Signature-based Möller's algorithm for strong Gröbner bases over PIDs
aa r X i v : . [ c s . S C ] J a n Signature-based Möller’s algorithmfor strong Gröbner bases over PIDs
Maria Francis
Indian Institute of Technology HyderabadHyderabad, [email protected]
Thibaut Verron
Institute for Algebra / Johannes Kepler UniversityLinz, [email protected]
ABSTRACT
Signature-based algorithms are the latest and most efficient ap-proach as of today to compute Gröbner bases for polynomial sys-tems over fields. Recently, possible extensions of these techniquesto general rings have attracted the attention of several authors.In this paper, we present a signature-based version of Möller’sclassical variant of Buchberger’s algorithm for computing strongGröbner bases over Principal Ideal Domains (or PIDs). It ensuresthat the signatures do not decrease during the algorithm, whichmakes it possible to apply classical signature criteria for furtheroptimization. In particular, with the F5 criterion, the signature ver-sion of Möller’s algorithm computes a Gröbner basis without re-ductions to zero for a polynomial system given by a regular se-quence. We also show how Buchberger’s chain criterion can beimplemented so as to be compatible with the signatures.We prove correctness and termination of the algorithm. Further-more, we have written a toy implementation in Magma, allowingus to quantitatively compare the efficiency of the various criteriafor eliminating S -pairs. KEYWORDS
Algorithms, Gröbner bases, Signature-based algorithms, Polynomi-als over rings, Principal Ideal Domains
ACM Reference Format:
Maria Francis and Thibaut Verron. 2019. Signature-based Möller’s algo-rithm for strong Gröbner bases over PIDs. In
Proceedings of Conference’19,July 2019, Washington, DC, USA (Conference’19).
ACM, New York, NY, USA,9 pages.
Motivation and main results.
Ever since Gröbner bases were in-troduced by Buchberger in 1965 [4], they have become a valuabletool for solving polynomial systems in many different applications,for example in cryptography or in engineering. For many applica-tions, restricting Gröbner basis computations to polynomials overa field is enough. However, some applications require the computa-tion of Gröbner bases over rings. For instance, Gröbner bases over Z can be used in lattice-based cryptography [10], or as a multi-purpose tool in integer linear algebra [15]. This work was started when the first author was supported by the Austrian FWF grantY464. The second author is supported by the Austrian FWF grant F5004.Permission to make digital or hard copies of part or all of this work for personal orclassroom use is granted without fee provided that copies are not made or distributedfor profit or commercial advantage and that copies bear this notice and the full citationon the first page. Copyrights for third-party components of this work must be honored.For all other uses, contact the owner/author(s).
Conference’19, 2018 © Copyright held by the owner/author(s).
In the case of polynomials over a field, many algorithms havebeen developed to make Gröbner basis computations more andmore efficient. The latest generation of Gröbner basis algorithmsfor fields is the class of signature-based algorithms. They introducesignatures, which are defined as the leading terms of a module rep-resentation of polynomials in terms of the generators of the ideal.This notion makes it possible to eliminate redundant computationsand reductions of S -polynomials, by enforcing the key invariantthat signatures always increase during the algorithm . With this in-formation, algorithms are able to use criteria such as the F5 cri-terion [9], which allows to compute a Gröbner basis for an idealgiven by a regular sequence without any reduction to zero.Several algorithms have been developed for Gröbner bases overrings. In [16], Möller sketched an algorithm for computing so-calledweak Gröbner bases over general commutative rings (describedin detail in [1, Sec.4.2]) and presented a specialized version, com-puting strong Gröbner bases over Principal Ideal Domains (PIDs).In this paper, to avoid ambiguity, we call the former algorithm Möller’s weak GB algorithm and the latter
Möller’s strong GB al-gorithm (or
Möller’s algorithm when clear from the context).In this paper, we show how to add signatures to Möller’s strongGB algorithm. We prove that our signature-variant of the algo-rithm is able to compute a strong Gröbner basis of any polynomialideal over a PID, and that the crucial invariant holds: the algorithmnever encounters a signature smaller than that of a previously com-puted polynomial.Möller’s algorithm maintains a weak Gröbner basis G w and astrong Gröbner basis G s . The basis G w is obtained by reducing S -polynomials by elements of the strong basis; the basis G s is ob-tained by computing (but not reducing) G -polynomials (called T -polynomials in [16]) of elements of the weak basis.The signature version of Möller’s algorithm maintains a signa-ture of each element in G w . As for elements of G s , requiring thecomputation of G -polynomials to maintain a matching signatureis too restrictive. However, we prove that maintaining an upperbound on their signature is sufficient to ensure that the signatureof S -polynomials in G w does not drop when reduced by elementsof G s , and that the algorithm as a whole is correct.Additional criteria can be implemented to further eliminate re-dundant S -polynomials, such as Buchberger’s criteria [3]. In par-ticular, we show that Buchberger’s chain criterion can be imple-mented in a similar fashion as Gebauer-Möller’s criteria, with anorder compatible with the selection strategy by smallest signature.The fact that signatures do not drop implies that the algorithm isalso compatible with additional criteria such as the singular crite-rion, the syzygy criterion or the F5 criterion. We prove that thealgorithm is correct and terminates.e have written a toy implementation of Möller’s algorithmwith signatures in the computer algebra system Magma [2], andwe use it to give experimental data on the number of computed andeliminated pairs for some systems. We also discuss some optimiza-tions which can be applied when implementing the algorithm. Related work.
Signature-based algorithms for fields have a longhistory. Early work in this direction was described in [17], wherethe authors use computations in a polynomial module for a similarpurpose, and Algo. F5 [9] showed that module computations canbe avoided by considering only signatures. From there, significantwork has gone into studying signature-based algorithms from atheoretical standpoint and extending them. An excellent survey ofthis is given in [6].Several algorithms have been developed for Gröbner bases overrings. Möller’s work [16], on an algorithm for weak GBs over gen-eral rings and an algorithm for strong GBs over PIDs, was alreadymentioned. It also gives a survey of precursor works regardingGröbner bases over rings. Similar ideas, notably G -polynomials,are present in different variations of Buchberger’s algorithm forPIDs[18] or Euclidean domains [13, 14].Extending signature techniques to rings has been the focus ofrecent research, starting in 2017 with Eder and Popescu [8]. In thatwork, the authors consider a signature-based version of Gröbnerbasis algorithms for Euclidean domains. The authors showed witha counter-example that implementing totally ordered signatures forrings cannot ensure that the crucial invariant holds. However, theiralgorithm can detect signature drops and fall back to existing algo-rithms without signatures. It can nonetheless serve as an efficientpreprocessing step.In [11], we described a way to add signatures to Möller’s weakGB algorithm, and proved that the resulting algorithm is correctand terminates over PIDs. In particular, there is no signature dropin the algorithm, and additional criteria such as the F5 criterioncan be used to eliminate reductions to zero in the case of a regu-lar sequence. The main difference with the approach of [8] is thatsignatures are only partially ordered, and the coefficient parts ofsignatures are never compared.In the present paper, we incorporate the same signature tech-niques into Möller’s strong GB algorithm [16].The main ingredients for the proofs of correctness of the algo-rithm with signatures and criteria are the relation between regularweak S -polynomials and weak signature-Gröbner bases from [11],and the characterization of Gröbner bases in terms of syzygies ofthe leading terms, given by the Lifting Theorem [16, Th. 1], whichwe generalize to a signature setting. Let R be a principal ideal domain (PID), which is assumed to havea unit element and be commutative. We assume that the ring R is effective in the sense that:(1) there are algorithms for all arithmetic operations ( + , ∗ , com-parison to zero and to one) in R ;(2) there is an algorithm which, given a and b ∈ R , computestheir greatest common divisor d and the Bézout coefficients u and v such that au + bv = d ; Available online: https://github.com/ThibautVerron/SignatureMoller (3) there is an algorithm which, given a and b ∈ R , tests whether a divides b and if so, computes the quotient b / a . Remark 2.1.
Effective Euclidean rings (in the sense that there arealgorithms for (1) and an algorithm for Euclidean division), thanksto the extended Euclid algorithm, are effective PIDs.
Let A = R [ x , . . . , x n ] be the polynomial ring in n indetermi-nates x , . . . , x n over R . A monomial in A is x a : = x a . . . x a n n where a = ( a , . . . , a n ) ∈ N n . A term in A is kx a , where k ∈ R \ { } .The set of terms (resp. monomials) of A is denoted by Ter ( A ) (resp.Mon ( A ) ).We use the notation a for ideals in the polynomial algebra A and I for ideals in the coefficient ring R .The notion of monomial order can be directly extended from K [ x , . . . , x n ] to A . In the rest of the paper, we assume that A is en-dowed with an implicit monomial order ă , and we define as usualthe leading monomial LM, the leading term LT and the leading co-efficient LC of a given polynomial.Given a tuple of polynomials ( д , . . . , д s ) and i ∈ { , . . . , s } , wewill frequently denote, for brevity, M ( i ) = LM ( д i ) , C ( i ) = LC ( д i ) and T ( i ) = LT ( д i ) = C ( i ) M ( i ) . Given i , j ∈ { , . . . , s } , we will fre-quently denote M ( i , j ) = lcm ( M ( i ) , M ( j )) , T ( i , j ) = lcm ( T ( i ) , T ( j )) and C ( i , j ) = lcm ( C ( i ) , C ( j )) . We consider the free A -module A m with basis e , . . . , e m . A term(resp. monomial) in A m is kx a e i (resp. x a e i ) for some k ∈ R \ { } , x a ∈ Mon ( A ) , i ∈ { , . . . , m } . The set of terms of A m is denoted byTer ( A m ) . In this paper, terms in A m are ordered using the PositionOver Term (POT) order, defined by kx a e i ă lx b e j ⇐⇒ i (cid:12) j or ( i = j and x a ă x b ) . Given two terms kx a e i and lx b e j in A m , we write kx a e i ≃ lx b e j if they are incomparable, i.e. if a = b and i = j .Given a set of polynomials f , . . . , f m ∈ A , we define an A -module homomorphism ¯ · : A m → A , by setting e i = f i and ex-tending linearly to A m .We recall the concept of signatures in A m . Let p = Í mi = p i e i be a module element. Under the POT ordering, the signature of p is LT ( p i ) e i where i is such that p i + = · · · = p m = p i , kx a e i , where k ∈ R , x a ∈ Mon ( A ) and e i is a standard basis vector.Note that we have two ways of comparing two similar signa-tures s ( α ) = kx a e i and s ( β ) = lx b e j . We write s ( α ) = s ( β ) if k = l , a = b and i = j , and we write s ( α ) ≃ s ( β ) if a = b and i = j , k and l being possibly different. If R is a field, one can assume thatthe coefficient is 1, and so this distinction is not important.Note also that when we order signatures, we only compare thecorresponding module monomials, and disregard the coefficients.This is a different approach from the one used in [8], where bothsignatures and coefficients are ordered. Möller’s algorithm for computing strong Gröbner bases over PIDsuses the classical constructions of S -polynomials and reductions,together with G -polynomials. For each polynomial f , we want tokeep track of a signature s ( f ) , such that s ( f ) = s ( p ) for some p ∈ A m with p = f . For that reason, the algorithm will maintain listsf labelled polynomials, where the label encodes the informationavailable regarding the signature. Definition 3.1.
Let f , . . . , f m ∈ A , a = h f , . . . , f m i , and ( f , l ) ∈ a × Ter ( A m ) . We say that ( f , l ) is: • a S -labelled polynomial , with signature l if l = s ( p ) for some p ∈ A m with p = f ; • a G -labelled polynomial , with G -signature l if l ľ s ( p ) forsome p ∈ A m with p = f .By abuse of notation, we say that f is S -labelled (resp. G -labelled)and we denote s ( f ) : = l (resp. σ ( f ) : = l ). Remark 3.2. S -labelled polynomials are naturally G -labelled. Remark 3.3.
The base polynomials f i are naturally S -labelledwith signature e i . We go through the required constructions, with the signature-related restrictions allowing to maintain the labelling, starting with S -polynomials and reductions: Definition 3.4.
Let G = { д , . . . , д t } ⊂ A be a set of S -labelledpolynomials. For all i ∈ { , . . . , t } , let M ( i ) , T ( i ) and C ( i ) be respec-tively LM ( д i ) , LT ( д i ) and LC ( f i ) . Given i , j ∈ { , . . . , t } , let M ( i , j ) , T ( i , j ) and C ( i , j ) be respectively lcm ( M ( i ) , M ( j )) , lcm ( T ( i ) , T ( j )) and lcm ( C ( i ) , C ( j )) .The S -polynomial of д i and д j is the polynomial S -Pol ( д i , д j ) = T ( i , j ) T ( i ) д i − T ( i , j ) T ( j ) д j . The leading term of its polynomial evaluation is ň M ( i , j ) .The S -pair ( i , j ) is called regular if M ( i , j ) M ( i ) s ( д i ) , M ( i , j ) M ( j ) s ( д j ) and singular otherwise. The S -pair ( i , j ) is called strictly singular if T ( i , j ) T ( i ) s ( д i ) = T ( i , j ) T ( j ) s ( д j ) , and admissible otherwise. Note that reg-ular pairs are admissible.Let ( i , j ) be an admissible S -pair, we extend the S -labelling of G to S -Pol ( д i , д j ) by defining s ( S -Pol ( д i , д j )) = S ( i , j ) , defined as:(1) S ( i , j ) = max (cid:16) T ( i , j ) T ( i ) s ( д i ) , T ( i , j ) T ( j ) s ( д j ) (cid:17) if ( i , j ) is a regular S -pair;(2) S ( i , j ) = (cid:16) C ( i , j ) C ( i ) − C ( i , j ) C ( j ) (cid:17) M ( i , j ) M ( i ) s ( д i ) if ( i , j ) is a singular, nonstrictly singular, S -pair. Remark 3.5. If ( i , j ) is not an admissible S -pair, it is strictly singu-lar, and knowing the signature of д i and д j is not enough to know asignature for S -Pol ( д i , д j ) . All we know is that S ( i , j ) ŋ s ( p ) for some p ∈ A m with p = S -Pol ( д i , д j ) . Such a situation is called a signaturedrop . Definition 3.6.
Let G = { д , . . . , д t } ⊂ A be a set of G -labelledpolynomials, let f ∈ A be a S -labelled polynomial and let д ∈ A . Wesay that f (strongly) s -reduces in one step to f modulo F if thereexists д i ∈ F such that(1) LT ( д i ) divides LT ( f ) , say LT ( f ) = cµ LT ( д i ) with c ∈ R and µ ∈ Mon ( A ) ;(2) д = f − cµд i ;(3) µσ ( д i ) ĺ s ( f ) We say that f (strongly) regular reduces in one step to д modulo F if the signature inequality is strict: x a σ ( д i ) ň s ( f ) .We say that f s -reduces (resp. regular reduces) to д modulo G if д is the result of a sequence of successive s -reductions (resp. regularreductions) in one step from f . If д is the result of regular reducing f modulo G , then we canextend the S -labelling to д by letting s ( д ) = s ( f ) . Using those definitions, we recall the definition of a (strong) sig-nature Gröbner basis.
Definition 3.7.
Let f , . . . , f m ∈ A , and G = д , . . . , д t a setof G -labelled polynomials in h f , . . . , f m i . Let T ∈ Ter ( A m ) , the set G is called a (strong) s -Gröbner basis up to signature T if for all д ∈ h f , . . . , f m i with signature ĺ T , д (strongly) s -reduces to modulo G . It is called a strong s -Gröbner basis if it is a strong s -GB up to signature T for all T ∈ Ter ( A m ) . Next, we recall the definition of GCD-polynomials (or G -polynomialsfor short) and how to equip them with a G -labelling. Definition 3.8.
Let f ∈ A be a G -labelled polynomial, and д ∈ A a S -labelled polynomial, such that LT ( f ) = aµ , LT ( д ) = bν , with a , b ∈ R , µ , ν ∈ Mon ( A ) . Let d = gcd ( a , b ) and u and v be the Bézoutcoefficients such that ua + vb = d . The G -polynomial of f and д isthe module element G -Pol ( f , д ) = u lcm ( µ , ν ) µ f + v lcm ( µ , ν ) ν д . The leading term of its polynomial evaluation is d lcm ( µ , ν ) .We extend the G -labelling by defining the G -signature of G -Pol ( f , д ) to be σ ( G -Pol ( f , д )) : = S G ( f , д ) = max (cid:18) lcm ( µ , ν ) µ σ ( f ) , lcm ( µ , ν ) ν s ( д ) (cid:19) . Since we do not require that the pair be admissible in any sense,this is really only a G -labelling. However, we will prove that this G -labelling for G -polynomials preserves enough information regard-ing the signature of the polynomials participating in the construc-tion (Lem. 5.3), and that it is sufficient to ensure that subsequentreductions preserve the signature, which is a key point in provingthat the algorithm is correct. Möller’s algorithm with signatures is presented in Algo. 1. Itis a straightforward adaptation of Möller’s algorithm, extended tokeep track of the signature of computed polynomials, similar tothe generic algorithm described in [7]. Note that any time the algo-rithm mentions a S -labelled polynomial f (resp. a G -labelled poly-nomial f ), it means a pair ( f , s ( f )) (resp. a pair ( f , σ ( f )) ).Algo. 1 maintains two sets of generators, G w which will be aweak s -Gröbner basis and G s which will be a (strong) s -Gröbnerbasis. The basis G s is the completion of G w , defined as follows. Definition 3.9.
Let F ⊂ A be a non-empty finite set of G -labelledpolynomials, the completion C ( F ) of F is the set of G -labelled poly-nomials defined recursively as: • C ( f ) = { f } ; • C ( f , . . . , f r ) = { G -Pol ( д , f r ) : д ∈ C ( f , . . . , f r − )} . It is known that over a PID, the completion of a weak Gröbnerbasis is a strong Gröbner basis [16, Cor. after Th. 4], we will provein Cor. 5.5 that it also holds for s -Gröbner bases. In the literature, it is sometimes only required that all elements with signature ň T s -reduce to . In the literature, G -polynomials are sometimes called T -polynomials [16]. lgorithm 1 Möller’s algorithm with signatures
Input { f , . . . , f m } ⊂ A = R [ x , . . . , x n ] , R a PID Output G s a set of G -labelled polynomials in A , which is a(strong) s -Gröbner basis of h f , . . . , f m i Local variables • G w = { д , . . . , д r } a set of S -labelled polynomials in A , whichis a weak Gröbner basis of h f , . . . , f m i• P ⊂ N a set of admissible S -pairs G s , G w , P ← ∅ for i ∈ { , . . . , m } do Update ( G w , G s , P , f i , e i ) while P , ∅ do Pick and remove ( i , j ) from P with minimal S ( i , j ) д ← SPol ( д i , д j ) Update ( G w , G s , P , д , S ( i , j )) end whileend for Return G s Algorithm 2
Procedure
Update : update the weak and the strongGröbner bases, and the list of pairs, eliminating pairs with Buch-berger’s chain criterion and signature restrictions
Input G w ⊂ A set of S -labelled polynomials, G s ⊂ A set of G -labelled polynomials, P ⊂ N , f ∈ A , s ( f ) ∈ Ter ( A m ) д ← RegularReduce ( f , s ( f ) , G s ) if д , then r ← G w + д r ← д // Index of the new element G w ← G w ∪ {( д r , s ( f ))} G s ← G s ∪ {( д r , s ( f ))} for all h ∈ G s do G s ← G s ∪ ( G -Pol ( h , д r ) , S G ( h , д r )) end forfor all i ∈ { , . . . , r − } such that ( i , r ) is an admissible S -pair and ∀ k ∈ { , . . . , r − } , Chain ( i , r ; k ) does not hold, do Add ( i , r ) to P end forfor all ( i , j ) ∈ P such that Chain ( i , j ; r ) holds do Remove ( i , j ) from P end forend if Most of the book-keeping work, maintaining the bases and thelist of pairs to consider together with signature information, is del-egated to the subroutine
Update (Algo. 2). The most important fea-ture of this subroutine is that it implements the following restric-tions, which ensure that we can maintain a S -labelling in G w :(1) all reductions have to be regular (that is, the signatures ofreducers have to be strictly less than the signature of thereducee);(2) all S -pairs have to be admissible (that is, the signatures mustnot be an exact match);(3) no restriction on G -pairs.We shall prove in Sec. 5 that with those restrictions, the algorithmis correct and terminates. The routine RegularReduce implements regular strong reduc-tion modulo the already computed basis, due to space constraintsit is not presented in details.Additionally, Buchberger introduced two criteria to make the al-gorithm more efficient by eliminating S -polynomials: the coprimecriterion [5, Sec. 2.10, Prop. 1] and the chain criterion [5, Sec. 2.10,Prop. 8] . Implementing the coprime criterion is straightforwardand not detailed here. In order to implement the chain criterion,we use ideas similar to Gebauer and Möller’s implementation [12],adapted to our selection order by smallest signatures first. Definition 3.10.
Let { д , . . . , д t } ⊂ A be a set of S -labelled poly-nomials. Let ( i , j , k ) ∈ { , . . . , t } , we say that Chain ( i , j ; k ) holds if T ( k ) | T ( i , j ) and S ( i , j ) ľ T ( i , j ) T ( k ) s ( д k ) . The consequence of that criterion is that S -pairs ( i , j ) such that Chain ( i , j , r ) holds for some r can be removed from consideration.The criterion is also implemented as part of the Update subrou-tine (Algo. 2).Similar to what was done with the signature-version of Möller’sweak GB algorithm [11], further criteria can be added to the algo-rithm to make the computations more efficient: polynomials whichhave been regular reduced by are 1-singular reducible can be elim-inated, and the Syzygy, the F5 and the Singular criteria can elim-inate redundant polynomials before any reduction. In particular,the F5 criterion ensures that the algorithm does not perform anyreduction to 0 for polynomial systems given as a regular sequence.Due to space constraints, we refer to [11] for details.
The rest of the paper will be devoted to proving that Algo. 1 is cor-rect and terminates. In this section, we recall necessary definitionsfor the proofs in Sec. 5.
The main ingredient of the proof will be the fact that Möller’s al-gorithm with signatures ensures that G w is a weak Gröbner basis.In this section, we briefly recall relevant definitions and results. Definition 4.1.
Let f , д , . . . , д s , h ∈ A . We say that f weakly(top) reduces in one step to h modulo д , . . . , д s if there exists J ⊂{ , . . . , s } such that • for all i ∈ J , there exists x a i ∈ Mon ( A ) such that x a i LM ( д i ) = LM ( f )• there exists c i ∈ A , i ∈ J such that Í i ∈ J c i LC ( д i ) = LC ( f )• h = f − Í i ∈ J c i x a i д i .In particular, LT ( h ) ň LT ( f ) .If f is S -labelled and д , . . . , д s are G -labelled, we call the one-stepreduction a • weak s -reduction if for all i ∈ J , x a i σ ( д i ) ĺ s ( f ) , and a • regular weak s -reduction if for all i ∈ J , x a i σ ( д i ) ň s ( f ) .As in the case of strong reductions, the terminology extends to se-quences of reductions in one step. Weak Gröbner bases (resp. weak s -Gröbner bases) are definedas strong Gröbner bases (resp. strong s -Gröbner bases), replacingstrong reductions (resp. strong s -reductions) with weak ones. In older editions of that book, those criteria can be found in Sec. 2.9, Prop. 4 andProp. 10 respectively. eak Gröbner bases can be computed with Möller’s weak GBalgorithm [1, Algo. 4.2.1]. A signature version of this algorithm,for PIDs, was presented in [11]. This algorithm is similar to Buch-berger’s algorithm, but it replaces strong reductions with weak re-ductions and strong S -polynomials with weak S -polynomials, de-fined as follows in the context of PIDs. Definition 4.2.
Let д , . . . , д t ∈ A be S -labelled polynomials.Let J be a subset of { , . . . , t } , define M ( J ) = lcm ({ M ( j ) : j ∈ J }) .Let s ∈ J and J ∗ = J \ { s } . We say that J is regular saturated , with signature index s , if J ∗ = (cid:26) j ∈ { , . . . , t } : M ( j ) | M ( J ) and M ( J ) M ( s ) s ( д s ) (cid:27) . Let c ∈ R be such that h c i = h C ( j ) : j ∈ J ∗ i : h C ( s )i . Then thereexists ( b j ) j ∈ J ∗ such that cC ( s ) = Í j ∈ J ∗ b j C ( j ) and the regular weak S -polynomial associated to J and ( b j ) is c M ( J ) M ( s ) д s − Õ j ∈ J ∗ b i M ( J ) M ( s ) . This weak S -polynomial can be S -labelled with signature S ( J ) = c M ( J ) M ( s ) s ( д s ) . A crucial tool for the proofs will be the syzygy characterizationof Gröbner bases, using the syzygy lifting theorem of Möller [16].This characterization gives a framework for proving that criteriaeliminating S -pairs do not break the correctness or termination ofthe algorithm. The central notion is that of term-syzygies, of whichwe recall the definition. Definition 4.3.
Let G = ( д , . . . , д t ) be a tuple of nonzero S -labelled polynomials in A . We consider the free module A t with basis ϵ , . . . , ϵ t . For any element Σ = Í ti = s i ϵ i ∈ A t , we define Σ = Í ti = s i д i . We say that Σ is a term-syzygy of G if LT ( Σ ) ň max { LT ( s i ) T ( i ) : i ∈ { , . . . , t }} . The polynomial Σ is called the syzygy polynomial of Σ .The set of all term-syzygies of G is denoted by TSyz ( G ) , it is asubmodule of A t called the syzygy module of LT ( G ) .If there exists a monomial µ s.t. for all i ∈ { , . . . , t } , LM ( s i д i ) = µ or , the term-syzygy Σ is called homogeneous with term degree µ .The signature of Σ is s ( Σ ) = max i { s i s ( д i )} .A tuple ( Σ , . . . , Σ s ) of TSyz ( G ) is called a S -basis of TSyz ( G ) iffor all Σ ∈ TSyz ( G ) , there exists p , . . . , p s ∈ A such that • Σ = Í si = p i Σ i • s ( Σ ) ľ max i { LM ( p i ) s ( Σ i )} . Definition 4.4.
A strong (resp. weak) S -polynomial is the syzygypolynomial Σ for some homogeneous term-syzygy Σ ∈ Syz ( F ) . Wecall those syzygies strong (resp. weak) S -pol. syzygies.Strong S -pol. syzygies are homogeneous term-syzygies with ex-actly two non-zero coefficients, and are sometimes called principal term-syzygies in the literature. The characterization of Gröbner bases using term-syzygies isgiven in Möller’s lifting theorem [16, Th. 4], of which we give asignature version here. In the literature, term-syzygies are sometimes simply called syzygies, and syzygypolynomials, S -polynomials. Theorem 4.5.
Let a = h f , . . . , f m i be an ideal in A and G = ( д , . . . , д t ) be a tuple of nonzero S -labelled polynomials in a suchthat for all i ∈ { , . . . , m } , f i s -reduces to modulo G . Let T ∈ Ter ( A m ) , and let TSyz T ( G ) be the module of term-syzygies generatedby term-syzygies with signature at most T .Let Σ , . . . , Σ s ∈ TSyz ( G ) be a homogeneous S -basis of TSyz T ( G ) ,where Σ i = Í tj = σ ij ϵ j , and define for i ∈ { , . . . , s } the syzygypolynomial Σ i = Í tj = σ ij д j .Then G is a strong s -Gröbner basis of a up to signature T if andonly if for all i ∈ { , . . . , s } , Σ i strongly s -reduces to modulo G . Proof.
The proof is similar to that of [16, Th. 1 and Th. 4]:indeed, if f ∈ a has signature T ∈ Ter ( A m ) , f has a represen-tation Í mi = q i f i with max i LT ( q i ) e i ĺ T . Since all f i ’s s -reduceto 0 modulo G , f also has a representation Í tj = h j д j such thatmax i LT ( h i ) s ( д i ) ĺ T .Following the proof of [16, Th. 1] allows to use term-syzygieswith signature ĺ T to rewrite this representation into a Gröbnerrepresentation, that can be decomposed into a sequence of reduc-tions.Conversely, if all f ∈ a s -reduce to 0, in particular it is true forthe syzygy polynomials of term-syzygies of G . (cid:3) In this subsection, we prove useful lemmas, related to the behav-ior of signatures throughout the algorithm, and generalizing withsignatures the correspondence between weak and strong construc-tions (reductions and S -polynomials) described in [16]. Lemma 5.1.
Let { д , . . . , д r } be the value of G w at any point inthe course of Algo. 1. Then s ( д ) ĺ s ( д ) ĺ · · · ĺ s ( д r ) . Proof.
The proof is similar to that of [11, Lem. 5.2]. Assumethat there exists i such that s ( д i ) ą s ( д i + ) and that i is the small-est index with this property. Let ( j i , k i ) (resp. ( j i + , k i + ) ) be theadmissible pair used to compute д i (resp. д i + ).If i is not one of j i + , k i + , then ( j i + , k i + ) was already in thequeue P when ( j i , k i ) was selected, and so, by the selection crite-rion in the algorithm, S ( j i , k i ) ă S ( j i + , k i + ) .If i is either j i + or k i + , wlog we can assume that i = j i + . Then S ( j i + , k i + ) ≃ max (cid:18) T ( i , k i + ) LT ( д i ) s ( д i ) , T ( i , k i + ) LT ( д k i + ) s ( д k i + ) (cid:19) ľ T ( i , k i + ) LT ( д i ) s ( д i ) ľ s ( д i ) . (cid:3) It allows us to prove that the signatures of elements in G s arealso non-decreasing. Lemma 5.2.
Let { д , . . . , д r − } be the value of G w at any point inthe course of Algo. 1, and let д r be the next computed element in thebasis. Then all elements added to G s have G -signature ľ s ( д r ) .More generally, all elements added to G s in later steps have G -signature ľ s ( д r ) . Proof.
The elements added to G s in the call to Update with д r as new element, are д r (with signature s ( д r ) ) and all G -polynomials G -Pol ( h , д r ) for h already in G s (with G -signature S G ( σ ( h ) , s ( д r )) ).Those G -labelled polynomials all have G -signature ľ s ( д r ) .he generalized statement follows from the fact that s ( д s ) ľ s ( д r ) for s > r (Lem. 5.1). (cid:3) The next lemma is a more precise description of elements of G s . Lemma 5.3.
Let G w = { д , . . . , д r } be a set of S -labelled polyno-mials, and G s be its ( G -labelled) completion. Let h ∈ G s , then thereexists i , . . . , i k ∈ { , . . . , r } such that h = G -Pol ( G -Pol (· · · G -Pol ( д i , д i ) , . . . , д i k − ) , д i k ) . Furthermore, there exists c j ∈ R , m j ∈ Mon ( A ) , j ∈ { , . . . , k } suchthat LT ( h ) = Í kj = c j m j T ( i j ) and σ ( h ) ≃ max ( m j s ( д i j )) . Proof.
The existence of i , . . . , i k and the decomposition of h and LT ( h ) are clear by definition of the completion.For the inequality regarding the signature, we proceed by induc-tion on k , where the base case k = k >
1, and let h k − be the result of the innermost k − G -polynomials in the expansion of h . So h = G -Pol ( h k − , д i k ) and h k − expands as k − G -polynomials of д i , . . . , д i k − ,with m ′ j M ( i j ) = LM ( h k − ) for all j ∈ { , . . . , k − } . Note that forall j ∈ { , . . . , k − } , µm ′ j = m j .There exists µ ∈ Mon ( A ) such that LM ( h ) = µ LM ( h k − ) = m k M ( i k ) , and σ ( h ) ≃ max ( µσ ( h k − ) , m k s ( д i k )) by def. of the G -signature ≃ max (cid:18) µ max j ≤ k − ( m ′ j s ( д i j )) , m k s ( д i k ) (cid:19) by induction hyp. ≃ max j ≤ k ( m j s ( д i j )) . (cid:3) The last results of this section generalize the correspondencebetween weak and strong Gröbner bases [16], adding some controlover the signatures. First, we generalize the equivalence betweenweak reduction and strong reduction through completion of thereducers [16, Prop. 2].
Lemma 5.4.
Let G w = { д , . . . , д r } be a weak s -GB up to signa-ture T , and G s be its completion. Let f be a S -labelled polynomialwith signature s ( f ) ă T , then the following properties are equiva-lent:(1) f is weakly s -reducible (resp. weakly regular s -reducible) mod. G w ;(2) f is strongly s -reducible (resp. strongly regular s -reducible)mod. G s . Proof.
For ( ) ⇒ ( ) , we proceed by induction on r . The case r = G w and G s contain only the ele-ment д .For the general case, let f be a S -labelled polynomial with signa-ture s ( f ) ă T and weakly s -reducible modulo G w . Let H w = { д j : j ∈ J ⊆ { , . . . , r }} ⊆ G w be a set of weak s -reducers of f , andconsider its completion H s = C ( H w ) ⊆ G s . By [16, Prop. 2], f isstrongly reducible modulo H s . Let h ∈ H s be a strong reducer of f .In particular, there exists µ ∈ Mon ( A ) such that µ LM ( h ) = LM ( f ) .In order to prove that h is a strong s -reducer of f , we need to provethat µσ ( h ) ĺ s ( f ) .By Lem. 5.3, h expands as iterated G -polynomials of elements h , . . . , h k of H w such that for all j ∈ { , . . . , k } , there exists m j ∈ Mon ( A ) such that m j LM ( h j ) = LM ( h ) and σ ( h ) = max ( m j s ( h j )) . Let j ∈ { , . . . , k } . Since h j ∈ H w , it is a weak s -reducer of f , sothere exists µ j such that µ j LM ( h j ) = LM ( f ) , and µ j s ( h j ) ĺ s ( f ) .Note that µ j = m j µ . So µσ ( h ) ≃ µ max ( m j s ( h j )) ≃ max ( µ j s ( h j )) ĺ s ( f ) . The fact that ( ) ⇒ ( ) is an immediate consequence of Lem. 5.3:if h ∈ G s is a strong s -reducer of f , then it expands as iterated G -polynomials of elements д i , . . . , д i k ∈ G w which are weak s -reducers of f .The statements with regular s -reductions are proved similarly,replacing ĺ with ň throughout. (cid:3) As a consequence, like in [16], the completion of a weak s -GBis a strong s -GB. Corollary 5.5.
Let G w = { д , . . . , д r } be a set of S -labelled poly-nomials, and G s its ( G -labelled) completion. Let T ∈ Ter ( A m ) . Then • G w is a weak s -GB up to signature T iff G s is a strong s -GBup to signature T ; • G w is a weak s -GB iff G s is a strong s -GB. The last lemmas of this section generalizes the expression ofa weak S -polynomial in terms of strong S -polynomials, with con-trol over the signatures. First, we take care of weak S -polynomials,without any regularity assumption. Lemma 5.6.
Let ( д , . . . , д r ) be a tuple of S -labelled polynomials.Let J ⊂ { , . . . , r } , and let p ⊂ A r (with basis ( ϵ j ) ) be a homogeneousterm syzygy associated to a weak S -pol. with support J . Then thereexists coefficients a i , j ∈ R , and monomials m i , j , i < j ∈ J , such that p = Õ i , j ∈ J a i , j m i , j S -Pol ( ϵ i , ϵ j ) . In this decomposition:(1) for all i , j ∈ J , m i , j M ( i , j ) = M ( J ) (2) for all i , j ∈ J , m i , j S ( i , j ) ĺ max ( M ( J ) M ( i ) s ( д i )) . Proof.
The existence of a i , j and m i , j , i < j ∈ J , is given by [16,Th. 2 and Prop. 1], and it follows from that proof that m i , j M ( i , j ) = M ( J ) . So for all i , j ∈ J , m i , j S ( i , j ) = M ( J ) M ( i , j ) S ( i , j ) ĺ M ( J ) M ( i , j ) M ( i , j ) M ( i ) s ( f i ) ≃ M ( J ) M ( i ) s ( f i ) , and similarly for j . (cid:3) Lemma 5.7.
Let ( д , . . . , д r ) be a tuple of S -labelled polynomials.Let J ⊂ { , . . . , r } be a regular subset, with signature index s , and let J ∗ = J \ { s } . Let p ⊂ A r be a homogeneous term syzygy associatedto a regular weak S -polynomial. With the notations of 5.6, denote a i : = a i , s if i < s and a s , i otherwise, and define similarly m i , j , so thatwe have the decomposition p = Õ i ∈ J ∗ a i m i S -Pol ( ϵ i , ϵ s ) + Õ i , j ∈ J ∗ a i , j m i , j S -Pol ( ϵ i , ϵ j ) In this decomposition:(1) Í i ∈ J ∗ a i C ( i , s ) = C ( J ) (2) ∀ i ∈ J ∗ , the S -pair ( i , s ) is regular and m i S ( i , s ) ≃ S ( J ) (3) Í i ∈ J ∗ a i m i S ( i , s ) = S ( J ) = s ( p ) (4) ∀ i , j ∈ J ∗ , m i , j S ( i , j ) ň S ( J ) roof. In the proof of [16, Prop. 1] a i and m i , for i ∈ J ∗ , aredefined as follows. Let c be the generator of h C ( i ) : i ∈ J ∗ i : h C ( s )i ,and for i ∈ J ∗ , let d i = C ( i , s ) C ( s ) . Then there exists ( a i ) i ∈ J ∗ , such that c = Í i ∈ J ∗ a i d i . In particular, C ( J ) = Í i ∈ J ∗ a i C ( i , s ) . For i ∈ J ∗ ,define m i = M ( J ) M ( i , s ) . With those a i and m i , property 1 is satisfied.Since the set J is regular with signature index s , by definition, S ( J ) ≃ M ( J ) M ( s ) s ( f s ) , and for all i ∈ J ∗ , M ( J ) M ( s ) s ( f s ) ŋ M ( J ) M ( s ) s ( f i ) . So forall i ∈ J ∗ , M ( i , s ) M ( s ) s ( f s ) ŋ M ( i , s ) M ( s ) s ( f i ) , so the S -pair ( i , s ) is regularand S ( J ) ≃ M ( J ) M ( i , s ) S ( i , s ) = m i S ( i , s ) . This proves property 2.By definition, S ( J ) = C ( J ) C ( s ) M ( J ) M ( s ) s ( f s ) and for all i ∈ J ∗ , S ( i , s ) = C ( i , s ) C ( s ) M ( J ) M ( s ) s ( f s ) . So, expanding C ( J ) = Í i ∈ J ∗ a i C ( i , s ) again, property 3 is satisfied.Now consider q = Í i , j ∈ J ∗ a i , j m i , j S -Pol ( ϵ i , ϵ j ) . It correspondsto a homogeneous term syzygy, with term degree ≃ M ( J ) . Wehave seen above that for all i ∈ J ∗ , M ( J ) M ( s ) s ( f s ) ŋ M ( J ) M ( s ) s ( f i ) . FromLem. 5.6, for all i , j ∈ J ∗ , m i , j S ( i , j ) ĺ max ( M ( J ) M ( s ) s ( f i )) ň S ( J ) . (cid:3) Remark 5.8.
Property (4) actually gives another proof of prop-erty (3), by proving that q has signature ň s ( p ) . Writing q = p − Í i ∈ J ∗ a i m i S -Pol ( ϵ i , ϵ s ) , it means that the signature of the two termsof the difference have to cancel out. The proof of correctness makes use of the following result for weaksignature Gröbner bases, proved in [11].
Proposition 5.9 ([11, Th. 5.5]).
Let G w = { д , . . . , д r } be a setof S -labelled polynomials. Let T ∈ Ter ( A m ) . Assume that all regularweak S -polynomials with signature ĺ T s -reduce to modulo G w .Then G w is a weak signature Gröbner basis up to signature T . Corollary 5.10.
Let G = { д , . . . , д t } be a set of S -labelled poly-nomials, T ∈ Ter ( A m ) , S ă T ( G ) = { homo. term-syz. of G with sig. ň T } and S T ( G ) = S ă T ( G ) ∪ { regular weak S -pol. syz. of G with sig. ≃ T } . Then S T ( G ) is a S -basis of TSyz T ( G ) . Proof.
The notion of S -basis of term-syzygies only depends onthe leading terms and labels of the family G . Extend the polynomialalgebra A = R [ x , . . . , x n ] into A ext = R [ x , . . . , x n , y , . . . , y t ] ,with a block order ordering the x i ’s first according to the monomialorder on A . Consider the set G ext = { д i − y i } ⊂ A ext , where д i − y i is given the signature s ( д i ) . S -bases of syzygies of TSyz T ( G ext ) andTSyz T ( G ) are in natural one-to-one correspondence.Let Σ ∈ TSyz T . If S ( Σ ) ň T there is nothing to prove, so assumethat S ( Σ ) ≃ T . Write Σ = Í ti = σ i ϵ i , ¯ Σ = Í ti = σ i д i and Σ ( y ) = Í ti = σ i y i , in particular the syzygy polynomial associated to Σ in A ext is ¯ Σ − Σ ( y ) .Let S , . . . , S k be the regular weak S -pol. syzygies of G ext withsignature ≃ T . Regular reducing them, in A t ext , yields module ele-ments of the form S ′ i = S i − Í (elements with sig. ň T ). Note thatsince we are only performing regular reductions and the signatureof S i is not divisible by any y j , those module elements remain linear in y . By Prop. 5.9, adding to G all the S ′ i ensures that all polynomi-als with signature at most T s -reduce to 0, in particular, the syzygypolynomial of Σ (in A ext ) s -reduces to 0. In other words, there exist τ , . . . , τ k ∈ Ter ( A ) such that¯ Σ − Σ ( y ) = k Õ i = τ i (cid:16) ¯ S ′ i − S ′ i ( y ) (cid:17) in A ext and, again since the reduction cannot increase the signature, theequality also holds in A : ¯ Σ = Í ki = τ i ¯ S i in A . So in the end, we getthat Σ ( y ) = k Õ i = S ′ i ( y ) = k Õ i = S i ( y ) + Õ (elements with sig. ň T ) , and substituting back y i ← ϵ i gives a representation of Σ as alinear combination of elements of S T , where all summands havesignature at most T = S ( Σ ) . (cid:3) Theorem 5.11 (Correctness and termination of Algo. 1).
Given f , . . . , f m ∈ A , Algo. 1 terminates and returns a strong s -Gröbner basis of a = h f , . . . , f m i . Proof.
The proof of termination is a transposition of that of [11,Th. 5.6] (which follows the proof of termination in [19]), to provethat G w , and thus G s , cannot grow infinitely large.As for correctness, let G w and G s be as computed by Algo. 1.Assume that G s is not a strong s -GB of a , then there exists u ∈ Ter ( A m ) such that G s is not a s -GB up to signature u . Assume that u is minimal for this property, in particular, for all T ň u , G s is astrong s -GB up to signature T .Equivalently, from Cor. 5.5, G w is a weak s -GB up to signature T but not a weak s -GB up to signature u . By Cor. 5.10, S u ( G w ) isa S -basis of the module TSyz u ( G w ) . Let S ă = S ă u ( G w ) . Then byLem. 5.7, the set S ă ∪ { regular strong S -pol. sygygies of G w with sig. ≃ u } is a S -basis of the module TSyz u ( G w ) .Let Σ ( i , j ) be a strong S -pol. syzygy associated with an S -pair ( i , j ) such that Criterion Chain ( i , j ; k ) holds for some k ∈ N . Thenas in the classical case [5, Sec. 2.10, Prop. 8], Σ ( i , j ) can be rewrittenas Σ ( i , j ) = T ( i , j ) T ( i , k ) Σ ( i , k ) − T ( i , j ) T ( j , k ) Σ ( j , k ) . The signature condition in
Chain implies that this rewriting doesnot make the signature increase. So Σ ( i , j ) can be removed fromthe S -basis of term-syzygies.Iterating the process, we get that the set S ă ∪{ regular S -pairs of G w with sig. ≃ u not excluded by Chain } is a S -basis of the module TSyz u ( G w ) .The algorithm ensures that all regular strong S -polynomials ob-tained from a S -pair not excluded by Chain strongly s -reduce to 0modulo G s . Furthermore, by minimality of u , for all syzygies Σ in S ă , the syzygy-polynomial ¯ Σ strongly s -reduces to zero modulo G s . So all syzygy-polynomials associated with all term-syzygiesin our basis strongly s -reduce to 0 modulo G s , and by the liftingtheorem 4.5, G s is a strong s -Gröbner basis up to signature u . (cid:3) ystem Pairs S -pols Coprime Chain F5 Singular 1-Singular Red. to 0Katsura-3 504 178 157 153 115 1 6 0Katsura-4 1660 603 509 517 388 9 84 0Generic (3;2;10) 383 192 73 99 117 1 19 0Generic (3;3;5) 2211 1161 155 911 842 0 78 0 Table 1: Experimental data on Möller’s algorithm with signatures.
We have written a toy implementation in Magma [2] of the algo-rithm, with the F5, Singular and 1-singular criteria. We give exper-imental data related to the computation of Gröbner bases for var-ious polynomial systems over Z : Katsura- n systems, and randomsystems with fixed degree and size of the coefficients. The data isgiven in Table 1 (“Generic ( n ; d ; s ) ” is a random system of n poly-nomials in n variables with degree d and coefficients in [− s ; s ] ).For each system, we give the number of considered S -pairs andreduced S -polynomials, as well as how many polynomials wereexcluded by the Coprime or Chain criterion (before being consid-ered as a S -pair), by the F5 or Singular criterion (counted in S -pairs,not in S -polynomials), or because they are 1-singular reducible (af-ter regular reducing). We also give the number of reductions to0 appearing in the algorithm, which is 0 as expected for regularsequences.Möller’s weak GB algorithm involved a combinatorial bottle-neck with cost exponential in the size of the current basis, makingit impractical as soon as the basis exceeds 30 elements. Möller’sstrong GB algorithm for PIDs replaces it with the computations of S -pairs, with quadratic cost. As a result, the algorithm is faster, butnonetheless becomes slow as the basis grows. As is frequently thecase with Gröbner basis algorithms, the main bottleneck appearsto be the reduction step.We implemented two additional optimizations, for Z , in order toreduce the size of the basis. The first one is a heuristic at the selec-tion step in the algorithm: when we pick a pair ( i , j ) with minimalsignature S ( i , j ) , we typically have a choice between many suchpairs. Selecting the one with the smallest coefficient part (in abso-lute value) appears to help eliminating subsequent S -polynomialsfaster, and makes the algorithm significantly faster: for instance,the Katsura-4 example was impractical before this change, and ter-minates in less than 30s after.The second optimization relies on the following idea: for a given i ∈ { , . . . , m } , when we enter the “for” loop at index i , we knowthat all subsequent polynomials will have a signature of the form • e k with k ≥ i , and all preceding polynomials have a signature ofthe form • e k with k < i . In particular, we do not need to considerthe individual signatures of already computed elements, beyondthe information that this signature is ň e i .As such, we may inter-reduce the strong basis G s and replaceboth G w and G s with the result, all elements being given signature e . For this inter-reduction step, at least in the case of Z , we coulduse Magma’s highly optimized routines.The consequence is that after each pass through the “for” loop,the weak and strong bases are made shorter, which slows downthe growth of the list of pairs in the remainder of the algorithm.One difficulty arising when computing signature Gröbner basesover rings is that the Singular criterion requires the signature tomatch exactly, including their coefficient. This leads to the compu-tation of many polynomials having similar signatures and leading Available online: https://github.com/ThibautVerron/SignatureMoller monomials. The heuristic presented above helps mitigate the issue,but it will be the object of future work to examine whether the Sin-gular criterion can be extended to eliminate more elements, in thecase of principal rings.For computations over Z or K [ X ] , it would also be interestingto use the additional structure of an euclidean ring to make thecomputations faster. It will be the focus of future research to inves-tigate whether leading coefficient reductions [13, 14] can be addedto the algorithm without breaking signature invariants. Acknowledgements
The authors thank C. Eder for helpful sug-gestions, M. Ceria and T. Mora for a fruitful discussion on thesyzygy paradigm for Gröbner basis algorithms, and M. Kauers forhis valuable insights and comments all through the elaboration ofthis work.
REFERENCES [1] W. Adams and P. Loustaunau.
An Introduction to Gröbner Bases . AmericanMathematical Society, 7 1994.[2] W. Bosma, J. Cannon, and C. Playoust. The Magma algebra system. I. The userlanguage.
J. Symbolic Comput. , 24(3-4):235–265, 1997. Computational algebraand number theory (London, 1993).[3] B. Buchberger. A criterion for detecting unnecessary reductions in the construc-tion of Gröbner-bases. In
Symbolic and algebraic computation (EUROSAM ’79,Internat. Sympos., Marseille, 1979) , volume 72 of
Lecture Notes in Comput. Sci. ,pages 3–21. Springer, Berlin-New York, 1979.[4] B. Buchberger. Bruno Buchberger’s PhD thesis 1965: An algorithm for findingthe basis elements of the residue class ring of a zero dimensional polynomialideal.
Journal of Symbolic Computation , 41:475–511, 2006.[5] David A. Cox, John Little, and Donal O’Shea.
Ideals, varieties, and algorithms .Undergraduate Texts in Mathematics. Springer, Cham, fourth edition, 2015. Anintroduction to computational algebraic geometry and commutative algebra.[6] C. Eder and Jean-Charles Faugère. A Survey on Signature-based Algorithms forComputing Gröbner Bases.
Journal of Symbolic Computation , 80:719–784, 2017.[7] C. Eder and J.E. Perry. Signature-based Algorithms to Compute Gröbner Bases.In
Proceedings of the 36th international symposium on Symbolic and algebraiccomputation , pages 99–106. ACM, 2011.[8] C. Eder, G. Pfister, and A. Popescu. On Signature-Based Gröbner Bases overEuclidean Rings. In
Proceedings of the 2017 ACM on International Symposium onSymbolic and Algebraic Computation , ISSAC ’17, pages 141–148, New York, NY,USA, 2017. ACM.[9] Jean Charles Faugère. A New Efficient Algorithm for Computing GrÖbner Baseswithout Reduction to Zero (F5). In
Proceedings of the 2002 International Sympo-sium on Symbolic and Algebraic Computation , ISSAC ’02, pages 75–83, New York,NY, USA, 2002. ACM.[10] M. Francis and A. Dukkipati. On Ideal Lattices, Gröbner Bases and GeneralizedHash Functions.
Journal of Algebra and Its Applications , 2017.[11] Maria Francis and Thibaut Verron. Signature-based Criteria for Möller’s Al-gorithm for Computing Gröbner Bases over Principal Ideal Domains. preprint ,abs/1802.01388, 2018.[12] R. Gebauer and H. M. Möller. On an Installation of Buchberger’s Algorithm.
Journal of Symbolic Computation , 6(2-3):275–286, 1988.[13] A. Kandri-Rody and D. Kapur. Computing a Gröbner Basis of a Polynomial Idealover a Euclidean Domain.
J. Symbolic Comput. , 6(1):37–57, 1988.[14] D. Lichtblau. Effective Computation of Strong Gröbner Bases over EuclideanDomains.
Illinois J. Math. , 56(1):177–194 (2013), 2012.[15] D. Lichtblau. Applications of Strong Gröbner Bases over Euclidean Domains.
Int. J. Algebra , 7(5-8):369–390, 2013.[16] H. M. Möller. On the Construction of Gröbner Bases using Syzygies.
Journal ofSymbolic Computation , 6(2-3):345–359, 1988.[17] H. M. Möller, T. Mora, and C. Traverso. Gröbner bases computation using syzy-gies. In
Papers from the International Symposium on Symbolic and Algebraic Com-putation , ISSAC ’92, pages 320–328, New York, NY, USA, 1992. ACM.[18] Luquan Pan. On the D-bases of polynomial ideals over principal ideal domains.
J. Symbolic Comput. , 7(1):55–69, 1989.19] B. H. Roune and M. Stillman. Practical Gröbner Basis Computation. In