Research proof index

The reverse identity. In S = Z_q[X]/(X^{2^α}+1), the conjugation σ_{-1} (here the semantic automorphism galoisAutₛ of exponent conjExp = 2^{α+1}-1) and the polynomial reversal are related by mk(reverse p) = σ_{-1}(mk p) · (mk X)^{deg p}. This is the concrete handle behind "σ_{-1} swaps the two factors": since (mk X)^{deg p} is a unit, `σ...

(C-1) X^{2^{α+1}} ≡ 1 in the quotient, since X^{2d} - 1 = (X^d - 1)(X^d + 1).

The conjugate σ_{-1}(X^e) lands at position d - e (mod d), for 0 < e < d.

(Phase 1) −1 ∉ ⟨q⟩ in (Z/2^{α+1})ˣ, stated as: no power of q equals −1. For q ≡ 5 (mod 8), every power of q is ≡ 1 (mod 4) (since q ≡ 1 (mod 4)), while −1 ≡ 3 (mod 4) (as α ≥ 1, so 4 ∣ 2^{α+1}); projecting to ZMod 4 separates them. This is the precise sense in which q ≡ 5 (mod 8) forces σ_{-1} to swap the two CRT factors.

The multiplicative order of q modulo 2^(α+1) is 2^(α-1), phrased to match ZMod.irreducible_of_dvd_cyclotomic_of_natDegree (K = ZMod q, n = 2^(α+1)).

Packing exponents stay in range: for 2·2^κ ∣ 2^α, every packed exponent packExp α (2^κ) j lands below the ring dimension d = 2^α, for j ranging over the packed index set Fin (d/2^κ).