title: Cyclotomic fast Fourier transform
text: # Cyclotomic fast Fourier transform
  
  The cyclotomic fast Fourier transform is a type of fast Fourier transform algorithm over finite fields. This algorithm first decomposes a DFT into several circular convolutions, and then derives the DFT results from the circular convolution results. When applied to a DFT over $GF(2^{m})$, this algorithm has a very low multiplicative complexity. In practice, since there usually exist efficient algorithms for circular convolutions with specific lengths, this algorithm is very efficient.
  
  ## Background
  
  The discrete Fourier transform over finite fields finds widespread application in the decoding of error-correcting codes such as BCH codes and Reed–Solomon codes. Generalized from the complex field, a discrete Fourier transform of a sequence $\{f_{i}\}_{0}^{N-1}$ over a finite field $GF(p^m)$ is defined as
  
      $F_{j}=\sum _{i=0}^{N-1}f_{i}\alpha ^{ij},0\leq j\leq N-1,$
  
  where $\alpha$ is the N-th primitive root of 1 in $GF(p^m).$ If we define the polynomial representation of $\{f_{i}\}_{0}^{N-1}$ as
  
      $f(x)=f_{0}+f_{1}x+f_{2}x^{2}+\cdots +f_{N-1}x^{N-1}=\sum _{0}^{N-1}f_{i}x^{i},$
  
  it is easy to see that $F_{j}$ is simply $f(\alpha ^{j})$. That is, the discrete Fourier transform of a sequence converts it to a polynomial evaluation problem.
  
  Written in matrix format,
  
      $\mathbf {F} =\left[{\begin{matrix}F_{0}\\F_{1}\\\vdots \\F_{N-1}\end{matrix}}\right]=\left[{\begin{matrix}\alpha ^{0}&\alpha ^{0}&\cdots &\alpha ^{0}\\\alpha ^{0}&\alpha ^{1}&\cdots &\alpha ^{N-1}\\\vdots &\vdots &\ddots &\vdots \\\alpha ^{0}&\alpha ^{N-1}&\cdots &\alpha ^{(N-1)(N-1)}\end{matrix}}\right]\left[{\begin{matrix}f_{0}\\f_{1}\\\vdots \\f_{N-1}\end{matrix}}\right]={\mathcal {F}}\mathbf {f} .$
  
  Direct evaluation of DFT has an $O(N^{2})$ complexity. Fast Fourier transforms are just efficient algorithms evaluating the above matrix-vector product.
  
  ## Algorithm
  
  First, we define a linearized polynomial over $GF(p^m)$ as
  
      $L(x)=\sum _{i}l_{i}x^{p^{i}},l_{i}\in \mathrm {GF} (p^{m}).$
  
  $L(x)$ is called linearized because $L(x_{1}+x_{2})=L(x_{1})+L(x_{2})$, which comes from the fact that for elements $x_{1},x_{2}\in \mathrm {GF} (p^{m}),$$(x_{1}+x_{2})^{p}=x_{1}^{p}+x_{2}^{p}.$
  
  Notice that $p$ is invertible modulo $N$ because $N$ must divide the order $p^{m}-1$ of the multiplicative group of the field $\mathrm {GF} (p^{m})$. So, the elements $\{0,1,2,\ldots ,N-1\}$ can be partitioned into $l+1$ cyclotomic cosets modulo $N$:
  
      $\{0\},$
      $\{k_{1},pk_{1},p^{2}k_{1},\ldots ,p^{m_{1}-1}k_{1}\},$
      $\ldots ,$
      $\{k_{l},pk_{l},p^{2}k_{l},\ldots ,p^{m_{l}-1}k_{l}\},$
  
  where $k_{i}=p^{m_{i}}k_{i}{\pmod {N}}$. Therefore, the input to the Fourier transform can be rewritten as
  
      $f(x)=\sum _{i=0}^{l}L_{i}(x^{k_{i}}),\quad L_{i}(y)=\sum _{t=0}^{m_{i}-1}y^{p^{t}}f_{p^{t}k_{i}{\bmod {N}}}.$
  
  In this way, the polynomial representation is decomposed into a sum of linear polynomials, and hence $F_{j}$ is given by
  
      $F_{j}=f(\alpha ^{j})=\sum _{i=0}^{l}L_{i}(\alpha ^{jk_{i}})$.
  
  Expanding $\alpha ^{jk_{i}}\in \mathrm {GF} (p^{m_{i}})$ with the proper basis $\{\beta _{i,0},\beta _{i,1},\ldots ,\beta _{i,m_{i}-1}\}$, we have $\alpha ^{jk_{i}}=\sum _{s=0}^{m_{i}-1}a_{ijs}\beta _{i,s}$ where $a_{ijs}\in \mathrm {GF} (p)$, and by the property of the linearized polynomial $L_{i}(x)$, we have
  
      $F_{j}=\sum _{i=0}^{l}\sum _{s=0}^{m_{i}-1}a_{ijs}\left(\sum _{t=0}^{m_{i}-1}\beta _{i,s}^{p^{t}}f_{p^{t}k_{i}{\bmod {N}}}\right)$
  
  This equation can be rewritten in matrix form as $\mathbf {F} =\mathbf {AL\Pi f}$, where $\mathbf {A}$ is an $N\times N$ matrix over GF(p) that contains the elements $a_{ijs}$, $\mathbf {L}$ is a block diagonal matrix, and $\mathbf {\Pi }$ is a permutation matrix regrouping the elements in $\mathbf {f}$ according to the cyclotomic coset index.
  
  Note that if the normal basis $\{\gamma _{i}^{p^{0}},\gamma _{i}^{p^{1}},\cdots ,\gamma _{i}^{p^{m_{i}-1}}\}$ is used to expand the field elements of $\mathrm {GF} (p^{m_{i}})$, the i-th block of $\mathbf {L}$ is given by:
  
      $\mathbf {L} _{i}={\begin{bmatrix}\gamma _{i}^{p^{0}}&\gamma _{i}^{p^{1}}&\cdots &\gamma _{i}^{p^{m_{i}-1}}\\\gamma _{i}^{p^{1}}&\gamma _{i}^{p^{2}}&\cdots &\gamma _{i}^{p^{0}}\\\vdots &\vdots &\ddots &\vdots \\\gamma _{i}^{p^{m_{i}-1}}&\gamma _{i}^{p^{0}}&\cdots &\gamma _{i}^{p^{m_{i}-2}}\\\end{bmatrix}}$
  
  which is a circulant matrix. It is well known that a circulant matrix-vector product can be efficiently computed by convolutions. Hence we successfully reduce the discrete Fourier transform into short convolutions.
  
  ## Complexity
  
  When applied to a characteristic-2 field $GF(2^m),$ the matrix $\mathbf {A}$ is just a binary matrix. Only addition is used when calculating the matrix-vector product of $\mathrm {A}$ and $\mathrm {L\Pi f}$. It has been shown that the multiplicative complexity of the cyclotomic algorithm is given by $O(n(\log _{2}n)^{\log _{2}{\frac {3}{2}}})$, and the additive complexity is given by $O(n^{2}/(\log _{2}n)^{\log _{2}{\frac {8}{3}}})$.
  
  