Paul Kirchner

Pierre- Alain Fouque

Submitted

Kirch- Ner Paul

Pierre-Alain Fouque

Alexandre Gélin

Pierre-Alain Fouque

Benoit Gérard

Jonathan Bootle

Claire Delaplace

Ierre- Alain Fouque

Alain Fouque

Blake With

Pierre-Alain Fouque

Pierre Karpman

Gilles Barthe

Sonia Belaïd

Pierre-Alain Fouque

Mélissa Rossi

Mehdi Ti

Pierre-Alain Fouque

Benjamin Grégoire

Marco Gaboardi

Justin Hsu

Pierre-Yves Strub

Tetsuya Sato

• Optimal lattice reduction and beyond with

Keywords:

Besides the topics covered in this manuscript, we worked on various other topics

• Relational reasoning via probabilistic coupling with Gilles Barthe, Benjamin Grégoire, Justin Hsu, Léo Stefanesco and Pierre-Yves Strub.

Proceedings of the conference on Logic for Programming, Arti cial Intelligence, and Reasoning LPAR . This work aims at giving a systematic account of the use of coupling of random variables for the proof of probabilistic programs. In particular, while the mathematical de nition of coupling looks rather complex and cumbersome to manipulate, we show that the relational program logic pRHL-the logic underlying the EasyCrypt cryptographic proof assistant-already internalizes a generalization of probabilistic coupling. With this insight, constructing couplings is no harder than constructing logical proofs. We demonstrate how to express and verify classic examples of couplings in pRHL, and we mechanically verify several couplings in EasyCrypt. Hermann Minkowski, dans son traité Geometrie der Zahlen -la Géométrie des nombres en français -([ ]), eut la fertile intuition qu'une géométrisation de la théorie des nombres permettrait de prouver de manière quasi visuelle des résultats abstraits. Cette Géométrie des Nombres a en particulier permis de comprendre et de simpli er les résultats portant sur les unités de corps de nombres, ainsi que d'étendre grandement les résultats d'approximation Diophantienne. Un exemple simple mais particulièrement frappant de cette nouvelle manière de « voir »la théorie des nombres est le célèbre théorème de deux carrés de Fermat, que l'on peut énoncer ainsi : Théorème . . Un nombre premier impair p peut être écrit comme une somme de deux carrés : x 2 + y 2 , avec x, y ∈ Z si et seulement si p ≡ 1 mod (4).

Nous en donnerons une preuve quasi intuitive après avoir introduit plus formellement la notion de réseau, par opposition avec la preuve plus classique, utilisant uniquement des raisonnements arithmétiques sur les congruences modulaires. Depuis les travaux de Minkowski, les liens entre géométrie et théorie des nombres se sont multipliés et densi és, élargissant ainsi l'éventail des méthodes pour attaquer des problèmes a priori purement arithmétiques.

L'objet central de cette théorie géométrique des nombres est le réseau, qui formalise l'idée intuitive de grille dans le plan ou l'espace. Au travers de cette thèse nous allons nous intéresser à une généralisation de la notion de réseau, non plus dans l'espace Euclidien usuel mais dans des espaces construits sur des corps de nombres, généralisant les nombres rationnels. C'est ce lien étroit entre la théorie des nombres, par essence arithmétique et algébrique, et la géométrie que nous avons souhaité mettre en avant dans ce manuscrit, au travers des méthodes de réduction algorithmique, permettant une approche calculatoire de la théorie développée par Minkowski.

A n de nous forger une intuition sur cet objet géométrique qu'est le réseau Euclidien, quittons l'arithmétique pour revenir aux prémices de cette notion, qui trouvent leur origine dans un problème au caractère très visuel.

. Genèse : les empilements denses de sphères Il s'agit du problème dit de « l'empilement de sphères » : quelle est la densité maximale possible d'un empilement de sphères de R n pour une dimension n xée ? Par empilement de sphères de R n , nous comprenons une famille in nie de boules de même rayon r et d'intérieurs disjoints, et par densité, la fraction de R n recouverte par les boules.

En dimension n = 2 par exemple, la densité maximale est obtenue grâce à l'empilement dit « hexagonal », où les boules sont centrées sur une grille hexagonale, comme représenté ci-dessous.

On peut alors montrer que la densité de cet empilement est de :

π 2 √ 3 ∼ = 0.9069,
en comparant l'aire de la surface dé nie par quatre cercles en contact avec celui du losange dé nit par les centres de ces cercles. Bien que le caractère optimal de cet empilement soit conjecturé depuis l'école pythagoricienne, il fallut attendre les travaux de Lagrange en pour en obtenir une preuve rigoureuse.

Le cas de la dimension apparaît comme plus complexe encore. Kepler conjectura en que l'empilement traditionnel des marchands de fruits, ou celui des canonniers, était le plus dense. Il consiste à empiler les boulets en les laissant glisser dans l'espace formé par ceux de l'étage du dessous, formant une pyramide, comme représenté ci-dessous : Mais il fallut attendre près de quatre siècles pour obtenir la première démonstration correcte de cette conjecture de Kepler : la preuve ne fut annoncée qu'en par Hales, et nalement publiée complètement en et dans [ , ]. L'article original de Hales fait près de pages et nécessite une grande quantité de calculs assistés par ordinateurs. La véri cation et certi cation de ces calculs utilise en particulier l'arithmétique d'intervalles a n de détecter et de gérer les erreurs d'arrondis des calculs numériques. Nous rencontrerons de nouveau cette technique de calcul, dans le cadre de nos travaux cette fois, pour assurer la certi cation des algorithmes de réduction de réseaux.

Dans ces deux cas, il est intéressant de remarquer que les centres des boules sont disposés de manière régulière dans l'espace : ils forment ce que l'on appelle un réseau.

Les cas des dimensions supérieures est resté ouvert jusqu'aux travaux de Viazovska en puis -avec ses collaborateurs Cohn, Kumar, Miller et Radchenko cette fois -qui prouvent que les empilements les plus denses en dimensions et proviennent eux aussi du placement de boules sur des réseaux : le réseau E 8 en dimension et le réseau dit de Leech en dimension . Il est toutefois amusant de constater que les preuves sont beaucoup plus concises que la preuve de Hales et surtout ne sont pas des preuves purement géométriques : elles reposent au contraire sur l'étude de certaines formes modulaires. Dualement aux idées de Minkowski, c'est cette fois la théorie des nombres qui permet de prouver des théorèmes de géométrie Euclidienne.

Ces cas très particuliers en dimension , , et incitent à l'étude des empilements de sphères centrées sur les points d'un réseau, plus simplement nommés «empilements de réseaux». C'est en e et l'une des motivations historiques de l'étude systématique des réseaux Euclidiens. De fait, déterminer la densité de l'empilement de réseau le plus dense revient à déterminer la valeur exacte de la constante dite de «Hermite», que nous introduirons formellement au paragraphe . . . Si de manière générale les empilements les plus denses sont encore inconnus , les empilements de réseaux de petites dimensions ont été, eux, complètement classi és : par Lagrange en dimension deux [ ], Gauss en dimension trois [ ], Korkine et Puisqu'il est possible de translater une telle grille sans changer ses propriétés géométriques, nous pouvons toujours supposer que l'origine (0) de l'espace est elle aussi dans le réseau. Dès lors, la somme de deux vecteurs du réseau est aussi un vecteur du réseau, ainsi que l'opposé de tout vecteur. Ainsi un réseau possède une structure algébrique naturelle de groupe abélien. En outre, comme l'indiquait l'exemple des empilements, deux vecteurs du réseau ne peuvent être arbitrairement proches : topologiquement, l'ensemble est discret pour la distance Euclidienne. Il s'avère que ces deux notions encodent exactement les propriétés d'un réseau, dé ni de la manière suivante : Dé nition . . Un réseau Euclidien Λ est un sous-groupe discret de (R n ,+), ou, de manière équivalente, il s'agit de l'ensemble des combinaisons linéaires à coe cients dans Z d'une famille de vecteurs linéairement indépendants.

De manière générale, notons Λ[v 1 , . . . , v k ] le sous-réseau engendré par une famille (v 1 , . . . , v k ) de vecteurs de Λ, c'est-à-dire :

Λ[v 1 , . . . , v k ] = a 1 v 1 + • • • + a k v k a 1 , . . . , a k ∈ Z .
Un réseau est donc une structure régulière -la structure des voisins de chaque point étant la même pour tout point -et discrète d'un espace, qui est munie d'une norme Euclidienne.

. . . Bases et covolume. Une base d'un réseau Λ est une famille (v 1 , . . . , v k ) de vecteurs linéairement indépendants tels que ces vecteurs génèrent le réseau, c'est-à-dire telle que :

Λ[v 1 , . . . , v k ] = Λ.
Manifestement, un réseau de dimension est de la forme Z = { k | k ∈ Z} pour un certain réel , et par conséquent n'a que deux bases et -. En revanche, dès que la dimension excède un, un réseau possède une in nité de bases. Elles ont toutes le même cardinal appelé « rang du réseau ». Les bases di èrent entre elles par des matrices de passage dites « unimodulaires » : si B = (b 1 , . . . , b n ) est une base de Λ, alors une famille C = (c 1 , . . . , c n ) de R n est aussi une base de Λ si et seulement si la matrice carrée U de taille n × n exprimant C dans la base B est une matrice inversible -pour conserver la propriété d'être une base -à coe cients entiers -puisque les deux familles sont composées d'éléments du réseau. Il s'avère que ces conditions sur U sont équivalentes au simple fait d'être entière et de déterminant ±1. est un réel strictement positif indépendant de la base B choisie : on l'appelle le discriminant du réseau Λ. Le déterminant ou covolume de Λ, noté covol Λ, est dé ni quant à lui comme la racine carrée du discriminant. Il est égal au volume -pour la mesure de Lebesgue de R n -du parallélépipède dé ni par la base B dans R n :

P (B) = d ∑ i=1 x i v i | 0 ≤ x i < 1 .
La Figure donne un exemple de réseau plan avec deux bases et leurs parallélépipèdes correspondants.

. . . Invariant d'Hermite. Comme nous en avions l'intuition, le caractère discret et périodique d'un réseau assure que ses éléments ne peuvent pas être arbitrairement près les uns des autres et en particulier de l'origine 0. De fait, il est possible de rechercher les plus courts vecteurs du réseau, c'est-à-dire les éléments étant les plus proches de 0. On appelle « premier minimum du réseau » la quantité λ 1 (Λ) = min x∈Λ\{0} x .

Les fondements de la géométrie des nombres telle qu'initiée par les travaux de Minkowski permettent de prouver l'existence d'un point du réseau dans des parties de l'espace su samment grandes :

Théorème . (Minkowsi). Soit Λ un réseau de R n et C ⊆ R n une partie mesurable, convexe, symétrique par rapport à , et telle que Vol(C) > 2 n covol Λ, alors C contient au moins un point de Λ.

L'intuition qui soutient ce théorème est relativement simple : on peut s'en convaincre en juxtaposant les parallélépipèdes formés par les 2 n choix d'orientations possibles des vecteurs d'une base B. L'intérieur de cet ensemble est de volume 2 n vol P (B) = 2 n covol Λ, et par construction, il ne peut contenir que 0. La Figure fournit un exemple en dimension de ce collage.

F : Exemple de cas critique du théorème de Minkowski.

Si l'on applique ce théorème en prenant pour ensemble C des boules fermées, on prouve que tout réseau Λ de dimension n contient un vecteur différent de 0, dont la taille véri e :

v = 2 covol(Λ)Γ n 2 + 1 π n 2 1 n ≤ 1 2 √ 4 + n(covol Λ) 1 n ,
avec Γ la fonction Gamma d'Euler . Le terme de droite de cette équation ne dépend que de la dimension et du volume du réseau Λ. Ainsi, nous pouvons nous demander quel est le meilleur majorant γ n , tel que pour tout réseau Λ de rang n il existe un vecteur non nul v ∈ Λ tel que v ≤ γ n (covol Λ)

1 n . Ceci revient donc à évaluer la constante :

√ γ n = max Λ λ 1 (Λ) (covol Λ)
1 n , Le volume de la boule de dimension n et de rayon r est en e et égal à π n/2 r n Γ( n 2 +1)

.

où le minimum est pris sur l'ensemble des réseaux réels de rang n. Cette quantité est appelée « la constante de Hermite en dimension n ». Puisque chaque réseau induit un empilement de sphères de rayon λ 1 (Λ)/2 et ayant pour centres les points du réseau, il s'avère qu'estimer la valeur de la constante d'Hermite revient à déterminer la densité de l'empilement de réseau le plus dense. La détermination exacte de la constante d'Hermite constitue de fait l'un des problèmes principaux de la géométrie des nombres. Il est intéressant de noter à ce point que les résultats évoqués permettent d'assurer l'existence théorique d'un vecteur court dans un réseau. Toutefois, en pratique, sa construction demeure di cile : la recherche algorithmique du plus court vecteur d'un réseau arbitraire est un problème di cile au sens de la théorie de la complexité . Dès lors, pour des calculs pratiques, lorsque la dimension devient trop importante on ne va plus chercher un plus court vecteur mais une « approximation» d'un plus court vecteur, c'est-à-dire un vecteur non nul du réseau se situant dans une boule centrée sur l'origine et de rayon su sant. Les méthodes algorithmiques permettant cette recherche forment l'algorithmique de la réduction de réseau.

. . . Digression : retour sur la preuve du théorème des deux carrés. Avant de poursuivre notre tour d'horizon des réseaux et de leur réductions, revenons sur notre théorème liminaire. Nous pouvons en e et donner une preuve concise du théorème des deux carrés de Fermat utilisant la notion de réseau introduite plus haut et en particulier grâce au théorème de Minkowski. Soit donc p un entier premier congru à -1 modulo 4, ainsi -1 est un résidu quadratique modulo p : il existe donc un entier q tel que -1 ≡ q 2 mod p. Considérons alors le réseau plan Λ engendré par les vecteurs u = (q, 1) et v = (p, 0). Notons M la matrice [u, v]. Le volume du réseau est donc par dé nition : covol Λ = det(M T M) = p Soit alors la partie convexe symétrique par rapport à 0 dé nie par : C = (x, y) ∈ R 2 x 2 + y 2 < 2p , c'est-à-dire le disque ouvert de rayon 2p centré en 0. Son volume est donc :

vol C = 2pπ > 4p = 2 2 p = 2 2 covol Λ.
Ainsi par le théorème de Minkowski, il existe un point non nul du réseau dans cette boule, (x, y). Mais alors il existe a, b ∈ Z tels que : (x, y) = au + bv = (aq + bp, a). Ainsi en prenant le carré de la norme de ce vecteur nous obtenons :

x 2 + y 2 = a 2 + a 2 q 2 + b 2 p 2 + 2abpq ≡ a 2 (1 + q 2 ) mod p. Mais comme q 2 ≡ -1 mod p nous obtenons x 2 + y 2 ≡ 0 mod p, et donc x 2 + y 2 = p puisque x 2 + y 2 = 0 et x 2 + y 2 < 2p. La Figure donne un exemple de la situation pour le cas p = 5. On voit clairement apparaître les points à l'intérieur du disque C, permettant de trouver les facteurs carrés comme dans la preuve.

C'est cette dualité entre arithmétique et géométrie qui sera notre l rouge tout au long de ce manuscrit. Nous avons souhaité développer ce sujet au travers du prisme de l'algorithmique des réseaux, domaine plus récent, qui trouve son origine dans les travaux de Gauss et Lagrange au XIX ème siècle.

.

De la réduction algorithmique des réseaux

Nous avons vu que les réseaux possèdent une in nité de bases dès que la dimension excède deux. Nous savons qu'un espace vectoriel Euclidien possède des bases plus privilégiées : les bases orthonormées. Le caractère continue de R n permet en e et de redresser itérativement chaque vecteur d'une base pour assurer son orthogonalité avec les vecteurs précédents.

. . . Orthogonalisation. Pour nous en convaincre, regardons comment rendre orthogonal un vecteur v par rapport à un vecteur u, et ce en utilisant seulement une combinaison linéaire de u : soit λ un paramètre réel et v λ = vλu le vecteur que nous voulons rendre orthogonal à u.

u • u,v u,u u v v λ
De l'équation u, v λ = 0 nous tirons : u, vλ u, u = u, v λ = 0, de telle sorte que choisir λ = u, v / u, u convient. Cette construction est illustrée par la gure ci-contre. Cette situation se généralise. Étant donnée une famille (v 1 , . . . , v n ) de vecteurs, nous pouvons commencer par orthogonaliser v 2 par rapport à v 1 . No-tons v * 2 ce nouveau vecteur. Nous pouvons alors orthogonaliser v 3 par rapport à v 1 et v * 2 , formant un vecteur v * 3 orthogonal à ces deux vecteurs. Nous pouvons continuer avec v 4 en le rendant orthogonal à v 1 , v * 2 , v * 3 , et ainsi de suite. Cet algorithme permet de construire une base orthogonale de l'espace telle que le sous-espace engendré par ses i premiers vecteurs soit le même que le sous espace engendré par v 1 , . . . , v i . Cette méthode constitue le procédé d'orthogonalisation de Gram-Schmidt. Son écriture en pseudo-code est precisée dans l'algorithme :

Algorithme -Gram-Schmidt Données : (v 1 , . . . , v n ) une famille de vecteurs Résultat : Une famille orthogonale (v * 1 , . . . , v * n ).

v * 1 ← v 1 pour k = 2 jusqu'à n faire v * k ← v k pour j = 1 jusqu'à k -1 faire v * k ← v * k - v k ,v * j v * j 2 • v * j fin pour fin pour Retourner (v * 1 , . . . , v * n )
. . . Réduction en taille. Dans le cas d'un réseau, en revanche, la rigidité imposée par le caractère discret engendre une obstruction à cette construction : puisque seules des combinaisons à coe cients entiers sont possibles, on ne peut que chercher à s'approcher des vecteurs résultants de l'orthogonalisation que nous venons d'introduire.

taille des vecteurs considérés. Ainsi ce processus porte le nom de «réduction en taille» ou de «réduction faible». Cet algorithme est décrit en pseudo-code dans l'algorithme .

Algorithme -Réduction en taille Données : (v 1 , . . . , v n ) une famille de vecteurs Résultat : Une famille réduite en taille (v 1 , . . . , v n ).

v * 1 , . . . , v * n ← Gram-Schmidt(v 1 , . . . , v n ) pour k = 2 jusqu'à n faire pour j = i -1 jusqu'à 1 faire

v k ← v k - v k ,v * j v * j 2
• v j fin pour fin pour Retourner (v 1 , . . . , v n ) . . . Densi er les réseaux successifs. La notion de base privilégiée semble donc moins immédiate dans le cadre d'un réseau que dans un espace Euclidien. Comme nous l'avons vu, la réduction en taille permet de réduire le défaut d'orthogonalité et la norme des vecteurs d'une base. Nous pouvons donc chercher une base formée de vecteurs aussi courts que possible. Pour ce faire nous pouvons par exemple nous e orcer de densi er les sous-réseaux successifs engendrés par les vecteurs de la base, c'est-à-dire d'en faire diminuer le volume. Plus spéci quement, prenons une base (v 1 , . . . , v n ) du réseau Λ, et dénotons par Λ i le sous-réseau engendré par les i premiers vecteurs v 1 , . . . , v i . Supposons que Λ 1 soit le sous-réseau le plus dense parmi tous les sous-réseaux de rang . En conséquence, v 1 est nécessairement le vecteur le plus court de Λ. Ensuite, si Λ 2 est lui aussi dense et contient v 1 , alors v 2 sera à son tour vraisemblablement court (bien que pas né'essairement le plus court), sans quoi le volume de ce sous-réseau serait grand. Il en va de même pour les sous-réseaux Λ i suivants : avoir des sous-réseaux Λ i denses implique que les vecteurs v i sont petits.

. . . Vers la réduction LLL. Il est donc manifeste que la réduction en taille agit sur les vecteurs sans modi er pour autant les sous-réseaux Λ i . A n de pouvoir pouvoir densi er ces sous-réseaux successifs, nous pouvons permuter les vecteurs de la base. Il serait bien entendu très coûteux d'essayer les n! permutations des n vecteurs. Mais rappelons-nous que le groupe des permutations est engendré par les transpositions de la forme (i, i + 1)-c'est-à-dire les transpositions de deux éléments adjacents. De fait, nous pouvons chercher à densi er les sous-réseaux successifs en transposant deux à deux des vecteurs successifs. Une fois que des vecteurs ont été échangés, il devient possible d'e ectuer une nouvelle réduction en taille. Cette procédure peut alors continuer jusqu'à ce que plus aucune modi cation, échange, ou réduc-Algorithme -LLL-réduction Données : (v 1 , . . . , v n ) une base d'un réseau Λ de rang d Résultat : Une base réduite de

Λ k ← 2 tant que k ≤ d faire v * 1 , . . . , v * n ← Gram-Schmidt(v 1 , . . . , v n ) pour j = k -1 jusqu'à 1 faire v k ← v k - v k ,v * j v * j 2 • v j fin pour si vol(v 1 , . . . , v i-1 , v i+1 ) < δ vol(v 1 , . . . , v i-1 , v i ) alors k ← k + 1 sinon échanger v k et v k-1 k ← max(k -1, 2) fin tq Retourner (v 1 , . . . , v n )
Le schéma suivant illustre une étape de l'algorithme en dimension . La base en cours de réduction est v 1 , v 2 , v 3 . On cherche à réduire v 3 par le vecteur v 2 . Cette étape va s'e ectuer, en relevant le résultat, noté x de la réduction de π(v 3 ) par π(v 2 ), où π est la projection orthogonale sur l'espace v ⊥ 1 . Ce relèvement est e ectué en choisissant l'élément v 3 de Λ ∩ (x + v 1 ) de plus petite norme.

v 3 v 2 v 1 v ⊥ 1 π(v 2 ) π(v 3 ) x (v 3 )
. . . Facteur d'approximation et réduction avec oracles. L'algorithme est un algorithme de type glouton puisqu'il provoque un échange de deux vecteurs dès qu'une amélioration de volume est possible. Néanmoins il n'est pas optimal vis-à-vis de la longueur du premier vecteur ou de la densité des sous-réseaux successifs retournés. En revanche il fournit une approximation des valeurs optimales de ces volumes, quanti ée par le lemme suivant : Lemme . . Soit (v 1 , . . . , v n ) une base d'un réseau Λ, qui est réduite par l'algorithme de paramètre 0 < δ < 1. Alors, pour tout 1 ≤ k ≤ n, nous avons :

covol Λ[v 1 , . . . , v k ] ≤ δ - 1 4 -(n-k)k 4 covol Λ k n :
Par exemple, ce lemme assure que l'algorithme permet de trouver un vecteur de norme plus petite que δ -1 4 -n-1 4 covol Λ 1 n . Sachant que la constante d'Hermite γ n est polynomiale en n, il s'agit donc d'une approximation exponentielle du plus court vecteur de Λ. Nous pouvons naturellement nous demander s'il est possible de diminuer les termes exponentiels en (δ -1/4) -k(n-k)/4 . Mais alors, à quel coût ? En e et ces facteurs, dits d'approximation, peuvent être réduits, si l'on accepte de recourir à l'usage d'un oracle permettant de déterminer exactement un plus court vecteur dans un réseau arbitraire. L'algorithm dit de semi-reduction, introduit par Schnorr [ ] en , peut être vu comme une extension de dans laquelle on ne cherche plus un plus court vecteur dans un réseau projeté de rang , mais cette fois dans un réseau projeté de rang β, pour un paramètre 1 < β < n. L'algorithme ainsi obtenu renvoie certes des vecteurs plus courts que , mais sa complexité est exponentielle en β. Il y a donc un compromis entre la qualité de réduction, essentiellement donnée par la taille du plus court vecteur de la base, et le temps nécessaire à ce calcul. L'illustration même de ce compromis temps/qualité est donnée par le théorème suivant, qui provient de la variante de Micciancio et Walter [ ], avec les techniques d'énumération de [ ] pour l'oracle de recherche du plus court vecteur : Théorème . . Le plus petit vecteur v renvoyé par l'algorithme avec paramètre β véri e :

v ≤ β n-1 2(β-1) • (vol Λ) 1 n .
Cet algorithme a une complexité de la forme Poly(n, log B) 3 2 β/2+o (β) , où B est une borne sur la taille des coe cients de la base d'entrée.

:

.

Corps de nombres, nombres algébriques

Le concept de nombre algébrique, introduit par Abel, est né de la volonté des mathématiciens de résoudre les équations « algébriques »c'est-à-dire de résoudre des équations du type P(x) = 0, où P désigne un polynôme à coefcients rationnels. L'idée fondamentale, évoquée dans les lettres d'Évariste Galois, consiste à adjoindre une racine α de P aux rationnels Q et à étudier l'objet

Q(α) = {q 0 + q 1 α + • • • + q k α k | k ≤ 0, q 1 ,
. . . , q k ∈ Q} résultant de cette adjonction. Donnons un exemple de corps de nombres qui nous servira à exempli er les notions que nous introduirons ultérieurement. On construit ainsi le corps Q(i) = {a + ib | a, b ∈ Q} provenant de l'adjonction des racines du polynome X 2 + 1 au corps des rationnels.

. . . Structure de corps de nombre. Il s'avère que Q(α) est un corps et constitue donc à ce titre une extension des rationnels. Il est en outre de degré ni -sa dimension [Q(α) : Q] est nie en tant que Q espace-vectorielsur Q. De ce fait, tout élément de Q(α) est algébrique, c'est-à-dire annulé par un polynôme à coe cients rationnels. Si nous nous limitons à regarder les éléments de Q(α) qui sont racines de polynômes unitaires à coe cients entiers nous obtenons un sous-ensemble O Q(α) , qui est un anneau pour les lois de Q(α). Il s'agit de l'anneau des entiers du corps Q(α), qui constitue une généralisation des entiers relatifs -l'anneau des entiers de Q n'est autre que Z. Il constitue même une généralisation n-dimensionnelle de Z puisque l'on peut montrer (cf. Theorem . . ) qu'il existe des éléments v 1 , . . . , v n ∈ O n K tels que O K soit l'ensemble des combinaisons linéaires à coe cients dans Z des v i , c'est-à-dire que :

O K ∼ = v 1 Z ⊕ • • • ⊕ v n Z ∼ = Z n .
Si l'on reprend notre exemple, l'anneau des entiers de Q(i) est Z[i] = {a + ib | a, b ∈ Z} appelé l'anneau des entiers de Gauss. Il est immédiat que Z[i] ∼ = Z 2 en tant que groupe abélien.

. . . Norme Euclidienne sur un corps de nombre. Un corps de nombres K = Q[α] peut être plongé , dans le corps des complexes C de multiples manières. Puisque le corps K est engendré par l'élément α, tout plongement σ est parfaitement déterminé par l'image de α. Sachant que pour tout polynôme P ∈ Q[X] nous avons nécessairement σ(P(α)) = P(σ(α)), σ(α) doit donc être conjugué avec α, c'est-à-dire être une racine du polynôme minimal de α. Il y a donc au plus n = [K : Q] prolongements possibles et on peut véri er qu'ils sont tous distincts. Notons les σ 1 , . . . , σ n .

Ces plongements permettent de dé nir le plongement Archimédien du corps K dans C n : σ : K -→ C n x -→ (σ 1 (x), . . . , σ n (x)) .

Nous pouvons alors relever la structure Hermitienne canonique de C n vers le corps K en dé nissant le produit hermitien :

a, b = n ∑ i=1 σ i (a)σ i (b),
où z → z est la conjugaison habituelle de C. Ce produit munit K de sa norme canonique, donnée par a = a, a . Dans notre exemple, il existe donc deux plongements σ 1 et σ 2 , envoyant respectivement la racine i sur elle-même et sur sur son conjugué -i. Ainsi, le plongement Archimédien d'un élement a + ib ∈ Q est le vecteur (a + ib, aib) ∈ C 2 . La norme algébrique de a + ib est donc (a + ib)(aib) = a 2 + b 2 .

Mais quel rapport avec les réseaux, introduits supra ?

Dans le sens présent le plongement est algébrique, c'est-à-dire qu'il préserve les propriétés de corps de K : un plongement n'est donc rien d'autre qu'un morphisme de corps de K dans C.

:

. Structure naturelle de réseaux des entiers de corps de nombre Puisque l'anneau des entiers O K de K est inclus dans K, il hérite de la structure Euclidienne que nous venons de dé nir. Ainsi puisque O K est l'ensemble des combinaisons linéaires entières d'une base, il s'agit bien d'un réseau au sens de la dé nition que nous avons donnée en paragraphe . . .

. Réseaux algébriques

Nous avons introduit la notion de réseau comme étant un ensemble de combinaisons linéaires à coe cients entiers, vivant dans un espace Euclidien. La structure algébrique décrivant formellement l'ensemble des combinaisons entières d'une base est celle de Z-module libre.

. . . Petite digression sur les modules. Rappelons brièvement qu'un module est une structure algébrique dé nie comme un espace vectoriel, mais dans laquelle le corps des scalaires n'est plus un corps mais seulement un anneau. Il s'agit donc d'un groupe additif muni d'une loi de multiplication externe par les éléments d'un anneau, avec les bonnes règles de compatibilité. Cette structure est plus subtile que celle d'espace vectoriel, en particulier car un anneau est beaucoup moins rigide qu'un corps et la théorie des modules sur des anneaux arbitraires est très riche. Néanmoins notons qu'un module libre niment généré sur un anneau R se comporte essentiellement comme un espace vectoriel. En particulier le module possède des bases de même cardinal. Il est, de fait, isomorphe à R n pour un certain n, de la même manière qu'un K-espace vectoriel de dimension n est isomorphe à K n . Ainsi, un Zmodule libre n'est rien d'autre qu'un « espace vectoriel »sur Z, c'est-à-dire une structure de la forme b 1 Z ⊕ • • • ⊕ b n Z pour b 1 , . . . , b n une base.

. . . Généralisation de la notion de réseau. Nous pouvons par conséquent réinterpréter de la manière suivante la dé nition de réseau donnée précédemment. Un réseau est la donnée de deux structures : d'une part la structure algébrique, à savoir celle de Z-module libre que nous venons de détailler, et d'autre part sa structure métrique, c'est-à-dire, celle de norme Euclidienne sur ses éléments. Nous allons maintenant tâcher de généraliser la notion de réseau en remplaçant l'anneau des entiers Z par des anneaux plus généraux.

Une famille de candidats naturels pour ces anneaux est constituée par les anneaux d'entiers de corps de nombres. Ces anneaux possèdent une arithmétique proche de l'arithmétique usuelle de Z. Ainsi, donnons-nous K, un corps de nombre, et notons O K son anneau d'entiers. Métriquement parlant, nous disposons d'une norme Euclidienne sur K, qui permet de construire une norme Euclidienne sur l'espace vectoriel K n pour n un entier xé. Nous n'allons plus considérer des modules sur Z mais des modules sur O K . Ainsi un O K -réseau de rang n sera un O K -module de rang n, muni de la norme Euclidienne de K n .

Les travaux que nous allons présenter dans ce manuscrit visent à étendre l'algorithmique des réseaux Euclidiens aux réseaux sur des corps de nombres.

.

Du problème de la représentation et de la réduction prouvable

Nous avons vu que nous pouvions construire une métrique adaptée à un réseau sur un corps en utilisant les plongements dans le corps des complexes.

Il est utile de remarquer que ces plongements sont calculés comme des évaluations de polynômes sur les racines du polynôme de dé nition du corps de nombre. Ainsi, une fois les racines approximées, grâce aux ra nements de la méthode itérative de Newton par exemple [ ], les calculs de produits scalaires entre vecteurs du réseau algébrique seront également des approximations de leur valeur exacte. Si nous lançons l'algorithme de réduction sur cette version approchée du réseau, nous ne pouvons pas garantir que la base renvoyée soit e ectivement -réduite.

. . . Une arithmétique des intervalles. L'arithmétique d'intervalles est une méthode de calcul consistant à manipuler des intervalles a n de représenter des nombres (par exemple entiers ou ottants), a n d'obtenir des résultats rigoureux. Cette approche permet de borner les erreurs d'arrondi dans des calculs approchés et ainsi de développer des méthodes numériques certi antes qui fournissent des résultats ables. Si les techniques d'encadrement de nombres réels font partie du folklore commun en calcul numérique -Archimède utilisait en e et déjà de tels outils pour ses premières estimations de la constante π au III e siècle av. J.-C.en revanche, la formalisation sous forme de règles de l'arithmétique d'intervalles ne date que des travaux de Young [ ] en . Par la suite, un article sur l'algèbre d'intervalles appliqué à l'analyse numérique a été publié par Sunaga en [ ]. La naissance de l'arithmétique d'intervalles moderne est ensuite marquée par le livre Interval Analysis de Ramon E. Moore en [ ], qui lui donne ses lettres de noblesse. Son mérite est, à partir d'un principe simple, de donner une méthode générale pour estimer les erreurs de calcul et d'imprécision sur les données d'entrée.

Le principe de cette arithmétique est en e et particulièrement simple : pour représenter un nombre x ∈ R, on va manipuler l'intervalle [x -, x + ] ⊂ R, tel que x ∈ [x -, x + ]. Par conséquent, on pourra additionner, soustraire, multiplier et diviser des intervalles tout en gardant la certi cation que le résultat se trouve toujours dans l'intervalle-résultat. L'utilité principale de cette arithmétique va être de pouvoir assurer des comparaisons et de détecter au cours du calcul si trop d'erreurs d'approximation ont été faites pour conclure de manière satisfaisante. Regardons par exemple le cas schématisé ci-dessous :

0 x x - x + y y - y + z z - z +
L'intervalle représentant x assure que x < 0 puisque la borne supérieure x + l'est aussi et que par dé nition, x ≤ x + . Par contre on ne peut pas conclure quant au fait que y < z, puisque y + > z -, ce qui implique que les intervalles représentant y et z se chevauchent. On peut en revanche inférer à ce point que les approximations e ectuées pour obtenir y et z sont trop grosses pour certi er le résultat global y < z.

. . . Réduction de réseaux approximés avec l'arithmétique d'intervalles. Les implémentations rapides actuelles de l'algorithme utilisent l'arithmétique ottante en basse précision pour accélérer les calculs. Bien entendu des bornes sur la précision minimale à utiliser sont prouvables, comme par exemple pour la variante 2 de Nguyen et Stehlé [ ]. Ces algorithmes supposent que les réseaux sont donnés exactement, c'est-à-dire que les produits scalaires sont calculables et représentables avec la précision utilisée par l'algorithme de réduction. En revanche s'il est impossible ne serait ce que d'obtenir une approximation des produits scalaires, comme dans le cas algébrique évoqué plus haut, nous ne pouvons nous contenter de telles bornes. Il faut être en mesure de détecter que l'approximation utilisée est insu sante. Cet obstacle est complètement résolu par l'utilisation de l'arithmétique d'intervalles : si un manque de précision dans le calcul est détecté et que la précision des quantités internes est su sante, alors nous pouvons conclure que la représentation même des plongements du réseau est insu sante et ainsi les recalculer plus nement. Cette technique permet donc de calculer de manière certi ée des bases réduites pour des réseaux algébriques, en utilisant uniquement la structure métrique du réseau : la réduction d'un O K -réseau de rang d sur un corps de nombres K de degré n passe donc par la réduction d'un réseau (approximé) de rang d × n.

. . . Un algorithme de réduction certi é grâce à l'arithmétique d'intervalles. Une conséquence intéressante de cette réduction est qu'elle permet de certier que tout le calcul de la réduction se fait comme l'aurait fait une version de en arithmétique exacte. En particulier, ceci permet l'étude expérimentale de la version exacte de l'algorithme avec la rapidité des implémentations en algorithmique ottante, tout en conservant l'assurance que la trace d'exécution est celle de la version exacte. comprise. Par exemple, les résultats pratiques de [ ] assurent qu'une base réduite l'est bien mieux que la borne théorique du pire cas. En revanche, les résultats théoriques de [ ] prouvent que l'immense majorité des bases -réduites sont des bases atteignant les bornes de pire-cas. L'algorithme choisit donc naturellement des bases de meilleure qualité que ce que son analyse ne laisse supposer. Il est de fait très avantageux de pouvoir utiliser un algorithme rapide qui possède la même trace d'exécution que la version originale du que l'on souhaite étudier.

.

Vers une réduction plus rapide

Grâce à l'arithmétique d'intervalles, il est donc possible d'assurer une notion de réduction prouvée pour des réseaux généraux et en particulier pour les réseaux algébriques. Néanmoins, la réduction des O K -réseaux commence par faire descendre le O K -réseau sur Z. On oublie la structure algébrique de O K et on lance la réduction . Or l'image sur Z d'un O K -réseau Λ de rang d est de rang d × n, où n est le degré de K : ainsi, même un réseau de petit rang sur O K peut nécessiter une réduction sur Z en grande dimension, qui est nécessairement coûteuse.

Lors d'un tel procédé, on laisse complètement de côté les spéci cités algébriques de l'anneau O K . Or ces propriétés se traduisent par des symétries sur les O K modules : ils sont très structurés. Par conséquent, la réduction évoquée ne tient pas compte des symétries produites par cette structure. Il est donc naturel de se demander s'il n'est pas possible d'exploiter la structure algébrique de O K pour accélérer la réduction.

. . . Réduction sur les anneaux Euclidiens. Une première porte vers une algorithmique générique des réseaux algébriques consiste à étudier la situation sur des anneaux dont l'arithmétique est la plus proche de l'arithmétique des entiers relatifs. Un rapide regard sur la taxonomie classique des anneaux révèle que les anneaux dits « Euclidiens »sont parmi les plus proches des entiers relatifs. Pour de tels anneaux l'algorithme de réduction peut être adapté presque sans modi cation . Cette variation a été introduite par Napias dans [ ], puis améliorée dans [ ].

Bien que cette généralisation soit simple et permette e ectivement la réduction de réseaux algébriques, nous sommes très loin du cas général puisque les anneaux Euclidiens sont rares . Regardons alors un cas plus général, qui sera étudié en détail au Chapitre .

. . . Récursion sur les tours de corps de nombres. Considérons un corps de nombres K h , situé au sommet d'une tour de corps de nombres :

Q ⊆ K 0 ⊆ • • • ⊆ K h-1 ⊆ K h , ainsi qu'un O K h -réseau Λ.
Il su t en e et de remplacer la valeur absolue sur Q par la norme algébrique de l'anneau. Parmi les anneaux norme-Euclidiens connus, citons les petits corps quadratiques imaginaires et les petits cyclotomiques Puisque nous pouvons voir Λ comme réseau sur n'importe lequel des anneaux d'entiers intermédiaires O K i , l'existence d'une telle tour de corps permet d'envisager une approche naturellement récursive de la réduction. En e et, nous savons réduire tout type de réseau sur Z, anneau présent en bas de la tour, qui constitue de facto le cas de base de notre algorithme.

K h O K h Λ K h-1 O K h-1
. . . . . .

Q Z

. . . Structure générale de la réduction. La structure générale de notre algorithme de réduction récursif est proche de celle de la réduction classique : outre des passes de réduction en taille qui permettent de maîtriser la taille des coe cients lors du calcul, le coeur de l'algorithme consiste en la réduction de réseaux de rang , projetés orthogonalement aux vecteurs précédents. Nous conservons ici cette idée, qui autorise l'extension de la réduction pour les réseaux de rang aux réseaux de rang arbitraires.

Il s'agit donc d'être capable de réduire des O K h -réseaux de rang , Λ, correspondant à la projection orthogonale d'une paire de vecteurs de la base en cours de réduction. Pour ce faire, nous utilisons la structure récursive de la tour pour « voir »le réseau Λ comme O K h-1 -réseau de rang 2 × [K h : K h-1 ] et appeler la réduction récursivement sur ce nouveau réseau. À chaque appel récursif nous descendons dans la tour, si bien que les feuilles vont correspondre à la réduction de réseaux sur un anneau qui sera Euclidien . Or nous savons réduire directement les réseaux sur un anneau Euclidien. Ainsi en utilisant une telle réduction pour traiter les feuilles de l'arbre de descente, nous pouvons renvoyer un réseau réduit.

Revenons donc au premier appel récursif : lorsque l'appel se termine, nous avons pu réduire notre réseau de rang 2 × [K h : K h-1 ] , correspondant à la descente sur O K h-1 de la projection orthogonale du O K h -réseau b i , b i+1 sur les vecteurs précédents. Cette réduction permet de trouver un vecteur court du plan P = b i O K h ⊕ b i+1 O K h . Il su t alors de construire un second vecteur capable de compléter le premier pour former une nouvelle base de P a n de continuer la réduction. Cette complétion se fait en résolvant une équation de Bézout à coe cients dans O K .

. . . Euclide étendu sur corps de nombres. Une équation de Bézout est une équation de la forme au + bv = 1 d'inconnues u et v dans les entiers relatifs. Elle n'a de solution que si a et b sont premiers entre eux. La recherche de solution s'e ectue classiquement en temps polynomial par l'algorithme d'Euclide étendu. La version généralisée de l'équation de Bézout sur les corps de nombres prend la même forme mais cette fois avec a, b ∈ O K h des entiers algébriques. Comme en toute généralité l'anneau O K n'est pas Euclidien, l'algorithme d'Euclide étendu, basé sur des divisions Euclidiennes successives, ne fonctionne pas en l'état.

Néanmoins si la tour Q ⊂ K 1 ⊂ • • • ⊂ K h n'est pas triviale, nous pouvons nous servir de la structure de cette tour pour descendre le problème sur le sous corps K h-1 , en calculant la norme relative N K h /K h-1 des éléments a et b. Ensuite, en rappelant récursivement l'algorithme de résolution sur

N K h /K h-1 (a) et N K h /K h-1 (b)
, nous obtenons deux entiers algébriques µ et ν de O K h-1 solutions de l'équation :

µN K h /K h-1 (a) + νN K h /K h-1 (b) = 1. ( . )
En conséquence, nous pouvons prouver que pour tout élément α ∈ O K h , nous avons

N K h /K h-1 (α) ∈ αO K h , de telle sorte que α -1 N K h /K h-1 (α) ∈ O K h . Alors nous obtenons a • µ a -1 N K h /K h-1 (a) :=u∈O K h +b • ν b -1 N K h /K h-1 (b) :=v∈O K h = 1, comme désiré.
Il su t alors de noter que les éléments u et v trouvés par cet algorithme ne sont pas nécessairement les plus petites solutions de l'équation de Bézout. A n d'éviter une explosion de la taille des coe cients nous devons contrôler la taille des solutions qui apparaissent à chaque descente et remontée. Ce contrôle est possible grâce à une technique similaire à celle qui permet de contrôler la taille des coe cients dans l'algorithme de réduction, à savoir une réduction en taille.

Ainsi, la combinaison de cette remontée avec l'algorithme que nous avons évoqué permet une réduction plus rapide sur les corps de nombres. Pour un réseau algébrique de rang sur un corps cyclotomique de degré n, il su t de O n 2 B log B opérations binaires, au lieu de O n 4 B log B que nécessiterait l'algorithme rapide de [ ].

.

Structure symplectique naturelle dans une tour

Génériquement, un espace Euclidien peut être dé ni comme un expie vectoriel munit d'une forme bilinéaire symétrique (dé nie positive). En rem-

Pour une extension de corps

K h-1 ⊂ K h , la norme relative N K h /K h-1 (a) ∈ K h-1 de a ∈ K h est le déterminant de l'application K h-1 linéaire x → ax sur K h vu comme espace vectoriel. Cette forme est multiplicative : pour tout a, b ∈ K h , N K h /K h-1 (ab) = N K h /K h-1 (a)N K h /K h-1 (b).
plaçant cette forme par une forme antisymétrique, nous obtenons un «espace symplectique». Les réseaux plongés dans des espaces symplectiques possèdent des symmétries qui peuvent être exploitées pour accélérer la réduction en taille-plus précisément, la version arrondie entière de l'orthogonalisation de Gram-Schmidt (ou décomposition QR) est remplacé par une version arrondie de la décomposition d'Iwasawa-. Dans ce manuscrit, nous montrons qu'il est possible de dé nir génériquement une structure symplectique sur un corps de nombre qui soit compatible avec la descente sur ses sous-corps. Ainsi, à toute tour de corps de nombre nous pouvons associer une structure symplectique compatible avec les descentes le long de la tour.

De fait lors de la réduction de réseaux algébriques dans de telles structures, nous pouvons diviser par deux le temps de calcul à chaque étage de la tour, donnant lieu à une accélération asymptotique non négligeable au total. Avec cette technique, nous pouvons réduire un réseau alébrique de rang sur un corps cyclotomique de degré n et de conducteur su sament lisse, donc les coe cients de la représentation matricielle tiennent sur B bits en temps

Õ n 2+ log(1/2+1/2q) log q B + n O(log log n) ,
où q est un nombre premier diviant le conducteur du corps. La première colonne de la matrice réduite à ses coe cients uniforméments bornés par

2 Õ(n) (covol M) 1 2n .
. Une application en théorie algorithmique des nombres : le problème de l'idéal principal

= 2 × 2 = (1 + i √ 3)(1 -i √ 3) dans le corps de nombre Q[i √ 3]. de ce paragraphe, nous noterons a = aO K = {a • x | x ∈ O K } l'idéal engendré par a dans O K pour tout élément a.
. . . Solution sur les petits premiers. Supposons que nous sachions résoudre ce problème pour tous les idéaux premiers de norme plus petite qu'une certaine borne B. Alors, en utilisant des résolutions de système linéaires nous pouvons résoudre le problème de l'idéal principal pour tout idéal principal qui est B-friable, c'est-à-dire tel que ses facteurs premiers sont plus petits que B. Ainsi, pour résoudre le problème en toute généralité, nous devons pouvoir réduire sa résolution pour un idéal a de norme arbitraire à l'étude d'une ou plusieurs instances pour des idéaux B-friables .

. . . Descente vers des idéaux friables. Soit a un idéal principal. Au vu de la remarque précédente, nous allons chercher à réduire le problème de l'idéal principal sur a à celui sur des idéaux friables. Pour ce faire nous allons nous e orcer de construire un élément a ∈ a tel que a • a soit su samment friable (pour une notion de su samment que nous éluciderons précisément au Chapitre ). Ainsi, nous factorisons cet idéal en un produit d'idéaux b 1 • • • b i de normes plus petites que celle de l'idéal de départ. Sur chacun de ces idéaux, nous pouvons recommencer la recherche d'un petit élément pour le rendre plus friable et recommencer jusqu'à arriver à la borne B introduite en paragraphe . . . La Figure donne une vision schématique de cette phase que nous nommerons « descente ».

Une fois cette descente terminée, il su t alors de résoudre le problème de l'idéal principal sur chacun d'entre eux, et de faire remonter les générateurs le long de l'arbre de descente pour en déduire un générateur de l'idéal de départ.

. . . Réduction d'un idéal A n de compléter cette présentation rapide de l'algorithme, il nous reste à éclaircir un point : étant donné un idéal a, comment construire un élément a tel que a • a soit plus friable que l'idéal a ? Pour ce faire, nous allons chercher à diminuer au maximum la norme de a • a . Cela revient à trouver un petit idéal principal a contenu dans a et de diviser a par a . Ainsi, par multiplicativité de la norme, le quotient sera de norme plus petite que celle de a et plus l'idéal a sera petit, plus le quotient le sera aussi. Il su t donc de construire un élément a petit dans l'idéal, c'est-à-dire d'e ectuer une réduction du réseau algébrique dé nie par a.

Nous sommes donc revenus à notre l rouge : le problème d'arithmétique algorithmique se réduit in ne à une myriade d'instances de recherches de vecteurs courts de réseaux, tout comme la preuve du théorème des deux carrés se réduisait à la recherche d'un vecteur court dans un réseau bien choisi.

C'est à dire des idéaux n'ayant que des premiers de normes plus petites que B dans leurs décompositions en facteurs premiers e q e q . . . . . .

a a b 1 b 1 b 1 c 1 c 1 c 1 . . . p 1 . . . c i c i c i . . . . . . c c c . . . . . . b i b i b i d 1 d 1 d 1 . . . . . . d i d i d i . . . . . .
p n • • • • • • • • • • • • • • • • • • • • • • • • • • • F :
Description schématique de la descente vers des idéaux de petites normes. La friabilité des idéaux est décroissante le long de l'arbre de descente. Les feuilles sont quant à elles toutes B-friables.

.

Ouverture cryptographique

Le XX e siècle fut le théâtre de profonds changements en cryptologie. La cryptologie, étymologiquement la science du secret, ne peut en e et être vraiment considérée comme une science que depuis la n des années , en lieu et place d'une simple discipline technique. Cette science englobe la cryptographie -l'art de protéger un secret -et la cryptanalyse -l'analyse, que l'on peut quali er d'o ensive, de cette dernière.

. . . Mutation du paysage cryptographique au cours du XX e siècle. Des prémices de la cryptographie, avec la fameuse scytale spartiate, jusqu'aux codes de guerre de la Première Guerre Mondiale, comme celui du télégramme de Zimmerman, la cryptographie était uniquement manuelle : tout chi rement, tout déchi rement et toute cryptanalyse reposait sur des transpositions de lettres, phonèmes ou mots réalisées à la main. La cryptographie connaît un tournant juste après la n de la guerre, avec la mise au point de la machine Enigma en , lorsqu'un ingénieur hollandais, Hugo Alexander Koch, dépose un brevet de machine à chi rer électromécanique. Il s'agit toujours d'un chi re dit de transposition -chaque lettre est remplacée par une autre -avec la subtilité que la substitution change d'une lettre à l'autre. Le chi rage est assuré par la machine, fonctionnant sur un astucieux système de rotors mobiles et de ches électriques. La cryptanalyse s'est aussi mécanisée avec l'invention par Turing des bombes, qui permettaient l'attaque par force brute d'Enigma, c'est-à-dire en essayant toutes les clefs possibles.

L'année marque profondément le fonctionnement des systèmes cryptographiques : c'est en e et de cette année-là que date la publication de l'article New Directions in Cryptography [ ] de Di e et Hellman. Cet article a introduit une méthode radicalement nouvelle pour distribuer les clefs cryptographiques, ce qui a résolu un des problèmes fondamentaux de la cryptographie : la distribution des clefs. Ce mode de distribution des clefs est appelé l'échange de clefs Di e-Hellman. L'article a également stimulé le développement presque immédiat d'une nouvelle classe d'algorithmes de chi rement, les algorithmes de chi rement asymétrique. Avant cette date, tous les algorithmes de chi rement (anciens et modernes) avaient été des algorithmes de chi rement symétrique dans lesquels la même clef cryptographique était utilisée avec l'algorithme sous-jacent à la fois par l'expéditeur et le destinataire.

Quittons cet aparté historique pour renouer avec notre sujet d'étude, les réseaux.

.

La cryptographie à base de réseaux

La cryptographie asymétrique nécessite de trouver des problèmes di ciles, au sens de la théorie de la complexité. Mais au-delà même du problème il faut être en mesure de générer des instances di ciles dudit problème pour pouvoir implémenter le cryptosystème.

Les premières méthodes utilisées en cryptographie pour produire des problèmes di ciles en cas moyen ont été proposées simultanément par Ainsi la sécurité de tels cryptosystèmes dépend de notre capacité à e ectuer des réductions de réseaux sur des anneaux d'entiers, justi ant par là l'intérêt des techniques développées plus haut.

. . . Exemples pratiques utilisant la réduction de réseaux algébriques. Le Chapitre , présentera les cryptanalyses de trois schémas basés sur les réseaux. La première est une application directe de la réduction rapide introduite au Chapitre sur les fonctions multilinéaires de [ ]. Partant de la clef publique, une base d'un réseau algébrique de rang sur un corps cyclotomique, on retrouve un vecteur su samment court pour retrouver la clef secrète du schéma. aucunement en cause la robustesse théorique d'un cryptosystème, mais expose seulement une faille dans son implémentation. Une analyse des consommations énergétiques du système embarquant la fonction de signature permet en e et d'estimer la norme de la clef secrète, qui est un petit élément d'un corps cyclotomique, sur un sous-corps. En utilisant la réduction de réseaux et les propriétés de factorisations des idéaux nous retrouvons la clef secrète à partir de sa norme sur un sous-corps, c'est-à-dire en résolvant une équation de norme.

P R E A M B L E

In his monograph Geometrie der Zahlen ([ ]) -Geometry of numbers in English -, Hermann Minkowski had the fertile intuition that giving a geometric insight to number theory would allow to prove abstract results in a quasi-visual manner. This geometry of numbers permitted in particular to enhance the comprehension and to simplify results on units of number elds, as well as to extend the eld of Diophantine approximation. A simple yet striking example of this new manner to "see" number theory is the famous Fermat's two-squared theorem, which can be presented as follows:

Theorem . . An odd prime number p can be written as the sum of two squares x 2 + y 2 , with x, y ∈ Z if and only if p ≡ 1 mod (4).

We give a quasi-intuitive proof after having introduced more formally the de nition of lattice, which contrasts with the more classical proof using solely modular arithmetic reasoning. Since the early work of Minkowski, links between geometry and number theory have grown wider and deeper, spreading the fan of methods available to attack problems that look a priori purely arithmetics.

The central object of this geometrical theory of numbers is the notion of lattice, which formalizes the intuitive idea of grid in the plane or space. Through this manuscript, we are going to look at a generalization of the notion of lattice, which is no more living in the canonical Euclidean space but in spaces constructs from number elds, an algebraic generalization of the eld of rational numbers. This tight bond between number theory, by essence arithmetic and algebraic, and geometry will be the guiding principle of this manuscript, viewed through threw prism of algorithmic reduction methods, allowing a computational approach of the theory developed by Minkowski. In order to forge an intuition on the lattice as a geometric object, we temporarily leave the arithmetic considerations to come back to the premises of this notion, nding their roots in a very visual and concrete problem.

.

Genesis: dense sphere packings

This is the problem of "sphere packing": what is the maximal density of a packing of hard spheres in R n for a xed dimension n? By sphere packing of R n we understand an in nite family of balls of same radius r and disjoint interiors, and by density, the fraction of the space R n covered by these balls.

For instance, in dimension n = 2, the maximal density is reached by the so-called hexagonal packing, where the balls are centered on an hexagonal grid, as depicted below.

We can show that the density of this packing is

π 2 √ 3 ∼ = 0.9069,
by comparing the area of the surface de ned by four circles in contact and by the area of the rhombus de ned by the center of these circles. Even though the optimality of this packing is conjectured since the Pythagorean school, the rst rigorous proof was only provided by Lagrange in .

The dimension case appears to be even more trickier. Kepler conjectured in that the traditional way of packing of fruits merchants and gunners. It consists of stacking the cannonballs by letting them slide onto the space formed by the ones of the oor below. This gives a kind of pyramid, represented below.

But it took almost four centuries to obtain the rst correct proof of this conjecture of Kepler. It has been announced rst by Hales in , which have been fully published in and in [ , ] The original rattle of Hales is almost pages long and required a large amount of computerassisted computations. The certi cation and veri cation of these computations use, in particular, a technique called Interval arithmetic to detects and handle the rounding errors of numerical computations. We will stumble upon this technique, in our work this time, to ensure the certi cation of lattice reduction algorithms.

In both cases, it is interesting to remark that the center of the balls are placed in a regular manner in the space: they form a so-called "lattice".

For higher dimensions, the question was open until the work of Viazovska in , and of Cohn, Kumar, Miller, Radchenko, and Viazovska in , who proved that the densest sphere packings in dimension and also come from the stacking of spheres on a lattice: the E 8 lattice in dimension and the Leech lattice in dimension . It is noticeable that the proofs of these optimalities are way simpler and concise than the proof of Hales, but above all are not purely geometrical: the crux of their proof is the study of wellchosen modular forms. Dually to the ideas of Minkowski, this time, number theory is providing the tools to prove theorems in the realm of Euclidean geometry.

These very peculiar cases in dimensions , , and encourage the systematic study of the properties of packings of spheres centered on the points of lattices, simply named "lattice packings". It is one of the historical incentives of the study of Euclidean lattices. Hence, estimating the density of the densest lattice packing corresponds to estimate the exact value of the socalled Hermite's constant of the lattice, which we formally introduce in Paragraph . . . If the value of this constant in large dimension is still unknown , the lattice packings in small dimension have been fully determined: by Lagrange in dimension two [ ], Gauss in dimension three [ ], Korkine and Zolotare in Through the examples given by sphere packings, we have seen that a lattice is a geometric structure of the Euclidean space R n , giving a regular grid. By the generic term grid, we understand that the vectors of the lattice regularly pave the space. To forge a visual intuition let us go back to the lattice of centers given by the hexagonal packing and the square packing in the plane R 2 : Since such a grid can be translated without changing its geometric properties we can suppose without loss of generality that the origin (0) belongs to the lattice. Thereof the sum of two lattice vectors is also a lattice vector, as well as the opposite of any lattice vector. Hence, a lattice is naturally endowed with a structure of abelian group. Besides, as the packings examples hinted, two vectors of a lattice can not be arbitrarily close to one-another: topologically speaking the set of vectors of a lattice is discrete for the Euclidean distance. It appears that these two notions actually encompasses exactly the properties of a lattice, de ned in the following manner: De nition . . A Euclidean lattice Λ is a discrete subgroup of (R n ,+), or equivalently it is the set of linear combinations with integral coe cients of a linearly independent family of vectors.

Generally speaking, we denote by Λ[v 1 , . . . , v k ] the sub-lattice spanned by a linearly independent family (v 1 , . . . , v k ) of vectors, that is:

Λ[v 1 , . . . , v k ] = a 1 v 1 + • • • + a k v k a 1 , . . . , a k ∈ Z .
Therefore, a lattice is a regular structure-as the geometric arrangement of the neighbors of a vector is independent of the vector-and discrete of an Euclidean space.

. . . Bases and covolume. A basis of a lattice Λ is a family (v 1 , . . . , v k ) of linearly independent vectors that spanned the whole lattice, that is such that

Λ[v 1 , . . . , v k ] = Λ.
Clearly, a one-dimensional lattice is of the shape Z = { k | k ∈ Z} for a certain real number , and thus has only two distinct bases and -. However, as soon as the dimension of the lattice is greater than one, it possesses an in nite number of bases. They all share the same cardinality, which is called the "rank of the lattice". Bases are related to one-another by linear mapping which are unimodular:

if B = (b 1 , . . . , b n ) is a basis of Λ, then a family C = (c 1 , . . . , c n ) of R n is
also a basis of Λ if and only if the n × n matrix U giving the coe cients of C in the basis B is invertible and has integral coe cients-since C is a basis of R n constituted from lattice vectors-. It appears that these two conditions on U corresponds to the fact of being integral and having determinant ±1.

In particular this implies that the determinant

∆(b 1 , . . . , b n ) of the Gram matrix G = b i , b j 1≤i,j≤n
is a strictly positive real, independent of the basis B: this is the "discriminant" of the lattice. The "determinant" or "covolume" of a lattice Λ, denoted covol Λ is de ned as the square root of the discriminant. It is equal to the volume -for the Lebesgue measure of R n -of the parallelepiped de ned by B in R n :

P (B) = d ∑ i=1 x i v i | 0 ≤ x i < 1 .
Figure gives an instance of a plane lattice with two distinguished bases and their respective associated parallelepiped.

. . . Hermite's constant. As dictated by the visual intuition, the periodicity and discreteness of a lattice ensure that these elements are not arbitrarily close to one another and in particular from the origin 0. Hence, it is possible to look for the shortest vectors of a lattice, which are the vectors which are the closest to 0. We call " rst minimum" of a lattice Λ the quantity

λ 1 (Λ) = min x∈Λ\{0} x .
The foundational work of Minkowski in his geometry of numbers ensures that a lattice vector always exists in any su ciently large convex sets of the space:

Theorem . (Minkowsi). Let Λ be a lattice of R n and C ⊆ R n a measurable convex symmetric from , such that Vol(C) > 2 n covol Λ, then C contains at least one non-zero point of Λ.

The intuition behind this theorem is relatively simple: we can convince ourselves by juxtaposing the parallelepiped formed by the 2 n possible orientations of the vectors of a basis B. The interior of this set is of volume 2 n vol P (B) = 2 n covol Λ, and by construction, it can not contain a lattice vector di erent from zero. Figure gives an example of this gluing in dimension . If we apply this theorem with C being closed balls, we can prove that any n-dimensional lattice contains a non-zero vector whose length satis es:

v = 2 covol(Λ)Γ n 2 + 1 π n 2 1 n ≤ 1 2 √ 4 + n(covol Λ) 1 n ,
with Γ the Euler Gamma function . The right-hand side of this equation only depends on the dimension and of the covolume of Λ. Therefore, we can wonder what is the best upper-bound γ n , such that for all lattice Λ of rank n there exists non-zero lattice vector such that we have v ≤ γ n (covol Λ)

1 n . This corresponds to evaluate the constant:

√ γ n = max Λ λ 1 (Λ) (covol Λ) 1 n
, where the minimum is taken on the set of real lattices of rank n. This quantity is called the "n-dimensional Hermite's constant". Since each lattice, Λ induces a sphere packing of λ 1 (Λ)/2 with centers the lattice vectors, it appears that estimating the numerical value of Hermite's constant allows to estimate the density of the densest lattice packing. Hence, the exact computation of this constant is one of the principal problems of the geometry of numbers.

It is interesting to remark that the results presented ensure that a short vector theoretically exists. However, in practice, its construction remains

The volume of the n dimensional ball of radius r is indeed equal to π n/2 r n Γ( n 2 +1)

. hard: the algorithmic search of the shortest vector of an arbitrary lattice is a hard problem in the sense of complexity theory . As such, for practical purposes, when the dimension is too large, we do not look for the shortest vector but instead for an approximation, that is to say for a non-zero vector located in a ball a su ciently small radius. The algorithmic methods to solve this problem are the basis of the so-called "lattice reduction".

. . . Digression: back on the two-square theorem. Before pursuing our journey in the world of lattices and their reduction, let us go back for a moment on our introductory theorem. Indeed, we can now provide a concise proof of Fermat's two square theorem by using the notion of lattices, in particular using Minkowski's theorem. Let then p be a prime congruent to -1 modulo 4, so that -1 is a square modulo p: hence it exists an integer q such that -1 ≡ q 2 mod p. Let us consider the plane lattice Λ spanned by the vectors u = (q, 1) and v = (p, 0). Denote by M the matrix [u, v]. The covolume of this lattice is by de nition :

covol Λ = det(M T M) = p
Let C be the convex symmetrical body de ned by

C = (x, y) ∈ R 2 x 2 + y 2 < 2p ,
that is the open disk or radius 2p, centered in 0. Its volume is then:

vol C = 2pπ > 4p = 2 2 p = 2 2 covol Λ.
Hence, by Minkowski's theorem, there exists a non-zero lattice vector in this ball, denoted by (x, y). But then, there exists a, b ∈ Z such that : (x, y) = au + bv = (aq + bp, a). Thus, by taking the square of the norm of this vector we get:

x 2 + y 2 = a 2 + a 2 q 2 + b 2 p 2 + 2abpq ≡ a 2 (1 + q 2 ) mod p.
But since q 2 ≡ -1 mod p we have x 2 + y 2 ≡ 0 mod p, and so x 2 + y 2 = p as x 2 + y 2 = 0 and x 2 + y 2 < 2p. Figure gives an example of the setting for the case p = 5. We can see the lattice vectors inside the disk C, allowing to retrieve the square factors as in the proof. This duality between arithmetic and geometry is our leitmotiv all along this manuscript. We wished to develop this topic through the prism of the algorithmic reduction theory, a more recent matter which nds its roots in the work of Gauss and Lagrange in the XIX th century.

.

On the algorithmic reduction of Euclidean lattices

We have seen that lattices possess an in nite number of bases as soon as the dimension is greater than one. We also know that an Euclidean vector space has privileged bases: the orthogonal bases. Indeed, the (local-) compactness of R n allows to straighten iteratively each vector of a basis to ensure that it becomes orthogonal to the one before it.

. . . Orthogonalization. To be more precise, let us look at how to orthogonalize a vector v with regard to a vector u, by using only a linear combination of u. Let λ be a real parameter and v λ = vλu the vector which we want to make orthogonal to u.

u • u,v u,u u v v λ From the equation u, v λ = 0 we get: u, v -λ u, u = u, v λ = 0,
so that choosing λ = u, v / u, u works. This construction is illustrated in the gure beside. This situation can be generalized. Given a family (v 1 , . . . , v n ) of vectors, we start by orthogonalizing v 2 with v 1 . Denote by v * 2 this new vector. Then we can orthogonalize v 3 with regards to v 1 and v 2 * , yielding a vector v * 3 , which is orthogonal to these two vectors. We can go on with v 4 by making it orthogonal to v 1 , v * 2 , v * 3 , and so on. This algorithm allows constructing an orthogonal basis of the space so that the subspace spanned by its i-th rst factors is the same as the subspace spanned by v 1 , . . . , v i . This method is the "Gram-Schmidt orthogonalization process". Its pseudo-code translation is given in Algorithm :

Algorithm -Gram-Schmidt Input : (v 1 , . . . , v n ) an independent family of vectors Output : An orthogonal family (v * 1 , . . . , v * n ). v * 1 ← v 1 for k = 2 to n do v * k ← v k for j = 1 to k -1 do v * k ← v * k - v k ,v * j v * j 2 • v * j end for end for return (v * 1 , . . . , v * n )
. . . Size-reduction. However, in the lattice case, the rigidity imposed by the discreteness generates an obstruction to this construction: since the only linear combinations allowed by the structure are the combinations with integral coe cients, we can only approximate the vectors given by the orthogonalization process.

u • u,v u,u u v v λ v λ
Indeed, if we go back to the case presented earlier with the vectors U and v. then we can not search for an arbitrary linear combination of them, but only for integral linear combinations. Thus it is not possible to make u λ orthogonal to u. Instead, we can still try to minimize the orthogonality defect, that is nding the integral values of λ minimizing the function λ → v λ , u , that is the integer the closest to λ = u, v / u, u . Similarly to the Gram-Schmidt process, we can reduce iteratively a family (v 1 , . . . , v n ) of lattice vectors, by discretizing the operations made at each step. Instead of making a vector orthogonal to the previous ones, we aim at reducing as much as possible the orthogonality defect. It appears that this minimization also shrinks the size of the considered vectors. Hence this process is called "size-reduction" or "weak reduction". It is described in pseudo-code in Algorithm .

Algorithm -Size-reduction

Input : (v 1 , . . . , v n ) a family of vectors Output : A size-reduced family (v 1 , . . . , v n ). v * 1 , . . . , v * n ← Gram-Schmidt(v 1 , . . . , v n ) for k = 2 to n do for j = i -1 to 1 do v k ← v k - v k ,v * j v * j 2 • v j
end for end for return (v 1 , . . . , v n ) . . . Densify the successive sublattices. Hence, the notion of privileged bases seems less canonical in the lattice context than in a Euclidean space. As we have seen, the size-reduction allows reducing the orthogonality defect and the norm of vectors of a basis. We can thus try to construct a basis with vectors as short as possible. To do so we can, for instance, strive to densify the successive sublattices spanned by the basis vectors, i.e. to shrink their volumes. More speci cally, let us x a basis (v 1 , . . . , v n ) of a lattice Λ, and denote by Λ i the sublattice spanned by the i-th rst vector's v 1 , . . . , v i . Suppose that Λ 1 is the densest sublattice among all the sublattices of rank one. Therefore, v 1 is necessarily the shortest vector of Λ. Then, if Λ 2 is also the densest sublattice among the sublattices of rank containing v 1 , then v 2 is also presumably short, without what the covolume of this sublattice would be large. The same goes for the following sublattices Λ i : having dense sublattices Λ i implies getting somewhat short vectors v i .

. . . Towards LLL reduction. Patently, the size-reduction acts on vectors without modifying the sublattices Λ i . If we aim at shrinking the covolume of these sublattices, we thus need to permute the basis vectors. Of course, it would be very costly to enumerate all the n! permutations of these n vectors. However, remember that the symmetric group is generated by the transpositions of the shape (i, i + 1), that is, the transpositions of two successive elements. As such, we can try to densify the covolumes of the Λ i by successively swapping two consecutive vectors of the basis. Once a pair of them have been swapped, it is now possible to perform a new pass of sizereduction. This procedure can be pursued up-to no new change, either being swaps or size-reduction, improve the basis. Then, such a basis is said to be reduced. This simple sketch translates easily in pseudo-code:

. While a modi cation improves the basis do .

Size-reduce the basis .

If it exists an index 1 ≤ i ≤ n such that the covolume of the sublattice spanned by v 1 , . . . , v i-1 , v i+1 is smaller than the covolume of the sublattice spanned by v 1 , . . . , v i-1 , v i then exchange the vectors v i and v i+1 .

. end By keeping track of the position of the last exchange, we can avoid restarting from the beginning at each iteration. Besides, we relax the exchange condition by a parameter 0 < δ < 1. This modi cation enforces a polynomial running time of the algorithm. All in all, we obtain Algorithm . This algorithm is exactly the Lenstra-Lenstra-Lovàsz ( ) algorithm, introduced in with application the factorization of polynomials with integral coecients. A basis is called -reduced is it satis es the two following properties:

. It is size-reduced.

. No swap can reduce the covolume of one of the successive sublattices

Λ[v 1 ], Λ[v 1 , v 2 ], . . . , Λ.
Hence, the algorithm returns a -reduced basis from an arbitrary basis of a lattice. If we denote by B an upper-bound on the number of bits required to store any coe cient of a basis of a lattice of rank n, then the reduction runs in a O n 5 B 3 binary operations. Variants of this algorithm, such as [ ] which uses oating-point arithmetic, allows reducing such a lattice in only a O n 4 B log B operations.

Algorithm -LLL-reduction

Input : (v 1 , . . . , v n ) a basis of a rank n latticeΛ Output : A -reduced basis of Λ k ← 2 while k ≤ d do v * 1 , . . . , v * n ← Gram-Schmidt(v 1 , . . . , v n ) for j = k -1 to 1 do v k ← v k - v k ,b * j b * j 2 • v j end for if vol(v 1 , . . . , v i-1 , v i+1 ) < δ vol(v 1 , . . . , v i-1 , v i ) then k ← k + 1 else Swap v k et v k-1 k ← max(k -1, 2) end while return (b 1 , . . . , b n )
The following representation illustrates a step of the algorithm in dimension . The current basis is v 1 , v 2 , v 3 . We aim at reducing v 3 using the vector v 2 . This step is going to be performed by lifting the result , denoted x, of the reduction of π(v 3 ) by π(v 2 ), where π is the orthogonal projection onto the subspace v ⊥ 1 . This lifting is done by choosing the element v 3 of Λ ∩ (x + v 1 ) of smallest norm.

v 3 v 2 v 1 v ⊥ 1 π(v 2 ) π(v 3 ) x (v 3 )
. . . Approximation factor and reduction with oracles. The algorithm is a greedy algorithm as it swaps two vectors as soon as an improvement on the covolumes is possible. However, it is not optimal with regards to the length of the rst vector of the basis nor the density of the successive sublattices. Indeed, it gives an approximation of the optimal values of these quantities, quanti ed by the following lemma: Lemma . . Let (v 1 , . . . , v n ) a basis of lattice Λ, which is reduced using the algorithm with parameter 0 < δ < 1. Then for each of the 1 ≤ k ≤ n, we have:

covol Λ[v 1 , . . . , v k ] ≤ δ - 1 4 -(n-k)k 4 covol Λ k n
For instance, this lemma ensures that the algorithm can be used to nd a vector of norm smaller than: δ -1

4

n-1 4 covol Λ 1 n . Knowing that Hermite's constant γ n is polynomial in the rank n, it is then an exponential approximation of the shortest vector. It is then natural to wonder if it is possible to shrink this exponential factor in (δ -1/4) -k(n-k)/4 . But is so, for which computational cost? Indeed these so-called "approximation factors" can be reduced, if we have access to an oracle which can determine exactly the shortest vector of an arbitrary lattice. The half-reduction algorithm, introduced by Schnorr [ ] in , can be seen as a generalization of the algorithm, in which we do not look for a short vector in a projected rank sublattice, but this time in a rank β projected sublattice, for a parameter 1 < β < n. This algorithm yields vectors shorter than the vectors discovered by the algorithm, but has a complexity exponential in β. Hence, there is a tradeo between the quality of the reduction, essentially given by the length of the rst vector of the basis and the time required to perform the computation. The most striking illustration of this tradeo is given in the following theorem, coming the variant of Micciancio and Walter [ ], combined with the enumeration techniques of of[ ] for the shortest vector oracle: : . Theorem . . Their exists an algorithm which outputs a vector v satisfying

v ≤ β n-1 2(β-1) • (vol Λ) 1 n ,
for a parameter 0 ≤ β ≤ n The complexity of the corresponding computation is a Poly(n, log B) 3 2 β/2+o (β) , where B is a bound on the bit size of the entree.

:

.

.

Number elds, algebraic numbers

The concept of algebraic number, introduced by Niels Abel, nds its origin in the willing of solving "algebraic equations", that is of solving equations of the shape P(x) = 0, where P is a rational polynomial. The fundamental idea, hinted in the letters of Évariste Galois, consists in adjoining a root α of P to the rationals Q and to study the resulting object:

Q(α) = {q 0 + q 1 α + • • • + q k α k | k ≤ 0, q 1 , . . . , q k ∈ Q}.
Let us give an example of number elds which is going to be used to exemplify the notions we introduce subsequently: we look at the eld Q(i){a + ib | a, b ∈ Q} coming form adjoining the roots i and -i of the polynomial X 2 + 1 to the rational numbers.

. . . Structure of a number eld. It appears that Q(α) is a eld, and as such a eld extension of the rationals. Moreover, it is of nite degree-its dimension [Q(α) : Q] as Q-vector space is nite-over Q. Henceforth, each element of Q(α) is algebraic, that is annihilated by a rational polynomial. If we limit ourselves to looking at the elements of Q(α) which are roots of unitary polynomials with integral coe cients, we get a subset O Q(α) , which is a ring for the laws of Q(α). It is the ring of integers of the eld Q(α), which is a generalization of the relative integers in the sense that the ring of integers of Q is Z. It also constitutes a n-dimensional generalization of Z as we can prove (see Theorem . . ) that there exists elements v 1 , . . . , v n ∈ O n K so that O K is the set of linear combinations with coe cients in Z of the v i , that is to say:

O K ∼ = v 1 Z ⊕ • • • ⊕ v n Z ∼ = Z n .
If we go back to our example the ring of integers of

Q(i) is Z[i] = {a + ib | a, b ∈ Z} called the ring of Gaussian integers. It is clear that Z[i] ∼ = Z 2
as an abelian group.

. . . Euclidean norm in a number eld. A number eld K = Q[α] can be embedded in the eld of complex numbers C in various manners. Since the eld K is spanned by an element α, any embedding σ is exactly determined

In this context, an embedding is algebraic, that is which preserves the properties of K: it is nothing else than a eld morphism.

by the image of α. Remembering that any polynomial P ∈ Q[X] we have σ(P(α)) = P(σ(α)), then σ(α) is a conjugate of α, that is is also a root of the de ning polynomial of K. Hence there is at most n = [K : Q] possible embeddings and we can check that they are all distinct. We denote them by σ 1 , . . . , σ n . This embeddings allows to de ne the Archimedean embedding of the eld K in C:

σ : K -→ C n x -→ (σ 1 (x), . . . , σ n (x)) .
Then, we can lift the canonical Hermitian structure of C n to K by de ning the inner product

a, b = n ∑ i=1 σ i (a)σ i (b),
where z → z is the usual conjugation of C. This inner product embed K by its so-called canonical norm, given by a = a, a . In our example, there exists two embeddings σ 1 and σ 2 respectively sending the root i to itself and on its conjugate -i. Thus the Archimedean embedding of an element a

+ ib ∈ Q is the vector(a + ib, a -ib) ∈ C 2 . The corresponding algebraic norm of a + ib is then (a + ib)(a -ib) = a 2 + b 2 .
But then, what is the connection with the lattices, introduced over?

.

Natural structure of lattice of the ring of integers

Since the ring of integers O K of K is included in K, it inherits the Euclidean structure that we just de ned. Hence, as O K is the set of integral linear combinations of a basis, it is a lattice in the sense given by Paragraph . . .

. Algebraic lattices

We introduced lattices as a set of integral linear combinations living in a Euclidean space. The algebraic structure formally describing the set of such linear combinations is the structure of free Z-module.

. . . A little digression on modules. Let us recall brie y that a module is an algebraic structure de ned similarly to a vector space, but in which the eld of scalars is replaced by a ring. It is thus an additive group endowed with an external multiplication law with the elements of a ring, with the right compatibility laws. This structure is more subtle than the vector space and the classi cation of modules is a lot more complicated. Nonetheless, a nitely generated free module over a ring R behaves quite similarly to a vector space. In particular, the module possesses bases of equal cardinality. As such it is isomorphic to R n for a certain n, in the same way, a n dimensional K-vector space is isomorphic to K n . Hence a free Z-module of rank n is nothing else than a "vector space" over Z, which is a structure of the shape b

1 Z ⊕ • • • ⊕ b n Z for b 1 , . . . , b n being a basis.
. . . Generalizing the notion of lattice. Henceforth, we can reinterpret the de nition of a lattice. It is the datum of two structures: on the one hand, the algebraic structure, given by the Z-module, and on the other hand the metric structure, given by the Euclidean norm on its elements. We now aim at generalizing the notion of lattice by replacing the ring Z by more general lattices.

A natural family of candidates for these rings is the class of ring of integers of number elds. These rings have an arithmetic which is quite close to the usual arithmetic of Z. Hence let us x a number eld K and denote by O K its ring of integers. From a metric point of view, we have access to the canonical norm of K, which extends to K n for any integer n. From now on we are not going to look at modules over Z but over O K . Hence a O K -lattice of rank n is an O K -module of rank n endowed with the Euclidean norm of K n .

The works presented in this manuscript aims at extending the lattice reduction algorithms to lattices over number elds.

.

The issue of provable and certi able reduction

We have seen that we could construct a metric structure adapted to a lattice over a number eld by using the embedding into the eld of complex numbers. It is useful to remark that these embeddings are computed as polynomial evaluations over the roots of the de ning polynomial of the number eld. Hence, once these roots are approximated, for instance by re nements of Newton's iterative method [ ], the computations of inner products between lattice vectors are also approximation of their actual value. If we launch the reduction algorithm on this approximation of the lattice we can not enforce that the returned basis is indeed -reduced.

. . . An interval arithmetic The interval arithmetic is a computational method consisting of manipulating intervals to represents numbers (such as integers or oating-point numbers), to obtain rigorous results. This approach allows to bound the rounding errors in the approximated computations and thus to develop certifying numerical methods, yielding reliable results.

If the techniques to round real numbers belong to the common folklore of numerical computations-Archimedes was already such tools for his rst estimates of the constant π in the III th century bf. J.-C.-, the formalization of under some precise arithmetic rules only comes back to the work of Young [ ] in

. Subsequently, an article on the algebra of intervals for numerical analysis was published by Sunaga in [ ]. A landmark in the birth of modern interval arithmetic is the book Interval Arithmetic of Ramon E. Moore in [ ], widening its range of applications. From a very simple principle, interval arithmetic gives a generic method to estimate the rounding errors and imprecision mistakes made at runtime. The crux of the method it to represent a number x ∈ R, by an interval [x -, x + ] ⊂ R, such that x ∈ [x -, x + ]. Thus we can add, subtract, multiply, and divide intervals while still enforcing the certi cation that the result of the operation lies between the bounds of the resulting interval. The usefulness of this arithmetic is to certify comparisons between numbers and to detect during the computation if too many approximations happened to conclude. Let us look at a schematized example

0 x x - x + y y - y + z z - z +
The interval reprinting x ensure that x < 0 since the upper bound e x + is also smaller than and that by de nition, x ≤ x + . On the contrary, one can not conclude that e y < z, since y + > z -, which implies that the intervals containing y and z are overlapping. But we can still infer at this point that the approximations leading to these representations of the values y and z are too large to certify the global result y < z and as such that the computation must be run again with more precision.

. . . Lattice reduction in interval arithmetic. The fast implementations of the algorithm use oating-point arithmetic with low precision to speedup the computations. Of course, bounds on the minimum amount of precision to use are provable, such for instance the 2 variant of Nguyen and Stehlé [ ]. These algorithms suppose that the lattices are given exactly, that is that the inner products are computed table and representable at arbitrary precision, and in particular at the precision used in the algorithm. However it is impossible to compute a priori the inner products at this precision, the bounds upper-evoked are not su cient to reduce the lattice. We must be able to detect that the approximation used in the representation of the lattice is not su cient.

These algorithms are designed with the promise that the lattices are given explicitly, that is that the inner products are computable and representable at the precision used by the reduction algorithm. However, it is impossible to know in advance the error made on these inner products, we can not use such bounds as we need to determine if the precision used to represent the lattice is actually su cient. This obstruction is fully resolved by the use of interval arithmetic: if a lack of precision is detected at runtime by the algorithm and the precision of the internal quantity is su cient, then we can conclude that the representation of the lattice-in the case of an algebraic lattice, of the embedding of lattice-is not su cient and that it is needed to recompute it with greater accuracy. Hence this technique allows computing in a certi ed manner reduced bases of an algebraic lattice, by using only its metric structure: the reduction of an O K -lattice of rank d over a number eld of degree n is then done by the reduction of an (approximate) Z-lattice of rank d × n.

. . . A certi ed reduction with interval arithmetic. An interesting byproduct of the reduction with interval arithmetic lies in the fact that it allows certifying the computation at any moment of the reduction, and in particular that the computation is the same as a reduction using exact arithmetic. In particular this opens the door to an experimental study of the exact version of , with the speed of oating-point implementation but with the promise that the execution trace is still the same as the exact version.

Lattice reduction in the average case, that is the study of reduction algorithms on random lattices , is not well understood. For instance, the practical results of [ ] ensure that a reduced basis is far more reduced than the theoretical bound for the worst case. However, the theoretical results of [ ] prove that the majority of -reduced bases are bases which reach the worst-case bounds. Hence the algorithm naturally choose bases of better quality. Therefore it is very interesting to have access to a fast reduction algorithm having the same execution trace as original to pursue extensive practical studies.

.

Towards a faster reduction of algebraic lattices

Thanks to interval arithmetic, it is possible to ensure a proved reduction for generic lattices and in particular for algebraic lattices. However, the reduction of O K -lattices starts by descending the O K -lattice over Z. This corresponds to forget the algebraic structure of O K and running the reduction. But the image over Z of a rank d O K -lattice is of rank d × n, where n is the degree of K. Hence, even in the case where the lattice is of small rank over O K , the reduction can be very costly as the dimension over Z might be large.

This process completely forgot about the algebraic speci cities of the ring O K . But these properties translate into symmetries over s O K -modules. Consequently, the above-mentioned reduction can not take these symmetries into account. Thus, it is natural to wonder if it is possible to exploit the algebraic structure of O K to speed up the reduction.

. . . Reduction on Euclidean number elds. A rst step towards a generic algorithmic for algebraic lattices consists in studying the reduction on rings where the arithmetic is the closest to the arithmetic of Z. A quick look at the classical taxonomy of rings reveals that the so-called "Euclidean" rings are the closest to the relative integers. For such rings the -reduction can be straightforwardly adapted, with almost no modi cations . This variation has been introduced by Napias in [ ], and the improved by Camus in [ ].

Even though this reduction is simple and allows to e ectively reduce algebraic lattices, we are still very far from the general case, as the norm Eu-clidean rings are very rare . Let us look at a more general case, which is studied in detail in Chapter .

. . . Recursion in a tower of number elds. Let us consider a number eld s K h , on the top of a tower of number elds:

Q ⊆ K 0 ⊆ • • • ⊆ K h-1 ⊆ K h , as well as an O K h -lattice Λ.
Since we can see Λ as a lattice over any of the intermediate ring of integers O K i , the existence of such a tower allows to consider a naturally recursive approach of the reduction. Indeed, we know how to reduce any lattice over Z, ring which is on the bottom of the tower and which constitutes de facto a base case for our algorithm.

K h O K h Λ K h-1 O K h-1 . . . . . .

Q Z

. . . General structure of the reduction. The general structure of our recursive reduction algorithm is close to the one of the classical : in addition to the pass of size-reduction which allows handling the size of the coe cients during the computation, the crux of the algorithm is the reduction of an orthogonally projected lattice of rank . We keep here this blueprint, which enables the extension of the reduction for rank two lattices to arbitrary lattices.

The reduction hence boils down to reduce arbitrarily O K h -lattice, say Λ of rank , corresponding to the orthogonal projection of a pair of vectors of the current basis. To do so, we make use of the recursive structure of the tower of number elds to "see" the lattice Λ as an

O K h-1 -lattice of rank 2 × [K h : K h-1
] and to recursively call the reduction on this new lattice. At each recursive call, we go down in the tower, so that the leaves correspond to the reduction of a Euclidean ring , where we know how to perform the reduction and yield a reduced lattice.

Let us go back to the topmost recursive call: when the call ends, we reduced a lattice of rank 2 × [K h : K h-1 ] corresponding to the descent of the O K h -lattice spanned by b i , b i+1 orthogonal projected to the previous vectors of the basis. This reduction allows to nd a short vector of the plane

P = b i O K h ⊕ b i+1 O K h . It
N K h /K h-1 (a) and N K h /K h-1 (b)
, we obtain two algebraic integers µ and ν of O K h-1 solutions of the equation

µN K h /K h-1 (a) + νN K h /K h-1 (b) = 1. ( . )
As a consequence, we can prove that for any elements α ∈ O K h , we have,

N K h /K h-1 (α) ∈ αO K h , so that, α -1 N K h /K h-1 (α) ∈ O K h . Then we get a • µ a -1 N K h /K h-1 (a) :=u∈O K h +b • ν b -1 N K h /K h-1 (b) :=v∈O K h = 1,
as wanted. It then su ced to remark that the element u and v found by these algorithms are not necessarily the smallest possible solutions of the Bezout equation. To avoid a blow-up in the size of the coe cients, we need to control the size of the solutions appearing at each descent and lift. This control is made possible by a similar technique to the one allowing to control the size of the coe cients in the reduction algorithm, which is the size-reduction.

Hence the combinations of this lifting with the algorithm we evoked allows a faster reduction on number elds, For a lattice of rank over a cyclotomic eld of degree n it su ces of O n 2 B log B binary operations, instead of the O n 4 B log B required by the algorithm of [ ].

For a eld extension K

h-1 ⊂ K h , the relative norm N K h /K h-1 (a) ∈ K h-1 of a ∈ K h is the determinant of the K h-1 -linear map x → ax on K h , seen as vector space. This form is multiplicative: for any a, b ∈ K h , N K h /K h-1 (ab) = N K h /K h-1 (a)N K h /K h-1 (b).
. Using a symplectic structure over number elds A Euclidean space is a vector space endowed with a positive de nite symmetric bilinear form acting on it. Replacing this form by an antisymmetric one yields the notion of symplectic space. Lattices embedded in symplectic spaces have additional symmetries that can be exploited to (roughly) halve the cost of the reduction-this is more precisely done by replacing the sizereduction viewed as an integral rounding of the Gram-Schmidt decomposition by a rounding version of the so-called Iwasawa decomposition. We prove that we can de ne a recursive symplectic structure over a tower of number elds, compatible with the descent between sub elds. As a consequence we can halve the running time of the reduction at each level of the recursion tree, yielding signi cant asymptotic speedups on the overall reduction. With this technique, over a cyclotomic eld of degree n and suciently smooth conductor, we can reduce a rank two module represented as a 2 × 2 matrix M whose number of bits in the input coe cients is uniformly bounded by B > n, in time

Õ n 2+ log(1/2+1/2q) log q B + n O(log log n) ,
where q is a prime, and the conductor is a power of q. The rst column of the reduced matrix has its coe cients uniformly bounded by 2 Õ(n) (covol M)

1 2n
.

. An application in algebraic number theory: the principal ideal problem . . . Ideals. Since the algebraic integers, O K of a number eld K have a ring structure, we can look at their ideals . In particular, if the algebraic integers do not share the property of unique factorization , its ideals does nonetheless. More precisely any a of O K decomposes in a product, unique up-to-order, of primes ideals. In this sense, the rings of integers have an ideal arithmetic which is similar to the rational arithmetic of Z. However, it is noticeable that on the contrary to the ideals of Z, ideals in generic rings of integers are not necessarily principal, that is spanned by a unique element. A classical problem in algorithmic number theory is raised by this question: given an ideal of a ring of integer, how di cult is it to compute a generator. In order to ease the readability of the subsequent paragraphs, we denote e q e q . . . . . .

a = aO K = {a • x | x ∈ O K } the
= 2 × 2 = (1 + i √ 3)(1 -i √ 3) in the number eld Q[i √ 3]. a a b 1 b 1 b 1 c 1 c 1 c 1 . . . p 1 . . . c i c i c i . . . . . . c c c . . . . . . b i b i b i d 1 d 1 d 1 . . . . . . d i d i d i . . . . . .
p n • • • • • • • • • • • • • • • • • • • • • • • • • • • Figure :
Description of the descent to small norm ideals. The smoothness of the ideals is decreasing along the descent tree. The leaves are all B-smooth.

. . . Solution on all small primes. Let us suppose that we know how to resolve this problem for all primes of norm bounded by a certain B > 0. Then, by using linear algebra, we can solve the principal ideal problem for all principal ideals which is B-smooth, that is such that all of its prime factors are of norm smaller than B. Hence, to solve the principal ideal problem in all generality, we can reduce the problem for an ideal a or arbitrary norm to multiple instances of for B-smooth ideals.

. . . Descending to B-smooth ideals. Let a be a principal ideal. By the latter remark, we aim at reducing the principal ideal problem on a to the problem on smooth ideals. To do so we look for an element a ∈ a such that a • a is su ciently smooth (for a notion of su ciently smooth that is explicated in Chapter ). Hence we then factorize this newly constructed ideal in primes factors of norm smaller than the starting ideal. On each of these ideals, we can start again and look for a small element to improve their smoothness, and continue this process until getting through the bound B introduced in Paragraph . . . Figure gives a schematic vision of this phase, called "descent".

Once this descent over, it then su ces to solve the principal ideal problem on each of them, and to propagate the found generators up to the top of the tree to recover a generator of the initial ideal.

. . . Reduction of an ideal. In order to complete this brief presentation of the algorithm, we still have to elucidate a point: given an ideal a, how to construct an element a such that a • a is smoother than the ideal a? To do so we are going to minimize the norm of a • a , which boils down to nding a small principal ideal a included in a and to divide a by a . Hence by multiplicativity of the norm, the quotient is of norm smaller than the norm of a and the smallest a , the smallest the resulting ideal will be. It then su ces to construct the smallest possible element a in the ideal, that is to say to perform a reduction of the algebraic lattice de ned by a.

We actually went back to our leitmotiv: the algorithmic arithmetic problem has been reduced in ne to a myriad of instances of search for short vectors in algebraic lattices, as the proof of the two square theorem reduced to the nding of a smallest vector in a well-chosen lattice.

.

Cryptographical opening

The XX th century has been the theater of profound changes in cryptography.

Etymologically, the cryptology is the science of secret, but can not really be considered as a science until the end of the 's, as it was more of a technical eld. This science encompasses the cryptography-the art of protecting a secret-and the cryptanalysis-which we could qualify by o ensive, consists in the analysis of the schemes produced by the cryptography.

. . . Mutation of the cryptographical landscape during the XX th century. From the premises of cryptography, with the famous scytale of the Spartans, to the war codes of the First World War, such as the one of the Zimmerman telegram, cryptography was manual: all encoding, decoding, and cryptanalysis was based on transpositions of letters, phonemes or words, and was perfumed by hand.

Cryptography was deeply just after the end of the war with the development of the Enigma machine in , when a dutch engineer, Hugo Alexander Koch, patent an electromechanical machine to encrypt. It is still a transposition cipher-each letter is replaced by another one-with the subtlety that the whole substitution change from a letter to another. The encryption is performed by the machine, built on an assiduous system using moving rotors and electric wires. The cryptanalysis was forced to enter this mechanical age, as the cryptanalysis of Enigma was introduced by Alan Turing and his so-called bombs which allowed the bruteforce of the code, that is trying every possible key.

The year was maybe the most profound change in cryptography: it is the date of publication of the seminal article New Directions in Cryptography [ ] of Di e and Hellman. This article introduced a radically new paradigm to distribute cryptographical keys and solve a fundamental problem of cryptography: the key exchange. This article almost instantly red up the development of a new kind of cryptographical algorithms, the asymmet-ric schemes. Before that landmark, all ciphers were symmetrical schemes where the same key was used by the sender and the receiver.

We shall now quit this historical aparté and get back to our matter of interest, lattices.

.

Lattice based-cryptography

Asymmetrical cryptography requires to nd hard problems, in the sense of complexity theory. But beyond the problem itself, nding hard instances of them is a critical matter to instantiate the cryptosystem.

The rst method used in cryptography to produce di cult problems on average case has been proposed simultaneously in by Ajtai on the one hand and by Ho stein, Pipher et Silverman (NTRU

) [ ] on the other hand. Both are based on Euclidean lattices. Subsequently, Regev introduced in the learning with error problem ( ), together with a quantum reduction to a classical lattice problem, the shortest independent vectors problem. Since then lattice-based cryptography has vividly developed and imposes itself as a serious contender for the rise of a "post-quantum" cryptography.

Indeed, it appears that, up to this date, we are not able to design an ecient quantum algorithm to solve the hard problems on Euclidean lattices, whereas some of the pillars of asymmetrical cryptography, notably integer factorization and discrete logarithm in nite elds have been undermined by quantum-enhanced search techniques.

In addition to this advantage on post-quantum security, lattices enabled the development of feature-rich primitives such as the homomorphic encryption [ ].

Hence, Euclidean lattices constitute a particularly attractive foundation for cryptographical researches, for the o ered possibilities as well as for the security promises.

.

Lattice reduction as a cryptanalytical toolkit . . . Security and reduction To evaluate the security of lattice-based primitives, it is often necessary to use lattice-reduction algorithms. Indeed, the nding of a short element in a lattice used to built a cryptographical scheme allows generally to reconstruct quite straightforwardly the secret key.

In order to speed-up the lattice-based cryptosystems, it has been suggested, for instance in [ ], [ ], [ ], to switch from arbitrary lattices to ideals and more generally to lattices over number elds. Indeed, the alge-A well-known example is the -SAT problem of satis ability: the instances which are not speci cally built to be di cult are actually much easier to solve that what the NPcompleteness of the problem would let us think, opening the door to numerous very e cient practical solvers. braic structure of these lattices allows performing faster computations while minimizing the size of the objects manipulated .

Hence the security of such cryptosystems depends on our capacity to reduce algebraic-lattices, justifying the interest of the reduction techniques introduced supra.

. . . Practical examples of cryptanalysis using algebraic lattices. Chapter presents the cryptanalysis of three lattice-based schemes. The rst one is an attack on the homomorphic encryption scheme of Smart and Vercauteren [ ]. Its secret key is made of a small element in a cyclotomic eld, and the corresponding public key is a Z-basis of the ideal generated by this element. Hence we can attack the scheme with the help of the algorithm for the principal ideal problem, presented in Chapter . Remark that nding a generator is not completely su cient, as we aim for a short generator. To do so, we use the reduction of [ ] allowing us to nd a short generator from an arbitrary one, in polynomial time.

Eventually, we detail a side-channel attack on the digital signature scheme [ ]. A side-channel attack is an attack which aims at discovering and exploiting the aws in the implementation, in software or hardware, of a cryptographical scheme or protocol. Such an attack does not alter the theoretical robustness of a cryptosystem, but solely expose a aw in its practical implementation. An analysis of the power consumption's traces of the signature scheme allows indeed to estimate the norm over a sub eld of the secret key, which is a small element of a cyclotomic eld. Using latticereduction and the properties of the factorization of ideals, we retrieve the secret key from its norm, that is solving a norm equation in a number eld.

For instance, a lattice coming from an ideal can be represented by two polynomials instead of a full integer matrix.

N O T AT I O N S A N D C O N V E N T I O N S

The bold capitals Z, Q, R refer as usual to the ring of integers and respectively the eld of rational and real. Given a real number x, its integral rounding denoted by x returns its closest. Its fractional part is the excess beyond that number's integer part and denoted by {x}.

These operators are extended to operate on vectors and matrices by pointwise composition. The complex conjugation of z ∈ C is denoted by the usual bar z. The logarithm functions are used as log for the binary logarithm and ln for the natural one.

We say that an integer n ∈ Z is log-smooth if all the prime factors of n are bounded by log(n).

For a eld K, let us denote by K d×d the space of square matrices of size d over K, Gl d (K) its group of invertibles. Denote classically the elementary matrices by T i,j (λ) and D i (λ) for respectively the transvection (or shear mapping) and the dilatation of parameter λ.

We extend the de nition of the product for any pair of matrices (A, B): for every matrix C with compatible size with A and B, we set: (A, B) • C = (AC, BC).

For a vector v (resp. matrix A), we denote by v ∞ (resp. A max ) its absolute (resp. max) norm, that is the maximum of the absolute value of its coe cients.

For any matrix A we geerically denotes by A i the i-th column of A. We also adopt the following conventions for submatrix extraction: for any matrix M = (m i,j )

∈ K n×n and 1 ≤ a < b ≤ n, 1 ≤ c < d ≤ n, de ne the extracted submatrix M[a : b, c : d] = m i,j a≤i≤b,c≤j≤d .
For a family of square matrices J 1 , . . . , J of respective dimensions n 1 × n 1 , . . . , n × n , denote by Diag(J 1 , . . . , J ) the block diagonal matrix (∑ i=1 n 1 ) × (∑ i=1 n i ) of diagonal elements the J i , that is:

               0 0 0 0 J 1 0 0 0 0 0 0 0 0 0 0 . . . 0 0 0 0 0 0 0 0 0 0 J               
We use the standard model in algorithmic theory, i.e. the word-RAM with unit cost and logarithmic size register (see for instance [ , Section . ] for a comprehensive reference). The number of bits in the register is generically denoted by w.

For a non-negative integer d, we set ω(d) to be the exponent of matrix multiplication of d × d matrices. If the dimension d is clear from context we might omit it and write simply O(d ω ) for this complexity. We can assume that this exponent is not too close to , in particular ω(d) > 2 + 1/ log(d), so that complexities with terms in O (ω -2) -1 makes sense. Also, we assume that ω is non-increasing.

Part I G E O M E T R Y O F N U M B E R S W I T H A F L AV O R O F N U M B E R T H E O R Y
This rst part introduces the objects and notions used in the subsequent part of the manuscript. It consists in three chapters.

The rst one provides a basic introduction to algebraic number theory, with an emphasis on its e ective aspects. Then, we move to a short introduction to Minowski's geometry of numbers, viewed through the prism of lattice reduction algorithms. Eventually, we make use of this background to present the theory of lattices over number elds, or so-called Humbert forms.

We conclude this third chapter by exposing the di culties yields when trying to extend the lattice reduction algorithms to this more general context.

1

A B R I E F I N T R O D U C T I O N T O A L G E B R A I C N U M B E R T H E O R Y
The aim of this chapter is to introduce the algebraic notions used in the subsequent parts of this manuscript. The rst part of this chapter is devoted to module theory, with an emphasis on torsion-free modules over Dedekind domains, since all of the rings we encounter in our works are actually be Dedekind domains. Then we invite the reader to a small journey into elementary number elds theory with a nal focus on cyclotomic elds.

Since the motto of the present manuscript is to give an algebraic insight on the algorithmic counterpart of a geometry of numbers over number elds, we put emphasis all along this chapter on the algorithmic methods used to manipulate and deal with the introduced objects. For an extensive reference on algorithms in number theory, we let the reader refer to the two books of Henri Cohen, [ ] and [ ].

. Modules over rings are a fundamental structure in algebra, appears naturally in many branches of mathematics, like algebraic geometry, algebraic topology and of course, number theory. A module is an additive abelian group endowed with a product between elements of the ring and its element, which is distributive over the addition operation of each parameter and is compatible with the ring multiplication. In a broad sense, modules can be thought as a generalization of vector spaces, where the base eld is replaced by an arbitrary ring.

Since the work presented in this manuscript only concerns the algebraic part of number theory, all the rings we encounter are actually commutative, and thus we simplify this introduction by sticking to the abelian case, allowing to avoid the distinction between left and right actions of the scalars.

. . Basic de nitions

Let R be a ring. We denote by and its respective additive and multiplicative neutral elements. A R-module M consists of an abelian group (M, +)

and an operation • : R × M → M such that for all r, s ∈ R and m, n ∈ M, we have:

• r • (m + n) = r • m + r • n (linearity with vectors) • (r + s) • m = r • m + s • m (linearity with scalars) • (rs) • m = r • (s • m) (associativity)
• 1 • m = m (action of the neutral element)

As for vector spaces, the action of the ring on M is called scalar multiplication.

Example.

A central example in this manuscript is given by the class of modules of the form Z n for an integer n, which can be seen as the set of n-dimensional vectors with integral coe cients.

. . Submodules, morphism

Suppose M is an R-module and N is a subgroup of M. Then N is a submodule (or more explicitly an R-submodule) if for any n ∈ N and any r ∈ R, the product r • n is still in N .

If M and N are two R-modules, then a map f : M → N is a homomorphism of R-modules (or a R-linear map) if for any m, n ∈ M and r, s ∈ R,

f (r • m + s • n) = r • f (m) + s • f (n).
It is an isomorphism if it is also bijective as a map between sets.

As usual for algebraic structures, the kernel-that is, the preimages of 0of an R-linear map between two R-modules M and N is a R-submodule of M.

. .

Direct sums and tensor product over modules

Let us x a commutative ring R and let M and N be two R-modules.

. . . . Direct sum. The cartesian product M × N can be given the structure of R-module by de ning the operations componentwise:

• (m, n) + (m , n ) = (m + n, m + n ) • r • (m, n) = (r • m, r • n)
for any m, m ∈ M, n, n ∈ N and r ∈ R. This module structure is denoted by M ⊕ N , called direct sum of M and N . This is the smallest module which contains the given modules as submodules.

Example. Taking two non-negative integers, say n and m, allows us to construct the direct sum Z n ⊕ Z m . Following the interpretation given above, an element of Z n ⊕ Z m is a couple consisting of a n-dimensional vector and of a m-dimensional vector with integer coe cients, that is a (n + m)-dimensional vector of integers. The addition rule and product rule let us easily verify that the resulting laws are the same as the laws of Z n+m , so that Z n ⊕ Z m ∼ = Z n+m . . . . . Tensor products, extension of scalars. Tensor product of modules is a construction that allows arguments about bilinear maps to be written in terms of linear maps. More precisely it satis es the following universal property: given M and N two R-modules, their tensor product is the data of an Rmodule M ⊗ R N and a bilinear map ϕ : M × N → M ⊗ R N which have the property that any bilinear map h : M × N → Z for an R-module Z factors uniquely through ϕ in a R-linear map f , that is making the following diagram commutative:

M ⊗ R N M × N Z f h ϕ
The construction of the tensor product M ⊗ R N takes a quotient of the free abelian group with basis the abstract symbols m * n-used here to denote the ordered pair (m, n)-for m in M and n in N , by the subgroup generated by all elements of the form:

• -m * (n + n ) + m * n + m * n • -(m + m ) * n + m * n + m * n • (m • r) * n -m * (r • n)
where m, m in M, n, n in N , and r in R. The quotient map takes m * n = (m, n) to the coset containing m * n; that is,

M × N → M ⊗ R N , (m, n) → [m * n].
This abelian group has a natural structure of R-module since R is commutative, as rr (m ⊗ n) = rm ⊗ r n = r m ⊗ rn, for any r, r ∈ R and m, n ∈ M × N . A useful application of the tensor construction is the so-called "extension of scalar". Let f : R → S be a homomorphism between two rings, and let M be a R-module. Consider the tensor product M S = M ⊗ R S, where S is considered as a R-module via the map f . Since S is also a module over itself, and the two actions commute, that is r • (s • s ) = (r • s) • s for any r ∈ R, and s, s ∈ S, the module M S inherits the action S. It is (m ⊗ s) • s = m ⊗ ss for any m ∈ M.

Example. A particularly interesting example is the completion of a module over an integral domain in a number eld by extending the ring into its fraction eld. For instance, if one consider a Z-module M, then its extension M ⊗ Z Q is a Q-vector space containing M.

. .

A small taxonomy of modules

In the following, we brie y introduce and discuss the properties of the modules we are going to encounter. For the sake of simplicity, we now only consider rings which are integral domains-i.e. rings where the products of two nonzero elements is not zero-, even though the following constructions can be adapted for any ring. This allows us to always consider the fraction eld of any ring used.

. . . . Finitely generated modules. A R-module M is nitely generated if there exists a family of elements (a 1 , a 2 , . . . , a d ) of M such that for any x ∈ M, there exist some r 1 , r 2 , . . . ,

r d in R such that x = r 1 a 1 + r 2 a 2 + • • • + r d a d .
The set (a 1 , a 2 , . . . , a d ) is referred to as a generating set for M in this case. A rank notion can be de ned on nitely generated modules, which can be seen as a generalization of the dimension in linear algebra. Denote by K the fraction eld of R. Formally the rank rk M of the module M over the domain R is the dimension of the space (M ⊗ R K) seen as a vector space over the eld K. The e ect of this scalar extension is to kill the torsion in the module M in the following sense:

Fact. M ⊗ R K ∼ = M t(M) ⊗ R K, where t(M) = {m ∈ M | ∃r ∈ R \ 0, r • m = 0} is the torsion submodule of M.
Proof. Denote by π the canonical projection of M over the quotient M t(M) . Let us de ne:

F : M × K -→ M t(M) ⊗ R K (m, k) -→ (π(m) ⊗ k) .
This map is clearly bilinear, so there exists a R-linear map f :

M ⊗ R K -→ M t(M) ⊗ R K for which f (m ⊗ k) = π(m)
⊗ k, that is, lifting the projection π. Conversely, remark that the tensor mapping ⊗ : M × K -→ M ⊗ R K vanishes over t(M) × K). As such we can factor this map into a bilinear mapping:

G : M t(M) × K -→ M ⊗ R K (π(m), k) -→ (m ⊗ k)
.

We have used implicitly in this de nition of the torsion that R is an integral domain.

This map is well de ned since the pure tensor m ⊗ k only depends on m through its class in the quotient M t(M) . Hence, there exists a R-linear map g : M

t(M) ⊗ R K -→ M ⊗ R K such that g(π(m) ⊗ k) = m ⊗ k.
As f • g and g • f xe all pure tensors and are linear, the let invariant all tensors and thus f and g are inverse isomorphisms.

Remark that the rank notion is compatible with the direct sum and tensor product in the sense that for any R-modules M and N we have: rk(M ⊕ N ) = rk M + rk N and rk(M ⊗ N ) = rk M × rk N .

Example. Finitely generated modules over Z are by de nition the nitely generated abelian groups. The structure theorem (see for instance [ ]) asserts that such a module M is isomorphic to

Z n ⊕ Z q 1 Z ⊕ • • • ⊕ Z q t Z
for a non negative integer n and q 1 , . . . , q t are powers of (not necessarily distinct) prime numbers. The rank of

M is n as M ⊗ Z Q ∼ = Z n ⊗ Z Q ∼ = Q n .
. . . . Free modules. For an integral domain R and an R-module M, a subset B ⊆ M is a basis for M if:

• B is a generating set for M.

• B is linearly independent, that is, r 1 e 1 + r 2 e 2 + • • • + r d e d = 0 for e 1 , e 2 , . . . , e d distinct elements of B and r 1 , . . . ,

r d ∈ R implies that r 1 = • • • = r d = 0.
A free module is a module with a basis. A simple, yet central, example of free module is given by quotients of polynomial rings: ( f ) and set ξ to be the image of X in B. Then B contains A as a subring and is free as an A-module with a basis 1, ξ, . . . , ξ d-1 , called its power basis.

The notion of freeness is also linked to the rank introduced in Paragraph . . . : let M be a nitely generated module over R, then its rank is also equal to the rank of any maximal free submodule of M.

. . . . Projective modules. The notion of projective modules is a slight generalization of free modules. Indeed, every free module is projective but the contrary does not hold.

A module P is projective if and only if there is another module Q such that the direct sum P ⊕ Q is free. Equivalently, this means that for any surjective R-module morphism f from some modules A to B, and any morphism g : P → B, there exists a lift morphism φ which makes the following diagram commutative:

A P B f g φ
An example of a nitely generated projective module which is not free is given and studied in Chapter .

. . Modules over Dedekind domains . . . . Ideal and fractional ideals.

De nition . . . An ideal, or integral ideal, of R is a non-zero R-submodule of R. More generally a fractional ideal a of R is a nonzero R-submodule of the fraction eld K of R for which there exists a nonzero x in K such that xa ⊂ R.

. . . . Multiplication. The product of two fractional ideals a and b is dened as follows De nition . . (Dedekind domain). A ring R, with fraction eld K, is said to be a Dedekind domain when it satis es the following properties:

ab := {a 1 b 1 + • • • + a m b m | a i ∈ a
• R is integrally closed: every element of K which is annihilated by a monic polynomial of R[X], lies in R.

• R is a Noetherian domain: there is no in nite strictly ascending sequence of ideals.

• Every nonzero prime ideal is maximal.

In all of the following let us x a Dedekind domain R and set K to be its fraction eld. . . . . Properties of ideals over Dedekind domains.

De nition . . (Invertible fractional ideal).

A fractional invertible ideal a is an ideal such that there exists a fractional ideal b such that ab = R = 1 .

The inverse of fractional ideals are very easy to describe: Proposition . . . In a Dedekind domain R of fraction eld K, every nonzero fractional ideal is invertible. The inverse of a is {x ∈ K : xa ⊆ R}.

Before proving this proposition we need a technical lemma on the denominators of integral ideals.

Lemma . . . For any proper integral ideal a, there is some γ ∈ K \ R for which γa ⊆ R.

Proof. Take any nonzero a ∈ a. Then aR contains a product of prime ideals, say aR ⊇ p 1 p 2 • • • p n with n minimal (i.e. a does not contain a product of n -1 prime ideals). Indeed, assume that this is not the case. Let S be the collection of integral ideals of R not containing a product of prime ideals, so S is nonempty and R ∈ S. As R is noetherian, S must have a maximal element, say s. Clearly s cannot be prime (otherwise it would contain a prime: itself), so there must be x, y ∈ R with xy ∈ s but x, y ∈ s. But then s s + (x), s + (y), and so s + (x) and s + (y) contain products of prime ideals. But then (s + (x))(s + (y)) = s + (xy) ⊆ s also contains a product of prime ideals, contradicting the choice of s.

As R ⊆ aR, n ≥ 1. As a is a proper ideal, it must be contained in some maximal ideal, p. Since maximal ideals are prime in commutative rings, p is prime. But now p 1 p 2 • • • p n ⊆ p. Thus as p is prime, p i ⊆ p for some i (if p is prime and A, B are ideals with AB ⊆ p then either A ⊆ or B ⊆ p). But as R is a Dedekind domain, p i must be maximal, so p = p i . Now assume without loss of generality that i = n. By the minimality of n, (p

1 • • • p n-1 ) ⊆ aR. Take any b ∈ p 1 • • • p n-1 \ aR and let γ = b/a ∈ K. We claim that this is the desired γ. First if γ ∈ R then b = γa ∈ aR, which is a contradiction, so γ ∈ R. Now for any x ∈ a, bx ∈ p 1 • • • p n-1 a ⊆ p 1 • • • p n ⊆ aR
, and so bx = ar for some r ∈ R. But now γx = bx a = r ∈ R, and so γa ⊆ R, as required. Proof of Proposition . . . Note that for any n ∈ R non-zero, we know a is invertible if and only if na is invertible. If the annonced result is false, there is an integral ideal a ⊆ R which is not invertible. Moreover, as R is Noetherian, we can assume a is maximal with this property, i.e. if a ⊂ a ⊂ R, then a is invertible.

Let b = {x ∈ K : xa ⊆ R}, which is a fractional ideal. We clearly have R ⊆ b, and by Lemma . . , we know this inclusion is strict.

As R ⊆ b, we know a ⊂ ab. Again, this inclusion is strict-if ab = a, then for all x ∈ b, we have xa ⊆ a. Hence R[x]a ⊆ a, so that R[x] is a fractional ideal. As such it is nitely generated as R-module as R is Noetherian and x is therfore annihilated by a polynomial with coe cients in R. By intergral closedness, x ∈ R, but remark that we cannot have b ⊆ R.

So a ab. By assumption, we know that ab ⊆ R, and since a is not invertible, the inclusion is strict. But then by de nition of a, ab is invertible, which implies a is invertible (if c is an inverse of ab, then bc is an inverse of a). This is a contradiction. So all fractional ideals must be invertible.

Finally, we have to show that the formula for the inverse actually holds. We write c = {x ∈ K : xa ⊆ R}.

Then by de nition, we know a -1 ⊆ c. Hence R = aa -1 ⊆ ac ⊆ R. Therefore, we must have ac = R, i.e. c = a -1 .

Proposition . . . Every fractional ideal a of a Dedekind R is a nitely generated module, i.e., it can be expressed as

α 1 R + • • • + α k R, for some integer k with the (α i ) belongings to R.
Proof. Take a a fractional ideal. We take x ∈ K \ {0} such that xa ⊆ R, which is an ideal of R. Since this ring is Noetherian, xa ⊆ R is nitely generated-otherwise, we could construct inductively an in nite strictly increasing chain by adding a new generator at each step-and hence a is nitely generated as then xa ∼ = a as R-module since x invertible in K.

. . . . Divisibility of ideal. Similarly to the divisibility notion over the rational integers we can de ne: . (⇒) is clear. For the other direction, we notice that the result is easy if

a = α is principal. Indeed, if b = β 1 , . . . , β r , then b ⊆ α means there are some β a , . . . , β r ∈ R such that β i = β i α. But this means: β a , . . . , β r = β 1 , . . . , β r α , So α | b. Now suppose we have b ⊆ a. By the proposition, there exists an ideal c ⊆ R such that ac = α is principal with α ∈ R, α = 0. Then • b ⊆ a if and only if bc ⊆ α by (i); and • a | b if and only if α | bc by (ii).
This concludes the proof.

Informally this last lemma states that inclusion of ideals is equivalent to divisibility, this in substance equivalent to saying that "prime ideals are primes of the ideal arithmetic". . . . . Unique factorization. Eventually, we will prove that every ideal is a product of prime ideals and that this factorization is unique, like for the rational integer arithmetic.

Theorem . . . Let a ⊆ R be an ideal, a = 0. Then a can be written uniquely (up-to-order) as a product of prime ideals.

Proof. Let us start by the existence. Suppose that a is not a prime. Then it is is not maximal, as maximal ideals are clearly primes by de nition of primality. Hence, there is some b a with b ⊆ R. Hence b | a, i.e. there is some c ⊆ R with a = bc, and c ⊇ a. We can continue factoring this way, and the process stops eventually, or else we could construct an in nite chain of strictly ascending ideals.

We now prove the uniqueness. We have shown p

| ab implies p | a or p | b. So if p 1 • • • p r = a 1 • • • a s , with p i , a j prime, then we know p 1 | a 1 • • • a s , which implies p 1 | a i
for some i, and without loss of generality we can assume that i = 1. So a 1 ⊆ p 1 . But a 1 is prime and hence maximal. So

p 1 = a 1 . Multiplying the equation p 1 • • • p r = a 1 • • • a s by p -1
1 , and we get

p 2 • • • p r = a 2 • • • a s .
We conclude by a nite induction.

Corollary . . . The non-zero fractional ideals form a group under multiplication. We denote this I K . This is a free abelian group generated by the prime ideals, i.e. any fractional ideal a can be written uniquely as p a 1 1 • • • p a r r , with p i distinct prime ideals and a i ∈ Z. For any i, the integer a i is called the p i -adic valuation of the ideal a, with the convention to be set at zero for any ideal not appearing in the prime decomposition.

Moreover, if a is an integral ideal, i.e. a ⊆ R, then a 1 , . . . , a r ≥ 0.

Proof. We already have unique factorization of non-fractional ideals. Now take any fractional ideal, and write it as a = ab -1 , with a, b ∈ R (e.g. take b = x for some x in the fraction eld of R), and the result follows directly by simple computation of the exponents.

With this factorization, we can be far more precise on the number of elements required to generate an ideal in a Dedekind domain: for R being a Dedekind domain, then any fractional ideal a of R can be generated by two elements. We prove now an ever stronger result: Proposition . . . Let R be a Dedekind domain, then for any fractional ideal a of R and a ∈ a, there exists b ∈ a so that a is generated by a and b.

Proof. Let a and take any a ∈ a. Then let factorize the principal ideal aR in ∏ r i=1 p a i i . Therefore, we have a = ∏ r i=1 p e i i for exponents e i ≤ a i as aR ⊂ a. Suppose that we can nd b ∈ R such that the p i -adic valuation of b is e i for each 1 ≤ i ≤ r. Then a divides bR and as such b ∈ a. Further, if we set a to be the ideal generated by a and b, then for any prime p dividing aR, the p-adic valuation of a is exactly min(a i , e i ) = e i and for any prone q which does not divide aR does not divide a . Hence a = a .

Let us prove that such a b always exists. Set I = ∏ r i=1 p e i +1 i , and

a i = I • p -e i -1 i , which is of course an integral ideal of R. Then a 1 + • • • + a r = R,
otherwise the whole sum would be divided by some common prime ideal. Hence there exists a family of x i ∈ a i such that ∑ r i=1 x i = 1. Then, for any set of elements b i ∈ p e i \ p e i -1 , the element ∑ r i=1 x i b i satis es the condition on the valuations. . . . . On nitely generated modules over a Dedekind domain. We conclude this review on modules by a structure theorem on modules over Dedekind domain, which turns out to be very rigid: these modules decompose as direct sums of fractional ideals. Since we are interested by Z-modules in the context of lattices, we start by discussing the structure of projective Z-modules, which will forge the intuition for the general case. Let M be a projective Z-module. Hence M is a direct factor of Z n for a certain n. As a subgroup of the abelian group Z n , there exists r ≤ n so that M ∼

= Z r , proving that M is free that is M = Z ⊕ • • • ⊕ Z.
This boils down to split M as a direct sum of ideals of the ring Z, which are isomorphic to Z itself by principality.

The general case is more complicated, as all ideals are not necessarily principal. However, it appears that any projective module is still a direct sum of fractional ideals (in the case of Z, since every ideal is isomorphic to Z itself, it recovers the previous isomorphism). This is Steinitz' theorem:

Theorem . . (Steinitz' classi cation). Let R be a Dedekind domain and let P be a nitely generated projective R-module of rank d. Then

P ∼ = a 1 ⊕ • • • ⊕ a d for a i a family of non-zero fractional ideals. Besides, the class of [a 1 • • • a d ],
called the Steinitz class, in the class group of R, that is in the quotient of the group of fractional ideals by the principal ideal, is uniquely determined by P.

((v 1 , a 1 ), . . . , (v d , a d ))
such that:

P ∼ = v 1 a 1 ⊕ • • • ⊕ v d a d ,
is called a pseudo-basis of P.

. ' . '

In this section, we review the notions of algebraic number theory that will be used in the further developments of this manuscript. A far more complete introduction to this topic can be found in the monograph Algebraic Number theory of Neukirch ([ ]) for instance.

. . Number elds

. . . . Extensions. De nition . . . Let K be a eld. A eld extension of K is a eld L that contains K. It is denoted by L/K.
If L/K is a eld extension, then the multiplication of K on L de nes a Kvector space structure on L. The degree

[L : K] of L/K is then the dimension dim K (L). L/K is called nite if [L : K] < ∞.
If L/K is a eld extension and α ∈ L, denote by K(α) is the sub eld of L generated by K and α. Explicitly we have:

K(α) = f (α) g(α) | f , g ∈ K[X], g(α) = 0 .
Such eld extensions generated by one element are called simple.

Any element α of a nite extension L/K is annihilated by a polynomial of K[X] since the extension K(α) is necessarily nite. The set of all polynomials vanishing at α is an ideal of K[X] and is, therefore, principal since K is a eld. The unique monic generator ρ α of this ideal is called the minimal polynomial of α. In this case, we have an isomorphism given by identifying α and the image of X in the quotient:

K[X] (ρ α ) ∼ = K(α).
. . . . Number elds.

De nition . . . A number eld L is a nite extension of the rational eld Q.

Number elds are simple extension, as we can always nd a so-called primitive element generating it:

Theorem . . (Primitive element theorem). Let L/Q be a number eld. Then there exists an α ∈ L such that Q(α) = L. Proof. A classical proof of this theorem can be found in [ ]. Example. We have Q( √ 2, √ 3) = Q( √ 2 + √
3): the adjunction of two different algebraic integers to Q can be treated by directly studying the primitive element √ 2 + √ 3.

Remark. By the primitive element theorem, we can represent a number eld by the polynomial quotient L ∼ = Q[X] (P) for a polynomial P of degree n with integral coe cients. Hence we can handle the elements of L by polynomials modulo (P). In practice, this implies that if α, β are represented as two polynomials of degree n = [L : Q] and of coe cients of bitsize B, the complexity of computing αβ is O(nB + n log n) . . Algebricity . . . . Ring of integers. Let L/K be a eld extension, α ∈ L. We say that

α is algebraic over K if there exists a non-zero polynomial f ∈ K[X] with f (α) = 0 De nition . . (Algebraic integer).
Let L be a number eld. An algebraic integer is an α ∈ L such that there is some monic f ∈ Z[X] vanishing at α. We write O L for the set of algebraic integers in L.

This de nition generalizes the notion of the rational integers Z as we have

O Q = Z, i.e. α ∈ Q is an algebraic integer if and only if α ∈ Z. Further, in this generalization, O L is a subring of L, as Z is a subring of Q. In addition L is the fraction eld of O L . De nition . . . Let L be a number eld. A unit of L is an element x ∈ O L such that x -1 still lies in O L .
The unit group or units of 2 is the ring:

O × L = {x ∈ O L : x -1 ∈ O L } . . . . Integral bases.

De nition . . (Integral basis).

Let L/Q be a number eld. Then a basis α 1 , . . . , α n of L is an integral basis i

O L = n ∑ i=1 m i α i : m i ∈ Z = n i=1 Zα i .
It is simultaneously a basis for L over Q and O L over Z.

Example. Consider Q( √ d) with d square-free, d = 0, 1. If d ≡ 1 (mod 4), then (1, 1 2 (1 + √ d)) is an integral basis. Otherwise, if d ≡ 2, 3 (mod 4), then (1, √ d) is an integral basis.
An integral basis always exists, implying that the ring of integers of a number elds always have a natural structure of free Z-module.

Theorem . . . Let L/Q be a number eld. Then there exists an integral basis for O L . In particular,

O L ∼ = Z n with n = [L : Q].
We defer the proof of this theorem to Section . . .

Remark.

While it is always true that we can nd an integral basis and that a power basis always exists for a number eld L, it is noticeable that an integral power basis does not always exist, so that O L is not necessarily isomorphic to Z[α] for some α ∈ L. An example of such eld is not completely trivial and one of the simplest comes back to Dedekind who provided the eld Q(θ) for θ being a root of

X 3 -X 2 -2X -8, for which O Q(θ) = Z ⊕ θZ ⊕ (θ + θ 2 )/2Z. Indeed, if we suppose that O Q(θ) = Z[α]
for an α ∈ L, then the factorization of the ideal 2O L would corresponds to the factorization of the minimal polynomial and(-3/2θ 2 + 6/2θ -4 Remark. Given a de ning polynomial of a number eld L, the problem of determining the ring O L is computationally equivalent (up-to additional polynomial computations) to the problem of nding the largest square-free of the discriminant (see Section . . for a de nition of this notion) of L. But being able to retrieve the square-free part does not seem to be an easy problem, as there is, up to our knowledge, no signi cant speedups on the naive approach consisting in factorizing the discriminant, leading to a subexponential algorithm. However, Buchmann and Lenstra showed in [ ] that we can approximate this ring of integers in polynomial time. This approximation can be used in place of O L for certain applications in algorithmic number theory.

f α of α in F 2 [X]. But 2 splits in O L : its prime factors are: (1/2(θ 2 -θ) + 1)O L , (-θ 2 + 2θ -3)O L
. ,

. . Norm and trace

De nition . . (Norm and trace). Let L/K be a eld extension, and α ∈ L.

We write m α : L → L for the "multiplication by α" map: → α . Viewing this as a linear map of K vector spaces, we de ne the norm of the element α to be

N L/K (α) = det m α ,
and the trace to be

tr L/K (α) = tr m α .
The following property is immediate by properties of the determinant and trace of linear maps: Proposition . . . For a eld extension L/K and a, b ∈ L, we have:

N L/Q (ab) = N L/K (a)N L/K (b) and tr(a + b) = tr(a) + tr(b).
We can alternatively de ne the norm and trace as follows:

More precisely, the algorithm of Buchmann and Lenstra takes as input an order A of O L and generates in polynomial time an order B containing A and a number q such that q is squarefree i B = O L . Equivalently given an order A and a squarefree integer m, this allows to devise in polynomial time an order

B containing A such that gcd(m, [O L : B]) = 1. Proposition . . . Let m α ∈ K[X] be the minimal polynomial of α. De ne its characteristic polynomial χ α to be det(XI -m α ) = m [L:K(α)] α
Hence if m α (x) splits in some eld L ⊇ K(α), as the product:

m α (x) = (x -α 1 ) • • • (x -α r ), then N K(α)/K (α) = r ∏ i=1 α i , tr K(α)/K (α) = r ∑ i=1 α i ,
and as such:

N L/K (α) = r ∏ i=1 α i [L:K(α)] , tr L/K = [L : K(α)] r ∑ i=1 α i .
Remark. This result implies that the trace and norm of an algebraic integer are rational integers, by Newton formulas on the relations between coe cients and roots.

Example (Quadratic integers). Let L = Q √ d ∼ = Q[z] (z 2 -d)
, where d is not a square in K. As a vector space over K, we can take 1, √ d as our basis. So every α can be written as

α = x + y √ d.
Hence the matrix of multiplication by α is

m α = x d • y y x .
So the trace and norm are given by

tr L/K (x + y √ d) = 2x = (x + y √ d) + (x -y √ d) N L/K (x + y √ d) = x 2 -dy 2 = (x + y √ d)(x -y √ d)
We can also obtain directly this result by considering the roots of the minimal

polynomial of α = x + y √ d, namely (α -x) 2 -y 2 d = 0, which has roots x ± y √ d.
In particular, if L = Q( √ d), with d < 0, then the norm of an element is just the square of its module viewed as an element of C.

Remark. When representing elements of L = Q[X]/(P) by polynomials modulo (P) of degree n, a simple way to compute the norm of α ∈ L, is to compute the polynomial resultant of α and P, which can be done in Example. For Q( √ -1), there are two such embeddings-one sends √ -1 to i and the other sends √ -1 to -i. This situation captures the general case: the rigidity imposed by the primitive element theorem ensures that all of the embeddings are completely determined by the image of a primitive element of L.

O n 2 log N L/K (α) log log N L/K (α) + (log N L/K α) 2 operations.

Lemma . . . The number of eld embeddings

L → C is equal to its degree [L : Q].
Proof. Let α be a primitive element, and

m α (x) ∈ Q[X] be its minimal poly- nomial, so that deg m α = [L : Q] = n. By primitivity, (1, α, α 2 , . . . , α n-1 ) is a basis of K as Q-vector space. Since L/Q is separable as Q is of charac- teristic ,
we know m α has n distinct roots in C, so that we write:

m α (x) = (x -α 1 ) • • • (x -α n ). Now an embedding Q[X]/(m α ) → C is
uniquely determined by the image of x, and x must be sent to one of the roots of m α , since its image must satisfy

m(σ(α)) = σ(m α (α)) = 0.
So for each i, the map x → α i gives us a eld embedding and clearly none of them can be equal to another one, so that there are exactly n of them.

We can separate the embeddings by theirs images: De nition . . (Signature of a number eld). We write r for the number of real eld embeddings L → R, and s the number of pairs of non-real eld embeddings L → C. Then

[L : Q] = r + 2s.
Alternatively, r is the number of real roots of m α , and s is the number of pairs of complex conjugate roots.

. . . . Connection to the norm and trace. Using these eld embeddings, we can give an alternative de nition of the trace and norm forms, which reveals directly their respective and additive natures:

Lemma . . . Let L/Q be a number eld. If σ 1 , . . . , σ n : L → C are the di erent eld embeddings and β ∈ L, then tr L/Q (β) = ∑ i σ i (β), N L/Q (β) = ∏ i σ i (β).
We call σ 1 (β), . . . , σ n (β) the conjugates of β in C. . . . . Characterization of units. Using this de nition of the norm, we can give an alternative characterization of the units of L:

Lemma . . . Let x ∈ O L . Then x is a unit if and only if |N L/Q (x)| = 1. Proof. Let x ∈ O × L , then there is some y ∈ O L such that xy = 1. Taking the norm yields N L/Q (x)N L/Q (y) = 1. So N L/Q (x) is a unit in Z, i.e. ±1.
Reciprocally, let σ 1 , . . . , σ n : L → C be the n embeddings of L in C. Without loss of generality, up to composing by σ -1 1 , we can identify L with a sub eld of C, so that σ 1 is the inclusion map. Then for each x ∈ O L , we have

N L/Q (x) = xσ 2 (x) • • • σ n (x). Now if N L/Q (x) = ±1, then x -1 = ±σ 2 (x) • • • σ n (x). So we have x -1 ∈ O L , since this is a product of algebraic integers. So x is a unit in O L . Corollary . . . If x ∈ O L is such that N L/Q (x) is prime, then x is irre- ducible. Proof. If x = ab, then N L/Q (a)N L/Q (b) = N L/Q (x). Since N L/Q (x) is prime, either N L/Q (a) = ±1 or N L/Q (b) = ±1. So a or b is a unit.

. . Discriminant

The nal invariant we attach to a number eld is its discriminant. In some sense it encodes the size of its ring of integers. It is based on the following observation:

Proposition . . . Let L/Q be a number eld. Then the L-bilinear form L × L → Q de ned by (x, y) → tr L/Q (xy) is non-degenerate. Equivalently, if (α 1 , . . . , α n ) is a basis of L, then the Gram matrix ∆(α 1 , . . . , α n ) = det tr L/Q (α i α j ) 1≤i,j≤n .
has non-zero determinant.

Proof. Let σ 1 , . . . , σ n : L → C be the n distinct L-linear eld embeddings to C. De ne the embedding matrix

S = (σ i (α j )) i,j=1,...,n =     σ 1 (α 1 ) • • • σ 1 (α n ) . . . . . . . . . σ n (α 1 ) • • • σ n (α n ).     ,
so that a simple computation yields

S T S = n ∑ k=1 σ k (α i )σ k (α j ) i,j = n ∑ k=1 σ k (α i α j ) i,j = tr L/Q (α i α j ) i,j = ∆(α 1 , . . . , α n ), since σ k is a eld homomorphism. Then det ∆(α 1 , . . . , α n ) = (det S) 2 . By the primitive element theorem, write L = Q(θ) such that 1, θ, . . . , θ n-1 is a basis for L over Q, with [L : Q] = n. Now S becomes S =     1 σ 1 (θ) • • • σ 1 (θ) n-1 . . . . . . . . . . . . 1 σ n (θ) • • • σ n (θ) n-1     .
This is a Vandermonde matrix, and so

∆(1, θ, . . . , θ n-1 ) = (det S) 2 = ∏ i<j (σ i (θ) -σ j (θ)) 2 .
Since the eld extension is separable, and hence σ i = σ j for all i, j, this implies σ i (θ) = σ j (θ), since θ generates the eld. So the product is non-zero and as such the determinant is non-zero. The base change formula ensures the result for any other basis.

The non degeneracy of this form now allows to prove that the ring of integers of a number eld have a Z-basis.

Proof of Theorem . . . Let α 1 , . . . , α n be any basis of L over Q. Then there are some n i ∈ Z such that n i α i ∈ O L (for instance by taking n i to be a common denominator of coe cients of the minimal polynomial of α i ). So without loss of generality, we can suppose that α 1 , . . . , α n ∈ O L , and are a basis of L over Q. Since α i are integral, so are α i α j , and so all of these products have integer trace. Hence ∆(α 1 , . . . , α n ), being the determinant of a matrix with integer entries, is an integer. Now choose a Q-basis α 1 , . . . , α n ∈ O L such that ∆(α 1 , . . . , α n ) ∈ Z \ {0} has minimal absolute value. We now show that these are an integral basis, i.e. a basis of O L as Z-module.

Let x ∈ O L , and write x = ∑ n i=1 λ i α i for some λ i ∈ Q. These λ i are necessarily unique since α 1 , . . . , α n is a basis.

Suppose some λ i ∈ Z. without loss of generality, we can say that λ 1 ∈ Z. We write

λ 1 = n 1 + ε 1 , for n 1 ∈ Z and 0 < ε 1 < 1. Then α 1 = x -n 1 α 1 = ε 1 α 1 + λ 2 α 2 + • • • + λ n α n ∈ O L .
So α 1 , α 2 , . . . , α n is still a basis for L/Q, and are still in O L . But then

∆(α 1 , . . . , α n ) = ε 2 1 • ∆(α 1 , . . . , α n ) < ∆(α 1 , . . . , α n ),
which contradicts the minimality assumption. So we must have λ i ∈ Z for all Z, ensuring that α 1 , . . . , α n is s an integral basis for O L . Now if α 1 , . . . , α n is another integral basis of L over Q, then there is some

U ∈ Gl n (Z) such that gα i = α i . Since det(U) is invertible in Z, it must be 1 or -1, and hence det ∆(α 1 , . . . , α n ) = det(U) 2 ∆(α 1 , . . . , α n ) = ∆(α 1 , . . . , α n )
and is independent of the choice of integral basis.

De nition . . (Discriminant). The discriminant ∆ L of a number eld L is de ned as

∆ L = ∆(α 1 , . . . , α n )
for any integral basis α 1 , . . . , α n .

. Again, let L/Q be a number eld. It turns out that in general, the integral ring O L is not as simple as the rational integers Z. In particular, the unique factorization property fails in general.

Example. Let L = Q( √ -5). Then O L = Z[ √ -5].
Then we nd by calculation:

3 • 7 = (1 + 2 √ -5)(1 -2 √ -5).
Note that it is still possible to factor any element into a product of irreducibles, this fact being proved trivially by induction on the norm. To x the lack of unique factorization, we instead look at ideals in O L . Recall from Paragraph . . . that ideals have a natural multiplicative structure. We now prove that the unique factorization property is actually veri ed for ideals, that is to say, in the light of Paragraph . . . : Theorem . . . Let L/Q be a number eld, and O L be its ring of integers. Then O L is a Dedekind domain.

Remark. Kummer rst published the failure of unique factorization in cyclotomic elds around . While it is widely believed that Kummer was led to his ideal complex numbers by his interest in Fermat's Last Theorem, it occurs that he was actually more interested in higher reciprocity laws, which he considered to be "the principal subject and the pinnacle of contemporary number theory". In modern language, a Kummer's "ideal number" is an algebraic integer which represents an ideal in the ring of integers of a number eld (in the light of the now-called class eld theory, every ideal is therefore represented by an ideal number in a certain eld extension). The adjective ideal was coined to refer to the good arithmetical properties of these numbers, such as their unique factorization. These ideas have been re ned to the general case by Kronecker and Dedekind, independently, during the next forty years, leading to major contributions, such as the modern notions of ideals, modules and divisors amongst others.

To prove this maximality property of prime ideals, we need the following lemma:

Lemma . . . Let a ⊆ O L be a non-zero ideal. Then a ∩ Z = {0} and O L a is nite. Proof. Let α ∈ a and α = 0. Let χ α = x m + a m-1 x m-1 + • • • + a 0 ∈ Z[X]
be its minimal polynomial. We know a 0 = 0 as χ α is irreducible. Since χ α (α) = 0, we have

a 0 = -α(α m-1 + a m-1 α m-2 + • • • + a 2 α + a 1 ).
We know that α ∈ a ⊆ O L by assumption, and as such that the sum α

m-1 + a m-1 α m-2 + • • • + a 2 α + a 1 is in O L . As such the whole right hand side is in a. But a 0 ∈ Z and therefore a 0 ∈ Z ∩ a.
Thus, a 0 ⊆ a, inducing a surjection

O L a 0 -→ O L a .
Hence, it su ces to show that O L / a 0 is nite. Remark that for d ∈ Z, we have that:

O L d = Z n dZ n = Z dZ n ,
which is of course nite.

Proof of Theorem . . .

Integrality: Obvious, since O L ⊆ L.
Notherian: We showed that as an abelian group,

O L ∼ = Z n . So if a ⊆ O L is an ideal, then a ⊆ Z n as a subgroup.
So it is nitely generated as an abelian group, and hence nitely generated as an ideal.

Integrally closed: note that Frac O L = L. If x ∈ L is integral over O L , as O L is integral over Z, x is also integral over Z. So x ∈ O L , by de nition of O L .
Maximality of prime ideals: Let p be a prime ideal. Then O L /p is an integral domain. Since Lemma . . says O L /p is nite, we deduce that O L /p is a eld . So p is maximal by de nition. .

. . De nition and multiplicativity

De nition . . (Norm of ideals). Let a ⊆ O L be an ideal. We de ne

|N L/Q (a)| = O L a ∈ N.
We already proved that |O L /a| is nite, so that this de nition actually makes sense.

Classically we know that a nite integral domain must be a eld. Indeed Let R be a nite integral domain and x ∈ R with x = 0. Then the map m x : y → xy is injective, as having a trivial kernel since R is an integral domain. So it is a bijection by niteness. And as such there exists some y ∈ R such that xy = 1.

Remark. It is clear that

N L/Q (a) = 1 if and only if a = O L (i.e. a is a "unit"). Example. Let d ∈ Z. Then since O L ∼ = Z n , we have dO L ∼ = (dZ) n . So we have N L/Q ( d ) = |Z n /(dZ) n | = |Z/dZ| n = d n .
Interestingly, the norm of any ideal is actually contained in the ideal itself:

Proposition . . . For any ideal a, we have

N L/Q (a) ∈ a ∩ Z. Proof. It su ces to show that N L/Q (a) ∈ a.
Viewing O L /a as an additive group, the order of 1 is a factor of

N L/Q (a). So N L/Q (a) = N L/Q (a) • 1 = 0 ∈ O L /a. Hence N L/Q (a) ∈ a.
We now turn to the multiplicativity of the norm form:

Proposition . . . Let a, b ⊆ O L be ideals. Then N L/Q (ab) = N L/Q (a)N L/Q (b).
Proof. By unique factorization theorem, it is enough to show that

N L/Q (p a 1 1 • • • p a r r ) = N L/Q (p 1 ) a 1 • • • N L/Q (p r ) a r .
By the Chinese remainder theorem, we have

O L p a 1 1 • • • p a r r ∼ = O L p a 1 1 × • • • × O L p a r r
where p 1 , . . . , p r are distinct prime ideals. But now we have:

O L p r = O L p × p p 2 × • • • × p r-1 p r = O L p r ,
since p k /p k+1 is a 1-dimensional vector space over the eld O L /p.

. . Relation to the discriminant

We now show that the norm is actually related to the discriminant, introduced in Section . . . Recall that the discriminant is de ned by:

∆(α 1 , . . . , α n ) = det(tr L/Q (α i α j )) = det(σ i (α j )) 2 . Proposition . . . Let a ⊆ O L be an ideal, n = [L : Q]. Then . There exists α 1 , . . . , α n ∈ a such that a = n ∑ i=1 r i α i : r i ∈ Z = n i=1 α i Z,
and α 1 , . . . , α n are a basis of L over Q.

. For any such α 1 , . . . , α n ,

∆(α 1 , . . . , α n ) = N L/Q (a) 2 ∆ L .
Remark. The rst point of Proposition . . states that any ideal a of O L has a natural structure of free Z-module of rank n. Since the ring of integers is a Dedekind domain, we also know from Section . that it also has a structure of projective O L -module since it is generated by two elements.

To prove Proposition . . , we need the following classical lemma on abelian groups:

Lemma . . . Let M be a Z-module, and suppose M ⊆ Z n is a subgroup of Z n . Then M ∼ = Z r for some 0 ≤ r ≤ n. Moreover, if r = n, then we can choose a basis v 1 , . . . , v n of M such that the change of basis matrix A = (a ij ) ∈ Z n×n is upper triangular, where v j = n ∑ i=1 a ij e i ,
for e 1 , . . . , e n is the standard basis of Z n and as such we have:

Z n M = |a 11 a 22 • • • a nn | = | det A|. Proof of Proposition . . . Let d ∈ a ∩ Z, where d = N L/Q (a). Then dO L ⊆ a ⊆ O L .
As abelian groups, after picking an integral basis α 1 , . . . , α n of O L , we have

Z n ∼ = dZ n ⊆ a ⊆ Z n .
So a ∼ = Z n . Then the lemma gives us a basis α 1 , . . . , α n of a as a Z-module.

As a Q-module, since the α i are obtained from linear combinations of α i , by basic linear algebra, α 1 , • • • , α n is also a basis of L over Q.

Moreover, we know that we have

∆(α 1 , . . . , α n ) = det(A) 2 ∆(α 1 , • • • , α n ). Since det(A) 2 = O L a 2 = N L/Q (a) and ∆ L = ∆(α 1 , . . . , α n ) by de ni- tion, the second part follows.
At this point we have two di erent norms on elements. Given α ∈ O L , we can take the norm of the principal ideal generated by the element α: N L/Q ( α ), or consider the algebraic N L/Q (α). They are actually equal, up to sign:

Lemma . . . If α ∈ O L , then N L/Q ( α ) = |N L/Q (α)|.
Proof. Let α 1 , . . . , α n be an integral basis of O L . Then α • α 1 , . . . , α • α n is obviously an integral basis of α . So by Proposition . . we nd:

∆(αα 1 , . . . , αα n ) = N L/Q ( α ) 2 ∆ L .
But by de nition of ∆ we have:

∆(αα 1 , . . . , αα n ) = det (σ i (αα j )) 1≤i,j≤n 2 = det (σ i (α)σ i (α j )) 1≤i,j≤n 2 = n ∏ i=1 σ i (α) 2 ∆(α 1 , • • • , α n ) = N L/Q (α) 2 ∆ L . So N L/Q (α) 2 = N L/Q ( α ) 2 .
But N L/Q ( α ) is positive. So the result follows.

. . Computation with ideals

Since by the results of Section . an ideal a is a projective module of rank over O L , we can represent it by a projective basis, that is a pair of elements in O L generating a. This is the two-elements representation. As it is also a free Z-module of rank [L : Q] we can represent a by a Z-generating family in a given basis of O L , that is by a matrix with integral coe cients. This is the matrix representation of a.

. . . . Changing the representation. Given one of the two representations evoked above, we can switch to the other. Let a an ideal of the number eld L. Suppose that O L is given by the Z-basis ω 1 , . . . , ω n . Then if a is generated by elements a and b, it is also spanned by aω 1 , . . . , aω n , bω 1 , . . . , aω n as a Z-module. It then su ces to compute the of the corresponding matrix to recover the coe cients of a basis of a in ω 1 , . . . , ω n . Getting a two-element representation is more complicated, as we need to nd uniformizers of primes, as implicitly shown in the proof of Proposition . . . A simple randomized algorithm is nonetheless practical: given a a generator of a ∩ Z, we sample uniformly at random b ∈ aO L and check if b suits, by checking of the of (bO L | aId) is equal to the of a. The success probability of this procedure is at least p) . This probability can be made independent of a with the techniques of Belabas [ ].

∏ p|a 1 -1 N L/Q (
The precise introduction of the Hermite Normal Form (

) is done in Section . . . In short, there exists a polynomial time algorithm allowing to compute this form, which in particular allows to reduce nd a basis of a free Z-module from an arbitrary generating family. . . . . Ideal arithmetic with matrices. Given a, b two ideals, represented respectively as matrices A and B of integers, the de nition of sum and multiplication of ideals yield a simple expression for the generating families of these ideals. Indeed, it is clear that the families of vectors

{A 1 , . . . , A n , B 1 , . . . , B n }, {A i • B j | 1 ≤ i, j ≤ n}
generates a + b and ab. Then a reduction reduces such families to basis. This implies that performing an addition of ideals can be done by computing a Hermite normal form from a matrix of size n × 2n and the multiplication from a computation of of size n × n 2 . The inversion of a boils down to the computation of the di erent ideal, that is the dual Z-module of O L :

d(L) = {x ∈ L, tr L/Q (xO L ) ⊂ Z}.
Indeed, remark that a Z-basis of a -1 d(L) -1 is given by (A T T) -1 , where T is the matrix tr(ω i ω j ) i,j . Therefore to compute a basis of a -1 , we start by computing T -1 , a basis of the inverse of the di erent, then we compute a basis, denoted by N of ad(L) -1 using the above-explained method from A and T -1 . And so the columns of (N T T) -1 are a basis of (ad(L) -1 ) -1 d(L) -1 = a -1 . The cost of the inversion is then a constant number of multiplications of ideals. . . . . Going further with two-elements representation. It would be interesting to be able to use the same approach for the two elements representation, since the set of sums, resp. of products, of the generators is only , instead of n 2 . But then, we need to be able to reduce e ciently a generating family into a basis of the corresponding ideal. Using, for instance, the generalized algorithm over number elds of [ ] would actually be slower than the previous approach. We address this particular question through the prism of lattice reduction in Chapter .

The representation with two elements allows an easy inversion, as we can exploit the relation:

a ∩ b = ab(a + b) -1 ,
valid for any ideals a, b of the number eld L. Indeed suppose that we want to invert an ideal c generated by α, β ∈ L, then we have:

(αO L ∩ βO L ) = αβO L (αO L + βO L ) -1 = αβc -1 ,
so that c -1 is the intersection of the ideals generated by α -1 and β -1

.

In this nal section we recall basic facts on cyclotomic elds. These particular number elds are very interesting since they are well understood and allow very explicit computations of invariants. For instance, the discriminant of a cyclotomic eld has a very simple shape and its ring of integers is very convenient to describe. For a very complete account on this subject, we invite the reader to refer to the monograph of Washington [ ].

De nition . . (Cyclotomic extension).

The n-th cyclotomic extension of Q, is the splitting eld of the polynomial X n -1. We call n the conductor of the extension.

Let n ≥ 2 and let L be the n-th cyclotomic extension of Q. The set of roots Root X n -1 (L) is a subgroup of multiplicative group L * = L \ {0}. Since this is a nite subgroup of L * , it is cyclic. But remark that the derivative (X n -1) = nX n-1 and this polynomial can not have a common root with X n -1. So X n -1 has no repeated roots: it has n distinct roots. So as a group,

Root X n -1 (L) ∼ = Z nZ .
In particular, this group has at least one element ζ n of order n.

De nition . . (Primitive root of unity).

The n-th primitive root of unity is an element of order n in Root X n -1 (L).

These elements correspond to the elements of the multiplicative group of units in Z nZ , written Z nZ × . Thus each root of unity can be reached from the primitive roots, meaning that we can de ne the cyclotomic extension with a polynomial of smaller degree, namely:

Theorem . . . For each d ∈ N, there exists a polynomial φ d ∈ Z[X] satis- fying:
. For each n ∈ N, we have

X n -1 = ∏ d|n φ d . . Root φ d (L) = {d -th primitive roots of unity}.
It is called the d-th cyclotomic polynomial.

Proof. Let us construct the cyclotomic polynomials by induction. When n = 1, let φ 1 = X -1. Then (i) and (ii) hold in this case, trivially. Assume now that (i) and (ii) hold for every n < n. To ful ll (i) let us de ne:

f = ∏ d|n,d<n φ d .
A nite recurrence on this product with the induction hypothesis ensures that,

f ∈ Z[X]. Moreover, if d | n and d < n, then φ d | (X n -1) because (X d -1) | (X n -1). To eventually prove that f | X n -1, it su ces to show that φ d and φ d have no common roots for distinct d, d | n (and d < n).
Indeed, φ d and φ d have no common roots because by hypothesis:

Root φ d (L) = {dth primitive roots of unity}, Root φ d (L) = {d th primitive roots of unity},
and these two sets are disjoint (or else the roots would not be primitive by de nition). Therefore φ d and φ d do not have a common irreducible factor. Hence f | X n -1. So we can write

X n -1 = f φ n , where φ n ∈ Q[X].
Since f is monic, φ n has integer coe cients. And as such

φ n ∈ Z[X].
To prove the second part, note that by induction hypothesis,

Root f (L) = {non-primitive nth roots of unit},
since all nth roots of unity are dth primitive roots of unity for some smaller d.

Since f φ n = X n -1, φ n contains the remaining, primitive nth roots of unit. Since X n -1 has no repeated roots, we know that φ n does not contain any extra roots. So

Root φ n (L) = {nth primitive roots of unity}.
By counting the primitive roots, we have directly that for every n ∈ N, deg φ n = φ(n), where φ(n) is Euler totient function. Therefore we have:

Proposition . . . Let Q[ζ n ] the n-th cyclotomic extension, then [Q[ζ n ] : Q] = ϕ(n).
The ring of integers of cyclotomic elds is very easy to describe, as the power base of the eld 1, ζ n , . . . , ζ n-1 n is actually an integral basis:

Proposition . . . Let Q[ζ n ] the n-th cyclotomic extension, then O Q[ζ n ] = Z[ζ n ].
This allows to compute the discriminant of cyclotomic elds: Theorem . . . Let n be an non negative integer, then: The discriminant of

Q[ζ n ] is given by ∆ n = (-1) ϕ(n)/2 n ϕ(n) ∏ p|n p ϕ(n)/(p-1)
As this computation is quite lengthy and not enlightening for the rest of this manuscript, we let the reader refer to the monograph of Washington [ ] for a complete proof of Proposition . . and Theorem . . .

. . On the maximal real sub eld of a cyclotomic

Given a number eld L, we can consider the set of totally real sub elds, that is sub elds with only real Archimedean embeddings. Since the compositum of totally real elds is also totally real, there exists a unique maximal element for the inclusion called the maximal real sub eld.

Let us suppose that L = Q[ζ] is a cyclotomic eld. We now prove that the maximal real sub eld of L is easy to describe:

Lemma . . . The sub eld L + = Q ζ + ζ -1 is the maximal real sub eld of L = Q[ζ].
Proof. Denote by f the conductor of L. Then remark that

ζ + ζ -1 = 2 cos 2π f ∈ R, so that L + is totally real. Hence, [L + : L] > 1. Now set f (X) = X 2 -(ζ + ζ -1 )X + 1 = (X -ζ)(X -ζ -1), so that f vanishes at ζ. Thus [L + : L] ≤ 2,
and we can conclude that [L + : L] = 2, concluding the proof.

We have seen that the ring of integers of the cyclotomic eld of conductor f is easily described as being Z[ζ f ]. The same description works for its maximal real sub eld.

Proposition . . . The ring of integer

O L + of the maximal real sub eld L + = Q ζ + ζ -1 of the cyclotomic eld L = Q[ζ] satifsies: O L + = Z[ζ -1 + ζ]. Proof. The inclusion Z[ζ -1 + ζ] ⊆ O L + is clear. Conversely, let us take u ∈ O L + = O L ∩ L + . Then we can decompose u in the power Z-basis of O L and in the Q-basis of the (ζ i + ζ -i ) i : u = n-1 ∑ i=0 x i ζ i u = (n-2)/2 ∑ i=0 y i (ζ i + ζ -i ), so that 0 = ∑ (n-2)/2 i=0 (x i -y i )ζ i + ∑ n-1 i=(n-2)/2+1 (x i -y n-1-i )ζ i .
We use the Q-freeness of the power-basis to conclude that the y i are all integers.

G E O M E T R Y O F N U M B E R S
This chapter presents the basic notions of classical and algorithmic geometry of numbers used in the subsequent parts of this manuscript. After recalling the de nition of lattices and related geometric invariants, we move on to the reduction theory of Euclidean lattices with an emphasis on the algorithmic side of this theory, namely by studying the algorithm and its generalization such as and .

.

. . Euclidean spaces . . . . Bilinear forms. In all of the following, we consider a nite-dimensional real vector space V. Its dual space, that is the vector space of linear forms over V, is denoted by V ∨ .

De nition . . (Bilinear form). A (real) bilinear form over

V is an applica- tion b : V × V → R so that: . For all x ∈ V, b(x, •) : y → b(x, y) is a linear map. . For all y ∈ V, b(•, y) : x → b(x, y) is a linear map.
A bilinear form b over V is said to be:

Symmetric: when ∀x, y ∈ V 2 , b(y, x) = b(x, y), Positive: when ∀x ∈ V, b(x, x) ≥ 0, De nite: when ∀x ∈ V, b(x, x) = 0 ⇔ b = 0.
A form satisfying these last three conditions is called an inner product over V.

Example.

•

On R d , the form b[(x 1 , . . . , x d ), (y 1 , . . . , y d )] = ∑ d i=1 x i y i is an inner product, called the canonical inner product of R d . • Let f , g ∈ V ∨ two linear forms, the product form b : (x, y) → f (x)g(y)
is clearly bilinear and symmetric, but not de nite.

. .

Orthogonality relations

In this section V is a xed real vector space of dimension d, and b a quadratic form acting on it.

De nition . . . Two vectors x, y ∈ V are called b-orthogonal (or simply orthogonal when there is no ambiguity on the form b considered) when b(x, y) = 0.

This de nition extends naturally to any couple of subsets of V: A, B ⊂ V are orthogonal when any pair of vectors (x, y) ∈ A × B is orthogonal.

De nition . . . Let A ⊂ V. The (b-)orthogonal of A is the subspace of V: A ⊥ = x ∈ V ∀a ∈ A, b(x, a) = 0 .
It is the largest (for the inclusion relation) space of V which is orthogonal to A.

. . . . Euclidean space and its inner product.

De nition . . (Euclidean space

). An Euclidean space is a pair (V, • ) consisting of a nite dimensional real vector space V and an Euclidean norm

• : V → R + , that is a norm satisfying the parallelogram identity: v + w 2 = 2 v 2 +2 w 2 -v -w 2 for every v, w ∈ V.
Given a Euclidean space (V, • ), we denote by

• , • : V × V -→ R x, y -→ x+y 2 -x-y 2 2
, its corresponding bilinear symmetric form. It is clear that this form is an inner product.

. . . . Quotient of Euclidean spaces. Let (V, • ) be an Euclidean space, and let V be a subspace of V. Then the restriction of • to V endows V with an Euclidean structure. The quotient space V V can be endowed with a canonical Euclidean structure by de ning:

v + V = inf v ∈V v -v ,
for all v ∈ V. Geometrically, the vector v minimizing the norm vv is the orthogonal projection of v onto V . Indeed, denoting by p the latter projection, we have for any v ∈ V :

v -v 2 = v -p + (p -v ) 2 = v -p 2 + p -v 2 +2 v -p, p -v .
Recall that a norm • is a mapping from V to [0, +∞[, which satis es the three following properties:

Absolutly scalability: ∀x ∈ V, ∀α ∈ R, αv = |α| v , Separation: ∀x ∈ V \ {0}, x > 0, Triangular inequality: ∀x, y ∈ V, x + y ≤ x + y . But v -p ∈ V ⊥ by de nition of p, so that v -p, p -v = 0. Hence: v -v 2 = v -p 2 + p -v 2 ≥ v -p 2 .
This quotient norm is well-de ned and Euclidean since we can check that it derives from the restriction of the inner product of V on V ⊥ , as:

v + V , w + V = π V ⊥ (v), π V ⊥ (w) .

. . Lattices

De nition . . (Lattice). A (real) lattice Λ is a nitely generated free Zmodule, endowed with a Euclidean norm on . on the real vector space Λ R = Λ ⊗ Z R.

From now on, Λ ⊗ Z 1 is simply identi ed with Λ. By de nition of a nitely-generated free module, there exists a nite family (v 1 , . . . ,

v d ) ∈ Λ d such that Λ = d i=1 v i Z, called a basis of Λ.
Every basis has the same number of elements rk Λ, called the rank of the lattice.

Lemma . . . The lattice Λ is discrete for the topology induced by • Λ in the space Λ R .

Proof. Let (Λ, • Λ ) be a lattice of rank d; its underlying Z-module Λ being free, we have Λ ∼ = Z d , so that:

Λ R ∼ = Z d ⊗ Z R ∼ = ⊕ d i=1 Z ⊗ Z R ∼ = ⊕ d i=1 (Z ⊗ Z R) ∼ = R d .
Fix now a basis (v i ) 1≤i≤d of Λ; the family (v i ⊗ 1) 1≤i≤d is then a spanning set of cardinality d in a space of dimension d: it is a basis of Λ R . By the group structure of Λ it su ces to prove that the vector 0 Λ ⊗ 1 is an isolated point of Λ ⊗ 1 to conclude. Let then (x k ) k∈N be any sequence of Λ ⊗ 1 converging towards 0 Λ ⊗ 1. Then, for each k ∈ N, we have by decomposing:

x k = d ∑ i=1 x (i) k (v i ⊗ 1), which makes arise d sequences x (i) k k∈N
of integers. Since (v i ⊗ 1) 1≤i≤d is a basis, by characterization of the convergence in normed spaces, each of them converges towards and is therefore stationary. As a consequence, (x k ) k∈N is also stationary, entailing that 0 Λ ⊗ 1 is isolated.

Conversely, it appears that this discreteness property characterize a lattice: any discrete additive subgroup of an Euclidean vector space is also a lattice, in the sense of de nition De nition . . . Lemma . . . Let V an Euclidean vector space, and Λ be a discrete subgroup of V. Then, Λ is a free Z-module of nite rank.

Proof. Since we can replace V by the vector space spanned by Λ, we can suppose without loss of generality that Λ spans V itself. Let v 1 , . . . , v k be a family of vectors of Λ which is R-free, of maximal cardinality. Hence, k = dim(V) by our assumption. Then,

Λ = v 1 Z ⊕ • • • ⊕ v k Z is
a subgroup of Λ by freeness hypothesis. Let us take any element x ∈ Λ, then, since we can identify the quotient Λ ⊗ R Λ ⊗ R with the parallelotope P spanned by v 1 , . . . v n , we can write x as x + x Λ for x ∈ P and x Λ ∈ Λ . Thus x ∈ Λ. But as Λ is discrete, so is the bounded set Λ ∩ P, which is therefore nite. As such, the quotient Λ Λ is nite, meaning that the index = [Λ : Λ ] is also nite. Consequently, Λ is contained in 1 Λ and then is also a free Z-module of rank n itself.

Lemma . . and Lemma . . actually prove that an alternate de nition of a lattice can be given, when know beforehand the ambient space: De nition . . (Lattice). Let (V, • ) be an Euclidean vector space. A (real) lattice Λ is a subgroup of (V, +) which is discrete for the topology induced by

• .

We may omit to write down the norm to refer to a lattice Λ when any ambiguity is removed by the context. However, as the following example shows, it might be crucial to keep track of it:

Example. Let us consider the ring of integer of the number eld

Q[ √ 2], which is Z[ √ 2].
A simple lattice structure can be given on this rank module by setting

1 2 α = 1, √ 2 2 α = 2 and 1, √ 2 = α for α = √ 2, making this module discrete in Z[ √ 2] ⊗ Z R ∼ = R 2 . However, we shall point out that we can embed naturally Z[ √ 2] into R as √ 2 ∈ R. The induced topology on Z[
√ 2] makes it dense in R, as √ 2 is an irrational number. We can not then refer to Z[ √ 2] as a lattice, without specifying the corresponding inner product.

. . . . Sublattices, quotient lattice. Let (Λ, • ) be a lattice, and let Λ be a submodule of Λ. Then the restriction of • to Λ endows Λ with a lattice structure. The pair (Λ , • ) is called a sublattice of Λ. Λ is a pure sublattice if the quotient Λ Λ is torsion-free. In this case, it can be endowed with a canonical lattice structure by seeing it embedded in the quotient space Λ R Λ R , that is:

v + Λ = inf v ∈Λ R v -v .
This de nition makes sense since as Λ Λ is torsion-free over Z, it is free.

+ v 2 = v 2 Λ + v 2 Λ .
The tensor product is also compatible with the lattice structure Λ ⊗ Λ when setting:

v ⊗ v , w ⊗ w V⊗V = v, w V • v , w V ,
on pure tensors and extending it by bilinearity.

.

v 1 v 2 π v ⊥ 1 (v 2 ) Figure : Two dimensional lattice Λ generated by v 1 , v 2 ∈ R 2 ,
in purple, and the quotient lattice identi ed with

π v ⊥ 1 (Λ) in blue. It is generated by π v ⊥ 1 (v 2 ).
. . . . Orthogonality and algebraic duality. The dual or polar lattice Λ ∨ of a lattice Λ is the set Hom(Λ, Z) of Z-module homomorphisms from Λ to Z with the pointwise module structure, endowed with the dual norm de ned by:

ϕ = inf v∈Λ\{0} ϕ(v) v ,
for any ϕ ∈ Λ ∨ . Equivalently the dual lattice can be de ned as the module {x ∈ Λ R | ∀v ∈ Λ, x, v ∈ Z} endowed directly with • Λ , by representation of linear forms over the nite dimensional space Λ R . Let Λ ⊂ Λ be a pure sublattice. De ne its orthogonal in Λ R to be the sublattice Λ

⊥ = {x ∈ Λ ∨ : x, Λ = 0} of Λ ∨ .
By the de nition of the Euclidean structure on the quotient, it is isometric to Λ Λ ∨ , so that we can identify the two lattices.

. . Numerical invariants attached to a lattice

In the following of this section, let us x Λ a lattice of rank d.

. . . . Volume and slope. A classical numerical invariant attached to Λ is its covolume covol(Λ) de ned as the volume of a cell P (B), also called a fundamental parallelotope, for any basis B = (v 1 , . . . , v d ), where:

P (B) = d ∑ i=1 x i v i | 0 ≤ x i < 1
is the parallelotope spanned by the vectors of B in Λ R . Figure depicts the situation for a rank-two lattice. This covolume is independent of the choice The volume is taken for the Lebesgue measure on Λ R normalized so that the Gaussian kernel of the basis as being the norm of a basis of the extremal exterior power module rk Λ Λ, of rank . Hence, it can e ectively be computed from the inner products of the vectors of B:

x → e -x 2 2 integrates over Λ R to √ 2π d .
covol(Λ) = det v i , v j 1≤i≤j≤d 1 2 , for a basis (v 1 , . . . , v d ) of Λ.
The covolume gives a measure of the density of the lattice in the sense that 1 covol Λ is the average number of points of Λ per unit volume of Λ R , and this intuition is formalized by the following lemma: Lemma . . . Let Λ a rank-d lattice. Then we have:

1 covol Λ = lim r→∞ Λ ∩ -r 2 , r 2
∩ -r 2 , r 2 d = v ∈ Λ|(P (B) + v) ∩ -r 2 , r 2 d + o r d .
But by denition of the volume we have:

v ∈ Λ|(P (B) + v) ∩ - r 2 , r 2 d = Vol -r 2 , r 2 d Vol(P (B)) + o r d ,
nishing the proof.

Conversely, and this time not asymptotically, we can prove that a symmetric set which is su ciently large always contains a lattice point. This is Minkowski's rst theorem: Theorem . . . For any lattice Λ of rank d, and any symmetric convex body K ⊂ Λ R with Vol(K/2) > covol(Λ), then K contains a non-zero lattice vector, where

K/2 = {v/2 | v ∈ K}.
Proof. Let us suppose that there exists two lattice vectors v, v ∈ Λ such that the bodies K/2 + v and K/2 + v have non-empty intersection and let y be in this intersection. Then vv lies in the intersection K ∩ Λ. Indeed, yv and yv lies in K/2 by construction and so v-v 2 = y-v 2 + y-v 2 ∈ K/2 by convexity. To conclude the proof let us suppose that there exists no such pair v, v . Then this means that for any r > 0: S(r) = v∈Λ∩[-r/2,r/2] d (K/2 + v) is a disjoint union so that we have:

Vol(S(r)) = Λ ∩ [-r/2, r/2] d • Vol(K/2) > Λ ∩ [-r/2, r/2] d • covol Λ by hypothesis. But clearly Vol(S(r)) ≤ r d + o r d since S(r) ⊂ K/2 + [-r/2, r/2] d
. This asymptotically contradicts Lemma . . .

De nition . . (Degree).

Let Λ be a lattice. Its degree is de ned the logarithm of its covolume deg Λ = log covol Λ.

Remark. In the previous de nition, we deliberately take the degree to be the opposite of the regular Arakelov degree of a vector bundle, as it eases some computations.

The degree is compatible with the monoidal constructions over lattices. Namely:

Lemma . . . Let Λ, Λ two lattices. Then: . deg(Λ ⊗ Z Λ ) = rk Λ deg Λ + rk Λ deg Λ . deg(Λ ⊕ Λ ) = deg Λ + deg Λ .
Proof. Please refer to Appendix .

And as such we have the following relation with the covolume of the lattice and of its dual:

Lemma . . . Let Λ a lattice then: deg Λ = -deg Λ ∨ .
Proof. Please refer to Appendix . . . . . Successive minima. We have seen that the covolume gives a quanti cation of the size of a given lattice, or equivalently of its density. To be more precise on the actual length of the vectors in the lattice, we can construct by discreteness of Λ a sequence of numerical invariants encoding the norm of small vectors of the lattice:

λ i (Λ) = min{λ > 0 | ∃ v 1 , . . . , v i ∈ Λ ∩ B 0 (λ), rk(v 1 , . . . v i ) = i},
where B 0 (λ) is the closed ball of radius λ, centered on 0 in Λ R . These are the successive minima of the lattice Λ.

A bound on the length of the rst vector is given by the normalized volume of the lattice up to a factor √ d. It follows directly from Minkowski's rst theorem when taking a d-ball for body K:

Corollary . . (Minkowski's rst theorem for λ 1 ). For any lattice Λ of rank d,

λ 1 (Λ) ≤ √ d(covol Λ) 1 d .
The right-hand side of this equation only depends on the dimension and of the covolume of Λ. Therefore, we can wonder what is the best upperbound γ d , such that for all lattice Λ of rank d there exists non-zero lattice vector such that we have v ≤ γ d (covol Λ) 1 d . This corresponds to evaluate the constant:

√ γ d = max Λ λ 1 (Λ) (covol Λ) 1 d
, where the minimum is taken on the set of real lattices of rank d. This quantity is called the "d-dimensional Hermite's constant". Of course, Minkowski's theorem gives an upper bound on this constant. Known re nement gives the estimate:

2Γ n 2 + 1 ζ(d) π n/2 r n 2 d ≤ γ d ≤ 1.744d 2πe + o(d).
by using Minkowski-Hlawka theorem [ ] for the lower bound and analytical arguments for the upper bound (see for instance [ ]), with Γ and ζ being respectively the classical Gamma and Zeta function.

Minkowski's rst theorem considers the shortest nonzero vector, i.e. the rst successive minimum λ 1 . A strengthening of the bound is given by what is known as Minkowski's second theorem. Instead of considering the rst minimum, this bound considers the geometric mean of all λ i (which is at least λ d 1 ). Theorem . . (Minkowski's second theorem). The successive minima satisfy

λ 1 λ 2 • • • λ d ≤ γ d 2 d covol(Λ). Proof. See for instance [ ].
Now that we proved that such small vectors exist in the lattice, we can wonder what is the algorithmic complexity of exhibiting them, and more generally what is the computational cost of problems related to lattices.

. We present here some of the basic computational problems that appear naturally when dealing with lattices. For the moment we deliberately choose not to talk of the well-known problem, introduced in the eld of latticebased cryptography. We delay the introduction of this problem to the nal part of the manuscript. For the rest of this section, as we are interested in complexity questions, we will consider rational lattices, that is lattices which can be described by a basis v 1 , . . . , v d ∈ Q n of R n . Without loss of generality we can multiply such lattices by the common denominator of all the coe cients so that we look at the properties of rank-d lattice represented by a matrix of Z n×d . . H is lower triangular, and any columns of zeros are located on the right:

. The leading coe cient (the rst nonzero entry from the top, also called the pivot) of a nonzero column is always strictly below the leading coefcient of the column before it.

. The pivot of any column is positive.

. The elements to the right of pivots are zero and elements to the left of pivots are non-negative and strictly smaller than the pivot.

Lemma . . . Any rational lattice Λ ⊂ R n admits a basis in Hermite normal form.

Proof. We will prove that we can transform any matrix A with integral coefcients into its form by sequences of elementary transformations. More precisely, we construct a sequence A k of matrices for k > 0, such that A 0 = A and

A k = H k 0 C k D k ,
with H k in Hermite normal form. The matrix A k+1 is constructed as follows.

Let d 1 , . . . , d n-k the coe cients of the rst row of D k , which can be supposed all non-negative by permuting and taking the opposite of the columns of D k . Then, by simulating the Euclidean algorithm between the coe cients d i and d j with elementary operations on the columns, we can suppose that all the d i are zero except one which is g, the of d 1 , . . . , d n-k . Up to permutation it can be put in the rst position of the row. It then remains to satisfy that the coe cients in the rst row of C k are non-negative and smaller than g. To do so, we substract c i /g times the (k + 1)-th column to the i-th column in B k , for each index i = 1, 2, . . . , k -1, which does not a ect the entries of H k .

The algorithm hinted in this proof, which is very close to the method used by Hermite, is however not polynomial in the size of the input. Indeed, the entries may grow exponentially during its execution. It was not until that an algorithm for computing the Hermite normal form that ran in strongly polynomial time was rst developed by Kannan et Bachem in [ ]. The fastest asymptotic variant for the computation of the is the one of [ ] of Storjohann and Labahn, whose running time is a O(m ω nB) for a m × n matrix whose coe cients represented with B bits.

An interesting consequence of the Hermite normal form is that the covolumes of the successive sublattices induced by the basis are necessarily increasing.

Lemma . . . Given (v 1 , . . . , v d ) a basis in Hermite normal form of a d- dimensional integer lattice Λ ⊂ Z d , then, for any 1 ≤ i < d, covol[v 1 Z ⊕ • • • ⊕ v i Z] ≤ covol[v 1 Z ⊕ • • • ⊕ v i+1 Z].
In particular, for any sublattice Λ generated by the m rst vectors v 1 , . . . , v m :

covol Λ ≤ covol Λ.
Proof. Let (v 1 , . . . , v d ) a basis in Hermite normal form of Λ ⊂ Z d . Then, since its matrix M in the canonical basis of Z d is triangular with non-negative coe cients, the sequence (m

1,1 , m 1,1 × m 2,2 , . . . , m 1,1 × • • • × m n,n ) of suc-
cessive products is increasing. It then su ces to remark that its k-th term corresponds to the determinant of the lattice generated by the k-th rst vectors v 1 , . . . , v k .

. . Shortest and closest vectors problems . . . . Exact problems and their hardness. We now de ne two classical complexity problems, related to the geometry of lattices: Problem ( ). Let Λ be a lattice, the shortest vector problem ( ) is de ned as the search problem:

Input: A basis of Λ. Output: A vector v ∈ Λ such that v = λ 1 (Λ).

Problem (

). Let Λ be a lattice, the closest vector problem ( ) is de ned as the search problem:

Input: A basis of Λ, a vector x ∈ Λ ⊗ Q. Output: A vector v ∈ Λ such that v -x is minimal over Λ.
Remark. We only describe the so-called search variants, since this is the problems we will be interested in and let their (equivalents under mild conditions) decisional counterparts aside.

The closest vector problem is NP-hard, which means that a polynomial time algorithm for this problem would give a polynomial time algorithm for any problem in the class NP . The reduction is pretty straightforward, as being a reduction to the subset-sum problem.

The shortest vector problem is only known to be NP-hard for randomized reductions (see for instance [ ]), which means that a polynomial time algorithm for this problem would give a randomized polynomial time algorithm for any problem in the class NP.

NP is the set of decision problems for which the problem instances, where the answer is "yes", have proofs veri able in polynomial time. . ' . . . . Approximate variants. Since these problems are hard, one can relax them into approximate versions: we do not seek exactly for the shortest or closest vector but for any vector inside a ball of given radius, expressed as a factor of the Hermite constant or of the covering radius.

Problem (γ-). Let Λ be a lattice, the approximate shortest vector problem with approximation factor γ (γ-) is de ned as the search problem:

Input: A basis of Λ. Output: A vector v ∈ Λ such that v ≤ γλ 1 (Λ).

Problem (γ-

). Let Λ be a lattice, the approximate closest vector problem with approximation factor γ (γ-) is de ned as the search problem:

Input: A basis of Λ, a vector x ∈ Λ ⊗ Q. Output: A vector v ∈ Λ such that v -x ≤ γ min v∈Λ v -x .
Of course, the hardness of the γ-problem depends on γ. Up to approximation factors of 2 1 2 (log d)for > 0, the problem is NP-hard, but

√

dhas been proved to be in NP∩co-NP, making it unlikely to be NP-hard. For high approximations factors, the situation is elucidated. For instance, we demonstrate at the end of this chapter, that the best known polynomial-time algorithm achieves an approximation factor of 2

O n log log n log n .
Remark. A similar problem to the γ-, sometimes used to compare lattice reduction algorithm,is the so-called γ-Hermite-problem, which is de ned as:

Problem (Hermite γ-). Let Λ be a lattice, the γ-Hermite shortest vector problem is de ned as:

Input: A basis of Λ. Output: A vector v ∈ Λ such that: v ≤ γ covol Λ 1 n .
As such, we can try to look for tractable approximations of solutions of these problems for arbitrary lattices. The systematic treatment of this question is the eld of algorithmic reduction theory, which aims at designing algorithms which compute a somewhat short basis of a lattice given as input. We choose to start this discussion by the simplest possible, but non-trivial, case: the reduction of rank-lattices.

. '

Let Λ be a two-dimensional lattice, given as a basis (u, v). Without loss of generality, we can suppose that u ≤ v , by rearranging the order of

λ u -λv 2 -u,v u 2 u 2 - u,v 2 u 2
Figure : Norm of the coset elements vλu these vectors. Now that the rst vector of the basis is the smallest among the two, we try to reduce the norm of the second one. Explicitly we want to nd the shortest vector v such that (u, v ) is a basis of Λ. This condition means that v and v must be equal up to sign in the quotient Λ uZ , since they must have the same degree deg Λdeg uZ in this quotient lattice of rank . Hence this means that v ∈ v + uZ. The problem is now reduced to nding the shortest vector in this coset.

. . Vector of minimal norm in the coset

To nd such a vector, let then explicitly write the norm of any vector in v + Zu. For any parameter λ ∈ R, we have by the parallelogram law and bilinearity of the norm:

v -λu 2 = v 2 +λ 2 u 2 -2λ v, u ( . )
The right hand side of Equation . is a degree two real polynomial in λ, of discriminant 4( u, v 2u 2 v 2 ) = -4 covol Λ < 0. Henceforth it has no real roots, and its (unique) global minimum is attained at λ min = -u,v u 2 . Remark now that the graph of function (λ → vλu + λ min u 2 ) is even, so that its minimum over Z, is attained at the closest integral point to λ min that is: λ min .

. . Iterating the reduction

Once such a small representant v of Λ Zu is found, we obtain a new basis of (u, v ) of Λ. If v < u we can start this whole reduction once again. Looping this process eventually terminates, since the size of the rst vectors shrinks at each step and is a non-negative integer. The whole algorithm is described in an iterative manner in Algorithm . (u, v) . .

Algorithm -Gauss reduction

Input : (u, v) a basis of a two-dimensional lattice Λ Output : A reduced basis (u, v) of Λ if v < u then return Gauss(v, u) v ← v -u,v u 2 u if v < v then return Gauss(u, v ) else return

On the properties of reduced bases

Let (u, v) be a reduced basis of a lattice Λ. By construction, these vectors satisfy u ≤ v and:

u, v u 2 = 0, i.e | u, v | ≤ u 2 2 .
From these observations, we can give a more axiomatic de nition of a reduced basis: De nition . . (Gauss-reduced basis). Let Λ be a two dimensional real lattice. A basis (u, v) of Λ is said to be Gauss-reduced if it ful lls the two conditions:

.

u ≤ v . | u, v | ≤ u 2 2 .
Proposition . . . Let (u, v) be a reduced basis of a lattice Λ, then u = λ 1 (Λ) and v = λ 2 (Λ).

Proof. Let (u, v) be a reduced basis of a lattice Λ. Remark that by de nition of the reduction, we have that v ≤ v ± u and by the analysis of Equation . , we have more generally v ≤ v + λu for any integer λ = 0.

Let now x = αu + βv be a generic point of Λ. Clearly if β = 0 we have x ≥ u . We can now suppose without of generality that β > 0 and set α = κβ + ρ with 0 ≤ ρ < β to be the Euclidean division of α by β. Then we have by reverse triangular inequality:

αu + βv ≥ β v + κu -ρ u = (β -ρ) v + κu +ρ( v + κu -u ) ≥ v + κu ≥ v ≥ u ,
as v + κuu ≥ 0 and βρ is an integer greater than . This ends the proof.

Using the existence of such reduces bases, we can relate the length of the shortest vector to the global determinants, retrieving Minkovsky's rst theorem for lattices of rank .

Corollary . . (Minkovsky rst theorem for planes). Let Λ be a lattice of rank . Then: λ 1 (Λ) ≤ 4 3 det Λ.

Proof. Let (u, v) be a reduced basis of Λ, then u, v 2 ≤ u 4 4 . As such, we have by de nition:

det Λ 2 = u 2 v 2 -u, v 2 ≥ u 2 v 2 - u 4 4 = 3 4 u 4 .
Remark. This bound is optimal, as being reached for the critical lattice of dimension : 1 2 ,

√ 3 2 Z ⊕ 1 2 , - √ 3
2 Z, as represented as follows:

. . On the running time of Gauss-reduction process Theorem . . . The number of steps of the Gauss-reduction is O(B), where B is a bound on the number of bits required to represents the basis given as input.

Proof. Remark rst that except for the last iteration of the algorithm, the norm of the rst vector of the basis shrinks by a factor of at least √ 3 -1 .

Indeed let (u, v) be the current state of the basis at any step except the nal one and (u, v ) the basis one step after. Remark that:

| u , v | = | v, u | = u, v u 2 - u, v u 2 u 2 ≤ 1 2 u 2 .
Suppose that u 2 ≥ u /3, then we would have:

| u , v | ≤ 3 2 u 2 .
In this case, during the next iteration of the algorithm, line of Algorithm makes appear u ± v . If this vector appears to be smaller than u then we would have already computed it di erently in the current iteration. Hence, the next step is the nal iteration. We can conclude since the norm of the rst vector is initially bounded by 2 B .

Remark. On a historical note, the reduction algorithm appears as natural generalization of Euclid's algorithm in Lagrange's letters of . It was also described later by Gauss in .

Now that we can reduce lattices in rank and reach the rst minima of such lattices, we might be interested in e ciently reducing lattices in arbitrary dimension, that is nding a polynomial time reduction procedure. . In the following of this section, let us x Λ a lattice of rank d. Suppose that we are given a basis B = (v 1 , . . . , v d ) of Λ. Let us denote by Λ i the sublattice of rank i generated by the rst ith vectors that is:

Λ i = v 1 Z ⊕ • • • ⊕ v i Z and by π i : Λ → Λ Λ i
the corresponding canonical projection . Such a choice yields a ltration of Z-modules:

F : {0} = Λ 0 ⊂ Λ 1 ⊂ • • • ⊂ Λ d = Λ.
We de ne the corresponding pro le µB of the basis B (or of the ltration F ) to be the sequence of degrees:

µB = (deg Λ 1 , deg Λ 2 , . . . , deg Λ).
Like for the Gauss' reduction algorithm, we aim at nding vectors of Λ which are the shortest possible, that is trying to solve the problem for the lattice Λ. Of course, by the NP-hardness result of Paragraph . . . , such a problem is hard. Henceforth, we will only look for reasonably short vectors. Since we do not know a priori how to reduce the lattice Λ as soon as rk Λ > 2, we will aim at reducing this problem to a succession of instances of reductions in smaller rank. We proceed by successive densi cation of the ltration F . This process is based on the following simple idea. Suppose that the rst vector v 1 is small-i.e., that the rst element Λ 1 has small degree-. Now, if we try to make the degree of Λ 2 as small as possible, among all sublattices of rank two containing Λ 1 , then by Hadamard's inequality v 2 is also small (even though not necessarily the smallest possible). Then, similarly, since we want the third vector to be small as well, we try to minimize the degree of Λ 3 , and so on for the subsequent elements of F . All in all, we aim at making the coe cients of the pro le of the ltration as small as possible, that is, making each of the Λ i as dense as we can. This justi es coining the term densi cation of a basis.

We start be describing such a reduction process abstractly, using only a ltration, and becomes gradually closer to vectors and practical considerations in order design and analyze an actual algorithm.

We also use this same notation π i to denote the orthogonal projection over the space Λ i ⊥ in Λ R since the projection of π i (Λ) is isometric to the quotient Λ Λ i .

. .

From Gauss' reduction to LLL reduction . . . . An action on ltration. The Gauss reduction algorithm acts naturally on (complete) ltrations. Let us explicitly write this action. At index 1 ≤ i ≤ d, we can construct a rank quotient lattice:

Λ * = Λ i+1 Λ i-1 .
Then, by Corollary . . , Gauss's reduction on this lattice nds a reduced basis of Λ * , that is a complete ltration {0} ⊂ Λ * 1 ⊂ Λ * , satisfying

2 deg Λ * 1 ≤ deg Λ * + log 4 3 .
We can now lift it into a sub ltration

Λ i-1 = Λ i ⊂ Λ i+1
, such the quotient ltration by Λ i-1 is equal to the reduced ltration:

Λ i-1 Λ i-1 ⊂ Λ i Λ i-1 ⊂ Λ i+1 Λ i-1 {0} ⊂ Λ * 1 ⊂ Λ * .
This lift can be done by using the restriction (π i ) |Λ i+1 of the canonical projection onto the quotient

Λ i Λ i-1 . It su ces to set Λ i = vZ ⊕ Λ i-1 for a representative v + Λ i-1 of the rank one lattice Λ * 1 .
. .

Densi cation of a basis

Applying Gauss' reduction to ltration locally densi es it, as it reduces the degree of the quotients Λ i Λ i-1 . To transform this local process to a global one, at least two possible iterative strategies opens from this observation:

Incremental progression: We try to densify the ltration starting from Λ 1 and incrementally progress through the ltration. If a modi cation is done for the sublattice Λ i we make a step back and start again at position i -1 in the ltration. Graphically, a generic execution might looks like: Time where we progress along the basis but with local back and forth (a small block indicates where the local reduction is done in the ltration). When we eventually reach the end of the ltration, no local reduction is able to alter the ltration and we can stop.

Ironing out strategy: We perform a local reduction at each index and start again when the end of the ltration is reached. We then start all over again from the beginning until no change are made by this process. Graphically, the rst steps of a generic execution might looks like:

Time

We rst look at the rst strategy as it recovers the historical algorithm and discuss the di erence with the second one thereafter. At the end of the process, no local progress can be done on the ltration, and as such, by construction, the sequence of degrees satis es the relation:

2 deg Λ i Λ i-1 ≤ deg Λ i+1 Λ i-1 + 1 2 log 4 3 ,
for any 1 ≤ i ≤ d -1, yielding by additivity of the degree over short exact sequences:

deg Λ i -deg Λ i-1 ≤ deg Λ i+1 -deg Λ i + 1 2 log 4 3 ,
with the convention that deg Λ 0 = 0. Summing these relations for all 1 ≤ i ≤ k gives for any j > k:

deg Λ k ≤ 1 2 log 4 3 + k(deg Λ j+1 -deg Λ j ).
Thus, by summing d times and separating indices below k and beyond k we have:

d deg Λ k ≤ k deg Λ k + d ∑ j=k+1 (deg Λ j+1 -deg Λ j ) + k(2j -k -1) 4 log 4 3 ≤ deg Λ d + d(d -k)k 4 log 4 3 .
In particular we have:

deg Λ 1 ≤ d -1 4 log 4 3 + 1 d deg Λ d Remark.
In substance this abstract procedure is similar to the technique used by Hermite in , proving the so-called Hermite's inequality:

γ d ≤ γ d-1 2 .
We can directly recover this inequality from our result, by remarking that:

• By de nition of the degree, we have log λ 1 (Λ) ≤ deg Λ 1 ,

• By Corollary . . , γ 2 = 4 3 .

So that:

√ γ d ≤ λ 1 (Λ) covol Λ ≤ γ d-1 2 2 .
. .

Towards an actual algorithm

In order to transform this abstract procedure on ltrations in an actual algorithm we need to explicitly describe the lifting procedure above-mentionned.

Using the same notations as in Section . . , this question translates to vectors in choosing an element of the coset v + Λ i-1 .

. . . . Finding a small representative in a coset. If we move back from the ltration point of view to the vector one, we might want to take the shortest possible vector of this coset. However, as stated in Paragraph . . . , this is a instance in dimension rk Λ i-1 = i -1, which is a priori hard. However if we relax the condition of nding the closest vector to v in nding a vector relatively close to it, the problem becomes much simpler, as we will break this search in successive instances of reductions of two vectors.

Remark that we can use the sub ltration Λ 0 ⊂ • • • ⊂ Λ i-1 to greedily nd such a representation. Suppose that this latter ltration arised from the basis (v 1 , . . . , v i-1 ). Then, we can start by reducing the vector v with the vector v i-1 , that is looking for a small representative of the class v i + Zv i-1 . But as at this point, since we do not have reduced v against the other vectors v 1 , . . . , v i-2 , we do want to make vanish the contribution of these rst i -2 vectors when trying to reduce v with v i-1 . Informally we want to reduce these vectors independently of all the possible linear combinations with elements in Λ i-2 . This means performing the reduction of v modulo the whole additive action of the lattice Λ i-2 . This simply translates as performing the reduction step inside the quotient Λ Λ i-2

, and then lifting the resulting vector in a new vector

v i ∈ v i + v i-1 Z ⊆ v + Λ i-1 .
The same quadratic minimization as the one performed in Section . reveals that the minimum norm is reached for

v + v, π i-1 (v i-1 ) π i-1 (v i-1 ) 2 v i-1 + Λ i-2 ∈ Λ Λ i-2 , so that the lifted vector is v = v + v,π i-1 (v i-1 ) π i-1 (v i-1 ) 2 v i-1
. Once this operation is performed, we can start to go back in the basis and reduce the newly found v with v i-2 . As before, we do perform this reduction modulo Λ i-3 , that is reducing the projection of v by v i-2 inside the quotient

(Λ i-2 ⊕ vZ) Λ i-3
. We can then perform this reduction up to getting down to to v 1 . This recursive reduction can be simply made iterative and gives the procedure called weak reduction, or size-reduction, written in pseudo-code in Algorithm .

Algorithm -Size-reduction

Input : (v 1 , . . . , v d ) a family of vectors Output : A size-reduced family (v 1 , . . . , v d ). for k = 2 to n do for j = k -1 downto 1 do v k ← v k - v k ,π j (v j ) π j (v j ) 2 • v j
end for end for return (v 1 , . . . , v d ) . . . . An iterative reduction process. If we breaks the steps of the Gauss reduction of the above-described procedure and combine these exchanges with the weak-reduction we get a blueprint of reduction, exposed in pseudocode in Algorithm , with the convention that v 0 is the zero vector.

Algorithm -Prototype of reduction

Input : (v 1 , . . . , v d ) a basis of a rank d lattice Λ Output : A reduced basis of Λ while progress is done do Size-reduce(v 1 , . . . , v d ) if ∃i, deg(v 0 , • • • , v i-1 , v i+1 ) < deg(v 0 , • • • , v i-1 , v i ) then Swap v i and v i+1 end if end while return (v 1 , . . . , v d )
Let us optimize the procedure a bit. First, we can order the exchange form the left part of the basis to its right and keeping track of the latest exchange to avoid performing a full size-reduction. Then remark that an exchange between the two vectors is then performed if

deg(Λ i-1 ⊕ v i+1 Z) < covol(Λ i-1 ⊕ v i Z), that is if v i+1 + Λ i-1 < v i + Λ i-1 ,
since by de nition of the quotient we have deg(Λ ⊕ xZ) = deg(Λ ) + log x + Λ for any strict sublattice Λ and vector x ∈ Λ . Expanding the inequality using the identi cation of the quotient lattice with the orthogonal projection and relaxing the strict inequality by a continuous parameter 0 < δ < 1 yields the condition:

δ π i-1 (v i-1 ) 2 ≤ π i (v i ) 2 + v i , π i-1 (v i-1 ) 2 π i-1 (v i-1 ) 2
The whole iteration of this process is described in an high-level manner in Algorithm . This is the Lenstra-Lenstra-Lovász algorithm, as presented in [ ].

Algorithm -Textbook LLL reduction

Input : (v 1 , . . . , v d ) a basis of a rank d lattice Λ Output : A δ-reduced basis of Λ k ← 2 Compute the π i (v i )'s with the Gram-Schmidt process while k ≤ d do for j = k -1 downto 1 do v k ← v k - v k ,π j (v j ) π j (v j ) 2 • v j if δ π k-1 (v k-1 ) 2 ≤ π k (v k ) 2 + v k , π k-1 (v k-1 ) 2 π k-1 (v k-1 ) 2 then k ← k + 1 else Swap v k and v k-1 ; Update π k (v k ) and π k-1 (v k-1 ) k ← max(k -1, 2) end while return (v 1 , . . . , v d )
On the QR-decomposition. Before pursuing this introduction to reduction algorithms, we point out the matrix interpretation of the decomposition induced by the projections π i . Given an invertible matrix B, representing a basis B of Λ, we have

B = QR by setting Q = π i (v i ) π i (v i ) 1≤i≤d and R = π i (v i ), v j 1≤i,j≤d . Q is an
orthogonal matrix and R an upper triangular one, by de nition of the projections. This decomposition is called the QR-decomposition of B.

This relaxation may seem arti cial, but it is a classical trick in algorithm design to ensure polynomial time for greedy algorithm.

The Gram-Schmidt orthogonalization process ( ) is an algorithmic way to compute inductively the projections π(v i ) and as such the QR-decomposition of a matrix. It is done by setting π 1 (v 1 ) = v 1 and then for all 1 < i ≤ r,

π i-1 (v i ) = v i - i-1 ∑ j=1 v i , π j (v j ) π j (v j ), π j (v j ) v j .
We can actually rewrite this algorithm using matrices by using the QRdecomposition. More precisely we only use the R part of this decomposition to perform the reduction. This simple rewriting, given in Algorithm , is the base from which we construct generalized reductions in algebraic contexts in Chapter . It also gives an interesting insight on the reduction: since lattice reduction is invariant by orthogonal transformation of the ambient space, by the QR-decomposition we only need to de ne a reduction for lattices given by triangular matrices. The reduction acts on such matrices by an iterative sequence of local reductions on the diagonal and overdiagonal elements, forming projected sublattices of rank which are themselves triangular. Thus, we actually retrieved the abstract point of view introduced in Section . . using ltrations: the R part of the QR-decomposition is nothing else than a matrix encoding of the ltration (indeed recall that ags of vector spaces are in correspondence with upper-triangular matrices). The reduction is indeed a sequence of local reduction (2 × 2-triangular matrices, i.e., quotient sub ltrations of dimension ).

Algorithm -R-based LLL reduction

Input : Initial basis (v 1 , . . . , v d ) Result : A δ--reduced basis k ← 1 while k < d do Compute the R part of the QR-decomposition of B for j = k -1 downto 1 do v k ← v k -R k,j • v j if δ (R k,k , 0) 2 ≤ (R k+1,k , R k+1,k+1 ) 2 then k ← k + 1 else Swap v k and v k+1 k ← max(k -1, 1) end while return (v 1 , . . . , v d )
. .

Properties of reduced bases

Similarly to the exposition of Gauss reduction algorithm in Section . , we say that a basis is reduced if it is invariant under the application of Algo-rithm . By de nition, such a basis veri es two sets of conditions. The unimodular transformation of line should act as the identity, that is that

v j , π i (v i ) π i (v i ) 2 = 0
for any index i. The second set of conditions arise from the guard of line : for any index i, the norm of the (i + 1)-th vector should be greater than the norm of the i-th vector. All in all, this leads to the following axiomatic de nition of the reduceness notion:

De nition . . ( reduction). A basis (v 1 , . . . , v d ) of a lattice is said to be δ--reduced for a certain parameter 1/4 < δ ≤ 1, if the following conditions are satis ed:

∀i < j, v j , π i (v i ) ≤ 1 2 π i (v i ) 2 (Size-Reduction condition) ( . ) ∀i, δ π i (v i ) 2 ≤ π i+1 (v i+1 ) 2 + v i+1 , π i (v i ) 2 (Lovász condition) ( . )
All in all, we can quantify the density of the successive sublattices:

Theorem . . . Consider a δ-reduced basis (v 1 , . . . , v d ) of (Λ, •, • ). For any 1 ≤ k ≤ d, denoting by Λ k the sublattice spanned by v 1 , . . . , v k , we have: covol(Λ k ) ≤ 1 δ -1/4 -(d-k)k 4 covol(Λ) k d .
Proof. The proof is in substance the same one we did with ltrations, this time, taking the relaxation factor δ into account. Using the Lovász condition at index 1 ≤ i < d, we write:

δ π i (v i ) 2 ≤ π i+1 (v i+1 ) 2 + v i+1 , π i (v i ) π i (v i ) 2 2 π i (v i ) 2
Thanks to the size-reduction condition, this implies:

∀i ∈ {1, . . . , d -1}, π i (v i ) 2 ≤ (δ -1/4) -1 π i+1 (v i+1 ) 2 . ( . )
Let K denote (δ -1/4) -1/2 and i be the norm of the vector π i (v i ). Then, Equation ( . ) becomes:

∀i ∈ {1, . . . , d -1}, i ≤ K i+1 .
Recall that covol(v 1 , . . . , v k ) = ∏ k i=1 i . This implies that for any j > k:

covol(v 1 , . . . , v k ) ≤ k ∏ i=1 K j-i j = K k(2j-k-1)/2 • k j .
. Thus:

covol(v 1 , . . . , v k ) d = k ∏ i=1 i d ≤ k ∏ i=1 i k d ∏ j=k+1 K k(2j-k-1)/2 • k j ≤ d ∏ i=1 i k K ∑ d j=k+1 k(2j-k-1)/2 ≤ covol(Λ) k K d(d-k)k 2 .
. .

Running time analysis

As shown in [ ], the algorithm terminates in polynomial time when δ < 1. The proof is two-fold: rst, we prove that the total number of swaps is polynomial, so that the number of iterations is polynomial, and then we conclude by proving that the complexity of an iteration of the loop is also polynomial.

Number of swaps.

By construction of the reduction, each swap makes a coe cient of the pro le decrease by at least log δ, so that µB 1 decreases by at least log δ. The quantity µB 1 is the potential of the basis B. Since the total number of iterations can be bounded by twice the number of swaps plus the dimension of the lattice, this su ces to conclude that it is bounded by O d 2 B where B = log B max is a bound on the size of the coe cients of the matrix of the initial basis B. But the cost of a loop iteration is of O(dn) arithmetic operations on rational coe cients.

Complexity of one iteration. Let us conclude this complexity analysis by proving that the length of these coe cients is at most as a O(dB). We start by bounding the size of the integers appearing during the size-reduction process. Denote by M the triangular matrix

v i ,π j (v j ) π j (v j ) 2 1≤i<j≤d
, completed with 's on its diagonal. Then, by denoting by N its inverse, we can express the Gram-Schmidt orthogonalization of the elements of B as:

π i (v i ) = v i + i=1 ∑ =1 N i, v ,
so that for all 1 ≤ j ≤ i -1 we have:

0 = v i , v j + i-1 ∑ =1 N i, v , v j ,
and so:

G[1 : i -1, 1 : i -1] • (N i,1 , . . . , N i,i-1 ) T = -( v i , v 1 , . . . , v i , v i-1 ) T ,
for G being the Gram matrix of the basis B. Each of these systems is invertible as det G[1 : i,

1 : i] = covol Λ 2 i > 0. As such, by Cramer's formulas, det G[1 : i -1 : 1 : i -1]N i,j is an integer and thus π i (v i ) 2 2 > det G[1 : i -1, 1 : i -1]. This means that the coe cient of M i,j is bounded by v i / π j (v j ) ≤ det G[1 : i -1, 1 : i -1] v i ≤ B i max , which is the announced result.
The total cost in term of binary operations is then bounded by O d 6 B 3 .

Remark (On the di erences between the reduction strategies). As mentioned, two natural strategies can be used to reduce a lattice, the progressive one (like the original we presented) and the global one (or attening out strategy). Even though both of them would lead to a reduced basis at the of the process, the overall behavior is quite di erent and in particular, the way we can analyze the process di ers signi cantly. The analysis of the progressive strategy is global: as the reduction is not over, we can assert properties of the current basis. We only have a global information coming from the upper bound on the norm of the pro le. Analyzing the attening out strategy can be done locally by looking at the process as a dynamical system which update the whole basis at each iteration, giving a bound on the pro le of the basis. Going further in this direction make us design a parallel variant of the reduction where we alternate passes of reduction on shifted blocks as in the following scheme:

This reduction behaves similarly to a well known dynamical process: the pro le evolves as a discretized heat di usion over a dimensional compact . In particular, the characteristic time of the di usion process is quadratic in the diameter of the compact. For the reduction algorithm, we can prove that the global number of rounds required to reduce the basis is a O (rk Λ) 2 , which is quadratic in the "diameter" of the basis. A full analysis using this model is performed for more general reductions in Chapter .

. . On the complexity of lattice reduction

We shall now prove that lattice reduction is no easier than linear algebra on a nite eld F p for a large enough prime p. Let us now de ne the related complexity problems:

. . . . Siegel reduction problem. We shall de ne a reduction notion which is slightly weaker than the -reduction notion, called Siegel reduction.

De nition . . (Siegel reduction).

A basis B of a lattice is said to be T-Siegel-reduced for T > 0 when the following conditions are satis ed:

∀i < j, v j , π i (v i ) ≤ 1 2 π i (v i ) 2 (Size-Reduction condition) ( . ) ∀i, T π i (v i ) ≤ π i+1 (v i+1 ) (Siegel condition) ( . )
The -algorithm produces Siegel-reduced bases with parameter T for any lattice and any T > 2 where we maximize the number k of columns of K. The reduction returns this matrix K. We now prove that it is a basis of the kernel of A.

We have L ≤ 2d 2 2 2d p 2 ≤ 2 B and L -1 ≤ 2d which is also less than 2 B since p ≥ 2. It is clear that vectors in LZ 2d of the form 0

x are exactly the integer solutions of Ax = 0 mod p. We let QR be the QR-decomposition of AU. Let K be a basis of ker A, where entries are integers smaller than p.

Then, since U is unimodular, there is an integer matrix V such that

AUV = 0 K .
If V has no nonzero entries V i,j with i > k, so that that the output is correct. Hence, we consider v a column of V where it is not the case. First, we have AUv ≤ √ dp. Second, as Q is orthogonal, we have AUv = Rv ≥ R i,i . Third, the de nition of k implies that R k+1,k+1 ≥ d2 2d p. As the lattice is reduced and i > k, we have R i,i ≥ R k+1,k+1 2 -2d . We conclude that:

√ dp ≥ AUv ≥ R k+1,k+1 2 -2d ≥ dp which is incorrect.
As we expect the kernel problem to have a complexity of at least an Ω(d ω B), we can expect the same for the Siegel reduction problem, and therefore of the -reduction.

. . On the behavior of the -reduction and the in uence of the δ-relaxation . . . . On the average behavior of As shown in [ ] for Siegel-reduced bases, a reduced basis chosen uniformly at random behaves as the worstcase allowed by the nal inequalities. By contrast, bases produced by the algorithm are usually much better than this worst-case. Let us give an example of this phenomena, which already appears in dimension as small as three.

Example. Let α ∈]1, √ 4/3] and de ne the vectors

b 1 = (α 2 0 0) b 2 = (α α 2 -1 α 0) b 3 = (0 α 2 -1 1)
.

We (we invite the reader to refer to Appendix for a proof of this result). One could intuitively think that the output distribution of on random bases of Λ α is uniform, or at least close to the uniform distribution. Interestingly, this is not the case: the basis L α is

Even if the natural notion of random lattice is fairly easy to describe, as a normalization of a Haar measure over the moduli space Gl(n, R)/Sl(n, Z), it appears that giving a "natural indeed obtained less than 25% of the time:

selects more often the basis with the shortest rst vector. This example con rms the observation that the procedure "selects" some reduced bases among all the possible -reduced ones, and therefore that in practice the bases output by are better (for the norm of the vectors, or the density of the successive sublattices, among other quality measures) than the worst case predictions. Going further in this direction, recall that we have proved that in the worst-case, the δ--reduction of a lattice of rank d yields a rst vector satisfying:

v ≤ 1 δ -1/4 -d 4 covol(Λ) 1 d .
However, as remarked in [ ], the average output has shorter vectors, in particular, on average, the rst vector satis es:

v ≈ 1.02 -d 4 covol(Λ) 1 d ,
for relaxation factor δ close to , meaning that favors bases with shorter than expected vectors. . . . . Phase transitions in the δ--reduction We have seen that the reduction can be thought as a relaxed and algorithmic version of Hermite's inequality. Of course this relaxation parameter in uences the reduction, as it forces the reduction to end in polynomial-time. Hence, we can wonder on the impact of this parameter on global behavior of . The comportment of the δ-reduction does not seem to be smooth: we can even observe a phase transition phenomena. For instance if we go back to our previous example L α it appears experimentally that the probability of outputting the so-called dark basis of the lattice discontinuously change at 1 α 2 . For 3 4 ≤ δ < α -2 the probability is close to one half, whereas as δ ≥ α -2 , it collapses to . . Figure shows an instance of this phase transition for α = 1.07.

Even though the worst-case behavior of is quite easy to state, its average case is still surprising and not-well understood (in particular, even if some models using dynamical system exists [ , ], there is no rigourous analysis of the -reduction in the average case). Therefore it is invaluable to have access to a fast reduction algorithm having the same execution trace as original to pursue extensive practical studies and experiments. This will be one of our goals when designing a fast and sound reduction process for arbitrary real lattices, in Chapter .

de nition" of a random basis is not as trivial. Indeed, the naive way of selecting a xed basis and multiplying by some unimodular transformation is not satisfactory as it introduce signi cant bias in the behavior of . A possible (and consistent with other methods) solution consists in sampling random vectors according to the discrete Gaussian distribution of su ciently large variance and transforming such a generating family in a basis with the algorithm of Micciancio and Goldwasser [ ]. A complete discussion on this topic would bring us far from the goals of this manuscript, but we point out the preprint [ ] for an in-depth treatment of this problem. . :

. . Towards Hermite-Korkine-Zolotarev reduction . . . . First minima of the successive projected lattices. Let (v 1 , . . . , v d ) be an -reduced basis. From the de nition of the -reduction, we remark that for any index 1 ≤ i < d, the basis

(π i (v i ), π i (v i+1 )) is a Gauss-reduced basis of the lattice Λ * i = π i (v i Z ⊕ v i+1 Z). From Proposition .
. , it implies that π i (v i ) reaches the rst minima of Λ * i . A possible generalization of this observation is to require the vector π i (v i ) to reach the rst minima of the lattice π i v i Z ⊕ • • • ⊕ v i+β Z for some parameter β > 2. This is in substance the de nition of the β-Hermite Korkine-Zolotarev reduction notion.

De nition . . (β-BKZ reduction).

A basis B of a lattice is said to be β-reduced fo certain parameters β > 1, if the following conditions are satis ed:

∀i < j, v j , π i (v i ) ≤ 1 2 π i (v i ) 2 (Size-Reduction condition) ( . ) ∀i, π i (v i ) = λ 1 π i v i Z ⊕ • • • ⊕ v i+min(β,rk(Λ)) Z (β-Minima condition) ( . )
. . . . Pushing β towards in nity, HKZ reduction. Strengthening the minima condition by letting β grows to in nity yields the Hermite-Korkine-Zolotarev reduction notion: hence the basis (v 1 , . . . , v d ) of a lattice Λ is reduced if it is weakly-reduced and if the vector π i (v i ) reaches the rst minima of the projected lattice π i (Λ). This reduction notion is quite natural in the sense that the size-reduction aims at controlling the contribution of the sublattice (v 1 , . . . , v i-1 ) to the vector v i , whereas the minima condition minimizes the remaining part. Of course in dimension two this notion corresponds exactly to Gauss reduction.

This reduction notion has been originally introduced by Korkine and Zolotarev for quadratic forms in the seminal article [ ] and reintroduced by Hermite in his second letter to Jacobi [ ].

. .

From slide-reduction to DBKZ

We now turn to the e ective computation of a β--reduced basis. In all of the following, we suppose that we are given a oracle O, which, when fed with a basis of a lattice Λ, returns a shortest vector of Λ. . Find a shortest vector v 1 of Λ, . Complete v 1 in a basis of Λ, and derive a basis of π 1 (Λ) from it by the Gram-Schmidt orthogonalization.

. Recursively nd an -reduced basis (v 2 , . . . , v d ) of π 1 (Λ).

. Lift each of the v i into v i by adding multiples of v 1 , so that the resulting basis (v 1 , . . . , v d ) is size-reduced.

It is clear that the running-time of this algorithm is asymptotically polynomial in the running time of the oracle O. Thanks to the results of Section . , we know that solving exactly these instances of is NP-hard. Practically speaking, the best algorithms known for this problem run in exponential time (O(2 n ) [ ] for proved algorithms, and 2 0.292d+o(d) for heuristic sieving algorithms [ ]).

As far as the β-reduction is concerned, the current state of the art of reduction algorithm is divided into two categories: on the one hand the proved algorithms, epitomized by the slide reduction of . Call the reduction to shrink the size of the basis vector (v 1 , . . . , v d ).

. For each of the block (v i , . . . , v min(i+β-1,d) )

• Find a shortest vector v of the corresponding projected lattice.

• If the vector v has a shorter norm than π i (v i ), then construct the lattice Λ generated by the lift of v and the vectors v i , . . . , v min(i+β-1,d) of the block. Reduce this lattice using the variant for generating families to avoid altering the lattice spanned by the block by reducing the size of its rst vector.

• Replace the block by the basis obtained at the previous step.

. Repeat until a β-reduced is obtained.

However, no polynomial bound on the number of oracle calls is known for BKZ. In fact, the experiments of [ ] suggest that this number of calls does not even grow polynomially! . . . . A proved algorithm for the β-problem.

In [ ], Gama and Nguyen introduced a di erent block reduction algorithm, called slide reduction. It is also parameterized by a block size β, which is required to divide the lattice dimension, but uses a oracle only in dimension β.

A basis B is slide-reduced with block size β, if B[1, k] is reduced, π 2 (B[2, k + 1]) is dual--reduced, and π k+1 (B[k + 1, n]
) is slide-reduced. The slidereduction process starts by alternately -reducing all blocks π ik+1 (B[ik + 1, (i + 1)k]) and running on B. Once no more changes occur, the blocks

π ik+2 (B[ik + 2, (i + 1)k + 1]
) are dual-reduced. This entire process is iterated until no more changes occur. Although enjoying a clean analysis, the slide-reduction algorithm has been reported by its author to be sensibly inferior to in experiments.

. . . . The heuristic BKZ algorithm. Instead of relying on proved algorithms, the heuristic variants of algorithm are used in practice since they provide very good experimental running time and better-than-expected output quality.

The search for a shortest vector is usually carried by enumeration techniques with computations carried out in oating-point representation, coupled with so-called pruning strategies (see [ , ] for instance) to provide early cuts in the enumeration tree and sensibly reduce the running time.

However, the caveat of the variants of algorithm is their notorious difculty to analyze properly. Actually, while there is no polynomial bound on the number of calls makes to the oracle, Hanrot, Pujol, and Stehlé showed in [ ] that one can abort a variant of reduction after a polynomial number of calls to the oracle and still provably achieve reasonable bounds on the size of the reduced vectors. Up to the work of Miccciancio and Walter [ ] the statu-quo was that a complex simulation procedure seemed to be the way to predict the result of their application to an instance (see [ ] for an instance of this simulation strategy).

. . . . The DBKZ algorithm. By providing a back-and-forth strategy coupled with enumeration in the dual lattice, the dual block Korkine-Zolotarev algorithm provides an algorithm with practical performances comparable to the variants but with provable and easy bounds on its running time. We provide the blueprint of this reduction in Algorithm .

Algorithm -DBKZ reduction

Input : (v 1 , . . . , v d ) a basis of a rank d lattice Λ, a oracle O Output : A k-reduced basis of Λ do for i = 1 to d -β + 1 do Find v such that π i (v) = λ 1 π i (v i ), . . . , π i (v i+β-1 ) v i , . . . , v i+β-1 ← LLL(v, v i , . . . , v i+β-1 ) end for for i = n -β + 1 downto 1 do d i , . . . d i+β-1 ← π i (v i ), . . . , π i (v i+β-1 ) ∨ Find v such that π i (v) = λ 1 d i , . . . , d i+β-1 v i , . . . , v i+β-1 ← LLL(v, v i , . . . , v i+β-1 ) end for while progress is done return (v 1 , . . . , v d )
The while progress is done condition is not completely straightforward to implement as it can stuck the algorithm in in nite loops, as mentioned in [ ]. However, Miccciancio and Walter show by a dynamical system analysis it is possible to abort the execution of the algorithm after a polynomial number of rounds and still achieve provable bounds on the output. This technique o ers a tradeo between the time spent and the quality of the output by looking at blocks of size β ≤ n, as stated in the following theorem. For the purposes of this manuscript it is encompassed in the following theorem, which can be easily derived from the original bound of [ ] and from the results on practical enumeration from [ ].

Theorem . . . There exists an algorithm ouputting a vector v of a lattice Λ satisfying:

v ≤ β n-1 2(β-1) • (covol Λ) 1 n .
Such a bound can be achieved in time Poly(n, log B 0 ) 3 2 β/2+o (β) , where B 0 is the input basis. We conclude this chapter by exposing a somewhat folklore result on the reduction of lattices with small determinants. This result is crucial for the design of the algorithm of Chapter .

. Let us examine the right-hand side of the equation of Theorem . . : (covol Λ)

1 d • β 2d β .
Both the d-th root of the determinant and exponential factor in d appear in this term. Generically, the determinant part prevails. However, when the determinant is small, the second term can be of the same order of magnitude than the root of the determinant. In this case one could desire to balance the contributions of these two expressions. A natural idea is then to reduce a lattice of smaller dimension in order to reduce this approximation factor. We

x the block-size β ≤ d and look at the output of performed on the sublattice Λ generated by the m rst vectors b 1 , . . . , b m of an basis. From Theorem . . , we have

v ≤ β m 2β • (covol Λ ) 1 m ≤ β m 2β • (covol Λ) 1 m .
The condition we require on the determinant of the lattice is covol Λ ≤ β n 2 2β : otherwise, for every m ≤ d, the term (covol Λ)

1 m is dominating. Assuming covol Λ ≤ β n 2
2β , we identify the optimal sub-dimension m in {β, . . . , n} depending on β that minimizes this upper bound: it corresponds to the balance between the two factors, that is m = 2β log β (covol Λ) . We x m to this value and we obtain the following corollary.

Corollary . . . For any integer lattice Λ of rank d such that covol Λ ≤ β n 2 2β , using reduction with block-size β on the rst m = 2β log β (covol Λ) vectors permits to output a short vector v that satis es β) , with B a bound on the bitsize of the coe cients of the input basis.

log v ≤ 1 + o(1) 2 log β β deg Λ.

This algorithm runs in time Poly

(n, B) • 3 2 β/2+o(
Proof. We consider the sublattice of dimension m, for m as de ned above.

The condition on the determinant of Λ ensures that our value of m is e ectively lower than d. Then, by Theorem . . and Lemma . . , we have

v ≤ β m 2β • (covol Λ) 1 m = β √ (2/β) log β (covol Λ) 1+o(1) ,
which yields the announced result -the (1 + o( 1)) factor appears because of the integer approximation of m.

Remark. Thanks to Corollary . . , we want to point out that choosing blocksize β = log(covol Λ)

1 3 when it is smaller than d allows to describe an algorithm that runs in time Poly(n, log B 0 ) • 3 2 β/2+o(β) and outputs a vector of norm less than β √ 2β 1+o(1) . This remark will be the crux of the descent technique of Chapter .

O N L AT T I C E S O V E R O R D E R S I N N U M B E R F I E L D S
We now dive into the generalization of lattices to the higher dimensional number theoretical setting.

This chapter introduces and exposes the elementary properties of an algebraic generalization of Euclidean lattices. Recall that a lattice is a free Z-module endowed with an Euclidean metric. Since Z is the ring of integers of the eld Q, a natural question arising from this sole de nition is what we obtain under a eld extension, that is an O K -module endowed with a suitable metric, i.e. compatible with the algebraic structure of the underlying number eld.

Remark. These lattices de ned over rings of integers appear in Arakelov theory as (Hermitian) vector bundles on the arithmetic curve SpecO K . But they were already considered by Humbert in [ ], in the equivalent language of Hermitian forms rather than lattices, and have been further studied in the spirit of classical lattice theory under the name Humbert forms. However, it is remarkable, as noticed by Yves André in [ ], that these two trends of research on the same object ignored each other for more than years. .

. . Projectiveness of ring of integers

In Theorem . . , we have proved that the ring of integers of a number eld is free as Z-module. It is a module not just over Z, but also over any intermediate ring of integers. That is to say, if we have a tower of number elds Q ⊆ K ⊆ L, then the ring O L can be viewed as an O K -module. Since O L is nitely generated over Z, it is also nitely generated over O K , as being the same module seen under scalar extension. However, even though O L is free over Z, it is not necessarily free over O K .

Example (Inspired by Keith

Konrad's [ ]). Let K = Q(i √ 6) and L = K(i √ 3). Then, O L = 1 + i √ 3 2 O K ⊕ 1 i √ 3 a,
for a being generated by (3, √ -6), but O L is not free over O K .

Proof. Suppose that O L is free over O K .

• Then, we would have:

O L = 1 + i √ 3 2 O K ⊕ O K .
Indeed, take E = (e 1 , e 2 ) an O K -basis of O L . We claim that since

F = 1, 1+i √ 3 2 is a K basis of L, the change of basis matrix M = α 1 α 2 β 1 β 2
transforms the basis E to the basis F had determinant in O × K . Indeed, L/K is Galois of degree , with the non-trivial automorphism given by the conjugation σ(i

√ 3) = -i √ 3. Then, M trans- forms (σ(e 1 ), σ(e 2 )) into (1, 1-i √ 3
2 ). Therefore:

α 1 α 2 β 1 β 2 e 1 σ(e 1 ) e 2 σ(e 2 ) = 1 1 1+i √ 3 2 1-i √ 3 2
, and so by taking the determinant of both sides of this equality we nd:

det(M)(e 1 σ(e 2 ) -e 2 σ(e 1 )) = -i √ 3.
As such,

N K/Q (det(M)) 2 N K/Q (e 1 σ(e 2 ) -e 2 σ(e 1 )) 2 = 9.
This last equation asserts that

N K/Q (det(M)) is either 1 or 3. Remark that for any a, b ∈ Z, N K/Q a + i √ 6b = a 2 + 6b 2
, which can not be equal to . Then N K/Q (det(M)) = 1, as claimed.

• We now prove that F can not be a basis of O L . Suppose it is the case, then, since

√ 2 = i √ 6 i √ 3 ∈ O L we can write, √ 2 = α + β 1+i √ 3 2
for some α, β ∈ O K . Then by the action of the Galois element σ we nd:

- √ 2 = α + β 1-i √ 3
2 . But then if we take the di erence of these two last equations we would have 2 √ 2 = iβ √ 3, implying 4 × 2 = -9β 2 by squaring, but remark that -8/9 ∈ O K , which is a contradiction.

As such, O L might not be free over O K but it is at least projective, as de ned in the de nition given in Section . . :

Proposition . . . Let Q ⊆ K ⊆ L be tower of number elds, then O L is a projective module over O K .
Proof. O L is clearly nitely generated over O K and has no torsion. Let X = (x 1 , . . . , x n ) be a generating set for O L over O K . Let T = (t 1 , . . . , t k ) be a set of O K linearly independent elements of O L . Then k ≤ n. Suppose that T is maximal for the cardinality, so that,

t 1 O K + • • • + t k O K is free of rank k.
Without loss of generality-up to composing by a suitable isomorphism-we can suppose that t i is the i-th vector of the standard basis of the free module O k K . For any element x ∈ O L , the maximality of T implies that there exists an integer α

x ∈ O K \ {0} such that α x • x ∈ t 1 O K + • • • + t k O K = O k K .
Doing so on each of the spanning set X yields a family α 1 , . . . , α n , verifying that α i x i ∈ O k K for each i. Hence the product of these elements also satis es:

α 1 • • • α n O L ⊆ O k K .
Since the α i are non-zero, α = α 1 • • • α n is also non-zero and, as such, is invertible in K, so that as an O K module, O L ∼ = αO L . Hence, it is a direct factor of the free module O k K .

. . . . Relative structure of projective modules Let Q ⊆ K ⊆ L be a tower of number elds and M a projective module over the ring O L . Then M is also projective over O K . Indeed, it is isomorphic to a direct sum of fractional ideals of O L . Each of them is itself a projective module over

O K . Its rank over O K of course satis es rk O K (M) = rk O L (M)[L : K].
Hence M can be seen as a module over any intermediate ring of integers between O L and Z, as depicted as follows:

F r e e o f r a n k d ×

[ L : Q ] Proj. of rank d P r o j . o f r a n k d × [ L : K ] L O L M K O K . . . . . . Q Z .

. . Archimedean embeddings, canonical norm

Let L be a number eld of degree n and O L its maximal order. Denote by α a primitive element of L. Then, as seen in Chapter , there are exactly n distinct embeddings, ie. eld homomorphisms, of L into C. We de ne the ith embedding σ i : L → C as the morphism mapping α to α i . We distinguish embeddings induced by real roots, the real embeddings, from embeddings coming from complex roots, the complex embeddings, and sort them as:

• σ 1 , . . . , σ r for the real ones,

• σ r+1 , . . . , σ n for the complex ones, paired so that σ n+i = σ n+i .

The L-vector space L R = L ⊗ Q R is naturally a R-algebra and any of the embeddings σ i de nes a morphism from L R to C, as σ i (α ⊗ r) = rσ i (α), so that we have an isomorphism of algebra, called the Archimedean embedding:

Σ : L R -→ R r × C c x -→ (σ 1 (x), . . . , σ r (x), σ r+1 (x), . . . σ n (x)) .
This embedding allows to de ne a symmetric bilinear form on L R , which is positive de nite and endows L R with a natural Hermitian structure given by

a, b σ = n ∑ i=1 σ i (a)σ i (b).
The corresponding norm is called the canonical norm, or T 2 norm as de ned in [ ]. We can make the canonical embedding an isometry, by endowing the space R r × C c with the product:

a, b σ = r ∑ i=1 a i b i + 2 c ∑ i=r+1 a i b i . . .
Extension to vector spaces.

Let d be a non-negative integer. We can construct the real vector space

d i=1 L R = L d R .
It is obviously a space of dimension dn, but also a free L R -module of rank n. Since each of the summand is an Euclidean space with the canonical norm, we can endow this space with a natural Euclidean structure by setting:

x, y = Example. Let us consider the most simple case, where L = Q, that is, a number eld of absolute degree . Then by de nition of the tensor product L ⊗ R R ∼ = R. There is a unique embedding into C (mapping 1 on 1, that is the identity map), and as such the canonical norm is simply x = √ x x = |x|, the absolute value. Thus, when taking L d R ∼ = R d the previous construction yields the product: x, y = ∑ d i=1 x i y i , which is nothing more than the usual scalar product in the canonical basis of R d .

Remark. By linearity, this de nition is equivalent to set:

x, y = ∑ σ:L→C σ(x) T σ(y)
when extending the embeddings σ : L → C pointwisely over vectors: σ(x) = (σ(x 1 ), . . . , σ(x d )).

Now that we have de ned a natural Euclidean metric on this space, we can twist it to get all the metrics compatible with the underlying algebraic structure. Recall that in the case where L = Q, once the standard scalar product is given, one can de ne the notion of self-adjoint operators, each of them de ning a new Euclidean metric on the space. We can emulate this construction in this more general case.

. . (Additive) Humbert forms

There have been a certain number of attempts to develop a notion generalization of quadratic forms in high degree. In the s, Paul Humbert presented two papers ([ ] and [ ]) about the reduction theory of quadratic forms over number elds. It appears that his notion is not strictly speaking a form but a tuple of quadratic forms, which we will call Humbert forms in the sequel, to follow the term coined by Icaza in [ ].

Remark. We only describe here the notion of additive Humbert forms (as opposed to multiplicative Humbert forms), as this are the ones we will get interested in, from the reduction point of view. We let the interested reader refer to [ ] for a precise account on multiplicative Humbert forms and their relation to higher degree Voronoï theory.

. . . . Humbert forms by twisting the embeddings Recall that a positive Hermitian (resp. Symmetric) quadratic form A of rank d is said to be positive de nite if for all non-zero x ∈

C d (resp. x ∈ R d ), we have Ax, x > 0, where •, • is the canonical inner product of C d (resp. R d ).
To x the notations of this section, let n, d be two non-negative integers. We take a number eld L of degree n, with r real embeddings and c complex ones. Set V to be the space L d R .

De nition . . . A Humbert form A of rank d over L is a d-tuple (A σ ) σ:L→C consisting of r positive de nite symmetric forms of rank d and s positive de nite Hermitian forms of rank d. The evaluation of A on vectors x, y ∈ L d R is:

A(x, y) = ∑ σ:L→C A σ (σ(x), σ(y)).
Therefore, through the structure isomorphism given by the Archimedean embedding giving

L d R ∼ = (R d ) r × (C d ) c
, a Humbert form can be seen as a quadratic twist of the canonical extension of the T 2 inner product at each of the embeddings. . . . . Matrix representation Let us x a basis of L d R and thus of each of the image σ(L d R ) at each embedding. We x a Humbert form A = (A σ ) σ:L→C . By the choice of the basis, each of the quadratic form A σ can be encoded as a matrix, which is Hermitian positive de nite for the complex embeddings and Symmetric positive de nite for the real ones. If we also denote by (A σ ) σ:L→C this matrix representation, we have for any x, y ∈ L d R :

A

(x, y) = ∑ σ:L→C σ(x) T A σ σ(y) ( . )
so that the canonical norm of L is exactly the evaluation of the Humbert form (Id 1 ) σ:L→C , and its extension to L d is the form (Id d ) σ:L→C . Given a Humbert form A = (A σ ) σ:L→C given as a tuple of complex matrices, remark that for any 1 ≤ i, j ≤ d, the n-tuple s = ((A σ ) i,j ) σ:L→C de nes uniquely an element of L R , given by Σ -1 (s) for Σ being the Archimedean embedding. Hence, A can be encoded as a matrix A ∈ L d×d R and as such we have by Equation .:

A(x, y) = x, Ay .

This latest expression recovers the usual construction of the evaluation of a Hermitian or Symmetric quadratic form as a matrix.

Remark. We can go further in this analogy and characterize the matrices encoding Humbert forms, as the cone of matrices satisfying:

∀x, y ∈ L d R ,
x, Ay = Ax, y and x, Ax > 0 for any non-zero x ∈ L d R . This is equivalent to requiring that A = A † , where • → • † is the composition of the transposition with the unique involution lifting the complex conjugation through Σ -1 . We let the reader refer to the thesis of Camus [ ] for a more complete account on the relation between Humbert forms and the structure of the space End(L d R ).

. We now generalize the notion of Euclidean lattice to the higher-degree context. Recall from Section . that a lattice is a nitely generated free Zmodule Λ endowed with a Euclidean structure on its real ambient space Λ ⊗ Z R. To extend this de nition we want to replace the base-ring Z by the ring of integers O L of a number eld L. However, the freeness condition is actually a bit too strong. Indeed we have seen that in a tower of eld . . Relative structure . . . . Direct Image of an algebraic lattice. Let us consider Q ⊂ K ⊂ L a tower of number elds, and denote by Z ⊂ O K ⊂ O L their respective ring of integers. Let Λ be a lattice over the top ring O L . We have seen in Section . that as a module, the underlying module of Λ can be viewed as an O K module. We can go further by descending the whole Euclidean structure to make it compatible with the algebraic structure on O L . More precisely for an O L -lattice (Λ, (A σ ) σ ) we de ne its direct image over O K as being (Λ, (A σ ) σ ) where for each embedding σ : K → L we have for any x, y ∈ Λ:

Q ⊆ K ⊆ L,
A σ (x, y) = ∑ σ:L→C A σ (x, y),
where the sum is taken over the [L : K] embeddings σ : L → C such that the restriction of σ to K is σ .

Remark. When viewing an algebraic lattice as a Hermitian vector bundle over an arithmetic curve, this descent corresponds exactly to performing a Weil restriction of scalar (or Weil descent). . . . . Direct Image to a Euclidean lattice. In particular when descending all the way through the base of the tower Z, we can de ne the direct image Λ * of Λ over Z, where Λ is seen as a projective-and therefore free-module over Z with the Euclidean structure being given by:

x| 2 = ∑ σ:L→C A σ (x, x),
for any x ∈ Λ, the sum being taken over all the [L : Q] embeddings. . . . . An important example: ideal lattices. Let L be a number eld, and a an ideal of O L . Then a is by de nition a projective module over the Dedekind domain O L . Equipped with the canonical norm described in Section . , it is a O L -lattice. Its rank over O L is of course , as

a ⊗ O L L R ∼ = L R ,
and its direct image a * is an Euclidean lattice of rank [L : Q]. It is called the ideal lattice attached to a.

Ideal lattices have become ubiquitous in the context of modern cryptography with the rise of so-called lattice based cryptography. We let the reader refer to Chapter , for a more detailed account on the use of such lattices.

Example (An ideal over a small cyclotomic). Let L = Q[ζ 8 ] the cyclotomic eld of conductor 8 and thus of degree 4 over Q. For notational simplicity, from now on, we denote ζ = ζ 8 . The Archimedean embeddings of L to C are given by the σ i : ζ → ζ i for i = 1, 3, 5, 7. Let us take the ideal a generated by the element g = 1ζ. Then we have:

N(a) = N L/Q (g) = 2. Since O L = Z[ζ],
a simple choice for a Z-basis of a is given by:

a = (1 -ζ) Z ⊕ ζZ ⊕ ζ 2 Z ⊕ ζ 3 Z = (1 -ζ)Z ⊕ (ζ -ζ 2 )Z ⊕ (ζ 2 -ζ 3 )Z ⊕ (ζ 3 + ζ)Z.
The corresponding Euclidean structure is then given by the Gram matrix:

A =       8 -4 0 4 -4 8 -4 0 0 -4 8 -4 4 0 -4 8      
by applying the descent formulas of previous section. For instance the canonical norm of the element (1

-ζ) is 1 -ζ = 1 -ζ, 1 -ζ 3 , 1 -ζ 5 , 1 -ζ 7 T 1 2 2 = 2 √ 2.
. .

Generalized invariants of algebraic lattices

The geometric invariants attached to a Euclidean lattice are of course generalizable to the algebraic setting. In all of the following we consider an O L -lattice (Λ, A).

. . . . Covolume. We can extend the de nition of covolume of the lattice. We could give an algebraic de nition to the covolume of an algebraic lattice by noticing that the volume of the fundamental cell R n /Λ was obtained by taking the determinant of the Gram-matrix of any basis of Λ. We can do the same in the algebraic case, by taking this time the algebraic norm of this determinant -which is O L -valued. However on the contrary to Z modules, an algebraic lattice can not be solely described by a basis, but instead by a pseudo-basis. Let us give an intuition of the impact of the phenomena on the covolume. To do so, consider a basis v 1 , . . . , v d in L d and a an ideal of

O L . Construct two modules M = v 1 O L ⊕ • • • ⊕ v d O L and M = v 1 O L ⊕ • • • ⊕ v d-1 O L ⊕ v d a. Since a is contained in O L , we have M ⊂ M.
Hence M is denser than M , in the sense that it contains "more points". As such, the covolume of M should be smaller than the covolume of M . Intuitively, M contains = M M more points than M , as M decomposes in a disjoint union of copies of M indexed by the split of the exact sequence 0 → M → M → M M → 0. Moreover, remark that the quotient M M has cardinality O L a , that is N(a). Hence the covolume of M should be N(a) larger than the covolume of M, yielding

covol M = N(a) covol M = N(a)N L/Q det b i † b j .
The same reasoning extends to arbitrary projective modules, since we can represent it in the same way as M with a being its Steinitz class (see Theorem . . for the de nition of this class). All in all we get the following de nition (linearly twisted by A, to accommodate the fact that we can use an arbitrary Euclidean metric instead of the canonical one):

De nition . . . Let L be a number eld and (Λ, A) be an O L -lattice of rank d, described by a pseudo-basis ((v 1 , a 1 ), . . . , (v d , a d )). Its covolume is de ned by

covol Λ = N(a 1 • • • a d ) N L/Q (det[G]),
where G is the Gram matrix of v 1 , . . . , v d , that is G = V † AV for † the involution presented in Paragraph . . . . Its degree is de ned as the logarithm of its covolume.

It is linked to the covolume of the direct image over Z as follows:

covol(Λ * ) = covol(Λ)|∆ L | 1 2 ,
by de nition of the absolute discriminant given in Section . . . In particular we have: For any a of O L , then

covol(a * ) = N L/Q (a)|∆ L | 1 2 .
Example (An ideal in a small cyclotomic). Let us return to the case of the ideal a generated by (1ζ) in the cyclotomic eld L of conductor 8. A pseudobasis of this ideal is ((1ζ), O L ), as being a principal ideal. Thus its covolume for the canonical norm is

covol a = N(O L ) N L/Q (ζ † ζ) = 1 × N L/Q (ζ 3 -ζ + 2) = 2.
Remark that this result is consistant with the fact that another choice for the pseudo-basis of this lattice which is (1, a), which would give:

covol a = N(a) N L/Q (1 † 1) = N(a) × √ 1 = 2.
We have seen that the direct image of this lattice over Z is isometric to the lattice (Z n , A). Hence its covolume is covol a

* = √ det A = 32. Since the discriminant ∆ of L is , we easily check that covol(a * ) = 32 = 2 × √ 256 = N L/Q (a)∆ 1 2 L .
. . . . Minima of the lattice The minima are de ned in the same way that for usual Euclidean lattice, that is:

λ 1 (Λ) = min v∈Λ,x =0 v Λ
and by taking the direct image of an O L -lattice, we can bound the rst minima by the correct normalization of its covolume:

Remark. In particular, we can de ne a generalization of the Hermite constant for algebraic lattices and thereof for Humbert forms. It should nonetheless be noticed that this constant depends on the Steinitz class of the modules (or the so-called A-invariant in the work of [ ]): . As for Euclidean lattices, we want to approximate as e ciently as possible short vectors of algebraic lattices. Therefore, it is natural to wonder if a generalization of the algorithms presented in Chapter can be provided to tackle this problem. Of course, we can always descend an algebraic lattice to Z by taking its direct image and reduce the corresponding lattice. But doing so, we are multiplying its rank by the absolute degree of the eld where it is de ned! The work of Fieker and Stehlé [ ] gives a precise analysis of the reduction algorithm for algebraic lattices, using this technique. Hence even small rank lattices can become very di cult to computationally reduce if the absolute degree of the eld is too high. In particular, this is also the case for ideal lattices over large degree cyclotomic elds, which are now ubiquitous in cryptography . In , Chris Peikert, in a survey on ideal lattice cryptography actually asks the following question [ ]: For worst-case problems on ideal lattices, especially in cyclotomic rings, are there algorithms that substantially outperform the known ones for general lattices? Being able to e ciently reduce algebraic lattices is then a matter of interest, not only in computational number theory, but also for cryptanalytical purposes.

γ d,a = max Λ λ 1 (Λ) (covol Λ)

. . Generalizing the LLL algorithm

In the following let us x a number eld L of absolute degree n and an O L -lattice (Λ, A) of rank d. Without loss of generality and to ease the presentation of algorithms, we can suppose that the operator A is the identity operator. Let us suppose that Λ is given by a pseudo-basis (v i , a i ) 1≤i≤d where v i ∈ L d and a i are fractional ideals of L.

As the algorithm is a basic building block of all reduction procedures, it is natural to wonder if an algebraic generalization is possible, which would not directly reduce a lattice by descending it over Z. A rst step in this

We give a longer account on the cryptographical perspectives of algebraic lattices in the third part of this manuscript. direction comes from the work of Fieker and Pohst in [ ], which aims at reducing pseudo-bases. The blueprint of this reduction is given as pseudocode in Algorithm . We voluntarily let the meaning of what is a reducedpseudo-basis unclear for the moment and discuss it afterward. The reduction mimics the algorithm but it replaces the canonical norm over R d by the canonical norm of L d .

Algorithm -Prototype of reduction of [ ]

Input : ((v 1 , a 1 ), . . . , (v d , a d )) a pseudo-basis of a rank d lattice Λ Output : A "reduced" basis of Λ k ← 2 while k ≤ d do (v * 1 , . . . , v * d ) ← Orthogonalize(v 1 , . . . , v d ) for j = k -1 downto 1 do Find x ∈ a k-1 a -1 k which minimizes x - v * k-1 † v k v * k-1 † v * k-1 L/Q v k ← v k -xv k-1 end for if δ v k-1 * L/Q ≤ (v * k ) + v * k-1 † v k v * k-1 † v * k-1 • v * k-1 L/Q then k ← k + 1 else Swap(v k-1 , v k ) Swap(a k-1 , a k ) k ← max(k -1, 2) end while return ((v 1 , a 1 ), . . . , (v d , a d ))
The orthogonalization process is then performed in the exact same way as in the rational case: denoting the orthogonalized family obtained from (v i ) 1≤i≤d by v * i as a shorthand for the orthogonal projection over the Lvector space spanned by the vectors v 1 , . . . , v i-1 . The computation is done inductively as follows: v * 1 = v 1 and for all 1 < i ≤ d, and

v * i = v i - i-1 ∑ j=1 v i † v * j v * j † v * j v j ,
the vector-vector product being here understood as a duality bracket. This algorithm can be modi ed to reduce according to various notions of reduction, depending on whether we choose to consider the canonical norm or the algebraic norm. Indeed, line of Algorithm corresponds to the so-called Lovàsz condition in the original algorithm and should be adapted to our algebraic context. However, as mentioned by the authors, it can be modi ed in multiple ways. For instance, we can lift it using either the algebraic norm:

∀i, δN L/Q (v k-1 * ) ≤ N L/Q (v * k ) + v * k-1 † v k v * k-1 † v * k-1 • v * k-1 ,
or twist it with the norm of the ideals of the pseudo-basis so that it corresponds to the condition stated on covolumes in Section . . :

∀i, δN(a i )N L/Q (v k-1 * ) ≤ N(a i-1 )N L/Q (v * k ) + v * k-1 † v k v * k-1 † v * k-1 • v * k-1 .
The size-reduction itself can also be made to deal with algebraic norms, if looking for an element x such that

N L/Q x - v * k-1 † v k v * k-1 † v * k-1 is minimal.
Using the same arguments as for the traditional algorithm, one can prove that the generalized reduction terminates. It should, however, be noticed that the size-reduction step requires to nd exactly a closest vector in O L . Indeed, over Z, this step aims at nding the closest lattice vector in a coset of the form x + Zv. In the algebraic case, this translates into seeking for the closest vector in a coset of the shape x + O L v. Up-to-our knowledge, no exponential speedup on calling a oracle on the corresponding Euclidean lattice (O L ) * exists to solve such instances. Even in the case where we are able to nd such an element x, we can not get any bound on the size of the vectors output by the reduction process. To nd such an estimate, as in the rational case, one would need that

x - v * k-1 † v k v * k-1 † v * k-1 L/Q < δ < 1, or N L/Q x - v * k-1 † v k v * k-1 † v * k-1 < δ < 1.
This is not the case in general, even for quadratic elds, as soon as the discriminant is too large. However, for elds satisfying such a condition, we can adapt quite straightforwardly the proof of the reduction. It appears that this condition implies that the eld is norm-Euclidean.

m L = sup x∈L inf y∈O L |N L/Q (x -y)|.
Proof. Let L be a number eld such that m L > 1. By de nition,

m L < inf{ε > 0 | ∀x ∈ L ∃γ ∈ O L |N L/Q (x -γ)| < ε}
. Then, there exists α, β ∈ O L such that for any x ∈ L:

|N L/Q (β -αx)| > |N L/Q (β)|
contradicting the de nition of norm-Euclideanity.

From this theorem one can easily nd out which imaginary quadratic elds are norm-Euclidean: Lemma . . . Let d > 0 be a squarefree non-negative integer. Then the imaginary quadaratic eld

Q[i √ d] is norm-Euclidean i d ∈ {1, 2, 3, 7, 11}.
Proof. Direct, by computing the Euclidean cell

sup x∈L inf y∈O L |N L/Q (x -y)|.
. . . . Principality of norm-Euclidean domains The arithmetic of ideals in a norm-Euclidean domain is very easy, indeed, every ideal is principal: Lemma . . . Let R be an Euclidean domain, then any ideal a is principal. Proof. Let a be an ideal of R. Then consider a non-zero element x ∈ a for which the stathsme f is minimal, which always exists since f is valued in N \ {0}. Suppose that a is not generated by x. Then there exists y ∈ a \ xR. But then there exist q, r ∈ R so that y = xq + r, with f (r) < f (x) or r = 0. By hypothesis on y, r can not be 0 and it belongs to a as being equal to yxq, contradicting the minimality of f (x).

Therefore, any projective module over a Euclidean ring is free, and a pseudo-basis is nothing more than a basis in the usual sense.

. .

Generalizing the LLL reduction to the norm-Euclidean case

In the case where the eld L is norm-Euclidean, we can perform the reduction with the algebraic norm, that is by adaptating the reduction process of Fieker and Pohst. The corresponding code is given in Algorithm .

Algorithm -Norm Euclidean Reduction

Input : (v 1 , . . . , v d ) a basis of a rank d O L -lattice Λ. Output : A "reduced" basis of Λ. k ← 2 while k ≤ d do (v * 1 , . . . , v * d ) ← Orthogonalize(v 1 , . . . , v d ) for j = k -1 downto 1 do Find x ∈ O L which minimizes N L/Q x - v * k-1 † v k v * k-1 † v * k-1 v k ← v k -xv k-1 end for if δN L/Q (v k-1 * ) ≤ N L/Q v * k + v * k-1 † v k v * k-1 † v * k-1 • v * k-1 then k ← k + 1 else Swap(v k-1 , v k ) k ← max(k -1, 2) end while return (v 1 , . . . , v d )
This is the algorithm given by Napias in [ ]. We can adapt the results presented in Theorem . . . Lemma . . . Let L a number eld such that O L is norm-Euclidean and Λ be an O L -lattice of rank d. Then, for any basis (v 1 , . . . , v d ), reduced by Algorithm with parameter m L < δ < 1, we have:

covol(v 1 O L ⊕ • • • ⊕ v i O L ) ≤ 1 δ -m L k(d-k) 2 covol Λ k d .

This algorithm has been enhanced by Camus in his PhD thesis [ ], using similar techniques as [ ]. The corresponding complexity for a quadratic

number eld is a O   d 4 log   m L ∏ d-1 i=1 γ -r d 2 O L ,r B    
, with B a bound on the bitsize of the coe cients of the imput basis.

The next part of this manuscript aims at providing sound and practical techniques for the reduction of general algebraic lattices, going further than the reductions above mentioned for norm-Euclidean lattices.

Part II A L G O R I T H M I C R E D U C T I O N O F A L G E B R A I C L AT T I C E S

This second part aims at developing algorithmic methods to perform the reduction of algebraic lattices. On the one hand we are interested in designing sound and certi able reductions techniques. On the other hand we also desire to improve the e ciency of the reduction to tackle larger and larger examples.

Eventually we demonstrate an application of such reduction algorithms to solve a classical problem in e ective number theory, the principal ideal problem.

C E R T I F I E D L AT T I C E R E D U C T I O N . ,
. .

On the approximation of algebraic lattices

Let L = (Λ, A) be an algebraic lattice over the ring of integers O L of a number eld L. By de nition of algebraic lattices, to practically compute the inner product of two vectors u, v ∈ Λ, we need to be able to compute the embeddings L → C. Hence, this requires to compute the roots of the de ning polynomial of L, meaning that in practice that we look for a suciently precise approximation of them. Suppose that we want to e ectively reduce L. By the discussion conducted in the previous chapter, we can take its direct image L * = (Λ * , A ) over Z and reduce it . However, the corresponding inner product A is a priori real-valued and its computation is subjected to the approximation we made when computing the embeddings. Up-to-our knowledge, no satisfactory estimation of the precision required on this inner product to reduce ideals, and thereof algebraic lattices, appears in the literature. Some authors, like Belabas [ ], suggest using some arbitrary approximation and let the reduction operate. However in this setting, the outputted basis has no reason to be -reduced, as mentioned for instance by Cohen in [ ]. In some cases, this aspect is not an issue since the reduction was only used to shrink the size of coe cients involved in some computations, but one can't assert any bounds on the norm of elements appearing in these somewhat reduced-bases.

But in the cases where we need to ensure that the output basis is reduced, we need to be able to certify the reduction. This implies to control the propagation of approximations during the reduction. A possible strategy to algorithmically tackle this issue is to use Interval Arithmetic.

More precisely, we would then need to lift the reducted basis to a pseudo-basis of the original lattice L. This computation can be done in polynomial time by adapting the techniques of [ ]. Buchmann gives in [ ] a bound on the required precision to achieve this goal by using a direct approximation of the input basis. However, this bound is computed in terms of a quantity called the defect that can be very large and also involves the rst minimum of the lattice. Thus it can not be computed independently of the geometry of the input lattice.

. .

On Interval arithmetic

Interval Arithmetic is a representation of reals by intervals-whose endpoints are oating-point numbers-that contain them. Arithmetic operations, in particular the basic operations +, -, ×, ÷ can be rede ned in this context. The main interest of this representation lies in its certi cation property: if real numbers are represented by intervals, the interval resulting from the evaluation of an algebraic expression contains the exact value of the evaluated expression.

For some authors, Interval Arithmetic was introduced by R. Moore in in his Ph.D. thesis [ ]. For others, it can be dated back to , in an article of T. Sunaga [ ] which describes an algebraic interpretation of the lattice of real intervals, or even sooner in as a proposal in the Ph.D. thesis [ ] of R.C. Young at Cambridge. Its main asset-calculating directly on sets-is nowadays used to deterministically determine the global extrema of a continuous function [ ] or localizing the zeroes of a function and (dis)proving their existence [ ]. Another application of Interval Arithmetic is to be able to detect lack of precision at run-time of numerical algorithms, thanks to the guarantees it provides on computations. This can, in particular, be used to design adaptive-precision numerical algorithms.

We aim at transforming and generalizing the algorithm into an adaptiveprecision version, so that it can reduce arbitrary real lattices-and in particular, the direct image over Z of algebraic lattices-and is forced to follow a certi ed ow of execution. More precisely, it uses Interval Arithmetic to validate the size-reduction and exchange steps that occur within the reduction process.

. . Practical reduction and behavior of

Current implementations of often work with low precision approximations of the Gram-Schmidt vectors in order to greatly speed-up the computations. Indeed, the algorithm works surprisingly well even with such reduced precision, even if some care needs to be taken to avoid in nite loops. Moreover, once the result is obtained, it can be veri ed e ciently as shown in [ ].

The certi ed algorithms presented in this chapter allow an alternative strategy where we not only certify that the end-result is a reduced basis but also that the algorithm followed a valid computation path to reach it. This strongly deviates from other approaches that have been taken to obtain guaranteed lattice reduced basis. At rst, this may seems irrelevant. After all, one might claim that a basis satisfying the end conditions of is what is desired and that the computation path doesn't matter. However we have seen in Chapter , that the -reduction tends to select the best bases among the set of reduced bases and presents very peculiar behavior, such as the phase transition e ect described in Paragraph . . . . This argues in favor of trying to follow the algorithm de nition exactly to better understand the phenomenon. In particular, this option might be invaluable for experiments performed toward analyzing this quality gap and explore the peculiarities of behavior.

. :

To begin with, we go back to the algorithmic reduction of Euclidean lattices and give a short review of the methods used to greatly improve the e ciency of the algorithm by using oating-point representation of the internal values.

. .

Floating point representation

The total cost of the algorithm is dominated by the computation to handle arithmetic on rational values. A rst idea of De Weger [ ] to overcome this issue is to avoid the use of denominators by multiplying all the quantities by their common denominator. This is slightly more e cient in practice but doesn't improve the asymptotics. Another idea is to remark that the norms of the rational values remain small and to try to use approximations instead of exact values. However, directly replacing rationals in the algorithm by oating-point approximations leads to severe drawbacks. The algorithm might not even terminate, and the output basis is not guaranteed to be -reduced.

The rst provable oating-point version of the algorithm is due to Schnorr in [ ], with complexity O d 4 log(B)M(d + B) , for B being a bound on the bitsize of the coe cients of the input lattice and d its rank. One of the key ingredients to achieve this reduction is to slightly relax the de nition of the size-reduction, in order to compensate for the approximation errors introduced by the use of oating-point arithmetic. We call admissible any parameters (δ, η) satisfying 1/4 < δ < 1, and 1/2 < η < √ δ and de ne:

De nition . . ((δ, η)-reduction). Let (δ, η) be admissible parameters. A basis B of a lattice is said to be (δ, η)-LLL-reduced if the following condition is satis ed:

∀i < j, v j , π i (v i ) ≤ η π i (v i ) 2 (Approximate size-reduction condition) ( .
) together with the Lovász condition, which is kept unchanged from De nition . . .

Using naive multiplication, the cost of Schnorr's algorithm is cubic in B.

The introduction of approximate size reduction removes the need to know with extreme precision values close to half-integers. Instead, approximate size reduction of such values can be achieved by rounding either up or down in an arbitrary (possibly randomized) manner. In our pseudo-code, we use a function called η-C I to achieve this rounding, returning an integer at distance at most η of the function's argument.

. .

The L 2 algorithm

The 2 algorithm is a variant of Schnorr-Euchner version [ ] of

. By contrast with the original algorithm, 2 computes the coe cients on the y as they are needed instead of doing a full orthogonalization at the start. It also uses a lazy size reduction inspired by the Cholesky factorization algorithm. These optimizations yield an improved lattice reduction with running time O d 5 B(d + B ).

As usual in lattice reduction, while performing the Gram-Schmidt orthogonalization of B, we also compute QR-decomposition of B into B * • M where B * is the matrix representing the (π i (v i )) 1≤i≤d , and M is the upper unitriangular matrix, whose coe cients with j ≥ i are M i,j = v j ,π i (v i ) π i (v i ) 2 . Thus, the Gram matrix associated to the basis, i.e., G = B T B satis es:

G = M T • B * T • B * • M = M T • D • M
where D is a diagonal matrix whose entries are π i (v i ) 2 . We denote by R the matrix D • M, and thus have

G = R T • M = M T • R.
We give the pseudo-code of the Lazy Size-Reduction procedure as Algorithm and of the 2 algorithm as Algorithm . Both use classical formulas relating R, M and B * to perform the computations.

Algorithm -η-LazyRed

Input : Initial basis B = (v 1 , . . . , v d ), with G, R and M. An integer 1 ≤ k ≤ d.

Output

: Size-reduces v k , updates G, R, M and returns s (k) done ← false while done = false do for j = 1 to k -

1 do R k,j ← G k,j ; for i = 1 to j -1 do R k,j ← R k,j -M j,i R k,i M k,j ← R k,j /R j,j ; end for s (k) 1 ← G k,k ; for j = 2 to k do s (k) j ← s (k) j-1 -M k,j-1 • R k,j-1 R k,k ← s (k) k if (max j<k |M k,j |) ≤ η then done ← true else for i = k -1 downto 1 do X i ← η-Closest-Integer(M k,i ) for j = 1 to i -1 do M k,j ← M k,j -X i M i,j end for v k ← v k -∑ k i=1 X i v i ; Update G accordingly end if end while Algorithm -L 2 Parameter : δ ∈ (1/4, 1), η ∈ (1/2, √ δ). Input : Initial basis B = (v 1 , . . . , v d ) Result : A (δ, η)--reduced basis Compute G = G(v 1 , . . . , v d ) in exact integer arithmetic R 1,1 ← G 1,1 k ← 2 while k ≤ d do Apply size reduction η-L R (k) k ← k while (k ≥ 2 and δR k-1,k-1 > s k k-1 ) do k ← k -1 R k,k ← s k k if k = k then for i = 1 to k -1 do M k,i ← M k ,i ; R k,i ← R k ,i R k,k ← s k k Insert v k at position k (before v k ) and update matrix G accordingly end if k ← k + 1 end while return (v 1 , • • • , v d )
. . . . Precision required. The precision required by the 2 -Algorithm is

d log (1 + η) 2 (δ -η) 2 + + o(d)
bits for any > 0, i.e., almost linear in the dimension of the lattice. Moreover, as discussed in [ ], it appears that-even though this bound can be shown to be sharp by speci c examples-experiments indicate that the number of bits required on average is, in fact, lower. This phenomenom is well-known and is often used in existing algorithms and softwares in the form of a compute-and-verify paradigm. For example, this is default strategy of the well-known FPLLL [ ]. It relies on the fact that verifying that a lattice basis is indeed reduced is much less costly than the reduction itself, as shown in [ ]. In addition, it is necessary to take several conservative measures in order to prevent the implementation to enter potentially in nite loops.

The approach we propose deviates from this paradigm. Instead of guaranteeing the end-result, we want to make sure that the whole computation follows the mathematical de nition of the algorithm. With low-precision approximations, it is unclear how this could be done. However, intervalarithmetic o ers a neat solution to achieve this goal.

. Interval arithmetic is a representation of reals by intervals that contain them. For instance, one can specify a value x with an error by giving an interval of length containing x. For example, the constant π can be represented with an error of 10 -2 by the interval [3.14, 3.15]. Interval arithmetic is crucial in the context of certi ed numerical computations, where reals can only be represented with nite precision. For more details, the interested reader can consult an extensive reference, such as [ ].

In the following, we denote by x a closed interval [x -, x + ]. We de ne its diameter as the positive real x +x -and its center as the real 1 2 (x + + x -). Given a real-valued function f (x 1 , . . . , x n ) an interval-arithmetic realization of f is an interval-valued function F such that the interval F(x 1 , . . . , x n ) contains all the values f (x 1 , . . . ,

x n ) for (x 1 , . . . , x n ) in x 1 × • • • × x n .
If F always returns the smallest possible interval, it is called a tight realization, otherwise it is called loose. In practice, tight realizations can only be achieved in very simple speci c cases. However, even a loose realization is su cient to certify the correctness of a computation.

Another important property of interval arithmetic is that it can be used to compare numbers in a certi ed way, as long as the intervals that represent them are disjoint.

. . Some useful interval-arithmetic realizations . . . . Integral representation of xed length. A rst convenient way to represent reals at nite precision is to use integers as an approximate representation.

De nition . . (Integral representation of reals)

. Let x ∈ R be an arbitrary real number and n ≥ 0 a non-negative integer. De ne an integral representation at accuracy n as an interval of diameter 2:

x n = [X n -1, X n + 1]
together with a guarantee that 2 n x belongs to x n . This representation is very compact, since it only requires to store the center X n of the interval using n + log x bits. However, computing with this form of representation is not convenient. As a consequence, we only use it to represent immutable values and we convert to a di erent representation for computations. The reason for using the interval [X n -1, X n + 1] of diameter 2 rather than [X n -1/2, X n + 1/2] (of diameter 1) is that when 2 n x is very close to a half-integer, it remains possible to easily provide a valid value for X n without computing extraneous bits of the representation of x.

We use here the denomination of "accuracy" instead of "precision" to avoid confusions with the oating-point precision as de ned in Paragraph . . . .

x -, x + + y -, y + = x -+ -y -, x + + + y + x -, x + -y -, y + = x ---y -, x + -+ y + x -, x + × y -, y + = min -(ρ), max + (ρ) where ρ = x -y -, x + y -, x -y + , x + y + x -, x + -1 = min -1 x + , 1 x -, max + 1 x + , 1 x -
+ + , + -are here respectively the + operator with rounding up or down. The same goes for the -+ , --, min -, max + operators. . . . . Fixed-point representations. In the context of lattice reduction, it is useful to compute linear combinations with exact integral coe cients. In order to do that with approximate values initially given by centered integral representation, it is possible to use a xed-point representation.

De nition . . (Fixed point representation of reals). Let x ∈ R be an arbitrary real number and n ≥ 0 a non-negative integer. De ne a xed-point representation at accuracy n of radius δ as an interval:

x n = [X n -δ, X n + δ]
together with a guarantee that 2 n x belongs to x n .

It is easy to add or subtract such intervals by doing the computation on the center and by adding the two radii. It is also easy to multiply by an exact integer by multiplying the center by the integer and the radius by its absolute value. Integral representations are a special case of xed-point representations, with radius equal to 1.

. . . . Floating-point representation. Another way to handle real values is to use oating point representations of the two bounds of each interval. For example, if we denote by x n and x n respectively the largest oatingpoint number below x and the lowest oating-point number above x written with n bits, the tightest oating-point representation of x with n bits of precision is the interval

I n (x) = [ x n , x n ].
With such a representation, it becomes possible to create a realization of the elementary operations by using careful rounding when computing approximations of the bounds of the resulting interval, as shown in Figure .  When speaking of the precision of such a representation, we simply refer to the common oating-point precision of the upper and lower bounds.

Once the elementary operations are available, they can be used to implement certi ed versions of any function that can classically be computed with oating point arithmetic.

. The need to reduce lattices given by approximations, especially for numbertheoretic applications as been known for long. Using interval arithmetic, it becomes possible to get ner control on the precision required to perform the lattice reduction, even with approximate lattices.

. . Approximate representation of a positive-de nite matrix

A real-valued matrix can easily be represented with the integral representation from De nition . . , using the same accuracy for all of its entries.

De nition . . (Matrix integral representation)

. Let A = (a i,j ) i,j ∈ R d×d be an arbitrary real matrix of dimension d and n > 0 be a xed positive integer.

A matrix of intervals

A n = (a i,j n ) (i,j)∈[1 ••• d] 2 ,
where each a i,j n is an integral representation of a i,j is said to integrally represent A at accuracy n.

We may omit the subscript n when the accuracy is clear from the context. Given a matrix A, and a matrix B ∈ A n , there exists a unique d × d matrix ∆ with entries in [-2, 2]

such that B = 2 n A + ∆.
In particular, we may apply this representation to symmetric matrices. In that case, we obtain the following useful lemma: Lemma . . . Let S = (s i,j ) i,j ∈ S d (R) be a symmetric matrix of dimension d and S n an integral representation of S at accuracy n. Then, for any symmetric matrix S in S n , we have:

2 n λ d (S) -2d ≤ λ d (S ) ≤ 2 n λ d (S) + 2d,
where λ d (T) denotes the smallest eigenvalue of a d-dimensional symmetric matrix T.

Proof. This is a direct consequence of Weyl's inequalities for Hermitian matrices and of the relation S = 2 n S + ∆, where ∆ is real symmetric with entries in [-2, 2]. Note that the eigenvalues of ∆ all belong to [-2d, 2d].

. . Representation of lattices

In order to represent arbitrary lattices, we rst need a description of their ambient space. We simply describe the ambient space V of dimension d by providing a basis γ = (γ 1 , . . . , γ d ). Then, the scalar product •, • on V can be encoded by a Gram matrix

G γ = γ i , γ j (i,j)∈[1 ••• d] 2 .
When the Gram matrix G γ is integral, this already is a standard description of the lattice Γ spanned by γ. This representation appears in particular in [ , Proposition . . ]. We now extend this in order to represent bases and generating families of arbitrary sublattices of Γ. Let Λ be a rank r ≤ d sublattice of Γ given by a generating family = 1 , . . . , p . Since any vector in belongs to Γ, it can be expressed with integral coordinates in the basis γ. As a consequence, we can represent by a p × d integral matrix L. Moreover, the knowledge of G γ allows us to easily compute the scalar product of any pair of vectors in Λ.

All this leads to the following de nition:

De nition . . (Approximate representation of a lattice). Let G γ and L be as above and n be a non-negative integer. Denote by G the matrix of centers of an integral representation G γ n at accuracy n of the Gram matrix G γ . Then the pair (G, L) ∈ Z d×d × Z p×d of integral matrices is said to represent at accuracy n the lattice Λ in the basis γ of Γ.

. . . . Computation of the inner product in Interval Arithmetic. Let a and b be two vectors of Λ described by their vectors A and B of coordinates in the basis γ. We know that:

a, b = A T • G γ • B.
Thus:

2 n a, b = A T • G • B + A T • ∆ • B, where |A T • ∆ • B| ≤ ∑ i |A i | ∑ i |B i | .
This directly gives an interval representation of a, b .

. . Lattice reduction of approximate lattices

Suppose now that the Gram matrix

G γ = γ i , γ j (i,j)∈[1 ••• d] 2 represent-
ing the inner product of the ambient space Γ ⊗ Z R in the basis γ is given indirectly by an algorithm or an oracle O γ that can compute each entry at any desired accuracy. We can restate the de nition of a reduced basis in this framework as:

De nition . . ((δ, η)-reduction). Let (δ, η) be admissible parameters. Given an integral matrix L ∈ Z p×d which describes the vectors of a basis of a lattice Λ in the basis γ, we say that (G γ , L) is a (δ, η)-reduced basis of Λ if and only if there exists an n 0 > 0 such that for any n ≥ n 0 there exists a pair (G n , L), where G n is an integral representation of G γ at accuracy n, which is a (δ, η)-reduced basis.

The computational problem associated with reduction theory can then be written as:

Problem (Lattice Reduction for approximate representation). Let δ, η be admissible parameters. The reduction problem for approximate representation if formally de ned as:

Input: Algorithm-or oracle-computing G γ at arbitrary precision and an integral matrix L ∈ Z p×d that describes the vectors of a generating family of a lattice Λ in the basis γ.

Output: Basis L of Λ such that (G γ , L ) is a (δ, η)-reduced basis in the sense of De nition . . . Note that using interval arithmetic it su ces to check the (δ, η)-reduction condition at accuracy n 0 to be sure it holds at any larger accuracy. Indeed, an integral representation that satis es the condition can be re ned into a more precise integral representation by scaling up the integer representing the center by an adequate power of two. This re ned representation continues to satisfy the condition. . . . . Accuracy of representation and space complexity. Let (G n , L) be an integral representation of Λ, at accuracy n. Then, the magnitude of the entries of G is 2 n times the magnitude of the entries of G γ . Thus, G n can be encoded using O d 2 (n + log G γ max ) bits.

. In this Section, we adapt lattice reduction algorithms to our setting. More precisely, we represent the information related to Gram-Schmidt vectors by interval arithmetic using a oating-point representation as described in Paragraph . . . . For the representation of the lattice itself, we consider two cases: either the underlying Gram matrix is integral, or it is given by an approximate integral representation as in Section . . . In the latter case, our algorithm also asks for representations with higher accuracy until it is su cient to yield a reduced basis for the given lattice. The canonical case with the standard Euclidean scalar product is achieved by setting the Gram matrix to the (exact) identity matrix.

. .

Interval Arithmetic L 2 reduction with xed precision.

We rst consider the simpli ed case where the lattice representation is xed. It can be either exact or approximate with a given accuracy. In both cases, we x a basis γ = (γ 1 , . . . , γ d ) and a representation of a lattice Λ in this basis. It is respectively an exact integral representation (G, L) or an approximate representation (G n , L) at accuracy n of (G γ , L).

. . . . Using Interval Arithmetic in

. We now modify the 2 algorithm of [ ] in a few relevant places to make use of interval arithmetic instead of oating-point arithmetic for the Gram-Schmidt-related values. Since the description of the lattice Λ is already using intervals, it seems natural to use interval arithmetic in the lattice reduction algorithm. For completeness, when the input Gram matrix is exact, we make the updates to the Gram-Schmidt orthogonalized matrix used by explicit in the algorithm (except the simple displacements). This also emphasizes a subtle di erence with the case of an approximate input Gram matrix. Indeed, in that case, we update the -values but recompute the errors rather than relying on the interval arithmetic to do it. This is important to gain a ne control on the error growth during updates.

In addition, when using the technique from [ ] to be able to deal with lattices given by a generating family instead of a basis, we make a slightly di erent choice than in [ ]. Instead of moving the zero vectors that are encountered during the computation during the reduction to the start of the basis, we simply remove them. Note that with an approximate matrix, if we discover a non-zero vector whose length is given by an interval containing 0, it is not possible to continue the computation. This means that the accuracy of the input is insu cient and we abort. The core modi cation with interval arithmetic appears while testing the Lovász condition. If it is not possible to decide whether the test is true or false because of interval overlap, we also abort due to lack of precision. To be more precise, when testing the Lovász condition, we also need to check that the corresponding µ coe cient is indeed smaller than η. The reason for this is that, when called with insu cient precision, the Lazy reduction routine may fail to ensure that property.

In addition, if a negative number occurs when computing the norm of a vector, it means that the given Gram matrix is not positive-de nite and the algorithm returns an error accordingly.

Algorithm -η-IL R Input

: Initial basis L = (L 1 , . . . , L d ), precomputed (internal) Gram matrix Gram, interval matrices R and M, an integer 1 ≤ k ≤ d.

Output

: Size-reduce the k-th vector of L and update the Gram matrix Gram.

done ← false while done = false do for j = 1 to k -

1 do R k,j ← C T FP (Gram k,j ) for i = 1 to j -1 do R k,j ← R k,j -M j,i R k,i M k,j ← R k,j /R j,j ;
end for for i = 1 to p for j = 1 to i do if Exact then GramL i,j ← L T i GL j else GramL i,j ← Interval of center L T i G n L j and radius

s (k) 1 ← C T FP (Gram k,k ) for j = 2 to k do s (k) j ← s (k) j-1 -M k,j-1 • R k,j-1 R k,k ← s (k) k τ ← (max j<k M k,j ) ret ← (τ ≤ η) if ret = false then done ← true else for i = k -1 downto 1 do X i ← η-I C I (M k,i ) for j = 1 to i -1 do M k,j ← M k,j -X i M i,j L k ← L k -X i L i // Update the Gram matrix accordingly Gram k,k ← Gram k,k -2X i Gram k,i + X 2 i Gram i,i for j = 1 to i do Gram k,j ← Gram k,j -X i Gram i,j for j = i + 1 to k -1 do Gram k,j ← Gram k,j -X i Gram j,i for j = k + 1 to d do Gram j,k ← Gram j,k -X i Gram
L i 1 L j 1 end for R 1,1 ← C T FP (GramL 1,1 ) while k ≤ p do // Size-reduce L k with interval on the family (L 1 , . . . , L k-1 ) η-IL R (k, Exact) if Exact = false then for j = 1 to k do Update radius of GramL k,j to L k 1 L j 1 (rounded up with signi cant bits) end for k ← k while k ≥ 2 do ret ← M k ,k-1 ≤ η and δ • R k-1,k-1 > s (k ) k-1 if ret = true then k ← k -1 else if ret = false then break else return ErrorPrecision end while if k = k then for i = 1 to k -1 do M k,i ← M k ,i ; R k,i ← R k ,i R k,k ← s k k L tmp ← L k for i = k downto k + 1 do L i ← L i-1 L k ← L tmp ; Move values in GramL accordingly else R k,k ← s (k ) k if 0 ∈ R k,k and L k = 0 then return ErrorAccuracy if R k,k < 0 then return ErrorNonPosDe nite end if if L k = 0 then // Remove zero vector from L for i = k to p -1 do L i ← L i+1 p ← p -1; k ← k -1; Move values in GramL accordingly end if k ← max(k + 1, 2) end while return (L)
. . . . Internal precision in the exact-input case. For the classical 2 algorithm, Paragraph . . . states that the precision that is needed for the computations only depends on the dimension of the lattice. It is natural to ask a similar question about the algorithm ˜ 2 : can the required internal accuracy be bounded independently of the entries appearing in the matrices G and L. When G is exact, i.e., integral, the adaptation is straightforward and we obtain the following result. In fact, the bound on is made explicit in [ ]. More precisely, it states that for any arbitrary C > 0 and an ∈]0, 1/2], it su ces to have:

≥ 10 + 2 log 2 d -log 2 min( , η -1/2) + d(C + log 2 ρ),
where ρ = (1+η) 2 + δ-η 2 . For example, choosing C = = η -1/2 it su ces to have:

≥ T(d, δ, η) = 10 + 2 log 2 d -log 2 (η -1/2) + (η -1/2 + log 2 ρ) d.
When δ is close to 1 and η to 1/2, the constant before d becomes smaller than 1.6. . . . . Dealing with approximate inputs. When dealing with lattices given in an approximate form, i.e., by a representation (G n , L) at accuracy n of (G γ , L), the analysis of the algorithms di ers in three main places:

• When bounding the number of rounds τ, we can no longer assume that the potential is an integer. As a consequence, in order to keep a polynomial bound on τ, we need to provide a lower bound on the possible values of the potential, rather than rely on the trivial lower bound of 1 for an integral-valued potential.

• Since the notion of -reduction is only well-de ned for a positive de nite G, we need to make sure that G n is positive-de nite during the algorithm. Otherwise, it should output an error; Algorithm returns an error that G n is incorrect whenever it encounters a vector with a negative norm.

• When G n is approximate, the scalar products between lattice vectors can no longer be exactly computed. Thus, we need to able to make sure that the errors are small enough to be compatible with the inner precision used for Gram-Schmidt values. At rst glance, this might seem easy. However, when using update formulas to avoid recomputation of scalar products, the estimates on errors provided by interval arithmetic can grow quite quickly. In fact,it would prevent the update strategy from working. The key insight is to remark that since the centers of the intervals are represented by integers, any computation on them is exact and we can use update formulas to compute them. However, it is essential to recompute the radii of the intervals, i.e., the errors, to prevent them from growing too quickly.

Number of rounds.

Since interval arithmetic allows up to emulate exact computations as long as no failures are detected, we can analyze the number of rounds by assuming that all computations on non-integral values are done using an exact arithmetic oracle. In this context, the number of rounds can be studied by considering the potential as usual. Remember that the initial setting where operates on a basis the potential is de ned as

Π(B) = d ∏ i=1 covol B [1...i] .
The key argument is that it decreases by a multiplicative factor whenever an exchange is performed. However, in our context, the starting upper bound and the ending lower bound are di erent from the integer lattice setting. The initial upper bound needs to account from the presence of the positive de nite matrix. So if the lattice is described by a pair (G γ , L) the upper bound becomes:

Π(B) 2 ≤ d 2 G γ max L 2 max d(d+1)/2 .
More importantly, it is no longer possible to claim that the potential is an integer. Instead, we derive a lower bound by considering the smallest eigenvalue of G γ and nd:

Π(B) 2 ≥ λ d (G γ ) d(d+1)/2 .
As a consequence, if we let τ denote the number of rounds of the algorithm, we can conclude that:

τ ≤ O d 2 (log( L max ) + log( G γ max /λ d (G γ )) + log(d) .
When the lattice is given by a generating family L rather than a basis B, we need a slightly di erent invariant. Following [ ], we de ne d i to be the product of the rst i non-zero values b * j . Note that they are not necessarily consecutive, since zeroes may occur anywhere. We then let:

Π (L) = dim L ∏ i=1 d i •   ∏ i,b * i =0 2 i   .
This generalized potential is needed for the proof of Theorem . . . Note that, for lattices given by a basis, the two de nitions coincide.

Necessary accuracy for the scalar products. In order to preserve the correctness of the algorithm when computing with internal precision , we need to check that all conversions of scalar product values, using the calls to C T FP in Algorithm and Algorithm , have su cient precision. For a pair of lattice elements, described by vectors L i and L j , the relative precision on the value of their scalar product is:

L i 1 L j 1 |L T i G n L j | .
When the vectors are close to orthogonal with respect to the scalar product given by G n , the error can be arbitrarily large. However, by carefully following the analysis of Theorem in [ , Section . ], we can show that this Theorem remains true in our context. This su ces to ensure the correctness part of Theorem of [ ]. The rst check is to verify that quantity called err 1 in the proof of the Theorem remains upper bounded by 2 -. Since the value is de ned as the error on the scalar product of the vectors number i and 1 divided by the norm of the rst vector, we have:

err 1 ≤ L i 1 L 1 1 |L T 1 G n L 1 | ≤ max i L i 2 1 λ d (G n ) ≤ d max i L i 2 λ d (G n ) ≤ d max i b i 2 λ d (G n ) 2 .
Thus:

err 1 ≤ d 3 G n max L 2 max λ d (G n ) 2 ≤ d 3 (2 n G γ max +1) L 2 max (2 n λ d (G γ ) -2d) 2 .
As a consequence, it su ces to have:

n ≥ + O(log( L max ) + log( G γ max /λ d (G γ )) + log(d)).
2 with approximate inputs. To complete the above properties on the number of rounds and necessary accuracy, it su ces to remark that the only additional line of code in the approximate 2 is the recomputation of interval radii on line . Since it su ces to know the high-order bits of the values, this recomputation can fully be done using arithmetic on . Indeed, during the computations of L i 1 no cancellation occurs. As a consequence, we get the following adaptation of Theorem . . . For completeness, we give here the case where the lattice is initially given by a generating family of p vectors, has rank d and lives in an ambient space of dimension D.

Theorem . . . Let (δ, η) be such that 1/4 < δ < 1 and 1/2 < η < √ δ. Let c > log (1+η) 2 δ-η 2 .
Assume that we are given as input (Λ, •, • ) a rankd lattice (G, L) described by p ≥ d generating vectors in a ambient space of dimension D ≥ d. Further assume that it is approximately represented at accurary N by the pair (G N , L) and let B denote the maximum entry in absolute value in L T G L. Let = cd + o(d) and

N ≥ + log(B/λ D (G)) + log(d).
Then, the ˜ 2 of Algorithm outputs a (δ, η)--reduced basis in time

O DN d 2 N + p(p -d) M(d) .
Furthermore, if τ denotes the number of main loop iterations, the running time is O(DN(dN + τ)M(d)).

. .

L 2 reduction with adaptive precision and accuracy.

. . . . Adaptive precision. Since by construction the ˜ 2 Algorithm can detect that the choice for internal precision is insu cient to correctly reduce the lattice Λ. The procedure can be wrapped in a loop that geometrically increases precision after each unsuccessful iteration. This yields an adaptive precision reduction algorithm . Since the complexity of oating-point multiplication is superlinear, the use of a geometric precision growth guarantees that the total complexity of this lattice reduction is asymptotically dominated by its nal iteration.

Moreover, the cost of operations in the oating-point realization of interval arithmetic is at most four times the cost of oating-point arithmetic at the same precision. Depending on the internal representation used, this constant can even be improved. As a consequence, for lattices that can be reduced with a low-enough precision, it can be faster to use interval arithmetic than oating-point arithmetic with the precision required by the bound from Paragraph . . . . . . . . Adaptive accuracy. We now turn to the setting of Section . . , where an algorithm or oracle O γ can output an integral representation of the Gram matrix G γ = γ i , γ j (i,j)∈[1 ••• r] 2 at arbitrary accuracy n. In that context, we need to determine both the necessary accuracy and internal precision. When running Algorithm with some given accuracy and precision, three outcomes are possible:

• Either the reduction terminates in which case the lattice is -reduced, which implies that both accuracy and precision are su cient.

• The Lovász condition fails to be tested correctly, which indicates an insu cient precision. In that case, we need to test whether the precision is lower than theoretical bound T(d, δ, η) given after Theorem . . or not. In the latter case, we know that the accuracy needs to be increased.

• The algorithm detects a non-zero vector whose norm is given by an interval containing . This directly indicates insu cient accuracy.

Depending on the result of Algorithm , we increase the precision or the accuracy and restart. The corresponding pseudo-code is given in Algorithm . Since the precision and accuracy both follow a geometric growth, . .

Possible generalizations and practical impact

The adaptative strategy we describe for can be generalized to other lattice reduction algorithms. In particular, enumeration algorithms are possible within our framework, which allows the implementation of the algorithm of [ ]. It would be interesting to study a generalization to sieving techniques to adapt them to approximate lattices. This framework can straightforwardly be applied to the generalization of Napias' algorithm of [ ], as it relies on oating-point computations to handle internal values. It would provide a speed-up based on the use of a smaller internal precision than the worst-case bound used. For instance, used on fpLLL it allows us to halve the running-time of reductions.

. We now go back to our matter of interest and detail the application of this interval arithmetic framework to the reduction of algebraic lattices in algorithmic number theory. As a warm-up, we start by the case of ideal lattices, as introduced in Paragraph . . . . In all of the following, suppose that L is a number eld of degree n over Q and that we are given an integral basis (w 1 , . . . , w n ) of O L . As a warmup, we start by exposing the reduction process for ideal lattices.

. .

Lattice reduction for ideals.

With the above notations, we can directly use our lattice reduction algorithm to reduce an ideal lattice. More precisely, given a two-element representation of a by α ∈ L and β ∈ L, we proceed as follows:

. De ne the Gram matrix G w with entries w i , w j σ . It can be computed to any desired precision from approximations of the roots of P. The roots themselves can be computed, using, for example, the Gourdon-Schönhage algorithm [ ].

. Let L be the matrix formed of the coordinates of (αw 1 , . . . , αw n ) and (βw 1 , . . . , βw n ) in the basis (w 1 , . . . , w n ).

. Directly apply Algorithm to (G w , L).

The same thing can be done, mutatis mudantis, for an ideal described by a Z-basis.

. .

Lattice reduction for algebraic lattices.

Let us take (Λ, A) an algebraic lattice of rank d over O L . Suppose that Λ =

α 1 a 1 ⊕ α 2 a 2 ⊕ • • • ⊕ α d a d is a decomposition of the lattice in pseudo-basis.
We perform the computation in the same way as for ideal lattices:

. De ne the Gram matrix G w with entries w i , Aw j σ . It can be computed to any desired precision from approximations of the roots of P.

In the case where the Hermitian metric is given as a Humbert form (A σ ) σ:L→C , we compute the matrix G w as: ∑ σ:L→C σ(w i ) T A σ σ(w j ).

. For each fractional ideal a i , denote by (x

(i) 1 , . . . , x (i)
n ). Let now L be the matrix formed of the (rational) coordinates of

(α 1 x (1) 1 , . . . , α 1 x (1) n ), (α 2 x (2) 2 , . . . , α 2 x (2) n ), . . . , (α d x (d) 1 , . . . , α d x (d) n )
in the basis (w 1 , . . . , w n ).

. Apply Algorithm to (G w , L).

A well-known special case. For some number elds, the Gram matrix G w is integral. In that case, the use of Algorithm isn't necessary and one can directly work with an exact lattice. This is described for the special case of reducing the full lattice corresponding to the ring of integers in [ , Section . ] for totally real elds. It can be generalized to CM-elds, since they satisfy the same essential property of having an integral Gram matrix. The same application is also discussed in [ , Section . . ].

Non integral case. For the general case where the Gram matrix is real, [ ] proposes to multiply by 2 e and round to the closest integer. It also gives a bound on the necessary accuracy e as the logarithm of (the inverse of) the smallest diagonal entry in the Cholesky decomposition of the Gram matrix. In some sense, this is similar to our approach. But the bound can only be oriented at runtime. However, without any auxiliary information on this coe cient, it is proposed to continue increasing e as long as it is deemed unsatisfactory.

By contrast, termination of our algorithm guarantees that lattice reduction is completed and that the output basis is -reduced.

T O WA R D S A F A S T R E D U C T I O N O F A L G E B R A I C L AT T I C E S
In the previous chapter, we devised a method to soundly reduce algebraic lattices using Interval Arithmetic. This corresponds to forgetting the algebraic structure of the module and running a reduction algorithm on it. But the image over Z of a rank d algebraic lattice is of rank d × n, where n is the degree of eld inside which we are working initially. Hence, even in the case where the lattice is of small rank, the reduction can be very costly as the actual dimension over Z might be large. This process is forgetful of the algebraic speci cities of the base ring. But these properties translate into symmetries over modules, as they are very structured. Consequently, the above-mentioned reduction cannot take these symmetries into account. Thus, it is natural to wonder if it is possible to exploit the algebraic structure of the elds to speed up the reduction. In this chapter, we introduce a framework of techniques to provide fast polynomial-time algorithms for reducing algebraic lattices. We instantiate this framework for cyclotomic elds and discuss its generalization to arbitrary number elds. This is the rst time, up to our knowledge, that we can take into account the special structure of ideal and module lattices over cyclotomic elds answering the question of Peikert reported in Section . . Before diving into the detail of the reduction algorithms, we give a brief overview of the key ideas which are going to be used and combined.

The core design principles of our framework to provide fast polynomial-time algorithms for reducing algebraic lattices de ned over cyclotomic elds are:

A recursive strategy on the rank: The reduction of a rank d lattice is performed recursively on large blocks. Instead of relying on a local ( -like) strategy consisting in choosing the rst (or an arbitrary) block for which some progress can be made, we systematically perform the reduction of the blocks. This global process is somewhat similar to the ironing out strategies of -like reductions or to the fast variant of of Neumaier and Stehlé [ ], where successive passes of local reductions are made on the whole basis to gradually improve its reduceness. However, we di er from the iterative design à la as we shift the blocks between odd and even steps to mix all basis vectors as in the early parallelized versions of of Villard [ ]. A generic instance of two successive passes of our strategy is given in the following:

The basis B is here sundered in four chunks B 1 , B 2 , B 3 , B 4 of length |B|/4. The reduction process will start by reducing (possibly at the same time) the rst chunk B * 1 = B 1 , the projection B * 2 of the second one orthogonally to B 1 , the projection B * 3 of the third one orthogonally of B 1 B 2 and so on. When this pass is over, the same process starts again, but this time on shifted blocks (i.e. the rst block B 1 starts with the vector |B|/8 and is of length |B|/4). Hence, the rank of the lattices which are called recursively decreases until we reach rank lattices, where we can use a fast reduction like Schönhage's algorithm [ ].

A recursive strategy on the degree of the eld: Suppose that we are given a tower of number elds K 0 ⊂ K 1 ⊂ . . . ⊂ K h . Let Λ be an algebraic lattice de ned over the ring of integers of the upper eld K h . We can look at Λ as an algebraic lattice de ned over the eld right under, that is K h-1 .

K h O K h Λ K h-1 O K h-1 . . . . . .

Q Z

Such an identi cation is possible at the cost of increasing the rank of the lattice: the rank of Λ seen over

K h-1 is exactly [K h : K h-1 ]
times its rank over K h . Then we make use of the recursive design over the rank, introduced above, to reduce this problem into numerous instances of reduction of rank two lattices over K h-1 . Each of them can be seen over K h-2 , inviting us to pursue this descent until we get to the bottom of the tower and are now reducing lattices over Z, that is, Euclidean lattices.

A generic use of symplectic structures in number elds: A Euclidean space is a vector space endowed with a positive de nite symmetric bilinear form acting on it. Replacing this form by an antisymmetric one yields the notion of symplectic space. Lattices embedded in symplectic spaces have additional symmetries that can be exploited to (roughly) halve the cost of the reduction. We prove that we can de ne a recursive symplectic structure over a tower of number elds. As a consequence we can halve the running time of the reduction at each level of the recursion tree, yielding signi cant asymptotic speedups on the overall reduction.

A (controlled) low precision reduction:

We use approximations instead of exact computations, which corresponds to reducing the projected sublattices with only the most signi cant bits of their basis. A careful analysis of the precision required to ensure a global reduction gains a factor up to d depending on the condition number of the initial basis, where d is the rank of the lattice we want to reduce. Furthermore, we can show that the precision needed will signi cantly decrease during some recursive calls, up to a factor of d once again.

A fast and generic algorithmic for the log-unit lattice: During the reduction of algebraic lattice, we need to balance the size of the Archimedean embeddings of elements to avoid a blow-up of the precision used. This can be done by carefully multiplying the considered quantities by units of the eld, yielding a decoding problem in the so-called log-unit lattice of cyclotomic elds. We prove that these results can be achieved within quasilinear running time for any cyclotomic eld.

. We start by proving the following theorem, as it will appear recurrently in all the following parts of this chapter: Theorem . . . Let L be the cyclotomic eld of conductor f . There is a quasilinear randomized algorithm that given any element in x ∈ (R ⊗ L) × nds a unit u ∈ O × L such that for any eld embedding σ : L → C we have

σ xu -1 = 2 O √ f log f N L/Q (x) 1 ϕ( f ) . Remark. Recall that f ϕ( f ) = O(log log f ), then denoting by n = ϕ(n) the dimension of L, we then shall use the bound 2 O √ n log n log log n N L/Q (x)
We call Unit the corresponding program.

Given an arbitrary element u in L, Unit allows to systematically and eciently nd a unit in the eld which balance the Archimedean embeddings of u. This process is the cornerstone of all the algorithms in this manuscript using a descent of an algebraic lattice, as it enable a ne-grained control of the size of the direct image of the elements. This allows in particular to use small precision approximation of the actual values computed.

Example. Let L = Q[ζ] be the cyclotomic eld of conductor , and thus of degree 8. Let us consider the embeddings (σ α ) α∈(Z/16Z) × of L, de ned by sending ζ to ζ α . These embeddings are grouped by conjugates (namely σ 1 and σ 15 , σ 3 and σ 13 , σ 5 and σ 11 , σ 7 and σ 9 . Take for instance the element x ∈ L given by:

x = 65210 3 ζ 7 + 78658 3 ζ 6 -41412ζ 5 + 16567 3 ζ 4 + 36970ζ 3 - 100235 3 ζ 2 - 145843 12 ζ + 86961 2 .
As we have by direct computation N L/Q (x) = 1696380897806689 429981696 ≈ 3945239.79, we could wonder on how balanced are the norm of the embeddings around their geometric mean N L/Q (x) 1 8 ≈ 6.6758. A direct computation of the modules of the embeddings reveals that:

|σ 1 (x)| = |σ 15 (x)| ≈ 2771.189 |σ 3 (x)| = |σ 13 (x)| ≈ 1.558406 × 10 -08 |σ 5 (x)| = |σ 11 (x)| ≈ 172334.9 |σ 7 (x)| = |σ 9 (x)| ≈ 266.8642.
indicating that these values are far from being concentrated around their mean. However when multiplied by the unit u -1 for u = -5080ζ 7 + 6664ζ 6 -6664ζ 4 + 5080ζ 3 + 2856ζ 2 -7361ζ + 2856 ∈ O × L , obtained by the algorithm Unit, we obtain a far better balance:

|σ 1 (x)| = |σ 15 (x)| ≈ 7.83729 |σ 3 (x)| = |σ 13 (x)| ≈ 7.33868 |σ 5 (x)| = |σ 11 (x)| ≈ 5.93346 |σ 7 (x)| = |σ 9 (x)| ≈ 5.82028.
In particular, the algebraic norm of x and xu -1 are equal, but the canonical norm of x (≈ 172357.38) is orders of magnitude larger than the canonical norm of xu -1 (≈ 13.57795).

The proof of this theorem relies on a randomized rounding in the so-called log-unit lattice of the eld. We perform here a novel analysis of the algorithm of [ ] allowing a faster running time and we extend their result for arbitrary cyclotomic elds.

. . Prime power-case

As a starter, we prove that the techniques of [ ] allows to do the unitrounding in prime-power cyclotomic elds in quasi-linear time. Formally we aim at proving the following:

Theorem . . . Let L be the cyclotomic eld of prime power conductor f . There is a quasi-linear randomized algorithm that given any element in x ∈ (R ⊗ L) × nds a unit u ∈ O × L such that for any eld embedding σ : L → C we have

σ xu -1 = 2 O √ f log f N L/Q (x) 1 ϕ( f ) .
Compared to [ ], there are two di erences with the treatment proposed here: on the one hand we use fast arithmetic of the involved objects-namely Fourier-based multiplication in an abelian group-ring-and on the other hand we increase the success probability by using a better bound by the classical Berry-Esseen theorem, as it was hinted in their seventh footnote.

. . . . Recall on the probability notions used in the proof. Before diving in the proof of Theorem . . , let us recall the basis notions of probability theory we are using, namely subgaussians variables and the Berry-Esseen theorem.

On subgaussian random variables. The notion of subgaussian distribution goes back to the work of Kahane in [ ], and encompasses a large family of real distributions with very convenient properties similar to the normal law.

De nition . . . A real random variable X is said to be τ-subgaussian for some τ > 0 if the following bound holds for all s ∈ R:

E exp(sX) ≤ exp τ 2 s 2 2 . ( .
)
A τ-subgaussian probability distribution is in an analogous manner.

Lemma . . . A τ-subgaussian random variable X satis es

E[X] = 0.
Proof. Follows from the Taylor expansion at of

E[exp(sX)] = 1 + sE[X] + O s 2 .
The main property of subgaussian distributions is that they satisfy a Gaussianlike tail bound. Lemma . . . Let X be a τ-subgaussian distribution. For all t > 0, we have

Pr[X > t] ≤ exp - t 2 2τ 2 . ( . )
Proof. Fix t > 0. For all s ∈ R we have, by Markov's inequality:

Pr[X > t] = Pr[exp(sX) > exp(st)] ≤ E[exp(sX)] exp(st)
since the exponential is positive. Using that X is τ-subgaussian, Equation .

gives:

Pr[X > t] ≤ exp s 2 τ 2 2 -st
and the right-hand side is minimal for s = t/τ 2 , entailing the announced result.

Many usual distributions over Z or R are subgaussian. This is in particular the case for distributions with nite supports and zero mean.

The Berry-Esseen approximation theorem. The Berry-Esseen theorem provides a quantitative estimates of the rate of convergence towards the normal distribution, as showing that the cumulative function (CDF) of the probability distribution of the scaled mean of a random sample converges to Φ at a rate inversely proportional to the square root of the number of samples. More formally we have: Theorem . . . There exists a positive C < 0.5 such that if X 1 , X 2 , • • • , X n are independent and identically distributed random variables with zero mean, satisfying E(X 2 1 ) = σ 2 > 0, E(|X 1 | 3 ) = ρ, and by setting

Y n = X 1 + X 2 + • • • + X n n
the sample mean, with F n the cumulative distribution function of Y n √ n σ and Φ the cumulative distribution function of the standard normal distribution, then for all x and n we have,

|F n (x) -Φ(x)| ≤ Cρ σ 3 √ n .
. . . Going back on the rounding problem. We now x a cyclotomic eld L = Q[ζ f ] with prime power-conductor f and degree n. We recall that in L, the cyclotomic units are easily described:

Lemma . . (Lemma . of [ ]).
Let f be a prime power, then the group of cyclotomic units is generated by ±ζ f and

ζ α f -1 ζ f -1 for α ∈ (Z/ f Z) × .
We rst provide a convenient description of the cyclotomic units as an orbit of the element ζ f -1 under the action of its Galois group. . . . . Log-embedding and action of (Z/ f Z) × /{-1, +1}. De ne the Log embedding to be the coe cient-wise composition of the real logarithm with the absolute value of Archimedean embeddings:

Log : L -→ R n 2 α -→ [log(|σ i (α)|)] i∈G ,
where the embeddings are paired by conjugates and listed by the group G = (Z/ f Z) × /{-1, +1}. The image of the unit multiplicative group O × L is a full rank lattice by Dirichlet unit's theorem, and is called the Log-unit lattice.

We rst remark that the group-ring Z[(Z/ f Z) × ] acts on the group (R ⊗ L) × in the following way: for any

g = ∑ α g α α ∈ Z[(Z/ f Z) × ] and x ∈ (R ⊗ L) × , g • x = ∏ α∈(Z/ f Z) × σ α (x) g α ,
where σ α (ζ f ) = ζ α f . But σ α acts as a permutation on the Archimedean embedding so that the embedding in the Log-unit lattice commutes with the action of Z[(Z/ f Z) × ] in the following sense:

Log(g • x) = gLog(x) ∈ R[G], for all x ∈ (R ⊗ L) × .
Henceforth, the cyclotomic units can be described using this action, as they correspond to the orbit of the element ζ f -1 by the kernel, called the augmentation ideal, of g → ∑ α g α :

g • (ζ f -1) | ∑ α g α = 0 ( . )
. . . . An upper bound on the norm of Log(ζ f -1). We also have that Log(ζ f -1) is invertible, and with a small inverse so that we can compute e ciently. We rst bound Log(ζ f -1):

Lemma . . . We have:

Log(ζ f -1) ∞ ≤ log f and Log(ζ f -1) 2 = O f .
Proof. The coordinates are given by

Log(ζ f -1) α = Log(|ζ α f -1|) = log(|2 sin(πα/ f )|), for any α ∈ (Z/ f Z) × . Now, for 0 ≤ x ≤ 1 2 and α ∈ (Z/ f Z) × , we have sin(πx) ≥ 2x and we can consider that 0 ≤ α f ≤ 1 2 . We deduce that Log(ζ f -1) ∞ ≤ log f 4 and Log(ζ f -1) 2 2 ≤ ∑ α log 2 f 4α ≤ f 1 2 0 log 2 4 x dx,
the latest integral being equal to 9 2 + 3 ln 2 + 1 ln 2 2 entails the announced inequality.

Remark. The multiplication in the group ring Z[G] is quasi-linear as G is a nite abelian group. Indeed, we can use Fourier transform to reduce the multiplication to point-wise multiplications (see for instance [ ]).

. . . . Fast rounding in the Log-unit lattice. We can now describe the rounding algorithm, which essentially is a randomized coe cient-wise rounding using the orbital description of Equation .. Proof of Theorem . . . Without loss of generality, we can assume N L/Q (x) = 1.

Then, using the description given by Equation . the problem is thus reduced to searching an unit u such that Log(u

) ∈ Z[G] which is close to y = Log(x)
Log(ζ f -1) and such that ∑ α Log(u) α = 0. The simplest idea consists in performing a coe cient wise rounding of the coe cients of the vector y. However this approach does not succeed all the time, but we can take advantage of the two possible choices in the rounding to closest integers to randomize the rounding-that is to say, by randomizing the choice of oor or ceil instead of relying deterministically to the round function • .

Formally, for α = 1, we sample z α following the unique distribution on the two elements set { y α , y α } with expectation y α . Then, z 1 is set at

-∑ α =1 z α to ensure ∑ α z α = 0. Clearly, u = z • (ζ f -1) veri es our requirements if Log(ζ f -1)(y -z) ∞ = O f log f . The Berry-Esseen theorem indicates that |y 1 -z 1 | ≤ √ n/ log n with probability Θ(1/ log n). The coordinates of Log(ζ f -1)(y -z -(y -z) 1 σ 1 )
are subgaussians of parameter Log(ζ f -1) 2 . Therefore, using the estimation of Lemma . . , we know that their absolute values can all be bounded by O f log f except with probability at most Θ 1 log 2 f . Hence, our requirement is ful lled with probability Ω 1 log n . We have Log(u) = zLog(ζ f -1) which can be computed in quasi linear time. Eventually a Fourier transform recovers √ u ū, which is u up to an irrelevant torsion .

. . Extension to arbitrary cyclotomic elds

We now extend the result of Theorem . . to arbitrary cyclotomic elds, that is proving:

One can compute u by simply removing the absolute values in the de nition of Log, and taking any determination of complex logarithm. As we work inside a CM-eld, this technicality is not needed.

Theorem . . . Let L be the cyclotomic eld of conductor f . There is a quasilinear randomized algorithm that given any element in x ∈ (R ⊗ L) × nds a unit u ∈ O × L such that for any eld embedding σ : L → C we have

σ xu -1 = 2 O √ f log f N L/Q (x) 1 ϕ( f ) .
In substance this proof is quite similar to the proof of the prime-power case but requires estimation of the evaluation of character's sum to bound the size of the roundings. As this computation is quite lengthy and not enlightening for the purposes of this chapter we defer it to Appendix .

. With this balacing tool available we are now ready to introduce the recursion technique for reducing algebraic lattices.

Let h be a non-negative integer. In the following of this section we x a tower of log-smooth conductor cyclotomic elds

L ↑ h = (Q = L 0 ⊂ L 1 ⊂ • • • ⊂ L h ) and denote by 1 = n 0 < n 1 < • • • < n h their respective degrees over Q.
Then we consider a free module M of rank d over the upper eld L h , which is represented by a basis (m 1 , . . . , m d ) given as the columns of a matrix M ∈ O d×d L h . For notational simplicity, in this section, we shall denote by a, b the O L -module aO L ⊕ bO L .

. .

In-depth description of the algorithm . . . . Outer iteration. In order to reduce the module M we adopt an iterative strategy to progressively modify the basis: for ρ steps a reduction pass over the current basis is performed, ρ being a parameter whose value is computed to optimize the complexity of the whole algorithm while still ensuring the reduceness of the basis; we defer the precise computation of this constant to Section . . As in the algorithm a size-reduction operation is conducted to control the size of the coe cients of the basis and ensure that the running time of the reduction is polynomial. Note that for number elds this subroutine needs to be adapted to deal with units of O L h when rounding. The speci cities of this size-reduction are the matter of Paragraph . . . . . . . . Step reduction subroutine. We now take a look at the step reduction pass, once the size-reduction has occurred. As observed in Chapter , the textbook algorithm is build on a simple idea: make the reduction process boiling down to the treatment of rank two modules and more precisely to iteratively reduce orthogonally projected rank two submodules. We are using the same paradigm here and this step reduction pass over the current basis is a sequence of reduction of projected rank O L h -modules. However on the contrary to the algorithm we do not proceed progressively along the basis, but reduce d/2 independent rank modules at each step. This design enables an e cient parallel implementation which reduces submodules simultaneously, in the same way that the classical algorithm can be parallelized [ , ].

Formally, given the basis of M collected in the matrix M, let us denote by r j the vector R j,j , R j+1,j = 0 , and r j the vector R j+1,j , R j+1,j+1 where R is the R-part of the QR-decomposition of M. The module R i encodes exactly the projection of M i = m i-1 , m i over the orthogonal space to the rst i -1 vectors (m 1 , . . . , m i-1 ). In order to recursively call the reduction algorithm on R i we need to descend it to the sub eld L h-1 . . . . . Interlude: descending to cyclotomic sub elds. Remark now that since L h is a cyclotomic extension of the cyclotomic eld L h-1 , there exists a root of unity ξ such that

O L h = O L h-1 ⊕ ξO L h-1 ⊕ • • • ⊕ ξ q h -1 O L h-1 .
for q h = n h /n h-1 being the relative degree of L h over L h-1 . As a consequence, the module R i decomposes over O L h-1 as:

R i = r i O L h ⊕ r i+1 O L h = r i O L h-1 ⊕ ξr i O L h-1 ⊕ • • • ⊕ ξ q h -1 r i O L h-1 ⊕ r i+1 O L h-1 ⊕ ξr i+1 O L h-1 ⊕ • • • ⊕ ξ q h -1 r i+1 O L h-1 ,
yielding a basis of R i viewed as a free O L h-1 -module of rank 2 × q h . This module can then recursively reduced, this time over a tower of height h -1. This conversion from an O L h -module to an O L h-1 module is referred as the function Descend. Conversely, any vector u ∈ O 2q h L h-1 can be seen with this decomposition as a vector of O 2 L h by grouping the coe cients as

∑ q h i=1 u[i]ξ i , ∑ q h i=1 u[q h + 1 + i]ξ i .
We denote by Ascend this conversion.

. . . . Back on the step reduction. As mentioned in Paragraph . . . , we start by reducing-with a recursive call after descending-all the modules R 2i = r 2i-1 , r 2i for 1 ≤ i ≤ d/2 , so that each of these reductions yields a small element of the submodule M 2i = m 2i-1 , m 2i ; which is then completed in a basis of M 2i . But on the contrary of the classical reduction, this sequence of pairwise independent reductions does not make interact the elements m 2i and m 2i+1 , in the sense that no reduction of the module projected from m 2i , m 2i+1 is performed. To do so, we then perform the same sequence of pairwise reductions but with all indices shifted by : we reduce the planes r 2i , r 2i+1 for each 1 ≤ i ≤ d/2 , as depicted in the following diagram:

The precise de nition of this completion and lifting is given in Paragraph . . . .

m 1 m 2 m 3 m 4 . . . m i-1 m i m i+1 . . . m n-1 m n Basis r 1 , r 2 r 3 , r 4 . . . r i-1 , r i . . . r n-2 , r n-1 Odd steps r 2 , r 3 r 4 , r 5 . . . r i , r i+1 . . . r n-1 , r n Even steps . . . . Unit-size-reduction for O L h -modules.
To adapt the size-reduction process to the module setting, one needs to adjust the rounding function. When L h = Q, the rounding boils down to nding the closest element in O L = Z, which is encompassed by the round function • . In the higher-dimensional context, we need to approximate any element of L h by a close element of O L h .

Note that nding the closest integral element is not e ciently doable. The naive approach to this problem consists in reducing the problem to the resolution of the closest integer problem in the Euclidean lattice of rank n h given by O L h under the Archimedean embedding. However, up to our knowledge, no exponential speedup exists using its particular structure compared to sieving or enumeration in this lattice.

Nonetheless, nding a target close enough to the target su ces for our application. As such we simply de ne the rounding of an element α ∈ L h as the integral rounding on each of its coe cients when represented in the power base of L h .

We add here an important and necessary modi cation: before the actual size-reduction occurred, we compute a unit u using Theorem . . close to R i,i . This routine is denoted by Unit. The vector M i is then divided by u.

While not changing the algebraic norms of the elements, this technicality forces the Archimedean embeddings of the coe cients to be balanced and helps the reduced matrix to be well-conditioned. This avoids a blow-up of the precision required during the computation. This modi ed size-reduction is fully described in Algorithm , Size-Reduce.

Algorithm -Size-Reduce

Input

: R-factor of the QR-decomposition of M ∈ O d×d

L h

Output : A unimodular transformation U representing the size-reduced basis obtained from M.

U ← Id d,d for i = 1 to d do D ← D i (Unit(R i,i ))// D i is a dilation matrix (U, R) ← (U, R) • D -1 for j = i -1 downto 1 do ∑ n-1 =0 r X ← R i,j // Extraction as a polynomial µ ← ∑ n-1 =0 r X // Approximate rounding of R i,j in O L h (U, R) ← (U, R) • T i,j (-µ) // T i
,j is a shear matrix end for end for return U . . . . Reduction of the leaves. As the recursive calls descend along the tower of number elds, the bottom of the recursion tree requires reducing O L 0 (= O Q = Z)-modules, that is Euclidean lattices. As a consequence, the step reduction performs calls to a reduction oracle for plane Euclidean lattices. For the sake of e ciency we adapt Schönhage's algorithm [ ] to reduce these lattices, which is faster than the traditional Gauss' reduction. This algorithm is an extension to the bidimensional case of the half-GCD algorithm, in the same way, that Gauss' algorithm can be seen as a bidimensional generalization of the classical GCD computation.

The original algorithm of Schönhage only deals with the reduction of binary quadratic forms, but can be straightforwardly adapted to reduce rank Euclidean lattices, and to return the corresponding unimodular transformation matrix. In all of the following, we denote by Schonhage this modi ed procedure.

. . . . The lifting phase. As explained in Paragraph . . . , we recursively call the reduction procedure to reduce the descent of projected modules of rank 2 of the form

R i = r i , r i+1 , over L h-1 , yielding a unimodular trans- formation U ∈ O 2q h ×2q h L h-1
where q h is the relative degree of L h over L h-1 . From U , we can nd random short elements in the module by computing a small linear combination of the rst columns. Applying Ascend, we deduce some short x = m i a + m i+1 b. But then to replace m i by x in the current basis, we need to complete this vector into a basis (x, y) of M i over O L h . Doing so boils down to complete a vector of O 2 L h into a unimodular transformation. Indeed, suppose that such a vector y is found and denote by (a, b) and (v, u) the respective coordinates of x and y in the basis (m i , m i+1 ). By preservation of the volume we have without loss of generality:

1 = det a v b u = au -bv.
Therefore nding the element y to complete x reduces to solving the Bézout equation in the unknown u and v aubv = 1 ( . )

over the ring O L h . Since this ring is in general not Euclidean we can not apply directly the Euclidean algorithm to solve this equation as an instance of the extended problem. However, we can use the algebraic structure of the tower L ↑ h to recursively reduce the problem to the rational integers. This generalized Euclidean algorithm works as follows:

If L h = Q: then the problem is an instance of extended GCD search, which can be solved e ciently by the binary-GCD algorithm.

If the tower L ↑

h is not trivial: we make use of the structure of L ↑ h and rst descend the problem to the sub eld L h-1 by computing the relative norm N L h /L h-1 of the elements a and b; then by recursively calling the algorithm on these elements

N L h /L h-1 (a) and N L h /L h-1 (b),
we get two algebraic integers µ and ν of O L h-1 ful lling the equation:

µN L h /L h-1 (a) -νN L h /L h-1 (b) = 1.
( . )

But then remark that for any element α ∈ O L h we have, using the comatrix formula and the de nition of the norm as a determinant that:

N L h /L h-1 (α) ∈ αO L h , so that α -1 N L h /L h-1 (α) ∈ O L h .
Then, from Equation .:

a • µ a -1 N L h /L h-1 (a) :=u∈O L h -b • ν b -1 N L h /L h-1 (b) :=v∈O L h = 1, as desired.
Reduction of the size of solutions: The elements u, v found by the algorithm are not necessarily the smallest possible elements satisfying Equation . . To avoid a blow-up in the size of the coe cients lifted, we do need to control the size of the solution at each step. Since the function Size-Reduce preserves the determinant by construction and reduces the norm of the coe cients, we can use it to reduce the bitsize of u, v to (roughly) the bitsize of a and b.

The translation of this method in pseudocode is given in Algorithm , G-Euclide.

Algorithm -G-Euclide, Li

Function G-Euclide:

Input : Tower of number elds L ↑ h , a, b ∈ L h . Output : u, v ∈ L h , such that au + bv = 1 if L h = Q then return ExGcd(a, b) µ, ν ← G-Euclide L ↑ h-1 , N L h /L h-1 (a), N L h /L h-1 (b) µ , ν ← µ a -1 N L h /L h-1 (a), ν b -1 N L h /L h-1 (b) W ← a ν b µ V ← Size-Reduce(Orthogonalize(W)) return W • V[2] Function Li : Input : Tower of number elds L ↑ h , unimodular matrix U ∈ O 2q h L h-1 Output : Unimodular matrix U ∈ O 2×2 L h a, b ←Ascend(L h , U[1]) µ, ν ← G-Euclide L ↑ h-1 , a, b U ← a ν b µ return U
The number of bits needed to represent the relative norms does not depend on the sub eld, and the size-reduction forces the output vector to have the same bitsize as the input one. This remark is the crux of the quasilinearity of the G-Euclide, as stated in Lemma . . . Remark that the algorithm needs N L h /Q (a) to be prime with N L h /Q (b). We assume that we can always nd quickly such a, b with a short x. This will lead to Heuristic . . , and the validity of this assumption is discussed in Section . . .

. . Wrapping-up

The full outline of the reduction if given in Algorithm and a schematic overview of the recursive steps is provided in the diagram of Figure . In this section, we devise the complexity of the Algorithm and of its approximation factor. More formally we prove the following theorem:

L h O L h M = m 1 O L h ⊕ • • • ⊕ m d O L h α 1 O L h ⊕ α 2 O L h υO L h ⊕ ωO L h υ ∈ M (short) L h-1 O L h-1 M = m 1 O L h-1 ⊕ • • • ⊕ m 2m h O L h-1 α 1 O L h-1 ⊕ α 2 O L h-1 υ O L h-1 ⊕ ω O L h-1 . . . . . . . . . . . . υ ∈ M (short) Q Z M Z = β 1 Z ⊕ • • • ⊕ β k Z α 1 Z ⊕ α 2 Z υZ ⊕ ωZ (reduced) υ (short)
Theorem . . . Let f be a log-smooth integer. The complexity of the algorithm Reduce on rank two modules over K = Q[x]/Φ f (x), represented as a matrix M whose number of bits in the input coe cients is uniformly bounded by B > n, is heuristically a Õ n 2 B with n = ϕ( f ). The rst column of the reduced matrix has its coe cients uniformly bounded by 2 Õ(n) (covol M) 1 2n .

. . Setting

Let h > 0 be a non-negative integer. In the following of this section we x a tower of cyclotomic elds

K ↑ h = (Q = K 0 ⊂ K 1 ⊂ • • • ⊂ K h )
with log- smooth conductors and denote by 1 = n 0 < n 1 < • • • < n h their respective degrees over Q. We consider a free module M of rank d over the upper eld K h , given by one of its basis, which is represented as a matrix M ∈ O d×d K h . In all of the following, for any matrix A with coe cients in K h we denote by A the -norm for matrices.

We aim at studying the behavior of the reduction process given in Algorithm on the module M; as such we denote generically by X (τ) the value taken by any variable X appearing in the algorithm at the end of step i = τ, for 0 ≤ τ ≤ ρ. For instance R (0) denotes the R-part of the orthogonalization of M and M (ρ) represents the reduced basis at the end of the algorithm.

Since the implementation of the algorithm is done using oating-point arithmetic, we need to set a precision which is su cient to handle the internal values during the computation. To do so we set:

p = log max σ:K h →C,R i,i ∈R σ(R i,i ) min σ:K h →C,R i,i ∈R σ(R i,i ) ,
where the σ runs over the possible eld embeddings and the R i,i are the diagonal values of the R part of the QR-decomposition of the input matrix of the reduction procedure. We will prove as a byproduct of the complexity analysis that taking a precision of O(p) su ces.

For technical reasons which will appear in the subsequent proofs, we introduce a constant α > 0 which will be optimized at the end of our analysis. It essentially encodes the approximation factor of the reduction. Eventually, we set the variable ε to be equal to 1/2. This apparently odd choice allows us to state our theorems with su cient generality to reuse them in the enhanced proof of the reduction algorithm with symplectic symmetries, as detailed in Section . , with a di erent value.

The whole set of notations used in the analysis is recalled in Table . . . .

Overview of the proof

Before going into the details of the proof, we lay its blueprint. We start by estimating the approximation factor of the reduction and deduce a bound in O d 2 log p on the number of rounds ρ required to achieve the reduction the module M, where p is the precision needed to handle the full computation.

We then prove that the limiting factor for the precision is to be su ciently large to represent the shortest Archimedean embedding of the norm of the Gram-Schmidt orthogonalization of the initial basis. We then devise a bound by looking at the sum of all the bit sizes used in the recursive calls and concludes on the complexity. The critical part of the proof is to use the potential to show that dividing the degrees by d 2 leads to a multiplication by a factor at most in O d 2 of the sum of all the precisions in the recursive calls, instead of the obvious O d 3 log p .

. . A bound on the number of rounds and the approximation factor of the reduction

We de ne here a set of tools to study the approximation factor of the reduction, by approximating it by an iterative linear operator on the family of volumes of the submodules

M i = m 1 Z ⊕ • • • ⊕ m i Z for 1 ≤ i ≤ d.
This method is quite similar to the one used by Hanrot et al. in [ ] to analyze the algorithm by studying a dynamical system. To ease the computation of the number of rounds, we can without loss of generality, scale the input matrix and suppose that:

covol M = |N K h /Q (det M)| 1 d = 2 -(d+1)(1+ε)αn 2 h .
We only do so for this subsection.

. . . . . Potential and volumes of ags. A global measure of reduceness of a Euclidean lattice is its potential. An O K h -analog of this constant can be de ned in a similar manner by using the algebraic norm to replace the Euclidean norm over R n .

De nition . . (Potential).

Let (m 1 , . . . , m d ) be a basis of the module M given as the columns of a matrix M ∈ O d×d K h , and let R be the R-part of its QR-decomposition. Its log-potential is de ned as:

Π(M) = d ∑ i=1 log covol M i = d ∑ i=1 (d -i) log N K h /Q (R i,i ).
As in the Euclidean case, a local tool to analyze the evolution of a basis (m 1 , . . . , m d ) of a lattice Λ, through a reduction, is the pro le of the volumes associated with the ag of a basis, namely the family: covol(M 1 ), . . . , covol(M i ), . . . , covol Λ.

As for the potential, we de ne the pro le of the ag in a similar way with the algebraic norm on K h , but for technical reasons, we quadratically twist it with the constant α > 0.

De nition . . (Flag pro le). Let (m 1 , . . . , m d ) be a basis of the module M given as the columns of a matrix M ∈ O d×d K h , and let R be the R-part of its QR-decomposition. Its pro le is the vector µ(M) ∈ R d de ned by:

µ(M) j = j ∑ k=1 log N K h /Q (R k,k ) + 2k(1 + ε)αn 2 h , for 1 ≤ j ≤ d.
The following lemma gives an estimate of the norm of the pro le in terms of the parameters of the algorithm and of the input bitsize.

Lemma . . . With the same notations as in De nition . . , we have:

µ(M) 2 ≤ (2 + ε)αd 2 n h p
Proof. We have |N K/Q (det(M))| ≤ 1 so for each i, and each embedding σ, we have that |σ(R i,i )| ≤ 2 p . Now we compute:

µ(M) 2 2 d ≤ max j=1,...,d-1 ∑ k≤j log N K h /Q (R k,k ) + 2k(1 + ε)αn 2 h ≤ dn h p + d(d -1)(1 + ε)αn 2 h
which implies the result.

. . . . A family of step operators. To study the reduction steps, we de ne the following linear operators

δ j : R d -→ R d v -→ (w ) =        v j-1 +v j+1 2 if = j v j if = j + 1 v else , ( . )
for each 1 ≤ j ≤ d. These operators provide an upper bound on the pro le of a basis after a reduction at index j. To encode the behavior of a full round of reduction we de ne the operators:

∆ o = ∏ i=1 | i odd δ i , and ∆ e = ∏ i=2 | i even δ i ,
to de ne inductively the sequence:

µ (1) = µ(M (1)
)

µ (i) = ∆ o µ (i-1) if i = 0 (mod 2) else ∆ e µ (i-1)
Remark. By the constraint on the volume of M to be equal to 2 -d(d+1)(1+ε)αn 2 h , we have for all 1 ≤ i ≤ ρ, that µ

(i) d = 0.
Proposition . . (Exponential decay of µ (i) 2 ). For all odd i, we have,

µ (i) 1 ≤ e -π 2 (i-1) 2d 2 µ (1) 2 and µ (i+1) 2 ≤ 2e -π 2 (i-1) 2d 2 µ (1) 2 . Proof. Note that ∆ o • ∆ e depends
∑ k=1 odd µ (i) 2 k ≤ e -π 2 (i-1) 2d 2 µ (1) 2 2 .
This implies the rst statement and

∑ k=2 even µ (i+1) 2 k ≤ ∑ k=1 odd µ (i) 2 k implies the second.
Remark (A "physical" interpretation of ∆). The operator ∆ introduced in the proof of Proposition . . acts as a discretized Laplacian operator on the discrete space indexed by {1, . . . , d}, for a metric where two consecutive integers are at distance 1. Then, the action of ∆ through the iterations 1 ≤ i ≤ ρ are reminiscent of the di usion property of the solution of the heat equation ( ∂u ∂t = α∆u), whose characteristic time is quadratic in the diameter of the space. . . . . A computational heuristic. We now relate the behavior of the sequences of µ to the values taken by R (i) . In order to do so, we introduce a computational heuristic on the behavior of the Li function, asserting that the lifting phase does not blow up the size of the reduced vectors.

Heuristic . . (Size of lifting).

For any 1 ≤ i ≤ ρ and any 1 ≤ j ≤ d where a call to Li happened:

N K h /Q R (i+1) j,j ≤ min 2 αn 2 h N K h /Q R (i) j,j R (i) j+1,j+1 , N K h /Q R (i) j,j .
A discussion on the validity of this heuristic is done in Section . . . However, we do not perform a local reduction if the following condition is fullled, up to the approximation error due to the representation at nite precision

N K h /Q (R (i) j,j ) ≤ min 2 (1+ε)αn 2 h N K h /Q R (i) j,j R (i) j+1,j+1 , N K h /Q R (i) j,j
.

From Heuristic . . we can show by a direct induction on i that the sequence of µ (i) is an over-approximation of the ag pro le at step i. More precisely we have:

Lemma . . . Under Heuristic . . , for any 1 ≤ i ≤ ρ: µ M (i) ≤ µ (i) ,
where the comparison on vectors is taken coe cient-wise.

. . . . A bound on the approximation factor and number of rounds. We can now conclude this paragraph by giving a quasiquadratic bound on the number of rounds: Theorem . . . Assuming that ρ is even and ρ > 2d 2 π 2 ln((2 + )αd 2 n h p), we have that

N K h /Q (R (ρ) 1,1 ) ≤ 2 (d-1)(1+ε)αn 2 h +1 |N K h /Q (det M)| 1 d .
More precisely, if the precision used when performing this testing is p, then if we are certain that

N K h /Q (R i,i ) ≤ min 2 (1+ε)αn 2 h N K h /Q R (i) j,j R (i) j+1,j+1 , N K h /Q R (i) j,j
, no local reduction is called, else we have

N K h /Q (R i,i ) ≥ min 2 (1+ε)αn 2 h N K h /Q R (i) j,j R (i) j+1,j+1 , N K h /Q R (i) j,j (1 -2 -Ω(p) )
and a recursive local reduction is called, the multiplicative error term coming from the approximation error committed by the approximation of the values R * , * at precision p.

Proof. By taking the exponential of both sides of the inequality of Lemma . . , we have:

N K h /Q (R (ρ+1) 1,1 ) ≤ 2 µ (ρ+1) 1 -2(1+ε)α .
Recall that we forced 1+ε) , so that:

N K h /Q (det M) 1 d = 2 -(d+1)αn 2 h (
N K h /Q (R (ρ+1) 1,1 ) ≤ 2 (d-1)(1+ε)αn 2 h +µ (ρ+1) 1 N K h /Q (det M) 1 d .
By Proposition . . , we know that µ

(ρ+1) 1 ≤ e -π 2 ρ 2d 2 µ (1)
2 . Since we have:

ln |µ (ρ+1) 1 | ≤ ln µ (1) 2 - ρπ 2 2d 2 ≤ ln((2 + )αd 2 n h p) - ρπ 2 2d 2 ≤ 0,
using Lemma . . and the hypothesis on ρ together with the fact that d > 1.

All in all |µ (ρ)

1 | ≤ 1 and which entails the desired inequality. With mild assumptions on the relative size of the parameters α, n h , d and p we have the following rewriting of Theorem . . . Corollary . . . Suppose that α = log O(1) (n h ) and that p > n h + d, then taking ρ = O d 2 log(p) is su cient to reduce the module M and such that the algebraic norm of the rst vector is bounded by a

2 Õ(dn 2 h ) |N K h /Q (det M)| 1 d .
Remark. If the caller makes a similar heuristic with a α , then we need α > α • 2(1 + ) d-1 d and any such value is plausible.

. . Time complexity of the toplevel reduction

Now that we have an estimate of the number of rounds, we can aim at bounding the complexity of each round, without counting the recursive calls, in a rst time. To do so we will look independently at each of the part of a round, namely at the complexity of Orthogonalize, Reduceand Li . Since the lifting algorithm performs a size-reduction, we rst give a ne-grained look at the Size-Reducefunction.

. . . . Complexity and quality of Size-Reduce. The quantitative behavior of the Size-Reduce procedure is encoded by the following theorem, given in all generality for arbitrary matrices over a cyclotomic eld.

Theorem . . . Let A be a matrix of dimension d whose coe cients lie in the cyclotomic eld K = Q[ζ f ], and n = ϕ( f ). We are given a non-negative integer p > 0, where A , A -1 ≤ 2 p and such that n log n log log n + d log n < p. By calling the algorithm Orthogonalize and Size-Reduce, we can nd in time ) , and a matrix R + E, such that E ≤ 2 -p , with R being the R-factor of the QR decomposition of AU and

O d 2 np 1 + d log p . an integral triangular matrix U ∈ O × K n×n , such that U ≤ 2 O(p
κ(AU) ≤ max i N K/Q (R i,i ) min i N K/Q (R i,i ) 1 n 2 O √ n log n log log n+d log n ,
for κ(X) = X X -1 being the condition number of X.

Proof. See Appendix .

Corollary . . . Suppose that:

M (0) , M (0) -1 ≤ 2 p and d log n h + n h log n h log log n h < p.
Then, we have the following bound on the condition number of M (i) , valid for any loop index

1 ≤ i ≤ ρ: κ M (i) ≤ 2 2p+O √ n h log n h log log n h +d log n h ,
and the call of the procedure Size-Reduce at this i-th round has complexity

O d 2 n h p 1 + d log p
and requires a O(p) of precision Proof. We rst remark that for any 1 ≤ j ≤ d, the map i → max

j N K h /Q R (i) j,j
is non-increasing, and therefore that i → min j N K h /Q R (i) j,j is non-decreasing. Now, Theorem . . implies that the Archimedean embeddings are balanced so that we have for all i:

max σ:K h →C,R (i) j,j ∈R (i) σ R (i) j,j min σ:K h →C,R (i) j,j ∈R (i) σ R (i) j,j ≤ 2 2p+O √ n h log n h log log n h ,
and so that

max j N K h /Q (R j,j ) min i N K h /Q (R j,j ) = 2 n h 2p+O √ n h log n h log log n h .
Therefore, by combining this bound with the result of Theorem . . , after the call to Size-Reduce, the condition number of M (i) is bounded by

2 2p+O √ n h log n h log log n h +d log n h
and the computation requires a O(p) bits of precision, with error bounded by 2 -p .

. . . . Complexity of the Li procedure. With the bounds given by Theorem . . we are now able to bound the complexity of the lift procedure described in Algorithm .

Lemma . . (Quasilinearity of Li ). Let K be the cyclotomic eld of conductor f > 0, of dimension n = ϕ( f ). Denote by r the largest prime factor of f . Let a, b ∈ O K and suppose that:

gcd(N K/Q (a), N K/Q (b)) = 1 and a + b ≤ 2 p .
Then, the time complexity of the algorithm G-Euclide on the inuput (a, b) is a O(r log(r)np log p)

for p ≥ n log n log log n. Consequently, it is quasilinear for r ≤ log n.

The output (u, v) verify:

au + bv = 1 and u + v ≤ 2 p+O √ n log n log log n .
Proof. We use a tower of number elds L ↑ h , where

L i = Q[x]/Φ f i (x) and f i / f i+1 ≤ r.
By trivial induction and multiplicativity of the relative norm map, we know that the input of the recursive call at level i, that is, in

L i is N L h /L i (a), N L h /L i (b)
. As such, with p i being the number of bits of the coecients of the input at level i of the recursion, we have n i p i = O(n h p). Since computing the automorphisms corresponds to permutation of evaluation of a polynomial, each norm can be computed in time O(r log(r)n i p i ) using a product tree [ ]. Now, we have by induction that 1 = det W = det V. With R being the R-part of the QR-decomposition of V we have at any level i in the tower

L ↑ h : R 2,2 = 1/R 1,1 ≤ 2 O √ n i log n i log log n i ,
so that the size-reduction implies that

M ≤ N L i /Q (R 1,1 ) 1 n i 2 O √ n i log n i log log n i = (n h a +n h b ) n h n i 2 O √ n i log n i log log n i .
Hence, the output coe cients are also stored using O(n h p/n i ) bits. The complexity when n 0 = 1, i.e. the ExGcd base case, is classically in O(p 0 log p 0 ). Summing along all complexities gives:

O n h p log(n h p) + h ∑ i=1 r log(r)n i p = O(n h p log p + r log(r)n h p log n h )
which simpli es to a O(r log(r)np log p).

Note that this tower is not same as the one used in the whole reduction process. The two towers are indeed constructed independently to optimize the global running time.

. . . . Complexity of the top-level. Now that we have analyzed the complexity and the output quality of each "atomic" parts, we can examine the complexity of the top-level of the algorithm Reduce-that is to say its complexity without counting the recursive calls.

Proposition . . . Suppose that the following conditions are ful lled:

min σ:K h →C,R (1) i,i ∈R (1) σ(R (1) i,i ) ≥ 2 -p , α = log O(1) (n h ) d log n h + n h log n h log log n h < p.
Then, the complexity at the top-level of the algorithm is a O d 5 n h p log p .

Proof.

Base case: K h = Q: This is a consequence of the analysis of Schönhage's fast reduction [ ].

General case: Using Corollary . . , the number of rounds is ρ = O d 2 log p . By Lemma . . the complexity of Li is quasilinear. Thus, the complexity of each round is dominated by the computation of the QR decomposition and the size-reduction. By Theorem . . , this complexity is a O d 3 n h p/ log p + d 2 n h p , yielding a global com- plexity of O d 5 n h p + d 4 n h p log p = O d 5 n h p log p . . . . . Bounding the precision at each level. We now bound the precision used in the recursive calls at the top-level of the Reducealgorithm: Lemma . . . The sum of all bit sizes used in the recursive calls at the toplevel is O d 2 p , when subjected to the conditions:

min σ:K h →C,R (1)
i,i ∈R (1) σ(R (1) i,i ) ≥ 2 -p d log n h + n h log n h log log n h < p.
Proof. Recall that the potential of the basis is de ned as

Π = d ∑ j=1 (d -j) log(N K h /Q (R j,j )),
which is in O n h d 2 p by assumption on p. Let 1 ≤ j ≤ d, then the reduction algorithm is about to perform a local reduction of the projected sublattice (r j , r j+1 ), as presented in Paragraph . . . , two cases can occur:

• Either N K h /Q (R (i) j,j ) ≤ min 2 αn 2 h N K h /Q R (i) j,j R (i) j+1,j+1 , N K h /Q R (i) j,j
, and as mentioned in Paragraph . . . the local reduction is not performed. We can consider that we use here a zero precision call.

• Either a local reduction is actually performed and by the result of Section . . , we can use a precision in O p i,j with:

p i = log   max k σ k (R (i) j,j ) min k σ k (R (i) j+1,j+1 )   to represent the projected lattice. Let now set L = log(N K h /Q (R (i) j,j /R (i) j+1,j+1 )) n h .
The precision p i,j is, thanks to the unit rounding Theorem . . a

O L + n h log n h log log n h = O(L),
by hypothesis. The reduction of this truncated matrix yields a unimodular transformation, represented with precision O p i,j , which when applied to the actual basis matrix implies that Π decreases by a term at least:

δ i,j = n h L 2 -αn h -2 -Ω(p)
by Heuristic . . and Theorem . . . Let us bound the ratio p i,j /δ i,j :

p i δ i = L + O n h log n h log log n h L 2 -αn h n h -2 -Ω(p i,j ) = 1 + O √ n h log n h log log n h L n h 2 - αn 2 h L -2 -Ω(p i,j )

2L

.

Now recall that

N K h /Q (R (i) j,j ) ≥ 2 2(1+ε)αn 2 h N K h /Q (R (i) j+1,j+1 )(1 -2 -Ω(p i,j ) ),
the multiplicative error term coming from the precision at which the values of the R (i) j,j and R (i) j+1,j+1 are approximated at runtime. Thus, we have:

n h log n h log log n h /L = O log n h log log n h n h , and
αn 2 h /L ≤ n h 2(1 + ε)
.

As such we have:

p i,j δ i,j ≤ 1 + O log n h log log n h n h n h ε 1+ε + o(1) . But then, δ i,j = Ω(n h εp i,j ).
The potential is always a sum of non-negative terms, so ∑ i,j δ i,j ≤ Π. The sum of the precision for the calls can thus be bounded by O

ε (1+ ) Π n h = O d 2 p , since ε = 1
2 , which concludes the proof.

Eventually we can prove the general complexity of the algorithm:

Proof of Theorem . . . The rst step of the proof consists in selecting a suitable tower of sub elds, for which the relative degrees are chosen to optimize the complexity of the whole reduction. We choose a tower of cyclotomic sub elds

K ↑ h = (Q = K 0 ⊂ K 1 ⊂ • • • ⊂ K h ) with [K i : Q] = n i and n i+1 /n i = r i which satis es r i /n 1/5 i+1 ∈ [1; log f ], so that h = O(log log n).
This always exists as f is log-smooth. We can set α i = 4 h-i+1 to satisfy the conditions of Lemma . . while making Heuristic . . practically possible. By de nition of the value set for p we have p = O(B). And it of course satis es the requirements of Proposition . . . Note that by the choices of local precision made in the proof Lemma . . , a simple induction shows that at each level of the recursion the local precision ful lls the condition of Lemma . . , by the exact choice of the p i,j 's. A by product of this induction asserts that the sum of the precision used in all the recursive calls needed to reduce a projected lattice at level i is a

O p i-1 ∏ j=1 O r 2 j = 2 O(i) B n n i 2 .
Then, since by Proposition . . the complexity of the top-level call at level

i is a O r 5 i n i p log(p) = O r 5 i n i B log(B) . Hence the total complexity at level i is r 5 i /m i • n 2 B log(Bn)2 O(i) = n 2 B log(B) log O(1) n.
Summing over all the levels retrieves the announced result.

An important point is that all recursive calls can be computed in parallel, and as most of the complexity is in the leaves, this leads to an important practical speed-up. We conjecture that when the number of processors is at most n/ log O(1) n, the speed-up is linear. .

. . On symplectic spaces and symplectic groups

In the following, we very brie y introduce the linear theory of symplectic geometry and establish all along this presentation the parallel between the Euclidean and Symplectic geometries.

. . . . De nitions. A symplectic space is a nite dimensional vector space E endowed it with an antisymmetric bilinear form J : E × E → E. We can de ne a natural orthogonality relation between vectors x, y ∈ E as being J(x, y) = 0. The linear transformations of E letting the symplectic structure J invariant is a group, called the J-symplectic group (or symplectic group if the context makes J clear). This group plays a similar role to the orthogonal group for Euclidean spaces.

. . . . Darboux bases. However on the contrary to Euclidean spaces, a symplectic space does not possess an orthogonal basis, but instead a basis e 1 , . . . , e d , f 1 , . . . , f d , so that for any indices i < j we have J(e i , e j ) = 0, J( f i , f j ) = 0, J(e i , f j ) = 0 and J(e i , f i ) > 0. It implies in particular that any symplectic space has even dimension. We have seen that it is easy to transform any basis of a Euclidean space in an orthogonal basis using the Gram-Schmidt orthogonalization process. This iterative construction is easily adapted to the symplectic case. . . . . Symplectic lattice, size reduction. We can now easily adapt the denition of a lattice to the symplectic setting: De nition . . . A symplectic lattice Λ is a nitely generated free Z-module, endowed with a symplectic form J on the rational vector space Λ ⊗ Z Q.

As mentioned in Paragraph . . . , an important tool to reduce lattices is the size-reduction procedure, which can be viewed as a discretization of the Gram-Schmidt orthogonalization. It aims at reducing the size and the condition number of the lattice basis. When dealing with symplectic symmetries, we can also discretize the process to obtain a basis which is close to a Darboux basis.

As we generalized the lattice formalism to O L -modules in number elds, we can generalize straightforwardly the notions of symplectic lattices to the algebraic context. Using the work presented in Section . , we aim at providing a fast reduction algorithm for O L -modules using these symplectic considerations. . . . . Towards an improved algorithmic size-reduction. The speci cities of the symplectic symmetry and of the evoked symplectic size-reduction enable a faster algorithm.

Indeed, we demonstrate that a local reduction within the rst half of the matrix can be applied directly to the second half. This almost divides by two the overall complexity at each descent.

In the rest of this section, we generalize the work of Gama, Howgrave-Graham and Nguyen [ ] on the use of symplectic symmetries lattices within the reduction process. In particular, we show that such techniques can be used for all towers of number elds, and instead of an overall constant factor improvement, we can gain a constant factor at each oor of the tower and then cumulate them. Lattice reduction algorithms hinge on the two following facts:

Size reduction: We can control the bit size without changing the Gram-Schmidt norms.

Local reduction: Any two consecutive Gram-Schmidt norms can be made similar.

We therefore have to show that these two parts can be done while preserving the symplectic property.

. . J-Symplectic group and compatibility with extensions

In all the following we x an arbitrary tower of number elds

L ↑ h = (Q = L 0 ⊂ L 1 ⊂ • • • ⊂ L h ).
For any 1 ≤ i ≤ h we denote by d h the relative degree of L h over L h-1 . On any of these number elds, we can de ne a simple symplectic form, which derives from the determinant form:

De nition . . . Let L be a eld, and set J to be an antisymmetric bilinear form on L 2 . A matrix M ∈ L 2×2 is said to be J-symplectic (or simply symplectic if there is no ambiguity on J) if it lets the form J invariant, that is if

J • M = J.
Let us instantiate this de nition in one of the elds of the tower L ↑ h on the 2 × 2-determinant form. Let J h be the antisymmetric bilinear form on L 2 h which is given as the determinant of 2 × 2 matrices in L h , i.e.

J h x 0 x 1 , y 0 y 1 = x 0 y 1 -x 1 y 0 .
Remark. In the presented case, M is J h -symplectic i det M = 1.

Notice that we can always scale a basis so that this condition is veri ed. We descend the form J h to L h-1 by composition with a non-trivial linear form L h → L h-1 , for instance by using the relative trace, that is J h = tr L h /L h-1 • J h . We then extend the de nition of symplectism to L 2d h h-1 by stating that a 2d h × 2d h matrix M is symplectic if it preserves the J h form, that is if J h • M = J h . This construction is tailored to be compatible with the descent of a matrix to L h-1 in the following sense:

Lemma . . . Let M be a 2 × 2 matrix over L h which is J h -symplectic, then its descent M ∈ L 2d h ×2d h h-1 is J h -symplectic.

. . Towards module transformations compatible with J-symplectism

Before exposing the transformation matrices in our size-reduction process of symplectic lattices, we give an insight on these techniques coming from the Iwasawa decomposition of Lie groups.

. . . . On the Iwasawa decomposition. The Iwasawa decomposition is a factorization of any semisimple Lie group in three components, which generalizes the decomposition of GL(n, R) in the product KAN where K = O(n, R) is the orthogonal group, A is the group of diagonal matrices with positive coe cients and N is the unipotent group consisting of upper triangular matrices with s on the diagonal. This decomposition of GL(n, R) arises directly from the Gram-Schmidt decomposition of any real matrix and extracting the diagonal of its R part. The J-symplectic group de ned here is a semisimple Lie group and thus is subject to Iwasawa decomposition. We aim at using an e ective version of the Iwasawa decomposition. In order to compute e ectively such a decomposition, we need to nd a generating set of elementary transformations over bases, which generalizes the operators of transvections and swaps in the general linear case.

We start by treating a simpler case, suited for cyclotomic extensions: the Kummer-like extensions. The general case can be done in a similar way, but requiere to be careful of the rami cation of places in the extemsion. We discuss this problem in Appendix . . . . . A simple case: Kummer-like extensions L[X]/(X d h + a). We de ne R d h as the reverse diagonal of 1 in a square matrix of dimension d h .

In this section, we use the notation A s as a shorthand for R d h A T R d h , which corresponds to the re ection across the antidiagonal, that is exchanging the coe cients A i,j with A d h +1-i,d h +1-j . We proceed here by adapting the work of Sawyer [ ]. Suppose that the de ning polynomial of

L h /L h-1 is X d h + a. Recall that J h is the 2 × 2-determinant form over L 2
h . We can compose it by the linear form

L h ∼ = L h-1 [X]/(X d h + a) -→ L h-1 y -→ tr L h /L h-1 ( Xy d h a )
, to construct the matrix J h , which now becomes

J h = 0 R d h -R d h 0
in the power basis. In this particular setting we retrieve the instantiation of [ ]. In particular:

Lemma . . . Fix a basis of the symplectic space where the matrix correspond-

ing to J h is 0 R d h -R d h 0
. Then, for any M a J h -symplectic matrix and QR its QR decomposition, both Q and R are J h -symplectic.

Proof. Direct from the explicit Iwasawa decomposition given by [ ].

Lemma . . (Elementary J h -symplectic matrices).

• For any A ∈ GL(d h , L h ), A 0 0 A -s is J h -symplectic. • For any A ∈ GL(2, L h ) with det A = 1 the block matrix     Id d h -1 0 0 0 A 0 0 0 Id d h -1     is J h symplectic.
Proof. By direct computation.

We now turn to the shape of triangular J h symplectic matrices.

Lemma . . . Block triangular symplectic matrices are exactly the matrices of the form

A AU 0 A -s where U = U s . Proof. Let M = A U 0 B
a block triangular matrix. By Lemma . . , the action of the block diagonal matrices A 0 0 A -s by left multiplication preserves the J h -symplectic group, so that without loss of generality we can suppose that A is the identity matrix. Identifying the blocks of M T J h M = J h yields two relations:

• R d h B = R d h , entailing B = Id d h , • B T R d h U -U T R d h B = 0, so that R d h U = U T R d h
, and as such U = U s .

. . . . Size-reduction of a J h -symplectic matrix. A direct consequence of Lemma . . is that the local reductions occurring during the reduction, that is swaps and transvections can preserve the J h -symplectism by using the corresponding previous constructions. Consider X a J h -symplectic matrix, we want to e ciently size-reduce X using the symmetries existing by symplectism. Let rst take the R part of the QR-decomposition of X and make appear the factors A and U as in Lemma . . .

Then we can focus on the left-upper matrix A and size-reducing it into a matrix A . Each elementary operations performed is also symmetrically performed on A s to retrieve (A ) s . Eventually the size reduction is completed by dealing with the upper-right block, which is done by performing a global multiplication by

Id d h -U 0 Id d h .
The corresponding algorithm is given in Algorithm , and uses the "classical" Size-Reduce procedure as a subroutine. The recursive reduction algorithm using the symplectic structure is then the exact same algorithm as Algorithm , where the size-reduction call of line is replaced by Symplectic-Size-Reduce.

Algorithm -Symplectic-Size-Reduce Input : R-factor of the QR decomposition of a

J h -symplectic matrix M ∈ O d×d L h Output : A J h -symplectic unimodular transformation U representing the size-reduced basis obtained from M. Set A, U such that A AU 0 A -s = R V ← Size-Reduce(A) return V -V U 0 V -s
The size reduction property on A implies that both A and A -1 are small, and therefore it is easy to check that the same is true for the now reduced R and of course for the corresponding size reduction of the matrix X itself.

This approach admits several algorithmic optimizations:

• Only the rst half of the matrix R is actually needed to perform the computation since we can retrieve the other parts. Indeed, with the equation QR = X, R is upper triangular and it only depends on the rst half of Q.

• Further, we compute only the part above the antidiagonal of AU. This is actually enough to compute the part above the antidiagonal of the matrix A -1 (AU), which is persymmetric .

• An interesting implication is that since we need to compute only half of the QR decomposition, we need (roughly) only half the precision .

. .

Improved complexity

We analyze the algorithm of the previous section with the improvements of Paragraph . . . . The notation used in this section are the same as in Section . , with the notable exception that we may use here a large ε-recall that it was xed to 1/2 in all of Section . . We also assume that α >

We call persymmetric a square matrix which is symmetric with respect to the northeast-tosouthwest diagonal. Not using the Cholesky decomposition also halves the precision needed.

log n h log log n h for the sake of simplicity. We use here the modi ed potential where we consider only the rst half of the matrix:

Π = d h ∑ i=1 (d h + 1 -i) log N L h /Q (R i,i ).
To complete the proof we need an experimentally validated heuristic on the repartition of the potential during the reduction.

Heuristic . . . The potential Π is, at the end of Reduce, always larger than the potential of an orthogonal matrix with the same volume.

Remark. This heuristic hinges on the fact the sequence of L h /Q (R i,i ) is nonincreasing, which is always the case in practice for random lattices.

We now give a better bound on the increase in bit sizes, which is a re nement of Lemma . . . The proof is done in the exact same manner.

Lemma . . . Suppose the input matrix M is a descent of a 2 × 2 triangular matrix u v 0 w
, where the diagonal elements have been balanced in the sense of Theorem . . . Under Heuristic . . , the sum of all bit sizes used in the recursive calls at the top-level is at most

pd 2 h 1 + 1 ε 1 2 + 1 d h + O log n h log log n h n h , with p = log max σ:L h →C,R i,i ∈R σ(R i,i ) min σ:L h →C,R i,i ∈R σ(R i,i ) ≥ n h d h ,
where the σ runs over the possible eld embeddings and the R i,i are the diagonal values of the R part of the QR-decomposition of M.

Proof. Without loss of generality, up to scaling, we can assume that

N L h+1 /Q (u)N L h+1 /Q (w) = N L h /Q ∏ i R i,i = 1.
Therefore, with our choice of p, we have at the beginning

R i,i ≤ u ∈ 2 p/2+O √ n h d h log(n h d h ) log log(n h d h ) .
Thus we have :

Π = n h d h (d h + 1) 4 p + O n h d h log(n h d h ) log log(n h d h ) = n h d h (d h + 1) 4 p 1 + O log n h log log n h n h ,
since by hypothesis, p > n h d h . And then by, Heuristic . . , we have Π ≥ 0 at the end of the calls. When performing local reductions, as in the proof of Lemma . . , two cases can occur:

• Either N L h /Q (R (i) j,j ) ≤ 2 2(1+ε)αn 2 h N L h /Q (R (i) j+1,j+1
), and as mentioned in Paragraph . . . the local reduction is not performed, so that we can consider that we use here a zero precision call.

• Either a local reduction is actually performed and by the result of Section . . , we can use a precision in O p i,j with:

p i,j = log   max k σ k (R (i) j,j ) min k σ k (R (i) j+1,j+1 )   , Let now set L = log(N L h /Q (R (i) j,j /R (i) j+1,j+1 )) n h .
The value p i,j is, thanks to the unit rounding Theorem . . a

L + O n h log n h log log n h ,
by hypothesis. The reduction of this truncated matrix yields a unimodular transformation, represented with precision O p i,j , which when applied to the actual basis matrix implies that Π decreases by a term at least:

δ i,j = n h L 2 -αn h -2 -Ω(p)
by Heuristic . . and Theorem . . . Let us bound the ratio p i,j /δ i,j :

p i δ i = L + O n h log n h log log n h L 2 -αn h n h -2 -Ω(p) = 1 + O √ n h log n h log log n h L n h 2 - αn 2 h L -2 -Ω(p) 2L . Now recall that N L h /Q (R (i) j,j ) ≥ 2 2(1+ε)αn 2 h N L h /Q (R (i) j+1,j+1 )(1 -2 -Ω(p)
), the multiplicative error term coming from the precision at which the values of the R (i) j,j and R (i) j+1,j+1 are approximated at runtime. Thus we have:

n h log n h log log n h /L = O log n h log log n h n h , and
αn 2 h /L ≤ n h 2(1 + ε)
.

As such we have:

p i,j δ i,j ≤ 1 + O log n h log log n h n h n h ε 1+ε + O(1/n h ) .
The sum of precisions is therefore multiplied by

d 2 h 1 + 1 ε 1 2 + 1 2d h + O log n h log log n h n h ,
which nishes the proof.

.

We can now collect all the calls at each level to compute the global complexity, for re ning Theorem . . : Theorem . . . Select an integer f a power of q = O(log f ) and let n = ϕ( f ). The complexity for reducing matrices M of dimension two over K = Q[x]/Φ f (x) with B the number of bits in the input coe cients is heuristically

Õ n 2+ log((1/2+1/2q)(1+1/ε)) log q B
and the rst column of the reduced matrix has coe cients bounded by

exp O n 1+ log((1+ε) 2q-1 q ) log q N L h /Q (det M) 1 2n .
Proof. The proof is now exactly the same as for Theorem . . . We select a tower of cyclotomic sub elds

L ↑ h with L 0 = Q, [L i : Q] = n i , n i+1 /n i = d i = q for i < h and L h = K with h = log f / log q.
We remark that we can take

α i = n i (1 + ε)
2q -1 q i and all our previous assumptions are ful lled. The complexity at the level i is O q 5 n i p log(Bn) for precision p but the sum on the precision over all calls is a:

O B ∏ j>i 1 + 1 ε 1 2 + 1 2q + O log n i log log n i n i d 2 j , which simpli es in O   B n n i 2 (1 + 1 ε )(q + 1) 2q h-i   .
Summing over all i gives the result.

Selecting ε = log n, and combining with the analysis of previous section yields:

Corollary . . . Select an integer f a power of q = O(log f ) and let n = ϕ( f ). The complexity for reducing matrices M of dimension two over K = Q[x]/Φ f (x) with B the number of bits in the input coe cients is heuristically

Õ n 2+ log(1/2+1/2q) log q B + n O(log log n)
and the rst column of the reduced matrix has coe cients bounded by

2 Õ(n) N L h /Q (det M) 1 2n .
Clearly, for B = n ω(1) , we can choose ε = ω(1) and get a running time of n

2+ log(1/2+1/2q) log q +o(1) B.
. The framework introduced in the previous sections have been implemented and tested. This section details various optimizations, implementation choices, improvement directions, as well as gives an experimental assessment on the heuristics used in the complexity proofs.

. .

On the choice of the base case

Let h > 0 be a non-negative integer. The setting of the reduction is a tower of power-of-two cyclotomic elds

L ↑ h = (Q = L 0 ⊂ L 1 ⊂ • • • ⊂ L h ).
. . . . Stopping the reduction before hitting Z. As stated in Theorem . . , the approximation factor increases quickly with the height of the tower. However, if we know how to perform a reduction over a number eld above Q, say L 1 for instance, directly, then there is no need to reduce up to getting a Z-module and we instead stop at this level. Actually, the largest the ring, the better the approximation factor becomes and the more e cient is the whole routine. As seen in Chapter , it is possible to come up with a direct reduction algorithm for an algebraic lattice when the underlying ring of integer is norm-Euclidean. Hence a natural choice would be Z[x]/(x n + 1) with n ≤ 8 as these rings are proved to be norm-Euclidean. . . . . The ring Z[x]/(x 16 + 1). However, it turns out that while L = Z[x]/(x 16 + 1) is not norm-Euclidean, we can still use this as our base case. As such, we need to slightly change the algorithm in case of failure of the regular algorithm. Given a, b, we use the randomized unit rounding of {µ} computed by Theorem . . with µ = a/b, which gives a unit u such that u 2 {µ} is round. We accept the change if

N L/Q (a -b( µ + u{µ} u -1 )) < N L/Q (a)
and restart up to a hundred times if it fails. This algorithm restarts on average 0.7 times and fails every 50000 times. On failure, one can for example use a more complicated approach; but as long as the number of bits is not gigantic, we can simply stop there since the other reductions around the two Gram-Schmidt norms will randomize everything and the algorithm can smoothly continue. The terms a, b tend to slowly accumulate a unit contribution when n ≥ 4, and it is therefore needed to rebalance them using randomized rounding. For n = 16, this happens on average every 50 times. . . . . Comparison between the base elds. We give in the Table . the properties of the various possible base cases between the dimension over Q-that is Q itself-and , as described above. In practice, we of course want the base case to be (relatively) fast. A heuristic method, used for instance in the implementation fpLLL, consists in applying a divide-andconquer strategy on the most signi cant bits: we rst reduce the input matrix with half the precision, apply the transition matrix, and reduce the rest with about half the precision. After that, we can run the full reduction one more time to verify that the lattice is indeed reduced.

. . Decreasing the approximation factor

In several applications, it is interesting to decrease the approximation factor. Our technique is, at the lowest level of recursion, and when the number of bits is low, to use a -type algorithm. Each time the reduction is nished, we descend the lattice to a lower level where the approximation factor is lower and restart the reduction on this descent.

. . Lifting a reduction

One might expect that, as soon as the ideal generated by all the N K/L (a i ) and N K/L (b i ) is O L , that for most of the small x ∈ O K , we would have

N K/L ( a, x )O L + N K/L ( b, x )O L = O L .
There is, however, a profusion of counterexamples to this and the algorithm often stumbles on them. This implies that the lift of a short vector can actually be quite large, depending on the norm of the ideal generated by the elements N K/L ( a, x ) and N K/L ( b, x ). A solution which practically works is to increase the number of short vectors we consider in the lifting phase: instead of lifting one vector, we lift multiple of them. As such, the lift step never causes problem when we are reducing a random lattice. In our exper-iments with random lattices, the average number of lifted vectors is around 1.5. When the lattice is not random, for example with a short planted element, it sometimes completely fails: at each round in the algorithm, the lift will return a long vector even if the recursive reduction found plenty of short ones. While this may not be a problem for some applications -nding a short vector in a lattice implies an ability to decrypt -it is an important one for others. Our proposed solution to this di culty is to use a pseudobasis instead of a basis. Indeed, it is a standard fact that the rst element can be lifted into a unimodular pseudo-basis [ , Corollary . . ]. Of course, we need to have a fast ideal arithmetic and to keep the ideals of small norm, which is neither easy nor fast and will be the subject of a future work.

. . Towards a fully recursive structure

A bottleneck with Algorithm is that each round needs a matrix multiplication, and there are at least d 2 rounds. However, one can notice that each round only make local modi cations. As a result, we propose to use a small number D of blocks, typically or su ces, and a round will (recursively) reduce consecutive pairs of dimension d/D. The resulting number of rounds is again O D 2 log B , which gives a top-level complexity of O D 2 (equivalent) multiplications. The corresponding algorithm is given in the Algorithm . We describe this algorithm with respect to an oracle Oracle which computes the base case. One can either use Schonhage, the algorithms in the previous or current section, or a recursive call. Thus, this general strategy can be used to reduce Euclidean lattices, as well as large rank algebraic lattices. A precise analysis on its cost would be of interest and is a clear direction of future work.

Algorithm -Recursive Reduce

Input

:

Basis M ∈ O d×d K of the O K -module M Output : A unimodular transformation U ∈ O d×d K representing a reduced basis of M. if d = 2 then return Oracle(M) for i = 1 to ρ do R ← Orthogonalize(M) U i ← Seysen-Size-Reduce(R) (M, R) ← (M, R) • U i for j = 1 + (i mod 2) to d by step of 2d/D do U ← Reduce(R[j : j + 2d/D -1, j : 2d/D -1]) (U i , M) ← (U i , M) • Diag Id j , U , Id 2d-j-2 ) end for end for return ∏ ρ i=1 U i //
The product is computed from the end .

. . Other details

The prototype of the program was written in the interpreted language Pari/GP [ ]. It uses the native functions for multiplying eld elements, which is not at all optimal, and even more so when we multiply matrices. Only the recursive calls were parallelized, and not the Gram-Schmidt orthogonalization nor the size reduction, which limits the speed-up we can achieve in this way. We used the Householder method for the QR-decomposition. The symplectic optimization was used at each step, and was not found to change the quality of the reduction .

. The fast reduction procedure for cyclotomic ideals can be used to build a fast implementation of the Gentry-Szydlo algorithm [ ]. This algorithm retrieves, in polynomial time, a generator of a principal ideal f O L given its relative norm f f in cyclotomic elds, or more generally in CM elds. This algorithm is a combination of algebraic manipulations of ideals in the eld and lattice reduction.

. . Gentry-Szydlo.

In this section, we brie y recall the crux of the Gentry-Szydlo algorithm [ ].

This algorithm aims at solving the following problem, presented in its whole generality:

Problem (Principal ideal problem with known relative norm). Let L be a CM-eld, of conjugation x → x, and denote by L + its maximal totally real sub eld. Let f ∈ O L and set f = f O L , the ideal spanned by this algebraic integer.

Input: The relative norm N L + /Q ( f ) = f f and a Z-basis of the ideal f. Output: The element f . We can use the reduction of an ideal as follows: from f and f f we start by reducing the

O L -lattice f O L f f ,
and nd an element of the shape f x where x ∈ O L and is small. Now we have that: We also have xx = f x f x f f so that we have reduced the problem to the smaller instance (xO L , xx).

f = f f f x xO L Gama,
For the sake of simplicity, we give here the outline of the remaining part of the algorithm for a cyclotomic eld of conductor a power of two. The algorithm selects an integer e such that f e mod r is known with a large r. Binary exponentiation with the above reduction computes a xO L with a short x ∈ O L and such that f e = Px with P known (and invertible) modulo r and q k . Now we can deduce x mod and since x is small, we know x. The last step is to extract an e-th root modulo q k . We choose q such that qO L = qq which always exists in power of two cyclotomic elds since (Z/2nZ) × /{-1, 1} is cyclic. Extracting e-th root modulo q is easy, as e is smooth. There are gcd(e, q n/2 -1) such roots, and we can choose q such that for each p|e with p not a Fermat prime, q n/2 = 1 mod p. If we choose f mod q as a root, then we know f mod q, and we also know f f so we can deduce f mod q. As a result, we know f mod q and Hensel lifting leads to f mod q k . For k su ciently large, we recover f .

We choose e to be the smallest multiple of 2n, such that r, the product of primes p such that 2n|p -1|e, is su ciently large. One can show [ ] that log e = O(log n log log n) is enough and heuristically taking e as the product of n and a primorial reaches this bound.

. .

Faster multiplication using lattice reduction.

The bottleneck of the Gentry-Szydlo algorithm is to accelerate the ideal arithmetic. We represent ideals with a small family of elements over the order of a sub eld O L . One can represent the product of two ideals using the family of all products of generators. However, this leads to a blow-up in the size of the family. A reasonable approach is simply to sample a bit more than [L : K] random elements in the product so that with overwhelming probability the ideal generated by these elements is the product ideal itself. It then su ces to reduce the corresponding module to go back to a representation with smaller generators. An important piece is then the reduction of an ideal itself. Our practical approach is here to reduce a square matrix of dimension [L : K], and every two rounds to add a new random element with a small Gram-Schmidt norm in the ideal at the last position.

In our experiment, we reduce up to 1.05 n (respectively 1.1 n ) the rst ideal to accelerate the powering with n ≤ 512 (respectively n = 1024). The smallest e such that this approximation works at the end was chosen. The other reductions are done with an approximation factor of 2 n/5 (respectively 2 n/3 ).

We emphasize that the implementation hardly used all cores: for example, the total running time over all cores in the last case was hours. The runtime of the rst implementation published [ ] in dimension was hours. Assuming it is proportional to n 6 leads to an estimate of years for n = 1024, or 800 times slower than our algorithm. Our practical results are compiled in Table . . This algorithm will play a role in the following chapter to speedup a whole algorithm for solving the so-called principal ideal problem, as well as in the cryptanalysis of a signature scheme in Chapter .

T H E P R I N C I P A L I D E A L P R O B L E M

In the previous chapter we devised algorithms for the reduction of algebraic lattices and in particular of so-called ideal lattices. We now make use of these reduction to solve a well-known problem in e ective number theory.

Recall that in an arbitrary number eld, even though every ideal is generated by two elements, not all of them can be generated by only one.

Example. Let L = Q[i √ 5].
The elds embeddings of L into C are on the one hand the identity map and on the other hand the linear map sending i √ 5 on -i √ 5. Hence the algebraic norm of any element α = (a

+ bi √ 5) is N LQ (α) = a 2 + 5b 2 .
Let now a be the ideal of O L spanned by the elements 2 and 1 + i √ 5. Let us rst show that this ideal is of norm . We x the Z-basis B = (1,

1 + i √ 5) of O L = Z[i √ 5]. Hence, the ideal a is generated as Z-module by (2, 2 + 2i √ 5, 1 + i √ 5, 2i √ 5 -4), that is by (2, 1 + i √ 5)
. Thus the corresponding matrix in B is:

M = 2 0 0 1 , implying that N(a) = O L a = Z 2 MZ = det(M) = 2.
This ideal is not principal. Indeed, suppose it is generated by an element α. Then we have

N(a)|N(2O L ). Since N(2O L ) = N L/Q (2) = 4, we deduce that N L/Q (α)|4. Similarly, N(a)|N((1 + i √ 5)O L ), implying that N L/Q (α)|6. As such we have N L/Q (α)|2.
As there are no integers of norm equal to , this is the desired contradiction.

The Principal Ideal Problem ( ) consists in nding a generator of an ideal in a number eld, assuming it is principal.

Example. Let us x a Z-basis of O L , for instance B = (1, i √ 5
). An instance of the principal ideal problem in the eld L can be for example: given the ideal T represented by the free Z-module spanned by 18 14 0 2 in B, retrieve its generator, up to a unit. In this particular case, an admissible answer is

τ = 4 -2i √ 5, as we can check that N L/Q (τ) = 36 = N(T).
Indeed, for a generic element α = x + yi √ 5 we have N L/Q (α) = x 2 + 5y 2 , which clearly can not be equal to .

In degree one-that is over the eld Q-the problem is fairly easy, as it reduces to nd a generator of an ideal of Z given by some generators, that is to compute the greatest common divisor of these elements, as Z is principal. In higher degree, the problem is considered as hard in computational number theory. It appears that its resolution is actually related to another hard problem in this area: the computation of the class groups of the number eld, as we need to sample independent relations in the class group. Interestingly, even the (apparently) simpler problem of testing the principality of an arbitrary ideal does not seem easier, as precised by Cohen in [ , Chapter ] and Thiel in [ , Section ] (essentially, solving this problem consists in trying to compute the class of the ideal in the class group to compare it with the neutral elements).

More practically, in the eld of cryptography, this problem appears in the context of Fully Homomorphic Encryption (FHE) [ ], a scheme of encryption where computations are possible over encrypted data. A usual setting for this type of cryptographic schemes are ring of integers of cyclotomic elds. For instance, the security of the scheme presented by Smart and Vercauteren [ ] relies on the di culty of , which consists in nding a short generator of a principal ideal. We discuss the practical implication of the resolution of in the nal part of this manuscript, where we demonstrate a total break of the scheme Chapter .

From class group computations to

Solving the principal ideal problem essentially requires the computation of the ideal class group, that is the class group of the ring of integers, of the number eld L where the ideals are de ned. This approach is described in [ , Algorithm . . ]. The rst subexponential algorithm for computing the class group was due to Hafner and McCurley [ ]. It applies in the context of imaginary quadratic elds and has been generalized by Buchmann [ ] to classes of number elds of xed degree. In [ ], Biasse and Fieker presented an algorithm for computing the class group in subexponential time in arbitrary classes of number elds. This yields a subexponential time algorithm for solving the in arbitrary classes of number elds. In a prime-power cyclotomic eld of degree n, the Biasse-Fieker algorithm solves the in time 1) , for ε > 0 arbitrarily small. A quantum polynomial-time algorithm for solving the was also described by Biasse and Song in [ ]. In this chapter, we present a subexponential algorithm which solves the in general cyclotomic elds. Its running time in such a eld L is

L ∆ 2 3 + ε ≈ 2 n 2/3+o(
L ∆ 1 2 , ω 2 2(ω -1) ≈ 2 n 1/2+o(1) ,
with ω being the exponent of the arithmetic complexity of matrix multiplication.

. Before diving into the subexponential solution to the principal ideal problem, we reintroduce here complementary notions on smoothness in ideal arithmetic, on the possible embeddings of an ideal and on subexponential complexity.

. . The L notation of subexponential complexities

When dealing with subexponential complexities, the L notation has become pretty ubiquitous, especially when studying sieve-based algorithms such as factorization or discrete-logarithm algorithms. It has been introduced by Pomerance in [ ] to simplify the analysis of some factoring algorithms and has then been re ned by Lenstra and Lenstra in [ ] who introduced the second constant term.

Given two constants a and c with α ∈ [0, 1] and c ≥ 0, de ne the class:

L n [α, c] = exp c + o(1) (log n) α (log log n) 1-α ,
where o(1) is the class of functions vanishing as n tends to in nity. We also encounter the simpli ed notation L n (α) when specifying c is super uous. This class encompasses the functions of polynomial-growth when taking α = 0 and the exponential-growth when α = 1. The term in

exp c(log n) α (log log n) 1-α
expresses the dominant term, while the

exp o(1)(log n) α (log log n) 1-α
term hides all of the negligible such as polynomial factors.

Remark. Let L = Q[ζ f ] the cyclotomic eld of conductor f . Then by Theorem . . , its discriminant ∆ satis es: 1) , so that for any α > 0 we have

∆ = (-1) ϕ(n)/2 n ϕ(n) ∏ p|n p ϕ(n)/(p-
log(L ∆ [α]) = f α+o(1) ,
using the trivial estimate ϕ( f ) < f . Denoting by ∆ + the discriminant of its maximal real sub eld we have

log(L ∆ + [α]) = f α+o(1) , as ∆ ≥ (∆ + ) 2 .
. .

Smooth ideals

. . . . Smoothness and ideals. Let us x a number eld L of discriminant ∆. Recall that any ideal of O L can be decomposed as a product of prime ideals and that this decomposition is unique up-to-the ordering of the product.

De nition . . . Let a be a principal ideal of O L and y > 0 a non-negative real. The ideal a is said to be y-smooth if it is the power-product of prime ideals of norm all bounded by y.

For our purposes, we need to rely on heuristics to evaluate the smoothness probabilities of ideals. They are generalizations of similar results for integers of Can eld, Erdős and Pomerance [ ].

Heuristic . . . The probability P (x, y) that an ideal of norm bounded by x is y-smooth satis es P (x, y) ≥ e -u(log u)(1+o(1)) for u = log x log y .

Corollary . . . Assuming that x = L ∆ [α 1 , c 1 ] and y = L ∆ [α 2 , c 2 ],
with α 1 > α 2 , Heuristic . . can be expressed as

P (x, y) = L ∆ α 1 -α 2 , (α 1 -α 2 ) c 1 c 2 -1
.

A similar assertion for smoothness of ideals was proved by Seysen [ ] in for the quadratic case, but for arbitrary degree, it remains conjectural, even under the Generalized Riemann Hypothesis. This is one of the reasons why the complexity of the number eld sieve ( ) [ ] is still a heuristic estimation.

. . . . On smoothness testing. A natural computational question raised by the de nition of smoothness is how to test if an arbitrary ideal a is B-smooth for a bound B > 0. Following the de nition gives the naive approach of factoring a in prime ideals and compute the norm of each of them. However, this approach requires to factor the norm of a over the integers and as such its complexity depends on a and not on B, which can be way smaller than N(a). Now remark that if a is B-smooth, then, in particular, its norm is also B-smooth. Hence, we want to test the smoothness of N(a). If this norm is not B-smooth we thus know that the ideal is not smooth. In the other case, if we know the prime factors appearing in the norm, it su ces to nd the valuations at the prime ideals above them. A way to derive these valuations is explained in [ , Section . . ]. The algorithm described also has a complexity that is polynomial in the extension degree and the size of the prime and henceforth in log B.

The probability distribution taken here is the uniform distribution over the nite set of ideals of norm bounded by x.

The whole test then reduces to e ciently test an integer for smoothness and to extract its factors if so. This can be done e ciently using a Monte-Carlo approach based on the Elliptic Curve Method ( ) for integer factorization.

This algorithm has been introduced in by Lenstra [ ]. It is the asymptotically fastest method that has been published for nding relatively small factors of large composites. Given an odd composite integer n to be factored, this method consists in performing arithmetic operations on elliptic curves considered over a nite eld F p for an unknown prime p dividing n. It nds p if the cardinality of at least one of these curves over the eld F p is smooth. For this reason, we use curves that are known to have favorable smoothness properties, such as a large torsion group over Q or a cardinality that is divisible by a xed factor.

Let N be an integer to test for B-smoothness. The crux of the smoothness testing is to launch on as many curves as we can in time Poly(log

N) • L B 1 2 , √
2 , which will return the factorization of N if it is B-smooth and "non smooth" otherwise. Heuristic . . . Let L be a number eld, a an ideal of O L and B > 0. Then, we can test in expected time:

Poly([L : Q], log N(a)) • L B 1 2 , √ 2 , ( . )
the B-smoothness a.

. . On the possible lattices structure of ideals

Let L be a number eld of degree n and a an ideal of O L . In Paragraph . . . , we saw that since a has a natural structure of O L -module, it can be endowed with the canonical norm of L so that it is actually an O L -lattice. Thus its direct image over Z is a Z-lattice, as described in Chapter . However in certain cases it can be useful to consider a somehow more "direct" lattice structure by taking the norm of the coe cients appearing in the decomposition in a xed basis of O L . Since this concept will only be developed in the case of the cyclotomic extensions we stick to this class of eld to ease the following development.

. . . . Coe cient 2 -norm. Suppose now that L is a cyclotomic eld and take ζ a primitive root of unity so that

L ∼ = Q(ζ), then O L ∼ = Z[ζ]. In the integral power basis (1, ζ, ζ 2 , • • • , ζ n-1 ) any algebraic integer x ∈ O L decomposes as ∑ n-1 i=0 x i ζ i , with x i ∈ Z.
This coordinate identi cation ι is an explicit isomorphism of Z-modules between O L and Z n as we have

O L ∼ = Z[ζ].
We can then lift the usual norm on Z n to O L in order to make the coe cient identi cation an isometry:

x 2 = n-1 ∑ i=0 x 2 i .
. . . . On the lattice structure involved by the coe cient 2 -norm. Since the 2 norm over Z n is an Euclidean norm, so is its lift over O L , making O L , and more generally any ideal a ⊆ O L an Euclidean lattice. The isomorphism of Z-modules ι makes the computation of its covolume straightforward:

Proposition . . . Let L be a cyclotomic eld and a an ideal of O L . Then the covolume covol 2 (a) of the direct image over Z of the O L -lattice given by a for the coe cient 2 -norm for the integral power basis, is N L (a).

Proof. Clearly we have:

covol 2 (a) = covol(ι(a)) = Z n ι(a) = ι(O L ) ι(a) = O L a = N(a),
as ι is an isomorphism of Z-modules.

This should be compared to the covolume of the direct image of a for the canonical norm of L, which is N(a) |∆ L |, by de nition of the covolume given in Section . .

Λ 2 = Z 2 , 9 3
3 2 .

Indeed, the coe cients of 3 is of course (3, 0) T , which is a vector of norm 3, the coe cients of 1ζ 3 are (1, 1) T of norm √ 2. The inner product of these two vectors is 3 × 1 + 0 × 1 = 3.

Under the canonical norm it is isometric to: We have the same result for the maximal real sub eld L + of L, this time for the folded power basis. De ne ς + the coe cient embedding for the basis Proposition . . . Let L be a cyclotomic eld, L + its maximal real sub eld, and a an ideal of O L + . Then the covolume covol 2 (a) of the direct image over Z of the O L + -lattice given by a for the embedding ς + , is N L + (a).

Λ c = Z 2 , 18 9 9 4 . We can check that |covol(Λ c )/ covol(Λ 2 )| 2 = 3 = |∆ L |. Indeed, the em- bedding of 3 is the vector (3, 3) T of norm 3 √ 2, the embedding of 1 -ζ 3 is (1 -ζ 3 , 2 + ζ 3 ) T of
(ζ i + ζ -i ) i of O L + (
Proof. The proof is done in the exact same way as for Proposition . . , using this time the fact that ς Input: B, a basis of a as a free Z-module of rank n.

+ (O L + ) = Z n 2 as O L + = Z[ζ + ζ -1 ] from Proposi- tion . . .
Output: The generator g ∈ O L , modulo the unit group O × L .

We rst give an overview of the whole strategy we use to solve this problem.

. . High level description

Before any other operations, the ambient dimension of the problem is shrunk by half by reducing the problem to an equivalent one in the maximal real sub eld

L + = Q ζ + ζ -1
. This reduction is not necessary from a theoretical point of view, but eases the computation as we are working with objects of smaller dimension, and decrease the asymptotic complexity. This reduction is a straightforward consequence of the Gentry-Szydlo algorithm introduced in Section . . . Hence the problem is now reduced to the search for a generator of a principal ideal a + in L + . The strategy then splits in three steps.

First, iteratively reduce the size of the ideal whereof we look for a generatorwhile staying in the class of principal ideals-until we eventually reach a B-smooth ideal for a xed bound B > 0. Formally this breaks down to the construction of an algebraic integer h and a B-smooth ideal a s , such that hO L = a + • a s . This is the descent phase. The process is illustrated in e q e q . . . . . . of all the relations among the small generators of the class group, and then rewrite the input ideal with respect to these generators. Then we can recover a generator h 0 of a s by simply solving a linear system of equations. The latter allows us to derive a generator of the ideal a + : h • h 0 -1 . A generator of the initial ideal is eventually obtained by lifting a generator of the ideal a + from the maximal real sub eld to the initial number eld L; this nal step being actually a multiplication by an algebraic integer.

p n • • • • • • • • • • • • • • • • • • • • • • • • • • •
In a nutshell, the full algorithm splits in four main steps, which are :

. Perform a reduction from the cyclotomic eld L to its maximal real sub eld L + , allowing to work in smaller dimension.

. Iteratively lowers the norm of the ideals involved.

. Collect relations on small prime ideals and run linear algebra to reconstruct the generator of the small ideal generated at step .

. Lift the generator from L + to L.

The remaining part of this chapter is devoted to prove the following complexity theorem:

Theorem . . . Let L = Q ζ f ,
which discriminant is denoted by ∆. There exists a heuristic Las-Vegas algorithm which solves the principal ideal problem in L in expected time:

L ∆ 1 2 , ω 2 2(ω -1)
.

Let us now dive into the details of all steps sketched above in order to prove Theorem . . . The estimate of the second constant

ω 2 √ 2(ω-1)
of the complexity is only addressed at the end of Section . . in order to lighten the algorithm description and ease the presentation, so that we only aim at ensuring a complexity of L ∆ 1 2 in a rst time. Recall that we work in L = Q[ζ] of conductor f and degree n = ϕ( f ). For any element u ∈ L, we denote by ū the conjugate of u for the automorphism de ned by ζ → ζ -1 . We are given a principal ideal a = gO L represented by a Z-basis B = (b 1 , . . . , b n ).

. .

Step : Reduction to the maximal real sub eld

As usual when doing computations, we are subjected to the curse of dimensionality: the larger the dimension becomes, the more costly the algebraic numbers are to handle and even only to represent, impacting the e ciency of any algorithm. However, in the present setting it is possible to halve the dimension in which the problem occurs with a polynomial time reduction.

The main part of this step relies on the so-called Gentry-Szydlo algorithm, presented in Section . . . In our case, we cannot perform the recovery of the generator g of the input ideal since a priori we do not have access to any kind of information about the product g • ḡ.

To overcome this di culty, let us introduce another algebraic integer

u = N L/Q (g) g ḡ ,
as described by Garg, Gentry, and Halevi in [ , Section . . ]. Here the norm factor is included only to avoid the introduction of denominators in the de nition of u. Although u is still unknown at this point, thanks to the Z-basis of gO L = a we can construct a Z-basis of uO L , since we have:

uO L = N L/Q (g) g ḡ O L = N(a)aa -1 .
Moreover, we can compute the product u • ū, as it simply corresponds to

N L/Q (g) 2 = N(a) 2 .
From this point we can compute u in polynomial time using the Gentry-Szydlo algorithm, and from this element u, we can directly recover

g ḡ = uN(a) -1 .
Using the basis B of a, we then introduce the family of vectors

c i = b i 1 + ḡ g ,
which is a basis of the ideal a + generated by g + ḡ. This ideal belongs to the maximal real sub eld

L + = Q ζ + ζ -1 , of index in L.
. . . . Lifting the maximal real solution. Suppose that we know the generator (g + ḡ) of a + , up to a unit. Then remark that:

(g + ḡ) 1 1 + g ḡ-1 = ḡ(g + ḡ) ḡ + g = ḡ,
so that we can recover the generator g. Hence, we have reduced the problem of nding a generator of the ideal a belonging to the cyclotomic eld L of dimension n to the one of nding a generator of ideal a + that belongs to the maximal real sub eld L + , whose degree over Q is n 2 .

. .

Step : Descent phase

Let us set aside the algebraic integer obtained in the previous phase and only focus on the ideal a + . By construction, it is principal and generated by g + ḡ, so that we aim at retrieving this generator by solving the principal ideal problem in the maximal real sub eld L + for a + .

. . . . Reducing the general problem to the PIP for small ideals. Suppose that we can solve e ciently this problem for all principal ideals which are B-smooth, for a certain bound B, which is xed. In this context, solving in its whole generality could be done by reduction to the B-smooth case. Formally this translates in the construction of an algebraic integer h and a B-smooth principal ideal a s , such that hO L = a + • a s . . . . . Construction of the elements. The element h and ideal a s are constructed iteratively, by generating at each step ideals of norm smaller and smaller until eventually nding a B-smooth one. We demonstrate in Paragraph . . . that this descent is doable in expected time L ∆ 1 2 from any ideal of algebraic norm bounded in L ∆ [1].

However the initial ideal a + is of arbitrary norm. As such in order to bootstrap this phase, we rst need to nd an ideal that splits as a product of prime ideals of controlled norm on which we will independently apply the descent. In this context being able to bounded the norm of these ideals L ∆ [1] su ces. . . . . Initial round Hence we aim at constructing e ciently an L ∆ [1]-smooth principal ideal from a + . Formally, we want to prove:

Theorem . . . Let L = Q[ζ f
] the cyclotomic eld of conductor f and L + its maximal real sub eld. Denote by ∆ its discriminant. Assuming Heuristic . . , from any ideal a ⊂ O L + , there exists a probabilistic algorithm which generates in expected time L ∆ 1 2 an integral ideal b that is L ∆ [1]-smooth and an algebraic integer v such that

vO L = a • b.
The di culty of this preliminary part is that a priori the norm of the input ideal a can be large. We thus want to construct at rst a candidate ideal a whose norm is bounded independently from N L + (a) and that belongs to the same ideal class as a. The probabilistic argument of Heuristic . . states that if this norm is small enough then the probability of being smooth will be large enough to be easily ampli ed by repetition. Proof. We proceed by lattice reduction, since a is endowed with a natural lattice structure from the canonical norm (see Section . . ). The covolume of the direct image of the lattice a over Z is

√ ∆ • N L + (a). Given an integer 2 ≤ β ≤ n
2 , it follows from Theorem . . on the quantitative analysis of the algorithm that the norm of the smallest vector v of a β -reduced basis of a satis es:

v L + ≤ β n/2-1 2(β-1) N L + (a) 2 n ∆ 1 n , ( . )
the cost of this reduction being upper bounded by Poly(n, log N L + (a))2 O(β) . Since the ideal a contains vO L + , there exists a unique integral ideal b satisfying vO L + = a • b. From Equation . , we have:

N L + /Q (vO L + ) ≤ β n/2(n/2-1) 2(β-1) • √ ∆ • N L + (a).
and by the multiplicative property of the norm, we nd: in

N L + (b) ≤ β n(n-2) 8(β-1) • √ ∆.
Since L is a cyclotomic eld, we are able to choose a block-size

β = log L ∆ 1 2 since log L ∆ 1 2
= n 1 2 +o(1) ≤ n by the remark of Section . . . Then we are able to generate in time

Poly(n, log N L + (a))2 O(β) = Poly(log N L + (a))L ∆ 1 2
an integral ideal of norm bounded by

β n(n-2) 8(β-1) • √ ∆ = log L ∆ 1 2 n 2 log L ∆ [ 1 2 ] = exp log log n 1 2 +o(1) n 3 2 +o(1) = L ∆ 3 2 .
This last result allows us to nd an ideal whose norm is bounded independently from N L (a). We then want this new ideal to split as a product of multiple prime ideals of controlled norms. Thanks to Corollary . . , the probability for an integral ideal b of norm bounded by L ∆ 3 2 to be L ∆ [1]smooth is greater than L ∆ 1 2 -1 , so that a randomized version of the latter construction will yield a smooth ideal after L ∆ 1 2 repetitions. This is the crux of the following proof.

Proof of Theorem . . . The simplest strategy to perform this randomization and be able to repeat the construction, is to compose the input ideal a with some factors of norm less than B = L ∆ 1 2 . Formally, we denote by B = {p 1 , . . . , p |B| } the set of all prime ideals of norm upper bounded by L ∆ 1 2 . As a consequence of Landau's Prime Ideal Theorem [ ],

|B| ∼ L ∆ 1 2 log L ∆ 1 2 -1 = L ∆ 1 2 .
Finding all these ideals can be done in a very naive way by factoring each of the O B log B prime integers 1 < p < B into primes ideals using polynomial factorization over nite elds, which yields a running time bounded by L ∆ 1 2 . Let k, A > 0 be xed integers. We choose p j 1 , . . . , p j k prime ideals of norm below L ∆ 1 2 . Then for any k-tuple e = (e 1 , . . . , e k ) ∈ {1, . . . , A} k , and a k-tuple (j 1 , . . . , j k ) ⊂ {1, . . . , |B|}, denote by P e = p e 1 j 1 • • • p e k j k so that we have:

N L + (aP e ) = N L + a • k ∏ i=1 p e i j i ≤ N L + (a) • k ∏ i=1 N L p e i j i ≤ N L + (a) • L ∆ 1 2 k•A = N L + (a) • L ∆ 1 2 .
Therefore the randomization can be done by choosing uniformly at random the tuple (e 1 , . . . , e k ) and k prime ideals in B. Since |B| = L ∆ 1 2 , the set of possible samples is large enough for sampling a L ∆ 1 2 independent number of di erent ideals.

Using to test for smoothness yields a complexity in L ∆ 1 2 (see Equation . ). Therefore, we can repeat the construction sketched in the proof of Lemma . . , on randomized independent inputs of the shape aP e until one of them eventually yields an L ∆ [1]-smooth ideal b. By Heuristic . . , the expected number of repetitions is a L ∆ 1 2 . To conclude it su ces to remark that the ideal b • P e is of course L ∆ [1]-smooth.

Other ways to perform the randomization may be by randomizing directly the lattice reduction algorithm or by enumerating points of the lattice of norm close to the norm guarantee and change the basis vectors by freshly enumerated ones. The latter would be useful in practice as it reduces the number of reductions. However the asymptotic analysis would remain unchanged.

The full outline of this bootstrapping approach, illustrated in the proof of Theorem . . , is given in pseudocode as Algorithm , Bootstrap.

Algorithm -Bootstrap

← vã -1 // Computed with Z-bases b ← b • ∏ k i=1 p -e i j i end while return v, b . . . . From L ∆ [1] to L ∆ 1 2 -smooth ideals.
In the proof of Theorem . . , we used directly the bound obtained from the reduction. We could not use Corollary . . on the reduction of a part of the of the basis here, since the norm of the ideal a + and thus its volume can be arbitrary large. Nonetheless, the norm of prime ideals appearing in its factorization are by the smoothness condition bounded, making possible the use of this pre-treatment of the underlying lattice. The systematic treatment of this question is the aim of Theorem . . . -smooth ideal b such that

vO L + = a • b.
The core of the proof is similar to the proof of Theorem . . as it relies on lattice reduction backed up with randomization. The di erence lies here in the norm with respect to which the reduction is performed. In Theorem . . , the canonical norm is used, whereas here we use directly the structure arising from the coe cient embedding ς. In the present context it allows a better bound on the size of the short vector found by reduction and therefore a better bound on the norm of the resulting ideal b.

Proof of Theorem . . . Remark that since we work in the maximal real subeld, we can use the folded coe cient embedding ς + for the Z-basis

(ζ i + ζ -i ) i , de ned in Proposition . . . Hence, we have for v ∈ O + L , ς(v) 2 = √ 2 ς + (v) 2 ,
where the • 2 is the canonical 2 norm over the spaces Q n 2 for the right hand side and Q n for the left hand side.

Let • ς + the corresponding norm on a, yielding an O L + -lattice a, • ς + . The covolume of its direct image Λ over Z is then N L + (a). Then, using the block-size

β = log L ∆ 1 2 = n 1 2 +o(1) , we have covol Λ ≤ L ∆ [α] = 2 O(n α log(n)) ≤ β n 2 2β .
Using the reduction algorithm within the analysis of Corollary . . yields in time L ∆ 1 2 an integer v satisfying

v ς + ≤ β 2 log β (covol Λ) β (1+o(1)) = exp (1 + o(1)) log(n) n α-1 2 +o(1) = L ∆ α 2 - 1 4 .
Formulating this bound in terms of the eld norm induces:

N L + (v) ≤ √ 2 n 2 + 1 n 2 • v n 2 ς + = L ∆ [1] • L ∆ α 2 - 1 4 n 2 = L ∆ [1] • L ∆ α 2 + 3 4 .
Since α ≥ 1 2 , we then have . .

N L + (vO L + ) = N L + /Q (v) = L ∆ α 2 + 3 4 .

Putting both parts together.

Thanks to Theorem . . we can generate a L ∆ [1]-smooth ideal, denoted by a (0) , and an algebraic integer h (0) satisfying h (0) O L + = a + • a (0) , with a + the ideal of the maximal real sub eld obtained as a result of the computation of Section . . . The factorization of a (0) gives

a (0) = ∏ j a (0) j ,
where the a (0) j are integral prime ideals of norm upper bounded by L ∆ [1].

Remark that we do not need to perform the descent on the a (0) j which are already of norm below B = L ∆ 1 2 , so that we only continue the process for the subset

S = a (0) j | N a (0) j > L ∆ 1 2 .
Taking the norms of these ideals yields:

N a (0) ≥ ∏ a (0) j ∈S N a (0) j , yielding the inequality log L ∆ 3 2 ≥ |S| log L ∆ 1 2 . Thus, |S| = O(n I ), with n I = log ∆ log log ∆ = O(n).
Then applying Theorem . . to each small ideal a (1) j such that for every j, h

(1)

j O L + = a (0) j • a (1) j .
For each factor a

(1) j , let us write its prime decomposition:

a (1) j = ∏ k a (1) j,k .
Once again, the number of terms appearing is a O(n I ). Since we have

N L + a (1) j,k = L ∆ 3 4
, performing the same procedure for each ideal a

(1) j,k then yields L ∆ 5 8 -smooth ideals a

(2) j,k and integers h

(2)

j,k such that h (2) j,k O L + = a (1) j,k • a (2) j,k , again in expected time L ∆ 1 2 . Remark that this smoothness bound L ∆ 5 8 is obtained as L ∆ 2×3+1 4
, as follows from Theorem . . . This reasoning naturally leads to an iterative strategy for reduction. At step k, we want to reduce an ideal a (k-1) a 1 ,...,a k-1 which is L ∆ 1 2 + 1 2 k+1 -smooth. As before, we have a decomposition -with O(n I ) terms -in smaller ideals:

a (k-1) a 1 ,...,a k-1 = ∏ j a (k-1) a 1 ,...,a k-1 ,j .
Using Theorem . . on each factor a (k-1) a 1 ,...,a k-1 ,j whose norm is upper bounded by L ∆

1 2 + 1 2 k+1 leads to L ∆ 1 2 + 1 2 k+2 -smooth ideals a (k)
a 1 ,...,a k-1 ,j and algebraic integers h (k) a 1 ,...,a k-1 ,j such that

h (k) a 1 ,...,a k-1 ,j O L + = a (k-1) a 1 ,...,a k-1 ,j • a (k) a 1 ,...,a k-1 ,j , since 2× 1 2 + 1 2 k+1 +1 4 = 1 2 + 1 2 k+2 .
As a consequence, one can generate L ∆ 1 2 + 1 log n -smooth ideals with the previous method in at most log log n steps. At this point, only (n I ) log(log n) ideals and algebraic integers appear since at each step this number is multiplied by a O(n I ). As deriving a single integer/ideal pair requires expected time L ∆ 1 2 , the overall complexity remains L ∆ 1 2 . . . . . A remark on the smoothness of the bottom ideals. Concerning the nal step, a quick calculation reveals that

log L ∆ 1 2 + 1 log n = O n 1 2 + 1 log n log(n) = O n 1 2 log(n) • n 1 log n .
Since the last factor n 1 log n is e = exp(1), we obtain that

log L ∆ 1 2 + 1 log n = log L ∆ 1 2 ,
so that after at most log log n steps, we have ideals that are L ∆ 1 2 -smooth.

. . . . Wrapping up and lift. At the end of this nal round, we may express the input ideal as the product of ideals for which we know a generator, and some others guaranteed to have their norm bounded by L ∆ 1 2 . Let denote the index of the nal step. To avoid having to deal with inverse ideals, we may assume without loss of generality that is even. Explicitly, we have

h (0) O L + = a + • a (0) = a + • ∏ a 1 a (0) a 1 = a + • ∏ a 1 h (1) a 1 ∏ a 1 ,a 2 ,a 3 h (3) a 1 ,a 2 ,a 3 ∏ a 1 ,a 2 h (2) a 1 ,a 2 O L + • ∏ a 1 ,a 2 ,a 3 a (3) a 1 ,a 2 ,a 3 = a + • ∏ a 1 ,...,a +1 ∏ t∈2Z+1 h (t) a 1 ,...,a t ∏ s∈2Z h (s) a 1 ,...,a s O L + • ∏ a 1 ,...,a +1 a (l)
a 1 ,...,a +1 .

:=a s

We can always run an additional step in the descent without changing the overall complexity.

In this last expression, the indices are chosen such that 1 ≤ t ≤ and 2 ≤ s ≤ . We also recall that all the quantities involved belong to the maximal real sub eld Q(ζ + ζ -1 ). By construction, the ideal a s is L ∆ 1 2 -smooth and we directly get h ∈ O + L such that hO L + = a + • a s . The full outline of this descent phase is sketched in Figure . Remark that the number of terms, which is at most O(n) = L ∆ [o(1)], is negligible in the nal complexity estimate.

a + Input ideal (a, • ) a + • ∏ i p e i j i h (0) a (0) a (0) = ∏ j a (0) j L ∆ 1 2 × σ Randomization Lattice reduction a (0) a 1 N L a (0) a 1 ≤ L ∆ [1] (a, • ς + ) a (0) a 1 • ∏ i p e i j i h (0) a 1 a (1) a 1 a (1)
a 1 = ∏ j a (1) a 1 ,j L ∆ 1 2 × ς + Randomization Lattice reduction a (l-1) a 1 ,...,a l (a, • ς + ) a (l-1) a 1 ,...,a l • ∏ i p e i j i h (l) a 1 ...a l a (l) a 1 ,...,a l a (l) a 1 ,...,a l L ∆ 1 2 -smooth. L ∆ 1 2 × ς +

Randomization

Lattice reduction l = log log n steps . .

Step : Case of L ∆ 1 2 -smooth ideals At this point, we have reduced the search for a generator of a principal ideal of large norm to the search for a generator of a principal ideal a s which is L ∆ 1 2 -smooth. To tackle this nal problem, we follow an approach similar to class group computation: take the set B of prime ideals of norm below B > 0 where B = L ∆ 1 2 and seek for relations of the form

vO L + = ∏ i p e i i , for v ∈ O L + ,
for p i prime ideals of norm smaller than B. Formally this corresponds to looking for element in the kernel of the surjective map:

Z |B| φ -→ S I π -→ Cl(O L + ) (e 1 , • • • , e |B| ) -→ ∏ i p e i i -→ ∏ i [p i ] e i ,
Thanks to class group studies (see for instance [ , ]), the relations heuristically form a full-rank sublattice of Z |B| . Hence we need to nd at least L ∆ [1/2] linearly independent relations to generate this lattice. The relation collection is performed in a similar way as in [ , ]: due to the nice shape of the de ning polynomial, the algebraic integers whose representation as polynomials in ζ have small coe cients also have small algebraic norms. Let us x an integer A > 1. Then for any integers

(v 0 , . . . , v n 2 -1 ) ∈ {-A, . . . , A} n 2 ,
we de ne the element

v = v 0 + ∑ i≥1 v i ζ i + ζ -i
The norm of this element in L + is upper bounded by L ∆ [1]. Indeed, it cor- responds to the square root of its norm in L, which is O

√ n n = L ∆ [1]
by Hadamard's inequality. Then under Heuristic . . , the element v generates an ideal vO

L + that is L ∆ 1 2 -smooth with probability L ∆ 1 2
-1 . This means that the expected number of independent algebraic integers to nd one relation is L ∆ 1 2 . To bound the runtime of the algorithm, we also need to rely on another heuristic: Heuristic . . . There exists a value K that is negligible compared with |B| such that collecting K • |B| relations su ces to obtain a relation matrix that has full-rank.

It implies that there exists K = o L ∆ 1 2 such that collecting K • |B| relations su ces to obtain a relation matrix that has full rank. We conclude that L ∆ 1 2 2 = L ∆ 1 2 independently drawn algebraic integers su ce to generate a full-rank matrix. Of course, the set of algebraic integers arising from the previous construction is large enough to allow such repeated sampling, because its size is L ∆ [1]. We store the relations in a K|B| × |B| matrix M, and store the corresponding algebraic integers in a vector v, as depicted as follows:

       v 1 v 2 . . . v K|B|        → → . . . →        M 1,1 • • • M 1,|B| M 2,1 • • • M 2,|B| . . . . . . M K|B|,1 • • • M K|B|,|B|        =⇒ ∀i, v i O L + = |B| ∏ j=1 p M i,j j .
The L ∆ 1 2 -smooth ideal a s splits over the set B, so that there exists a vector Y in Z |B| containing the exponents of the factorization

a s = ∏ i p Y i i .
As the relations stored in M generate the lattice of all elements of this form, the vector Y necessarily belongs to this lattice. Hence solving the equation MX = Y yields a vector X ∈ Z K|B| . From this vector, we can recover a generator of the ideal since:

∏ i p Y i i = v X 1 1 • • • v X K|B| K|B| O L + . ( . ) By construction, N L + a s ≤ L ∆ +1 2
so that the coe cients of Y are bounded by L ∆ [0]. Since solving such a linear system with Dixon's p-adic method [ ] can be done in time Poly(d, log M ) where d is the dimension of the ma- trix and M = max |M i,j | the maximum of its coe cients, we can nd X in time L ∆ 1 2 .

. The overall runtime of our attack is

L ∆ 1 2 , that is a 2 O( √ n log n) operations.
We have already mentioned on-the-y the complexity of most parts of our algorithm, but give in this section some details and provide a detailed analysis to estimate the second constant of the L notation.

. .

Complements on the coarse complexity analysis

Concerning the reduction algorithms, using on the rst part of the of the lattice, the block-size is always chosen as log L ∆ 1 2 so that the complexity of the reduction procedure is in L ∆ 1 2 . Our choice for the smoothness bound B = L ∆ 1 2 ensures that time L ∆ 1 2 su ces for the relation collection and linear system solution, as detailed in Section . . . In addition, from the work of [ ], the rst part of the algorithm, corresponding to the reduction to the totally real sub eld, is known to be polynomial time.

As a consequence the overall complexity is dominated by the descent step, which runs in time L ∆ 1 2 . We now deepen the analysis in order to exhibit the second constant of this L notation.

. . Estimate of the second constant.

We recall that in our context, the extension degree n satis es 2 k +1 . To precise this complexity, suppose that we are actually given as input an ideal of norm

n = log ∆ log log ∆ [1 + o(1)].
L ∆ 1 2 + 1 2 k+1 , s k ,
for a certain constant s k .

Then using the same algorithm an is Theorem . . , we are able to derive as output an ideal of norm

L ∆ 1 2 + 1 2 k+2 , s k+1 .
Each step has a runtime given by L ∆ 1 2 , s k 2c d s k+1 , where c d > 0 is a constant that depends on the dimension of the sublattice we are searching in. Finally, after l = log 2 log n steps, we get an ideal that is L ∆ 1 2 + 1 2 l+1 , s l -smooth, and as L ∆

L ∆ 1 2 , ω • c b + L ∆ 1 2 , 1 8c b which is minimal when c b + 1 8c b = ω • c b , that is c b = 1 2 √ 2(ω-1)
. Therefore the complexity of algorithm post-descent is in

L ∆ 1 2 , ω 2 2(ω -1)
.

Now remark that we can set c 0 to satisfy:

9 16c 0 1 3 = ω 2 √ 2(ω-1)
to obtain a bootstrap complexity also in

L ∆ 1 2 , ω 2 2(ω -1)
,

yielding an ideal a (0) which is L ∆ 1, ω 2 √ 2(ω-1)
-smooth (that is, setting

s 0 = ω 2 √ 2(ω-1)
).

For the subsequent steps, it is su cient to x

s k+1 = s k • c b e • s 0 1 to reach s = s 0 • c b e•s 0 = c b .
We can then x c d large enough to get a complexity of

L ∆ 1 2 , ω 2 2(ω -1) ,
for the descent phase too.

Taking ω = log 2 7 (using for instance Strassen's fast multiplication algorithm) yields a runtime for our attack of L ∆ 1 2 , 0.738 = 2 1.066 √ n log n .

Part III C R Y P T O G R A P H I C A L P E R S P E C T I V E S

In this nal and shorter part we make use of the techniques introduced in Part II to tackle cryptanalytical problems. After getting through the context of lattice-based crytography, we expose the cryptanalysis of two schemes, where the reduction of algebraic lattices and the use of some algorithmic number theory is central.

A B I R D ' S E Y E V I E W O N L AT T I C E -B A S E D C R Y P T O G R A P H Y
This short historical chapter aims at providing a transition between the theoretical considerations of Part II and the applied research problems tackled in the nal part of this manuscript. We start by a brief panorama of the mutation encountered in cryptography in the second half of the XX th century, with focus on so-called "latticebased cryptography". We try to enlighten how the algorithmic geometry of numbers has become an important tool for both cryptanalysts and cryptographers. Indeed since the seminal works of Ajtai [ ], Euclidean lattices have become an interesting workplace for creating cryptographical schemes with rich features (such as fully homomorphic encryption, graded encoding schemes, identity-based encryption, ...). But lattices have also been a practical tool for cryptanalysis, not only for breaking the above mentioned latticebased cryptography but also for classical systems as .

.

. . From the secret-key paradigm...

Up to the second half of the XX th century, all cryptographic constructions were built upon the same paradigm, called today symmetric cryptography: we suppose that the persons who want to exchange secret data share the knowledge of a common secret. In a nutshell, using an encryption algorithm with the secret key, data is converted to a form that is unintelligible by anyone who does not possess this secret key to decrypt it. Once the intended recipient, who possesses the key, has the message, the algorithm reverses its action so that the message is returned to its original and understandable form. It is still a very vivid technological area as having incomparable practical performances.

. . ... to the public-key paradigm However, the caveat of this methodology lies in the absolute necessity for the two parties to agree beforehand on the shared secret. In , Di e and Hellman in the foundational paper New directions in cryptography [ ] It was however revealed in that James H. Ellis, Cli ord Cocks, and Malcolm J. Williamson of GCHQ, the British intelligence agency, had previously shown how public-key cryptography could be achieved in .

demonstrated an exchange method allowing two parties that have no prior knowledge of each other to jointly establish a shared secret key over an insecure channel. Such procedure uses a pair of keys instead of a unique shared key: public key which may be sent over any public channel, and private key which is known only by the owner. By contrast with the symmetric cryptography, in a public key system, the public keys can be disseminated widely and openly-and only the private key needs to be kept secure by its owner.

Two of the best-known uses of public key cryptography are the encryption schemes and the signature schemes. Since we are going to provide a cryptanalysis of an encryption scheme [ ] and of a signature [ ], we provide a generic de nition of such primitives for completeness purposes.

. . . . Public key encryption. A message is encrypted with a recipient's public key. The message cannot be decrypted by anyone who does not possess the matching private key, who is thus presumed to be the owner of that key and the person associated with the public key. This aims at ensuring the con dentiality of the data. Such a scheme consists of three di erent algorithms:

Key generation: selects a private key (usually uniformly at random) from the set of secret keys. The algorithm outputs it as well as the corresponding public key.

Encryption algorithm: produces a ciphertext when fed with a message and a public key.

Decryption: Given the ciphertext and secret key, retrieves the original message. . . . . Signatures schemes. A message is signed with the sender's private key and can be veri ed by anyone who has access to the sender's public key. This veri cation proves that the sender had access to the private key, and therefore is likely to be the person associated with the public key. This also ensures that the message has not been tampered with, as a signature is mathematically bound to the message it originally was made with, and that veri cation will fail for any other message. A signature scheme consists of three di erent algorithms: Key generation: selects a private key (usually uniformly at random) from the set of secret keys. The algorithm outputs it as well as the corresponding public key.

Signing algorithm: produces a signature when fed with a message and a private key.

Verifcation: Given the message, public key and signature, either accepts or rejects the message's claim to authenticity.

. . One way functions and hard problems

The public key paradigm essentially relies on the existence of one-way functions, that is a function F acting on binary strings such that there is a polynomialtime algorithm which maps any string r ∈ {0, 1} * to F(r) and such that for every probabilistic polynomial-time algorithm A, constant c > 0, and suciently large n ∈ N, we have:

Pr v=F(r);r∼U ({0,1} n ) F(A(v)) = v < n -c .
This means that such F is easy-by the polynomial time mapping to the image of F-to compute on every input, but hard to invert given the image of a random input. While the de nition of one-way functions does not involve any secret key, it was shown in a large amount of research, mainly through the connection to pseudorandomness enabled by the Goldreich-Levin theorem [ ], that the existence of one way functions is equivalent to the existence of many cryptographic primitives including pseudorandom generators, digital signatures, commitment schemes and zero knowledge proofs for every language in . Remark that for any one-way function F, the inversion of F is hard to compute, by de nition, but is actually easy to check, by just computing F on it. Thus, the existence of a one-way function implies that that = . However, it is not known whether the fact that = actually implies the existence of one-way functions. Indeed, we do not know if such functions exist: several candidates have been proposed and are supposed to be one-way, but extensive research has so far failed to produce an e cient inverting algorithm for any of them.

. This conceptual change also required the development of new mathematical tools to make such exchanges possible, that is by giving candidates of one-way functions. Symmetric cryptography was very close by design to the conception of hash functions, with iterations of fast non-linear Boolean functions, whereas the asymmetric cryptography requires tools from number theory, from the elementary theory of cyclic rings Z (n) (such as [ ]), elliptic curves [ ], coding theory [ ] or lattices.

. Although the introduction of number theory for cryptographical constructions goes back to the early s, the use of lattices only appears two decades later with the work of Ajtai in [ ], who constructed a hash function whose security relies on the short integer solution ( ) problem. In this paper he also demonstrated that the average-case of the problem was at least as hard as the worst case of the problem. A milestone in the history of lattice-based public-key cryptography came from the work of Regev in [ ], who introduced a new hard problem: the Learning with Errors problem ( ), inspired by the classical learning problems on vector spaces. This work showcases an encryption scheme whose security is proved under the worst-case hardness assumptions of the SIVP problem.

In order to optimize the lattice-based constructions, it has been proposed to migrate from Euclidean lattices to more structured ones, such as ideal lattices [ ], and more generally algebraic lattices [ ]. Indeed, the algebraic structure of these lattices allows to handle their elements in very compact forms such as vectors of integral polynomials. For instance an ideal lattice can be represented by a couple of polynomials instead of a full rank integral matrix.

Further, many lines of work have been initiated to optimize the e ciency of lattice scheme as well as enhancing the cryptographic possibilities of the scheme. A breakthrough instance of this direction of research is the creation of the rst fully homomorphic encryption ( ) scheme by Craig Gentry in [ ].

allows computation on ciphertexts, generating an encrypted result which, when decrypted, matches the result of the operations as if they had been performed on the plaintext. .

. . Theoretical security arguments from lattices

If the use of lattices as a constructive tool for the cryptographer is a somewhat recent matter, it is not the case in cryptanalysis. Of course lattice-based schemes are attacked through lattice reduction algorithms, as their security is proved by reduction to , or problems, which are solved in practice by performing lattice reduction. But the range of applications of lattice techniques is wider than that. Indeed, as reduction techniques allow nding short or small modular linear dependencies among a set of vectors, a natural use of lattice reduction is the cryptanalysis of so-called knapsack problems, speci c setting. A more number-theoretical example is the cryptanalysis of when part of the secret key is known by the use of the so-called Coppersmith technique [ ]. It consists in a method to nd small integer zeroes of univariate or bivariate polynomials modulo a given integer. It uses reduction algorithms to nd a polynomial over Z that has the same zeroes as the target polynomial but with smaller coe cients.

In all the cases where lattices are used for cryptanalysis, the goal remains the same: nd a short enough vector in an ad hoc lattice, which will retrieve the secret key, or at least will allow the construction of a trapdoor to break the attacked cryptosystem. Therefore, enhancing lattice reduction algorithms impacts directly the cryptanalysis of numerous schemes.

As mentioned, modern lattice-based schemes are built on algebraic lattices, such as the Bliss or Dilithium signatures [ , ], for instance. Hence, the design of fast lattice reduction for algebraic lattices is a natural matter for the security evaluation of lattice-based cryptography.

. .

On the practical security of real-world cryptography

As hinted above, the theoretical security evaluation of a public key primitive gets through the theoretical analysis of a presumably hard problem. However, in the context of real-world implementation of a scheme, one can exploit more than its abstract speci cation, by exploiting the whole physical ngerprint the algorithm lefts in the physical world, during its computation.

A side-channel attack is any kind of attack using pieces of information gained from the implementation of a physical system, rather than weaknesses of the algorithm itself. Such leaks can be found for instance in the cache , read as timing information , power consumption , electromagnetic leaks or even sounds. Hence, providing a theoretically secure algorithm is not su cient to ensure a secure implementation of the scheme. However, the exploitation of side-channel traces is usually not direct and often requires non trivial techniques to retrieve secret elements, as we demonstrate in the next chapter.

These attacks are based on attacker's ability to monitor cache accesses made by the victim in a shared physical system as in virtualized environment. These attacks are mounted by measuring how much time various computations such as, say, comparing an attacker's given password with the victim's unknown one take to perform. These attacks make use of varying power consumption by the hardware during computation.

C R Y P T O G R A P H

I C A L AT T A C K S B Y N U M B E R T H E O R Y
This nal chapter showcases how the algorithm exposed in Part II can be applied to perform practical cryptanalysis of lattice-based schemes, namely fully-homomorphic encryption and signatures. We start by looking at the application of the algorithm of Chapter solving algorithm to perform a full key recovery of the fully-homomorphic encryption scheme of Smart and Vercauteren. Our nal landmark is an attack in the context of sidechannel attacks on the signature scheme, which crucially relies on ne grained-ideal manipulation, integer factorization and on the Gentry-Szydlo algorithm presented at the end of Chapter .

. '

. .

Relation the principal ideal problem

Among all the Fully Homomorphic Encryption ( ) schemes proposed in the last decade, the security of a couple of them directly collapses if it is possible to nd relatively short generators in principal ideals. This is the case of the proposal of Smart and Vercauteren [ ], which is a simpli ed version of the original scheme of Gentry [ ]. Other schemes based on the same security assumption include the Soliloquy scheme of Campbell, Groves, and Shepherd [ ] and candidates for multilinear maps [ , ]. More formally, the underlying-presumably hard-problem is derived from the introduced in Chapter : it is the -(Short Generator-Principal Ideal Problem): given some Z-basis of a principal ideal with a promise that it possesses a "short" generator g for the Euclidean norm, nd this generator or at least a short enough generator of this ideal. The strategy to address this problem roughly splits into two main steps:

. Principal ideal problem: given the Z-basis of the ideal, nd a generator, not necessarily short, that is g = g • u for a unit u, that is solve an instance of .

. Reduction from g , nd a short generator of the ideal.

Several results have allowed to deal with the second step. Indeed, Campbell, Groves, and Shepherd [ ] claimed in an e cient-although unprovensolution for power-of-two cyclotomic elds, con rmed by experiments conducted by Schanck [ ] in . Eventually, the proof was provided by Cramer, Ducas, Peikert, and Regev [ ], together with an extension to all prime-power cyclotomic elds. We proposed an extension to this algorithm as a byproduct of the design of the algorithms of Chapter for arbitrary cyclotomic elds and decreased the complexity to quasilinear.

As a direct illustration of the algorithm presented in Chapter , we showcase an attack on the scheme that Smart and Vercauteren describe in [ ], which leads to a full key recovery. We recall in Algorithm the key generation process in the case of power-of-two cyclotomic elds. This instantiation is the one chosen by the authors for presenting their implementation results.

Algorithm -Key-Generation

Input

: The security parameter n = 2 m . Output : A pair (sk, pk) of secret/public keys.

Φ 2n (X) ← X n + 1 as the polynomial de ning the cyclotomic eld

L = Q(ζ 2n ) do G(X) ← 1 + 2 • S(X)
for S(X) of degree n -1 with coe cients absolutely bounded by 2

√ n g ← G(ζ 2n ) ∈ O L while N L/Q G(ζ 2n )O L is prime return sk = g, pk = gO L
Remark. The public key can be any Z-basis of the ideal generated by g, or even a two-elements representation of this ideal. Indeed, the original paper of Smart and Vercauteren [ ] provides the public key as a pair of elements that generates the lattice, for compactness purposes.

As our attack consists in a full secret-key recovery, only based on the public key, the encryption and decryption procedures are irrelevant for our purposes. As such we omit their presentation in this present chapter. Even though this work is more concerned with the principal ideal problem rather than the reduction step, we emphasize the fact that the short generator resulting from this reduction is the key modulo the multiplicative action of the roots of unity of the number eld. This is not an issue, since all these keys are equivalent with regard to the decryption procedure. In addition, in this precise construction of the Smart and Vercauteren scheme, the only odd coe cient of G(X) is the constant one, so that we may recover the exact generator g readily-as multiplying by a primitive root of unity acts as a simple coe cient shift.

. . Implementation results

In [ , Section ], security estimates of Smart and Vercauteren's scheme are given for parameters n = 2 m for 8 ≤ m ≤ 11, since the authors were unable to generate keys for larger parameters. Our implementation allows us to nd a secret key from the public key for n = 2 8 = 256 in less than a day: the code runs with Pari/GP [ ], with an external call to fplll [ ], and all the computations are performed on an Intel(R) Xeon(R) CPU E -v @ . GHz with GB of memory. The large storage requirements are due to the Gentry-Szydlo algorithm.

We perform the key generation as in Algorithm . We then obtain a generator for the ideal as a polynomial in ζ = ζ 512 , of degree and coe cients absolutely bounded by 2 √ 256 + 1 = 65537. That corresponds to ideals whose norms have about 4800 bits on average, which is below the bound 6145 obtained from the following claim:

Lemma . . . Let L ∼ = Q[X]
(T) be a number eld, de ned by a unitary irreducible polynomial T, and θ be the image of X in L. For an algebraic integer

x = P x (θ) for P x ∈ Z[X], then |N L/Q (x)| = Res(T, P x ) ≤ (n + 1) m/2 (m + 1) n/2 H(P x ) n H(T) m , where n = [L : Q] and m = deg P x = deg x.
Proof. By de nition of the resultant, since T is unitary, we have Res(T, P x ) = ∏ ρ∈Root(T) P x (ρ).

Remark that the P x (ρ) are the conjugates of P x (θ) in the algebraic closure of L, so that N(x) = ∏ ρ∈Root(T) P x (ρ). The upper bound is a direct consequence of Hadamard's bound on the Sylvester matrix de ning Res(T, P x ) as a determinant. This bound is nonetheless above the size given in [ ] (4096). As for all timings in this section, we have derived a set of keys, and the given time is the average one. Thus, deriving a secret key takes on average 30 seconds. We test 1381 algebraic integers resulting in ten that have a prime norm. Then the public key is derived from the secret key in about 96 seconds.

While, in theory, the rst reduction to the totally real sub eld seems to be of limited interest, it is clearly the main part of the practical results: indeed, it reduces in our example the size of the matrices involved from 256 × 256 to 128 × 128. As we know that the quality of lattice-reduction is getting worse as the dimension grows, this part is the key point of the algorithm. The attack essentially corresponds to the Gentry-Szydlo algorithm described in Section . . together with the trick explained in Paragraph . . . , in order to output the element u and a basis of the ideal a + generated by g + ḡ. This part of the algorithm runs in less than an hour, and requires about GB of memory.

At this point, we put aside u and only consider the ideal a + . Our goal is to recover one generator of this ideal, after which a multiplication by 1 1+u leads to a generator of the input ideal. The method we have presented is to reduce step by step the norms of the ideals involved by performing lattice reductions. However, we observe that for the cases we run, the rst reduction su ces: the short vector we nd corresponds to a generator. We make use of the algorithm implemented in fplll [ ], with block-size 30, requiring between 2 and 4 hours of computation. This surprisingly good practical behavior of the lattice reduction is a consequence of the conjunction of two facts. One is the dimension of the lattices involved-medium dimensions allow better practical output bounds than the theoretical worst case-and the other one are the favorable properties of the geometry of the considered ideals.

In addition to the good behavior of this reduction, the generator we found is already small, by construction. More precisely, it corresponds to g + ḡ, up to a factor that is a power of ζ. Hence, we recover g • ζ i thanks to u and the decoding algorithm presented in Section . turns out to be unnecessary for our application. The key recovery is already completed after these rst two steps. Nevertheless, we implemented this part along with a method to nd the actual private key (up to sign). Indeed, because all its coe cients are even except the constant one, it is easy to identify the power of ζ that appears as a factor during the computation.

All in all, given the public key a, the practical attack reduces to the following steps:

) Reduction to the maximal totally real sub eld: Reduce for a to the for an ideal a + in the maximal totally real sub eld, with the technique of Section . . coupled with the Gentry-Szydlo algorithm of Section . . . ) Lattice reduction: Find a short element α ∈ a such that a + = αa , and a is a smooth ideal (precisely, L ∆ 1 2 -smooth, as in Chapter ). This element is discovered by a -reduction on the ideal lattice corresponding to a.

) Collection relation and resolution on a: Using the relation collection of Section . . nd a generator β of a by linear algebra.

) Key recovery: Shift the coe cients of the αβ to recover the private key.

To conclude, for the parameter n = 2 8 , the time of the key recovery is below less than 5 hours, and the main part of the computation comes from the lattice reduction part.

Remark (On the theoretical complexity of the attack.). The -solving algorithm of Chapter has a complexity in L ∆ 1 2 in the discriminant that represents the size of the number eld involved. However, it is important to ascertain that the parameters of the keys have n .

In the early days of lattice-based cryptography, several signature schemes with heuristic security were proposed, most notably and ign (see [ ] and [ ]), but despite several attempts to patch them, they turned out to be insecure: it was found that the distribution of generated signatures leaks statistical information about the secret key, which can be exploited to break these schemes and their variants [ , , ]. The most common approach to obtain e cient, provably secure lattice-based signatures in the random oracle model is the "Fiat-Shamir with aborts" paradigm introduced by Lyubashevsky [ ] (it coexists with hash-and-sign paradigm relying on lattice trapdoors [ ], which has some theoretical bene ts compared to Fiat-Shamir, but tends to result in less e cient implementations [ ]). Lyubashevsky's approach is an extension of the usual Fiat-Shamir transformation which uses rejection sampling to make sure that generated signatures have a distribution independent of the secret key, and avoid the statistical pitfalls of schemes like ign. More precisely, the underlying identi cation protocol achieves its honest-veri er zero-knowledge property by aborting some of the time, and signatures are produced by re-running that protocol with random challenges until it succeeds.

Several instantiations of this paradigm have been proposed [ , , , ], targeting various output distributions for signatures, but one of the most popular among them is certainly the signature scheme proposed by Ducas et al. [ ]. It is possibly the most e cient lattice-based signature scheme so far, boasting performance comparable to common implementations of and -based signatures, such as the one in Open . Signature and public-key size are a few times larger than (and about one order of magnitude bigger than ); signature generation is comparable to and beats by an order of magnitude; and signature veri cation is similar to and faster than by an order of magnitude. This e ciency is achieved in particular through the use of Gaussian noise, and a target distribution for signature that has a bimodal Gaussian shape. This makes the rejection sampling step for somewhat tricky to implement, particularly on platforms where evaluating transcendental functions to a high precision is impractical. However, the authors of [ ] proposed an e cient technique to carry out this rejection sampling based on iterated Bernoulli trials. This technique is used, in particular, in the embedded implementations of described in [ , ].

. .

Description signature

One can give a simpli ed description of the scheme as follows. We are working inside the ring of integer O L of a cyclotomic eld L whose conductor is a power-of-two. The public key is an -like ratio of the form a q = s 2 /s 1 mod q, where the signing key polynomials s 1 , s 2 ∈ O L are small and sparse. To sign a message µ, one rst generates commitment values y 1 , y 2 ∈ O L with normally distributed coe cients, and then computes a hash c of the message µ together with u = -a q y 1 + y 2 mod q. The signature is then the triple (c, z 1 , z 2 ), with z i = y i + s i c. The rejection sampling to ensure that the distribution of z i is independent of the secret key. Verication is possible because u -a q z 1 + z 2 mod q.

The real scheme, described in Algorithm , includes several optimizations on top of the above description. In particular, to improve the repetition rate, it targets a bimodal Gaussian distribution for the z i 's, so there is a random sign ip in their de nition. In addition, to reduce key size, the signature element z 2 is actually transmitted in compressed form z † 2 , and accordingly the hash input includes only a compressed version of u. The random oracle H takes its values in the set of polynomials in O L with 0/1 coe cients and Hamming weight exactly κ, for some small constant κ. We refer to the original paper [ ] for the de nition of notation like M, ζ, N κ and • d , as they are not relevant for our purposes.

Algorithm -signature algorithm

Input : µ, pk = a 1 , sk = S y 1 ← D n , y 2 ← D n u = ζ • a 1 • y 1 + y 2 mod 2q c ← H( u d mod p, µ) Choose a random bit b z 1 ← y 1 + (-1) b s 1 c z 2 ← y 2 + (-1) b s 2 c restart to step 2 except with probability 1/ M exp(-Sc 2 /(2σ 2 )) cosh( z, Sc /σ 2 ) z † 2 ← ( u d -u -z 2 d ) mod p return (z 1 , z † 2 , c)
. . . . Implementation of the rejection sampling. It is essential for the security of the scheme that the distribution of signatures is essentially statistically independent of the secret signing key. This is achieved using the rejection sampling step of algorithm S , as described in Algorithm .

To implement this rejection sampling in practice, one needs to be able to e ciently sample from Bernoulli distributions of the form B exp(-x/ f ) and B 1/ cosh(x/ f ) for some xed constant f and variable integers x (where B p denotes the Bernoulli distribution of parameter p, which outputs 1 with probability p and 0 otherwise). of this oracle. Precisely, the resolution is performed using a generalization of the Howgrave-Graham-Szydlo algorithm [ ], detailed in Section . . . Suppose that one value s 1 • u 1 or s 2 • u 2 (with u 1 , u 2 roots of unity), we can use our knowledge of the public key s 2 /s 1 mod q to recover candidates for the other part of the secret (once again up to unity). Hence, when candidate secrets are determined, we can discriminate valid keys among them by checking their sparsity and polynomial height, to satisfy the conditions imposed by the key generation procedure. The whole attack is described in Algorithm .

Algorithm -Algebraic side-channel a ack Collect traces (c (k) , Sc (k) 2 ) k until the matrix C corresponding of the corresponding system is full-rank. Solve the linear system C • X = ( Sc (1) 2 , . . . , Sc (k) 2 ) T . Call Algorithm on either s 1 • s 1 or s 2 • s 2 to recover s 1 and s 2 up to a root of unity.

The mostly costly part of this attack is the resolution of the norm equation, which in particular requires a norm factorization over the integers. In order to estimate the cost of this factorization step, one can bound the algebraic norm of the secret element. Let s be one of the secret elements s 1 , s 2 . Note that N L/Q (s) is equal to the resultant of s (explicitly, the lift of s in Z[X] from its representation in O L ). From Lemma . . we have:

|N L/Q (s)| ≤ 2 n 2 δ 2 1 + 4δ 2 2 n n , yielding directly that log |N L/Q ( f )| ≤ n 2 log n δ 2 1 + 4δ 2 2 + 1 .
Table . compiles the theoretical bound and the average practical results for the various proposed security parameters.

We can see that these integers are typically too large to be factored in practice. Since the success of the attack depends on the ability to factor the norm, we are only able to attack a fraction of the whole space of private keys, for which the factorization is easy. A particular class of them is the set of keys whose norm is a B-semi-smooth integer, that is a composite number p • b, where p is prime and b is B-smooth for a non-negative integer B. As already remarked, the recovery of either s 1 or s 2 is su cient to recover the full secret. Hence, the above-described attack becomes tractable as soon as one of the norm N L/Q (s 1 ), N L/Q (s 2 ) is semi-smooth. This means that the probability of getting a weak key is twice the probability of one of the constituting part of the private key to have a semi-smooth norm. Practical estimations of the fraction of keys with semi-smooth norms are presented in Table . . Note that the entire attack is actually known to run on average in polynomial time, except, classically, the factorization of the norm. Remark (An interesting feature). Amusingly, this means that the attack becomes quantumly fully polynomial: this is an interesting feature for an attack targeting a post-quantum scheme!

The entire attack was implemented in PARI/GP, including the generalized Howgrave-Graham-Szydlo algorithm and the Gentry-Szydlo algorithm. To the best of our knowledge, this was the rst full implementation of this algorithm. It allows to tackle the problem of solving norm equations in dimension up to . Experiments were conducted with this implementation to obtain the running time of the attack and presented in Table . , on a quad-core Intel I -CPU.

In their original paper, Howgrave-Graham and Szydlo were limited to smaller dimension (up to ) and did not implement all the possible cases occurring in the algorithm. We now present a generalization of the Howgrave-Graham-Szydlo algorithm to power-of-two cyclotomic elds since the signatures works over this class of elds. The original procedure solves the problem of recovering an element f of the ring of integers of a cyclotomic eld of prime conductor l given its relative norm f • f factorization. This problem is computationally hard since it relies heavily on the factorization of the algebraic norm of f over the integers. In all of the following, for any element α ∈ O L , we shall denote by (α) the ideal generated by α in O L , that is αO L .

. . Generalization of Howgrave-Graham-Szydlo algorithm

Let L be a cyclotomic eld of conductor m which is a power-of-two and f ∈ L, and denote by L + its maxima real sub eld. We are given the value f • f and aim at retrieving f . The algorithm extracts the information contained in the relative norm f • f by rst descending it to the rationals where we can factor it and derive from it the absolute norm of f (Step I). Then it lifts all these pieces of information to the base eld to yield candidate ideals verifying the same norm equations as the principal ideal ( f ) = f O L (Step II). If we get the guarantee that one of them at least is principal, alongside with the possibility to easily retrieve the corresponding generator, then this latter element will be solution of the norm equation (Step III). Let us now precise this intuition.

. . . . (Step I) Norm computation. The rst step aims to compute the norm of the element f over the ground eld Q. Since the ideal norm is multiplicative, it corresponds to the square norm of N L/Q ( f • f ) or equivalently to the absolute norm in the maximal real sub eld L + : N L + /Q ( f • f ). Let assume for simplicity that this norm is a -ower of a prime number p from now on, so that N L/Q ( f ) = p α . A discussion on the way to adapt the algorithm to the generic case is conducted below. Except from the very speci c case of p = 2 (rami ed case) which is treated separately, two cases occur: either p ≡ 1 mod 4, or p ≡ 3 mod 4.

. . . . (Step II) Creation of the candidate ideal(s). Let study separately what occurs in the two sub-cited cases. The case p ≡ 1 mod 4 splits itself into two sub-cases, depending on whether N L/Q ( f ) is prime or prime-power.

p ≡ 1 mod 4, α = 1. One could be surprised by dealing separately with an apparently such restrictive case, but it appears that this case is in fact somehow a generic case. Indeed, the density of prime ideals of norm a strict prime power among all prime ideals is zero. More generally the density of ideals of prime norm among all ideals of prime-power norm is one. Hence, the case α = 1 is in this sense generic.

Moreover, if an ideal has an odd prime norm p, then necessarily p ≡ 1 mod 4. Indeed, if p was congruent to 3 modulo , it would be inert in Z

[i]. As such the ideal ( f ) would have a norm over Z[i] divisible by pZ[i], meaning that p 2 would divide N L/Q ( f ) = p in Z, yielding a contradiction. ( ) Q[i ]
. Now that we obtained the norm p, we can consider the principal ideal (p) generated by this prime in the sub eld

Q[i] ⊂ Q[ζ m ]. The ideal (p) splits into two distinct conjugate prime ideals in Z[i]: (p) = (a + ib) • (a -ib)
, as a consequence of Fermat's theorem on sums of two squares .

(

) . Let consider one of the ideals (a ± ib) of Z[i] resulting from the splitting on the quadratic sub eld, and lift it the whole cyclotomic eld, that is seeing it as an ideal of O L -which is considering the ideals (a + ib)O L and (aib)O L . By notational abuse we also denote by (a + ib) (resp. (aib)) the ideal lifted from (a + ib) (resp. (aib)).

From these two ideals, we can construct two candidate ideals a + and a - respectively de ned as the ideals (a

+ ib) + ( f • f ) and (a -ib) + ( f • f ), each of them satisfying the norm equation a • a = ( f • f ).
At least one of this candidate ideal is principal and by construction its generator will be solution of the norm equation. The schematic representation of the algorithm in this case is presented in Figure .   p ≡ 1 4, α > 1. For any prime ideal P dividing ( f • f ), appearing with multiplicity t in its decomposition, P can appear in the decomposition of ( f ) with multiplicity 0 ≤ i ≤ t, implying that P will appear with multiplicity ti in the decomposition of ( f ). As such one of the 1 + t such ideals appears in the decomposition of ( f ).

In order to compute ( f ), we thus need to compute the prime decomposition of ( f • f ) and test for the possible multiplicities of each prime ideal of its decomposition. Since we know that the algebraic norm of f • f is p α , we also know that its prime divisors are all primes above p. Then after rst enumerating the prime ideals over p, with Berlekamp's algorithm for instance,

We let the reader refers to the introductory section of this manuscript for a proof of this theorem using lattices. Indeed, in that case p can be written as the sum of two squares a 2 + b 2 , yielding directly the announced decomposition. we test the divisibility of ( f • f ) by each of their exponentiation. By multiplicativity of the norm each prime ideal can only appear with multiplicity lower than α.

L

I candidate such that I • I = ( f • f ) L + ( f • f ) ⊂ Q N L/Q ( f ) = p Q[i]⊃ a + ; a - Gentry-Szydlo(I, ( f • f )) (I)
Once the prime decompositions

( f • f ) = ∏ i p t i i (p i ) t i is obtained, we
can construct the candidate ideals by computing the products of exactly one ideal of the form p k i (p i ) t i -k among the 1 + t i possibles for each (p i , p i ) pair of conjugate primes, divisors of ( f • f ).

p ≡ 3 mod 4. In this case p is inert in Z[i], and then we can not construct a list of candidate from the decomposition in the quadratic eld as in step II-of the previous case. Nonetheless this case is somehow simpler: the ideal ( f ) in O L is actually invariant under the conjugation map. Indeed if we decompose ( f ) in prime ideals: ( f ) = ∏ i p e i i , each ideal p i is necessarily a real prime ideal over p. Indeed, the norm of each p i over Q(i) is also real as being a prime over p in Z[i], that is (p) itself since p is inert. As a consequence, ( f • f ) = ( f ) 2 , and we only need to compute the square root of the principal ideal generated by the norm ( f • f ) to recover ( f ). This can be done easily by rst decomposing ( f • f ) in prime ideals and then dividing the valuation of each prime by two. For notational simplicity and consistence with the ideals generated for the case p ≡ 1 mod 4, we will also denote the recovered ideal ( f ) as I and call it a candidate ideal. The schematic representation of the algorithm in this case is presented in Figure .   . . . . (Step III) Generator recovery. This nal step is now common for the two cases. Given one -or the unique -of the candidate I -which is supposed to be principal -as well as the element f • f , generator of the ideal I • I by construction, the Gentry-Szydlo algorithm can be called to recover f up to a root of unity. In the case where I is not principal , the latter algorithm returns an error, giving hence a method to distinguish principal candidates from others.

L I candidate such that I • I = ( f • f ) L + ( f • f ) ⊂ Q N L/Q ( f ) = p α Gentry-Szydlo(I, ( f • f )) (I) Norm computation (II) Square root computation of ( f • f ) (III) Generator recovery
. .

The case p = 2

The last case is p = 2, which is very speci c since 2 is the only prime that rami es in L. It is in fact totally rami ed, since

O L 2O L ∼ = F 2 [X] (X n + 1) ∼ = F 2 [X] (X + 1) n,
since n is a power-of-two. In particular, the only prime above 2 is (1 + ζ m ).

As such ( f ) = (1 + ζ) α , giving directly f up to a unit of the eld. Let us see how to generalize the latter described algorithm in the case of a composite norm N L/Q ( f ).

. .

Composite case

Due to the inherent multiplicative structure of the problem, knowing how to solve it for every element whose norm is a prime power is actually su cient to solve any instance. Indeed, we perform a reasoning à la Chinese reminder theorem: we deal separately with every prime power factor thanks to the study we just carried out and multiplicatively recompose these chunks of solutions.

As mentioned, this case can only occur when p ≡ 1 mod 4.

. Thus, the algorithm starts exactly as before, by computing the algebraic norm of the element f , as the square root of the norm of f • f . In order to deal with every prime factors, we then factor this norm in:

N L/Q ( f ) = 2 α 2 • ∏ i p α i i • ∏ j q α j j ,
where the (p i ) i are the prime factors congruent to modulo and the (q i ) i are the prime factors congruent to modulo .

We rst take care of the primes (p i ) i congruent to modulo . For primes appearing with multiplicity one, applying the technique described in Section Paragraph . . . , each prime p i yields exactly two ideals above itself divisors of ( f ), along with the guarantee that at least one of them is principal. As such, since the (p i ) i are coprimes, we can construct 2 T possible products, for T the number of primes appearing with multiplicity 1, obtained by taking exactly one ideal above each p i . Let C 1 this set of ideals.

Then, let us turn to the primes appearing with multiplicity greater than one. In order to fall back on the cases described in section Figure . . . , we need to construct an ideal of norm p α i i dividing the principal ideal generated by the relative norm ( f • f ). This is simply the sum of the latter ideal with the principal ideal generated by the element p α i i ∈ O L . Then applying the technique described in Section Figure . . . . each prime p i yields a certain number c i of candidate ideals above p α i i divisors of ( f ), along with the guarantee that at least one of them is principal. As such, since the (p i ) i are coprimes, the possible products obtained by taking exactly one ideal above each p α i i and one ideal from the set C 1 , are divisors of ( f ) above ∏

i p α i i = N L/Q ( f ) 2 α 2 •∏ j q α j j .
At least one of them is principal.

We then treat the case of the primes (q j ) j congruent to modulo . Let q j one of those primes appearing in the factorization of N L/Q ( f ). In order to fall back on the cases described in section Figure . . . , we need to construct a real ideal N of norm q α j j dividing the principal ideal generated by the relative norm ( f • f ). This is simply the sum of the latter ideal with the principal ideal generated by the element q α j j ∈ Z[ζ]. As in Figure . . . we construct a principal I q j of norm q α j j dividing ( f ). Performing this construction on every prime q j and denoting by R the product of each freshly obtained I q j , ensures that the principal ideal R is a divisor of the ideal ( f )

above ∏ j q α j j = N L/Q ( f ) 2 α 2 •∏ i p α i i .
Finally, we deal with the power-of-two appearing in the norm. The reasoning is similar to what happens in Section Section . . : the prime power principal ideal

D = (1 + ζ m ) α 2 is a divisor of ( f ) above 2 α 2 .
It is now time to reconstruct candidate ideals from these three parts. Multiplying each of the ∏ i (1 + α i ) candidates obtained from the (p i ) i with the principal ideal R • D yields a candidate ideal of norm N L/Q ( f ). Eventually, taking the sum with the ideal ( f • f ) gives then a list of ∏ i (1 + α i ) ideals satisfying the norm equation, with the guarantee that at least one of them is principal. The nal step of the algorithm is then unchanged: nding the gen-erator of the principal ideal by using the Gentry-Szydlo algorithm. A method of reducing the running time of this nal phase is to process all possible candidate ideals in parallel and stop as soon as one of the process returns a generator. The full outline of the algorithm is given in Algorithm .

Algorithm -Generalized Howgrave-Graham-Szydlo

Input : Relative norm f • f . Output : Algebraic integer α such that α • α = f • f . Compute the norm N L/Q ( f ) as N L/Q ( f • f ) Factor N L/Q ( f ) in prime product ∏ i p α i i for each p i such that p ≡ 3 mod 4 do Split the ideal ( f • f ) + (p α i i ) of O L in primes: ∏ j p e j I p i ← ∏ j p e j /2 end for R ← ∏ p i ≡3[4] I p i D ← (1 + ζ) α 2 for each p i such that p ≡ 1 mod 4 and α i = 1 do Split (p i ) in Z[i] as (a + ib), (a -ib) Lift (a + ib), (a -ib)in Z[ζ] a + ← (a + ib) + ( f • f ) a -← (a -ib) + ( f • f ) C p i ← {a + , a -} end for for p i such that p ≡ 1 mod 4 and α i > 1 do Factor ( f • f ) + (p α i i ) as ∏ j p t j j
for each (p j , p j ) of the decomposition do t j ← multiplicity of p j in ( f • f )

C p i ,p j ← p t j j , p t j -1 j p j . . . , p k j p j t j -k , . . . , p j t j end for C p i ← ∏ b∈B b | B ∈ ∏ j C p i ,p j end for for A ∈ ∏ p i C p i do I ← RD • ∏ b∈A b if Gentry-Szydlo(I, f • f ) outputs α ∈ Z[ζ]
then return α end if end for . . . . Remarks on complexity. Performing operations on ideals in a number eld of degree n is polynomial in n, since when working with representation of ideals, the computations of sum, product or intersections of ideals boils down to basic linear algebra computations and calls to an oracle, which is known to be polynomial in the dimension (see for instance Chapter to of [ ] for a complete introduction to computations with ideals). As early mentioned by Dedekind in [ ], computing the decomposition in prime ideals of a given prime boils down to factor the de ning polynomial of the eld Φ m modulo p, which can be e ciently performed by the Cantor-Zassenhaus algorithm or Berlekamp algorithm [ ]. . In the previous section, we exploited the leakage coning from the computation of the relative norm of the secret, coming from the Bernoulli sampler of exponential parameter. It appears that even if we patch this sampler to be constant-time (by going through the whole loop instead of early aborting) and try to avoid the algebraic attack, the second Bernoulli sampler, of hyperbolic cosine parameter, is leaking.

Indeed, by de nition of the function SampleBernCosh, the probability of outputting a is equal to the probability of the expression ¬a ∧ (b ∨ c) to be false, which is

p(S, c, z) = 1 -Pr(¬a) Pr(b ∨ c) = 1 -(1 -Pr(a))(1 -Pr(¬b ∧ ¬c)) = 1 -1 -e -| z,Sc | 2σ 2   1 - 1 -e -| z,Sc | 2σ 2 2   = 1 + e -| z,Sc | σ 2 2 .
Therefore, by measuring the di erences in computation time, one can derive traces that shape (z, c, t), where t ∈ N is the number of restarts performed before outputting the value a. In the following of this section, we describe two ways to exploit this leakage, leading again to a full key recovery.

. . Spectral attack with samples with t = 0

Remark that if a trace satis es t = 0, then it is likely for the geometric distribution parameter p(S, c, z) to be large. Therefore, for such a sample, z, Sc should be close to zero, i.e., S should be close to be orthogonal to the vector zc * , where c * is the adjoint of c: z, Sc = zc * , S .

If the vector S was actually orthogonal to each of these zc * then it would be enough to collect su ciently of them so that they generate an hyperplane H of the ambient space R n and return the unique (up to sign) vector of H ⊥ of norm compatible with the speci cation of (secret vectors in all have the same known norm by construction). This would practically translate in constructing the empirical covariance matrix W = ∑ i w i w T i In full generality, this is the case only when p does not divide the index [O K : Z[α]] for O K the ring of integers of K and α a primitive element of the number eld K. Since this index is always for cyclotomic elds, the factorization can always be carried by the abovementioned technique.

(w i = z i c * i ) for a series of trace (z i , c i , 0) and get a basis of its kernel. Remark now that since the secret is not actually orthogonal to these vectors, the obtained matrix is not singular. To overcome this di culty we thus do not seek a vector in the kernel but instead in the eigenspace associated with the smallest eigenvalue of W. This technique can be seen as a continuous relaxation of the kernel computation in the prefect case. It translates directly into pseudocode in Algorithm , where the computation of the eigenvector is performed iteratively and N = δ 1 n + 4 δ 2 n is the norm of the secret key. Remark that this technique does not recover exactly the secret but an approximate solution over the reals. To recover the secret we need to nd the closest integral vector to the output candidate, which is simply done by rounding each coe cient to the nearest integral elements. In addition, remark that by the contruction of the public key from the secret one, recovering solely s 2 is su cient to reconstruct the full secret key. Hence the rounding can be carried to 2Z on the second part of the eigenvector to conclude, as s 2 has its coe cients equal to , ±2 or ±4 by construction.

Algorithm -Spectral a ack

Collect m traces (z i , c i , t i )

for i = 0 to m do if t i = 0 then W ← c i z * i • c i z * i T
end if end for S ← $ N (0, 1) n ; S ← S s 0 for i = 0 to K do S ← W -1 S; S ← S s 0 end for return round( S S N )

Let us now try to use all the samples and not discard the ones for which t > 0. j . .

A timing attack by phase retrieval

Exploiting the leakage of the sampler boils down to retrieve S up to sign from a family of values of the shape (z i , c i , t i ) where t i is sampled under a geometric distribution of parameter p(S, c i , z i ). A natural approach would then consist in starting by estimating the values of p(S, c i , z i ) for each trace (c i , z i , t i ), yielding a (noisy) estimate of the absolute value of the inner product | z i , Sc i | = | z i c * i , S |. In a second time we then fall back on retrieving S from samples of the form (| w i , S |, w i ). This is an instance of so-called (noisy) phase retrieval problem. . . . . First phase: estimation of the phases. In order to get a (noisy) evaluation of the phases, we devise an estimator of maximum likelihood. For any x, set L i (ω)(x) to be the logarithm of the probability Pr[| S, w i | = x|t = ω]. We then set the estimator y i to be the arguments of the maximum of L i (t i ) for each trace. Such a computation is classically done using Bayes' theorem and seeking for critical values from the derivates of x → L i (ω)(x).

. . . . Second phase: solving the phase retrieval instance. Phase retrieval aims at solving quadratic equations of the shape | S, w i | 2 = y i i = 1, . . . , m, where S is the decision variable, the w i are known sampling vectors and the y i ∈ R are the phase measurements. The noisy version of this problem consists in retrieving the variable S from noisy quadratic equations:

| S, w i | 2 + e i = y i i = 1, . . . , m, for e i independents (usually gaussian) random variables. This non-noisy problem has been widely studied in the elds of statistical learning and the most common approach to tackle it consists of a two-step strategy. It appears that with some minor tweaks, this method is robust enough to tackle our noisy version. . . . . Initialization via spectral method. First, nd a candidate vector s 0 that is su ciently close to the actual solution to make the second step converges towards the actual solution. The usual way to initialize the candidate vector can be seen as a generalization of the principal component analysis (PCA): the initial guess is given via a spectral method; in short, s 0 is the leading eigenvector of the positive de nite symmetric matrix ∑ i y i w i w T i . The intuition behind this method is to remark that the secret vector will have a greater inner product with the test vectors w i which have a small angle with it. Hence we want to extract the direction of the w i for which the inner product is the largest, that is, favoring the components inducing high y i 's. This corresponds to extract the largest eigenvalue of the Gram-matrix of the w i , normalized by a diagonal matrix of y i . It is nothing more than a principal component analysis on the test vectors w i . In practice, we use a slightly di erent version of the (iterative version of the) spectral initializer, outlined in Algorithm , which provides slightly better practical results than the classical method of [ ]. In this algorithm, N (0, 1) is the centered normal reduced distribution, K is a constant, set su ciently large and N is the (public) norm of the secret key of the signature.

Algorithm -Spectral Initializer Input : Test vectors (w i ) i and their corresponding measures (y i ) i Output : A candidate solution s 0

A ← [w 1 | • • • | w m ]
s 0 ← $ N (0, 1) n for i = 0 to K do s 0 ← A T diag(y 1 , . . . , y m )As 0 s 0 ← (A T A) -1 s 0 s 0 ← s 0 s 0 end for s 0 ← s 0 s 0 N return rounding(s 0 ) . . . . The descent phase. Once an initialization vector is found, we iteratively try to make it closer to the actual secret by a series of updates like in a gradient descent scheme. Note that in the problem of phase retrieval the problem is non-convex so that a direct gradient descent would not be directly applicable. As stated in [ ], the phase retrieval problem can be stated as a minimization problem:

minimize 1 2m m ∑ r=1 (y r , | w r , x | 2 ), z ∈ R n , ( . )
where is a distance function over the reals (such as the Euclidean distance 2 (a, b) = (ab) 2 ). The corresponding descent, called Wirtinger ow, is then simply stated in Algorithm where t → µ t is a step function, which has to be experimentally tailored to optimize the convergence. The value > 0 is a small constant that determines the desired precision of the solution.

It is well known that minimizing non-convex objectives, which may have very many stationary points is in general NP-hard. Nonetheless if the initialization s 0 is su ciently accurate, then the sequence s i will converge toward a solution to the problem given by Equation ..

As in the rst attack, the descent algorithm does not directly give an integral solution to the retrieval problem, so that we eventually need to round the coe cients before outputting the solution.

The full outline of the attack is given in Algorithm . By the inherent noisy nature of the problem, if not enough samples are used to mount the attack, the recovery might fail on a certain amount of bits.

Algorithm -Wirtinger Flow Descent

In such a case one cannot gure a priori where these errors are and would be forced to enumerate the possible errors, using, for instance, the hybrid MiTM technique of Howgrave-Graham [ ]. Since the dimension (n = 512) is large, such an approach becomes quickly untractable as the number of errors is greater than . However, as the nal step of both of the attacks consists of a coe cientwise rounding, we can study the distance of each coe cient to 2Z. Heuristically since the descent is supposed ultimately to converge to the secret, the retrieved coe cients should be close to 2Z. Hence if some of them are far from this lattice, we can consider them as problematic coe cients and likely to be prone to induce an error after rounding. Suppose that we discriminate these problematic coe cients in a nite set T and that each coe cient outside T is correctly retrieved by rounding. Then we can nd the correct value of the coe cients in T by lattice reduction in dimension slightly larger than |T| by the exploitation of dimension reduction techniques we introduced j in [ ].

If the resulting dimension with this reduction is su ciently small (less than 100 for typical computers), this approach allows to still perform a full key recovery in cases where the sole descent algorithm would have led to some errors.

. . Practicality of the attacks and discussion

We summarize in Table . the number of samples required to perform a full key recovery with both of the attacks. The rst column corresponds to the rst attack described in Section . . with the MiTM technique of [ ] to correct the errors. The second column corresponds the Wirtinger ow technique coupled with the lattice reduction and the localization of Section . . . Since the descent attack is an improvement build on a spectral method, it is natural to see that this algorithm indeed requires far fewer samples to mount the attack than the rst method presented in Section . . . It should also be noticed that this attack discards every samples for which t > 0, implying that a certain amount of the information provided by the samples is not used. For instance when attacking -II with compression, almost millions of samples are necessary to retrieve the secret, but among those, only millions of them are actually conserved to mount the attack. The number of required samples may seems high compared to the dimension of the problem, but it can be noticed that the size of the errors obtained by obtaining the estimation of the phases by maximum likelihood is of the same magnitude as the actual phase we are trying to retrieve. Hence, canceling the noise actually costs a signi cant amount of samples, as evoked above.

As far as the correction of errors is concerned, with the two techniques introduced in Section . . (i.e. the MiTM and the localization), the two attacks have di erent behaviors. Indeed, the MiTM exhaustive search appeared to be more tailored to the rst attack whereas the localization worked far better for the descent attack. A more detailed discussion on the causes of this phenomena is provided in Section . . below. The results presented in Table . are obtained by making the maximum use of these correction techniques. Hence, the running time of a full key recovery is contributed almost exclusively by this nal phase: practically the parameters given allows the descent to yield a lattice problem in dimension at most . On a Intel Xeon E -v workstation this phase takes less than an hour to complete. Using the reduction with blocksize takes then around h to complete the recovery.

A striking observation is that in both of the attacks the compression on z 2 used in actual signatures, makes the recovery signi cantly harder: indeed, there is an order of magnitude between the number of samples needed to make a full key recovery. Indeed the bit dropping yields noisier estimates for the recovery problem. Finally, note that -is the hardest variant to attack with this method. This is due to the fact that this parameter set provides the highest rate of compression. A striking observation is that the descent attack pushes way more the distances towards either or and as such makes it easy to localize the coe cients that are prone to be problematic. Indeed setting a threshold at . clearly discriminates the "good" coe cients form the potentially problematic ones. On the contrary, the situation is way more blurry in the other attack, where the distances are much more close to . . As such being able to distinguish the "good" coe cients from the "bad" ones is much more difcult in order not to create false positives.

As a consequence, it is experimentally less costly to rely on Meet in the Middle technique to resolve the errors in this latter case as setting a threshold too low would imply reducing lattices of dimension too large. crucial rejection sampling step that forms the core of the Fiat-Shamir with aborts framework that supports 's security. Generally speaking, Gaussian distributions are ubiquitous in theoretical works on lattice-based cryptography, thanks to their convenient behavior with respect to proofs of security and parameter choices. However, their role in practical implementations is less clear, largely because of the concerns surrounding implementation attacks. Hence it seems important to develop e cient implementations of that are secure against these attacks, and in particular of the Gaussian generation part.

A possible solution can be nd by relying on an alternate implementation of the rejection sampling step, carried out by computing a su ciently precise polynomial approximation of the rejection probability using pure integer arithmetic. We manage to do so using a novel technique for polynomial approximation in Sobolev norm . As this norm is Euclidean, we can solve the polynomial approximation problem using the techniques introduced in Chapter to reduce the corresponding Z-module endowed with the (real-For u and v two di erentiable functions de ned on an interval I, Sobolev H 2 inner product is de ned by the following u, v = I uv + u v valued) inner product coming from this norm. We do not detail the precise construction here as it get out of the scope of this manuscript but still remark that the techniques developed in this thesis can also be applied for constructive matters in post-quantum cryptography. For a detailed reference on this constant time-implementation, we let the interested reader refer to our work [ ]. All along this manuscript, we tried to reveal relations between lattices and arithmetic, through the prism of the algorithmic of lattice reduction. In particular, we highlighted the notion of algebraic lattices and showcased some applications of the reduction of these objects in number theory and in cryptography. Our objectives were twofold: on the one hand we aimed at providing a sound framework to perform the reduction of arbitrary real latticesand in particular to make possible the certi ed reduction of algebraic lattices by using their image over Z-, and on the other hand we wanted to avoid the dimensional blow-up coming from the descent over Z to speed up such reduction, by exploiting the algebraic structure of these lattices.

. However, the reduction techniques introduced in Chapter , lead to a heuristic reduction of algebraic lattices over cyclotomic elds. This reduction was focusing on the reduction of free algebraic lattices. From this rst step, we can now aim at extending the reduction to arbitrary projective modules and thus to arbitrary algebraic lattices. This requires to move from bases to pseudo-bases. The whole resulting reduction is actually similar to the one presented in this manuscript, but the lifting phase is presenting the most di erences as it now acts on ideals. We need to generalize the Euclidean algorithm for solving Bezout equation to the ideal setting. As a consequence, we also need to compute with ideals at each step of the reduction. A naive approach to ideal arithmetic would become the bottleneck of the reduction. However, using the idea introduced in Section . . , we can obtain fast arithmetic if we can fastly compute a two-element representation from multiple generators. This computation can be done with lattice reduction. This gives a two-way recursive procedure: on the one hand, the reduction itself makes calls to a fast arithmetic procedure which itself may require to reduce some algebraic lattices. Besides, this reduction is fully provable and works with any tower of number elds: it is not restricted to the cyclotomics elds. Besides the fast ideal arithmetic, an application of this reduction is the fast computation of the Hermite Normal Form for modules over number elds.

As the rational arithmetic is performed using oating-point in the evoked algorithm, a natural line of research is then to combine this algorithm with the interval arithmetic presented in Chapter in order to certify the reduction while using minimal precision.

. ? A natural question remains open from the research presented in this manuscript and even from the generalization we evoked: how does this algebraic framework generalizes to the blockwise reduction algorithms, à la ? Indeed, we have seen in Chapter that a generic way to improve the quality of reduction is to adjoin a -oracle to the reduction. Therefore a faster -oracle for algebraic lattices would allow designing a blockwise reduction tailored for algebraic lattices, replacing the reduction by the fast reduction of Chapter . However, up-to-our knowledge, no signi cant improvement for the exact-problem for algebraic lattices exists. Trying to exploit the symmetries and algebraic structure of number elds to construct ad-hoc enumeration or sieving processes constitutes a thriving open problem for enhancing the reduction of algebraic lattices. Implications in lattice-based cryptography would be of course deep as it would force to reevaluate the security of all primitives using algebraic lattices.

. In Chapter , we introduced an e ective technique to make compatible the symplectic structure with the direct image of a lattice over a sub eld. This allowed attaching a symplectic structure to an algebraic lattice over a tower of number elds. This technique allowed to greatly improve the e ciency of lattice reduction for algebraic lattices. Indeed, recall that, informally, symplectic geometry aims at studying transformations letting areas between pair of vectors unchanged. Hence, by using only speci c transformations to manipulate a symplectic lattice we could preserve its symplectic structure: each local transformation on a basis let invariant a speci c area element so that acting on a vector also modi es another vector. All in all, it su ces to reduce only half of the basis to act on the whole basis by the preservation of the symplectic structure.

However, the drawback of this approach is to make the approximation factor of the reduction slightly worse. But then, instead of looking at transformations preserving areas, we could try to use transformations preserving volume forms or even more generally n-volume forms. Instead of relying on symplectic geometry, we would now enter the realm of n-plectic geometry, or so-called higher-order symplectic geometry. In this case, a local transformation of n -1 vectors of a basis would su ce to transform n vectors. The resulting reduction would, of course, be slower than with the symplectic technique used, but the approximation factor would be improved.

If the transition from lattice reduction to symplectic lattice reduction is pretty straightforward, going to n-plectic reduction seems to us a bit trickier. Indeed, a nice property of the symplectic spaces (or more generally symplectic manifolds) is that there is essentially a unique symplectic structure, by Darboux theorem (the structure being given by any Darboux basis, as explained in Chapter . This is no longer the case for n-plectic geometry. In particular, there is no direct correspondence between a "size-reduction" and a discretized version of the computation of a canonical basis of a n-plectic space. Hopefully, for the volume form coming from the Euclidean structure, it appears that we can adapt the construction of such a basis to overcome this obstruction. However, nding a descent of this structure which remains compatible with the direct image is still an open and very interesting problem.

. Arakelov theory is a geometric approach to Diophantine equations and approximation in high dimensions. However, very few works have been done in the design of e cient algorithms in algebraic Arakelov theory and in particular in the computation of the Arakelov class group of a number eld. An important result comes from the original remark of Schoof in [ ], where he noticed that the infrastructure machinery used by Shanks [ ] for the computations of class group à la Buchmann [ ] are very naturally described within the Arakalov class group of a number eld. This group consists of the quotient of so-called Arakelov divisors by principal Arakelov divisors, which are in correspondence with line bundles over the arithmetic curve given by spectrum of a maximal order of the eld. Hence computations in this setting require the reduction of vector bundles over such curves, which can be done e ciently and in a certi ed manner by developing the lattice reduction techniques introduced in Chapter and Chapter . Hence the techniques introduced in this thesis are naturally tailored for handling the base objects appearing in this theory and form a rst (baby) step towards e ectiveness in this theory.

Conversely, a natural investigation would be to make the Arakelov machinery revolving around the study of vector bundles over curves to irrigate the analysis and design of lattice reduction alogrithms. We have seen in Chapter of numbers that reductions algorithms can be interpreted as acting on ltrations of lattices. Hence they can be thought as a greedy approximation of the Harder-Narashiman ltration [ ] of the corresponding vector bundle. On the one hand, viewing lattice reduction as acting on such approximate strati cation gives a new way to understand and analyze classical algorithms whereas on the other hand, trying to nd e cient algorithms to approximate the Harder-Narashiman ltration would make arise new reduction techniques for Euclidean or algebraic lattices. As a very basic instance of this program, it seems to us the ltration machinery is a more natural mathematical tool to describe and analyze lattice reduction, compared to the usual way of dealing with Gram-Schmidt vectors. Of course, any result can be proved by one or the other approach, but it appears the computations can be done in a cleaner manner using ltrations.

. The celebrated problem of Regev [ ] and its numerous variants (Ring LWE, Module LWE, Order LWE, Middle-Product LWE, Torus LWE, among others) all live in a common natural arithmetic-geometric setting. Indeed these problems can be seen as learning a morphism from a vector bundle over an arithmetic curve to a compact variety-the classical problem being encompassed by the trivial vector bundle over Spec Z to the real torus R Z -. This general setting would allow simplifying and uniting the numerous variants and proofs, as well as being able to use the whole arsenal of arithmetic geometry to re ne and develop the theory revolving around these problems. In particular, we can wonder if it is possible to give less ad-hoc proofs of hardness and rely more on the interaction between the geometry of the problem and its information theoretical analysis. Moreover, a non-commutative version of Arakelov theory has been proposed [ ] to study bundles over the spectrum of a Z-order in nite-dimensional semisimple Q-algebras. The formalism evoked above would then be extendible to non-commutative curves and would lead to a very generic -like problem in a non-commutative geometric setting. Cryptographic constructions arising from this formalism would keep the e ciency of lattice-based cryptography while being less sensible to linear representation-based attacks. A question which arises then is the possibility to construct secure graded-encoding schemes from such non-commutative learning problems-which would be resistant to the disastrous zeroizing attacks [ ] breaking all of the previous constructions of such schemes-.

In order to prove Lemma . . , we rst compute a basis of the dual lattice from the basis L 3 and compute its Gram-Schmidt orthogonalization.

Claim . Let D = [d 3 , d 2 , d 1 ] the reversed dual base of L 3 . Then:

    0 0 1 0 1 a - √ a 2 -1 a 1 a 2 - √ a 2 -1 a 2 a 2 -1 a 2    
Its Gram-Schmidt orthogonalization is:

    0 0 1 0 1 a 0 1 a 2 0 0         = d 3 := d * 3 = π (d 3 ) ⊥ (d 2 ) := d * 2 = π (d 3 ,d 2 ) ⊥ (d 1 ) := d * 1    
Then we have: and so -4 3 ≤ x 2 ≤ 4 3 , meaning that x 2 ∈ {-1, 0, 1}. Case x 2 = 0: We have z 2 3 d * 3 2 ≤ 4 3α 2 and as such

d 2 , d * 3 d * 3 2 = - √ α 2 -1 α d 1 , d * 2 d * 2 2 = - √ α 2 -1 α d 3 , d * 1 d * 1 2 = 0 Proof of Lemma . . . Let v = x 1 • d 1 + x 2 • b 2 + x 3 • v 3 be a
x 2 3 = z 2 3 r * 3 2 ≤ 4α 2 3
and so x 3 ∈ {-1, 0, 1}, leading to v ∈ {0, ±d 3 }.

Case x 2 2 = 1: In this case we have:

x 3 + √ α 2 -1 α 2 = z 2 3 r * 3 2 ≤ 4 3α 2 - 1 α 2 ≤ 1 3α 2
leading to:

-2 < - 1 3 - √ α 2 -1 α ≤ x 3 ≤ 1 3 - √ α 2 -1 α < 1.
Therefore, up to sign, v ∈ {d 2 , d 2d 3 }. Remark that:

r 2 -r 3 2 = 2 √ α 2 -1 α + 2 > 4 3α 2
since α > 1. Hence v = ±d 2 .

Case x 2 1 = 1: Without loss of generality (since the lattice is invariant by sign change) we can suppose that x 1 = 1. We have z 2 2 r * 2 2 +z 2 3 r *

3 2 ≤ 4 3α 2 + 1 α 2 -1 α 4 -1 = -3 a 4 +7 a 2 -3 3 a 4
and as such

x 2 + √ α 2 -1 α 2 1 α 2 = z 2 2 r * 2 2 ≤ -3 a 4 + 7 a 2 -3 3 a 4
and so:

x 2 + √ α 2 -1 α 2 ≤ 10 9
-2 < x 2 < 2. Therefore x 2 ∈ {-1, 0, 1}.

Case x 2 = 0: We have z 2 3 d * 3 2 ≤ 4 3α 2 -1 α 4 and as such

x 2 3 = z 2 3 r * 3 2 ≤ 4α 2 -1 3α 4 ,
and so -2 < x 3 < 2, that is x 3 ∈ {-1, 0, 1}. Remark now that:

• d 1 + d 3 2 = a 2 -1 a + 1 2 + a 2 -1 a 2 + 1 a 4 > 4 3a 2
• d 1d 3 2 = a 2 -1 a -1 2 + a 2 -1 a 2 + 1 a 4 > 4 3a 2 , since α > 0 All in all v = d 1 .

Case x 2 = 1: We have z 2 3 d * 3 2 ≤ 4 3α 2 -1 α 4 -1 a 2 < 0, which is not possible.

Wrapping up everything gives v ∈ {±d 1 , ±d 2 , ±d 3 }.

. Λ 3

We are now able to prove our main theorem on the structure of reduced bases of Λ 3 .

α 2 √ α 2 -1α √ α 2 -1α α 2 . Therefore x, y x 2 = √ α 2 -1 α ≤ 1 2 .
Corollary . . . The basis L 3 is reduced.

Proof. By Claim we only need to verify that [b 1 , b 2 ] is Gauss-reduced to conclude, which is immediate.

Claim . The shortest vectors of π (b 1 ) ⊥ (Λ 3 ) are exactly π (b 1 ) ⊥ (b 2 ), π (b 1 ) ⊥ (b 3 ).

Proof. By Claim , the rst two minima in this lattice coincides and are equals to α. Therefore if another shortest vector exists it is of the form with limited loss in precision. The complexity of this computation is a O(np + n log n • p/w) = O(np) for p = Ω(w + log n) with n = ϕ( f ). Indeed it breaks down as:

• Write the coe cients as polynomials with register-size coe cients and compute their Fourier transform with a cost of O(np)

• Compute O(p/w) convolutions with Fourier transforms of size O(n)

• Compute the inverse transform and propagate the carries for a running time of O(np).

(A modular implementation is probably faster if n is not tiny.) In the general case, one would have to precompute the roots and use product and remainder trees [ ].

. The Householder orthogonalization algorithm transforms a complex matrix A into a product of QR, with Q unitary and R upper-triangular. Q is formed as a product of unitary re ections, which are all of the type Id -2vv t for certain vectors v = 1.

The vector v corresponding to the rst symmetry is chosen so that the rst column of R has only its rst coordinate to be non-zero. The algorithm then applies this unitary operation to the matrix A and recursively orthogonalize the bottom-right of this new matrix.

More precisely, denote by a the rst column of the matrix A. As such, the rst column of R will be the vector r =a • a 1 |a 1 | , 0, . . . , 0 t , with the quotient a 1 |a 1 | set to 1 if a 1 = 0. Then with v = a-r a-r and Q = Id -2vv t , we have that:

Qa = a -2
(ar)(ar) t a ar 2 = a -2( a 2 -r t a) ar 2 (ar)

We now use the fact that a t r ∈ R and r = a to get:

2( a 2 -r t a) = a 2 -r t aa t r + r 2 = ar 2 so that Qa = r.

The sign in the de nition of r implies that ar ≥ a so that we can compute v with the precision used to handle a.

If we use p > ω(log d) bits of precision, we can multiply by Id -2vv t with a relative error of O(d2 -p ). Using Lemma . . , since we are perform- ing d symmetries, each column is computed with a relative error of at most a O d 2 2 -p . Hence, with Q the matrix output by the algorithm, each column of Q t A has a relative error of O d 2 2 -p with respect to the computed R.

This implies that there exists a matrix A where each column is A within a relative error of O d 2 2 -p , and whose R-factor in the QR decomposition is the returned R. Remark that the returned R i,i may not be real. While this is usually not a problem, R has to be multiplied on the left by a diagonal unitary matrix to obtain the QR-decomposition.

We de ne the conditional number of A as κ(A) = A A -1 . We can bound the stability of the QR decomposition [ ]:

Theorem . . . Given a matrix A, let R be the R-factor of its QR decomposition. For the matrix A + δA, let R + E be the R-factor of its QR decomposition.

Then:

E ≤ 3κ(A) δA provided that κ(A) δA A < 1/10. Proof. Let A = QR be the QR-decomposition. Without loss of generality, we assume A = 1. For a technical reason, we study the problem with δA a linear function where δA(1) is the wanted matrix, which means that other quantities such as E are also functions.

We now obtain:

(A + δA) We multiply by A -t on the left and A -1 on the right:

A -t E t Q t + QEA -1 + A -t E t EA -1 = A -t δA t + δAA -1 + A -t δA t δAA -1 .
With ρ = EA -1 and = δAA -1 , we take the norm and get the inequality:

ρρ 2 ≤ 2 + 2 so that for < 1/10 we have ρ ≤ 3 if ρ < 1/2. We now have to exclude the case ρ > 1/2, which we do with a topological argument. It is clear from the algorithm that the QR-decomposition is continuous over invertible matrices. Since A -1 (A + δA(t)) -Id ≤ A -1 δA(t) < 1/2 for 0 ≤ t ≤ 1, we have that A + δA is invertible and therefore ρ is continuous over [0; 1]. As ρ(0) = 0 and ρ([0; 1]) is connex, we get ρ(1) < 1/2.

Finally E ≤ EA -1 A = ρ gives the result.

Theorem . . . Let A, δA and U an integer matrix such that AU ≤ κ A , κ(AU) ≤ κ and δA A ≤ 3κ 3

with < 1/4 and κ ≥ κ(A). Let R be the R-factor of the QR-decomposition of AU and R + E be the one of (A + δA)U. Then U ≤ κ 2 and E A ≤ .

Proof. First U ≤ A -1 AU ≤ κ A -1 A ≤ κ 2 . Then U ≥ 1 since it is integral so that 1 ≤ A -1 AU ≤ A -1 AU and AU ≥ 1 A -1 = κ(A)

A . We deduce: δAU AU ≤ 3κ 2

. and applying the stability theorem we get:

E AU ≤ κ .
Using the lower bound on AU nishes the proof.

In all algorithms, max i N K/Q (R i,i ) is non-increasing with respect to the round number and min i N K/Q (R i,i ) is non-decreasing so that we can use the theorem for all U where AU is size-reduced with

κ ≤ max i N K/Q (R i,i ) min i N K/Q (R i,i ) 1/n 2 O √ n log n log log n+d log n .
Heuristically, for random lattices, we have U κ(A) and κ(AU) depends only on the dimension so a truncation of the R-factor of the QRdecomposition of A with error roughly A /κ(A) is enough. The precision needed is therefore on the order of 2 log(κ(A)). We recall that we want to prove the following general rounding theorem:

Theorem . . . Let L be the cyclotomic eld of conductor f . There is a quasilinear randomized algorithm that given any element in x ∈ (R ⊗ L) × nds a unit u ∈ O × L such that for any eld embedding σ : L → C we have

σ xu -1 = 2 O √ f log f N L/Q (x) 1 ϕ( f ) .
. .

Let us consider an integer f and take its prime decomposition f = ∏ r i=1 p e i i . We set q i = p e i i and we x the cyclotomic eld L = Q[ζ f ] of conductor f . Classically, the Galois group of L is equal to G = (Z/ f Z) × {-1, 1} , whose elements are the σ α , sending ζ f to ζ α f for any α ∈ G.

. .

The cyclotomic units are de ned as all the products of ±ζ f and ζ a f -1 which are units. We let Q be the set of the 2 r possible products of the q i .

A standard theorem of [ , Lemma . ] reduces the number of generators of the cyclotomic units: Theorem . . . The cyclotomic units are all the products of ±ζ f and G • (ζ a f -1) which are units, when a runs through Q. Proof. Let a ∈ Z, and de ne k to be the product of all the q i dividing a, so that by construction k ∈ Q. Now, we have:

1 -ζ a f = a k -1 ∏ i=0 1 -ζ k+ i f k a f
. Let p j |k + i f k a . Remark that p j | f k a , so that p j |k, and by de nition of k we have q j |k. We have therefore q j | f k a and hence Proof. If gcd(c, e) > 1, we have ∑ α∈(Z/ gcd(c,e)Z) × χ(α) = 0 so the result is zero. We therefore assume for now on that c and e are coprime.

ζ k+i f k/a f -1 ∈ ±G • ζ k f -1.
We rst compute: With this de nition we can complete the description of the cyclotomic units:

Theorem . . . [ , Lemma . ] The cyclotomic units are generated by:

• The pair ±ζ f ,

• the G • ζ a f -1 for all a ∈ Q such that f a is not prime power,

• the orbit of ζ f /q i f -1 by the action of the augmentation ideal.

Proof. Note rst that for any a ∈ Q, (1σ α ) • (ζ a f -1) ∈ O L . Next, we prove that an element u generated by the ζ a f -1 is a unit if N L/Q (u) = 1. We remark that

ϕ( f ) • u = N L/Q (u) ∑ α 1 -σ α • u = ∑ α 1 -σ α • u
so that it is a unit. The converse is clear. Eventually a direct computation ensures that

N L/Q (1 -ζ a f ) is p ϕ(a) i
if a = f /q i and 1 else using the equations at the beginning of the proof of Theorem . . .

. " "

We now de ne the family (b i ) 1≤i≤|Q| by setting b i = Log(ζ a f -1) where the a ∈ Q are taken in decreasing order. We can de ne some Gram-Schmidt orthogonalization on this family with the relations:

b * i = b i -∑ j<i b i , b * j b * j , b * j b * j = b i -∑ j<i b i b * j (b * j ) †
where the dagger is the Moore-Penrose pseudo-inverse. As such, χ(b i ) = χ(b * i ) if χ(b * j ) = 0 for all j < i, and is equal to zero elsewhere. As L(1, χ) = 0, we have for all χ = 1 that χ(b * i ) = 0 i rad( f e )|c| f e where c is the conductor of the character χ. Furthermore, in this case, the term ∏ p i | f e (1χ(p i )) is one. We can now give our decoding algorithm, assuming again that the cyclotomic units have a nite index:

Proof of the rounding theorem for arbitrary cyclotomic elds. We let b i = Log(ζ e f -1) and recall that for all χ with conductor not coprime with e we have χ(b i ) = 0. We remark that if f e is a prime power, we have b * i = b i and as a result b * i ∞ ≤ log( f e ). Also, we have for all i that b *

i ≤ b i = O ϕ f e
using the same technique. The algorithm consists in using Babai reduction with our generating family, with the modi cation described above to round with respect to the augmentation ideal when we have to. More precisely, for any y ∈ Z[G]b * i , we compute z a randomized rounding of y/b * i in the same way as in the previous section. If f e is a prime power, the rounding

is z -∑ α z α σ 1 , else it is z. If | ∑ α z α | ≥ f e log( f e )
in case where f e is a prime power, we restart the rounding. We then continue in the same way with i -1. The analysis is as before. The randomized rounding produces an error with subgaussian coordinates with parameter O ∑ e∈X ϕ(

f e ) = O
f . The correction for the prime power adds an error bounded by ∑ i log(q i ) √ q i / log(q i ) = O( f ). Hence, the bound on the output holds. In Chapter , we described how to descend the symplectic structure when L = K[X]/(X d + a), that is for Kummer-like extensions. We show here the general case, that is when L = K[X]/ f (X). We rst give a simple construction which recovers the one given above but has losses in the general case; and then describe a general construction without losses.

.

We have the following lemma, proved in [ , Chapter III, Proposition . ]:

Lemma . . . Let a i = X i and ∑ i b Y i = f (Y) Y-X . Then tr L/K (a i b j / f (X)) is equal to if i = j and 0 else. This suggests taking as a K-basis for L 2 the (a i , 0) followed by the (0, b i ).

With the notations of Section . , we now de ne J L as tr L/K (J L / f (X)).

It follows from the lemma that in our basis, this is represented by the Darboux matrix:

0 Id d -Id d 0
and, as usual, we can reverse the order of the second part of the basis to obtain the wanted matrix. We can convert e ciently a number z ∈ L in the basis of b i . Clearly, the coe cients are given by all the tr L/K (z/ f (X) • X i ). We then simply evaluate z/ f (X) on all roots of f using a remainder tree, and follow by a Vandermonde matrix-vector multiplication, which is also a multipoint evaluation [ ]. In particular, we do not need to compute the b i .

There is however a loss with this basis: the algorithm tries to minimize the size of the coe cients in our basis of L 2 instead of the canonical norm.

. We want to build an orthogonal R ⊗ K-basis of R ⊗ L. We assume for simplicity (only) that L (and therefore K) is a totally real eld. Hence, with K = Q[Y]/g(Y), we have that all roots r i of g are real, and when we evaluate all coe cients of f on r i , the resulting polynomial has real roots r i,j .

.:

  Elementary operations . . . . . . . . . . . . . . . . . . . . . . Householder orthogonalization . . . . . . . . . . . . . . . . . Size-reduction . . . . . . . . . . . . . . . . . . . . . . . . . . . Setting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . Cyclotomic units and their generators. . . . . . . . . . . . . . Construction of an "orthogonal" basis . . . . . . . . . . . . . . . The dual integer construction . . . . . . . . . . . . . . . . . . The orthogonal construction . . . . . . . . . . . . . . . . . . : Self Dual Block Korkine Zolotare algorithm of Micciancio and Walter2 : : Quadratic Lenstra-Lenstra-Lovász algorithm of Nguyen and Stehlé : : Adaptive precision Lenstra-Lenstra-Lovász algorithm : : Principal Ideal Problem : : Short integer solution problem : : Learning With Error problem : : Shortest vector problem : : Closest vector problem : : Fully Homomorphic Encryption I N T R O D U C T I O N

  , avec deux bases B = (u, v) et C = (x, y) ainsi que leurs parallélogrammes respectivement associés P (B) et P (C). Les aires de ces deux parallélogrammes sont comme annoncé égales. En particulier, ceci implique que le déterminant ∆(b 1 , . . . , b n ) de la matrice de Gram G = b i , b j 1≤i,j≤n

  réseau obtenu pour p = 5, avec le disque C correspondant, hachuré.

  dimensions four and ve [ ], Blichfeldti for dimensions six to eight[ ], and eventually Cohn and Kumar in dimension twenty-four [ ]. The set of techniques introduced to prove these rst results are prototypes of algorithms which are now known as lattice reduction algorithms. . Euclidean lattices . . . Formalization of the lattice notion.

Figure :

 : Figure : Plane lattice, with two basis B = (u, v) and C = (x, y) as well as their associated parallelograms P (B) and P (C). The area of these two parallelograms are equals.

Figure :

 : Figure : Example of the critical case for Minkowski's theorem.

Figure :

 : Figure : Example of the lattice obtained for p = 5, with the disk C hatched.

  Example. Let A[X] be a polynomial ring over a commutative ring A and f a monic polynomial of degree d in A[x]. De ne the quotient module B = A[X]

  De nition . . (Divisibility of ideals). Let a and b two ideals: we say that a divides b, and write a | b, if there exists some ideal c such that ac = b. Divisibility de nes a relation which is, in fact, the inclusion relation: Corollary . . . Let a, b, c ⊆ R be ideals, c = 0. Then . b ⊆ a if and only if bc ⊆ ac . a | b if and only if ac | bc . a | b if and only if b ⊆ a. Proof. . (⇒) is clear, and (⇐) is obtained by multiplying by c -1 . . (⇒) is clear, and (⇐) is obtained by multiplying by c -1 .

Proof.

  Refer for instance to [ ]. De nition . . (Pseudo-basis). Let R be a Dedekind domain and let P be a nitely generated projective R-module of rank d. Then a family

  )O L implying that the factoring of f α must have to distinct linear irreducible factors. But there are only two irreducible linear polynomials in F 2 [X], a contradiction.

  Structure of the elds embeddings. By being algebraically closed and containing Q, every number eld is a sub eld of C. A natural object of study is then the possible embeddings-that is eld homomorphisms-L → C.

  Figure presents an example of this situation for a planar lattice. . . . . Direct sums, tensor, and exterior products. Let (Λ, • Λ ), (Λ , • Λ ) two lattices of rank-d and d . The direct sum Λ ⊕ Λ can be equipped with a lattice structure by setting: v

Figure :

 : Figure : Plane lattice with two bases represented B = (u, v) and C = (x, y) as well as the corresponding parallelotope P (B) et P (C). The area of these two bodies is of course the same.

  Let us x a basis B of Λ. Then the open parallelotope P (B) forms a tiling of Λ R by translation by the elements of Λ: v∈Λ P (B) + v. Each of these translations P (B) + v intersects Λ only on v by construction. Hence, Λ

√ 3 .

 3 The corresponding search problem is written as: Problem (Siegel reduction for well conditiond bases). Given an rank d integer lattice Λ given as a matrix A of dimension d with A , A -1 ≤ 2 B , nd a √ 2-Siegel reduced basis of Λ. . . . . A linear algebra problem over nite elds. De nition . . (Kernel problem). Given a square matrix A of dimension d over F p , output a matrix K such that AK = 0 and the number of columns of K is dim ker A. . . . . A reduction for the reduction problem. The reduction from the Siegel problem to the kernel problem is very straightforward and almost lossless: Theorem . . . If one can solve the Siegel-reduction problem in dimension 2d with parameter B, then one can solve the kernel problem in dimension d for any prime p ≤ 2 B/2-d-1 d -1 with the same complexity, up to a constant. Proof. Let A,p be the input of the kernel problem. The matrix L = d2 2d p 2 Id d pd2 2d A 0 Id d is given to the Siegel reduction oracle. The output is of the form 0 * K *

  have b 3 < b 2 ≤ b 1 . Denote by Λ α the Euclidean lattice spanned by b 1 , b 2 , b 3 . This lattice has only two -reduced bases : L 3 = [b 1 , b 2 , b 3 ] and the size-reduction of R 3 = [b 3 , b 2 , b 1 ]

Figure :

 : Figure : Phase transition on the behavior of δ-for the lattice Λ α . Probability of outputting [b 1 , b 2 , b 3 ] after the δ-reduction of random basis of Λ α for α = 1.07.

  . . . . A simple algorithm for reduction. It is easy to unfold De nition . . to construct an algorithm computing an -reduced basis from the oracle O:

  Gama and Nguyen [ ] and the other hand, the practical heuristic variants, culminating in the recent self-dual of Micciancio and Walter [ ]. . . . . The Block-Korkine-Zolotarev algorithm. In [ ], Schnorr describes a block generalization of the -algorithm, parametrized by the block-size β which works essentially as follow:

Proof.

  The bound we get is a direct consequence of [ , Theorem ]. We only replaced the Hermite constant γ β by an upper bound in O(β) as presented in Paragraph . . . . The cost analysis is derived from a study of [ , Algorithm ] (with the abort technique after a polynomial number of rounds), and the complexity of the Shortest Vector Problem ( ) is below 3 2 β/2+o(β) operations, according to [ ]. Remark (Complexity bound for polynomial-time γ-). This last result ensures that solving γ-for approximation factors in O 2 n log log n log n is possible in polynomial time, by instantiating the algorithm with block-size β = Θ(log n).

  y i σ , for any x = (x 1 , . . . , x d ) ∈ L d R and y = (y 1 , . . . , y d ) ∈ L d R .

  the module O L seen over the Dedekind domain O L is not necessarily free. Hence, if we use as de nition of an O L -lattice to be a free O L -module, then such lattices would not necessarily be lattices over O K . Relaxing the freeness into projectiveness is however su cient as O L is always a projective O K -module.De nition . . (O L -lattice).Let L be a number eld. An O L -lattice-or algebraic lattice over O L -is a projective O L -module Λ of nite rank, endowed with a Humbert form on the ambient vector space Λ ⊗ O L R.Remark. We can rewrite De nition . . , as being a projective O L -module endowed with a family of Hermitian forms • σ on the spaces Λ ⊗ O L C, which are invariant by conjugation. This de nition corresponds to the notion of Hermitian vector bundles over the arithmetic curve SpecO L , as studied in Arakelov geometry. For a very detailed account on this topic, we invite the reader to refer to the monograph ofBost [ ].

  is taken over O L -lattices sharing the same Steinitz class a. For a precise treatment of this question in a more general context (which encompasses Thunder's constant, Rankin's contant, and adelic version of them) we invite the reader to refer to the work of Watanabe and Coulangeon [ ].

  On norm-Euclidean domains.De nition . . . Let R be an integral domain. A Euclidean function, or stathsme, on R is a function f : R{0} → N \ {0}, satisfying the divisionwith-remainder property: if a and b = 0 are in R, then there exists q and r in R such that: a = bq + r and either r = 0 or f (r) < f (b).

Figure :

 : Figure : Basic arithmetic operators in Interval Arithmetic

  Theorem . . . Let (δ, η) be admissible parameters. Let c > log (1+η) 2 δ-η 2 and let (Λ, •, • ) denote a rank-d lattice, exactly described by the pair (G, L). Let B denotes the maximum entry in absolute value in L T GL. Then, the ˜ 2 of Algorithm used with = cd + o(d) outputs a (δ, η)--reduced basis in time O d 3 log B(d + log B)M(d) . Furthermore, if τ denotes the number of main loop iterations, the running time is O(d(τ + d log dB)(d + log B)M(d)).

  Figure : Schematic view of the recursive call of reductions.

  only on the odd coordinates, so let ∆ be its restriction to them in the domain and codomain. Remark that for all 1 ≤ k ≤ dthe eigenvectors are orthogonal. Since 2 d/2 ≤ d, we use the trivial bound cos kπ d ≤ cos π d in addition to the convexity bound ln(cos(π/d)) < -

  Howgrave-Graham and Nguyen [ ] found instead that it gave a "smoother (better)" basis, showing a signi cant di erence in their Figure . An other version of the paper does not include this comment, and their (perplexing) Figure shows no di erence in the exponential decrease of the Gram-Schmidt norms.

  Example. Let us take L = Q[ζ 3 ], the cyclotomic eld of conductor 3 and degree 2.Its discriminant is -3. Then, O L = Z[ζ 3 ] admits B = (1, ζ 3 ) as a Z-basis.The canonical embeddings are given by the identity map and by the morphism mappingζ 3 to ζ 2 3 = -1ζ 3 , so that the canonical norm of a generic element is N L/Q (x + yζ 3 ) = x 2 + y 2xy.Let us construct the ideal a generated by the element (1ζ 3 ), of norm equal to 3. The corresponding Z-module is generated by (3, 1ζ 3 ) Hence under the 2 coe cient norm in B, the corresponding lattice is isometric to :

  norm 4 and the inner product of these two embeddings is3(1 -ζ3 ) + 3(2 + ζ3 ) = 9.The Figure and Figure depict the di erence between these two embeddings.

  see Proposition . . for the structure result of this ring).

Figure : Figure :

 :: Figure : Lattice generated by (1ζ 3 ) ⊂ Z[ζ 3 ] through the coe cient embedding.

  This should be compared to the covolume of the direct image of a for the canonical norm of L, which gives: covol(a) = N(a) |∆ L |... . SettingIn all of the following let us x a cyclotomic eldL = Q[ζ f ] of conductor f and degree n = ϕ( f ).For the sake of simplicity, we now write ζ for ζ f . The principal ideal problem is formally stated as follow:Problem (Principal ideal problem the number eld L). Let g ∈ O L an integer. Denote by a = gO L the ideal generated by this element.

  Figure . The next step consists in nding a generator of a s . We use a strategy based on class group computation. It boils down to constructing a generating set

Figure :

 : Figure : Description of the descent to small norm ideals. The smoothness of the ideals is decreasing along the descent tree. The leaves are all B-smooth.

  . . . . Reduction to the Gentry-Szydlo setting. This original algorithm from [ ] takes as input a Z-basis of a principal ideal b in the ring O L and an algebraic integer of the form b • b, for b a generator of b. It then recovers in polynomial time the element b.

  Lemma . . . Let L = Q[ζ f ] the cyclotomic eld of conductor f and degree n = ϕ( f ), and L + its maximal real sub eld. Denote by ∆ the discriminant of L + . Assuming Heuristic . . , from any ideal a ⊂ O L , it is possible to generate in deterministic time L ∆ 1 2 an integral ideal b of norm bounded by L ∆ 3 2 and an algebraic integer v such that vO L + = a • b.

  Theorem . . . Let L = Q[ζ f ] the cyclotomic eld of conductor f and degree n = ϕ( f ), and L + its maximal real sub eld. Denote by ∆ the discriminant of L + . Let a be an ideal of L + of norm below L ∆ [α], for 1 2 ≤ α ≤ 1. Then, in expected time L ∆ 1 2 , it is possible to construct an algebraic integer v and an L ∆ 2α+1 4

  Because the ideal a contains vO L + , there exists a unique integral ideal b, satisfying vOL + = a • b. We nd that N L + (b) ≤ L ∆ α 2 + 3 4 fromthe multiplicative property of the norm and N L + (a) = L ∆ [1] ≤ L ∆ α randomization-and-repeat technique as in Algorithm , the reduction yields the desired couple (v, b) in expected time L ∆ 1 2 .

Figure :

 : Figure :The descent algorithm.

  . . . . Bootstrapping phase. Let us introduce a real constant c 0 > 0 which will be optimized to minimize the global cost of the algorithm. When using a block-size β = c derive an ideal a (0) that is L ∆ 1is a re nement of Theorem . . , according to the cost stated in Equation . . . . . . Descent phase. The analysis of the descent is done by re ning the complexity of Theorem . . . At the k-th step of the descent, we have seen in Paragraph . . . that we take an ideal of norm L ∆ 1 2 + 1

  • s l , this su ces for our purposes. . . . . Linear algebra phase. Let us x c b = e • s l and B = L ∆ 1 2 , c b . We now have to handle of all the B-smooth ideals resulting from the descent. As a consequence of Landau's Prime Ideal Theorem [ ], we know that the factor base composed of all prime ideals of norm below B has cardinality B log(B) -1 1 + o(1) . The ideals generated by the algebraic integers v used in Step have norm upper bounded by L ∆ 1, 1 4 by construction. Hence we can nd one that is B-smooth by testing on average L ∆ 1 2 , 1 8c b of them. As we want about B 1 + o(1) relations, the cost of this collection is given by L ∆ 1 2 , c b + 1 8c b . Eventually the remaining part is to solve the corresponding linear system. To do so, we can use for instance the Las-Vegas algorithm described by Storjohann in [ ], whose complexity is in L ∆ 1 2 , ω • c b . . . . . Optimizing on c. Combining the complexity of the relation collection and the linear algebra yields a nal cost of

  Figure : Recovery of the generator f from its relative norm: Case p ≡ 1 mod 4.

Figure :

 : Figure : Recovery of the generator f from its relative norm: Case p ≡ 3 mod 4.

  present the result of an experiment picturing the distance of each coe cient of the candidate secret from the lattice 2Z before the nal rounding, for both of the proposed attacks.

.

  Figure : Comparison of the repartition of the distance to the lattice 2Z.

  The corresponding norm• H 2 is u H 2 = I (u 2 + u 2 ) . C O N C L U D I N G R E M A R K S A N D O P E N P R O B L E M S

  and de ne b 1 = (α 2 0 0), b 2 = (α√ α 2 -1 α 0) and b 3 = (0 √ α 2 -1 1), so that Λ 3 is spanned by these latter vectors. The respective (squared) norms of these vectors is α 4 , α 2 , α 4 . Then we have . The basisL 3 = [b 1 , b 2 , b 3 ] is reduced. . The basis R 3 = [b 3 , b 2 , b 1 ] is weakly-HKZ reduced.. The only reduced bases of the lattice Λ 3 are L 3 and SR(R 3 ).

Proof.

  Since α > 1, the study of the norm of the projected vectors π (b 3 ) ⊥ (b 2 ) and π(b 3 ) ⊥ (b 1 ) done in Claim asserts that π (b 3 ) ⊥ (b 2 ) < π (b 3 ) ⊥ (b 1 ) .Since the vectors of a Gauss reduced basis reach respectively the rst and second minimum of their rank lattice we deduce that λ1 (π (b 3 ) ⊥ (Λ 3 )) < λ 2 (π (b 3 ) ⊥ (Λ 3 ). Let [b 3 , x, y] areduced basis of Λ 3 , then by de nition the projected vectors [π (b 3 ) ⊥ (x), π (b 3 ) ⊥ (y)] are a Gauss reduced basis ofπ (b 3 ) ⊥ (Λ 3 ). Then π (b 3 ) ⊥ (x) = r *2 and π (b 3 ) ⊥ (y) = b 1 . This implies that there exists two integers u, v such that x = b 2 + ub 3 and y = b 1 + vb 2 . By size-reduceness of [b 3 , x, y], u, v = 0, which concludes the proof.Claim . The projected basis [π (b ⊥ 1 ) (b 2 ), π (b ⊥ 1 ) (b 3 )] is Gauss-reduced in π (b ⊥ 1 ) (Λ 3 ). Proof. We have: x := π (b ⊥ 1 ) (b 2 ) = [0 α 0]and y := π (b ⊥ 1 ) (b 3 ) = b 3 by orthogonality. Hence the Gram matrix of the projected basis [x y] is:

π

  (b 1 ) ⊥ (b 2 ) ± π (b 1 ) ⊥ (b 3 ), which have squared norm respectively equal to:2α(α ± √ α 2 -1) > α 2 .Claim .The basis L 3 is the only -basis of Λ 3 of rst vector b 1 .Proof. Let [b 1 , x, y] a reduced basis of Λ 3 , then by de nition the projected vectors [π (b 1 ) ⊥ (x), π (b 1 ) ⊥ (y)]are a Gauss reduced basis of π (b 1 ) ⊥ (Λ 3 ), hence by size reduceness and Claim , either x = b 2 , y = b 3 or x = b 3 , y = b 2 . But in the latter case, the Lovasz condition fails between b 3 and b 1 since b 3 < b 1 .Claim . The size reduced projected basis SR([π (b ⊥ 2 ) (b 1 ), π (b ⊥ 2 ) (b 1 )]) is Gaussreduced in π (b ⊥ 2 ) (Λ 3 ).

U

  N I T R O U N D I N G F O R A R B I T R A R Y C Y C L O T O M I C F I E L D S

  Theorem . . . Let χ be an even Dirichlet character of conductor c | f with c > 1 and e ∈ X. Then if c and e are coprime, then

..

  In the same way, we have if p i | f e and p i c, with r -1 = f eq i mod p i :In case p i |e, we have q i |e and therefore /cZ) × /{-1,1} χ(α) log(|ζ α c -1|).

  the standard computation([ , Theorem . ]) of the term on the right with the Gauss sum:τ = ∑ α∈(Z/cZ) × χ(α)ζ α c :De nition . . . The augmentation ideal is the kernel of the form:(∑ α x α σ α → ∑ α x α ) over Z[G].

  The running time is quasi-linear since we can work at each step with the ring E R A L I Z AT I O N O F T H E S Y M P L E C T I C D E S C E N T.

  Zolotare en dimensions quatre et cinq [ ], Blichfeldt en dimensions six à huit [ ], et en n Cohn et Kumar en dimension vingt-quatre [ ]. Les techniques développées pour prouver ces premiers résultats sont des prototypes d'algorithmes que l'on nomme aujourd'hui « réduction de réseaux». Formalisation de la notion de réseau. Nous avons vu au travers des exemples d'empilements de sphères qu'un réseau est une structure géométrique vivant dans l'espace Euclidien R n , et formant une grille régulière. Par grille nous entendons que les vecteurs du réseau pavent régulièrement l'espace. A n d'obtenir une représentation visuelle, reprenons le réseau des centres formé par l'empilement hexagonal et l'empilement carré, dans le plan R 2 :

	.	Réseaux Euclidiens
	. . .

  accompagné d'une réduction quantique á un problème classique de réseaux, la recherche des vecteurs indépendants les plus courts. Dès lors, la cryptographie basée sur les réseaux a connu un vif essor et s'est imposée comme un des concurrents les plus sérieux pour l'avènement d'une cryptographie dite «post-quantique».Il s'avère en e et que l'on ne parvient pas, à l'heure actuelle, à obtenir d'algorithme quantique e cace pour résoudre les problèmes di ciles sur les réseaux Euclidiens, alors que plusieurs des piliers de la cryptographie asymétrique, notamment le problème de la factorisation d'entiers et du logarithme discret dans les corps nis, s'e ondreraient si nous disposions e ectivement d'un calculateur quantique de grande envergure.Outre cet avantage de sécurité que confèrent les réseaux, ils ont aussi permis le développement de primitives cryptographiques riches, telles que le chi rement homomorphe [ ].Ainsi, les réseaux Euclidiens constituent un socle particulièrement attractif pour le développement cryptographique, tant par les possibilités ouvertes que par la sécurité o erte. Sécurité et réduction. A n d'évaluer la sécurité des primitives cryptographiques fondées sur les réseaux, il est souvent nécessaire d'utiliser des algorithmes de réduction de réseaux. En e et, la découverte d'un élément court dans un réseau utilisé pour construire un schéma cryptographique permet généralement de reconstruire la clef secrète.A n d'accélérer les cryptosystèmes sur les réseaux, il a été proposé, par exemple dans [ ], [ ], [ ], de ne pas utiliser des réseaux arbitraires, mais plutôt des idéaux et plus généralement des réseaux sur des anneaux d'entiers de corps de nombres. En e et la structure algébrique de ces réseaux permet de calculer plus rapidement tout en minimisant la taille des objets cryptographiques manipulés .

	Ajtai ) [ ] d'autre . Toutes deux se basent sur les réseaux Euclidiens. Par la suite, d'une part et par Ho stein, Pipher et Silverman (NTRU part, en Regev introduit en le problème de l'apprentissage avec erreur ( en Cryptanalyse de primitives par réduction de réseau anglais, pour learning with errors), . . . .

  then su ces to construct a second vector allowing to complete the rst one to form a new basis of P to pursue the reduction. It has solutions if and only if the integers a and b are coprime. The search for solutions is classically done in polynomial time by the so-called extended Euclidean algorithm. The generalized version of this equation on number elds has the same shape but with this time a, b ∈ O K h being algebraic integers. As in the whole generality the ring O K is not Euclidean, the extended euclidean algorithm based on subversive Euclidean divisions, can not work directly. However if the towerQ ⊂ K 1 ⊂ • • • ⊂ K h isnot trivial, we can use the structure of this tower to descend the problem on the sub eld K h-1 ,by computing the relative norm N K h /K h-1 of elements a and b. Then, by recursively calling the resolution algorithm on

	This completion is done by solving a Bezout-equation with coe cients in
	O K .
	. . . Extended Euclidean algorithm in number elds. A Bezout equation is
	an equation of the shape:
	au + bv = 1,
	with unknown u and v in Z.

  ideal spanned by a in O K for any element a. : that is for any integer x ∈ O K , xa ⊆ a. An ideal is prime if the following condition is satis ed: for all a, b ∈ O K , ab ∈ a implies that a ∈ a or b ∈ a. Its norm is de ned as the cardinal of the quotient O K a . It is a multiplicative form giving a measurement of the size of the ideal: the closest a is from O K , the smaller is its norm. Think of the double factorization 4

	Recall that an ideal a is a subgroup for the additive law and stable under the multiplication
	by O K

  and b i ∈ b, i ∈ {1, . . . , m}; ∀m ∈ N}, i.e., the product is the fractional ideal generated by all products ab with a ∈ a and b ∈ b. Clearly, R is the neutral element of this multiplication, giving the set of fractional ideals a monoid structure.De nition . . (Prime ideal).Let R be a ring. An prime ideal p ⊆ R is an ideal such that R p is an integral domain, that is, for all x, y ∈ R, xy ∈ p implies x ∈ p or y ∈ p. Lemma . . . Let p be a prime ideal in a ring R. Then for a, b ⊆ R ideals, ab ⊆ p implies a ⊆ p or b ⊆ p.Proof. If it was not the case, then there would be some a ∈ a \ p and b ∈ b \ p. Then ab ∈ ab ⊆ p. But then a ∈ p or b ∈ p. Contradiction.

	. . . . Prime ideals.
	. . . . Dedekind domains. We now specialize these notions in the context
	of Dedekind domains.

  An n-by-d matrix A with integer entries has a (column) Hermite normal form H if there is a square unimodular matrix U where H = AU and H satis es:

	. .	Normal form of a lattice
	De nition . . .

  Let f be a non negative integer so that φ( f ) < 16 and f ∈ {16, 24}.Then O Q(ζ f ) ∼ = Z[ζ f ] is norm-Euclidean.

	• Q(	√	-19) is principal and not Euclidean.
	• Q(	√	69) is Euclidean and not norm-Euclidean
	Lenstra proved that small cyclotomics are norm-Euclidean:
	Theorem . . (Lenstra [ ]). . . Unimodularity of Euclidean rings
	Lemma . . . Let L be a number eld whose ring of integers O L is norm-
	Euclidean, then:

Table . :

 . Notations used in the complexity analysis. p is of course set to be larger to the bitsize of the input matrix.

	h	Height of the tower
	n h	Absolute height [K h : Q]
	p	bound on the precision used by the reduction
	ε	/
	i	Current outmost loop number (1 ≤ i ≤ ρ) iteration
	α	Constant to be optimized

Table . :

 . Lattice reduction with root factor α in dimension d over Z gives an element of Λ of norm around α d/2 covol(Λ) 1/d . After k steps in the Euclidean algorithm with norm factor β, the norm of the elements is roughly divided by β k . Both are for random inputs.

	Dimension Root factor Norm factor
	.	.
	.	.
	.
	.
	.
	Remark (A heuristic optimization of bitsize of the lattice).

Table . :

 . Implementation results

	Dimension	e	Running time	Processor
			minutes	Intel i -	( cores)
			hours	Intel i -	( cores)
			hours	Intel E -	( cores)

  Input : An arbitrary ideal a and constants B, A, and k as in the proof of Theorem . . . Output : An integer v and an L ∆ [1]-smooth ideal b such thatvO L + = ab // Precomputation of B, independant of a B = ∅ P ≤B ← sieve primes below B for p ∈ P ≤B do Factor pO L + in ∏ i p e i i P p = {p i } p i | (p) B ← B ∪ P p end for // Bootstraping phase of a b ← a while b is not L ∆ [1]-smooth doChoose p j 1 , . . . , p j k uniformly at random in B P e ← a • ∏ p e i j i for random e i ∈ {0, . . . , A} ã ← a • P e // Computed using Z-bases v ← shortest vector of DBKZ((a, • L + ) * ) // See Chapter 3 for the definition of the direct image

	b

Table . :

 . Estimation of the absolute norms of secret keys for the security parameters of [ ] (experimental averages over keys per set).

				Bitsize of N L/Q ( f )
		n	(δ 1 , δ 2 )	theoretical exp. avg.
		256 (0.55, 0.15)	1178	954
	I	512	(0.3, 0)	2115	1647
	II 512	(0.3, 0)	2115	1647
	III 512 (0.42, 0.03)	2332	1866
	IV 512 (0.45, 0.06)	2422	1957

Table . :

 . Estimation of the proportion weak secret keys, namely those for which at least one of s 1 or s 2 has B-semi-smooth norm, for the security parameters of [ ] and several choices of B. Estimates obtained by sampling secret keys per parameter set and testing their norm for semismoothness by trial division.

		n	B = 2 B = 5 = 65537 B = 655373 B = 6553733
		256	4%	6%	7.6%	12%	13%
	I/II	512	2%	3%	4%	5.6%	7.4%
	III/IV 512 1.5%	2%	3.5%	4%	5%

Table . :

 . Average running time of the attack for various eld sizes n. The parameters correspond to n = 256 and n = 512.

		Field size n
		CPU time	. s	s	min.	h min.	Day
	. .	Howgrave-Graham-Szydlo Algorithm in Power-of-Two Cyclo-
		tomic Fields

  Input : Test vectors (w i ) i and their corresponding measures (y i ) i , initial guess s 0Output : A candidate solution s 0 t ← 0 do s t+1 ← s t -µ t m s 0 2 ∑ m r=1 (| w r , s t | 2y r )(w r w t r )s t t ← t + 1 while s ts t+1 > return RoundingS Algorithm -Full timing a ack Collect m traces (z i , c i , t i ) for i = 0 to m do y i ← (argmax x L i (t i )(x)) 2 end for s 0 ← Spectral Initializer((z i c * i ) i , (y i ) i ) S ← Wirtinger flow Descent((z i c * i ) i , (y i ) i , s 0 ) return S . .Reducing the number of samples by error localization and dimension reduction

Table . :

 . Experimental number of samples required to perform a full key recovery. The average CPU time for a full key recovery is h on a Intel Xeon Ev workstation.

  vector of the ball of radius α -1 4 3 in Λ ∨ . By de nition of the Gram-Schmidt orthogonalization we havev = z 1 • d * 1 + z 2 • d * 2 + z 3 • d * 3 where z 1 = x 1 , z 2 = x 2 +

	d 1 ,d * 2 d * 2 2 x 1 and z 3 = x 3 + 4 3α 2 , so that	d 2 ,d * 3 d * 2 x 2 . By orthogonality: z 2 1 d * 1 3 x 2 1 1 α 4 = z 2 1 d * 1 2 ≤ 4 3α 2 ,	2 +z 2 2 d * 2	2 +z 2 3 d * 3	2 ≤
	meaning that -4 3 ≤ x 1 ≤ 4 3 and so that x 1 ∈ {-1, 0, 1}.
	Case x 1 = 0: We have z 2 2 d * 2	2 +z 2 3 d * 3	2 ≤ 4 3α 2 and as such
		x 2 2 = z 2 2 r * 2	2 ≤	4 3α 2

Si les empilements les plus denses connus sont e ectivement des empilements de réseaux, la généralisation de ce phénomène ne semble pourtant pas aller de soi : cela constitue un problème actuellement ouvert.

u • u,v u,u u v v λ v λEn e et, si nous reprenons le cas exposé précédemment avec les deux vecteurs u et v, nous ne pouvons plus chercher une combinaison linéaire arbitraire de u et v mais seulement des combinaisons à coe cients entiers. Ainsi il n'est plus possible de rendre v λ et u orthogonaux, mais nous pouvons tâcher de minimiser le défaut d'orthogonalité, c'est-à-dire de trouver la valeur entière de λ minimisant la fonction λ → v λ , u , c'est-à-dire l'entier le plus proche du réel λ = u, v / u, u . De la même manière que le procédé de Gram-Schmidt permet d'orthogonaliser des vecteurs, nous pouvons réduire itérativement une famille (v 1 , . . . , v n ) de vecteurs d'un réseau en discrétisant les opérations à chaque étape. Au lieu de chercher à rendre orthogonal un vecteur par rapport à chacun des précédents, nous nous e orçons à réduire au maximum le défaut d'orthogonalité. Il s'avère que faire diminuer ce défaut permet aussi de diminuer la

Pour des raisons de compatibilité que nous éclaircirons au Chapitre , nous verrons qu'il est trop restrictif de ne considérer que des modules libres, mais qu'assouplir légèrement cette condition en projectivité su t.

Ensuite, nous proposerons une attaque sur le chi rement homomorphe de Smart et Vercauteren [ ]. Sa clef secrète est constituée d'un petit élément d'un corps cyclotomique, et la clef publique correspondante est une Z-base de l'idéal principal engendré par cette clef secrète. Ainsi, on peut attaquer à l'aide de l'algorithme de résolution du problème de l'idéal principal, comme présenté dans le Chapitre . Il est à noter que retrouver le générateur n'est pas su sant, nous souhaitons en e et trouver un générateur court. Pour se faire nous utiliserons la réduction de [ ] qui permet de transformer un générateur arbitraire en un plus court, et ce en temps polynomial. En n nous détaillerons une attaque par canal auxiliaire sur la fonction de signature [ ]. Une attaque par canal auxiliaire est une attaque qui recherche et exploite des failles dans l'implémentation, logicielle ou matérielle, d'un schéma cryptographique ou d'un protocole. Une telle attaque ne remet Par exemple, un réseau provenant d'un idéal peut être représenté de manière compacte par deux polynômes, au lieu d'une matrice.

For all known values, the densest sphere packings are indeed lattice packings, but there is no proof that this is the case in arbitrary dimension.

The reader who is already familiar with lattice reduction shall remark that the exchange condition with covolumes is exactly the so-called Lovàsz condition on the norm of projected vectors.

For compatibility reasons which we elucidate in Chapter , we will see that it is too restrictive to only consider free modules, but that relaxing this condition in projectivity is su cient.

It is possible to de ne formally a notion of random lattice, by renormalizing the Haar measure on the moduli space of lattices Indeed, it su ces to replace the absolute value over Q by the algebraic norm of the ring.

Among the known Euclidean ring, let us mention the quadratic imaginary Q[i √ d] for d = 1, 2, 3, 7, 11 and the cyclotomic rings of conductor m such that φ(m) < 16 with m ∈ {16, 24}. Recall that any number eld contains Q so that we are sure to descend to at least Z at the end of the recursion

That is, encoded by the evolution equation ∂u ∂t = α ∂ 2 u ∂x 2 .

In practice, for lattices of rank few hundreds it appears nonetheless that the computational cost of the previous iterations lies between 20% and 40% of the total cost.

n , in the result of Theorem . . .

bits. Therefore we present an algorithm that is "sort of" L 1

Interestingly, our initializer outperforms the state-of-the-art techniques for a wide range of statistical datasets. A precise theoretical analysis of this algorithm would be interesting for its own sake and is a future research topic we desire to tackle.

We then de ne the j-th element of the basis as being the element of L which, when we evaluate on (Xr i,k , Yr i ), we obtain if j = k and else. This is clearly an orthogonal basis for the canonical norm, and in this case, it is also its dual. Hence, using twice this basis leads again to the Darboux matrix for J L = tr L/K (J L ). Exactly the same construction works for totally imaginary K (and therefore L).

The general case can be done in the same way, by taking care of rami ed places.

the computation is dominated by its nal iteration. In particular, we may use the complexity bound given by Theorem . . . Note that when we increase the accuracy in Algorithm , we also reset the precision to its minimal value. This is a matter of preference that doesn't a ect the asymptotic complexity. In practice, it seems to be preferable.

It is important to note that we do need to precompute the eigenvalues of the Gram matrix, since Algorithm automatically detects the needed accuracy.

Algorithm -

Parameter : δ ∈ (1/4, 1), η ∈ (1/2, √ δ), 0 ∈ N initial precision of the algorithm for oating-point representation, n 0 initial accuracy for representing the scalar product, g > 1 geometric growth factor.

Input

: γ a basis of a lattice (Γ, •, • ), and O γ (n) an oracle that compute the integral representation of the inner product •, • at accuracy n.

Input

: A generating family represented by L in γ of a sublattice Λ ⊂ Γ. Output : A (δ, η) -reduced basis of Λ represented as L ∈ Z rk(Λ)×rk (Λ) .

// Set initial values for accuracy and precision // T(d, δ, η) is the theoretical bound given after Theorem 4.5.1

representing a reduced basis of M.

This can in principle be done by computing the rejection probability every time with su cient precision and by comparing it to uniformly sampled randomness in a suitable interval, but such an approach is quite costly, especially on constrained devices, as it relies on the evaluation of transcendental functions to arbitrary precision. Therefore, relies on an alternate approach, which is described in [ , § ] and can be implemented based on sampling Bernoulli distributions B c i for a few precomputed constants c i .

The idea is as follows. To sample from B exp(-x/ f ) , one can consider the binary expansion ∑ x i • 2 i of x, and let c i = exp(-2 i / f ). Then one has exp(-x/ f ) = ∏ x i =1 c i . As a result, sampling from B exp(-x/ f ) can be done by sampling from each of the B c i ; if all the resulting samples are 1, return 1, and 0 otherwise. This can even be done in a lazy manner, as described in algorithm SampleBernExp in Algorithm .

Algorithm -Samplers

Function SampleBernExp:

.

In addition, one can show that sampling from B 1/ cosh(x/ f ) can be done by repeated sampling from B exp(-x/ f ) and B 1/2 , as described in algorithm SampleBernCosh in Algorithm (the correctness of that method is proved as [ , Lemma . ]). The algorithm has an a priori unbounded number of iterations, but the expected number of calls to B exp(-x/ f ) is less than 3.

Concretely, the rejection sampling is thus implemented as follows. The denominator f in SampleBernExp and SampleBernCosh is set to 2σ 2 , and the scaling factor M for the rejection sampling is taken of the form exp(K/ f ) for some integer K. Then, step of Sign in Algorithm actually consists of the instructions described in Algorithm .

. . Exploiting the norm leakage

Let us suppose we can have access by single power analysis ( ) to the bits of Sc 2 in the nal computation of the rejection sampling. Recalling that Sc = (s 1 c, s 2 c) T , we have Sc 2 = s 1 c, s 1 c + s 2 c, s 2 c and thus this norm can be seen as

for c being the vector encoding of the polynomial c, and S 1 (resp. S 2 ) being the skew-circulant matrix encoding the polynomial s 1 (resp. s 2 ). Let X be the matrix Σ T • Σ. Then, recovering the value Sc 2 yields an equation of the shape:

This equation can be viewed as a row of a linear system whose unknowns are the coe cients of the secret-dependent matrix X. Remark that X is a block matrix of shape Diag X (1) , X (2) where X (i) are circulant matrices of rst line

as product of two conjugate skew-circulant matrices. Thus, only 2 × m/2 = m distinct unknowns are actually present in X. As a consequence, we only need m linearly independent equations to fully recover the matrix X. Once recovered, we therefore get access to the submatrices S T 1 • S 1 and S T 2 • S 2 . By de nition, these matrices corresponds to the encoding of the polynomial s 1 • s 1 and s 2 • s 2 , that is the relative norm of the secrets s 1 and s 2 in the maximal real sub eld. This is an instance of so-called relative norm equation. In an arbitrary number eld, the problem of recovering an element from its norm over a sub eld is a hard problem of number theory and its complete solution requires an oracle to the , yielding subexponentials algorithms [ ]. However in the cyclotomic elds we are considering, we can avoid the use SPA involves visual examination of graphs of the current used by a device over time to notice the spikes of consumption, on a digital oscilloscope for instance.

Part IV

This rst appendix provides the proof of the technical lemmas related to the properties of covolumes and degrees.

.

Proof. Let Λ, Λ two lattices of rank respectively d, d . Recall that the exterior algebra Λ over a Z-module Λ is de ned as the quotient algebra of the tensor algebra T(Λ) by the two-sided ideal I generated by all elements of the form v ⊗ v for v ∈ Λ (i.e. all tensors that can be expressed as the tensor product of any vector in Λ by itself). The k exterior power of Λ, denoted k Λ, is the vector subspace of Λ spanned by elements of the form

Canonically, the ith exterior product can be endowed with a Euclidean norm, de ned as

. Remark that:

so that we can reduce to prove the announced relation for lattices of rank . Suppose then that dd = 1. By de nition of the metric on the tensor product for any vectors

Taking the logarithm then conclude since Λ × Λ is of rank .

. We have by [ ], A.III § . :

It then su ces to use the point ( ) we just proved.

. Lemma . . . . . Let Λ a lattice and Λ a sublattice of Λ, then:

To complete this proof we rst need a technical lemma, which is a consequence of the compatibility of the degree with tensor products.

Corollary . . . Let Λ a lattice and Λ a sublattice of Λ. The degree is additive over the short exact sequence:

that is:

By the result ( ) of Lemma . . it su ces to prove that the sequence splits, that is:

Proof. Proof of Lemma . . Let Λ a lattice and

. We denote by Λ 3 the Euclidean lattice spanned by b 1 , b 2 , b 3 . The aim of this appendix is to prove that this lattice has only two -reduced bases :

We start by enumerating the short vectors of Λ 3 and its dual.

.

and we have:

Hence z 2 1 ≤ 13 9 and all in all, x 1 ∈ {-1, 0, 1}.

Case

3 and as such

and so x 2 ∈ {-1, 0, 1}.

3 and as such

and so x 3 ∈ {-1, 0, 1}, leading to v ∈ {0, ±b 3 }.

Case x 2 2 = 1: In this case we have:

leading to:

-2 < -

Case x 2 1 = 1: Without loss of generality (since the lattice is invariant by sign change) we can suppose that

9 and as such

and so: -1 < x 2 < 1. Therefore x 2 = 0. We have z 2 3 r * 3 2 ≤ 12α 2 14 and as such . .

Short vectors of Λ

so that we have:

These variations assert that f -1 2 has a unique real zero c 3 in the interval [1,

Case α ≤ c 3 : Then f (α) ≤ 1/2, showing that the basis is indeed Gauss reduced since then b 1 , r * 2 / r * 2 , r * 2 < 1/2.

Case α ≥ c 3 : Then by monotonicity 8/13 = f (

Proof. b 3 is the shortest vector of the lattice Λ 3 by Corollary . . and π (b 3 ) ⊥ (b 2 ) is the shortest vector of π (b 3 ) ⊥ (Λ 3 ) as being the rst vector of a Gaussreduced basis, by Claim .

Corollary . . . The basis SR(R 3 ) is the only -basis of Λ 3 of rst vector b 3 .

Proof. A simple computation ensures that π

Hence the Gram matrix of the projected basis [x, y] is:

.

Once again we introduce the function f : a → α 2 -1 α 2 +1/a 2 -1 . This function admits 4α 3 -2α

(1-α 2 +α 4 ) 2 for derivative so that f is increasing between and +∞. Since f (1) = 0 and lim ∞ f (x) = 1, we can ensure that for any

The reasoning is then exactly the same as in Claim .

Corollary . . . There exists no -basis of Λ 3 of rst vector b 2 .

Proof.

] is Gauss-reduced. But this projected lattice is non critical by Claim and as such we have:

). Thus, by size-reduceness: x = b 3 , y = b 1 . But remark now that b 2 > b 3 , which contradicts the Lovász condition for these two vectors. Therefore there can not be a reduced basis starting with b 2 .

A reduced basis of Λ 3 has its rst vector contained in a ball of radius

In this appendix, we give details on the precision required the algorithms of Chapter . We rst indicate the loss of precision of elementary operations, then look at the precision and complexity of the QR decomposition, and nally the size-reduction procedure. The penultimate part indicates how to use fast matrix multiplication to reach the same goal. We recall that w is the number of bits in the words. Eventually we adapt the proof of the reduction algorithm for cyclotomic elds to the symplectic context.

In this section, we give details on the precision required in our algorithms. We rst indicate the loss of precision of elementary operations, then look at the precision and complexity of the QR decomposition, and nally the sizereduction procedure. The last part indicates how to use fast matrix multiplication to reach the same goal. We recall that w is the number of bits in the words. .

. . Fast computation of primitive roots of unity

The fast Fourier transform algorithm needs a precise approximation of the primitive roots of unity to be performed in xed-point arithmetic. In order to compute with high precision a primitive f -th root of unity, one can use Newton's method where we start with 1 + 6.3i/ f . The following lemma ensures that the convergence, in this case, is at least quadratic.

Proof. Without loss of generality, by dividing everything by ζ, we can assume ζ = 1. We then have the following equality:

Applying the triangular inequality gives:

We can conclude by noticing that (1

For f ≥ 128, it is now easy to show that the sequence converges towards exp(2iπ/ f ); the nite number of remaining cases are easily done by direct computations.

. . A bound on the loss when iterating unitary matrices

We now show the following elementary lemma on the iterations of matrixvector computations, which states that the error made when computing chained matrix-vector multiplications can be controlled.

Lemma . . . Let A i be a family of k unitary matrices. Suppose that for each of these matrices A i there exists an algorithm A i that given some vector x, outputs A i x within a certain vector of errors e such that e ≤ x with ≤ 1 2k . Then, the algorithm which computes (∏ i A i )x by composing the algorithms A i returns (∏ i A i )x within an error vector e such that e ≤ 2k x .

Proof. Let B = ∏ k i=2 A i and Bx + e the error committed using the algorithms A i . The algorithm A 1 outputs A 1 (Bx + e ) + e, so that the error committed towards A 1 Bx is

We now prove by induction that this error is less than (1 + ) k -1 x with:

The case k = 1 is immediate and (1 + ) k -1 < 2k for < 1 2k nishes the proof.

. . Analysis of the Discrete Fourier transform

We now show how to e ciently compute a close approximation of a Fourier transform. Indeed, the fast Fourier transform on 2 n points correspond to a product of n unitary matrices, so that we can get p bits of precision using a precision in O(p + log n) by Lemma . . . Using this, we obtain an algorithm to multiply integers with B bits with complexity O(B/w • log(B/w)) = O(B). Bluestein's algorithm [ ] for Chirp-Z transform reduces discrete Fourier transform in any size to the computation of fast Fourier transform over power-of-two so that the same holds. Recall that Inverse Fourier transform can also be computed from a discrete Fourier transform.

All in all, we can evaluate the corresponding Fourier isomorphism and its inverse:

Combining these results, we get:

Theorem . . . Given a matrix A, we can compute the R-factor of its QR decomposition in time

if this is smaller than a constant.

We can, of course, decrease the 3 in the exponent to a few matrix multiplications using aggregated Householder transformations and a divide-andconquer algorithm, see [ , Subsection . ]. This is also at the end of the appendix.

. We rst consider the size-reduction for unitriangular matrices (i.e. upper triangular matrices with ones on the diagonal). Such a matrix A is said to be size-reduced if both A and A -1 are small. Lemma . . . Let A be a unitriangular matrix of dimension d with coecients in K = Q[ζ f ], such that its coe cients in the power basis are bounded in absolute value by 1. Then A ≤ dn 3/2 and A -1 = (2n) O(d) with n = ϕ( f ).

Proof. It is clear that A i,j ≤ n f ≤ n 3/2 so that A ≤ dn 3/2 . Now let x be a column of A -1 . Consider a i which maximizes x i (2n 3/2 ) i . Then we have

and we obtain x i ≤ 3 which gives x ≤ 3(2n 3/2 ) d-1 √ d.

We can nally prove our size-reduction theorem:

and n = ϕ( f ). We are given p, where A , A -1 ≤ 2 p and also n log n log log n + d log n < p. In time O d 3 np/w + d 2 pn log d , we can nd an integral triangular matrix U with U i,i ∈ O × K and a matrix R + E such that E ≤ 2 -p , with R the R-factor of the QR decomposition of AU and

We also have U ∈ 2 O(p) Proof. In the canonical basis of K repeated d times, A corresponds to a d × d block matrix, where each block is a diagonal complex matrix of size n/2 × n/2, so that the QR decomposition can be obtained from n/2 complex QR decompositions of dimension d. We can transform into (and from) this basis at a cost of O d 2 pn ; and the same technique can be used with the sizereduction algorithm.

The algorithm computes R , the R-factor of the QR decomposition of A. Then we use Algorithm on R which returns a U, and the algorithm returns U and R U.

We have that

As a result, we can use a precision of O(p) bits.

Let D be the diagonal of R. We have κ(AU) = κ(R) ≤ κ(D)κ(D -1 R). The reduction with units guarantees that

The previous lemma gives κ(D -1 R) = 2 O(d log n) .

. . On the reduction of well-conditioned matrices

We nish this section with properties of lattices represented by a well-conditioned matrix. The following easy theorem indicates that if we want to reduce the lattice generated by A, we can always truncate the matrix and work with precision only O(log(κ(A))). The transition matrix which will be computed by the algorithm also needs at most this precision. Up to an irrelevant (small) quantity, this is of course a O log max i N K/Q (R i,i )

Final Version as of November , Ṫhomas Espitau.