\section{Introduction}

\section{Motivation}

Let $(X,\|\cdot\|)$ be an ultrametric Banach space over a non-Archimedean valued field $\mathbb{K}$, and let
$\{0\}=A_0\subset A_1\subset\ldots \subset A_n\subset\ldots \subset X$
be an infinite chain of subsets of $X$, where all inclusions are
strict.

\begin{definition} We say that $(X,\{A_n\})$ is an {\it ultrametric approximation scheme} (or that $(A_n)$ is an approximation scheme in $X$) if:
\begin{itemize}
\item[$(i)$] There exists a map $K:\mathbb{N}\to\mathbb{N}$ such that $K(n)\geq n$ and $A_n+A_n\subseteq A_{K(n)}$ for all $n\in\mathbb{N}$.

\item[$(ii)$] $\lambda A_n\subset A_n$ for all $n\in\mathbb{N}$ and all scalars $\lambda\in \mathbb{K}$.

\item[$(iii)$] $\bigcup_{n\in\mathbb{N}}A_n$ is a dense subset of $X$
\end{itemize}
The approximation scheme is called {\it non-trivial} if $X \neq \cup_n \overline{A_n}$.
\end{definition}

A particular example is a {\it linear approximation scheme}, arising when the
sets $A_n$ are linear subspaces of $X$.  Approximation schemes were introduced, for $X$ a quasi-Banach space over $\mathbb{R}$ or $\mathbb{C}$, by Butzer and Scherer in 1968 \cite{butzer_scherer}, and are a natural object to study in classical approximation theory. Their study leads to the theory of approximation spaces and, in particular, the problem of characterizing membership to several  functional approximation spaces in terms of smoothness. To be more precise, the so called Central Theorems in approximation theory show that, in general, there exists a strong relation between the rate of decay of the best approximation errors $E(f,A_n)$ and the smoothness properties of $f$ \cite{devore,LGM,Pie}.  On the other hand, one of the most remarkable early results in the constructive theory of functions
is Bernstein Lethargy Theorem, which states that if
$X_0\subsetneq X_1\subsetneq X_2\subsetneq \cdots \subsetneq X$ is an ascending chain of finite dimensional vector subspaces of a Banach space $X$, and $\{\varepsilon_n\}\searrow 0$
is a non-increasing sequence of positive real numbers that converges to zero, then there exists an element $x\in X$ such that the $n$-th error of best approximation by elements
of $X_n$ satisfies $E(x,X_n)=\varepsilon_n$ for all $n\in\mathbb{N}$.   This result was first obtained in 1938 by  Bernstein \cite{bernsteininverso}
for $X=C([0,1])$ and $X_n=\Pi_n$, the vector space of real polynomials of degree $\leq n$.
The case of arbitrary finite dimensional $X_n$ is treated, for instance, in
\cite[Section II.5.3]{singerlibro}.

There are several generalizations of Bernstein's result to arbitrary chains of
(possibly infinite dimensional) closed subspaces
$X_1 \subsetneq X_2 \subsetneq \ldots$ of a Banach space $X$.
For example, Tjuriemskih \cite{tjuriemskih} and Nikolskii \cite{nikolskii,nikolskii2}
(see also \cite[Section I.6.3]{singerlibro}) proved that a sufficient (resp.~necessary)
condition for the existence of $x \in X$ verifying $E(x,X_n) = \varepsilon_n$ is that
$X$ is a Hilbert space (resp.~$X$ is reflexive). These results were proved independently and
by other means by Almira and Luther \cite{almiraluther1, almiraluther2} and Almira and Del Toro \cite{almiradeltoro1,almiradeltoro2}. Also, Bernstein
Lethargy Theorem has been generalized to
chains of finite-dimensional subspaces in non-Banach spaces (such as $SF$-spaces)
by  Lewicki \cite{lewicki, lewicki1}. These two approaches were successfully combined
by Micherda \cite{micherda}. Finally, thanks to the work by Plesniak \cite{plesniak}, the lethargy theorem has become a very
useful tool for the theory of quasianalytic functions of several complex variables.

In 1964 Shapiro \cite{shapiro} used Baire Category Theorem to prove that,
for any sequence $X_1 \subsetneq X_2 \subsetneq \ldots \subsetneq X$ of
closed (not necessarily finite dimensional) subspaces of a Banach space $X$,
and any sequence $\{\varepsilon_{n}\}\searrow 0$, there exists an $x\in X$ such that $E(x,X_{n})\neq\mathbf{O}(\varepsilon_{n})$.  This result was strengthened by Tjuriemskih \cite{tjuriemskih1} who, under the very same conditions of Shapiro's Theorem, proved the existence of  $x\in X$ such that $E(x,X_{n})\geq \varepsilon_{n}$, $n=0,1,2,\cdots$. Moreover, Borodin \cite{borodin} gave an easy proof of this result and proved that, for arbitrary infinite dimensional Banach spaces $X$ and for sequences $\{\varepsilon_n\}\searrow 0$ satisfying $\varepsilon_n>\sum_{k=n+1}^\infty\varepsilon_k$, $n=0,1,2,\cdots$, there exists  $x\in X$ such that $E(x,X_{n})= \varepsilon_{n}$, $n=0,1,2,\cdots$.

In this paper we show a result analogous to Shapiro's Theorem, but in the non-Archimedean context and for general ultrametric approximation schemes (Theorem \ref{main}) and, as a consequence, we prove the existence of $p$-adic transcendental numbers whose best approximation errors by algebraic p-adic numbers of degree $\leq n$ decays slowly (Theorem \ref{transcendental}).

Throughout the paper we consider $(X,\|\cdot\|)$ an ultrametric Banach space over a non-Archimedean complete valued field $(\mathbb{K},|\cdot|)$ which is nontrivial.  By nontrivial, we mean that the absolute value $|\cdot|$ is not the trivial one, which is given by $|x|=1$ for $x\neq 0$ and $|0|=0$. If $\mathbb{K}$ is such a field and
\[
p_{\mathbb{K}}=\sup\{|\lambda|: \lambda\in\mathbb{K}, |\lambda|<1\}, \]
then either $p_{\mathbb{K}}<1$, in which case, the set $|\mathbb{K}^{\times}|:=\{|\lambda|:\lambda\in\mathbb{K}\setminus\{0\}\}$ satisfies  $|\mathbb{K}^{\times}|=\{p_{\mathbb{K}}^n:n\in\mathbb{Z}\}$ and there exists $\rho\in \mathbb{K}$ such that $p_{\mathbb{K}}=|\rho|$, or $p_{\mathbb{K}}=1$, in which case,  $|\mathbb{K}^{\times}|$ is a dense subset of $(0,\infty)$. If $p_{\mathbb{K}}<1$ we say that the absolute value of $\mathbb{K}$ is discrete. If $p_{\mathbb{K}}=1$, we say that $\mathbb{K}$ is densely valued.  The most important examples of non-Archimedean complete valued fields we deal with are the fields of $p$-adic numbers $\mathbb{Q}_p$ and $\mathbb{C}_p$. Concretely, the elements of $\mathbb{Q}_p$ are the expressions of the form
\begin{equation}\label{numero}
x=a_{m}p^{m}+a_{m+1}p^{m+1}+\cdots+a_0+a_1p+a_2p^2+ \cdots + a_np^n +\cdots =\sum_{n\geq m}a_np^n,
\end{equation}
where $m\in\mathbb{Z}$, $1\leq a_{m}\leq p-1$ and  $0\leq a_k\leq p-1$ for all $k>m$. Given $x$ as in \eqref{numero},  its $p$-adic absolute value is given by $|x|_p=p^{-m}$. Obviously, the set of rational numbers $\mathbb{Q}$ is a dense subset of $\mathbb{Q}_p$. Indeed, $\mathbb{Q}_p$ results from $\mathbb{Q}$ by topological completion, when we consider over $\mathbb{Q}$ the topology defined by the p-adic absolute value $|\cdot|_p$. The construction of $\mathbb{C}_p$ is a little bit more difficult. As a first step, it is shown that if $\mathbb{K}$ is an algebraic extension of $\mathbb{Q}_p$, there exists a unique absolute value over $\mathbb{K}$ extending the absolute value of $\mathbb{Q}_p$. This implies that there exists a unique absolute value over $\mathbb{Q}_p^a$, the field of algebraic numbers over $\mathbb{Q}_p$, which extends the p-adic absolute value $|\cdot|_p$. Then $\mathbb{C}_p$ results from $\mathbb{Q}^a_p$ by topological completion (see, for example, \cite{gouvea}, \cite{robert} for the definition and basic properties of $\mathbb{Q}_p$ and  $\mathbb{C}_p$ ).

 Finally, we use the following standard notation: Given $A,B\subseteq X$ and $x\in X$, we define the best approximation error $E(x,A)=\inf_{a\in A}\|x-a\|$ and the deviation of $B$ from $A$ is given by $E(B,A)=\sup_{b\in B}E(b,A)$. Furthermore, $B(X)=\{x\in X:\|x\|\leq 1\}$ denotes the unit ball of $X$ and, for $r>0$, $B(x,r)=\{y\in X:\|x-y\|\leq r\}$.

\section{An ultrametric lethargy result} \label{section_s}

Let us state the main result of this section:

\begin{theorem}\label{main} Let $(X,\{A_n\})$ be an ultrametric approximation scheme. The following claims are equivalent:
\begin{itemize}
\item[$(a)$] For every sequence of real numbers $\{\varepsilon_n\}\searrow 0$, there exists $x\in X$ such that $E(x,A_n)\neq \mathbf{O}(\varepsilon_n)$.
\item[$(b)$] \[\inf_{n\in\mathbb{N}}E(B(X),A_n)=c>0.\]
\end{itemize}
\end{theorem}

\begin{remark} Let $(X,\|\cdot\|)$ be an ultrametric Banach space. If $X$ is re-normed with an equivalent ultrametric norm $\|\cdot\|^*$, and we denote $B(X)^*=\{x\in X: \|x\|^*\leq 1\}$, $E(x,A_n)^*=\inf_{a\in A_n}\|x-a\|^*$, and  $E(B(X),A_n)^*=\sup_{x\in B(X)^*}E(x,A_n)^*$, we have that
\[\inf_{n\in\mathbb{N}}E(B(X),A_n)>0 \text{ if and only if } \inf_{n\in\mathbb{N}}E(B(X)^*,A_n)^*>0.
\]
This observation is specially useful when $p_{\mathbb{K}}<1$, since every ultrametric
normed space $(X,\|\cdot\|)$ over a discretely valued field $\mathbb{K}$ can be equivalently renormed  with a norm $\|\cdot\|^*$ which satisfies $\|X\|^*=\{\|x\|^*:x\in X\}\subseteq |\mathbb{K}|$ (see, for example, \cite[Theorem 2.1.9]{perez}).
\end{remark}

The proof of Theorem \ref{main} is based on the following three technical results:

\begin{lemma}\label{uno} Let
$h:\mathbb{N}\to\mathbb{N}$ be a map such that $h(n)\geq n$ for all $n$,
 and let $\{\varepsilon _{n}\}\searrow 0$. Then there exists a
sequence
$\{\xi_{n}\}\searrow 0$ such that $\xi_{n}\geq\varepsilon_{n}$ and
$\xi_{n}\leq 2\xi_{h(n)}$ for every $n$.
\end{lemma}

\begin{lemma}\label{cero} Let $\rho\in\mathbb{K}$ with $|\rho|<1$.  Let $x\in X\setminus\{0\}$ and $r\in (0,\infty)$. Then:
 \begin{itemize}
 \item[$(a)$] There exists $\lambda\in \mathbb{K}$ such that
\[|\rho| <\|\lambda x\|\leq 1\]
\item[$(b)$]  There exists $\lambda\in \mathbb{K}$ such that
\[\|\lambda x\|\leq r \text{ and } \frac{1}{|\lambda|}\leq \frac{1}{|\rho|^2}\frac{\|x\|}{r}.\]
\end{itemize}

\end{lemma}

 \begin{lemma}\label{dos} Let $(X,\{A_n\})$ be an ultrametric approximation scheme and assume that  $\{\xi_n\} \searrow 0$  satisfies
 \begin{equation}\label{condicionsalto}
\xi_n\leq C \xi_{K(n+1)-1} \ \ (n\in\mathbb{N})
 \end{equation}
for a certain constant $C>0$. Then the following are equivalent claims:
 \begin{itemize}
 \item[$(a)$] For all $x\in X$ there exists $C(x)>0$ such that \begin{equation}\label{verif_shap} E(x,A_n)\leq C(x)\xi_n, \  \  (n\in\mathbb{N}). \end{equation}
 \item[$(b)$] There exists a constant $D>0$ such that,
 \begin{equation}\label{verif_shap_fuerte} E(x,A_n)\leq D\|x\|\xi_n,\ \ \ (n\in\mathbb{N}, x\in X).\end{equation}
 \end{itemize}
 \end{lemma}
 \noindent \textbf{Proof of Theorem \ref{main}.} Let us prove $(b)\Rightarrow (a)$ or, equivalently, we show that the negation of $(a)$ implies the negation of $(b)$. Assume that $(A_n)$ fails Shapiro's theorem. Then there exists a sequence $\{\varepsilon_n\} \searrow 0$ and a function $C:X\to \mathbb{R}^+$ such that $E(x,A_n)\leq C(x) \varepsilon_n$ for all $n\in \mathbb{N}$ and  all $x\in X$. Then taking the sequence $\{\xi_n\}\searrow 0$ given by Lemma \ref{uno} for the case $h(n)=K(n+1)-1$, and applying Lemma \ref{dos} to this sequence, we have that  (\ref{verif_shap_fuerte}) holds true. It follows that
 \[
 E(B(X),A_n)=\sup_{\|x\|\leq 1}E(x,A_n)\leq D\xi_n \  \ (n\in \mathbb{N}),
 \]
so that $\lim_{n\to\infty}E(B(X),A_n)=0$, which contradicts $(b)$. This ends the proof.

Let us now prove $(a)\Rightarrow (b)$.   Assume that $(b)$ fails. Then  $\lim_{n\to\infty}E(B(X),A_n)=0$. Take $x\in X\setminus\{0\}$ and $\rho\in\mathbb{K}$ such that $0<|\rho|<1$. Then part $(a)$ of Lemma \ref{cero} says us that there exists $\lambda\in \mathbb{K}$ such that $|\rho|<\|\lambda x\|\leq 1$, so that $\frac{1}{|\lambda|}< \frac{1}{|\rho|}\|x\|$. It follows that
\[
E(x,A_n)=\frac{1}{|\lambda|}E(\lambda x,A_n)\leq \frac{1}{|\lambda|}E(B(X),A_n) \leq \frac{1}{|\rho|}\|x\| E(B(X),A_n)
\]
and $(a)$ fails with $\varepsilon_n=E(B(X),A_n)$. This completes the proof of the theorem.  {\hfill $\Box$}

Lemma \ref{uno} is an easy exercise on real sequences:

\noindent \textbf{Proof of Lemma \ref{uno}.}
Passing from the original function $h$ to
$h^\prime(n) = \max_{1 \leq k \leq n} h(k) + n$, we can assume that
(i) $h(n) > n$ for every $n$, and (ii) the function $h$ is strictly increasing.
Set $m_0 = 0$, and, for $k \geq 1$, $m_k = h(m_{k-1})$. Set $\beta_0 = \varepsilon_1$,
and $\beta_k = \max\{\varepsilon_{m_k}, \beta_{k-1}/2\}$ for $k \geq 1$.
For $n \in \mathbb{N}$, find $k \geq 0$ such that  $n \in [m_k, m_{k+1})$, and set
$\xi_n = \beta_k$.

Then the sequence $(\xi_n)$ has the desired properties.
For $n \in [m_k, m_{k+1})$, $\xi_n = \beta_k \geq \varepsilon_{m_k} \geq \varepsilon_n$.
Furthermore, as $h$ is strictly increasing, $h(n) \in [m_{k+1}, m_{k+2})$, hence
$\xi_{h(n)} = \beta_{k+1} \geq \beta_k/2 = \xi_n/2$.
It remains to show that $\lim \xi_n = 0$, or in other words, that
$\lim \beta_k = 0$. If $\beta_k = \varepsilon_{m_k}$ for infinitely
many values of $k$, then $\lim \beta_k = \lim \varepsilon_{m_k} = 0$.
Otherwise, $\beta_k = \beta_{k-1}/2$ for any $k \geq k_0$. In this case,
too, $\lim \beta_k = 0$.
{\hfill  $\Box$}

\noindent \textbf{Proof of Lemma \ref{cero}.} Let $\rho\in\mathbb{K}$ be such that $0<|\rho|<1$.
Then there exists $a,b\in\mathbb{Z}$ such that $|\rho|^{a+1}< r \leq |\rho|^a$ and $|\rho|^{b+1}< \|x\| \leq |\rho|^b$. Hence
\[
|\rho|=\frac{|\rho|^{b+1}}{|\rho|^{b}}<\frac{\|x\|}{|\rho|^{b}}=\|\frac{x}{\rho^{b}}\|\leq 1,
\]
which proves $(a)$. On the other hand,
\[
\|\rho^{a-b+1}x\|=|\rho|^{a+1}\|\frac{x}{\rho^b}\|\leq r,
\]
and
\[
\frac{1}{|\rho^{a-b+1}|}=|\rho^{b-(a+1)}|=\frac{1}{|\rho|^2}|\rho|^{b+1}\frac{1}{|\rho|^a}\leq \frac{1}{|\rho|^2} \|x\|\frac{1}{r},
\]
which proves part $(b)$ of the lemma. {\hfill $\Box$}

Lemma \ref{dos} is, in our opinion, the difficult part of Theorem \ref{main}.

\noindent \textbf{Proof of Lemma \ref{dos}. } Obviously $(b)\Rightarrow (a)$ (just take $C(x)=D\|x\|$). Let us prove $(a)\Rightarrow (b)$. If $(a)$ holds, then $X=\bigcup_{m\in\mathbb{N}}\Gamma_m$, where
\[
\Gamma_m=\{x\in X: E(x,A_n)\leq m\xi_n, \ \ (n\in\mathbb{N})\}.
\]
The sets $\Gamma_m$ satisfy the following nice properties:
\begin{itemize}
\item[$(i)$] $\Gamma_m=\overline{\Gamma_m}^X$ for all $m\in\mathbb{N}$.
\item[$(ii)$] $\Gamma_m=-\Gamma_m$
\item[$(iii)$]$\Gamma_m+\Gamma_m \subseteq \Gamma_{([C]+1)m}$ for all $m\in\mathbb{N}$, where $C$ is the constant such that $\xi_n\leq C\xi_{K(n+1)-1}$, ($n\in\mathbb{N}$).
\end{itemize}
Property $(i)$ follows from the continuity of the functions $f_n(x)=E(x,A_n)$ and $(ii)$ is a direct consequence of $E(-x,A_n)=E(x,A_n)$. To prove $(iii)$, let us take $x,y\in\Gamma_m$. Then
\[
E(x+y,A_{K(n)})\leq \max\{E(x,A_n),E(y,A_n)\}\leq m\xi_n \ \ (n\in\mathbb{N}).
\]
Thus, given $j\in\mathbb{N}$, $K(n)\leq j\leq K(n+1)-1$, we have that
\[
E(x+y,A_j)\leq E(x+y,A_{K(n)})\leq m\xi_n\leq mC\xi_{K(n+1)-1}\leq m([C]+1)\xi_j.
\]
This proves $\Gamma_m+\Gamma_m\subseteq \Gamma_{([C]+1)m}$.

Taking into account Baire category theorem, there exists $m_0\in\mathbb{N}$ such that $\Gamma_{m_0}$ contains a ball $B(x_0,r_0)$ for a certain $x_0\in X$ and $r_0>0$. Then $B(-x_0,r_0)=-B(x_0,r_0)\subseteq \Gamma_{m_0}$ and, thanks to $(iii)$,
\[
B(0,r_0)=-x_0+B(x_0,r_0)\subseteq -\Gamma_{m_0}+\Gamma_{m_0}=\Gamma_{m_0}+\Gamma_{m_0} \subseteq \Gamma_{([C]+1)m_0}.
\]
Take $x\in X$, $x\neq 0$. If $\rho\in\mathbb{K}$ satisfies $|\rho|<1$, part $(b)$ of Lemma \ref{cero} implies that there exists $\lambda\in\mathbb{K}$ such that $\|\lambda x\|\leq r_0$  and $\frac{1}{|\lambda|}\leq \frac{1}{|\rho|^2}\frac{\|x\|}{r_0}$. Hence $\lambda x\in \Gamma_{([C]+1)m_0}$ and
\[
E(x,A_n)=\frac{1}{|\lambda|}E(\lambda x,A_n)\leq \frac{1}{|\rho|^2}\frac{\|x\|}{r_0} ([C]+1)m_0 \xi_n \ \ (n\in\mathbb{N}, x\in X),
\]
which proves $(b)$.    {\hfill $\Box$}

Once we have proved Theorem \ref{main}, several questions arise. The first one is: Do we have some nice example where the conditions of Theorem \ref{main} are satisfied? Another question is: What can we say about constant $c$ appearing in part $(b)$ of Theorem \ref{main}? We solve both questions with the results below.

\begin{theorem}[Ultrametric Shapiro's Theorem] \label{teosha} If the ultrametric approximation scheme $(X,\{A_n\})$ is such that $A_n$ is a closed linear subspace of $X$ for all $n$, then \[\inf_{n\in\mathbb{N}}E(B(X),A_n)\geq p_{\mathbb{K}}>0.\]
\end{theorem}
\noindent \textbf{Proof. } We just need to prove that, if $Y$ is a proper  closed  subspace of $X$ then there exists $x\in X$ such that $\|x\|\leq 1$ and $E(x,Y)\geq p_{\mathbb{K}}$. Let $y\in X\setminus Y$ then $E(y,Y)=d>0$ since $Y$ is closed. Let $\varepsilon\in (0,1)$ and let $z\in Y$ be such that $\|y-z\|\leq d (1+\frac{\varepsilon}{1-\varepsilon})$.
If $p_{\mathbb{K}}<1$,
Let us take $\rho\in\mathbb{K}$ such that $0<|\rho|<1$ and apply Lemma \ref{cero} with $x=y-z$. Thus, there exists $\lambda\in\mathbb{K}$ such that $|\rho|<\|\lambda x\|\leq 1$. Furthermore, by construction,
\begin{eqnarray*}
\frac{1}{\|x\|} &=& \frac{1}{\|y-z\|} \\
&\geq&  \frac{1}{d}\frac{1}{1+\frac{\varepsilon}{1-\varepsilon}}\\
&=& \frac{1}{d}(1-\varepsilon)
\end{eqnarray*}
Hence $\lambda x\in B(X)$ and
\[
E(\lambda x,Y)=|\lambda|E(x,Y)=|\lambda|E(y,Y)\geq \frac{|\rho|}{\|x\|} d\geq |\rho|(1-\varepsilon).
\]
This proves that
\begin{equation}\label{nueva}
\inf_{n\in\mathbb{N}}E(B(X),A_n)\geq |\rho|,
\end{equation}
since $\varepsilon$ was arbitrarily small. The theorem follows since relation $(\ref{nueva})$ holds for all $\rho\in\mathbb{K}$ with $0<|\rho|<1$.

{\hfill $\Box$}

\begin{theorem}[Dichotomy] \label{dicotomia} Let  $(X,\|\cdot\|)$ be an ultrametric normed  space.
The following are equivalent claims:
\begin{itemize}
\item[$(a)$] \[\inf_{n\in\mathbb{N}}E(B(X),A_n)=c>0.\]
\item[$(b)$]  \[\inf_{n\in\mathbb{N}}E(B(X),A_n)\geq p_{\mathbb{K}}^3>0.\]
\end{itemize}
Furthermore, if    $E(B(X),A_m)< p_{\mathbb{K}}^3$   for a certain $m\in\mathbb{N}$ and the jump function satisfies $K(n)\leq Cn$ for all $n$ and a certain $C>0$, then
$E(B(X),A_n)=\mathbf{O}( \tau^{k^{\frac{1}{\log_2C}}})$ for a certain $0<\tau<1$. In particular, if $C\leq 2$ then the sequence
$\{E(B(X),A_n)\}$ decays exponentially to zero.
\end{theorem}

\noindent \textbf{Proof. } Take $\rho\in\mathbb{K}$ such that $0<|\rho|<1$. We prove that, if $A_n+A_m\subseteq A_{h(n,m)}$, then
\begin{equation}\label{condiciondicotomiacero}
E(B(X),A_{h(n,m)})\leq \frac{1}{|\rho|^2}E(B(X),A_{n})E(B(X),A_{m}).
\end{equation}

Now, the inequality $(\ref{condiciondicotomiacero})$ implies that
\[
\inf_{n\in\mathbb{N}} E(B(X),A_{m})\geq |\rho|^3
\]
since, if  $E(B(X),A_{m_0})<|\rho|^3$ for a certain $m_0\in\mathbb{N}$, then
\[E(B(X),A_{K(m_0)})\leq \left(\frac{E(B(X),A_{m_0})}{|\rho|}\right)^2\leq |\rho|^4
\]
and, if we denote by $K^s(m)=K(K^{s-1}(m))$, $K^0(m)=m$, $K^1(m)=K(m)$, then
\[
E(B(X),A_{K^s(m_0)})\leq |\rho|^{r_s}, \text{ where } r_0=3 \text{ and } r_{s+1}=2(r_s-1).
\]
Obviously, the sequence $(r_s)$ goes to infinity, so that  $E(B(X),A_{K^s(m_0)})$ decreases exponentially. In particular, due to the non-increasing character of the sequence $E(B(X),A_{n})$, we have that $\lim_{n\to\infty}E(B(X),A_n)=0$. This proves the first part of the theorem, since $\rho$ was an arbitrary element of $\{x\in\mathbb{K}:0<|x|<1\}$.

Let us now assume that $K(n)\leq Cn$. We  claim that $E(B(X),A_n)=\mathbf{O}( |\rho|^{\frac{1}{2} k^{\frac{1}{\log_2C}}})$ .  To prove this, we assume with no loss of generality that $K(1)>1$, $E(B(X),A_{1})<|\rho|^3$, and $C>1$ is a natural number. Then $K^s(1)$ converges to infinity and $K^s(1)\leq C^s$ for all $s$. On the other hand, it is clear that $(r_s)$ satisfies $2^s\leq r_s$, $s=0,1,\cdots$, so that
\[
E(C^s)\leq E(K^s(1))=E(B(X),A_{K^s(1)})\leq |\rho|^{r_s}\leq |\rho|^{2^s}.
\]
Thus, taking $s=\log_Ck$, we have that
\begin{eqnarray*}
E(k)&=& E(C^s)\leq E(C^{[s]})\leq |\rho|^{2^{[s]}}\leq |\rho|^{2^{s-1}}\\
&=& \left(|\rho|^{\frac{1}{2}}\right)^{2^{\frac{\log_2k}{\log_2C}}}\\
&=& |\rho|^{\frac{1}{2} k^{\frac{1}{\log_2C}}}
\end{eqnarray*}
Obviously, for $C\leq 2$, $E(k)$ decreases exponentially.

Let us now prove the inequality $(\ref{condiciondicotomiacero})$.
Let $\delta>0$ be fixed and let $x\in X\setminus\{0\}$. Use Lemma \ref{cero} to find $\lambda\in\mathbb{K}$ such that \[|\rho|<\|\lambda x\|\leq 1.\]
Then, by definition of  $E(B(X),A_{n})$, there exists $a_n\in A_n$ such that
\[
\|\lambda x-a_n\|\leq (1+\delta)E(\lambda x, A_n)\leq (1+\delta)E(B(X),A_{n}).
\]
Hence
\[
\| x-\frac{1}{\lambda}a_n\|\leq \frac{1}{|\lambda|}(1+\delta)E(B(X),A_{n})< \frac{\|x\|}{|\rho|}(1+\delta)E(B(X),A_{n}).
\]
It follows that, for all $x\in X$ and all $n\in\mathbb{N}$,
\begin{equation}\label{otra}
E(x,A_n)\leq \frac{\|x\|}{|\rho|}E(B(X),A_{n}),
\end{equation}
since $\delta>0$ was arbitrary. Apply $(\ref{otra})$ to $y=x-\frac{1}{\lambda}a_n$, taking into account that $A_n+A_m\subseteq A_{h(n,m)}$. Then
\[
E(x,A_{h(n,m)})\leq E(y,A_m)\leq \frac{\|y\|}{|\rho|}E(B(X),A_{m})\leq \frac{\frac{\|x\|}{|\rho|}(1+\delta)E(B(X),A_{n})}{|\rho|}E(B(X),A_{m}).
\]
This proves $(\ref{condiciondicotomiacero})$, since $\delta>0$ was arbitrary.

{\hfill $\Box$}

\section{Application to p-adic number theory}
Let us consider $\mathbb{C}_p$ as an ultrametric Banach space over $\mathbb{Q}_p$, and let
$$\mathcal{A}_n=\{\alpha\in \mathbb{C}_p: \exists p(t)\in\mathbb{Q}_p[t], \deg (p)\leq n, \ p(\alpha)=0\}$$
denote the set of $p$-adic algebraic elements of degree $\leq n$. Obviously, $\bigcup\mathcal{A}_n=\mathbb{Q}_p^a$ is the field of $p$-adic algebraic numbers over $\mathbb{Q}_p$, which is a dense subset of $\mathbb{C}_p$. Furthermore, it is well known that $\mathcal{A}_n$ is a closed subset of $\mathbb{C}_p$ for all $n$, and $\lambda \mathcal{A}_n\subseteq \mathcal{A}_n$ for all $\lambda\in\mathbb{Q}_p$ and all $n$ (see \cite[page 130]{robert}). Finally, it is also known that $\mathcal{A}_n+\mathcal{A}_m\subset \mathcal{A}_{nm}$. This proves that $(\mathbb{C}_p,\{\mathcal{A}_n\})$ is an ultrametric approximation scheme with jump function $K(n)=n^2$.
The main result in this section is the following theorem about transcendental $p$-adic numbers:
\begin{theorem}\label{transcendental} Let $\{\varepsilon_n\}\searrow 0$. Then there exists $\alpha\in \mathbb{C}_p\setminus\mathbb{Q}_p^a$ such that
\[
E(\alpha, \mathcal{A}_n)=\inf_{a\in \mathcal{A}_n}|\alpha-a|_p \neq\mathbf{O}(\varepsilon_n).
\]
\end{theorem}
To prove this theorem, we will use Theorem \ref{main}, in conjunction with the following well known result from number theory:
\begin{theorem}[Krasner's Lemma]    Let $\mathbb{K}$ be a non-Archimedean complete valued field of characteristic zero, and let $a$ and $b$ be elements of the algebraic closure of $\mathbb{K}$. Let $a_1=a,a_2,\cdots,a_N$ be the algebraic conjugates of $a$ over $\mathbb{K}$. Suppose that $b$ is closer to $a$ than any other of the conjugates of $a$, i.e., \[
|b-a|<\min_{i=2,3,\cdots,N}|a-a_i|.
\]
Then $K(a)\subseteq K(b)$.
\end{theorem}

This result was initially proved by Ostrowski in 1917 \cite{ostrowski} and rediscovered by Krasner in 1946 \cite{krasner} and it is usually named as Krasner's Lemma \cite[page 178, Theorem 5.7.2]{gouvea}.

\noindent \textbf{Proof of Theorem \ref{transcendental}. } Let $n\in\mathbb{N}$, $n\geq 1$, and let $\sigma_{n}\in\mathbb{C}_p$ be a primitive $p^n$-th root of $1$. Then $\sigma_{n}$ is algebraic of degree $p^n-p^{n-1}$, and its minimal polynomial is given by $g(t)=h(t^{p^{n-1}})$, where $h(t)=t^{p-1}+t^{p-2}+\cdots+t+1$. This is well known, but a direct proof follows by applying Eisenstein's irreducibility criterium to $g(t)$ and taking into account that $t^p-1=(t-1)(t^{p-1}+t^{p-2}+\cdots+t+1)$, so that $$(\sigma_{n}^{p^{n-1}}-1)g(\sigma_{n})=(\sigma_{n}^{p^{n-1}}-1)h(\sigma_{n}^{p^{n-1}})=(\sigma_{n}^{p^{n-1}})^p-1=\sigma_{n}^{p^n}-1=0,$$
which implies that $g(\sigma_{n})=0$. Moreover, it is also well known (\cite[page 107]{robert}) that $$|\sigma_{n}-1|=\frac{1}{p^{\frac{1}{p^n-p^{n-1}}}}.$$ If $\tau_n$ denotes an algebraic conjugate of $\sigma_{n}$, then
\[
|\sigma_{n}-\tau_n|=|\tau_n||\frac{\sigma_{n}}{\tau_n}-1|=\frac{1}{p^{\frac{1}{p^n-p^{n-1}}}}\geq  \frac{1}{p^{\frac{1}{p-1}}}=2c_0>0.
\]
since $\frac{\sigma_{n}}{\tau_n}$ is also a $p^n$-th root of $1$. Moreover, it is easy to check that
\[
\inf_{n\geq 1}\frac{1}{p^{\frac{1}{p^n-p^{n-1}}}}=\frac{1}{p^{\frac{1}{p-1}}}=2c_0>0.
\]
Let us now assume that $\alpha\in \mathcal{A}_n$ and $|\sigma_{n}-\alpha|\leq c_0$. Then Krasner's Lemma implies that $\mathbb{Q}_p(\sigma_{n})\subseteq \mathbb{Q}_p(\alpha)$, which is impossible, since $[\mathbb{Q}_p(\sigma_{n}):\mathbb{Q}_p]=p^n-p^{n-1}>n\geq [\mathbb{Q}_p(\alpha):\mathbb{Q}_p]$. In particular, this implies that $E(\sigma_{n},\mathcal{A}_n)\geq c_0$, so that $\inf_{n\in\mathbb{N}}E(B(\mathbb{C}_p),\mathcal{A}_n)\geq c_0>0$ and we can apply Theorem \ref{main}. This completes the proof.

{\hfill $\Box$}

\section{Acknowledgement}
 The author is very grateful to the anonymous referees of this paper for their many interesting comments. Their advice has greatly improved the readability of this paper.

 \bibliographystyle{amsplain}


\section{Introduction}

In this paper we prove the following result.
\begin{thm}\label{thm:maintheorem}
Given a prime power $q$, a positive integer $d$,
coprime polynomials $h_0$ and $h_1$ in $\mathbf{F}_{q^d}[x]$ of degree at most two, and an irreducible degree $\ell$ factor~$I$ of ${h_1x^q - h_0}$, the discrete logarithm problem in $\mathbf{F}_{q^{d\ell}} \cong \mathbf{F}_{q^d}[x]/(I)$ can be solved in expected time $q^{\log_2\ell + O(d)}$.
\end{thm}

It was originally proven in~\cite{GKZ} when $q > 61$, $q$ is not a power of $4$, and ${d \geq 18}$.
Even though we eliminate these technical conditions, the main contribution is the new approach to the proof.
The theorem represents the state of the art of provable quasi-polynomial time algorithms for the discrete logarithm problem (or DLP) in finite fields of fixed characteristic. The obstacle separating Theorem~\ref{thm:maintheorem} from a full provable algorithm for DLP is the question of the existence of a good field representation: polynomials $h_0$, $h_1$ and $I$ for a small $d$. A direction towards a full provable algorithm would be to find analogues of this theorem for other field representations, but this may require in the first place a good understanding of why Theorem~\ref{thm:maintheorem} is true.

The integers $q$, $d$ and $\ell$, and the polynomials $h_0, h_1$ and $I$ are defined as in the above theorem for the rest of the paper.
The core of that result is Proposition~\ref{prop:onestepdescent} below, which essentially states that elements of $\mathbf{F}_{q^{d\ell}}$ represented by a \emph{good} irreducible polynomial in $\mathbf{F}_{q^d}[x]$ of degree $2m$ can be rewritten as a product of \emph{good} irreducible polynomials of degrees dividing $m$ --- a process called \emph{degree two elimination}, first introduced for $m=1$ in~\cite{GGMZ}.

\begin{defn}[Traps and good polynomials]
An element $\tau \in {\overline{\F}_q}$ for which $[\mathbf{F}_{q^d}(\tau) : \mathbf{F}_{q^d}]$ is an even number $2m$ and $h_1(\tau) \neq 0$ is called
\begin{enumerate}
\item a \emph{degenerate trap root} if $\frac{h_0}{h_1}(\tau) \in \mathbf{F}_{q^{dm}}$,
\item a \emph{trap root of level $0$} if it is a root of $h_1x^q-h_0$, or
\item a \emph{trap root of level $dm$} if it is a root of $h_1x^{q^{dm+1}} - h_0$.
\end{enumerate}
Analogously, a polynomial in ${\overline{\F}_q}[x]$ that has a trap root is called a \emph{trap}.
A polynomial is \emph{good} if it is not a trap.
\end{defn}

\begin{prop}[Degree two elimination]\label{prop:onestepdescent}
Given an extension $k/\mathbf{F}_{q^d}$ of degree $m$ such that $dm \geq 23$, and a good irreducible quadratic polynomial $Q \in k[x]$, there is an algorithm which finds a list of good linear polynomials $(L_0,\dots,L_n)$ in $k[x]$ such that $n \leq q+1$ and
$$Q \equiv h_1L_0^{-1}\cdot\prod_{i = 1}^nL_i \mod I,$$
and runs in expected polynomial time in $q$, $d$ and $m$.
\end{prop}

The difficulty of proving Theorem~\ref{thm:maintheorem} lies mostly in Proposition~\ref{prop:onestepdescent}. We recall briefly in Section~\ref{sec:propimpliesthm} how the proposition implies the theorem. The main contribution of the present paper is a new proof of Proposition~\ref{prop:onestepdescent}, which hopefully provides a better understanding of the degree two elimination method, the underlying geometry, and the role of traps. The action of $\mathrm{PGL}_2$ on the polynomial $x^q - x$ became a crucial ingredient in the recent progress on the discrete logarithm problem for fields of small characteristic, since~\cite{Joux13} (and implicitly in~\cite{GGMZ}). While the proof in~\cite{GKZ} resorted to an intricate case by case analysis enumerating through all possible subgroups of $\mathrm{PGL}_2(\mathbf{F}_q)$, we provide a unified geometric argument, shedding new light on the role of $\mathrm{PGL}_2$.

\subsection{Degree two elimination algorithm} \label{sec:overview}
The key observation allowing degree two elimination is that a polynomial of the form $\alpha x^{q+1} + \beta x^q + \gamma x + \delta$ has a high chance to split completely over its field of definition. Furthermore, we have the congruence
\begin{equation}\label{eq:maincong}
\alpha x^{q+1} + \beta x^q + \gamma x + \delta \equiv h_1^{-1}(\alpha xh_0 + \beta h_0 + \gamma xh_1 + \delta h_1) \mod I,
\end{equation}
and the numerator of the right-hand side has degree at most $3$. Consider the ${\overline{\F}_q}$-vector space $V$ spanned by $x^{q+1},x^q,x$ and $1$ in  ${\overline{\F}_q}[x]$, and the linear subspace
$$V_Q = \{\alpha x^{q+1} + \beta x^q + \gamma x + \delta \in V \mid \alpha xh_0 + \beta h_0 + \gamma x h_1 + \delta h_1 \equiv 0 \mod Q\}.$$
As long as $Q$ is a good irreducible polynomial, $V_Q$ is of dimension two. The algorithm simply consists in sampling uniformly at random elements $f \in V_Q(k)$ (or equivalently in its projectivisation $\P^1_Q(k)$) until $f$ splits completely over $k$ into good linear polynomials $(L_1,\dots,L_{\deg f})$. Since $f \in V_Q$, the polynomial $Q$ divides the numerator of the right-hand side of \eqref{sec:overview}, and the quotient is a polynomial $L_0$ of degree at most $1$. The algorithm returns $(L_0,\dots,L_{\deg f})$.

To prove that the algorithm terminates in expected polynomial time, we need to show that a random polynomial in $V_Q(k)$ has good chances to split into good linear polynomials over $k$. In this paper, we prove this by constructing a morphism $C \rightarrow \P^1_Q$ where $C$ is an absolutely irreducible curve defined over $k$, such that the image of any $k$-rational point of $C$ is a polynomial that splits completely over $k$. This construction is the object of Section~\ref{sec:ramifications}. The absolute irreducibility implies that $C$ has a lot of $k$-rational points, allowing us to deduce that a lot of polynomials in $\P^1_Q(k)$ split over $k$. This is done in Section~\ref{sec:proofmainprop}.

\subsection{Proof of Theorem~\ref{thm:maintheorem}} \label{sec:propimpliesthm}
We briefly explain in this section how Proposition~\ref{prop:onestepdescent} implies Theorem~\ref{thm:maintheorem}.
Consider the factor base $$\mathfrak F = \{f \in \mathbf{F}_{q^d}[x] \mid \deg f \leq 1, f \neq 0\} \cup \{h_1\}.$$
First, the following proposition extends the degree two elimination to a full descent algorithm from any polynomial down to the factor base.
\begin{prop}\label{prop:descent}
Suppose $d \geq 23$.
Given a polynomial $F \in \mathbf{F}_{q^d}[x]$, there is an algorithm that finds integers $(\alpha_f)_{f \in \mathfrak F}$ such that
$$F \equiv \prod_{f \in \mathfrak F}f^{\alpha_f} \mod I,$$
and runs in expected time $q^{\log_2\ell + O(d)}$.
\end{prop}

\begin{proof}
This is essentially the \emph{zigzag} descent presented in~\cite{GKZ}. We recall the main idea for the convenience of the reader. First, one finds a good irreducible polynomial $G \in \mathbf{F}_{q^d}[x]$ of degree $2^e$ such that $F \equiv G \mod I$ (this can be done for $e = \lceil\log_2(4\ell+1)\rceil$, see~\cite[Th. 5.1]{Daqing} and~\cite[Lem. 2]{GKZ}).
Over the extension $\mathbf{F}_{q^{d2^{e-1}}}$, the polynomial $G$ splits into $2^{e-1}$ good irreducible quadratic polynomials, all conjugate under $\Gal(\mathbf{F}_{q^{d2^{e-1}}}/\mathbf{F}_{q^{d}})$. Let $Q$ be one of them, and apply the algorithm of Proposition~\ref{prop:onestepdescent} to rewrite $Q$ in terms of linear polynomials $(L_0,\dots,L_n)$ in $\mathbf{F}_{q^{d2^{e-1}}}[x]$ and $h_1$.
For any index $i$, let $L_i'$ be the product of all the conjugates of $L_i$ in the extension $\mathbf{F}_{q^{d2^{e-1}}}/\mathbf{F}_{q^{d}}$. Then,
$$F \equiv h_1^{2^{e-1}}L_0'^{-1}\cdot\prod_{i = 1}^nL_i' \mod I,$$
and each $L_i'$ factors into good irreducible polynomials of degree a power of 2 at most $2^{e-1}$. The descent proceeds by iteratively applying this method to each $L_i'$ until all the factors are in the factor base $\mathfrak F$.
\end{proof}

Then, as in~\cite[Sec. 2]{GKZ}, the descent algorithm of Proposition~\ref{prop:descent} can be used to compute discrete logarithms, following ideas from~\cite{EG02} and~\cite{diem_2011}. To compute the discrete logarithm of an element $h$ in base $g$, the idea is to collect relations between $g$, $h$, and elements of the factor base by applying the descent algorithm on $g^\alpha h^\beta$ for a few uniformly random exponents $\alpha$ and $\beta$.
That proves Theorem~\ref{thm:maintheorem} for $d \geq 23$. To remove the condition on $d$, suppose that $d \leq 22$, and let $d' \leq 44$ be the smallest multiple of $d$ larger than $22$. Let $I'$ be an irreducible factor of $I$ in $\mathbf{F}_{q^{d'}}[x]$.
The DLP can be solved in expected time $q^{\log_2(\deg I') + O(d')} = q^{\log_2 \ell + O(1)}$ in $\mathbf{F}_{q^{d'}}[x]/(I')$, and therefore also in the subfield $\mathbf{F}_{q^d}[x]/(I)$.

\section{The action of $\mathrm{PGL}_2$ on $x^q-x$}
As already mentioned, a crucial fact behind degree two elimination is that a polynomial of the form $\alpha x^{q+1} + \beta x^q + \gamma x + \delta$ has a high chance to split completely over its field of definition. This fact is closely related to the action of $2\times 2$ matrices on such polynomials.
\begin{defn} We denote by $\star$ the action of invertible $2 \times 2$ matrices on univariate polynomials defined as follows:
$$\left(\begin{matrix}a&b \\ c & d\end{matrix}\right)\star f(x) = (cx+d)^{\deg f}f\left(\frac{ax+b}{cx+d}\right).$$
\end{defn}

Consider the ${\overline{\F}_q}$-vector subspace $V$ spanned by $x^{q+1},x^q,x,$ and $1$ in ${\overline{\F}_q}[x]$.
The above action induces an action of the group $\mathrm{PGL}_2$ on the projective space $\P(V)$, which we also write $\star$.
Parameterizing the polynomials in $\P(V)$ as $\alpha x^{q+1} + \beta x^q + \gamma x + \delta$, let $S$ be the quadratic surface in $\P(V)$ defined by the equation $\alpha\delta = \beta\gamma$. This surface is the image of the morphism
\begin{alignat*}{1}\label{eq:definitionS}
\psi: \P^1 \times \P^1 &\longrightarrow \P(V) :
(a,b) \longmapsto (x-a)(x-b)^q.
\end{alignat*}
Note that to avoid heavy notation, everything is written affinely, but we naturally have $\psi(\infty,b) = (x-b)^q$, $\psi(a,\infty) = x-a$ and $\psi(\infty,\infty) = 1$. More generally, we say that $f(x) \in V$ has a root of degree $n$ at infinity if $f$ is of degree $q+1-n$.
Now, the following lemma shows that apart from the surface $S$, the polynomials of $\P(V)$ form exactly one orbit for $\mathrm{PGL}_2$.

\begin{lem}\label{lem:pgl2orbit}
We have $\P(V) \setminus S = \mathrm{PGL}_2 \star (x^q-x)$.
\end{lem}
\begin{proof}
First notice that both $S$ and $\P(V) \setminus S$ are closed under the action of $\mathrm{PGL}_2$. In particular, $\mathrm{PGL}_2 \star (x^q-x) \subseteq \P(V) \setminus S$.
Let $f(x) \in \P(V) \setminus S$. Suppose by contradiction that $f(x)$ has a double root $r \in \P^1$, and let $g \in \mathrm{PGL}_2$ be a linear transformation sending $0$ to $r$. The polynomial $g \star f(x)$ has a double root at $0$, so has no constant or linear term, and must be of the form $\alpha x^{q+1} + \beta x^q$, so it is in $S$, a contradiction. Therefore $f(x)$ has $q+1$ distinct roots. Let $g \in \mathrm{PGL}_2$ send $0$, $1$ and $\infty$ to three of these roots. Then, $g \star f(x)$ has a root at $0$ and at $\infty$ so is of the form $\beta x^q + \gamma x$, and since it also has a root at $1$, it can only be $x^q - x$.
\end{proof}

This result implies that most polynomials of $\P(V)$ are of the form $g \star (x^q-x)$, which splits completely over the field of definition of the matrix $g$.

\section{The role of traps}
Consider a finite field extension $k/\mathbf{F}_{q^d}$ of degree $m$.
Let $Q$ be an irreducible quadratic polynomial in $k[x]$ coprime to $h_1$. Let ${a_1}$ and ${a_2}$ be the roots of $Q$ in~${\overline{\F}_q}$.
The degree two elimination aims at expressing $Q$ modulo $h_1x^q - h_0$ as a product of linear polynomials.
To do so, we study a variety $\P^1_Q \subset \P(V)$ parameterizing polynomials that can possibly lead to an elimination of $Q$ (i.e., such that $Q$ divides the right hand side of~\eqref{eq:maincong}).
In this section, we define $\P^1_Q$ and show how the notion of traps and good polynomials determine how it intersects the surface $S$ from Lemma~\ref{lem:pgl2orbit}.

Recall that $V$ is the ${\overline{\F}_q}$-vector subspace $V$ spanned by $x^{q+1},x^q,x,$ and $1$ in ${\overline{\F}_q}[x]$. Consider the linear map
\begin{equation}\label{eq:morphxqtoh}
\varphi : V \longrightarrow {\overline{\F}_q}[x][h_1^{-1}] :
\begin{cases}
1 &\longmapsto 1,\\
x &\longmapsto x,\\
x^q &\longmapsto {h_0}/{h_1},\\
x^{q+1} &\longmapsto x{h_0}/{h_1}.\\
\end{cases}
\end{equation}
We want $\P^1_Q$ to parameterise the polynomials $f \in V$ such that $\varphi(f)$ is divisible by~$Q$.
For any $P \in {\overline{\F}_q}[x]$ coprime with $h_1$, write $\varphi_P = \pi_P \circ \varphi$ where $\pi_P : {\overline{\F}_q}[x][h_1^{-1}] \rightarrow {\overline{\F}_q}[x]/P$ is the canonical projection.
We can now define $\P^1_Q$ as
\begin{equation}\label{eq:defnPQ}
\P^1_Q = \P(\ker \varphi_Q).
\end{equation}
The variety $\P^1_Q$ is the intersection of the two planes $\P(\ker \varphi_{x-{a_1}})$ and $\P(\ker \varphi_{x-{a_2}})$.

\begin{lem}\label{lem:nondegenerate}
If $Q$ is not a degenerate trap, then ${|(\P^1_Q \cap S)({\overline{\F}_q})| = 2}$, and these two points are of the form $\psi(a_1,b_1)$ and $\psi(a_2,b_2)$, with $a_1 \neq a_2$ and $b_1 \neq b_2$.
\end{lem}
\begin{proof}
For $a \in \{{a_1},{a_2}\}$, we have
\begin{alignat*}{3}
&\P(\ker \varphi_{x-{a}}) \cap S& &= \psi\left(\{a\}\times \P^1\right) \cup \psi\left(\P^1 \times \left\{\frac{h_0}{h_1}(a)^{1/q}\right\}\right).
\end{alignat*}
Since the polynomial $Q$ is irreducible, we have ${a_1} \neq {a_2}$. Furthermore, assuming that $Q$ is not a degenerate trap, we have $\frac{h_0}{h_1}({a_1}) \not\in k$, and thereby $\frac{h_0}{h_1}({a_1}) \neq \frac{h_0}{h_1}({a_2})$. Therefore $\P^1_Q \cap S$ is equal to
\begin{alignat*}{1}
\P(\ker \varphi_{x-{a_1}}) \cap \P(\ker \varphi_{x-{a_2}}) \cap S = \left\{\psi\left({a_1},\frac{h_0}{h_1}({a_2})^{1/q}\right),\psi\left({a_2},\frac{h_0}{h_1}({a_1})^{1/q}\right)\right\}.
\end{alignat*}
\end{proof}

In particular, when $Q$ is not a degenerate trap, $\P^1_Q$ is exactly the line passing through the two points $s_1 = \psi(a_1,b_1)$ and $s_2 = \psi(a_2,b_2)$. We get a $k$-isomorphism $\P^1 \rightarrow \P^1_Q : \alpha \mapsto s_1 - \alpha s_2$. For this reason the two points $s_1$ and $s_2$ play a central role in the rest of the analysis, and the following proposition shows that they behave nicely when $Q$ is a good polynomial.

\begin{prop}\label{prop:distinctroots}
Suppose $Q$ is a good polynomial. Then, $(\P^1_Q \cap S)({\overline{\F}_q}) = \{s_1,s_2\}$, where $s_1 = (x-{a_1})(x-b_1)^q$, and $s_2 = (x-{a_2})(x-b_2)^q$, and the roots ${a_1}$, ${a_2}$, $b_1$ and $b_2$ are all distinct.
\end{prop}

\begin{proof}
From Lemma~\ref{lem:nondegenerate}, we can write $(\P^1_Q \cap S)({\overline{\F}_q}) = \{s_1,s_2\}$ with $a_1 \neq a_2$ and $b_1 \neq b_2$.
If ${a_1} = b_2$ or ${a_2} = b_1$, then $Q$ divides $x^qh_1 - h_0$, a trap of level $0$.
Now, suppose ${a_1} = b_1$ (the case ${a_2} = b_2$ is similar). Since ${a_1}$ and ${a_2}$ are the two roots of~$Q$, and $Q$ divides $(x-{a_1})(h_0 - {a_1^q} h_1)$, then ${a_2}$ is a root of $h_0 - {a_1^q} h_1$. We get that $h_0({a_2}) = {a_1^q} h_1({a_2})$, so ${a_2}$ is a root of $h_1x^{q^{dm + 1}} - h_0$, a trap of level $dm$.
\end{proof}

\section{Irreducible covers of $\P^1_Q$} \label{sec:ramifications}
In this section we suppose that $Q$ is a good polynomial, and we consider the polynomials $s_1 = (x-{a_1})(x-b_1)^q$ and $s_2 = (x-{a_2})(x-b_2)^q$ as defined in Proposition~\ref{prop:distinctroots}, where ${a_1}$, ${a_2}$, $b_1$ and $b_2$ are all distinct. Consider the variety $\P^1_Q$ from~\eqref{eq:defnPQ}.\\

Recall that our goal is to prove that a significant proportion of the polynomials of $\P^1_Q(k)$ splits completely over $k$. As mentioned in Section~\ref{sec:overview}, our method consists in constructing a morphism $C \rightarrow \P^1_Q$ where $C$ is an absolutely irreducible curve defined over $k$, such that the image of any $k$-rational point of $C$ is a polynomial that splits completely over $k$. The absolute irreducibility is crucial as it implies that $C$ has a lot of $k$-rational points.
The idea is to consider the algebraic set
$$C = \{(u,r_1,r_2,r_3) \mid \text{the $r_i$'s are three distinct roots of $u$}\} \subset \P^1_Q \times \P^1 \times \P^1 \times \P^1,$$
and the canonical projection $C \rightarrow \P^1_Q$.

\begin{prop}\label{prop:Csplitcomp}
If $(u,r_1,r_2,r_3) \in C(k)$, then $u$ splits completely over $k$.
\end{prop}
\begin{proof}
Suppose that $(u,r_1,r_2,r_3)$ is a $k$-rational point of $C$. From Lemma~\ref{lem:pgl2orbit}, we get $u = g \star (x^q - x)$ where $g$ is the matrix $g \in \mathrm{PGL}_2(k)$ sending the three points $r_1,r_2$ and $r_3$ to $0$, $1$ and $\infty$.
In particular, the set of roots of $u$ is $g^{-1}(\P^1(\mathbf{F}_q))$ which are all in $\P^1(k)$.
\end{proof}
In the rest of this section, we prove that $C$ is absolutely irreducible (Proposition~\ref{prop:Cirred}).
The strategy is the following. Instead of considering directly $C$, which encodes three roots for each polynomial of $\P^1_Q$, we start with the variety
$$X = \{(u,r) \mid u(r) = 0\} \subset \P^1_Q \times \P^1,$$
which considers a single root for each polynomial. We can then ``add'' roots by considering fibre products.
Recall that given two covers $\nu : Z \rightarrow Y$ and $\mu: Z' \rightarrow Y$,
the geometric points of the fibre product $Z\times_YZ'$ are pairs $(z,z')$ such that $\nu(z) = \mu(z')$.
In particular, the fibre product over the projection $X \rightarrow \P^1_Q$~is
\begin{alignat*}{1}
X\times_{\P^1_Q} X &= \{((u_1,r_1),(u_2,r_2) ) \mid u_1(r_1) = 0, u_2(r_2) = 0, u_1 = u_2\}\\
&\cong \{(u,r_1,r_2) \mid u(r_1) = 0, u(r_2) = 0\}.
\end{alignat*}
This product $X\times_{\P^1_Q} X$ contains a trivial component, the diagonal, corresponding to triples $(u,r,r)$. The rest is referred to as the non-trivial part, and we prove that it is an absolutely irreducible curve (Corollary~\ref{lem:Y2Irred}).
Iterating this construction, the fibre product $(X\times_{\P^1_Q}X)\times_{X}(X\times_{\P^1_Q}X)$ (over the projection $X\times_{\P^1_Q}X \rightarrow X$ to the first component) encodes quadruples $(u,r_1,r_2,r_3)$. Therefore the curve $C$ naturally embeds into the non-trivial part of this product.
We prove that this non-trivial part is itself an absolutely irreducible curve (Lemma~\ref{lem:x3irred}).\\

Instead of the projection $X \rightarrow \P^1_Q$, we work with an isomorphic cover $\theta$.
It is easy to see that the canonical projection $X \rightarrow \P^1$ is an isomorphism, with inverse $r \mapsto (s_2(r)s_1 - s_1(r)s_2,r)$.
Through the isomorphisms ${X \cong \P^1}$ and ${\P^1_Q \cong \P^1}$, this projection is isomorphic to the cover $\theta$ in the following commutative diagram (where, again, the morphisms are written affinely for convenience):
\begin{equation*}
\xymatrixrowsep{0.3pc}
\xymatrix{
&(u,r)\ar@{|->}[r] & u &\\
(u,r)\ar@{|->}[ddd]&X \ar[r]\ar[ddd]^{\wr} & \P^1_Q\ar[ddd]^{\wr} & s_1 - \alpha s_2\ar@{|->}[ddd]\\
&&  &\\
&&  &\\
r&\P^1 \ar[r]^{\theta} & \P^1 & \alpha\\
&r\ar@{|->}[r] & s_1(r)/s_2 (r). &
}
\end{equation*}
For convenience, consider $\theta$ as a cover $X_1 \rightarrow X_0$ where $X_0 = X_1 = \P^1$.
As a first step, we study the induced fibre product ${X_1\times_{X_0}X_1}$.
It contains the diagonal $\Delta_1$, isomorphic to $X_1$.
We wish to show that $Y_2 = X_1\times_{X_0}X_1 \setminus \Delta_1$ is absolutely irreducible.
The second step consists in showing that $X_2 \times_{X_1} X_2 \setminus \Delta_2$ is also absolutely irreducible, where $X_2$ is a desingularisation of $Y_2$ and $\Delta_2$ is the diagonal.
The following lemma provides a general method used in both steps.

\begin{lem}\label{lem:FiberProductIrred}
Let $Y$ and $Z$ be two absolutely irreducible, smooth, complete curves over $k$, and consider a cover $\eta : Z \rightarrow Y$. If there exists a point $a \in Z$ such that $\eta$ is not ramified at $a$ and $\#(\eta^{-1}(\eta(a))) = 2$, then $Z\times_YZ \setminus \Delta$ is absolutely irreducible, where $\Delta$ is the diagonal component.
\end{lem}

\begin{proof}
By contradiction, suppose that $Z\times_YZ \setminus \Delta$ is not absolutely irreducible, and can be decomposed as two components ${A \cup B}$.
Let $\mathrm{pr} : Z\times_YZ \rightarrow Z$ be the projection on the first factor.
Since $Z\times_YZ$ is complete, both $A$ and $B$ are complete,
so we have $\mathrm{pr}(A) = \mathrm{pr}(B) = \mathrm{pr}(\Delta) = Z$. Observe that $\mathrm{pr}^{-1}(a)$ consists of $\#(\eta^{-1}(\eta(a))) = 2$ points, so one of them must belong to two of the components $A$, $B$ and $\Delta$. That point must therefore be singular in $Z\times_YZ$, contradicting the fact that $\eta$ is not ramified at $a$ (recall that a point $(z_1,z_2) \in Z\times_YZ$ is singular if and only if $\eta$ is ramified at both $z_1$ and $z_2$).
\end{proof}

\begin{cor}\label{lem:Y2Irred}
The curve $Y_2 = X_1\times_{X_0}X_1 \setminus \Delta_1$ is absolutely irreducible.
\end{cor}

\begin{proof}
First observe that $\theta$ is ramified only at $b_1$ and $b_2$ (as can be verified from the explicit formula $\theta(r) = s_1(r)/s_2 (r)$). In particular, it is not ramified at $a_1$. Since $\#(\theta^{-1}(\theta(a_1))) = \#\{a_1,b_1\} = 2$, we apply Lemma~\ref{lem:FiberProductIrred}.
\end{proof}

\begin{lem}\label{lem:desingbij}
The desingularisation morphism $\nu : X_2 \rightarrow Y_2$ is a bijection between the geometric points.
\end{lem}

\begin{proof}
It is sufficient to prove that for any singular point $P$ on $Y_2$, and $\varphi: \tilde Y_2 \rightarrow Y_2$ the blowing-up at $P$, the preimage $\varphi^{-1}(P)$ consists of a single smooth point.
Up to a linear transformation of $X_1 = \P^1$, we can assume that $s_1$ and $s_2$ are of the form $s_1(x) = (x-1)x^q$ and $s_2(x) = x-a$, for some $a \neq 0,1$.
The intersection $A$ of the curve $Y_2$ with the affine patch $\mathbf A^2 \subset \P^1 \times \P^1$ is then defined by the polynomial
$$f(x,y) = \frac{s_1(x)s_2(y) - s_1(y)s_2(x)}{x-y} = \frac{x^q(x-1)(y-a) - y^q(y-1)(x-a)}{x-y}.$$
It remains to blow up $A$ at the singularity $(0,0)$ (which corresponds to $(b_1,b_1)$ through the linear transformation), and check the required properties. This is easily done following~\cite[Ex. 4.9.1]{hartshorne}, and we include details for the benefit of the reader. Let $\psi: Z \rightarrow \mathbf A^2$ be the blowing-up of $\mathbf A^2$ at $(0,0)$. The inverse image of $A$ in $Z$ is defined in $\mathbf A^2 \times \P^1$ by the equations $f(x,y) = 0$ and $ty = xu$ (where $t$ and $u$ parameterize the factor $\P^1$). It consists of two irreducible components: the blowing-up $\tilde A$ of $A$ at $(0,0)$ and the exceptional curve $\psi^{-1}(0,0)$. Suppose $t \neq 0$, so we can set $t = 1$ and use $u$ as an affine parameter (since $f$ is symmetric, the case $u \neq 0$ is similar). We have the affine equations $f(x,y) =0$ and $y = xu$, and substituting we get $f(x,xu) = 0$, which factors as
$$f(x,xu) = x^{q-1} \frac{(x-1)(xu-a) - u^q(xu-1)(x-a)}{1-u}.$$
The blowing-up $\tilde A$ is defined on $t = 1$ by the equations $g(x,u) = f(x,xu)/x^{q-1} = 0$ and $y = xu$. It meets the exceptional line only at the point $u = 1$, which is non-singular.
\end{proof}

The projection $X_1\times_{X_0}X_1 \rightarrow X_1$ on the first component induces another cover ${\theta_2 : X_2 \rightarrow X_1}$, through which we build the fibre product $X_2\times_{X_1}X_2$. As above, it contains a diagonal component $\Delta_2$ isomorphic to $X_2$.

\begin{lem}\label{lem:x3irred}
The curve $Y_3 = X_2\times_{X_1}X_2 \setminus \Delta_2$ is absolutely irreducible.
\end{lem}

\begin{proof}
Let $\nu : X_2 \rightarrow Y_2$ be the bijective morphism from Lemma~\ref{lem:desingbij}.
Since $\theta_1$ is only ramified at $b_1$ and $b_2$,
the cover $\theta_2$ is ramified at most at the points $\nu^{-1}(b_i,b_i)$ and $\nu^{-1}(a_i,b_i)$ (for $i \in \{1,2\}$).
In particular, it is not ramified at $\nu^{-1}(b_1,a_1)$. Since $\#(\theta_2^{-1}(\theta_2(\nu^{-1}(b_1,a_1)))) = \#\{\nu^{-1}(b_1,a_1),\nu^{-1}(b_1,b_1)\} = 2$, we apply Lemma~\ref{lem:FiberProductIrred}.
\end{proof}

\begin{prop}\label{prop:Cirred}
The curve $C$ is absolutely irreducible.
\end{prop}
\begin{proof}Let $\nu : X_2 \rightarrow Y_2$ be the morphism from Lemma~\ref{lem:desingbij}.
It is an isomorphism away from the singularities of $Y_2$, so
$$C \longrightarrow Y_3 : (u,r_1,r_2,r_3) \longmapsto (\nu^{-1}(r_1,r_2), \nu^{-1}(r_1,r_3))$$
is a morphism. It is an embedding, and the result follows from Lemma~\ref{lem:x3irred}.
\end{proof}

\section{Counting split polynomials in $\P^1_Q$}\label{sec:proofmainprop}

Recall that we wish to prove Proposition~\ref{prop:onestepdescent} by showing that $\P^1_Q(k)$ contains a lot of polynomials that split into good polynomials over $k$.
The results of Section~\ref{sec:ramifications} allow us to prove in Theorem~\ref{thm:splitpolyonp} that a lot of polynomials in~$\P^1_Q(k)$ do split. We then show in Proposition~\ref{prop:coprimality} that all these polynomials are coprime, which implies that bad polynomials cannot appear too often.

\begin{thm}\label{thm:splitpolyonp}
Let $k/\mathbf{F}_{q^d}$ be a field extension of degree $m$, and $Q$ be a good irreducible quadratic polynomial in $k[x]$ coprime to $h_1$.
If $dm \geq 23$, there are at least $\#k/2q^3$ polynomials in~$\P^1_Q$ that split completely over the field $k$.
\end{thm}

\begin{proof}
Let ${\Theta : Y_3 \rightarrow \P^1_Q}$ be the cover resulting from the composition of the successive covers of Section~\ref{sec:ramifications}.
Let $S_3 = \Theta^{-1}(\P^1_Q \cap S)$.
The embedding $C\rightarrow Y_3$ from Proposition~\ref{prop:Cirred} has image $Y_3 \setminus S_3$.
The morphism $$\mu : Y_3 \rightarrow \P^1 \times \P^1 \times \P^1 : (\nu^{-1}(r_1,r_2), \nu^{-1}(r_1,r_3)) \mapsto (r_1,r_2,r_3)$$
restricts to an embedding of $Y_3\setminus S_3$.
Let $A$ be the intersection of $\mu(Y_3)$ with the affine patch $\mathbf A^3$. The curve $A$ is a component of the (reducible) curve defined by the equations $\theta(r_1) = \theta(r_2)$ and $\theta(r_1) = \theta(r_3)$. Therefore $A$ is of degree at most $4(q+1)^2$. If $B$ is the closure of $A$ in $\P^3$, then~\cite[Th. 3.1]{Ba96} shows that
$$|\# B(k) - \#k - 1| \leq 16(q+1)^4\sqrt{\#k}.$$
Since $Y_3$ is complete, $\mu(Y_3)$ is closed, so all the points of $B \setminus A$ are at infinity, and there are at most $\deg(B) \leq 4(q+1)^2$ of them. Also, at most $2(q^3-q)$ points of $B$ are in $\mu(S_3)$ (because $\#S = 2$ and $\Theta$ is of degree $q^3-q$). Therefore
$$\#C(k) = \#(Y_3\setminus S_3)(k) \geq \#k + 1 - 16(q+1)^4\sqrt{\#k} - 4(q+1)^2 - 2(q^3-q).$$
Since $q \geq 2$ and $dm \geq 23$, we get $\#C(k) \geq \#k /2$. From Proposition~\ref{prop:Csplitcomp}, and the fact that the map $\Theta$ is $q^3-q$ to one, we get that at least $\#k/2q^3$ polynomials in $\P^1_Q$ split completely over $k$.
\end{proof}

Let $\varphi$ be the morphism defined in~\eqref{eq:morphxqtoh}.

\begin{prop}\label{prop:coprimality}
Suppose $Q$ is a good polynomial. For any two distinct polynomials $f$ and $g$ in $\P^1_Q({\overline{\F}_q})$, we have $\gcd(f,g) = 1$ and $\gcd(h_1\varphi(f),h_1\varphi(g)) = Q$.
\end{prop}
\begin{proof}
Let $s_1$ and $s_2$ be as in Proposition~\ref{prop:distinctroots}. They have no common root.
Since $f$ and $g$ are distinct, all the polynomials of $\P^1_Q$ are of the form $\alpha f + \beta g$ for $(\alpha:\beta) \in \P^1$. Then, if $r$ is a root of $f$ and $g$, $r$ is a root of all the polynomials of $\P^1_Q$. In particular, it is a root of both $s_1$ and $s_2$, a contradiction. This shows that $\gcd(f,g) = 1$.

Similarly, if a polynomial $h$ divides $h_1\varphi(f)$ and $h_1\varphi(g)$, it must also divide both
$h_1\varphi(s_1) = (x-a_1)(h_0 - b_1^qh_1) \text{, and }
h_1\varphi(s_2) = (x-a_2)(h_0 - b_2^qh_1).$
Since $h_0 - b_1^qh_1$ and $h_0 - b_2^qh_1$ are coprime, $h$ must divide $Q$.
\end{proof}

\subsection*{Proof of Proposition~\ref{prop:onestepdescent}} \label{sec:proofprop}
As discussed in Section~\ref{sec:overview}, it is sufficient to prove that a uniformly random element of $\P^1_Q(k)$ has a good probability to lead to an elimination into good polynomials.
A polynomial $f \in \P^1_Q(k)$ leads to an elimination into good polynomials if $f$ splits completely over $k$ into good linear polynomials, and $\varphi(f)$ is itself a good polynomial.

Let $A$ be the set of polynomials of $\P^1_Q(k)$ that split completely over $k$.
From Theorem~\ref{thm:splitpolyonp}, $A$ contains at least $q^{dm-3}/2$ elements.
Trap roots $\tau$ occurring in $A$ or $\varphi(A)$ must be roots of $h_1x^q - h_0$, or of $h_1x^{q^{dn+1}}-h_0$ for $n \mid m/2$, or satisfy $\frac{h_0}{h_1}(\tau) \in \mathbf{F}_{q^{dm/2}}$. There are at most $q^{\frac{dm}{2} + 3}$ such trap roots. From Proposition~\ref{prop:coprimality}, any trap root can only occur once in $A$ and in $\varphi(A)$.
So there are at most $2q^{\frac{dm}{2} + 3}$ polynomials in $A$ for which trap roots appear.
Therefore the number of elements in $A$ leading to a good reduction is at least $$\frac{1}{2}q^{dm-3} - 2q^{\frac{dm}{2} + 3} \geq \frac{1}{2}\left(q^{dm-3} - 4q^{dm - 8}\right) \geq \frac 1 4 q^{dm-3},$$
using $dm \geq 23$. Since $\P^1_Q(k)$ contains $q^{dm}+1$ elements, the probability of a random element to lead to a good elimination is $1/O(q^3)$.\qed

\section*{Acknowledgements}
Part of this work was supported by the Swiss National Science Foundation
under grant number 200021-156420.

\bibliographystyle{amsalpha}