\documentclass[11pt]{madras}%
\usepackage{longtable}%
\usepackage{nomencl}%
\usepackage{makeidx}%
\usepackage{algorithm2e}%
\usepackage{amssymb}%
\usepackage{amsthm}%
\usepackage{amsmath}%
\usepackage[all]{xy}%
\newtheorem{theorem}{Theorem}[chapter]
\newtheorem{lemma}[theorem]{Lemma}
\newtheorem{corollary}[theorem]{Corollary}
\newtheorem{proposition}[theorem]{Proposition}
\newtheorem{definition}[theorem]{Definition}

\theoremstyle{remark}
\newtheorem{remark}[theorem]{Remark}

\newcommand{\Aut}[1]{{\ensuremath{\mathrm{Aut}\left(#1\right)}}}
\newcommand{\Norm}[1]{{\ensuremath{\mathrm{N}\left(#1\right)}}}
\newcommand{\Gal}[1]{{\ensuremath{\mathrm{Gal}\left(#1\right)}}}
\newcommand{\Sym}[1]{{\ensuremath{\mathrm{Sym}\left(#1\right)}}}
\newcommand{\ModkP}[1]{{\ensuremath{\mathrm{Mod}_{#1}\mathrm{P}}}}
\newcommand{\ModkL}[1]{{\ensuremath{\mathrm{Mod}_{#1}\mathrm{L}}}}
\newcommand{\findgroup}[0]{{\ensuremath{\textrm{\small FINDGROUP}}}}
\newcommand{\problemfont}[1]{{\ensuremath{\textsc{#1}}}}
\newcommand{\size}[1]{{\ensuremath{\mathrm{size}\left(#1\right)}}}
\newcommand{\Ideal}[1]{{\ensuremath{\mathfrak{#1}}}}
\newcommand{\etal}[0]{{\emph{et al}}}
\newcommand{\length}[1]{{\ensuremath{\left|#1\right|}}}
% \newcommand{\Artin}[2] {\ensuremath {\left[
%      \begin{array}{c}
%        #1\\
%        \hline
%        #2
%      \end{array}
%    \right] } }

%\newcommand{\SoftO}[1]{\ensuremath{\widetilde{O}\left(#1\right)}}

\newcommand{\ProblemFont}[1]{{\ensuremath{\textrm{\small #1}}}}
\newcommand{\Frob}[2]{\ensuremath{\left(#1 \over #2\right)}}
%\newcommand{\Artin}[2]{\ensuremath{\left[#1 \over #2\right]}}
\newcommand{\Artin}[2]{\ensuremath{\mathrm{Frob}_{#1}({#2})}}
\newcommand{\pr}[2]{{\ensuremath{\left.{#1}\right\vert_{#2}}}}
\newcommand{\Ker}[1]{{\ensuremath{\mathrm{ker}\left(#1\right)}}}
\newcommand{\Soc}[1]{{\ensuremath{\mathrm{Soc}\left(#1\right)}}}
\newcommand{\Blocks}[1]{{\ensuremath{\mathcal{B}\left(#1\right)}}}
\newcommand{\Gof}[2][G]{{\ensuremath{#1\left(#2\right)}}}
\newcommand{\pointwise}[2]{{\ensuremath{#1\left(#2\right)}}}
\newcommand{\Diag}[2][]{{\ensuremath{\mathrm{Diag}_{{#1}}\left(#2\right)}}}
\newcommand{\Residue}[2][]{{\ensuremath{\mathrm{Res}_{{#1}}\left(#2\right)}}}
\newcommand{\NCL}[2][]{\ensuremath{\mathrm{NCL}_{#1}({#2})}}
\newcommand{\Cent}[2][]{\ensuremath{\mathrm{C}_{#1}({#2})}}
\newcommand{\Sift}[1]{{\ensuremath{\mathrm{Sift}({#1})}}}
\newcommand{\Fix}[2]{{\ensuremath{\mathrm{Fix}\left(#1,#2\right)}}}
\newcommand{\commu}[1]{{\ensuremath{\left\lbrack #1 \right\rbrack}}}
\newcommand{\abs}[1]{{\ensuremath{\left\vert #1 \right\vert}}}
\newcommand{\norm}[1]{{\ensuremath{\left\Vert #1 \right\Vert}}}
\newcommand{\Height}[1]{\ensuremath{\mathrm{H}\left(#1\right)}}
\newcommand{\bigtimes}{\prod}

%%
%% Nonsense to fix the glossary. I want to classify symbols. The
%% prefix choosen for this purpose is the following.  g - groups, p -
%% permutation groups, r - fields, q - graphs.
%%
%% The commands below is to put entries in appropriate groups.
%%
%%

\newcommand{\nomclgroups}[3][]{{\nomenclature[g#1]{#2}{#3}}}
\newcommand{\nomclgraphs}[3][]{{\nomenclature[q#1]{#2}{#3}}}
\newcommand{\nomclpermg}[3][]{{\nomenclature[p#1]{#2}{#3}}}
\newcommand{\nomclfields}[3][]{{\nomenclature[r#1]{#2}{#3}}}

\newcommand{\Int}[1][]{{\ensuremath{\mathbb{O}_{#1}}}}
%%
%% Here is where the \nomgroup command is being defined. This is
%% shamelessly flicked from the nomenclature manpage. I roughly
%% understand it but do not know it fully. Will fix it if hell breaks
%% loose.
%%

%% notation with headings
% \newcommand{\nomgrouphead}[1]{
%  \tabularnewline\multicolumn{2}{l}{\large\bf{}#1}
%  \tabularnewline}

% \usepackage{ifthen}

% \renewcommand{\nomgroup}[1]{
%   \ifthenelse{\equal{#1}{G}}{\nomgrouphead{Group theory}}{%
%     \ifthenelse{\equal{#1}{P}}{\nomgrouphead{Permutation group
%         theory}}{%
%       \ifthenelse{\equal{#1}{R}}{\nomgrouphead{Algebraic number
%           theory}}{%
%         \ifthenelse{\equal{#1}{H}}{\nomgrouphead{Graphs}}{}}}}}
%%
%% And finally tell LaTeX to generate glossary
%%
\makeglossary
%%
%% End of mucking around with nomenclature package
%%
%%
%% parameters of the thesis
%%
\title{Complexity Upper Bounds using Permutation Group theory}
\author{Piyush P Kurur}
\subject{Theoretical Computer Science}
\advisor{V. Arvind}
\advisoraddress{Institute of Mathematical Sciences}
\thesisstartdate{January 2003}
\thesisenddate{January 2006}
\renewcommand{\month}{1}
\renewcommand{\day}{13}
\renewcommand{\year}{2006}
%%
%% end parameters
%%
\makeindex
\begin{document}
\maketitle

\makedeclaration
%\onehalfspacing
\makecertificate

%\input{ack.tex}

\chapter*{Acknowledgements}
\addcontentsline{toc}{chapter}{Acknowledgements}

During my stay at IMSc, I was fortunate to be in the company of some
wonderful people who have directly or indirectly contributed to this
thesis. Firstly I thank Arvind for supervising my work. It was he who
introduced me to many of the fascinating topic in Computer Science.
Working with him was a great experience in itself. In him I found a
great teacher, a friend and a research collaborator. His contribution
to this thesis is far more than what I could express in this limited
space.

I had the privilege to learn Computer Science and Mathematics through
some excellent lectures at IMSc. I thank the group at IMSc, especially
Meena Mahajan, R. Ramanujam, Kamal Lodaya and Venkatesh Raman, for
this wonderful research environment.

% I would like to thank the Computer Science group of IMSc and CMI for
% providing an excellent environment for research.  He patiently went
% through the numerous drafts of this thesis in the process improving
% it tremendously.  As part of the DST-DAAD personnel exchange program
% I had a great time in Germany.

My visit to Germany as part of the DST-DAAD personnel program was a
great learning experience for which I am indebted. I had the good
fortune to enjoy the hospitality of Johannes K\"obler while visiting
Humboldt Universit\"at, Berlin under this program.  During this period
I had a great time visiting Universit\"at Paderborn thanks to Joachim
von zur Gathen and Technische Universit\"at Darmstadt thanks to
Johannes Buchmann.  My visit to Japan in December 2003 was made
memorable due to the time I spent at the Tokyo Institute of Technology
thanks to Osamu Watanabe.

% I had a great time at the Universit\"at of Paderborn thanks to
% Joachim von zur Gathen. Just before returning to India I had the
% pleasure of visiting the Technische Universit\"at Darmstadt thanks
% to Johannes Buchmann.  My visit to Japan in December 2003 was made
% memorable due to the time I spent at the Tokyo Institute of
% Technology thanks to Osamu Watanabe.

Many individuals and organisations helped me by funding my research
visits.  I would like to thank the conference committees of CCC 2002,
CCC 2005 (especially Eric Allender and Lance Fortnow) and ANTS VI for
their funds that helped me attend these conferences.  I thank the
National Board of Higher Mathematics (NBHM) and the Indian Association
for Research in Computer Sciences (IARCS) for funding some of my
research visits.

Finally I would like to thank my friends for making the life in IMSc
memorable and entertaining.

\tableofcontents
\renewcommand{\nomname}{Notation\addcontentsline{toc}{chapter}{Notation}}
\printglossary

\chapter{Introduction}%
\pagenumbering{arabic}%% start numbering in the usual way

Considerable progress has been made recently in the design of
efficient algorithms for computational problems in permutation group
theory. Many of these results exploit the structure of permutation
groups. As permutation groups arise naturally in many computational
problems, algorithmic breakthrough in this area often led to progress
in solving, at least partially, other computational problems; Graph
Isomorphism being a striking example. It is reasonable to expect that
these group-theoretic and algorithmic advances would lead to better
insights into the complexity of computational problems which are
connected to permutation group theory. In this thesis we study Graph
Isomorphism and problems that arise in Galois theory. Our aim is to
use the structural properties of permutation groups together with
other algebraic techniques to prove complexity upper bounds.

Complexity theory is the study of resource bounded computations.
Efficiency is measured in terms of the resource required to solve the
problem as a function of the input size. Two of the most important
measures are the time and space required to solve the problem on a
Turing machine.  Often problems have a trivial exponential time brute
force algorithm that searches for a potential solution in the set of
all possible solutions. Such exponential time algorithms are
impractical as they take considerable time for solving instances of
reasonable sizes. Following the suggestion of
Edmonds~\cite{edmonds65paths} it is widely accepted that computational
problems in $\mathrm{P}$, i.e. problems that are solvable in
polynomial time on a deterministic Turing machine, are those that are
tractable. This assumption is called the \emph{extended Church-Turing
  hypothesis}. The complexity class $\mathrm{NP}$ is the class of
problems that can be solved on a nondeterministic Turing machine in
polynomial time.  It is exactly the class of decision problems for
which yes instances have polynomial time verifiable certificates.
Clearly $\mathrm{NP}$ contains the class $\mathrm{P}$ but whether this
containment is strict is a central open problem in complexity theory.

An important concept in complexity theory is the notion of
completeness. A problem $P$ in a complexity class $\mathcal{C}$ is
said to be complete for $\mathcal{C}$ if for any other $P^\prime$ in
$\mathcal{C}$ instance of $P^\prime$ can efficiently reduced to $P$.
Problems complete for a complexity class $\mathcal{C}$ are in some
sense the hardest problems of $\mathcal{C}$.  For the class
$\mathrm{NP}$ starting with the work of Cook~\cite{cook-sat} and
Levin~\cite{levin-np} and subsequently Karp~\cite{karp-np} many
important computational problems have been show to be complete (see
the book of Garey and Johnson~\cite{garey-johnson}). If any of these
problems have polynomial time algorithm then $\mathrm{P} =
\mathrm{NP}$. Hence a problem being $\mathrm{NP}$-complete is a strong
evidence that it has no efficient (i.e. polynomial time) algorithm.

Classifying natural problems by showing it to be complete for a
complexity class is an important goal in complexity theory.  For a
computational problem, proving complexity theoretic upper and lower
bounds often requires novel insights into the mathematics underlying
the problem. The tight classification of the complexity of the
permanent~\cite{valiant79permanent},
determinant~\cite{toda91determinant,vinay91pda} are classic examples.
Despite serious efforts many problems still elude such a tight
classification.

In this thesis we study the complexity Graph Isomorphism and problems
associated with Galois theory with an aim of classifying these in the
frame work of complexity theory. A common thread that connects these
two is the role of permutation group theory.  The structure of
permutation groups and the numerous efficient algorithms for
permutation group problems play an important role in our results.

Permutation groups, apart from being a source of interesting
computational problems, have played important role in algorithms for
Graph Isomorphism like for example in the polynomial time algorithm of
Luks~\cite{luks82bounded} for bounded valence graphs. Group theory has
played important role in various complexity theoretic results.
Babai's~\cite{babai92bounded} $\mathrm{AM}\cap
\textrm{co-}\mathrm{AM}$ upper bounds for matrix group problems and
Barrington's~\cite{barrington89boundedwidth} group theoretic
characterisation of $\mathrm{NC}^1$ are two classic examples.

\section{Overview of this thesis}

We now give an overview of the thesis.
Chapter~\ref{chap-complexity-theory} is a brief survey of the
complexity theory required for this thesis and
Chapter~\ref{chap-group-theory} develops the required group theory.
For our results on Galois theory we need some results from algebraic
number theory. We describe these in Chapter~\ref{chap-ant}.  Our
results on Graph Isomorphism and related problems are explained in
Chapters~\ref{chap-gi-in-spp} and \ref{chap-bcgi}. We describe our
results on computational problems in Galois theory in
Chapters~\ref{chap-property-testing}, \ref{chap-order-finding} and
\ref{chap-galois-special}.

\subsection*{Graph Isomorphism}

Given two undirected graphs $X_1 = (V_1,E_1)$ and $X_2= (V_2,E_2)$ the
Graph Isomorphism problem is to check whether $X_1$ and $X_2$ are
isomorphic, i.e. to check whether there is a one-to-one map $f: V_1
\to V_2$ such that for every unordered pair $\{u,v\}$ from $V_1$,
$\{u,v\} \in E_1$ if and only if $\{f(u), f(v)\} \in E_2$. In this
thesis we also study a special case of Graph Isomorphism problem
called the \emph{bounded colour multiplicity Graph Isomorphism
  problem}, $\ProblemFont{BCGI}$ for short. Given two vertex-coloured
graphs $X_1$ and $X_2$ such that the number of vertices with a given
colour is less than a constant $b$, we want to check whether there is
a colour preserving isomorphism, i.e. an isomorphism $f$ from $X_1$ to
$X_2$ such that $u \in V(X_1)$ and $f(u) \in V(X_2)$ are of the same
colour.  We call this problem \emph{bounded colour multiplicity} graph
isomorphism problem, $\ProblemFont{BCGI}_b$ for short.

In Chapter~\ref{chap-gi-in-spp} we show that the Graph Isomorphism
problem is in the complexity class $\mathrm{SPP}$. In fact we prove a
more general result: We show that the generic group theoretic problem
$\ProblemFont{FINDGROUP}$ is in the complexity class
$\mathrm{FP}^{\mathrm{SPP}}$. As a consequence many interesting
problems in permutation group theory like Graph Isomorphism, Set
stabiliser problem and the Hidden subgroup problem over permutation
groups are in $\mathrm{SPP}$ (or $\mathrm{FP}^{\mathrm{SPP}}$ for
functional problems).  Computational problem in $\mathrm{SPP}$ (or
$\mathrm{FP}^{\mathrm{SPP}}$ in case they are functional problems) are
\emph{low} for many important complexity classes like $\oplus
\mathrm{P}$ (in fact $\ModkP{k}$ for all $k$),
$\mathrm{C}_{=}\mathrm{P}$ etc. Hence by proving the Graph Isomorphism
problem to be in $\mathrm{SPP}$ we have show it to be low for each of
these classes. Earlier it was not even know whether {\small GI} was in
$\oplus \mathrm{P}$.
% Problems that are $\mathrm{NP}$-complete are not expected to have
% these \emph{lowness} properties.

In Chapter~\ref{chap-bcgi} we prove that $\ProblemFont{BCGI}_b$ is in
the $\ModkL{k}$-hierarchy where the constant $k$ and the level of the
hierarchy depends only on $b$.  Recently
Tor\'an~\cite{toran2004hardness} has shown the Graph Isomorphism
problem to be hard for various complexity classes.  In particular he
has proved that $\ProblemFont{BCGI}$ is hard for $\ModkL{k}$ for all
$k$.  The graph gadgets that he construct can be used to show the
hardness of $\ProblemFont{BCGI}$ for the entire
$\ModkL{k}$-hierarchy~\cite[Appendix]{arvind2005bounded}, a stronger
result. Our result on $\ProblemFont{BCGI}$ complements his result and
gives a fairly tight classification of $\ProblemFont{BCGI}$ in terms
of logspace counting classes.

Another consequence of our result is on the parallel complexity of
$\ProblemFont{BCGI}$. Our results improve the $\mathrm{NC}$ upper
bound of Luks~\cite{luks86parallel} to $\mathrm{NC}^2$ (even
$\mathrm{TC}^1$).

\subsection*{Galois theory}

Consider a number field $K$, a field extension of $\mathbb{Q}$ the
field of rational numbers. The Galois group of $K$, denoted by
$\Gal{K/\mathbb{Q}}$, is the group of \emph{field automorphisms} of
$K$ that when restricted to $\mathbb{Q}$ is identity. For a polynomial
$f(X) \in \mathbb{Q}[X]$, the splitting field $\mathbb{Q}_f$ is the
smallest extension of $\mathbb{Q}$ that contains all the roots of $f$.
By the Galois group of $f$ we mean the Galois group
$\Gal{\mathbb{Q}_f/\mathbb{Q}}$.

The Galois group of a degree $d$ polynomial $f$ can be thought of as a
subgroup of $S_d$, the group of permutations on $d$ objects.  This
follows from the fact that the Galois group of $f$ is fully specified
by giving its action on the roots of $f$.

%Given a polynomial $f(X) \in \mathbb{Q}[X]$ of degree $d$ we are
%interested in the following problems:
%\begin{enumerate}
%\item \label{prob-compute-galois} Computing a generating set of
%  $\Gal{f}$ as a subgroup of $S_d$.
%\item \label{prob-compute-order} Computing the order of the group
%  $\Gal{f}$.
%\item \label{prob-property-testing} Checking whether the Galois group of
%$f$ satisfies certain properties like being solvable or nilpotence etc.
%\end{enumerate}

Computing the Galois group of a polynomial is a fundamental problem in
algorithmic number theory.  Often one is interested in verifying
whether the Galois group of a polynomial satisfies certain properties
instead of actually computing the Galois group.  Asymptotically, the
best algorithm for computing the Galois group of a polynomial $f(X)
\in \mathbb{Q}[X]$ is due to Landau~\cite{landau84galois} and runs in
time polynomial in $\size{f}$ and the order of the Galois group of
$f$.  Since the Galois group of a polynomial $f(X)$ of degree $n$ can
have $n!$ elements, Landau's algorithm takes exponential-time in the
worst case.

Besides being a natural computational problem, knowing the Galois
group of a polynomial $f$ or knowing certain properties of the Galois
group of $f$ gives information about the roots of $f$. A classic
example is the seminal work of Galois showing that a polynomial $f$ is
solvable by radicals if and only if its Galois group is solvable. Thus
checking whether a polynomial is solvable by radicals amounts to
checking whether its Galois group is solvable and hence has an
exponential time algorithm.  Landau and Miller
\cite{landau85solvability} gave a remarkable polynomial time algorithm
for solvability checking. This algorithm manages to check solvability
without actually computing the entire Galois group. This remarkable
result gives hope that certain non-trivial properties of Galois groups
can be tested efficiently.  Chapter~\ref{chap-property-testing} deals
with such efficiently testable properties of Galois group.  We give
polynomial time algorithms for nilpotence testing and
$\Gamma_d$-testing.

We generalise the Landau-Miller algorithm and give a polynomial-time
algorithm for testing whether the Galois group of a given polynomial
is in $\Gamma_d$ for constant $d$.  The class of groups $\Gamma_d$
often crops up in permutation group theoretic problems, e.g.\ Luks'
polynomial-time algorithm~\cite{luks82bounded} for testing isomorphism
of bounded degree graphs.

Even though nilpotent groups are solvable the Landau-Miller
solvability test does not give a polynomial time nilpotence test.  The
Landau-Miller algorithm gives a way to test whether all composition
factors of the Galois group are abelian. Nilpotence however is a more
``global'' property in the sense that it cannot be inferred by knowing
the composition factors alone. In Chapter~\ref{chap-property-testing}
we give a characterisation of nilpotent permutation groups and this
characterisation yields a polynomial time nilpotence test.

Many computational problems in algebraic number theory are hard. In
the absence of non-trivial upper bounds, conditional results, i.e.
results whose validity depends on widely believed yet unproven
conjectures of number theory, are of great interest. We now look at
complexity theoretic results of this thesis that depend on the
validity of the generalised Riemann hypothesis. An important
ingredient used in our results is the Chebotarev density theorem, a
result on the distribution of primes. For the complexity theoretic
applications of this thesis we need an effective version of Chebotarev
density theorem due to Lagarias and
Odlyzko~\cite{lagarias:1977:effective} proved assuming the generalised
Riemann hypothesis.

The problem of interest in Chapter~\ref{chap-order-finding} is order
finding of Galois groups. Given a polynomial $f(X) \in \mathbb{Q}[X]$
we are interested in computing the order of $\Gal{f}$ (or equivalently
the degree $[\mathbb{Q}_f:\mathbb{Q}]$ of the extension
$\mathbb{Q}_f/\mathbb{Q}$). For permutation groups of degree $n$
presented via a generating set, the order can be computed in time
polynomial in $n$. Hence computing the order is no more difficult that
computing the Galois group and there is an exponential time algorithm
for it. We prove better upper bounds assuming generalised Riemann
hypothesis.

Given a polynomial $f(X) \in \mathbb{Q}[X]$ we show that there is a
polynomial time algorithm making one query to a $\# \mathrm{P}$ oracle
that computes the order of the Galois group of
$f$~\cite{arvind2003galois}. Furthermore using Stockmeyer's result on
approximating $\# \mathrm{P}$
functions~\cite{stockmeyer85approximating}, we show that there is a
randomised algorithm with $\mathrm{NP}$ oracle to approximate the
order of the Galois group.

For polynomials with Galois group in $\Gamma_d$, $d$ a constant, we
give a polynomial time reduction from exact order finding to
approximate order finding. Thus for polynomials with Galois group in
$\Gamma_d$, $d$ a constant, we have a randomised algorithm with an
$\mathrm{NP}$-oracle to compute the order assuming the generalised
Riemann hypothesis.

Finally in Chapter~\ref{chap-galois-special} we give nontrivial upper
bounds on computing the Galois group of some special polynomials.  We
show that given a polynomial $f(X) \in \mathbb{Q}[X]$ with abelian
Galois group, there is a randomised algorithm for computing the Galois
group. This we achieve by giving a polynomial time randomised
algorithm for sampling almost uniformly {from} the Galois group of
$f$.  The effective version of the Chebotarev density theorem plays a
crucial role here. The only nontrivial bound of non-abelian Galois
group computation is the following. Given a polynomial $f(X) \in
\mathbb{Q}[X]$ such that every irreducible factor $g$ of $f$ has
non-abelian simple Galois group of small size, there is a polynomial
time deterministic algorithm for computing the Galois group of $f$.
This result uses a special property of non-abelian semi-simple groups
called Scott's Lemma (Lemma~\ref{lem-scott}) and is unconditional.

\chapter{Complexity theory}
\label{chap-complexity-theory}

In this chapter we recall the complexity theory required for this
thesis. A detailed presentation is available in any standard textbook
on complexity theory (\cite{structcomp1,structcomp2}). The survey
article of Fortnow and Homer~\cite{fortnow2003history} gives a
historical perspective together with pointers to many important
results of complexity theory.

By an \emph{alphabet} we mean a finite set $\Sigma$ of \emph{letters}.
\index{alphabet} \index{letters} A \emph{string}\index{string} of
\emph{length} $n$\index{length of a string} over an alphabet $\Sigma$
is a finite sequence $x_1\ldots x_n$ of letters from $\Sigma$. For a
string $x$ we will use $\length{x}$ to denote the length of $x$. By
$\Sigma^*$ we mean the set of all strings over $\Sigma$. We will use
$\epsilon$ to denote the \emph{empty string}\index{empty string}, the
unique string of length $0$.  A \emph{language} over $\Sigma$ is a
subset of $\Sigma^*$.\index{language}

A \emph{decision problem}\index{decision problem} is a computational
problem where we expect a yes/no answer for e.g. the Graph Isomorphism
problem. By suitably encoding instances of a problem, any decision
problem can be seen as a language over $\{0,1\}$; the language
corresponding to a decision problem is the set of encodings of input
instances which evaluate to ``yes''. We will use the terms language
and decision problem interchangeably.

Often computational problem require more than a yes/no answer for e.g.
consider the problem of sorting a list of numbers. The functions of
interest for us are functions from $\Sigma^*$ to $\Sigma^*$. Again for
countable sets $A$ and $B$ by suitable encoding, functions from $A$ to
$B$ can be thought of as functions from $\Sigma^*$ to $\Sigma^*$.
Computing such functions are called \emph{functional problems}.
\index{functional problems}

The complexity class $\mathrm{P}$ is the class of decision problems
that can be solved in time bounded by a polynomial in the size of its
inputs on a Turing machine. The class $\mathrm{P}$ is robust because
Turing machines can simulate other reasonable models of computation
with a polynomial time overhead.  Moreover, most natural problems that
have polynomial time algorithms are tractable in practice.  These
properties led Edmonds~\cite{edmonds65paths} to suggest $\mathrm{P}$
as the class of tractable problems and is now widely accepted as the
\emph{extended Church-Turing hypothesis}\footnote{Quantum computing is
  a potential challenge to this hypothesis.}. By $\mathrm{FP}$ we mean
the class of functions from $\Sigma^*$ to $\Sigma^*$ that can be
computed on a polynomial time bounded Turing machine.

There are certain problems for which a candidate solution can be
verified in polynomial time. The complexity class $\mathrm{NP}$
captures exactly this. It is the class of problems that can be solved
on a nondeterministic Turing machine in polynomial time. Clearly
$\mathrm{NP}$ contains the class $\mathrm{P}$ but whether this
containment is strict is a central open problem in complexity theory.
Although widely believed that $\mathrm{P} \neq \mathrm{NP}$, the
$\mathrm{P}$ vs $\mathrm{NP}$ conjecture has successfully resisted
attempts of resolution till date. This question gained importance
after the concept of $\mathrm{NP}$-completeness was formalised due to
the seminal work of Cook~\cite{cook-sat} and Levin~\cite{levin-np}
which proved that checking satisfiability of boolean formulae, {\small
  SAT}, is $\mathrm{NP}$-complete. Subsequently Karp~\cite{karp-np}
showed a number of combinatorial problems including clique problem and
travelling salesman problem to be $\mathrm{NP}$-complete. A problem
being $\mathrm{NP}$-complete is a strong evidence that it has no
polynomial time algorithm.  The class of $\mathrm{NP}$-complete
problems is particularly important in view of the large number of
important problems that it contains.  The book of Garey and
Johnson~\cite{garey-johnson} gives a through review of
$\mathrm{NP}$-completeness and intractability with a list of important
$\mathrm{NP}$-complete problems.

Are there problems that are of intermediate complexity in
$\mathrm{NP}$?  Ladner~\cite{ladner75ptimereduce} showed that if
$\mathrm{P} \neq \mathrm{NP}$ then there are problems that are neither
in $\mathrm{P}$ nor are $\mathrm{NP}$-complete. It is of interest to
know whether there are natural problems of this kind. Graph
Isomorphism seems to be one such and is one of the topics of this
thesis.

Analogous to the arithmetic hierarchy in computability, Stockmeyer
defined the polynomial hierarchy~\cite{stockmeyer76hierarchy}.
However, unlike the arithmetic hierarchy, it is not known whether the
polynomial hierarchy is infinite. Many interesting problems have been
shown to be at different levels of the polynomial hierarchy. Like the
working assumption that $\mathrm{P} \neq \mathrm{NP}$, it is widely
believed that the polynomial time hierarchy is infinite.

%\section{Logspace class and Parallel complexity}

Important subclasses of $\mathrm{P}$ are the complexity classes
$\mathrm{L}$ and $\mathrm{NL}$. The class $\mathrm{L}$ consists of
problems for which input instance of size $n$ can be solved with
$O(\log{n})$ space on a deterministic Turing machine. Recently,
Reingold~\cite{reingold2005undirected} proved that $\mathrm{L}$
contains undirected $s$-$t$ connectivity problem: given an undirected
graph and two nodes $s$ and $t$ check whether there is a path from $s$
to $t$.  As a consequence many problems that involve connectivity in
undirected graphs can be solved in logspace.  We summarise these
results here for use in later chapters.

\begin{lemma}[Reingold]\label{lem-connectivity}
  Given a undirected graph, computing the connected components, find a
  maximal spanning forest etc. can be solved in logspace.
\end{lemma}

The class $\mathrm{NL}$ is the nondeterministic version of
$\mathrm{L}$ consisting of languages that can be accepted by
\emph{nondeterministic} logspace bounded Turing machines. A complete
problem for $\mathrm{NL}$ is the directed $s$-$t$ connectivity
problem: given a directed graph and two distinguished points $s$ and
$t$ check if there is a path from $s$ to $t$.

In order to capture complexity classes below $\mathrm{P}$, we need to
restrict the oracle access mechanism for nondeterministic and
randomised logspace machines. A widely accepted oracle access
mechanism is the ``Ruzzo-Simon-Tompa'' oracle
access~\cite{ruzzo84spacebounded} mechanism in which the oracle
machine is restricted to write oracle queries deterministically. In
this thesis we will follow this mechanism when we deal with
$\mathrm{NL}$ oracle machines.

Circuit depth and size gives an elegant way of capturing parallel
complexity of a problem.  The class $\mathrm{AC}^k$ consists of
polynomial sized circuits of depth $O(\log^k{n})$.  If there is an
additional constraint that each gate has bounded fanin we get the
class $\mathrm{NC}^k$. It is known that $\mathrm{NC}^k \subseteq
\mathrm{AC}^k \subseteq\mathrm{NC}^{k+1}$.  The class $\mathrm{NC}$ is
the union $\cup_{k=1}^\infty \mathrm{NC}^k$ and captures problems that
have efficient parallel algorithms: problems that can be solved in
polylog time on a parallel machine with the number of processors
bounded by a polynomial in the input size.

%  exists quite accurately\footnote{Of
%  course some notion of uniformity is required and is typically
%  logspace uniformity.}.
%
% Apart {from} time and space, Complexity theory has been successful
% in formalising other important efficiency criteria like for example
% efficiency on parallel machines.  Many other resource measures like
% circuit depth, non-determinism, randomness etc.  were studied and
% led to finer classification of natural problems. We give a brief
% description of those relevant to this thesis.

\section{Counting complexity classes}

\emph{Counting complexity classes} are defined based on the number of
accepting and rejecting paths of a nondeterministic computation.
Consider the functional problem $\# \ProblemFont{SAT}$ of counting the
number of satisfying assignments of a boolean formula. Functional
problems like $\# \ProblemFont{SAT}$ are problems in the complexity
class $\# \mathrm{P}$. The complexity class $\# \mathrm{P}$ consists
of all functions $f$ {from} strings to non-negative integers for which
there is a $\mathrm{NP}$ machine $M_f$ such that $f(x)$ is the number
of accepting paths of $M_f$ on input $x$.  The functions that are
complete for $\# \mathrm{P}$ are hard to compute functions as they
directly give a way of solving $\mathrm{NP}$-complete problems.
Surprisingly, certain decision problems that have polynomial time
algorithms have counting versions that are $\# \mathrm{P}$-complete. A
classic example is the problem of counting the number of matchings of
a bipartite graph.  Counting the number of matching in a bipartite
graph is equivalent to computing the permanent of a $(0,1)$-matrix
which was shown to be $\# \mathrm{P}$ complete by
Valiant~\cite{valiant79permanent}.

The class $\# \mathrm{P}$ is closed under sum and product However it
is not closed under subtraction.  The closure of $\# \mathrm{P}$ under
subtraction is the class $\mathrm{GapP}$.  Alternatively,
$\mathrm{GapP}$ can be defined as the class of all functions $f$ for
which there is a $\mathrm{NP}$-machine $M_f$ such that $f(x)$ is the
difference of the accepting and rejecting paths of $M_f$ on input $x$.
Apart from being closed under subtraction $\mathrm{GapP}$ inherits all
the nice closure properties of $\# \mathrm{P}$. We summarise these
closure properties below (see \cite{fenner91gapdefinable}).

\begin{theorem} The class $\# \mathrm{P}$ and $\mathrm{GapP}$ are
  closed under exponential summation and polynomial product, i.e. if
  $f(x,y)$ be a function in $\# \mathrm{P}$ ($\mathrm{GapP}$ ) then
  for any polynomial $r(.)$ the functions
   \[
   g(x) = \sum_{\length{y} \leq r(\length{x}) } f(x,y)
   \] and
   \[
   h(x) = \prod_{y \leq r(\length{x})} f(x,y)
   \] are in $\# \mathrm{P}$ ($\mathrm{GapP}$).
\end{theorem}

The functions in $\# \mathrm{P}$ are hard to compute ---
Toda's~\cite{toda91pp} results shows that the entire polynomial
hierarchy is contained in $\mathrm{P}^{\# \mathrm{P}}$. Nonetheless,
certain $\# \mathrm{P}$ functions can be efficiently approximated, for
example $\# \ProblemFont{DNFSAT}$ has polynomial time approximation
algorithms. For approximating general $\# \mathrm{P}$ function the
best known result is due to
Stockmeyer~\cite{stockmeyer85approximating}.

\begin{theorem}
  For every function $f$ in $\# \mathrm{P}$ and any fixed constant $c$
  there is a randomised polynomial time algorithm with
  $\mathrm{NP}$-oracle that on input $x$ computes a value $N_x \in
  \mathbb{N}$ such that
  \[
  \left( 1 - \frac{1}{\length{x}^c}\right) N_x \leq f(x) \leq \left( 1
    + \frac{1}{\length{x}^c}\right) N_x
  \]
\end{theorem}

The class $\mathrm{PP}$ consists of all languages $L$ for which there
is a $\mathrm{GapP}$ function $f$ such that $x \in L$ if and only if
$f(x) > 0$. Surprisingly the entire polynomial hierarchy is contained
in $\mathrm{P}^{\mathrm{PP}}$ as shown by Toda~\cite{toda91pp}.  The
class $\ModkP{k}$ consists of all languages $L$ for which there is a
$\# \mathrm{P}$ function $f$ such that $x \in L$ if and only if $f(x)$
is not divisible by $k$. By $\oplus \mathrm{P}$ we mean the class
$\ModkP{2}$.

\subsection*{UP and SPP}

A language $L$ is in $\mathrm{UP}$ if there is a $\# \mathrm{P}$
function $f$ such that $x$ is in $L$ if $f(x) = 1$ and $x$ is not in
$L$ if $f(x) = 0$. The class $\mathrm{UP}$ was introduced by
Valiant~\cite{valiant76relative} to captures the complexity of one-way
functions. One-way functions are functions that are easy to compute
but hard to invert and their study is central to cryptography. The
existence of one-way functions is equivalent to the complexity
theoretic assumption that $\mathrm{UP} \neq \mathrm{P}$. The class
$\mathrm{SPP}$ is the $\mathrm{UP}$ analogue of $\mathrm{GapP}$. A
language $L$ is in $\mathrm{SPP}$ if there is a function $f$ in
$\mathrm{GapP}$ such that for all strings $x$, $x \in L$ if $f(x) = 1$
and $x \not \in L$ if $f(x) = 0$.

The class $\mathrm{SPP}$ is probably one of the most natural counting
complexity class. An important property of $\mathrm{SPP}$ is that it
is exactly the class of languages that are low for $\mathrm{GapP}$. A
language $L$ is said to be \emph{low} for a complexity class
$\mathcal{C}$ if $\mathcal{C}^L = \mathcal{C}$. \index{low complexity
  class} Sch\"oning~\cite{schoning88graph} introduced the concept of
lowness as a tool for classifying complexity theoretic problems and
showed that $\mathrm{NP}\cap \textrm{co-}\mathrm{AM}$ is low for
$\Sigma_2^p$. \index{lowness}

Due to the lowness of $\mathrm{SPP}$ for $\mathrm{GapP}$, languages in
$\mathrm{SPP}$ are in and low for all reasonable \emph{gap-definable}
complexity classes \index{gap-definable} including itself
\cite{fenner91gapdefinable}. Many interesting counting complexity
classes like $\oplus \mathrm{P}$, $\ModkP{k}$,
$\mathrm{PP}$,$\mathrm{C}_=\mathrm{P}$ are gap definable and hence
showing a language $L$ to be in $\mathrm{SPP}$ in one stroke shows
that it is in and low for each of these classes.  Since $\mathrm{SPP}$
is low for itself, the class $\mathrm{FP}^{\mathrm{SPP}}$ also share
these interesting lowness properties. The class
$\mathrm{FP}^{\mathrm{SPP}}$ is essentially $\mathrm{SPP}$ as the bits
of functions of $\mathrm{FP}^{\mathrm{SPP}}$ can be computed in
$\mathrm{SPP}$.  Computational problems that are $\mathrm{NP}$-hard
are not expected to share these lowness properties and hence languages
in $\mathrm{SPP}$ (or functional problems in
$\mathrm{FP}^{\mathrm{SPP}}$) are unlikely to be $\mathrm{NP}$-hard.
In Chapter~\ref{chap-gi-in-spp} we show that the Graph Isomorphism
problem is in $\mathrm{SPP}$.

We now describe an important technique that is used to give
$\mathrm{SPP}$-upper bounds. Let $A$ be a language in $\mathrm{NP}$.
An polynomial time oracle machine $M^A$ is said to make
$\mathrm{UP}$-like queries to $A$ if there is an $\mathrm{NP}$ machine
$N$ accepting $A$ such that for all inputs $x$ and for all queries $y$
made by $M$ on input $x$, $N$ has at most one accepting computation on
$y$, i.e. for queries made by $M$ the machine $N$ behaves like a
$\mathrm{UP}$ machine.  Again due to the closure properties of
$\mathrm{GapP}$ and the lowness properties of $\mathrm{SPP}$ we have
the following important theorem~\cite{kobler92graph}.

\begin{theorem}\label{thm-uplike-spp}
  Any language accepted by (function computed by) a polynomial time
  oracle machine $M^A$ making $\mathrm{UP}$-like queries to $A \in
  \mathrm{NP}$ is in $\mathrm{SPP}$ ($\mathrm{FP}^{\mathrm{SPP}}$).
\end{theorem}
%
%\begin{theorem}\hfil%\break
%  \begin{enumerate}
%  \item Any language accepted by an oracle machine $M^A$ making
%    $\mathrm{UP}$-like queries to $A \in \mathrm{NP}$ is in
%    $\mathrm{SPP}$.
%  \item Any function computed by an oracle machine $M^A$ making
%    $\mathrm{UP}$-like queries to $A \in \mathrm{NP}$ is in
%    $\mathrm{FP}^\mathrm{SPP}$.
%  \end{enumerate}
%\end{theorem}

\subsection*{Logspace Counting classes}

Analogous to $\mathrm{GapP}$ and $\# \mathrm{P}$ by considering
$\mathrm{NL}$ machines we can define classes $\mathrm{GapL}$ and $\#
\mathrm{L}$. The class $\# \mathrm{L}$ consists of functions $f$ for
which there is an $\mathrm{NL}$ machine $M_f$ such that $f(x)$ is the
number of accepting paths of $M_f$ on $x$. Similarly we say that a
function $f(x)$ is in $\# \mathrm{L}^A$ for some language $A$ if there
is an oracle $\mathrm{NL}^A$ machine $M_f^A$ such that $f(x)$ is the
number of accepting paths of $M_f^A$ on $x$. Recall that the oracle
machine $M_f^A$ follows the Ruzzo-Simon-Tompa access mechanism for
making queries to $A$.

Logspace counting classes have played an important role in classifying
natural problems in $\mathrm{NC}^2$. For example it follows from the
work of Toda~\cite{toda91determinant} and Vinay~\cite{vinay91pda} that
the problem of computing the determinant of an integer matrix is
complete for $\mathrm{GapL}$ (for a detailed study see the article of
Mahajan and Vinay~\cite{mahajan99determinant}).  Also the complexity
of perfect matching is now quite well characterised by Allender
\etal~\cite{allender99isolation} using logspace counting classes and
the isolation lemma.

% \footnote{Compare this with the completeness of permanent for $\#
%   \mathrm{P}$. The complexity of permanent vs determinant in the
%   algebraic setting is connected intimately with Valiant's
%   hypothesis (an algebraic analogue of $\mathrm{P}$ vs $\mathrm{NP}$
%   problem~\cite{burgisser98completeness})}.

%$\left.
%%\def\objectstyle{\scriptstyle}
%\def\labelstyle{\scriptstyle}
%\vcenter{\xymatrix{
%    & \ModkL{k}\\
%    \ModkL{k} \ar@{.}[ur]
%  }
%}\right\}k
%$

The complexity class $\ModkL{k}$ is the logspace analogue of
$\ModkP{k}$.  The class $\ModkL{k}$ consists of languages $L$ for
which there is a function $f$ in $\# \mathrm{L}$ such that $x$ is in
$L$ if and only if $f(x) \neq 0\ (\textrm{mod } k)$.  It is known that
if $k_1 \mid k_2$ then we have $\ModkL{k_1} \subseteq \ModkL{k_2}$.
For a prime $p$ the complexity class $\ModkL{p}$ captures the
complexity of determinant over $\mathbb{F}_p$ quite accurately (cf.
\cite{buntrock92structure}).  Recently, Allender
\etal~\cite{allender99complexity} showed that many important linear
algebraic problems like finding the rank and checking feasibility of
linear equations over $\mathbb{F}_p$ are intimately connected to the
complexity class $\ModkL{p}$. A survey of important results in this
area is given in the article of
Allender~\cite{allender2004arithmetic}.  We summarise these results in
the following theorem.

\begin{theorem}[Buntrock \etal]%
  \label{thm-modp-linearalgb}
  Let $p$ be a prime. Given a $m \times n$ matrix $A$ and a $m \times
  1$ column vector $\mathbf{b}$ over $\mathbb{F}_p$ the problem of
  testing whether the system of linear equations $A \mathbf{x} =
  \mathbf{b}$ is feasible is in $\ModkL{p}$. In case the system is
  feasible finding a nontrivial solution for the vector $\mathbf{x}$
  of indeterminates is in $\mathrm{FL}^{\ModkL{p}}$.
\end{theorem}

We now define the $\ModkL{k}$ hierarchy. The first level of the
$\ModkL{k}$-hierarchy is the class $\ModkL{k}$. A language $L$ is said
to be in the $l+1$th level of the $\ModkL{k}$-hierarchy if there is a
function $f$ in $\#\mathrm{L}^{A}$, $A$ a language in the $l$th level
of the $\ModkL{k}$-hierarchy, such that for all $x$, $x$ is in $L$ if
and only if $f(x) \neq 0\ (\textrm{mod } k)$.

The $\ModkL{k}$ hierarchy can also be seen as languages accepted by
constant depth circuits with $\ModkL{k}$ oracle, i.e. the $\ModkL{k}$
hierarchy is exactly $\mathrm{AC}^0(\ModkL{k})$. It is not known
whether the $\ModkL{k}$-hierarchy is infinite. However for primes $p$
the $\ModkL{p}$-hierarchy collapses to $\ModkL{p}$.  In
Chapter~\ref{chap-bcgi} we see the connections of $\ProblemFont{BCGI}$
with the $\ModkL{k}$-hierarchy.

\chapter{Group Theory}
\label{chap-group-theory}

In this chapter we review the group theory in particular the theory of
permutation groups required for this thesis.  The groups we encounter
here will all be finite.  For a detailed presentation any standard
text book on group theory (for example~\cite{hall}) may be consulted.
We follow the notation of Wielandt~\cite{wielandt64finite} for
permutation groups.

We use the following notation: For groups $G$ and $H$, $H \leq G$
means that $H$ is a subgroup of $G$. By $H < G$ we mean that $H$ is a
strict subgroup of $G$ i.e. $H \leq G$ and $H \neq G$.  By $G \geq H$
and $G > H$ we mean $H \leq G$ and $H < G$ respectively.
%%
\nomclgroups[le]{$H \leq G$, $G \geq H$}{$H$ is a subgroup $G$}%
\nomclgroups[lt]{$H < G$, $G > H$}{$H \leq G$ and $H \neq G$}%
%%
Similarly by $H \unlhd G$ we mean $H$ is a normal subgroup of $G$.
When $H$ is a strictly smaller normal subgroup we denote it by $H \lhd
G$. As before we use $G \unrhd H$ and $G \rhd H$ to mean $H \unlhd G$
and $H \lhd G$ respectively. %
\index{normal!subgroup}%
%
\nomclgroups[nle]{$H \unlhd G$, $G \unrhd H$}{$H$ is a normal subgroup
  of $G$}%
%
\nomclgroups[nlt]{$H \lhd G$, $G \rhd H$}{$H \unlhd G$ and $H \neq
  G$}%
%
Let $G$ be a group and $A$ be any subset of $G$. By the normal closure
of $A$ in $G$, denoted by $\NCL[G]{A}$, we mean the smallest normal
subgroup of $G$ containing $A$. The centraliser $\Cent[G]{A}$ is the
subgroup of $G$ that commutes with all the elements of $A$.
\index{normal closure} \index{centraliser}
\nomclgroups{$\NCL[G]{A}$}{the normal closure of $A$ in $G$\refpage}
\nomclgroups{$\Cent[G]{A}$}{the centraliser of $A$ in $G$\refpage}

Let $H$ be any subgroup of $G$.  By the index \index{index! of a
  subgroup} of $H$ in $G$, denoted by $[G:H]$, we mean the number of
distinct $H$ cosets in $G$. We have $[G:H] = \frac{\# G}{\# H}$.
%
\nomclgroups[ltindex]{$[G:H]$}{the index of $H$ in $G$ for $H \leq
  G$\refpage}%
%
We say that $H$ \emph{embeds} into a group $G$, denoted by $H
\hookrightarrow G$ if there is a one-to-one homomorphism from $H$ to
$G$. In other words $H$ is isomorphic to a subgroup of $G$.
%
\nomclgroups[e]{$H \hookrightarrow G$}{$H$ embeds into $G$\refpage}%
%

Consider a normal subgroup $N$ of $G$. There is a canonical
homomorphism from $G$ to $G/N$ that maps an element $g$ in $G$ to its
coset $Ng$. The canonical homomorphism gives a one-to-one
correspondences between subgroups of $G/N$ and subgroups of $G$
containing $N$.  For a subgroup $L$ of $G/N$, by the \emph{pullback}
of $L$ in $G$ we mean the unique subgroup of $G$ that contains $N$
under this correspondence. More generally suppose $\psi$ is a
homomorphism from $G$ \emph{onto} $H$ then there is a one-to-one
correspondence between subgroups of $G$ containing $\Ker{\psi}$ and
subgroups of $H$ given by $L \mapsto \psi(L)$. The \emph{pullback} of
a subgroup $H^\prime$ of $H$ is the unique $G^\prime$ such that
$\psi(G^\prime) = H^\prime$. \index{pullback}

Let $K$ and $H$ be subgroups of $G$ then the set $KH$ is also a
subgroup if and only if $KH = HK$ and has order given by $\# KH =
\frac{1}{\# K \cap H } .\# K . \# H$.  If in addition $H$ is a normal
subgroup of $KH$ and $K \cap H$ is trivial we say that $KH$ is the
\emph{semidirect product} of $K$ and $H$ which we denote by $K \ltimes
H$. The semidirect product $K \ltimes H$ is the \emph{direct product}
(or just product) $K \times H$ if both $K$ and $H$ are normal subgroup
of $KH$.
%
%
\index{semidirect product} \index{direct product}
\nomclgroups{$G\ltimes H$}{semidirect product of $G$ and $H$\refpage}
\nomclgroups{$G\times H$}{direct product of $G$ and $H$\refpage}
%%

Let $G$ be any group. For a subgroup $H$, a series of groups $G = G_0
> \ldots > G_t = H$ is called a \emph{tower} \index{tower of groups}
of groups between $G$ and $H$. The subgroup $H$ is \emph{subnormal}
\index{subnormal!subgroup} if there exists a \emph{subnormal tower of
  groups} \index{subnormal!tower of groups} between $G$ and $H$, i.e.
a tower of groups $G = G_0 \rhd \ldots \rhd G_t = H$ such that for all
$0 \leq i < t$, $G_{i+1}$ is a normal subgroup of $G_i$. For any group
$G$ the trivial group $\{ 1 \}$ is subnormal and any subnormal tower
of groups between $G$ and $\{ 1 \}$ is called a \emph{subnormal
  series} \index{subnormal!series} for $G$. A \emph{composition
  series} \index{composition series} for $G$ is a subnormal series $G
= G_0 \rhd \ldots \rhd G_t = \{ 1 \}$ such that each of the quotients
$G_i/G_{i+1}$ are simple.

\begin{definition}[Solvable groups]\index{solvable group} A group
  $G$ is said to be solvable if there is a subnormal series $G = G_0
  \rhd \ldots \rhd G_t = \{ 1 \}$ such that for all $ 0 \leq i < t$
  the quotient $G_i/G_{i+1}$ is abelian.
\end{definition}

We now define the class $\Gamma_d$ of groups. The class $\Gamma_d$ is
a generalisation of the class of solvable groups; if $G$ is solvable
then $G$ is in $\Gamma_d$ for any $d$. Computational problems for
groups in $\Gamma_d$ occur in many permutation group theoretic
algorithms for example in Luks' polynomial time algorithm for bounded
degree graphs~\cite{luks82bounded}.

\begin{definition}\index{$\Gamma_d$}%
  A group $G$ is said to be in
  $\Gamma_d$ if there is a subnormal series $G = G_0 \rhd \ldots \rhd
  G_t = \{ 1 \}$ such that for all $0 \leq i < t$ either $G_i/G_{i+1}$
  is abelian or is isomorphic to a subgroup of $S_d$, the group of
  permutations on $d$ objects.
\end{definition}

For $d < 5$, since $S_d$ is solvable, $\Gamma_d$ is just the class of
solvable groups. The $\Gamma_d$-testing, which we will describe in
Chapter~\ref{chap-property-testing}, will use the following closure
properties of the class $\Gamma_d$.

\begin{proposition}\label{prop-gammad-closure}%
  Any subgroup of a group in $\Gamma_d$ is also in $\Gamma_d$. For any
  group $G$ and a normal subgroup $H$, $G$ is in $\Gamma_d$ if and
  only if the groups $G/H$ and $H$ are in $\Gamma_d$.
\end{proposition}

An important subclass of the class of solvable group is the class of
nilpotent groups which we define below.

\begin{definition}[Nilpotent groups]\index{nilpotent groups}%
  A group $G$ is said to be nilpotent if all its Sylow subgroups are
  normal.
\end{definition}

The following lemma gives alternate characterisation of nilpotent
groups (see Section 10.3 of Hall's book~\cite{hall}).

\begin{lemma}\label{lem-nilpotent-equivalent}
  Let $G$ be a finite group then the following are equivalent.
  \begin{enumerate}
  \item $G$ is nilpotent.
  \item $G$ is the product of all its Sylow subgroups.
  \item For every prime $p$ that divides the order of $G$ there is a
    unique $p$-Sylow subgroup.
  \end{enumerate}
\end{lemma}

Let $G$ be a group and $H \unlhd G$ be a normal subgroup of $G$. A
\emph{normal tower} between $G$ and $H$ is a subnormal series $G = G_0
\rhd \ldots \rhd G_t = H$ such that each $G_i$ is normal in $G$. A
\emph{normal series} for $G$ is a normal tower between $G$ and the
trivial normal subgroup $\{ 1 \}$.%
\index{normal!tower}%
\index{normal!series}%

Let $G_1$ and $G_2$ be two isomorphic groups and let $\phi : G_1 \to
G_2$ be an isomorphism. The \emph{diagonal subgroup}%
\index{diagonal subgroup} with respect to $\phi$, denoted by
$\Diag[\phi]{G_1\times G_2}$, is the subgroup $\{ \langle g , \phi(g)
\rangle : g \in G_1 \}$ of $G_1 \times G_2$. Even though the diagonal
group $\Diag[\phi]{G_1 \times G_2}$ depends on the isomorphism $\phi$,
it is isomorphic to $G_1$ (and $G_2$) and hence we will usually drop
the isomorphism $\phi$.
%
\nomclgroups{$\Diag{G_1\times G_2}$}{diagonal subgroup of $G_1 \times
  G_2$\refpage}
%

A group $G$ is said to be \emph{simple} if the only proper normal
subgroup of $G$ is the trivial group.  Let $T$ be a simple group. A
group $G$ is said to be $T$-semisimple if there is a positive integer
$k$ such that $G$ is isomorphic to $T^k$.  An important property of
non-abelian semisimple group which we will use in many occasions is
Scott's lemma~\cite{scott1980representation} (see Luks' course notes
for a proof\cite[page 38]{luks90lecture}).%
\index{semisimple}%
\index{simple}

\begin{lemma}[Scott's Lemma]\label{lem-scott}\index{Scott's Lemma}
  Let $T_1,\ldots,T_k$ be nonabelian finite simple groups. Let $G$ be
  any subgroup of $\prod_{i=1}^r T_i$ that projects \emph{onto} each
  $T_i$.  Then $G$ is a direct product of diagonal subgroups. More
  precisely, there is a partition $\cup_{j=1}^s I_s$ of
  $\{1,\ldots,r\}$ such that
  \[
  G=\prod_{j=1}^s\Diag{\bigtimes_{i\in I_j}T_i}.
  \]
\end{lemma}

The Scott's lemma is valid only for nonabelian simple groups. We give
a counter example to illustrate this. Consider the vector space
$\mathbb{F}_2^3$. Let $W$ be the subspace $\{ (x_1,x_2,x_3)^\mathrm{T}
| x_1 + x_2 + x_3 = 0 \}$. The space $W$ project onto each of the
component $\mathbb{F}_2$ however it is easy to see that $W$ is not a product
of diagonal subgroups.

\section{Permutation Groups}

Let $\Omega$ be a finite set. The \emph{symmetric
  group}\index{symmetric group} $\Sym{\Omega}$ is the group of all
permutations on $\Omega$.  By a \emph{permutation group on $\Omega$}
we mean a subgroup of $\Sym{\Omega}$. By $S_n$ we mean $\Sym{\{
  1,\ldots, n \}}$. For a group $G$ the action $g: a \mapsto ag$ makes
$G$ a permutation group on itself. This action is called the right
\emph{regular action}.  \index{regular action} Similarly the left
regular action is the action $g: a \mapsto ga$.%
\nomclpermg{$\Sym{\Omega}$}{symmetric group on the set $\Omega$}%
\nomclpermg{$S_n$}{$\Sym{\{1,\ldots,n\}}$}

While dealing with permutation groups over $\Omega$ we adopt the
following convention: Lower case Greek letters will be used to denote
elements of $\Omega$ where as upper case Greek letters will be used to
denote subsets of $\Omega$. Lower case Latin letters will be used to
denote elements of $\Sym{\Omega}$ and upper case Latin letters will be
used to denote subsets or subgroups of $\Sym{\Omega}$.

The image of $\alpha \in \Omega$ under the permutation $g \in
\Sym{\Omega}$ will be denoted by $\alpha^g$. The advantage of this
notation is that group action behave similar to exponentiation, i.e.
$(\alpha^g)^h = \alpha^{gh}$. For $A \subseteq \Sym{\Omega}$,
$\alpha^A$ denotes the set $\{ \alpha^g : g \in A\}$.  In particular,
for $G\leq\Sym{\Omega}$ the \emph{$G$-orbit}\index{orbit} containing
$\alpha$ is $\alpha^G$. The $G$-orbits form a partition of $\Omega$.
Given a generating set of $G$, a straight forward transitive closure
algorithm can be used to compute all the orbits (cf.
\cite{luks93permutation}).%
\nomclpermg{$\alpha^g$}{image of $\alpha$ under a permutation $g$}%
\nomclpermg{$\alpha^A$}{the set $\{ \alpha^g | g \in A \}$}

\begin{theorem}\label{thm-compute-orbit}
  Given $G\leq\Sym{\Omega}$ by a generating set $A$ and $\alpha \in
  \Omega$, there is a polynomial-time algorithm to compute $\alpha^G$.
  Moreover for each $\beta \in \alpha^G$ the above mentioned algorithm
  can compute a $g_\beta \in G$ such that $\alpha^{g_\beta} = \beta$.
\end{theorem}

Let $G$ be a permutation group action on $\Omega$.  For $\Delta
\subseteq \Omega$ and $g \in \Sym{\Omega}$, $\Delta^g$ denotes $\{
\alpha^g : \alpha \in \Delta \}$. The \emph{set-wise stabiliser}
\index{stabiliser!setwise} of $\Delta$, i.e. $\{ g \in G : \Delta^g =
\Delta\}$, is denoted by $G_\Delta$. If $\Delta$ is the singleton set
$\{ \alpha \}$ we write $G_\alpha$ instead of $G_{\{\alpha\}}$.  For
any $\Delta$ by $\pr{G}{\Delta}$ we mean $G_\Delta$ restricted to
$\Delta$. For a set $\Delta \subseteq \Omega$ the \emph{pointwise
  stabiliser} \index{stabiliser!point-wise} will be denoted by
$\pointwise{G}{\Delta}$. Notice that $\pointwise{G}{\Omega} = \{ 1 \}$
and $\pointwise{G}{\{ \alpha \}} = G_\alpha$.%
\nomclpermg{$G_\Delta$}{setwise stabiliser of $\Delta$}%
\nomclpermg{$\pointwise{G}{\Delta}$}{pointwise stabiliser of $\Delta$}

An often used result is the orbit-stabiliser formula stated
below~\cite[Theorem 3.2]{wielandt64finite}.

\begin{theorem}[Orbit-Stabiliser formula]\index{Orbit-Stabiliser formula}
  \label{thm-orbit-stab-formula}%
  Let $G$ be a permutation group on $\Sym{\Omega}$ and let $\alpha$ be
  any element of $\Omega$ then the order of the group $G$ is given by
  $\# G = \# G_\alpha . \# \alpha^G$.
\end{theorem}

\section{Strong generator set}
\index{strong generator set|(} % |)

Let $G$ be a group and $H$ be a subgroup of $G$. By a \emph{right
  traversal} of $H$ in $G$ we mean a collection of coset
representatives one from each right coset of $H$ in $G$. Similarly we
can define the left traversal of $H$ in $G$.\index{traversal} Let $G =
G_0 \geq \ldots \geq G_t = \{ 1 \}$ be a decreasing tower of subgroups
of $G$. Let $C_i$ denote the right traversal of $G_i$ in $G_{i-1}$
then the collection $\cup_{i=1}^t C_i$ is a generator set of $G$ which
we call a \emph{strong generator set} of $G$ with respect to the given
tower. The strong generator set depends on the choice of the
traversals $C_i$ at each stage. Also $\# C_i = [G_i : G_{i-1}]$ and
hence the order of $G$ is given by $\prod_{i=1}^t \# C_i$.

We now describe a particularly useful strong generating set for
permutation groups of degree $n$.  Let $G$ be a permutation group over
$\Omega$, a set of cardinality $n$. Without loss of generality we
assume that $\Omega$ is the set $\{ 1 ,\ldots , n\}$. Let $G^{(i)}$ be
the point-wise stabiliser of $\{1,\ldots,i\}$. The tower of groups $G
= G^{(0)} \geq \ldots \geq G^{(n-1)} = \{ 1 \}$ gives rise to a strong
generator set called the Schreier-Sims strong generating set.  For any
permutation group $G \leq S_n$ note that $\# C_i \leq n - i$ and hence
the Schreier-Sims strong generator set is a succinct presentation of
$G$. There are polynomial time algorithm for computing the
Schreier-Sims strong generator set
\cite{sims70computational,sims78some,furst80polynomialtime}.  Many
algorithmic tasks involving permutation groups can be solved once a
strong generator set is computed. We collect some of the useful
computational results in the following theorem.

\begin{theorem}\label{thm-schreiersims}
  Let $G$ a permutation group on $\Omega$ presented by giving a
  generator set of $G$. The following tasks can be done in polynomial
  time.
  \begin{enumerate}
  \item Computing the Schreier-Sims strong generator set.
  \item Computing the order of $G$.
  \item Given $g \in \Sym{\Omega}$ checking whether $g \in G$.
  \item Given a subset $\Delta$ of $\Omega$ compute the pointwise
    stabiliser $\pointwise{G}{\Delta}$.
  \end{enumerate}
\end{theorem}

A detailed treatment of computational issues in permutation groups is
available in the book by Seress~\cite{seress2003permutationalgo}.
\index{strong generator set|)}
\section{Transitivity, Blocks and Primitivity}

A permutation group $G$ on $\Omega$ is
\emph{transitive}\index{transitive} if there is only one $G$-orbit.
Suppose $G \leq \Sym{\Omega}$ is transitive.  Then $\Delta\subseteq
\Omega$ is a \emph{$G$-block}\index{block} if for all $g \in G$ either
$\Delta^g = \Delta$ or $\Delta^g \cap \Delta=\emptyset$.  For every
$G$, $\Omega$ is a block and each singleton $\{\alpha\}$ is a block.
These are the \emph{trivial blocks} of $G$. A transitive group $G$ is
\emph{primitive}\index{primitive} if it has only trivial blocks and it
is \emph{imprimitive}\index{imprimitive} if it has nontrivial blocks.
Examples for primitive groups are $S_n$ and $A_n$. These are the
``giants''.  However the following bound on primitive groups in
$\Gamma_d$ shows that they are small \cite{babai82primitive}.

\begin{theorem}[Babai, Cameron, P\'alfy]%
\index{Babai-Cameron-P\'alfy bound}%
\label{thm-babai-cameron-palfy}
  Let $G \leq S_n$ be a primitive permutation group in $\Gamma_d$.
  Then $\# G \leq n^{O(d)}$.
\end{theorem}

The above mentioned bound is a generalisation of P\'alfy's
bound~\cite{palfy82primitive} on the order of primitive solvable
subgroups of $S_n$ that was used in the Landau-Miller solvability
test~\cite{landau85solvability}. Bounds on sizes of primitive groups
such as Theorem~\ref{thm-babai-cameron-palfy} are important in runtime
analysis of various permutation group theory problems. In particular
our $\Gamma_d$-testing algorithm depends on
Theorem~\ref{thm-babai-cameron-palfy}.

A $G$-block $\Delta$ is a \emph{maximal subblock} of a $G$-block
$\Sigma$ if $\Delta \subset \Sigma$ and there is no $G$-block
$\Upsilon$ such that $\Delta \subset \Upsilon \subset \Omega$. Let
$\Delta$ and $\Sigma$ be two $G$-blocks. A chain $\Delta = \Delta_0
\subset \ldots \subset \Delta_t = \Sigma$ is a \emph{maximal
  increasing chain} of $G$-blocks between $\Delta$ and $\Sigma$ if for
all $i$, $\Delta_i$ is a maximal subblock of $\Delta_{i+1}$.%
%
\index{maximal subblock}%
\index{maximal increasing chain}%

If $\Delta$ is a $G$-block then $\Delta^g$ is also a $G$-block, for
each $g\in G$. Two $G$-blocks $\Delta_1$ and $\Delta_2$ are
\emph{conjugates} (more precisely $G$-conjugates) if there is a $g \in
G$ such that $\Delta_1^g = \Delta_2$. It is not difficult to see that
the conjugate relation on the set of $G$-blocks forms a equivalence
relation.  Let $\Delta$ and $\Sigma$ be two $G$-blocks such that
$\Delta \subseteq \Sigma$.  The \emph{$\Delta$-block system of
  $\Sigma$}, is the collection
\[
\Blocks{\Sigma/\Delta} = \{ \Delta^g : g \in G \textrm{ and } \Delta^g
\subseteq \Sigma \}.%
%
\]%
\nomclpermg{$\Blocks{\Sigma/\Delta}$}{conjugate blocks of $\Delta$ contained in $\Sigma$\refpage}%

The $\Delta$-block system of $\Sigma$ gives a partition of $\Sigma$.
It follows that $\# \Delta$ divides $\# \Sigma$ and by \emph{index} of
$\Delta$ in $\Sigma$,\index{index!of blocks} which we denote by
$[\Sigma:\Delta]$, we mean $\# \Blocks{\Sigma/\Delta} = \frac{\#
  \Sigma}{\# \Delta}$. We will use $\Blocks{\Delta}$ to denote
$\Blocks{\Omega/\Delta}$.%
\index{block system}%
\index{conjugate!blocks}%
\nomclpermg{$[\Sigma:\Delta]$}{index of the block $\Delta$ in
  $\Sigma$\refpage}

Blocks are fundamental structures associated with permutation groups
and have intimate connections with subgroups of $G$. To illustrate
this consider a finite group $G$ as a permutation group on itself
under the right regular action. A subset $H$ of $G$ is a subgroup if
and only if $H$ is a $G$-block containing the identity.  For a
subgroup $H$ of $G$, which is a $G$-block under the right regular
action, any other conjugate block of $H$ is a right coset of $H$.
More generally if $G$ is a transitive permutation group on $\Omega$,
we have the following Galois correspondence between blocks and
subgroups \cite[Theorem 7.5]{wielandt64finite}.%
\index{Galois correspondence!of blocks}

\begin{theorem}[Galois correspondence of blocks]\label{thm-blocks-galois}
  Let $G\leq\Sym{\Omega}$ be transitive and $\alpha\in\Omega$. There
  is a one-to-one correspondence between $G$-blocks containing
  $\alpha$ and subgroups of $G$ containing $G_\alpha$ given by $\Delta
  \rightleftharpoons G_\Delta$.  Also for blocks $\Delta \subseteq
  \Sigma$ we have $[G_\Sigma : G_\Delta] = [\Sigma : \Delta]$.
\end{theorem}
In particular the above theorem implies that $G$ is primitive if and
only if for all $\alpha \in \Omega$, $G_\alpha$ is a maximal proper
subgroup of $G$.

Let $G\leq\Sym{\Omega}$ be transitive and $\Delta$ and $\Sigma$ be two
$G$-blocks such that $\Delta\subseteq \Sigma$. Let
$\Gof{\Sigma/\Delta}$ denote the group $\{ g \in G : \Upsilon^g =
\Upsilon \textrm{ for all } \Upsilon \in \Blocks{\Sigma/\Delta} \}$.
We write $G^\Delta$ for the group $\Gof{\Omega/\Delta}$.  For any $g
\in G_\Sigma$, since $g$ setwise stabilises $\Sigma$, $g$ permutes the
elements of $\Blocks{\Sigma/\Delta}$. Hence for any $\Upsilon \in
\Blocks{\Sigma/\Delta}$ we have $\Upsilon^{g^{-1}\Gof{\Sigma/\Delta}g}
= \Upsilon$. Thus, $\Gof{\Sigma/\Delta}$ is a normal subgroup of
$G_\Sigma$.  In particular, $G^\Delta$ is a normal subgroup of $G$.
The following lemma lists important properties of
$\Gof{\Sigma/\Delta}$.%

\begin{theorem}\label{thm-gsupdelta}\hfill{~}
  \begin{enumerate}
  \item For $G$-blocks $\Delta \subseteq \Sigma$,
    $\Gof{\Sigma/\Delta}$ is the largest normal subgroup of $G_\Sigma$
    contained in $G_\Delta$.

  \item Let $\Sigma$ be $G$-block then $G^{\Sigma} \hookrightarrow
    \prod_{\Upsilon \in \Blocks{\Sigma}} \pr{G}{\Upsilon}$.

  \item Let $\Delta$ be a $G$-subblock of $\Sigma$ then
    $\frac{G_\Sigma}{\Gof{\Sigma/\Delta}}$ is a faithful permutation
    group on $\Blocks{\Sigma/\Delta}$ and is primitive if and only if
    $\Delta$ is a maximal subblock.

  \item The quotient group $G^\Sigma/G^\Delta$ can be embedded into
    the product group
    $\left(\frac{G_\Sigma}{\Gof{\Sigma/\Delta}}\right)^l$ for some
    $l$.

% More precisely the following is a group embedding:
%    \[
%    G^{\Sigma}/G^\Delta \hookrightarrow \prod_{\Upsilon \in
%      \Blocks{\Sigma}}
%    \frac{G_\Upsilon}{\Gof{\Upsilon/\Delta_{\Upsilon}}}.
%    \]
\end{enumerate}
\end{theorem}
\begin{proof}

  Let $N$ be any normal subgroup of $G_\Sigma$ contained in
  $G_\Delta$.  We have for $\Delta^N = \Delta$. Consider any $\Upsilon
  \in \Blocks{\Sigma/\Delta}$. Since $G_\Sigma$ acts transitively on
  $\Blocks{\Sigma/\Delta}$ there is a $g \in G_\Sigma$ such that
  $\Upsilon = \Delta^g$. Since $gN = Ng$ we have $\Upsilon^N =
  \Delta^{gN} = \Delta^{Ng}= \Upsilon$. This proves that for all
  $\Upsilon \in \Blocks{\Sigma/\Delta}$, $\Upsilon^N = \Upsilon$.
  Hence $N$ is contained in $\Gof{\Sigma/\Delta}$. This proves part 1.

  The group $G^\Sigma$ consists of all elements $g$ of $G$ that fixes
  setwise every block $\Upsilon \in \Blocks{\Sigma}$ and hence we have
  the embedding of part 2.

  That $\frac{G_\Sigma}{\Gof{\Sigma/\Delta}}$ acts faithfully on
  $\Blocks{\Sigma/\Delta}$ follows from the fact that for any two $g$
  and $h$ in $G_\Sigma$, $g$ and $h$ has the same action on
  $\Blocks{\Sigma/\Delta}$ if and only if $g\Gof{\Sigma/\Delta}$ and
  $h\Gof{\Sigma/\Delta}$ are equal.  Any nontrivial
  $\frac{G_\Sigma}{\Gof{\Sigma/\Delta}}$-block of
  $\Blocks{\Sigma/\Delta}$ gives a nontrivial $G$-block between
  $\Delta$ and $\Sigma$ and vice versa. Thus,
  $\frac{G_\Sigma}{\Gof{\Sigma/\Delta}}$ is primitive if and only if
  $\Delta$ is a maximal subblock of $\Sigma$.

  Finally for the last statement notice that we have the group
  isomorphism
  \[
  \frac{\pr{G}{\Upsilon}}{\pr{\Gof{\Upsilon/\Delta_{\Upsilon}}}{\Upsilon}}
  \cong \frac{G_\Upsilon}{\Gof{\Upsilon/\Delta_{\Upsilon}}}.
  \]
  Also since $G^\Delta = G^\Sigma \cap \prod
  \pr{\Gof{\Upsilon/\Delta_\Upsilon}}{\Upsilon}$ where $\Upsilon$
  varies over $\Blocks{\Sigma}$ and $\Delta_\Upsilon$ is any conjugate
  of $\Delta$ contained in $\Upsilon$ we have
  \[
  G^\Sigma /G^\Delta \hookrightarrow \prod_{\Upsilon \in
    \Blocks{\Sigma}}
  \frac{\pr{G}{\Upsilon}}{\pr{\Gof{\Upsilon/\Delta_{\Upsilon}}}{\Upsilon}}
  = \prod_{\Upsilon \in \Blocks{\Sigma}}
  \frac{G_\Upsilon}{\Gof{\Upsilon/\Delta_{\Upsilon}}}.\]

  Let $g \in G$ be any element that maps $\Delta$ to
  $\Delta_{\Upsilon}$ then it follows that $G_\Upsilon = g^{-1}
  G_\Sigma g$ and $\Gof{\Upsilon/\Delta_\Upsilon} =
  g^{-1}\Gof{\Sigma/\Delta}g$. Hence the quotient groups
  $\frac{G_\Sigma}{\Gof{\Sigma/\Delta}}$ and
  $\frac{G_\Upsilon}{\Gof{\Upsilon/\Delta_\Upsilon}}$ are isomorphic.
  Thus, we see that $G^\Sigma/G^\Delta$ is isomorphic to a subgroup of
  $\left(\frac{G_\Sigma}{\Gof{\Sigma/\Delta}}\right)^l$ for some $l$.
\end{proof}

\begin{lemma}\label{lem-orbit-normal}
  Let $G\leq\Sym{\Omega}$ be transitive and $N$ be a normal subgroup
  of $G$. Let $\alpha\in\Omega$. Then the $N$-orbit $\alpha^N$ is a
  $G$-block and the collection of $N$-orbits is an $\alpha^N$-block
  system of $\Omega$ under $G$ action. If $N\neq\{ 1 \}$ then
  $\# \alpha^N > 1$. Furthermore, if $G_\alpha\leq N\neq G$ then the
  $\alpha^N$-block system is nontrivial implying that $G$ is not
  primitive.
\end{lemma}
\begin{proof}
  Let $\alpha\in\Omega$ and $g \in G$. Then $(\alpha^N)^g =
  \alpha^{Ng} = \alpha^{gN} = (\alpha^g)^N$. Thus $(\alpha^g)^N$ and
  $\alpha^N$ are identical if $\alpha^g\in\alpha^N$ and disjoint
  otherwise, since they are distinct $N$-orbits. Hence $\alpha^N$ is a
  $G$-block and the orbits of $N$ is an $\alpha^N$-block system of
  $\Omega$ under $G$ action. If $\alpha^N = \{ \alpha \}$ then for all
  $\beta \in \Omega$, $\beta^N = \{ \beta \}$. Thus, $N=\{1\}$.

  Finally, note that by the Orbit-Stabiliser formula $\#
  G=\#\Omega\cdot\# G_\alpha$ and $\# N=\#\alpha^N\cdot\# G_\alpha$.
  Thus, if $\{1\}\neq N\neq G$ then $\alpha^N$ is a proper $G$-block.
  This completes the proof.
\end{proof}

\section{Structure Tree and Structure
  Forest}\label{sect-structure-tree}
An important structure associated with a transitive permutation group
is its structure tree.  Structure trees have proved useful in
analysing various divide and conquer algorithms for permutation groups
(see, e.g.\ \cite{luks93permutation}). Let $G$ transitive permutation
group acting on $\Omega$. Consider a maximal chain of $G$-blocks $\{
\alpha \} = \Delta_0 \subset \ldots \subset \Delta_t = \Omega$. For
each such maximal chain we can associate a structure tree as follows:

\begin{definition}[Structure Tree]\index{structure tree}
  Let $G$ be a transitive permutation group acting on $\Omega$ and let
  $\Omega = \Delta_0 \supset \ldots \supset \Delta_t = \{ \alpha \}$
  be any maximal decreasing chain of $G$-blocks. A structure tree of
  $G$ with respect to this maximal chain is a labelled rooted tree of
  depth $t$ satisfying the following conditions.
  \begin{enumerate}
  \item The root is labelled $\Omega$.
  \item The leaves are labelled with singleton sets $\{ \gamma \}$,
    $\gamma \in \Omega$.
  \item For each node labelled $\Sigma$ at level $i$ the children of
    $\Sigma$ are $\{ \Delta \in \Blocks{\Delta_{i+1}} : \Delta \subset
    \Sigma \}$.
  \end{enumerate}
\end{definition}

We will identify the nodes of the tree with its labels (which are
$G$-blocks).  Any root-to-leaf path $\Omega = \Delta_0 \supset \ldots
\supset \Delta_t = \{ \alpha \}$ in a structure tree is a maximal
decreasing chain of $G$-blocks.  Conversely any maximal decreasing
chain $\Omega = \Delta_0 \supset \ldots \supset \Delta_t = \{ \alpha
\}$ of $G$-blocks gives a structure tree for which it is a
root-to-leaf path.  If two maximal chains $\Omega = \Delta_0 \supset
\ldots \supset \Delta_t = \{ \alpha \}$ and $\Omega = \Sigma_0 \supset
\ldots \supset \Sigma_s = \{ \beta \}$ gives the same structure tree
then $t = s$ and there is a permutation $g \in G$ such that
$\Delta_i^g = \Sigma_i$ for each $i$ (pick any $g$ that maps $\alpha$
to $\beta$). For two nodes $\Delta$ and $\Sigma$ of a structure tree
$T$, $\Sigma$ is an ancestor of $\Delta$ if and only if $\Delta
\subseteq \Sigma$.

Let $G$ be a transitive permutation group on $\Omega$ and let $T$ be
any structure tree of $G$. There is a natural action of $G$ on the
nodes of $T$; a node $\Delta$ under the action of $g\in G$ goes to the
node $\Delta^g$. This action embeds $G$ into the group of
automorphisms of the labelled graph $T$. For any node $\Sigma$ the
subgroup of $G$ that fixes $\Sigma$ is the group $G_\Sigma$ and for
any child $\Delta$ of $\Sigma$ the group $\Gof{\Sigma/\Delta}$ is the
subgroup of $G$ that fixes all the siblings of $\Delta$. It follows
from Theorem~\ref{thm-gsupdelta} that $G$ acts primitively on the
children of the root of $T$.

For intransitive groups $G$ on $\Omega$ instead of a structure tree we
have a \emph{structure forest} \index{structure forest}. Let
$\Omega_1,\ldots,\Omega_k$ be the distinct $G$-orbits then $G$
restricted to $\Omega_i$ is transitive on $\Omega_i$. A structure
forest of $G$ is the collection of structure trees
$\{T_1,\ldots,T_k\}$ where $T_i$ is a structure tree of transitive
group $\pr{G}{\Omega_i}$ on $\Omega_i$. Many permutation group
algorithm uses a divide and conquer strategy by first computing the
orbits and then finding the maximal blocks. The structure forest thus
appear naturally in the analysis of such algorithms.

Given a permutation group $G$ acting on $\Omega$ there is a polynomial
time algorithm to compute a structure tree for $G$. A key step
involved is to compute a minimal $G$-block.  The polynomial time
algorithm for finding the minimal $G$-block follows from the fact that
the smallest block that contains $\alpha$ and $\beta$ is exactly the
connected component of $\alpha$ in the undirected graph $X$ where the
vertex set is $\Omega$ and the edge set is $\{ \{\alpha,\beta\}^g : g
\in G \}$. The graph $X$ can be constructed in polynomial time as it
amounts to finding the orbit of $\{ \alpha, \beta \}$ under the action
of $G$ on the set of unordered pairs of $\Omega$.  To summarise the
above discussion we have the following lemma~\cite[Lemma
1.3]{luks82bounded}

\begin{lemma} Given a permutation group $G$ on $\Omega$ via a
  generating set $A$ and a $G$-orbit $\Omega^\prime$ there is a
  polynomial time algorithm for computing the $G$-block system of
  $\Omega^\prime$ corresponding to a minimal $G$-block.
\end{lemma}
\chapter{The Graph Isomorphism problem}
\label{chap-gi-in-spp}

In this chapter we study the Graph Isomorphism problem
($\ProblemFont{GI}$ for short).  A \emph{graph} $X$ for us is an
undirected graph i.e. a finite set of vertices $V(X)$ and a set $E(X)$
of unordered pairs of elements of $V(X)$.  Two graphs $X_1$ and $X_2$
are isomorphic if there is a one-to-one map $f$ from $V(X_1)$ onto
$V(X_2)$ that preserves the edge relations i.e. for every unordered
pair $\{ u,v \}$, $u,v \in V(X_1)$, $\{u,v\} \in E(X_1)$ if and only
if $\{ f(u),f(v) \} \in E(X_2)$. The function $f$ we will call an
isomorphism between $X_1$ and $X_2$.

\begin{definition}[Graph Isomorphism problem]
  Given two graphs $X_1$ and $X_2$ test whether they are isomorphic.
\end{definition}

The Graph Isomorphism problem is believed to be one of the natural
problems that lie between the complexity classes $\mathrm{P}$ and
$\mathrm{NP}$.  Even though no polynomial time algorithm is know, it
is not expected to be $\mathrm{NP}$-complete. In fact, under
reasonable complexity theoretic assumptions, it appears that the graph
isomorphism problem is unlikely to be $\mathrm{NP}$-complete. It was
shown by Boppana \etal~\cite{boppana87does} that Graph Isomorphism is
not $\mathrm{NP}$-complete unless the polynomial hierarchy collapses
to $\Sigma_2^p$.  They also showed that graph non-isomorphism is in
$\mathrm{AM}$ and hence $\ProblemFont{GI}$ is in $\mathrm{NP} \cap
\textrm{co-}\mathrm{AM}$.  Sch\"oning~\cite{schoning88graph}
generalised the result of Boppana \etal~\cite{boppana87does} and
proved that $\mathrm{NP}\cap \textrm{co-}\mathrm{AM}$ is low for
$\Sigma_2^p$. It then follows that any language in $\mathrm{NP} \cap
\textrm{co-}\mathrm{AM}$ cannot be $\mathrm{NP}$-complete unless the
polynomial hierarchy collapses to $\Sigma_2^p$.  Lowness for
$\mathrm{PP}$ is another property that $\mathrm{NP}$-complete problems
are unlikely to have. It was shown by K\"obler
\etal~\cite{kobler92graph} that $\ProblemFont{GI}$ is in
$\mathrm{LWPP}$ and hence is low for the class $\mathrm{PP}$.  For a
detailed study of the Graph Isomorphism problem {from} a complexity
theoretic perspective see the book of K\"obler \etal~\cite{gi-book}.

%% Organisation of the chapter
The main result of this chapter is the $\mathrm{SPP}$ upper bound for
Graph Isomorphism~\cite{arvind2002graph}. Our result is an improvement
on the $\mathrm{LWPP}$ upper bound of K\"obler
\etal~\cite{kobler92graph}. As mentioned in
Chapter~\ref{chap-complexity-theory} a problem in $\mathrm{SPP}$ (or
$\mathrm{FP}^{\mathrm{SPP}}$) is low for many interesting complexity
classes like $\oplus \mathrm{P}$ for example. Hence our result shows
that $\ProblemFont{GI}$ is low for each of these complexity classes.
Earlier it was not even known whether $\ProblemFont{GI}$ is in $\oplus
\mathrm{P}$.

To prove the $\mathrm{SPP}$ upper bound for $\ProblemFont{GI}$ it is
sufficient to give an $\mathrm{FP}^{\mathrm{SPP}}$ algorithm for
$\ProblemFont{AUT}$. In fact in Section~\ref{sect-findgroup} we show
that a generic permutation group theoretic problem which we will call
$\ProblemFont{FINDGROUP}$ problem, has a $\mathrm{FP}^{\mathrm{SPP}}$
algorithm. Many interesting permutation group problems including
$\ProblemFont{AUT}$ will be special cases of this generic problem.

%\section{Basic definitions}

\section{Group theoretic formulation of Graph Isomorphism problem}
\label{sect-gi-group-formulation}

We now formulate the Graph Isomorphism problem as a group theory
problem. Many important upper bounds for $\ProblemFont{GI}$ were
achieved by making use of this group theoretic formulation. The
polynomial time algorithm for bounded valance
graphs~\cite{luks82bounded} and the fastest known algorithm for
general graphs~\cite{zemlyachenko85gi,babai83canonical} are group
theoretic in nature.

Consider the family of $n$-vertex graph. With out loss of generality
we fix their vertex set to be an $n$ element set $\Omega$, say
$\{1,\ldots,n\}$ for example. Let $\mathcal{G}(\Omega)$ be the set of
graphs with vertex set $\Omega$. The permutations $g \in \Sym{\Omega}$
has a natural induced action on the set of unordered pairs $\Omega
\choose 2$ namely $\{ u, v\}^g = \{u^g, v^g\}$. This natural action
induced action on $\mathcal{G}(\Omega)$; a permutation $g \in
\Sym{\Omega}$ maps the graph $X = (\Omega,E)$ to $X^g = (\Omega,E^g)$.
The Graph Isomorphism problem can be formulated as follows: Given two
graphs $X_1$ and $X_2$ in $\mathcal{G}(\Omega)$ check whether they are
in the same orbit under the $\Sym{\Omega}$ action.

An \emph{automorphism of a graph}\index{automorphism!of a graph} $X$
in $\mathcal{G}(\Omega)$ is an element of $\Sym{\Omega}$ such that
$X^g = X$. The set of all automorphisms of a graph $X$, which we will
denote by $\Aut{X}$, is but the stabiliser subgroup of the point $X$
under $\Sym{\Omega}$ action. We now define the Graph Automorphism
problem, $\ProblemFont{AUT}$ for short, which is closely related to
$\ProblemFont{GI}$.

\begin{definition}[Graph Automorphism problem] Given an undirected
  graph $X$ compute a generator set of $\Aut{X}$ as a permutation
  group on $V(X)$.
\end{definition}

By $\# \ProblemFont{GI}$ we mean the counting problem where given two
graphs $X_1$ and $X_2$ we want to compute the number of isomorphisms
between $X_1$ and $X_2$. Similarly by $\# \ProblemFont{AUT}$ we mean
the counting version of $\ProblemFont{AUT}$, i.e. given a graph $X$
counting the number of automorphisms of $X$.

The problem $\# \ProblemFont{AUT}$ is polynomial time Turing reducible
to $\ProblemFont{AUT}$ as there are polynomial time algorithm for
computing the order of a permutation group given by a generating set.
Let $X_1$ and $X_2$ be isomorphic graphs in $\mathcal{G}(\Omega)$.
Let $g \in \Sym{\Omega}$ be any isomorphism between $X_1$ and $X_2$
then the set of all isomorphism between $X_1$ and $X_2$ is the coset
$\Aut{X_1}g$ and hence $\#\mathrm{Iso}(X_1,X_2) = \# \Aut{X_1} = \#
\Aut{X_2}$. Mathon~\cite{mathon79note} proved that the Graph
Isomorphism problem and Graph Automorphism problem are equivalent
under polynomial time Turing reductions. As a result we have the
following theorem.

\begin{theorem}[Mathon]\label{thm-mathon}
  The computational problems $\ProblemFont{GI}$, $\ProblemFont{AUT}$,
  $\# \ProblemFont{GI}$ and $\# \ProblemFont{AUT}$ are all equivalent
  under polynomial-time Turing reductions.
  % i.e.
  % \[ \# \ProblemFont{GI} \equiv_T^p \# \ProblemFont{AUT} \equiv_T^p
  % \ProblemFont{GI} \equiv_T^p \ProblemFont{AUT}.
  % \]
\end{theorem}

Mathon's result together with Toda's~\cite{toda91pp} theorem gives
another reason to believe that $\ProblemFont{GI}$ is unlikely to be
$\mathrm{NP}$-complete. By Toda's theorem $\mathrm{P}^{\# \mathrm{P}}$
contains the entire polynomial hierarchy. Therefore the counting
problem $\# \ProblemFont{GI}$ is not $\# \mathrm{P}$-complete unless
the polynomial hierarchy collapses to $\Delta_2^p$.  Counting versions
of almost all known $\mathrm{NP}$-complete problems are complete for
$\# \mathrm{P}$.  In fact counting versions of certain problems in
$\mathrm{P}$, like perfect matching, are also complete for $\#
\mathrm{P}$.

\section{Problems related to Graph Isomorphism}

We look at problems that are closely related to $\ProblemFont{GI}$.
Many isomorphism problems of combinatorial structures are closely
connected to the Graph Isomorphism problem.  For a detailed account of
these problems, their complexity and their relation to
$\ProblemFont{GI}$ see the book of K\"obler \etal~\cite[Chapter
1]{gi-book}.

First we consider slight variations of the Graph Isomorphism problem.
A directed graph consists of a finite set of vertices $V$ and a
collection $E \subseteq V \times V$. Isomorphisms of directed graphs
should also preserve the direction of edges, i.e. a bijection $f$ from
$V(X_1)$ to $V(X_2)$ is an isomorphism if for all $u$ and $v$ in
$V(X_1)$ the ordered pair $(u,v) \in E(X_1)$ if and only if
$(f(u),f(v)) \in E(X_2)$. The problem of directed Graph Isomorphism is
to check whether two directed graphs $X_1$ and $X_2$ are isomorphic.
A vertex coloured graph is a graph together with a colouring function,
i.e. a map $\psi : V \to C$ where $C$ is the set of colours. For
coloured graphs $X_1$ and $X_2$ a map $f : V(X_1) \to V(X_2)$ is an
isomorphism if $f$ should preserve the edge relations and also the
colours, i.e. for any $u \in V(X_1)$ both $u$ and $f(u)$ should of the
same colour.  The problem of coloured Graph Isomorphism is to check
whether two coloured graphs are isomorphic.

By attaching suitable graph gadgets one can show that each of these
problems are polynomial time equivalent to $\ProblemFont{GI}$
(see~\cite{miller79graph}).

We now consider the Group Isomorphism problem. We are given a group
$G$ via its multiplication table, i.e. a two dimensional array indexed
by elements of the group $G$ where for each $g$ and $h$ in $G$ the
$(g,h)$th entry is $gh$. The Group Isomorphism problem, {\sc GrpI} for
short, is to check whether two groups presented via their
multiplication table is isomorphic. It turns out that $\textrm{\sc
  GrpI} \leq_m^p \ProblemFont{GI}$ (see~\cite{miller79graph}) however a
reduction in the other direction is not known. If instead of groups we
consider semigroup Isomorphism, {\sc SemiGrpI} we have and equivalence
result, i.e.  $\textrm{\sc SemiGrpI} \equiv_m^p \textrm{\sc
  Gi}$~\cite{booth78isomorphism}.  We now define the Setwise
stabiliser problem {\sc SetStab}.

\begin{definition}[Setwise Stabiliser Problem]
  Given a generator set for a permutation group $G$ over $\Omega$ and
  a subset $\Delta \subseteq \Omega$ compute a generator set for
  $G_\Delta$ the set-wise stabiliser of $\Delta$.
\end{definition}

There is a polynomial time many one reduction from $\ProblemFont{AUT}$
to {\sc SetStab}. To see this consider a graph $X = (V,E)$ consider
the action of $G = \Sym{V}$ on the set $\Omega = {V \choose 2}$ of
unordered pairs of $V$. Then $\Aut{X}$ is nothing but $G_{E}$ (or
$G_{\Omega \setminus E}$). However no reduction is known in the other
direction. The Setwise stabiliser problem seems to be harder than the
Graph Isomorphism problem.

We now define the \emph{hidden subgroup problem}, {\sc Hsp} for short.
Many interesting computational problems for which there are efficient
quantum algorithms are variants of the {\sc Hsp}. This include the
Shor's polynomial time algorithm for integer factoring and discrete
logarithm~\cite{shor97factoring}. Many other group theoretic problems
including $\ProblemFont{AUT}$ can be cast as a Hidden subgroup problem.

For a group $G$ and a set $X$, $\phi : G \to X$ is a \emph{right
  hiding function} for a subgroup $H$ of $G$ if $\phi$ is constant and
distinct on the right cosets of $H$, i.e.  for any $g_1$ and $g_2$ in
$G$, $\phi(g_1) = \phi(g_2)$ if and only if $Hg_1 = Hg_2$.

\begin{definition}[Hidden Subgroup Problem]
  Given a group $G$ by its generator set and a hiding function $\phi:
  G \to X$ for a subgroup $H$ compute a generator set for $H$.
\end{definition}

\section{Computing the lex-least element of a Coset}

Consider a finite totally-ordered set $(\Omega,<)$. The order $<$ on
$\Omega$ induces a natural order, the lexicographic order, on
$\Sym{\Omega}$ as follows: $g < h$ if there is an $\alpha \in \Omega$
such that $\alpha^g < \alpha^h$ and for all $\beta < \alpha$, $\beta^g
= \beta^h$. It is not difficult to see that $<$ is a total order on
$\Sym{\Omega}$ and the least element is $1$. In this section we give a
polynomial time algorithm that computes the least element of $Gg$
given $g$ and a generating set for $G$. This algorithm plays a crucial
role in our $\mathrm{SPP}$ algorithm for $\ProblemFont{FINDGROUP}$.

\begin{theorem}\label{thm-lexleast}
  Given a permutation group $G$ on a totally ordered set $(\Omega,<)$
  via a generator set. Let $g \in \Sym{\Omega}$ be any permutation of
  $\Omega$.  There is a polynomial-time algorithm that computes the
  lexicographically least element of $Gg$.
\end{theorem}

\begin{proof}
  Let $g^*$ be the lex-least element of $Gg$.  Let $\alpha$ be the
  least element of $\Omega$. We first compute the set $\alpha^{Gg}$ in
  polynomial time --- First compute the $G$-orbit $\Sigma = \alpha^G$
  using Theorem~\ref{thm-compute-orbit} and then compute $\Sigma^g$.
  Furthermore we assume that we have actually computed for each $\eta
  \in \alpha^{Gg}$ an element $g_\eta \in Gg$ such that
  $\alpha^{g_\eta} = \eta$.  Let $\beta$ be the least element of
  $\alpha^{Gg}$ then we have $\alpha^{g^*} = \beta$.  Otherwise
  $\alpha^{g_\beta} = \beta < \alpha^{g^*}$ and hence $g_\beta \in Gg$
  is lesser that $g^*$ in the lexicographic order which is a
  contradiction.

  Every element of the coset $G_\alpha g_\beta \subseteq Gg$ maps
  $\alpha$ to $\beta$. Conversely consider any $h \in Gg$ that maps
  $\alpha$ to $\beta$. The elements $hg_\beta^{-1}$ fixes $\alpha$ and
  hence $h \in G_{\alpha}g_\beta$. Therefore $G_\alpha g_\beta$ is
  exactly the set of elements that map $\alpha$ to $\beta$ and hence
  contains $g^*$. We can use the above idea repeatedly as follows: Let
  $G^{(i)}$ be the subgroup of $G$ that fixes pointwise the first $i$
  elements $\alpha_1,\ldots,\alpha_i$ of $\Omega$. By
  Theorem~\ref{thm-schreiersims} we can compute the strong generator
  set of $G$ and hence compute the generator sets of each of the
  groups $G^{(i)}$ in polynomial time.  Starting with $g_0 = g$, for
  $1 \leq i < n$ we compute an element $g_i \in Gg$ such that $g^* \in
  G^{(i)}g_i$. In the $i$th step we compute the least element
  $\beta_i$ in the set $\alpha_i^{G^{(i-1)}g_{i-1}}$ and a permutation
  $h$ that maps $\alpha_i$ to $\beta_i$. The permutation $g_i$ is $h$.
  Since $G^{(n-1)} = \{ 1 \}$, where $n = \# \Omega$, we have $g_{n-1}
  = g^*$.  Algorithm~\ref{algo-lex-least} is the detailed presentation
  of the above discussion.
\end{proof}

%
% Let $\alpha_1 < \ldots < \alpha_n$ be the ordered list of elements
% of $\Omega$. Let $G^{(i)}$ denote the subgroup of that point-wise
% fixes the subset $\{ \alpha_1,\ldots,\alpha_i \}$. Using
% Theorem~\ref{} we can compute a the strong generating set for each
% of the groups $G^{(i)}$. We inductively compute permutations $g_i
% \in \Sym{\Omega}$ such that the lex-least element $g^*$ is contained
% in $G^{(i)}g_i$. To begin with $g_0 = g$. Inductively assume that we
% have computed $g_{i-1}$.  We first compute the set
% $\alpha_i^{G^{(i-1)}g_{i-1}}$ in polynomial time --- First compute
% the set $A = \alpha_i^{G^{(i-1)}}$ using
% Theorem~\ref{thm-compute-orbit} and then compute the set
% $A^{g_{i-1}}$. Let $\beta$ be the least element of
%

\begin{algorithm}[H]
  \caption{Lexicographically least in a Right Coset}
  \label{algo-lex-least}
        %\SetLine
  \KwIn{An ordered set $\Omega$, a generator set for $G \leq
    \Sym{\Omega}$, and a $g \in \Sym{\Omega}$}

  \KwOut{Lexicographically least element in $Gg$}

  Let $\alpha_1 <\ldots < \alpha_n$ be the ordered list of element of
  $\Omega$.

  Let $G^{(i)}$ be the pointwise stabiliser of $\{ \alpha_1, \ldots,
  \alpha_i \}$.

 $g_0 = g$

 \For{ $i = 0$ \KwTo $n-1$} {

   Find the element $\gamma$ in $\alpha_i^{G^{(i)}}$ and $h \in
   G^{(i)}$ such that $\alpha_i^h = \gamma$ and $\beta = \gamma^{g_i}$
   is minimum (Use Theorem~\ref{thm-compute-orbit})\;

  $g_{i+1} = h g_i$

}

\KwRet{$g_n$}
\end{algorithm}

We can easily extend the above result to show the following.

\begin{theorem}
  For an ordered set $\Omega$ there is a polynomial time algorithm
  that on input a generator set for permutation group $G$ on $\Omega$
  and $g_1,g_2 \in \Sym{\Omega}$, computes the lexicographically least
  element of $g_1Gg_2$. In particular there is a polynomial time
  algorithm to compute the lex-least element for a left coset $gG$.
\end{theorem}
\begin{proof}
  Since $g_1Gg_2 = g_1Gg_1^{-1}g_1g_2$ and the lex-least element of
  $g_1Gg_2$ is equal to the lex least element of $Hg^\prime$ where $H
  = g_1Gg_1^{-1}$ and $g^\prime = g_1g_2$. If $A$ is a generator set
  of $G$ then $g_1Ag_1^{-1} = \{ g_1hg_1^{-1} : h \in A \}$ is a
  generator set for $H$. The result then follows from
  Theorem~\ref{thm-lexleast}.
\end{proof}

\section{The {\small FINDGROUP} problem}\label{sect-findgroup}

In this section we study the generic group theoretic problem
$\ProblemFont{FINDGROUP}$. We give an $\mathrm{FP}^{\mathrm{SPP}}$
upper bound for $\ProblemFont{FINDGROUP}$. Many permutation group
theoretic problems $\ProblemFont{AUT}$, {\sc Hsp} and {\sc SetStab}
special cases of $\ProblemFont{FINDGROUP}$. Hence giving an
$\mathrm{FP}^{\mathrm{SPP}}$ bound for $\ProblemFont{FINDGROUP}$ in one
stroke gives $\mathrm{SPP}$ (or $\mathrm{FP}^{\mathrm{SPP}}$) upper
bounds for each of these problems.

We define a generic permutation group problem called
$\ProblemFont{FINDGROUP}$. To each instance $\langle x,0^n \rangle$ of
$\ProblemFont{FINDGROUP}$ there is an associated an unknown subgroup
$G_x\leq S_n$ for which there is polynomial time membership test, i.e.
there is a polynomial-time function $mem(x,g)$ that takes $x$ and
$g\in S_n$ as input and evaluates to {\bf true} if and only if $g\in
G_x$.  The $\ProblemFont{FINDGROUP}$ problem is to compute a
generating set for $G_x$ given $\langle x,0^n \rangle$ as input.  The
rest of the section is devoted to the $\mathrm{FP}^{\mathrm{SPP}}$
upper bound for $\ProblemFont{FINDGROUP}$

Fix an input instance $\langle{x,0^n}\rangle$ be an input instance of
$\ProblemFont{FINDGROUP}$. Our goal is to compute a strong generator
set for $G_x\leq S_n$ using the membership function $mem(.,.)$ as a
subroutine. The input instance being fixed, we will sometimes drop the
subscript and write $G$ instead of the group $G_x$.  Let $G^{(i)} \leq
G$ denote pointwise stabiliser of $\{ 1,\ldots,i \}$. Starting from $i
= n-1$ we compute a strong generator set for $G^{(i)}$ for decreasing
values of $i$. Assuming that we have a generator set for $G^{(i)}$, we
show that a generator set for $G^{(i-1)}$ can be computed in
$\mathrm{FP}^{\mathrm{SPP}}$. We give a polynomial time deterministic
algorithm making $\mathrm{UP}$-like queries to a language $L$ in
$\mathrm{NP}$ which we now define.  Consider the $\mathrm{NP}$-machine
$M$ defined in Algorithm~\ref{alg-L} and let $L$ be the language
accepted by $M$.

\begin{algorithm}
  \caption{The $\mathrm{NP}$ machine for $A$}\label{alg-L}
  % \SetLine

  \SetKw{Kwand}{and}

  \KwIn{$ x\in \{0,1\}^*$, an integer $0 \leq i \leq n$, a subset $S
    \subseteq S_n$ and a partial permutation $\pi$}

  Verify using the membership test $mem(.)$ that $S \subseteq G^{(i)}$

  \lnl{step-guess-g}%
  Guess $g \in G^{(i-1)}$ i.e. guess $g \in S_n$ and verify using
  $mem(.)$.

  Let $H$ be the group generated by $S$.

  Use Theorem~\ref{thm-lexleast} to compute the lexicographically
  least element $g^*$ of $Hg$.

  \lnl{step-check-lexleast}%
  \lIf{$g \neq g^*$}{\KwSty{Reject}.}

  \lnl{step-checking-pi}%
  \lIf{$g^*$ extends $\pi$}{\KwSty{Accept}. }

  \lElse{\KwSty{Reject}.}
\end{algorithm}

Here by a partial permutation we mean a partial function one-to-one
function {from} $\{1,\ldots,n\}$ to itself. Let the $G^{(i-1)}$-orbit
of $i$ be $\{ i_1,\ldots,i_k \}$.  The set $\{ g_1,\ldots,g_k \}$
where $g_s \in G^{(i-1)}$ is any permutation that maps $i$ to $i_s$
forms a right traversal of $G^{(i)}$ in $G^{(i-1)}$.  Let $g_s^*$
denote the lexicographically least element in the coset $G^{(i)}g_s$.
We have the following proposition for the language $L$

\begin{proposition}\label{prop-property-M}
  Let $S$ be a generator set for the group $G^{(i)}$. Consider a
  partial permutation $\pi$ whose domain includes $\{ 1,\ldots,i\}$.
  Then the tuple $\langle x,i,S,\pi\rangle \in L$ if and only if $\pi$
  maps $i$ to $i_s$ and agrees with $g_s^*$ for some $s$.  For such an
  input, the machine $M$ has only one accepting path.
\end{proposition}
\begin{proof}
  The nondeterminism in the definition of $M$ is due to
  step~\ref{step-guess-g} of Algorithm~\ref{alg-L} where we guess an
  element $g$ of $G^{(i-1)}$. Since $g \in G^{(i-1)}$, $i^g = i_s$ for
  some $s$. If $S$ generates $G^{(i)}$ then only the path that guessed
  $g_s^*$ survives (on all other paths step~\ref{step-check-lexleast}
  rejects). Furthermore, if $\langle x,i,S,\pi\rangle \in L$ then
  $\pi$ agrees with $g_s^*$ as well (we verified this in
  step~\ref{step-checking-pi}). The proposition follows. More
  generally if $S$ generates a subgroup $H$ of $G^{(i)}$ then the
  number of accepting paths on such a partial permutation $\pi$ will
  be the index $[G^{(i)}: H]$.
\end{proof}

We are ready to give the $\mathrm{FP}^{\mathrm{SPP}}$ algorithm for
$\ProblemFont{FINDGROUP}$. To begin with we already know $G^{(n-1)}$.
Assume that a generating set $D_i$ of $G^{(i)}$ is known. {From} $D_i$
we will compute a right traversal $C_i$ of $G^{(i)}$ in $G^{(i-1)}$
using the language $L$ as oracle. The base algorithm will be a
deterministic polynomial time algorithm that makes $\mathrm{UP}$-like
queries to $L$, i.e. for all queries that the machine makes to $L$ the
$\mathrm{NP}$-machine of $M$ described in Algorithm~\ref{alg-L} will
have at most one accepting path.  To begin with we have a generating
set $D_{n-1} = \{ 1 \}$ of $G^{(n-1)}$. The complete algorithm is give
below.

\SetKwFunction{PrefixSearch}{prefixSearch}
\begin{algorithm}[H]
%  \SetLine
   \SetKw{KwDownTo}{down to}
   \SetKw{Function}{function}

   \caption{$\mathrm{FP}^L$ algorithm {\small
       FINDGROUP}}\label{alg-findgroup}

   $C_i \leftarrow \emptyset$ for every $0 \leq i \leq n-2$.

   $D_i \leftarrow \emptyset$ for every $0 \leq i \leq n-2$.

   $D_{n-1}=1$

   \lnl{step-main-loop}
   \For{$i = n - 1$ \KwDownTo $1$}
   {

     Let $\pi_i$ be the partial permutation that fixes all elements
     from $1$ to $i-1$.

     \lnl{loop-over-j}
     \For{ $j = i+1$ \KwTo $n$}
     {

       $\pi' \leftarrow \pi[i := j]$.

      \lnl{step-main-query}%
      \If{$\langle{x,D_i,i,\pi'}\rangle \in L$}
       {

         $C_i \leftarrow C_i \cup g$ where $g$ =
         \PrefixSearch{$x,D_i,i,\pi^\prime$}.
       }
     }

     $D_{i-1} \leftarrow D_i \cup C_i$.

   }

   \KwResult{$D_0$.}

   \Function{} \PrefixSearch{$x,D_i,i,\sigma$}

   \Begin{
     \For{$k \leftarrow i+1$ \KwTo $n$}
     {

       \lnl{step-prefix-query}%
       Find the element $l$ not in the range of $\pi'$ such that
       $\langle x,0^n,D_{i},i,j,\pi'[ k := l] \rangle \in L$ by making
       queries to $L$.

       $\sigma := \sigma[ k := l ]$.%

     }%

     \KwRet{$\sigma$}.
   }
\end{algorithm}

By $\pi[l:=m]$ we mean the partial permutation $\sigma$ that agrees
with $\pi$ except at $l$ where its value is $m$.  The function
\PrefixSearch{$x,i,D_i,\pi^\prime$} completes the partial permutation
$\pi^\prime$ to an appropriate $g_s^*$ using $L$ as an oracle.

\begin{proposition}\label{prop-spp}
  The Algorithm~\ref{alg-findgroup} computes the generator set for $G$
  and for all queries made to $L$ the machine $M$ described in
  Algorithm~\ref{alg-L} has at most one accepting path.
\end{proposition}
\begin{proof}
  The invariant of the loop~\ref{step-main-loop} is that $D_i$
  generates the subgroup $G^{(i)}$. In the beginning of the loop the
  invariant is true.  Since inductively we have made sure that $D_i$
  generates $G^{(i)}$ by Proposition~\ref{prop-property-M} there is
  at most one accepting path for any queries made, whether in
  step~\ref{step-main-query} or in step~\ref{step-prefix-query}.
  Hence the polynomial time oracle machine makes only
  $\mathrm{UP}$-like query to $L$ whether in the main loop or in the
  subroutine \PrefixSearch{}.

  Proposition~\ref{prop-property-M} also guarantees that the query in
  step~\ref{step-main-query} gives a ``yes'' answer if and only if $j$
  is in the orbit $i^{G^{(i-1)}}$. When $j$ is indeed in the orbit
  $i^{G^{(i-1)}}$ then \PrefixSearch{}, by making queries to $L$,
  returns the lexicographically least element in the coset $G^{(i)}g$
  where $g$ is some permutation in $G^{(i-1)}$ that maps $i$ to $j$.
  Since we cycle through all $i < j \leq n$ in the
  loop~\ref{loop-over-j}, $C_{i}$ will be a right traversal of
  $G^{(i)}$ in $G^{(i-1)}$ at the end of loop~\ref{loop-over-j}.  As
  $D_{i-1} = D_i \cup C_i$ the loop invariant of
  loop~\ref{step-main-loop} is maintained.  Finally when $i = 0$,
  $D_0$ is the generator set for $G$.
\end{proof}

The following theorem is a direct consequence of
Proposition~\ref{prop-spp} and Theorem~\ref{thm-uplike-spp}.

\begin{theorem}\label{thm-findgroup}
  The $\ProblemFont{FINDGROUP}$ problem is in
  $\mathrm{FP}^\mathrm{SPP}$.
\end{theorem}

\section{The complexity of Graph Isomorphism}

We now give $\mathrm{SPP}$ upper bound for the Graph Isomorphism.
Since $\ProblemFont{GI} \equiv_T^p \ProblemFont{AUT}$ it follows from
the closure properties of $\mathrm{SPP}$ that it is sufficient to give
an $\mathrm{FP}^{\mathrm{SPP}}$ algorithm for $\ProblemFont{AUT}$. We
show that $\ProblemFont{AUT}$ is a special case of the
$\ProblemFont{FINDGROUP}$ problem. Without loss of generality assume
that the vertex set of the graph is $\{1,\ldots,n\}$. Assume a
suitable encoding of graphs say via adjacency matrix.  For encodings
$x$ of $n$ vertex graph $X$ let $G_x$ be the automorphism subgroup of
$X$. There is a polynomial time membership test for $G_x$ as given the
encoding $x$ of a graph $X$, there is a polynomial time algorithm to
test whether a given permutation $g \in S_n$ is an automorphism of
$X$. Hence $\ProblemFont{AUT}$ is a special case of
$\ProblemFont{FINDGROUP}$.

Similarly given permutation group $G$ over $\Omega$ and a subset
$\Sigma$ of $\Omega$ there is a polynomial time membership test for
elements of $G_\Sigma$. Hence the {\sc SetStab} problem is a special
case of $\ProblemFont{FINDGROUP}$. For the hidden subgroup problem the
hiding function $\phi$ gives a membership test: $h \in H$ if and only
if $\phi(h) = \phi(1)$.  Using Theorem~\ref{thm-findgroup} we have the
main result of this chapter.

\begin{theorem}
  The Graph Isomorphism problem, the hidden subgroup problem over
  permutation groups, the set-wise stabiliser problem etc. are in
  $\mathrm{SPP}$ (or $\mathrm{FP}^{\mathrm{SPP}}$ in the case of
  functional problems).
\end{theorem}

\section{Discussion}

We have shown that the Graph Isomorphism problem is in the complexity
class $\mathrm{SPP}$. We proved this by shown that given a graph $X$,
a generator set for $\Aut{X}$ can be computed by a polynomial time
deterministic machine making $\mathrm{UP}$-like queries to an
$\mathrm{NP}$ language. It is still open whether the Graph Isomorphism
problem is in $\mathrm{UP}$.

An approach to Graph Isomorphism is via Graph Canonisation. A function
$f$ from $\mathcal{G}(\Omega)$ to $\mathcal{G}(\Omega)$ is a
\emph{canonising function} on graphs if it satisfies the following
properties: (1) for all $X \in \mathcal{G}(\Omega)$ $f(X)$ is
isomorphic to $X$ and (2) graphs $X$ and $Y$ in $\mathcal{G}(\Omega)$
are isomorphic if and only if $f(X) = f(Y)$. Intuitively $f$ pick a
\emph{canonical} element from each equivalence class. It is not
difficult to see that testing for isomorphism reduces to canonisation.
In fact the asymptotically fastest
algorithm~\cite{zemlyachenko85gi,babai83canonical} for Graph
Isomorphism is through Graph Canonisation. However the best known
complexity theoretic upper bound for Graph canonisation is
$\mathrm{FP}^{\mathrm{NP}}$. It would be interesting to show better
upper bounds for this problem.
\chapter{Bounded colour multiplicity Graph Isomorphism problem}
\label{chap-bcgi}

In this chapter we study the \emph{bounded colour multiplicity Graph
  Isomorphism} problem, a restricted version of vertex coloured Graph
Isomorphism problem. For a finite set $C$ of \emph{colours}, a
$C$-coloured graph \index{coloured graph} is a triple $X = (V,E,\psi)$
where $V$ is the set of vertices, $E \subseteq {V \choose 2}$ is the
set of edges and $\psi : V \to C$ is the colouring that assigns to
each vertex $v \in V$ a \emph{colour} $\psi(v) \in C$.  An isomorphism
$f$ between two $C$-coloured graphs $X_1 = (V_1,E_1,\psi_1)$ and $X_2=
(V_2,E_2,\psi_2)$ if it exists, is an isomorphism from the graph
$(V_1,E_1)$ to graph $(V_2,E_2)$ that preserves the colours, i.e. for
all $u \in V_1$, $\psi_1(u) = \psi_2(f(u))$.  The Coloured Graph
Isomorphism problem, for short, is to check whether two vertex
coloured graphs $X_1$ and $X_2$ are isomorphic.  Note that
$\ProblemFont{GI}$ is the special case of $\ProblemFont{CGI}$ where
every vertex has the same colour. On the other hand using suitable
graph gadgets $\ProblemFont{CGI}$ is reducible to $\ProblemFont{GI}$
(details can be found in~\cite{gi-book}).

We now define a restricted version of $\ProblemFont{CGI}$, the bounded
colour multiplicity Graph Isomorphism problem or $\ProblemFont{BCGI}$
for short.  The colouring map $\psi$ induces an equivalence relation
on $V$; $u \sim_\psi v$ if $\psi(u) = \psi(v)$. A \emph{colour class}
is an equivalence class under this equivalence relation.  For a colour
$c \in C$, the \emph{$c$-colour class} of $X$ is the equivalence class
$\{ v \in V : \psi (v) = c \}$. \index{colour class}

\begin{definition}[$\ProblemFont{BCGI}_b$]
  Given two $C$-coloured graphs $X_1$ and $X_2$ such that the size of
  each colour class of $X_i$, $i =1,2$, is bounded by a constant $b$,
  check whether $X_1 \cong X_2$.
\end{definition}

One of the first versions of Graph Isomorphism problem that was
studied using group theoretic methods is the $\ProblemFont{BCGI}$
problem. Babai gave a randomised polynomial time algorithm for
$\ProblemFont{BCGI}_b$ for each constant $b$~\cite{babai79montecarlo}.
This was improved to a deterministic polynomial time algorithm by
Furst \etal~\cite{furst80polynomialtime}.  Subsequently,
Luks~\cite{luks86parallel} gave a remarkable $\mathrm{NC}$ algorithm.
% for $\ProblemFont{BCGI}_b$.

Recently Tor\'an~\cite{toran2004hardness} has proved various hardness
results for Graph Isomorphism. In particular, he proved that
$\ProblemFont{BCGI}_b$ is $\mathrm{AC}^0$-many one hard for the
logspace counting class $\ModkL{k}$ for each constant $k$. A key step
in the hardness proofs is the construction of certain graph gadgets
that enables the simulation of addition modulo $k$. In fact, these
graph gadgets can be used to prove that $\ProblemFont{BCGI}$ is hard
for the entire $\ModkL{k}$
hierarchy~\cite[Appendix]{arvind2005bounded}.

In this chapter we prove that $\ProblemFont{BCGI}_b$ is in the
$\ModkL{k}$ hierarchy, where the constant $k$ and the level of the
hierarchy depends on $b$~\cite{arvind2005bounded}. Together with the
hardness for the $\ModkL{k}$-hierarchy, we have a fairly tight
classification.  Though not explicitly mentioned, it appears that
Luks' $\mathrm{NC}$-algorithm puts $\ProblemFont{BCGI}_b$ in
$\mathrm{NC}^k$ where the constant $k$ depends on $b$ (Luks solves a
more general problem and as a consequence derives the $\mathrm{NC}$
algorithm for $\ProblemFont{BCGI}_b$).  Since the $\ModkL{k}$
hierarchy is contained in $\mathrm{NC}^2$ (even $\mathrm{TC}^1$) our
result is an improvement on Luks' result.

We first prove that there is a logspace Turing reduction from
$\ProblemFont{BCGI}_b$ to the pointwise stabiliser problem
$\ProblemFont{PWS}_c$ (definition in Section~\ref{sect-pws}) for some
constant $c$ that depends only on $b$. In this sequel we often say
that a function $f$ can be computed in the $\ModkL{k}$-hierarchy if
there is a logspace bounded oracle machine $M^A$ that computes $f$ for
some language $A$ in the $\ModkL{k}$-hierarchy. We prove in this
chapter that $\ProblemFont{PWS}_c$ is in the $\ModkL{k}$ hierarchy
where $k$ is the product of all primes less than $c$. This would imply
that $\ProblemFont{BCGI}_b$ is the $\ModkL{k}$ hierarchy as
$\ProblemFont{BCGI}_b \leq_{T}^{\log} \ProblemFont{PWS}_c$.  We now
define the problem $\ProblemFont{PWS}_c$ and give an outline of the
$\ModkL{k}$ algorithm for it.

\section{The Pointwise stabiliser problem}\label{sect-pws}

Given a permutation group $G$ on $\Omega$ and a set $\Delta \subseteq
\Omega$, recall that the pointwise stabiliser of $\Delta$,
$\pointwise{G}{\Delta}$, is the subgroup $\{ g \in G : \delta^g =
\delta \textrm{ for all }\delta \in \Delta \}$. As opposed to the
setwise stabiliser, the pointwise stabiliser can be computed in
polynomial time (using Theorem~\ref{thm-schreiersims} for example).
However in this chapter we are interested in a restricted version
where $G$-orbits are of bounded size which we show is in the
$\ModkL{k}$-hierarchy.  The polynomial time algorithm for the general
case that uses Theorem~\ref{thm-schreiersims} does not help us here
because it is sequential.

\begin{definition}[$\ProblemFont{PWS}_c$]
  Let $G$ be a permutation group on $\Omega$ such that each $G$-orbit
  is of cardinality at most $c$. Given a subset $\Delta \subseteq
  \Omega$ compute $\pointwise{G}{\Delta}$.
\end{definition}

%We now give a brief sketch of the reduction from $\ProblemFont{BCGI}_b$
%to $\ProblemFont{PWS}_c$~\cite[Section 7]{luks86parallel}.

Recall the permutation group theoretic formulation of the Graph
Isomorphism problem from Section~\ref{sect-gi-group-formulation}. We
generalise this to coloured graphs in a straight forward manner: Let
$\mathcal{CG}(\Omega,C)$ denote the set of $C$-coloured graphs with
vertex set $\Omega$. As before there is a natural action of the group
$\Sym{\Omega}$ on $\mathcal{CG}(\Omega,C)$: The graph $(V,E,\psi)$
goes to $(V,E^g,\psi^g)$ where $\psi^g$ is the map $u \mapsto
\psi(u^{g^{-1}})$. For a $C$-coloured graph $X \in
\mathcal{CG}(\Omega,C)$, the automorphism subgroup $\Aut{X}$ is the
stabiliser of the point $X$ under this action. It is easy to verify
that the set of $C$-coloured graphs in $\mathcal{CG}(\Omega,C)$
isomorphic to $X$ is exactly the $\Sym{\Omega}$-orbit containing $X$.
If $X$ and $Y$ are two isomorphic coloured graphs in
$\mathcal{CG}(\Omega,C)$ and $g \in \Sym{\Omega}$ be such that $X^g =
Y$ then, as before, the set of all isomorphisms between $X$ and $Y$
are exactly $\Aut{X}g$.

\begin{definition}[$\ProblemFont{AUT}_b$]
  Given a $C$-coloured graph $X$ such that each colour class is of
  cardinality bounded by $b$ compute a generator set for $\Aut{X}$ as
  a subgroup of $\Sym{V(X)}$.
\end{definition}

Mathon's result (Theorem~\ref{thm-mathon}) generalises to coloured
graphs as well and it can be show that the coloured graph isomorphism
problem is logspace Turing reducible to coloured automorphism problem.
In particular there is a logspace Turing reduction from
$\ProblemFont{BCGI}_b$ to $\ProblemFont{AUT}_{2b}$.  To show that
$\ProblemFont{BCGI}_b$ reduces to $\ProblemFont{PWS}_c$ for some
constant $c$ that depends on $b$ it is therefore sufficient to give a
logspace Turing reduction {from} $\ProblemFont{AUT}_b$ to
$\ProblemFont{PWS}_c$. We sketch the logspace reduction~\cite[Section
7]{luks86parallel}\footnote{Luks gives a $\mathrm{NC}$-reduction but
  for a more general version.}.

Consider an instance $X = (V,E,\psi)$ in $\mathcal{CG}(V,C)$ of
$\ProblemFont{AUT}_b$. Recall that the colouring $\psi$ of $X$
partitions the vertex set $V$ into disjoint colour classes
$V_1,\ldots,V_m$ and for each $i$, $\# V_i \leq b$.  Consider the
group $G = \prod \Sym{V_i}$ acting on $V$. For $1 \leq i \leq j \leq
m$ define the sets $\Omega_{ij} = 2^{V_{ij}}$, where $V_{ij}$ denotes
collection of all unordered pairs $\{ u , v\}$, $u \in V_i$ and $v \in
V_j$. The elements of set $\Omega_{ij}$ are subsets of unordered pairs
$\{ u,v\}$, $u \in V_i$ and $v \in V_j$. In particular consider the
collection $E_{ij}$ defined as follows
\[
E_{ij} = \{ \{ u,v\} \in E : u \in V_i\textrm{ and }v \in V_j \}.
\]
The subsets $E_{ij}$ are points of $\Omega_{ij}$.  Define $\Omega =
\cup \Omega_{ij}$. We have $\# \Omega_{ij} \leq 2^{b^2}$ and $\#
\Omega \leq m^2 .  2^{b^2}$.  The action of $G$ on $V(X)$ extends
naturally to $\Omega$ and hence $G$ is a permutation group on
$\Omega$. If $\Delta = \{ E_{ij} : 1 \leq i \leq j \leq m \}$ then the
pointwise stabiliser of $\Delta \subseteq \Omega$,
$\pointwise{G}{\Delta}$, is the group $\Aut{X}$.  Furthermore $G$ maps
a point in $\Omega_{ij}$ to another point in $\Omega_{ij}$ and hence
$G$-orbits are of size bounded by $c = 2^{b^2}$. Given the instance $X
= (V,E,\psi)$ of $\ProblemFont{AUT}_b$, a generator set of $G$ as a
permutation group on $\Omega$ can be computed in $\mathrm{FL}$.  Hence
the following proposition.

\begin{proposition}\label{prop-red-aut-pws}
  There is a logspace reduction from $\ProblemFont{AUT}_b$ to
  $\ProblemFont{PWS}_c$ where $c \leq 2^{b^2}$. Hence if for all
  constants $c$ there is a constant $k$ that depends only on $c$ such
  that $\ProblemFont{PWS}_c$ is in the $\ModkL{k}$-hierarchy then for
  all constants $b$ there is a constant $k'$ that depends only on $b$
  such that $\ProblemFont{BCGI}_b$ and $\ProblemFont{AUT}_b$ are in
  the $\ModkL{k'}$-hierarchy.
\end{proposition}

In the rest of the chapter we prove that $\ProblemFont{PWS}_c$ is in
the $\ModkL{k}$-hierarchy. We give an outline of the strategy.  The
key step in our algorithm is what we call ``target reduction''.  Given
an instance $(G,\Omega,\Delta)$ of $\ProblemFont{PWS}_c$ we compute a
subgroup $G'$ of $G$ such that
\begin{enumerate}
\item $G \geq G' \geq \pointwise{G}{\Delta}$.
\item For every $G$-orbit $\Sigma$ containing a point of $\Delta$,
  $\pr{G'}{\Sigma}$ is a proper subgroup of $\pr{G}{\Sigma}$.
\end{enumerate}
We prove that target reduction can be performed in the
$\ModkL{k}$-hierarchy where $k$ is the product of all primes less than
$c$.

We now argue that the target reduction procedure can be used to
compute the pointwise stabiliser. Starting with $G$, by applying the
target reduction procedure compute a subgroup $G'$ which is strictly
smaller than $G$ on each of the orbits that contain points of
$\Delta$.  Since $G \geq G' \geq \pointwise{G}{\Delta}$,
$\pointwise{G}{\Delta} = \pointwise{G'}{\Delta}$. Moreover for each
$G$-orbit $\Sigma$ such that $\Sigma \cap \Delta \neq \emptyset$, the
projection $\pr{G'}{\Sigma}$ is a proper subgroup of $\pr{G}{\Sigma}$
and hence $\# \pr{G'}{\Sigma} \leq \frac{1}{2} \# \pr{G}{\Sigma}$.  We
then repeat the target reduction procedure with $G$ replaced by $G'$.
Since $G$-orbits are of size bounded by a constant $c$, after
$O(c.\log{c})$ iterations of the target reduction step we converge to
$\pointwise{G}{\Delta}$. Thus if the target reduction step in in the
$l$th level of the $\ModkL{k}$-hierarchy then $\ProblemFont{PWS}_c$
can be solved in the $l.c.\log{c}$ level of the $\ModkL{k}$-hierarchy.
The detailed description of the target reduction procedure is given in
Section~\ref{sect-target-reduction}.

For the target reduction procedure we require a special strong
generating set for $G$. We consider a special normal series $G = N_0
\rhd \ldots \rhd N_l = 1$ of length $l$ bounded by a constant that
depends only on $c$ such that each of the quotient group $N_i/N_{i+1}$
is $T_i$-semisimple for some simple group $T_i$. Using this normal
series we compute a strong generator set $C$ of $G$. The computation
of the strong generator set $C$ proceeds in $l$ stages. Each of this
stage involves solving a certain normal closure problem for which we
give a $\mathrm{FL}^{\ModkL{k}}$ algorithm. The detailed procedure for
computing the strong generator set $C$ is described in
Section~\ref{sect-generalised-sgs}.

For computing the strong generator set $C$ and for the target
reduction procedure we require some more group theory. The two
important group theoretic concepts we require is (1) the socle and (2)
residual series of a group.  The normal series $G = N_0 \unrhd \ldots
\unrhd N_l = 1$ which is used to compute the strong generator set $C$
is obtained by patching up the residue series of each of the constant
sized groups $G_i$. The target reduction procedure makes use of the
O'Nan-Scott theorem (Theorem~\ref{thm-onan-scott}), a result on the
structure of socles of primitive permutation groups.  In the next two
sections we develop the group theory required for this chapter.

\section{Characteristic subgroups and Socles}

In this section we develop some more group theory relevant for this
chapter.  Most of the group theory that we require, albeit in a
slightly different form, is developed by Luks~\cite{luks86parallel}
for his $\mathrm{NC}$-algorithm.

\begin{definition}[Characteristic subgroup] \index{characteristic
    subgroup} A subgroup $H$ of a finite group $G$ is a
  \emph{characteristic subgroup} if all automorphisms of $G$ maps $H$
  to itself.
\end{definition}

In this context, notice that a normal subgroup of $G$ is a subgroup
that is invariant under inner automorphisms of $G$ whereas a
characteristic subgroup is invariant under all automorphisms. Hence
characteristic subgroups are normal subgroups.  For a characteristic
subgroup $R$ of $G$, the restriction of any $G$-automorphism to $R$ is
an $R$-automorphism. The following proposition directly follows from
the above discussion.

\begin{proposition}\label{prop-char-subgroup}\hfil
  \begin{enumerate}
  \item If $R_1$ is a characteristic subgroup of $G$ and $R_2$ is a
    characteristic subgroup of $R_1$ then $R_2$ is also a
    characteristic subgroup of $G$.
  \item If $R_1$ and $R_2$ be characteristic subgroups of $G$ then so
    is $R_1R_2$ and $R_1 \cap R_2$.
  \item Let $R_1$ and $R_2$ be normal subgroups of $G$ such that
    $R_1\cap R_2 = \{ 1 \}$. If $R_1 R_2$ and $R_1$ are characteristic
    subgroups of $G$ then so is $R_2$.
  \end{enumerate}
\end{proposition}

The entire group $G$ and the trivial subgroup $\{ 1 \}$ are
characteristic subgroups of $G$. The centre $\Cent[G]{G}$ of $G$, the
subgroup of elements of $G$ that commute with all elements of $G$, is
also a characteristic subgroup of $G$.

Let $G$ be a nontrivial finite group. By a \emph{minimal normal
  subgroup} of $G$ we mean a normal subgroup $N \unlhd G$ different
from $\{ 1 \}$ which is minimal in the containment order, i.e. there
is no proper subgroup of $N$ other than $\{ 1 \}$ that is normal in
$G$. For a simple group $T$, the only minimal normal subgroup is $T$
itself. We now state an important lemma about minimal normal subgroups
of a group $G$ (\cite[Theorem 4.3A]{dixon91permutationbook}).

\begin{lemma}\label{lem-min-normal}
  Let $G$ be any group and let $K$ be a minimal normal subgroup of
  $G$. Then $K = T_1 \times \ldots \times T_n$ where $T_i$'s are all
  isomorphic to a simple group $T$ (i.e. $K$ is $T$ semisimple).
  Moreover for any $i$ and $j$ there is an element $g \in G$ such that
  $T_i = g^{-1} T_j g$.
\end{lemma}

Having defined the minimal normal subgroup we define the \emph{socle}
of a group $G$, an important characteristic subgroup of $G$.

\begin{definition}[Socle]
  \index{socle}\nomclgroups{$\Soc{G}$}{Socle of $G$\refpage} For a
  finite group $G$ the \emph{socle} $\Soc{G}$ is the subgroup
  generated by the set of all minimal normal subgroups of $G$.
\end{definition}

Clearly any automorphism of $G$ maps minimal normal subgroups to
minimal normal subgroups and hence fixes the socle. Therefore
$\Soc{G}$ is a characteristic subgroup of $G$.  We now state a
restricted version of the O'Nan-Scott theorem, a theorem on the
structure of socles of primitive permutation groups, suitable for our
purposes. A complete statement of the theorem (Theorem 4.1A of
\cite{dixon91permutationbook}), its proof and its applications to the
study of permutation groups can be found in Chapter 4 of the book by
Dixon and Mortimer~\cite{dixon91permutationbook}.

\begin{theorem}[O'Nan-Scott theorem]\index{O'Nan-Scott
    theorem}\label{thm-onan-scott}
  Let $G$ be a primitive permutation group on $\Omega$ with socle
  $\Soc{G} = K$.  Then $K$ is transitive and $T$-semisimple for some
  simple group $T$. Furthermore exactly one of the following is true
  for $K$.
  \begin{enumerate}
  \item $K$ is abelian in which case $K$ is elementary abelian and
    regular on $\Omega$. Also $K$ is the unique minimal normal
    subgroup of $G$. For an $\alpha \in \Omega$, the group $K_\alpha$
    is the trivial group $\{ 1 \}$.\label{case-onan-abelian}
  \item $K$ is nonabelian and is the unique minimal normal subgroup of
    $G$. For $\alpha \in \Omega$, $K_\alpha$ is a proper subgroup of
    $K$.\label{case-onan-nonab1}
  \item $K$ is nonabelian and is a product $K = K_1 \times K_2$, where
    $K_1$ and $K_2$ are isomorphic. The subgroups $K_1$ and $K_2$ are
    the only minimal normal subgroups of $G$ and each $K_i$ is regular
    on $\Omega$. Furthermore the centraliser of $K_1$ in $G$,
    $\Cent[G]{K_1}$, is $K_2$ and vice-versa. For $\alpha \in \Omega$,
    $K_\alpha$ is a diagonal subgroup of $K_1 \times K_2$.
    \label{case-onan-nonab2}
  \end{enumerate}
\end{theorem}

\section{Residues and Residual Series}

In the previous section we studied an important characteristic
subgroup, the socle. Let $G$ be a finite group. For any simple group
$T$, we associate a characteristic subgroup of $G$ called its
$T$-residue.

\begin{definition}[Residue subgroup]\index{residue subgroup}
  Let $T$ be a finite simple group. For a group $G$ we say that the
  normal subgroup $N$ is a $T$-residue of $G$ if $G/N$ is
  $T$-semisimple and for all $H \unlhd G$ contained in $N$, $G/H$ is
  $T$-semisimple if and only if $H = N$.
\end{definition}

To prove that $T$-residues are unique, we require the following two
lemmas on normal subgroups of semisimple groups.

\begin{lemma}\label{lem-factor-semisimple}
  Let $G$ be a semisimple group with a normal subgroup $H$.  Then $G =
  L \times H$ for some normal subgroup $L$ of $G$. Moreover $G/H$ is
  also semisimple.
\end{lemma}
\begin{proof}
  Let $G$ be $T$-semisimple. Depending on whether $T$ is abelian or
  not we have two cases.

\paragraph{$T$ is abelian} In this case $T = \mathbb{F}_p$ for some
prime $p$. The group $G$ is therefore a vector $V$ over
$\mathbb{F}_p$. The subgroup $H$ corresponds to a subspace $W$ of $V$.
We can decompose $V$ as the direct sum $V = W \oplus W'$. The required
group $L$ is the subspace $W'$. Clearly $G/H$ is isomorphic to the
subspace $L$ and is hence $\mathbb{F}_p$-semisimple.

\paragraph{$T$ is nonabelian}
Let $G = T_1 \times \ldots \times T_k$ where each $T_i$ is isomorphic
to $T$. Firstly the projection $H_i$ of $H$ on any of the group $T_i$
is either trivial or the full group $T_i$. Otherwise $H_i$ will be a
nontrivial normal subgroup of $T_i$ which contradicts the fact that
$T_i$ is simple. Thus we assume, with out loss of generality, that
there is an integer $l \leq k$ such that $H$ projects onto each of the
group $T_i$ for $1 \leq i \leq l$ and is trivial on $T_j$ for $l < j
\leq k$.  By Scott's Lemma $H$ is a product of diagonals of the groups
$\{ T_i \}_{1 \leq i \leq l}$.  Consider any two indices $i,j \leq l$.
Any diagonal group $\Diag{T_i \times T_j}$ is not a normal subgroup of
$T_i \times T_j$. To see this consider an element $\langle a ,
\psi(a)\rangle \in \Diag[\psi]{T_1\times T_2}$ for some isomorphism
$\psi : T_i \to T_j$.  Let $b$ be any element of $T_i$ that does not
commute with $a$ then $\langle 1, \psi(b) \rangle^{-1} \langle a
,\psi(a) \rangle \langle 1,\psi(b) \rangle = \langle a , \psi(b^{-1} a
b) \rangle \not \in \Diag[\psi]{T_i \times T_j}$.  Therefore $H$ is
exactly the subgroup $T_1\times \ldots \times T_l$.  The required
group $L$ is $T_{l+1} \times \ldots \times T_k$.  Clearly $G/H = L$ is
$T$-semisimple.
\end{proof}

The next lemma follows directly from Lemma~\ref{lem-factor-semisimple}
(consider the semisimple group $G/N$ and its normal subgroup $H/N$).

\begin{lemma}\label{lem-factor-semisimple-general}
  Let $G$ be any group with a normal subgroup $N$ such that $G/N$ is
  semisimple. Let $H$ be any subgroup of $G$ containing $N$.  Then
  there is a normal subgroup $L$ of $G$ containing $N$ such that $G =
  LH$ and $L \cap H = N$.
\end{lemma}

We now prove that for any simple group $T$, the $T$-residue is unique.
This a slightly weaker version of Lemma~{6.2} stated in
Luks~\cite{luks86parallel} and is sufficient for our purpose. The
proof of the more general version~\cite[Lemma 6.2]{luks86parallel} is
along similar lines.

\begin{lemma}[Luks]
\label{lem-unique-residue}
Let $G$ be any finite group. For any simple group $T$ there is a
unique $T$ residue, i.e. there is a normal subgroup $N$ of $G$ such
that $G/N$ is $T$-semisimple and for any $H \unlhd G$ such that $G/H$
is $T$-semisimple, $H$ contains $N$.
\end{lemma}
\begin{proof}
  The proof is via induction on the order of $G$. Firstly, if $G$
  itself is $T$-semisimple then lemma is clearly true; the unique
  $T$-residue is $\{ 1 \}$. This is the base case of our induction.

  We assume the assertion to be true for all groups of order less than
  $k$. Consider a group $G$ of order $k$.  If possible, let $N_1$ and
  $N_2$ be two distinct $T$-residues of $G$. Let $H = N_1 \cap N_2$
  and $N = N_1N_2$. From the minimality of $N_i$'s it follows that $H$
  is a strict subgroup of $N_i$ for $i= 1,2$.  We have two
  cases.\\

  \noindent{\it Case 1 ($H \neq \{ 1 \}$):} In this case $G/H$ is a
  group of smaller cardinality than $G$ and hence, by induction
  hypothesis, has a unique $T$-residue $L/H$ for some normal subgroup
  $L$ of $G$ containing $H$. Since $N_i/H \unlhd G/H$ and
  $\frac{G/H}{N_i/H} \cong G/N_i$ is $T$-semisimple, $N_i/H$ contains
  $L/H$. Therefore $N_i$ contains $L$ for $i = 1,2$.  Therefore $L
  \subseteq N_1 \cap N_2 = H$ and since $L$ contains $H$, $L = H$.
  However $G/L \cong \frac{G/H}{L/H}$ and hence is
  $T$-semisimple.  This contradicts the minimality of $N_i$'s.\\

  \noindent{\it Case 2 ($H = \{ 1 \}$):} We prove that in this case
  $G$ itself is $T$-semisimple. Firstly, $N = N_1 N_2 = N_1 \times
  N_2$. Hence the subgroup $N_1$ is isomorphic to $N_1 N_2/N_2$ and
  since $N_1N_2/N_2 \unlhd G/N_2$, is itself $T$-semisimple
  (Lemma~\ref{lem-factor-semisimple}).

  Consider the group $G$ with normal subgroup $N_2$. The quotient
  group $G/N_2$ is $T$-semisimple and $N$ is a normal subgroup of $G$
  containing $N_2$.  Using Lemma~\ref{lem-factor-semisimple-general}
  we have a normal subgroup $L$ of $G$ such that $L \cap N = N_2$ and
  $G = L N$. Since $N = N_1 \times N_2$ and $L \geq N_2$ it follows
  that $G = L N_1$. But $L \cap N_1 = \{ 1 \}$ and hence $G = L \times
  N_1$.

  Having proved that $G = N_1 \times L$ it is easy to see that $L$
  itself is $T$-semisimple.  This is because $L$ is isomorphic to
  $G/N_1$ which is $T$-semisimple. Hence $G = N_1 \times L$ is
  $T$-semisimple. This however contradicts the minimality of $N_1$ and
  $N_2$ as the unique $T$-residue of $G$ is $\{ 1 \}$.
\end{proof}

In view of Lemma~\ref{lem-unique-residue}, we use $\Residue[T]{G}$ to
denote the unique $T$-residue of $G$. %
%%
\nomclgroups{$\Residue[T]{G}$}{for simple group $T$ the $T$-residue of
  $G$\refpage}%
%%
For any simple group $T$ since the $T$-residue of $G$ is unique, any
$G$-automorphism has to map $\Residue[T]{G}$ to itself. Hence
$\Residue[T]{G}$ is a characteristic subgroup of $G$.  Based on
residues, we can define an important normal series called the
\emph{residual} series.

\begin{definition}[Residual series]\index{residual series}
  A \emph{residual series} of $G$ is a series $G = R_0 \unrhd \ldots
  \unrhd R_l = \{ 1 \}$ where for all $1 \leq i \leq l$, $R_i =
  \Residue[T_i]{R_{i-1}}$ for some simple group $T_i$.
\end{definition}

In fact from Proposition~\ref{prop-char-subgroup} it follows that the
residual series is a series of characteristic subgroups.  We now prove
an important property of residual series of primitive permutation
group due to Luks~\cite[Lemma 6.3]{luks86parallel}.

\begin{lemma}[Luks]\label{lem-smallest}
  Let $G$ be a primitive permutation group acting on $\Omega$ and let
  $G = R_0 \rhd \ldots \rhd R_t = \{ 1 \}$ be any residual series then
  the last nontrivial subgroup in the series, is the socle of $G$.
\end{lemma}
\begin{proof}
  We assume that $t>1$ for otherwise $G$ itself is $T$-semisimple,
  hence is its own socle and we are through.

  Let $S$ be the socle of $G$.  The group $G$ being primitive, it
  follows from the O'Nan-Scott theorem that the socle $S$ and hence
  all the minimal normal subgroups of $G$ are $T$-semisimple for some
  simple group $T$.

  First let us suppose that $R_{t-1}$ does not contain $S$.  Since
  $R_{t-1}$ is a normal subgroup of $G$ there is a minimal normal
  subgroup $K$ of $G$ that is contained in $R_{t-1}$. This rules out
  cases~\ref{case-onan-abelian} and \ref{case-onan-nonab1} of the
  O'Nan-Scott theorem as in those cases $G$ has a unique normal
  subgroup which is also the socle $S$.  Thus $G$ has exactly two
  minimal normal subgroups $K_1$ and $K_2$, $S = K_1 \times K_2$ and
  $R_{t-1}$ contains one of them say $K_1$.  Let $s$ be the largest
  index $i$ such that $R_i$ contains $S$. Clearly $s < t - 1$ and
  $R_{s+1} \geq R_{t-1} \neq 1$.  Moreover $R_{s+1}$ contains $K_1$
  but not $K_2$.

  The group $R_s/R_{s+1}$ is semisimple and $R_{s+1}S$ is a normal
  subgroup of $R_s$ containing $R_{s+1}$. Therefore by
  Lemma~\ref{lem-factor-semisimple-general} we have a subgroup $L$ of
  $R_s$ such that $R_s = L R_{s+1} S$ and $L \cap R_{s+1}S = R_{s+1}$.
  However since $L$ contains $R_{s+1} $ and hence $K_1$ it follows
  that $R_s = L K_2$.  Furthermore $L \cap K_2 = 1$. Thus $R_s = L
  \times K_2$ and every element of $L$ commutes with $K_2$. This is
  possible only if $L = K_1$ as by the O'Nan-Scott theorem
  $\Cent[G]{K_2} = K_1$.

  For a $T$-semisimple group $G$, $\Residue[T']{G}$ is either $1$ or
  the whole of $G$ depending on whether $T'= T$ or not.  We have
  proved that if $R_{t-1}$ does not contain the socle $S$ then $R_s =
  S$ which is $T$-semisimple by the O'Nan-Scott theorem. Since
  $R_{s+1}$ is a proper subgroup of $R_s$ it follows that $R_{s+1} =
  \Residue[T]{R_s} = 1$. This however contradicts the fact that
  $R_{s+1} \geq R_{t-1} \neq 1$. Hence $R_{t-1}$ contains the socle
  $S$.

  Having proved that $R_{t-1}$ contains $S$ it is easy to see that
  $R_{t-1}$ is indeed the socle. The group $R_{t-1}$ being
  $T$-semisimple there is a subgroup $L$ of $R$ such that $L \times S
  = R_{t-1}$ (Lemma~\ref{lem-factor-semisimple}). It follows from
  Proposition~\ref{prop-char-subgroup} that $L$ is a characteristic
  subgroup of $G$. This is not possible unless $L$ is the trivial
  group otherwise there is a minimal normal subgroup $K$ of $G$
  contained in $L$ and $K \leq S \cap L $.

\end{proof}

\section{Strong generator set revisited}\label{sect-generalised-sgs}
\index{strong generator set|(}%|)

Recall that for every decreasing tower of groups $G = G_0 \geq \ldots
\geq G_t = \{ 1 \}$ we can associate a generator set called the strong
generator set. We now generalise this to relative strong generator
set. Let $H$ be a subgroup of $G$ and let $G = G_0 \geq \ldots \geq
G_t = H$ be a decreasing sequence of groups from $G$ to $H$. Let $C_i$
denote the coset representatives of $G_i$ in $G_{i-1}$. Then the set
$C = \cup C_i$ is called a \emph{strong generator set} of $G$
\emph{relative} to $H$, SGS of $G$ rel $H$ for short.  For any element
$g \in G$ there is a unique $h$ in $H$ such that $g = g_1\ldots g_t h$
where $g_i \in C_i$. By sift of $g$ with respect to the strong
generator set $C$ we mean this $h$. We will use $\Sift{g}$ to denote
the sift of $g$ with respect the strong generator set $C$. The sift of
an element is not unique and depends on the choice of the coset
representatives $C_i$.  \index{strong generator set} \index{sift}
\nomclgroups{\Sift{g}}{The sift of $g$\refpage}

A \emph{semisimple series}\index{semisimple!series} from $G$ to a
normal subgroup $N$ is a normal series $G = N_0 \unrhd \ldots \unrhd
N_t = N$ where the quotient groups $N_i/N_{i+1}$ are $T_i$-semisimple
for simple groups $T_i$.  We associate a strong generator set for such
a series. Let the quotient group $N_i/N_{i+1}$ be $\prod_{j} T_{ij}$
where each $T_{ij}$ is isomorphic to $T_i$.  Consider a normal series
(normal in $N_i$) given by $N_i = N_{i,0} \rhd \ldots \rhd N_{i,n_i} =
N_{i+1}$ where $N_{i,s}/N_{i+1}$ is the  group $\prod_{j>s}
T_{ij}$. Let $C_{ij}$ be the right (or left) traversal of $N_{i,j}$
over $N_{i,j+1}$. Then $C = \cup_{i,j} C_{i,j}$ forms a strong
generator set for $G$ rel $N$ with respect to the subnormal series $\{
N_{i,j} \}$.

% Any $g \in G$ can be expressed uniquely as the product
% \[
% g = \biggl(\prod_{i} \prod_j x_{ij}\biggr) x
% \] where each $x_{ij} \in C_{ij}$ and $x \in N$.  The collection
% $C_{ij}$ forms a strong generator set of $G$ relative to $N$. To see
% this The set $C_{ij}$ is a traversal of $N_{i,j}$ in $N_{i,j+1}$.
% Hence $C = \cup_{ij} C_{ij}$ is a strong generator set of $G$
% relative to $N$.

We are interested in permutation group $G$ over $\Omega$ with bounded
orbits. The simple groups $\{ T_i \}_{0 \leq i < t}$ that occur will
all be of order bounded by a constant and the semisimple series which
we construct for $G$ will be of bounded length.  Furthermore, the
computation of strong generator set $C$ is done inductively by
computing the strong generator set of $G$ relative to $N_i$ starting
with $i = 0$. The fact that the series $\{ N_i \}_{i=1}^t$ is of
bounded length is important for the $\ModkL{k}$-hierarchy upper bound.
Hence in this context it is more natural to associate the semisimple
series $\{ N_i\}_{i=1}^t$ to the strong generator set $C$ than the
subnormal series $\{ N_{i,j}\}$.

We now prove a property analogues to Proposition 3.2 of Luks and
McKenzie~\cite{luks88solvable}.

\begin{proposition}\label{prop-sift}
  Given a group $G$ via a generator set $A$.  Let $G = N_0 \unrhd
  \ldots \unrhd N_t = N$ be a semisimple series from $G$ to $N$ and
  let $C = \cup_{ij}C_{ij}$ be the associated strong generator set of
  $G$ relative to $N$.  Let $S$ be the set containing the following
  elements:
\begin{enumerate}
  \item $\Sift{g}$ for all $g \in A$.
  \item \label{pro-commutator}$\Sift{x^{-1}yx}$ for all $x \in
    C_{ij}$ and $y \in C_{lm}$, $(i,j) < (l,m)$.
  \item \label{pro-product} $\Sift{xy}$ for all $x,y \in C_{ij}$ for
    all $i$ and $j$.
\end{enumerate}
Then the normal closure $\NCL[G]{S}$ of $S$ in $G$ is $N$.
\end{proposition}
\begin{proof}
  The proof is similar to that of Proposition 3.2 of Luks and
  McKenzie~\cite{luks88solvable}. The set $S$ is clearly a subset of
  $N$ and since $N$ is a normal subgroup of $G$ we have $\NCL[G]{S}
  \unlhd N$. To prove the converse consider any element $h \in N$.
  There exists elements $y_1,\ldots,y_m$ in $A$ such that $h =
  y_1\ldots y_l$. For ease of notation we assume that $l =2$ and $h
  = xy$ for $x,y \in A$.  The general case is similar. Since $S$
  contains the sifts of all the elements of $A$ there exists
  $x_{ij}\in C_{ij}$ and $y_{lm} \in C_{lm}$ such that $x =
  \prod_{i,j} x_{ij} s_1$ and $y = \prod_{lm}y_{ij} s_2$ where $s_1$
  and $s_2$ are elements of $S$ and hence $\NCL[G]{S}$. Hence $h$ is
  given by
  \begin{equation}\label{eq-ncl-proof}
    h = \biggl(\prod_{ij} x_{ij}\biggr)s_1 \biggl(\prod_{lm}
    y_{lm}\biggr)s_2.
  \end{equation}
  We prove that $h$ can be written as $\prod_{ij} z_{ij} s$ where $s
  \in \NCL[G]{S}$.  The first task is to push down $s_1$ to the end.
  For any $y \in G$ since $\NCL[G]{S}$ is normal subgroup of $G$ we
  have $y \NCL[G]{S} = \NCL[G]{S}y$ and therefore whenever we have a
  product of the form $h = \ldots s y \ldots$, $s \in \NCL[G]{S}$ and
  $y \in C$, we can replace it with $h = \ldots y s^* \ldots$ for some
  $s^* \in \NCL[G]{S}$.

  For products of the form $h = \ldots y x \ldots$ where $x \in
  C_{ij}$ and $y \in C_{lm}$ with $(i,j) < (l,m)$, since $S$ contains
  $\Sift{x^{-1}yx}$ we can rewrite it as
  \begin{equation} \label{eq-rule1} h = \ldots y x \ldots = \ldots x
    \Biggl(\prod_{(r,t)>(i,j)} u_{rt}\Biggr) s \ldots\textrm{, }
    u_{rt} \in C_{rt}.
  \end{equation}
  Similarly when $h = \ldots xy \ldots$ where $x,y \in C_{ij}$, since
  $S$ contains $\Sift{xy}$ we can rewrite $h$ as
  \begin{equation}\label{eq-rule2}
    h = \ldots x y \ldots = \ldots z \Biggl(\prod_{r>i}\prod_t
    u_{rt}\Biggr) s \ldots.\textrm{, }
    u_{rt} \in C_{rt}.
  \end{equation}
  By repeatedly rewriting the expression of $h$ in
  Eq.~\ref{eq-ncl-proof} using Eqs.~\ref{eq-rule1} and \ref{eq-rule2},
  we have $h = (\prod_{i} \prod_j z_{ij}) s$ for some $s \in
  \NCL[G]{S}$.  However since $h$ is in $N$, we have $z_{ij} = 1$ for
  all $i$ and $j$. Therefore $h = s$ and hence $h \in \NCL[G]{S}$.
\end{proof}
\index{strong generator set|)}

\subsection{Computing the strong generator set}%
\label{subsect-compute-sgs}

We are give a generator set $A$ for a permutation group $G$ on
$\Omega$ with orbits of size bounded by a constant $c$. We will find
the strong generator set for $G$ with respect to a semisimple series
of length bounded by a constant that depends only on $c$.  The
semisimple series which we consider is similar to the residual series
of $G$.

Consider a permutation group $G$ on $\Omega$ with orbits $\Omega_1,
\ldots, \Omega_m$ all of size bounded by an constant $c$.  Let $G_i$'s
be the projection of $G$ onto $\Omega_i$, Then $G_i$'s are all of
order bounded by $c!$ as $\# \Omega \leq c$. Let $\mathcal{T} = \{
T_1,\ldots,T_k\}$ be the collection of all simple groups of order at
most $c!$ then $k = \# \mathcal{T}$ is a constant for us that depends
only on $c$. For $1 \leq i \leq m$ define a $k$ length normal series
$G_i = R_{i,0} \unrhd \ldots \unrhd R_{i,k}$ where $R_{i,s} =
\Residue[T_s]{R_{i,s-1}}$. The group $R_{i,k}$ is a proper subgroup of
$G_i$ as there exists a normal subgroup $H_i$ of $G_i$ such that
$G_i/H_i$ is simple and isomorphic to some $T_s$.  Repeat this process
starting with $R_{i,k}$ in place of $G_i$. We would have to repeat
this at most $c . \log{c}$ times before we hit the trivial group $\{ 1
\}$. Thus, for each $1 \leq i \leq m$, we have a residual series $G_i
= R_{i,0} \unrhd \ldots \unrhd R_{i,l} = \{ 1 \}$ where the constant
$l$ depends only on $c$. Let $R_s$ denote the product group $R_s =
\prod_i R_{i,s}$ then $R_0 \unrhd \ldots \unrhd R_l$ is a residual
series for the product group $\prod_i G_i$.  Since for $1 \leq i \leq
m$ the group $G_i$ is of order less that $c!$ in $\mathrm{FL}$ we
compute the groups $R_{i,s}$ and hence the product groups $R_s$ for
each $1 \leq s \leq l$.

Let $N_s \unlhd G$ be the normal subgroup $G \cap R_s$ then $G = N_0
\unrhd \ldots \unrhd N_l = \{ 1 \}$ is a semisimple series for $G$ as
$N_i/N_{i+1} = (G\cap R_i)/(G \cap R_{i+1}) \hookrightarrow
R_i/R_{i+1}$ via the map $x N_{i+1} \mapsto x R_{i+1}$. We prove the
following important property due to Luks~\cite[Lemma
6.4]{luks86parallel}.

\begin{proposition}[Luks]\label{prop-local-residual}
  Let $H \leq \Sym{\Omega}$ be any subgroup of the product $\prod_i
  G_i$. For all $i$, if $\pr{H}{\Omega_i} = G_i$ then $\pr{H \cap
    R_s}{\Omega_i} = R_{i,s}$, $1 \leq s \leq l$.
\end{proposition}
\begin{proof}
  Let $\psi$ denote the homomorphism that restricts an element of the
  product group $R_0 = \prod_i G_i$ to its action on $\Omega_i$.  Fix
  an $s$. Let $L$ and $M$ be the groups $H \cap R_s$ and $H \cap
  R_{s+1}$ respectively. The groups $\pr{H \cap R_s}{\Omega_i}$ and
  $\pr{H \cap R_{s+1}}{\Omega_i}$ are $\psi(L)$ and $\psi(M)$
  respectively.

  First we prove that $\psi(M)$ is a normal subgroup of $\psi(L)$ and
  the quotient group $\psi(L)/\psi(M)$ is $T$-semisimple.  As $L \leq
  R_s$ and $M = L \cap R_{s+1}$ the map $gM \mapsto g R_{s+1}$ is an
  embedding of $L/M$ into $R_s/R_{s+1}$.  The quotient group $L/M$ is
  thus $T$-semisimple. Let $K$ be the kernel of the map $\psi$ in $L$.
  Consider the normal subgroup $MK$ of $L$. Since $\psi$ maps $K$ to
  $1$ it follows that $\psi(M) = \psi(MK)$. However $MK$ is a normal
  subgroup of $L$ containing $K$ and hence $\psi(MK) = \psi(M)$ is a
  normal subgroup of $\psi(L)$. The quotient group $\psi(L)/\psi(M)$
  is thus $\frac{L/K}{MK/K} = L/MK$. However $L \unrhd MK \unrhd M$ is
  a normal series with $L/M$ being $T$-semisimple. The group $MK /M$
  is a normal subgroup of the semisimple group $L/M$.  Hence by
  Lemma~\ref{lem-factor-semisimple} $L/MK \cong \frac{L/M}{MK/M}$ is
  also $T$-semisimple. We have thus proved that $\psi(M)$ is a normal
  subgroup of $\psi(L)$ and the quotient group $\psi(L)/\psi(M)$ is
  $T$-semisimple. If $\psi(L)$ is $R_{i,s}$ then this is impossible
  unless $\psi(M)$ is $R_{i,s+1}$.  Let $\psi(H) =\psi(H \cap R_1) =
  G_i = R_{i,0}$. Assume that $\psi(H \cap R_s) = R_{i,s}$ for some
  $s$. Then we have just proved that $\psi(H \cap R_{s+1}) =
  R_{i,s+1}$. Now repeat the argument with $s$ replaced by $s+1$. As
  result we have $\psi(H \cap R_j) = R_{i,j+1}$ for all $1 \leq j \leq
  l$. This completes the proof.
\end{proof}

In particular, Proposition~\ref{prop-local-residual} proves that for
all $s$, $\pr{N_s}{\Omega_i}$ is $R_{i,s}$. Thus for any $G$-orbit
$\Sigma$, $\pr{G}{\Sigma} = \pr{N_0}{\Sigma} \unrhd \ldots \unrhd
\pr{N_l}{\Sigma}$ is a residual series for $G_i$. Hence we call this
series a \emph{locally residual}\index{locally residual series}
series.  We show that a strong generator set for $G$ with respect to
this locally residual generator set can be computed in the
$\ModkL{k}$-hierarchy. A property which we use repeatedly is the
following:

\begin{proposition}\label{prop-append-sgs}
  Let $N$ and $K$ be two normal subgroups of $G$ such that $N \geq K$.
  Let $C$ and $D$ be the strong generator set of $G$ relative to $N$
  and $N$ relative to $K$ respectively. Then $C \cup D$ gives a strong
  generator set of $G$ relative to $K$.
\end{proposition}

Firstly, since each of the groups $G_i$ are constant sized, the
residual series $G_i = R_{i,0} \unrhd \ldots \unrhd R_{i,l} = \{ 1 \}$
for each $G_i$ can be computed separately in logspace.  We prove by
induction on $i$ that an SGS $A_i$ of $G$ rel $N_i$ can be computed in
the $i$th level of the $\ModkL{k}$-hierarchy where $k$ is the product
of all primes less that $c$. In addition, we prove inductively that
given $g \in G$, $\Sift{g}$ with respect to $A_i$ can also be computed
in $i$th level of the $\ModkL{k}$-hierarchy.  This sifting procedure
is required for our induction step.

To begin with we know the strong generator set of $G$ relative to
$N_0$.  Assuming we have already computed the strong generator set
$A_i$ of $G$ relative to $N_i$. Using the sifting procedure for $A_i$
as an oracle, we compute a set $S$ such that $\NCL[G]{S} = N_i$
(Proposition~\ref{prop-sift}). To complete the induction we give
$\mathrm{FL}^{\ModkL{k}}$ algorithms for the following.
\begin{enumerate}
\item[(1)] Given $S$ and the SGS of $G$ rel $N_s$ compute the strong
  generator set $C$ of $N_s$ rel $N_{s+1}$.
\item[(2)] Given $x \in N_s$ compute $\Sift{x}$ with respect to the SGS
  $C$.
\end{enumerate}

Depending on whether $N_s/N_{s+1}$ is abelian or not we have two
cases. If $N_s/N_{s+1}$ is abelian then it is
$\mathbb{F}_p$-semisimple for some prime $p$. We prove that in this
case both (1) and (2) can be done in $\mathrm{FL}^{\ModkL{p}}$.  On
the other hand when $N_s/N_{s+1}$ is non-abelian we prove that both
(1) and (2) can be done in $\mathrm{FL}$.

\subsubsection{Computing the strong generating set: nonabelian case}

Let $L_i$ and $M_i$ denote the group $R_{i,s}$ and $R_{i,s+1}$
respectively. Let $L$ and $M$ be the product groups $R_s = \prod_{i
  =1}^m L_i$ and $R_{s+1} = \prod_{i = 1}^m M_i$. Then $N_s$ and
$N_{s+1}$ are the $G \cap L$ and $G \cap M$ respectively. Our task is
to compute the strong generator set of $N_s$ rel $N_{s+1}$ for which
we give an $\mathrm{FL}$ algorithm.

The group $L/M$ is $T$-semisimple as each $L_i/M_i$ is $T$-semisimple.
Consequently, $L/M$ is of the form $T_1 \times \ldots \times T_r$
where $T_i \cong T$ for all $1 \leq i \leq r$.  The quotient group
$N_s/N_{s+1}$ can be faithfully embedded into $\prod_{i=1}^m L_i/M_i$
via the map $x N_s \mapsto x M$ and hence can be seen as a subgroup of
$L/M$. Furthermore since $N_s$ projects onto $L_i$ for $1 \leq i \leq
m$ (Proposition~\ref{prop-local-residual}), by Scott's Lemma we know
that $N_s/N_{s+1}$ is a product of diagonal groups of $T_1 \times
\ldots \times T_r$, i.e.  there is a partition $\mathcal{I} = \{ I_1,
\ldots, I_s \}$ of indices $\{ 1, \ldots, r\}$ such that
\[
 N_s/N_{s+1} = \prod_{i = 1}^s \mathrm{Diag}\biggl( \prod_{j \in I_i}
T_j \biggr).
\]

Let $\phi_i : L \mapsto T_i$ be the homomorphism obtained by composing
the natural quotient homomorphism {from} $L$ to $L/M$ and the
projection map to $T_i$. Fix an index $i_j \in I_j$ for each $I_j$.
Since $\phi_i$ restricted to $N_s$ is onto (because $N_s$ projects
onto $L_i$) for each $x \in T_{i_j}$ one can associate a permutation
$x^*$ in $N_s$ such that $\phi_{i_j}(x^*) = x$ and for all $i$ not in
$I_j$, $\phi_i(x^*)$ is identity.  Let $B_j$ be the set of such $x^*$
one for each $x \in T_{i_j}$. The set $\cup_j B_j$ gives strong
generator set of $N_s$ rel $N_{s+1}$. We will show that this strong
generator set for $N_s$ rel $N_{s+1}$ can be computed in
$\mathrm{FL}$. To this end we prove that the following can be computed
in $\mathrm{FL}$.
\begin{enumerate}
\item The partition $\mathcal{I}$.
\item The collection of sets $\{B_j\}_j$
\item Sifts of $g \in N_s$ with respect to the SGS $\cup_t B_t$.
\end{enumerate}

\noindent{\bf Computing $\mathcal{I}$:} For indices $i$ and $j$ we say
that $i$ is \emph{linked} to $j$ if $i$ and $j$ falls in the same
partition. Clearly $i$ and $j$ are linked if and only if $N_s/N_{s+1}$
restricted to $T_i \times T_j$ is a diagonal group $\Diag{T_i \times
  T_j}$.  The relation $i \sim j$ if $i$ is linked to $j$, is an
equivalence relation and the equivalence classes give the partition
$\mathcal{I}$.  Consider an undirected graph $\mathcal{G}$ with vertex
set $V = \{ 1, \ldots, r \}$ and edge set $ \{ \{i,j\} : i \textrm{
  and } j \textrm{ are linked}\}$. Each connected component
$\mathcal{C}_k$ in $\mathcal{G}$ corresponds to diagonal part of
$N_s/{N_{s+1}}$. Hence to compute $\mathcal{I}$ it is sufficient to
compute the connected components of $\mathcal{G}$.

To compute the graph $\mathcal{G}$, it is sufficient to give an
algorithm to check whether $T_i$ and $T_j$ are linked.  For this we
compute $N_s/N_{s+1}$ restricted to $T_i \times T_j$. Let $\phi_{ij}$
denote the projection of $L/M$ to $T_i \times T_j$. We give an
$\mathrm{FL}$ algorithm (Algorithm~\ref{algo-norm-closure}) that
computes a subset $D_{i,j}$ of elements in $N_s$ such that the
projection from $D_{i,j}$ to $T_i \times T_j$ is $\phi_{ij}(N_s)$.
Since $\phi_{ij}(N_s)$ is of order bounded by a constant that depends
only on $c$, one can easily determine whether it is $T_i \times T_j$
or $\Diag{T_i\times T_j}$ (by checking the order for example).

% Computing $G \cap L / N_{s+1}$ restricted to $T_i \times T_j$ is
% not difficult.  We give a logspace algorithm
% (Algorithm~\ref{algo-norm-closure}) for computing $\frac{G \cap L}{G
%   \cap M}$ restricted to $T_i \times T_j$.

\begin{algorithm}[h]
  \caption{Computing ${N_s}/{N_{s+1}}$ restricted to $T_i \times T_j$}
  \label{algo-norm-closure}
%  \KwIn{A generator set for $A$ for $G$}

  Initialise $D_{i,j}$ to be the set of $x^*$ one for each $x \in
  \phi_{ij}(S)$.

  \Repeat{ $D_{i,j}$ is not modified} {

    Let $S'$ be the set $g^{-1} s g$ for each $g \in A$ and $s \in
    D_{i,j}$.

    Add to $D_{i,j}$ all elements $s$ in $S'$ such that no two
    elements of $D_{i,j}$ have the same image under $\phi_{ij}$.

  }

  \KwRet{$D_{i,j}$}
\end{algorithm}

Using Algorithm~\ref{algo-norm-closure} we compute the edges of the
graph $\mathcal{G}$. The graph $\mathcal{G}$ is a disconnected set of
cliques one for each diagonal component.  In $\mathrm{FL}$ we compute
its connected components. Let $\mathcal{C}_1,\ldots,\mathcal{C}_s$ be
the connected components of $\mathcal{G}$. Then the vertices of
$\mathcal{C}_k$ gives us $I_k$. Thus in $\mathrm{FL}$ we compute the
partition
$\mathcal{I}$. \\

\noindent{\bf Computing $B_k$:} To compute the set $B_k$ the main
algorithmic step is the computation of elements $g_k \in N_s$, $1
\leq k \leq s$ such that $\phi_{i_k}(g_k) \neq 1$ and $\phi_{i_j}(g_k)
= 1$ for all $j$ not equal to $k$.  Given two $i$ and $j$ such that
$T_i$ and $T_j$ are not linked, using
Algorithm~\ref{algo-norm-closure} one can compute an element $g$ that
is nontrivial on $T_i$ and trivial on $T_j$. However we want elements
$g_k$ that is nontrivial on $T_{i_k}$ and trivial on all other
$T_{i_j}$ simultaneously.  We make use of the following proposition.

\begin{proposition}\label{prop-commutator}
  Let $x$ and $y$ be permutations in $N_s$. Let $X$ denote the
  indices $i$ such that $\phi_i(x)$ is trivial. Similarly let $Y$ be
  the set of all $j$ such that $\phi_j(y)$ is trivial.  Then the
  commutator $[x,y]$ has the property that $\phi_{j}([x,y]) = 1$ for
  all $j \in X \cup Y$.
\end{proposition}
\begin{proof}
  For all $i \in X$ since $\phi_i(x) = 1$ we have $\phi_i([x,y]) =
  \phi_i(x^{-1}y^{-1} x y ) = \phi_i(y^{-1} y) = 1$. Similarly for all
  $j \in Y$, $\phi_j([x,y]) = 1$. Therefore for all $k \in X \cup Y$
  $\phi_{k}([x,y]) = 1$.
\end{proof}

We use Proposition~\ref{prop-commutator} to compute the required
permutations $g_k$. For this purpose we need \emph{iterated
  commutators}. Let $\commu{h_1,\ldots,h_k}$ be defined as
\begin{eqnarray*}
  \commu{h_1,h_2} &=& h_1^{-1}h_2^{-1}h_1h_2,\\
  \commu{h_1,\ldots,h_i,h_{i+1}} &=& \left[
    \commu{h_1,\ldots,h_i},h_{i+1}\right].
\end{eqnarray*}

To compute $g_k$ we compute a sequence of elements $h_1,\ldots,h_s$
satisfying the following properties.

\begin{enumerate}
\item $\phi_{i_k}(h_1) \neq 1$,
\item $\phi_{i_k}(\commu{h_1,\ldots,h_j}) \neq 1$ for all $j$ and
\item $\phi_{i_j}(h_j) = 1$ for all $1 \leq j \leq s $ and $j \neq
  k$.
\end{enumerate}

It follows {from} Proposition~\ref{prop-commutator} that given
$h_1,\ldots,h_s$ with the above mentioned properties, $g_k =
\commu{h_1,\ldots,h_s}$ has the required properties: $\phi_{i_k}(g_k)$
is nontrivial and $\phi_{i_j}(g_k) =1$ for $1 \leq j \leq s$ and $j
\neq k$.  We give the logspace algorithm
(Algorithm~\ref{algo-compute-hi}) to find such a sequence
$h_1,\ldots,h_s$.

\begin{algorithm}
  \caption{Computing $h_i$'s}\label{algo-compute-hi}

  Let $h_i$ be any permutation such that $\phi_{i_k}(h_1) \neq 1$.
  Such an element has to exist in the set $S$ itself.

  $g \leftarrow \phi_{i_k}(h_1)$

  \For{$j = 1$ \KwTo $s$ and $j \neq k$} {

    \lnl{step-choose-noncommute}%
    Using Algorithm~\ref{algo-norm-closure} find an $h_j$ such that
    $\phi_{i_k}(h_j)$ does not commute with $g$ and $\phi_{i_j}(h_j) =
    1$.

    $h \leftarrow \phi_{i_k}(h_j)$

    $g \leftarrow [g,h]$

    output $h_j$

  }
\end{algorithm}

In Algorithm~\ref{algo-compute-hi} the
step~\ref{step-choose-noncommute} is possible only because $T_{i_k}$
is nonabelian and simple. The simplicity of $T_{i_k}$ guarantees that
its centre is trivial and hence for any nontrivial element $g$ of
$T_{i_k}$ there is an $h \in T_{i_k}$ such that $g$ and $h$ do not
commute. The loop invariant is that $g$'s value is
$\phi_{i_k}([h_1,\ldots,h_j]) \neq 1$.
Step~\ref{step-choose-noncommute} ensures that (1)
$\phi_{i_k}([h_1,\ldots,h_j]) \neq 1$ and (2) $\phi_{i_j}(h_j) = 1$.
Therefore Algorithm~\ref{algo-compute-hi} indeed computes a sequence
$h_1,\ldots,h_s$ with the desired properties.

Having got the sequence $h_1,\ldots,h_s$ we show that the iterated
commutator $\commu{h_1,\ldots,h_s}$ can be computed in logspace.  It
is sufficient to compute the action of $\commu{h_1,\ldots,h_s}$
separately for each $G$-orbit.  The iterated commutator
$\commu{h_1,\ldots,h_s}$ is a formula over the $h_i$'s, and since each
$G$-orbit is of bounded size, the action of $\commu{h_1,\ldots,h_s}$
restricted to a $G$-orbit $\Omega_i$ can be computed by a bounded
width branching program.  Hence the iterated commutator can be
computed in $\mathrm{FL}$ (in fact ever in $\mathrm{NC}^1$). Thus we
have the following proposition.

\begin{proposition}{\label{prop-iter-commu}}
  Let $G$ be a permutation group with bounded-size orbits. Given
  $h_1,\ldots,h_n \in G$, the iterated commutator
  $\commu{h_1,\ldots,h_n}$ can be computed in deterministic logspace.
\end{proposition}

Using Algorithm~\ref{algo-compute-hi} and
Preposition~\ref{prop-iter-commu}, for all $1 \leq k \leq s$, we
compute in $\mathrm{FL}$ a permutation $g_k \in N_s$ such that
$\phi_{i_k}(g_k) \neq 1$ and for all $1 \leq j \leq s$, $j \neq k$
$\phi_{i_j}(g_k) = 1$.

Finally from the permutations $g_k$, we now describe how the set $B_k$
can be computed. Since $T_{i_k}$ is simple, $T_{i_k} = \phi_{i_k}
\left(\NCL[G]{g_k}\right)$.  We compute a set $B_k$ of distinct
inverse images of $\phi_{i_k}(\NCL[G]{g_k})$, $1 \leq k \leq l$.
Start with $B_k = \{ g_k\}$. The algorithm consists of $\# T$ stages
in which we update $B_k$. At every stage update $B_k$ by adding, for
every element $g$ in the generating set for $G$ and $x \in B_k$, the
elements $y = g^{-1} x g$ to $B_k$ if $\phi_{i_k}(y) \not \in
\phi_{i_k}(B_k)$.  We repeat this process till $\phi_{i_k}(B_k)$
generates $T_{i_k}$.  Since $\# T_{i_k} = \# T \leq c!$ we require at
most $c!$ stages each of which is in $\mathrm{FL}$. Thus the sets
$B_k$, $1\leq k \leq s$ can be computed in $\mathrm{FL}$.

Having computed the sets $B_k$, we compute the strong generator set
$B = \cup_{k=1}^s B_k$ of $N_s$ rel $N_{s+1}$.%
\\

\noindent{\bf Computing sifts:}

Finally we explain how to compute $\Sift{x}$ for any $x\in N_s$ with
respect to the computed strong generator set $B = \cup_{k=1}^s B_k$ of
$N_s$ rel $N_{s+1}$. Given $x \in N_s$ in $\mathrm{FL}$ we compute for
each, $1 \leq k \leq s$, a permutation $y_k \in B_k$ such that
$\phi_{i_k}(y_k)=(\phi_{i_k}(x))^{-1}$.  The sift of $x$ is given by
$\Sift{x}=x\prod_{k=1}^s y_k$.  This completes the nonabelian case of
our induction step.

\subsubsection{Computing the strong generating set: abelian case}

We are given a set $S \subset N_s$ such that $\NCL[G]{S} = N_s$. Our
task is to compute the strong generator set of $N_s$ rel $N_{s+1}$.
Since $N_s/N_{s+1}$ is semisimple and abelian, it is
$\mathbb{F}_p$-semisimple for some prime $p \leq c$.  First we
describe $\mathrm{FL}^{\ModkL{p}}$ algorithms for some basic linear
algebraic problems over $\mathbb{F}_p$ that follows from the results of
Buntrock \etal~\cite{buntrock92structure} . These will be used as
subroutines in our $\mathrm{FL}^{\ModkL{p}}$ algorithm for computing
the strong generator set of $N_s$ rel $N_{s+1}$.

\begin{proposition}\label{prop-compute-basis-fp}
  For a prime $p$ consider the vector space $V = \mathbb{F}_p^r$ then
  \begin{enumerate}
  \item \label{part-check-span}%
    Let $\mathcal{B} = \{ \mathbf{v}_1,\ldots,\mathbf{v}_n \}$ be a
    subset of $V$. Given $\mathbf{v} \in V$, in $\ModkL{p}$ we can
    check whether $\mathbf{v}$ is contained in the subspace $U$ of $V$
    spanned by $\mathcal{B}$. Furthermore, if $\mathbf{v} \in U$ then
    in $\mathrm{FL}^{\ModkL{p}}$ we can compute $a_1,\ldots,a_n \in
    \mathbb{F}_p$ such that $\mathbf{v} = \sum_{i=1}^n a_i
    \mathbf{v}_i$.
  \item \label{part-find-basis}%
    Let $\mathcal{B} = \{ \mathbf{v}_1,\ldots,\mathbf{v}_n \}$ be a
    subset of $V$ not necessarily linearly independent and let $U$ be
    the subspace of $V$ spanned by $\mathcal{B}$. Then in
    $\mathrm{FL}^{\ModkL{p}}$ we can compute a subset $\mathcal{B}'
    \subseteq \mathcal{B}$ such that $\mathcal{B}'$ is a basis for
    $U$.
  \end{enumerate}
\end{proposition}
\begin{proof}

  Let $\mathbf{e}_1,\ldots,\mathbf{e}_m$ denote the standard basis for
  $V = \mathbb{F}_p^r$ and let $\mathbf{v}_i = \sum_{j= 1}^m v_{i,j}
  \mathbf{e}_j$ for $1 \leq i \leq n$. Let $\mathbf{v} = \sum_{j =
    1}^m v_j \mathbf{e}_j$. Let $A$ be the matrix $(v_{i,j})$, $1\leq
  i \leq n$ and $1 \leq j \leq m$. Let $\mathbf{b}$ the column vector
  $(v_1,\ldots,v_m)^T$. Then the vector $\mathbf{v}$ is in the span of
  $\mathcal{B}$ if and only if the system of linear equation $A
  \mathbf{x} = \mathbf{b}$ has a solution. Furthermore if $x_i = a_i$,
  $1 \leq i \leq n$ is a solution to $A \mathbf{x} = \mathbf{b}$ then
  $\mathbf{v} = \sum_{i = 1}^n a_i \mathbf{v}_i$.
  Part~\ref{part-check-span} then follows from
  Theorem~\ref{thm-modp-linearalgb}.

  To prove part~\ref{part-find-basis} consider the
  $\mathrm{FL}^{\ModkL{p}}$ algorithm that cycles over all $1 \leq i
  \leq n$ and outputs $\mathbf{v}_i$ if it is not in the span of the
  set $\{\mathbf{v}_1,\ldots,\mathbf{v}_{i-1} \}$. Clearly the output
  $\mathcal{B}'$ is a basis of the vector space spanned by
  $\mathcal{B}$.
\end{proof}

% Consider the vector space $U$.  Let $U = U_1 \oplus\ldots\oplus U_n$
% be a direct decomposition of $U$. Let $W$ be a subspace of $U$. By a
% \emph{diagonal basis}\index{diagonal!basis} for $W$ with respect to
% the direct sum decomposition $U = \oplus_{i=1}^n U_i$ we mean a
% basis $\mathcal{B}^* = \mathcal{B}^*_1 \cup \ldots \cup
% \mathcal{B}^*_n$ such that $\cup_{i = j}^n \mathcal{B}^*_i$ is a
% basis for $W \cap U_j \oplus \ldots \oplus U_n$. For a diagonal
% basis $\mathcal{B}^* = \cup_{i=1}^n \mathcal{B}_i^*$, every vector
% of $\mathcal{B}_i^*$ is $0$ when projected to the subspace $U_1
% \oplus \ldots \oplus U_{i-1}$.
%
%
% \begin{proposition}
%   Consider the vector space $U$ over $\mathbb{F}_p$ of dimension
%   $r$.  Let $U = U_1 \oplus\ldots\oplus U_n$ be a direct
%   decomposition of $U$.  Given a basis $\mathcal{B} = \{
%   \mathbf{u}_1,\ldots,\mathbf{u}_m \}$ for a subspace $W$ of the
%   direct sum $U$, in $\mathrm{FL}^{\ModkL{p}}$ we can compute a
%   diagonal basis $\mathcal{B}^* = \{
%   \mathbf{u}_1^*,\ldots,\mathbf{u}_m^* \}$ for $W$, i.e. we can
%   compute elements $a_{i,j} \in \mathbb{F}_p$ such that the elements
%   $\mathbf{u}_i^* = \sum_{j=1}^m a_{i,j} \mathbf{u}_j$ forms a
%   diagonal basis for $W$.
% \end{proposition}
% \begin{proof}
%   Let $\mathcal{B} = \{ \mathbf{u}_1,\ldots,\mathbf{u}_m \}$. Let
%   $\mathbf{e}_1,\ldots,\mathbf{e}_{r}$ be the standard basis for
%   $U$.  Every element $\mathbf{u} = \sum a_i \mathbf{e}_i$ can be
%   seen as a column vector $(a_1,\ldots,a_r)^T$. Furthermore we
%   assume without loss of generality that the coordinates
%   corresponding to each of the vector space $U_i$ occur together,
%   i.e. there are integers $1 = i_0 \leq \ldots \leq i_n = r$ such
%   that $e_{i_s},\ldots,e_{i_{s+1} -1}$ is the standard basis for
%   $U_s$.  For an integer $1 \leq i \leq r$ consider the system of
%   linear equations
%   \begin{equation}\label{eqn-diagonalising}%
%     \sum_{j = 1}^r X_j
%    \mathbf{u}_j = \mathbf{e}_i + \sum_{j = i+1}^r Y_j \mathbf{e}_j
%  \end{equation}
%  where $X_j$'s and $Y_j$'s are variables.
%  Equation~\ref{eqn-diagonalising} is feasible if and only if there
%  exists a vector in $\mathbf{w}_i \in W$ such that the $j$th
%  component of $\mathbf{w}_i$ is $0$ if $j < i$ and $1$ if $j = i$.
%  Using the results of Buntrock \etal~\cite{buntrock92structure} in
%  $\ModkL{p}$ we can check if Equation~\ref{eqn-diagonalising} is
%  feasible.  Furthermore if for a given $i$
%  Equation~\ref{eqn-diagonalising} is feasible then in
%  $\mathrm{FL}^{\ModkL{p}}$ we can compute the vector $\mathbf{w}_i$
%  as a linear combination of the vectors in $\mathcal{B}$.
%
%  The $\mathrm{FL}^{\ModkL{p}}$ algorithm for computing the sets
%  $\mathcal{B}_s^*$ is now straight forward. For all $i_s \leq i \leq
%  i_{s+1} -1$ we check if Equation~\ref{eqn-diagonalising} is
%  feasible using a query to the $\ModkL{p}$-oracle. If yes we compute
%  a solution $\mathbf{w}_i = \sum_{i=1}^m a_i \mathbf{u}_i$ and
%  include it in $\mathcal{B}_s^*$. A straight forward induction shows
%  that the sets $\cup_s \mathcal{B}_s^*$ is a diagonal basis for $W$.
% \end{proof}

We fix some notations: Recall that $R_{i,s}/R_{i,s+1}$ is isomorphic
to vector space over $\mathbb{F}_p$ which we denote by $V_i$.  Let $V$
be the direct sum $\oplus_{i=1}^m V_i$. Then $R_s/R_{s+1}$ is
isomorphic to $V$.  For a permutation $x \in R_s$ let $\mathbf{v}_x$
denote the image of $xR_{s+1}$ under the above mentioned isomorphism.
If $x$ and $y$ are permutations in $L$ then for integers $a$ and $b$
it follows that $\mathbf{v}_{x^a y^b} = \tilde{a} \mathbf{v}_{x} +
\tilde{b} \mathbf{v}_y$ where $\tilde{a}$ and $\tilde{b}$ are the
elements $a \ (\textrm{mod } p)$ and $b \ (\textrm{mod } p)$ of
$\mathbb{F}_p$ respectively.  Furthermore the vector space structure
of $R_s/R_{s+1}$ is obtainable effectively in logspace, i.e. for an
element $x \in R_s$ one can compute the image $\mathbf{v}_x$ of the
coset $xR_{s+1}$ in $V$ in $\mathrm{FL}$.  This is because each of the
groups $R_{i,s}$ are constant sized.  Since $\frac{N_s}{N_{s+1}}
\hookrightarrow R_s/R_{s+1}$ it is isomorphic to a subspace of $V$
which denote by $W$.  We are given a subset $S \subseteq N_s$ such
that $\NCL[G]{S} = N_s$.

The group $ \NCL[G]{S}$ is the group generated by the set $\{ g^{-1}s
g| s \in S g \in G \}$ and hence the conjugation action can be seen as
a linear action of $G$ on $V$ as we now explain: For each element $g
\in G$, $g$ maps $\mathbf{v}_h $, $h \in R_s$, to the vector
$\mathbf{v}_{h^*}$ where $h^* =g^{-1}hg$.  Since both $R_s$ and
$R_{s+1}$ are normalised by $G$, each $g\in G$ is an invertible linear
transformation from $V$ to $V$.

First $S \subseteq N_s$ and $N_s$ is a normal subgroup of $G$.
Therefore $\NCL[H]{S}$ is a subgroup of $N_s$ that is closed under
conjugation by elements of $H$.  Thus we have the following
observation of Luks and McKenzie~\cite{luks88solvable} about the
normal closure $\NCL[H]{S}$.

\begin{proposition}[Luks and McKenzie]\label{prop-linear-closure}
  Let $H \leq G$ and let $W$ be the subspace $\{ \mathbf{v}_x | x \in
  \NCL[H]{S} \}$. Then $W$ is the smallest subspace of $V$ containing
  $\{ \mathbf{v}_s | s \in S \}$ and closed under the action of
  elements of $H$
\end{proposition}

We compute the generator set of $\NCL[N_j]{S}$ rel $N_{s+1}$
inductively starting with $j = s$ down to $j =0$ using the SGS of
$N_j$ rel $N_s$ that is already computed. Let $U_j$ denote the
subspace of $V$ associated to $\NCL[N_j]{S}/N_{s+1}$ then it follows
from~\ref{prop-linear-closure} that $U_j$ is the closure of $\{
\mathbf{v}_s | s \in S \}$ under $N_j$. We compute a basis for $U_j$.

To begin with since $N_s/N_{s+1}$ is commutative. It follows that $S
\cup N_{s+1}$ is a generating set for $\NCL[N_s]{S}$ and hence $U_s$
is spanned by $\{ \mathbf{v}_s | s \in S \}$. Assume that we have
already computed a basis for $U_{j+1}$. Our task is to compute a basis
for $U_j$ using the basis for $U_{j+1}$ and the strong generator set
$C$ of $N_j$ rel $N_{j+1}$. The vector space $U_j$ is the span of $g
U_{j+1}$ where $g$ ranges over the distinct coset representative of
$N_{j+1}$ in $N_j$.

\begin{proposition}\label{prop-compute-Uj}
  Given a basis for $U_{j+1}$ we can compute a basis for $U_j$ in
  $\ModkL{p}$.
\end{proposition}
\begin{proof}

  Recall that $N_j/N_{j+1}$ is $T$-semisimple for some simple group
  $T$. Since $U_{j+1}$ is stabilised by $N_{j+1}$ we can assume that
  $N_j/N_{j+1}$ is acting on $U_{j+1}$.  Depending on whether $T_j$ is
  abelian or not we have two cases.

  \paragraph{T is non-abelian}

  We prove that in this case it is sufficient to find the closure of
  $U_{j+1}$ under all monomials $M$ over $C$ which are of degree
  bounded by a constant $c'$ that depends only on $c$. Recall that
  $R_j/R_{j+1} = T_1 \times \ldots \times T_n$ for some integer $n$
  and there is a partition $\mathcal{I} = \{ I_1 \ldots I_r \}$ such
  that $N_j/N_{j+1}$ is product of diagonal groups $\Diag{\prod_{i \in
      I_k} T_i }$, $1 \leq i \leq r$. Each of the diagonal component
  $\Diag{\prod_{i \in I_k} T_i }$ is isomorphic to $T$ and the strong
  generator set $C$ is the union $C = \cup C_k$ where $C_k$ consists
  of one element $g \in N_j$ for each $gN_{j+1} \in \Diag{\prod_{i \in
      I_k} T_i }$.

  Consider any element $g \in C$. We say that $g$ is trivial on
  $\Omega_i$ if $\pr{g}{\Omega_i} \in R_{i,j+1}$. For each $g \in C$
  there exists $h_g \in N_{j+1}$ such that $\pr{g}{\Omega_i} =
  \pr{h}{\Omega_i}$ for all $\Omega_i$ for which $g$ is trivial.
  Consider the elements $\mu_g = h_g - g$, $g \in C$.  Then $U_j$ is
  the space spanned by $M U_{j+1}$ where $M$ ranges over all
  (non-commutative) monomial in $\{ \mu_g : g \in C \}$.  If $g \in
  C_i$ and $h \in C_j$, $i \neq j$ then since $gh = hgx$ for some $x
  \in N_{j+1}$ we can assume that $P(g)$ and $Q(h)$ commutes for any
  two polynomials $P(X)$ and $Q(X)$.  Any monomial $M$ in $\mu_g$'s
  can therefore be assumed to be in the form $\mu_1\ldots \mu_n$ where
  $\mu_i$ is either $1$ or $h_g - g$ for some $g \in C_{i}$.

  For any $i$ if $g$ is trivial on $\Omega_i$ then $\mu_g V_i = 0$.
  Since each orbit $\Omega_i$ is of cardinality at most $c$ there
  exists a constant $c'$ that depends only on $c$ such that for any
  orbit $\Omega_i$ there are at most $c'$ distinct $\mu_g$'s that are
  non-zero on $V_i$.  Consider a monomial $M = \mu_1 \ldots \mu_n$ of
  degree $n > c'$. For any $V_i$ there is a $\mu_k$ such that $\mu_k
  V_i = 0$. Therefore since $V$ is the direct sum $V_1 \oplus \ldots
  \oplus V_m$, $MV = 0$.  As a consequence to obtain $U_j$ it is
  sufficient to take the closure of $U_{j+1}$ with respect to
  monomials in $\{ \mu_g | g \in C \}$ of total degree bounded by
  $c'$. In $\mathrm{FL}$ we can enumerate all monomials over $C$ of
  degree bounded by $c'$.  Hence $U_j$ is the obtained by taking the
  span of $MU_{j+1}$ where $M$ is a monomial in $C$ of degree at most
  $c$. A basis of for $U_j$ can then be computed in
  $\mathrm{FL}^{\ModkL{p}}$ using
  Proposition~\ref{prop-compute-basis-fp}.

  \paragraph{T is abelian}
  The vector space $U_{j+1}$ is closed action of $N_{j+1}$. Therefore
  as far as computing the closure of $U_{j+1}$ is concerned we assume
  that the group algebra of the quotient group $N_j/N_{j+1}$ is acting
  on $V$.  In this case the  group algebra of $N_j/N_{j+1}$ is
  abelian.  Therefore elements $g$ and $h$ can be thought of as
  commuting linear transformations over $V$. Also there is a prime $q
  < c$ such that $g^q -1 = 0$. In $\mathrm{FL}^{\ModkL{p}}$ we can
  find a set $\mathcal{T}$ of elements in the group algebra
  $N_j/N_{j+1}$ such that the $U_j$ is the span of $\{ \tau U_{j+1} :
  \tau \in \mathcal{T} \}$.
\end{proof}

We now give the $\mathrm{FL}^{\ModkL{p}}$ algorithm for computing the
strong generator set of $N_s$ rel $N_{s+1}$ problem.  Let $W$ denote
the subspace of $\{ \mathbf{v}_x | x \in N_s \}$. It follows from
Proposition~\ref{prop-compute-Uj} that a basis $\mathcal{B}$ for the
space $W$. We can keep track of the entire permutations: Whenever we
add the vector $g \mathbf{v}_x$ into $\mathcal{B}$ we add the
corresponding permutation $g^{-1} x g$ into $B$. We thus have a subset
$B$ of $N_s$ such that $\{ \mathbf{v}_x | x \in B \}$ spans $W$.  Let
$B = \{x_1,\ldots,x_n \}$ then, for $1 \leq i \leq n$, define the set
$C_i = \{ x_i^a : 1 \leq a \leq p -1 \}$.  The set $\cup_{i=1}^n C_i$
is the strong generator set of $N_s$ rel $N_{s+1}$. Clearly $C$ can be
computed in $\mathrm{FL}^{\ModkL{p}}$.

Finally, we describe how to compute $\Sift{x}$ for any $x \in N_s$
with respect to the above mentioned strong generator set. In logspace
compute the vector $\mathbf{v}_x \in V$ corresponding to the
permutation $x$.  Using Proposition~\ref{prop-compute-basis-fp}
compute $a_i \in \mathbb{F}_p$ such that $\mathbf{v}_x = \sum a_i
\mathbf{v}_{x_i}$.  The sift of $x$ is given by
$\Sift{x}=x\prod_{i=1}^r x_i^{-a_i}$. This completes the abelian case
of our induction step.

We have thus shown that the strong generator set of $G$ rel $N_{s+1}$
can be computed inductively starting from $s = 0$. Since the locally
residual series $G = N_0 \unrhd \ldots \unrhd N_l$ is of length $l$
bounded by a constant in $c$ we have the following theorem.

\begin{theorem}\label{thm-SGS}
  Let $G$ be a permutation group with orbits of size bounded by a
  constant $c$. Given a generator set $A$ for $G$, we can compute the
  strong generator set for $G$ with respect to the locally residual
  series in the $\ModkL{k}$-hierarchy. The constant $k$ is the product
  of all primes less than $c$ and the level of the hierarchy depends
  only on $c$.
\end{theorem}
\section{The target reduction procedure}
\label{sect-target-reduction}

Our goal is to show that $\ProblemFont{PWS}_c$ is in the
$\ModkL{k}$-hierarchy.  The heart of the algorithm is the target
reduction procedure: Given a instance $(G,\Omega,\Delta)$ of
$\ProblemFont{PWS}_c$, we compute a subgroup $G^\prime$ of $G$
containing $\pointwise{G}{\Delta}$ such that for each $G$-orbit
$\Omega'$ that contains a point of $\Delta$, $\pr{G^\prime}{\Omega'}$
is a proper subgroup of $\pr{G}{\Omega'}$. In this section we show
that target reduction can be performed in the $\ModkL{k}$-hierarchy.

Let $\Omega_1, \ldots, \Omega_m$ be the set of $G$-orbits.  We fix
some terminologies and conventions local to this section. Points in
$\Delta$ will be called \emph{target points}. \emph{Target orbits} are
$G$-orbits that contain target points, i.e. orbits $\Omega_i$ such
that $\Omega_i \cap \Delta \neq \emptyset$.

Firstly, if $\Sigma \subseteq \Delta$ then $\pointwise{G}{\Sigma} \geq
\pointwise{G}{\Delta}$. Let $\Sigma$ be the subset of $\Delta$ that
contains exactly one target point from each target orbit. Any target
orbit will continue to be a target orbit even if we replace $\Delta$
by the subset $\Sigma$, i.e. if $G'$ be the group obtained by
performing target reduction on $(G,\Omega,\Sigma)$ then $G' \geq
\pointwise{G}{\Delta}$ and $\pr{G^\prime}{\Omega'}$ is a proper
subgroup of $\pr{G}{\Omega'}$ for all target orbit $\Omega'$.
Therefore as far as target reduction is concerned, we can assume that
the instance $(G,\Omega,\Delta)$ is such that each $G$-orbit contains
at most one target point.

We make an additional assumption that $G$ acts primitively on each
target orbit which we justify now.  Consider a structure forest
$\mathcal{F} = \{ \mathcal{T}_1,\ldots,\mathcal{T}_m\}$ of $G$ where
$\mathcal{T}_i$ is the structure tree of the transitive action of $G$
on $\Omega_i$.  Let $\Omega^*$ denote the vertices of $\mathcal{F}$.
We identify the set $\Omega$ with the set of leaf nodes of
$\mathcal{F}$.  Recall from Section~\ref{sect-structure-tree} that
$G$'s action on $\Omega$ can be extended to $\Omega^*$ such that given
the action of an element $g \in G$ on $\Omega^*$, we can recover its
action on $\Omega$. Furthermore, all the $G$-orbits of $\Omega^*$ are
of size bounded by $c$.  In $\mathrm{FL}$ we can compute the structure
forest $\mathcal{F}$ of $G$ by separately computing the structure tree
$\mathcal{T}_i$ for each $1 \leq i \leq m$.  Furthermore for a given
$g$ in $G$, in $\mathrm{FL}$ we can compute the action of $g$ on the
$\Omega^*$.

Let $\Omega_i^* \subseteq \Omega^*$, $1\leq i \leq m$, denote the
children of the root of $\mathcal{T}_i$. Then for every $1 \leq i \leq
m$, the set $\Omega_i^*$ is an orbit and $G$ acts primitively on it
(Theorem~\ref{thm-gsupdelta}).  Let $\Delta^*$ be the ancestors of
elements of $\Delta$ in $\cup_{i=1}^m \Omega_i^*$.

\begin{proposition}\label{prop-target-primitive}
  The group $\pointwise{G}{\Delta^*}$ contains $\pointwise{G}{\Delta}$
  and for any subgroup $H$ of $G$, if $\pr{H}{\Omega_i^*} <
  \pr{G}{\Omega_i^*}$ then $\pr{H}{\Omega_i} < \pr{G}{\Omega_i}$.
\end{proposition}
\begin{proof}
  Consider any $\delta^* \in \Delta^*$. There is a $\delta \in \Delta$
  such that $\delta^*$ is the ancestor of $\delta$ in the structure
  forest of $G$. Let $\Sigma$ be the leaves of the structure tree
  rooted at $\delta^*$ then $\Sigma$ is a $G$-block that contains
  $\delta$ (Section~\ref{sect-structure-tree}). Thus for a $g \in G$
  if $\delta^g = \delta$ then $\Sigma^g = \Sigma$ and hence
  ${\delta^*}^g = \delta^*$. This proves that $\pointwise{G}{\Delta^*}
  \geq \pointwise{G}{\Delta}$.

  Consider any subgroup $H$ of $G$. Recall that the action of $G$ on
  the structure tree $\mathcal{T}_i$ depends only on the action of
  $\pr{G}{\Omega_i}$ on $\Omega_i$. Hence if $\pr{H}{\Omega_i} =
  \pr{G}{\Omega_i}$ then $\pr{H}{\Omega_i^*} = \pr{G}{\Omega_i^*}$.
\end{proof}

Proposition~\ref{prop-target-primitive} proves that target reduction
for the instance $(G,\Omega,\Delta)$ can be achieved by performing
target reduction on $(G,\Omega^*,\Delta^*)$.  Summarising the above
discussions, for target reduction we assume that the given instance
$(G,\Omega,\Delta)$ has the following properties.

\begin{enumerate}
\item All $G$-orbits are of size bounded by a constant $c$.
\item $G$ acts primitively on each target orbit.
\item Each target orbit contains a unique target point.
\end{enumerate}

In this section we use the following notation: $X$ denotes the set of
all $i$ such that $\Omega_i$ is a target orbit.  For each index $i \in
X$, $\delta_i$ denotes the unique target point in $\Omega_i$.
Identifying the indices of $X$, the corresponding target orbits and
the target points leads to no confusion. Hence for a subset of $Z$ of
$X$, by target orbits of $Z$ we mean the collection $\{ \Omega_i | i
\in Z\}$.  Similarly by target points of $Z$ we mean the set $\{
\delta_i | i \in Z \}$.

\subsubsection{Overview of the target reduction step}

First we use Theorem~\ref{thm-SGS} to compute the strong generator set
of $G$ with respect to the locally residual series $G = N_0 \unrhd
\ldots \unrhd N_l = \{ 1 \}$. In fact in the $\ModkL{k}$-hierarchy we
obtain the following.
\begin{enumerate}
\item For each $i$ a residual series $G_i = R_{i,0}\unrhd \ldots
  \unrhd R_{i,l} = 1$ such that, $R_{i,s+1} = \Residue[T_s]{R_{i,s}}$.
\item The product group $R_s = \prod_i R_{i,s}$ and
\item The groups $N_s = G \cap R_s$.
\end{enumerate}

Consider any target orbit $\Omega_i$. Recall that $\pr{N_s}{\Omega_i}
= R_{i,s}$ (Proposition~\ref{prop-local-residual}) and hence $G_i =
\pr{N_0}{\Omega_i} \unrhd \ldots \unrhd \pr{N_l}{\Omega_i} = \{ 1 \}$
is a residual series for $G_i$. Since $G_i$ acts primitively on
$\Omega_i$, the last nontrivial group in this series is $\Soc{G_i}$
(Lemma~\ref{lem-smallest}).  Let $X_s$ denote the set of all $i$ such
that $\pr{N_s}{\Omega_i} = \Soc{G_i}$ and $\pr{N_{s+1}}{\Omega_i} = \{
1 \}$.  We have $\cup X_s = X$.

The target reduction is done inductively in $l$ stages where in the
$s$th stage we handle the target orbits in $X_s$. Inductively we
compute the generator sets of the sequence of groups $G = H_0 \geq
\ldots \geq H_{l+1}$ such that for all $s$, $H_s \geq
\pointwise{G}{\Delta}$ and $\pr{H_s}{\Omega_i}$ is a proper subgroup
of $\pr{G}{\Omega_i}$ for each $i$ in $\cup_{j=0}^{s-1}X_s$. In fact
the group $H_s$ that we compute in the $s$th stage will contain $N_s$.
Since $X = \cup_{j = 0}^l X_s$, the group $H_{l+1}$ is the required
group $G^\prime$.

To begin with $H_0 = G$. Inductively assume that we have computed a
generator set $A_s$ of $H_s$.  To compute $H_{s+1}$ we first identify
a subset $Y_s \subseteq X_s$ of critical indices. A subset $Y$ of $X$
is said to be \emph{critical} if it has the following properties:

\begin{enumerate}
\item Let $N$ be the subgroup of $N_s$ that fixes all the target
  points in $Y$ then $\pr{N}{\Omega_i} < \pr{N_s}{\Omega_i}$ for all
  $i \in X_s$.
\item For any $x \in G$ there is a $y \in N_s$ such that $x^* = xy$
  fixes all the points of $Y$.
\end{enumerate}

\begin{proposition}\label{prop-critical}
  Let $H$ be the subgroup of $H_s$ that fixes all the target points in
  a critical subset $Y$ of $X_s$ then $H_s \geq H \geq
  \pointwise{G}{\Delta}$ and for all $i \in X_s$ $\pr{H}{\Omega_i} <
  G_i$.
\end{proposition}
\begin{proof}
  Let $\Delta'$ be the subset of $\Delta$ containing all the target
  points of $Y$. By induction hypothesis $H_s \geq
  \pointwise{G}{\Delta}$ and hence $H = \pointwise{H_s}{\Delta'} \geq
  \pointwise{G}{\Delta}$. The group $H_s \cap R_s = N_s$ we have $H
  \cap R_s = N$. Since $\pr{N}{\Omega_i} < R_{i,s}$ for all $i \in
  X_s$, $\pr{H \cap R_s}{\Omega_i} < R_{i,s}$.  Therefore by
  Proposition~\ref{prop-local-residual} we have $\pr{H}{\Omega_i} <
  G_i$ for all $i \in X_s$.
\end{proof}

Recall that our goal is to compute a subgroup $H_{s+1}$ of $H_s$ that
contains $\pointwise{G}{\Delta}$ and is strictly smaller that $G_i$ on
$\Omega_i$ for each $i \in X_s$. By Proposition~\ref{prop-critical} it
is sufficient to choose $H_{s+1}$ to be the subgroup of $H_s$ that
fixes all the target points in $Y$ for some critical subset $Y$ of
$X_s$.  In the $s$th stage of the algorithm we identify a critical
subset $Y_s$ which is \emph{effective}, i.e. given any $x \in G$, in
$\mathrm{FL}^{\ModkL{k}}$ we can compute a $y \in N_s$ such that $x^*
= xy$ fixes all the points in $Y_s$.  The subgroup $H_{s+1}$ is the
subgroup of $H_s$ that fixes all the target points of $Y_s$.

We now show how a generator set for $H_{s+1}$ can be computed.  Let
$A_s$ be the a generator set for $H_s$.  Since $Y_s$ is critical for
each $x \in A_s$ there is a $y \in N_s$ such that $x^* = xy$ fixes all
the target points in $Y_s$.  Let $A_s^*$ denote the set $\{ x^* | x
\in A_s \}$.

\begin{proposition}\label{prop-genset-hsp1}
  Let $N$ be the subgroup of $N_s$ that fixes all the target points of
  $Y_s$ and let $B$ be a generator set for $N$. Then $A_s^* \cup B$
  generates the subgroup $H_{s+1}$.
\end{proposition}
\begin{proof}
  First, we claim that $A_x^* N_s$ generates $H_s$. Consider any $g
  \in H_s$. Since $A_s$ generates $H_s$, for some integer $t \geq 0$
  there exists $t$ elements $x_1,\ldots, x_t$ in $A_s$ such that $g$
  is the product $\prod_{i=1}^t x_i$.  For any $x \in A_s$ there is an
  element $y \in N_s$ such that $x^* = xy$ is contained in $A_s^*$,
  Therefore we have for $1 \leq i \leq t$ elements $x_i^* \in A_s^*$
  and $y_i \in N_s$ such that $g = x_1^* y_1 \ldots x_t^* y_t$. This
  proves our claim.

  The group $N_s$ is a normal subgroup of $G$ and hence is also a
  normal subgroup of $H_s$. Therefore every element $g \in H_s$ can be
  written as $g = g_1g_2$ where $g_1$ is contained in the group
  generated by $A_s^*$ and $g_2 \in N_s$.  Furthermore, since every
  element of $A_x^*$ fixes all the target points of $Y_s$, so does
  $g_1$. As a consequence any element of $H_{s+1}$, the subgroup of
  $H_s$ that fixes the target points of $Y_s$, is of the form $uv$
  where $u$ is in the group generated by $A_s^*$ and $v \in N$.  Hence
  $A_s^* N$ generates the group $H_{s+1}$ and if $B$ is a generator
  set of $N$, $A_s^* \cup B$ generates $H_{s+1}$.
\end{proof}

To complete the inductive procedure for target reduction it is thus
sufficient to perform the following subtasks.
\begin{enumerate}
\item Compute a critical subset $Y_s \subseteq X_s$.\label{compute-Ys}
\item Given $x \in G$ compute a $y \in N_s$ such that $xy$ fixes each
  of the target points of $Y_s$. \label{compute-xstar}
\item Compute a generator set of the subgroup $N$ of $N_s$ that fixes
  each of the target points of $Y_s$.\label{compute-N}
\end{enumerate}

Depending on whether $N_s/N_{s+1}$ is abelian or not we have two case.
When $N_s/N_{s+1}$ is abelian then $N_s/N_{s+1}$ is
$\mathbb{F}_p$-semisimple for some prime $p \leq c$. In this case we
show that the steps~\ref{compute-Ys}, \ref{compute-xstar} and
\ref{compute-N} can be done in $\mathrm{FL}^{\ModkL{p}}$. On the other
hand when $N_s/N_{s+1}$ is nonabelian then the steps~\ref{compute-Ys},
\ref{compute-xstar} and \ref{compute-N} can be done in $\mathrm{FL}$.
We explain these two case in the next two subsections.
\subsection{Computing the critical orbits: abelian case}\label{subsect-ab-critical}

In this case the quotient group $N_s/N_{s+1}$ is
$\mathbb{F}_p$-semisimple for some prime $p \leq c$. Let
$\Omega_1,\ldots,\Omega_m$ be the $G$-orbits and let $G_i =
\pr{G}{\Omega_i}$. Then by the O'Nan-Scott theorem $\Soc{G_i}$ is
regular on $\Omega_i$, i.e. $\Soc{G_i}$ is transitive on $\Omega_i$
and for any $\delta \in \Omega_i$, the subgroup of $\Soc{G_i}$ that
fixes $\delta$ is the trivial group.  As a consequence we have the
following property.

\begin{proposition}\label{prop-K-property}
  Let $Y$ be any subset of $X_s$ and let $K$ be the subgroup of $N_s$
  that fixes the target points of $Y$. Then we have.
  \begin{enumerate}
  \item $K \unlhd G$. \label{case-K-normalsubgroup-G}
  \item For any $i$ in $X_s$ either $\pr{K}{\Omega_i}$ is trivial or
    is $\Soc{G_i}$. \label{case-pr-K-omega-i}
  \item For any $i \in X_s$ such that $\pr{K}{\Omega_i}$ is nontrivial
    and for any two elements $\delta$ and $\delta'$ of $\Omega_i$,
    there is an element $h$ of $K$ such that $\delta^h = \delta'$.
    \label{case-action-K-omega-i}
  \end{enumerate}
\end{proposition}
\begin{proof}
  The group $K$ is a subgroup of $N_s$ and hence for all $i \in X_s$,
  $\pr{K}{\Omega_i}$ is a subgroup of $\Soc{G_i}$. Moreover $K$ fixes
  the target point $\delta_i$ of $\Omega_i$ for each $i \in Y$.
  Therefore the projection of $K$ onto $\Omega_i$ is the subgroup of
  $\Soc{G_i}$ that fixes $\delta_i$. However since $\Soc{G_i}$ is
  regular on $\Omega_i$, $\pr{K}{\Omega_i}$ is trivial for all $i \in
  Y$.  Thus $K$ is the intersection of the groups $N_s$ and $\prod_{i
    \not \in Y} R_{i,s}$.  The group $G$ normalises the group
  $\prod_{i \not \in Y} R_{i,s}$. Also $N_s \unlhd G$. Hence their
  intersection $K$ is a normal subgroup of $G$. This proves
  part~\ref{case-K-normalsubgroup-G}.

  Consider an $i \in X_s$. As argued before since $K \leq N_s$,
  $\pr{K}{\Omega_i}$ is a subgroup of $\Soc{G_i}$. Suppose that
  $\pr{K}{\Omega_i}$ is nontrivial. Then since $K$ is a normal
  subgroup of $G$ and since $\pr{G}{\Omega_i} = G_i$, it follows that
  $\pr{K}{\Omega_i}$ is a normal subgroup of $G_i$. However by the
  O'Nan-Scott theorem $\Soc{G_i}$ is the unique minimal normal
  subgroup of $G_i$.  Therefore $\pr{K}{\Omega_i} = \Soc{G_i}$ which
  proves part~\ref{case-pr-K-omega-i}.

  Finally consider an $i$ in $X_s$ such that $\pr{K}{\Omega_i}$ is
  nontrivial. The group $\Soc{G_i}$ is regular on $\Omega_i$
  (O'Nan-Scott theorem). Hence for any two elements $\delta$ and
  $\delta'$ of $\Omega_i$ we have an element $g \in \Soc{G_i}$ such
  that $\delta^g = \delta'$. Since $\pr{K}{\Omega_i} = \Soc{G_i}$,
  part~\ref{case-action-K-omega-i} then follows as there is an element
  $g^* \in K$ such that $\pr{g^*}{\Omega_i} = g$.
\end{proof}

We fix the following notation for this subsection. Recall that $N_s$
is the intersection of the product group $R_s = \prod_{i=1}^m R_{i,s}$
and $G$ (Subsection~\ref{subsect-compute-sgs}). The quotient groups
$R_{i,s}/R_{i,s+1}$ is $\mathbb{F}_p$-semisimple and hence is a vector
space $V_i$ over $\mathbb{F}_p$. Let $V$ be the direct sum
$\oplus_{i=1}^m V_i$ then $R_s/R_{s+1}$ is isomorphic to $V$. We
identify the vector space $V$ with the quotient group $R_s/R_{s+1}$
under this isomorphism, i.e. for every element $x \in R_s$ we
associate isomorphic image $\mathbf{v}_x$ of $x$ in $V$. Clearly for
any $x$ and $y$ in $R_s/R_{s+1}$ the vector $\mathbf{v}_{x+y}$ is
$\mathbf{v}_x + \mathbf{v}_y$ and for any integer $a$
$\mathbf{v}_{x^a} = \tilde{a} \mathbf{v}_x$, where $\tilde{a} \in
\mathbb{F}_p$ is the element $a\ (\textrm{mod } p)$.

\begin{proposition}
  Given any element $x \in R_s$, in $\mathrm{FL}$ we can compute the
  vector $\mathbf{v}_x$.
\end{proposition}
\begin{proof}
  Let $\mathbf{w}_i$ denote the projection of $\mathbf{v}_x$ onto the
  vector space $V_i$.  Since the vector space $V$ is the direct sum of
  the subspaces $V_i$, $\mathbf{v}_x = \sum_{i=1}^m \mathbf{w}_i$.
  The order of the group $R_{i,s}$ is at most $c!$ as the size of the
  orbit $\Omega_i$ is less than $c$. Hence in $\mathrm{FL}$ we can
  compute the projection $\mathbf{w}_i$ and thus compute
  $\mathbf{v}_x$.
\end{proof}

The quotient group $N_s/N_{s+1}$ is a subgroup of the $R_s/R_{s+1}$
(more precisely $N_s/N_{s+1} \hookrightarrow R_s/R_{s+1}$) and hence
is a subspace $U$ of $V$.

\begin{proposition}\label{prop-compute-basis-U}
  Given the strong generator set $C$ of $N_s$, in
  $\mathrm{FL}^{\ModkL{p}}$ a subset $B = \{x_1,\ldots,x_r \}$ of $C$
  can be computed such that the vectors
  $\mathbf{v}_{x_1},\ldots,\mathbf{v}_{x_r}$ forms a basis of $U$.
\end{proposition}
\begin{proof}
  The subset $\mathcal{C} = \{ \mathbf{v}_x | x \in C \}$ of $V$ spans
  $U$.  Using Proposition~\ref{prop-compute-basis-fp} in
  $\mathrm{FL}^{\ModkL{p}}$ compute a subset $\mathcal{B}$ of
  $\mathcal{C}$ that forms a basis of $U$. For each $\mathbf{v} \in
  \mathcal{B}$ pick a permutation $x \in C$, say the lexicographically
  least such that $\mathbf{v}_x = \mathbf{v}$ and form the subset $B$
  of $C$. Clearly $B$ can be computed in $\mathrm{FL}^{\ModkL{p}}$.
\end{proof}

Our goals are (1) to compute a critical subset $Y_s$ of $X_s$, (2)
compute a generator of the subgroup $N$ of $N_s$ that fixes all the
points of $Y_s$ and (3) give a $x \in G$ compute a $y \in N_s$ such
that $x^* = xy$ fixes all the target points of $Y_s$. By
Proposition~\ref{prop-K-property} it follows that the subgroup $K$ of
$N_s$ that fixes some of the target points of $X_s$ is such that for
all $i$ either $\pr{K}{\Omega_i} =1$ or $\pr{K}{\Omega_i} =
\Soc{G_i}$. The subset $Y_s$ of $X_s$ that we choose will be a minimal
subset of target points such that the subgroup of $N_s$ that fixes the
points of $Y_s$ will be trivial on all the target orbits of $X_s$.
First we prove the following proposition that will be used to identify
$Y_s$ and later on to compute the set $N$.

\begin{proposition}\label{prop-compute-K}%
  Given any subset $Y$ of $X_s$ there is a $\mathrm{FL}^\ModkL{p}$
  algorithm to compute the generator set of the subgroup $K$ of $N_s$
  that fixes all the target points of $Y$.
\end{proposition}
\begin{proof}
  Since $N_{s+1}$ is trivial on all the target orbits it follows that
  $K$ contains $N_{s+1}$. Let $W$ denote the vector space associated
  with the quotient group $K/N_{s+1}$. From
  Proposition~\ref{prop-K-property} it follows that $K$ is trivial on
  all the orbits of $Y$. Therefore $K$ is the intersection of the
  groups $N_s$ and $\prod_{j \not \in Y} R_{i,s}$. Hence $W$ is the
  subspace $U \cap \oplus_{i\not \in Y_s} V_i$.

  In $\mathrm{FL}^{\ModkL{p}}$ we first compute the set $B = \{ x_1,
  \ldots, x_r \}$ such that $\mathcal{B} = \{
  \mathbf{v}_{x_1},\ldots,\mathbf{v}_{x_r} \}$ is a basis for $U$
  (Proposition~\ref{prop-compute-basis-U}). Consider the projection of
  $U$ on to the space $\oplus_{i \in Y_s} V_i$. Then $W$ is the kernel
  of this projection. Let $A$ be the matrix associated to this
  projection with respect to the basis $\mathcal{B}$. The subspace $W$
  consists of all vectors $\sum a_i \mathbf{v}_{x_i}$ which are
  solutions of the linear equation $A \mathbf{x} = 0$. Using
  Theorem~\ref{thm-modp-linearalgb} we can compute a basis
  $\mathbf{u}_1,\ldots,\mathbf{u}_t$ for $W$. In fact the algorithm
  outputs the elements $a_{ij} \in \mathbb{F}_p$ such that
  $\mathbf{u}_i = \sum_{j = 1}^r a_{ij} \mathbf{v}_{x_j}$.  Let $g_i =
  \prod_{j =1}^r x_j^{a_{ij}}$ then clearly the set $D = \{
  g_1,\ldots,g_t\}$ generates the quotient group $K/N_{s+1}$.  As part
  of the strong generator set of $G$ we have already computed a strong
  generator set $C'$ of $N_{s+1}$. The set $C' \cup D$ gives a
  generator set for $K$.
\end{proof}

We now present the $\mathrm{FL}^{\ModkL{p}}$ algorithm
(Algorithm~\ref{algo-compute-Ys-abelian}) for computing $Y_s$.

\begin{algorithm}
  \caption{Computing $Y_s$}\label{algo-compute-Ys-abelian}
  $Y \leftarrow \emptyset$.

  \ForEach{$i \in X_s$}%
  {

    Let $K_i$ be the subgroup of $N_s$ that fixes target points of
    $Y$.

    \lnl{step-K-nontrivial}%
    \lIf{$K$ is nontrivial on $\Omega_i$}%
    {  $Y \leftarrow Y \cup \{ i \}$  }%
  }
  Return the set $Y_s = Y$.
\end{algorithm}

For the step~\ref{step-K-nontrivial} in $\mathrm{FL}^{\ModkL{p}}$ we
first compute the generator set $D_i$ of $K_i$
(Proposition~\ref{prop-compute-K}). The group $K_i$ is trivial on $i$
if and only if all the elements of $D_i$ is trivial on $\Omega_i$.
Thus step~\ref{step-K-nontrivial} can be performed by making a query
to a $\ModkL{p}$ oracle and hence
Algorithm~\ref{algo-compute-Ys-abelian} is a $\mathrm{FL}^{\ModkL{p}}$
procedure. Having computed $Y_s$ using
Proposition~\ref{prop-compute-K} we compute in
$\mathrm{FL}^{\ModkL{p}}$ the generator set of the subgroup $N$ of
$N_s$ that fixes all the target points of $Y_s$.  To complete the
abelian case we show that for each $x \in G$, $x^*$ can be computed in
$\mathrm{FL}^{\ModkL{k}}$.

\begin{proposition}
  Given any $x \in G$ there is a $\mathrm{FL}^{\ModkL{p}}$ algorithm
  to compute an element $y$ of $N_s$ such that $xy$ fixes all the
  points of $Y_s$.
\end{proposition}
\begin{proof}
  Without loss of generality assume that $Y_s = \{ 1,\ldots,t \}$ for
  some integer $t$. Let $\delta_i$ denote the target point in
  $\Omega_i$. Let $K_0 = N_s$ and for $1 \leq i \leq t$ let $K_i$
  denote the subgroup of $N_s$ that fixes the target points
  $\delta_1,\ldots,\delta_i$.

  First, we prove by induction that there are elements $h_i \in K_i$,
  $0 \leq i < t$, such that $xh_0 \ldots h_i$ fixes every element of
  the set $\{ \delta_1,\ldots,\delta_{i+1} \}$.  Let $x$ map
  $\delta_1$ to $\delta_1'$.  Since $\pr{K_0}{\Omega_1}$ is transitive
  on $\Omega_1$ there is an element $h_0 \in K_0$ that maps
  $\delta_1'$ to $\delta_1$. Hence $xh_0$ fixes $\delta_1$.
  Inductively assume that there exists elements $h_j$, $0 \leq j < i$
  such that $xh_0\ldots,h_{i-1}$ fixes the target points
  $\delta_1,\ldots,\delta_i$. Let $xh_0\ldots h_{i-1}$ map
  $\delta_{i+1}$ to $\delta_{i+1}'$. Since $K_i$ is nontrivial on
  $\Omega_{i+1}$, it follows from part~\ref{case-action-K-omega-i} of
  Proposition~\ref{prop-K-property} that there is an element $h \in
  K_i$ that maps $\delta_{i+1}'$ back to $\delta_{i+1}$. Let $h_i =
  h$. The group $K_i$ is trivial on all the $G$-orbits
  $\Omega_1,\ldots,\Omega_i$ and therefore $xh_1\ldots h_i$ fixes all
  the points in the set $\{ \delta_1,\ldots,\delta_{i+1} \}$.  The
  element $y = h_0\ldots h_{t-1} \in N_s$ is such that $xy$ fixes all
  the target points of $Y_s$.  We now give the
  $\mathrm{FL}^{\ModkL{p}}$ algorithm for computing $y$.

  Let $x$ map $\delta_i$ to $\nu_i$. We want to compute an element $y
  \in N_s$ that maps $\nu_i$ to $\delta_i$ for all $i \in Y_s$.  To
  this end consider the vector space $V' = \oplus_{i\in Y_s} V_i$ and
  let $U'$ be the projection of $U$ onto $V'$. Recall that the groups
  $R_{i,s}$ and $\pr{N_{s+1}}{\Omega_i}$ are trivial for all $i \in
  Y_s$. Therefore the vector spaces $V'$ and $U'$ are isomorphic to
  the groups $R_s$ and $N_s$ restricted to the target orbits of $Y_s$.
  For an element $x \in R_s$ let $\mathbf{u}_x$ be the image of $x$ in
  $V'$ under this restriction.  In fact $\mathbf{u}_x$ is the
  projection of $\mathbf{v}_x$ onto $V'$.  Analogues to
  Proposition~\ref{prop-compute-basis-U}, using
  Proposition~\ref{prop-compute-basis-fp} we compute in
  $\mathrm{FL}^{\ModkL{p}}$ a subset $B' = \{ x_1,\ldots,x_t \}$ of
  $B$ such that $\mathcal{B}' = \{ \mathbf{u}_{x_1}, \ldots,
  \mathbf{u}_{x_t} \}$ forms a basis for $U'$. First we show that
  $\mathbf{u}_y$ can be computed in $\mathrm{FL}$ and then we recover
  the permutation $y$ in $\mathrm{FL}^{\ModkL{p}}$.

  % We prove that in $\mathrm{FL}$ the projection $\mathbf{w}_i$ can
  % be computed.

  Consider an $i \in Y_s$.  Since $R_{i,s}$ is a constant sized
  transitive permutation group on $\Omega_i$, in
  $\mathrm{FL}^{\ModkL{p}}$ we can compute an element $y_i \in
  R_{i,s}$ that maps $\nu_i$ back to $\delta_i$.  The group
  $\pr{N_s}{\Omega_i} = \Soc{G_i}$ and by the O'Nan-Scott theorem
  $\Soc{G_i}$ has a regular action on $\Omega_i$.  The element
  $yy_i^{-1} \in R_s$ fixes the point $\nu_i$ and therefore restricted
  to $\Omega_i$ is trivial. As a result if $\mathbf{w}_i$ denotes the
  projection of $\mathbf{u}_y$ onto $V_i$ then $\mathbf{w}_i =
  \mathbf{v}_{y_i}$. Since $R_{i,s}$ is a group of order bounded by
  $c!$, in $\mathrm{FL}$ we can compute the vector $\mathbf{w}_i$. The
  vector $\mathbf{u}_y$ is given by $\sum_{i \in Y_s} \mathbf{w}_i$
  which can also be computed in $\mathrm{FL}$.

  To complete the algorithm we need to recover $y$ from the vector
  $\mathbf{u}_y$.  Using Proposition~\ref{prop-compute-basis-fp} we
  compute, in $\mathrm{FL}^{\ModkL{p}}$, elements $a_1, \ldots, a_t
  \in \mathbb{F}_p$ such that $\mathbf{u}_y = \sum_{i=1}^t a_i
  \mathbf{u}_{x_i}$. The permutation $y = \prod_{i=1}^t x_i^{a_i}$ is
  the required element of $N_s$.
\end{proof}

\subsection{Computing the critical orbits: nonabelian case}\label{subsect-nonab-critical}

Consider any $i \in X_s$. By O'Nan-Scott theorem $\Soc{G_i}$ is either
$K$ (type~\ref{case-onan-nonab1}) for some minimal normal subgroup $K$
of $G_i$ or is of the form $K_1 \times K_2$
(type~\ref{case-onan-nonab2}) where $K_1$ and $K_2$ are the only
minimal normal subgroups of $G_i$.  For each $i \in X_s$, by a
\emph{socle part} associated to $i$ we mean a minimal normal subgroup
of $G_i$. For a $T$-semisimple group $L = T_1 \times \ldots \times
T_r$ by a \emph{simple part} we mean one of the subgroup $T_i$.

The quotient group $N_s/N_{s+1}$ is a subgroup of the $T_s$-semisimple
group $R_s/R_{s+1}$. Hence by Scott's Lemma (Lemma~\ref{lem-scott}),
$N_s/N_{s+1}$ is a product of diagonals of simple parts of
$R_s/R_{s+1}$.  Consider two simple parts $T'$ and $T''$ of
$R_s/R_{s+1}$. As before we say that $T'$ and $T''$ are \emph{linked}
if in $N_s/N_{s+1}$, $T'$ and $T''$ are in the same diagonal
component.  We now extend the ``linking'' relation to socle parts.
Any socle part $K$ is the product of certain subset of simple parts of
$R_s/R_{s+1}$. We say that the socle parts $K'$ and $K''$ are
\emph{linked} if $K' = \ldots \times T'\times \ldots$ and $K'' =
\ldots \times T'' \times \ldots$ such that $T'$ and $T''$ are linked.
For socle parts $K'$ and $K''$ we prove that either they are fully
linked or are unlinked.

\begin{proposition}\label{prop-link-socles}
  Let $K' = T_1' \times \ldots \times T_u'$ and $K'' = T_1'' \times
  \ldots \times T_v''$ be two socle parts. If $K'$ and $K''$ are
  linked then $u = v$ and there is a permutation $\pi \in S_u$ such
  that $T_i'$ is linked to $T_{i^\pi}''$.
\end{proposition}
\begin{proof}
  Let $K'$ and $K''$ be socle parts corresponding to orbits $\Omega'$
  and $\Omega''$.  Let us assume without loss of generality that
  $T_1'$ is linked to $T_1''$. Since $K'$ is the minimal subgroup of
  $\pr{G}{\Omega'}$, for any $i$ there is an element $g \in G$ such
  that $g^{-1}T_1'g = T_i'$ (Lemma~\ref{lem-min-normal}). The element
  $g$ maps via conjugation $T_1''$ to some $T_i''$. Thus for any
  simple part $T_i'$ in $K'$ there is a simple part $T_i''$ in $K''$
  such that $T_i'$ and $T_i''$ are linked. However no two simple parts
  of $K'$ are linked. Each simple part of $K'$ therefore, is linked to
  distinct simple part of $K''$.  By interchanging the role of $K'$
  and $K''$ we can prove the converse.  As a result, we have $u = v$
  and $\pi \in S_u$ is the permutation that maps $i$ to $j$ if $T_i'$
  is linked to $T_j''$.
\end{proof}

Recall that for target reduction our goal is to (1) compute the set
$Y_s$ of critical orbits, (2) compute a generator set of subgroup $N$
of $N_s$ that fixes all the points of $Y_s$ and (3) for each $x \in G$
an element $y \in N_s$ such that $x^* = xy$ is trivial on all the
target points of $Y_s$. We now show that each of these three tasks can
be achieved by an $\mathrm{FL}$ algorithm.

\subsubsection{Computing $Y_s$}

%First we describe the main idea behind the computation of $Y_s$. For
%any $i \in X_s$ the group $\pr{N_s}{\Omega_i}$ is the transitive group
%$\Soc{G_i}$ where as $\pr{N_{s+1}}{\Omega_i} = 1$. Consider any two
%elements $i$ and $j$ of $X_s$. If $\Soc{G_i}$ and $\Soc{G_j}$ are
%completely independent, i.e. non of the socle parts of $\Soc{G_i}$ is
%linked to the socle parts of $\Soc{G_j}$ then fixing a point in
%$\Omega_i$ does not effect the orbit $\Omega_j$. Hence $Y_s$ has to
%contain both $i$ and $j$. Depending on the type of the socles
%$\Soc{G_i}$ and $\Soc{G_j}$ there can arise
%  =
%\begin{figure}
%  \def\orbit
%  \caption{$i$ is included and $j$ is excluded}
%  $
%  \xymatrix{
%    *[o]{K} \ar@{-}"K1p"\\
%    K_1^\prime \ar@{}[r]|{\times}="times" &K_2%
%    {\save [].[l]="K1p" *[F-:<10pt>] \frm{}\restore}% draw box
%    {\save "times"+<0cm,-0.5cm> \Omega_j \restore}% label it
%    \\
%  }
%  $
%  $
%  \xymatrix{
%    *[o]{K_1} \ar@{-}"K1p"  \ar@{}[r]|{\times} &  K_2 \ar@{-}"K2p" \\
%    K_1^\prime [0,0]="K1p" \ar@{}[r]|{\times}="times" &K_2%
%    {\save  "K1p".[l]="K2p" *[F-:<10pt>] \frm{}\restore}% draw box
%    {\save "times"+<0cm,-0.5cm> \Omega_j \restore}% label it
%    \\
%  }
%  $
%\end{figure}

Let $\mathcal{K}$ be the collection of socle parts of orbits of $X_s$.
To construct critical subset $Y_s$ of $X_s$ consider the graph
$\mathcal{G} = (\mathcal{K},\mathcal{E})$ where the edge set
$\mathcal{E}$ is partitioned into the set of red edges $\mathcal{R}$
and the set of blue edges $\mathcal{B}$.  The red edges $\mathcal{R}$
consists of all unordered pairs $\{ K_1 , K_2 \}$ where $K_1$ and
$K_2$ are linked.  On the other hand the blue edges consists of all
unordered pairs $\{ K_1,K_2 \}$ such that $K_1$ and $K_2$ are distinct
socle parts of the same $G$-orbit.  We have the following proposition
about the structure of the graph $\mathcal{G}$.

\begin{proposition}\label{prop-socle-graph-property}
  The red subgraph, i.e. $\mathcal{G}_{\mathrm{red}} =
  (\mathcal{K},\mathcal{R})$, consists of disconnected cliques and any
  blue edge is between two disconnected red cliques.
\end{proposition}
\begin{proof}
  The ``linking'' relation is an equivalence relation and hence the
  red subgraph consists of disconnected red cliques. Any blue edge is
  between two socle parts of the same $G$-orbit. Hence they cannot be
  linked. Therefore blue edges are always between two disconnected red
  cliques in the red subgraph.
\end{proof}

In logspace we compute the set $\mathcal{C}$ of red cliques in the red
subgraph $\mathcal{G}_{\mathrm{red}}$.  We partition the set
$\mathcal{C}$ into subsets $\mathcal{C}'$ and $\mathcal{C}''$, where a
red clique $C$ is put in $\mathcal{C}'$ if $C$ contains an element
$K=\Soc{G_i}$ for some $i \in X_s$. The remaining cliques are put in
$\mathcal{C}''$.  We now construct the subset of critical orbits $Y_s$
as the union of $Y_s'$ and $Y_s''$.

The set $Y_s'$ consists of one index $i$ per clique $C \in
\mathcal{C}'$ such that $K = \Soc{G_i} \in C$.  Shrink all the red
cliques in $\mathcal{G}$ and delete all vertices (and blue edges
incident on them) that corresponds to cliques in $\mathcal{C}'$.  Call
the new graph $\mathcal{G}'$. In $\mathcal{G}'$, compute the
lexicographically first spanning forest of blue edges.  Let
$\mathcal{B}'$ be the blue edges in the spanning forest.  Recall that
each $e\in \mathcal{B}'$ corresponds to the orbit $\Omega_i$ where
$\Soc{G_i}=K\times K'$. The subset $Y_s''$ of the critical subset
$X_s''$ consist of such indices $i$ corresponding to edges in
$\mathcal{B}'$.  We prove the following proposition

\begin{proposition}\label{prop-critical-nonab}
  The set $Y_s = Y_s' \cup Y_s''$ can be computed in logspace. Let $N$
  be the subgroup of $N_s$ that fixes all the target points of $Y_s$
  then $\pr{N}{\Omega_i} \leq R_{i,s}$ for all $i \in X_s$.
\end{proposition}
\begin{proof}
  The sets $Y_s'$ and $Y_s''$ can be computed in logspace as this
  involves reachability in undirected graphs
  (Lemma~\ref{lem-connectivity}).

  Let $\Delta'$ be the subset containing all the target points of
  $Y_s$ and let $N = \pointwise{N_s}{\Delta'}$.  Depending on whether
  $\Soc{G_i}$ has one or two socle parts we have the following two
  cases.\newline

  \noindent {\bf Case 1:} The socle $\Soc{G_i}$ is itself a socle part
  $K$. Consider the red clique $C \in \mathcal{C}'$ that contains $K$.
  By the construction of $Y_s'$ there is a $j \in Y_s'$ such that
  $\Soc{G_j} = K' \in C$.  Since $K'$ and $K$ are linked, any $h \in
  N_s$ when restricted to $\Omega_i \cup \Omega_j$ is of the form
  $\langle \phi(h') ,h' \rangle $, $h' \in K'$, for some isomorphism
  $\phi$ from $K'$ to $K$. Therefore $N$ when restricted to $\Omega_i$
  is $\phi(K'_{\delta_j})$. By O'Nan-Scott's theorem $K'$ is
  transitive and hence $K'_{\delta_j}$ is a proper subgroup of $K'$.
  Thus $N$ restricted to $\Omega_i$ is also a proper subgroup of $K =
  R_{i,s}$.  \newline

  \noindent {\bf Case 2:} The socle $\Soc{G_i}$ is of the form $K
  \times K'$. Then there is blue edge $e = \{ K , K'\}$ in the graph
  $\mathcal{G}$.  Firstly if $e$ is one of the edges in the maximal
  spanning forest $\mathcal{B}'$ then $N$ fixes the target point
  corresponding to $e$. The group $\pr{N}{\Omega_i}$ is a diagonal
  group $\Diag{K \times K'}$ (O'Nan-Scott theorem) and hence a proper
  subset of $K \times K'$.  Thus we have disposed the case when $e$ is
  an edge of the spanning forest $\mathcal{B}'$.

  We now handle the case when $e$ is not an edge of the spanning
  forest $\mathcal{B}'$. Suppose that the edge $e = \{ K,K'\}$
  connects the distinct red cliques $C_1$ and $C_2$ with $K \in C_1$
  and $K' \in C_2$.  If $C_1$ (or $C_2$) is a clique in $\mathcal{C}'$
  then there is a $j \in Y_s'$ such that $\Soc{G_j} = K_j \in C_1$ (or
  $C_2$).  By an argument similar to the Case~1 it follows that $N$
  restricted to $K$ is a strict subgroup $K''$ isomorphic to the
  subgroup of $K_j$ that fixes $\delta_j$.  Hence $N$ restricted to
  $\Omega_i$ is $K''\times K'$ which is a strict subgroup of $R_{i,s}
  = K \times K'$.

  Suppose that both $C_1$ and $C_2$ are cliques of $\mathcal{C}''$.
  Then since $\mathcal{B}'$ forms a maximal spanning forest, adding
  edge $e$ to $\mathcal{B'}$ gives a cycle $e_1,\ldots,e_{r}, e$ (see
  the figure below).
  \[
  \xymatrix@M=0pt@W=0pt{
    %% First row first column
    \bullet \ar@{--}[rrrr]^<{K_2}
    %% labeling edges
    \ar@{}[rrrr]^>{K_{r-1}'}
    & & & &
    %% second column
    \bullet \ar@{-}[dl]_{e_r} \ar@{}[dl]^<{K_r} \ar@{}[dl]^>{K_r'}\\
    %
    % Second row first column
    %
    & \bullet \ar@{-}[ul]_{e_1} \ar@{}[ul]^<{K_1} \ar@{}[ul]^>{K_1'}
    \ar@{}[rr]_<K & &  \bullet \ar@{}[ll]^<{K'} \ar@{-}[ll]_e }
  \]

  Let $\Omega_{j_t}$ be the orbit that corresponds to the edge $e_t$
  and let $\Soc{G_{j_t}} = K_t \times K_t'$. The group $N$ fixes all
  the points $\delta_{j_t} \in \Omega_{j_t}$.  By
  case~\ref{case-onan-nonab2} of O'Nan-Scott theorem it follows that
  $\pr{N}{\Omega_{j_t}}$ is the diagonal group $\Diag{K_t \times
    K_t'}$. Note that $K_1$ and $K_t'$ are linked to $K$ and $K'$
  respectively in $N_s$. Hence the group $N$ restricted to $\Omega_i$
  is a diagonal group $\Diag{K \times K'}$ which is a strict subgroup
  of $R_{s,t} = K \times K'$.
\end{proof}

\subsubsection{Computing $x^*$}

Given an $x \in G$ we give an $\mathrm{FL}$ algorithm to compute a $y
\in N_s$ such that $x^* = x y$ fixes all target points in $Y_s$.  For
any $i \in Y_s$ let the target point $\delta_i$ of $\Omega_i$ be mapped
to $\nu_i$. Then we want to find a $y$ in $N_s$ that maps $\nu_i$ back
to $\delta_i$.

\begin{proposition}\label{prop-compute-Di}
  Given an $i \in X_s$.  There is an $\mathrm{FL}$ algorithm to
  compute a subset $D_i \subseteq N_s$ elements such that (1) the
  projection of $D_i$ to $\Soc{G_i}$ is one-to-one and (2) for any
  socle part $K'$ of $\Soc{G_j}$, $j \in X_s$, $D_i$ projected to $K'$
  is trivial if $K'$ is not linked to any of the socle parts of
  $\Soc{G_i}$.
\end{proposition}
\begin{proof}

  Let $R_s/R_{s+1} = T_1\times \ldots \times T_u$ where each $T_i$ is
  isomorphic to $T$. Since $N_s/N_{s+1} \hookrightarrow R_s/R_{s+1}$
  there exists a partition $\mathcal{I} = \{I_1,\ldots,I_t \}$ of
  indices $1,\ldots,u$ such that $N_s/N_{s+1}$ is the product
  $\prod_{k=1}^{t} \Diag{\bigtimes_{j \in I_k} T_j}$.  We have
  computed the strong generator set $C$ of $N_s$ rel $N_{s+1}$ as part
  of the SGS of $G$.  Recall that the strong generator set $C$ of
  $N_s$ rel $N_{s+1}$ consists of subset $C_1,\ldots,C_{t}$ where the
  subset $C_k$ corresponds to the diagonal group $\Diag{\bigtimes_{j
      \in I_k} T_j}$, i.e. the projection of $C_k$ on $T_j$ is the
  group $T_j$ if $j \in B_i$ and $1$ otherwise.

  Let $x_1,\ldots,x_r$ be the elements of $C$ whose action on
  $\Omega_i$ is nontrivial.  Then for any other socle part $K_j$ that
  is not linked to any of the socle parts of $\Soc{G_i}$, $x_i$'s are
  trivial on $K_j$. Furthermore if $z_i$ denotes the projection of
  $x_i$ onto $\Soc{G_i}$, then $z_1,\ldots,z_r$ generates $\Soc{G_i}$.
  For each element $z \in K$ we express $z$ as a product $z =
  z_{i_1}\ldots z_{i_k}$. Include into $D_i$ the element $x_z =
  x_{i_1}\ldots x_{i_k}$. Since $\Soc{G_i}$ is a constant sized group
  and each $x_i$'s are elements of the group $G$ with constant sized
  orbits, $D_i$ can be computed in $\mathrm{FL}$.

\end{proof}

\begin{remark}\label{rem-Di-generate}
  Consider the SGS $C = \cup_{k=1}^t C_k$ of $N_s$ rel $N_{s+1}$ where
  $C_k$ corresponds to the diagonal component $\Diag{\bigtimes_{j \in
      I_k} T_j}$. For a $j \in X_s$ the elements of $C_k$ is
  nontrivial on $\Omega_j$ if and only if a $\Soc{G_j} = \ldots \times
  T_{r} \times \ldots$ and $r \in I_k$. It follows from the proof of
  Proposition~\ref{prop-compute-Di} that we can ensure $C_k \subseteq
  D_j$ for any $j$ such that $C_k$ is nontrivial on $\Omega_j$.
  Therefore the set $\cup_{i \in X_s }D_i \cup C'$ is a generator set
  for $N_s$ rel $N_{s+1}$ where $C'$ denotes the elements of $C$ that
  are trivial on all the target orbits.
\end{remark}

We now prove that given any $x \in G$ we can compute in $\mathrm{FL}$
an element $y \in N_s$ such that $x^* = xy$ fixes all the target
points of $Y_s$. Intuitively we want to choose an element $y$ in $N_s$
that ``negates'' the effect of $x$ on $\delta_i$ for all $i \in Y_s$

First we handle the target points in $Y_s'$.  Each $i \in Y_s'$ can be
handled independent of the other target points in $Y_s$, i.e. we can
compute elements $y_i$ such that $xy_i$ fixes $\delta_i$ and for all
$j$ in $Y_s \setminus \{ i \}$, $\pr{y_i}{\Omega_j}$ is $1$.  That
such an element exists follows from the fact that (1) $\Soc{G_i}$ is
transitive and (2) none of the socle parts of $\Soc{G_j}$ is linked to
$K_i = \Soc{G_i}$ for all $j \in Y_s \setminus \{ i \}$.  We compute
$y_i$ in $\mathrm{FL}$ using Proposition~\ref{prop-compute-Di}.

The target points in $Y_s''$ however cannot be handles independently,
i.e.  the choice of a $y_i$ for some $i \in Y_s''$ will have a
nontrivial action on some of the other target orbits in $j \in Y_s''$
as illustrated below.  Recall that for each $i \in Y_s'$ there is an
edge $e_i \in \mathcal{B}'$. The difficulty arises for $i$ and $j$ in
$Y_s''$ for which the edges $e_i$ and $e_j$ share a common vertex in
$\mathcal{G}'$ (see figure below).
\[
\xymatrix@M=0pt@W=0pt{ \bullet\ar@{-}[rr]^{e_i}_{\Omega_i}
  \ar@{-}[rr]_<{K_i'} & \ar@{-}[r]_>>{K_i} & \bullet
  \ar@{-}[rr]^{e_j}_{\Omega_j} \ar@{-}[rr]_<<{K_j} & \ar@{-}[r]_>{K_j'}
  & \bullet }
\]

In such a case $\Soc{G_i} = K_i \times K_i'$ and $\Soc{G_j} = K_j
\times K_j'$ and $K_i$ and $K_j$ are linked. Thus any nontrivial
element chosen from $K_i$ will have a nontrivial action on $\Omega_j$.
Any element $y_j$ that we choose for the orbit $\Omega_j$ has to
negate this ``propagated'' effect. The main idea therefore is to
systematically choose elements $y_e$ for each edge in $\mathcal{B}'$
keeping in view this propagated effect.

Recall that we have computed a lexicographically least maximal
spanning forest $\mathcal{F}$ of $\mathcal{G}'$ with edge set
$\mathcal{B}' \subseteq \mathcal{B}$.  Each tree $\mathcal{T}$ in the
forest $\mathcal{F}$ can be considered as a rooted tree with root at
the lexicographically least vertex of $\mathcal{T}$. Thus each edge in
$\mathcal{B}$ acquires a direction: the tail at the vertex closer to
the root (see figure below).  This gives a partial order on
$\mathcal{B}'$: edges $e < e'$ if $e$ and $e'$ belong to the same tree
and the unique path from the root to the tail of $e'$ contains the
edge $e$.

\[
\xymatrix@M=0pt@W=0pt{
  &  & & \bullet \ar[r]^{e'} & \bullet \\
  \bullet \ar@{~>}[r] & \bullet \ar[r]^e &  \bullet \ar@{~>}[ur] \ar@{~>}[dr]\\
  &&&& }
% \xymatrix{
%  & \bullet \ar@{~>}[d] \\
%  & \bullet \ar@{->}[d]^e \\
%  & \bullet \ar@{~>}[dl] \ar@{~}[dr] \\
%  \bullet \ar@{->}[d]^{e'} &  &  \\
%  \bullet& }
\]

Since the vertices of $\mathcal{G}'$ corresponds to red-cliques in
$\mathcal{G}$ which in turn corresponds to linked socle parts the
following proposition is direct.

\begin{proposition}\label{prop-K2-unlinked}
  Let $e$ be any edge with tail at $K_1$ and head at $K_2$. Fix an
  edge $e' \ngtr e$ and let $\Omega_i$ be the orbit corresponding to
  $e'$. Then the socle part $K_2$ is not linked to any of the socle
  parts of $\Soc{G_i}$.
\end{proposition}

Consider any edge $e \in \mathcal{B}'$ and let $\mathcal{T}_e$ be
rooted tree in the forest $\mathcal{B}'$ containing $e$.  We give an
$\mathrm{FL}$ algorithm (Algorithm~\ref{algo-compute-ye}) to compute a
permutation $y_e \in N_s$ that is trivial on all orbits corresponding
to edges $e' \ngtr e$ and for the unique path $e_1,\ldots,e_t$ from
the root of $\mathcal{T}_e$ to the tail of $e$, negates the action of
$xy_{e_1}\ldots y_{e_t}$ on the target point corresponding to $e$. In
fact $y_e$ will be trivial on all orbits other than those that
corresponds to $e$ and edges going out of the head of $e$ (indicated
by a double arrow in the figure).

\[
\xymatrix@M=0pt@W=0pt{
  & & & & &  \bullet \ar@{.>}[r] & \\
  % the path
  \bullet \ar[r]_{e_1} & %
  \bullet \ar@{.>}[r] & %
  \bullet \ar[r]_{e_t} & %
  \bullet \ar[r]_e & %
  \bullet \ar@{=>}[ur] \ar@{=>}[r] \ar@{=>}[dr] %
  &\bullet \ar@{.>}[r] & &
  \\
  & & & & &  \bullet \ar@{.>}[r] & \\
}
\]

The main idea behind algorithm is that once the path $e_1,\ldots,e_t$
is computed (which can be done in $\mathrm{FL}$ using Reingold's
algorithm~\cite{reingold2005undirected}), the propagated effect of
$y_{e_i}$'s on the orbit associated to $e$ can be kept track of using
constant amount of space. This is because for each $i$ since $e_i <
e_j$ the permutation $y_{e_i}$ is trivial on all the orbits associated
to $e_j$ for $j > i+1$. Let $e$ be the directed edge $(K_1,K_2)$ then
since $K_2$ is transitive on the orbit associated to $e$, the
permutation $y_e$ will be chosen such that $y_e$ does not effect any
of the orbits associated to edges $e' \ngtr e$.
Proposition~\ref{prop-K2-unlinked} guarantees that such a $y_e$ exists.

\begin{algorithm}[h]
  \caption{Computing the permutations $y_e$.}\label{algo-compute-ye}
  \KwIn{The permutation $x \in G$ and an edge $e \in \mathcal{B}'$}

  \KwOut{The permutation $y_e$}

  \lnl{step-compute-path} Compute a path $e_1, \ldots, e_t = e$ from
  the corresponding root of the tree containing $e$ to $e$.

  Let $\Sigma_i$ be the $G$-orbit associated to $e_i$.

  Let $\delta_i$ be the target point associated with the edge $e_i$.

  $y^* \leftarrow 1$.

  \lnl{loop-compute-ye}%
  \For{$i = 1$ \KwTo $t$} {

    $\delta \leftarrow \delta_{i}^{xy^*}$.

    \lIf{$\delta = \delta_i$}{ $y_i \leftarrow 1.$ }%

    \Else{%

      Let $e_i$ be the directed edge $(K_1,K_2)$ (tail at $K_1$ and
      head at $K_2$).

      \lnl{step-compute-yi}%
      Using Proposition~\ref{prop-compute-Di} compute $y_i$ such that
      $\delta^{y_i} = \delta_i$ with the additional property that
      $y_i$ is trivial and all socle parts not linked to $K_2$.

    }

    \lIf{$i < t$ } {$y^* = \pr{y_i}{\Sigma_{i+1}}$.}%

  }
  \KwRet{$y_t$}

\end{algorithm}

\begin{proposition}
  Algorithm~\ref{algo-compute-ye} is a $\mathrm{FL}$ algorithm.
\end{proposition}
\begin{proof}
  The algorithm can be seen as the composition of two stages (1)
  computing the paths $e_1,\ldots,e_t$ (step~\ref{step-compute-path}
  of Algorithm~\ref{algo-compute-ye}) and (2) computing $y_e$
  (loop~\ref{loop-compute-ye} of Algorithm~\ref{algo-compute-ye}).
  Computing the path involves applying Reingold's $s$-$t$ connectivity
  algorithm~\cite{reingold2005undirected} (also
  Lemma~\ref{lem-connectivity}) repeatedly and hence is in
  $\mathrm{FL}$. The permutation $y_i$ (step~\ref{step-compute-yi} of
  Algorithm~\ref{algo-compute-ye}) is computed by first computing the
  set $D_i$ (using Proposition~\ref{prop-compute-Di}). Recall that
  $D_i$ projects onto $\Soc{G_i} = K_1 \times K_2$ and $K_2$ is
  transitive (O'Nan-Scott).  Hence in $\mathrm{FL}$ by examining all
  the $\# \Soc{G_i}$ elements of $D_i$ we can find a desired $y_i$.
  All these can be achieved by logspace bounded computations.
\end{proof}

Let $e_1,\ldots,e_r$ denote a topological sorting of edges in
$\mathcal{B}'$ and let $y'' = y_{e_1}\ldots y_{e_r}$ then $y''$ is
trivial on all orbits of $Y_s'$ and $xy''$ fixes all the target points
in $Y_s''$. Recall that we have already computed a $y'$ such that $y'$
is trivial on all the orbits in $Y_s''$ and $xy'$ fixes all points of
$Y_s'$. Let  $x^* = x y' y''$.

\begin{proposition}
  The element $x^* \in G$ fixes all the points in $Y_s$.
\end{proposition}
\begin{proof}
  We prove by induction. Let $z = xy'$ then as argued before $z$ fixes
  all the target points on $Y_s'$.  Consider any topological ordering
  $e_1,\ldots,e_r$ of edges in $\mathcal{B}'$. Let $\Omega_i$ denote
  the $G$-orbit corresponding to $e_i$. Let $0 \leq k \leq r+1$ be the
  largest index such that the permutation $z$ fixes the target points
  of $\cup_{j = 1}^{k-1} \Omega_j$. If $k=r+1$ then we are through.
  Otherwise Algorithm~\ref{algo-compute-ye} computes a $y_{e_k}$ such
  that $zy_{e_k}$ fixes $\delta_k$, the target point of $\Omega_k$.
  Let $e_k$ be the directed edge $(K_1,K_2)$ with the head at $K_2$.
  By step~\ref{step-compute-yi} we have ensured that $y_{e_k}$
  projected onto $\Omega_k$ is in $K_2$. Since $e_1,\ldots,e_r$ is a
  topological sort, $e_i \ngtr e_k$ for every $i < k$. Therefore for
  any $i < k$, the socle parts of $\Soc{G_i}$ is not linked to $K_2$
  (Proposition~\ref{prop-K2-unlinked}).  Hence $y_i$ is trivial on all
  $\Omega_i$ for $1 \leq i < k$ and $z' = zy_{e_k}$ fixes all the
  target points in $\cup_{j = 1}^{k} \Omega_j$. We now repeat the
  argument with $z$ replaced with $z' = zy_{e_k}$. At each stage $k$
  increase by $1$ and hence after $r$ steps $k = r+1$ are we are
  through.
\end{proof}

\begin{remark}\label{rem-canonical-yi}

  Consider any $x \in G$ and $x^* = xy$ where $y \in N_s$ be the
  permutation computed by our algorithm such that $x^*$ fixes all
  points in $Y_s$. Let $e = (K_1,K_2)$ be a minimal edge in the $<$
  order (or in other words an edge going out of a root node) with head
  at $K_2$. Then it is straight forward to verify that $y$ restricted
  to $K_1$ is trivial. This follows from the choice of $y_i$'s in
  Algorithm~\ref{algo-compute-ye}.

  Given an element $x \in G$ we have associated for each $i \in Y_s$
  an element $y_i$ such that $x\prod_{i \in Y_s} y_i$ (note the order
  in which the indices of $Y_s''$ are taken does matter; the
  corresponding edges should be topologically sorted).  We can ensure
  that the choice of $y_i$'s depended only on the action of $x$ on the
  target points of $Y_s$. In other words for two elements $x_1$ and
  $x_2$ in $G$ and let $\{ y_i \}_{i \in Y_s}$ and $\{ y_i'\}_{i \in
    Y_s}$ be the elements chosen.  Then if $\delta^{x_1} =
  \delta^{x_2}$ for all target point $\delta$ of $Y_s$, $y_i = y_i'$
  for all $i \in Y_s$ and
  \[
  \prod_{i \in Y_s} y_i = {x_1^*}^{-1} x_1 = {x_2^*}^{-1}x_2 = \prod_{i
    \in Y_s} y_i'.
  \]
  Furthermore we can assume that if $x$ fixes all the target points of
  $Y_s$ then each of the $y_i = 1$ for all $i \in Y_s$. We will make
  this additional assumption which will be helpful in computing the
  generator set for $N$.
\end{remark}
\subsubsection{Computing $N$}

Finally we give the $\mathrm{FL}$ algorithm to compute the generator
set of $N$, the subgroup of $N_s$ that fixes all the target points in
$Y_s$.  To this end we examine the strong generator $C$ of $N_s$ rel
$N_{s+1}$ which we have computed as part of the generator set of $G$.

Let $R_s/R_{s+1} = T_1\times \ldots \times T_u$ where each $T_i$ is
isomorphic to a nonabelian simple group $T$. We have a partition
$\mathcal{I} = \{ I_1,\ldots, I_t \}$ of indices $\{1,\ldots, u\}$,
such that the quotient group $N_s/N_{s+1}$ is the product of diagonals
$\prod_{k=1}^{t} \Diag{\bigtimes_{j \in I_k} T_j}$.  Recall that the
strong generator set $C$ of $N_s$ rel $N_{s+1}$ consists of subset
$C_1,\ldots,C_{t}$ where each $C_k$ corresponds to the diagonal group
$\Diag{\bigtimes_{j \in I_k} T_j}$.

Without loss of generality we assume that $Y_s = \{1,\ldots, r_1 ,
r_1+1, \ldots , r \}$ where $Y_s' = \{ 1, \ldots, r_1\}$ and $Y_s'' =
\{ r_1 +1, \ldots, r \}$. We assume further without loss of generality
that the ordering $r_1 +1,\ldots,r$ of elements of $Y_s''$ is
compatible with the ordering of edges in the forest $\mathcal{F}$,
i.e. if $e_j$ is the edge associated to $j > r_1$ then $e_{r_1 +
  1},\ldots,e_{r_2}$ is a topological sort of edges of $\mathcal{F}$.

Using Proposition~\ref{prop-compute-Di} in $\mathrm{FL}$ for each $i
\in Y_s$ compute the sets $D_i$ such that (1) the projection of $D_i$
on to $\Soc{G_i}$ is one-to-one and (2) for any socle part $K$ of
$\Soc{G_j}$ not linked to socle parts of $\Soc{G_i}$ the projection of
$D_i$ is $1$.

Recall that for each $x \in G$ we gave an $\mathrm{FL}$ to compute
$x^* = xy$, $y \in N_s$ such that $x^*$ fixes all the target points of
$Y_s$. This we achieved by computing for each $i \in Y_s$ an element
$y_i \in N_s$ such that $x y_1 \ldots y_{r_1+r_2} = x^*$. Furthermore
we assume that the $y_i$'s are canonical as described in
Remark~\ref{rem-canonical-yi}.  For each $i \in Y_s$ let $D_i^* = \{
x^* | x \in D_i \}$.

\begin{proposition}
  Let $A$ be a generator set of $N_{s+1}$ and let $C'$ be the elements
  of $C$ that is trivial on the target orbits of $Y_s$. Then $D^* =
  (\cup_{i \in Y_s} D_i^*) \cup C' \cup A$ is a generator set of $N$,
  the subgroup of $N_s$ that fixes all the target points of $Y_s$.
\end{proposition}
\begin{proof}

  Clearly every element of $D^*$ is contained in $N$ therefore $N^*$,
  the group generated by $D^*$, is contained in $N$. We now prove the
  converse.

  It follows from Remark~\ref{rem-Di-generate} that $ D = (\cup_{i \in
    Y_s} D_i) \cup C'$ forms a generator set of $N_s$. Hence any
  element $x \in N$ can be written as $x = x_1\ldots x_{r} y z$ where
  $x_i \in D_i$, $y$ is in the group generated by $C'$ and $z \in
  N_{s+1}$.

  For any $i \in Y_s'$ notice that $x_i$ is trivial on all target
  orbits in $Y_s \setminus \{ i \}$. Hence $x_i$ fixes all the target
  points of $Y_s$. By Remark~\ref{rem-canonical-yi} it follows that
  $x_i^* = x_i \in D_i^*$. Thus to prove that $x$ is in $N^*$ it is
  sufficient to prove that $z = x_{r_1 +1} \ldots x_r \in N^*$.  Let
  $e_j$ denote the edge corresponding to the point $j \in Y_s''$.  Let
  $k\leq r+1$ be the largest integer such that $x_j$ restricted to
  $\Omega_j$ is $1$ for all $r_1 < j < k$.  By the construction of
  $D_k^*$ we have $x_k^* \in D_k^*$ such that $x_k^* = x_k y$ fixes
  all the target points of $Y_s$ where $y$ satisfies the properties of
  Remark~\ref{rem-canonical-yi}.

  Consider the permutation $z' ={x_k^*}^{-1}z= y x_{k+1} \ldots x_r$.
  Since both $z$ and ${x_k^*}^{-1}$ fixes the target points of $Y_s$
  so does $z'$. We show that $z'$ is trivial on all orbits $\Omega_j$,
  $1\leq j \leq k$. First for any $1 \leq i < k$, $x_j$ is trivial for
  all $j > k$.  Recall that if $e_k$ be the directed edge $(K_1,K_2)$
  with the head at $K_2$ then $y$ is trivial on $\Omega_j$ for all $j
  < k$ and projected to $\Omega_k$, is an element of the subgroup
  $K_2$ (this follows from Remark~\ref{rem-canonical-yi}).  Therefore
  $z' = yx_{k+1}\ldots x_r$ is trivial on $\Omega_j$ for all $r_1 < j
  < k$.  Furthermore note that none of the socle parts of $\Soc{G_j}$
  is linked to $K_1$ for $k < j \leq r$ and hence $x_j$ projected on
  $\Omega_k$ is also an element of $K_2$. This proves that $z'$
  projected to $\Omega_k$ is an element of $K_2$. However by the
  O'Nan-Scott theorem $K_2$ is regular. This is possible if and only
  if $z'$ restricted to $\Omega_k$ is $1$ as $z'$ fixes the target
  point of $\Omega_k$.

  We repeat this argument with $z$ replaced with $z'$ and in each step
  $k$ increases by at least $1$. Thus it follows that there exists
  element $x_j^* \in D_j^*$, $r_1 < j \leq r$, such that $z \prod_{j =
    r_1 +1}^r x_j^*$ is $1$ on all the target orbits of $Y_s$ and
  hence is of the form $gh$ where $g$ is in the group generated by
  $C'$ and $h$ is in $N_{s+1}$.  It follows that $x$ is in the group
  generated by $D^*$.

\end{proof}

Given $x \in G$ since $x^*$ can be computed in $\mathrm{FL}$ it
follows that a generator set for $N$ can be computed in $\mathrm{FL}$.
This completes the algorithm for target reduction in the nonabelian
case.

\begin{theorem}\label{thm-target-reduction}
  Given an instance $(G,\Omega,\Delta)$ of $\ProblemFont{PWS}_c$
  subgroup $G'$ of $G$ satisfying the properties (1) $G \geq G' \geq
  \pointwise{G}{\Delta}$ and (2) for all $G$-orbit $\Sigma$ such that
  $\Sigma \cap \Delta \neq \emptyset$, $\pr{G}{\Sigma} >
  \pr{G'}{\Sigma}$ can be computed in the $\ModkL{k}$ hierarchy where
  $k$ is the product of all primes less than $c$ and the level of the
  hierarchy is a constant that depends only on $c$.
\end{theorem}
\section{Complexity of {\small BCGI$_b$}}

We now show that $\ProblemFont{PWS}_c$ is in the
$\ModkL{k}$-hierarchy.  The complete algorithm is given below
(Algorithm~\ref{algo-pws}).  Each iteration of the
loop~\ref{loop-compute-gdelta} is in the $\ModkL{k}$-hierarchy:
step~\ref{step-compute-sgs} uses Theorem~\ref{thm-SGS} and
step~\ref{step-target-reduction} uses
Theorem~\ref{thm-target-reduction}. Since the $G$-orbits are of size
bounded by $c$, we will have to iterate through the
loop~\ref{loop-compute-gdelta} at most $c.\log{c}$ times before each
point in $\Delta$ is a $G$-orbit in itself (i.e. $H$ is
$\pointwise{G}{\Delta}$).

\begin{algorithm}
  \caption{Complete algorithm for $\ProblemFont{PWS}_c$}
  \label{algo-pws}
  \KwIn{An instance $(G,\Delta)$ of $\ProblemFont{PWS}_c$} \KwOut{A
    generator set for $\pointwise{G}{\Delta}$.}

  $H \leftarrow G$.

  \lnl{loop-compute-gdelta}
  \Repeat{$H$ fixes all points in $\Delta$}
  {

    \lnl{step-compute-sgs}
    Compute a strong generator set for $H$ with respect to a locally
    residual series.

    \lnl{step-target-reduction}
    Compute the generator set of $H'$ such that $H \geq H' \geq
    \pointwise{H}{\Delta}$ and such that $\pr{H'}{\Sigma} <
    \pr{H}{\Sigma}$ for each $H$-orbit $\Sigma$ containing a point of
    $\Delta$.

    $H \leftarrow H'$

  }

  \KwRet{the generator set for $H$}
\end{algorithm}

Using Proposition~\ref{prop-red-aut-pws} we have the main theorem of
this chapter.

\begin{theorem}
  The $\ProblemFont{PWS}_c$, $\ProblemFont{AUT}_b$ and
  ${\ProblemFont{BCGI}}_b$ are in the $\ModkL{k}$-hierarchy.
\end{theorem}

\section{Discussion}

We have proved the $\ProblemFont{BCGI}$ is in the
$\ModkL{k}$-hierarchy. In fact we proved this by proving that
$\ProblemFont{PWS}_c$ is in the $\ModkL{k}$-hierarchy. The algorithm
involved two stages; computing the strong generator set and the target
reduction. Both these stages handled the abelian and non-abelian
quotients separately. It is surprising that even though the group
theory is more involved the non-abelian quotients could be handled in
logspace where as the abelian quotient required $\ModkL{p}$ as an
oracle for some appropriate prime $p$. Thus if the composition series
of $G$ had only nonabelian simple groups then $\ProblemFont{PWS}_c$
for $(G,\Omega,\Delta)$ can be solved in logspace. In view of the
hardness result of Tor\'an~\cite{toran2004hardness}, we cannot improve
on the complexity of handling the abelian quotients unless $\ModkL{p}$
is in $\mathrm{L}$.

There is a gap between our upper bound for $\ProblemFont{BCGI}$ and
the lower bound that follows from Tor\'an's
results~\cite{toran2004hardness}. It follows from Tor\'an's result
that $\ProblemFont{BCGI}_b$ is hard for the $l$th level $\ModkL{k}$
where $b$ is exponential in $k$ and $l$. Our upper bound however places
$\ProblemFont{BCGI}_b$ is a higher lever of the $\ModkL{k}$-hierarchy.
\chapter{Computational Galois theory}
\label{chap-ant}

We now move on to the next part of this thesis where we show upper
bounds on certain computational problems in Galois theory. Given a
polynomial $f(X)$ of degree $n$ over $\mathbb{Q}$ we are interested in
the following three fundamental tasks.

\begin{enumerate}
\item Compute the Galois group as a permutation group on the roots of
  $f(X)$,
\item Compute the order of the Galois group of $f(X)$ or equivalently
  the degree $[\mathbb{Q}_f: \mathbb{Q}]$ of the splitting field
  extension of $f(X)$.
\item Check whether the Galois group of $f(X)$ satisfies certain
  properties.
\end{enumerate}

Given a polynomial $f(X)$ over $\mathbb{Q}$, in
Chapter~\ref{chap-property-testing} we give polynomial time algorithms
for (1) checking whether the Galois group of $f(X)$ is nilpotent and
(2) checking whether the Galois group of $f(X)$ is in $\Gamma_d$.
Chapter~\ref{chap-order-finding} deals with computing the order of the
Galois group of a polynomial. We prove certain upper bounds assuming
the generalised Riemann hypothesis. Finally in
Chapter~\ref{chap-galois-special} we give some algorithms for
computing the Galois group of certain special polynomials.

For a polynomial $f(X)$, the Galois group $G$ can be seen as a
permutation group on the set of roots of $f(X)$.  Combinatorial
structures like orbits and blocks associated with the Galois group $G$
play an important role in our results. The Galois correspondence
between blocks and subgroups on one hand
(Theorem~\ref{thm-blocks-galois}) and subgroups and subfields on the
other hand (Theorem~\ref{thm-funda-galois}) gives us a Galois
correspondence (Theorem~\ref{thm-twoway-galois}) between subfields,
subgroups and blocks. This interplay between fields and permutation
group theoretic structures is crucial for our upper bounds.  Apart
from the permutation group theory we require, for our conditional
results of Chapter~\ref{chap-order-finding} and
\ref{chap-galois-special}, an effective version of the Chebotarev
density theorem proved assuming the generalised Riemann hypothesis
(Section~\ref{sect-chebotarev-density}).

In this chapter we give a brief description of the Galois theory and
algebraic number theory required for our results in
Chapters~\ref{chap-property-testing}, \ref{chap-order-finding} and
\ref{chap-galois-special}. In Section~\ref{sect-galois-theory} we
describe the required Galois theory and in Section~\ref{sect-ant} some
algebraic number theory. In Section~\ref{sect-basicalgo-ant} we
explain some fundamental algorithmic results that we require in this
thesis. To measure the complexity of various algorithms we need a
precise formulation of sizes of various algebraic entities. This is
explained in Section~\ref{sect-basicalgo-ant}. Finally, in
Section~\ref{sect-bounds-ant}, we prove some bounds that will be
needed in analysing the complexity of various algorithms in this
thesis.

\section{Galois theory}\label{sect-galois-theory}

We recall some basic facts from Galois theory required for this
thesis.  A detailed account is available in any standard text book on
Galois theory or Algebra for example Lang~\cite[Chapter
VI]{lang:algebra}.  By $\mathbb{Q}$, $\mathbb{R}$ and $\mathbb{C}$ we
mean the field of rational, real and complex numbers respectively. The
ring of integers will be denoted by $\mathbb{Z}$. For primes $p$,
$\mathbb{F}_{p^r}$ denotes the unique finite field of $p^r$ elements.
%
%
%
\nomclfields{$\mathbb{Q}$, $\mathbb{R}$, $\mathbb{C}$}{field of
  rational, real and complex numbers respectively}%
\nomclfields{$\mathbb{F}_{p^r}$}{unique finite field of cardinality
  $p^r$}%
%
%

Let $K$ be a field. A field $L$ is said to be a \emph{field
  extension}\index{extension!of a field} of $K$, denoted by $L/K$, if
$L \supseteq K$. For a field extension $L/K$, $L$ is a vector space
over $K$ and its dimension, denoted by $[L:K]$, is the
\emph{degree}\index{degree} of $L/K$. An extension $L/K$ is
\emph{finite} if its degree $[L:K]$ is finite.  If $L/M$ and $M/K$ are
finite extensions then $[L:K] = [L:M].[M:K]$.%
\nomclfields{$[L:K]$}{degree of the extension $L/K$\refpage}

Let $K$ be any field. By $K[X]$ we mean the ring of polynomials in $X$
with coefficients from $K$. The ring $K[X]$ is a \emph{unique
  factorisation domain}.  A polynomial $f(X) \in K[X]$ is
\emph{irreducible}\index{irreducible polynomials} if it has no
nontrivial factor.%
\nomclfields{$K[X]$}{polynomials in $X$ with coefficients from $K$}

For a field $K$ the smallest positive integer $n$ such that $n.1 = 0$,
if it exists, is called the characteristic of $K$. If no such integer
exists then we say that $K$ is of characteristic $0$.  For example the
fields $\mathbb{Q}$, $\mathbb{R}$ and $\mathbb{C}$ are of
characteristic $0$ where as the field $\mathbb{F}_{p^r}$ is of
characteristic $p$. For any field $K$, the characteristic is either
$0$ or a prime $p$. If $L/K$ is an extension then the characteristic
of $L$ is same as the characteristic of $K$.

Let $L/K$ be an extension. Then $\alpha \in L$ is
\emph{algebraic}\index{algebraic} over $K$ if there is an $f(X)\in
K[X]$ such that $f(\alpha)=0$. For $\alpha$ algebraic over $K$, the
\emph{minimal polynomial}\index{minimal polynomial} of $\alpha$ over
$K$ is the unique monic polynomial $\mu_\alpha[K](X)$ of least degree
in $K[X]$ for which $\alpha$ is a root. When $K$ is clear from the
context, we simply write $\mu_\alpha(X)$ instead of
$\mu_\alpha[K](X)$. Elements $\alpha,\beta\in L$ are
\emph{conjugates}\index{conjugate} over $K$ if they have the same
minimal polynomial over $K$.

Let $L/K$ be an extension and let $\alpha \in L$ then $K(\alpha)$ is
the smallest subfield of $L$ containing $K$ and $\alpha$. If $\alpha$
is algebraic over $K$ and if $\mu_\alpha(X)$ is the minimal polynomial
of $\alpha$ over $K$ then $K(\alpha)$ is isomorphic to
$K[X]/\mu_\alpha(X)$, the ring of polynomials over $K$ modulo
$\mu_\alpha(x)$. If $L/K$ is a finite extension then by the primitive
element theorem \cite[Theorem 4.6, Chapter V]{lang:algebra} there is
an $\alpha\in L$ such that $L=K(\alpha)$. Such an element $\alpha$ is
called a \emph{primitive element}\index{primitive!element} of $L$. A
\emph{primitive polynomial}\index{primitive!polynomial} of an
extension $L/K$ is the minimal polynomial of some primitive element of
$L/K$. Thus if $T(X)$ is a primitive polynomial of $L/K$ then the
field $L$ is isomorphic to $K[X]/T(X)$.

The \emph{splitting field}\index{splitting field} $K_f$ of $f\in K[X]$
is the smallest extension of $K$ containing all the roots of $f$.  An
extension $L/K$ is \emph{normal}\index{extension!normal extension} if
for all irreducible polynomials $f(X)\in K[X]$, either $f(X)$ splits
completely into linear factors or has no root in $L$. Any finite
normal extension over $K$ is the splitting field of a polynomial in
$K[X]$. Let $L/K$ be any extension.  By \emph{normal
  closure}\index{normal closure} of $L$ over $K$ we mean the smallest
normal extension of $K$ that contains $L$.  For a finite extension
$L/K$, let $T(X)$ be any primitive polynomial.  The normal closure of
$L$ over $K$ is the splitting field over $K$ of $T(X)$.
\nomclfields{$K_f$}{splitting field of the polynomial $f(X)$ over
  $K$\refpage}

An extension $L/K$ is \emph{separable}\index{extension!separable
  extension} if for all irreducible polynomials $f(X) \in K[X]$ there
are no multiple roots in $L$. In particular all characteristic $0$
fields are separable and so are all finite fields. A normal and
separable extension $L/K$ is called a \emph{Galois
  extension}\index{extension!Galois extension}.

A field $K$ is \emph{algebraically closed} if every polynomial in
$K[X]$ splits over $K$. For example the field of complex numbers
$\mathbb{C}$ is algebraically closed. Let $K$ be any field. The
\emph{algebraic closure}\index{algebraic closure} of $K$, denoted by
$\overline{K}$, is the smallest field containing $K$ that is
algebraically closed.  For every field there is a unique algebraic
closure up to isomorphism.

An \emph{automorphism}\index{automorphism!field automorphism} of a
field $L$ is a field isomorphism $\sigma:L\rightarrow L$. The
\emph{Galois group}\index{Galois group} $\Gal{L/K}$ of a field
extension $L/K$ is the subgroup of automorphisms of $L$ that leaves
$K$ fixed, i.e. for all $\alpha \in K$, $\sigma(\alpha) = \alpha$. The
Galois group of a polynomial $f\in K[X]$ is $\Gal{K_f/K}$.  Let $f(X)$
be a polynomial over $K$ of degree $n$. If $\alpha$ is a root of
$f(X)$ and $\sigma \in \Gal{K_f/K}$ then $\sigma(\alpha)$ is also a
root of $f(X)$. Each $\sigma\in\Gal{K_f/K}$ is thus completely
determined by $\sigma(\alpha_i)$, $1 \leq i \leq n$, where the
$\alpha_1,\ldots,\alpha_n$ are the roots of $f$.  Thus the Galois
group of a polynomial $f(X)$ can be seen as a permutation group on the
set of roots of $f(X)$ and hence has order at most $n!$.

For a subgroup $G$ of automorphisms of $L$, the \emph{fixed field}
$\Fix{L}{G}$ is the largest subfield $K$ of $L$ such that every
element of $G$ restricted to $K$ gives the identity automorphism. We
now state the fundamental theorem of Galois theory~\cite[Theorem 1.1,
Chapter VI]{lang:algebra} which, given a finite Galois extension $L/K$
with Galois group $G$, gives a \emph{Galois correspondence} between
subgroups of $G$ and subfields of $L$ containing $K$.%
%
%
\index{Galois correspondence!of fields}%
\index{fixed field}%
\nomclfields{\Fix{L}{G}}{fixed field of $L$ under $G$\refpage}

\begin{theorem}\label{thm-funda-galois} Let $L/K$ be a
  Galois extension with Galois group $G$. There is a one-to-one
  correspondence between subfields $E$ of $L$ containing $K$ and
  subgroups $H$ of $G$, given by $E \rightleftharpoons \Fix{L}{H}$.
  The Galois group $\Gal{L/E}$ is $H$ and $E/K$ is a Galois extension
  if and only if $H$ is a normal subgroup of $G$. If $H$ is a normal
  subgroup of $G$ and $E = \Fix{L}{H}$ then $\Gal{E/K}$ is the
  quotient group $G/H$.
\end{theorem}%
\section{Finite Fields}\label{sect-finite-fields}

A finite field is a field of finite cardinality. An example for a
finite field is $\mathbb{F}_p = \mathbb{Z}/p\mathbb{Z}$, the field of
integers modulo a prime $p$ with addition and multiplication defined
modulo $p$.  For any prime $p$ and an integer $r$ there is a unique
field of cardinality $p^r$ which we denote by $\mathbb{F}_{p^r}$. We
have $[\mathbb{F}_{p^r} : \mathbb{F}_p] = r$ and $\mathbb{F}_{p^r}$ is
the splitting field of $f(X)$ for any irreducible polynomial $f(X) \in
\mathbb{F}_p[X]$ of degree $r$. For integers $n$ and $r$,
$\mathbb{F}_{p^n}$ is an extension of $\mathbb{F}_{p^r}$ if and only
if $r$ divides $n$ in which case the degree
$[\mathbb{F}_{p^n}:\mathbb{F}_{p^r}]$ is given by $\frac{n}{r}$. Also
in this case $\mathbb{F}_{p^n}/\mathbb{F}_{p^r}$ is a Galois
extension.

Consider the algebraic closure $\overline{\mathbb{F}}_p$ of
$\mathbb{F}_p$. The map $\sigma: a \mapsto a^p$ is an automorphism of
$\overline{\mathbb{F}}_p$ that is identity on $\mathbb{F}_p$. The
automorphism $\sigma$ is called the \emph{Frobenius}\index{Frobenius}
automorphism. The Galois group
$\Gal{\mathbb{F}_{p^n}/\mathbb{F}_{p^r}}$ is a cyclic group of order
$\frac{n}{r}$ and is generated by $\sigma^r$.  In terms of the
Frobenius we can give a different characterisation of the field
$\mathbb{F}_{p^r}$. The field $\mathbb{F}_{p^r}$ is the fixed field of
$\overline{\mathbb{F}}_p$ under the group of automorphisms generated
by $\sigma^r$. Equivalently, $\mathbb{F}_{p^r}$ is the set of roots of
the polynomial $X^{p^r} - X$ in $\overline{\mathbb{F}}_p$.

Let $f(X)$ be any polynomial in $\mathbb{F}_q$, $q$ a power of prime
$p$. Let $f(X)$ factorise as $f_1\ldots f_r$ over $\mathbb{F}_q$ and
let $d_i$ denote the degrees of $f_i$. The splitting field of $f$ is
$\mathbb{F}_{q^m}$ where $m$ is the least common multiple of the
integers $d_1,\ldots,d_r$.

\section{Algebraic numbers and number fields}\label{sect-ant}

We now recall some algebraic number theory.  A detailed presentation
is available in any standard textbook on algebraic number theory like
for example the one due to Neukirch~\cite{neukirch:ant}.

\emph{Algebraic numbers}\index{algebraic numbers} are roots of
polynomials over $\mathbb{Q}$ and \emph{algebraic
  integers}\index{algebraic integers} are roots of monic polynomials
in $\mathbb{Z}[X]$. The set of rational algebraic integers, i.e.
algebraic integers in $\mathbb{Q}$, is exactly $\mathbb{Z}$. For an
algebraic number $\alpha$ there is an integer $m\in \mathbb{Z}$ such
that $m\alpha$ is an algebraic integer.  A \emph{number
  field}\index{number field} is a finite extension of $\mathbb{Q}$.

Let $\alpha$ be an algebraic number and let $K$ be the number field
$\mathbb{Q}(\alpha)$. Since $\mathbb{C}$ is algebraically closed and
contains $\mathbb{Q}$, $K$ can be seen as a subfield of $\mathbb{C}$,
i.e.  there is an isomorphism from $K$ to a subfield of $\mathbb{C}$.
Such an isomorphism from $K$ to $\mathbb{C}$ is called an embedding of
$K$. If $K$ is of degree $n$ then there exists $n$ distinct embeddings
of $K$ into $\mathbb{C}$. An embedding $\sigma$ of $K$ is a \emph{real
  embedding}\index{embedding!real embedding} if the image of $K$ under
$\sigma$ is contained in $\mathbb{R}$, otherwise it is a \emph{complex
  embedding}\index{embedding!complex embedding}.  The
\emph{height}\index{height} of $\alpha$, denoted by $\Height{\alpha}$,
is $\mathrm{max}\{|\sigma(\alpha)|^{c_\sigma} \}$, where $\sigma$
varies over all embeddings of $K$ and $c_\sigma$ is either $1$ or $2$
depending on whether $\sigma$ is a real or complex embedding. Let
$\mu_\alpha(X) \in \mathbb{Q}[X]$ be the minimal polynomial of
$\alpha$ then $\Height{\alpha}$ is $\mathrm{max}\{ |\eta|^{c_\eta} \}$
where $\eta$ runs over all roots of $\mu_{\alpha}$ in $\mathbb{C}$ and
$c_\eta$ is $1$ if $\eta$ is a real root and $2$ otherwise.  If
$\alpha^\prime$ is a conjugate of $\alpha$ then $\Height{\alpha} =
\Height{\alpha^\prime}$. The height of an algebraic number is a
measure of its size. Using Cauchy-Schwartz the following inequalities
can be derived.%
\nomclfields{$\Height{\alpha}$}{height of the algebraic number
  $\alpha$\refpage}

\begin{lemma}\label{lem-height-inequalities}
For any two algebraic numbers $\alpha$ and $\beta$:
\begin{enumerate}
  \item $\Height{\alpha + \beta} \leq \Height{\alpha} + \Height{\beta}$.
  \item $\Height{\alpha \beta} \leq \Height{\alpha} \Height{\beta}$.
  \end{enumerate}
\end{lemma}

\subsection{Ring of Algebraic Integers}

Let $K$ be a number field of degree $n$ and let $\Int[K]$ denote the
\emph{ring of algebraic integers} of $K$. There exist
$\omega_1,\ldots,\omega_n\in \Int[K]$ such that $\Int[K] =
\mathbb{Z}\omega_1+ \ldots + \mathbb{Z}\omega_n$. Such a set of
elements in $\Int[K]$ is a \emph{basis} for $\Int[K]$. If
$\omega_1,\ldots,\omega_n$ is a basis for $\Int[K]$ then $K =
\mathbb{Q}\omega_1+\ldots + \mathbb{Q}\omega_n$, i.e. the set $\{
\omega_1,\ldots,\omega_n\}$ is a basis of $K$ as a vector space over
$\mathbb{Q}$. For two bases $\theta_1,\ldots,\theta_n$ and
$\omega_1,\ldots,\omega_n$ of $\Int[K]$ there is a unimodular matrix
$A = (a_{ij})$ such that $\omega_i = \sum a_{ij} \theta_j$ for all $1
\leq i \leq n$.%
%
%
\nomclfields{$\Int[K]$}{ring of algebraic integers of number field
  $K$}.
%

Let $K$ be a number field of degree $n$. Recall that $K$ has $n$
distinct embedding $\sigma_1,\ldots,\sigma_n$ into $\mathbb{C}$. Let
$\omega_1,\ldots,\omega_n$ be a basis for $\Int[K]$. Then the
\emph{discriminant}\index{discriminant!of a number field} $d_K$ of $K$
is the positive integer $|\textrm{det}(\sigma_j(\omega_i))|^2$. The
discriminant is independent of the basis chosen for $\Int[K]$.
%
\nomclfields{$d_K$}{discriminant of the number field $K$}
%

An ideal $\Ideal{a}$ of $\Int[K]$ is an additive subgroup of $\Int[K]$
such that for every $\alpha \in \Int[K]$ and $\beta \in \Ideal{a}$
$\alpha \beta \in \Ideal{a}$. Let $\Ideal{a}$ be an ideal of
$\Int[K]$. For an algebraic integer $\alpha \in \Int[K]$, the set
$\alpha \Int[K] = \{ \alpha \beta | \beta \in \Int[K] \}$ is an ideal.
Such ideals are called \emph{principal ideals}. Often we will denote
the principal ideal $\alpha \Int[K]$ as $\alpha$. A principal ideal
domain is a ring where all ideals are principal. An example for a
principal ideal domain is $\mathbb{Z}$.

We define the sum and product of ideals of $\Int[K]$. For ideals
$\Ideal{a}$ and $\Ideal{b}$ of $\Int[K]$, by $\Ideal{a} + \Ideal{b}$
we mean $\{ \alpha + \beta : \alpha \in \Ideal{a}\textrm{, } \beta \in
\Ideal{b} \}$. Similarly by $\Ideal{a} \Ideal{b}$ we mean $\{ \sum_i
\alpha_i \beta_i : \alpha_i \in \Ideal{a}\textrm{, } \beta_i \in
\Ideal{b} \}$.  Furthermore $\Ideal{a} + \Ideal{b}$ is the smallest
ideal that contains $\Ideal{a}$ and $\Ideal{b}$ and $\Ideal{a}
\Ideal{b}$ is the ideal $\Ideal{a} \cap \Ideal{b}$.

We say that $\Ideal{a}$ \emph{divides} $\Ideal{b}$, denoted by
$\Ideal{a} \mid \Ideal{b}$, if $\Ideal{a} \supseteq \Ideal{b}$. Unlike
$\mathbb{Z}$, for number fields $K$, $\Int[K]$ need not be a unique
factorisation domain (for example in the ring $\mathbb{Z}[\sqrt{-5}]$,
21 has two factorisations~\cite[Chapter I, \S 3]{neukirch:ant}).
However ideals of $\Int[K]$ have the unique factorisation property,
i.e. any ideal $\Ideal{a}$ has a unique factorisation into prime
ideals as $\Ideal{a} = \Ideal{p}_1^{a_1} \ldots \Ideal{p}_r^{a_r}$,
where $a_i$ is the highest power $k$ such that $\Ideal{p}_i^k$ divides
$\Ideal{a}$ ($\Int[K]$ is a \emph{Dedekind domain}).

For any ideal $\Ideal{a}$, the ring $\Int[K]/\Ideal{a}$ is a finite
ring.  The \emph{norm}\index{norm} of $\Ideal{a}$, denoted by
$\Norm{\Ideal{a}}$, is the number of elements in $\Int[K]/\Ideal{a}$.
Consider a number field $K$ of degree $n$. Let
$\sigma_1,\ldots,\sigma_n$ be the $n$ distinct embeddings of $K$ into
$\mathbb{C}$. For any $\alpha \in \Int[K]$, the norm of the principal
ideal $\alpha \Int[K]$, which we denote by $\Norm{\alpha}$, is equal
to the product $\prod_i \sigma_i(\alpha)$.%
%
%
\nomclfields{$\Norm{\Ideal{a}}$,$\Norm{\alpha}$}{norm of the ideal
  $\Ideal{a}$ and $\alpha \Int[K]$ respectively\refpage}
%
%

Let $p \in \mathbb{Z}$ be any prime. For a number field $K$, the
principal ideal $p\Int[K]$, which we denote by $p$, need not be a
prime ideal. Knowing how the principal ideal $p$ factorise is
important and Kummer-Dedekind theorem is algorithmically useful for
this purpose (see \cite[Theorem 4.8.13]{cohen:1993} for a proof).%
%
%
\index{Kummer-Dedekind Theorem}%
%

\begin{theorem}[Kummer-Dedekind]\label{thm-kummer}
  Let $K=\mathbb{Q}(\theta)$, where $\theta$ is an algebraic integer
  with minimal polynomial $T(X)\in\mathbb{Z}[X]$. Let $p \in
  \mathbb{Z}$ be a prime that does not divide the index $[\Int[K]:
  \mathbb{Z}[\theta]]$. Suppose $T = T_1^{e_1}\ldots T_k^{e_k}
  (\textrm{mod }p)$ is the factorisation of $T$ over $\mathbb{F}_p$
  into its irreducible factors. Then $p\Int[K]$ factors into prime
  ideals as $p \Int[K] =\Ideal{p}_1^{e_1}\ldots\Ideal{p}_k^{e_k}$.
  Moreover the prime ideals $\Ideal{p}_i$ are given by $\Ideal{p}_i =
  p\Int[K] + T_i(\theta) \Int[K]$ and $\Int[K]/\Ideal{p}_i \cong
  \mathbb{Z}[\theta]/(p,T_i(\theta))$.
\end{theorem}

\section{Basic algorithms}\label{sect-basicalgo-ant}

In this section we give an overview of the algorithmic results
required for this thesis. For a detailed presentation of various
algorithmic aspects of algebraic number theory we refer the reader to
the textbook of Cohen~\cite{cohen:1993}. The algorithms we describe
take various algebraic entities like algebraic numbers and number
fields as inputs.  We need to encode these algebraic entities over a
finite alphabet $\Sigma$ typically $\{0,1\}$. The complexity of these
algorithms are measured in terms of the size of these encodings. Our
first goal is to make this precise.

\subsection{Encoding algebraic entities}

For integers $c$ we use the standard binary encoding.  The size of an
integer $c$ is therefore $\lceil \lg{c}\rceil$. A rational number $r$
is given by a pair of coprime integers $(a,b)$ such that $r =
\frac{a}{b}$. Thus, $\size{r} = \size{a} + \size{b}$. Elements of the
finite field $\mathbb{F}_p$, for prime $p$, will be represented as
integers in between $0$ and $p$. Hence an element of $\mathbb{F}_p$ is
of size $\lg{p}$.

The fields that we encounter in this thesis are either finite fields
or number fields. Recall that any field $K$ is a vector space over the
associated base field which is either $\mathbb{Q}$, if the
characteristic is $0$, or $\mathbb{F}_p$, if the characteristic is
$p$.  We follow the approach of
Lenstra~\cite{lenstra91isomorphisms,lenstra92algorithm} for encoding
fields. Here we describe how number fields are presented. A similar
approach can be taken for finite fields for which we refer to the
article of Lenstra~\cite{lenstra91isomorphisms}.

There are two algorithmically equivalent ways of presenting a number
field $K$, (1) by explicit data and (2) by presenting a primitive
polynomial for $K$.  Let $K$ be a number field of degree $n$. By
\emph{explicit data} we mean a linearly independent basis
$e_1,\ldots,e_n$ for $K$ as a vector space over $\mathbb{Q}$ together
with $n^3$ rationals $\{c_{ijk}\}_{1 \leq i, j, k, \leq n}$ such that
$e_i e_j = \sum_k c_{ijk} e_k$.  In addition by multiplying each
$e_i$'s by suitable rational integers we assume, with out loss of
generality, that $e_i$'s are algebraic integers.  Thus the field can
be presented by giving the list $\{c_{ijk}\}_{1 \leq i,j,k \leq n}$
and by size of $K$ we mean $\sum \size{c_{ijk}}$.

Any $\alpha \in K$ can be expressed uniquely as a summation $\alpha =
\sum a_i e_i$, $a_i \in \mathbb{Q}$.  By $\size{\alpha}$ we mean $\sum
\size{a_i}$. A polynomial of degree $d$ over $K$ is presented by
giving the ordered list of all its $d$ coefficients and hence for
$f(X) = a_0 + \ldots + a_d X^d$ in $K[X]$ by $\size{f}$ we mean $\sum
\size{a_i}$.

Recall that $K = \mathbb{Q}(X)/\mu(X)$ for some primitive polynomial
$\mu(X)$ over $\mathbb{Q}$.  Thus a number field $K$ can be presented
by giving a primitive polynomial $\mu(X) \in \mathbb{Q}[X]$.  If
$\mu(X) = c_0 + c_1 X + \ldots + c_{n-1} X^{n-1} + X^n$ then by
$\size{K}$ we mean $\sum \size{c_i}$.  As before we can ensure that
$\mu(X)$ is a monic polynomial with coefficients from $\mathbb{Z}$.

A primitive polynomial $\mu(X)$ for $K$ directly gives explicit data
for $K$: choose $e_i$ to be $X^{i-1}\ (\textrm{mod } \mu(X))$.
Conversely we show that given explicit data, one can compute a
primitive polynomial.  We first prove the following lemma.

\begin{lemma}\label{lem-compute-minpoly}
  Let $K$ be a number field of degree $n$ presented via explicit data
  $\{ c_{ijk}\}_{1 \leq i,j,k \leq n}$.  Let $e_1,\ldots,e_n$ denote
  the corresponding basis for $K$.  Given an algebraic number $\alpha
  = \sum_{i = 1}^n a_i e_i$ there is an algorithm to compute the
  minimal polynomial of $\alpha$ that runs in time bounded by a
  polynomial in $\size{K}$ and $\sum \size{a_i}$
\end{lemma}
\begin{proof}
  Recall that $K$ is a vector space over $\mathbb{Q}$ with a basis
  $\{e_i\}_{i=1}^n$ and any algebraic number $\alpha$ in $K$ is a
  vector $\sum a_i e_i$.  The degree $d$ of $\alpha$ is the largest
  $i$ such that the set $\{1,\ldots,\alpha^{i-1}\}$ is a linearly
  independent set of vectors.  It follows that $-\alpha^d$ can be
  written as a linear combination $- \alpha^d = c_0 + \ldots + c_{d-1}
  \alpha^{d-1}$.  Using the explicit data we can compute the vectors
  $\alpha^i = \sum_{j} a_{ij} e_j$ in time polynomial in $\size{K}$
  and $\sum \size{a_i}$.  Furthermore in polynomial time we can
  compute $d$ and the rationals $\{ c_i : 0 \leq i < d \}$ as it
  involves solving linear equations over $\mathbb{Q}$.  The minimal
  polynomial of $\alpha$ is therefore $c_0 + c_1 X + \ldots + c_{d-1}
  X^{d-1} + X^d$.
\end{proof}

We require the following effective version of primitive element
theorem (see Section~6.10 of van der Waerden's
book~\cite{waerden:1991}).

\begin{lemma}\label{lem-combine-fields}
  Let $\alpha$ and $\beta$ be algebraic numbers of degrees $m$ and $n$
  respectively.  Let $\{ \alpha_i \}_{i=1}^m$ and $\{ \beta_j
  \}_{j=1}^n$ be their $\mathbb{Q}$-conjugates. Let $c$ be any integer
  such that $\alpha_i + c \beta_j \neq \alpha_r + c \beta_s$ for all
  $(i,j) \neq (r,s)$. Then $\alpha + c \beta$ is a primitive element
  of $\mathbb{Q}(\alpha,\beta)$.
\end{lemma}

Consider the set $A = \{ \frac{\alpha_i - \alpha_r}{\beta_s -
  \beta_j}| s \neq j \}$ of ${m \choose 2}.{n \choose 2} + 1$
algebraic numbers. It follows from Lemma~\ref{lem-combine-fields} that
if $c \not \in A$ then $\alpha + c \beta$ is a primitive element of
$\mathbb{Q}(\alpha,\beta)$. Therefore there exists an integer $c$, $1
\leq c \leq m^2 n^2 +1$ such that $\alpha + c\beta$ is primitive. We
summarise this in the following proposition.

\begin{proposition}\label{prop-combine-fields}
  Let $\alpha$ and $\beta$ be algebraic numbers of degree $m$ and $n$
  respectively. There exists an integer $c \in \{ 1, \ldots, m^2n^2+1
  \}$ such that $\alpha + c \beta$ is a primitive element of
  $\mathbb{Q}(\alpha,\beta)$.
\end{proposition}

Computing the primitive polynomial for $K$ is now straight forward.
Let $K$ be presented via explicit data $\{ c_{ijk} \}_{1 \leq i,j,k
  \leq n}$ and let $e_1,\ldots,e_n$ be the corresponding basis.  We
compute constants $1 \leq c_i \leq n^4 + 1$, $1 \leq i \leq n$, such
that $\sum_{i=1}^n c_i e_i$ is a primitive element for $K$.

Let $K_r$ denote the field $\mathbb{Q}(e_1,\ldots,e_r)$.  We compute
the primitive element $\gamma_i$ of $K_i$ inductively. To begin with
$\gamma_1 = e_1$. Assume that we have computed $\gamma_{i-1}$. We
choose an integer $c_i$ from the set $\{ 1, \ldots , n^4 +1 \}$ such
that the minimal polynomial of $\gamma_{i-1} + c_i e_i$ is of maximal
degree.  The algebraic number $\gamma_i = \gamma_{i-1} + c_i e_i$ is a
primitive element for $K_i$. Having computed $\gamma_n$ we can compute
the minimal polynomial for $\gamma_n$ using
Lemma~\ref{lem-compute-minpoly}. This gives a primitive polynomial for
$K$.

We have thus proved that presenting number fields via explicit data or
via a primitive polynomial are polynomial time equivalent. The size of
$K$ in each of these presentation might differ but only up to a
polynomial factor. Thus we can assume without loss of generality
either of the two presentation.

\subsection{Factoring polynomials and related problems}

% An important algorithmic task is to factor a given polynomial $f(X)
% \in K[X]$ into irreducible factors. Efficient algorithms are known
% for this fundamental task.

Recall that for a field $K$, the ring $K[X]$ is a unique factorisation
domain. Polynomials $f(X)$ over $\mathbb{Q}$ can be factored into
irreducible factors in polynomial time using the celebrated
Lenstra-Lenstra-Lov\'asz~\cite{lll} algorithm.  A key step in this
algorithm is lattice basis reduction.
A.~K.~Lenstra~\cite{lenstra82factoring} generalised this basis
reduction to give a polynomial time algorithm for factoring
polynomials over number fields. Using norms of polynomials,
Landau~\cite{landau85factoring} gave a polynomial time reduction from
factoring over $K$ to factoring over $\mathbb{Q}$.  We summarise these
results in the following theorem.

\begin{theorem}\label{thm-factoring-numberfield}
  Given a number field $K$ and a polynomial $f(X)$ in $K[X]$ there is
  an algorithm that computes the irreducible factors of $f(X)$ in time
  bounded by a polynomial in $\size{f}$ and $\size{K}$.
\end{theorem}

Let $K$ be a finite field of characteristic $p$.
Berlekamp~\cite{berlekamp67factoring} gave a deterministic polynomial
time algorithm for factoring polynomials over $K$ for small primes
$p$. However for large characteristic only randomised algorithms are
known. Given a polynomial $f(X) \in \mathbb{F}_{q}$, there are
randomised algorithms that run in time polynomial in $\size{f}$ and
$\lg{q}$ \cite{berlekamp70factoring,cantor81factoring} for factoring
$f(X)$.  We summarise these results in the following theorem.

\begin{theorem}\label{thm-factoring-finitefield}
  Given a polynomial $f(X)$ over the finite field $K$ of
  characteristic $p$ there is a deterministic algorithm that runs in
  time polynomial in $\size{f}$ and $p$ for factoring $f(X)$. Given a
  polynomial $f(X) \in \mathbb{F}_q$ there is a randomised algorithm
  that runs in time polynomial in $\size{f}$ and $\lg{q}$ to factor
  $f(X)$.
\end{theorem}

Even though factoring polynomials over finite fields do not have
efficient deterministic algorithms, there are efficient deterministic
irreducibility tests. More generally given a polynomial $f(X) \in
\mathbb{F}_q[X]$ and an integer $d$ there is a polynomial time
deterministic algorithm to compute the product of all irreducible
factors of $f(X)$ of degree $d$ (see Section 14.2 of
\cite{gathen:modern}). In particular, for a give number $d$ one can
compute the number of irreducible factor of $f(X)$ of degree $d$ and
thus we have an efficient irreducibility test.  We summarise this
result in the following theorem.

\begin{theorem}\label{thm-degree-sequence}%
  Given a polynomial $f(X) \in \mathbb{F}_q[X]$ of degree $n$ and an
  integer $d \leq n$, there is a deterministic algorithm that runs in
  time polynomial in $\size{f}$ and $\lg{q}$ that computes the product
  of all the irreducible factors of $f(X)$ of degree $d$. In
  particular there is a deterministic algorithm that runs in time
  polynomial in $\size{f}$ and $\lg{q}$ that computes for each $d$ the
  number of irreducible factors of $f(X)$ of degree $d$.
\end{theorem}

\subsection{Algorithms for Galois group computation}

Let $L/K$ be a field extension. Recall that the Galois group
$\Gal{L/K}$ is the group of automorphisms of $L$ that are identity
when restricted to $K$. In this section we describe known algorithms
for computing the Galois group of a polynomial and related problems.

Firstly from a computational point of view if $K$ is a finite field
then the problem is trivial as the Galois group is generated by an
appropriate power of the Frobenius (see
Section~\ref{sect-finite-fields}). Let $q = p^r$. Given a polynomial
$f(X)$ over a finite field $\mathbb{F}_q$ recall that if
$d_1,\ldots,d_k$ are the set of degrees of irreducible factors of
$f(X)$ then the Galois group of $f(X)$ is a cyclic group of order $m$
where $m$ is the least common multiple of $d_1,\ldots,d_k$ and is
generated by the $r$th power of the Frobenius. By
Theorem~\ref{thm-degree-sequence} we can compute the degrees
$d_1,\ldots,d_k$ in time polynomial in $\size{f}$ and $\lg{q}$.

For polynomials $f(X)$ over number fields the best known algorithm for
computing the Galois group is due to Landau~\cite{landau84galois}.
Given a polynomial $f(X) \in K[X]$ Landau's algorithm computes the
Galois group $\Gal{K_f/K}$ in time polynomial in $\size{f}$ and $[K_f:
K]$. Since $[K_f:K]$ could be as large as $n!$, this is an exponential
time algorithm. We give a brief sketch of this algorithm.

Let $K$ be any number field and let $L/K$ be an extension, not
necessarily Galois. There exists a primitive element $\alpha$ such
that $L = K(\alpha)$. Let $\mu(X) \in K[X]$ be the minimal polynomial
of $\alpha$ over $K$.  Using Theorem~\ref{thm-factoring-numberfield}
we first factorise $\mu(X)$ over $L$. Any root of $\mu(X)$ can be
expressed as a polynomial in $\alpha$.  Let
$P_1(\alpha),\ldots,P_r(\alpha)$, $P_i(X) \in K[X]$, be the distinct
roots of $\mu(X)$ over $L$ then the Galois group $\Gal{L/K}$ consists
of exactly $r$ elements given by the linear maps $\alpha \mapsto
P_i(\alpha)$. Thus the Galois group $L/K$ can be computed in time
polynomial in $\size{L}$. Thus the problem of computing the Galois
group amounts to computing a primitive polynomial for the splitting
field of $f(X)$.

Given a polynomial $f(X) \in K[X]$ of degree $n$.  Let
$\alpha_1,\ldots,\alpha_n$ be the roots of $f(X)$.  Using
Theorem~\ref{thm-factoring-numberfield} we compute the fields $L_i =
K(\alpha_1,\ldots,\alpha_i)$ inductively. Start with $L_0 = K$.
Assume that we have already computed the explicit data for $L_i$.  If
$f(X)$ splits completely over $L_i$ we stop otherwise let $g(X)$ be an
irreducible factor of $f(X)$ of degree greater than $1$ over $L_i$
which we obtain using Theorem~\ref{thm-factoring-numberfield}.  Then
the field $L_{i+1} = L_i[X]/g(X)$ contains at least one more root of
$f(X)$ than $L_i$ and the explicit data for $L_{i+1}$ can be computed.
Having computed the splitting field $L$ of $f$ we can compute the
Galois group $\Gal{L/K}$ as described above.  We summarise the above
discussion in the following theorem.

\begin{theorem}[Landau]\label{thm-landau-galois}
  Given a polynomial $f(X)$ over a number field $K$ and a positive
  integer $N$. There is a deterministic algorithm running in time
  bounded by a polynomial in $N$ and $\size{f}$ that checks whether
  the splitting field of $f$ is of degree less than $N$ and if yes
  computes the entire multiplication table for $\Gal{K_f/K}$. In
  particular given a number fields $L/K$ and an integer $N$, there is
  an algorithm running in time polynomial in $\size{L}$, $\size{K}$
  and $N$ that decides whether the normal closure $\tilde{L}$ of $L$
  is of degree less than $N$ over $K$ and if yes computes the explicit
  data for $\tilde{L}$.
\end{theorem}

The algorithm of Theorem~\ref{thm-landau-galois} outputs the entire
multiplication table of the Galois group of $f(X)$. There is a much
more succinct way of presenting the Galois group. Recall that the
Galois group of $f(X)$ is completely specified by its action on the
roots of $f(X)$. If $n$ is the degree of $f(X)$, by suitably naming
the roots of $f(X)$ the Galois group of $f(X)$ can be seen as a
subgroup of $S_n$. In other words there is a faithful representation
of $\Gal{K_f/K}$ as a permutation group over a cardinality $n$ set
$\Omega$. Recall that subgroups of $S_n$ can be presented succinctly
via a generator set. Moreover several natural algorithmic tasks for a
permutation group $G$ given a generator set for it can be accomplished
efficiently. For example it is possible to determine if $G$ is
solvable in polynomial time, or to determine a composition series for
$G$ in polynomial time among several other tasks (a survey of
important results is available in the article of Luks
\cite{luks93permutation}).  Thus determining the Galois group by its
action on the roots of $f$ is a reasonable way of describing the
output.

For polynomials $f(X)$ with small Galois group
Theorem~\ref{thm-landau-galois} gives an efficient algorithm for
Galois group computation. For example if $f(X)$ is irreducible and
$f(X)$ splits in $K[X]/f(X)$ then we have a polynomial time algorithm
for computing the Galois group of $f(X)$. In particular
Theorem~\ref{thm-landau-galois} gives a polynomial time algorithm to
compute the Galois group of an irreducible polynomial $f(X)$ with
abelian Galois group.  This is because an abelian transitive subgroup
of $S_n$ is of size $n$.

\begin{proposition}\label{prop-abelian-transitive}
  Let $G$ be a transitive abelian permutation group on $\Omega$ then
  for any $\alpha \in \Omega$ $G_\alpha = 1$ and $\# G = \#
  \Omega$.
\end{proposition}
\begin{proof}
  Fix any $\alpha \in \Omega$. Since $G$ is transitive for any $\beta
  \in \Omega$ there is a $g_\beta \in G$ such that $\alpha^{g_\beta} =
  \beta$. The group $G_\beta$ is given by $g_\beta^{-1}G_\alpha
  g_\beta$ and since $G$ is abelian is equal to $G_\alpha$. This
  implies any element that fixes $\alpha$ fixes all elements $\beta$
  pointwise and hence is identity. Therefore $G_\alpha =1$.  By
  Orbit-Stabiliser formula (Theorem~\ref{thm-orbit-stab-formula}) we
  have $\# G = \# \Omega . \# G_\alpha = \# \Omega$.
\end{proof}

Proposition~\ref{prop-abelian-transitive} and
Theorem~\ref{thm-landau-galois} can be used to give a polynomial time
algorithm to test whether the Galois group of a polynomial $f(X) \in
K[X]$ is abelian~\cite{landau84galois}. Given a polynomial $f(X)$ we
first compute all its irreducible factors over $K[X]$. For each
irreducible factor $g(X)$ we to compute the Galois group $\Gal{K_g/K}$
using Theorem~\ref{thm-landau-galois}. If $\Gal{K_g/K}$ is too large,
i.e.  $\Gal{K_g/K}$ is of order greater than the degree of $g(X)$ then
clearly it is not abelian (Proposition~\ref{prop-abelian-transitive}).
Having computed the Galois group $\Gal{K_g/K}$ explicitly we can check
whether it is abelian. The Galois group of $f(X)$ is abelian if the
Galois groups of each of its irreducible factor is abelian.

\begin{theorem}[Landau]\label{thm-landau-abelian-galois}
  Let $f(X) \in K[X]$ be any polynomial. There is an algorithm that
  runs in time polynomial in $\size{f}$ and $\size{K}$ that checks
  whether the Galois group of $f(X)$ is abelian. If in addition the
  polynomial $f(X)$ is irreducible, there is an algorithm that runs in
  time polynomial in $\size{f}$ and $\size{K}$ that computes the
  Galois group of $f$.
\end{theorem}

Even though the Galois group of an irreducible polynomial $f(X) \in
\mathbb{Q}[X]$ with abelian Galois group can be computed efficiently,
there are no efficient algorithms when $f(X)$ is reducible.  In fact
even when $f(X)$ is a product of quadratic polynomials nothing better
than the exponential algorithm is known (\cite[Problem
3.4]{lenstra92algorithm}). In Chapter~\ref{chap-galois-special},
assuming the generalised Riemann hypothesis, we give a randomised
polynomial time algorithm for this problem.

We now consider another important task, computing the fixed field of a
field $L$ given a set of automorphism of $L$. Given an automorphism
$\sigma$ of $L$, the fixed field of $L$ under automorphisms generated
by $\sigma$ is the kernel of the map $\sigma - 1$.  Let $L$ be any
field of degree $n$ presented via explicit data $\{ c_{ijk}\}_{1 \leq
  i,j,k \leq n}$.  Let $e_1,\ldots,e_n$ be the corresponding basis for
$L$.  Then any automorphism $\sigma$ is a linear map on $L$ as a
vector space over $\mathbb{Q}$. Having fixed a basis $e_1,\ldots,e_n$,
each $\sigma$ can be represented by an $n\times n$ matrix $A_\sigma$
over $\mathbb{Q}$.  The subspace of solutions for the linear equation
$A_\sigma \mathbf{x} = \mathbf{x}$ is exactly the fixed field of $L$
under $\sigma$.  A basis for this field can be computed in polynomial
time and thus we have its explicit data.

To find the fixed field of $L$ under the automorphisms generated by
$S= \{ \sigma_1,\ldots,\sigma_r \}$, consider the fixed field $L_i$ of
$L$ under the automorphisms generated by $\{ \sigma_1,\ldots,\sigma_i
\}$. Starting from $L_0 = L$ we compute the fields $L_i$ inductively.
Having computed a basis for $L_{i-1}$, we compute $L_i$ by computing a
basis of the kernel of $\sigma_i - 1$ over $L_i$ as described above.
This inductive algorithm is evidently polynomial time.  Thus we have
the following theorem.

\begin{theorem}\label{thm-compute-fixed-field}
  Given a field $L$ via explicit data $\{ c_{ijk} \}_{1 \leq i,j,k
    \leq n}$ and a set $S$ of automorphisms of $L$. There is a
  deterministic algorithm running in time polynomial in $\# S$ and
  $\size{L}$ to compute the fixed field of $L$ under the group
  generated by $S$.
\end{theorem}
\section{Some useful bounds}\label{sect-bounds-ant}

In this section we prove certain bounds that will be useful in
analysing the algorithms of this thesis. Given a number field $K$ of
degree $n$ presented via explicit data.  Our first goal is to give a
bound on the height of algebraic numbers of $K$ in terms of its size.

\begin{lemma}
  Let $K$ be a number field of degree $n$ presented via explicit data
  $\{c_{ijk}\}_{1 \leq i,j,k \leq n}$. Let $e_1,\ldots,e_n$ be the
  corresponding basis for $K$. Then for each $i$, $\Height{e_i} \leq
  n. 2^{\size{K}}$. It follows that for any $\alpha$ in $K$,
  $\Height{\alpha} \leq n^2. 2^{\size{\alpha} + \size{K}}$.
\end{lemma}
\begin{proof}
  Let $1 \leq i \leq n$ be such that $\Height{e_i}$ is maximum. We
  have $e_i e_i = \sum_{k=1}^n c_{iik} e_k$. Each $c_{ijk}$ is less
  than $2^{\size{K}}$. Hence it follows that $\Height{e_i}^2 \leq n
  \Height{e_i} 2^\size{K}$ (Lemma~\ref{lem-height-inequalities}) and
  $\Height{e_i} \leq n . 2^{\size{K}}$.

  Let $\alpha = \sum_{k=1}^n a_i e_k$. Recall that $\size{\alpha} =
  \sum \size{a_k}$ and hence $a_k \leq 2^\size{\alpha}$. Therefore
  $\Height{\alpha} \leq n . 2^{\size{\alpha}} .  \Height{e_i} = n^2 .
  2^{\size{\alpha} + \size{K}}$.
\end{proof}

Conversely, in many cases we would like to bound the sizes of
algebraic numbers given a bound on its height. The following lemma
serves this purpose.

\begin{lemma}\label{lem-bound-on-size-height}%
  Let $K$ be a number field of degree $n$ and $\alpha \in \Int[K]$.
  Then $\size{\alpha} \leq n^3 (\lg{\Height{\alpha}} + \size{K})$.
\end{lemma}
\begin{proof}
  Let $\{c_{ijk}\}_{1\leq i,j,k\leq n}$ be the explicit data for $K$
  and let $e_1,\ldots,e_n$ be the corresponding basis.  Let
  $\sigma_1,\ldots,\sigma_n$ be the $n$ distinct embeddings of $K$
  into $\mathbb{C}$ and let $e_{ij} = \sigma_i (e_j)$. Consider the
  algebraic integer $\alpha = \sum_j c_j e_j$. If $\alpha_i =
  \sigma_i(\alpha) = \sum_j c_j e_{ij}$ then $| \alpha_i | \leq
  \Height{\alpha}$.

  Consider the system of linear equations $\sum c_j e_{ij} =
  \alpha_i$, $1\leq i\leq n$.  By Cramer's rule, we have $c_j =
  \frac{\mathrm{det}(A_j)}{\mathrm{det}(A)}$ where $A$ is the $n
  \times n $ matrix $(e_{ij})_{1 \leq i,j \leq n}$ and $A_j$ is the
  matrix obtained by replacing the $j^{\mathrm{th}}$ column of $A$ by
  $\alpha_i$'s.  The number $\mathrm{det}(A)^2$ is a symmetric
  function on the algebraic integers $e_{ij}$'s. It follows that
  $\mathrm{det}(A)^2$ is in $\mathbb{Z}$ and therefore $|c_j|\leq
  \mathrm{det}(A_j)$ for each $i$.

  For an $n\times n$ matrix $M$, the determinant of $M$ is bounded by
  $n^n \lambda^n$ where $\lambda$ is the largest entry of $M$.
  Therefore $|\mathrm{det}(A_i)| \leq n^n.\lambda^n$ where $\lambda =
  \mathrm{max}(\Height{e_i},\Height{\alpha})$ ($\Height{e_{ij}} =
  \Height{e_i}$). We have thus proved that $\size{c_i}\leq n.(\lg n +
  \lg\Height{\alpha} + \lg\Height{e_i})\leq n.(\lg\Height{\alpha} +
  \size{K} + 2 \lg{n})$.  We then obtain
  \[
  \size{\alpha} =\sum_{i=0}^{n-1}\size{c_i} \leq
  n^3(\lg\Height{\alpha} + \size{K}).
  \]
\end{proof}

We now prove a bound on the size of the minimal polynomial of an
algebraic integer $\alpha$ in terms of its height.

\begin{proposition}\label{prop-bound-minpoly}
  Let $\alpha$ be an algebraic integer of degree $n$ and let
  $\mu_\alpha(X)$ be the minimal polynomial of it over $\mathbb{Q}$.
  Then $\size{\mu_\alpha(X)} \leq n^2 (1 + \lg{\Height{\alpha}})$.
\end{proposition}
\begin{proof}
  Let $\alpha_1,\ldots,\alpha_n$ be the conjugates of $\alpha$ then
  the minimal polynomial is give by $\mu(X) = \sum_{i=0}^n s_i X^i$
  where $s_i$ is the $i$th symmetric function over
  $\alpha_1,\ldots,\alpha_n$, i.e. $s_i$ is the sum of all possible
  products of elements in $\{\alpha_1,\ldots,\alpha_n\}$ taken $i$ at
  a time.  Since $\Height{\alpha_i} = \Height{\alpha}$ we have $|s_i|
  \leq {n \choose i} \Height{\alpha}^i$ .  Therefore
  \[
  \size{\mu_\alpha(X)} \leq \sum_i \lg \left[{n \choose i}
    \Height{\alpha}^i\right] \leq n^2 (1 + \lg{\Height{\alpha}}).
  \]
\end{proof}

Conversely, given and algebraic number $\alpha$, we often need a bound
on $\Height{\alpha}$ in terms of the size of its minimal polynomial
$\mu_\alpha$ over $\mathbb{Q}$.  For this purpose we state an
inequality due to Landau~\cite{landau:1905:ineq} (a proof of this
inequality is available in \cite[Theorem 6.31]{gathen:modern}).
Consider a polynomial $f(X) = \sum a_i X^i\in \mathbb{C}[X]$.  Define
$\norm{f}_2$ as $\sqrt{\sum \abs{a_i}^2}$.  We use the following
inequality to bound the sizes of algebraic numbers.

\begin{lemma}[Landau]\label{lem-landau-ineq}
  Let $f(X) = a_0 + \ldots + a_d X^d\in \mathbb{C}[X]$ of degree $d$,
  and let $\alpha_1,\ldots,\alpha_d\in\mathbb{C}$ be its roots.  Then,
  \[
  \abs{a_d}\prod_{i=1}^d \textrm{max}(1,\abs{\alpha_i}) \leq
  \norm{f}_2.
  \]
\end{lemma}

Let $\alpha$ be an algebraic integer of degree $n$ and let
$\mu_{\alpha}(X) = c_0 + c_1 X + \ldots + c_n X^{n-1} + X^n$ be its
minimal polynomial. For all $i$, $c_i \leq 2^\size{\mu_\alpha}$ and
therefore $\norm{\mu_\alpha}_2 \leq \sqrt{n}2^{\size{\mu_\alpha}}$.
Recall that $\Height{\alpha}$ is the maximum over $| \eta |^{c_\eta}$
where $\eta$ ranges over the roots of $\mu_\alpha$ and $c_\eta$ is
either $1$ or $2$ depending on whether $\eta$ is real or complex.
Together with Landau's inequality we thus have the following bound.

\begin{proposition}\label{prop-height-wrt-sizeminpoly}
  Let $\alpha$ be an algebraic integer with minimal polynomial
  $\mu_\alpha$ over $\mathbb{Q}$. Then $\Height{\alpha} \leq
  n.4^{\size{\mu_\alpha}}$.
\end{proposition}

We now prove a bound on the discriminant of a number field. For a
polynomial $T(X) \in \mathbb{Q}[X]$ with roots
$\theta_1,\ldots,\theta_n$ by
\emph{discriminant}\index{discriminant!of a polynomial}, which we
denote by $d_T$ we mean the product $\prod_{i\neq j} (\theta_i -
\theta_j)$. For an algebraic number $\alpha$, by the discriminant of
$\alpha$, denoted by $d_\alpha$, we mean the discriminant of the
minimal polynomial $\mu_\alpha(X)$ of $\alpha$ over $\mathbb{Q}$.
Consider a number field $K = \mathbb{Q}(\theta)$ where $\theta$ is an
algebraic integer. The discriminant $d_K$ of $K$ divides $d_\theta$
and $\frac{d_\theta}{d_K} = [\Int[K]: \mathbb{Z}[\theta]]^2$.
Therefore to bound $d_K$ it is sufficient to give a bound on the
discriminant $d_\theta$.  We use of this to show the following bound
on the discriminant.

\begin{theorem}\label{thm-bound-dtheta}
  Let $f(X)$ be a monic polynomial over $\mathbb{Z}$ of degree $n$
  with roots $\alpha_1,\ldots,\alpha_n$.  There exists an algebraic
  integer $\theta = \sum c_i \alpha$, $c_i \in \mathbb{Z}$ such that
  the $\theta$ is a primitive element for the extension
  $\mathbb{Q}_f/\mathbb{Q}$ and $\lg{d_\theta} \leq (n!)^3.
  \size{f}$.  As a result we have $\lg{d_{\mathbb{Q}_f}} \leq
  (n!)^3.\size{f}$.
\end{theorem}
\begin{proof}
  Let $N \leq n!$ be the degree of the splitting field $K =
  \mathbb{Q}_f$. Let $\alpha_1,\ldots,\alpha_n$ be the roots of $f(X)$
  then $K = \mathbb{Q}(\alpha_1,\ldots,\alpha_n)$. By
  Proposition~\ref{prop-combine-fields} there are integer constant $1
  \leq c_i \leq N^4 +1$ such that $\theta = \sum_i c_i \alpha_i$ is a
  primitive element of $K$. Since $f(X)$ is a monic polynomial over
  $\mathbb{Z}$ it follows that $\alpha_i$'s are algebraic integers and
  so is $\theta$.

  By Landau's inequality we have $|\alpha_i| \leq \sqrt{n}2^\size{f}$
  and therefore we have $\Height{\theta} \leq n.N^4 4^\size{f}$.
  Therefore we have
  \[
  \lg{d_K} \leq \lg{d_\theta} \leq N^2 (1 + 2\lg{n} + 4\lg{N} +
  2\size{f}).
  \]
  Since $N \leq n!$ we have the required bound.
\end{proof}
\section{Discussion}

% Given a polynomial $f(X)$ over $\mathbb{Q}$, in
% Chapters~\ref{chap-property-testing}, \ref{chap-order-finding} and
% \ref{chap-galois-special}, we study the following three important
% problems in computational Galois theory.
%
% \begin{enumerate}
% \item Computing the Galois group of $f(X)$ as permutation group over
%   the roots of $f(X)$,
% \item Computing the order of the Galois group of $f(X)$ and
% \item Checking if the Galois group of $f(X)$ satisfies certain
%   properties.
% \end{enumerate}

Computing the Galois group of $f(X)$ is hard both in theory and in
practice. No polynomial time algorithm is known. Current computer
algebra systems can compute typically the Galois group of polynomials
of degree in the range 20 to 25. Apart {from} their mathematical
significance many computational problems that arise in algebraic
number theory have wide range of application especially in
cryptography.  Hence algorithms that run efficiently in practice are
of utmost importance.  For a detailed presentation of algorithms from
a practical point of view we refer to the book of
Cohen~\cite{cohen:1993}.

However, in this thesis our focus is not directed on these issues. A
polynomial time algorithm will be considered efficient although
practical implementations might turn out to be too slow.  In this
sense our approach is similar to the approach of Lenstra in his survey
article~\cite{lenstra92algorithm}. In the absence of efficient
algorithms our attempt would be to give nontrivial complexity upper
bounds.

As mentioned before, to prove nontrivial complexity theoretic results
one often require novel techniques. A striking example is the recent
AKS algorithm for primality testing \cite{agrawal2004primes}. Although
the algorithm runs in polynomial time, as far as testing primality of
large numbers in practical contexts like for example in cryptographic
application, the randomised tests are still preferred. However the
techniques developed could lead to solutions of other interesting
questions.

Often complexity theoretic classification of natural problems have
been fruitful in understanding the inherent intractability of these
problems. For example showing hardness results for a problem say for
$\mathrm{NP}$ in some sense shows that the problem is computationally
hard. Even though computing Galois groups are hard in practice, no
hardness results (in the complexity theoretic sense) is yet known.
Showing such hardness results could be challenging and probably need
considerable mathematical techniques.

Attempts to understand the complexity of natural problems have led to
considerable progress in complexity theory as well. For example study
of one-way functions led Valiant to define the complexity class
$\mathrm{UP}$~\cite{valiant76relative}.  Algebraic number theory and
Galois theory is a rich source of natural computational problems and
studying the complexity of these problems might lead to considerable
progress in complexity theory as well.  What makes these problems
particularly attractive is the availability of powerful mathematical
tools. Unfortunately even though the mathematics is fairly well
understood virtually nothing is known about the computational
complexity of many of the fundamental problems in this area.  On one
hand even for polynomials with abelian Galois group no efficient
algorithms are know unconditionally.  On the other hand there is no
hardness result known despite the fact that the best known algorithm
for computing the Galois group is exponential time.

\chapter{Testing nilpotence of Galois group}
\label{chap-property-testing}

Given a polynomial $f(X)$ over $\mathbb{Q}$ in this chapter we study
the following two problems (1) checking whether the Galois group is
nilpotent and (2) checking whether the Galois group is in $\Gamma_d$.
As mentioned before knowing certain properties of the Galois group of
a polynomial $f(X)$ gives information about its roots. For example the
seminal work of Galois shows that a polynomial $f(X)$ is solvable by
radicals if and only if its Galois group is solvable. However
algorithmically this does not give a satisfactory answer as computing
the Galois group is hard.  Landau and Miller
\cite{landau85solvability} achieved a remarkable breakthrough by
giving a polynomial time algorithm for checking solvability.

First, we show that given a polynomial $f(X) \in \mathbb{Q}[X]$, we
can test whether the Galois group of $f(X)$ is nilpotent in polynomial
time. Recall that a group $G$ is nilpotent if all its Sylow subgroups
are normal. Even though every nilpotent group is solvable, the
Landau-Miller solvability test does not give a nilpotence test.  This
is because knowing the composition factors of a group $G$ alone is not
enough to decide whether $G$ is nilpotent.

We generalise the Landau-Miller test and show that $\Gamma_d$-testing
for constant $d$ is in polynomial time.  Recall that a group $G$ is in
$\Gamma_d$ if there is a composition series $G = G_0 \rhd \ldots \rhd
G_t = 1$ such that $G_i/G_{i+1}$ is either abelian or is isomorphic to
a subgroup of $S_d$.

An important idea used in both these tests is the Galois
correspondence between blocks, fields and groups that we now explain.
Let $f(X)$ be an irreducible polynomial in $\mathbb{Q}[X]$ and let $G$
be the Galois group of $f(X)$. Since $f(X)$ is irreducible, $G$ is a
transitive permutation group on $\Omega$, the set of roots of $f(X)$.
For a block $\Delta$ recall that $G_\Delta$ is the subgroup of $G$
that setwise stabilises $\Delta$. Let $\mathbb{Q}_\Delta$ denote the
fixed field $\Fix{\mathbb{Q}_f}{G_\Delta}$.

\begin{theorem}\label{thm-twoway-galois}
  Let $f(X) \in \mathbb{Q}[X]$ be an irreducible polynomial with
  Galois group $G$. Let $\Omega$ be the roots of $f(X)$ and let
  $\alpha \in \Omega$ be any particular root.  There is a one-to-one
  correspondence between $G$-blocks containing $\alpha$, subgroups of
  $G$ containing $G_\alpha$ and subfields between $\mathbb{Q}(\alpha)$
  and $\mathbb{Q}$ given by
  \[
  \Delta \rightleftharpoons G_\Delta \rightleftharpoons
  \mathbb{Q}_\Delta.
  \]
  Furthermore if $\{ \alpha \} = \Delta_0 \subseteq \ldots \subseteq
  \Delta_m = \Omega$ is an increasing chain of blocks then
  $\mathbb{Q}(\alpha) = \mathbb{Q}_{\Delta_0} \supseteq \ldots
  \supseteq \mathbb{Q}_{\Delta_m} = \mathbb{Q}$ is a decreasing tower
  of number fields between $\mathbb{Q}(\alpha)$ and $\mathbb{Q}$.
\end{theorem}

The first is the Galois correspondence between $G$-blocks and
subgroups of $G$ containing $G_\alpha$
(Theorem~\ref{thm-blocks-galois}) and the second correspondence is via
the fundamental theorem of Galois theory
(Theorem~\ref{thm-funda-galois}).  The crucial observation of Landau
and Miller is that even though the Galois group $G$ is unknown, the
field $\mathbb{Q}_\Delta$ can be computed in polynomial time.  Knowing
the structure of the fields $\mathbb{Q}_\Delta$ gives us valuable
information about the groups $G_\Delta$. Consider a permutation group
$G$ on the set $\Omega$. Let $\Delta \subseteq \Sigma$ be two
$G$-blocks recall that $\Blocks{\Sigma/\Delta}$ denotes the set of
blocks $\{ \Delta^g | g \in G\ \Delta^g \subseteq \Sigma \}$. The group
$\Gof{\Sigma/\Delta}$ is the subgroup of $G_\Sigma$ that fixes all the
blocks in $\Blocks{\Sigma/\Delta}$ and $G^\Delta =
\Gof{\Omega/\Delta}$.

\begin{proposition}\label{prop-twoway-galois}%
  Let $\Delta \subseteq \Sigma$ be two $G$ blocks then.
  \begin{enumerate}
  \item The normal closure of the field $\mathbb{Q}_\Delta$ over
    $\mathbb{Q}_\Sigma$ is exactly the fixed field
    $\Fix{\mathbb{Q}_f}{\Gof{\Sigma/\Delta}}$. In particular the
    normal closure of $\mathbb{Q}_\Delta$ is the fixed field
    $\Fix{\mathbb{Q}_f}{G^\Delta}$.
  \item The index of $G$-blocks $[\Sigma : \Delta]$ is equal to the
    degree $[\mathbb{Q}_\Delta : \mathbb{Q}_\Sigma]$.
  \end{enumerate}
\end{proposition}
\begin{proof}
  Recall that the normal closure of $\mathbb{Q}_\Delta$ over
  $\mathbb{Q}_\Sigma$ is the smallest field containing
  $\mathbb{Q}_\Delta$ that is normal over $\mathbb{Q}_\Sigma$.  The
  field $\mathbb{Q}_f$ is a Galois extension of $\mathbb{Q}_\Sigma$
  with Galois group $G_\Sigma$.  Since $\mathbb{Q}_\Delta$ is
  contained in $\mathbb{Q}_f$ it follows that the normal closure of
  $\mathbb{Q}_\Delta$ over $\mathbb{Q}_\Sigma$ is contained in
  $\mathbb{Q}_f$. Let $L \subseteq \mathbb{Q}_f$ be any normal
  extension of $\mathbb{Q}_\Sigma$ containing $\mathbb{Q}_\Delta$.  By
  the fundamental theorem of Galois theory
  (Theorem~\ref{thm-funda-galois}), $L$ is the fixed field
  $\Fix{\mathbb{Q}_f}{H}$ for some subgroup $H$ of $G_\Delta$ that is
  normal in $G_\Sigma$. The group $\Gof{\Sigma/\Delta}$ is the largest
  subgroup of $G_\Delta$ that is normal in $G_\Sigma$
  (Theorem~\ref{thm-gsupdelta}).  Therefore
  $\Fix{\mathbb{Q}_f}{\Gof{\Sigma/\Delta}}$ is the smallest normal
  extension of $\mathbb{Q}_\Sigma$ that contains $\mathbb{Q}_\Delta$
  and is thus the normal closure of $\mathbb{Q}_\Delta$ over
  $\mathbb{Q}_\Sigma$. Let $\Sigma = \Omega$ then we have
  $\mathbb{Q}_\Sigma = \mathbb{Q}_\Omega = \mathbb{Q}$.  Hence the
  normal closure of $\mathbb{Q}_\Delta$ is
  $\Fix{\mathbb{Q}_f}{G^\Delta}$. This completes the proof of part 1.

  For $G$-blocks $\Delta \subseteq \Sigma$, by the Galois
  correspondence of blocks (Theorem~\ref{thm-blocks-galois}), the
  index $[\Sigma: \Delta ] = [G_\Sigma : G_\Delta]$.  Consider any
  $G$-block $\Psi$. The extension $\mathbb{Q}_f/\mathbb{Q}_\Psi$ is
  Galois with Galois group $G_\Psi$.  Therefore $[\mathbb{Q}_f:
  \mathbb{Q}_\Psi] = \# G_\Psi$.  It follows that $[G_\Sigma:
  G_\Delta] = \frac{[\mathbb{Q}_f :
    \mathbb{Q}_\Sigma]}{[\mathbb{Q}_f:\mathbb{Q}_\Delta]} =
  [\mathbb{Q}_\Delta : \mathbb{Q}_\Sigma]$. This proves part 2.
\end{proof}

Proposition~\ref{prop-twoway-galois} will play an important role in
our algorithms for nilpotence and $\Gamma_d$ testing. We give
polynomial time algorithm for computing the fields $\mathbb{Q}_\Delta$
in Section~\ref{sect-compute-qdelta}.  In Section~\ref{sect-nilpotent}
we study the block structure of transitive nilpotent permutation
groups.  Using these properties we give a nilpotence test.  Finally
the $\Gamma_d$-test is given in section~\ref{sect-gammad-check}.

\section{Computing the fields $\mathbb{Q}_\Delta$}
\label{sect-compute-qdelta}

The goal of this section is to prove the following theorem that plays
an important role in both the property testing algorithms we are going
to describe.

\begin{theorem}\label{thm-enlarge-block}
  Let $f(X)$ be an irreducible polynomial over $\mathbb{Q}$ with
  $\Omega$ as its set of roots. Let $G \leq \Sym{\Omega}$ be its
  Galois group. Let $\Delta$ be any $G$-block of $\Omega$ such that
  $\alpha\in \Delta$ for some $\alpha \in \Omega$.  There is an
  algorithm that given the field $\mathbb{Q}_\Delta$ as a subfield of
  $\mathbb{Q}(\alpha)$, runs in time polynomial in $\size{f}$ and
  $\size{\mathbb{Q}_\Delta}$ and computes the field
  $\mathbb{Q}_\Sigma$ for all $G$-blocks $\Sigma$ such that $\Delta$
  is a maximal $G$-subblock of $\Sigma$.  Moreover
  $\size{\mathbb{Q}_\Sigma}$ is at most a polynomial in $\size{f}$ and
  is independent of the size of the presentation of
  $\mathbb{Q}_\Delta$.
\end{theorem}

Although stated differently, this algorithm is due Landau and
Miller~\cite{landau85solvability} and is used in their polynomial-time
solvability test. Through a sequence of lemmas we prove this theorem
in the rest of this section.

For a $G$-block $\Delta$ let $T_\Delta(X)$ be the polynomial defined
by
\[
T_\Delta(X) = \prod_{\eta \in \Delta} (X - \eta).
\]

\begin{proposition}\label{prop-tdelta-qdelta}
  If $T_\Delta(X) = \delta_0 + \delta_1 X + \ldots + \delta_{r-1}
  X^{r-1} + X^r$ then field $\mathbb{Q}_\Delta$ is the field
  $\mathbb{Q}(\delta_0,\ldots,\delta_{r-1})$.
\end{proposition}
\begin{proof}
  For any automorphism $\sigma \in G$ we have $\sigma (T_\Delta) =
  T_{\Delta^\sigma}$. Therefore if $\sigma$ is in $G_\Delta$ then
  $\sigma (T_\Delta) = T_\Delta$. Let $T_\Delta(X) = \delta_0 +
  \delta_1 X + \ldots + \delta_{r-1} X^{r-1} + X^r$.  Comparing the
  coefficients of $X^i$ we have $\sigma(\delta_i) = \delta_i$ for all
  $0 \leq i < r$.  Conversely if for some $\sigma \in G$, if
  $\sigma(\delta_i) = \delta_i$, $0 \leq i < r$, then
  $\sigma(T_\Delta) = T_\Delta$ and hence $\sigma \in G_\Delta$.  Thus
  we have the following proposition.
\end{proof}

In view of Proposition~\ref{prop-tdelta-qdelta}, to compute
$\mathbb{Q}_\Delta$ it is sufficient to compute the polynomial
$T_\Delta(X)$.  The algebraic integers $\delta_i$'s are symmetric
functions on the roots of $f(X)$ in $\Delta$ and hence using
Lemma~\ref{lem-bound-on-size-height} and
Proposition~\ref{prop-height-wrt-sizeminpoly}, $\size{\delta_i}$ is
bounded by a polynomial in $\size{f}$. Having computed the polynomial
$T_\Delta$, one can compute the field $\mathbb{Q}_\Delta$ in time
polynomial in $\size{f}$.

We prove the following important lemma on the irreducible factors of
$f(X)$ over $\mathbb{Q}_\Delta$.

\begin{lemma}\label{lem-orbit-corr}
  Let $\Delta$ be a $G$-block containing $\alpha$. There is a
  one-to-one correspondence between irreducible factors of $f(X)$ over
  $\mathbb{Q}_\Delta$ and orbits of $G_\Delta$ given by
  \[
  \Omega' \rightleftharpoons \prod_{\eta \in \Omega'} (X - \eta),\
  \Omega' \textrm{ a }G\textrm{-orbit}.
  \]
\end{lemma}
\begin{proof}
  Let $g(X)$ be an irreducible factor of $f(X)$ over
  $\mathbb{Q}_\Delta$.  Then $G_\Delta =
  \Gal{\mathbb{Q}_f/\mathbb{Q}_\Delta}$ acts transitively on the roots
  of $g(X)$. Hence for any two roots $\eta$ and $\eta'$ of $g(X)$
  there is an element $\sigma \in G_\Delta$ such that $\sigma(\eta) =
  \eta'$. Therefore $\eta$ and $\eta'$ belong to the same
  $G_\Delta$-orbit. Conversely if $\eta$ and $\eta'$ belong to the
  same $G_\Delta$ orbit then there is a $\sigma \in G_\Delta$ such
  that $\sigma(\eta) = \eta'$ and they are
  $\mathbb{Q}_\Delta$-conjugates.  This is possible if and only if
  $\eta$ and $\eta'$ are the roots of the same irreducible factor $g$
  of $f(X)$ over $\mathbb{Q}_\Delta$.
\end{proof}

The above lemma has the following important corollary.

\begin{lemma} \label{lem-factor-blocks}%
  Let $\Delta$ be any $G$-block containing $\alpha$. The polynomial
  $T_\Delta$ is the irreducible factor of $f$ over $\mathbb{Q}_\Delta$
  which has $\alpha$ as its root.  Let $\Sigma$ be any $G$-block such
  that $\Sigma \supseteq \Delta$.  If $g$ is an irreducible factor of
  $f$ over $\mathbb{Q}_\Delta$ then $\Sigma$ contains a root of $g$ if
  and only if it contains all the roots of $g$.
\end{lemma}
\begin{proof}
  In the correspondence of Lemma~\ref{lem-orbit-corr}, $T_\Delta$
  corresponds to the orbit of $\alpha$ under $G_\Delta$. Hence
  $T_\Delta$ is the factor of $f(X)$ that has $\alpha$ as a root.

  Let $\Delta \subseteq \Sigma$ be any two $G$-blocks and let $g(X)$
  be an irreducible factor of $f(X)$ over $\mathbb{Q}_\Delta$. Suppose
  that $\Sigma$ contains a root $\eta$ of $g$.  Any other root $\eta'$
  of $g$ is in the same $G_\Delta$ orbit, i.e. $\eta' \in
  \eta^{G_\Delta}$. However since $\Delta \subseteq \Sigma$ we have
  $G_\Delta \leq G_\Sigma$. Hence $\eta' \in \eta^{G_\Sigma} =
  \Sigma$.
\end{proof}

The above theorem gives a polynomial time algorithm to identify the
polynomial $T_\Delta(X)$.  Recall that $\mathbb{Q}_\Delta$ is a
subfield of $\mathbb{Q}(\alpha)$. The polynomial $T_\Delta(X)$ is that
irreducible factor $g(X)$ of $f(X)$ for which $g(\alpha) = 0$. We now
prove an important lemma from which the proof of
Theorem~\ref{thm-enlarge-block} is more or less direct.

\begin{lemma}\label{lem-enlarge-block}
  Let $\Delta$ be a $G$-block containing $\alpha$. Given the field
  $\mathbb{Q}_\Delta$ as a subfield of $\mathbb{Q}(\alpha)$ and an
  irreducible factor $g$ of $f$ over $\mathbb{Q}_\Delta$, we can
  compute in polynomial time $T_\Sigma$ as a polynomial in
  $\mathbb{Q}(\alpha)[Y]$, where $\Sigma$ is the smallest $G$-block
  containing $\Delta$ and the roots of $g$.
\end{lemma}
\begin{proof}
  Let the factorisation of $f$ over $\mathbb{Q}_\Delta$ be $f=g_0
  \ldots g_r$, where $g_0 = T_\Delta$ and $g=g_1$.  Denote the set of
  roots of $g_i$ by $\Phi_i$, for each $i$. Then by
  Lemma~\ref{lem-orbit-corr}, $\Phi_i$'s are the orbits of $G_\Delta$
  and the polynomial $T_\Sigma(X)$ is precisely the product of $g_i$
  such that $\Phi_i \subseteq \Sigma$.  Let $\beta$ be any root of
  $g(X)$, and $\sigma \in \Gal{\mathbb{Q}_f/\mathbb{Q}}$ be an
  automorphism that maps $\alpha$ to $\beta$. The map $\sigma$ is
  in fact an isomorphism between the fields $\mathbb{Q}(\alpha)$ and
  $\mathbb{Q}(\beta)$.  Let $\Sigma$ be the smallest $G$-block
  containing $\Delta$ and $\Phi_1$.  It follows from the Galois
  correspondence of blocks (Theorem~\ref{thm-blocks-galois}) that
  $G_\Sigma$ is generated by $G_\Delta\cup\{\sigma\}$.  If we knew the
  permutation $\sigma$ and the orbits $\Phi_i$ explicitly then the
  following transitive closure procedure would give us $\Sigma$.

  \begin{algorithm}
    \caption{Computing $\Sigma$}\label{alg-compute-sigma}%
    $S \leftarrow \{\Delta,\Phi_1\}$

    \Repeat{$S$ is unchanged}
    {

      $S' \leftarrow \{ \Phi^\sigma \mid \Phi \in S \}$

      \ForEach{orbit $\Phi_j$}{

     \lnl{step-intersect}
     \lIf{$\Phi_j \cap \Phi^\sigma \neq \emptyset$ for some
          $\Phi^\sigma \in S'$}
        {
          $S \leftarrow S \cup \{ \Phi_j \}$
        }
      }
    }

    Output $\bigcup\{\Phi\mid \Phi\in S\})$
  \end{algorithm}

  Our goal is to ``simulate'' Algorithm~\ref{alg-compute-sigma}. The
  key ideas is that the orbit $\Phi_i$ corresponds to the irreducible
  factor $g_i$ of $f(X)$ over $\mathbb{Q}_\Delta$ and testing whether
  $\Phi_j\cap\Phi_i^\sigma\neq\emptyset$ (step~\ref{step-intersect} of
  the Algorithm~\ref{alg-compute-sigma}) amounts to checking whether
  the g.c.d of $g_j$ and $g_i^\sigma$ is nontrivial. We give a
  polynomial time algorithm for computing the g.c.d of $g_j$ and
  $g_i^\sigma$.

  First, we compute the extension field $\mathbb{Q}(\alpha,\beta)$. We
  factor the polynomial $g(X)$ over the field $\mathbb{Q}(\alpha)$
  into irreducible factors.  Let $h$ be any irreducible factor of $g$
  over $\mathbb{Q}(\alpha)$ then $\mathbb{Q}(\alpha,\beta)=\mathbb{Q}
  (\alpha)[X]/h(X)$. Since $[\mathbb{Q}(\alpha,\beta):\mathbb{Q}]\leq
  n^2$ and the heights $\Height{\alpha} = \Height{\beta}$ is bounded
  by $2^{O(\size{f})}$
  (Proposition~\ref{prop-height-wrt-sizeminpoly}), we can compute in
  polynomial time the explicit data of $\mathbb{Q}(\alpha,\beta)$.
  Furthermore, in polynomial time we compute a primitive element
  $\gamma = \alpha + c \beta$, $1 \leq c \leq n^8 + 1$, of the field
  $\mathbb{Q}(\alpha,\beta)$ and polynomials $a(X)$ and $b(X)$ in
  $\mathbb{Q}[X]$ such that $\alpha=a(\gamma)$ and $\beta=b(\gamma)$.

  Any irreducible factors $g_i(X)$ can be written as a bivariate
  polynomial $g_i(X,\alpha)$. Hence symbolically $g_i^\sigma(X)$ is
  the bivariate polynomial $g_i(X,\beta)$. In $g_i(X,\alpha)$ and
  $g_i(X,\beta)$ we replace $\alpha$ and $\beta$ by $a(\gamma)$ and
  $b(\gamma)$ respectively to get the polynomials $g_i(X)$ and
  $g_i^\sigma(X)$ as polynomials of over $\mathbb{Q}(\gamma) =
  \mathbb{Q}(\alpha,\beta)$. Having computed the polynomials
  $g_i^\sigma$ and $g_j$ as polynomials over the same field
  $\mathbb{Q}(\gamma)$, one can compute their g.c.d in polynomial
  time.  The complete algorithm to compute the polynomial $T_\Sigma$
  is given below (Algorithm~\ref{alg-enlarge-block}).  Clearly
  Algorithm~\ref{alg-enlarge-block} runs in time bounded by a
  polynomial in the input size. The correctness of the algorithm
  follows from the correctness of Algorithm~\ref{alg-compute-sigma}.

  \begin{algorithm}
    \caption{Computing $T_\Sigma$}\label{alg-enlarge-block}

    $S \leftarrow \{T_\Delta,g\}$

    \Repeat{$S$ is unchanged}
    {

      $S' \leftarrow \{g_i^\sigma\mid g_i\in S\}$.

      \ForEach{factor $g_j$}{

        \lIf{$gcd(g_j,h^\sigma)$ is nontrivial for some $h^\sigma\in S'$}
        { $S \leftarrow S \cup \{ g_j \}$}}

    }

    Output $T_\Sigma = \prod_{g_i \in S} g_i$

 \end{algorithm}

\end{proof}

We now complete the proof of Theorem~\ref{thm-enlarge-block}.  By
Proposition~\ref{prop-tdelta-qdelta}, it suffices to compute the set
$\mathcal{S}$ of polynomials $T_\Sigma$ such that $\Sigma$ is a
minimal $G$-block properly containing $\Delta$. Let $f(X)$ factor as
$f(X) = g_0\ldots g_r$ over $\mathbb{Q}_\Delta$ with $g_0 = T_\Delta$.

Let $\Sigma_i$ be the smallest $G$-block containing $\Delta$ and all
the roots of $g_i$. For any $G$-block $\Sigma$ such that $\Delta$ is a
maximal $G$-subblock of $\Sigma$, there is an $i$, $1 \leq i \leq r$
such that $\Sigma = \Sigma_i$. Using Lemma~\ref{lem-enlarge-block} we
compute $T_{\Sigma_i}$'s for each $1 \leq i \leq r$.  The $G$-block
$\Sigma_j \subseteq \Sigma_i$ if and only if $T_{\Sigma_j}$ divides
$T_{\Sigma_i}$ and hence $\Sigma_i$ is a minimal $G$-block properly
containing $\Delta$ if and only if $T_{\Sigma_i}$ is not divisible by
$T_{\Sigma_j}$ for all $j \neq i$.  The set $\mathcal{S}$ is the
collection of all the polynomials $T_{\Sigma_i}$ such that for all $j
\neq i$, $T_{\Sigma_j} \nmid T_{\Sigma_i}$.  Clearly computing
$\mathcal{S}$ is in polynomial time.

Having computed the set $\mathcal{S}$ we compute the fields
$\mathbb{Q}_{\Sigma_i}$ for all polynomials $T_{\Sigma_i}(X) \in
\mathcal{S}$. Recall that $\mathbb{Q}_{\Sigma_i}$ is obtained by
adjoining the coefficients of the polynomial $T_{\Sigma_i}$ each of
which are symmetric functions of roots of $f(X)$ in $\Sigma_i$. Thus
although computing $\mathbb{Q}_{\Sigma_i}$ takes time proportional to
$\size{f}$ and $\size{\mathbb{Q}_\Delta}$, the size of the explicit
data computed for the field $\mathbb{Q}_{\Sigma_i}$ is polynomial in
$\size{f}$ and is independent of the size of presentation of
$\mathbb{Q}_\Delta$. This completes the proof of
Theorem~\ref{thm-enlarge-block}.

\begin{remark}
  That the size of the computed presentation of $\mathbb{Q}_\Sigma$ is
  bounded by a polynomial in $\size{f}$ and is independent on the size
  of $\mathbb{Q}_\Delta$ is important because
  Theorem~\ref{thm-enlarge-block} will be used repeatedly in our
  algorithms to compute a tower of fields
  $\mathbb{Q}_{\Delta_0}\supset \ldots \supset \mathbb{Q}_{\Delta_m}$
  for a maximal chain of $G$-blocks $\Delta_0 \subset \ldots \subset
  \Delta_m$. The length $m$ of such a chain of $G$-blocks could be as
  large as $\lg{n}$ where $n$ is the degree of $f$. If the size of
  $\mathbb{Q}_{\Delta_i}$ depended on the size of presentation of
  $\mathbb{Q}_{\Delta_{i-1}}$ then the presentation of
  $\mathbb{Q}_{\Delta_m}$ could be as large as $n^{\lg n}$.

\end{remark}
\section{Nilpotence testing for Galois groups}\label{sect-nilpotent}

In this section we give a polynomial time algorithm for testing
whether the Galois group of a given polynomial is nilpotent. We give a
characterisation of transitive nilpotent groups which can be tested
in polynomial time. Recall that a finite group $G$ is \emph{nilpotent}
if and only if every Sylow subgroup of $G$ is normal (see
Lemma~\ref{lem-nilpotent-equivalent} for other equivalent
definitions).  For a nilpotent group $G$ and a prime $p$ that divides
$\# G$, there is a unique $p$-Sylow subgroup which we denote in this
section by $G_p$. In fact $G_p$ is the set of all element of $G$ that
has order a power of $p$. Moreover any subgroup $H$ of $G$ is also
nilpotent and the $p$-Sylow subgroup of $H$ is $G_p \cap H$.  If $\{
p_1,\ldots,p_k \}$ are the set of prime factors of $\#G$ then $G =
G_{p_1} \times \ldots \times G_{p_k}$.

\begin{lemma}\label{lem-struct-nilpotent}
  Let $G$ be a transitive nilpotent permutation group on $\Omega$ then
  \begin{enumerate}

  \item For all primes $p$, $p$ divides $\#G$ if and only if $p$
    divides $\# \Omega$.\label{lem-struct-nilpotent-ps}

  \item For any prime $p \mid \# G$ and $\alpha \in \Omega$ there is a
    block $\Sigma_p^\alpha$ containing $\alpha$ such that $\#
    \Sigma_p^\alpha$ is the highest power of $p$ that divides $\#
    \Omega$.\label{lem-struct-nilpotent-sigma}
  \item Let $\Delta$ be any $G$-block containing $\alpha$ such that
    $\# \Delta = p^l$ for some prime $p$ dividing $\# G$. Then $\Delta
    \subseteq \Sigma_p^\alpha$. Also for all $q$ different from $p$
    the $q$-Sylow subgroup of $G_\Delta$ is same as the $q$-Sylow
    subgroup of $G_\alpha$, i.e. $G_q \cap G_\Delta = G_q \cap
    G_\alpha$.
  \end{enumerate}
\end{lemma}
\begin{proof}
  As $G$ is transitive on $\Omega$, $\# \Omega$ divides $\# G$ by
  Orbit-Stabiliser formula (Theorem~\ref{thm-orbit-stab-formula}).
  Hence, each prime factor of $\# \Omega$ divides $\# G$. Conversely
  let $p$ be a prime factor of $\# G$.  For $\alpha \in \Omega$, the
  set $\Sigma_p^\alpha = \alpha^{G_p}$ is a nontrivial $G$-block as
  $G_p$ is a normal subgroup of $G$ (Lemma~\ref{lem-orbit-normal}).
  Since $G_p$ is transitive on $\Sigma_p^\alpha$, it follows from the
  Orbit-Stabiliser formula that $\# \Sigma_p^\alpha$ divides $\# G_p$.
  Hence $\# \Sigma_p^\alpha$ is $p^l$ for some $l > 0$. Since $p$
  divides the cardinality of a $G$-block $\Sigma_p^\alpha$, $p$ must
  divide $\# \Omega$. This proves part 1.

  Next, we prove (2). {From} the Galois correspondence of $G$-blocks
  (Theorem~\ref{thm-blocks-galois}) we have $[\Omega :
  \Sigma_p^\alpha] = [G : G_{\Sigma_p^\alpha}]$. The prime $p$ does
  not divide $[G:G_p]$ as $G_p$ is the $p$-Sylow subgroup of $G$.
  Therefore $p$ does not divide $[G: G_{\Sigma_p^\alpha}]$ either as
  $G_p$ is a subgroup of $G_{\Sigma_p^\alpha}$.  Hence $p$ is not a
  factor of $[\Omega:\Sigma^\alpha_p]$ and $\# \Sigma_p^\alpha$ is the
  highest power of $p$ that divides $\# \Omega$.

  To prove part 3 notice that $G_\Delta$ is a nilpotent group with the
  unique normal $q$-Sylow subgroup $G_q \cap G_\Delta$. Therefore we
  have $G_\Delta = \prod_q (G_q \cap G_\Delta)$. By the Galois
  correspondence (Theorem~\ref{thm-blocks-galois}) of blocks we have

  \begin{equation}\label{eqn-index}
    \# \Delta = [G_\Delta : G_\alpha ] = \prod_q [ G_q \cap G_\Delta : G_q \cap
    G_\alpha].
  \end{equation}

  Since $G_q \cap G_\Delta$ is a $q$-group, the prime $p$ divides the
  index $[G_q \cap G_\Delta : G_q \cap G_\alpha]$ if and only if $q =
  p$.  However, in Equation~\ref{eqn-index} $\# \Delta$ is a power of
  $p$.  This is possible if and only if $[G_q \cap G_\Delta :G_q \cap
  G_\alpha] = 1$ for all $q \neq p$. Thus $G_q \cap G_\Delta = G_q
  \cap G_\alpha$ for all $q$ different from $p$.

  The group $G_\Delta$ is therefore the product group $G_p \cap
  G_\Delta \times \prod_{q \neq p} G_q \cap G_\alpha$. Since the group
  $G_{\Sigma_p^\alpha}$ contains both $G_p$ and $G_\alpha$ we have
  $G_{\Sigma_p^\alpha} \geq G_\Delta$. Thus by Galois correspondence
  of blocks (Theorem~\ref{thm-blocks-galois}), $\Delta$ is a
  $G$-subblock of $\Sigma_p^\alpha$.
\end{proof}

Nilpotent groups behave almost like $p$-groups. Let $G$ be a
transitive nilpotent permutation group on $\Omega$ and let $p$ be a
prime dividing $\# G$. We prove that as far as $G$-blocks contained in
$\Sigma_p^\alpha$ are concerned, $G$ behaves like $G_p$.  The
following lemma makes this precise.

\begin{lemma}\label{lem-nilpotent-pgroup-similar}
  Let $G$ be a transitive nilpotent permutation group acting on
  $\Omega$. Let $p$ be any prime that divides $\# G$ and let $G_p$ be
  the corresponding $p$-Sylow subgroup. Consider any element $\alpha
  \in \Omega$ and let $\Sigma_p^\alpha$ be the $G$-block
  $\alpha^{G_p}$. A set $\Delta \subseteq \Sigma_p^\alpha$ is a
  $G$-block if and only if $\Delta$ is a $G_p$-block under the
  transitive action of $G_p$ on $\Sigma_p^\alpha$.
\end{lemma}
\begin{proof}
  Clearly any $G$-block contained in $\Sigma_p^\alpha$ is a
  $G_p$-block as $G$ contains $G_p$. Conversely consider a $G_p$-block
  $\Delta$ of $\Sigma_p^\alpha$.  The group $G_p \cap G_\Delta$
  contains $G_p \cap G_\alpha$. To see this consider the transitive
  action of $G_p$ restricted to $\Sigma_p^\alpha$. The restriction
  action is a homomorphism $\psi: G_p \to \Sym{\Sigma_p^\alpha}$.  Let
  $H$ denote the image $\psi(G_p) = \pr{G_p}{\Sigma_p^\alpha}$.  The
  groups $G_p \cap G_\Delta$ and $G_p \cap G_\alpha$ are the pullbacks
  $\psi^{-1}(H_\Delta)$ and $\psi^{-1}(H_\alpha)$ respectively.  Since
  the subset $\Delta$ is a $H$-block of $\Sigma_p^\alpha$ and contains
  $\alpha$, $H_\Delta \geq H_\alpha$. Therefore $G_p \cap G_\Delta
  \geq G_p \cap G_\alpha$.

  Consider the group $G' = (G_p \cap G_\Delta) \times \prod_{q \neq
    p}G_q \cap G_\alpha$. The group $G_\alpha$ is nilpotent and hence
  $G_\alpha = (G_p \cap G_\alpha) \times \prod_{q \neq p} G_q \cap
  G_\alpha$. Since $G_p \cap G_\Delta \geq G_p \cap G_\alpha$ we have
  $G' \geq G_\alpha$. Therefore by the Galois correspondence of blocks
  (Theorem~\ref{thm-blocks-galois}) we have $\Delta = \alpha^{G'}$ is
  a $G$-block between $\{ \alpha \}$ and $\Sigma_p^\alpha$.
\end{proof}

We now study the structure of blocks of a $p$-group. We state the
following result due to Luks~\cite[Lemma 1.1]{luks82bounded}.

\begin{lemma}[Luks]\label{lem-luks-pgroups}
  Let $G$ be a $p$-group acting transitively on $\Omega$ and let
  $\Delta$ be a maximal $G$-block. Then the index $[\Omega : \Delta]$
  is exactly $p$ and $G_\Delta = \Gof{\Omega/\Delta}=G^{\Delta}$ is a
  normal group of index $p$ in $G$.
\end{lemma}
\begin{proof}
  Let $\Delta$ be a maximal $G$-block. By Galois correspondence of
  blocks we have $[ \Omega : \Delta] = [ G : G_\Delta]$. Suppose that
  $[G: G_\Delta] = p^l$ for $l \geq 1$. The group $G$ being a
  $p$-group, it follows that there is a subnormal series $G = G_ 0
  \rhd G_1 \ldots \rhd G_l = G_\Delta$ such that $[G_i : G_{i+1} ] =
  p$~\cite[Theorem~4.3.2]{hall}.  Let $\alpha$ be any element of
  $\Delta$. Since $G_\Delta \geq G_\alpha$, ${(G_i)}_\alpha =
  G_\alpha$.  Therefore by Orbit-Stabiliser formula $\frac{\#
    \alpha^{G}}{\# \alpha^{G_1}} = \frac{\# G}{\#G_1} = [G : G_1] =
  p$. However $G_1$ is a normal subgroup of $G$ and $\alpha^{G_1} \neq
  \Omega$.  Therefore $\alpha^{G_1}$ is the maximal block $\Delta$ and
  $G_\Delta = G_1$.

  Recall that $G^\Delta = \Gof{\Omega/\Delta}$ is the largest normal
  subgroup of $G = G_\Omega$ contained in $G_\Delta$
  (Theorem~\ref{thm-gsupdelta}. However $G_\Delta = G_1$ itself is
  normal. Hence $G_\Delta = G^\Delta$.
\end{proof}

 Applying Lemma~\ref{lem-luks-pgroups} repeatedly we have the
 following lemma.

 \begin{lemma}\label{lem-struct-pgroups}
   Let $G$ be a transitive $p$-group acting on $\Omega$ and
   $\alpha \in \Omega$. Let $\{ \alpha \} = \Delta_0 \subset \ldots
   \subset \Delta_t = \Omega$ be any maximal chain of $G$-blocks.
   Then
   \begin{enumerate}
   \item $[\Delta_{i+1}: \Delta_i] = p$ for all $0 \leq i < t$.
   \item $\Gof{\Delta_{i+1}/\Delta_i} = G_{\Delta_i}$.
   \item The group $G_{\Delta_i}$ is a normal subgroup of
     $G_{\Delta_{i+1}}$ and the quotient group
     $G_{\Delta_{i+1}}/G_{\Delta_i}$ is cyclic of order $p$.
   \end{enumerate}
   In particular any minimal $G$-block is of cardinality $p$.
 \end{lemma}

 We now prove the following important property of transitive nilpotent
 permutation groups.

\begin{lemma}\label{lem-nilpotent-block-increment}
  Let $G$ be a transitive nilpotent permutation group on $\Omega$. Let
  $p$ be any prime dividing $\# G$. Let $\Delta$ be any $G$-block such
  that $\# \Delta = p^l$ for some integer $l \geq 0$. Let $m$ be the
  highest power of $p$ that divides $\# \Omega$. If $l < m$ then we
  have
  \begin{enumerate}
  \item There exists a $G$-block $\Sigma$ such that $\Delta$ is a
    maximal $G$-subblock of $\Sigma$ and $[\Sigma: \Delta] = p$.
  \item For all $G$-blocks $\Sigma$ such that $\Delta$ is a maximal
    $G$-subblock of $\Sigma$ and $[\Sigma: \Delta] = p$, $G_\Delta$ is
    a normal subgroup of $G_\Sigma$.
  \end{enumerate}
\end{lemma}
\begin{proof}
  Let $\Sigma_p^\alpha$ as before denote the $G$-blocks
  $\alpha^{G_p}$.  Since $\# \Delta$ is a power of $p$ it follows that
  $\Delta$ is a $G$-subblock of $\Sigma_p^\alpha$
  (Lemma~\ref{lem-struct-nilpotent}). The subset $\Delta$ is a
  $G_p$-block on the transitive action of $G_p$ on $\Sigma_p^\alpha$
  (Lemma~\ref{lem-nilpotent-pgroup-similar}).  Consider the action of
  the $p$-group $G_p$ on $\Sigma_p^\alpha$. If $l < m$ there is a
  $G_p$-block $\Sigma$ such that $\Sigma_p^\alpha \supseteq \Sigma
  \supset \Delta$ and $[\Sigma : \Delta] = p$. By
  Lemma~\ref{lem-nilpotent-pgroup-similar} it follows that $\Sigma$ is
  a $G$-block contained in $\Sigma_p^\alpha$. This proves part 1.

  Let $\alpha$ be any element of $\Delta$. It follows {from}
  Lemma~\ref{lem-struct-nilpotent} that for all $q \neq p$ the
  $q$-Sylow subgroup of $G_\Sigma$ and $G_\Delta$ are both $G_q \cap
  G_\alpha$. Let $\widehat{G}_p$ be the product group $\prod_{q \neq
    p} G_q$.  The groups $G_\Sigma$ and $G_\Delta$ are $(G_p \cap
  G_\Sigma) \times (\widehat{G}_p \cap G_\alpha)$ and $(G_p \cap
  G_\Delta) \times (\widehat{G}_p \cap G_\alpha)$ respectively.
  Moreover the groups $G_p \cap G_\Sigma$ and $G_p \cap G_\Delta$ are
  $p$-groups with index $[G_p \cap G_\Sigma : G_p \cap G_\Delta] =
  [G_\Sigma : G_\Delta] = [\Sigma : \Delta] = p$.  Therefore $G_p \cap
  G_\Delta$ is a normal subgroup of $G_p \cap G_\Sigma$. As a result
  $G_\Delta = (G_p \cap G_\Delta)\times (\widehat{G}_p \cap G_\alpha)$
  is a normal subgroup of $G_\Sigma = (G_p \cap G_\Sigma) \times
  (\widehat{G}_p \cap G_\alpha)$ and the quotient group
  $\frac{G_\Sigma}{G_\Delta} = \frac{G_p \cap G_\Sigma}{G_p \cap
    G_\Delta}$ is isomorphic to $\mathbb{F}_p$.

\end{proof}

We give the following characterisation of transitive nilpotent groups.

\begin{theorem}\label{thm-nilpotent-main-theorem}
  Let $G$ be a transitive permutation group on $\Omega$ then the
  following are equivalent.
  \begin{enumerate}
  \item $G$ is nilpotent.
  \item For all primes $p$ dividing $\# G$, $p$ divides $\# \Omega$
    and there exists a maximal chain of $G$-block $\{ \alpha \} =
    \Delta_0 \subset \ldots \subset \Delta_m$ such that
    \begin{enumerate}
    \item $m$ is the highest power of $p$ dividing $\# \Omega$.
      %\label{cond-m}
      \label{cond-start}%
    \item $G_{\Delta_i}$ is a normal subgroup of $G_{\Delta_{i+1}}$.
      %\label{cond-gsubdelta}%
    \item $[\Delta_{i+1} : \Delta_i] = p$ for all $0 \leq i < m$.
      %\label{cond-delta}%
    \item $p \nmid [G : G^{\Delta_m}]$. %\label{cond-gsupdelta}
      \label{cond-end}%
    \end{enumerate}
  \end{enumerate}
\end{theorem}
\begin{proof}
  If $G$ is nilpotent then condition 2 holds. The required maximal
  chain of $G$-blocks is any maximal chain between $\{ \alpha \}$ and
  $\Sigma_p^\alpha$. We now prove the converse.

  Consider any prime $p$ dividing $\# G$. The prime $p$ divides $\#
  \Omega$ and let $m> 0$ be the highest power of $p$ dividing $\#
  \Omega$.  Let $\{ \alpha \} = \Delta_0 \subset \ldots \subset
  \Delta_m$ be a maximal chain of $G$-blocks satisfying the
  conditions~\ref{cond-start}--\ref{cond-end}.  We prove that
  $G^{\Delta_m}$ is the unique $p$-Sylow subgroup for $G$.

  Recall that $\Gof{\Delta_{i+1}/\Delta_i}$ is the largest subgroup of
  $G_{\Delta_i}$ that is normal in $G_{\Delta_{i+1}}$
  (Theorem~\ref{thm-gsupdelta}). However since $G_{\Delta_i}$ itself
  is a normal subgroup of $G_{\Delta_{i+1}}$ it follows that
  $G_{\Delta_i} = \Gof{\Delta_{i+1}/\Delta_i}$. Moreover
  $[G_{\Delta_{i+1}}:G_{\Delta_i}] = [\Delta_{i+1} : \Delta_i] = p$
  and therefore $[G_{\Delta_{i+1}}: \Gof{\Delta_{i+1}/\Delta_i}] = p$.

  The group $\frac{G^{\Delta_{i+1}}}{G^{\Delta_i}}$ is a subgroup of
  the $l_i$-fold product of
  $\frac{G_{\Delta_{i+1}}}{\Gof{\Delta_{i+1}/\Delta_i}}$
  (Theorem~\ref{thm-gsupdelta}). Hence
  $\frac{G^{\Delta_{i+1}}}{G^{\Delta_i}}$ is of order $p^l$ for some
  $l$. As a result we have
  \[
  \# G^{\Delta_m} = [G^{\Delta_m}:G^{\Delta_{m-1}}]\ldots
  [G^{\Delta_1}: G^{\Delta_0}] = \textrm{ a power of }p.
  \]

  The group $G^{\Delta_m}$ is thus a $p$-group. Furthermore $p \nmid
  [G : G^{\Delta_m}]$ (condition~\ref{cond-end}). Therefore
  $G^{\Delta_m}$ is a $p$-Sylow subgroup of $G$.  Moreover the group
  $G^{\Delta_m} = \Gof{\Omega/\Delta_m}$ is also a normal subgroup of
  $G = G_\Omega$ (part 1 of Theorem~\ref{thm-gsupdelta}).  Thus we
  have shown that for every prime $p$ that divides $\#G$ the $p$-Sylow
  subgroup is normal.  This proves that $G$ is nilpotent.
\end{proof}

\subsection{The nilpotence test}

Given $f(X) \in \mathbb{Q}[X]$ we want to test if the Galois group of
$f(X)$ is nilpotent. If $f$ is reducible then the Galois group of $f$
is nilpotent if and only if the Galois group of each of its
irreducible factors is nilpotent.  This is because nilpotent groups
are closed under products and subgroups.  Since in polynomial time one
can factor polynomials over $\mathbb{Q}$
(Theorem~\ref{thm-factoring-numberfield}), without loss of generality
we assume that $f(X)$ is irreducible.  Let $G$ be the Galois group of
$f(X)$ considered as a subgroup of $\Sym{\Omega}$, where $\Omega$ is
the set of roots of $f(X)$. Since $f$ is irreducible, $G$ is
transitive on $\Omega$.

We describe the main idea behind the algorithm.  It follows {from}
Theorem~\ref{thm-nilpotent-main-theorem} that $G$ is nilpotent if and
only if for all primes $p$ that divide the order of $G$, there is a
maximal chain of $G$-blocks $\{\alpha \} = \Delta_0\subset \ldots
\subset \Delta_m$ satisfying the conditions of part 2 of
Theorem~\ref{thm-nilpotent-main-theorem}. We do not have access to the
sets $\Delta_i$ and the groups $G_{\Delta_i}$. However we prove that
conditions in part 2 of Theorem~\ref{thm-nilpotent-main-theorem} can
be verified once the fields $\mathbb{Q}(\alpha) =
\mathbb{Q}_{\Delta_0} \supset \ldots \supset \mathbb{Q}_{\Delta_m}$
are known.  Recall that for a $G$-block $\Delta$, $\mathbb{Q}_\Delta$
is the fixed field of the splitting field $\mathbb{Q}_f$ under the
automorphisms of $G_\Delta$. Algorithm~\ref{algo-nilpotent} is the
complete algorithm.

\begin{algorithm}
  \SetKw{Print}{print}
  \caption{Nilpotence test}\label{algo-nilpotent}
  \KwIn{A polynomial $f(X) \in \mathbb{Q}[X]$ of degree $n$.}
  \KwResult{\emph{Accepts} $f$ if Galois group of $f(X)$ is nilpotent,
    \emph{Rejects} otherwise.}

  Verify whether $f(X)$ is solvable.

  \lnl{step-compute-ps} Compute the set $P$ of all the prime factors
  of $\# \Gal{f}$.

  Let $G$ denote the Galois group of $f$ thought of as a permutation
  group on $\Omega$, the set of roots of $f$.

  \lnl{step-for-loop}%
  \ForEach{$p \in P$} {

    \lnl{step-check-p-divides-n}%
    \lIf{$p$ does not divide $n$}{ \KwSty{Reject}.}

    Let $m$ be the highest power of $p$ dividing $n$.

    $\mathbb{Q}_{\Delta_0} \leftarrow \mathbb{Q}[X]/f(X)$.

    \lnl{loop-compute-qdeltas}%
    \For{$i \leftarrow 1$ \KwSty{to} $m$}
    {

      Using Theorem~\ref{thm-enlarge-block} compute the set of fields
      \[ \mathcal{F} = \{ \mathbb{Q}_\Sigma | \Delta \textrm{ is a
        maximal } G\textrm{-block of }\Sigma \}.
      \]

      \lnl{step-p-degree-field}%
      Let $\mathbb{Q}_\Sigma$ be any field of $\mathcal{F}$ such that
      $[\mathbb{Q}_{\Sigma} : \mathbb{Q}_{\Delta_{i-1}}] = p$. If no
      such field exists then \KwSty{Reject}.

      \lnl{step-if-normal}%
      \lIf{$\mathbb{Q}_{\Sigma}/\mathbb{Q}_{\Delta_{i-1}}$ is not
        normal}{ \KwSty{Reject}.}%

      \lElse {$\mathbb{Q}_{\Delta_i} \leftarrow \mathbb{Q}_\Sigma$.}%

    }

    Let $\mu_{\Delta_m}(X)$ be the primitive polynomial for
    $\mathbb{Q}_{\Delta_m}$.

    \lnl{step-check-psylow}%
    \lIf{$p$ divides $\# \Gal{\mu_{\Delta_m}}$}
    {
      \KwSty{Reject}.
    }
  }

  \KwSty{Accept}.

\end{algorithm}

Given a polynomial $f(X)$ with solvable Galois group, as a by product
of the Landau-Miller test~\cite{landau85solvability}, there is a
polynomial time algorithm to compute the prime factors of $\# \Gal{f}$
(see also Theorem~\ref{thm-gammad-primes}).  Therefore the
steps~\ref{step-compute-ps} and \ref{step-check-psylow} of
Algorithm~\ref{algo-nilpotent} can be performed in polynomial time.
All other steps can clearly be performed in polynomial time.  This
gives us the following proposition.

\begin{proposition}\label{prop-nilpotent-polytime}
  Algorithm~\ref{algo-nilpotent} runs in time polynomial in
  $\size{f}$.
\end{proposition}

We now argue the correctness of the algorithm in the following two
propositions.

\begin{proposition}\label{prop-if-nilpotent-accept}
  Algorithm~\ref{algo-nilpotent} accepts $f(X)$ if the Galois group of
  $f$ is nilpotent.
\end{proposition}
\begin{proof}
  Let $G$ be the Galois group of $f(X)$ and let $p$ be any prime that
  divides $\# G$. Let $G_p$ be the $p$-Sylow subgroup of $G$ and let
  $\Sigma_p^\alpha$ be the $G$-block $\alpha^{G_p}$. The loop in
  step~\ref{loop-compute-qdeltas} in fact constructs the tower of
  fields $\mathbb{Q}_{\Sigma_p^\alpha} = \mathbb{Q}_{\Delta_m} \subset
  \ldots \subset \mathbb{Q}_{\Delta_0} = \mathbb{Q}(\alpha)$ for a
  maximal chain of $G$-blocks $\{ \alpha \} = \Delta_0 \subset \ldots
  \Delta_m = \Sigma_p^\alpha$.
  Lemma~\ref{lem-nilpotent-block-increment} guarantees that the
  step~\ref{step-p-degree-field} will never fail.

  The extension $\mathbb{Q}_{\Delta_i}/\mathbb{Q}_{\Delta_{i-1}}$ is
  normal because $G_{\Delta_{i-1}}$ is a normal subgroup of
  $G_{\Delta_i}$. Let $K$ be the normal closure of
  $\mathbb{Q}_{\Delta_m}$ then it follows form
  Proposition~\ref{prop-twoway-galois} that $\Gal{\mathbb{Q}_f/K}$ is
  $G^{\Delta_m}$.  The Galois group of $\mu_{\Delta_m}(X)$ is the
  quotient group $\frac{G}{G^{\Delta_m}}$.  Since $G^{\Delta_m} =
  G^{\Sigma_p^\alpha} = G_p$, $p$ does not divide the order of the
  Galois group of $\mu_{\Delta_m}(X)$.

  Thus no step in the loop~\ref{loop-compute-qdeltas} will reject the
  input if the Galois group of $f$ is nilpotent. This completes the
  proof.
\end{proof}

We now prove the converse.

\begin{proposition}\label{prop-if-accept-nilpotent}
  If Algorithm~\ref{algo-nilpotent} accepts then the Galois group of
  $f(X)$ is nilpotent.
\end{proposition}
\begin{proof}
  Let $\Omega$ be the roots of $f(X)$ and let $G$ be the Galois group
  of $f(X)$ as a permutation group on $\Omega$.  Since the algorithm
  has accepted $f(X)$ we have the following conditions of the Galois
  group $G$ of $f(X)$.

  \begin{enumerate}
  \item Every prime $p$ that divides $\# G$ also divides $n = \#
    \Omega$. This is verified in step~\ref{step-check-p-divides-n}.
  \item For any prime $p$ dividing $\# G$ let $m$ be the highest power
    of $p$ dividing $n$. There is a maximal chain $\{ \alpha \} =
    \Delta_0 \subset \ldots \subset \Delta_m$ of $G$-blocks such that
    for all $0 \leq i < m$
    \begin{enumerate}
    \item $G_{\Delta_i}$ is a normal subgroup of $G_{\Delta_{i+1}}$.
      We verified this in step~\ref{step-if-normal} by checking that
      the extension $\mathbb{Q}_{\Delta_{i+1}}/\mathbb{Q}_{\Delta_i}$
      is a normal.
    \item $[\Delta_{i+1} : \Delta_i] = p$. This is because
      $[\Delta_{i+1} : \Delta_i] = [\mathbb{Q}_{\Delta_{i+1}}:
      \mathbb{Q}_{\Delta_i}] = p$
      (Proposition~\ref{prop-twoway-galois}).
    \item The prime $p$ does not divide $[G:G^{\Delta_m}]$. As argued
      before the Galois group of the polynomial $\mu_{\Delta_m}$, a
      primitive polynomial of $\mathbb{Q}_{\Delta_m}$, is the Galois
      group $\frac{G}{G^{\Delta_m}}$. Thus in
      step~\ref{step-check-psylow} we have verified that $p$ does not
      divide $\#\frac{G}{G^{\Delta_m}} = [G:G^{\Delta_m}]$.
    \end{enumerate}
  \end{enumerate}

  Hence {from} Theorem~\ref{thm-nilpotent-main-theorem}, $G$ is
  nilpotent.
\end{proof}

Combining Propositions~\ref{prop-nilpotent-polytime},
\ref{prop-if-nilpotent-accept} and \ref{prop-if-accept-nilpotent} we
have the main theorem of this section.

\begin{theorem}
  Given a polynomial $f(X) \in \mathbb{Q}[X]$, there is an algorithm
  that runs in time polynomial in $\size{f}$ that decides whether the
  Galois group of $f$ is nilpotent.
\end{theorem}

\section{$\Gamma_d$-testing for Galois
  groups}\label{sect-gammad-check}

In this section we show that the technique underlying the
Landau-Miller solvability test can be adapted to efficiently solve a
more general problem, the problem of testing whether the Galois group
of a polynomial $f(X) \in \mathbb{Q}[X]$ is in $\Gamma_d$ for constant
$d$.  Recall that a group $G$ is in $\Gamma_d$ if there is a
composition series $G = G_0 \rhd \ldots \rhd G_t = \{ 1 \}$ such that
$G_i/G_{i+1}$ is either abelian or isomorphic to a subgroup of $S_d$.
Given a polynomial $f(X)$ over $\mathbb{Q}$ of degree $n$, we give an
algorithm that runs in time polynomial in $\size{f}$ and $n^d$ to
check whether the Galois group of $f$ is in $\Gamma_d$. For constant
$d$ this yields a polynomial time $\Gamma_d$-test. As a byproduct of
our polynomial time $\Gamma_d$-testing, we obtain a polynomial time
algorithm to compute the prime factors of $\# \Gal{f}$ for any
polynomial $f$ with Galois group in $\Gamma_d$.  Note that for $d <
5$, $\Gamma_d$ is the class of solvable groups and hence our result is
a generalisation of the result of
Landau-Miller~\cite{landau85solvability}.

We are given a polynomial $f(X)$ over $\mathbb{Q}$.  Since the class
$\Gamma_d$ is closed under subgroups and quotients and products,
without loss of generality assume that $f(X)$ is irreducible of degree
$n$. For describing the $\Gamma_d$ test we fix the following notation
for the rest of this section. Let $G$ be the Galois group of $f$.
Consider the faithful action of $G$ as a permutation group on
$\Omega$, the set of roots of $f$.  Let $\{ \alpha \} = \Delta_0
\subset \ldots \subset \Delta_m = \Omega$ be any maximal chain of
$G$-blocks.  Recall that for all $0 \leq i < m$ the group
$\Gof{\Delta_{i+1}/\Delta_i}$ is a normal subgroup of
$G_{\Delta_{i+1}}$ (Theorem~\ref{thm-gsupdelta}).  We have the
following proposition.

\begin{proposition}\label{prop-g-gdelta-gammad}
  The group $G$ is in $\Gamma_d$ if and only if the quotient groups
  $\frac{G_{\Delta_{i+1}}}{\Gof{\Delta_{i+1}/\Delta_i}}$, $0 \leq i <
  m$, are all in $\Gamma_d$.
\end{proposition}
\begin{proof}
  The series $G = G^{\Delta_t} \rhd \ldots \rhd G^{\Delta_0} = 1$
  gives a normal series for $G$.  Hence $G$ is in $\Gamma_d$ if and
  only if for each $0 \leq i < m$ the quotient
  $\frac{G^{\Delta_{i+1}}}{G^{\Delta_i}}$ is in $\Gamma_d$.  Consider
  the subgroups $G_{\Delta_{i+1}}$ and $\Gof{\Delta_{i+1}/\Delta_i}$
  of $G$.  If $G$ is in $\Gamma_d$ so are $G_{\Delta_{i+1}}$ and
  $\Gof{\Delta_{i+1}/\Delta_i}$ and hence their quotient
  $\frac{G_{\Delta_{i+1}}}{\Gof{\Delta_{i+1}/\Delta_i}}$
  (Proposition~\ref{prop-gammad-closure}). On the other hand,
  $\frac{G^{\Delta_{i+1}}}{G^{\Delta_i}}$ is isomorphic to a subgroup
  of
  $\left(\frac{G_{\Delta_{i+1}}}{\Gof{\Delta_{i+1}/\Delta_i}}\right)^l$
  for some $l$ (Theorem~\ref{thm-gsupdelta}) and therefore
  $\frac{G^{\Delta_{i+1}}}{G^{\Delta_i}}$ is in $\Gamma_d$ if
  $\frac{G_{\Delta_{i+1}}}{\Gof{\Delta_{i+1}/\Delta_i}}$ is in
  $\Gamma_d$.  Hence $G$ is in $\Gamma_d$ if and only if for each $0
  \leq i < m$ the quotient group
  $\frac{G_{\Delta_{i+1}}}{\Gof{\Delta_{i+1}/\Delta_i}}$ is in
  $\Gamma_d$.
\end{proof}

We have no access to the groups $G_{\Delta_{i+1}}$ and
$\Gof{\Delta_{i+1}/\Delta_i}$. However using
Theorem~\ref{thm-enlarge-block} we can compute the field $K_i =
\mathbb{Q}_{\Delta_i}$, $0 \leq i \leq m$, for some maximal chain of
$G$-blocks $\{ \alpha \} = \Delta_0 \subset \ldots \subset \Delta_m =
\Omega$.  Let $L_i$ be the normal closure of $K_{i-1}$ over $K_i$.
Using Proposition~\ref{prop-twoway-galois} and
\ref{prop-g-gdelta-gammad} we have the following proposition.

\begin{proposition} \label{prop-order-li-ki} The Galois group $G$ is
  in $\Gamma_d$ if and only the Galois groups $\Gal{L_i/K_i}$, $1 \leq
  i \leq m$, is in $\Gamma_d$. Furthermore, if $G$ is in $\Gamma_d$
  then the degree $[L_i:\mathbb{Q}] = n^{O(d)}$.
\end{proposition}
\begin{proof}
  The field $L_i$ is the fixed field
  $\Fix{\mathbb{Q}_f}{\Gof{\Delta_i/\Delta_{i-1}}}$
  (Proposition~\ref{prop-twoway-galois}) and hence the Galois group
  $\Gal{\mathbb{Q}_f/L_i}$ is $\Gof{\Delta_i/\Delta_{i-1}}$. Moreover
  the Galois group of $\mathbb{Q}_f/\mathbb{Q}_{\Delta_i}$ is
  $G_{\Delta_i}$ and hence by the fundamental theorem of Galois theory
  (Theorem~\ref{thm-funda-galois}), the Galois group $\Gal{L_i/K_i}$
  is the quotient group
  $\frac{G_{\Delta_i}}{\Gof{\Delta_i/\Delta_{i-1}}}$. It then follows
  from Proposition~\ref{prop-g-gdelta-gammad} that $G$ is in
  $\Gamma_d$ if and only if each of the Galois groups $\Gal{L_i/K_i}$
  is in $\Gamma_d$.

  The block $\Delta_{i-1}$ is a maximal $G$-subblock of $\Delta_i$.
  Recall that the group
  $\frac{G_{\Delta_i}}{\Gof{\Delta_i/\Delta_{i-1}}}$ acts faithfully
  as a primitive permutation group on the set of $G$-blocks
  $\Blocks{\Delta_i/\Delta_{i-1}}$ (Theorem~\ref{thm-gsupdelta}).
  Moreover if $G$ is in $\Gamma_d$ then so is
  $\frac{G_{\Delta_i}}{\Gof{\Delta_i/\Delta_{i-1}}}$ and hence by the
  Babai-Cameron-P\'alfy bound (Theorem~\ref{thm-babai-cameron-palfy})
  we have
  \[
  [L_i: K_i] = \# \Gal{L_i/K_i} = \#
  \frac{G_{\Delta_i}}{\Gof{\Delta_i/\Delta_{i-1}}} \leq
  [\Delta_i:\Delta_{i-1}]^{O(d)} \leq n^{O(d)}
  \]
  Therefore $[L_i:\mathbb{Q}] \leq n^{O(d)}$.
\end{proof}

The above proposition in particular implies that if $G$ is in
$\Gamma_d$ then the fields $L_i$ can be computed in time polynomial in
$\size{f}$ and $n^d$. To see this note that we have computed the
explicit data of the fields $K_i$ and $K_{i-1}$ which are of size at
most a polynomial in $\size{f}$. Since the degree of the normal
closure $L_i$ of $K_{i-1}$ over $K_i$ is bounded by a polynomial in
$n^d$, we can use Landau's algorithm (Theorem~\ref{thm-landau-galois})
to compute the field $L_i$. Thus we have the following proposition.

\begin{proposition}
  If the Galois group $G$ is in $\Gamma_d$ then there is an algorithm
  that runs in time polynomial in $\size{f}$ and $n^d$ to compute the
  fields $L_i$.
\end{proposition}

We now describe the polynomial time algorithm for $\Gamma_d$-testing.
The algorithm first computes the fields $K_i$ in time polynomial in
$\size{f}$. Let $b(n)$ be the bound on the size of primitive subgroups
of $S_n$ that are in $\Gamma_d$. By the Babai-Cameron-P\'alfy bound we
have $b(n) = n^{O(d)}$. For each $i$, using Landau's algorithm
(Theorem~\ref{thm-landau-galois}), checks whether the degree
$[L_i:K_i]$ is at most $b(n)$ and if yes computes it.  If any of the
degrees $[L_i:K_i]$ is greater than $b(n)$ then clearly $G$ is not in
$\Gamma_d$.

Having computed the fields $L_i$ and $K_i$, the Galois groups
$\Gal{L_i/K_i}$ are explicitly computed using Landau's algorithm. In
time bounded by a polynomial in $n^d$ we verify whether each of the
groups $\Gal{L_i/K_i}$ is in $\Gamma_d$ (this is sufficient because of
Proposition~\ref{prop-order-li-ki}).  Algorithm~\ref{algo-gamma-d} is
the complete algorithm.

\begin{algorithm}
  \caption{$\Gamma_d$-testing}\label{algo-gamma-d}%
  \KwIn{An irreducible polynomial $f(X)$ of degree $n$ over
    $\mathbb{Q}$.}%
  \KwResult{\emph{Accept} if the Galois group of $f(X)$ is in
    $\Gamma_d$, \emph{Reject} otherwise.}

  Let $G$ be the Galois group of $f(X)$ as a permutation group on
  $\Omega$, the roots of $f(X)$.

  Using Theorem~\ref{thm-enlarge-block} compute the fields $K_i =
  \mathbb{Q}_{\Delta_i}$ for a maximal chain of $G$-blocks $\{ \alpha
  \} = \Delta_0 \subset \ldots \subset \Delta_m = \Omega$.

  \ForEach{$1 \leq i \leq m$} {%
    \lIf{$[L_i:K_i] > b(n)$}{ \KwSty{Reject}. }%

    \lElse{
      \lIf{$\Gal{L_i/K_i}$ is not in $\Gamma_d$}{\KwSty{Reject}.}%
    }%
  }%

  \KwSty{Accept}.
\end{algorithm}

The main theorem of this section follows.

\begin{theorem}\label{thm-gammad-test}%
  Given a polynomial $f(X) \in \mathbb{Q}[X]$, there is an algorithm
  running in time polynomial in $\size{f}$ and $n^{O(d)}$ that decides
  whether the Galois group of $f$ is in $\Gamma_d$.
\end{theorem}

For any $1 \leq i \leq m$, we have $ \# G = [\mathbb{Q}_f:\mathbb{Q}]
= [\mathbb{Q}_f:L_i].[L_i:K_i].[K_i: \mathbb{Q}]$.  Therefore any
prime factor of $[L_i:K_i]$ divides $\# G$. Conversely
$G^{\Delta_i}/G^{\Delta_{i-1}}$ is a subgroup of $l_i$-fold product of
$\frac{G_{\Delta_i}}{\Gof{\Delta_i/\Delta_{i-1}}}$
(Theorem~\ref{thm-gsupdelta}) for some integer $l_i \geq 0$. However
by Proposition~\ref{prop-order-li-ki}
$\frac{G_{\Delta_i}}{\Gof{\Delta_i/\Delta_{i-1}}} = \Gal{L_i/K_i}$. It
follows that any prime factor of $\# G$ is a prime factor of
$[L_i:K_i]$ for some $1 \leq i \leq m$.  Therefore the set of primes
dividing $\#G$ is exactly the set $\{ p | p \textrm{ prime and }
\exists \ 1 \leq i \leq m \ p \textrm{ divides } [L_i:K_i] \}$. If the
Galois group $G$ is in $\Gamma_d$, in time polynomial in $\size{f}$
and $n^d$ we can compute the fields $L_i$ and $K_i$.  As a result we
have the following theorem.

\begin{theorem}\label{thm-gammad-primes}%
  Given $f(X) \in \mathbb{Q}[X]$ with Galois group in $\Gamma_d$ there
  is an algorithm running in time polynomial in $\size{f}$ and $n^d$
  that computes all the prime factors of $\# \Gal{f}$.
\end{theorem}

\section{Discussion}

We saw that even though computing the Galois group of a polynomial is
hard, certain properties of Galois groups can be efficiently tested.
Landau and Miller showed that solvability is one such property.  We
have added nilpotence testing and $\Gamma_d$ testing to this list.  A
group being solvable is in some sense a ``local property''. The
solvability of a group $G$ can be established by looking at the
composition series of $G$. The composition series considered for $G$
was $G = G^{\Delta_m} \rhd \ldots \rhd G^{\Delta_0} = 1$ for a maximal
chain of $G$-blocks $\{ \alpha \} = \Delta_0 \subset \ldots \subset
\Delta_m = \Omega$. The two-way Galois correspondence of
Theorem~\ref{thm-twoway-galois} and Theorem~\ref{thm-gsupdelta}
ensured that it was sufficient to compute the fields $\{
\mathbb{Q}_{\Delta_i}\}_{0 \leq i \leq m}$, to infer the solvability
of $G^{\Delta_i}/G^{\Delta_{i-1}}$ and hence $G$.  Nilpotence testing
cannot be inferred from the composition series. However
Theorem~\ref{thm-nilpotent-main-theorem} together with
Theorem~\ref{thm-twoway-galois} ensured that the nilpotence of $G$ can
be tested once the tower of fields $\{\mathbb{Q}_{\Delta_i} \}_{0 \leq
  i \leq m}$ for a suitable maximal chain of $G$-blocks $\{ \alpha \}
= \Delta_0 \subset \ldots \subset \Delta_m$ is computed. In this
context an interesting open problem is to test whether the Galois
group of a polynomial is supersolvable.  A group $G$ is
\emph{supersolvable}\index{supersolvable group} if there is a
\emph{normal series} $G = G_0 \rhd \ldots\rhd G_t = 1$ such that each
of the quotient group $G_i/G_{i+1}$ is cyclic. (see Chapter 10 of
Hall's book~\cite{hall}).  Super solvable groups are a proper subclass
of solvable groups and contain nilpotent groups.  However, it is not
clear whether the Landau-Miller solvability test or our nilpotence
test can be adapted to an efficient supersolvability test.  Even
conditional results, for example assuming the generalised Riemann
hypothesis, would be interesting.

What about nilpotence and $\Gamma_d$ testing $\Gal{f}$ for polynomials
$f(X)$ over a number field $K$? It is not difficult to see that our
algorithms can be generalised. This is because our test require only
certain basic algorithms like factoring of univariate polynomials and
gcd computations and efficient algorithms for these basic tasks over
arbitrary number field are known.

\chapter{Chebotarev density theorem and Order
  finding}\label{chap-order-finding}

In this chapter we study the problem of finding the order of the
Galois group of a degree $n$ polynomial $f(X) \in
\mathbb{Q}[X]$~\cite{arvind2003galois}. There is a polynomial time
Turing reduction from computing the order to computing the Galois
group because given a permutation group $G \leq S_n$ via its
generators, the order of $G$ can be computed in time polynomial in $n$
(Theorem~\ref{thm-schreiersims}).  In this chapter we show some
conditional results. Assuming the generalised Riemann hypothesis we
show better upper bounds for computing the order than the direct
exponential time algorithm that follows from Landau's algorithm
(Theorem~\ref{thm-landau-galois}).

Assuming the generalised Riemann hypothesis, we prove that there is a
polynomial time deterministic algorithm that makes one query to a $\#
\mathrm{P}$ oracle to compute the order of the Galois group $\Gal{f}$
In particular, this shows that the order can be computed in PSPACE,
which was not known before. Recall that computing the Galois group of
a polynomial is not known to be in $\mathrm{PSPACE}$ as nothing better
than the $\mathrm{EXP}$ upper bound is known. From the above result,
by an application of Stockmeyer's result on approximating $\#
\mathrm{P}$ functions, we prove that there is a randomised algorithm
with an $\mathrm{NP}$ oracle to approximate the order of the Galois
group of $f(X)$.

Our next result is on computing the order of polynomials with Galois
group in $\Gamma_d$.  We give a polynomial time reduction from exact
computation to approximate computation of order of $\Gal{f}$ for
polynomials $f(X)$ with Galois group in $\Gamma_d$. Therefore assuming
the generalised Riemann hypothesis, there is a randomised algorithm
with $\mathrm{NP}$-oracle for computing the order of $\Gal{f}$ exactly
for polynomials $f(X)$ with Galois group in $\Gamma_d$.

We can assume that the given polynomial $f(X)$ is a monic polynomial
over $\mathbb{Z}$. Otherwise by clearing denominator we can assume
that $f(X) = a_0 + \ldots + a_n X^n$, $a_i \in \mathbb{Z}$. Consider
the polynomial $g(X) = a_0a_n^n + \ldots + a_i a_n^{n-i} X + \ldots +
X^n$. Clearly $g(X)$ is a monic polynomial over $\mathbb{Z}$. Moreover
$g(a_n X) = a_n^n f(X)$. Hence every root of $g(X)$ is of the form
$a_n \alpha$ where $\alpha$ is a root of $f(X)$. Therefore
$\mathbb{Q}_g = \mathbb{Q}_f$. Give $f(X)$ we can compute $g(X)$ in
polynomial time and hence from now on, with out loss of generality, we
will assume that the input polynomial $f(X)$ is a monic polynomial of
$\mathbb{Z}$.

The main idea underlying these results is the following: For a
positive integer $x$ let $S^f(x)$ denote the number of primes $p \leq
x$ such that $f(X)\ (\textrm{mod } p)$ splits completely over
$\mathbb{F}_p$.  It follows from the Chebotarev density theorem, which
we describe in Section~\ref{sect-chebotarev-density}, that $S^f(x)$ is
asymptotically $\frac{x}{\# G\ln{x}}$. Thus for large enough $x$,
$\#G$ is close to $\frac{x}{S^f(x) \ln{x}}$. We prove that the
function $x \mapsto S^f(x)$ is a $\# \mathrm{P}$ function.  The
polynomial time algorithm makes a query to and $\# \mathrm{P}$ oracle
and computes $S^f(x)$. The effective version of Chebotarev density
theorem guarantees that the order $\# G$ is then the nearest integer
to $\frac{x}{S^f(x) \ln{x}}$ .  We now describe the Chebotarev density
theorem which plays a crucial role in our complexity theoretic
results.

\section{Chebotarev density theorem}\label{sect-chebotarev-density}

\index{Chebotarev's theorem|(}

Let $K$ be any number field and $L/K$ be an extension of $K$. Recall
that the ring of integers of $L$, $\Int[L]$, is a Dedekind domain and
ideals of $\Int[L]$ has the unique factorisation property.  Let
$\Ideal{p}$ be a prime ideal of $\Int[K]$. The ideal $\Ideal{p}
\Int[L]$, which will also be denoted by $\Ideal{p}$, need not be a
prime ideal of $\Int[L]$. Let $\Ideal{p}$ factorise as $\Ideal{p} =
\Ideal{P}_1^{e_1} \ldots \Ideal{P}_g^{e_g}$ over $\Int[L]$.  If $L/K$
is a Galois extension then all the exponent $e_i$ are the same, i.e.
$e_1 = \ldots = e_g = e$. A prime ideal $\Ideal{p}$ of $\Int[K]$ is
\emph{ramified}\index{ramified prime} over the extension $L/K$ if $e>1$
and \emph{unramified} otherwise.

We now consider Galois extensions $L/K$. Let $G$ be the Galois group
of $L/K$. Consider a prime $\Ideal{p}$ of $\Int[K]$ that is unramified
in $L$. Let $\Ideal{P}$ be any prime ideal of $\Int[L]$ that divides
$\Ideal{p}$. Since $\Int[L]$ and $\Int[K]$ are Dedekind domains it
follows that $\Int[L]/\Ideal{P}$ and $\Int[K]/\Ideal{p}$ are finite
fields of cardinality $\Norm{\Ideal{P}}$ and $\Norm{\Ideal{p}}$
respectively. Furthermore the field $\Int[L]/\Ideal{P}$ is an
extension of $\Int[K]/\Ideal{p}$ and the corresponding Frobenius
element is given by $\alpha (\textrm{mod } \Ideal{P}) \mapsto
\alpha^{N(\Ideal{p})} (\textrm{mod } \Ideal{P})$.  For $\Ideal{P} \mid
\Ideal{p}$ there is an element $\Frob{L/K}{\Ideal{P}}$ of $\Gal{L/K}$
such that
\[
\Frob{L/K}{\Ideal{P}} \alpha = \alpha^{N(\Ideal{p})}\ (\textrm{mod }
\Ideal{P}),
\]
for all $\alpha$ in $\Int[L]$. This element is called the
\emph{Frobenius}\index{Frobenius} element associated with $\Ideal{P}$
as its action modulo $\Ideal{P}$ matches with the Frobenius element of
the finite field extension
$\frac{\Int[L]}{\Ideal{P}}/\frac{\Int[K]}{\Ideal{p}}$.

Let $\Ideal{P}_1, \ldots, \Ideal{P}_g$ be the primes of $\Int[L]$ that
divide $\Ideal{p}$. The Galois group $\Gal{L/K}$ fixes the ideal
$\Ideal{p}$ and act transitively on the set $\{ \Ideal{P}_1, \ldots,
\Ideal{P}_g \}$.  In particular, if $\sigma\in\Gal{L/K}$ maps
$\Ideal{P_1}$ to $\Ideal{P_2}$ then $\Frob{L/K}{\Ideal{P_2}} = \sigma
\Frob{L/K}{\Ideal{P_1}} \sigma^{-1}$.  Thus $\Frob{L/K}{\Ideal{P_i}}$
are all conjugates in $\Gal{L/K}$ and the subset
$\Artin{L/K}{\Ideal{p}}$ of $\Gal{L/K}$ defined by
\[
\Artin{L/K}{\Ideal{p}} = \left\{ \Frob{L/K}{\Ideal{P}} : \Ideal{P} |
  \Ideal{p}\right\}
\]
is a conjugacy class of $\Gal{L/K}$. Let $C$ be any conjugacy class of
$G$ and let $\pi_C(x)$ denote the function
\[
\pi_C(x) = \# \left\{ \Ideal{p} : \Artin{L}{\Ideal{p}} = C
    \textrm{ and } N(\Ideal{p}) \leq x\right\} .
\]

A remarkable result on the asymptotic value of $\pi_C(x)$ is the
\emph{Chebotarev density theorem} which states that $\pi_C(x) \sim
\frac{\# C}{\# G} \frac{x}{\ln x}$. To apply this result in a
complexity-theoretic setting we need the following effective version
of the Chebotarev density theorem due to Lagarias and Odlyzko proved
assuming the generalised Riemann Hypothesis
\cite{lagarias:1977:effective}.

\begin{theorem}[Lagarias and Odlyzko]\label{thm-effective-cheb}
Let $L/K$ be a Galois extension and $C$ be any conjugacy class of
$\Gal{L/K}$. Assuming the generalised Riemann hypothesis we have the following bound for
$\pi_C(x)$:
\[
\left| \pi_C(x) - \frac{\# C}{\# G} \frac{x}{\ln x} \right| \leq
O\left(\sqrt{x} .\ln{x}.\ln {d_L} + \# C \sqrt{x}\right).
\]
\end{theorem}

An unramified prime ideal $\Ideal{p}$ of $K$ is said to be
\emph{completely split} if the number of prime ideals $\Ideal{P}$ of
$L$ that divide $\Ideal{p}$ is $[L:K]$. In this case
$\Artin{L}{\Ideal{p}}$ is the singleton conjugacy class containing the
identity element. The number of completely split primes $\Ideal{p}$
such that $\Norm{\Ideal{p}} \leq x$ is denoted by $\pi_1(x)$. A direct
consequence of Theorem~\ref{thm-effective-cheb} is the following.

\begin{proposition}\label{prop-splitprime}
  Assuming the generalised Riemann Hypothesis we have
  \[
  \left| \pi_1(x) - \frac{1}{\# G} \frac{x}{\ln x} \right | \leq
  O\left(\sqrt{x}.\ln{x}.\ln {d_L}\right).
  \]
\end{proposition}

We are given a monic polynomial $f(X)$ over $\mathbb{Z}$. For an
integer $x$, using the Chebotarev density theorem, we estimate the
number of primes $p \leq x$ for which $f(X)\ (\textrm{mod } p)$ splits
completely over $\mathbb{F}_p$.

\begin{theorem}\label{thm-sfx}
  Given a monic polynomial $f(X)$ over $\mathbb{Z}$ with Galois group
  $G$ let $S^f(x)$ denote the number of primes $p \leq x$ such that
  $f(X)\ (\textrm{mod } p)$ splits completely over $\mathbb{F}_p$.
  Assuming generalised Riemann hypothesis we have
  \[
  \left| S^f(x) - \frac{1}{\# G} \frac{x}{\ln{x}} \right| \leq
  O\left(\sqrt{x}. \ln{x} .(n!)^3. \size{f}\right).
  \]
\end{theorem}
\begin{proof}
  Let $\mathcal{S}^f(x)$ denote the set of all primes $p$ such that
  $f(X)\ (\textrm{mod } p)$ splits completely over $\mathbb{F}_p$.
  Then $S^f(x) = \# \mathcal{S}^f(x)$. Let $L$ be the splitting field
  $\mathbb{Q}_f$.  Roots of $f(X)$ are algebraic integers and hence
  are contained in $\Int[L]$. Consider any prime $\Ideal{p}$ of
  $\Int[L]$ and let $p$ be the prime in $\mathbb{Z}$ such that
  $\Ideal{p} \cap \mathbb{Z} = p \mathbb{Z}$. Then for any root
  $\alpha \in \Int[L]$ of $f(X)$, $\alpha\ (\textrm{mod }\Ideal{p})$
  is a root of $f(X)\ (\textrm{mod } p)$ in the finite field
  $\Int[L]/\Ideal{p}$. Therefore $\Int[L]/\Ideal{p}$ is the splitting
  field of $f(X)\ (\textrm{mod } p)$. If $p$ is unramified and splits
  completely over $L$ then $\Int[L]/\Ideal{p} = \mathbb{F}_p$ for all
  $\Ideal{p} \mid p$ and hence $f(X)$ splits completely over
  $\mathbb{F}_p$. Therefore all unramified primes $p \leq x$ that
  split completely over $L/\mathbb{Q}$ are contained in the set
  $\mathcal{S}^f(x)$.

  We now prove that the number of primes $p$ in $\mathcal{S}^f(x)$
  that are not completely split are $\leq (n!)^3.\size{f}$.  Let
  $\alpha_1,\ldots,\alpha_n$ denote the roots of $f(X)$. Then there
  exists an algebraic integer $\theta = \sum c_i \alpha_i$ such that
  $\theta$ is a primitive element of $L$ and $\lg{d_\theta} \leq
  (n!)^3 \size{f}$ (Theorem~\ref{thm-bound-dtheta}). Let
  $\mu_\theta(X)$ be the minimal polynomial of $\theta$. Since $\theta
  = \sum c_i \alpha_i$, for any $p$ if $f(X)$ splits completely over
  $\mathbb{F}_p$ then so does $\mu_\theta(X)$.  If in addition $p$
  does not divide the discriminant $d_\theta$ then $\mu_\theta(X)$
  splits completely into distinct linear terms.  It follows from the
  Kummer-Dedekind theorem (Theorem~\ref{thm-kummer}) that $p$ is
  unramified and splits completely over $L/\mathbb{Q}$. Therefore the
  primes $p \in \mathcal{S}^f(x)$ that are not completely split divide
  the discriminant $d_\theta$.  The number of primes that divide
  $d_\theta$ is bounded by $\lg{d_\theta} \leq (n!)^3.\size{f}$
  (Theorem~\ref{thm-bound-dtheta}). Hence the number of primes in
  $\mathcal{S}^f(x)$ that are not completely split over $L/\mathbb{Q}$
  is less that $(n!)^3.\size{f}$

  We have thus proved that $\pi_1(x) \leq \# \mathcal{S}^f(x) = S^f(x)
  \leq \pi_1(x) + \lg{d_\theta}$. Also $d_L \leq d_\theta$. Thus
  \begin{eqnarray*}
    \left| S^f(x) - \frac{1}{\# G}\frac{x}{\ln{x}} \right| &\leq& \left|
      S^f(x) - \pi_1(x) \right| + \left|\pi_1(x) - \frac{1}{\#
        G}\frac{x}{\ln{x}} \right|\\
    & \leq&  O\left( \sqrt{x} .\ln{x}.
      (n!)^3. \size{f}\right) \textrm{ (Proposition~\ref{prop-splitprime})}.
  \end{eqnarray*}
\end{proof}
\index{Chebotarev's theorem|)}%

\section{Computing the order of the Galois group}

In this section we prove our first result on order computation. We are
given a monic polynomial $f(X)$ over $\mathbb{Z}$. As in the previous
section let $S^f(x)$ denote the number primes $p \leq x$ such that
$f(X)$ splits completely over $\mathbb{F}_p$.

% In Theorem~\ref{thm-sfx} we proved assuming generalised Riemann
% hypothesis that $\left|S^f(x) - \frac{1}{\# G}\frac{x}{\ln
%     x}\right\vert$ is bounded by
% $O((n!)^3.\sqrt{x}.\ln{x}.\size{f})$.

\begin{proposition}\label{prop-hashg-approx}
  Assuming generalised Riemann hypothesis there exists a constant $c$
  such that for $x \geq c. (n!)^{10} \size{f}^{2k}$
  \[
  \left| \# G - \frac{1}{S^f(x)} \frac{x}{\ln {x}} \right| \leq
  \frac{1}{n!.\size{f}^{k-1}}.
  \]
  Therefore if $x \geq c (n!)^{10} \size{f}^2$ and $n \geq 2$, the
  integer closest to $\frac{1}{S^f(x)} \frac{x}{\ln {x}}$ is $\# G$.
\end{proposition}
\begin{proof}
  Let $N(x) = \frac{1}{S^f(x)}\frac{x}{\ln{x}}$. From
  Theorem~\ref{thm-sfx} we have
  \[ (1 - \varepsilon(x)) \frac{1}{\# G}\frac{x}{\ln{x}} \leq S^f(x)
  \leq (1 + \varepsilon(x)) \frac{1}{\# G}\frac{x}{\ln{x}} \] where
  $\varepsilon(x)$ is
  $O\left(\frac{\ln^2{x}.n!^3.\size{f}}{\sqrt{x}}\right)$. Therefore
  $(1 - \varepsilon(x))N(x) \leq \# G \leq (1 + \varepsilon(x)) N(x)$.
  It follows that $N(x) \leq \frac{\#G}{1 - \varepsilon(x)} \leq
  \frac{n!}{1 - \varepsilon(x)}$. For $x = \Omega(n!^{6}.\size{f}^2)$,
  $\frac{1}{1 - \varepsilon(x)} \leq 1 + 2 \varepsilon(x)$.  Therefore
  \[
  \left|\# G - \frac{1}{S^f(x)}\frac{x}{\ln{x}} \right| = \left|\# G -
    N(x) \right| \leq n!\varepsilon(x)(1 + 2\varepsilon(x)).
  \]
  There is a constant $c$ such that for $x \geq
  c.n!^{10}\size{f}^{2k}$, $\varepsilon(x) \leq
  \frac{1}{4n!^2.\size{f}^{k-1}}$. It follows that for $x \geq
  c.n!^{10}\size{f}^{2k}$, $\left|\# G -
    \frac{1}{S^f(x)}\frac{x}{\ln{x}} \right|$ is bounded by
  $\frac{1}{n!.\size{f}^{k-1}}$.
\end{proof}

%\footnote{The $\mathrm{NP}$ machine actually guesses a
%  number $p \leq x$ and checks whether $p$ is prime. The AKS
%  algorithm~\cite{agrawal2004primes} may be used but recall that
%  PRIMES were already known to be in $\mathrm{NP}$~\cite{}.}

Consider the machine $M$ that on input $\langle f(X) , x \rangle$
guesses a prime $p \leq x$ and checks whether $f(X)$ splits over
$\mathbb{F}_p$. Since in time polynomial in $\size{f}$ and $\size{p}$
one can verify whether $f(X)$ completely splits over $\mathbb{F}_p$
(Theorem~\ref{thm-degree-sequence}), $M$ is an $\mathrm{NP}$ machine.
The function $S^f(x)$ is the number of accepting paths of $M$ on input
$\langle f(X),x\rangle$ and therefore is in $\# \mathrm{P}$.

\begin{proposition}\label{prop-numP}
  The function $\langle f , x \rangle \mapsto S^f(x)$ is in $\#
  \mathrm{P}$.
\end{proposition}

We now give the $\mathrm{FP}^{\# \mathrm{P}}$ machine $M$ to compute
the order of the Galois group. Given the polynomial $f(X)$ the machine
$M$ makes a single query to the $\# \mathrm{P}$ function of
Proposition~\ref{prop-numP} and computes $S^f(x)$ for $x = c.
(n!)^{10}. \size{f}^2$, where $c$ is the constant of
Proposition~\ref{prop-hashg-approx}.  Having computed $S^f(x)$ the
machine $M$ in polynomial time finds the integer $N$ closest to
$\frac{1}{S^f(x)}\frac{x}{\ln{x}}$. It follows from
Proposition~\ref{prop-hashg-approx} that $N$ is the order of
$\Gal{f}$.  Thus we have the following theorem.

\begin{theorem}\label{thm-order-finding}
  Given a polynomial $f(X)$ over $\mathbb{Q}$, assuming the
  generalised Riemann hypothesis there is a polynomial time
  deterministic algorithm with a $\# \mathrm{P}$ oracle that computes
  the order of $\Gal{\mathbb{Q}_f/\mathbb{Q}}$.
\end{theorem}

For an arbitrary function in $\# \mathrm{P}$, Stockmeyer proved the
following theorem \cite{stockmeyer85approximating}.

\begin{theorem}[Stockmeyer]\label{thm-stockmeyer}
  For every function $F$ in $\# \mathrm{P}$ and any fixed constant $c$
  there is a randomised polynomial time algorithm with $\mathrm{NP}$
  oracle that on input string $x$ of length $n$ computes a value $N_x$
  such that
  \[
  \left( 1 - \frac{1}{n^c}\right) N_x \leq F(x) \leq \left( 1 +
    \frac{1}{n^c}\right) N_x.
  \]
\end{theorem}

Using the above theorem we show that there is a randomised polynomial
time algorithm with $\mathrm{NP}$ oracle to approximate the order of
the Galois group.

\begin{theorem}\label{thm-order-approximating}
  Given a polynomial $f(X)$ over $\mathbb{Q}$ there is a randomised
  algorithm with an $\mathrm{NP}$ oracle that runs in time polynomial
  in $\size{f}$ and approximates the order of the Galois group of $f$
  with a error of at most $\frac{1}{\size{f}^{O(1)}}$.
\end{theorem}
\begin{proof}
  Since $S^f(x)$ is in $\# \mathrm{P}$, using the randomised procedure
  of Theorem~\ref{thm-stockmeyer}, for any constant $k$, we can
  compute a $\frac{1}{\size{f}^k}$-approximation $\tilde{S}^f(x)$ of
  $S^f(x)$, i.e. compute $\tilde{S}^f(x)$ such that $(1 -
  \varepsilon)\tilde{S}^f(x) \leq S^f(x) \leq (1 + \varepsilon
  )\tilde{S}^f(x)$ where $\varepsilon = \frac{1}{\size{f}^k}$.
  Therefore we have
  \[
  \frac{1 - \varepsilon}{S^f(x)} \leq \frac{1}{\tilde{S}^f(x)}
  \leq \frac{1 + \varepsilon}{S^f(x)}.
  \]
  By Proposition~\ref{prop-hashg-approx} there is a constant $c$ such
  that for $x \geq c. n!^{10}\size{f}^{2(k+1)}$
  $\left|\frac{1}{S^f(x)}\frac{x}{\ln{x}} - \# G\right|$ is bounded by
  $\frac{1}{n!.\size{f}^k}$. Choosing $x = c.
  n!^{10}\size{f}^{2(k+1)}$ we have
  \begin{equation}
    \left.
      \begin{array}{ccc}
        \left| \frac{1}{\tilde{S}^f(x)}\frac{x}{\ln{x}} - \# G \right| &\leq&
        \left|\frac{1}{S^f(x)}\frac{x}{\ln{x}} - \# G\right| + \varepsilon.
        \frac{1}{S^f(x)}\frac{x}{\ln{x}}\\
        &\leq& \frac{2}{n!.\size{f}^k} + \#G \frac{1}{\size{f}^k} \\
        &\leq& \#G \frac{2}{\size{f}^k}.
      \end{array}
    \right\}
    \label{ineq-approx-Sfx}
  \end{equation}
  The above inequality proves that the integer closest to
  $\frac{1}{\tilde{S}^f(x)}\frac{x}{\ln{x}}$ is a
  $\frac{2}{\size{f}^k}$-approximation of $\# G$.

  We now give the randomised algorithm with NP-oracle to compute an
  $\frac{1}{\size{f}^k}$ approximation of $\#G$.  For $x =
  c.n!^{10}\size{f}^{2(k+1)}$, using Theorem~\ref{thm-stockmeyer}, the
  algorithm first computes the approximation $\tilde{S}^f(x)$ of the
  $\# \mathrm{P}$ function $S^f(x)$. Then compute the integer $N$
  closest to $\frac{1}{\tilde{S}^f(x)}\frac{x}{\ln{x}}$.  It follows
  from inequality~\ref{ineq-approx-Sfx} that $N$ is a
  $\frac{2}{\size{f}^k}$-approximation of $\#G$.
\end{proof}
\section{Computing the order of Galois groups in $\Gamma_d$}

Given a polynomial $f(X)$ over $\mathbb{Q}$ with
$\Gal{\mathbb{Q}_f/\mathbb{Q}}$ in $\Gamma_d$, in this section we show
that $\#\Gal{\mathbb{Q}_f/\mathbb{Q}}$ can be computed by a randomised
polynomial-time algorithm with access to an $\mathrm{NP}$ oracle.  The
algorithm can be seen as a polynomial time Turing reduction from exact
order finding to approximate order finding. The result then follows
from Theorem~\ref{thm-order-approximating}.

First we state an important Lemma from Lang's book~\cite[Chapter VI,
Theorem 1.12]{lang:algebra}.

\begin{lemma}\label{lem-lang}
  Let $L/M$ be a Galois extension and let $N$ be any field that
  contains $M$. Then $LN/N$ is Galois and $\Gal{LN/N} \cong \Gal{L/L
    \cap N}$. Moreover the map that sends $\tau \in \Gal{LN/N}$ to its
  restriction on $L$ is an isomorphism between the Galois groups
  $\Gal{LN/N}$ and $\Gal{L/L \cap N}$.
\end{lemma}
\[
\xymatrix{ & & & LN \\ L \ar@{.}[urrr]& & & & N \ar@{-}[ul]\\ & L \cap
  N \ar@{.}[urrr] \ar@{-}[ul]\\ M \ar@{-}[uu] \ar@{.}[uurrrr]
  \ar@{-}[ur]\\ }
\]

Using Lemma~\ref{lem-lang} we prove the following theorem on simple
Galois extensions, i.e. Galois extensions $L/K$ such that $\Gal{L/K}$
is simple.

\begin{theorem}\label{thm-power-simple-extension}
  Let $L/M/N$ be finite extensions such that $L/M$ is a simple Galois
  extension. Let $E$ be a finite Galois extension of $N$ containing
  $M$ and let $K$ be the normal closure of $EL$ over $N$. Then $[K:E]
  = [L:M]^l$ for some integer $l \geq 0$.
\end{theorem}
\begin{proof}
  Let $L_1,\ldots,L_r$ be the conjugate fields of $L$ over $N$. Fix
  $r$ automorphisms $\{ \sigma_i \}_{1\leq i\leq r}$ of
  $\Gal{\overline{N}/N}$ such that $L_i = \sigma_i(L)$ and let $M_i =
  \sigma_i(M)$.

  First we prove that the Galois group $\Gal{K/E}$ embeds into the
  product group $\prod_{i=1}^r \Gal{L_i/M_i}$.  Let $G_i$ be the
  Galois group $\Gal{L_i/M_i}$. For any $\tau \in \Gal{K/E}$ let
  $\tau_i$ denote the element of $G_i$ obtained by restricting the
  action of $\tau$ on $L_i$. The homomorphism $\psi$ that maps $\tau$
  to $\langle \tau_1,\ldots,\tau_r \rangle$ is an embedding from
  $\Gal{K/E}$ to $\prod_{i=1}^r G_i$. This is because $K$ is the field
  $EL_1\ldots L_r$ and hence for any $\tau \in \Gal{K/E}$ if $\tau_i$
  fixes $L_i$ for all $1 \leq i \leq r$ then it fixes $K$ as well.

  Having proved that $\Gal{K/E}$ embeds into the product group
  $\prod G_i$ we now prove that the degree $[K:E]$ is a power of
  $[L:M]$.  We dispose of the case when $E$ contains one of the fields
  $L_i$.  Since $E$ is Galois over $N$, if $E$ contains $L_i$, it
  contains all the other conjugate fields $L_j$ and hence $K = E$.
  Therefore when $E$ contains one of the $L_i$, $[K:E] = 1 = [L:M]^0$.

  We now consider the case when $E$ contains none of the fields
  $L_1,\ldots,L_r$.  We prove that in this case the projection map
  $\tau \mapsto \tau_i$ from $\Gal{K/E}$ to $G_i$ is onto.  It is
  sufficient to show that for all $\sigma \in G_i = \Gal{L_i/M_i}$
  there is an automorphism $\tau$ in $\Gal{K/E}$ such that $\tau_i =
  \sigma$, $1 \leq i \leq r$.

  Since $K/E$ is Galois, every element $\tau \in \Gal{EL_i/E}$ can be
  extended to an element $\tilde{\tau} \in \Gal{K/E}$ such that
  $\tilde{\tau}$ restricted to $EL_i$ is $\tau$ (\cite[Theorem 2.8,
  Chapter V]{lang:algebra}). Therefore, it is sufficient to prove that
  for any element $\sigma \in \Gal{L_i/M_i}$ there is an element
  $\tau_i \in \Gal{EL_i/E}$ such that $\tau_i$ restricted to $L_i$ is
  $\sigma$.

  Consider the extension $EL_i/E$. Since $E$ is Galois and contains
  $M$, $E \supseteq M_i$.  By Lemma~\ref{lem-lang}, $\Gal{EL_i/E}$ is
  isomorphic to $\Gal{L_i/L_i \cap E}$ via the map that send an
  automorphism $\Gal{EL_i/E}$ to its restriction on $L_i$. The
  extensions $L_i/M_i$ and $E/M_i$ are Galois and hence $ L_i\cap
  E/M_i$ is also Galois.  Therefore $\Gal{L_i/L_i\cap E}$ is a normal
  subgroup of $\Gal{L_i/M_i}$ (Theorem~\ref{thm-funda-galois}).  But
  $\Gal{L_i/M_i}$ is simple and $L_i \cap E \neq L_i$. Therefore $L_i
  \cap E = M_i$ and hence $\Gal{EL_i/E} \cong \Gal{L_i/M_i}$.

  For any $\sigma \in \Gal{L_i/M_i}$, there is an element $\sigma_i$
  in $\Gal{EL_i/E}$ such that $\sigma_i$ restricted to $L_i$ is
  $\sigma$. Let $\tau \in \Gal{K/E}$ be any automorphism such that
  $\tau$ restricted to $EL_i$ is $\sigma_i$.  Then $\tau_i = \sigma$.
  As a result we have $\Gal{K/E}$ embeds \emph{onto} the product group
  $\prod_{i=1}^r \Gal{L_i/M_i}$ via the map $\tau \mapsto \tau_i$.

  If $L_i/M_i$ is a simple abelian extension then $\Gal{L_i/M_i} \cong
  \mathbb{F}_p$ and therefore $\Gal{K/E}$ is isomorphic to a vector
  space over $\mathbb{F}_p$.  Hence $[K:E] = \# \Gal{K/E} = p^l =
  [L:M]^l$ for some $l$.  Otherwise if $L_i/M_i$ is a nonabelian
  simple extension then using Scott's Lemma (Lemma~\ref{lem-scott}),
  $\Gal{K/E}$ is a product of diagonal subgroups of $\Gal{L_i/M_i}$
  and hence $[K:E] = [L:M]^l$.
\end{proof}

Given a polynomial $f(X)$ over $\mathbb{Q}$ of degree $n$. If the
Galois group of $f$ is in $\Gamma_d$ then we show that the order of
the Galois group of $f$ can be computed by a randomised algorithm with
an $\mathrm{NP}$ oracle. We first give a sketch of the algorithm here
and defer the detailed description to
Algorithm~\ref{algo-order-finding-gammad}. For simplicity we assume
that $f(X)$ is irreducible. Algorithm~\ref{algo-order-finding-gammad}
handles reducible $f(X)$ as well.

For a number field $K$ we denote the normal closure of $K$ over
$\mathbb{Q}$ by $\tilde{K}$. Let $G$ be the Galois group of $f(X)$
thought of as a permutation group over $\Omega$ the set of roots of
$f(X)$.  For a $G$-block $\Delta$ recall that $\mathbb{Q}_\Delta$
denotes the fixed field $\Fix{\mathbb{Q}_f}{G_\Delta}$. Using
Theorem~\ref{thm-enlarge-block} repeatedly we can compute the number
fields $K_i = \mathbb{Q}_{\Delta_i}$ for maximal chain of $G$-blocks
$\{\alpha \} = \Delta_0 \subseteq \ldots \subseteq \Delta_m = \Omega$.
Recall that the normal closure $\tilde{K}_m$ and $\tilde{K}_0$ are
respectively $\mathbb{Q}$ and $\mathbb{Q}_f$ and $\# \Gal{f} =
[\mathbb{Q}_f:\mathbb{Q}]$. For $i$ decreasing from $m$ to $0$ we
compute the degree $[\tilde{K}_i : \mathbb{Q}]$ inductively. To begin
with the degree $[\tilde{K}_m : \mathbb{Q}] = 1$. Assuming we have
computed the degree $[\tilde{K}_i : \mathbb{Q}]$ we show how the
degree $[\tilde{K}_{i-1} :\mathbb{Q}]$ can be computed.  Let $L_i$
denote the normal closure of $K_{i-1}$ over $K_i$. Recall that
$\tilde{L}_i = \tilde{K}_{i-1}$ and hence it is sufficient to compute
the degree $[\tilde{L}_i : \mathbb{Q}]$. Recall that $L_i/K_i$ is a
Galois extension with small ($\leq O(n^d)$) Galois group
(Proposition~\ref{prop-order-li-ki}). Hence we can compute the Galois
group $H = \Gal{L_i/K_i}$ using Landau's algorithm. Furthermore in
time polynomial in $n^d$ we compute a composition series $H = H_0 \rhd
\ldots \rhd H_t = 1$ for $H$ where each of the quotient group
$H_i/H_{i+1}$ is simple.  Let $F_i$ denote the fixed field
$\Fix{L_i}{H_i}$. Consider the tower of extensions $\tilde{K}_i =
\tilde{F}_0 \subseteq \ldots \subseteq \tilde{F}_t = \tilde{K}_{i-1}$.
We have the following proposition

\begin{proposition}\label{prop-fj}
  The extension $F_{j+1}/F_j$ is a simple Galois extension and the
  degree $[\tilde{F}_{j+1}: \tilde{F}_j]$ is a power of the degree
  $[F_{j+1}:F_j]$.
\end{proposition}
\begin{proof}
  The group $H_{j+1}$ is a normal subgroup of $H_j$ such that
  $H_j/H_{j+1}$ is simple. Hence by fundamental theorem of Galois
  theory, the extension $F_{j+1}/F_j$ is a simple Galois extension.
  Using Theorem~\ref{thm-power-simple-extension} for the field
  extensions $F_{j+1}/F_j/\mathbb{Q}$, the degree $[\tilde{F}_{j+1}:
  \tilde{F}_j]$ is a power of the degree $[F_{j+1}: F_j]$.
\end{proof}

We compute the degree $[\tilde{F}_j : \mathbb{Q}]$ inductively for
increasing $j$. To begin with $[\tilde{F}_0 :\mathbb{Q}] =
[\tilde{K}_i:\mathbb{Q}]$ which we have already computed. Assume that
we already know the degree $[\tilde{F}_j :\tilde{K}_i]$. We can
compute a primitive polynomial $h(X)$ of $F_{j+1}$ over $\mathbb{Q}$
in time polynomial in $\size{f}$ and $n^d$. Using
Theorem~\ref{thm-order-approximating} for a suitable small
$\varepsilon$ (say $\varepsilon = 0.1$) we compute an approximation
$A$ of the degree $[\tilde{F}_{j+1}: \mathbb{Q}]$ such that $(1 -
\varepsilon) A \leq [\tilde{F}_{j+1} : \mathbb{Q}] \leq (1 +
\varepsilon) A$. We have already computed the degrees
$[\tilde{F}_j:\tilde{K}_i]$ and $[\tilde{K}_i:\mathbb{Q}]$ and
therefore can compute $[\tilde{F}_i : \mathbb{Q}] =
[\tilde{F}_j:\tilde{K}_i][\tilde{K}_i:\mathbb{Q}]$. Therefore $A' =
\frac{A}{[\tilde{F}_j:\mathbb{Q}]}$ gives an
$\varepsilon$-approximation of $[\tilde{F}_{j+1}:\tilde{F}_j]$.

Let $r$ denote the degree $[F_{j+1}:F_j]$ which we have already
computed.  Then by Proposition~\ref{prop-fj},
$[\tilde{F}_{j+1}:\tilde{F}_j]$ is a power of $r$. Let $r^l$ be the
power of $r$ that is closest to $A'$. Since $A'$ is an
$\varepsilon$-approximation of $[\tilde{F}_{j+1}:\tilde{F}_j]$, if
$\varepsilon < 0.1$ then $[\tilde{F}_{j+1}:\tilde{F}_j] = r^l$.

Having computed $A'$, $r$ and $[\tilde{F}_j:\mathbb{Q}]$, it is easy
to find $[\tilde{F}_{j+1}:\tilde{F}_j]$ and thus
$[\tilde{F}_{j+1}:\mathbb{Q}]$. This completes our description of the
algorithm. Algorithm~\ref{algo-order-finding-gammad} is a detailed
presentation.

\begin{algorithm}
  \caption{Computing  order of Galois group in $\Gamma_d$.}
  \label{algo-order-finding-gammad}
  \KwIn{A polynomial $f(X)$.}

  \KwOut{The order of $\Gal{f}$.}

  \lIf{$f(X)$ is a constant polynomial}{\KwRet{$1$}}

  Let $f$ factorise as $gh$ where $g$ is an irreducible polynomial
  over $\mathbb{Q}$.

  Let $G$ be the Galois group $\Gal{\mathbb{Q}_g/\mathbb{Q}}$.

  Using Theorem~\ref{thm-enlarge-block} compute the fields $K_i =
  \mathbb{Q}_{\Delta_i}$ for a maximal chain of $G$-blocks $\{ \alpha
  \} = \Delta_0 \subseteq \ldots \subseteq \Delta_m = \Omega$.

  Recursively compute $N_m = [\mathbb{Q}_h: \mathbb{Q}]$.  $N_i$ will
  denote the degree $[\mathbb{Q}_{h}\tilde{K}_i : \mathbb{Q}]$.

  \For{$i \leftarrow m$ \KwSty{downto} 0} {

    Compute the normal closure $L_i$ of $K_{i-1}$ over $K_i$.

    Compute $H = \Gal{L_i/K_i}$.

    Compute a composition series $H = H_0 \rhd \ldots \rhd H_t$.

    \For{$j \leftarrow 0$ \KwTo $t$}{

      $F_j \leftarrow \Fix{L_i}{H_j}$

      Compute the primitive polynomial $f_j(X)$ of $F_j$

    }

    $M_0 \leftarrow 1$, $M_j$ will be the degree
    $[\mathbb{Q}_h\tilde{F}_j : \mathbb{Q}_h]$.

    \For{$j \leftarrow 1$ \KwTo $t$}{

      \lnl{step-oracle-approx-order}%
      Compute a $0.1$-approximation $A$ of $\# \Gal{hf_j}$.

      Let $r = [F_j: F_{j-1}]$.

      Compute the power $r^l$ closest to $\frac{A}{M_{j-1}N_i}$.

      $M_j \leftarrow M_{j-1}.r^l$.

    }
    $N_{i-1} \leftarrow N_i. M_t$
  }

  \KwRet{$N_0$}.
\end{algorithm}

Algorithm~\ref{algo-order-finding-gammad} can be seen as a polynomial
time Turing reduction from exact order finding to approximate order
finding. The step~\ref{step-oracle-approx-order} can be seen as an
oracle query to a function that gives an approximation of the order of
the Galois group. We thus have the following theorem.

\begin{theorem}\label{thm-order-finding-gammad}
  For polynomials $f(X)$ with Galois group in $\Gamma_d$ there is a
  polynomial time (polynomial in $\size{f}$ and $n^d$) Turing
  reduction from exact order finding to approximate order finding.
  Hence there is a randomised algorithm with an $\mathrm{NP}$-oracle
  to compute the order of $\Gal{f}$ for polynomials $f(X)$ with Galois
  group in $\Gamma_d$.
\end{theorem}

\section{Discussion}

In this section we proved upper bounds on order finding for Galois
group assuming the generalised Riemann hypothesis. We proved that
computing the order of the Galois group of a polynomial $f(X)$ is in
$\mathrm{FP}^{\# \mathrm{P}}$. In addition if the Galois group of
$f(X)$ is in $\Gamma_d$, a fact that can be checked efficiently using
Theorem~\ref{thm-gammad-test}, then the order of $\Gal{f}$ can be
computed within the polynomial hierarchy.  We can prove similar
results for $f(X) \in K[X]$ where $K$ is give via explicit data.

An interesting open problem is to give nontrivial upper bound
unconditionally.  Another interesting problem is to give better upper
bounds for order finding for special polynomials, like for example
polynomials with solvable Galois groups. One way to achieve this is to
give better upper bounds for approximating the order of the Galois
group. Certain $\# \mathrm{P}$-complete functions like $\#
\textrm{{\small DNF}}$ can be approximated efficiently (Chapter 11 of
the book by Motwani and Raghavan~\cite{motwani97randomized} gives a
detailed presentation of such $\# \mathrm{P}$ complete problems). It
would be interesting to know whether the number of completely split
primes less than a given number $x$ can be approximated efficiently in
which case we would have efficient order finding algorithm for
polynomials with Galois group in $\Gamma_d$.

At present computing the Galois group looks harder than computing the
order. It would be interesting to know for example whether the Galois
group can be computed in PSPACE. Even conditional results will be
interesting.  For polynomials with solvable Galois group are there
better upper bounds ?

\chapter{Computing Galois groups}%
\label{chap-galois-special}

In this chapter we give some upper bounds on computing the Galois
group of certain special polynomials. Our first result is a randomised
algorithm to compute the Galois group of polynomials with abelian
Galois group~\cite{arvind2003galois}. This result makes use of the
effective version of the Chebotarev density theorem and hences is
conditional on the validity of the generalised Riemann hypothesis. We
then consider polynomials $f(X)$ that are product of polynomials $\{
f_i\}_{1 \leq i \leq m}$ having the following properties (1)
$\mathbb{Q}_{f_i} = \mathbb{Q}[X]/f_i(X)$ and (2) $\Gal{f_i}$ is
simple and nonabelian.  We show that in this case there is
deterministic algorithm that runs in time polynomial in $\size{f}$ to
compute the Galois group of $f$.  This result is unconditional and
Scott's Lemma plays a crucial role in the proof of this result. In
particular, for this result the assumption that $\Gal{f_i}$ is
nonabelian is crucial as Scott's lemma is not true for abelian simple
groups.

Recall that if $f(X)$ is irreducible and has abelian Galois group then
$\Gal{f}$ can be computed in polynomial time using Landau's algorithm
(Theorem~\ref{thm-landau-abelian-galois}).  However, when $f(X)$ is
reducible with abelian Galois group, the Galois group can be
exponentially large. Hence Landau's algorithm cannot be used directly.
In fact even when the polynomial is a product of quadratic polynomial
nothing better than the exponential time algorithm is known (cf.
Lenstra~\cite{lenstra92algorithm}).

For polynomials $f(X)$ with abelian Galois group we give a polynomial
time almost uniform sampling algorithm for elements of
$\Gal{\mathbb{Q}_f/\mathbb{Q}}$.  It is easy to see that for a group
$G$ a random sample of $O(\lg{G})$ elements from $G$ is a generator
set with high probability.

\section{Computing abelian Galois groups}

Given a polynomial $f(X)$ with abelian Galois group. Our task is to
compute the Galois group $G$ of $f(X)$.  Let $f = f_1,\ldots,f_r$ be
the factorisation of $f$ into irreducible factors.  Let $G_i$ be the
Galois group of $f_i$. Each of the groups $G_i$ can be computed
explicitly using Landau's algorithm. The group $G$ is a subgroup of
the product group $\prod_{i=1}^r G_i$ and projects onto each $G_i$,
i.e. $G$ embeds into the product group $\prod G_i$. Hence any $\sigma
\in G$ can be considered as a tuple $\sigma = \langle \sigma_1,
\ldots, \sigma_r\rangle$ where $\sigma_i \in G_i$.

There are two important properties of abelian extensions that we
require.  Firstly, each conjugacy class of $G$ is a singleton set.
Secondly, by factoring each of the irreducible factors $f_i$ over
$\mathbb{F}_p$ we can recover the Frobenius element associated to $p$
(Proposition~\ref{prop-recover-frob}).

Let $L$ denote the splitting field $\mathbb{Q}_f$.  Recall that for
each prime $p$ we can associate a conjugacy class
$\Artin{L/\mathbb{Q}}{p}$ (see Section~\ref{sect-chebotarev-density}).
Since $G$ is abelian the conjugacy class $\Artin{L/\mathbb{Q}}{p}$ is
a singleton set $\{\sigma_p \}$. We show that for a given $\sigma \in
G$ the probability that $\sigma_p = \sigma$ for a random prime is
close to $\frac{1}{\# G}$. This follows from the Chebotarev density
theorem.  Hence picking primes $p$ at random and recovering the
corresponding Frobenius gives us an almost uniform sampler for
elements of $G$. A polynomial size sample will then generate $G$.

Let $p$ be any prime. To recover the Frobenius $\sigma_p$, we recover
the corresponding Frobenius' $\sigma_{p,i}$ of $G_i$. Then $\sigma_p =
\langle \sigma_{p,1},\ldots,\sigma_{p,r}\rangle$.  The following
important property of polynomials with abelian Galois group is useful
in recovering the Frobenius element $\sigma_p$.

\begin{lemma}\label{lem-abelian-galois}
  Let $g \in \mathbb{Q}[X]$ be an irreducible polynomial of degree $d$
  with abelian Galois group. Let $\theta$ be any root of $g$ and let
  $g(X) = \prod_{i=1}^d (X- A_i(\theta))$ be the factorisation of $g$
  over $\mathbb{Q}(\theta)$ where $A_i(X)$ are polynomial over
  $\mathbb{Q}$. For any $\sigma \in \Gal{\mathbb{Q}_g/\mathbb{Q}}$
  there is a unique index $i$ such that $\sigma$ maps $\eta$ to
  $A_i(\eta)$ for any root $\eta$ (not necessarily $\theta$) of $g$.
\end{lemma}
\begin{proof}
  Let $G$ be the Galois group of $g(X)$. Since $g$ is irreducible and
  $G$ is abelian, $\mathbb{Q}_g = \mathbb{Q}(\theta)$ and there is a
  unique automorphism $\sigma_i$ that maps $\theta$ to $A_i(\theta)$.
  The automorphisms $\{\sigma_i\}_{i=1}^d$ constitutes the group $G$.
  Consider any root $\eta$ of $g$.  Since $G$ is transitive there is a
  $\tau \in G$ such that $\tau(\theta) = \eta$. Now $\sigma_i (\eta) =
  \sigma_i \tau (\theta) = \tau \sigma_i (\theta)$ since $G$ is
  abelian.  Therefore $\sigma_i (\eta) = \tau (A_i(\theta)) =
  A_i(\tau(\theta)) = A_i(\eta)$.  Therefore $\sigma_i$ maps $\eta$ to
  $A_i(\eta)$.
\end{proof}

We now show that given a prime $p$ that does not divide the
discriminant $d_f$, the automorphism $\sigma_p$ can be recovered
efficiently.

\begin{proposition}\label{prop-recover-frob}%
  Given a prime $p$ that does not divide $d_f$, there is a randomised
  algorithm running in time polynomial in $\size{f}$ and $\lg{p}$ that
  computes the Frobenius $\sigma_p$ as an $r$-tuple $\langle
  \sigma_{p,1},\ldots,\sigma_{p,r} \rangle$ where $\sigma_{p,i} \in
  G_i$ is the Frobenius element corresponding to $p$ for the extension
  $\mathbb{Q}_{f_i}/\mathbb{Q}$.
\end{proposition}
\begin{proof}

  Fix a root $\theta_i$ of $f_i(X)$ over the extension
  $\mathbb{Q}[X]/f_i(X)$. Let $f_i(X)$ factorise as
  \[
  f_i(X) = \prod_{j=1}^{n_i} (X - A_{ij}(\theta_i)).
  \]
  Compute the Galois group $G_i$ of $f_i$ using Landau's algorithm.
  Let $\sigma_{ij}$ denote the unique automorphism of $G_i$ that maps
  $\theta_i$ to $A_{ij}(\theta_i)$. Our task is to identify which of
  these is $\sigma_{p,i}$.

  For each $i$ we find the splitting field $\mathbb{F}_{q_i}$ of $f_i$
  over $\mathbb{F}_p$.  Since $f_i$ is irreducible over $\mathbb{Q}$
  the order of the Frobenius $\sigma_{p,i}$ divides $n_i$, the degree
  of $f_i$.  Therefore $[\mathbb{F}_{q_i}: \mathbb{F}_p]$ divides
  $n_i$ and hence the splitting field is a small extension (of degree
  less than the degree of $f$) over $\mathbb{F}_p$. Let $\alpha$ be
  any root of $f_i(X)$ in $\mathbb{F}_{q_i}$. In polynomial time find
  the index $j$ such that $\alpha^p = \tilde{A}_{ij}(\alpha)$ where
  $\tilde{A}_{ij}(X)$ is the polynomial $A_{ij}(X)$ mod $p$.  Since $p
  \nmid d_f$ the index $j$ is unique as there are no multiple roots
  for $f_i(X)$ over $\mathbb{F}_p$. The Frobenius $\sigma_{p,i} =
  \sigma_{ij}$.

  Having computed $\sigma_{p,i}$ for all $1 \leq i \leq r$ we have
  $\sigma_p = \langle \sigma_{p,1}, \ldots, \sigma_{p,r} \rangle$.
\end{proof}

For our almost uniform sampler we study the distribution of $\sigma_p$
for random primes $p$. We show that for a random prime $p$, the
distribution of $\sigma_p$ is almost uniform over $G$.

\begin{proposition}\label{prop-sampler-probability}
  Let $\sigma$ be any automorphism in $\Gal{\mathbb{Q}_f/\mathbb{Q}}$.
  Let $P_\sigma(x)$ denote the probability that for an unramified
  prime $p \leq x$ picked uniformly at random $\sigma_p = \sigma$.
  Assuming the generalised Riemann hypothesis, there exists a constant
  $c$ independent of $f(X)$ such that
  \[ \frac{1}{\#G} \left(1 - \frac{1}{n!}\right) \leq P_\sigma(x) \leq
  \frac{1}{\#G} \left(1 + \frac{1}{n!}\right) \] for all $x \geq c .
  (n!)^{10}. \size{f}^2$.
\end{proposition}
\begin{proof}
  Let $L$ be the splitting field $\mathbb{Q}_f$. For an automorphism
  $\sigma \in G$ let $\pi_\sigma(x)$ denote the number of unramified
  primes $p \leq x$ such that $\sigma_p = \sigma$.  By the effective
  version Chebotarev density theorem
  (Theorem~\ref{thm-effective-cheb}) we have $\left| \pi_\sigma(x) -
    \frac{1}{\# G} \frac{x}{\ln x} \right| \leq O(\sqrt{x} .\ln x .
  \ln{d_L})$. Recall that $d_L \leq (n!)^3 \size{f}$.  Also by the
  prime number theorem, the number of primes less than $x$ is given by
  $\pi(x) = \frac{x}{\ln{x}}$. Therefore $P_\sigma(x) =
  \frac{\pi_\sigma(x)}{\pi(x)}$. It follows that
  \[
  \left| P_\sigma(x) - \frac{1}{\# G} \right| \leq O\left(
    \frac{\ln{x}^2.{n!}^3 \size{f}}{\sqrt{x}}\right).
  \]
  Therefore there is a constant $c$ such that for $x \geq c .
  (n!)^{10} .\size{f}^2$
  \[
  \frac{1}{\#G}\left(1 - \frac{1}{n!}\right) \leq P_\sigma(x) \leq
  \frac{1}{\#G}\left(1 + \frac{1}{n!}\right).
  \]
\end{proof}

Proposition~\ref{prop-sampler-probability} shows that picking random
primes and computing $\sigma_p$ gives an almost uniform sampling
procedure. That $\sigma_p$ can be computed given $p$ follows from
Proposition~\ref{prop-recover-frob}. The only missing result is to
show that a polynomial sized sample generates $G$ which we do now.

\begin{lemma}\label{lem-samp-group}
  Let $G$ be any group. Consider a sampling procedure that produces
  each element $g \in G$ with probability at least $\frac{1}{\lambda
    \# G}$, for some $\lambda > 1$. A sample set of size $4.\lambda
  .\lg{\# G}$ where each element is obtained by running the sampling
  procedure independently will generate $G$ with probability at least
  $\frac{1}{4\lambda}$.
\end{lemma}
\begin{proof}
  Let $N = 4.\lambda . \lg{\# G}$ and let $g_1,\ldots,g_N$ be the
  group elements sampled by running the procedure $N$ times. Let $G_0
  = \{ 1 \}$ and let $G_i$ denote the group generated by $\{
  g_1,\ldots,g_i\}$. Define the random variable $X_i$ as follows.
  \[
  X_i = \left\{ \begin{array}{l}
      1 \textrm{ if } G_{i-1} \neq G \textrm{ and } g_i \in G_{i-1}\\
      0 \textrm{ otherwise}
    \end{array}
  \right.
  \]

  We have $\mathrm{Prob}[X_i = 1 \mid G_{i-1} = G] = 0$. If $G_{i-1}
  \neq G$ then $\# G_{i-1} \leq \frac{1}{2}\#G$. Therefore the
  probability $\mathrm{Prob}[g_i \not\in G_{i-1}\mid G_{i-1} \neq G]$
  is at least $\frac{1}{2\lambda}$.  We now compute the expectation of
  the variable $X_i$.
  \begin{eqnarray*}
    \mathbf{E}[X_i] &=& \mathrm{Prob}[X_i = 1]\\
    & = & \mathrm{Prob}[G_{i-1} \neq G_i \textrm{ and } g_i \in G_{i-1}]\\
    & = & \mathrm{Prob}[g_i \in G_{i-1}\mid G_{i-1} \neq G_i].
    \mathrm{Prob}[ G_{i-1} \neq G_i]\\
    &=& 1 - \mathrm{Prob}[g_i \not\in G_{i-1} \mid G_{i-1} \neq G] \\
    &\leq&  1 - \frac{1}{2\lambda}.
\end{eqnarray*}

Let $X$ be the random variable $\sum_{i=1}^N X_i$.  The random
variable $X$ is always positive with expectation $\mathbf{E}[X] = \sum
\mathbf{E}[X_i] \leq N .  (1 - \frac{1}{2\lambda})$. By Markov's
inequality $\mathrm{Prob}[X \geq t] \leq \frac{\mathbf{E}[X]}{t}$ for
all $t$.  Using $t = N - \lg{\# G}$ we have
\begin{eqnarray*}
  \mathrm{Prob}[X \geq N - \log{\# G}] & \leq &\frac{1 -
    \frac{1}{2\lambda}} {1 - \frac{1}{4 \lambda}}\\
  &\leq &1 - \frac{1}{4 \lambda}.
\end{eqnarray*}

Consider any sample $g_1,\ldots,g_N$ such that random variable $X$ is
less than $N - \lg{\# G}$. Assume that the random group $G_N$
generated by $g_1,\ldots,g_N$ is different from $G$. Then $G_i \neq G$
for all $ 1\leq i \leq n$. As a result there are at least
$\left\lceil\lg{\# G}\right\rceil$ different indices $i$ such that
$g_i \not\in G_{i-1}$. At each such $i$, $\# G_{i} \geq 2 \# G_{i-1}$.
Hence $\# G_N \geq G$. But $G_i$'s are all subgroup of $G$.  This
contradicts the assumption that $G_N \neq G$.  Therefore if $X \leq N
- \lg{\# G } -1$ then $G_N = G$. Thus
\begin{eqnarray*}
  \mathrm{Prob}[G_N = G] &\geq& \mathrm{Prob}[X < N - \lg{\# G}] \\
  &=& 1 - \mathrm{Prob}[X \geq N - \lg{\# G}] \\
  &\geq & \frac{1}{4\lambda}.
\end{eqnarray*}

\end{proof}

We are ready to give a randomised algorithm to compute the Galois
group of $f(X)$.  The idea is to pick a prime $p \leq x$ for some
sufficiently large $x$ at random and recover $\sigma_p$ using
Proposition~\ref{prop-recover-frob}. It follows from
Proposition~\ref{prop-sampler-probability} that if $x \geq c.
(n!)^{10}. \size{f}^2$, an element $\sigma$ will be obtained by this
sampling procedure with probability at least $\frac{1}{2\# G}$.
Therefore an $8\lg{\# G} \leq 8n^2$ sized sample set will generate $G$
with probability at least $\frac{1}{8}$.
Algorithm~\ref{algo-compute-abelian-galois} is the detailed
presentation.

\begin{algorithm}
  \caption{Computing abelian Galois
    group}\label{algo-compute-abelian-galois}%
  \KwIn{A polynomial $f(X)$ over $\mathbb{Q}$.}%

  \KwOut{Galois group of $f(X)$.}%

  Factorise $f$ into irreducible factors $f_1,\ldots f_r$.

  Let $S \leftarrow \emptyset$

  \For{$i = 1$ to  $8n^2$}%
  {

    Pick a prime $p \leq c. (n!)^{10} \size{f}^2$ at random.

    Recover the $\sigma_p$ using Proposition~\ref{prop-recover-frob}

    $S \leftarrow S \cup \{ \sigma_p \}$

  }

  \KwRet{$S$}.

\end{algorithm}

We now prove the main result of this section.

\begin{theorem}
  Given a polynomial $f(X)$ over $\mathbb{Q}$ of degree $n$ with
  abelian Galois group. Assuming the generalised Riemann hypothesis
  there is a randomised algorithm that runs in time polynomial in
  $\size{f}$ and outputs a strong generator set for Galois group of
  $f$ with probability $1 - \frac{1}{2^{n.\size{f}}}$
\end{theorem}
\begin{proof}
  Algorithm~\ref{algo-compute-abelian-galois} gives a generator set of
  $G$ with probability at least $\frac{1}{8}$. To improve the
  probability we run Algorithm~\ref{algo-compute-abelian-galois}
  independently $s$ times to get subsets $A_1,\ldots,A_s$ each of size
  $8n^2$. Since $A_i$'s are picked independently at random, the
  probability that none of $A_i$'s generate $G$ is a at most
  $\left(\frac{7}{8}\right)^s$.  Hence $A = \cup_{i=1}^k A_k$ is a
  generating set for $G$ with at least $1 - (\frac{7}{8})^s$.
  Choosing $s = \frac{n.\size{f}}{\lg{8} - \lg{7}}$ we have the
  desired result. We can reduce the size of the set $A$ to $n^2$ by
  computing a strong generator set for $G$.
\end{proof}

\section{Computing simple Galois groups}\label{sect-simple-galois}

We consider an interesting special case of nonabelian Galois groups
computation for which we have a polynomial-time algorithm.  Let $f(X)$
be a polynomial such that $f(X)$ factors as $f=\prod_{i=1}^r f_i(X)$
over $\mathbb{Q}$.  Suppose the Galois group of $f_i(X)$ is small (of
order bounded by a polynomial in $\size{f}$), simple and nonabelian.
Then there is a polynomial time algorithm to compute the Galois group
of $f$.

Firstly using Landau's algorithm the groups $G_i= \Gal{K_{f_i}/K}$ can
be computed in time polynomial in $\size{f}$ as $G_i$ is of size
bounded by a polynomial in $\size{f}$.  The Galois group $G =
\Gal{\mathbb{Q}_f/\mathbb{Q}}$ is a subgroup of $\prod_{i=1}^r G_i$.
Moreover since the splitting field $\mathbb{Q}_f$ contains the
splitting field $\mathbb{Q}_{f_i}$, the projection from $G$ to $G_i$
is onto.  Each of the groups $G_i$ is simple and non-abelian.
Therefore, by Scott's Lemma (Lemma~\ref{lem-scott}), there is a
partition on the set $\{1,\ldots,r\}$ into subsets $I_1,\ldots, I_s$
such that $G$ is given by
\[
G = \prod_{k=1}^s \Diag{ \bigtimes_{j \in I_k} G_j}.
\]

As in Chapter~\ref{chap-bcgi} we say that $i$ and $j$ are
\emph{linked} if $G_i$ and $G_j$ belong to the same partition. In this
case $G$ projected to $G_i \times G_j$ is the diagonal group. This
implies that $i$ and $j$ are linked if and only if the splitting
fields $f_i$ and $f_j$ are the same.  This give a polynomial time
algorithm to check whether $i$ and $j$ are linked: Compute the
explicit data for the splitting field $L_i = \mathbb{Q}_{f_i}$ and
factorise $f_j(X)$ over $L_i$. The indices $i$ and $j$ are linked if
and only if $f_j(X)$ splits completely over $L_i$

The partitions $I_1,\ldots,I_s$ are the equivalence classes of the
equivalence relation $\sim$ defined by $i \sim j$ if $i$ linked to
$j$.  Since $i \sim j$ can be checked in time polynomial in $\size{f}$
the equivalence classes $\{ I_k \}_{1 \leq k \leq s}$ can be computed
in polynomial time.  Putting it all together we have the following
theorem.

\begin{theorem}\label{thm-compute-galois-simple}
  Let $f(X) \in \mathbb{Q}[X]$ be a polynomial such that $f = f_1 f_2
  \ldots f_r$ where each $f_i$ has a non-abelian simple Galois group
  of size at most $N$. Then there is an algorithm that runs in time
  polynomial in $\size{f}$ and $N$ to compute the Galois group of
  $f(X)$.  In particular if $N$ is bounded by a polynomial in
  $\size{f}$, there is a polynomial time algorithm for finding the
  Galois group of $f$.
\end{theorem}
\begin{proof}
  First factorise the polynomial $f$ into $f_1, f_2 \ldots, f_n$.
  Compute the Galois groups $G_i = \Gal{\mathbb{Q}_{f_i}/\mathbb{Q}}$
  for each $1 \leq i \leq n$ in time polynomial in $\size{f}$ and $N$
  using Landau's algorithm (Theorem~\ref{thm-landau-galois}). As
  described before equivalence classes $\{ I_k \}_{1 \leq k \leq s}$
  can be computed in time polynomial in $\size{f}$ and $N$. For $i$
  and $j$ that are linked, in order to compute the diagonal group, we
  need to find the right isomorphism between $G_i$ and $G_j$. This can
  be computed by factoring $f_j$ over $\mathbb{Q}_{f_i}$. We then
  output the group
  \[
  G = \prod_{k=1}^t \Diag{ \bigtimes_{j \in I_k} G_j},
  \]
  which is the required Galois group.
\end{proof}

\section{Discussion}

As all our results on computational Galois theory, we can prove
similar results for polynomials $f(X)$ over a number field $K$ given
by explicit data.  It still remains open whether there is a polynomial
time deterministic algorithm to compute the Galois group of a
polynomial with abelian Galois group. Even when $f(X)$ is a product of
quadratic polynomials we do not have polynomial time deterministic
algorithm.

For polynomials $f(X)$ with abelian Galois group, each conjugacy class
of $G$ was singleton. Also any prime $p$ that does not divide the
discriminant $d_f$, using Lemma~\ref{lem-abelian-galois} we could
recover the Frobenius associated to the prime $p$. These two
properties gave us the uniform sampling procedure. However if the
Galois group of $f(X)$ is not abelian we do not have a method to
recover the action of the Frobenius. By factoring $f(X)$ over
$\mathbb{F}_p$ for different primes we get only the cyclic structure
of element of $\Gal{f}$.

Finally, in the absence of any good algorithms, it is of interest to
prove hardness results for Galois group computations.

\bibliographystyle{plain}%
%
\addcontentsline{toc}{chapter}{Bibliography}
\bibliography{bibdata}%
%
\addcontentsline{toc}{chapter}{Index}
\printindex
\end{document}

\subsection{The {\small NORMALCLOSURE} problem}\label{subsect-normalclosure}

An important step in our algorithm for $\ProblemFont{PWS}_c$ is to
compute suitable generator sets for permutation groups with
constant sized orbits. Our approach is very similar to that of
Luks~\cite{luks86parallel} which in turn is a generalisation of the
ideas of Luks and McKenzie~\cite{luks88solvable}. To this end we
define the following group theoretic problem.

Given a generator set $A$ of a permutation group $G$ on $\Omega$ with
orbits $\Omega_1,\ldots,\Omega_m$ all of which are of size bounded by
$c$.  For each $1 \leq i \leq m$ given permutation groups $L_i$ and
$M_i$ on $\Omega_i$ staisfying the following conditions
\begin{enumerate}
\item The group $L_i/M_i$ is $T$-semisimple for some simple group $T$.
\item $G$ \emph{normalises} the product groups $L = \prod_{i=1}^m L_i$
  and $M = \prod_{i=1}^m M_i$.
\item $G \cap L$ projects \emph{onto} $L_i$ for all $1 \leq i \leq m$.
\end{enumerate}
Given a subset $S \subseteq G \cap L$ such that the normal closure
$\NCL[G]{S}$ of $S$ is $G \cap L$, the {\small NORMALCLOSURE} problem
is to compute the strong generator set of $G \cap L$ rel $G \cap M$.
Also given an $x \in G \cap L$ compute $\Sift{x}$ with respect to the
computed strong generator set.

The abelian {\small NORMALCLOSURE} problem is the special case for
which the simple group $T$ is abelian. In this case $T$ is isomorphic
to $\mathbb{F}_p$ for some prime $p$. Similarly by nonabelian {\small
  NORMALCLOSURE} problem we mean the special case where the simple
group $T$ is nonabelian.

The procedure for solving the {\small NORMALCLOSURE} problem will be
required as a subroutine in our algorithm for computing a strong
generator set.  We study the complexity of this problem.  We prove
that if $T$ is isomorphic to $\mathbb{F}_p$ then the corresponding
{\small NORMALCLOSURE} problem is in $\mathrm{FL}^{\ModkL{p}}$.
Surprisingly nonabelian {\small NORMALCLOSURE} problem is in
$\mathrm{FL}$.

\subsubsection{Abelian {\small NORMALCLOSURE}}

Let the notations be as before.  As $T$ is abelian and simple, for
some prime $p$, $T$ is isomorphic to the additive group
$\mathbb{F}_p$.  Since $L_i/M_i$ is $\mathbb{F}_p$-semisimple it is
isomorphic to a vector space over $\mathbb{F}_p$ and hence $L/M$ is
also a vector space over $\mathbb{F}_p$.  The quotient group
$\frac{G\cap L}{G \cap M}$ is a subgroup of $L/M$.  More precisely the
map $x (G \cap M) \mapsto x M$ is an embedding of $\frac{G \cap L}{G
  \cap M}$ into $L/M$. We are given the set $S \subseteq G \cap L$
such that $\NCL[G]{S} = G \cap L$ and our goal is to compute a strong
generator set for $G\cap L$ rel $G \cap M$. To this end we describe
$\mathrm{FL}^{\ModkL{p}}$ algorithms for some basic linear algbraic
problems over $\mathbb{F}_p$. These will be uses as subroutines in our
$\mathrm{FL}^{\ModkL{p}}$ algorithm for computing the strong generator
set of $G \cap L$ rel $G \cap M$.

\begin{proposition}\label{prop-compute-basis-fp}
  For a prime $p$ consider the vector space $V = \mathbb{F}_p^r$ then
  \begin{enumerate}
  \item \label{part-check-span}%
    Let $\mathcal{B} = \{ \mathbf{v}_1,\ldots,\mathbf{v}_n \}$ be a
    subset of $V$. Given $\mathbf{v} \in V$, in $\ModkL{p}$ we can
    check whether $\mathbf{v}$ is contained in the subspace $U$ of $V$
    spanned by $\mathcal{B}$. Furthermore, if $\mathbf{v} \in U$ then
    in $\mathrm{FL}^{\ModkL{p}}$ we can compute $a_1,\ldots,a_n \in
    \mathbb{F}_p$ such that $\mathbf{v} = \sum_{i=1}^n a_i
    \mathbf{v}_i$.
  \item \label{part-find-basis}%
    Let $\mathcal{B} = \{ \mathbf{v}_1,\ldots,\mathbf{v}_n \}$ be a
    subset of $V$ not necessarily linearly independent and let $U$ be
    the subspace of $V$ spanned by $\mathcal{B}$. Then in
    $\mathrm{FL}^{\ModkL{p}}$ we can compute a subset $\mathcal{B}'
    \subseteq \mathcal{B}$ such that $\mathcal{B}'$ is a basis for
    $U$.
  \end{enumerate}
\end{proposition}
\begin{proof}

  Let $\mathbf{e}_1,\ldots,\mathbf{e}_m$ denote the standard basis for
  $V = \mathbb{F}_p^r$ and let $\mathbf{v}_i = \sum_{j= 1}^m v_{i,j}
  \mathbf{e}_j$ for $1 \leq i \leq n$. Let $\mathbf{v} = \sum_{j =
    1}^m v_j \mathbf{e}_j$. Let $A$ be the matrix $(v_{i,j})$, $1\leq
  i \leq n$ and $1 \leq j \leq m$. Let $\mathbf{b}$ the column vector
  $(v_1,\ldots,v_m)^T$. Then the vector $\mathbf{v}$ is in the span of
  $\mathcal{B}$ if and only if the system of linear equation $A
  \mathbf{x} = \mathbf{b}$ has a solution. Furthermore if $x_i = a_i$,
  $1 \leq i \leq n$ is a solution to $A \mathbf{x} = \mathbf{b}$ then
  $\mathbf{v} = \sum_{i = 1}^n a_i \mathbf{v}_i$.
  Part~\ref{part-check-span} the follows from
  Theorem~\ref{thm-modp-linearalgb}.

  To prove part~\ref{part-find-basis} consider the
  $\mathrm{FL}^{\ModkL{p}}$ that cycles oveer all $1 \leq i \leq n$
  and outputs $\mathbf{v}_i$ if it is not in the span of the set
  $\{\mathbf{v}_1,\ldots,\mathbf{v}_{i-1} \}$. Clearly the output
  $\mathcal{B}'$ is a basis of the vector space spanned by
  $\mathcal{B}$.
\end{proof}

% Consider the vector space $U$.  Let $U = U_1 \oplus\ldots\oplus U_n$
% be a direct decomposition of $U$. Let $W$ be a subspace of $U$. By a
% \emph{diagonal basis}\index{diagonal!basis} for $W$ with respect to
% the direct sum decomposition $U = \oplus_{i=1}^n U_i$ we mean a
% basis $\mathcal{B}^* = \mathcal{B}^*_1 \cup \ldots \cup
% \mathcal{B}^*_n$ such that $\cup_{i = j}^n \mathcal{B}^*_i$ is a
% basis for $W \cap U_j \oplus \ldots \oplus U_n$. For a diagonal
% basis $\mathcal{B}^* = \cup_{i=1}^n \mathcal{B}_i^*$, every vector
% of $\mathcal{B}_i^*$ is $0$ when projected to the subspace $U_1
% \oplus \ldots \oplus U_{i-1}$.
%
%
% \begin{proposition}
%   Consider the vector space $U$ over $\mathbb{F}_p$ of dimension
%   $r$.  Let $U = U_1 \oplus\ldots\oplus U_n$ be a direct
%   decomposition of $U$.  Given a basis $\mathcal{B} = \{
%   \mathbf{u}_1,\ldots,\mathbf{u}_m \}$ for a subspace $W$ of the
%   direct sum $U$, in $\mathrm{FL}^{\ModkL{p}}$ we can compute a
%   diagonal basis $\mathcal{B}^* = \{
%   \mathbf{u}_1^*,\ldots,\mathbf{u}_m^* \}$ for $W$, i.e. we can
%   compute elements $a_{i,j} \in \mathbb{F}_p$ such that the elements
%   $\mathbf{u}_i^* = \sum_{j=1}^m a_{i,j} \mathbf{u}_j$ forms a
%   diagonal basis for $W$.
% \end{proposition}
% \begin{proof}
%   Let $\mathcal{B} = \{ \mathbf{u}_1,\ldots,\mathbf{u}_m \}$. Let
%   $\mathbf{e}_1,\ldots,\mathbf{e}_{r}$ be the standard basis for
%   $U$.  Every element $\mathbf{u} = \sum a_i \mathbf{e}_i$ can be
%   seen as a column vector $(a_1,\ldots,a_r)^T$. Furthermore we
%   assume without loss of generality that the coordinates
%   corresponding to each of the vector space $U_i$ occur together,
%   i.e. there are integers $1 = i_0 \leq \ldots \leq i_n = r$ such
%   that $e_{i_s},\ldots,e_{i_{s+1} -1}$ is the standard basis for
%   $U_s$.  For an integer $1 \leq i \leq r$ consider the system of
%   linear equations
%   \begin{equation}\label{eqn-diagonalising}%
%     \sum_{j = 1}^r X_j
%    \mathbf{u}_j = \mathbf{e}_i + \sum_{j = i+1}^r Y_j \mathbf{e}_j
%  \end{equation}
%  where $X_j$'s and $Y_j$'s are variables.
%  Equation~\ref{eqn-diagonalising} is feasible if and only if there
%  exists a vector in $\mathbf{w}_i \in W$ such that the $j$th
%  component of $\mathbf{w}_i$ is $0$ if $j < i$ and $1$ if $j = i$.
%  Using the results of Buntrock \etal~\cite{buntrock92structure} in
%  $\ModkL{p}$ we can check if Equation~\ref{eqn-diagonalising} is
%  feasible.  Furthermore if for a given $i$
%  Equation~\ref{eqn-diagonalising} is feasible then in
%  $\mathrm{FL}^{\ModkL{p}}$ we can compute the vector $\mathbf{w}_i$
%  as a linear combination of the vectors in $\mathcal{B}$.
%
%  The $\mathrm{FL}^{\ModkL{p}}$ algorithm for computing the sets
%  $\mathcal{B}_s^*$ is now straight forward. For all $i_s \leq i \leq
%  i_{s+1} -1$ we check if Equation~\ref{eqn-diagonalising} is
%  feasible using a query to the $\ModkL{p}$-oracle. If yes we compute
%  a solution $\mathbf{w}_i = \sum_{i=1}^m a_i \mathbf{u}_i$ and
%  include it in $\mathcal{B}_s^*$. A straight forward induction shows
%  that the sets $\cup_s \mathcal{B}_s^*$ is a diagonal basis for $W$.
% \end{proof}

We fix some notations: Recall that $L_i/M_i$ is isomorphic to vector
space over $\mathbb{F}_p$ which we donte by $V_i$.  Let $V$ be the
direct sum $\oplus_{i=1}^m V_i$ then $L/M$ is isomorphic to $V$.  For
a permutation $x \in L$ let $\mathbf{v}_x$ denote the image of $xM$
under the above mentioned isomorphism.  If $x$ and $y$ are
permutations in $L$ the for integers $a$ and $b$ it follows that
$\mathbf{v}_{x^a y^b} = \tilde{a} \mathbf{v}_{x} + \tilde{b}
\mathbf{v}_y$ where $\tilde{a}$ and $\tilde{b}$ are the elements $a \
(\textrm{mod } p)$ and $b \ (\textrm{mod } p)$ of $\mathbb{F}_p$
respectively.  Furthermore the vector space structure of $L/M$ is
obtainable effectively in logspace, i.e. for an element $x \in L$ one
can compute the image $\mathbf{v}_x$ of the coset $xM$ in $V$ in
$\mathrm{FL}$.  This is because each of the groups $L_i$ are constant
sized.  Since $\frac{G\cap L}{G \cap M} \hookrightarrow L/M$ it is
isomorphic to a subspace of $V$ which denote by $W$.  We are given a
subset $S \subseteq G \cap L$ such that $\NCL[G]{S} = G \cap L$. Let
$U$ denote the space spanned by $\{ \mathbf{v}_s | s \in S \}$.  To
compute the required strong generator set we first compute a basis for
$W$ using the basis for $U$ and the generator set for $G$.

The group $ \NCL[G]{S}$ is the group generated by the set $\{ g^{-1}s
g| s \in S g \in G \}$ and hence the conjugation action can be seen as
a linear transformation on $V$ as we now explain: For each element $g$
in the generator set of $G$, define the linear map
$\tau_g:V\rightarrow V$ that maps the vector $\mathbf{v}_h$, $h \in L$
to the vector $\mathbf{v}_{h^*}$ where $h^* =g^{-1}hg$.  Since both
$L$ and $M$ is normalised by $G$, for each $g\in G$, $\tau_g$ is an
invertible linear transformation from $V$ to $V$.  We make use of the
following observation of Luks and McKenzie~\cite{luks88solvable} about
the normal closure $\NCL[G]{S}$.

\begin{proposition}[Luks and McKenzie]\label{prop-linear-closure}
  Let $A$ be a generator set of $G$.  The subspace $W$ of $V$
  associated with $G \cap L/G \cap M$ is the smallest subspace of $V$
  containing $\{ \mathbf{v}_s | s \in S \}$ and closed under the
  linear transformations $\mathfrak{T} = \{ \tau_g : g \in A \}$.
\end{proposition}
\begin{proof}
  The normal closure $\NCL[G]{S}$ is the smallest subgroup of $G$ that
  contains $S$ and is closed under conjugation by elements of $G$.  By
  the definition of the linear transformations $\tau_g$, for any
  element $x \in L$, $\mathbf{v}_{g^{-1}x g} = \tau_g \mathbf{v}_x$.
  Therefore $W$ is the smallest subspace of $V$ containing $\{
  \mathbf{v}_s | s \in S \}$ and closed under the set of linear
  transformations $\{ \tau_g | g \in A \}$.
\end{proof}

Let $\mathcal{A}$ be the algebra $\mathbb{F}_p[\mathfrak{T}]$. For a
subset $\mathcal{M}$ of $\mathcal{A}$ and an integer $k \geq 0$ let
$\mathcal{M}^k$ denote the set of all possible products of $j$
elements from $\mathcal{M}$, i.e.  $\mathcal{M}^0 = \{ 1 \}$ and
$\mathcal{M}^{k+1} = \mathcal{M}^k \cup \{ \tau \sigma | \tau \in
\mathcal{M}\textrm{ and } \sigma \in \mathcal{M}^k \}$.

\begin{proposition}\label{prop-property-M}%
  Let $\mathcal{M} = \mathfrak{T}^k$. Then for any $\tau \in
  \mathcal{A}$ and $1 \leq i \leq m$ there is an element $\tau_i \in
  \mathrm{Span}(\mathcal{M})$ such that $\tau - \tau_i$ is $0$ when
  restricted to $V_i$.
\end{proposition}
\begin{proof}
  Let $\mathcal{A}$ be the algebra $\mathbb{F}_p[\mathfrak{T}]$.  The
  vector spaces $\{ V_i \}_{1 \leq i \leq m}$ are stabilised by the
  elements of $\mathcal{A}$.  Fix a basis for $V$ by picking a basis
  for each $V_i$. With respect to this basis the elements of
  $\mathcal{A}$ are block diagonal matrices where the $i$th block is
  the action of $\mathcal{A}$ on $V_i$.  Let $\mathcal{A}_i$ denote
  the matrix algebra obtained by restricting the action of
  $\mathcal{A}$ on $V_i$. Since $G$-orbits are of size bounded by a
  constant $c$, the dimension of $V_i$ is bounded by $c$. Therefore
  $\mathcal{A}_i$ is of dimension at most $c^2$.

  If $\mathfrak{T}_i$ be the set consisting of $i$th block of elements
  of $\mathfrak{T}$ then $\mathcal{A}_i =
  \mathbb{F}_p[\mathfrak{T}_i]$. Let $\mathcal{W}_i$ denote vector
  space spanned by the matrices $\mathfrak{T}_i^k$. Clearly if for
  some $k$ if $\mathcal{W}_k = \mathcal{W}_{k+1}$ then $\mathcal{W}_k
  = \mathcal{A}_i$.  Since dimension of $\mathcal{A}_i$ is at most
  $c^2$, the tower $\mathcal{W}_0 \subseteq \ldots \subseteq
  \mathcal{W}_k$ stabilises to $\mathcal{A}_i$ for some $k \leq c^2$.
  Therefore $\mathfrak{T}_i^k$ spans $\mathcal{A}_i$ for all $k \geq
  c^2$.

  For all $1 \leq i \leq m$ the set $\mathfrak{T}_i^k$ is the
  projection of $\mathfrak{T}^k$ on $\mathcal{A}_i$. Hence the
  projection of $\mathfrak{T}^k$ on $\mathcal{A}_i$ spans
  $\mathcal{A}_i$ for $k \geq c^2$. Therefore for any $\tau \in
  \mathcal{A}$ there exists a $\tau_i$ in the vector space of matrices
  spanned by $\mathcal{M} = \mathfrak{T}^k$ such that $\tau_i$ and
  $\tau$ agree on their action on $V_i$.  Therefore $\tau - \tau_i$ is
  $0$ on $V_i$.
\end{proof}

\begin{proposition}\label{prop-spanning-M}%
  Let $\mathcal{M} = \mathfrak{T}^k$. Then $\{ \tau \mathbf{v}_s |
  \tau \in \mathcal{M} \textrm{ and } s \in S \}$ spans $W$.
\end{proposition}
\begin{proof}
  Let $U$ be the space spanned by $\{ \mathbf{v}_s | s \in S \}$.
  Since $\tau$ is a linear map from $V$ to $V$ it is sufficient to
  prove that $\mathcal{M}U = \{ \tau \mathbf{u} | \tau \in
  \mathcal{M}\ \mathbf{u} \in U \}$ spans $W$.  For any subspace
  $\mathcal{V}$ of $V$ consider the tower of subspaces $\mathcal{V} =
  \mathcal{V}^{(0)} \supseteq \ldots \supseteq \mathcal{V}^{(m)} = 0$
  where $\mathcal{V}^{(i)}$ denotes the subspace $ \mathcal{V} \cap
  \oplus_{j=i+1}^m V_i$ of $\mathcal{V}$.  We prove inductively
  starting form $i = m$ down to $i = 0$ that the set $\mathcal{M}
  U^{(i)} = \{ \tau \mathbf{u} | \tau \in \mathcal{M} \mathbf{u} \in
  U^{(i)} \}$ spans $W^{(i)}$.

  To begin with since $U^{(m)} = W^{(m)} = 0$. Inductively assume that
  $\mathcal{M} U^{(i)}$ spans $W^{(i)}$ We prove that $\mathcal{M}
  U^{(i-1)}$ spans $W^{(i-1)}$.  Let $\mathcal{A}$ be the algebra
  $\mathbb{F}_p[\mathfrak{T}]$. It follows from
  Proposition~\ref{prop-linear-closure} that $W$ is the vector space
  $\{ \tau \mathbf{v} | \tau \in \mathcal{A}\ \mathbf{u} \in U \}$.
  Consider any vector $\mathbf{w} \in W^{(i-1)}$. Since $\mathcal{A}$
  stabilises the vector spaces $V_{i-1} \oplus \ldots \oplus V_m$, the
  closure of $U^{(i)}$ under $\mathcal{A}$ is $W^{(i)}$. Therefore
  there is an element $\tau \in \mathcal{A}$ and a vector $\mathbf{u}
  \in U^{(k-1)}$ such that $\tau \mathbf{u} = \mathbf{w}$. By
  Proposition~\ref{prop-property-M} we have a $\tau' = \sum_{\sigma
    \in \mathcal{M}} a_\sigma \sigma$, $a_\sigma \in \mathbb{F}_p$
  such that $\tau - \tau'$ restricted to $V_i$ is $0$.  Therefore
  $\mathbf{u}' = (\tau - \tau')(\mathbf{u}) \in W^{(i)}$.  Clearly
  vector $\tau'(\mathbf{u}) = \sum_{\sigma \in \mathcal{M}} a_\sigma
  \sigma(\mathbf{v})$ is contained in the span of $\mathcal{M}
  U^{(i-1)}$. By our inductive assumption since $\mathbf{u}' \in
  W^{(i)}$, $\mathbf{u}'$ is in the span of $\mathcal{M} U^{(i)}
  \subseteq \mathcal{M} U^{(i-1)}$. Therefore $\mathbf{w} = \tau
  (\mathbf{u}) = \mathbf{u}' + \tau'(\mathbf{u})$ is in the span of
  $\mathcal{M} U^{(i-1)}$. Since $U^{(0)} = U$ we have the desired
  result.
\end{proof}

We now give the $\mathrm{FL}^{\ModkL{p}}$ algorithm for abelian
{\small NORMALCLOSURE} problem.  Let $A$ be the generator set of $G$
and $\mathfrak{T} =\{ \tau_g | g \in A \}$. Let $\mathcal{M} =
\mathfrak{T}^{c^2}$. Since every $\tau \in \mathcal{M}$ is block
diagonal where each block is a $c \times c$ matrix, we can compute in
$\mathrm{FL}$ we can compute the set $\mathcal{M}$.  Every element of
$\mathcal{M}$ is of the form $\tau_g$ where $g = g_1\ldots g_k$, $g_i
\in A$, for some $k \leq c^2$.  We keep track of these permutations,
i.e. together with $\mathcal{M}$ we compute the set $M$ of
permutations of $G$ obtained by taking all possible products of $0
\leq k \leq c^2$ elements from $A$.  We then compute in $\mathrm{FL}$
the set $\mathcal{C} = \{ \tau \mathbf{v}_s | s \in S \}$. Let $C$ be
the corresponding set of permutations, i.e. $C = \{ g^{-1} s g | s \in
S\ g \in M \}$. Since we have already computed $M$ we can compute $C$
aswell in $\mathrm{FL}$.

{From} Proposition~\ref{prop-spanning-M} it follows that $\mathcal{C}$
spans $W$. Using~\ref{prop-compute-basis-fp} we compute in
$\mathrm{FL}^{\ModkL{p}}$ a subset $\mathcal{C}^*$ of $\mathcal{C}$
that forms a basis for $W$.  We also obtain the subset $C^* = \{ x_1,
\ldots, x_n \}$ of $C$ such that $\mathcal{C}^* = \{
\mathbf{v}_{x_1},\ldots,\mathbf{v}_{x_n} \}$.  For each $1 \leq i \leq
n$ define the set $C_i = \{ x_i^a : 1 \leq a \leq p -1 \}$.  The set
$\cup_{i=1}^n C_i$ is the strong generator set of $G \cap L$ rel $G
\cap M$. The computation of $C_i$ involves computing $\mathcal{C}^*$
from $\mathcal{C}$ which can be done in $\mathrm{FL}^{\ModkL{p}}$.
All the other computations involved can be performed in $\mathrm{FL}$.
Hence we can compute strong generator set $C = \cup_{i=1}^n C_i$ in
$\mathrm{FL}^{\ModkL{p}}$.

Finally, we describe how to compute $\Sift{g}$ for any $g\in G\cap L$
with respect to the above mentioned strong generator set. In logspace
compute the vector $\mathbf{v}_g \in V$ corresponding to the
permutation $g$.  Using Proposition~\ref{prop-compute-basis-fp}
compute $a_i \in \mathbb{F}_p$ such that $\mathbf{v}_g = \sum a_i
\mathbf{v}_{x_i}$.  The sift of $g$ is given by
$\Sift{g}=g\prod_{i=1}^r x_i^{-a_i}$. This completes the
$\mathrm{FL}^{\ModkL{p}}$ for abelian {\small NORMALCLOSURE} problem.