← All papers
First page of Fast Evaluation of Polynomials with Rational Preprocessing

Fast Evaluation of Polynomials with Rational Preprocessing

Thomas D. Ahle, Jakob B. T. Knudsen

cs.DS Sep 5, 2026 · v1
Upper-bound construction (multiplication count, decoder, height) and the degree-6 lower bound are machine-checked in a Lean 4 development, FastPoly.
Horner's rule evaluates a monic degree-$n$ polynomial using $n-1$ multiplications. We show that with rational preprocessing of the coefficients, any such polynomial can be evaluated using only $\lfloor n/2 \rfloor + 1$ multiplications over fields of characteristic zero or of characteristic $p>n$. This resolves the multiplication side of a conjecture of Rabin and Winograd (Comm. Pure Appl. Math 1972), who achieved $n/2 + 2\lceil\log_2 n\rceil$ multiplications and conjectured the logarithmic overhead was necessary. We show that this multiplication count can't be beaten in general, proving that three multiplications do not suffice for degree $6$. This strengthens the lower bound of Pan (STOC 1978), who proved a tight bound for general, complex preprocessing. In characteristic 2, for every $n>1$ and every finite field of size at least $2n$, we prove that an $n$-multiplication chain cannot parametrize all value vectors at $2n$ distinct evaluation points, even with arbitrary preprocessing. We give $\lfloor n/2 \rfloor + 1$ multiplication schedules over characteristic 2, each with an explicit inverse, for every odd degree $n\le 25$ and conjecture that this is possible for all $n$. We also give an injective polynomial construction for universal hashing that uses $N$ multiplications to hash $2N$ values with a single random key. This improves the best previous construction by Daniel J. Bernstein (cryp.to).

Horner's rule evaluates a monic degree-n polynomial with n-1 multiplications. Rabin and Winograd conjectured that rational preprocessing of the coefficients requires a logarithmic overhead above n/2 multiplications.

The authors build explicit circuit schedules with rational, everywhere-defined preprocessing and polynomial decoders, using floor(n/2)+1 multiplications in characteristic zero or characteristic p>n. They prove a lower bound showing three multiplications do not suffice for degree 6, and give characteristic-2 schedules for odd degrees up to 25. They also give an injective recurrence for universal hashing. The upper-bound construction and the lower-bound case analysis are formalized in Lean 4 over commutative rings, with explicit IsUnit hypotheses.

Any monic polynomial can be evaluated with floor(n/2)+1 multiplications after rational preprocessing, which resolves the multiplication side of the Rabin–Winograd conjecture; this count is tight in general. The hashing construction uses N multiplications to hash 2N values and was benchmarked on ARM and x86 over GF(2^64).