Main Page Reference Manual Compound List File List

Cracking parameter b of the elliptic curve

Today, 24 November 2004, I found the answer to the question why #E₀ + #E₁ = 2(q + 1). It is actually quite trivial. The reason is simply this:

The number of points on a given elliptic curve is equal to

#E = 2 + 2 $\kappa$

where $\kappa$ is the number of different non-zero x coordinates for which there is a solution (and thus exactly two solutions) to the elliptic curve equation E: x³ + ax² + b = y² + xy.

The first 2 takes the point at infinity and the point with x is zero (0, $\sqrt{b}$ ) into account.

After dividing the elliptic curve equation by x², we see that there will be a solution for a non-zero value of x when x + a + b/x² = (y/x)² + y/x. And because of theorem 5, this only has a solution when Tr(x + a + b/x²) = 0.

In other words, when the trace of a is changed from 0 into 1, then there will be solutions for exactly the other non-zero values of x!

Therefore, with #E₀ = 2 + 2 $\kappa_0$ and #E₁ = 2 + 2 $\kappa_1$ as defined in the chapter "Cracking parameter a of the elliptic curve", we can conclude that $\kappa_0$ + $\kappa_1$ equals the total number of possible non-zero values of the field: q - 1. And thus #E₀ + #E₁ = 4 + 2(q - 1) = 2(q + 1).

The following might be a very important result, since I never saw it anywhere in literature yet (please contact me if you know whether or not this is indeed new):

The order of an elliptic curve over $\mathbb{F}_{2^m}$ is equal to (assuming Tr(a) = 0, otherwise it is 2(q + 1) minus this) 2 plus 2 times the number of values of x for which Tr(x) = Tr(b/x²). Note that due to Frobenius $Tr(b/x^2) = Tr(\sqrt{b}/x)$ .

If its new, then I hereby claim it ;).

It has been two years since I wrote something, but lets go again.

In order to find some relationship between b and #E we'll start with calculating #E₀ for different values of m, setting a=0 and b=1. The choice for a is irrelevant as has been shown before. The choice for b=1 is made because it is the only value that will be independent of the field (using b=0 gives a singular curve) so that comparing them with different values of m makes sense.

Thus, given the curve E: y² + xy = x³ + 1 over $\mathbb{F}_{2^m}$ , #E was calculated by running over all non-zero values of x and then counting how many times Tr(x) = Tr(1/x). Multiplying this value with 2 and adding 2 then gives #E as shown above. The program used to do these calculations can be found in testsuite/point/pointcount.cc.

The results are as follows.

Table 1.
m	#E
2	8
3	4
4	16
5	44
6	56
7	116
8	288
9	508
10	968
11	2116
12	4144
13	8012
14	16472
15	33044
16	65088
17	130972
18	263144
19	523492
20	1047376
21	2099948
22	4193912
23	8383412
24	16783200
25	33558844
26	67092488
27	134225284
28	268460656
29	536830604
30	1073731736
31	2147574356

I looked long and hard at those numbers and believe it or not, I came up with a structure.

First of all, you have to realize that each of those numbers where calculated as $2 + 2 \cdot count$ , so we might as well go back to that number.

Table 2.
m	(#E - 2)/2
2	3
3	1
4	7
5	21
6	27
7	57
8	143
9	253
10	483
11	1057
12	2071
13	4005
14	8235
15	16521
16	32543
17	65485
18	131571
19	261745
20	523687
21	1049973
22	2096955
23	4191705
24	8391599
25	16779421
26	33546243
27	67112641
28	134230327
29	268415301
30	536865867
31	1073787177

Then it occured to me that if you subtract one from that number, m divides the result if m is prime. This being the case for m=2, 3, 5, 7, 11, 13, 17, 19, 23, 29 and 31 can hardly be a coincidence, so I subtracted 1 from the number and calculated the division.

Table 3.
m	(#E - 2)/2 - 1	((#E - 2)/2 - 1)/m
2	2	1
3	0	0
4	6
5	20	4
6	26
7	56	8
8	142
9	252
10	482
11	1056	96
12	2070
13	4004	308
14	8234
15	16520
16	32542
17	65484	3852
18	131570
19	261744	13776
20	523686
21	1049972
22	2096954
23	4191704	182248
24	8391598
25	16779420
26	33546242
27	67112640
28	134230326
29	268415300	9255700
30	536865866
31	1073787176	34638296

This isn't as odd as it might seem, it is our friend Frobenius again! The value $ x=1 $ gives rise to the '1' count; after all we have b=1 and thus Tr(x) = Tr(1/x) for x=1! And if some $x \neq 0$ and $x \neq 1$ satisfies Tr(x) = Tr(1/x), then the Frobenius map that sends $x \mapsto x^2$ gives a different value of x that satisfies the formula as well. Since Frobenius repeats after m times when m is prime, those values of x come in groups of size m.

This discovery therefore immediately clarifies how to continue. When m is not prime, some values of x will not repeat after applying Frobenius m times, but after a factor of m times. For example, if m = 12 then some values of x will repeat after applying Frobenius 2, 3, 4, or 6 times, because each of those values divides 12.

We can therefore write (#E - 2)/2 - 1 as a weighted sum over the divisors of m as follows,

$(\#E - 2)/2 - 1 = \sum_{1 \le d < m, d|m} w(m, d) \cdot m/d$

where w(m, d) is a function of the divisor and of the field (not of E since a=0 and b=1 are fixed and the whole elliptic curve is virtually out of the picture here). As the field is entirely determined by m, w(m, d) is a function of d and m. The actual value of w(m, d) is then the number of different elements x of the field $\mathbb{F}_{2^m}$ that satisfy Tr(x) = Tr(1/x) and for which the smallest positive integer n such that x^2ⁿ = x is n = m/d. Put in a formula,

$w(m, d) = \left|\left\{x \in \mathbb{F}_{2^m} \mid \mathrm{Tr}(x)=\mathrm{Tr}(1/x) \text{ and } \min \left\{k \in \mathbb{Z}^+ \mid x^{2^k} = x \right\} = m/d \right\}\right|$

These values can be brute force calculated. Note that when m is prime then ((#E - 2)/2 - 1)/m = w(m, 1), so we replace the last column in the previous table with w(m, 1). New columns are added for each of the divisors of m. The program used to calculate this can be found in testsuite/point/bspace.cc.

Table 4.
m	(#E - 2)/2 - 1	w(m, 1)	w(m, 2)	w(m, 3)	w(m, 4)	w(m, 5)	w(m, 6)	w(m, 7)	w(m, 8)	w(m, 9)	w(m, 10)	w(m, 11)	w(m, 12)	w(m, 13)	w(m, 14)	w(m, 15)
2	2	1
3	0	0
4	6	1	1
5	20	4
6	26	3	2	1
7	56	8
8	142	16	3		1
9	252	28		0
10	482	45	6			1
11	1056	96
12	2070	167	9	1	2		1
13	4004	308
14	8234	579	18					1
15	16520	1100		4		0
16	32542	2018	30		3				1
17	65484	3852
18	131570	7280	56	3			2			1
19	261744	13776
20	523686	26133	99		6	1					1
21	1049972	49996		8				0
22	2096954	95223	186									1
23	4191704	182248
24	8391598	349474	335	16	9		3		2				1
25	16779420	671176				4
26	33546242	1289925	630											1
27	67112640	2485644		28						0
28	134230326	4793355	1161		18			1							1
29	268415300	9255700
30	536865866	17894421	2182	45		3	6				2					1
31	1073787176	34638296

And what a beautiful structure it is! This shows clearly that only w(m, 1) and w(m, 2) are significant. The value of w(m, d) with d > 2 can be directly expressed in one of the former:

$w(m, d) = \begin{cases} w(m / d, 1) & \mbox{if d is odd} \\ w(2m / d, 2) & \mbox{if d is even} \end{cases}$

After several weeks of writing down little numbers of papers, I can tell you that got very excited when I finally found the next step: A way to calculate w(m, 2)!

$w(2m, 2) = foc(m)/m$

where

$foc(m) = 2^m - \sum_{0<d<m,\ d|m} foc(d)$

For example, in the table we see that w(26, 2) = 630. This number can be expressed in m as foc(13)/13 = (2¹³ - foc(1))/13 = (8192 - 2)/13 = 630.

The name foc stands for Frobenius Order Count, as it turns out that foc(m) is the number of elements of the field $\mathbb{F}_{2^m}$ for which the smallest positive integer n such that x^2ⁿ = x is n = m.

foc(1) therefore represents the two elements of the base field { 0, 1 } whose square is equal to itself and thus never contribute to the count of elements. While if m is prime, then every other element does contribute, hence that for prime m we have 2^m - 2. If m is not prime then elements with a Frobenius multiplicity between 1 and m have to be taken into account, by subtracting them, as well.

In order to really understand the table (and the meaning of w(m,d)), lets look at each of the different contributions in turn. We'll start with the diagonal series of 1's on the right-side of the table. These 1's each have a count of 2 (m/d = 2): there are two different values of x that contribute to each of them. The reason for their existance is that, for some fields, there exists an element x such that applying Frobenius two times returns to itself (x⁴ = x). If such an element exists, then apparently all of them satisfy the equation Tr(x) = Tr(1/x), which can only be accounted for when x² = 1/x (recall that Tr(x) = Tr(x²) due to Frobenius). "Normally" an element of $\mathbb{F}_{2^2}$ is expected to return to itself after applying Frobenius two times. Lets recall that fact by working it out.

Table 5.
F_2², t²+t+1=0
x	1/x	x²	x²+x+1
0		0	0
t⁰	=	1	t⁰	=	1	1	1
t¹	=	t	t²	=	t + 1	t + 1	0
t²	=	t + 1	t¹	=	t	t	0

Where the Frobenius multiplicity of t and t+1 is 2 because squaring t gives t+1 and squaring that once more gives t again.

The elements 0 and 1 have both already been taken into account by subtracting 2 from #E (for x = 0 and the point at infinity) and subtracting 1 from (#E - 2) / 2 respectively, so we don't see any count for them back in the table with w(m, d) (table 4). I won't show x = 0 in the table below and x = 1 will be dropped further on, too.

Looking at table 4 again, the table with w(m,d), we see that this 1 occurs for every even value of m. The reason for that is that each of those fields has $\mathbb{F}_{2^2}$ as subfield, and have therefore two elements that satisfy x² + x + 1 = 0. More in general, a field $\mathbb{F}_{2^m}$ will have a subfield $\mathbb{F}_{2^n}$ if and only if n|m. As an example lets have a detailed look at the smallest field that has $\mathbb{F}_{2^2}$ as subfield, $\mathbb{F}_{2^4}$ . Lets use g as generator of the field rather than t in order not to get confused by the previously used t for the reduction polynomial of $\mathbb{F}_{2^2}$ .

Table 6.
F_2⁴, t⁴+t+1=0, g=t
x	1/x	x²	x²+x+1
g⁰	=	1	g⁰	=	1	1	1
g¹	=	g	g¹⁴	=	g³ + 1	g²	g² + g + 1
g²	=	g²	g¹³	=	g³ + g² + 1	g + 1	g² + g
g³	=	g³	g¹²	=	g³ + g² + g + 1	g³ + g²	g² + 1
g⁴	=	g+1	g¹¹	=	g³ + g² + g	g² + 1	g² + g + 1
g⁵	=	g² + g	g¹⁰	=	g² + g + 1	g² + g + 1	0
g⁶	=	g³ + g²	g⁹	=	g³ + g	g³ + g² + g + 1	g
g⁷	=	g³ + g + 1	g⁸	=	g² + 1	g³ + 1	g + 1
g⁸	=	g² + 1	g⁷	=	g³ + g + 1	g	g² + g
g⁹	=	g³ + g	g⁶	=	g³ + g²	g³	g + 1
g¹⁰	=	g² + g + 1	g⁵	=	g² + g	g² + g	0
g¹¹	=	g³ + g² + g	g⁴	=	g+1	g³ + g + 1	g²
g¹²	=	g³ + g² + g + 1	g³	=	g³	g³ + g	g²
g¹³	=	g³ + g² + 1	g²	=	g²	g³ + g² + g	g
g¹⁴	=	g³ + 1	g¹	=	g	g³ + g² + 1	g² + 1

Here I used the same color for elements in the same Frobenius equivalence class. For example, g⁶ and g⁹ are in the same Frobenius equivalence class because ((g⁶)²)² = s²⁴ = g⁹ (recall that g^{2^m} = g and thus g¹⁵ = 1).

Note that the two values (g⁵ and g¹⁰) together with g⁰ form a group under multiplication isomorphic with $\mathbb{Z}_3$ , and together with 0 they form a group under addition, so that this latter set is a subfield isomorphic with $\mathbb{F}_4$ . For our investigation only the multiplication is important, so lets look at the group $\mathbb{Z}_3$ .

Table 7.
Z₃
n	2n
0	0
1	2
2	1

As mentioned before, a field $\mathbb{F}_{p^m}$ will only contain a subfield of the form $\mathbb{F}_{p^n}$ if n|m (so that (pⁿ - 1) divides (p^m - 1), giving a subgroup under multiplication with size (p^m - 1) / (pⁿ - 1) = p^m/n + 1). Therefore, every field with even m has a subgroup under multiplication isomorphic with $\mathbb{Z}_3$ that gives rise to the same number of solutions as does its subfield $\mathbb{F}_{2^2}$ . This is what caused the diagonal of 1's in the table for w(m, m/2).

Now lets have a look at the next diagonal, the alternating 2's and 0's, in particular the 2's thereof. These are the contributions w(m, m/3) and in particular when m is even. The smallest subfield that we can investigate that has this structure is with m = 6 and thus d = m/3 = 2. The following table was generated with testsuite/point/bspacetables2.cc.

Table 8.
F_2⁶, t⁶+t+1=0
x = gⁿ	GCD(n, 63)	1/x	Tr(x)	Tr(1/x)	d	x²+x+1	x³+x+1
g¹	=	t	1	g⁶²	=	t⁵+1	0	1	1	t²+t+1	t³+t+1
g²	=	t²	1	g⁶¹	=	t⁵+t⁴+1	0	1	1	t⁴+t²+1	t²+t
g³	=	t³	3	g⁶⁰	=	t⁵+t⁴+t³+1	0	1	1	t³+t	t⁴+1
g⁴	=	t⁴	1	g⁵⁹	=	t⁵+t⁴+t³+t²+1	0	1	1	t⁴+t³+t²+1	t⁴+t²
g⁵	=	t⁵	1	g⁵⁸	=	t⁵+t⁴+t³+t²+t+1	1	1	1	t⁴+1	t³+1
g⁶	=	t+1	3	g⁵⁷	=	t⁵+t⁴+t³+t²+t	0	1	1	t²+t+1	t³+t²+1
g⁷	=	t²+t	7	g⁵⁶	=	t⁴+t³+t²+t+1	0	0	1	t⁴+t+1	t⁵+t⁴+t³+t²
g⁸	=	t³+t²	1	g⁵⁵	=	t⁵+t³+t²+t	0	1	1	t⁴+t³+t²+t	t⁴+t³+t²
g⁹	=	t⁴+t³	9	g⁵⁴	=	t⁴+t²+t+1	0	0	2	t⁴+t²+t	t⁴+t²+t+1
g¹⁰	=	t⁵+t⁴	1	g⁵³	=	t⁵+t³+t	1	1	1	t³+t²+1	t
g¹¹	=	t⁵+t+1	1	g⁵²	=	t⁴+t²+1	1	0	1	t⁴+t²+t+1	t⁵+t⁴
g¹²	=	t²+1	3	g⁵¹	=	t⁵+t³+t+1	0	1	1	t⁴+t²+1	t⁴+t
g¹³	=	t³+t	1	g⁵⁰	=	t⁵+t⁴+t²	0	1	1	t³+t²	t⁵+t⁴+t³+t²+1
g¹⁴	=	t⁴+t²	7	g⁴⁹	=	t⁴+t³+t	0	0	1	t³+1	t⁵+t³+t²+t+1
g¹⁵	=	t⁵+t³	3	g⁴⁸	=	t³+t²+1	1	0	1	t⁴+t³+t	t⁵+t⁴
g¹⁶	=	t⁴+t+1	1	g⁴⁷	=	t⁵+t²+t+1	0	1	1	t⁴+t³+t+1	t⁴+t³+t²+t+1
g¹⁷	=	t⁵+t²+t	1	g⁴⁶	=	t⁵+t⁴+t	1	1	1	t+1	t³+t²
g¹⁸	=	t³+t²+t+1	9	g⁴⁵	=	t⁴+t³+1	0	0	2	t⁴+t³	t⁴+t³+1
g¹⁹	=	t⁴+t³+t²+t	1	g⁴⁴	=	t⁵+t³+t²+1	0	1	1	t²	t⁵+1
g²⁰	=	t⁵+t⁴+t³+t²	1	g⁴³	=	t⁵+t⁴+t²+t+1	1	1	1	t⁴+t	t²
g²¹	=	t⁵+t⁴+t³+t+1	21	g⁴²	=	t⁵+t⁴+t³+t	1	1	3	0	t⁵+t⁴+t³+t+1
g²²	=	t⁵+t⁴+t²+1	1	g⁴¹	=	t⁴+t³+t²+1	1	0	1	t⁴+t³+1	t⁵+t⁴+t³+t²
g²³	=	t⁵+t³+1	1	g⁴⁰	=	t⁵+t³+t²+t+1	1	1	1	t⁴+t³+t	t⁵+t³+t+1
g²⁴	=	t⁴+1	3	g³⁹	=	t⁵+t⁴+t²+t	0	1	1	t⁴+t³+t²+1	t³
g²⁵	=	t⁵+t	1	g³⁸	=	t⁴+t³+t+1	1	0	1	t⁴+t²+t+1	t⁵+t²+t
g²⁶	=	t²+t+1	1	g³⁷	=	t⁵+t³+t²	0	1	1	t⁴+t+1	t⁵+t³+t²+t
g²⁷	=	t³+t²+t	9	g³⁶	=	t⁴+t²+t	0	0	2	t⁴+t³	0
g²⁸	=	t⁴+t³+t²	7	g³⁵	=	t³+t+1	0	0	1	t	t⁵+t²+t
g²⁹	=	t⁵+t⁴+t³	1	g³⁴	=	t⁵+t²	1	1	1	t²+t	t⁵+t³
g³⁰	=	t⁵+t⁴+t+1	3	g³³	=	t⁴+t	1	0	1	t³+t+1	t⁵+t⁴+t³+t²
g³¹	=	t⁵+t²+1	1	g³²	=	t³+1	1	0	1	t²+1	t⁴+t²+t+1
g³²	=	t³+1	1	g³¹	=	t⁵+t²+1	0	1	1	t³+t	t⁴+t³+t
g³³	=	t⁴+t	3	g³⁰	=	t⁵+t⁴+t+1	0	1	1	t⁴+t³+t+1	t²+1
g³⁴	=	t⁵+t²	1	g²⁹	=	t⁵+t⁴+t³	1	1	1	t²+1	t⁴+t+1
g³⁵	=	t³+t+1	7	g²⁸	=	t⁴+t³+t²	0	0	1	t³+t²	t⁵+t⁴
g³⁶	=	t⁴+t²+t	9	g²⁷	=	t³+t²+t	0	0	2	t³+t²+t+1	t³+t²+t
g³⁷	=	t⁵+t³+t²	1	g²⁶	=	t²+t+1	1	0	1	t³+t²+t	t⁵
g³⁸	=	t⁴+t³+t+1	1	g²⁵	=	t⁵+t	0	1	1	t⁴	t⁵+t⁴+1
g³⁹	=	t⁵+t⁴+t²+t	3	g²⁴	=	t⁴+1	1	0	1	t⁴+t³+t²+t+1	t⁵
g⁴⁰	=	t⁵+t³+t²+t+1	1	g²³	=	t⁵+t³+1	1	1	1	t³	t⁴
g⁴¹	=	t⁴+t³+t²+1	1	g²²	=	t⁵+t⁴+t²+1	0	1	1	t	t⁵+t²+1
g⁴²	=	t⁵+t⁴+t³+t	21	g²¹	=	t⁵+t⁴+t³+t+1	1	1	3	0	t⁵+t⁴+t³+t
g⁴³	=	t⁵+t⁴+t²+t+1	1	g²⁰	=	t⁵+t⁴+t³+t²	1	1	1	t⁴+t³+t²+t+1	t⁵+t⁴+t³+t²+t
g⁴⁴	=	t⁵+t³+t²+1	1	g¹⁹	=	t⁴+t³+t²+t	1	0	1	t³+t²+t	t⁵+t³+t²+t+1
g⁴⁵	=	t⁴+t³+1	9	g¹⁸	=	t³+t²+t+1	0	0	2	t⁴+t²+t	0
g⁴⁶	=	t⁵+t⁴+t	1	g¹⁷	=	t⁵+t²+t	1	1	1	t³+t+1	t⁵+t⁴+t²+t
g⁴⁷	=	t⁵+t²+t+1	1	g¹⁶	=	t⁴+t+1	1	0	1	t+1	t³+t²+t
g⁴⁸	=	t³+t²+1	3	g¹⁵	=	t⁵+t³	0	1	1	t⁴+t³+t²+t	t+1
g⁴⁹	=	t⁴+t³+t	7	g¹⁴	=	t⁴+t²	0	0	1	t⁴	t⁵
g⁵⁰	=	t⁵+t⁴+t²	1	g¹³	=	t³+t	1	0	1	t⁴+t³+1	t⁵+t²
g⁵¹	=	t⁵+t³+t+1	3	g¹²	=	t²+1	1	0	1	t⁴+t³+t²	t⁵+t²
g⁵²	=	t⁴+t²+1	1	g¹¹	=	t⁵+t+1	0	1	1	t³+1	t⁵+t²+t+1
g⁵³	=	t⁵+t³+t	1	g¹⁰	=	t⁵+t⁴	1	1	1	t⁴+t³+t²	t⁵+t⁴+t³+1
g⁵⁴	=	t⁴+t²+t+1	9	g⁹	=	t⁴+t³	0	0	2	t³+t²+t+1	0
g⁵⁵	=	t⁵+t³+t²+t	1	g⁸	=	t³+t²	1	0	1	t³	t⁴+t³+1
g⁵⁶	=	t⁴+t³+t²+t+1	7	g⁷	=	t²+t	0	0	1	t²	t⁵+t²
g⁵⁷	=	t⁵+t⁴+t³+t²+t	3	g⁶	=	t+1	1	0	1	t⁴+t²	t⁵+t²+t
g⁵⁸	=	t⁵+t⁴+t³+t²+t+1	1	g⁵	=	t⁵	1	1	1	t⁴+t²	t⁵+t⁴+t+1
g⁵⁹	=	t⁵+t⁴+t³+t²+1	1	g⁴	=	t⁴	1	0	1	t⁴+t	t⁴+t²+t+1
g⁶⁰	=	t⁵+t⁴+t³+1	3	g³	=	t³	1	0	1	t²+t	t⁵+t³+t²+t+1
g⁶¹	=	t⁵+t⁴+1	1	g²	=	t²	1	0	1	t³+t²+1	t³+t²+t
g⁶²	=	t⁵+1	1	g¹	=	t	1	0	1	t⁴+1	t⁴+t³+1

Here we see again the two elements that give rise to the w(6,3) as g²¹ and g⁴². Together with 1 they form the multiplicative subgroup GF(2²)^* as can be seen from the fact that x²+x+1 in the second column from the right is zero. Likewise, the third column contains zeroes for the roots of x³+x+1: g²⁷, g⁴⁵ and g⁵⁴ which are thus, elements of the multiplicative group GF(2³)^*. The remaining elements of that group, besides the multiplicative unity, are g⁹, g¹⁸ and g³⁶. At this point I have no idea if it's a coincidence that those are precisely the inverse of first three (this could be because there simply are no other elements with GCD(n, 63) of 9). Note that GF(2³)^* is isomorphic with $\mathbb{Z}_7$ :

Table 9.
Z₇
n	6n
0	0
1	6
2	5
3	4
4	3
5	2
6	1

In this case we have two different colors (two Frobenius equivalence classes) and thus w(6, 2) = 2.

Looking at F_2⁶ again, we only see one other (besides { g²¹, g⁴² }}) Frobenius equivalence class that automatically adds to the count of solutions in the form of the elements { t⁷, t¹⁴, t²⁸, t³⁵, t⁴⁹, t⁵⁶ }, because their inverses are in the same Frobenius equivalence class. These elements added one to the value of w(6,1) because there are six of them (d = 1).

What exactly is the structure that gives rise to these six elements? As you can see, they are not part of a subfield of $\mathbb{F}_{2^6}$ ( $\mathbb{F}_{2^2}$ and $\mathbb{F}_{2^3}$ ): neither of the two right-most columns is zero for these elements.

The magic lies in the fact that each element can be paired up with another element from the same Frobenius equivalence class, such that if x is in this class then so is 1/x. The factor 7 is an arbitrary residue factor so lets start with deviding that away. Much in the same way as we did get $\mathbb{Z}_7$ before, now we get $\mathbb{Z}_9$ . The elements we have are the set $S = \{ 1, 2, 4, 8, 16-9 = 7, 32-27 = 5 \} = \{ 2^i \pmod{9} \mid i \in \mathbb{N} \}$ which is a direct result of the fact that we repeatedly applied Frobenius: each time the exponents of t are doubled.

The puzzle that we have to solve therefore is this: Let G = Z/nZ, S={2ⁱ}, when will S be even and for each x in S there will be a y in S such that x+y = 0 (mod n)?

I had two mathematicians look at that, and after two hours of trying and discussion, they came up with the following. If there exists a k such that 2^k + 1 = 0 (mod n), then let k be the least positive such, then S = { 2⁰, 2¹, ..., 2^(2k-1)} since 2^2k = 1 (mod n), thus S = 2k is even, and 2ⁱ + 2^k+i = 2ⁱ + (-1) $\cdot$ 2ⁱ = 0 (mod n), i.e. all elements are paired up. Let 2ⁱ = x in S then there exists a y in S such that x + y = 0 (mod n) thus 2ⁱ + 2^k $\cdot$ 2ⁱ = 0 (mod n), thus 2^k $\cdot$ 2ⁱ = (-1) $\cdot$ 2ⁱ (mod n), which shows that this is the only possibility. $\qed$

The restriction on the factor (n) is therefore that there has to exist a k such that 2^k + 1 = 0 (mod n).

And indeed, 9 = 2³ + 1, where the exponent k = 3 gives rise to 2k = 6 elements in the Frobenius equivalence class of w(m, m/6). Moreover, 3 = 2¹ + 1, where the exponent k = 1 gives rise to 2k = 2 elements in the Frobenius equivalence class of w(m, m/2). This does not happen for every m however, but only for those m where 2^m - 1 has a factor n such that there exists a positive k such that 2^k + 1 = 0 (mod n).

Lets start using m/d rather than d, because it is m/d that is constant along of the diagonals in table 4. For the same reason, show (2^m - 1) / gcd(2^m - 1, n) instead of gcd(2^m - 1, n).

The same structures return for larger m if it is a multiple of 6. Consider these tables for m = 6, 12, 18, 24:

Table 10-a.
F_2⁶, t⁶+t+1=0
x = gⁿ	63/GCD(n, 63)	1/x	Tr(x)	Tr(1/x)	m/d	x²+x+1	x³+x+1
g⁹	=	t⁴+t³	7	g⁵⁴	=	t⁴+t²+t+1	0	0	3	t⁴+t²+t	t⁴+t²+t+1
g¹⁸	=	t³+t²+t+1	7	g⁴⁵	=	t⁴+t³+1	0	0	3	t⁴+t³	t⁴+t³+1
g²¹	=	t⁵+t⁴+t³+t+1	3	g⁴²	=	t⁵+t⁴+t³+t	1	1	2	0	t⁵+t⁴+t³+t+1
g²⁷	=	t³+t²+t	7	g³⁶	=	t⁴+t²+t	0	0	3	t⁴+t³	0
g³⁶	=	t⁴+t²+t	7	g²⁷	=	t³+t²+t	0	0	3	t³+t²+t+1	t³+t²+t
g⁴²	=	t⁵+t⁴+t³+t	3	g²¹	=	t⁵+t⁴+t³+t+1	1	1	2	0	t⁵+t⁴+t³+t
g⁴⁵	=	t⁴+t³+1	7	g¹⁸	=	t³+t²+t+1	0	0	3	t⁴+t²+t	0
g⁵⁴	=	t⁴+t²+t+1	7	g⁹	=	t⁴+t³	0	0	3	t³+t²+t+1	0

Table 10-b.
F_2¹², t¹²+t³+1=0
x = gⁿ	4095/GCD(n, 4095)	1/x	Tr(x)	Tr(1/x)	m/d	x²+x+1	x³+x+1
g⁵⁸⁵	=	t¹⁰+t⁷+t⁵+t+1	7	g³⁵¹⁰	=	t¹¹+t⁸+t⁷+t	0	0	3	t¹¹+t⁸+t⁷+t+1	t¹¹+t⁸+t⁷+t
g¹¹⁷⁰	=	t¹¹+t¹⁰+t⁸+t⁵+1	7	g²⁹²⁵	=	t¹⁰+t⁷+t⁵+t	0	0	3	t¹⁰+t⁷+t⁵+t+1	t¹⁰+t⁷+t⁵+t
g¹³⁶⁵	=	t⁶+t³	3	g²⁷³⁰	=	t⁶+t³+1	0	0	2	0	t⁶+t³
g¹⁷⁵⁵	=	t¹¹+t¹⁰+t⁸+t⁵	7	g²³⁴⁰	=	t¹¹+t⁸+t⁷+t+1	0	0	3	t¹⁰+t⁷+t⁵+t+1	0
g²³⁴⁰	=	t¹¹+t⁸+t⁷+t+1	7	g¹⁷⁵⁵	=	t¹¹+t¹⁰+t⁸+t⁵	0	0	3	t¹¹+t¹⁰+t⁸+t⁵+1	t¹¹+t¹⁰+t⁸+t⁵
g²⁷³⁰	=	t⁶+t³+1	3	g¹³⁶⁵	=	t⁶+t³	0	0	2	0	t⁶+t³+1
g²⁹²⁵	=	t¹⁰+t⁷+t⁵+t	7	g¹¹⁷⁰	=	t¹¹+t¹⁰+t⁸+t⁵+1	0	0	3	t¹¹+t⁸+t⁷+t+1	0
g³⁵¹⁰	=	t¹¹+t⁸+t⁷+t	7	g⁵⁸⁵	=	t¹⁰+t⁷+t⁵+t+1	0	0	3	t¹¹+t¹⁰+t⁸+t⁵+1	0

Table 10-c.
F_2¹⁸, t¹⁸+t³+1=0
x = gⁿ	262143/GCD(n, 262143)	1/x	Tr(x)	Tr(1/x)	m/d	x²+x+1	x³+x+1
g³⁷⁴⁴⁹	=	t¹²+t⁶+t³+1	7	g²²⁴⁶⁹⁴	=	t¹²+t⁹	0	0	3	t⁹+t⁶+t³+1	0
g⁷⁴⁸⁹⁸	=	t¹²+t⁹+1	7	g¹⁸⁷²⁴⁵	=	t⁹+t⁶+t³+1	0	0	3	t¹²+t⁶+t³	0
g⁸⁷³⁸¹	=	t¹⁵+t¹²+t⁹+t³+1	3	g¹⁷⁴⁷⁶²	=	t¹⁵+t¹²+t⁹+t³	1	1	2	0	t¹⁵+t¹²+t⁹+t³+1
g¹¹²³⁴⁷	=	t¹²+t⁶+t³	7	g¹⁴⁹⁷⁹⁶	=	t⁹+t⁶+t³	0	0	3	t⁹+t⁶+t³+1	t⁹+t⁶+t³
g¹⁴⁹⁷⁹⁶	=	t⁹+t⁶+t³	7	g¹¹²³⁴⁷	=	t¹²+t⁶+t³	0	0	3	t¹²+t⁹	0
g¹⁷⁴⁷⁶²	=	t¹⁵+t¹²+t⁹+t³	3	g⁸⁷³⁸¹	=	t¹⁵+t¹²+t⁹+t³+1	1	1	2	0	t¹⁵+t¹²+t⁹+t³
g¹⁸⁷²⁴⁵	=	t⁹+t⁶+t³+1	7	g⁷⁴⁸⁹⁸	=	t¹²+t⁹+1	0	0	3	t¹²+t⁹	t¹²+t⁹+1
g²²⁴⁶⁹⁴	=	t¹²+t⁹	7	g³⁷⁴⁴⁹	=	t¹²+t⁶+t³+1	0	0	3	t¹²+t⁶+t³	t¹²+t⁶+t³+1

Table 10-d.
F_2²⁴, t²⁴+t⁴+t³+t+1=0
x = gⁿ	16777215/GCD(n, 16777215)	1/x	Tr(x)	Tr(1/x)	m/d	x²+x+1	x³+x+1
g^2396745	=	t¹⁵+t¹⁴+t¹³+t⁹+t⁷+t⁵+t³+t²+1	7	g^14380470	=	t¹⁸+t¹⁵+t¹³+t⁸+t⁷+t⁶+t⁵	0	0	3	t¹⁸+t¹⁵+t¹³+t⁸+t⁷+t⁶+t⁵+1	t¹⁸+t¹⁵+t¹³+t⁸+t⁷+t⁶+t⁵
g^4793490	=	t¹⁸+t¹⁴+t⁹+t⁸+t⁶+t³+t²+1	7	g^11983725	=	t¹⁵+t¹⁴+t¹³+t⁹+t⁷+t⁵+t³+t²	0	0	3	t¹⁵+t¹⁴+t¹³+t⁹+t⁷+t⁵+t³+t²+1	t¹⁵+t¹⁴+t¹³+t⁹+t⁷+t⁵+t³+t²
g^5592405	=	t¹²+t⁶+t³+t²+t	3	g^11184810	=	t¹²+t⁶+t³+t²+t+1	0	0	2	0	t¹²+t⁶+t³+t²+t
g^7190235	=	t¹⁸+t¹⁴+t⁹+t⁸+t⁶+t³+t²	7	g^9586980	=	t¹⁸+t¹⁵+t¹³+t⁸+t⁷+t⁶+t⁵+1	0	0	3	t¹⁵+t¹⁴+t¹³+t⁹+t⁷+t⁵+t³+t²+1	0
g^9586980	=	t¹⁸+t¹⁵+t¹³+t⁸+t⁷+t⁶+t⁵+1	7	g^7190235	=	t¹⁸+t¹⁴+t⁹+t⁸+t⁶+t³+t²	0	0	3	t¹⁸+t¹⁴+t⁹+t⁸+t⁶+t³+t²+1	t¹⁸+t¹⁴+t⁹+t⁸+t⁶+t³+t²
g^11184810	=	t¹²+t⁶+t³+t²+t+1	3	g^5592405	=	t¹²+t⁶+t³+t²+t	0	0	2	0	t¹²+t⁶+t³+t²+t+1
g^11983725	=	t¹⁵+t¹⁴+t¹³+t⁹+t⁷+t⁵+t³+t²	7	g^4793490	=	t¹⁸+t¹⁴+t⁹+t⁸+t⁶+t³+t²+1	0	0	3	t¹⁸+t¹⁵+t¹³+t⁸+t⁷+t⁶+t⁵+1	0
g^14380470	=	t¹⁸+t¹⁵+t¹³+t⁸+t⁷+t⁶+t⁵	7	g^2396745	=	t¹⁵+t¹⁴+t¹³+t⁹+t⁷+t⁵+t³+t²+1	0	0	3	t¹⁸+t¹⁴+t⁹+t⁸+t⁶+t³+t²+1	0

showing all the elements that contribute to w(m, m/2) and w(m, m/3), namely one Frobenius equivalence class for m/2, and two Frobenius equivalence classes for m/3. If m is an odd multiple of 3, the same two Frobenius equivalence classes still exist, but they are not a solution of the Elliptic Curve (Tr(x) $\neq$ Tr(1/x)):

Table 11-a.
F_2³, t³+t+1=0
x = gⁿ	7/GCD(n, 7)	1/x	Tr(x)	Tr(1/x)	m/d	x²+x+1	x³+x+1
g¹	=	t	7	g⁶	=	t²+1	0	1	3	t²+t+1	0
g²	=	t²	7	g⁵	=	t²+t+1	0	1	3	t+1	0
g³	=	t+1	7	g⁴	=	t²+t	1	0	3	t²+t+1	t²+t
g⁴	=	t²+t	7	g³	=	t+1	0	1	3	t²+1	0
g⁵	=	t²+t+1	7	g²	=	t²	1	0	3	t²+1	t²
g⁶	=	t²+1	7	g¹	=	t	1	0	3	t+1	t

Table 11-b.
F_2⁹, t⁹+t+1=0
x = gⁿ	511/GCD(n, 511)	1/x	Tr(x)	Tr(1/x)	m/d	x²+x+1	x³+x+1
g⁷³	=	t⁸+t⁷+t⁶+t⁴+t+1	7	g⁴³⁸	=	t⁸+t⁵+t³+t²+t	1	0	3	t⁸+t⁵+t³+t²+t+1	t⁸+t⁵+t³+t²+t
g¹⁴⁶	=	t⁷+t⁶+t⁵+t⁴+t³+t²+1	7	g³⁶⁵	=	t⁸+t⁷+t⁶+t⁴+t	1	0	3	t⁸+t⁷+t⁶+t⁴+t+1	t⁸+t⁷+t⁶+t⁴+t
g²¹⁹	=	t⁷+t⁶+t⁵+t⁴+t³+t²	7	g²⁹²	=	t⁸+t⁵+t³+t²+t+1	0	1	3	t⁸+t⁷+t⁶+t⁴+t+1	0
g²⁹²	=	t⁸+t⁵+t³+t²+t+1	7	g²¹⁹	=	t⁷+t⁶+t⁵+t⁴+t³+t²	1	0	3	t⁷+t⁶+t⁵+t⁴+t³+t²+1	t⁷+t⁶+t⁵+t⁴+t³+t²
g³⁶⁵	=	t⁸+t⁷+t⁶+t⁴+t	7	g¹⁴⁶	=	t⁷+t⁶+t⁵+t⁴+t³+t²+1	0	1	3	t⁸+t⁵+t³+t²+t+1	0
g⁴³⁸	=	t⁸+t⁵+t³+t²+t	7	g⁷³	=	t⁸+t⁷+t⁶+t⁴+t+1	0	1	3	t⁷+t⁶+t⁵+t⁴+t³+t²+1	0

Table 11-c.
F_2¹⁵, t¹⁵+t+1=0
x = gⁿ	32767/GCD(n, 32767)	1/x	Tr(x)	Tr(1/x)	m/d	x²+x+1	x³+x+1
g⁴⁶⁸¹	=	t¹²+t¹⁰+t⁹+t⁵+t⁴+t	7	g²⁸⁰⁸⁶	=	t⁹+t⁸+t⁶+t⁵+t⁴+t³+t²+1	0	1	3	t¹²+t¹⁰+t⁸+t⁶+t³+t²+t+1	0
g⁹³⁶²	=	t⁹+t⁸+t⁶+t⁵+t⁴+t³+t²	7	g²³⁴⁰⁵	=	t¹²+t¹⁰+t⁸+t⁶+t³+t²+t+1	0	1	3	t¹²+t¹⁰+t⁹+t⁵+t⁴+t+1	0
g¹⁴⁰⁴³	=	t¹²+t¹⁰+t⁹+t⁵+t⁴+t+1	7	g¹⁸⁷²⁴	=	t¹²+t¹⁰+t⁸+t⁶+t³+t²+t	1	0	3	t¹²+t¹⁰+t⁸+t⁶+t³+t²+t+1	t¹²+t¹⁰+t⁸+t⁶+t³+t²+t
g¹⁸⁷²⁴	=	t¹²+t¹⁰+t⁸+t⁶+t³+t²+t	7	g¹⁴⁰⁴³	=	t¹²+t¹⁰+t⁹+t⁵+t⁴+t+1	0	1	3	t⁹+t⁸+t⁶+t⁵+t⁴+t³+t²+1	0
g²³⁴⁰⁵	=	t¹²+t¹⁰+t⁸+t⁶+t³+t²+t+1	7	g⁹³⁶²	=	t⁹+t⁸+t⁶+t⁵+t⁴+t³+t²	1	0	3	t⁹+t⁸+t⁶+t⁵+t⁴+t³+t²+1	t⁹+t⁸+t⁶+t⁵+t⁴+t³+t²
g²⁸⁰⁸⁶	=	t⁹+t⁸+t⁶+t⁵+t⁴+t³+t²+1	7	g⁴⁶⁸¹	=	t¹²+t¹⁰+t⁹+t⁵+t⁴+t	1	0	3	t¹²+t¹⁰+t⁹+t⁵+t⁴+t+1	t¹²+t¹⁰+t⁹+t⁵+t⁴+t

The following is a discussion of the data on this page.

It is not a coincidence that every time this shows alternating a table where every entry is a solution of the elliptic curve. For those tables where m / (m/d) is even, in other words, showing the elements that contribute to even d. We saw already before that those values, the values of w(m, 2), can be easily calculated.

Recall that,

$Tr(x) = \sum_{i=0}^{m-1}{x^{2^i}}$

In this case we have x = gⁿ such that (gⁿ)^{2^m/d} = gⁿ (= (gⁿ)^2⁰), and thus,

$Tr(x) = \sum_{i=0}^{m-1}{(g^n)^{2^i}} = \sum_{i=0}^{m-1}{(g^n)^{2^{(i\textrm{ mod }(m/d))}}} = d \sum_{i=0}^{m/d-1}{(g^n)^{2^i}} = 0$

where the last equation holds because d is even. Likewise Tr(1/x) = 0 and thus all values are a solution of the Elliptic curve.

Instead we need to concentrate on the other values, the odd values of d, and because the structures are 100% equivalent, it is also not needed to look at large m, the smallest with d = 1 will do, because the rest is trivially deducable.

Those elements are:

Table 15-a.
F_2³, t³+t+1=0
x = gⁿ	7/GCD(n, 7)	1/x	Tr(x)	Tr(1/x)	m/d
g¹	=	t	7	g⁶	=	t²+1	0	1	3
g²	=	t²	7	g⁵	=	t²+t+1	0	1	3
g³	=	t+1	7	g⁴	=	t²+t	1	0	3
g⁴	=	t²+t	7	g³	=	t+1	0	1	3
g⁵	=	t²+t+1	7	g²	=	t²	1	0	3
g⁶	=	t²+1	7	g¹	=	t	1	0	3

Table 15-b.
F_2⁴, t⁴+t+1=0
x = gⁿ	15/GCD(n, 15)	1/x	Tr(x)	Tr(1/x)	m/d
g¹	=	t	15	g¹⁴	=	t³+1	0	1	4
g²	=	t²	15	g¹³	=	t³+t²+1	0	1	4
g³	=	t³	5	g¹²	=	t³+t²+t+1	1	1	4
g⁴	=	t+1	15	g¹¹	=	t³+t²+t	0	1	4
g⁶	=	t³+t²	5	g⁹	=	t³+t	1	1	4
g⁷	=	t³+t+1	15	g⁸	=	t²+1	1	0	4
g⁸	=	t²+1	15	g⁷	=	t³+t+1	0	1	4
g⁹	=	t³+t	5	g⁶	=	t³+t²	1	1	4
g¹¹	=	t³+t²+t	15	g⁴	=	t+1	1	0	4
g¹²	=	t³+t²+t+1	5	g³	=	t³	1	1	4
g¹³	=	t³+t²+1	15	g²	=	t²	1	0	4
g¹⁴	=	t³+1	15	g¹	=	t	1	0	4

Table 15-c.
F_2⁵, t⁵+t²+1=0
x = gⁿ	31/GCD(n, 31)	1/x	Tr(x)	Tr(1/x)	m/d
g¹	=	t	31	g³⁰	=	t⁴+t	0	0	5
g²	=	t²	31	g²⁹	=	t³+1	0	0	5
g³	=	t³	31	g²⁸	=	t⁴+t²+t	1	0	5
g⁴	=	t⁴	31	g²⁷	=	t³+t+1	0	0	5
g⁵	=	t²+1	31	g²⁶	=	t⁴+t²+t+1	1	1	5
g⁶	=	t³+t	31	g²⁵	=	t⁴+t³+1	1	0	5
g⁷	=	t⁴+t²	31	g²⁴	=	t⁴+t³+t²+t	0	1	5
g⁸	=	t³+t²+1	31	g²³	=	t³+t²+t+1	0	0	5
g⁹	=	t⁴+t³+t	31	g²²	=	t⁴+t²+1	1	1	5
g¹⁰	=	t⁴+1	31	g²¹	=	t⁴+t³	1	1	5
g¹¹	=	t²+t+1	31	g²⁰	=	t³+t²	1	1	5
g¹²	=	t³+t²+t	31	g¹⁹	=	t²+t	1	0	5
g¹³	=	t⁴+t³+t²	31	g¹⁸	=	t+1	1	1	5
g¹⁴	=	t⁴+t³+t²+1	31	g¹⁷	=	t⁴+t+1	0	1	5
g¹⁵	=	t⁴+t³+t²+t+1	31	g¹⁶	=	t⁴+t³+t+1	0	0	5
g¹⁶	=	t⁴+t³+t+1	31	g¹⁵	=	t⁴+t³+t²+t+1	0	0	5
g¹⁷	=	t⁴+t+1	31	g¹⁴	=	t⁴+t³+t²+1	1	0	5
g¹⁸	=	t+1	31	g¹³	=	t⁴+t³+t²	1	1	5
g¹⁹	=	t²+t	31	g¹²	=	t³+t²+t	0	1	5
g²⁰	=	t³+t²	31	g¹¹	=	t²+t+1	1	1	5
g²¹	=	t⁴+t³	31	g¹⁰	=	t⁴+1	1	1	5
g²²	=	t⁴+t²+1	31	g⁹	=	t⁴+t³+t	1	1	5
g²³	=	t³+t²+t+1	31	g⁸	=	t³+t²+1	0	0	5
g²⁴	=	t⁴+t³+t²+t	31	g⁷	=	t⁴+t²	1	0	5
g²⁵	=	t⁴+t³+1	31	g⁶	=	t³+t	0	1	5
g²⁶	=	t⁴+t²+t+1	31	g⁵	=	t²+1	1	1	5
g²⁷	=	t³+t+1	31	g⁴	=	t⁴	0	0	5
g²⁸	=	t⁴+t²+t	31	g³	=	t³	0	1	5
g²⁹	=	t³+1	31	g²	=	t²	0	0	5
g³⁰	=	t⁴+t	31	g¹	=	t	0	0	5

Table 15-d.
F_2⁶, t⁶+t+1=0
x = gⁿ	63/GCD(n, 63)	1/x	Tr(x)	Tr(1/x)	m/d
g¹	=	t	63	g⁶²	=	t⁵+1	0	1	6
g²	=	t²	63	g⁶¹	=	t⁵+t⁴+1	0	1	6
g³	=	t³	21	g⁶⁰	=	t⁵+t⁴+t³+1	0	1	6
g⁴	=	t⁴	63	g⁵⁹	=	t⁵+t⁴+t³+t²+1	0	1	6
g⁵	=	t⁵	63	g⁵⁸	=	t⁵+t⁴+t³+t²+t+1	1	1	6
g⁶	=	t+1	21	g⁵⁷	=	t⁵+t⁴+t³+t²+t	0	1	6
g⁷	=	t²+t	9	g⁵⁶	=	t⁴+t³+t²+t+1	0	0	6
g⁸	=	t³+t²	63	g⁵⁵	=	t⁵+t³+t²+t	0	1	6
g¹⁰	=	t⁵+t⁴	63	g⁵³	=	t⁵+t³+t	1	1	6
g¹¹	=	t⁵+t+1	63	g⁵²	=	t⁴+t²+1	1	0	6
g¹²	=	t²+1	21	g⁵¹	=	t⁵+t³+t+1	0	1	6
g¹³	=	t³+t	63	g⁵⁰	=	t⁵+t⁴+t²	0	1	6
g¹⁴	=	t⁴+t²	9	g⁴⁹	=	t⁴+t³+t	0	0	6
g¹⁵	=	t⁵+t³	21	g⁴⁸	=	t³+t²+1	1	0	6
g¹⁶	=	t⁴+t+1	63	g⁴⁷	=	t⁵+t²+t+1	0	1	6
g¹⁷	=	t⁵+t²+t	63	g⁴⁶	=	t⁵+t⁴+t	1	1	6
g¹⁹	=	t⁴+t³+t²+t	63	g⁴⁴	=	t⁵+t³+t²+1	0	1	6
g²⁰	=	t⁵+t⁴+t³+t²	63	g⁴³	=	t⁵+t⁴+t²+t+1	1	1	6
g²²	=	t⁵+t⁴+t²+1	63	g⁴¹	=	t⁴+t³+t²+1	1	0	6
g²³	=	t⁵+t³+1	63	g⁴⁰	=	t⁵+t³+t²+t+1	1	1	6
g²⁴	=	t⁴+1	21	g³⁹	=	t⁵+t⁴+t²+t	0	1	6
g²⁵	=	t⁵+t	63	g³⁸	=	t⁴+t³+t+1	1	0	6
g²⁶	=	t²+t+1	63	g³⁷	=	t⁵+t³+t²	0	1	6
g²⁸	=	t⁴+t³+t²	9	g³⁵	=	t³+t+1	0	0	6
g²⁹	=	t⁵+t⁴+t³	63	g³⁴	=	t⁵+t²	1	1	6
g³⁰	=	t⁵+t⁴+t+1	21	g³³	=	t⁴+t	1	0	6
g³¹	=	t⁵+t²+1	63	g³²	=	t³+1	1	0	6
g³²	=	t³+1	63	g³¹	=	t⁵+t²+1	0	1	6
g³³	=	t⁴+t	21	g³⁰	=	t⁵+t⁴+t+1	0	1	6
g³⁴	=	t⁵+t²	63	g²⁹	=	t⁵+t⁴+t³	1	1	6
g³⁵	=	t³+t+1	9	g²⁸	=	t⁴+t³+t²	0	0	6
g³⁷	=	t⁵+t³+t²	63	g²⁶	=	t²+t+1	1	0	6
g³⁸	=	t⁴+t³+t+1	63	g²⁵	=	t⁵+t	0	1	6
g³⁹	=	t⁵+t⁴+t²+t	21	g²⁴	=	t⁴+1	1	0	6
g⁴⁰	=	t⁵+t³+t²+t+1	63	g²³	=	t⁵+t³+1	1	1	6
g⁴¹	=	t⁴+t³+t²+1	63	g²²	=	t⁵+t⁴+t²+1	0	1	6
g⁴³	=	t⁵+t⁴+t²+t+1	63	g²⁰	=	t⁵+t⁴+t³+t²	1	1	6
g⁴⁴	=	t⁵+t³+t²+1	63	g¹⁹	=	t⁴+t³+t²+t	1	0	6
g⁴⁶	=	t⁵+t⁴+t	63	g¹⁷	=	t⁵+t²+t	1	1	6
g⁴⁷	=	t⁵+t²+t+1	63	g¹⁶	=	t⁴+t+1	1	0	6
g⁴⁸	=	t³+t²+1	21	g¹⁵	=	t⁵+t³	0	1	6
g⁴⁹	=	t⁴+t³+t	9	g¹⁴	=	t⁴+t²	0	0	6
g⁵⁰	=	t⁵+t⁴+t²	63	g¹³	=	t³+t	1	0	6
g⁵¹	=	t⁵+t³+t+1	21	g¹²	=	t²+1	1	0	6
g⁵²	=	t⁴+t²+1	63	g¹¹	=	t⁵+t+1	0	1	6
g⁵³	=	t⁵+t³+t	63	g¹⁰	=	t⁵+t⁴	1	1	6
g⁵⁵	=	t⁵+t³+t²+t	63	g⁸	=	t³+t²