passagemath-modules 10.6.31rc3__cp314-cp314-manylinux_2_27_x86_64.manylinux_2_28_x86_64.whl

sage/crypto/lattice.py

@@ -0,0 +1,312 @@
+# sage_setup: distribution = sagemath-modules
+# sage.doctest: needs sage.modules
+"""
+Hard Lattice Generator
+
+This module contains lattice related functions relevant in
+cryptography.
+
+Feel free to add more functionality.
+
+AUTHORS:
+
+- Richard Lindner <rlindner@cdc.informatik.tu-darmstadt.de>
+
+- Michael Schneider <mischnei@cdc.informatik.tu-darmstadt.de>
+"""
+
+#*****************************************************************************
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 2 of the License, or
+# (at your option) any later version.
+#                  http://www.gnu.org/licenses/
+#*****************************************************************************
+
+from sage.rings.polynomial.polynomial_ring import PolynomialRing_generic
+
+
+def gen_lattice(type='modular', n=4, m=8, q=11, seed=None,
+                quotient=None, dual=False, ntl=False, lattice=False):
+    r"""
+    This function generates different types of integral lattice bases
+    of row vectors relevant in cryptography.
+
+    Randomness can be set either with ``seed``, or by using
+    :func:`sage.misc.randstate.set_random_seed`.
+
+    INPUT:
+
+    - ``type`` -- one of the following strings
+
+      - ``'modular'`` -- default; a class of lattices for which
+        asymptotic worst-case to average-case connections hold. For
+        more refer to [Aj1996]_
+      - ``'random'`` -- special case of modular (n=1); a dense class
+        of lattice used for testing basis reduction algorithms
+        proposed by Goldstein and Mayer [GM2002]_
+      - ``'ideal'`` -- special case of modular; allows for a more
+        compact representation proposed by [LM2006]_
+      - ``'cyclotomic'`` -- special case of ideal; allows for
+        efficient processing proposed by [LM2006]_
+
+    - ``n`` -- determinant size, primal: `det(L) = q^n`, dual: `det(L) = q^{m-n}`.
+      For ideal lattices this is also the degree of the quotient polynomial.
+
+    - ``m`` -- lattice dimension, `L \subseteq Z^m`
+
+    - ``q`` -- coefficient size, `q-Z^m \subseteq L`
+
+    - ``seed`` -- randomness seed
+
+    - ``quotient`` -- for the type ``'ideal'``, this determines the quotient
+      polynomial. Ignored for all other types
+
+    - ``dual`` -- set this flag if you want a basis for `q-dual(L)`, for example
+      for Regev's LWE bases [Reg2005]_
+
+    - ``ntl`` -- set this flag if you want the lattice basis in NTL readable
+      format
+
+    - ``lattice`` -- set this flag if you want a
+      :class:`FreeModule_submodule_with_basis_integer` object instead
+      of an integer matrix representing the basis
+
+    OUTPUT: ``B`` a unique size-reduced triangular (primal: lower_left,
+    dual: lower_right) basis of row vectors for the lattice in question
+
+    EXAMPLES:
+
+    Modular basis::
+
+        sage: sage.crypto.gen_lattice(m=10, seed=42)
+        [11  0  0  0  0  0  0  0  0  0]
+        [ 0 11  0  0  0  0  0  0  0  0]
+        [ 0  0 11  0  0  0  0  0  0  0]
+        [ 0  0  0 11  0  0  0  0  0  0]
+        [ 2  4  3  5  1  0  0  0  0  0]
+        [ 1 -5 -4  2  0  1  0  0  0  0]
+        [-4  3 -1  1  0  0  1  0  0  0]
+        [-2 -3 -4 -1  0  0  0  1  0  0]
+        [-5 -5  3  3  0  0  0  0  1  0]
+        [-4 -3  2 -5  0  0  0  0  0  1]
+
+    Random basis::
+
+        sage: sage.crypto.gen_lattice(type='random', n=1, m=10, q=11^4, seed=42)
+        [14641     0     0     0     0     0     0     0     0     0]
+        [  431     1     0     0     0     0     0     0     0     0]
+        [-4792     0     1     0     0     0     0     0     0     0]
+        [ 1015     0     0     1     0     0     0     0     0     0]
+        [-3086     0     0     0     1     0     0     0     0     0]
+        [-5378     0     0     0     0     1     0     0     0     0]
+        [ 4769     0     0     0     0     0     1     0     0     0]
+        [-1159     0     0     0     0     0     0     1     0     0]
+        [ 3082     0     0     0     0     0     0     0     1     0]
+        [-4580     0     0     0     0     0     0     0     0     1]
+
+    Ideal bases with quotient `x^n-1`, `m=2*n` are NTRU bases::
+
+        sage: sage.crypto.gen_lattice(type='ideal', seed=42, quotient=x^4 - 1)          # needs sage.symbolic
+        [11  0  0  0  0  0  0  0]
+        [ 0 11  0  0  0  0  0  0]
+        [ 0  0 11  0  0  0  0  0]
+        [ 0  0  0 11  0  0  0  0]
+        [-3 -3 -2  4  1  0  0  0]
+        [ 4 -3 -3 -2  0  1  0  0]
+        [-2  4 -3 -3  0  0  1  0]
+        [-3 -2  4 -3  0  0  0  1]
+
+    Ideal bases also work with polynomials::
+
+        sage: R.<t> = PolynomialRing(ZZ)
+        sage: sage.crypto.gen_lattice(type='ideal', seed=1234, quotient=t^4 - 1)        # needs sage.libs.pari
+        [11  0  0  0  0  0  0  0]
+        [ 0 11  0  0  0  0  0  0]
+        [ 0  0 11  0  0  0  0  0]
+        [ 0  0  0 11  0  0  0  0]
+        [-3  4  1  4  1  0  0  0]
+        [ 4 -3  4  1  0  1  0  0]
+        [ 1  4 -3  4  0  0  1  0]
+        [ 4  1  4 -3  0  0  0  1]
+
+    Cyclotomic bases with n=2^k are SWIFFT bases::
+
+        sage: sage.crypto.gen_lattice(type='cyclotomic', seed=42)                       # needs sage.libs.pari
+        [11  0  0  0  0  0  0  0]
+        [ 0 11  0  0  0  0  0  0]
+        [ 0  0 11  0  0  0  0  0]
+        [ 0  0  0 11  0  0  0  0]
+        [-3 -3 -2  4  1  0  0  0]
+        [-4 -3 -3 -2  0  1  0  0]
+        [ 2 -4 -3 -3  0  0  1  0]
+        [ 3  2 -4 -3  0  0  0  1]
+
+    Dual modular bases are related to Regev's famous public-key
+    encryption [Reg2005]_::
+
+        sage: sage.crypto.gen_lattice(type='modular', m=10, seed=42, dual=True)
+        [ 0  0  0  0  0  0  0  0  0 11]
+        [ 0  0  0  0  0  0  0  0 11  0]
+        [ 0  0  0  0  0  0  0 11  0  0]
+        [ 0  0  0  0  0  0 11  0  0  0]
+        [ 0  0  0  0  0 11  0  0  0  0]
+        [ 0  0  0  0 11  0  0  0  0  0]
+        [ 0  0  0  1 -5 -2 -1  1 -3  5]
+        [ 0  0  1  0 -3  4  1  4 -3 -2]
+        [ 0  1  0  0 -4  5 -3  3  5  3]
+        [ 1  0  0  0 -2 -1  4  2  5  4]
+
+    Relation of primal and dual bases::
+
+        sage: B_primal = sage.crypto.gen_lattice(m=10, q=11, seed=42)
+        sage: B_dual = sage.crypto.gen_lattice(m=10, q=11, seed=42, dual=True)
+        sage: B_dual_alt = transpose(11*B_primal.inverse()).change_ring(ZZ)
+        sage: B_dual_alt.hermite_form() == B_dual.hermite_form()
+        True
+
+    TESTS:
+
+    Test some bad quotient polynomials::
+
+        sage: sage.crypto.gen_lattice(type='ideal', seed=1234, quotient=cos(x))         # needs sage.symbolic
+        Traceback (most recent call last):
+        ...
+        TypeError: self must be a numeric expression
+        sage: sage.crypto.gen_lattice(type='ideal', seed=1234, quotient=x^23-1)         # needs sage.symbolic
+        Traceback (most recent call last):
+        ...
+        ValueError: ideal basis requires n = quotient.degree()
+        sage: R.<u,v> = ZZ[]
+        sage: sage.crypto.gen_lattice(type='ideal', seed=1234, quotient=u+v)
+        Traceback (most recent call last):
+        ...
+        TypeError: quotient should be a univariate polynomial
+
+    We are testing output format choices::
+
+        sage: sage.crypto.gen_lattice(m=10, q=11, seed=42)
+        [11  0  0  0  0  0  0  0  0  0]
+        [ 0 11  0  0  0  0  0  0  0  0]
+        [ 0  0 11  0  0  0  0  0  0  0]
+        [ 0  0  0 11  0  0  0  0  0  0]
+        [ 2  4  3  5  1  0  0  0  0  0]
+        [ 1 -5 -4  2  0  1  0  0  0  0]
+        [-4  3 -1  1  0  0  1  0  0  0]
+        [-2 -3 -4 -1  0  0  0  1  0  0]
+        [-5 -5  3  3  0  0  0  0  1  0]
+        [-4 -3  2 -5  0  0  0  0  0  1]
+
+        sage: sage.crypto.gen_lattice(m=10, q=11, seed=42, ntl=True)
+        [
+        [11 0 0 0 0 0 0 0 0 0]
+        [0 11 0 0 0 0 0 0 0 0]
+        [0 0 11 0 0 0 0 0 0 0]
+        [0 0 0 11 0 0 0 0 0 0]
+        [2 4 3 5 1 0 0 0 0 0]
+        [1 -5 -4 2 0 1 0 0 0 0]
+        [-4 3 -1 1 0 0 1 0 0 0]
+        [-2 -3 -4 -1 0 0 0 1 0 0]
+        [-5 -5 3 3 0 0 0 0 1 0]
+        [-4 -3 2 -5 0 0 0 0 0 1]
+        ]
+
+        sage: sage.crypto.gen_lattice(m=10, q=11, seed=42, lattice=True)                # needs fpylll
+        Free module of degree 10 and rank 10 over Integer Ring
+        User basis matrix:
+        [ 0  0  1  1  0 -1 -1 -1  1  0]
+        [-1  1  0  1  0  1  1  0  1  1]
+        [-1  0  0  0 -1  1  1 -2  0  0]
+        [-1 -1  0  1  1  0  0  1  1 -1]
+        [ 1  0 -1  0  0  0 -2 -2  0  0]
+        [ 2 -1  0  0  1  0  1  0  0 -1]
+        [-1  1 -1  0  1 -1  1  0 -1 -2]
+        [ 0  0 -1  3  0  0  0 -1 -1 -1]
+        [ 0 -1  0 -1  2  0 -1  0  0  2]
+        [ 0  1  1  0  1  1 -2  1 -1 -2]
+    """
+    from sage.rings.finite_rings.integer_mod_ring import IntegerModRing
+    from sage.matrix.constructor import identity_matrix, block_matrix
+    from sage.matrix.matrix_space import MatrixSpace
+    from sage.rings.integer_ring import ZZ
+    if seed is not None:
+        from sage.misc.randstate import set_random_seed
+        set_random_seed(seed)
+
+    if type == 'random':
+        if n != 1:
+            raise ValueError('random bases require n = 1')
+
+    ZZ_q = IntegerModRing(q)
+    A = identity_matrix(ZZ_q, n)
+
+    if type == 'random' or type == 'modular':
+        R = MatrixSpace(ZZ_q, m-n, n)
+        A = A.stack(R.random_element())
+
+    elif type == 'ideal':
+        if quotient is None:
+            raise ValueError('ideal bases require a quotient polynomial')
+        try:
+            quotient = quotient.change_ring(ZZ_q)
+        except (AttributeError, TypeError):
+            quotient = quotient.polynomial(base_ring=ZZ_q)
+
+        P = quotient.parent()
+        # P should be a univariate polynomial ring over ZZ_q
+        if not isinstance(P, PolynomialRing_generic):
+            raise TypeError("quotient should be a univariate polynomial")
+        assert P.base_ring() is ZZ_q
+
+        if quotient.degree() != n:
+            raise ValueError('ideal basis requires n = quotient.degree()')
+        R = P.quotient(quotient)
+        for i in range(m//n):
+            A = A.stack(R.random_element().matrix())
+
+    elif type == 'cyclotomic':
+        from sage.arith.misc import euler_phi
+        from sage.misc.functional import cyclotomic_polynomial
+
+        # we assume that n+1 <= min( euler_phi^{-1}(n) ) <= 2*n
+        found = False
+        for k in range(2*n,n,-1):
+            if euler_phi(k) == n:
+                found = True
+                break
+        if not found:
+            raise ValueError("cyclotomic bases require that n "
+                       "is an image of Euler's totient function")
+
+        R = ZZ_q['x'].quotient(cyclotomic_polynomial(k, 'x'), 'x')
+        for i in range(m//n):
+            A = A.stack(R.random_element().matrix())
+
+    # switch from representatives 0,...,(q-1) to (1-q)/2,....,(q-1)/2
+    def minrep(a):
+        if abs(a-q) < abs(a):
+            return a-q
+        else:
+            return a
+    A_prime = A[n:m].lift().apply_map(minrep)
+
+    if not dual:
+        B = block_matrix([[ZZ(q), ZZ.zero()], [A_prime, ZZ.one()] ],
+                         subdivide=False)
+    else:
+        B = block_matrix([[ZZ.one(), -A_prime.transpose()],
+            [ZZ.zero(), ZZ(q)]], subdivide=False)
+        for i in range(m//2):
+            B.swap_rows(i,m-i-1)
+
+    if ntl and lattice:
+        raise ValueError("Cannot specify ntl=True and lattice=True "
+                         "at the same time")
+
+    if ntl:
+        return B._ntl_()
+    elif lattice:
+        from sage.modules.free_module_integer import IntegerLattice
+        return IntegerLattice(B)
+    else:
+        return B

sage/crypto/lfsr.py

@@ -0,0 +1,295 @@
+# sage_setup: distribution = sagemath-modules
+# sage.doctest: needs sage.rings.finite_rings
+r"""
+Linear feedback shift register (LFSR) sequence commands
+
+Stream ciphers have been used for a long time as a source of pseudo-random
+number generators.
+
+S. Golomb [Go1967]_ gives a list of three statistical properties that a sequence of
+numbers `{\bf a}=\{a_n\}_{n=1}^\infty`, `a_n\in \{0,1\}` should display to be
+considered "random". Define the autocorrelation of `{\bf a}` to be
+
+.. MATH::
+
+     C(k)=C(k,{\bf a})=\lim_{N\rightarrow \infty} \frac{1}{N}\sum_{n=1}^N (-1)^{a_n+a_{n+k}}.
+
+In the case where `{\bf a}` is periodic with period `P`, then this reduces to
+
+.. MATH::
+
+     C(k)=\frac{1}{P}\sum_{n=1}^P (-1)^{a_n+a_{n+k}}.
+
+Assume `{\bf a}` is periodic with period `P`.
+
+-  balance: `|\sum_{n=1}^P(-1)^{a_n}|\leq 1`.
+
+-  low autocorrelation:
+
+   .. MATH::
+
+      C(k)= \left\{ \begin{array}{cc} 1,& k=0,\\ \epsilon, & k\not= 0. \end{array} \right.
+
+   (For sequences satisfying these first two properties, it is known that
+   `\epsilon=-1/P` must hold.)
+
+-  proportional runs property: In each period, half the runs have length `1`,
+   one-fourth have length `2`, etc.  Moreover, there are as many runs of `1`'s as
+   there are of `0`'s.
+
+A general feedback shift register is a map `f:{\bf F}_q^d\rightarrow {\bf
+F}_q^d` of the form
+
+.. MATH::
+
+     \begin{array}{c} f(x_0,...,x_{n-1})=(x_1,x_2,...,x_n),\\ x_n=C(x_0,...,x_{n-1}), \end{array}
+
+
+where `C:{\bf F}_q^d\rightarrow {\bf F}_q` is a given function. When `C` is of
+the form
+
+.. MATH::
+
+     C(x_0,...,x_{n-1})=a_0x_0+...+a_{n-1}x_{n-1},
+
+for some given constants `a_i\in {\bf F}_q`, the map is called a linear
+feedback shift register (LFSR).
+
+Example of an LFSR: Let
+
+.. MATH::
+
+     f(x)=a_{{0}}+a_{{1}}x+...+a_{{n}}{x}^n+...,
+
+.. MATH::
+
+     g(x)=b_{{0}}+b_{{1}}x+...+b_{{n}}{x}^n+...,
+
+be given polynomials in `{\bf F}_2[x]` and let
+
+.. MATH::
+
+     h(x)=\frac{f(x)}{g(x)}=c_0+c_1x+...+c_nx^n+... \ .
+
+We can compute a recursion formula which allows us to rapidly compute the
+coefficients of `h(x)` (take `f(x)=1`):
+
+.. MATH::
+
+     c_{n}=\sum_{i=1}^n {\frac{-b_i}{b_0}c_{n-i}}.
+
+The coefficients of `h(x)` can, under certain conditions on `f(x)` and `g(x)`,
+be considered "random" from certain statistical points of view.
+
+Example: For instance, if
+
+.. MATH::
+
+     f(x)=1,\ \ \ \ g(x)=x^4+x+1,
+
+then
+
+.. MATH::
+
+     h(x)=1+x+x^2+x^3+x^5+x^7+x^8+...\ .
+
+The coefficients of `h` are
+
+.. MATH::
+
+     \begin{array}{c} 1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, \\
+     1, 1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, ...\ . \end{array}
+
+The sequence of `0,1`'s is periodic with period `P=2^4-1=15` and satisfies
+Golomb's three randomness conditions. However, this sequence of period 15 can
+be "cracked" (i.e., a procedure to reproduce `g(x)`) by knowing only 8 terms!
+This is the function of the Berlekamp-Massey algorithm [Mas1969]_, implemented
+in ``berlekamp_massey.py``.
+
+AUTHORS:
+
+- David Joyner (2005-11-24): initial creation.
+
+- Timothy Brock (2005-11): added ``lfsr_sequence`` with code modified from
+  Python Cookbook, http://aspn.activestate.com/ASPN/Python/Cookbook/
+
+- Timothy Brock (2006-04-17): added ``lfsr_autocorrelation`` and
+  ``lfsr_connection_polynomial``.
+"""
+
+###########################################################################
+#  Copyright (C) 2006 Timothy Brock
+#  and William Stein <wstein@gmail.com>
+#
+#  Distributed under the terms of the GNU General Public License (GPL)
+#
+#                  https://www.gnu.org/licenses/
+###########################################################################
+
+import copy
+
+from sage.structure.all import Sequence
+from sage.rings.finite_rings.finite_field_base import FiniteField
+from sage.rings.integer import Integer
+from sage.rings.polynomial.polynomial_ring_constructor import PolynomialRing
+
+
+def lfsr_sequence(key, fill, n):
+    r"""
+    Create an LFSR sequence.
+
+    INPUT:
+
+    - ``key`` -- list of finite field elements, `[c_0, c_1,\dots, c_k]`
+
+    - ``fill`` -- the list of the initial terms of the LFSR sequence, `[x_0,x_1,\dots,x_k]`
+
+    - ``n`` -- number of terms of the sequence that the function returns
+
+    OUTPUT:
+
+    The LFSR sequence defined by `x_{n+1} = c_kx_n+...+c_0x_{n-k}` for `n \geq k`.
+
+    EXAMPLES::
+
+        sage: F = GF(2); l = F(1); o = F(0)
+        sage: F = GF(2); S = LaurentSeriesRing(F,'x'); x = S.gen()
+        sage: fill = [l,l,o,l]; key = [1,o,o,l]; n = 20
+        sage: L = lfsr_sequence(key,fill,20); L
+        [1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 1, 0]
+        sage: from sage.matrix.berlekamp_massey import berlekamp_massey
+        sage: g = berlekamp_massey(L); g
+        x^4 + x^3 + 1
+        sage: (1)/(g.reverse()+O(x^20))
+        1 + x + x^2 + x^3 + x^5 + x^7 + x^8 + x^11 + x^15 + x^16 + x^17 + x^18 + O(x^20)
+        sage: (1+x^2)/(g.reverse()+O(x^20))
+        1 + x + x^4 + x^8 + x^9 + x^10 + x^11 + x^13 + x^15 + x^16 + x^19 + O(x^20)
+        sage: (1+x^2+x^3)/(g.reverse()+O(x^20))
+        1 + x + x^3 + x^5 + x^6 + x^9 + x^13 + x^14 + x^15 + x^16 + x^18 + O(x^20)
+        sage: fill = [l,l,o,l]; key = [l,o,o,o]; n = 20
+        sage: L = lfsr_sequence(key,fill,20); L
+        [1, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 1, 1, 1, 0, 1]
+        sage: g = berlekamp_massey(L); g
+        x^4 + 1
+        sage: (1+x)/(g.reverse()+O(x^20))
+        1 + x + x^4 + x^5 + x^8 + x^9 + x^12 + x^13 + x^16 + x^17 + O(x^20)
+        sage: (1+x+x^3)/(g.reverse()+O(x^20))
+        1 + x + x^3 + x^4 + x^5 + x^7 + x^8 + x^9 + x^11 + x^12 + x^13 + x^15 + x^16 + x^17 + x^19 + O(x^20)
+    """
+    if not isinstance(key, list):
+        raise TypeError("key must be a list")
+    key = Sequence(key)
+    F = key.universe()
+    if not isinstance(F, FiniteField):
+        raise TypeError("universe of sequence must be a finite field")
+
+    s = fill
+    k = len(fill)
+    L = []
+    for i in range(n):
+        s0 = copy.copy(s)
+        L.append(s[0])
+        s = s[1:k]
+        s.append(sum([key[i] * s0[i] for i in range(k)]))
+    return L
+
+
+def lfsr_autocorrelation(L, p, k):
+    """
+    INPUT:
+
+    - ``L`` -- a periodic sequence of elements of ZZ or GF(2); must have length `p`
+
+    - ``p`` -- the period of `L`
+
+    - ``k`` -- integer between `0` and `p`
+
+    OUTPUT: autocorrelation sequence of `L`
+
+    EXAMPLES::
+
+        sage: F = GF(2)
+        sage: o = F(0)
+        sage: l = F(1)
+        sage: key = [l,o,o,l]; fill = [l,l,o,l]; n = 20
+        sage: s = lfsr_sequence(key,fill,n)
+        sage: lfsr_autocorrelation(s,15,7)
+        4/15
+        sage: lfsr_autocorrelation(s,int(15),7)
+        4/15
+    """
+    if not isinstance(L, list):
+        raise TypeError("L (=%s) must be a list" % L)
+    p = Integer(p)
+    _p = int(p)
+    k = int(k)
+    L0 = L[:_p]     # slices makes a copy
+    L0 = L0 + L0[:k]
+    return sum([int(L0[i]) * int(L0[i + k]) / p for i in range(_p)])
+
+
+def lfsr_connection_polynomial(s):
+    """
+    INPUT:
+
+    - ``s`` -- a sequence of elements of a finite field of even length
+
+    OUTPUT:
+
+    - ``C(x)`` -- the connection polynomial of the minimal LFSR
+
+    This implements the algorithm in section 3 of J. L. Massey's article
+    [Mas1969]_.
+
+    EXAMPLES::
+
+        sage: F = GF(2)
+        sage: F
+        Finite Field of size 2
+        sage: o = F(0); l = F(1)
+        sage: key = [l,o,o,l]; fill = [l,l,o,l]; n = 20
+        sage: s = lfsr_sequence(key,fill,n); s
+        [1, 1, 0, 1, 0, 1, 1, 0, 0, 1, 0, 0, 0, 1, 1, 1, 1, 0, 1, 0]
+        sage: lfsr_connection_polynomial(s)
+        x^4 + x + 1
+        sage: from sage.matrix.berlekamp_massey import berlekamp_massey
+        sage: berlekamp_massey(s)
+        x^4 + x^3 + 1
+
+    Notice that ``berlekamp_massey`` returns the reverse of the connection
+    polynomial (and is potentially must faster than this implementation).
+    """
+    # Initialization:
+    FF = s[0].base_ring()
+    R = PolynomialRing(FF, "x")
+    x = R.gen()
+    C = R.one()
+    B = R.one()
+    m = 1
+    b = FF.one()
+    L = 0
+    N = 0
+
+    while N < len(s):
+        if L > 0:
+            r = min(L + 1, C.degree() + 1)
+            d = s[N] + sum([(C.list())[i] * s[N - i] for i in range(1, r)])
+        if L == 0:
+            d = s[N]
+        if d == 0:
+            m += 1
+            N += 1
+        if d > 0:
+            if 2 * L > N:
+                C = C - d*b**(-1)*x**m*B
+                m += 1
+                N += 1
+            else:
+                T = C
+                C = C - d*b**(-1)*x**m*B
+                L = N + 1 - L
+                m = 1
+                b = d
+                B = T
+                N += 1
+    return C