers of two. If we have a value bound v, we do all the computations with V = log 2 v bits before the binary point.

v D = ñ(λ)v C is a value bound and e D = ñ(λ)e C + 2 λ v C 2 -S+1
is an error bound after the multiplication.

Proof. Let k be a non negative integer. We denote by ω k,i the coefficients of ω k . We showed that i |ω k,i | ≤ ñ(λ). We have

C • ω k = 2 λ -1 i=0   i-1 j=0 c j ω k,i-j - 2 λ -1 j=i c j ω k,2 λ +i-j   x i .
We represent the c j 's by c j + (c j ). We have the same decomposition for the coefficients of the root of unity ω k,j + (ω k,j ). We decompose C • ω into three parts:

C • ω = 2 λ -1 i=0   i-1 j=0 c j ω k,i-j - 2 λ -1 j=i c j ω k,2 λ +i-j   x i + 2 λ -1 i=0   i-1 j=0 (c j )ω k,i-j - 2 λ -1 j=i (c j )ω k,2 λ +i-j   x i + 2 λ -1 i=0   i-1 j=0 c j (ω k,i-j ) - 2 λ -1 j=i c j (ω k,2 λ +i-j )   x i .
The first sum is the theoretical polynomial to be approximated. We can bound it by ñ(λ)v C , where ñ(λ) is an upper bound on the L 1 -norm of ω k .

The coefficients of the second sum can be bounded in absolute value by e C ñ(λ):

|ω k,i | ≤ |ω k,i |
because of the truncature and

i-1 j=0 (c j )ω k,i-j - 2 λ -1 j=i (c j )ω k,2 λ +i-j ≤ e C   2 λ -1 j=0 |ω k,j |   .
We bound the coefficients of the third sum by 2 λ v C 2 -S since the (ω k,j )'s satisfy (ω k,j ) < 2 -S . Moreover, we introduce a new error due to the rounding on each coefficient of the product. Thus, we add v D 2 -S ≤ 2 λ v C 2 -S to the previous sum.

We do not prove the following lemmas, since the proofs are exactly the same as in [START_REF] Fürer | Faster integer multiplication[END_REF], although we have to take into account the fact that we work with reals and that we obtained new bounds in Lemma 7.10. Lemma 7.11 (Lemma 6.2 in [START_REF] Fürer | Faster integer multiplication[END_REF]). Let N be a power of two such that N ≥ 2 and λ be a non negative integer. Let L = (log 2 N )/(λ+1) -1 be the number of levels with computationally intensive principal roots of unity in Fürer FFT. If the input A of an N -point FFT has a value bound v A and an error bound e A , then the output B has a value bound

v B = N ñ(λ) L v A
and an error bound

e B = N ñ(λ) L e A + v A 2 -S log 2 N + 2L 2 λ ñ(λ)
We need to estimate the error produced by the point-wise product. Thus, given C and C elements of R with v C and e C their value bound and their error bound, the problem is to estimate the error on the product. Lemma 7.12 (Lemma 6.3 in [START_REF] Fürer | Faster integer multiplication[END_REF]). If v C is a value bound and e C , such that v C 2 -S ≤ e C , is an error bound for C and C before their multiplications, then v D = 2 λ v 2 C is a value bound and e D = 2 λ+2 v C e C is an error bound on the coefficients of D = C • C . Lemma 7.13 (Lemma 6.4 in [START_REF] Fürer | Faster integer multiplication[END_REF]). For λ = log

(2) 2 n and N = 2n/2 2λ-1 , precision S ≥ log 2 15 + log 2 N 2 + 3 log 2 ñ(λ) log 2 2 λ + λ + 2 λ+1 + log 2 (L + 1) + log (2)
2 N + 1 is sufficient for the multiplication of integers of bit-length n.

We summarize in Table 7.1 the evolution of the value and error bounds, at different stages of Fürer's algorithm. These stages are as follow:

Stage

Value bound Absolute error bound We proved that this bound can be actually taken as

1 2 2 λ 0 2 ñ(λ)2 2 λ 2 λ 2 2 λ 2 -S+1 3 N ñ(λ) L+1 2 2 λ N ñ(λ) L+1 2 2 λ 2 -S log 2 N + 2(L + 1)2 λ /ñ(λ) 4 2 λ N 2 ñ(λ) 2(L+1) 2 2 λ 2 λ+2 N 2 ñ(λ) 2(L+1) 2 2 λ+1 2 -S log 2 N + 2(L + 1)2 λ /ñ(λ) 5 2 λ N 2 ñ(λ) 3L+2 2 2 λ+1 ñ(λ) 3L+2 2 λ N 2 2 λ+1 +1 2 -S 5 log 2 N + (10L + 8)2 λ /ñ(λ) 6 2 λ N 2 ñ(λ) 3(L+1) 2 2 λ+1 ñ(λ) 3(L+1) 2 λ N 2 2 λ+1 +1 2 -S 5 log 2 N + (10L + 8)2 λ /ñ(λ)
1+log 2 15+log 2 N (2+3 log 2 n(λ) log 2 2 λ )+log 2 2 λ +2 λ+1 +log 2 (L+1)+log (2)
2 N ∼ (2+o(1)) log 2 N +2 λ+1 .

Thus, we have improved this bound by a factor almost equal to 2, when looking the coefficient of the dominant term log 2 N .

Complexity analysis

Some non-trivial multiplications by elements of R are needed in Algorithm 18: 3E(N ) multiplications in recursive calls, and 4N multiplications by scaling factors (because of the negacyclic convolution) and pointwise products. For these, we use Kronecker substitution: we encode elements of R as integers of bit length O((log 2 n) 2 ), and then call recursively FurerComplexMul.

Other multiplications by roots of unity are cheap. Their number is O(N log N ), and their cost is linear in the size of elements of R, that is O(2 λ log n). Additionally, all implicit rearrangement costs of Algorithm 18 (see §6.4) are also within this same bound. We get the following equation for M(n):

M(n) = N (3 log 2 λ+1 N + 1) • M(O(log n) 2 ) + O(N log N • 2 λ log n). (7.2)
Fürer proves by induction that this equation leads to

M(n) ≤ n log n(2 c log * 4 √ n -d) for some constants c, d > 0, so that M(n) = n • log n • 2 O(log * n) ,
where log * is the iterated logarithm function defined in Section 6.6. This trick allows one to have an exponent log * Algorithm 19 DFT of polynomial with Bluestein's chirp transform

1: Input: A = L-1 i=0 a i X i ∈ R[X]/ X L -1 , ν a principal 2L-th root of unity and ω = ν 2 . 2: Output:  = DFT L,ω (A) = A(1) + A(ω)X + • • • + A(ω L-1 )X L-1 3: function BluesteinTransform(A,L,ν) 4: Let à be 0≤i<L a i ν -i 2 X i 5: Let B be 0≤i<L ν i 2 X i 6: Let C = à • B mod X L + 1 computed with Kronecker substitution 7: return A(1) + • • • + A(ω L-1 )X L-1 by scaling the k-th coefficient of C by ν -k 2 . 8: end function
The idea developed in [START_REF] Harvey | Even faster integer multiplication[END_REF] implies to use, instead of a radix-2 λ FFT, another method described in Algorithm 20. On Line 11 of Algorithm 20, they use Bluestein's chirp transform instead of Algorithm 20 FFT of order a power of two N using Bluestein's chirp transform

1: Input: A = N -1 i=0 a i X i ∈ R[X]/ X N -1 , ν a principal 2L-th root of unity and ω = ν 2 . 2: Output: Â = DFT N,ω (A) = A(1) + A(ω)X + • • • + A(ω N -1 )X N -1 3: function BluesteinFFT(A,N ,λ,ν) 4: if N < 2 λ then 5:
Compute  with BluesteinTransform and a Kronecker substitution Let B k be the polynomial given by the coefficients (a jK+k ) j 11:

Bk ← BluesteinTransform(B k , J, ν K ) 12:
Bk ← Bk (ω k X)

Let (S j (Y )) j ∈ R[Y ] J be such that 0≤k<K Bk (X)Y k = 0≤j<J S j (Y )X j 15:
for 0 ≤ j < J do 16:

Ŝj (Y ) ← BluesteinFFT(S j , K, λ, ν J ) Recursive call 17:
end for 18:

return 0≤i<J Ŝi (X J )X i 19:
end if 20: end function a radix-2 Cooley-Tukey FFT: they compute a negacyclic product of two polynomials with the Kronecker substitution. In this version, the ring R can be any ring containing an N -th principal root of unity (C for example) and λ can be taken larger than in Fürer's algorithm: rather than λ ≈ log (2) 2 n, they can choose it as λ ≈ (log

(2) 2 n) 2 + O(log (2)
2 n). Rather than concentrating the expensive operations in the multiplications on Line 12, there is a trade-off between the complexity of the N multiplications in R on Line 12 and the N/2 λ multiplications in R[x]/ (x 2 λ + 1) .

In order to multiply two n-bit integers a and b, they split these integers into N/2 pieces of size s. Assuming that the precision required in C is p, the complexity equation is

M(n) = O N log N λ M(O(p)) + O N log 2 N λ2 λ M(O(2 λ p)) + O(n log 2 n).
Using the radix-2 Cooley-Tukey algorithm, the second term in the equation is

O(N log 2 N M(O(p))). Taking λ = log 2 n log (2)
2 n+O(log 2 n), the first term is negligible and the second term is dominant. They obtain O(n log 2 n2 O(log * 2 n ) as a solution of the recursive equation.

Chapter 8

Generalized Fermat primes

This chapter defines admissible generalized Fermat numbers. Our main use case will be when such numbers are prime, and we define a descending chain of such primes.

Definition 8.1. A generalized Fermat number is an integer of the form r 2 λ + 1, where λ and r are two positive integers. We use the shorthand notation P (r, λ) for such numbers.

For notational ease, throughout this chapter, whenever we mention a generalized Fermat number p, we actually consider the pair (r, λ) rather than the number p alone. For this reason, it shall be understood without further mention that r and λ are implicit data that is unequivocally attached to p, which is underlined by the fact that we favor the expression "let p = P (r, λ) be a generalized Fermat number".

Abundance of generalized Fermat primes

Asymptotically, the existence of generalized Fermat primes in integer intervals can be obtained via the Bateman-Horn conjecture [START_REF] Bateman | A heuristic asymptotic formula concerning the distribution of prime numbers[END_REF]. For real numbers A < B and an integer λ ≥ 1, we let ∆(λ, A, B) denote the number of integers r ∈ [A, B) such that p = P (r, λ) = r 2 λ + 1 is a generalized Fermat prime. The following lemma captures the asymptotic behaviour of ∆ in specific intervals. However it will be of little use per se but to define some notations. Lemma 8.2. Fix an integer λ ≥ 1. Let α > 1 be a real number (possibly depending on λ). If the Bateman-Horn conjecture holds for the function f

(x) = x 2 λ + 1, then ∆(λ, R, αR) ∼ C λ 2 λ (li(αR) -li(R))
as R → ∞, where we used the notations:

li(x) = x 2 dt log t , C λ = 1 2 p prime 1 -χ λ (p)/p 1 -1/p , χ λ (p) = 2 λ if 2 λ+1 | p -1, 0 otherwise.
Proof. Bateman and Horn [START_REF] Bateman | A heuristic asymptotic formula concerning the distribution of prime numbers[END_REF] define the constant C λ as above, and conjecture that as R grows, we have

∆(λ, 1, R) ∼ C λ 2 λ li(R) ∼ C λ 2 λ • R log R .
Let > 0. Assuming the Bateman-Horn conjecture holds, we have for R large enough

∆(λ, R, αR) C λ 2 λ (li(αR) -li(R)) -1 < • 1 + li(R)/ li(αR) 1 -li(R)/ li(αR) .
Now since li(x) ∼ x/ log x and α > 1, the right-hand side above converges to a positive constant as R → ∞. This proves the claim.

We now go through several steps to provide heuristic arguments supporting the existence of sufficiently many generalized Fermat primes in our ranges of interest. Our attention first goes to the asymptotic estimate on the right-hand side in Lemma 8.2, and to how it evolves as λ → ∞, for some specific choices of α and R. Table 8.1 indicates some experimental values for the constant C λ (the same data has also been collected by [START_REF] Dubner | Distribution of generalized Fermat prime numbers[END_REF]). While the observation of Table 8.1 would support the empirical claim that C λ increases as λ increases, a proof of such a statement has eluded us. We prove Proposition 8.3 below, which is a much weaker statement. We then choose α and R so that the estimate of Lemma 8.2 can be shown to tend to infinity (Proposition 8.4). Proposition 8.3. Let C λ be as in Lemma 8.2. We have

1 λ = O(C λ ).
Proof. We prove that there exists an absolute constant C > 0 such that C λ ≥ C λ for any λ ≥ 1, where C λ is defined as in Lemma 8.2.

The idea is to rely on the proof of the main theorem of [49, §2], and to use the main result of [START_REF] Elliott | Primes in progressions to moduli with a large power factor[END_REF] for arithmetic progressions with "powerful moduli", since we consider arithmetic progressions (q • k + r) k where q is a power of two.

Let P(x) be the set of primes smaller than x, and extend the notation of Lemma 8.2 to define

C λ (x) = 1 2 p∈P(x) 1 -χ λ (p)/p 1 -1/p .
Throughout this proof, we use the shorthand notation q = 2 λ+1 . Let π(x, q, r) be the number of primes ≤ x congruent to r mod q. Let G(x) = π(x, q, 1). We will use twice the Brun-Titchmarsh inequality, which says that G(x) = π(x, q, 1) ≤ 2(x/φ(q))/ log(x/q) = 4x/(q log(x/q)).

Let now g(t) = G(t)-G(t-q). By construction, G and g are constant on intervals [1+qi, 1+qi+q) for any integer i ≥ 0, and g(t) is equal to to 1 or 0 on that interval depending on whether 1 + qi is prime or not. Hence

g(1 + qi) = 1 q 1+qi+q 1+qi g(t) dt and G(1 + qi) = 1 q 1+qi+q 0 g(t) dt. Let F (x) = -log(1 -2 λ /x) = -log(1 -q/(2x))
, which is a decreasing, convex, and nonnegative function defined for x > q/2. Furthermore, since λ ≥ 0, for x ≥ 1 + q/2 we have F (x) ≤ log 2. Our goal is to find an asymptotic lower bound for the (logarithm of the) numerator of C λ (x) for large x (we impose x ≥ 1 + 2q below). Equivalently, we seek an upper bound for S(x) = N i=1 F (1 + qi)g(1 + qi), where we set N = (x -1)/q . Throughout the proof below, implicit constants O(1) are uniform on λ -possibly for x larger than some bound that depends on λ, but that is not an issue since C λ = lim x→∞ C λ (x).

S(x) = N i=1 F (1 + qi)g(1 + qi) = N i=1 F (1 + qi) 1 q 1+qi+q 1+qi g(t) dt ≤ 1 q N i=1 1+qi+q 1+qi F (t -q/2)g(t) dt (because F is convex) ≤ 1 q x+q 1+q F (t -q/2)g(t) dt + 1 q 1+qN +q x+q F (t -q/2)g(t) dt O(1) ≤ F (x + q/2)G(x) -F (1 + q/2)G(1 + q) - x 1 F (t + q/2)G(t) dt + O(1).
Since F (x + q/2) ≤ q 2x and G(x) ≤ 4x/(q log x/q)), the first summand is bounded by 2/ log 2 for x ≥ 2q. Since G(1 + q) ≤ 1 and G(t) = 0 for t < 2 we have:

S(x) ≤ O(1) + x 2 qπ(t, q, 1) t(2t + q) dt ≤ O(1) + x 2 qπ(t, q, 1) 2t 2 dt.
Elliott [START_REF] Elliott | Primes in progressions to moduli with a large power factor[END_REF] proved a theorem that relates π(x, q, r) to its asymptotic estimate We state a very weak form of it, namely that there exists an absolute constant K such that for any λ ≥ 0 and t such that min(t 1/3 exp(-(log log t) 3 ), t 1/2 exp(-8 log log t)) ≥ q, we have π(t, q, 1) -2t q log t < Kt q(log t) 2 .

(8.1)

The condition above on t can be simplified. There exists an absolute constant H such that for any x > 1 min(x 1/3 exp(-(log log x) 3 ), x 1/2 exp(-8 log log x)) ≥ (Hx) 1/4 . Thus, for t ≥ q 4 /H, Equation (8.1) holds. We rewrite the upper bound on S(x):

S(x) ≤ O(1) + q 4 /H 2 qπ(t, q, 1) 2t 2 dt I0(λ) + x q 4 /H qπ(t, q, 1) 2t 2 dt I1(λ,x)
.

For I 0 (λ), by Brun-Titchmarsh we have

I 0 (λ) ≤ q 4 /H 2 2 t log(t/q) dt ≤ q 3 /H 2 2 u log(u) du ≤ 2 log log(q 3 /H) ≤ 2 log λ + O(1). λ C λ 1
= O(C λ ).
We use Elliott's theorem to bound I 1 (λ, x) (using the notations of Equation (8.1)):

I 1 (λ, x) - x q 4 /H 1 t log t dt ≤ x q 4 /H K t(log t) 2 dt ≤ - K log x + K log(q 4 /H) = O(1) so that I 1 (λ, x) ≤ log log x -log log(q 4 /H) + O(1) ≤ log log x -log λ + O(1).
Combining the bounds on I 0 and I 1 , we have obtained:

S(x) ≤ log log x + log λ + O(1).
The lower bound on C λ (x) follows: indeed, we have

-log C λ (x) = p∈P(x) log 1 - 1 p + S(x), ≤ (-γ -log log x + o(1)) + (log log x + log λ + O(1)) , log C λ (x) ≥ O(1) -log λ.
Hence C λ (x) ≥ A/λ for some absolute constant A, and x large enough. It follows that C λ ≥ A/λ, as claimed. We notice that the multiplier affecting log λ above, and hence the exponent of λ in our lower bound, can be directly traced to the use of the Brun-Titchmarsh inequality in bounding I 0 (λ).

Proposition 8.4. We use the same notations as in Lemma 8.2. Let a(λ) be a real-valued function such that a(λ) ≥ κλ 2+ for two positive constants κ, . Then the asymptotic estimate of Lemma 8.2, when formulated for R = 2 λ and α = a(λ) is such that, as λ → ∞:

C λ 2 λ li(a(λ) • 2 λ ) -li(2 λ ) -→ ∞.
Proof. A lower bound for (li(αR) -li(R)) is (α -1)R/ log(αR). We have

C λ 2 λ li(a(λ) • 2 λ ) -li(2 λ ) ≥ C λ 2 log 2 • κλ 2+ -1 λ ≥ λC λ • κλ -1/λ 2 2 log 2 .
The claim follows, since 1 λ = O(C λ ) implies that λC λ λ tends to ∞.

Our heuristic claim is that for α = λ 2.5 (which fulfills the conditions of Proposition 8.4), the estimate of Lemma 8.2 is accurate enough, as early as for R = 2 λ . Hypothesis 8.5. Let λ ≥ 2 be an integer. For any real number R such that 2 λ ≤ R ≤ 2 2λ , we have ∆(λ, R, λ 2.5 R) ≥ 1. In other words, there exists a generalized Fermat prime p = P (r, λ) such that R ≤ r < λ 2.5 R.

Both the constant C λ , as well as the accordance of the prime count ∆(λ, 1, B) with the asymptotic estimate given by the Bateman-Horn conjecture, have been studied by [START_REF] Dubner | Distribution of generalized Fermat prime numbers[END_REF]. While the experiments of [START_REF] Dubner | Distribution of generalized Fermat prime numbers[END_REF] do support the validity of the Bateman-Horn conjecture even for primes not very large, we provide independent experimental data to support Hypothesis 8.5. We computed numerically the value ∆(λ, 2 λ , λ 2.5 2 λ ), as well as the estimate given by Lemma 8.2. We chose to restrict the verification to R = 2 λ because this is empirically the hardest case.

To obtain ∆(λ, 2 λ , λ 2.5 2 λ ), we used a simple primality proof algorithm based on Pocklington's theorem, in Las Vegas probabilistic time. The result of our experiments is given in Table 8.2. For each potential divisor q of N -1 = r 2 λ and each prime divisor s of r, we prove that the s-valuation of q is exactly 2 λ times the s-valuation of r, whence it follows eventually that N is prime. The probabilistic time comes from the fact that we use random picks to find a generator of the s-Sylow subgroup. Most computations were short, except for λ = 12 where we had to use some non-trivial amount of computing power. We reported the "total" number of candidate values for r in Table 2. It is easy to filter out r's that are roots of x 2 λ + 1 mod smallish primes congruent to 1 modulo 2 λ+1 . With a small expense in computation time, we can roughly halve the number of candidates. Yet we did not take this optimization into account when mentioning the number of candidates.

Hypothesis 8.5 is in fact stronger than what would be strictly necessary to reach the asymptotic complexity we claim in this thesis. Proposition 8.4 led us to choose α as a polynomial of degree at least two, and our particular choice α = λ 2.5 has the advantage that the data in Table 8.2 has no corner cases for small values of λ (in particular for λ = 3). That factor could be replaced by any polynomial in λ, this would not affect the fact that the bounds used in Proposition 9.6 have a numerator in O(log 2 λ). We note, however, that using a polynomial with a more rapid growth would invalidate some inequalities for small values of λ, so that we would only be able to state our algorithm for larger values of λ.

Throughout the rest of the thesis, Hypothesis 8.5 is tacitly assumed.

Chains of generalized Fermat primes

Some generalized Fermat numbers, defined below, play a key role in this thesis. In the other direction, the condition on p being admissible gives the following uniform bound on λ (we first bound p by 2r 2 λ ):

λ ≤ 1 + log (2) 2 (1 + 2 λ (2λ + 2.5 log 2 λ)).
An unilluminating calculation shows that this right hand side is indeed bounded by 3 log 2 λ -1 for all λ ≥ 3, and then by λ for all λ ≥ 4.

The lower bound given by Lemma 8.8 is most useful now, and gives in fact the correct order of magnitude for λ . The upper bound is much coarser and will be used in §9.5. Possible values for λ are given in Table 8.3. In particular, λ ≥ 4 implies λ ≥ 3.

Proof of Proposition 8.7. The function φ is easily seen to satisfy φ(k) ≤ 2φ(k -1) for any integer k ≤ λ + 2. As a consequence, the intervals [φ(k), 2φ(k)], for k ranging from 0 to λ -1, form a covering of the interval [φ(0), φ(λ )].

We prove φ(0) ≤ 2λ 2 λ ≤ φ(λ ), which will directly entail that 2λ 2 λ is within one of the above intervals that form a covering.

The bound 2λ 2 λ ≤ φ(λ ) is a consequence of λ ≥ λ :

φ(λ ) ≥ 2 λ +1 log 2 r ≥ 2 λ +1 λ ≥ 2 λ +1 λ .
The proof that 2λ 2 λ ≥ φ(0) is based on calculus. Lower and upper bounds for 2λ 2 λ and φ(0) are

2λ 2 λ ≥ 2(λ + log 2 λ) log 2 (λ + log 2 λ) ≥ (λ + log 2 λ) log 2 (36), φ(0) ≤ λ + 2(2λ + 2.5 log 2 λ) = 5(λ + log 2 λ).
We have proved that there exists an integer k such that 0 ≤ k < λ , and that φ(k) ≤ 2λ 2 λ ≤ 2φ(k). Let β = 2 k , so that (i ) holds. We have that

λ ≤ φ(log 2 β) 2 λ ≤ 2λ . This implies (ii ). Finally, R = 2 φ(log 2 β) 2 λ
is such that 2 λ ≤ R ≤ 2 2λ . Hypothesis 8.5 then implies (iii ), and concludes the proof. Admissibility of p follows from Definition 8.6.

The following technical lemma provides useful bounds for p = smallerprime(p). Lemma 8.9. Let p = P (r, λ) be as in Proposition 8.7. Let β = batchsize(p) and p = smallerprime(p). We have

i . 1 ≤ log 2 p 2β log 2 r ≤ min(1 + 4 log 2 λ λ -1 , 7
2 ). In particular, log 2 p β log 2 r = 2 + o(1).

ii . λ + log 2 λ ≤ log

2 p ≤ λ + log 2 λ + 2.

Proof. We follow the notations of Proposition 8.7. The lower bound in (i ) is easy:

log 2 p ≥ 2 λ log 2 R ≥ φ(log 2 β) ≥ 2β log 2 r.
The upper bound requires more work. On the one hand, Lemma 8.8 gives 2 λ > λ, whence

2β log 2 r + 2 λ ≥ φ(log 2 β) ≥ λ 2 λ 2β log 2 r ≥ (λ -1)2 λ .
And on the other hand, we can bound log 2 p as follows.

log 2 p = log 2 ((p -1) + 1) = log 2 (p -1) + log 2 (1 + 1/(p -1)) ≤ 2 λ log 2 r + 1 ≤ 2 λ log 2 R + 2 λ log 2 (λ 2.5 ) + 1 ≤ φ(log 2 β) + 2 λ log 2 (λ 2.5 ) + 1 (8.2)
by the definition of R . Using now Lemma 8.8 and

2 λ ≥ λ + log 2 λ ≥ λ + 2 we have log 2 p ≤ 2β log 2 r + (2 λ -2) + 2 λ log 2 (λ 2.5 ) + 1 ≤ 2β log 2 r + 2 λ • min(4 log 2 λ , 5(λ -1)/2) since λ ≥ 3.
The upper bound on the last line is obtained by calculus. We have thus proved (i ).

The lower bound in statement (ii ) is trivial. The upper bound is derived from inequality (8.2) above. By (ii ) in Proposition 8.7, we have φ(log 2 β)

2 λ ≤ 2λ , whence log 2 p ≤ 2λ 2 λ + 2 λ log 2 (λ 2.5 ) + 1. log (2)
2 p ≤ log 2 1 + 2 λ (2λ + log 2 (λ 2.5 ))

≤ λ + log 2 λ + 2 since λ ≥ 3.
Again, this last upper bound is verified by calculus.

Chapter 9

Integer multiplication algorithm using generalized Fermat primes

We now see how we can design an asymptotically fast integer multiplication algorithm that uses rings of integers modulo generalized Fermat primes. Throughout this chapter, our preferred representation for elements of a ring R of integers modulo a generalized Fermat number p = P (r, λ) is the representation in radix r. Namely, a ∈ R is represented as a 2 λ -uple (a 0 , . . . , a 2 λ -1 ) such that a = j<2 λ a j r j and 0 ≤ a j < r. This representation does not cover the case a = -1, and we need an ad hoc exceptional representation for this case (possible representation choices are plenty -one extra bit is enough). Conversions between binary representation and radix r representation can be done in linear time when r is a power of two, but we also need to deal with the general case. Recursive base conversion algorithms (see [10, §1.7.2]), do this in quasi-linear time O(λM(log p)) (this holds both for ways, both to and from representation in radix r). Additions and subtractions in R using this representation are linear. This chapter is concerned with the complexity of multiplication in R. We denote this cost by M R .

Preliminaries: transforms

The following definition extends concepts defined in Proposition 8.7 and defines useful data for our algorithms. Definition 9.1 (smallerring(R)). Let λ ≥ 4. Let p = P (r, λ) = r 2 λ +1 be an admissible generalized Fermat number, and let R = Z/ pZ . Following Proposition 8.7 we let smallerring(R) be the triple (R , N , ω ) defined as follows:

• R = Z/ p Z , with p = P (r , λ ) = smallerprime(p).

• N = 2 λ / batchsize(p). (N is a power of two.)

• ω is a primitive 2N -th root of unity in R .

For the root ω to be well defined above, we need the following property. Lemma 9.2. Using the notations above, R has a primitive 2N -th root of unity.

109

Proof. Notice first that λ ≥ 3 so that p ≥ 2 3•2 3 , and that p = r 2 λ + 1 is prime, so that in particular r is even. For 2N to divide p -1, it suffices to check that 2N divides 2 2 λ . We have

log 2 (2N ) = λ + 1 -log 2 β 2 λ ≥ λ + log (2)
2 r, so that it is sufficient to check that log (2) 2 r ≥ 1, which holds as soon as λ ≥ 2.

The algorithms described in the remainder of this chapter all assume that the sequences of rings and auxiliary data defined by Definition 9.1 are computed in advance, for all levels of the recursion. We assume that a tape of our Turing machine is devoted to that data, stored one level after another. The size of the data smallerring(R ) is clearly O(log p ).

New algorithms

We now describe two new algorithms that are dependent on each other. Both aim at computing products of elements of R.

• One algorithm that computes "transforms" of elements of R, denoting the transform of an element a ∈ R by T R (a). Internally, this algorithm multiplies elements of R .

• One algorithm that multiplies elements of R. This algorithm uses the transforms computed by the previous algorithm.

We begin with Algorithm 21 (TransformR), which computes transforms. We can state it thanks to Lemma 9.2. Input: a ∈ R, represented in radix r.

3:

Output: T R (a), a vector of N elements of R , represented in radix r

4:

Let β = batchsize(p), and (R , N , ω ) = smallerring(R).

5:

Let Ã(X) ∈ Z[X] with positive coefficients below r β be such that Ã(r β ) = a;

6:

Map à to A ∈ R [X]/(X N + 1).

7:

Rewrite coefficients of A in radix r .

8:

return Half-DFT N ,ω (A) = LargerRadixCooleyTukeyFFT(A(ω X), N , λ , ω

2 ).

9: end function

Our complexity analysis will need to reason on the set of transforms of roots of unity that are used by Algorithm 21. We define it as follows: Definition 9.3 (W(R), vector of precomputed transforms useful for T R ). Fix notations as in Definition 9.1. We let W(R) denote the vector defined as:

W(R) = {T R (ω 2i+1 ), i ∈ [[0, N 2 λ +1 -1]]} Algorithm 22 Multiplication in R = Z/ pZ , with p = r 2 λ + 1 admissible, λ ≥ 4. p is not necessarily prime.
We use the notations T R , W R as in §9.2. Let β = batchsize(p), and (R , N , ω ) = smallerring(R).

5:

Compute W = W(R) using Algorithm TransformR.

6:

Compute T R (a) using Algorithm TransformR and W as auxiliary data.

7:

Compute

γ = T R (a) * T R (b)
point-wise products of elements of R .

8:

Compute c = T -1 R (γ) as follows:

9:

C ← Half-IFT N ,ω (γ) ∈ R [X]/(X N + 1) using W as auxiliary data.

10:

Lift C to C ∈ Z[X] as follows:

11:

for i ∈ [[0, N -1]] do 12: Lift coefficient of degree i to [[-(N -1 -i)r 2β , (i + 1)r 2β [[. 13:
end for 14:

Rewrite coefficients of C as signed integers in radix r.

15:

Compute C(r β ) = c. The result is defined modulo (r β ) N + 1 = p. ii . The polynomial C is equal to à • B mod X N + 1.

iii . c is equal to ab mod p. Proof. We prove (i ) for T R (a), the same reasoning holds for T R (b). The polynomial A ∈ R [X]/(X N + 1) is uniquely defined because Half-DFT is an isomorphism. Now since T R (a) is computed from an element a of R, line 5 of Algorithm 21 has unambiguously computed a polynomial Ã, which meets the conditions. Since there is a unique lift of A to Z[X] that has degree less than N and positive coefficients below p , this lift is then necessarily the same as Ã.

Statement (ii ) holds modulo p by construction, but we must make sure that the lift on lines 10-13 of Algorithm 22 computes the correct product over the integers. To do so, we compute a bound for the coefficients of the product à • B mod X N + 1. Both operands have at most N coefficients. The coefficient of degree i of their product modulo X N + 1 lies within the interval [[-(N -1 -i)(r β ) 2 , (i + 1)(r β ) 2 [[ (actually with the lower endpoint open for i < N -1), which has width N (r β ) 2 . The base 2 logarithm of this latter value is 2β log 2 r + λ -log 2 β = φ(log 2 β), following the notation of Proposition 8.7. Now again following notations of Proposition 8.7, we for p an admissible generalized Fermat prime is out of question: unless we consider that p is given beforehand, computing it is likely to be more expensive than computing a product of bit length log 2 p, and would therefore appear dominant, maybe prohibitive even for a precomputation. Fortunately, Algorithm 22 (MulR) does not require that p be prime, and therefore this difficulty can easily be circumvented. For example we may select λ such that λ2 λ ≥ 2n, and then set p = P (2 λ , λ). The second issue is harder to deal with: in the ring R used by Algorithm 22, we need to find 2N -th roots of unity, and for this we need a quadratic nonresidue in R (which generates the 2-Sylow subgroup of R ). Alas, if our first (non-prime) modulus p is such that log 2 p ≥ 2n, then in Proposition 8.7 we have λ = log 2 n, so that the upper bound on log 2 p that we obtain from Lemma 8.9 is at least as large as log 2 n • log Similar (but subtly different) issues were already encountered by Harvey, van der Hoeven and Lecerf. The workarounds proposed in [32, §8] also apply here.

• Either we assume the generalized Riemann hypothesis, in which case a quadratic nonresidue in R can be found in polynomial time.

• Or we do the top-level multiplication with one round of Fürer's algorithm. Multiplication in the ring C[X]/ X 2 λ + 1 that is used by Algorithm 18 (FurerComplexMul) reduces to multiplication of integers of bit length n 0 = O((log n) 2 ), with n denoting the bit length of the integers a and b (see Equation (7.2)). These integers are then multiplied by Algorithm 22 (MulR), for a suitable modulus p 0 (not necessarily prime).

The latter strategy is given by Algorithm 23 (MulZ). Note that since we build upon Algorithm 18, we force the bit length n to be rounded up to a power of two. Let n 0 be such that all internal multiplications in FurerComplexMul(•, •, n) may be done by multiplying two n 0 -bit integers. (As per the analysis of FurerComplexMul, we have n 0 = O((log 2 n) 2 ).)

5:

Let λ 0 be the smallest integer such that 2n 0 ≤ λ 0 2 λ0 .

6:

Let p 0 = P (2 λ0 , λ 0 ) = 2 λ02 λ 0 + 1.

7:

return c = FurerComplexMul(a, b, n), where all internal multiplications are done with Algorithm 22 (MulR), in the ring R 0 = Z/ p 0 Z . 8: end function It is easy to see that p 0 in Algorithm 23 is an admissible generalized Fermat number. As for the determination of prime moduli as well as the computation of primitive roots of unity of the desired order in the recursive multiplication levels of Algorithm 22, we have that log 2 (smallerprime(p 0 )) is polynomial in log [START_REF] Barbulescu | Finding optimal formulae for bilinear maps[END_REF] 2 n. This is small enough so that simple algorithms are fit for the task of testing smallerprime(p 0 ) for primality, as well as for finding primitive roots. Thus the complete chain of precomputed triples defined by smallerring in Definition 9.1 can be computed in advance and stored on an auxiliary tape of the Turing machine, as suggested in §9.1.

The complexity of computing n-bit products with Algorithm 23 (MulZ), which we denote by M new (n), can be expressed as follows. The equation below is naturally very similar to Equa-tion (7.2). In Algorithm 22 (MulR), multiplication in R uses (R , N , ω ) = smallerring(R). In turn, multiplication in R may use (R , N , ω ) = smallerring(R ) if recursion is used again. We define (R i ) i≥0 as well as (N i ) i≥1 and (ω i ) i≥1 by: R 0 = as in Algorithm 23, (R i+1 , N i+1 , ω i+1 ) = smallerring(R i ) for i ≥ 0. Likewise, we let p i be such that R i = Z/ p i Z , for i ≥ 0. Of course, since Definition 9.1 as well as Algorithms 21 and 22 are only valid for λ i ≥ 4, only a finite number of terms of the above sequences are defined for a given input size n. Part of the work towards determining our final complexity will be to determine this number of terms (the recursion depth). We briefly recall the key equations for the complexity analysis: We first prove the following lemma that bounds the transform length N .

M Ri ≤ 2N i+1 • (3 + log 2 λ i+1 +1 N i+1 ) • M Ri+1 + O(N i+1 • λ i+1 • M(log p i+1 )) + O(N i+1 • log N i+1 • log p i+1 ) + O(log p i ).
Lemma 9.5. Using the notations as above, we have

N i+1 ≤ min 2 1 + 4 log 2 λ i+1 λ i+1 -1 , 7 • log 2 p i log 2 p i+1 .
Proof. Let β = batchsize(p i ). We have 2 λi log 2 r i ≤ log 2 p i , therefore

N i+1 = 2 λi β ≤ log 2 p i β log 2 r i ≤ 2 log 2 p i log 2 p i+1 log 2 p i+1 2β log 2 r i .
Then (i ) in Lemma 8.9 allows to conclude.

The following result plays a central role in the asymptotic analysis.

Proposition 9.6. We keep the above notations. Let i ≥ 0 be such that p i is admissible. Let . We have

m i ≤ 4 • (1 + 0,i ) • (1 + 1,i ) • (1 + 2,i ) • m i+1 + O(1).
Proof. We first bound the second and third lines in the equation for M Ri , and compare them to log p i • log (2) p i . The third line uses Lemma 9.5. We have In the expression above, we obtain the upper bound by bounding the numerator by a polynomial in λ i+1 (because p i+1 is admissible), while the denominator is exponential in λ i+1 .

N
The most important calculation for the analysis is the comparison of the first term of M Ri with log p i • log (2) p i . Lemma 9.5 gives the bound N i+1 ≤ 2(1 + 0,i ) log 2 pi log 2 pi+1 , and we also have the coarse bound log 2 N i+1 = log 2 (2 λi /β i ) ≤ λ i . This implies

m i ≤ 4(1 + 0,i ) log 2 p i log 2 p i+1 • 3 + λ i λ i+1 + 1 • m i+1 log 2 p i+1 log (2)
2 p i+1 log 2 p i log . Furthermore by statement (ii ) from Lemma 8.9 for i > 0, we have log

2 p i ≥ λ i + log 2 λ i , so that

m i ≤ 4 • (1 + 0,i ) • λ i + 9 log 2 λ i λ i + log 2 λ i • log (2) 2 p i+1 λ i+1 • m i+1 + O(1) ≤ 4 • (1 + 0,i ) • (1 + 1,i ) • (1 + 2,i ) • m i+1 + O(1).
where we used again Lemma 8.9 to bound log

2 p i+1 . This proves our claim. It is easy to convince oneself that the three quantities 0,i , 1,i , and 2,i all tend to zero as λ i grows (that is, as we deal with larger and larger input numbers). The final asymptotic formula needs the following stronger result, however. Lemma 9.7. Let λ 0 be an arbitrarily large integer. Let K be the first integer such that λ K < 4. We have K = log * λ 0 + O(1). Furthermore, for j = 0, 1, 2:

K-1 i=0 (1 + j,i ) < ∞ (independently of K)
Proof. The expression of K follows from the inequality λ < 3 log λ -1 proved in Lemma 8.8. To see that, let Φ(λ) = 3 log 2 λ -1, defined for λ ≥ 4. Let Φ * (x) be the function defined similarly to log * , by Φ * (x) = 0 for x < 4, and Φ * (x) = 1 + Φ * (Φ(x)) otherwise. It is clear that K ≤ Φ * (λ 0 ). Now using the terminology defined in [32, §5], the function Φ * is an iterator for the logarithmically slow function Φ. As such, it satisfies Φ * (x) = log * x + O(1), which corresponds to our claim.

To bound the product, it suffices to bound i | j,i |. Let f 0 (x) = 4 log 2 x

x , f 1 (x) = 8 log 2 x

x , and f 2 (x) = 2+log 2 x x , so that 0,i = f 0 (λ i+1 ), 1,i = f 1 (λ i ), 2,i = f 2 (λ i+1 ). The functions f j are decreasing for x ≥ exp(1). In particular, we have 1,i ≤ f 1 (λ i+1 ). Consider the sequence of real numbers defined by u 0 = 3, u 1 = 4, u 2 = 6, u 3 = 27, and u k+1 = 2 u k /3 for k ≥ 3. This sequences diverges to infinity. Independently of the starting value λ 0 , we have

λ K ≥ 3 = u 0 , λ K-1 ≥ 4 = u 1 , λ K-2 ≥ 6 =

This yields

K-1 i=0 2 j=0 | j,i | = K-1 k=0 2 j=0 | j,K-1-k | ≤ K-1 k=0 (f 0 (λ K-k ) + f 1 (λ K-1-k ) + f 2 (λ K-k )) ≤ K-1 k=0 2 j=0 f j (λ K-k ) ≤ K-1 k=0 2 j=0 f j (u k ) ≤ ∞ k=0 2 j=0 f j (u k ).
The latter sum converges to an absolute constant. Proof. This theorem is a consequence of the results obtained thus far. Recall that in Algorithm 18 (FurerComplexMul), we have N = O(n/(log 2 n) 2 ) and 2 λ = O(log 2 n). The input size of Algorithm 23 (MulZ) is n 0 = Θ((log 2 n) 2 ) bits. We have

Complexity of integer multiplication

O(N log N • 2 λ log n) = O((n/(log 2 n) 2 )(log 2 n) 3 ) = O(n log n). N (3 log 2 λ+1 N + 1) • M R0 ≤ O n (log 2 n) 2 • O log 2 n log (2) 2 n M R0 ≤ O(n log n) • M R0 n 0 (log 2 n 0 )
.

We thus have, using log p 0 = Θ(n 0 ):

M new (n) n log n = O(1) + O M R0 log 2 p 0 log (2)
2 p 0 = O(1) + m 0 part of the thesis show that computing with generalized Fermat prime is asymptotically feasible, and yields a good complexity.

Parameter choices for various input sizes

In this section, we consider various input sizes n, and various candidate generalized Fermat primes p 1 = r 1 2 λ 1 + 1. For combinations of these, we find values η and N (both powers of two) such that Algorithm 14 works. Let us briefly recall its structure: we write both n-bit integer inputs a and b in radix η, or equivalently as the evaluations at η of two polynomials of degree less than N/2. We multiply these polynomials in R 1 [x]. For this, we compute full N -point DFTs, then a point-wise product, and finally an inverse DFT. Arithmetic in R 1 , as in §9, uses representation in radix r 1 . For this procedure to correctly compute the integer product a • b, the following conditions must hold:

       N η 2 ≤ p 1
(no overflow occurs in R 1 ), 2 2n ≤ η N -1 (correct computation of the product of two n-bit integers), N | p 1 -1 (a principal N -th root of unity exists in R 1 ).

In particular, N is the smallest power of two above 2n/ log 2 η. When choosing η and N subject to the conditions above, we have some freedom. Ultimately, we wish to minimize the number of multiplications in R 1 , because we expect those to form the largest part of the computation time.

More precisely, we wish to minimize the overall cost (3E(N )+N )M R1 of expensive multiplications as introduced in §7 (M R1 denotes the cost of one expensive multiplication in R 1 ; we add N because of the point-wise products, and not 4N since here we do not use a half-DFT). Using the expression of E(N ), a rough estimate of the quantity to minimize is n log 2 η log 2 n λ1+1 M R1 , therefore for n constant we try to minimize

Q ≈ M R1 λ 1 log 2 η .
Thus, there is a trade-off to determine: when η grows, larger primes p 1 have to be used: M R1 increases, while 1 log 2 η decreases. Since the cost M R1 is given by the bit length of the prime p 1 , the η that we choose should be the largest η for which p 1 is valid (as per the first of the three conditions above). The number of expensive multiplications for various input sizes n and primes p 1 is reported in Table 10.1. We added in Table 10.1 the additional constraint that log 2 η be a multiple of the machine word size, to the extent possible (since N must be a power of two anyway, this constraint has no impact).

Cost of multiplications in the underlying ring

We now turn to the two last columns of Table 10.1. Our goal is to obtain a coarse lower bound on the time we expect our algorithm to take. Arithmetic in R 1 , and in particular multiplication, is our main focus. Elements of R 1 are represented in radix r 1 . We avoid the conversion between radix r 1 and binary representation by using Kronecker substitution: an element of R 1 , represented as a 2 λ1 -uple of integers in [0, r 1 ), is transformed into an integer of bit length k = (2 log 2 r 1 + λ 1 ) • 2 λ1 .

Multiplication in R 1 is then done by multiplying these integers modulo 2 k + 1 (we deal with signs in the same way as in Algorithm 22 (MulR)). We ignore the cost of converting this product back to radix r 1 . This is likely to be at the very least a significant source of inaccuracy in our lower bounds.

The fifth column of Table 10.1 reports the bit length k introduced above, for the various generalized Fermat primes chosen. Based on this bit length, we determined experimentally on a target machine (Intel Xeon E7-4850v3 CPU clocked at 2.20GHz) the time taken by the function mpn_mul in the GMP library [START_REF] Granlund | GNU MP: The GNU Multiple Precision Arithmetic Library[END_REF], thereby giving a lower bound on the multiplication time in R 1 . We multiplied this lower bound by the number of expensive multiplication reported on the fourth column of Table 10.1, from which we deduced a lower bound on the multiplication time for n-bit integers using our algorithm.

The determination of the bit length above led us to restrict the set of generalized Fermat primes to consider: two such primes that lead to identical bit length lead to an identical time for internal multiplications. Therefore, we favor the largest generalized Fermat prime for each value of the Kronecker-Schönhage bit length k above. In our choice, we also favored primes such that r 1 has largest 2-valuation among the candidate values (e.g. both 984 16 + 1 and 1018 16 + 1 are primes, but we experimented with the former because the latter only allows a maximum transform length of 2 16 ).

We deduce from Table 10.1 that for realistic sizes, choosing the prime p 1 appropriately can lead to a speed-up of the order of 2 to 4, with all the necessary words of caution: as mentioned above, we deliberately omitted some conversion costs that are unlikely to be negligible in practice, and also our measurements are done with all operands in cache memory, which is quite probably optimistic.

Comparison with Schönhage-Strassen

Let us compare approximatively the cost of Schönhage-Strassen's algorithm to our algorithm. We can do two things. At least up to some size, we can run GMP's implementation of the Schönhage-Strassen algorithm, and obtain an actual computation time. Or we can do as we did in Table 10.1: count the number of small multiplications involved, and measure their cost. We did both, because the latter approach, which inherently gives a lower bound, is a fairer comparison given that a lower bound is all that we have in Table 10.1.

Roughly speaking, a Schönhage-Strassen multiplication of two 2 n -bit integers involves 2 (n+1)/2 multiplications of 2 1+ (n+1)/2 -bit modular integers. In truth, a well-tuned implementation of the Schönhage-Strassen algorithm uses all sorts of optimizations that are well outside the scope of this thesis (see e.g. [START_REF] Gaudry | A GMP-based implementation of Schönhage-Strassen's large integer multiplication algorithm[END_REF]), so that this is a crude estimate.

In Table 10.2, we report how our lower bound compares to the lower bound that we obtain in this way on the running time of the Schönhage-Strassen algorithm. As we did in Table 10.1, the fourth column is computed by determining experimentally the individual cost of each of the underlying multiplications. For this, we timed GMP's internal routine mpn_mul_fft, as it is called in the implementation. The fifth column of Table 10.2 indicates the real computation time, measured experimentally (we modified GMP's internal mp_size_t type to go beyond 31 bits). Our measurements were limited by core memory, since the product of two 2 40 -bit integers took 1.3TB of RAM. The comparison with the previous column shows that our lower bound on the Schönhage-Strassen time is within a factor of two of the real computation time, which is acceptable.

We conclude from Table 10.2 that an implementation of our algorithm will unlikely beat an implementation of the Schönhage-Strassen algorithm for sizes below 2 40 . Above 2 40 , the ratio of our lower bounds is only slightly more than two. We may speculate that an optimized implementation could compensate this gap: by improving the arithmetic modulo a generalized Fermat prime for example. A direction to consider for optimization can be to improve on the time needed for internal multiplications. Considering that multiplication in R 1 can be though as multiplications of polynomials modulo X 2 λ 1 + 1, the idea is to use efficient algorithms to multiply polynomials modulo X P + 1 where P is less than 2 λ1 . For example, we may represent elements of R 1 in radix r In some cases, it might lead to a smaller bit length, at the expense of some extra conversion costs. For example for p 1 = 1984 16 + 1, working in radix 1984 2 leads to polynomials of length 8, and a bit length of 8 • 48 = 384 bits, instead of 416 bits (see Table 10.1). Another possibility is to use the multipoint Kronecker substitution proposed by Harvey in [START_REF] Harvey | Faster polynomial multiplication via multipoint kronecker substitution[END_REF]. For this same example, evaluating at +2 24 and -2 24 , we can compute the product via two multiplications of two 192-bit integers, which might be faster. For both ideas however, we have not taken into account the conversion costs, and it seems difficult to be very confident about the induced benefit.

Example 1 . 5 (

 15 Multiplication of linear polynomials).Let A = a 0 + a 1 X and B = b 0 + b 1 X be two polynomials over K. The product A • B is associated to the bilinear map Φ taking as input the vectors a = a

α

  i (a 0 , . . . , a m-1 , b 0 , . . . , b n-1 )β i (a 0 , . . . , a m-1 , b 0 , . . . , b n-1 )c i . By linearity, for i ∈ {0, . . . , L(Φ) -1}, α i (a 0 , . . . , a m-1 , b 0 , . . . , b n-1 ) = α i (a 0 , . . . , a m-1 , 0, . . . , 0) + α i (0, . . . , 0, b 0 , . . . , b n-1 ) and β i (a 0 , . . . , a m-1 , b 0 , . . . , b n-1 ) = β i (a 0 , . . . , a m-1 , 0, . . . , 0) + β i (0, . . . , 0, b 0 , . . . , b n-1 ).

Notation 1 . 25 .

 125 Let S be a set of subspaces of L(K m , K n ; K) and H ⊂ RPA m,n stabilizing S. We denote by S/ H = {{V • σ | σ ∈ H} | V ∈ S} the set of equivalence classes, or orbits, under the relation associated to the action of H on S.

Figure 2 . 1 :

 21 Figure 2.1: Subspaces V visited by recursive calls of Algorithm 3 up to k = 3

Figure 2 . 2 :

 22 Figure 2.2: Subspaces V visited by recursive calls of Algorithm 5 up to k = 3

2 .

 2 compute its orbit O under the action of U and reduce its elements by M , 3. remove the elements ψ of H such that their reduction by M is in O, 4. add to a list O the orbit O and return to Step 1.

Figure 2 . 3 :

 23 Figure 2.3: Pruning branches in an exhaustive search using RP-automorphisms.

Theorem 4 . 1 .

 41 Let any integer ≥ 2: 1. the orbit of the identity matrix I = N 0 for the action of Stab(T ) is the set of invertible matrices of T ; 2. the orbit of N for the action of Stab(T ) ∩ Stab(I) is the set of nilpotent matrices of T ; 3. for any pair (Ψ, Ψ ) of elements of T such that rk(Ψ) = and rk(Ψ ) = -1, there exists σ ∈ Stab(T ) such that (Ψ • σ, Ψ • σ) = (I, N ); 4. we have Stab(I)∩Stab(N ) ⊂ Stab(T ) and the cardinality of Stab(T ) is (#K) 3 -4 (#K-1) 3 .

Proposition 4 . 2 (

 42 Stem of short product). Let and r ≥ . The set {Span(Φ 0 , Φ 1 )}is a stem of T : for any basis B of T , there exists σ ∈ Stab(T ) and U ⊂ B of cardinality 2 such that Span(U) • σ = Span(Φ 0 , Φ 1 ).

  Once we have computed Q, it remains to compute the left transversalL = Stab({I, N })/ Stab(T ) ∩ Stab({I, N })and to compute Q • L. According to Theorem 4.1, we have #L = 1, which means that Algorithm 10 actually returns Sr-+2 ({I, N }) • L.

Proposition 4 . 4 (

 44 Stem of the circulant product). The set {Span({Φ 4 }), H} is a stem of T : for any basis B of T , there exists U ⊂ B and σ ∈ Stab(T ) such that Span(U) • σ = Span(Φ 4 ) or Span(U) = H.

Proposition 4 . 5 (

 45 Stem of H). The set {(Φ 0 + Φ 1 + Φ 2 + Φ 3 )} is a stem of H: for any basis B of H, there exists U ⊂ B of cardinality 1 and σ ∈ Stab(H) = Stab(T ) such that

Notation 5 . 1 .

 51 We denote by Ω d the quotient S d,d,d/GL(K d ) × GL(K d ) for any d ≥ 1.

Example 5 . 2 .

 52 are the reduced column echelon form of the matrices U and V , respectively. Let us consider the vector space W of S 3,4,6 generated by the rank-one bilinear forms represented by

  d in reduced column echelon form, we obtain all the elements of S m,n,d/GL(K m ) × GL(K n ) by considering the subset Ω d of Ω d = S d,d,d/GL(K d ) × GL(K d ) of elements represented by matrices (U, V ) in reduced column echelon form such that rk(U ) ≤ min(m, d) and rk(V ) ≤ min(n, d). Given m and n, a set of representatives for S m,n,d/GL(K m ) × GL(K n ) can be seen as matrices (U , V ) ∈ M d,m × M d,n in reduced column echelon form and for which there exists matrices (U, V ) ∈ M 2 d,d , representing an element of Ω d , obtained by adding d -m an d -n zero columns to U and V , respectively, or by removing zero columns if d < m or d < n.

4 :

 4 for σ ∈ S d do S d are the row permutations of M d,d 5:

Proposition 5 . 3 .

 53 Let d ≥ 1. There exists W ∈ Ω d such that there are # GL(d, K) free families B = (φ 0 , . . . , φ d-1 ) with rk(φ j ) = 1 for any j, and such that W = Span(B).

4 :

 4 for σ ∈ S d (dim E, . . . , d -1) doPermutations of the d -dim(E) last rows 5:

Figure 5 . 1 :

 51 Figure 5.1: Partially ordered structure of the Ω d for d ≤ 3 and K = F .

0≤i<n a i 2 i

 2 and b = 0≤i<n b i 2 i .

( 100010000000 )

 100010000000 and (000010001000), since k = 2 + log 2 4 = 4. The product c is represented by (00001000010010000000).

Algorithm 14 7 : 8 : 9 :

 14789 Multiply in Z via multipoint evaluation of polynomials 1: Input: a, b two integers to be multiplied; we let n ≥ max(log 2 |a| , log 2 |b|) 2: η a power of two; we let N = 2n/ log 2 η 3: R a ring such that there exists an injective function mapping integers below N η 2 to R 4: S ⊂ R a set of N evaluation points 5: Output: c = a • b 6: function MultiplyIntegersViaMultipointEvaluation(a, b, η, R) Let A(x) ∈ Z[X] with positive coefficients less than η and such that A(η) = a Let B(x) ∈ Z[X] with positive coefficients less than η and such that B(η) = b A and B are seen as elements of R[X] 10: Â ← MultiEvaluation(A, S); define B likewise.

11 :Ĉ

 11 ← PointwiseProduct( Â, B).

  and L(2) = 2. The resolution of the recursive equation leads to L(N ) = N log 2 N .

7 2 transforms of length 8 8 transforms of length 2 Figure 6 . 1 :

 7261 Figure 6.1: Butterfly of a 16-point FFT

. 7 . 7 .

 77 Proposition Let N ≥ 1. For λ ≥ 1, we denote by n(λ) the maximum max 0≤k<N/2 λ

.

  The functions x → sin(uπ) sin( uπ 2 λ ) and x → cos(uπ) cos( uπ 2 λ ) are both decreasing functions on ]0, 1/2[. Consequently, h 0 has at most one zero on ]0, 1/2[. Moreover, we have h 0 (1/2) > 0, since 2 -2 λ sin π 2 λ+1 > 0.

Lemma 7 . 10 (

 710 Lemma 6.1 in[START_REF] Fürer | Faster integer multiplication[END_REF]).Let C ∈ R be represented by C, such that C ∞ < v C and C -C ∞ < e C . Let k ∈ {0, . . . , 2N -1}.From C and ω k we compute a machine representation D of the product D = C • ω k , such that v D is a value bound and e D is an error bound on the coefficients of D. Then,

1. Start; 2 .

 2 After first level of Half-FFT; 3. After N -point FFT; 4. After point-wise products; 5. After Inverse-FFT; 6. After last level of Inverse-Half-FFT.

( 2 ) 2 (

 22 2N ) + 5 log 2 N ∼ 5 log 2 N + 2 λ+1 .

2 4 √

 24 n decreasing at each recursive call to the integer multiplication algorithm. they compute C = Ã • B mod X L + 1 and they obtain A(ω k ) multiplying the k-th coefficient of C by ν -k 2 .

Definition 8 . 6 (≥ 7 Table 8 . 3 :

 86783 Admissible generalized Fermat number). A generalized Fermat number p = P (r, λ) is called admissible whenever λ ≥ 4 and r is such that 2 λ ≤ r < 2 2λ λ 2.5 . Possible values for λ = log

( 3 ) 2 p

 32 for p = P (r, λ) an admissible generalized Fermat number, using the bounds log 2 (λ + log 2 λ) ≤ λ ≤ 1 + log

  2 λ (2λ + 2.5 log 2 λ)).

Algorithm 21

 21 Transform T R (a) of a ∈ R = Z/ pZ , with p = r 2 λ + 1 admissible (not necessarily prime), λ ≥ 4. (Algorithm without precomputations.) 1: function TransformR(a) 2:

1 : 2 :

 12 function MulR(a,T R (b)) Input: a ∈ R, represented in radix r; T R (b) for some b ∈ R.

3 :

 3 Output: a • b mod p, represented in radix r 4:

9 . 3 Lemma 9 . 4 .

 9394 Multiplication modulo generalized Fermat numbers Using Algorithm 21 (TransformR), we can now state Algorithm 22 (MulR). Its validity depends on the following lemma: Let notations be as in Algorithm 22. Let Ã, B be polynomials in Z[X] of degree less than N and with positive coefficients below r β such that, A and B being their respective images in R [X]/(X N + 1), we have T R (a) = Half-DFT N ,ω (A) and T R (b) = Half-DFT N ,ω (B) on line 7 of Algorithm 22. i . Both à and B are uniquely defined from T R (a) and T R (b).

  If we can use only deterministic exponential-time algorithms to search for a multiplicative generator for R , then the complexity of this search exceeds the overall complexity of integer multiplication.

Algorithm 23 1 :

 231 Multiplication of integers in Z Input: a, b two positive n-bit integers, n being a power of two. 2: Output: c = a • b 3: function MulZ(a,b) 4:

M

  new (n) = N (3 log 2 λ+1 N + 1) • M R0 + O(N log N • 2 λ log n);9.5 Solution of the recursive complexity equations 9.5.1 Summary of the recursive complexity equations

M Ri ≤ 3 2 M

 2 Ri . M new (n) = N (3 log 2 λ 0 +1 N + 1) • M R0 + O(N log N • 2 λ0 log n).

  By Lemma 8.8 we have 3 + λi λi+1+1 ≤ λi+9 log 2 λi λi+1+1 ≤ λi+9 log 2 λi λi+1

Theorem 9 . 8 .

 98 The complexity M new (n) of the algorithm presented in §9.4 to multiply n-bit integers isM new (n) = O(n • log n • 4 log * n ).

2 1instead of r 1 . 1 + a 3 r 3 1 and b 0 + b 1 r 1 + b 2 r 2 1 + b 3 r 3 1 modulo r 4 1 + 1 .

 21111311 For λ 1 = 2, we multiplya 0 + a 1 r 1 + a 2 r 2The conversion in radix r2 1 leads to the computation and the multiplication of(a 0 + a 1 r 1 ) + (a 2 + a 3 r 1 )r 2 1 and (b 0 + b 1 r 1 ) + (b 2 + b 3 r 1 )r 2 1 .

  ). On détaille les propriétés des premiers généralisés de Fermat dans le Chapitre 8. On propose un nouvel algorithme dans le Chapitre 9, basé sur la stratégie de Fürer et sur les premiers généralisés de Fermat, et on prouve qu'il multiplie des entiers de n bits en O(n • log 2 n • 4 log * n ). Dans le Chapitre 10, on discute des aspects pratiques d'une implémentation de notre algorithme de multiplications d'entiers.

	Introduction	xiii
	I Bilinear rank

1 From bilinear maps to vector spaces 1.1 Bilinear rank . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.1 Bilinear forms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.2 Bilinear maps . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.1.3 Multiplicative complexity and bilinear rank . . . . . . . . . . . . . . 1.2 A linear algebra problem . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 RP-automorphisms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 A review of existing exhaustive search algorithms 2.1 Mongtomery's Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 Exhaustive search for any bilinear map . . . . . . . . . . . . . . . . . . . . . 2.2.1 Naive algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.2 Oseledets' heuristics . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2.3 The BDEZ Algorithm (Barbulescu, Detrey, Estibals, Zimmermann) . 2.2.4 Improving on BDEZ using RP-automorphisms . . . . . . . . . . . . . 3 A new algorithm using coverings 3.1 Intermediate algorithms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2 Coverings of optimal decompositions . . . . . . . . . . . . . . . . . . . . . . 3.3 Enumerating the elements of Sr-+k (F) . . . . . . . . . . . . . . . . . . . . 4 Application to examples of bilinear maps 4.1 Application to the short product . . . . . . . . . . . . . . . . . . . . . . . . . 4.1.1 Structure of the short product . . . . . . . . . . . . . . . . . . . . . . ix x Sommaire

  We detail the properties of generalized Fermat primes in Chapter 8. We propose a new algorithm in Chapter 9, based on Fürer's strategy and on generalized Fermat primes and we prove it multiplies n-bit integers in O(n • log 2

Table 4 .

 4 the subspace of L(K , K ; K) spanned by the bilinear forms that are the coordinates of Φ, denoted by Φ 0 , . . . , Φ -1 .The matrix representing the element 0≤i< m i Φ i ∈ T , where m i ∈ K, is • 10 16 (est.) 5.7 • 10 12 (est.) BDEZStab 6.9 • 10 11 (est.) 2.2 • 10 8 (est.) • 10 26 (est.) 4.7 • 10 23 (est.) BDEZStab 2.0 • 10 19 (est.) 2.7 • 10 16 (est.) 1: Number of tests and timings obtained with Algorithms BDEZ, BDEZStab and CoveringSetsMethod for various bilinear maps over K = F 2 .

	bilinear map	rank	algorithm	nb. of tests	time (s)
	ShProd 3	5	BDEZ BDEZStab		5.9 • 10 2 3.4 • 10	1.4 • 10 -1 0.0
			BDEZ		5.2 • 10 7	4.3 • 10 3
	ShProd 4	8	BDEZStab		3.1 • 10 5	2.7 • 10
			CoveringSetsMethod		2.8 • 10 2	3.0
	ShProd 5	11	BDEZ 1.8 CoveringSetsMethod	6.3 • 10 6	2.4 • 10 3
	ShProd 6 3.9 CircProd 3 14 BDEZ BDEZ 4 BDEZStab	36 6	0.0 0.1 • 10 -2
	CircProd 4	8	BDEZ BDEZStab		5.2 • 10 7 3.1 • 10 5	4.3 • 10 3 2.7 • 10
	CircProd 5	10
			CoveringSetsMethod		8.8 • 10 8	5.4 • 10 3
	CircProd 6 1.0 • 10 MatProd (2,2,2) 12 BDEZ BDEZ 1.05 • 10 6 7 BDEZStab 6.8 • 10 3	8.5 • 10 5.0 • 10 -1
	MatProd (3,2,3)	15	BDEZ 9.2 • 10 CoveringSetsMethod 1.6 • 10 9	8.5 • 10 5
	MatProd (2,3,2)	11	BDEZ 2.3 • 10 CoveringSetsMethod 6.3 • 10 10	4.1 • 10 6

BDEZ 4.0 • 10 13 (est.) 1.2 • 10 10 (est.) BDEZStab 1.0 • 10 10 (est.) 3.5 • 10 6 (est.) 20 (est.) 1.3 • 10 17 (est.) BDEZStab 1.1 • 10 15 (est.) 1.5 • 10 12 (est.) 19 (est.) 1.1 • 10 17 (est.) BDEZStab 2.6 • 10 13 (est.) 3.4 • 10 10 (est.) 23 (est.) 2.7 • 10 20 (est.) BDEZStab 4.6 • 10 18 (est.) 5.4 • 10 15 (est.)

Table 4 .

 4 3: Short product analysisWe observe in Table4.3 that the cost of Step 2 and Step 3 grows linearly with the number of tests. The cost of Step 2 is indeed negligible for ShProd 5 . For ShProd 4 , it seems less clear: it is probably not precise enough for this magnitude.

	F	d # Sd ({F})	tests	step 1 (s) step 2 (s) step 3 (s)	sol.
	ShProd 4 {Φ 0 , Φ 1 } 6	2.8 • 10 2	2.8 • 10 2	2.8	1.0 • 10 -2 2.0 • 10 -2	83
	ShProd 5 {Φ 0 , Φ 1 } 8	6.3 • 10 6	6.3 • 10 6	1.8 • 10 3	3.9	2.8 • 10 2	3,168

Table 4 .

 4 4: Vector spaces found for the short product

Table 4 . 5

 45

			Sd ({F})	tests	step 1 (s) step 2 (s) step 3 (s) sol.
	{Φ 0 }	6	5.2 • 10	8.7 • 10 6	6.9 • 10	3.7	3.1 • 10 3	0
	{ 0≤i<4 Φ i } 6	2.0 • 10 3	6.7 • 10 5	6.7 • 10	5.0 • 10	1.9 • 10 2	264

: Circulant product

Table 4 .

 4 {Φ 0,0 , Φ 1,1 , Φ 2,2 } 9 2.5 • 10 7 9.1 • 10 8 1.5 • 10 5 4.1 • 10 3 1.3 • 10 6 2

			Sd ({F})	tests	step 1 (s) step 2 (s) step 3 (s)	sol.
	Φ 0,0 + Φ 1,1	7	8.8 • 10	1.2 • 10 8	2.7	2.8 • 10 4	2.0 • 10 5	5
	+Φ 2,2
	Φ 0,0 + Φ 1,1 ,	8	7.5 • 10 5	2.2 • 10 7	1.2 • 10 3	1.2 • 10 4	3.3 • 10 5	13
	Φ 0,1 + Φ 2,2
	Φ 0,0 + Φ 1,1 ,	8	1.0 • 10 4	2.8 • 10 5	9.3 • 10 2	9.9	4.1 • 10 2	1
	Φ 1,1 + Φ 2,2
	Φ 0,0 + Φ 1,1 ,	8	2.7 • 10 5	5.9 • 10 8	5.3 • 10 2	4.9 • 10 4	9.1 • 10 5	46
	Φ 2,2
				6: Matrix product analysis
	Instead of computing S9 ({Φ 0,0 , Φ 1,1 , Φ 2,2 }), we actually compute a subset E given by a special
	trick described in Section 4.3.2.

Table 4 . 7

 47

: Timings for E

Table 4 . 8

 48

	3.8 • 10 8	6.3 • 10 10	1.0 • 10 5	1.0 • 10 3	3.7 • 10 6	5,614

: Product of 2 × 3 by 3 × 2 matrices analysis

Table 5 .

 5 1: Number of elements of Ω d over K = F 2 having N bilinear forms of rank one, when this number is not zero.

		2	262	6	3315	7
	2	3	295	7	3569	8
	#elts of Ω 3 N	150	8	1993	9
	4	3	77	9	818
	2	4	63	10	593
	1	5	44	11	383
	2	7	17	12	226
	#elts of Ω 4 N	16	13	77
	10	4	6	14	84
	8	5	6	15	26
	4	6	11	17	24
	2	7	6	18	47
	2	8	4	19	42
	3	9	6	21	14
	2	15	2	32	23
	#elts of Ω 5 N	2	33	10
	38	5	2	63	8
	43	6			6
	21	7			3
	6	8			8
	13	9			6
	7	10			4
	4	11			4
	3	13			2
	2	16			2
	2	17			2	127
	2	31

1 , 1

Table 5 . 2

 52 • 10 7 3.8 • 10 11 6.1 • 10 15 4.0 • 10 20

	3	9	31	141	969	11, 289	265, 577
	upper bound 9.5 time (s) 1 9 4.4 • 10 2 9.9 • 10 4 0 0.0 0.0 1.8 • 10 -1 1.5	1.8 • 10	4.7 • 10 2	1.8 • 10 4

: Timings for our approach to compute the sets Ω d over K = F 2 on a single core of a 3.3 GHz Intel Core i5-4590.

Table 7 .

 7 1: Value and error bounds.

	In Fürer's article, the bound on the precision was
	9 + 2 λ+1 + 4λ + log

Table 8 .

 8 1: Approximations of the infinite product C λ , as defined by Lemma 8.2. The computation was done by enumerating all primes below 10 11 , with resulting values rounded to nearest. Proposition 8.3 shows that 1 λ

		λ	C λ	λ	C λ	λ	C λ	λ	C λ
	1.37	5 3.61	9 7.49	13 8.47	17 11.00
	2 2.68	6 3.94	10 8.02	14 8.01	18 13.01
	3 2.09	7 3.11	11 7.23	15 5.80	19 13.06
	4 3.67	8 7.43	12 8.43	16 11.20	20 14.45

  i+1 / log 2 p i ≤ 7/ log 2 p i+1 = O(1)which obviously also implies (log 2 N i+1 )/(log(2) 2 p i ) = O(1). Then N i+1 log 2 N i+1 log 2 p i+1 log 2 p i logFor the second line, it suffices to assume that M(log p i+1 ) is bounded by the complexity of the Schönhage-Strassen algorithm. We haveN i+1 λ i+1 M(log p i+1 ) log 2 p i log

		(2) 2 p i	≤ 7	log 2 N i+1 log 2 p i (2)	= O(1).
	(2) 2 p i	≤ 7	λ i+1 log	(2) 2 p i+1 log log	(3) 2 p i+1

  u 2 by observing Table8.3,λ K-3 ≥ 27 = u 3 again by Table 8.3, λ K-4 ≥ 2 λ K-3 /3 ≥ u 4 by Lemma 8.8, λ K-k ≥ u k for all k ≤ K.

Table 10 .

 10 10.4. Comparison with Schönhage-Strassen 2: Comparison of lower bounds on the running time of the Schönhage-Strassen algorithm and the practical algorithm described in 10.1. The right half is from Table 10.1. Timings measured on an Intel Xeon E7-4850v3 CPU (2.20GHz).

	123

Chapter 2. A review of existing exhaustive search algorithms

The code of this implementation can be found at the address http://karancode.gforge.inria.fr

λ otherwise.

On lines 10-13 of Algorithm 22, intervals depend on the degree so that we can do without a needlessly coarse lower bound 2N (r β ) 2 ≤ p . It would be possible to adjust the definition of φ in Proposition 8.7, as well as the corresponding proofs, so that that coarser inequality holds.

Remerciements

are concerned by the case rk(Φ i ) = 2 for any i (otherwise H2 is not satisfied). Since we assume Hypothesis H1, it is enough to prove that there exists i such that H B (Φ i ) > 2.

There is necessarily a couple (Φ i , Φ i ) such that

Otherwise, we would have #B ≥ 2 • 9 = 18 = 15 = rk(T ).

and, by Lemma 4.12, rk({Φ i , Φ i }) ≤ 3. Henceforth, we prove that this is contradictory, because rk({Φ i , Φ i }) = 4. Indeed, there are two cases.

• If Φ i + Φ i has rank 4, the conclusion follows.

• If Span(Φ i , Φ i ) is isomorphic to T 2,2,1 , whose rank is equal to 4: T 2,2,1 and T 2,1,2 have the same rank according to [START_REF] De Groote | Lectures on the Complexity of Bilinear Problems[END_REF] and T 2,1,2 is a vector space of dimension one generated by a bilinear form of rank 4.

Consequently, H B (Φ i ) > 2 or H B (Φ i ) > 2.

Matrix product (2, 3, 2)

We denote by Φ 2,3,2 the bilinear map

and Φ i,j its coefficients. We denote by T the corresponding vector space.

Proposition 4.16 (Stem of the matrix product 2 × 3 by 3 × 2). The set C = {Span({Φ 0,0 + Φ 1,1 , Φ 0,0 + Φ 0,1 + Φ 1,0 }), Span({Φ 0,0 + Φ 1,1 , Φ 0,0 })} is a stem of T : for any basis B of T , there exists U ⊂ B and σ ∈ Stab(T ) such that

Proof. Let B be a basis of T . We have to distinguish 2 cases:

• there exists an element of rank 6 in B;

• any element of B has rank 3.

In the first case, there exists σ ∈ Stab(T ) such that B • σ = (Φ 0,0 + Φ 1,1 , Ψ 1 , Ψ 2 , Ψ 3 ). We can assume that the coordinates of Ψ 1 in the basis (Φ 0,0 , Φ 1,1 , Φ 0,1 , Φ 1,0 ) have the following shape:

(1, 0, λ 2 , λ 3 ) or (0, 1, λ 2 , λ 3 ), because otherwise every element of the basis B would have coordinates of the shape (λ 0 , λ 0 , λ 2 , λ 3 ). Up to the action of Stab(Φ 0,0 + Φ 1,1 ) ∩ Stab(T ), we can assume that we are in the first case.

Part II

Asymptotic multiplication 67 Corollary 6.4. The morphism DFT N,ω is, in fact, a ring isomorphism.

Proof. The integer N is supposed to be invertible in the ring R. Consequently, DFT N,ω is invertible.

Thus, the task of interpolating a polynomial A from its multi-evaluation  can be done with essentially the same algorithm.

The isomorphism given by the DFT of a polynomial of length N is an isomorphism between R[X]/ (X N -1) and R N . In our applications, it is also useful to have an isomorphism between R[X]/ (X N + 1) and R N . Thus, we define the Half-DFT, which is an isomorphism derived from the one given by the DFT. Definition 6.5 (Half discrete Fourier Transform (DFT)). Let R be a ring with ω a principal 2N -th root of unity. The Half-DFT of length N and base root ω over R is the ring isomorphism Half-DFT N,ω defined as:

P → (P (ω), P (ω 3 ), . . . , P (ω 2N -1 )).

The fact that (X

Half-DFTs are used for polynomial products modulo X N + 1, as opposed to X N -1. Such convolutions are called negacyclic. The half-DFT of a polynomial A is related to the DFT of the polynomial A(ωX) via

Thus, an algorithm computing a DFT can be used to compute a half-DFT, with N additional multiplications involved in the computation of the polynomial A(ωX).

Cooley-Tukey FFT

Cooley and Tukey showed in [START_REF] Cooley | An algorithm for the machine calculation of complex Fourier series[END_REF] how a DFT of composite order N = N 1 N 2 can be computed. This algorithm is also sometimes called "matrix Fourier algorithm", alluding to the fact that it performs N 2 "column-wise" transforms of length N 1 , followed by N 1 "row-wise" transforms of length N 2 . It is described in Algorithm 15.

The notation DFT N,ω denotes a mathematical object rather than an algorithm. Therefore, we need to detail how recursive computations of DFT N k ,ω k are handled in Algorithm 15. Two approaches are rather typical instantiations of the Cooley-Tukey algorithm when the length N is a power of two:

Complex FFT

The choice R = C might seem natural because roots of unity are plenty. For a polynomial of length N , we can use the principal root of unity ω = e 2iπ/N . For any k such that k and N are coprime, ω k is an N -th principal root of unity.

The precision required calls for some analysis. The asymptotic complexity depends on the best choice for this precision. A precision of t = O(log 2 n) bits is compatible with a transform length N where N is the smallest power of two larger than ( n log 2 n ) (see [52, §3]), in the sense that the polynomials that we multiply can be represented on tN bits and the product would not be correct if t were smaller (thus, t = O(log 2 n) is optimal). We represent the elements of C as linear polynomials with coefficients in Z. Using the Kronecker substitution for the multiplications, we are led to store the elements of C on 4t + 2 = O(t) bits. The 4t + 2 bits include the zero padding due to the Kronecker substitution.

Assuming that we use RadixTwoCooleyTukeyFFT, we have N log 2 N additions and subtractions in C, whose cost is O(t) each. Thus, the binary cost of the additions and subtractions is

We have N log 2 N memory accesses to elements of size O(t). Thus, the binary cost of the memory accesses is also O(n log 2 n).

Finally, we have O(N log 2 N ) multiplications of integers of size O(t). Thus, the recursive equation corresponding to the FFT over the complex field is:

We simplify the equation by considering that n log 2 n ≤ N (log 2 N )M(t): we use the fact that M(t) is more expensive than the cost of an addition, which is linear in t. Thus, we have

2 n • . . . , where the number of recursive calls is log * 2 n + O(1).

Schönhage-Strassen algorithm

Schönhage and Strassen proposed in [START_REF] Schönhage | Schnelle Multiplikation großer Zahlen[END_REF] and in [START_REF] Schönhage | Asymptotically fast algorithms for the numerical multiplication and division of polynomials with complex coeficients[END_REF] two recursive algorithms to multiply elements of a ring of the form Z/ (2 m + 1)Z , where m is a power of two. Note that, in particular, the Schönhage-Strassen algorithms can be used to compute the product of n-bit integers for any n ≤ m 2 . We describe these algorithms in the following paragraphs. These algorithms are parametrized by integers t, k and e, depending on m. We split the m-bit elements of Z/ (2 m + 1)Z into pieces of size t, obtaining polynomials of length denoted by N = m/t. We consider that the coefficients of these polynomials live in R = Z/ 2 k (2 e + 1) Z , with e chosen such that N divides e and k "negligible", compared to m (say k ≈ log 2 m).

We multiply elements of R using Chinese remainder theorem (CRT), which states that

• To muliply polynomials of length N over Z/ 2 k Z , we use Kronecker substitution and any subquadratic algorithm to multiply integers.

• In Z/ (2 e + 1)Z , we use the fact that, since 2 is a 2e-th principal root of unity in Z/ (2 e + 1)Z and N divides e, 2 e/N is also a 2N -th principal root of unity in Z/ (2 e + 1)Z . Thus, we perform an FFT for the multiplication of polynomials of length N over Z/ (2 e + 1)Z .

Chapter 7

Fürer-like algorithms

Fürer proposed two distinct algorithms: one in [START_REF] Fürer | On the complexity of integer multiplication[END_REF] and, some 20 years later, in [START_REF] Fürer | Faster integer multiplication[END_REF]. The scheme proposed in [START_REF] Fürer | On the complexity of integer multiplication[END_REF] relies on the assumption that there exist infinitely many Fermat primes, which is unfortunately widely believed to be wrong.

Fürer's algorithm in a complex modular ring

In this section, we describe an improved version of the algorithm developed in [START_REF] Fürer | Faster integer multiplication[END_REF]. In particular, the ring R, described in [26, Section 4], is a complex ring of the form C[x]/ (x 2 λ + 1) . We prove here that we can work in a real ring of the form R[x]/ (x 2 λ + 1) . Fürer's algorithm combines the advantages of the complex field C and of the modular ring Z/ (2 e + 1)Z , for a multiplication of n-bit integers. These rings have orthogonal advantages and drawbacks.

• In the modular ring, there exists a particular root of unity, namely 2, for which the multiplications by its powers are linear in e, because they are equivalent to negacyclic shifts. In this ring, e ≈ √ n.

• In the complex field, there exists a particular power of the roots of unity for which the multiplications are also "easy" to compute: these roots are the powers of i. This can be used in a radix-4 FFT: the transforms of size 4 involve multiplications by powers of i, which are linear. Although there are fewer particular powers of roots of unity, the bitlength of the multiplications is approximately log 2 n which is less than √ n, by an order of magnitude. Thus, the recursive calls are done on smaller sizes, but the quantity of expensive multiplications is larger.

Fürer proposed in [START_REF] Fürer | Faster integer multiplication[END_REF] to use the ring

For any integer N which is a multiple of 2 λ+1 (and in particular for powers of two of higher order), we define ω N as the unique element of R that maps to exp(2(2j + 1)iπ/N ) in R j . Lagrange interpolation can be used to compute ω N explicitly. We verify easily that:

We assume that there exists n 0 satisfying n ≥ n 0 ≥ n 0 ≥ 16, where n 0 is the bit-length below which we apply a multiplication algorithm of worse asymptotic complexity. We suppose that Fürer's assertion is true for any k ∈ {2, . . . , n}. Then, we obtain from

We notice that log

2 n. By choosing c and d such that 16a ≤ 2 c and -8ad + 2b ≤ d (and c sufficiently large to initialize the induction), we obtain the final result. Compared to original Fürer's algorithm, using a polynomial ring with real coefficients and an improved precision involves a different coefficient a. A modification of this coefficient a involves a modification of the constant c and hence the constant hidden in the term O(log * n) of the final complexity.

Modular ring

A modular version of Fürer's algorithm has been proposed in [START_REF] De | Fast integer multiplication using modular arithmetic[END_REF]. Rather than considering the ring C[x]/(x 2 λ + 1), the authors proposed the ring Z[x]/(p c , x 2 λ + 1) for a well-chosen prime p, and a constant c. It can be understood as a p-adic version of Fürer's algorithm, with a fixed precision. When they split the input integers a and b, they decompose them into N chunks, where N is no longer

for a constant k that will be detailed later.

Thus, they decompose a as a = a 0 + ...

is the decomposition of i in radix N (to recover a, they evaluate the X i 's at 2 ( n N k )(N i -1) ). According to this decomposition, they need to choose c such that p c > N k 2 λ 2 2 λ+1 . The ring Z/p c Z should contain a 2N -th principal root of unity. For this purpose, they have to check that 2N | (p -1). Thus, they are looking for a prime p in the set {1 + 2iN | i ≥ 0}. They reduce the search by using the following theorem.

Theorem 7.14 (Linnik's theorem [START_REF] Linnik | On the least prime in an arithmetic progression. I. The basic theorem[END_REF]). There exist constants l and L such that for d and m coprime integers, the smallest prime p satisfying p ≡ d mod m is less than lm L .

Let now k be an integer greater than L.

Thus, according to Linnik's theorem, they can find p ≡ 1 mod 2N with a cost no larger than to O(N L ) = o(n).

It remains to find a 2N -th principal root of unity in Z/p c Z. For this purpose, it is necessary to find a generator of F p , which is a (p-1)-th root of unity in F p , with a deterministic complexity equal to O(p 1 4 + ), according to [START_REF] Shparlinski | On finding primitive roots in finite fields[END_REF], for any > 0. One can deduce from it a (p -1)-th root of unity in Z/p c Z by using Hensel lifting.

Once the root of unity is obtained, it remains to apply the Lagrange interpolation used in Fürer's version to get a root of unity

Thus, the authors use the same algorithm as Fürer, although they work with k-variate polynomials, where k 7 and c > 5(k + 1), which implies to work in the ring

), but does not change radically the complexity. They use several FFT: if the lengths are

) and Fürer's strategy.

However, using k-variate polynomials instead of univariate polynomials introduce constants in the term O(log * n) of the final complexity, due to the fact that the number of nonzero coefficients of the product of k-variate polynomials is larger than the number of coefficients of these k-variate polynomials (at most 2 k times). These constants have a practical impact and can be improved by considering that the computation of the prime p is a precomputation. Thus, rather than using k-variate polynomials, one can determine randomly the prime p with a cost O(log 3 2 N ). and work in (Z[x]/(p c , x 2 λ + 1)), but the algorithm is not deterministic anymore.

Bluestein's chirp transform

Harvey, van der Hoeven and Lecerf in [START_REF] Harvey | Even faster integer multiplication[END_REF], and Harvey and van der Hoeven in [START_REF] Harvey | Faster integer multiplication using plain vanilla FFT primes[END_REF] propose new algorithms achieving complexity bounds similar to the one that Fürer gets, and improve on the constant hidden in O(log * 2 n). Their improvement yields an asymptotic equation similar to the improvement in this part. The algorithms in [START_REF] Harvey | Even faster integer multiplication[END_REF][START_REF] Harvey | Faster integer multiplication using plain vanilla FFT primes[END_REF] rely on Bluestein's chirp transform [START_REF] Bluestein | A linear filtering approach to the computation of discrete Fourier transform. Audio and Electroacoustics[END_REF].

Bluestein's chirp transform allows one to compute an L-point DFT as a negacyclic product of two polynomials à and B. Let A = 0≤i<L a i X i be a polynomial of length L in R and ω ∈ R be an L-th principal root of unity. We assume that L is even and that there exists ν ∈ R such that ν 2 = ω. The authors have

Using the identity

Thus, denoting by à and B the polynomials The following proposition shows how from admissible generalized Fermat numbers (not necessarily prime), we can build smaller generalized Fermat primes. For large enough inputs, these smaller primes are in turn admissible, so that this construction can be used another time.

Proposition 8.7. Let λ ≥ 4, and let p = P (r, λ) = r 2 λ + 1 be an admissible generalized Fermat number. A smaller generalized Fermat prime denoted smallerprime(p) and an integer batchsize(p) are defined as follows.

Let λ = log

There exists a power of two β such that the following conditions hold:

+ 1 is a generalized Fermat prime.

Given β and p as above, we let smallerprime(p) = p and batchsize(p) = β. Furthermore, if λ ≥ 4, then p is admissible too.

In anticipation for the proof of Proposition 8.7, we prove the following bounds.

Lemma 8.8. Let λ and λ be as in Proposition 8.7. We have

Proof. Since p is admissible, we have

where T R is defined as in Algorithm 21 (albeit using R as an input ring).

Complexity of Algorithm 21, with or without precomputations

We define the following costs. The analysis of M R and M R will be done in §9.3.

• M R : cost of multiplying a ∈ R by b ∈ R, with no auxiliary inputs.

• M R : cost of the same computation, with T R (b) known.

• T R : cost of computing T R with Algorithm 21.

• T R : cost of computing T R with Algorithm 21, aided with the auxiliary knowledge of W(R).

• W R : cost of computing W(R).

We begin with T R . Algorithm 21 uses base conversions on lines 5 and 7. Both operations perform N = 2 λ /β conversions, and the respective costs per conversion in each case are O(log β • M(β log r)) and O(λ • M(β log r)) (in these complexity estimates, M(n) can be taken as the complexity obtained for multiplying integers by the Schönhage-Strassen algorithm, for example). By Proposition 8.7 we have log β ≤ λ , and by Lemma 8.9 we have log p = Θ(β log r), so that the overall base conversion costs in Algorithm 21 can be expressed as O(N λ • M(log p )).

The computation of the Half-DFT on line 8 of Algorithm 21 involve N log N multiplication by roots of unity in R , of which only (E(N ) + N ) exceed a linear cost (using the notation of Section 7.1). We have

We now turn to the analysis of T R . If the vector

]]} is known, then the computation of T R can be done a bit faster: the (E(N ) + N ) "expensive" multiplications by roots of unity in R do not need to recompute the transforms of the roots. They may thus use a somewhat faster algorithm for multiplication in R . We defined above its cost as M R , and we have:

Finally, we give the cost W R of computing W(R). Here, we do not recursively use W(R ) to compute the different elements. We do however use the knowledge of the root of unity ω (it belongs to the precomputed data smallerring(R)). We use the fact that we can deduce the transform of ω k from the binary decomposition of k and the computation of the transforms of the powers of the form ω 2 j , as in the fast exponentation algorithms. To compute W(R), we first compute T R (ω ) and T R (ω 2 ) , which cost 2T R . Then we do successive point-wise multiplications by the vector T R (ω 2 ) to obtain the transforms of the other roots. For each of the N /2 λ +1 -1 transforms to be inferred this way, we need N multiplications in R , where we temporarily set (R , N , ω ) = smallerring(R ). Therefore we have

Without further detail, we also claim that the inverse transform T -1 R can be computed with the same cost as T R .

is lifted to a unique signed representative modulo p on line 10. This proves the claim. 2 Statement (iii ) follows: by (ii ), we have that C = Ã • B mod X N + 1. By evaluating at r β , we obtain the result c = ab modulo (r β ) N + 1 = p.

Complexity analysis of Algorithm 22

We first mention that the relative costs of multiplications and transforms, with or without precomputations, satisfy the following equations.

(To get M R ≤ M R + T R , it suffices to first compute W(R), and then T R (b).) On line 10, Algorithm 22 converts between representation in radix r and binary representation. On line 14 the conversion is between binary representation and representation in radix r. As with Algorithm 21, we can do this in time O(N λ • M(log p )). Point-wise products, on line 7, use a variation of Algorithm 22, where there is no auxiliary input, recursively (thus exploiting the fact that the coefficients of T R (a) and T R (b) are represented in radix r ). And last but not least, the most important aspect of the complexity of Algorithm 22 is that since we compute W(R), the transforms T R (a) and T -1 R (γ) can take advantage of it. We thus have:

We now use the various expressions obtained in §9.2 to rewrite this. We use the coarse bounds

where we used E(N ) ≤ N log 2 λ +1 N and 5/2 < 3. Algorithm 22 also needs to move the head of tape of precomputed data by the size of the current data smallerring(R). The corresponding overhead O(log p ) is easily subsumed within the lower-order terms above.

Multiplication in Z using multiplication in R

We can build on Algorithm 22 to obtain an integer multiplication algorithm for n-bit integers a and b.

Note however that we avoid the following simple approach because it does not work complexitywise: we do not multiply a and b by considering them as elements of Z/ pZ for p an admissible generalized Fermat number such that p ≥ 2 2n . There are two reasons for that. First, doing so using the notation of Proposition 9.6. Let now A be a constant bounding the O(1) in Proposition 9.6, let C = A/3, and let e(i) = 0≤j≤2 (1 + j,i ). We have 4e(i) -1 ≥ 3 so that A ≤ (4e(i) -1)C. Proposition 9.6 implies

so that we get m 0 = O(4 log * n ) by Lemma 9.7. Finally, this gives

Chapter 10

Practical considerations

While our algorithm is mostly of theoretical interest, several points are worth mentioning, as an answer to the natural question of its practicality. Despite the title of this chapter, we are not reporting data on an actual implementation of our algorithm, but rather measurements that shed some light on its practical value.

Adaptation of the asymptotically fast algorithm to practical sizes

At the beginning of §9.4, we briefly alluded to a way to multiply two n-bit integers: pick a generalized Fermat number (not a priori prime) of the form p 0 = P (2 λ0 , λ 0 ), for λ 0 such that λ 0 2 λ0 ≥ 2n. Then use Algorithm 22 (MulR). This does not work asymptotically because computing roots of unity modulo p 1 = smallerprime(p 0 ) cannot be done deterministically with good complexity. However, in practice, for say n ≤ 2 64 , Table 8.3 and Lemma 8.9 imply that p 1 would then be at most a 2048-bit prime, for which both the primality proof and the computation of roots can reasonably be assumed to be done once and for all. Therefore, the stumbling blocks that are relevant for the asymptotic analysis need not be considered as such for a practical implementation. This implies in particular that resorting to Algorithm 18 (FurerComplexMul), as we do in Algorithm 23 (MulZ) for asymptotic reasons, is not needed in practice. Going further in this direction, we may in fact consider as a practical instance of our algorithm the more general procedure that follows Algorithm 14 with R 1 = Z/ p 1 Z as a base ring, where p 1 is a generalized Fermat prime. The aforementioned strategy can be regarded as Algorithm 14 with η = 2 λ0 , N = 2 λ0 (still with λ 0 2 λ0 ≥ 2n), at least in the case where β = batchsize(p 0 ) = 1.

Another alteration that we wish to make in practice is that our top-level multiplication need not use a negacyclic transform: whether we compute a product modulo 2 2n + 1 or 2 2n -1 makes no difference when both inputs are less than or equal to 2 n -1, which is the case on the top-level. On the other hand, a "full" DFT of length N instead of a Half-DFT saves 3N multiplications in the base ring, which is not entirely negligible. Since a product modulo 2 2n + 1 is done with a Half-DFT, we prefer to compute the product modulo 2 2n -1 on the top-level.

Finally, we note that for all sizes of practical interest, arithmetic in R 1 = Z/ p 1 Z will not be done with a Fourier-transform-based algorithm, because p 1 is only of very moderate size.

Taking into account all the remarks above, the only link that remains between the practical procedure that we envision and the algorithms (in particular, Algorithm 22 (MulR)) described in the second part of this thesis is that p 1 is a generalized Fermat prime. The developments in this bit length of both operands:

. De la même manière, l'algorithme de Strassen permet de multiplier deux matrices 2n × 2n en seulement sept produits de matrices n × n.

Les deux exemples précédents tombent dans la catégorie des applications bilinéaires : des fonctions de la forme Φ : K m × K n → K , pour un corps donné K, linéaires en chacune des deux variables. Parmi les applications bilinéaires les plus classiques, on trouve ainsi la multiplication de polynômes, de matrices, ou encore d'éléments d'extensions algébriques de corps finis. Étant donnée une application bilinéaire Φ, calculer le nombre minimal de multiplications nécessaires au calcul de cette application est un problème NP-difficile. L'objectif de cette thèse est de proposer des algorithmes minimisant ce nombre de multiplications. Deux angles d'attaques ont été suivis.

Un premier aspect de cette thèse est l'étude du problème du calcul de la complexité bilinéaire sous l'angle de la reformulation de ce problème en termes de recherche de sous-espaces vectoriels de matrices de rang donné. Ce travail a donné lieu à un algorithme tenant compte de propriétés intrinsèques aux produits considérés tels que les produits matriciels ou polynomiaux sur des corps finis. Cet algorithme a permis de trouver toutes les décompositions possibles, sur F 2 , pour le produit de polynômes modulo X 5 et le produit de matrices 3 × 2 par 2 × 3.

Un autre aspect de ma thèse est celui du développement d'algorithmes asymptotiquement rapides pour la multiplication entière. Une famille particulière d'algorithmes récents ont été proposés suite à un article de Fürer publié en 2007, qui proposait un premier algorithme, reposant sur la transformée de Fourier rapide (FFT) permettant de multiplier des entiers de n bits en O n log n • 2 O(log * n) , où log * est la fonction logarithme itéré. Dans cette thèse, un algorithme dont la complexité dépend d'une conjecture de théorie des nombres est proposé, reposant sur la FFT et l'utilisation de premiers généralisés de Fermat. Une analyse de complexité permet d'obtenir une estimation en O(n log n • 4 log * n ).

Mots-clés: multiplication, algorithme, complexité, rang, bilinéaire, entiers, matrices, polynômes, FFT

Abstract

Since 1960 and the result of Karatsuba, we know that the complexity of the multiplication (of integers or polynomials) is sub-quadratic: given a ring R, the product in R[X] of polynomials a 0 + a 1 X and b 0 + b 1 X, for any a 0 , a 1 , b 0 and b 1 in R, can be computed with three and not four multiplications over R: (a 0 + a 1 X)(b 0 + b 1 X) = m 0 + (m 2 -m 0 -m 1 )X + m 1 X 2 , with the three multiplications m 0 = a 0 b 0 , m 1 = a 1 b 1 et m 2 = (a 0 + a 1 )(b 0 + b 1 ). In the same manner, Strassen's algorithm allows one to multiply two matrices 2n × 2n with only seven products of matrices n × n.

The two previous examples fall in the category of bilinear maps: these are functions of the form Φ : K m × K n → K , given a field K, linear in each variable. Among the most classical bilinear maps, we have the multiplication of polynomials, matrices, or even elements of algebraic extension of finite fields. Given a bilinear map Φ, computing the minimal number of multiplications necessary to the evaluation of this map is a NP-hard problem. The purpose of this thesis is to propose algorithms minimizing this number of multiplications. Two angles of attack have been studied.

The first aspect of this thesis is to study the problem of the computation of the bilinear complexity under the angle of the reformulation of this problem in terms of research of matrix subspaces of a given rank. This work led to an algorithm taking into account intrinsic properties of the considered products such as matrix or polynomial products over finite fields. This algorithm allows one to find all the possible decompositions, over F 2 , for the product of polynomials modulo X 5 and the product of matrices 3 × 2 by 2 × 3.

Another aspect of this thesis was the development of fast asymptotic methods for the integer multiplication. There is a particular family of algorithms that has been proposed after an article by Fürer published in 2007. This article proposed a first algorithm, relying on fast Fourier transform (FFT), allowing one to multiply n-bit integers in O n log n • 2 O(log * n) , where log * is the iterated logarithm function. In this thesis, an algorithm, relying on a number theoretical conjecture, has been proposed, involving the use of FFT and generalized Fermat primes. With a careful complexity analysis of this algorithm, we obtain a complexity in O(n log n • 4 log * n ).

Keywords: multiplication, algorithm, complexity, rank, bilinear, integers, matrix, polynomials, FFT