Solving Polynomial Equations Modulo p

Executive summary

Isolate the roots, then split them by randomisation

The roots of a polynomial f in the prime field are exactly the roots of gcd(f, x^p − x), because x^p − x is the product of all linear factors. Computing that GCD requires only one modular exponentiation in the quotient ring. Separating the resulting linear factors from one another is then done by random shifts, which split the roots into residues and non-residues with probability close to one half at each attempt.

Learning objectives

Reduce root-finding to a single GCD with x^p − x.
Implement equal-degree splitting by random shifts and analyse its success probability.
Handle the low-degree cases with closed forms.
Explain why the algorithm is probabilistic in time but never in correctness.

Section 01Isolating the roots

Every element of the prime field satisfies x^p = x, so

x^p − x = ∏_{c ∈ F_p} (x − c)

Therefore gcd(f, x^p − x) is the product of the distinct linear factors of f — exactly the roots, each appearing once.

AlgorithmRoot isolationin: f ∈ F_p[x], p prime → out: g, the product of linear factors

Make f monic and remove repeated factors: replace f by f / gcd(f, f′).
Compute x^p mod f by modular exponentiation in the ring F_p[x]/(f) — never expand x^p as a polynomial.
Set g ← gcd(f, x^p mod f − x).
The roots of g are precisely the roots of f in F_p; deg g is their number.

The classic implementation error

Computing x^p as a literal polynomial of degree p is catastrophic — for a 64-bit prime the object cannot be stored. The exponentiation must happen in the quotient ring, where every intermediate has degree less than deg f.

Section 02Splitting by random shifts

Once g is a product of distinct linear factors, the roots are separated by exploiting quadratic residuacity: for a random shift a, the polynomial (x + a)^(p−1)/2 − 1 vanishes at exactly those roots r for which r + a is a non-zero square.

AlgorithmEqual-degree splitting (linear case)in: g, a product of distinct linear factors → out: all roots

If deg g ≤ 1, output the root and return.
Choose a ∈ F_p uniformly at random.
Compute h ← gcd(g, (x + a)^(p−1)/2 mod g − 1).
If h is trivial (degree 0 or deg g), return to step 2. A wasted attempt costs one exponentiation.
Recurse on h and on g/h.

Las Vegas, not Monte Carlo

Randomisation affects only the running time. Every factor produced is verified by an exact GCD, so the output is always correct — the algorithm may take longer than expected but never returns a wrong root.

Section 03Low-degree closed forms

Special cases worth handling directly
Degree	Method	Notes
1	r = −b/a	One modular inversion
2	Quadratic formula with a modular square root	Discriminant residuacity decides solvability; needs Tonelli–Shanks when p ≡ 1 (mod 8)
3	Cardano's formulae, or direct splitting	Requires a cube root; in characteristic 3 the formulae degenerate and must not be used
4	Resolvent cubic	Reduces to the cubic and quadratic cases
≥ 5	General algorithm above	No closed form exists; the probabilistic method is the practical choice

Small characteristic

Closed forms assume the characteristic does not divide the relevant denominators. In characteristic 2 the quadratic formula fails outright — the equation must be solved by the additive analogue — and in characteristic 3 the cubic formulae collapse. Guard these cases explicitly.

ReferenceFrequently asked questions

Does this work over an extension field?

Yes, with p replaced by the field size q throughout. The gcd with x^q − x still isolates the elements of the base field, and the splitting step uses the appropriate norm map in place of the quadratic residue character.

What if the modulus is composite?

The method breaks, because polynomials over ℤ/nℤ do not form a UFD and GCDs may not exist. In practice an attempted GCD that fails reveals a factor of n — which is useful, but it is not a root-finding algorithm.

Is Berlekamp's algorithm still relevant?

For small p it is excellent, being deterministic and reducing factorisation to a null-space computation of a p-dimensional matrix. For large p the matrix is too big and the Cantor–Zassenhaus style randomised approach dominates.

NavigateContinue in this stream

Curated next steps from this page. The site also surfaces algorithmically related reading below.

ProvenanceSources and further reading

This page is an original KEVOS explanatory article. It presents the underlying mathematics — definitions, algorithms, complexity results and selection criteria — in KEVOS editorial voice. No text is reproduced from any copyrighted source. Where numerical tables are relevant, KEVOS links to live authoritative databases rather than republishing static values.

Handbook application: from concept to controlled practice

Purpose. This expanded section turns the original page into a practical handbook. It preserves the supplied material and adds a repeatable way to apply, check and review Solving Polynomial Equations Modulo p. It does not replace a contract, legislation, a controlled standard, competent engineering judgement or specialist advice.

The operating aim is to turn a compact mathematical statement into a usable chain of definitions, claims, examples and checks. Read the original explanation first, then use the workflow and checks below to convert knowledge into evidence.

Treat Solving Polynomial Equations Modulo p as a network of definitions and implications, not as a list of formulas. The working vocabulary on this page—modulo, splitting, roots, section, random—should be made explicit before any proof or computation begins. Record the ambient set or structure, the permitted operations and the equality or equivalence relation in use. A compact theorem often changes meaning when the base field, finiteness condition, commutativity assumption or direction of an action changes.

For a proof, write the hypotheses as a checklist and mark the line at which each one is used. For a computation, state the representation of the input, the arithmetic model, the termination condition and the output invariant. For a classification problem, distinguish existence from uniqueness and distinguish an object from its representation. These separations prevent a correct local calculation from being mistaken for the general result.

A useful worked example should be small enough to inspect completely but rich enough to exercise the main mechanism. Compute the result in two ways where practical: symbolically and by substitution, structurally and numerically, or directly and through a normal form. Then include one near-miss example in which a hypothesis fails. The contrast explains why the theorem is shaped as it is and gives the reader a diagnostic pattern for later problems.

Verification is part of the mathematics. Check domains and codomains, substitute proposed solutions, test identity and zero cases, compare dimensions or cardinalities, and confirm that maps respect the required operations. In numerical work, report precision, conditioning and a residual rather than digits alone. In algorithmic work, separate mathematical correctness from implementation complexity and resource limits.

Step-by-step operating method

Fix the setting. State the objects, ambient structure, notation and assumptions before manipulating symbols.
Separate claims. Distinguish definitions, hypotheses, conclusions, equivalent conditions and consequences.
Choose a method. Select proof, construction, calculation or algorithm according to the question actually asked.
Work a small case. Use the smallest non-trivial example to expose the mechanism and test edge behaviour.
Verify independently. Substitute back, check invariants, test boundary cases or use an alternative derivation.

Worked-example protocol

Illustrative method—not a source theorem. Start with a small admissible input and list the definitions it must satisfy. Carry out each transformation on a separate line, citing the property that permits it. Preserve exact values until approximation is necessary. At the end, verify the output against the original definition and one invariant such as dimension, degree, determinant, order, norm or residual. Then alter one hypothesis and observe which step ceases to be valid. This protocol creates a reusable example without inventing a theorem-specific numerical answer.

Stage	Record	Quality check
Input	Objects, domain, notation, assumptions	Every symbol is defined
Method	Permitted operation or cited result at each step	All hypotheses hold
Output	Exact result and representation	Correct type, domain and form
Verification	Substitution, invariant or alternative derivation	Independent agreement
Boundary test	Zero, identity, degenerate or failed hypothesis	Scope is understood

Common failure modes and recovery actions

1. Watch for

Using a theorem without checking every hypothesis.

Recovery: Return to the governing definition or requirement and restate the decision in one sentence.

2. Watch for

Treating a suggestive example as a proof of the general case.

Recovery: Separate evidence from assumption, assign an owner and set a date for validation.

3. Watch for

Changing notation or conventions part-way through an argument.

Recovery: Run a small counterexample, boundary test, pilot or independent check before proceeding.

4. Watch for

Hiding a division-by-zero, convergence, finiteness or commutativity assumption.

Recovery: Record the consequence, decision and rationale, then update the controlled baseline.

5. Watch for

Reporting a computed result without a residual, substitution or structural check.

Recovery: Escalate when the issue affects safety, compliance, acceptance, material value or an agreed tolerance.

Review checklist

Can every symbol be traced to a definition or prior result?
Which hypothesis does each major step use?
Does the method cover zero, identity, degenerate and boundary cases?
Can the conclusion be checked by a second representation or calculation?
Are mandatory requirements distinguished from recommendations and illustrative values?
Are sources, assumptions, units, dates and versions recorded closely enough to reproduce the decision?
Have safety, legal, ethical, stakeholder and operational consequences been considered at the appropriate level?
Is there a named owner and a trigger for review, escalation, change or retirement?

Questions for deeper application

What is the most important distinction a practitioner must preserve when applying Solving Polynomial Equations Modulo p?