Rader's FFT algorithm

Remarks

Since $g$ generates the multiplicative group modulo $p$, the maps $m \mapsto g^m$ and $q \mapsto g^{-q}$ are bijections from $\set{0, \ldots, p-2}$ onto $\set{1, \ldots, p-1}$. For $n = g^m$ and $k = g^{-q}$ one has $nk \equiv g^{-(q-m)} \pmod p$, and $\omega^{nk}$ depends only on $nk$ modulo $p$; this gives the formula. The cyclic convolution of length $p-1$ can be computed by DFTs of length $p - 1$, which is composite for $p > 3$. These can use the Cooley–Tukey algorithm, possibly after zero padding to a power of $2$. Example: $p = 5$ and $g = 2$, so $(g^0, g^1, g^2, g^3) = (1, 2, 4, 3)$ and $(g^0, g^{-1}, g^{-2}, g^{-3}) = (1, 3, 4, 2)$. The hypothesis that $p$ is prime gives a primitive root, and makes the nonzero indices a group under multiplication. For composite lengths the nonzero indices do not form such a group.

Going deeper

For a student

The algorithm uses the structure of $(\Z/p\Z)^\times$, which is cyclic of order $p - 1$. Permuting inputs by $n = g^m$ and outputs by $k = g^{-q}$ turns the $(p-1) \times (p-1)$ block of the DFT matrix into a circulant matrix. Circulant matrices are diagonalised by the DFT, which is why the convolution can be done in $O(p \log p)$ operations. Winograd's short-length FFT modules are built on the same reduction. Bluestein's algorithm is an alternative that works for every length and does not need a primitive root.