Les remerciements constituent une partie facile et en même temps difficile à écrire. Facile car elle est exclue des corrections mais en même temps un exercice difficile pour les matheux qui n'aiment pas beaucoup parler ni exprimé leur propres sentiments (même si les femmes ne sont pas vraiment reconnues pour cela!). J'ai toujours considéré la recherche non pas comme un travail mais plutôt comme une passion. Le défi et la curiosité sont les deux mots qui résument mon histoire avec les maths. Ces trois années ont été pour moi une expérience très enrichissante. J'aimerai commencer par remercier celui qui m'a lancé dans cette fabuleuse aventure, celui avec lequel j'ai pris un très grand plaisir à travailler: mon directeur de thèse Christian Klein que je ne saurai jamais assez remercier pour tout ce qu'il m'a apporté. Je le remercie énormément pour ses précieuses remarques, la qualité de nos discussions mathématiques mais aussi pour sa gentillesse et son écoute. Je tiens également à remercier Peter Schauenburg pour son aide, sa gentillesse et aussi pour sa disponibilité malgré un planning chargé. J'ai eu également la chance et le plaisir de rencontrer Jörg Frauendiener, que je remercie pour son attention, son suivi tout au long de ces trois ans, à distance mais également en n'hesitant pas à venir depuis la Nouvelle Zélande. Je remercie également Damien Stehlé pour les conseils prodigués et les discussions que nous avons pu avoir. Il me faut également remercier Harry Braden et Dmitri Korotkin pour avoir accepter d'être mes rapporteurs. Merci encore à Simonetta Abenda d'avoir accepter de faire partie du jury et à Jean-Marc Couveignes d'être le président de ce jury. Faire une thèse, c'est également faire des rencontres! Je salue et remercie tous les thésards que j'ai pu rencontrer et je leur souhaite une bonne chance pour leur thèses. Je remercie également les membres du laboratoire. Ce travail n'aurait pu s'effectuer sans la bourse de la société libanaise L'orient SAL que je ne remercierai jamais assez de m'avoir offrir l'opportunité poursuivre mes études en réalisant cette thèse. Enfin un grand merci à ma famille: ma soeur Léa, mes deux frères et tout particulièrement mes parents qui ont toujours été à mes côtés et fières de leur fille. Je remercie énormément mon amour (mon mari Jamal) et ma princesse (Ella) dont j'étais enceinte durant ma première année de thèse. Ils m'ont apporté tant de bonheur me permettant d'oublier tout mon stress. Merci à vous tous!!

List of Figures

Abstract

The action of the symplectic group Sp(2g, R) on Siegel upper half space is a generalization of the action of the group SL(2, R) = Sp(2, R) on the usual complex upper half plane to higher dimensions. A study of the latter action was done by Siegel in 1943 and led to the well known elliptic fundamental domain. This action for dimension 2, goes back to Gottschling's work in 1959 where 19 conditions were identified to construct this fundamental domain for g = 2. However, for g > 2, no results appear to be known until now.

The construction of a fundamental domain for the symplectic group is essentially based on the Minkowski reduction theory of positive definite quadratic forms, i.e., a collection of shortest lattice vectors which can be extended to a basis for the lattice and on the maximal height condition (det(CΩ + D) ≥ 1), i.e., find the symplectic element in order to maximize the length of the shortest vector of the lattice generated by the imaginary part of the Riemann matrix.

In this work, we present our Minkowski reduction algorithm for dimension g ≤ 5. Also, we present a part of the finitely many conditions that determine Siegel's fundamental domain for genus 3, especially rank C = 1 (the necessity of the conditions is not yet shown).

A motivation for this study is to obtain a rapid convergence of theta functions.

The approach adopted here is based on a previous algorithm by Deconinck et al using the Lenstra, Lenstra and Lovász algorithm for finding the shortest lattice vector. In this work, the LLL algorithm is replaced by our exact Minkowski reduction algorithm for small dimensions (g ≤ 5) and an exact identification of the shortest vector problem for larger values of the genus for two simple reasons: first, the LLL algorithm only provides vectors that are no more than exponentially longer than the shortest ones whereas the Minkowski reduction algorithm finds an exact determination of the shortest lattice vector. Secondly, in the LLL algorithm, there is no reason for the shortest lattice vector to appear at the first position of a matrix whereas it is the first with the Minkowski reduction (an important condition in Siegel's fundamental domain). The utility and effectiveness of this replacement are justified by examples.

Résumé

L'action du groupe symplectique Sp(2n, R) sur le demi-espace de Siegel n'est qu'une généralisation de l'action du groupe SL(2, R) = Sp(2, R) sur le demiplan de Siegel, à une dimension supérieure. Une étude de cette dernière action a été effectuée par Siegel en 1943 et a conduit au domaine fondamental elliptique bien connu. Cette action pour la dimension 2, remonte au travail de Gottschling en 1959 où 19 conditions ont été identifiés pour construire ce domaine fondamental pour g = 2. Cependant, pour g > 2, aucun résultat ne semble être connu jusqu'à présent. La construction d'un domaine fondamental pour le groupe symplectique repose essentiellement sur la théorie de la réduction de Minkowski des formes quadratiques définitives positives, c'est-à-dire une collection de vecteurs les plus courts d'un réseau qui peut être étendue à une base à ce réseau et sur la condition de hauteur maximale (det(CΩ + D) ≥ 1), c'est-à-dire, trouver l'élément symplectique afin de maximiser la longueur du vecteur le plus court d'un réseau engendrée par la partie imaginaire de la matrice de Riemann. Dans ce travail, nous présentons notre algorithme de réduction de Minkowski pour une dimension g ≤ 5. De plus, nous présentons une partie des conditions finies qui déterminent le domaine fondamental pour le genre 3, notamment pour rang C = 1 (la nécessité des conditions n'est pas encore connue). Une motivation de cette étude est d'obtenir une convergence rapide des fonctions thêta. L'approche adoptée ici est basée sur un algorithme précédent de Deconinck et al utilisant l'algorithme Lenstra, Lenstra et Lovász pour trouver le vecteur le plus court d'un réseau. Dans ce travail, l'algorithme LLL est remplacé par notre algorithme de réduction de Minkowski pour une petite dimension (g ≤ 5) et une identification exacte du problème de vecteur le plus court pour des dimensions supérieures pour deux simple raisons: D'abord, l'algorithme LLL ne fournit que des vecteurs qui ne sont pas plus qu' exponentiellement plus longs que les vecteurs les plus courts d'un réseau tandis que l'algorithme de réduction de Minkowski trouve une détermination exacte du vecteur le plus court. Deuxièmement, dans l'algorithme LLL, il n'y a aucune raison pour que le vecteur le plus court apparaisse à la première position d'une matrice alors qu'il est le premier avec la réduction de Minkowski (une condition importante dans le domaine fondamental de Siegel). L'utilité et l'efficacité de ce remplacement sont justifiés par des exemples.

Chapter 1 Introduction

The Symplectic group Sp(2g, R) is a generalization of the group SL(2, R) = Sp(2, R) to higher dimensions. This group acts on a symmetric homogeneous space, called Siegel upper half space. This action has a few similarities with the action of SL(2, R) on the hyperbolic plane for genus g = 1. A study of this action was firstly done by Carl Ludwig Siegel in 1943 and published in his book Symplectic Geometry [START_REF] Siegel | Symplectic Geometry[END_REF]. Siegel described a fundamental domain for that action, using Minkowski's reduction of positive definite quadratic forms. It is clear that Siegel's fundamental domain is intimately linked to lattices where the central computational problem on lattices is the shortest vector problem for dimensions greater than 2. The shortest vector problem appears in the context of Siegel's fundamental domain and for this the main part of our work was dedicated to an exact determination of the shortest lattice vector for low-dimensional lattices, more precisely constructing a Minkowski reduced basis for dimensions ≤ 5. As an application, Siegel's fundamental domain can be used as an efficient method for the computation of theta series.

Lattices and lattice reductions

Lattice reduction plays an important role in many areas of mathematics and computer science (see [START_REF] Cassels | An introduction to the geometry of numbers[END_REF], [START_REF] Nguyen | The LLL Algorithm: Survey and Applications[END_REF], [START_REF] Knuth | The Art of Computer Programming, Reading[END_REF], [START_REF] Grötschel | Geometric Algotithms and combinatorial Optimization[END_REF], [START_REF] Lovász | An Algorithmic Theory of Numbers, Graphs and Convexity[END_REF], [START_REF] Kannan | Algorithmic geometry of numbers[END_REF], [START_REF] Vallée | La réduction des réseaux: autour de l'algorithme de Lenstra[END_REF], [START_REF] Joux | Lattice reduction: A toolbox for the cryptanalyst[END_REF], [START_REF] Micciancio | Complexity of Lattice Problems: A cryptographic Perspective[END_REF], [START_REF] Nguyen | Lattice Reduction in cryptology: An Update[END_REF], [START_REF] Ling | Effective LLL reduction for lattice decoding[END_REF], [START_REF] Ling | Towards Characterizing the performance of Approximate Lattice decoding in MIMO communications[END_REF], [START_REF] Draziotis | Lattice attacks on DSA schemes based on Lagrange's algorithms[END_REF], [START_REF] Poulakis | New lattice attacks on DSA Schemes[END_REF]). Lattice reduction was used to break schemes based on the Knapsack problem 1 . The success of reduction algorithms at breaking various cryptographic schemes over the past twenty years (see [START_REF] Joux | Lattice reduction: A toolbox for the cryptanalyst[END_REF]) have arguably established lattice reduction techniques as the most popular tool in public-key cryptanalysis. Ajtai and Dwork in [START_REF] Ajtai | A public-key cryptosystem with worstcase/average-case equivalence[END_REF] designed a probabilistic public key cryptosystem whose security relies on the hardness of lattice problems. Inspired by the Ajtai-Dwork cryptosystem, Goldreich, Goldwasser and Halevi proposed in [START_REF] Coldreich | Public-key cryptosystem from lattice Reduction Problems[END_REF] a public key cryptosystem based on the closest vector problem in a lattice i.e, the location of the lattice vector closest to a given point x ∈ R n [START_REF] Hanrot | Algorithms for the shortest and closest lattice vectors problems[END_REF] (see also [START_REF] Cai | A lattice-based Public-key cryptosystem[END_REF]). In [START_REF] Coppersmith | Small solutions to polynomial equations, and low exponent RSA vulnerabilities[END_REF], Coppersmith showed by means of lattice reduction how to solve rigorously certain apparently non-linear problems related to the question of finding small roots of lowdegree polynomials equations. Lattice reduction leads to efficient solutions for several classical problems in lattice theory. For example, lattice reduction is intimately linked to the search for the shortest vector in a lattice, which is a fundamental algorithmic problem and lies at the heart of the solution of many diophantine problems in arithmetics, including integer programming, [START_REF] Lenstra | Lattices and factorization of polynomials[END_REF], finding irreducible factors of polynomials (see [START_REF] Kannan | Polynomial factorization and nonrandomness of bits of algebraic and some transcendental numbers[END_REF], [START_REF] Eisenbrand | Integer Programming And Algorithmic Geometry Of Numbers, A tutorial[END_REF]), minimal polynomials of algebraic numbers, [START_REF] Kannan | Polynomial factorization and nonrandomness of bits of algebraic and some transcendental numbers[END_REF], and many more, [START_REF] Simon | Selected Applications Of LLL In Number Theory, Chapter of The LLL algorithm, part of the series Information Security and Cryptography[END_REF], [START_REF] Agrell | Closest point search in lattices[END_REF] and [START_REF] Fincke | Improved methods for calculating vectors of short length in a lattice, including a complexity analysis[END_REF].

We will show in this first part that an exact determination of the shortest lattice vector can be obtained by lattice reduction algorithms, in particular our Minkowski reduction algorithm. Other algorithms as the LLL algorithm are faster (in polynomial time) then the Minkowski reduction but find the shortest lattice vector merely with an error growing exponentially with the lattice dimension.

Definition. A lattice in R g is the set

L(b 1 , .., b g ) = g i=1 x i b i | x i ∈ Z ,
of all integer combinations of g linearly independent vectors b 1 ,...,b g . These vectors are known as a basis B of the lattice. A lattice basis is usually not unique but all have the same number of elements called "dimension" or "rank" of the lattice. Now, in order to understand when the lattice bases that generate the same lattice hold, we recall that an integer matrix U is called "unimodular" if and only if |det(U )| = 1. Then, it follows Lemma. Let B, B ∈ R g×g be two non-singular matrices. One has L(B) = L(B ) if and only if there exists an unimodular matrix U ∈ Z g×g with B = BU .

The most fundamental problem involving lattices is to find a "nice" basis, which consists of short and almost orthogonal vectors (see Figure 1.1). The process of improving the quality of a basis by applying well chosen unimodular matrices is generally called lattice reduction. The lattice reduction techniques provide a compromise between the quality of the reduced basis and the computational effort required for finding it.

Many different notions of reduced bases exist, and for most of them there is an algorithm for computing a reduced basis from any lattice basis. These reduction algorithms are often classified into two categories according to their complexity: exponential time or the slower algorithms as Minkowski reduced bases and polynomial time where such algorithms are used more from the practical point of view as the LLL algorithm named after Lenstra, Lenstra and Lovász.

In this work, in order to better understand lattice reduction, we study low-dimensional lattices (g ≤ 5).

Gram-Schmidt orthogonalization

The achieved reductions are most often defined in terms of orthogonality. For linearly independent vectors, we define the Gram However, the Gram-Schmidt orthogonalization process is not useful in general for lattices since the coefficients µ i,j do not usually lie in Z and so the resulting vectors are not elements of the lattice (see, Figure 1.2). It follows from this definition a simple but not very powerful criterion, the so-called "size-reduction"

Size-reduction

A lattice basis is said to be size-reduced or weakly reduced if its Gram-Schmidt coefficients µ i,j 's all satisfy:

|µ i,j | ≤ 1 2 .
The size-reduction was introduced by Lagrange and seems like one of the main condition for several algorithms such as Gauss, HKZ and LLL algorithms. The size-reduction can be easily achieved by subtracting from each b i a suitable linear combination i-1 j=1 x j b j of the previous b j 's, for each i = 2, ..., g.

The Shortest vector problem (SVP)

The most basic computational problem in lattices is the shortest vector problem. The SVP asks to find a non zero lattice vector of smallest norm for a given lattice basis as input. This norm is called the first minimum, λ 1 (L) or the minimum distance and is in general unique up to the sign. An equivalent way to define the λ 1 : it is the smallest r such that the lattice points inside a ball of radius r span a space of dimension 1.

Minkowski's theorem gives a simple way to bound the length of the shortest lattice vector.

Theorem (Minkowski's theorem). λ 1 (L) ≤ √ g(det(L))

1 g for any L of dimension g. However, in general λ 1 can be much smaller than √ g(det(L))

1 g and as an example we take a lattice generated by the following orthogonal vectors b 1 = e 1 and b 2 = ( 1 )e 2 (e i are the unit vectors). The determinant of this lattice is 1 (det(L) = |det(B)|) and we obtain λ 1 (L) ≤ √ 2 via Minkowski's theorem. However, λ 1 (L) = can be arbitrarily small.

In fact, the SVP can be solved efficiently by lattice reduction for dimension 2 (Gauss's reduction). However for dimension greater than 2, the exact determination of the shortest lattice vector becomes more complicated to be obtained.

The definition of the first minimum leads to the following generalization of λ 1 known as "successive minima". The ith successive minimum, λ i (L), is the radius of the smallest closed ball centered at the origin containing at least i linearly independent lattice vectors.

Proposition. The successive minima of a lattice are always reached, there always exist independent vectors v i 's such that v i 2 = λ i (L), for all i.

However, for g > 4, such vectors do not necessarily form a basis for the lattice. This implies that the construction of a "nice" basis will not be easily obtained.

The best approach for solving the shortest vector problem for low dimensional lattices is the enumeration technique which dates back to the early 1980s with work by Pohst [START_REF] Pohst | On the computation of lattice vectors of minimal length, successive minima and reduced bases with applications[END_REF], Kannan [START_REF] Kannan | Improved algorithms for integer programming and related lattice problems[END_REF], and Fincke-Pohst [START_REF] Fincke | Improved methods for calculating vectors of short length in a lattice, including a complexity analysis[END_REF], and is still actively investigated [START_REF] Schnorr | Lattice basis reduction: Improved practical algorithms and solving subset sum problems Mathematical Programming[END_REF][START_REF] Agrell | Closest point search in lattices[END_REF][START_REF] Hanrot | Improved analysis of Kannan's shortest lattice vector algorithms[END_REF][START_REF] Pujol | Rigorous and efficient short lattice vectors enumeration[END_REF][START_REF] Schnorr | Average time fast SVP and CVP algorithms for low density lattices[END_REF][START_REF] Micciancio | A deterministic single exponential time algorithm for most lattice problems based on Voronoi cell computations[END_REF][START_REF] Stehlé | On the extremality of an 80-dimensional lattice[END_REF]. These methods are all deterministic and are guaranteed to output a non zero vector of minimum length. The time complexity is exponential in the lattice dimension, but the storage requirements are polynomial. This approach is known by the name "sphere decoding" in the communications community. Enumeration is simply an exhaustive search for the best integer combination of the basis vectors.

Another approach for solving lattice problems was suggested in 2001 by Ajtai, Kumar and Sivakumar [START_REF] Ajtai | A Sieve algorithms for the shortest lattice vector problem[END_REF] (see also [START_REF] Ajtai | Sampling short lattice vectors and the closest lattice vector problem[END_REF], [START_REF] Nguyen | Sieve algorithms for the shortest vector problem are practical[END_REF], [START_REF] Micciancio An | Faster exponential time algorithms for the shortest vector problems[END_REF], [START_REF] Pujol | Solving the shortest lattice vector problem in time 2 2.465n[END_REF]). This technique known as sieving algorithm leads to the asymptotically fastest algorithms for solving lattice problems (running in time essentially 2 O(g) ) and requires an exponential amount of space. As a result, it is so far not useful in practice.

The basic enumeration algorithm (as in [START_REF] Fincke | Improved methods for calculating vectors of short length in a lattice, including a complexity analysis[END_REF][START_REF] Schnorr | Lattice basis reduction: Improved practical algorithms and solving subset sum problems Mathematical Programming[END_REF]) allows to enumerate all vectors of euclidean norm ≤ R (see, Figure 1.3). So, we attempt to search over only lattice points that lie in a certain sphere of radius R around the vector zero, thereby reducing the search space by taking the new radius R equal to the shortest distance between the lattice points and the vector Figure 1.3: Idea behind the sphere decoder for the shortest lattice vector 0. The procedure continues until no points can be found inside the sphere and the last point obtained by this procedure is considered as the shortest lattice vector. The search can be seen as a depth-first on a tree whose leaves correspond to lattice vectors, and whose internal nodes correspond to partial assignments to the coefficients of the integer combination (see, Figure 1.4).

Figure 1.4: Enumeration tree

The Schnorr-Euchner enumeration. The Schnorr-Euchner enumeration [START_REF] Schnorr | Lattice basis reduction: Improved practical algorithms and solving subset sum problems Mathematical Programming[END_REF] performs a depth-first search to find the single leaf. The goal is to find the shortest lattice vector, say, v. The enumeration goes through the enumeration tree formed by all vectors in the projected lattices π g (L), π g-1 (L),..., π 1 (L) of norm at most R where π i is the orthogonal projection on (b 1 , ..., b i-1 ) ⊥ . For all i ∈ {1, ..., g + 1}, π i (L) is a g + 1 -i-dimensional lattice generated by the basis (π i (b i ), ..., π i (b g )). The enumeration tree is a tree of depth g, and for each k ∈ {0, ..., g}, the nodes at depth k are all the vectors of the rank-k projected lattice π g+1-k (L) with norm at most R. In particular, the root of the tree is the zero vector (because π g+1 (L) = {0}), while the leaves are all the vectors of L of norm ≤ R. The shortest lattice vector v ∈ L can be written as v = g i=1 v i b i where the v i 's are unknown integers, {b 1 , ..., b g } is the lattice basis of L such that

b i = b * i + i-1 j=1 µ ij b * j . Then v = g j=1 (v j + g i=j+1 µ ij v i )b * j which
gives the norm of its projection as:

π g+1-k (v) 2 = g j=g+1-k   v j + g i=j+1 µ ij v i   2 b * j 2 , 1 ≤ k ≤ g.
If v is a leaf of the tree, then we have

g j=g+1-k   v j + g i=j+1 µ ij v i   2 b * j 2 ≤ R 2 , 1 ≤ k ≤ g.
(1.1)

(1.1) can be written for 1 ≤ k ≤ g as

v g+1-k + g i=g+2-k µ ij v i ≤ R 2 -g j=g+2-k (v j + g i=j+1 µ ij v i ) 2 b * j 2 b * g+1-k . (1.2)
Suppose that the projection π g+2-k (v) has been computed for some k i.e., the integers v g+1-(k-1) ,..., v g are known. Then (1.2) allows to compute an interval I g+1-k such that v g+1-k ∈ I g+1-k , and therefore to perform an exhaustive search for v g+1-k . A depth first search of the tree corresponds to enumerating I g+1-k from its middle, by increasing values of π g+1-k (v) , namely v g+1-k = -g i=g+2-k µ ij v i , -n i=g+2-k µ ij v i ± 1, and so on.

Lattice reduction algorithms

The result of the multiplication of the basis B by a unimodular matrix U can be also obtained by a sequence of elementary column operations on B:

1. Swapping columns: b i ↔ b j ;

2. Multiplication of a column with -1: -b i ← b i ;

3. Addition of an integral multiple of one column to another column: b i ← b i + kb j for i = j and k ∈ Z.

Now that we know which operations to apply let us consider an example of lattice basis reduction. Suppose that we want to determine the shortest vector of the lattice generated by the following vectors u = 2.1 1 and v = 3 1 .

It is difficult to guess what the shortest vector of this lattice could be. Thus, we subtract u from v and replace v with the outcome of this operation. The result is this new basis (u, v) = 2.1 0.9 1 0 .

Since u 2 > v 2 , we perform a column swap u ↔ v, that leads to the following basis matrix (u, v) = 0.9 2.1 0 1 .

Still, it is not easy to determine the shortest vector. Next, we subtract 2-times u from v and replace v with the outcome of this operation, v = 0.3 1 .

Now, according to the figure 1.5, the shortest vector reveals itself easily Figure 1.5: Gauss's reduction since the obtained basis consists of two orthogonal vectors. In fact, we have traced here the reduction algorithm of Lagrange which was also described by Gauss. Gauss's algorithm takes a two-dimensional basis matrix B as input . Thus, we have described an algorithm which finds a minimal basis in two dimension and it is similar in style to Euclid's famous gcd (greatest common divisor) algorithm.

For dimension greater than 2, several types of strong reductions are considered in the literature and includes the most frequent one: Minkowski's reduction which gives an exact determination of the shortest lattice vector at least for dimension less or equal to 4 however it is considered as an exponential time algorithm. In 1905 Minkowski introduced his theory of reduction of positive definite quadratic forms [START_REF] Minkowski | Diskontinuitatsbereich für arithmetische Äquivalenz[END_REF]. This theory is one of the essential foundations of the geometry of numbers.

Definition. A form f = g i,j=1 a ij x i x j is Minkowski reduced if for any col- lection of integers (l 1 , ..., l g ), from the condition gcd(l i , ..., l g ) = 1, it follows that f (l 1 , ..., l g ) ≥ a ii .
A Minkowski reduced basis can also be defined as follows:

Definition. A basis B = {b 1 , .., b g } of a lattice is Minkowski reduced if for each i, b i is the shortest vector in the lattice such that b 1 ,...,b i can be extended to a basis of the lattice L.

Note that (a ij ) 1≤i,j≤g = ( b i , b j ) 1≤i,j≤g where we denote by " ., . " the Euclidean scalar product.

Equivalently;

Lemma. A basis [b 1 , ..., b g ] ≤ of a lattice L is Minkowski-reduced if and only if i ∈ [1,
.., g] and for any integers x 1 , ..., x g such that x i , ..., x g are altogether coprime, we have:

x 1 b 1 + .... + x g b n ≥ b i .
Fortunately, in any fixed dimension, it is sufficient to check a finite subset of conditions and we call Minkowski conditions such a subset with minimal cardinality. Minkowski conditions have been obtained by Tammela up to dimension 7 in [START_REF] Tammela | The Hermite-Minkowski domain of reduction of positive definite quadratic forms in six variables[END_REF][START_REF] Tammela | Minkowski reduction region for positive quadratic forms in seven variables[END_REF]. However, it is not clear how to generalize these conditions for higher dimensions. As a consequence, in low dimension, one can check quickly if a basis is Minkowski-reduced by checking these conditions.

Here, we present Tammela's conditions for g ≤ 7.

Theorem (Tammela). Let g ≤ 7. A basis [b 1 , ..., b g ] ≤ of L is Minkowskireduced if and only if for any i ≤ g and for any integers x 1 , ..., x g that satisfy both conditions below, we have the inequality:

x 1 b 1 + .... + x g b g ≥ b i .
1. The integers x i , ..., x g are altogether coprime.

2. For some permutation ∇ of [1, .., g], x ∇(1) , .., x ∇(g) appears in the list below (where blanks eventually count as zeros).

Gauss's algorithm computes a Minkowski basis for any two-dimensional lattice. In terms of Minkowski conditions, Gauss's reduction can be defined as follows:

Definition. A lattice basis b 1 , b 2 is Gauss reduced if it satisfies b 1 ≤ b 2 ≤ b 1 -b 2 ≤ b 1 + b 2 .
For g > 2, an algorithm was presented by Helfrich [START_REF] Helfrich | Algorithms to construct Minkowski reduced and Hermite reduced lattice bases[END_REF] which is polynomial for fixed g but grows exponentially in g. Also Phong and Stehlé presented in [START_REF] Nguyen | Low dimensional basis reduction revisited[END_REF] a new concept of reduced bases called "greedy-reduced". They showed that the algorithm takes polynomial time for g ≤ 4 and this basis found is Minkowski reduced. In fact, there exist many algorithms for producing a Minkowski reduced bases and an HKZ reduced bases in exponential time.

However, up to now, there is no known polynomial time algorithms. Some of these algorithms are more considered as a theoretical result than as a practical tool.

In our work, we present in this context a Minkowski reduction algorithm for g ≤ 5 inspired by the algorithm presented by Zhang, Qiao and Wei [START_REF] Zhang | HKZ and Minkowski Reduction Algorithms for Lattice-Reduction-Aided MIMO Detection[END_REF].

We search a unimodular matrix Z such that the lattice basis B = BZ is Minkowski reduced. This work is divided into two parts as indicated in the definition.

1. Constructing the ith Minkowski reduced basis vector m i ; 2. Extending {m 1 , ..., m i } to a basis for the lattice L.

The first part is based on Schnorr-Euchner enumeration since enumerative algorithms are more efficient than the probabilistic ones (Sieve algorithms) for g ≤ 40. However, there is a difference between the enumeration adopted here and the original Schnorr-Euchner enumeration and this is in the way of updating the search radius. In the original one we update the search radius when a shorter lattice vector is found whereas here we update the search radius when a shorter lattice vector satisfying the gcd constraint is found.

For the second part, we use the following results:

Lemma. Let B = {b 1 , ..., b g } ∈ R n×g and L be the lattice generated by B.

For a vector v = g i=1 v i b i and any index p, 1 ≤ p ≤ g, there exists a basis for L containing {b 1 , .., b p-1 , v} if and only if gcd(v p , .., v g ) = 1.

Procedure. Let [p, q] be a non zero integer vector and gcd(p, q) = d. Using the extended Euclidean algorithm, we find integers a and b such that ap + bq = d. The integer matrix

M = p/d -b q/d a
is unimodular and

M -1 p q = d 0 , such that M -1 = a b -q/d p/d .
In terms of matrices, we try to find a unimodular matrix Z such that

B i+1 = B i Z,
where the first i -1 columns of Z are the first i -1 unit vectors and the ith one is the integer vector z obtained by the Schnorr-Euchner enumeration. Therefore, the first i -

1 columns of B i+1 equal to the first i -1 columns m 1 ,..,m i-1 and the ith column of B i+1 is m i = B i z. Since gcd(z i , .., z g ) = 1
where z i , ..., z g are the values taken by z from the ith to the last position, we can construct from the above procedure a unimodular matrix

M i whose first column is [z i , ..., z g ] . Therefore, Z = Z 1 Z 2 where Z 1 = I i-1 0 0 M i , Z 2 =             z 1 I i-1 . . . 0 z i-1 1 0 . . . 1            
This algorithm looks like the algorithm presented by Zhang, Qiao and Wei [START_REF] Zhang | HKZ and Minkowski Reduction Algorithms for Lattice-Reduction-Aided MIMO Detection[END_REF] only in the idea and not in the content.

The algorithm is applied to the upper triangular matrix R obtained by the Cholesky decomposition i.e, Y = R R.

If the initial matrix Y is symmetric positive definite therefore R = chol(Y ) otherwise R = chol(Y Y ).
In fact, Minkowski reduction defines three different domains:

1. The Minkowski domain formed by the set of Minkowski reduced forms considered in the space R N (N = g(g+1)

2

) where the domain is a convex cone with finitely many faces; 2. The simple Minkowski domain. This domain can be obtained by adding the condition a i,i+1 ≥ 0 for i = 1, ..., g -1;

3. The Minkowski fundamental domain (the "exact" domain of reduction) which is contained in a simple domain of Minkowski reduction.

Definition ([137]). An ordered basis {b 1 , .., b g } ≤ is Hermite-reduced if it is the smallest basis of L for the lexicographic order: for any other basis b

1 , ..., b g ≤ of L, we must have b 1 2 = b 1 2 ,..., b i-1 2 = b i-1 2 and b i 2 > b i 2 for some 1 ≤ i ≤ g.

Definition.

Let f be a Hermite-reduced form, and S be an unimodular matrix. Then by the definition of Hermite reduction, f S is Hermite-reduced if and only if f (S i1 , ..., S ig ) = a ii , (i = 1, ..., g).

Let M be the domain of Minkowski reduction (respectively, H the domain of Hermite reduction); H ⊂ M and the interior points of H and M coincide [START_REF] Van Der Waerden | Die Reduktionstheorie der positiven quadratischen Formen[END_REF]. H = M for g ≤ 6 (see, [START_REF] Ryshkov | The theory of Hermite-Minkowski reduction of positive definite quadratic forms[END_REF][START_REF] Tammela | The Hermite-Minkowski domain of reduction of positive definite quadratic forms in six variables[END_REF]), H = M for g > 6 [START_REF] Ryshkov | On the reduction of positive quadratic forms of n variables in the sense of Hermite, Minkowski, and Venkov[END_REF] (parts of the boundary of M do not belong to H). For g = 2, the Minkowski fundamental domain is given by the simple Minkowski domain.

Theorem.

       a 12 ≥ 0 a 11 -2a 12 ≥ 0 a 22 ≥ a 11 > 0 (1.3)
All the transformations of a form f (f is a Hermite-reduced form) from the domain (1.3) into reduced form are automorphisms of this form (M f = S M f S). In other words, all the forms of the domain (1.3) are not equivalent.

However, for g > 2, the simple Minkowski domain does not define the Minkowski fundamental domain. On the boundary of a simple Hermite-Minkowski domain, there are equivalent points. The fundamental domain for g = 3 is given by Tammela (see details in chapter2; section: An introduction to the fundamental domain of Minkowski) but the corresponding conditions in higher dimensions appear to be unknown.

In order to better understand the problem, we consider an example for g = 3

Example. Consider the face a 11 = a 22 of a simple Minkowski domain M 0 . This domain intersects with two domains M 1 and M 2 equivalent to it, where It can be easily seen that the partition of the cone of positivity into domains equivalent to a simple Minkowski domain is not normal. Some domains intersect along pieces of the faces. The idea of Tammela here was to reconstruct a new partition of all the faces of a simple Minkowski domain where all the faces are not equivalent. Now, we present 2 systems among the 16 systems that define the Minkowski fundamental domain for g = 3 where only the boundary points are considered in this case.

M 1 = M 0 S1 , M 2 = M 0 S2 and S1 , S2 are a linear transformations in the space R N induced by the matrices S 1 =    0 1 0 1 0 0 0 0 1    and S 2 =    0 1 0 1 0 0 0 0 -1   .
                                                       a 12 = 0 a 23 ≥ 0 a 11 -2a 12 > 0 a 11 -2a 13 > 0 a 11 + 2a 13 > 0 a 22 -2a 23 > 0 a 22 > a 11 a 33 > a 22 a 11 + a 22 -2a 12 + 2a 13 -2a 23 > 0 a 13 ≥ 0                                                        a 12 = 0 a 23 ≥ 0 a 11 -2a 12 > 0 a 11 -2a 13 > 0 a 11 + 2a 13 > 0 a 22 -2a 23 > 0 a 22 = a 11 a 33 > a 22 a 11 + a 22 -2a 12 + 2a 13 -2a 23 > 0 a 23 ≥ a 13 a 13 ≥ 0
The famous one in the second category of lattice reductions is the LLL algorithm. Lenstra, Lenstra and Lovász introduced the notion of LLL reduction in their article [START_REF] Lenstra | Factoring Polynomials With Rational Coefficients[END_REF] where an algorithm for computing such reduced bases is also presented. The LLL algorithm can be seen as an extension of Gauss reduction for dimension greater than 2. The LLL algorithm generalizes Gauss reduction and exploits the Gram-Schmidt orthogonalization.

Definition. A lattice basis

B = {b 1 , ...., b g } is LLL reduced if: • It is size reduced, i.e, |µ ik | ≤ 1 2 for 1 ≤ i < k ≤ g; • δ b * i-1 2 ≤ b * i 2 + µ 2 i,i-1 b * i-1 2 , such that 1 4 < δ ≤ 1 and b * 1 , ...b * g is the Gram-Schmidt orthogonalization of B.
The LLL algorithm performs a sequence of steps: translations and swap steps, where the aim of translations is to satisfy the size-reduction condition and the swap is to shift the weight in the orthogonalized basis B * from the first to the last ones.

However, this type of reduction has some drawbacks: The first vector in an LLL-reduced basis approximates a shortest lattice vector.

Corollary 1.

In an LLL-reduced basis B with δ = 3/4, we have

b 1 ≤ 2 (n-1)/2 .λ 1 (L(B)).
Hence, we can deduce that • The LLL algorithm runs in polynomial time but it only provides vectors that are no more than exponentially longer (in n) than the shortest ones.

• In the LLL algorithm, there is no reason for the shortest lattice vector to appear at the first position of a matrix. An important remark for Siegel's fundamental domain where the shortest lattice vector is assumed to appear at the fist position of a matrix (see, [START_REF] Frauendiener | Efficient computation of multidimensional theta functions[END_REF] and chapter 5). We notice here that the length of the shortest vector identified by the LLL reduction is 0.5735, longer than the shortest vector obtained by the Minkowski reduction (0.5321) and appears as the second vector in contrast to the Minkowski matrix where an exact determination of the length of the shortest vector appears at the first element of the matrix.

Siegel's fundamental domain

The construction of the fundamental domain for the modular symplectic group is essentially based on the Minkowski reduction theory of positive quadratic forms. In the matrix language, the problem of reduction of positive quadratic forms relative to unimodular equivalence is that of construction of a fundamental domain for the unimodular group ι = GL(g, Z) acting on the cone

P = P g := Y ∈ M (g, R) | Y = Y, Y positive definite
of real positive definite matrices of order g by

ι V : Y → Y [V ] := V Y V.
In other words, Y must be in the Minkowski fundamental domain: we search the fundamental domain of the unimodular group such that the matrix V Y V is Minkowski-reduced. We will see that Siegel's fundamental domain shows that every Riemann surface is Γ g -equivalent to a unique point of the fundamental region. It also permits to decide whether two different algebraic curves define the same Riemann surface and this by constructing for both Riemann matrices the symplectic transformation to the Siegel fundamental domain. If both Riemann matrices map to the same point in the fundamental domain, they correspond to the same surface.

We begin this part with some definitions.

Definition 1. Siegel's modular group Γ g is the group of all 2g × 2g matrices with integer entries which satisfy the condition

M JM = J,
where M ∈ Γ g , and if I g and 0 g are the g×g unit and zero matrices respectively, and where

J = 0 g I g -I g 0 g .
It follows from the definition that a 2g × 2g integer matrix

A B C D with g × g-blocks A, B, C, D is symplectic if and only if A C = C A, B D = D B, A D -C B = I g . (1.4)
It is easy to see that a matrix M is symplectic if and only if the matrix M = JM -1 J -1 is symplectic. This implies that the conditions (1.4) can be rewritten in the form

AB = BA , CD = DC , AD -BC = I g .
Generators for Γ g were first determined by Hua and Reiner [START_REF] Hua | On the Generators of the Symplectic Modular group[END_REF]. In 1961, Klingen [START_REF] Klingen | Introductory Lectures on Siegel Modular Forms[END_REF] obtained a characterization of Γ g for g ≥ 2 by a finite system of defining relations. In 1983, Mumford [START_REF] Mumford | Tata lectures on Theta. I and II[END_REF] gave three generators for the modular group Γ g .

0

I -I 0 , A 0 0 (A -1 ) , I B 0 I
for all A ∈ GL(g, Z) and B a symmetric, integer matrix.

Definition 2. A symmetric matrix A ∈ R n×n is positive definite if x Ax > 0 for all x = 0.
Note that if A is an n × n symmetric matrix, then x Ax is the function

x Ax = n i=1 n j=1 A ij x i x j = n i=1 A ii x 2 i + 2 i>j A ij x i x j ;
this is called "a quadratic form".

Definition 3 (Cholesky Factorization). Every positive definite matrix A ∈ R n×n can be factored as

A = R R
where R is upper triangular matrix with positive diagonal elements.

H g ∼ = R g(g+1) 2 × P g ⊂ R g(g+1) ,
The group Sp(2g, R) operates on H g by

A B C D .Ω := (AΩ + B)(CΩ + D) -1 , where M = A B C D ∈ Sp(2g, R), one has I(M.Ω) = (CΩ + D) -I(Ω)(CΩ + D) -1 .
We give a brief overview of this action. The facts stated here will be given in more detail later. We consider the Siegel modular group Γ g = Sp(2g, Z) of degree g and the generalized upper half plane H g , on which Γ g acts properly discontinuously. For Γ g , a fundamental domain on H g , which (roughly) contains one representative from the orbit of every Ω ∈ H g , has been given in [START_REF] Siegel | Topics in complex function theory[END_REF].

Definition 6. Siegel's fundamental domain is the subset of H g such that Ω = X + iY ∈ H g satisfies: 1. |X jk | ≤ 1 2 , j, k = 1, ..., g; 2.
Y is in the fundamental region of Minkowski reductions;

|det(CΩ + D)| ≥ 1 for all C, D.

Note that the third condition must be verified for all matrices C and D of the symplectic group and it is also called the maximal height condition.

For genus 1, Siegel's fundamental domain is given by the well-known "elliptic fundamental domain"

D := Ω ∈ H 1 | |Ω| ≥ 1, |R(Ω)| ≤ 1 2 .
In fact, there are many ways of constructing a fundamental domain (see, Figure 1.7) whereas a common choice is the above region, bounded by the vertical line R(Ω) = 1 2 and R(Ω) = -1 2 and the circle |Ω| = 1. It has vertices at 1 2

+ i √ 3 2 and -1 2 + i √ 3
2 , where the angle between its sides is π 3 and a third vertex at infinity, where the angle between its sides is 0. Since the points on the borders of this region are equivalent under symplectic transformations: the points on the two lines R(Ω) = ± 1 2 are equivalent under the action of T : ω → Ω ± 1 and the points on the left and right halves of the arc |Ω| = 1 are also equivalent under the action S : Ω → -1 Ω , it is better to Figure 1.7: The elliptic fundamental domain [Mumford] consider a part of the boundary of this domain more precisely, we add only the boundary points with non-positive real part. For this reason, we define the semi-closure of D as the fundamental region of the elliptic case. Thus, every point of H g is equivalent under modular group to a unique point of this new fundamental domain.

We can also factorize H 2 by the action of Sp(4, Z) (g = 2). This gives the Siegel-Gottschling fundamental domain H 2 /Sp(4, Z). In this case, the fundamental domain is defined by the following set of inequalities: The standard bounds on the real part of the Riemann matrix Ω, (1.5)

|X 11 | ≤ 1 2 , |X 12 | ≤ 1 2 , |X 22 | ≤ 1
|Ω 11 | ≥ 1, |Ω 22 | ≥ 1, |Ω 11 + Ω 22 -2Ω 12 + e| ≥ 1,
A constraint appears in the construction of such a domain: the maximal height condition that must be verified for all matrices C and D of the symplectic group. For this reason, Siegel showed in his book [START_REF] Siegel | Topics in complex function theory[END_REF] that third condition is equivalent to a finite number of conditions i.e., just a finite number of matrices has to be considered. However, it is not trivial to determine these set of matrices for dimension greater than 2. We present in this context, a part of the finitely many inequalities that determine the fundamental domain for g = 3, especially for rankC = 1 (see, Chapter 5).

Theorem 1. For genus 3 and a rank 1 matrix C, we have the following inequalities to be verified:

Writing Ω =    Ω 1 Ω 4 Ω 5 Ω 4 Ω 2 Ω 6 Ω 5 Ω 6 Ω 3    then |Ω 1 | ≥ 1, |Ω 2 | ≥ 1, |Ω 3 | ≥ 1, |Ω 1 + Ω 2 -2Ω 4 ± 1| ≥ 1, |Ω 2 + Ω 3 -2Ω 6 ± 1| ≥ 1, |Ω 1 + Ω 3 + 2Ω 5 ± 1| ≥ 1 if I(Ω 5 ) < 0, |Ω 1 + Ω 3 -2Ω 5 ± 1| ≥ 1 if I(Ω 5 ) > 0, |Ω 1 + Ω 2 + Ω 3 + 2Ω 4 -2Ω 5 -2Ω 6 + d| ≥ 1, for -4 ≤ d ≤ 4
, and I(Ω 5 ) > 0,

|Ω 1 + Ω 2 + Ω 3 -2Ω 4 -2Ω 5 + 2Ω 6 + d| ≥ 1, for -4 ≤ d ≤ 4
, and I(Ω 5 ) > 0,

|Ω 1 + Ω 2 + Ω 3 -2Ω 4 + 2Ω 5 -2Ω 6 + d| ≥ 1, for -4 ≤ d ≤ 4.
For this result, we have used Tammela's conditions for constructing a Minkowski fundamental domain for dimension 3 [START_REF] Tammela | On reduction theory of positive quadratic forms, Studies in number theory. Part 3[END_REF] and the following lemma due to Gottschling.

Lemma (Gottschling). In the domain B e where e = -1, 0, 1, the inequality

|B 11 + B 22 -2B 33 -2e| ≥ 1; is a sequence of |det(B + eS)| ≥ 1 with S = 0 1 1 0 . B 0 is the part of B in which Y 22 ≤ 1, B 1 is a part of B 0 in which -1 2 ≤ X 3 ≤ -1 4 and B -1 that part of B 0 in which 1 4 ≤ X 3 ≤ 1 2 .
B is a region that contains the standard limits for the real part and the simple Minkowski conditions for dimension 2 and the two inequalities |B 11 | ≥ 1 and |B 22 | ≥ 1. Now, since the Minkowski fundamental domain appearing in the second condition is only known for g ≤ 3 (see, [START_REF] Tammela | On reduction theory of positive quadratic forms, Studies in number theory. Part 3[END_REF]) and the third condition is the least studied one, there is no constructive approach to actually identify the domain for g > 2. However, Siegel [START_REF] Siegel | Topics in complex function theory[END_REF] gave an algorithm to approximately reach the fundamental domain called Siegel reduction. Siegel's reduction preserves the first condition presented in its fundamental domain and among the finitely many inequalities of the third condition, Siegel's reduction is concerned with that the absolute value of the first element of the Riemann matrix must be greater or equal to 1, i.e, |Ω 11 | ≥ 1.

Theorem 2 (Siegel Reduction). Every Riemann matrix Ω can by means of a symplectic transformation be reduced to a Riemann matrix Ω = X + i Ỹ , where Ỹ = R R, X( Ỹ ) are the real (imaginary) part of Ω and R is an upper triangular matrix, obtained by Cholesky decomposition, such that 1. Xjk ≤ 1 2 , for j, k = 1, ..., g;

2. The length of the shortest lattice vector of the lattice generated by the columns of R is bound from below by √ 3/2.

The second condition is ensured by the following quasi-inversion:

Ω → Ω := (AΩ + B)(CΩ + D) -1 (1.6) such that A = 0 0 n-1 0 n-1 I n-1 , B = -1 0 n-1 0 n-1 0 n-1,n-1 C = 1 0 n-1 0 n-1 0 n-1,n-1 , D = 0 0 n-1 0 n-1 I n-1
Where does the second condition comes from? Siegel showed that the determinants of the imaginary parts of two Riemann matrices connected by a modular transformation (1.6) and finally by the maximal height condition we obtain the second condition of Siegel's reduction. A motivation for this work will stem from theta functions associated to Siegel upper half space, more precisely an efficient method for the computation of these theta functions by using Siegel's reduction will be presented in this part.

Theta Functions

The theta function of a Riemann surface is a very fundamental special function associated to a Riemann surface both in algebro-geometrical calculations and in applications to non-linear equations and cryptography [START_REF] Swierczewski | Computing Riemann theta functions in Sage with applications[END_REF][START_REF] Ji | Universal moduli spaces of Riemann surfaces[END_REF][START_REF] Frauendiener | Computational Approach to Hyperelliptic Riemann Surfaces[END_REF][START_REF] Frauendiener | Hyperelliptic theta functions and spectral methods: Kdv and KP solutions[END_REF]. Partial solutions of differential equations can often be written in terms of abelian functions, and this in terms of theta functions [START_REF] Korotkin | Finite-gap solutions of the stationary axially symmetric Einstein equation in vacuo, (Russian); translated from Teoret[END_REF]. Jacobi introduced theta functions in his study of elliptic functions. The Riemann theta function was introduced by Riemann as a generalization of Jacobi's theta functions of one variable for solving the Jacobi inversion problem on general compact connected Riemann surfaces [START_REF] Riemann | Theorie der Abel'schen Functionen[END_REF][START_REF] Campo | On the early history of moduli and Teichmüller spaces[END_REF]. Multidimensional theta functions are functions in g complex variables and a convenient tool to work with meromorphic functions. In general, each Riemann surface is characterized by its Riemann matrix [START_REF] Deconinck | Computing the Riemann matrix of algebraic curve[END_REF] and to a Riemann matrix one can associate a Riemann theta function. Note that in general, the presence of symmetries allows to significantly simplify the Riemann matrix of a surface, but only in a homology basis adapted to the symmetries, see [START_REF] Braden | Klein's curve[END_REF] for the Klein curve. We start by some basic facts about theta functions and we define them as an infinite series.

Definition.

Let Ω be a g × g Riemann matrix. The theta function with characteristic [p, q] is defined as

θ pq (z, Ω) = N ∈Z g exp {iπ Ω(N + p), N + p + 2πi z + q, N + p } , (1.8)
with z ∈ C g and p, q ∈ C g , where ., . denotes the Euclidean scalar product

N, z = g i=1 N i z i .
The properties of the Riemann matrix ensure that the series converges absolutely and that the theta function is an entire function on C g . The theta function with characteristic is related to the Riemann theta function θ, the theta function with zero characteristic θ := θ 00 , via θ pq (z, Ω) = θ(z + Ωp + q) exp {iπ Ωp, p + 2π p, z + q } .

(1.9)

The theta function has the periodicity properties θ pq (z + e j ) = e 2πp j θ pq (z), θ pq (z + Ωe j ) = e -2π(z j +q j )-iπΩ jj θ pq (z), (1.10) where e j is a vector in R g consisting of zeros except for a 1 in the jth position. These periodicity properties (1.10) can be used in the computation of the theta function: an arbitrary vector z ∈ C g can be written in the form

z = ẑ + N + ΩM with N , M ∈ Z g , where z = Ωp + q with |p i | ≤ 1 2 , |q i | ≤ 1 2
. Thus, it is sufficient to compute the theta function for arguments z lying in the fundamental domain of the Jacobian. For general arguments z one computes θ(ẑ, Ω) and obtains θ(z, Ω) from the periodicity properties (1.10) by multiplying with an appropriate exponential factor. In this work, we are interested in a rapid convergence of these multi-dimensional theta functions. The basic idea is to approximate the expression (1.8) via a truncated series. To compute the series (1.9), it will be approximated by a sum, |N i | ≤ N , i = 1, ..., g where the constant N is chosen such that all omitted terms in (1.8) are smaller than some prescribed value of . In contrast to [START_REF] Deconinck | Computing Riemann theta functions[END_REF], we do not give a specific bound for each N i , i = 1, ..., g, i.e., we sum over a g-dimensional sphere instead of an ellipsoid. Taking into account that we can choose z in the fundamental domain of the Jacobian, we get for the Riemann theta function the estimate

N > - ln πy min + 1 2 such that y min = N min , N min Y := min N ∈Z g /0 Y N, N ,
i.e., y min is the shortest vector of the lattice generated by the imaginary part Y of the Riemann matrix Ω. Thus, the longer the shortest vector, the more rapid the convergence of the theta series. Changing the shortest vector can be achieved by changing the homology basis of the underlying Riemann surface which yields a different but symplectically equivalent Riemann matrix. An important step in the efficient computation of theta functions is the construction of appropriate symplectic transformations to generate larger norms of the shortest vector for a given Riemann matrix Ω assuring a rapid convergence of the theta series.

The behavior of theta functions under modular transformations is explicitly known. One has

θ pq (M -1 z, B) = k det(M) exp 1 2 i≤j z i z j ∂ ∂B ij ln det M θ pq (z), M = CB + D, p q = D -C -B A p q + 1 2 diag(CD ) diag(AB ) .
Thus, such transformations can dramatically increase the rate of convergence which is especially important for larger values of g. Now, the goal is to find these symplectic transformations on the Riemann matrix Ω and this will be done by Siegel's fundamental domain. We have already seen that Siegel has constructed a fundamental region for Riemann matrices, analogous to the elliptic case and the algorithm finds iteratively a new Riemann matrix. However, the determination of such a domain becomes more complicated for g > 2.

This approach was for the first time implemented in an algorithm by Deconinck et al. in [38]. This algorithm is based on Siegel's reduction together with the LLL algorithm for finding the shortest lattice vector. In our work, the LLL algorithm is replaced by our Minkowski reduction algorithm for dimension ≤ 5 and an exact determination of the shortest lattice vector for higher dimensions.

In order to generate larger norms of the shortest lattice vector, [START_REF] Deconinck | Computing Riemann theta functions[END_REF] adopted the following algorithm: 1. Apply the LLL algorithm on the imaginary part of the Riemann matrix in order to find the shortest lattice vector as the first vector of the lattice. 2. Subtract an integer matrix to Ω so that

|R(Ω ij )| ≤ 1 2 . 3. If |Ω 11 | ≥ 1, terminate the algorithm; if not apply a quasi-inversion Ω → Ω = (AΩ + B)(CΩ + D) -1 such that A = 0 0 n-1 0 n-1 I n-1 , B = -1 0 n-1 0 n-1 0 n-1,n-1 C = 1 0 n-1 0 n-1 0 n-1,n-1 , D = 0 0 n-1 0 n-1 I n-1 ,
then go back to step 1 for the resulting Ω. It is clear that the shortest lattice vector is assumed to appear at the first position of the imaginary part of the Riemann matrix. Now, in order to show the improvement that can be achieved in the computation of theta series if we replace the LLL algorithm used by Deconinck et al by our Minkowski reduction algorithm for small dimensions and an exact determination of the shortest vector problem for higher dimensions, we take as an example (among many others) the Riemann matrix of the Fricke-Macbeath surface [START_REF] Fricke | Über eine einfache Gruppe von 504 Operationen[END_REF][START_REF] Macbeath | On a curve of genus 7[END_REF], a surface of genus g = 7 with the maximal number 84(g -1) = 504 of automorphisms. It can be defined via the algebraic curve f (x, y) := 1 + 7yx + 21y 2 x 2 + 35x 3 y 3 + 28x 4 y 4 + 2x 7 + 2y 7 = 0. However, the square of the norm of the shortest lattice vector of the imaginary part of the matrix W is 0.6585, well below the threshold √ 3/2. This shows the limitations of the LLL algorithm since the convergence of the theta series is controlled by the length of the shortest lattice vector. Note that the LLL reduced Ỹ above has the shortest vector in the 6th column (with squared norm 0.6585). One could construct a unimodular matrix Z such that RZ has this vector appearing in the first column (the resulting matrix might not satisfy the LLL condition). This would be more suited to the application of Siegel's algorithm, but will be still approximate since in general LLL does not identify the shortest lattice vector correctly. Now, if the same algorithm is applied with an exact determination of the shortest vector, the result changes considerably: in the first step of the iteration, the shortest lattice vector is correctly identified having the square of the norm 0.6585. Thus after a shift of the real part, a quasi-inversion is applied. The subsequent identification of the shortest vector of the resulting matrix leads to a vector of squared norm 0.7259. After a shift of the real part, another quasi-inversion is applied. This time the square of the norm of the shortest vector is In contrast to the algorithm incorporating LLL reductions, the square length of the shortest vector of the imaginary part is here given by the (11) component of the matrix W . Note that the approximate character of the LLL algorithm is unsatisfactory for our purposes for two reasons: First, the overestimation of the length of the shortest vector leads to a premature end of the algorithm and a much shorter shortest vector than necessary. But secondly, the potentially crude approximation of its length implies that an estimate of the truncation parameter N based on the LLL result could be misleading with the consequence of a loss of accuracy in the approximation of the theta functions.

RieMat

We have shown in this part that Siegel's reduction can be used to efficiently compute the theta functions and this by replacing the LLL algorithm used by Deconinck et al. by a Minkowski reduction algorithm. In fact, our implementation of Siegel's reduction algorithm allows also a precise estimate of the number in the truncated sum and reduces this number. If for example, we were to gain in dimension g a factor 2 per direction, this would correspond to 2 g terms in the sum. hence more g is high, the advantage would be decisive.

Outline of the thesis

The material of this work is arranged as follows:

We start the second chapter by a general introduction about lattices and lattice reduction problems in section 2.1. In section 2.2, we recall the necessary background about lattices (the dual lattice, the Gram-Schmidt orthogonalization, the determinant of a lattice, the complex-valued lattices, the size reduction algorithm, Minkowski's successive minimum and Hermite's constant, Minkowski's theorem), in order to be able to properly define several notions of reduction. In section 2.3 and 2.4, we present the most studied algorithmic problem on Euclidean lattices the SVP and the known algorithms related to lattice reduction especially for the Minkowski reduction and its different definitions. In section 2.5, we show a particular result due to Tammela in the determination of Minkowski's fundamental domain for genus 3. In chapter 3, we focus on the time complexity of the different reduction algorithms presented in the second chapter where Gauss's reduction and the LLL reduction are the only polynomial reduction algorithms. In chapter 4, we present our Minkowski reduction algorithm up to dimension 5, we start by a description of the algorithm, the drawback of this algorithm, and then we show by examples the differences between these reduction algorithms and the quality of a reduction algorithm measured in terms of the orthogonality defect. Finally, chapter 5 is devoted to study the action of the symplectic group on the Siegel upper half space, especially for genus 1 and 2. A new result is presented for genus 3. This chapter contains also a powerful application of Siegel's fundamental domain to "Riemann's theta function" where the idea was investigated first by Deconinck et al. An efficient computation of this function illustrated by examples is presented in this context by replacing the LLL algorithm used in [START_REF] Deconinck | Computing Riemann theta functions[END_REF] strategy by our Minkowski reduction algorithm up to dimension 5 and an exact determination of the shortest lattice vector for greater dimensions.

Chapter 2

Lattice and lattice reduction

Historically, lattices were investigated since the late of 18th century by Lagrange and Gauss. In the 19th century, important results due to Minkowski motivated the use of lattice theory in the theory and geometry of numbers. The evolution of computer science in the 20th century, especially after the publication of the landmark polynomial time reduction method by Lenstra, Lenstra and Lovász and that was widely known as the LLL algorithm, led to lattice applications in various theoretical areas such as factorization of integers, polynomials, integer programming and public-key cryptography. In the latter area, lattice theory has played a powerful role in the definition of new cryptosystems and in cryptanalysis.

Introduction

A lattice L is a discrete additive subgroup of R n . Any lattice can be characterized in terms of a set of m ≤ n linearly independent basis vectors

B = {b 1 , ..., b m } as {x : x = m l=1 z l b l , z l ∈ Z} = {Bz : z ∈ Z n }
where m is the rank or the dimension of L. A lattice basis is usually not unique. Given a lattice L of dimension m, (m ≥ 2), the lattice L can have infinitely many different bases, see [START_REF] Hoffstein | An introduction to mathematical cryptography[END_REF], where two bases are connected by an unimodular matrix Z, B = BZ. Some bases are more interesting than others; they are called reduced. The goal of lattice basis reduction is to find, for a given lattice, a basis matrices with favorable properties. Usually, such a basis consists of vectors that are reasonably short or, equivalently, a basis consisting of vectors that are pairwise nearly orthogonal, is called "a reduced lattice basis". It is a vague concept and the geometry of numbers has sought from the beginning to clarify this reduced bases concept. This leads to two crucial questions:

What is the complexity of the main problems related to the reduction? How to construct effective reduction algorithms?

The time complexity of an algorithm quantifies the amount of time taken by an algorithm to run. It is commonly estimated by counting the number of elementary operations performed by the algorithm, where an elementary operation takes a fixed amount of time to perform. An algorithm with 2 poly(n) is called an exponential time complexity and with 2 O(log n) = poly(n), a polynomial time complexity where poly(n) means polynomial in n.

There are many lattice reduction algorithms with corresponding reduction criteria and for each of them, there is a notion of quality of the reduced basis and computational complexity required to obtain it: in 1850, Hermite introduced the first notion of reduction, [START_REF] Hermite | Extraits de lettres de M. Hermite à M. Jacobi sur différents objets de la théorie des nombres[END_REF]. In 1873, Korkine and Zolotareff, [START_REF] Korkine | Sur les formes quadratiques[END_REF], strengthened the definition of Hermite reduction. Their proposed notion is referred to as HKZ reduction, [START_REF] Nguyen | The LLL Algorithm: Survey and Applications[END_REF]. In 1973, Kannan gave an algorithm for constructing HKZ reduced bases, [START_REF] Kannan | Improved algorithms for integer programming and related lattice problems[END_REF], which in particular contain a shortest non zero lattice element. The algorithm was exponential, but polynomial for fixed dimension. His algorithm yields the asymptotically best known algorithm for integer linear programming as Hermite reduced bases. Minkowski reduced bases contain a shortest nonzero lattice vector, however, Minkowski reduced bases were only constructed for dimensions 2 and 3, [START_REF] Lagarias | Worst-Case complexity bounds for algorithms in the theory of integral quadratic forms[END_REF]. The algorithm was further refined to construct both Minkowski reduced bases and HKZ reduced bases and improved the complexity analysis by Helfrich [START_REF] Helfrich | Algorithms to construct Minkowski reduced and Hermite reduced lattice bases[END_REF] in 1985, Kannan in 1987 [START_REF] Kannan | Minkowski's convex body theorem and integer programming[END_REF], Banihashemi and Khandani [START_REF] Banihashemi | On the complexity of decoding lattices using the Korkine-Zolotarev reduced basis[END_REF] in 1998. Among these, the strongest one is Minkowski reduction. In 1890s, Minkowski [START_REF] Minkowski | Über die positiven quadratischen Formen und über kettenbruchähnliche Algorithmen[END_REF] defined 'Minkowski reduced' bases, requiring that each basis vector is as short as possible. Minkowski dealt with these bases in his Geometry of Numbers and in the theory of quadratic forms. Up to dimension four, it is arguably optimal compared to all other known reductions, because it reaches all the so-called Minkowski's successive minima, denoted by λ i and defined as the smallest positive number λ such that λL contains at least i linearly independent lattice vectors. However, finding a Minkowski reduced basis cannot be solved in polynomial time under randomized reductions as the dimension increases because such a basis contains a shortest lattice vector and the shortest vector problem cannot be solved in polynomial time under randomized reductions, [START_REF] Micciancio | The shortest vector in a lattice is NP-hard to approximate to within some constant[END_REF], [START_REF] Micciancio | Complexity of Lattice Problems: A cryptographic Perspective[END_REF]. Unfortunately, finding good reduced bases has proved invaluable in many fields and the computational complexity of lattice reduction has attracted considerable attention. Therefore, the lattice reduction algorithms yield reduced bases with shorter basis vectors and improved orthogonality. It provided a compromise between the quality of the reduced basis and the computa-tional effort required for finding it. The lattice reduction algorithms can be grouped into two categories according to their complexity: exponential time algorithms and polynomial time algorithms. There are no known polynomial time algorithm for producing Minkowski reduced bases and HKZ reduced bases [START_REF] Aharonov | Lattice problems in NP and co-NP[END_REF].

Practical algorithms for computing Minkowski reduced and HKZ reduced lattice bases can be found in [START_REF] Nguyen | Low dimensional basis reduction revisited[END_REF], for lattices of low dimensions with quadratic complexity, [START_REF] Chen | Greedy Algorithm Computing Minkowski Reduced Lattice Bases with Quadratic Bit Complexity of Input Vectors[END_REF], [START_REF] Zhang | HKZ and Minkowski Reduction Algorithms for Lattice-Reduction-Aided MIMO Detection[END_REF], [START_REF] Zhang | Practical HKZ and Minkowski Lattice Reduction Algorithms[END_REF], for lattices of arbitrary rank, where [START_REF] Zhang | HKZ and Minkowski Reduction Algorithms for Lattice-Reduction-Aided MIMO Detection[END_REF], [START_REF] Zhang | Practical HKZ and Minkowski Lattice Reduction Algorithms[END_REF] used sphere decoding strategies [START_REF] Hassibi | On the sphere-decoding algorithm I: Expected complexity[END_REF] to find a shortest lattice vector inside a sphere centered at 0 of radius ρ and reduced the computational costs of their existing counterparts.

The first polynomial time lattice reduction algorithm was presented in 1982, [START_REF] Lenstra | Factoring Polynomials With Rational Coefficients[END_REF], known as LLL reduced basis, named after the three authors A. Lenstra, W. Lenstra and L. Lovász. Theoretically, the LLL reduction algorithm can produce an approximate shortest vector that is at most a factor of O(2 m ) times longer than a real shortest vector of a lattice, [START_REF] Babai | On Lovász Lattice reduction and the nearest lattice point problem[END_REF]. This basis is, of course, not perfect but sufficient for many problems. Further improvements of the LLL algorithm have been developed, while some improve the output quality, [START_REF] Schnorr | A hierarchy of polynomial lattice basis reduction algorithms[END_REF][START_REF] Luk | A pivoted LLL algorithm[END_REF][START_REF] Nguyen | An LLL algorithm with quadratic complexity[END_REF][START_REF] Luk | A lattice basis reduction algorithm, nstitute for computational Mathematics[END_REF], others improve the efficiency, [START_REF] Nguyen | An LLL algorithm with quadratic complexity[END_REF], [START_REF] Ling | Effective LLL reduction for lattice decoding[END_REF]. The Jacobi lattice reduction algorithm presented in [START_REF] Qiao | A Jacobi method for lattice basis reduction[END_REF] adopted a different strategy from the LLL algorithm to construct a reduced basis in polynomial time and showed that the Jacobi method outperforms the LLL algorithm in not only efficiency, but also the orthogonality defect (which measures the quality of a such lattice basis). It is equal to 1 if and only if the vectors of a such a lattice basis are orthogonal.

In this chapter, we give the mathematical background on lattices. The chapter mainly includes definitions about lattices, some useful lattice properties and some necessary theorems in section 2.2. Then, we proceed by defining and studying a very important characteristic of a lattice, namely its shortest vector in section 2.3. we describe also various notions of reduction in section 2.4 and present an important result due to Tammela for constructing a Minkowski fundamental domain for dimension 3 in section 2.5.

Lattice

A lattice is a set of points in an n-dimensional space with period structure, such as the one illustrated in Figure . 2.1. The theoretical study of lattices is often called the Geometry of Numbers, a name bestowed on it by Minkowski in his 1910 book "Geometrie der Zahlen". More recently, lattices have become a topic of active research in computer science. They are used as an algorithmic tool to solve a wide variety of problems as the SVP and the CVP. The practical process of finding short(est) or close(st) vectors in lattices is called "Lattice Reduction".

Let R n be the n-dimensional Euclidean space. A lattice in R n is the set

L(b 1 , .., b m ) = m i=1 x i b i ; x i ∈ Z , of all integer combinations of m linearly independent vectors b 1 , b 2 , ..., b m in R n (n ≥ m).
The integers n and m are called the dimension and rank of the lattice. The sequence of vectors b 1 , .., b m is called a lattice basis and it is conveniently represented as a matrix

B = [b 1 , ..., b m ] ∈ R n×m ,
having the basis vectors as columns. Using matrix notation, a lattice can be rewritten as

L(B) = {Bx : x ∈ Z m },
where Bx is the usual matrix-vector multiplication. If n = m, then L(B) is called a full rank lattice. Note that a full rank lattice will be considered in this context except otherwise indicated.

The basis for a given lattice is not unique. There exist infinitely many bases for a lattice.

Theorem. [START_REF] Micciancio | Introduction To Lattices[END_REF] Let B and B be two bases. Then L(B) = L( B) if and only if there exists a unimodular matrix U such that B = BU .

Proof. First let B = BU for some unimodular matrix U . Notice that if U is unimodular, then U -1 is unimodular too. B = BU and B = BU

I -V W = 0, i.e., V W = I and V , W have integer entries, then det(V )det(W ) ∈ Z and det(V ) = det(W ) = ±1.
The simplest example is the cubic lattice, obtained by taking the basis vectors b i = e i where e i denotes the ith column of the n-dimensional identity matrix I n . In this case, we have B = I n and L = Z n . Z n can also be generated by the basis vectors {e 1 , e 2 + ke 1 , ..., e n + ke 1 }, k ∈ Z, i.e, B = B + k(0, e 1 , e 1 , ..., e 1 ). Since B = I n is an orthogonal basis, B is the best reduced basis of L. Above, we illustrate the case for n = 2, see Figure . 2.2.

The Dual Lattice

To any lattice, there is an associated dual lattice, defined by

L = x ∈ Span (B) | x x ∈ Z for all x ∈ L , where Span (B) = {Bx | x ∈ R m } .
If B is a basis for the primal lattice L, a basis B for the dual lattice L can be obtained via the right Moore-Penrose pseudo inverse [START_REF] Macausland | The Moore-Penrose Inverse and Least Squares[END_REF], i.e.,

D = B = B B B -1
. Definition. For an m-dimensional lattice spanned by B, we call a basis D ∈ R n×m a dual basis if:

Since B B = I m , it
1. Span(B) = Span(D).

B D = D B = I.

In other words, B and D are dual bases if they have the same linear span, and any primal and dual basis vector have scalar product b i , d j = δ ij where

δ ij =    0 if i = j 1 if i = j
It is not hard to check that D is unique for a given B, given by D = B(B B) -1 . v ∈ R n is a dual vector if and only if B v ∈ Z n . Therefore, this last condition can be written as v ∈ B -Z n = L(B -). Thus, B -is a basis for the dual lattice. We deduce that when B ∈ R n×n , the expression for the dual basis given before simplifies to D = B -.

Theorem. If D is the dual basis of B then L(B) = L(D).
Proof. For any Dy ∈ L(D), and all Bx ∈ L(B), we have:

Dy = B(B B) -1 y ∈ Span(B).
Also, we find that (Dy) (Bx) = y D Bx = y x ∈ Z, which implies that Dy ∈ L(B) and L(D) ⊆ L(B) . Now, we consider an arbitrary vector v ∈ L(B) , so by the definition of the dual lattice basis, we

obtain that B v ∈ Z m and v ∈ Span(B). It follows that v = Bw for some w ∈ R m and v = Bw = B(B B) -1 B Bw = D(B v) ∈ L(D).
This proves L(D) ⊆ L(B) .

Properties of dual lattices.

Lemma. For any lattice L, (L ) = L.

Proof. We assume that B is the basis of L

B(B B) -1 ((B(B B) -1 ) B(B B) -1 ) -1 = B(B B) -1 ((B B) -1 ) -1 = B. Lemma. For a lattice L, det(L ) = 1 det(L)
.

Proof. Let B be the basis of L. Then, we have

det(L ) = (B(B B) -1 ) B(B B) -1 = (B B) -1 (B B)(B B) -1 = (B B) -1 = 1 det(L) . Lemma. For any lattice L of rank m, λ 1 (L)λ 1 (L ) ≤ m,
where λ 1 is the first successive minimum.

Proof. From Minkowski's bound, [START_REF] Micciancio | Lecture 3: Minimum distance, CSE 206A: Lattice Algorithms and Applications[END_REF], (see also 2.2.7), we have

λ 1 (L) ≤ √ m det(L) 1 m . b 1 = b 2 b 1 b 2 Figure 2.3: Gram-Schmidt orthogonalization Since Span(L) = Span(L ), λ 1 (L ) ≤ √ m det(L ) 1 m .
Multiplying and using the previous lemma, we obtain the desired result.

Lemma. For a lattice L,

λ 1 (L)λ m (L ) ≥ 1.
Proof. Let v ∈ L such that λ 1 = v , v is a vector that achieves the first successive minimum of the lattice L. Take any set x 1 , ..., x m of m linearly independent vectors in L . Not all of them are orthogonal to v. Hence, there exists an i such that x i , v = 0. By the definition of the dual lattice, we have x i , v ∈ Z and hence

λ 1 (L)λ m (L ) ≥ v . x i ≥ | v, x i | ≥ 1.
More generally, for any i,

λ i (L)λ m-i+1 (L ) ≥ 1.

Gram-Schmidt Orthogonalization

Any basis B can be transformed to an orthogonal basis for the same vector space using the well-known Gram-Schmidt orthogonalization method. Suppose

* i = b i - j<i µ i,j b * j where µ i,j = b i , b * j b * j , b * j . ( )
In matrix notation, B = B * M where M is the upper triangular matrix with 1 along the diagonal and m i,j = µ i,j for all j < i. It also follows that

B * = BM -1
where M -1 is also upper triangular with 1 along the diagonal. Note that the columns of B * are orthogonal b * i , b * j = 0 for all i = j . Therefore, the (non-zero) columns of B * are linearly independent and form a basis for the vector space Span (B). However they are generally not a basis for the lattice L (B). So, while vector spaces always admit an orthogonal basis, this is not true for lattices.

Example. The Gram

Let B = [b 1 , .., b m ] be a basis for a lattice L in R n and B * = [b * 1 , ..., b * m ] be its Gram-Schmidt orthogonalization. For i ∈ {1, ..., m}, denote by π i : R n → (Rb 1 + ... + Rb i-1 ) ⊥ the orthogonal projection on the orthogonal complement of Rb 1 + .. + Rb i-1 . L m-i+1 = π i (L), this is a lattice of rank m -i + 1 with basis [π i (b i ), ..., π i (b m )].
In terms of the Gram-Schmidt decomposition we have

π i (b j ) = b * j + j-1 k=i µ jk b * k , In particular, π i (b i ) = b * i .
What We start with the second one. For all i, j > 1, we have

π 2 (b i ), d j = b i -µ i1 b 1 , d j = b i , d j -µ i1 b 1 , d j = δ ij -µ i1 δ 1j = δ ij This proves that (B ) (D ) = I.
For the first one, we know that B and D span the same vector space V . The linear span of B is by definition the orthogonal complement of b 1 in V . Since the vectors d 2 , ..., d m are all orthogonal to b 1 (by definition of dual basis) and they are linearly independent, they also span the orthogonal complement of b 1 in V . So, B and D have the same linear span and this proves the lemma.

In contrast, another orthogonalization approach is the QR decomposition.

Definition. The QR decomposition is a decomposition obtained by applying a sequence of Householder or Givens transformations, that factorizes B according to B = QR, where Q = (q 1 , ..., q m ) is an n × m columns-orthogonal matrix, we have Q Q = I m , and R is an m × m upper triangular matrix with positive diagonal element.

The QR decomposition amounts to expressing the lth column of B in terms of the orthonormal basis vectors q 1 , ..., q l as

b l = l k=1 r k,l q k .
Here, q k b l = r k,l characterizes the component of b l collinear with q k . Furthermore, r l,l describes the component of b l which is orthogonal to the space spanned by b 1 , .., b l-1 , or, equivalently, by q 1 , ..., q l-1 . A basis vector b l is almost orthogonal to the space spanned by b 1 , .., b l-1 , if the absolute values of r 1,l , ..., r l-1,l are close to zero. If these elements of R are exactly zero, b l has no component in the direction of b 1 , .., b l-1 and is correspondingly orthogonal to the space spanned by these vectors. However, for general lattices such a strictly orthogonal basis does not exist and one has to settle for a basis satisfying less stringent criteria. Instead of GSO, many recent lattice reduction algorithms [START_REF] Wübben | Lattice reduction: A survey with applications in wireless communications[END_REF], [START_REF] Luk | An improved LLL algorithm[END_REF], [START_REF] Wübben | Nearmaximum-likehood detection of MIMO systems using MMSE-based lattice reduction[END_REF], [START_REF] Wübben | MMSE-based lattice reduction for near-ML detection of MIMO systems[END_REF], [START_REF] Morel | Using householder inside LLL[END_REF], [START_REF] Chang | Solving ellipsoïd-constrained integer least squares problems[END_REF] adopt the QR decomposition approach, since the QR decomposition can be performed more efficiently than the Gram-Schmidt orthogonalization. We have the following relations between QR decomposition and the Gram-Schmidt orthogonalization:

• q l = b * l b * l . • b * l = r l,l . • µ l,k = r k,l r k,k .
Another practical method will be used in this context, and it is called the "Cholesky factorization".

Definition. A symmetric matrix

A ∈ R n×n is positive definite if x Ax > 0 for all x = 0 Note that if A is an n × n symmetric matrix, then x Ax is the function x Ax = n i=1 n j=1 A ij x i x j = n i=1 A ii x 2 i + 2 i>j A ij x i x j
this is called "a quadratic form".

Definition (Cholesky Factorization). Every positive definite matrix A ∈ R n×n can be factored as

A = R R
where R is upper triangular matrix with positive diagonal elements.

We define now a fundamental quantity associated to any lattice, the determinant.

The Determinant

Given a basis B = [b 1 , ..., b m ] ∈ R n×m
, the fundamental parallelepiped associated to B is the set of points

P (B) = B [0, 1) m = m i=1 x i .b i : 0 ≤ x i < 1 .
P (B) is also a so-called fundamental region, i.e, a region that completely covers the span of B when shifted to all points of the lattice (for any x ∈ R n , there exists a unique lattice point v ∈ L (B), such that x ∈ (v + P (B)). Another important fundamental region is the Voronoi region, defined as the set of points in R n that are closer to the origin than to any other lattice point, V (L) := {x| x ≤ x -y for all y ∈ L} .

In contrast to the fundamental parallelepiped P (B), the Voronoi region V (L) is a lattice invariant, i.e., it is independent of the specific choice of a lattice basis. However, the volume (here, volume is defined in the m-dimensional space spanned by the columns of B) of P (B) is the same for all bases of a given lattice. This volume equals the so-called lattice determinant, which is a lattice invariant defined as the square-root of the determinant of the Gramian B B,

|L| := Vol (P (B)) = i b * i = det (B B),
                 b * 1 µ 21 b * 1 • • • µ m1 b * 1 0 b * 2 • • • µ m2 b * 2 . . . . . . . . . 0 • • • b * m-1 µ mm-1 b * m-1 0 • • • 0 b * m 0 • • • 0 0 . . . • • • . . . . . . 0 • • • 0 0                 
In the case n = m this is an upper-triangular square matrix. From this representation, it is easy to see that the volume of

P(b 1 , ..., b n ), or equivalently, det(L(b 1 , .., b n ))
, is given by n i=1 b i . If the lattice has full rank, the lattice determinant equals the magnitude of the determinant of the basis matrix B, i.e.,

|L| = |det (B)| .
Remember the Gram-Schmidt orthogonalization procedure ( ). In matrix notation, it shows that the orthogonalized vectors B * satisfy B = B * T , where T is an upper triangular matrix with 1's on the diagonal, and the µ i,j coefficients at position (j, i) for all j < i.So, our formula for the determinant of a lattice can be written as

det (B B) = det (T B * B * T ) = det (T ) det (B * B * ) det (T ).
The matrices T * , T are triangular, and its determinant can be easily computed as the product of the diagonal elements, which is 1. Now consider B * B * . This matrix is diagonal because the columns of B * are orthogonal. So, its determinant can also be computed as the product of the diagonal elements which is

det B * B * = i b * i , b * i = i b * i 2 = det (L (B)) 2 .
Taking the square root we get det (T ) det (B * B * ) det (T ) = det (L (B)) .

Complex-Valued Lattices

A complex-valued lattice of rank m in the n-dimension complex space C n is defined as

L = x | x = m l=1 z l b l , z l ∈ Z j ,
with complex basis vectors b l ∈ C n and Z j = Z + jZ denoting the set of complex integers (also known as Gaussian integers). By arranging the basis vectors into an n × m complex-valued matrix B and noticing that the complex mapping x = Bz can be equivalently expressed as

x = R (x) I (x) = R (B) -I (B) I (B) R (B) R (z) I (z) ,
In fact, since a m-dimensional complex lattice is isomorphic to a 2mdimensional real lattice, every decoding problem that has a complex lattice formulation can also be reformulated as a real lattice decoding problem. Many of the concepts and algorithms from the real-valued space can be formulated directly in the complex domain with minor modifications [START_REF] Ma | Lattice-reduction aided equalization for OFDM systems[END_REF], [START_REF] Seethaler | Efficient vector perturbation in multiantenna multi-user systems based on approximate integer relations[END_REF], [START_REF] Seethaler | Low-complexity MIMO detection using Seysen's lattice reduction algorithm[END_REF], [START_REF] Gan | Complex lattice reduction algorithm for low-complexity full-diversity MIMO detection[END_REF], [START_REF] Mow | Universal lattice decoding: A review and some recent results[END_REF], [START_REF] Gan | Complex lattice reduction algorithms for low-complexity MIMO detection[END_REF], [START_REF] Ling | Effective LLL reduction for lattice decoding[END_REF].

For example, let H = {h 1 , ..., h m } an n × m complex matrix, and the conjugate transpose (Hermitian) of a matrix H is denoted by H H . The inner product of two vectors h 1 and h 2 is defined as

h 1 , h 2 = h H 2 h 1 .
The set of orthogonal vectors generated by the Gram-Schmidt Orthogonalization procedure are represented as {h * 1 , ..., h * m } which span the same space as {h 1 , ..., h m }, and further

µ ij = h i , h * j h * j 2 ,
Note that working directly on the complex lattice can result in decoding algorithms with lower complexity, because the exploitation of the complex lattice structure allows the lattice dimension involved to be only half of that of the equivalent real lattice. Definition (The orthogonality Defect.). The "quality" of a lattice basis can be measured in terms of the orthogonality defect, defined as

δ (B) = 1 det (L (B)) m l=1 b l .
For any m×m positive definite matrix A with elements a k,l , the Hadamard inequality, [START_REF] Hadamard | Résolution d'une question relative aux détérminants[END_REF], states that det (A) ≤ m l=1 a l,l with equality if and only if A is diagonal. Setting A = B B this implies that the orthogonality defect is bounded from below as δ (B) ≥ 1, with equality if and only if B is orthogonal. Reduce a lattice basis means transform this lattice basis to an orthogonal one or constitute a basis where the lengths of the bases vector are close to successive minima. This is why some reductions are trying to imitate the orthogonalization of Gram-Schmidt.

Size Reduction

A rather simple but not very powerful criterion is given by the so-called "Size Reduction", often called weakly reduced. A basis B is size-reduced if the elements of the corresponding upper triangular matrix R satisfy the following condition:

|r kl | ≤ 1 2 |r kk | for 1 ≤ k < l ≤ m.
We can also say, a basis is called size-reduced if

|µ kl | ≤ 1 2 , for 1 ≤ i < j ≤ m where µ kl = b k , b l b l , b l .

Minkowski's Successive Minimum And Hermite's Constant

Let L be an m-dim lattice in R n . For 1 ≤ i ≤ m, the ith Minkowski's successive minimum, λ i (L), is the radius of the smallest closed ball centered at the origin containing at least i linearly independent lattice vectors.

λ i (L) = min (r, dim(B(0, r) ∩ L) ≥ i) .
In particular, λ 1 (L) is the Euclidean length of the shortest non zero lattice vector of L. In dimension 2, we say that a basis (b 1 , b 2 ) of a lattice L is reduced, if it takes out the first and the second minimum.

Proposition. The successive minima of a lattice are always reached, there always exist independent lattice vectors v i 's such that

v i 2 = λ i (L) , for all i
Proof. We consider an n-ball, B n , centered at the origin with radius r. r is large enough such that B n contains a non zero lattice vector. Therefore, there exists a non zero lattice vector of minimal length in D.

D = (L ∩ B n ) -{0}
Note that for m > 4, such vectors do not necessarily form a basis for L. Let us consider for example the following lattice, in dimension 5:

        2 0 0 0 1 0 2 0 0 1 0 0 2 0 1 0 0 0 2 1 0 0 0 0 1         .
This lattice contains the vector below:

V =         1 1 1 1 1         .
It is easy to notice that the successive minima are:

λ 1 = 2, λ 2 = 2, λ 3 = 2, λ 4 = 2, λ 5 = 2.
However, a family realizing these minimum, does not contain necessarily V , as for example:

        2 0 0 0 0 0 2 0 0 0 0 0 2 0 0 0 0 0 2 0 0 0 0 0 2        
Now, we are going to give Minkowski's theorem, which allows to finitely increase the minimum of a given lattice and to make the link between a simple invariant to calculate, the volume, and the successive minima.

Minkowski's Theorem

In this section, we consider the classical result of Minkowski, which, in some sense, originated the whole geometry of numbers.

Definition.

A set S ⊂ R n is said to be centrally-symmetric about the origin, if x ∈ S implies -x ∈ S. The set S is said to be convex, if for any x, y ∈ S, tx + (1 -t)y ∈ S for 0 ≤ t ≤ 1: that is S contains the line segment that passes through x and y.

Theorem (Blichfeldt,[START_REF] Blichfeldt | A new principle in the geometry of numbers, with some applications[END_REF]). For any full rank lattice L ⊂ R n and a measurable set S ⊂ R n with vol(S) > det(L), there exist distinct vectors

z 1 , z 2 ∈ S such that z 1 -z 2 ∈ L.
Proof. Let B be a basis of L. x ranges over all L, therefore, x + P(B) := {x + y : y ∈ P(B)} form a partition of R n , [START_REF] Shomonin | Minkowski's theorem and its application[END_REF]. Let us define S x = S ∩ (x + P(B)). Since S = x∈L S x , we deduce that vol(S) = x∈L vol(S x ). Now, consider the translates Ŝx = S x -x. Clearly, Ŝx ⊆ P(B). Now, we argue that these translates Ŝx cannot be pairwise disjoint. Indeed, since vol( Ŝx ) = vol(S x ), the total volume of all these sets is

x∈L vol( Ŝx ) = x∈L vol(S x ) = vol(S) > vol(P).
Therefore, there must exist some x, y ∈ L, x = y for which Ŝx ∩ Ŝy = ∅. Let z be a point in Ŝx ∩ Ŝy . Then, z + x ∈ S x ⊆ S, z + y ∈ S y ⊆ S, and (z + x) -(z + y) = x -y ∈ L.

We will give an upper bounds on the length of the shortest vector in a lattice. For this, we start by giving and proving a very important theorem (Minkowski's convex body theorem).

Theorem 3 (Minkowski's Convex Body Theorem). Let L be a full rank lattice of rank m. Then, for any centrally-symmetric convex set S, if vol(S) > 2 m det(L) then S contains a non-zero lattice point.

Proof. Let us define Ŝ = 1 2 S = {x : 2x ∈ S}. Then, vol( Ŝ) = 2 -m vol(S) > det(L). By Blichfeldt's theorem, there exist two points z 1 , z 2 ∈ Ŝ such that z 1 -z 2 ∈ L is a non zero lattice point. By definition, 2z 1 , 2z 2 ∈ S and because is centrally-symmetric, also -2z 2 ∈ S. Finally, since S is convex, 2z 1 -2z 2 2 = z 1 -z 2 is in S.
Theorem (The first theorem of Minkowski). Let L be a lattice of dimension m. Then, we have:

λ 1 (L) ≤ √ m vol (L) 1 m .
Proof. We first bound the volume of the ball B (0, r), for some radius r. This ball contains the hypercube

-r √ m , r √ m m
. Hence, its volume is greater than

2r √ m m . For r = √ m det(L) 1 m
, the volume of B(0, r) is greater than 2 m det(L), so by Minkowski's convex body theorem (see, theorem. 3), the ball contains a non zero lattice vector, and therefore, the length of the shortest vector is at most

√ m det(L) 1 m .
When the dimension remains small, we know explicitly the constant of Hermite, [START_REF] Bremner | Lattice basis reduction, An introduction to the LLL and its applications[END_REF]. It is the supremum of the following quantities as L ranges over all m-dimensional lattices:

γ m = max L, dim L=m λ 1 (L) vol(L) 1 m 2 ≤ m,
We notice that Hermite's lattice constant is used to scale the size of the first minimum λ 1 (L). However, finding the exact value of γ m is a very difficult problem, which plays a central role in the theory of geometry of numbers. The exact value of γ m is only known for 1 ≤ m ≤ 8 and m = 24, [START_REF] Nguyen | The LLL Algorithm: Survey and Applications[END_REF]. An upper bound of Hermite's constant is given in [START_REF] Nguyen | The LLL Algorithm: Survey and Applications[END_REF]:

γ m ≤ 1 + m 4
, for all m ≥ 1.

In the following table, we give the values known to date. The first theorem of Minkowski admits a stronger version, which allows to limit the product of the successive minimum. The above theorem easily generalizes to other minima.

Theorem (The second theorem of Minkowski.). Let L be a lattice of dimension m, then we have:

m i=1 λ i (L) ≤ γ m m vol(L) ≤ m m 2 vol(L).
Where λ i (L) is the length of the ith shortest vector.

Proposition. For every lattice basis B and its Gram-Schmidt orthogonalization B * ,

λ j (L(B)) ≥ min 1≤i≤m b * i . (2.1)
Proof. Note that b * i are not lattice vectors. Let us consider a generic lattice vector

Bx ∈ L(B) \ {0} , ( 2.2)
where x ∈ Z m \ {0} and let k be the biggest index such that x k = 0. We prove that

Bx ≥ b * k ≥ min i b * i . (2.3)
In order to prove (2.3), we take the scalar product of our lattice vector and

b * k . Using the orthogonality of b * k and b i (for i < k) we get Bx, b * k = i≤k b i x i , b * k = x k b k , b * k = x k b * k 2 . (2.4) By Cauchy-Schwarz inequality, i.e., | x, y | ≤ x y , Bx . b * k ≥ | Bx, b * k | ≥ |x k | . b * k 2 .
(2.5)

Using |x k | ≥ 1 and dividing by b * k , we get Bx ≥ b * k .

The Shortest vector problem and Sphere decoding algorithms

Minkowski's first theorem gives a simple way to bound the length λ 1 of the shortest non zero vector in a lattice L (B). In general λ 1 can be smaller than √ m det(B)

1 m where L(B) is a full rank lattice. For example, consider the two-dimensional lattice generated by orthogonal vectors b 1 = e 1 and b 2 = 1 e 2 . The determinant of the lattice is 1 and

λ 1 ≤ √ 2.
However λ 1 = can be arbitrarily small. Moreover, we know from Minkowski's theorem (see, Section. 2.2.7) that a shortest non zero vector exists, but it doesn't give any computational method to efficiently find vectors of length bounded by √ m det(L)

1 m , let alone vectors of length λ 1 . The problem of finding a lattice vector of length λ 1 is the well-known, shortest vector problem (SVP).

Definition (Shortest Vector Problem, SVP). Given a basis B ∈ R n×m , find a non zero lattice vector Bx (with x ∈ Z m \ {0}) such that Bx ≤ By for any other y ∈ Z m \ {0}.

The lack of efficient algorithms to solve SVP has led computer scientists to consider approximative versions of the problem.

The Closest Point And The Shortest Vector Problem

The Closest-Point problem is the problem of finding for a given lattice L and a given input point x ∈ R n , a vector ĉ ∈ L such that

x -ĉ ≤ x -c for all c ∈ L, (2.6)
where . denotes the Euclidean norm. The shortest vector problem is a special case of the closest point problem, the idea is to use x = 0 as the input and exclude 0 as a potential output,

min z =0 { Bz 2 | z = z i ∈ Z m } , ( 2.7)
where B is the lattice basis of L.

As already said, the shortest vector problem is to find a vector in L \ {0} that has the smallest Euclidean norm. Thus, the history of the shortest vector problem is closely linked with that of the closest point problem.

This problem was studied in a very intense way for more than 25 years. It has been conjectured [START_REF] Van Emde | Another NP-Complete partition problem and the complexity of computing short vectors in a lattice Rep[END_REF] that the shortest vector problem (with L ⊆ Z n ) is NP-hard, in other words, cannot be solved in polynomial time. But, in contrast to the closest point problem, this is still not proved. The conjecture of [START_REF] Van Emde | Another NP-Complete partition problem and the complexity of computing short vectors in a lattice Rep[END_REF] is supported by the result of Ajtai [START_REF] Ajtai | The shortest vector problem in L 2 is NP-hard for randomized reductions[END_REF] who showed that the shortest vector problem cannot be solved in polynomial time under randomized reductions. Micciancio [START_REF] Micciancio | The shortest vector in a lattice is NP-hard to approximate to within some constant[END_REF] furthermore proved that finding an approximate solution within any constant factor less than √ 2 cannot be also solved in polynomial time for randomized reductions. It is known [START_REF] Goldreich | Approximating shortest lattice vectors is not harder than approximating closest lattice vectors[END_REF], [START_REF] Henk | Note on shortest and nearest lattice vectors[END_REF], however, that the shortest vector problem is not harder than the closest vector problem.

Therefore, the answer to the question: "What is the best and fastest algorithm available to determine the shortest vector of a lattice?" is not immediately clear. The choice of a method for solving the shortest vector problem depends on the structure of the lattice. For many classical lattices, efficient search methods are known [START_REF] Conway | Sphere Packings, Lattices and Groups[END_REF], [START_REF] Vardy | Be'ery, Maximum-likelihood decoding of the Leech Lattice[END_REF]. Here, we address the problem for general lattices.

The first SVP algorithm was Gauss's reduction algorithm (details in Section. 2.4), which solves SVP exactly in dimension 2, in quadratic time. In arbitrary dimension, there are two types of SVP algorithms:

Exact algorithms These algorithms provably find a shortest vector, but they are expensive, with a running time at least exponential in the dimension. Intuitively, these algorithms perform an exhaustive search of all extremely short lattice vectors, whose number is exponential in the dimension (in the worst case): in fact, there are lattices for which the number of shortest lattice vectors is already exponential. Exact algorithms can be split into two categories: a) Polynomial-Space exact algorithms In general, the common feature of these deterministic algorithms is to first identify a region in which a shortest lattice point must lie, and then exhaustively search the lattice points lying in this region for the shortest non zero lattice vector, while possibly reducing the size of the region dynamically. They are based on enumeration which dates back to the early 1980s with work by Pohst [START_REF] Pohst | On the computation of lattice vectors of minimal length, successive minima and reduced bases with applications[END_REF], Fincke-Pohst [START_REF] Fincke | Improved methods for calculating vectors of short length in a lattice, including a complexity analysis[END_REF], and named sphere decoding algorithms, [START_REF] Agrell | Closest point search in lattices[END_REF], [START_REF] Schnorr | Lattice basis reduction: Improved practical algorithms and solving subset sum problems Mathematical Programming[END_REF], [START_REF] Pohst | On the computation of lattice vectors of minimal length, successive minima and reduced bases with applications[END_REF], [START_REF] Fincke | Improved methods for calculating vectors of short length in a lattice, including a complexity analysis[END_REF], [START_REF] Viterbo | A universal lattice code decoder for fading channels[END_REF], in which they examined lattice points lying inside a hypershere. Also, we have algorithms based on Kannan's strategy, [START_REF] Kannan | Improved algorithms for integer programming and related lattice problems[END_REF], [START_REF] Helfrich | Algorithms to construct Minkowski reduced and Hermite reduced lattice bases[END_REF], [START_REF] Kannan | Minkowski's convex body theorem and integer programming[END_REF], [START_REF] Banihashemi | On the complexity of decoding lattices using the Korkine-Zolotarev reduced basis[END_REF]. Let {b 1 , .., b m } be a basis for an m-dim lattice L and let π 2 (.) be an orthogonal projection operator which projects ". . Then the shortest lattice point must lie in a parallelepiped of cardinality no more than m 0.5m+O (1) and can thus be found by enumerating this finite set (see, [START_REF] Kannan | Improved algorithms for integer programming and related lattice problems[END_REF]). It is proved in [START_REF] Helfrich | Algorithms to construct Minkowski reduced and Hermite reduced lattice bases[END_REF], [START_REF] Kannan | Minkowski's convex body theorem and integer programming[END_REF] that algorithms based on Kannan's strategy require a complexity of m 0.5m+O(m) polynomial-time operations. Variants of Kannan's [START_REF] Kannan | Improved algorithms for integer programming and related lattice problems[END_REF], [START_REF] Helfrich | Algorithms to construct Minkowski reduced and Hermite reduced lattice bases[END_REF], [START_REF] Kannan | Minkowski's convex body theorem and integer programming[END_REF], [START_REF] Banihashemi | On the complexity of decoding lattices using the Korkine-Zolotarev reduced basis[END_REF] differ mainly in how the size of the search region for each iteration level are chosen. b) Exponential-Space exact algorithm These algorithms have a better asymptotic running time, but they all require exponential space 2 O(m) . The first algorithm of this kind is the randomized sieve algorithm of Ajtai, Kumar and Sivakumar (AKS), [START_REF] Ajtai | A Sieve algorithms for the shortest lattice vector problem[END_REF], with exponential worst-case complexity of 2 O(m) polynomial-time operations. Micciancio and Voulgaris [START_REF] Micciancio | A deterministic single exponential time algorithm for most lattice problems based on Voronoi cell computations[END_REF] presented an alternative deterministic algorithm, which solves both CVP and SVP within 2 2m+O(m) polynomial-time operations. Interestingly, there are several heuristic variants [START_REF] Hanrot | Algorithms for the shortest and closest lattice vectors problems[END_REF], [START_REF] Nguyen | Sieve algorithms for the shortest vector problem are practical[END_REF], [START_REF] Micciancio An | Faster exponential time algorithms for the shortest vector problems[END_REF], [START_REF] Wang | Improved Nguyen-Vidick heuristic sieve algorithms for shortest vector problem[END_REF] of AKS with running time 2 O(m) , where O(.) constant, is much less than that of the best provable algorithms known, resulting in the List Sieve algorithms of Micciancio and Voulgaris [START_REF] Micciancio An | Faster exponential time algorithms for the shortest vector problems[END_REF]. Currently, the fastest provable variant of lattice sieving runs in time 2 2.465m+O(m) and space 2 1.325m+O(m) , [START_REF] Pujol | Solving the shortest lattice vector problem in time 2 2.465n[END_REF], (see [START_REF] Laarhoven | Finding shortest lattice vectors faster using quantum search[END_REF] for a quantum acceleration). In practice, heuristic variants of the lattice sieving algorithms are found to be more efficient. Nguyen and Vidick [START_REF] Nguyen | Sieve algorithms for the shortest vector problem are practical[END_REF] exhibited a version of AKS that can be heuristically argued correct and which requires a running-time of (4/3) m+O(m) ≈ 2 0.4150m+O(m) and space of (4/3) m/2+O(m) ≈ 2 0.2075m+O(m) . Micciancio and Voulgaris [START_REF] Micciancio An | Faster exponential time algorithms for the shortest vector problems[END_REF] later proposed a heuristic variant of their ListSieve algorithm, namely the GaussSieve algorithm. In practice, the GaussSieve seems to perform well compared to the other variants [START_REF] Micciancio An | Faster exponential time algorithms for the shortest vector problems[END_REF]. It has been investigated further in a series of works (see, e.g., [START_REF] Fitzpatrick | Tuning GaussSieve for speed[END_REF]). The GaussSieve algorithm is one of the most promising candidates for lattice sieving algorithms in practice.

Nearest neighbor search techniques have been used to accelerate heuristic sieving algorithms further. The technique was first used in the context of lattice sieving by Laarhoven in [START_REF] Laarhoven | Sieving for shortest vectors in lattices using angular locality-sensitive hashing[END_REF]. Currently, the best variant is due to Becker, Ducas, Gama, and Laarhoven [START_REF] Becker | New directions in nearest neighbor searching with applications to lattice sieving[END_REF], which has a time complexity of(3/2) m/2+O(m) ≈ 2 0.2925m+O(m) and space complexity (4/3) m/2+O (m) .

Recently, Bai, Laarhoven and Stehlé, [START_REF] Bai | Tuple Lattice Sieving[END_REF], propose tuple variants for the ListSieve and GaussSieve algorithms which they call TupleSieve and TupleMinkowskiSieve, whose memory footprint is smaller than 2 0.2075m+O(m) . The main idea is to attempt to create shorter vectors by looking at triples, quadruples, etc. of vectors rather than pairs of vectors. For triples of vectors, they estimate the space complexity by 2 0.1887m+O(m) and for the quadruples, the space complexity is about 2 0.1724m+O(m) .

Approximation algorithms These algorithms are much faster than exact algorithms, but they output short lattice vectors, not necessarily the shortest ones: they typically produce a whole reduced basis, and are therefore lattice reduction algorithms. The first algorithm of this kind is the celebrated algorithm of Lenstra, Lenstra and Lovasz (LLL) [START_REF] Lenstra | Factoring Polynomials With Rational Coefficients[END_REF], which can approximate SVP to within a factor of O((2/ √ 3) m ) in polynomial time. The efficiencies of the three strategies were compared in [START_REF] Nguyen | Sieve algorithms for the shortest vector problem are practical[END_REF], [START_REF] Zhang | Practical HKZ and Minkowski Lattice Reduction Algorithms[END_REF], and simulation results in [START_REF] Nguyen | Sieve algorithms for the shortest vector problem are practical[END_REF], [START_REF] Micciancio An | Faster exponential time algorithms for the shortest vector problems[END_REF], suggest that for lattices of dimension less than 40, the sphere decoding algorithm using the SE (Schnorr-Euchner enumeration) [START_REF] Schnorr | Lattice basis reduction: Improved practical algorithms and solving subset sum problems Mathematical Programming[END_REF] is the most efficient algorithm.

We give a table that summarizes the best known fully analyzed algorithms. We denote by "T", (respectively. "S" and "P or D"), the "Time upper bound" (respectively, the "Space upper bound", "Probabilistic or Deterministic algorithm"). T S P or D via enumeration [START_REF] Hanrot | Improved analysis of Kannan's shortest lattice vector algorithms[END_REF][START_REF] Hanrot | Worst-case Hermite-Korkine-Zolotarev reduced lattice bases[END_REF] 2+O(m) poly(m) Deterministic via Sieving [START_REF] Pujol | Solving the shortest lattice vector problem in time 2 2.465n[END_REF] 2 2.247m+O(m) 2 1.325m+O(m) Probabilistic via Voronoi Cell [START_REF] Micciancio | A deterministic single exponential time algorithm for most lattice problems based on Voronoi cell computations[END_REF] 2 2m+O(m) 2 m+O(m) Deterministic via Gaussians [START_REF] Micciancio An | Faster exponential time algorithms for the shortest vector problems[END_REF] 2 m+O(m) 2 m+O(m) Probabilistic

m m/

The Sphere Decoding Algorithms

Idea Behind The Sphere Decoder

The basic premise in Sphere decoding is rather simple: we attempt to search over only lattice points that lie in a certain sphere of radius ρ around the given vector x, here in our case x = 0, thereby reducing the search space and hence the required computations. Clearly, the shortest lattice vector inside the sphere will also be the shortest lattice vector for the whole lattice. However, close scrutiny of this lattice basic idea leads to two key questions:

How to choose ρ? Clearly, if ρ is too large, we obtain too many points and the search remains exponential in size, whereas if ρ is too small, we obtain no points inside the sphere.

We have already seen that Minkowski's theorem (see Section. 2.2.7) gives us a simple way to bound the length of the shortest non zero vector. However, √ m det(L) 1 m can be too large and produces an exponential-time complexity. A natural candidate for ρ is the covering radius of the lattice, defined to be the smallest radius of spheres centered at the lattice points that cover the entire space. This is clearly the smallest radius that guarantees the existence of a point inside the sphere for any vector x. The problem with this choice of ρ is that determining the covering radius for a given lattice cannot be solved in polynomial time, [START_REF] Conway | Sphere Packings, Lattices and Groups[END_REF]. Another choice is to use ρ as the distance between the Babai estimate (found by the Babai nearest plane algorithm [START_REF] Babai | On Lovász Lattice reduction and the nearest lattice point problem[END_REF]. This Babai estimate can be easily obtained by first, finding the real solution for the triangular system Rz = x, which is the real least squares solution for the problem min x -Bz 2 2 , then round the entries of z to their nearest integers to obtain the lattice point, z = z ∈ Z m ) and the vector x, i.e., ρ = x -Bz . However, Zhao and Qiao [START_REF] Zhao | Radius Selection Algorithms For Sphere Decoding[END_REF] have showed that this method may produce a too small radius and cause sphere decoding to fail to find a solution. Note also that in the case of searching the shortest lattice vector, this distance will be zero.

How can we know which lattice points are inside the sphere? If this means testing the distance of each lattice point from x (to determine whether it is less than ρ), then there is no point in sphere decoding as we will still need an exhaustive search. A natural candidate for ρ is b 1 2 . However, it does propose an efficient way to answer the second. The basic observation is the following: Although it is difficult to determine the lattice points inside a general m-dimensional sphere, it is trivial to do so in the (one-dimensional) case of m = 1. The reason is that a one-dimensional sphere is simply an interval and so the desired lattice points will be the integer values that lie in this interval. We can use this observation to go from dimension k to dimension k + 1. Suppose we have determined all k-dimensional lattice points that lie in a sphere of radius ρ. Then for any such k-dimensional point, the set of admissible values of the k + 1th-dimensional coordinate that lie in the higher dimensional sphere of the same radius ρ forms an interval. This means that we can determine all lattice points in a sphere of dimension m and radius ρ by successively determining all lattice points in spheres of lower dimensions 1, 2, ..., m and the same radius ρ (see, below).

The Algorithms for SVP

Let ρ be the radius of the initial search sphere in which at least one shortest lattice point must lie. The sphere of radius ρ and centered at 0 in (2.7) can be defined as

S = z | Bz 2 2 < ρ 2 , ( 2.8)
Such hypersphere search strategy was firstly presented in [START_REF] Pohst | On the computation of lattice vectors of minimal length, successive minima and reduced bases with applications[END_REF] and further improved in [START_REF] Agrell | Closest point search in lattices[END_REF], [START_REF] Schnorr | Lattice basis reduction: Improved practical algorithms and solving subset sum problems Mathematical Programming[END_REF], [START_REF] Fincke | Improved methods for calculating vectors of short length in a lattice, including a complexity analysis[END_REF], [START_REF] Viterbo | A universal lattice code decoder for fading channels[END_REF]. To learn the strategy of the hypersphere enumeration, we shall present a recursive version of the sphere decoding algorithms in this section.

Let R = chol(B B) be the Cholesky factorization of B B, then (2.8) can be transformed into Rz 2 2 < ρ 2 , (2.9)

Since R is an upper triangular matrix, we can rewrite the condition (2.9) as

m i=1   m j=i r i,j z j   2 < ρ 2 . (2.10)
where r i,j , j ≥ i, denotes the (i, j)th entry of R. The above inequality can then be expanded to

(r m,m z m ) 2 + (r m-1,m-1 z m-1 + r m-1,m z m ) 2 + ...... < ρ 2 , (2.11)
the first entry of Rz is a function of z m only. We can see that a necessary condition for Rz lying in the hypersphere of radius ρ is (r m,m z m ) 2 ≤ ρ 2 which is equivalent to the following condition for entry z m :

l m = - ρ r m,m ≤ z m ≤ ρ r m,m = u m . Partition R into R m-1 h 0 r m,m where R m-1 ∈ R (m-1)×(m-1) , h ∈ R m-1 . Then for each integer value of z m , the m-dimensional SVP (2.7) is reduced to an (m -1)-dimensional CVP. min R m-1 z + z m h 2 : z ∈ Z m-1 , (2.12)
with a solution lying in the (m -1)-dimensional hypersphere

R m-1 z + z m h 2 2 ≤ ρ 2 -z 2 m r 2 m,m , (2.13)
Therefore, an m-dimensional SVP can be reduced to a finite number (at most 2ρ rm,m + 1) of (m -1)-dimensional CVPs, leading to a recursive algorithm. In summary, we unite Pohst's strategy [START_REF] Pohst | On the computation of lattice vectors of minimal length, successive minima and reduced bases with applications[END_REF], [START_REF] Fincke | Improved methods for calculating vectors of short length in a lattice, including a complexity analysis[END_REF], [START_REF] Viterbo | A universal lattice code decoder for fading channels[END_REF] and Schnorr-Euchnerr strategy [START_REF] Agrell | Closest point search in lattices[END_REF], [START_REF] Schnorr | Lattice basis reduction: Improved practical algorithms and solving subset sum problems Mathematical Programming[END_REF] in the same framework, and present a recursive implementation (see below, details about the recursion implementation). Clearly, a shortest non zero lattice vector can be found by calling Algorithm Sph-Dec (R, 0, ∅, r, 0).

Details About the Recursive Implementation.

Let

c m = 0, c k =   m j=k+1 r k,j z j   /r k,k , for k such that m -1 ≤ k ≤ 1. (2.14)
Note that c k depends on z k+1 , ..., z m . Substituting (2.14) in (2.10), we have

m k=1 r 2 k,k (z k -c k ) 2 < ρ 2 .
(2.15)

If z satisfies the bound, then it must also satisfy inequalities

level k : r 2 k,k (z k -c k ) 2 < ρ 2 - m i=k+1 r 2 i,i (z i -c i ) 2 .
(2.16)

The search process starts at level m and moves down to level 1. At level k,

z k is determined for m -1 ≤ k ≤ 1. From (2.16), the range of z k is [ k , u k ],
where

k =      c k -   ρ 2 - m i=k+1 r 2 i,i (z i -c i ) 2   1 2 /r k,k     
and

u k =     c k +   ρ 2 - m i=k+1 r 2 i,i (z i -c i ) 2   1 2 /r k,k      .
There are two typical strategies to examine the integers inside [ k , u k ]. In the Pohst strategy, the integers are chosen in the ascending order

k , k + 1, k + 2, ...., u k .
However, in the Schnorr-Euchner strategy, the integers are chosen in the zig-zag order

z k =    c k , c k -1, c k + 1, c k -2, ..., if c k ≤ c k c k , c k + 1, c k -1, c k + 2, ..., if c k ≥ c k .
In fact, Schnorr-Euchner strategy combines the advantages of the Babai nearest plane algorithm and the Pohst strategy (when the radius ρ is immediately updated every time a lattice point inside the sphere is found).

Observe that in Schnorr-Euchner strategy, once an integer z k does not satisfy (2.16), all the following integers in the sequence will not satisfy it. These integers can be pruned from the search process. Such a property does not exist in the Pohst strategy. Another benefit with the Schnorr-Euchner enumeration order is that the first points examined are more likely to minimize (2.16) than the last points examined. As will be seen in the next paragraph, this allows to shrink the search hypersphere faster. Simulations in [START_REF] Agrell | Closest point search in lattices[END_REF] confirm that the Schnorr-Euchner strategy is more efficient than the Pohst strategy.

We now describe the search process using the Schnorr-Euchner strategy. At level m, we set z m = 0. If (2.16) at level k = m is not satisfied, no integer can satisfy (2.15). Otherwise, we go to level m -1, compute c m-1 and set z m-1 = c m-1 . If (2.16) does not hold, we go back to level m and choose z m to be the second nearest integer to c m . Otherwise, we move down to level m -2. When we reach level 1, we compute c 1 and set z 1 = c 1 . Then if (2.16) at level k = 1 is satisfied, we set ẑ = [z 1 , ..., z m ] , where ẑ is a full integer point inside the search hypersphere. We update ρ by setting Note that the efficiency of the sphere decoding algorithm is closely related to the structure of the lattice basis.

l = ρ 2 = m k=1 r 2 k,k (ẑ k -c k ) 2 = nd.
Thus, an appropriate preprocessor, such as the LLL algorithm, is useful. The LLL algorithm [START_REF] Lenstra | Factoring Polynomials With Rational Coefficients[END_REF] can be used to reduce the computational complexity in two ways:

First, it can be used to reduce the radius of the search sphere by reducing the norm of R. Second, the sphere decoding is a depth-first searching (i.e., an algorithm that constructs a tree to obtain a solution) for the lattice points inside a sphere, the LLL algorithm can be used to reduce the total number of search paths. Thus, the performance of the sphere decoding algorithm can be further improved for LLL reduced bases.

Algorithm 1 Sphere-Dec (R, x, z in , r, dist)

Input: R ∈ R m×m , a vector x = [x i ] ∈ R m to decode, an integer partial solution z in , the current distance record r and the distance to the examined layer dist.

Output: a solution z ∈ Z m and = Rz -

x 2 2 . LB ← - √ r-dist+xm rm,m , UB ← √ r-dist+xm rm,m ; ← r, z ← ∅; if LB ≤ UB then for each integer s lying in [LB, UB] do newdist ← dist + (x m -s.r m,m ) 2 ; if newdist ≤ then ẑin ← [s; z in ] ; if m > 1 then x ← x (1 : m -1) -s × R (1 : m -1, m) ; [z , ] ← Sph-Dec (R m-1 , x, ẑin , , newdist) ; if ≤ then ← , z ← z ; end if else if newdist = 0 then z ← ẑin , ← newdist; end if end if end if end for end if
Obviously, a shortest non zero vector can be found by calling Algorithm Sph-Dec(R, 0, ∅, r, 0) see Algorithm 1. We notice, one m-dimensional problem can be solved recursively by reducing it to at most 2 √ r/r m,m + 1 (m -1)dimensional sub-problems. The size of the search region is reduced dynamically (however, the algorithms based on the Kannan strategy scan all the (m -1)-dimensional sub-lattices with the same value of ρ). That is, when any lattice point Rz inside the search region is found, the squared radius can be reduced to Rz 2 2 , since Rz 2 2 < . Therefore, not all the 2 √ r/r m,m +1 (m -1)-dimensional sub-problems are necessarily to be solved in practice.

Note that the last condition "if newdist = 0" is to make sure that the lattice points being searched are non zero. The above algorithm can be applied to solve general CVP, by deleting this last condition.

The complexity of the sphere decoding algorithms was discussed in [START_REF] Hassibi | On the sphere-decoding algorithm I: Expected complexity[END_REF], [START_REF] Jaldén | On the complexity of sphere decoding in digital communications[END_REF], [START_REF] Nguyen | Sieve algorithms for the shortest vector problem are practical[END_REF].

The efficiency of the three strategies were compared in [START_REF] Nguyen | Sieve algorithms for the shortest vector problem are practical[END_REF]. In general, for lattices of small dimensions, the sphere decoding using Schnorr-Euchner enumeration is the fastest. Simulation results in [START_REF] Nguyen | Sieve algorithms for the shortest vector problem are practical[END_REF], [START_REF] Micciancio An | Faster exponential time algorithms for the shortest vector problems[END_REF] illustrate that for lattices of dimension m ≤ 40, Schnorr-Euchner enumeration provides the most efficient algorithm.

Lattice reduction:

The history of reduction theory begins in the Euclidean era about 300 BC when the Euclidean algorithm was introduced to compute the greatest common divisor of two integers. A lattice basis reduction algorithms is analogous to Euclid's GCD algorithm. A formal study of integer lattices was initiated in the 18th century by Lagrange, Gauss, Hermite and others. However, little progress was made. As computers became more powerful towards the middle of the 20th century, researchers contributed extensive work to lattices. The development of lattice basis reduction began in 1773 by Lagrange, [START_REF] De Lagrange | Recherches d'arithmétique[END_REF]. He had presented the first algorithm for constructing a reduced bases for lattices of dimension two. The algorithm takes a two-dimensional basis matrix B as input and successively performs column swaps and size reduction until a Gauss reduced basis is obtained where b 1 ≤ b 2 and the properties of a size reduced basis are satisfied. Then this algorithm was extended to dimensions three by Vallée in 1986 and Semaev in 2001 [START_REF] Vallée | Une approche géométrique de la réduction des réseaux en petite dimension[END_REF] [164]: Semaev's algorithm is quadratic without fast integer arithmetic, whereas Vallée's algorithm has cubic complexity. An extension to dimension four by Nguyen and Stehlé [START_REF] Nguyen | Low dimensional basis reduction revisited[END_REF] was named "greedy algorithm". This implies that a shortest vector and a HKZ reduced basis can be computed in quadratic time up to dimension four. More generally, Helfrich [START_REF] Helfrich | Algorithms to construct Minkowski reduced and Hermite reduced lattice bases[END_REF] and Afflerbach and Grothe [START_REF] Afflerbach | Calculation of Minkowski-reduced lattice bases[END_REF] presented algorithms for lattices of arbitrary dimension. A variant of Kannan's strategy was proposed in [START_REF] Helfrich | Algorithms to construct Minkowski reduced and Hermite reduced lattice bases[END_REF]. Hence, like Kannan's algorithm [START_REF] Kannan | Improved algorithms for integer programming and related lattice problems[END_REF], [START_REF] Kannan | Minkowski's convex body theorem and integer programming[END_REF], Helfrich's algorithm is also intended rather as a theoretical result than as a practical tool and its runtime is exponential, but polynomial for fixed dimension. However, Afflerbach and Grothe handled this problem in a different way: let p be the pth stage of the reduction process, starting from p = 1, this algorithm first performs Pohst enumeration [START_REF] Fincke | Improved methods for calculating vectors of short length in a lattice, including a complexity analysis[END_REF], [START_REF] Pohst | On the computation of lattice vectors of minimal length, successive minima and reduced bases with applications[END_REF] and during the search process, whenever an intermediate lattice point B p z inside the search process satisfying the gcd conditions (gcd(z p , ..z m ) = 1), for m > 7 or z p = 1 for m ≤ 7, is found, the pth column of B p is then replaced by B p z and the algorithm is restarted from p = 1. On the other hand, if the pth column of B p is already the shortest lattice point satisfying the corresponding gcd constraint, we set p = p + 1 and repeat the above process. The algorithm terminates when p = m + 1. Note that the number of lattice points enumerated by Pohst's strategy grows exponentially with the dimension m. Therefore, in practice the algorithm in [START_REF] Afflerbach | Calculation of Minkowski-reduced lattice bases[END_REF] is restarted many times and the complexity becomes prohibitive quickly as the dimension increases.

Gauss Reduction.

The reduction method introduced by Gauss in the context of binary quadratic forms is restricted to lattices of rank m = 2, [START_REF] Gauss | Untersuchungen über höhere Arithmetik[END_REF], which is a natural generalization of the centered Euclidean algorithm, [START_REF] Vallée | Gauss's algorithm revisited[END_REF]. For such two-dimensional lattices, Gauss reduction constructs a basis that fulfills the reduction criteria introduced by Minkowski and HKZ.

In addition to size reduction, Gauss reduction also includes column swapping operations. In particular, after first size reducing the given basis matrix B, the columns of the resulting basis B = b1 , b2 are swapped if the length of b1 is larger than that of b2 and the resulting basis is again size-reduced. This process of successive size reduction and column swapping operations is repeated until the length of b1 is shorter, after the preceding size reduction step, than that of b2 , which implies that no further column swapping operation is performed.

After a finite number of iterations, this algorithm provides a Gauss reduced basis B, where b1 ≤ b2 and the properties of a size reduced basis are satisfied. In particular, b1 and b2 are the two shortest vectors in the lattice L that form a basis for L.

Minkowski Reduction. Definition 7.

A lattice generator matrix B := [b 1 , ..., b m ] is called Minkowski reduced if for all 1 ≤ i ≤ m, the vector b i has the minimum norm among all lattice vectors b i such that {b 1 , ..., b i } can be extended to a basis for L (B), [START_REF] Minkowski | Über die positiven quadratischen Formen und über kettenbruchähnliche Algorithmen[END_REF].

From [START_REF] Van Der Waerden | Studien Zur Theorie der Quadratischen Formen[END_REF], [START_REF] Krieg | Primitive minima of positive definite quadratic forms[END_REF], the length of each Minkowski reduced basis vector can be bounded by

λ 2 i (L) ≤ b i 2 2 ≤ max 1, 5 4
(m-4)

λ 2 i (L) , 1 ≤ i ≤ m;
(2.17)

m i=1 b i 2 ≤ γ m 2 m vol (L) , for m ≤ 4; (2.18) m i=1 b i 2 ≤ γ m 2 m 5 4
(m-3)(m-4) 4 vol (L) , for m > 4. (2.19)
From (2.17), we deduce that for lattices of dimension m ≤ 4, the norms of Minkowski reduced basis vectors reach strongly Minkowski's successive minima. However, in high dimensions, there does not necessarily exist a Minkowski reduced basis whose vector norms achieve Minkowski's successive minima. Furthermore, from (2.19) and the Hermite constant, we find that the orthogonality defect of a Minkowski reduced basis is bounded by a constant depending only on the rank of the given lattice. ≤ i ≤ m, and all integers x i , ..., x m such that gcd(x i , .., x m ) = 1, we have:

x 1 b 1 + ..... + x m b m ≥ b i ;
With the above statement, one might think that to ensure that a given basis is Minkowski reduced, there are infinitely many conditions to be checked. Fortunately, it is sufficient to check a finite subset of them. This result is noted as the second finiteness theorem in [START_REF] Siegel | Lectures on the Geometry of Numbers[END_REF]. Several sufficient sets of conditions are possible. We call a such a subset with minimal cardinality, Minkowski conditions.

For dimensions m ≤ 6, Minkowski stated a finite number of conditions that a quadratic form is Minkowski reduced. In the m ≤ 4 case, he published a proof in [122]. The proofs in the m = 5 and m = 6 cases can be found in [START_REF] Afflerbach | Minkowskische Reduktionsbedingungen für positiv definite quadratische Formen in 5 Variablen[END_REF], [START_REF] Ryshkov | On the reduction theory of positive quadratic form[END_REF], [START_REF] Ryshkov | The theory of Hermite-Minkowski reduction of positive definite quadratic forms[END_REF], [START_REF] Tammela | On reduction theory of positive quadratic forms, Studies in number theory. Part 3[END_REF], [START_REF] Tammela | The Hermite-Minkowski domain of reduction of positive definite quadratic forms in six variables[END_REF]. Corresponding conditions for the case m = 7 were stated and proved in [START_REF] Tammela | Minkowski reduction region for positive quadratic forms in seven variables[END_REF]. But for m ≥ 8 no similar conditions are known to date. Therefore, in low dimension, one can check quickly for m ≤ 7 if a basis is reduced in the sense of Minkowski by checking these conditions.

Naturally the dimension is limited by m = 7. However, in this case already over 90000 conditions have to be checked. Therefore, there is a need for an algorithm which calculates Minkowski reduced bases in acceptable computation time for even greater dimension. Note that for each b i , there are more than one shortest vector available (-b i for example). So when we refer to a minimal basis, we mean one among many available minimal bases. As a special case, when L has a basis consisting of orthogonal vectors, it is automatically a reduced basis. In the general case, a reduced basis is the closest to an orthogonal basis that a lattice can have. [START_REF] Tammela | On reduction theory of positive quadratic forms, Studies in number theory. Part 3[END_REF], [START_REF] Tammela | Minkowski reduction region for positive quadratic forms in seven variables[END_REF]) Let m ≤ 6. A lattice generator matrix B := [b 1 , ...., b m ] is a Minkowski reduced basis if and only if for all 1 ≤ i ≤ m and for all integers x i , ....., x m satisfying the three conditions below, we have:

Theorem. (Minkowski conditions

x 1 b 1 + ..... + x m b m ≥ b i ;
1. The integers x i , ..., x m are relatively prime; 2. For some permutation σ ∈ S m , x σ(1) , ...., x σ(m) appears in the list below (where empty places can be counted as zeros);

2 1 1 3 1 1 1 4 1 1 1 1 5 1 1 1 1 1 1 1 1 1 2 6 1 1 1 1 1 1 1 1 1 1 1 2 1 1 1 1 2 2 1 1 1 1 2 3 7 1 1 1 1 1 1 1 1 1 1 1 1 1 2 1 1 1 1 1 1 3 1 1 1 1 1 2 2 1 1 1 1 1 2 3 1 1 1 1 2 2 2 1 1 1 1 2 2 3 1 1 1 1 2 2 4 1 1 1 1 2 3 3 1 1 1 1 2 3 4 1 1 1 2 2 2 3 1 1 1 2 2 3 4
Moreover, this list is minimal, which means that if a table row is rejected, then a basis satisfy the remaining conditions without being a Minkowski reduced basis.

We have already seen that Minkowski proved a result saying that we only need to check a finite number of inequalities. This is most conveniently expressed in terms of the Gram matrix associated to the basis. Call B the m × m matrix having b i s as columns, then the Gram matrix Q = B B has entries

q ij = q ji = b i , b j . Q is a positive definite matrix.
Theorem (Minkowski, see [START_REF] Siegel | Lectures on the Geometry of Numbers[END_REF][START_REF] Gruber | Geometry of numbers[END_REF]). Given m linearly independent vectors B = b 1 , ..., b m in R m . Let L be the lattice generated by B and Q be the Gram matrix with q ij = b i , b j . Then B is a reduced basis for L if and only if the q ij entries satisfy a set of linear inequalities, which only depend on the dimension m.

We call any symmetric matrix Q satisfying such inequalities a "reduced or Minkowski" reduced form. Reduction in R 2 is particularly simple and was known to Gauss. In this case,

M = a b b c is Minkowski reduced when a ≤ c and 2 |b| ≤ a, these correspond to the inequalities b 1 2 ≤ b 2 2 and 2 | b 1 , b 2 | ≤ b 1 2 .
A more geometric way to look at the second inequality is

b 2 ≤ b 1 -b 2 and b 2 ≤ b 1 + b 2 ,
together with b 1 ≤ b 2 , these are exactly the finite collection of inequalities for m = 2.

In dimension 3, a basis is Minkowski reduced if and only if we have the following inequalities:

b 1 ≤ b 2 ≤ b 3 b 1 + b 2 ≥ b 2 b 1 -b 2 ≥ b 2 b 1 + b 3 ≥ b 3 b 1 -b 3 ≥ b 3 b 2 + b 3 ≥ b 3 b 2 -b 3 ≥ b 3 b 1 + b 2 + b 3 ≥ b 3 b 1 + b 2 -b 3 ≥ b 3 b 1 -b 2 + b 3 ≥ b 3 b 1 -b 2 -b 3 ≥ b 3 .
It was shown in [START_REF] Barnes | On Minkowski reduction of positive quaternary quadratic forms[END_REF] that a (4 × 4) positive definite matrix is Minkowski reduced when it verifies the following 39 reduction conditions:

M =      a 11 a
• a 11 ≤ a 22 ≤ a 33 ≤ a 44 ;

• For each 1 < i < 4, we must have x M x ≥ a ii for any A lattice basis of dimension m that reaches successive minima is necessarily Minkowski reduced, but the inverse isn't true. On the other hand, it still reaches the first four minimum [START_REF] Van Der Waerden | Studien Zur Theorie der Quadratischen Formen[END_REF] :

x = {x 1 , x 2 , x 3 , x 4 } satisfying x i = 1, x j = 0 if j > i, x j ∈ {0, 1, -1} if j < i,
If [b 1 , ..., b m ] is Minkowski reduced, then for all 1 ≤ i ≤ min(m, 4), we have b i = λ i (L). Thus, a Minkowski reduced basis is optimal in a very natural way up to dimension 4.

LLL Reduction.

In 1982, a central tool in the algorithmic study of lattices (and their applications) appears, the LLL algorithm of Lenstra, Lenstra and Lovász, which generalizes an old algorithm due to Gauss for reducing lattices of rank 2 to dimensions m ≥ 2, performed a sequence of steps, each being a translation step, or a swap step. It is a polynomial time algorithm that finds a non zero vector in an m-dimensional lattice that is guaranteed to be at most O((2/ √ 3) m )-times the length of the shortest non zero vector in that lattice.

This notion of reduction, although not perfect, has solved many problems. After this publication, many results appeared. For example, Kannan provided an algorithm (not polynomial time) for finding the shortest vector of a lattice, from a reduced basis in the sense of Lovász. Babai extends this algorithm to the search of the closest lattice point to a given arbitrary point.

The performance of the LLL algorithm has been further improved by suitable modifications [START_REF] Euchner | Praktische Algorithmen Zur Gitterreduktion Und Faktorisierung[END_REF], [START_REF] Lamacchia | Basis Reduction Algorithms And Subset Sum Problems[END_REF], [START_REF] Radziszowski | Solving Subset Problems With The LLL algorithm[END_REF], and new algorithms were invented [START_REF] Lovász | The generalized basis reduction algorithms[END_REF], [START_REF] Schnorr | A hierarchy of polynomial lattice basis reduction algorithms[END_REF], [START_REF] Schnorr | A more efficient algorithms for lattice basis reduction[END_REF], [START_REF] Seysen | Simultaneous reduction of a lattice basis and its reciprocal basis[END_REF], [START_REF] Brun | En generalisation av kjederbrøken I[END_REF], [START_REF] Brun | En generalisation av kjderbrøken II, Skv.Vidensk. Selsk. Kristiana[END_REF], [START_REF] Clarkson | Approximation of linear forms by lattice points with applications to signal processing[END_REF].

Seysen [START_REF] Seysen | Simultaneous reduction of a lattice basis and its reciprocal basis[END_REF], [START_REF] Wübben | Lattice reduction: A survey with applications in wireless communications[END_REF] and Schnorr [START_REF] Schnorr | A hierarchy of polynomial lattice basis reduction algorithms[END_REF], [START_REF] Schnorr | A more efficient algorithms for lattice basis reduction[END_REF] have written new algorithms for basis reduction in the square norm. Seysen's method performs extremely well for lattices of dimension up to 30. It operates on small integers. Brun [START_REF] Brun | En generalisation av kjederbrøken I[END_REF], [START_REF] Brun | En generalisation av kjderbrøken II, Skv.Vidensk. Selsk. Kristiana[END_REF], [START_REF] Clarkson | Approximation of linear forms by lattice points with applications to signal processing[END_REF], proposed an efficient algorithm for finding approximate integer solutions, i.e., finding integer vectors t l ∈ Z m that are (almost) orthogonal to a given vector u ∈ R m while being as short as possible. It has been realized in [START_REF] Semaev | A 3-dimensional lattice reduction algorithm[END_REF] that Brun's algorithm can also be used for lattice reduction. Compared to LLL and Seysen reduction, Brun reduction performs more poorly but has significantly lower complexity.

Schnorr offered many improvements of the LLL algorithm: on the theoretical side, he shows how to make it faster by replacing rationals by floating points in LLL and how to do better by defining a hierarchy of polynomial time algorithms that approximate the shortest vector of a lattice better than the LLL algorithm does but increasingly slow. Finally, together with Euchner [START_REF] Wübben | Lattice reduction: A survey with applications in wireless communications[END_REF], he shows how to reduce in practice a lattice as fast as possible. At the same time, the possible applications of the reduced lattice basis algorithms are diversified.

Nguyen and Stehlé, [START_REF] Nguyen | An LLL algorithm with quadratic complexity[END_REF], introduced a new and natural floating point variant of the LLL algorithm which provably outputs LLL reduced bases in polynomial time and claim that this is the first LLL algorithm whose running time (without fast integer arithmetic) provably grows only quadratically with respect to log C, (C is a constant where the Euclidean norm of the vectors of the lattice basis are less than C), like Euclid's gcd algorithm and Lagrange's two-dimensional algorithm. Also the Jacobi lattice reduction algorithm [START_REF] Qiao | A Jacobi method for lattice basis reduction[END_REF], [START_REF] Tian | A Complexity Analysis Of a Jacobi Method for Lattice Basis Reduction[END_REF] which presents a new strategy with respect to the LLL algorithm to construct a reduced basis in polynomial time.

Recently

|µ ij | ≤ 1 2 , ( 2.20
)

δ b * i-1 2 ≤ b * i + µ i,i-1 b * i-1 2
, for all i ≥ 2.

(2.21)

It can also be defined as follows: Let R be the upper triangular matrix of the QR decomposition of the basis matrix B, then B is LLL reduced if and only if:

|r ij | ≤ 1 2 |r ii | , for 1 ≤ i < j ≤ m, δ |r j-1,j-1 | 2 ≤ |r jj | 2 + |r j-1,j | 2 , j = 2, ..., m.
The choice of the parameter δ affects the quality of the reduced basis and the computational complexity. We often set δ = 3 4 .

The second property (2.21) can be written as:

δ b * i-1 2 ≤ b * i + µ i,i-1 b * i-1 2 = b * i 2 + µ 2 i,i-1 b * i-1 2 .
where the second equality follows since b * i-1 and b

* i are orthogonal. It follows that b * i 2 ≥ δ -µ 2 i,i-1 b * i-1 2 ≥ δ - 1 4 b * i-1 2 .
Put this way, the second property (2.21) reads "b * i is not much shorter than b * i-1 ". Consider the orthogonal basis obtained by normalization of the Gram-Schmidt vectors b * 1 , ..., b * m . In this basis, B can be written as

           b * 1 * • • • * 0 b * 2 • • • * . . . . . . 0 • • • b * m           
where column i shows the coordinates of b i in this orthonormal basis. The first condition (2.20) guarantees that the absolute value of any off-diagonal element is at most half the one in the diagonal element on the same row. This can be written as

            b * 1 ≤ 1 2 b * 1 • • • ≤ 1 2 b * 1 0 b * 2 • • • ≤ 1 2 b * 2 . . . . . . ≤ 1 2 b * m-1 0 • • • b * m            
where ≤ 1 2 b * j indicates that the absolute value of this coordinate is at most 1 2 b * j . For the second condition (2.21), consider the 2 × 2 sub-matrix of the above matrix, with the upper left entry indexed at (i -

1, i -1). b * i-1 µ i,i-1 b * i-1 0 b * i .
Then the second condition (2.21) requires that the second column of this matrix is almost as long as its first column.

Proposition. Let {b 1 , ..., b m } ∈ R n be a LLL reduced basis. Then

b 1 ≤ 4 4δ -1 (m-1)/2 λ 1 (L) . For δ = 3 4 this gives b 1 ≤ 2 (m-1)/2 λ 1 (L) . Proof. Since for any basis b 1 , ..., b m , λ 1 (L) ≥ min i b * i ( b i ≥ b * i ). We get b * m 2 ≥ (δ - 1 4 ) b * m-1 2 ≥ ...... ≥ (δ - 1 4 ) m-1 b * 1 2 = (δ - 1 4 ) m-1 b 1 2 then, for any i, b * 1 ≤ (δ - 1 4
)

-(i-1)/2 b * i ≤ (δ - 1 4
)

-(m-1)/2 b * i .
Hence,

b 1 ≤ (δ - 1 4
)

-(m-1)/2 min i b * i ≤ (δ - 1 4
) -(m-1)/2 .λ 1 (L) .

Lemma. If the LLL procedure described above ever terminates, then its output is an LLL reduced basis for the lattice spanned by the input basis b 1 , ..., b m .

Proof. We need to prove that the output of the LLL algorithm is a basis for L (B) that satisfies both properties of an LLL reduced basis. The second property of an LLL reduced basis is enforced by the check during the swap step. The reason that the output of the algorithm is indeed a basis for L (B), is that we only perform column operations of the form b i ← b i + ab j for i = j, with a ∈ Z. We notice that throughout this step, the Gram-Schmidt basis does not change. After this step of reduction, b 1 , ..., b m satisfy |µ i,j | ≤ 1 2 , for all i > j. Consider some i > j, then |µ i,j | can be written as

|µ i,j | = b i -c i,j .b j , b * j b * j , b * j = b i , b * j b * j , b * j -     b i , b * j b * j , b * j     . b j , b * j b * j , b * j ≤ 1 2 .
Where the first equality follows from the fact that µ i,j was |µ i,j | ≥ 1 2 at the beginning c i,j =

≤ 2 i-1 b * i for i ≤ j ≤ i ≤ m, (2.22) det (L) ≤ m i=1 b i ≤ 2 m(m-1)/4 det (L) , (2.23) b 1 ≤ 2 (m-1)/4 det (L) 1 m . (2.24)
Proof. From the LLL conditions, we notice that

b * i 2 ≥ 3 4 -µ 2 i,i-1 b * i-1 2 ≥ 1 2 b * i-1 2 , for 1 < i ≤ m, so by induction we get b * j 2 ≤ 2 i-j b * i 2 for 1 ≤ j ≤ i ≤ m.
Now, From the Gram-Schmidt orthogonalization and condition (2.20) we obtain Note that the left side of the second inequality follows from "Hadamard's inequality" [START_REF] Hadamard | Résolution d'une question relative aux détérminants[END_REF], [START_REF] Holland | Another Proof Of Hadamard's Determinantal Inequality[END_REF]. Now, from b * i ≤ b i and b i ≤ 2 (i-1)/2 b * i , we deduce the second property (2.23). Putting j = 1 in (2.22) and taking the product over i = 1, 2, ..., m we find (2.24). Proposition 1. Let L be a lattice with reduced basis b 1 , ..., b m . Then

b i 2 = b * i 2 + i-1 j=1 µ 2 ij b * j 2 ≤ b * i 2 + i-1 j=1 1 4 2 i-j b * i 2 = 1 + 1 4 2 i -2 b * i 2 ≤ 2 i-1 b * i 2 . It follows that b j 2 ≤ 2 j-1 b * j 2 ≤ 2 i-1 b * i 2 for 1 ≤ j ≤ i ≤ m.
b 1 2 ≤ 2 m-1 x 2 ,
for every x ∈ L, x = 0.

Proof. x ∈ L , then x = m i=1 r i b i = m i=1 r i b * i with r i ∈ Z, r i ∈ R, (1 ≤ i ≤ m).
And as, x = 0 so if we take i as the largest index with r i = 0 then r i = r i , so

x 2 ≥ r 2 i b * i 2 ≥ b * i 2 .
By using (2.22) and putting j = 1, we obtain

b 1 2 ≤ 2 i-1 b * i 2 ≤ 2 m-1 b * i 2 .
This proves the proposition.

Note that, by proposition 1 we can also prove a previous result, b 1 ≤ 2 (m-1)/2 λ 1 (L). Proposition 2. Let L be a lattice with reduced basis b 1 , ..., b m . And let x 1 , x 2 , ...., x t ∈ L be linearly independent. Then we have

b j 2 ≤ 2 m-1 max x 1 2 , x 2 2 , ..., x t 2 for j = 1, 2, ..., t.
Proof. We have

x j = m i=1 r ij b i with r ij ∈ Z (1 ≤ i ≤ m) for 1 ≤ j ≤ t.
For fixed j, let i(j) be the largest i for which r ij = 0. Then, as in the previous proof of proposition 1, we have

x j 2 ≥ b * i(j) 2 , ( 2.25)
for 1 ≤ j ≤ t. We renumber the x j such that i(1) ≤ i(2) ≤ ... ≤ i(t) and we claim that j ≤ i(j) for 1 ≤ j ≤ t. If not, we take for example j = 2 and j > i(j), hence i(2) = 1, then we notice that r i,2 = 0 for 2 ≤ i ≤ m which implies that x 2 belongs to Rb 1 , so we conclude that in this case x 1 , ...., x t would all belong to Rb 1 + ... + Rb j-1 , a contradiction with the linear independence of x 1 , ...., x t . Therefore, from j ≤ i(j), (2.22) and using (2.25) we obtain

b j 2 ≤ 2 i(j)-1 b * i(j) 2 ≤ 2 m-1 b * i(j) 2 ≤ 2 m-1 x j 2 ,
for j = 1, 2, ..., t. This proves the proposition.

Let now, λ 1 , λ 2 , ..., λ m denote the successive minima on L and b 1 , ..., b m a reduced basis for L. Then by the previous proposition 2 and (2.22), we deduce that 2

1-i λ 2 i ≤ b i 2 ≤ 2 m-1 λ 2 i , for 1 ≤ i ≤ m. So, the norm b i 2 is a reasonable approximation of λ 2 i .
Definition (Complex LLL Reduction). Let H = {h 1 , ..., h m } an n × m complex lattice basis and {h * 1 , ..., h * m } the set of orthogonal vectors generated by the Gram-Schmidt orthogonalization. H is CLLL reduced (complex LLLreduced), if both of the following conditions are satisfied:

|R (µ ij )| ≤ 1 2 and |I (µ ij )| ≤ 1 2 , for 1 ≤ j < i ≤ m,
and

H k ≥ δ -|µ k,k-1 | 2 H k-1 ,
where

H k denote the squared norm of h * k , i.e, H k = h * k 2
, for 1 < k ≤ m, and δ with 1 2 < δ < 1 is a factor selected to achieve a good quality-complexity tradeoff, see [START_REF] Lenstra | Factoring Polynomials With Rational Coefficients[END_REF], [START_REF] Gan | Complex lattice reduction algorithms for low-complexity MIMO detection[END_REF], for more details.

The LLL algorithm has many applications. Here is a brief description of some of these applications.

1. Approximation to the SVP and the CVP (see, [START_REF] Babai | On Lovász Lattice reduction and the nearest lattice point problem[END_REF][START_REF] Agrell | Closest point search in lattices[END_REF]).

2. Finding Z-linear relations among real numbers (Machin's formula) [START_REF] Simon | Selected Applications Of LLL In Number Theory, Chapter of The LLL algorithm, part of the series Information Security and Cryptography[END_REF].

cryptanalysis: breaking cryptosystems based on number theory (break-

ing the Merkle-Hellman cryptosystem...).

4. The simple application of LLL to algorithmic number theory is the two-square theorem: if p is a prime ≡ 1mod4, the p is a sum of two squares p = x 2 + y 2 .

5. Integer programming, factoring polynomials (see, [START_REF] Likavec | Application of lattice basis reduction[END_REF]) and many more...

HKZ Reduction

In reduction theory, we often distinguish between reductions that are weak, but can be computed efficiently, and reductions that are strong but that require a much larger amount of computational resources.

The famous reduction of the first family is the LLL reduction (can be reached in polynomial-time). However, the famous one in the second family is the HKZ reduction.

Note that an HKZ reduced basis is LLL reduced for any 1/4 < δ < 1. There are two main algorithms to compute an HKZ reduced basis. The first one is due to Kannan [START_REF] Kannan | Improved algorithms for integer programming and related lattice problems[END_REF] and further refined by Helfrich and Schnorr [START_REF] Helfrich | Algorithms to construct Minkowski reduced and Hermite reduced lattice bases[END_REF][START_REF] Schnorr | A hierarchy of polynomial lattice basis reduction algorithms[END_REF]. Its complexity has been revisited by Hanrot and Stehlé [START_REF] Hanrot | Improved analysis of Kannan's shortest lattice vector algorithms[END_REF] who proved a m m 2e (1+O(1)) upper bound, where m is the lattice dimension. The other algorithm is due to Ajtai, Kumar and Sivakumar (AKS) [START_REF] Ajtai | A Sieve algorithms for the shortest lattice vector problem[END_REF]. It was introduced as the first single-exponential time algorithm for shortest lattice vector problem, However, no explicit time bound was given. In [START_REF] Regev | Lecture notes of lattices in Computer Science[END_REF], Regev described a simple version of this algorithm, running in time 2 16m+O(m) . The constant in the exponent was decreased from 16 to 5.9 by Nguyen and Vidick [START_REF] Nguyen | Sieve algorithms for the shortest vector problem are practical[END_REF], 3.4 by Micciancio and Voulgaris [START_REF] Micciancio An | Faster exponential time algorithms for the shortest vector problems[END_REF], 2.7 by Pujol and Stehlé [START_REF] Pujol | Solving the shortest lattice vector problem in time 2 2.465n[END_REF] and the currently best time complexity upper bound is 2 2.465m+O(m) with a space requirement bounded by 2 1.325m+O(m) [START_REF] Hanrot | Algorithms for the shortest and closest lattice vectors problems[END_REF]. The latter algorithm has a much better asymptotic complexity upper bound than Kannan's. All algorithms based on the Kannan strategy are intended as theoretical results and the complexity quickly becomes prohibitive as the dimension of the lattice increases. However, the second algorithm had also drawbacks (which is a Monte-Carlo probabilistic algorithm running in exponential time and space).

Recently, Zhang, Qiao and Wei, [START_REF] Zhang | HKZ and Minkowski Reduction Algorithms for Lattice-Reduction-Aided MIMO Detection[END_REF], have proposed a new algorithm for constructing a HKZ basis. They used Schnorr's strategy and a different method for the extension of a shortest vector into a new lattice basis (the unimodular transformation technique presented in [START_REF] Luk | A lattice basis reduction algorithm, nstitute for computational Mathematics[END_REF]) than the basis extension strategy introduced by Kannan (which only works for rational lattices, not for general real lattices). Definition 8. A lattice basis B = {b 1 , .., b m } is called HKZ reduced if the upper triangular matrix R of the QR decomposition of B is size reduced and for each trailing (m -i + 1)-by-(m -i + 1) sub-matrix, 1 ≤ i < m, its first column is a shortest non zero vector in the lattice generated by the sub-matrix.

HKZ Properties:

An HKZ reduced basis has a very interesting property, it provides a very good approximation of the successive minima of a lattice.

4 i + 3 λ 2 i (L) ≤ b i 2 ≤ i + 3 4 λ 2 i (L) for 1 ≤ i ≤ m,
Note that the upper bound of this theorem is due to K. Mahler, [START_REF] Mahler | A theorem on inhomogeneous diophantine inequalities[END_REF].

Proof. Consider L m-i+1 = π i (L), the lattice of rank m -i + 1. From the definition of successive minima λ i (L) and under the projection L -→ L (m-i+1) , at least one of them maps to a non zero vector. Therefore we have

λ 1 (L m-i+1 ) = b * i ≤ λ i (L).
Now, from the Gram-Schmidt orthogonalization and the size reduction, we obtain the right side of the inequality

b i 2 ≤ b * i 2 + 1 4 i-1 j=1 b * j 2 ≤ λ 2 i (L) + 1 4 i-1 j=1 λ j (L) ≤ i + 3 2 λ 2 i (L).
For the left side of the inequality, since π j (b i ) is a non zero element of L (m-j+1) and for j ≤ i we have

b * j 2 = λ 2 1 (L (n-j+1) ) ≤ π j (b i ) 2 ≤ b i 2 .
The last inequality comes from the fact that b

i = b * i + i-1 k=1 µ ki b * k and π j (b i ) = b * i + i-1 k=j µ ki b * k . Hence, for j ≤ i we have b j 2 ≤ b * j 2 + 1 4 j-1 k=1 b * k 2 ≤ j + 3 4 b i 2 .
74 Therefore, we obtain

λ 2 i (L) ≤ max b j 2 : 1 ≤ j ≤ i ≤ i + 3 4 b i 2 .
Theorem.

If [b 1 , ..., b m ] is a HKZ basis of a lattice L, then m i=1 b i 2 ≤ γ m m m i=1 i + 3 4 det(L) 2 .
Proof. This follows from the previous theorem. 4 and Minkowski's theorem, (see 2.2.7):

m i=1 λ i (L) ≤ γ m 2 m . det(L). Proposition 3. Let [b 1 , .
., b m ] be a HKZ basis of a lattice L, and let L be its reciprocal (dual) lattice. Then we have

b i 2 λ 1 (L ) ≤ i + 3 4 γ 2 m for 1 ≤ i ≤ m,
where γ m is defined by max {γ i }, γ i is Hermite's constant for a lattice of dimension i (see, [START_REF] Lagarias | Korkin-Zolotarev bases and successive minima of a lattice and its reciprocal lattice[END_REF]).

Proof. Since L (m-j+1) is a sub-lattice of L , we have λ 1 (L ) ≤ λ 1 (L (m-j+1) ) for each j. From the Gram-Schmidt decomposition and HKZ definition, we have

b i 2 ≤ b * i 2 + 1 4 i-1 j=1 b * j 2 = λ 1 (L (m-i+1) ) 2 + 1 4 i-1 j=1 λ 1 (L (m-j+1) ) 2 .
Therefore, we obtain

b i 2 λ 1 (L ) 2 ≤ λ 1 (L (m-i+1) ) 2 λ 1 (L (m-i+1) ) 2 + 1 4 i-1 j=1 λ 1 (L (m-j+1) ) 2 λ 1 (L (m-j+1) ) 2 .
By the definition of Hermite's constant (see, section. Minkowski's successive minimum and Hermite's constant), we have that for any lattice N of rank k

λ 1 (N ) 2 λ 1 (N ) 2 ≤ γ k . det(N ) 2 k .γ k . det(N ) 2 k = γ 2 k ,
We deduce that

b i 2 λ 1 (L ) 2 ≤ γ 2 m-i+1 + 1 4 i-1 j=1 γ 2 n-j+1 ≤ i + 3 4 γ 2 m .
Proposition 4. For any lattice L of rank m with reciprocal lattice L we have

λ i (L) 2 λ 1 (L ) 2 ≤ i + 3 4 γ 2 m for 1 ≤ i ≤ m.
Proof. This follows from the previous proposition. 3, since

λ i (L) 2 ≤ max b j 2 : 1 ≤ j ≤ i . Theorem 5. If [b 1 , ..., b m ] is HKZ basis of a lattice L, then b i 2 λ m-i+1 (L ) 2 ≤ i + 3 4 n -i + 4 4 γ 2 m , for 1 ≤ i ≤ m.
Proof. Since L (m-j+1) is a sub-lattice of L , we have

λ m-i+1 (L ) ≤ λ m-i+1 (L (m-j+1) ) whenever j ≤ i. Combining this with b i 2 ≤ b * i 2 + 1 4 i-1 j=1 b * j 2 = λ 1 (L (m-i+1) ) 2 + 1 4 i-1 j=1 λ 1 (L (m-j+1) ) 2 , we obtain, b i 2 λ m-i+1 (L ) 2 ≤ λ 1 (L (n-i+1) ) 2 λ m-i+1 (L (m-i+1) ) 2 + 1 4 i-1 j=1 λ 1 (L (n-j+1) ) 2 λ m-i+1 (L (m-j+1) ) 2 .
Applying the previous proposition. 4 to each L (m-j+1) we find that

b i 2 λ m-i+1 (L ) 2 ≤ m -i + 4 4 γ 2 m-i+1 + 1 4 i-1 j=1 m -i + 4 4 γ 2 m-j+1 m -i + 4 4 i + 3 4 γ 2 m .
Theorem. The successive minima of a lattice L of rank m and its dual lattice L satisfy

1 ≤ λ i (L) 2 λ m-i+1 (L ) 2 ≤ i + 3 4 m -i + 4 4 γ 2 m , for 1 ≤ i ≤ m.
Proof. The lower bound is due to [START_REF] Cassels | An introduction to the geometry of numbers[END_REF]. For the upper bound, interchanging L and L , if necessary, we may assume that i ≤ (m + 1)/2. Choosing an HKZ basis [b 1 , .., b m ] of L and applying the previous theorem. 5, we obtain

λ i (L) 2 λ m-i+1 (L ) ≤ max b i 2 : 1 ≤ j ≤ i λ m-i+1 (L ) 2 ≤ max b j 2 λ m-j+1 (L ) 2 : 1 ≤ j ≤ i ≤ max j + 3 4 . m -j + 4 4 γ 2 m : 1 ≤ j ≤ i = i + 3 4 m -i + 4 4 γ 2 m .

An introduction to the fundamental domain of Minkowski reduction

Suppose that f = m i,j=1 a ij x i x j is a positive definite quadratic form with real coefficients a ij . The condition for f to be Minkowski-reduced is that, for all i = 1, .., m, and for all integer (l 1 , .., l m ) if gcd(l i , .., l m ) = 1 then f (l 1 , ..., l m ) ≥ a ii .

Hermite reduction is closely related to Minkowski reduction. A form f is

Hermite reduced if for δ → ∞ the function h(f, δ) = a 11 δ m-1 + a 22 δ m-2 + .... + a mm
is the smallest among functions defined in the same way for all forms equivalent to the form f , [START_REF] Nguyen | Low dimensional basis reduction revisited[END_REF]. We notice from the definition that corresponding diagonal coefficients of two equivalent Hermite reduced forms are identical. The domains H for Hermite's reduction and M for Minkowski reduction are convex. H = M for m ≤ 6, [START_REF] Ryshkov | On the theory of Hermite-Minkowski reduction of positive quadratic forms[END_REF] [177] and different for m > 6, [START_REF] Ryshkov | On the reduction of positive quadratic forms of n variables in the sense of Hermite, Minkowski, and Venkov[END_REF] (a part of the boundary of M doesn't belong to H).

The positivity cone ℘ corresponds to the set of positive-definite quadratic forms in the N = 1 2 m (m + 1)-dimensional space of the coefficients (a 11 ,.., a mm , a 12 ,.., a m-1,m ).

The set of all Minkowski reduced forms in ℘ will be called the classical Minkowski region, and its subset with the additional constraint a i,i+1 ≥ 0 (i = 1, .., m) will be called the simple Minkowski reduction region.

The Minkowski reduction regions (classical and simple) are convex gonohedra with finitely many planar faces in the positivity cone ℘ (finitely many inequalities of Minkowski's condition suffice to define it), [START_REF] Minkowski | Diskontinuitatsbereich für arithmetische Äquivalenz[END_REF]. These finitely many inequalities have been determined for m ≤ 7, [START_REF] Ryshkov | On the theory of reduction of positive quadratic forms[END_REF][START_REF] Ryshkov | On the reduction of positive quadratic forms of n variables in the sense of Hermite, Minkowski, and Venkov[END_REF][START_REF] Tammela | On reduction theory of positive quadratic forms, Studies in number theory. Part 3[END_REF][START_REF] Tammela | Minkowski reduction region for positive quadratic forms in seven variables[END_REF][START_REF] Minkowski | Diskontinuitatsbereich für arithmetische Äquivalenz[END_REF].

Consider the set of regions equivalent to any of the reduction regions of quadratic forms. The set of such regions covers the entire ℘ and different regions have no common interior points. Only the classical Minkowski region may have completely coinciding equivalent regions; other regions are fundamental and may not coincide. The set of equivalent regions forms a partition of the positivity cone.

We call a partition of the positivity cone ℘ normal if any N -dimensional element of the partition touches only one element of the partition along any integral (N -1)-dimensional face (it suffices to show that the Minkowski reduction region has at least one (N -1)-dimensional face which is partitioned into two (N -1)-dimensional parts, such that an integral unimodular transformation moves one part of this face into itself and removes the other part outside the Minkowski reduction region). Otherwise, the partition is called non normal.

Note that a face of dimension (N -k) for 1 ≤ k ≤ N -1 is any non empty set Γ of points of the Minkowski domain of reduction M which satisfies the following properties:

1. Γ lies in some (N -k)-dimensional plane.

Γ is open in this plane.

3. Γ contains no points of the faces of dimensions N, ..., N -k + 1.

Γ is maximal

: if Γ ⊂ Γ ⊂ M and Γ satisfies conditions 1, 2, 3, then Γ = Γ.
The unique face of dimension N is the interior of the cell M.

A simple domain of Minkowski reduction together with its equivalent domains fills out the cone of positivity without gaps and superpositions of interior points. It gives a partition of the cone of positivity.

For m = 2, the simple domain of Lagrange-Minkowski reduction is

       a 12 ≥ 0 a 11 -2a 12 ≥ 0 a 22 ≥ a 11 > 0
Tammela showed in [START_REF] Tammela | On reduction theory of positive quadratic forms, Studies in number theory. Part 3[END_REF] that for m ≥ 3 the partition of the cone of positivity into regions (domains) equivalent to a simple Minkowski reduction region (to a simple domain of Minkowski reduction) is non normal (some domains intersect along pieces of the face), the same for m ≥ 7 in [START_REF] Tammela | Theory of reduction of positive-definite quadratic forms: Nonnormality of the partition of the positivity cone into Minkowski (n ≥ 7) and Barnes-Cohn (n = 4) reduction region[END_REF], Tammela showed that for m ≥ 7 the partition of the cone of positivity into regions equivalent to the classical Minkowski reduction region is non normal.

Theorem ([176]). Let m ≥ 3. Then the partition of the cone of positivity into domains equivalent to a simple domain of Minkowski reduction is not normal.

Proof. We will give here the main steps of the proof without going into details. Let D be the simple Minkowski reduction region. In order to prove the theorem, it suffices to find an (N -1)-dimensional closed face Γ of D, two quadratic forms f 1 and f 2 , and an integral unimodular matrix S which satisfy the following conditions: 1) f 1 lies inside Γ, 2) f 2 ∈ Γ, 3) f 1 S = g 1 lies inside Γ, 4) f 2 S = g 2 / ∈ D. Then the region D and DS touch at the interior points of the face Γ, but D ∩ DS = Γ. Note that (f S)(x) = f (Sx), DS = {f = f S | f ∈ D}.

Equivalence of reduced quadratic forms

We consider a form f from the domain of Hermite reduction.

Definition. We denote by Z 1 (f ) the collection of all integer vectors

      l (i 1 ) 1 . . l (i 1 ) m       , for which f (l (i 1 ) 1 , ..., l (i 1 ) m ) = a 11 .
Let k be an index with 2 ≤ k ≤ m, we denote by Z k (f ) the collection of all integral primitive matrices (the matrix is primitive if the greatest common divisor of the minors of order k of this matrix is equal to one)

   l (i 1 ) 1
. . l

(i k-1 ) 1 l (i k ) 1 . . . . . l (i 1 ) m . . l (i k-1 ) m l (i k ) m    , where    l (i 1 ) 1 . . l (i k-1 ) 1 . . . . l (i 1 ) m . . l (i k-1 ) m    ∈ Z k-1 (f ) and f (l (i k ) 1 , ..., l (i k ) m ) = a kk . We denote Z m (f ) by Z(f )
. By the definition of the domain of Hermite reduction, Z(f ) is the set of all transformations of the form f into forms which are Hermite reduced.

Let f be a Hermite reduced form, and let S be an integral unimodular matrix. Then by the definition of Hermite reduction in order that f S be Hermite reduced it is necessary and sufficient that f (s i1 , ..., s im ) = a ii , i = (1, ..., m).

Therefore, if for some form f and integral, unimodular matrix S for some k = 1, ..., m f (s i1 , ..., s im ) = a ii , i = (1, ..., k -1) and f (s k1 , ..., s km ) < a kk , then the form f is not Hermite reduced.

Theorem. Let Γ be a face of the domain of Hermite reduction of dimension

d (1 ≤ d ≤ N ) and let f, g ∈ Γ. Then Z k (f ) = Z k (g) (k = 1, ..

., m).

We can deduce from this theorem that the set Z k (f ) only depends on Γ and does not depend on the choice of f ∈ Γ. Therefore, we denote

Z k (Γ) = Z k (f ) (k = 1, ..., m), Z(Γ) = Z(f ).
By Minkowski's theorem (|l ik | < C), we deduce that the set Z(Γ) is finite.

Theorem. Let Γ be a face of the domain of Hermite reduction of dimension d (1 ≤ d ≤ N ) and let f ∈ Γ. In order that an integer, unimodular matrix S = (s ij ) transforms the form f into a Hermite reduced form it is necessary and sufficient that S ∈ Z(Γ).

For m ≤ 6 the construction of Z(Γ) can be found in [START_REF] Tammela | On reduction theory of positive quadratic forms, Studies in number theory. Part 3[END_REF]. Let now Γ be a face of a simple domain of Hermite reduction of dimension d (1 ≤ d ≤ N ). We consider a form f ∈ Γ. and f (l

Definition. We denote by

Z (0) 1 (f ) the collection of all integer vectors       l (i 1 ) 1 . . l (i 1 ) m       , for which f (l (i 1 ) 1 , ..., l (i 1 ) m ) = a 11 . If k is an index with 2 ≤ k ≤ m, we denote by Z (0) k (f ) the collection of all integer primitive matrices    l (i 1 ) 1 . . l (i k-1 ) 1 l (i k ) 1 . . . . . l (i 1 ) m . . l (i k-1 ) m l (i k ) m    , where    l (i 1 ) 1 . . l (i k-1 ) 1 . . . . l (i 1 ) m . . l (i k-1 ) m    ∈ Z (0) k-1 (f ) and f (l (i k ) 1 , ..., l (i k ) m ) = a kk ,
(i k-1 ) 1 , .., l (i k-1 ) m ; l (i k ) 1 , ..., l (i k ) m ) ≥ 0. We denote Z (0) m (f ) by Z (0) (f ).
Z (0) (f ) is the set of all transformations of the form f into forms f belonging to a simple domain of Hermite reduction.

Note that if f is considered as a form from the classical domain of Hermite reduction, i.e., if f ∈ Γ, where Γ is a face of a classical Hermite domain of dimension d, then Z (0) (f ) ⊂ Z(Γ). Theorem 6. Interior points of a simple domain of reduction have only trivial transformations (the automorphisms ±I, where I is the identity transformation) into forms that belong to a simple domain of reduction.

Proof. Let f = (a ij ) ∈ Γ 0 be an interior form of a simple domain of Hermite reduction, and let f = (a ij ) be a form of a simple domain of Hermite reduction equivalent to f . As Z (0) (f ) is contained among matrices that transform the interior points of the classical domain of Hermite reduction into points of the classical domain of Hermite reduction, i.e., by the previous theorem among matrices of the form

     1 0 . . 0 n      where i = ±1 (i = 1, .., m). But since a i,i+1 > 0, (interior points), a i,i+1 ≥ 0 (i = 1, ..., m -1), it follows that 1 = 2 = ... = m = ±1. Therefore Z (0) (f ) = {±I}.
Let Γ be a face of a simple domain of Hermite reduction of dimension d (1 ≤ d ≤ N ) and let g ∈ Γ. We consider a partition of Γ by the planes f (s i1 , ..., s im ; s i+1,1 , ..., s i+1,m ) = 0, (i = 1, ..., m -1), where S = (s ij ) ∈ Z (0) (g). We obtain partitions

Γ = p k=1 Γ k ,
where Γ k are the parts of Γ of different dimensions which are open in the respective subspace.

Let the points f, g ∈ Γ k , then Z (0) (f ) = Z (0) (g) for otherwise there would exist a plane (defined above) separating these points. Therefore, we can say

Z (0) (Γ k ) = Z (0) (f ) if f ∈ Γ k .
The finiteness of this partition follows from the Minkowski theorem |s ik | < c for transformations S = (s ij ) of a domain of Minkowski reduction into equivalent domains having common points with a domain of Minkowski reduction not lying on the boundary of the cone of positivity.

Let L = {Γ i } M i=0 be a finite set that represents the elements of the partition of all faces. Note that points of faces of a classical domain of Hermite reduction can be equivalent only to points of faces of a classical domain of Hermite reduction of the same dimension, we find that Γ i is either equivalent to Γ j (j = i; j = 0, ...., M ) or has no equivalent points with Γ j (j = i; j = 0, ..., M ).

A simple domain of reduction can be considered as the basis for constructing a fundamental domain F of reduction of positive quadratic forms (i.e, as a set of forms such that any positive definite form is equivalent to one and only one form of the fundamental domain).

Note that the definition of the faces of a fundamental domain is analogous to the definition of the faces of a simple domain of Hermite reduction.

The exact domain of Minkowski reduction for m= 3

Tammela described in [START_REF] Tammela | On reduction theory of positive quadratic forms, Studies in number theory. Part 3[END_REF] an algorithm for finding a fundamental domain. It starts by a partition L = {Γ i } M i=0 of all the faces of a simple domain of Hermite reduction (where Γ 0 represent the interior of a simple domain of Hermite reduction). He constructed a set F as the union

F = M i=0 F i of certain subsets F i = p Γ (p) i
of a simple domain of Hermite reduction, where the Γ (p) i are parts of the set Γ i . For constructing F k (k = 0, ..., M ), it was enough to consider Γ k , where three cases were possible: a) Γ k is equivalent to one of the Γ j , j < k; for this F k = ∅; b) Γ k is not equivalent to one of the Γ j , j < k, and all transformations of Γ k into itself are automorphisms of all the forms of Γ k , then F k = Γ k ; c) Γ k is not equivalent to one of the Γ j , j < k, but among the transformations of Γ k into itself there are transformations S = (s ij ) which are not automorphisms of all the forms of Γ k ; this case was considered separately. Let S (t) = (S (t) ij ) (t = 1, ..., ι) be all the transformations in question in part c). The partition of Γ k by the planes

f (S (t) i1 , ...., S (t) im ; S (t) j1 , ..., S (t) jm ) = a ij (t = 1, .., ι; i, j = 1, ..., m).
is considered into account and provides the following partition

Γ k = v p=1 Γ (p) k , where Γ (p) k are parts of Γ k of different dimensions. If f ∈ Γ (p)
k and suppose that some transformation

S (t) (1 ≤ t ≤ ι) takes f into the form f ∈ Γ (p)
k , then S (t) is an automorphism of the form f , since otherwise there would exist a plane (defined above) separating the equivalent forms f and f . Then Tammela defined

F k = p∈P Γ (p) k ,
where p runs through the set P ⊂ [1, ..., v] which is constructed as follows:

1 ∈ P ; h ∈ P if Γ (h) k
is not equivalent to one of the sets Γ (j) k , j < h; and otherwise h / ∈ P . Having thus considered all i = 0, ..., M , corresponding to elements Γ i of the partition L, Tammela constructed the sets F i (i = 0, ..., M ). Then

F = M i=0 F i .
For m = 2 the simple domain of Lagrange-Minkowski reduction is also a fundamental domain. (It suffices to prove that all forms of the domain are not equivalent. Since an interior form of the domain is not equivalent to any other reduced form, it suffices to consider the boundary points. All transformations of the form f from the domain into reduced forms are automorphisms of this form, for more details see [START_REF] Tammela | On reduction theory of positive quadratic forms, Studies in number theory. Part 3[END_REF]).

However, for m = 3 this is no longer true: on the boundary of a simple Hermite-Minkowski domain there are equivalent points.

Theorem. The following 16 systems of linear inequalities between the coefficients of forms define a fundamental domain: Theorem. If Y = (y kl ) 1≤k,l≤m is a Minkowski reduced matrix, then the following holds:

                                           a 12 > 0 a 23 > 0 a 11 -2a 12 > 0 a 11 -2a 13 > 0 a 11 + 2a 13 > 0 a 22 -2a 23 > 0 a 22 > a 11 a 33 > a 22 a 11 + a 22 -2a 12 + 2a 13 -2a 23 > 0                                                  a 12 = 0 a 23 ≥ 0 a 11 -2a 12 > 0 a 11 -2a 13 > 0 a 11 + 2a 13 > 0 a 22 -2a 23 > 0 a 22 > a 11 a 33 > a 22 a 11 + a 22 -2a 12 + 2a 13 -2a 23 > 0 a 13 ≥ 0                                                        a = 0 a ≥ 0 a -2a 12 > 0 a -2a 13 > 0 a + 2a 13 > 0 a -2a 23 > 0 a = a 11 a > a 22 a + a 22 -2a 12 + 2a 13 -2a 23 > 0 a ≥ a 13 a ≥ 0                                                  a 12 > 0 a 23 = 0 a 11 -2a 12 > 0 a 11 -2a 13 > 0 a 11 + 2a 13 > 0 a 22 -2a 23 > 0 a 22 > a 11 a 33 > a 22 a 11 + a 22 -2a 12 + 2a 13 -2a 23 > 0 a 13 ≥ 0                                                        a ≥ 0 a = 0 a -2a 12 > 0 a -2a 13 > 0 a + 2a 13 > 0 a -2a 23 > 0 a > a 11 a = a 22 a + a 22 -2a 12 + 2a 13 -2a 23 > 0 a ≥ a 13 a ≥ 0                                                        a 12 > 0 a 23 ≥ 0 a 11 -2a 12 = 0 a 11 -2a 13 ≥ 0 a 11 + 2a 13 > 0 a 22 -2a 23 > 0 a 22 > a 11 a 33 ≥ a 22 a 11 + a 22 -2a 12 + 2a 13 -2a 23 > 0 2a 23 ≥ a 13 a 13 ≥ 0                                                  a > 0 a ≥ 0 a -2a 12 = 0 a -2a 13 ≥ 0 a + 2a 13 > 0 a -2a 23 > 0 a = a 11 a > a 22 a + a 22 -2a 12 + 2a 13 -2a 23 > 0 a ≥ 2a 23                                                  a 12 ≥ 0 a 23 ≥ 0 a 11 -2a 12 > 0 a 11 -2a 13 = 0 a 11 + 2a 13 > 0 a 22 -2a 23 ≥ 0 a 22 ≥ a 11 a 33 > a 22 a 11 + a 22 -2a 12 + 2a 13 -2a 23 > 0 2a 23 ≥ a 12                                                  a ≥ 0 a > 0 a -2a 12 ≥ 0 a -2a 13 ≥ 0 a + 2a 13 > 0 a -2a 23 = 0 a > a 11 a > a 22 a + a 22 -2a 12 + 2a 13 -2a 23 > 0 2a 13 ≥ a 12                                                  a 12 ≥ 0 a 23 > 0 a 11 -2a 12 > 0 a 11 -2a 13 ≥ 0 a 11 + 2a 13 > 0 a 22 -2a 23 = 0 a 22 > a 11 a 33 = a 22 a 11 + a 22 -2a 12 + 2a 13 -2a 23 > 0 a 13 ≥ 2a 12                                                        a > 0 a ≥ 0 a -2a 12 > 0 a -2a 13 > 0 a + 2a 13 > 0 a -2a 23 > 0 a = a 11 a > a 22 a + a 22 -2a 12 + 2a 13 -2a 23 ≥ 0 a ≥ a 13 a ≥ -a 23                                                  a 12 ≥ 0 a 23 > 0 a 11 -2a 12 > 0 a 11 -2a 13 > 0 a 11 + 2a 13 > 0 a 22 -2a 23 > 0 a 22 > a 11 a 33 = a 22 a 11 + a 22 -2a 12 + 2a 13 -2a 23 > 0 a 12 ≥ |a 13 |                                                        a ≥ 0 a ≥ 0 a -2a 12 > 0 a -2a 13 > 0 a + 2a 13 > 0 a -2a 23 > 0 a = a 11 a = a 22 a + a 22 -2a 12 + 2a 13 -2a 23 ≥ 0 a ≥ |a 13 | a ≥ a 12                                                  a 12 ≥ 0 a 23 > 0 a 11 -2a 12 > 0 a 11 -2a 13 ≥ 0 a 11 + 2a 13 > 0 a 22 -2a 23 = 0 a 22 = a 11 a 33 = a 22 a 11 + a 22 -2a 12 + 2a 13 -2a 23 > 0 a 13 ≥ 2a 12                                                        a 12 > 0 a 23 > 0 a 11 -2a 12 > 0 a 11 -2a 13 > 0 a 11 + 2a 13 > 0 a 22 -2a 23 > 0 a 22 > a 11 a 33 = a 22 a 11 + a 22 -2a 12 + 2a 13 -2a 23 = 0 a 12 ≥ -a 13 a 11 -a 12 + 2a 13 ≤ 0                                                  a 12 > 0 a 23 > 0 a 11 -2a 12 > 0 a 11 -2a 13 > 0 a 11 + 2a 13 > 0 a 22 -2a 23 > 0 a 22 >
• y k,k ≤ y k+1,k+1 (k = 1, ..., m -1), • |2y k,l | ≤ y k,k (k < l),
• there exists a real number c m such that

det (Y ) ≤ m v=1 y v,v ≤ c m . det (Y )
where c m is a constant depending only on m.

A proof can be found on page 13 of Klingen's book, [START_REF] Klingen | Introductory Lectures on Siegel Modular Forms[END_REF]. The last inequality is called "Minkowski's inequality" (see below).

Minkowski's fundamental inequality

Minkowski established the existence of a number c m with the property that, if f (x)= m 1 a i,j x i x j is positive definite and reduced in the sense of Minkowski, with determinant D = det (a i,j ), then a 11 a 22 ...a mm ≤ c m D, named Minkowski's fundamental inequality for reduced quadratic forms.

Lekkerkerker (1969, Section 10) [START_REF] Lekkerkerker | Geometry of Numbers[END_REF] and Van der Waerden (1956) [START_REF] Van Der Waerden | Die Reduktionstheorie der positiven quadratischen Formen[END_REF] give detailed accounts of reduction theory and the best estimates for c m in this "fundamental inequality". Mahler has made several contributions to the

Chapter 3 Time Complexity Of Reduction Algorithms

This chapter is intended to study the complexity of each reduction algorithm without going into the details of the computational complexity theory, which is a branch of the theory of computation in theoretical computer science. We provide some background on complexity theory in sections 3.1, 3.2 and 3.3. We present the algorithms that produce the reduction notions cited in the previous chapter and comment their performance and computational complexity in sections 3.5, 3.6 and 3.7.

Mathematical Preliminaries

We start by explaining mathematical preliminaries that are important for some details in this chapter.

Turing Machine: In theoretical computer science, a Turing Machine is a theoretical machine that is used in thought experiments to examine the abilities and limitations of computers. A Turing Machine uses a tape, which is considered to be infinite in both directions. The tape consists of a series of squares each of which can hold a simple symbol. The tape head or read-write head, can read a symbol from the tape, write a symbol to the tape and move one square in either direction. In other words, A Turing Machine is a 7-tuple (Q, Σ, Γ, ∆, q 0 , B, F ) whose components have the following meaning:

• Q: The finite set of states of the machine;

• Σ: The finite set of input symbols;

• Γ: The complete set of tape symbols;

• ∆: The transition function. The arguments of ∆ (q, X) are a state q and a tape symbol X. The value of ∆(q, X), if it is defined, is a triple (p, Y, D) where 1. p: is the next state in Q;

2. Y is the symbol, in Γ, written in the cell being scanned, replacing whatever symbol was there;

3. D is the direction, either L or R, standing for "left" or "right", respectively and telling us the direction in which the head moves;

• q 0 : The start state, a member of Q, in which the machine is found initially;

• B: The blank symbol. This symbol is in Γ but not in Σ;

• F : The set of final or accepting states; a subset of Q.

There are two kinds of Turing Machines: a deterministic and non-deterministic Turing Machine.

Deterministic Turing Machine, [START_REF] Sheng | Relationships between Nondeterministic and Deterministic tape complexity[END_REF]: A Turing Machine is deterministic if there is only one possible action each step.

Non-Deterministic Turing Machine, [START_REF] Sheng | Relationships between Nondeterministic and Deterministic tape complexity[END_REF]: A Turing Machine is nondeterministic if there is many finite actions each step.

Probabilistic Turing Machine (PTM), [START_REF] Saha | Lecture 14: Randomized / Probabilistic computation, E 224 computational complexity theory[END_REF]: The finite state machine in the Probabilistic Turing Machine is probabilistic, in other words, a transition can be a random choice according to fixed, predetermined probabilities. For example, the transition function will look something like the following:

∆ (q, a) =    q 1 , b, L with probability 1 2 q 2 , c, R with probability 1 2
In this case, the transition function will transition from state q to state q 1 , write a b, and move its head left with probability 1 2 and it will transition to state q 2 , write a c, and move its head right with probability 1 2 .

Oracle Turing Machine, [START_REF] Alper | Oracle Theory, Oracle Theory courses Notes[END_REF]: An Oracle is a language A. An Oracle Turing Machine, is a standard Turing Machine with an additional tape denoted as the oracle tape. The machine can copy characters onto the oracle tape and in a single step receive definitive knowledge of whether the string is in the language A.

Definition. Given computational problems A to B, A is reducible to B if: given a way instantly finding answers to arbitrary instances of B allows for some easy method of solving arbitrary instances of A. The source of information concerning B is called an oracle to B. The algorithm for using the answers of B in order to find answers to A is called the reduction algorithm.

Introduction

How long does this sorting program run? By the computational complexity (or for short, complexity) of an algorithm, we mean the number of basic computational steps (such as arithmetical operations and comparisons) required for its execution. This number clearly depends on the size and nature of the input.

Since the algorithm's performance may vary with different types of input data, hence for an algorithm we usually use the worst-case time complexity of an algorithm because that is the maximum time taken for any input size.

Definition. The worst-case time complexity of an algorithm is expressed as a function

T : N -→ N
where T (n) is the maximum number of steps in any execution of the algorithm on inputs of size n. The amount of time an algorithm takes depends on how large is the input on which the algorithm must operate: sorting large lists takes longer than sorting short lists; multiplying huge matrices takes longer than multiplying small ones.

We have already defined the worst-case time complexity so for example, if the time complexity of an algorithm is 3.n 2 , it means that on inputs of size n, the algorithm requires up to 3.n 2 steps. To make this precise, we must classify what we mean by input size and step. Definition. We define the size of the input in a way that is problem-dependent. For example, if we are dealing with algorithms for multiplying square matrices, we may express the input size as the dimension of the matrix (i.e, the number of columns, or rows), or we may express the input size as the number of entries in the matrix. Sometimes there may be several reasonable choices for the size of input. So, in order to properly interpret the function that describes the time complexity of an algorithm we must be clear about how exactly we measure the size of inputs.

Definition. In general we will consider a step to be anything that we can reasonably expect a computer to do in a fixed amount of time. Typical examples are performing an arithmetic operations, comparing two numbers.

The question that we can ask now, how can we define time complexity in an universal way? Thus, we measure time in somewhat abstractly defined steps, there is little point in fretting over the precise number of steps. If by some definition of steps the time complexity of the algorithm is 5.n 2 , by a different definitions of steps it might be 7.n 2 , and by yet another definition of steps it might be n 2 /2. For this, computer scientists have developed some special notation about functions, known as the big-oh, the big-omega and big-theta notation.

If k ∈ N, N ≥k denotes the set of natural numbers that are greater than or equal to k. R ≥0 denotes the set of non negative real numbers and R >0 denotes the set of positive real numbers.

Definition. Let f : N ≥k -→ R ≥0 , for some k ∈ N. O(f ) is the following set of functions from N ≥l to R ≥0 , for any l ∈ N: O(f) := g: there exist c ∈ R >0 and n 0 ∈ N such that for all n ≥ n 0 , g(n) ≤ c.f (n) . Therefore, g ∈ O(f) if for all sufficiently large n (for n ≥ n 0 ), g(n) is bounded from above by f (n) -possibly multiplied by a positive constant. We say that f is an asymptotic upper bound for g.

Example. f (n) = 3.n 2 + 4.n 3 2 ∈ O(n 2 ). This is because 3.n 2 + 4.n 3 2 ≤ 3.n 2 + 4.n 2 ≤ 7.n 2 . Thus, take n 0 = 0 and c = 7. For all n ≥ n 0 , f (n) ≤ c.n 2 .
If the complexity is bounded from above by a polynomial in the input size, the algorithm is called a polynomial-time algorithm. Such an algorithm of Garey and Johnson, [START_REF] Garey | Computers and intractability. A guide to the theory of NP-completeness[END_REF], or in chapter 29 of the Handbook of Combinatories, [START_REF] Graham | Handbook of combinatories[END_REF], [START_REF] Aurora | Computational complexity: A modern approach[END_REF].

The classes P, NP and co-NP:

An alphabet is a finite set of symbols Σ. A string (over Σ) is a sequence of symbols from Σ (a string of bits is a finite sequence of zeroes and ones). The length of a string y is the number of symbols in y, and it is denoted by |y|.

The set of all strings over Σ is denoted by Σ * and the set of all strings of length n is denoted by Σ n . A Turing Machine M runs in time T (n), if for every input string ω of length n (over some fixed input alphabet Σ), M(n) stops after at most T (n) steps. We identify the notion of efficient computations with Turing Machines that stop in time polynomial in the size of the input, i.e, Turing Machines that run in time T (n) = a + n b for some constants a, b independent of n. There are many basic problems for which polynomial time algorithms have yet to be found, and indeed might well not exist. Determining which problems are solvable in polynomial time and which are not is evidently a fundamental question. For this reason, let us define three classes of decision problems.

Definition (Decision Problem)

. A decision problem is the problem of deciding whether the input string satisfies or not some specified property. Formally, a decision problem is specified by a language, i.e, a set of strings L ⊆ Σ * , and the problem is given an input string ω ∈ Σ * decide whether ω ∈ L or not. Thus, a decision problem is a question whose answer is either yes or no.

Definition (P). The class of decision problems that can be solved by a deterministic Turing Machine in polynomial time is called P. Such a problem belongs to the class P if there is a polynomial time algorithm that solves any instance of the problem in polynomial time. We can say that P is the set of problems that can be solved quickly.

Definition (NP). The class of decision problems that can be solved by a non-deterministic Turing Machine in polynomial time is called NP. Such a problem belongs to the class NP if, given any instance of the problem whose answer is yes, there is a certificate validating this fact which can be checked in polynomial time; such a certificate is said to be succinct (that means that you can quickly check whether a candidate solution is a solution). Intuitively, NP is the set of problems where we can verify a Yes answer quickly if we have the solution in front of us. Definition (co-NP). Analogously, a decision problem belongs to the class co-NP if, given any instance of the problem whose answer is no, there is a succinct certificate which confirms that this is so. (A decision problem X is a member of co-NP if and only if its complement X is in the complexity class NP. Instances of decision problems in co-NP are sometimes called "counterexamples", or co-NP is the set of decision problems where "no" instances can be solved in polynomial time by a theoretical non-deterministic Turing machine).

We can notice from those definitions that P ⊆ NP. Likewise, P ⊆ co-NP. Therefore, P ⊆ NP ∩ co-NP. B) we also use reductions to show that we cannot find algorithms for some problems. (We say that these problems are "hard").

We say that X is polynomial-time reducible or reducible in polynomial time to Y if the reduction map between them can be computed in polynomial time. Therefore, we say X is polynomially reducible to Y and write X ≤ Y. The significance of polynomial reducibility is that X ≤ Y, and if there is a polynomial time algorithm for solving Y, then this algorithm can be converted into polynomial time algorithm for solving X. If X and Y are both decision problems;

X ≤ Y and X ∈ P =⇒ Y ∈ P.

Definition (Karp reduction). Let A and B be two decision problems. A Karp

reduction from A to B is a polynomial time computable function f : Σ * → Σ * such that x ∈ A if and only if f (x) ∈ B.
Clearly, if A reduces to B can be solved in polynomial time, then also A can be solved in polynomial time. Let us define another notion of reductions called Cook reduction and Randomized reduction.

Definition. A Cook Reduction from A to B is a polynomial time Turing

Machine M with access to an oracle that takes instances of problem B as input. M reduces A to B, if, given an oracle that correctly solves problem B, M correctly solves problem A. A problem A is NP-Hard under Cook Reduction if for any NP problem B there is a Cook Reduction from B to A. If A is NP, then we say that A is NP-Complete under Cook Reduction.

Definition. Language A reduces to language B under randomized reduction, denoted A ≤ r B, if there exists a deterministic, polynomial time computable function f : {0, 1} * → {0, 1} * and a polynomial p() such that

For all x ∈ A, Pr y∈{0,1} p(|x|) [f (x, y) ∈ B] ≥ 2 3 For all x / ∈ A, Pr y∈{0,1} p(|x|) [f (x, y) ∈ B] ≤ 1 3
In other words, the reduction from A to B is a polynomial time computable function by a probabilistic algorithm f : Σ * → Σ * such that x ∈ A if and only if f (x) ∈ B. The output of the reduction is only required to be correct with sufficiently high probability, for more details see [START_REF] Micciancio | Complexity of Lattice Problems: A cryptographic Perspective[END_REF]. This means that the NP-complete problems are the most difficult problem in class NP. If we could solve just one of them in a polynomial time, we could solve all problems in class NP in a polynomial time.

NP-Hard Problems are partly similar but more difficult problems than NP-complete problems. They do not themselves belong to class NP (or they do, but no one has found it yet) but all problems in class NP can be reduced to them, i.e., a problem satisfying the second condition of NP-Complete problems is said to be "NP-Hard", whether or not it satisfies the first condition of NP-Complete problems. Therefore, a NP-Hard problem cannot be solved in polynomial time unless P = NP. We notice that NP-Complete problems are a subset of NP-Hard problems, for more details, see [START_REF] Hämäläinen | Class NP, NP-Complete, and NP-Hard Problems[END_REF]. The standard technique to prove that a problem A in NP-Hard (and therefore no polynomial time solution for A is likely to exists) is to reduce some other NP-Hard problem B to A.

Complexity of the Gauss algorithm

The proof that the algorithm terminates is based on the fact that the value of b2 decreases strictly. A lattice is a discrete set, therefore, it can take only a finite number of values. We show now, that this algorithm computes a good basis, realizing the first and the second lattice successive minima. First, the algorithm produces necessarily a basis because at each step, the applied transformation is unimodular. Secondly, as the obtained basis satisfies b1 ≤ b2 and 2 b1 . b2 ≤ b1 size of the entries. For an input basis of size M , the number of iterations is at most log √ 3 M + 2. The proof is not trivial, as we need for it a t-Gauss algorithm, where the stop condition is replaced by a stronger one: the b1 ≤ b2 condition is replaced by b1 ≤ t b2 for t > 1. The proof has two steps:

First, we show that the t-Gauss algorithm terminates in polynomial number of iterations in the size of the entries. Then we show that the Gauss algorithm is at most one more iteration than the t-Gauss, for a t well chosen, for details, see [START_REF] Vera | Analyses de l'algorithme de Gauss[END_REF].

We illustrate size reduction and Gauss reduction with an example.

Example. Let B = 2.1 3 1 1 be a basis matrix for a two-dimensional lattice L. The first basis vector is unchanged, i.e, ũ = u, hence r 12 = r 12 -r 11 = 0.8126 < |r 11 | /2. And finally the new basis is size reduced.

Size

Gauss Reduction:

After the size reduction, we notice that ũ > ṽ . So, we perform a column swap ũ ↔ ṽ, that leads to the basis matrix 0. and u = ṽ = 0.9 0

Since u is shorter than v , no further column swap or size reduction is possible and a Gauss reduced basis has been obtained i.e the basis 0.9 0.3 0 1 consists of two shortest vectors that span L.

The complexity of Gauss's algorithm is given by the following result:

Theorem. Given as input a basis {b 1 , b 2 } of a lattice L. Gauss's algorithm produces a lattice basis that realizes the successive minimum in time

O (log b 2 . [1 + log b 2 -log λ 1 (L)]) .
The main difficulty is to prove that the total number of loop iterations is O (1 + log v -log λ 1 (L)), where v is the initial second basis vector, for details, see [START_REF] Nguyen | Low dimensional basis reduction revisited[END_REF].

Complexity of the LLL algorithm

Let us make some important observations on this reduction. We can see that as Gauss's algorithm, there are essentially two types of operations: translations and exchanging vectors. The aim of these translations is to return the µ ij coefficients with an absolute value lower than 1 2 . Thus letting b k closer to b * k for making b k almost orthogonal to the previous vectors. Each of these translations is realized by a call to the RED procedure (see Algorithm.

3).

We take as an input a lattice basis {b 1 , ..., b m } and output {b 1 , ..., b m } a lattice basis of the same lattice. Let us suppose that, the first k -1 vectors b 1 , ..., b k-1 already satisfy the LLL conditions and that we have calculated the

µ ij coefficients for j ≤ i ≤ k -1 as well as b * i 2 for 1 ≤ i ≤ k -1.
First, we take care of the first condition which is easy to satisfy. Indeed, suppose that we replace the b k vector by a vector of the form b k -qb l with l < k and q an integer ( this step is to make sure that the projection of b k on b * l for any l < k is at most 1 2 b * l , and it does so by subtracting from the column k some integer multiple of the column l such that the lth coordinate becomes at most 1 2 b * l in absolute value), then:

• The lattice generated by b 1 , ..., b k is unchanged.

• The Gram-Schmidt orthogonalization vectors b * 1 , ...., b * k stay also unchanged.

• µ kk ,..., µ k,l+1 are unchanged. However, µ kl is replaced by µ kl -q.

The last point is a consequence of the equality:

b k -qb l = k j=1 (µ k,j -qµ l,j ) b * j .
Therefore, we see that we can successively satisfy the conditions:

|µ k,k-1 | ≤ 1 2 by replacing b k by b k -µ k,k-1 b k-1 , then |µ k,k-2 | ≤ 1 2 by replacing b k by b k -µ k,k-2 b k-2
and so on. To demonstrate this step, let us write B in the orthonormal basis obtained by normalizing the Gram-Schmidt vectors

                 b * 1 * • • • ≤ 1 2 b * 1 * 0 b * 2 . . . . . . ≤ 1 2 b * k-1 * b * k . . . 0 • • • b * m                  RED(k, l) is the procedure which replaces b k by b k -µ k,l b l
and updates the µ kj coefficients for j ≤ l. So to obtain the condition (2.20), it is necessary to execute successively RED(k, k -1) until RED(k, 1). It should be noted that the condition (2.20) can be checked as soon as RED(k, k -1) is executed because the µ k,k-1 coefficient is not changed any more. Thus, we proceed in the following way: we execute RED (k, k -1), then later we test the second condition. If it is verified, we execute RED (k, k -2),..

, ..., b * k-2 have not changed, nor µ ij for i ≤ k -2. As b k = b * k + µ k,k-1 b * k-1 + µ k,k-2 b * k-2 + .... b * k-1 is replaced by b * k + µ k,k-1 b * k-1 and the µ k-1,j 's coefficients by µ k,j for j < k -1.

Algorithm 3 RED

Input: i and j are integers.

Output:

|µ ij | ≤ 1 2 . if |µ i,j | > 1 2 then r ← µ i,j ; b i ← b i -rb j ; µ i,j ← µ i,j -r; w ← 1; while w ≤ l -1 do µ i,w ← µ i,w -rµ j,w ; w ← w + 1; end while end if
In order to better understand the strategy of this reduction, we take the following simple example for m = 2: We notice from R that the first condition (2.20) is not verified. So, we apply RED procedure for k = 2 and we obtain v ← v -3.1385/2.3259 u = v -u = 0.9 0 , and r 12 = r 12 -r 11 = 3.1385 -2.3259 = 0.8126.

Example. Let B = 2.
After the RED(2, 1) procedure, we check the Lovász condition (2.21). For this, we take

δ = 1/2 δ | r 11 | 2 = 2.7049 > | r 22 | 2 + | r 12 | 2 = 0.8100.
According to the algorithm, a column swap, u ↔ v, must be done in this case, then we repeat what we had already done for k = max(k -1, 2) = 2. Thus, again

v = v -2.1/0.9 u = 2.1 1 -2 0.9 0 = 0.3 1
and we obtain the following lattice basis matrix 0.9 0.3 0 1

We notice that the second condition holds: 0.5.(0.9) 2 < 1 2 + (0.3) 2 . Since the second condition is verified, we move to the next case k = 3 but as k = 3 > m = 2, the algorithm terminates and the LLL reduced basis is 0.9 0.3 0 1 .

Note that a Gauss reduced basis is an LLL reduced basis. A pseudo-code summarizes the main algorithmic steps (see, Algorithm. 4). Now, it is clear that if the algorithm terminates, an LLL reduced basis lattice is obtained.

Definition. Let B = {b 1 , ..., b m } be a lattice basis. The potential of B, denoted D B , is defined by m i=1 b * i m-i+1 = m i=1 b * 1 b * 2 ... b * i = m i=1 D B,i .
where D B,i := det Λ i and Λ i is defined as the lattice spanned by b 1 , .., b i .

We have already seen that during the Size Reduction step, the Gram-Schmidt basis does not change. Now consider the swap step. Suppose that b i is swapped with b i+1 . For all k = i, Λ k is not changed by the swap, and so D B,k . To prove this look at the two cases k < i and k > i.

D B,i D B,i = det Λ i det Λ i = det L (b 1 , ..., b i-1 , b i+1 ) det L (b 1 , .., b i ) = i-1 j=1 b * j . µ i+1,i b * i + b * i+1 i j=1 b * j = µ i+1,i b * i + b * i+1 b * i < √ δ.
Where the last inequality follows from the condition in the swap step. Thus each passage through Swap multiplies the product D B,1 D B,2 ...D B,m by a factor at most equal to √ δ. Therefore, we have just to show that the lower bound of this product is a constant depending only on the lattice. . The spheres centered at the lattice points of radius r are interior disjoints, (it is the largest possible radius). Let Σ be the set of these spheres and V the Voronoi region of the lattice L, an important fundamental region, defined as the set of points in R n that are closer to the origin than to any other point. The volume of this fundamental region is equal to det (L). And the volume of V ∩ Σ is equal to the volume of a sphere of radius r, i.e, r m Π m where Π m is the volume of a sphere of radius 1 and dimension m, for details see [START_REF] Sloane | The Sphere Packing Problem[END_REF], [START_REF] Conway | Sphere Packings Lattices and Groups, Third Edition[END_REF]. Then we have

∆ = vol (V ∩ Σ) vol (V) ≤ 1. Let r m Π m det (L) ≤ 1, or   min (L) det (L) 1 m   m 2 Π m 2 m ≤ 1.
Then,

γ ≤ 2 m Π m 2 m = 2 2 Π 1 m m .
Proposition. The LLL algorithm terminates for arbitrary lattice bases.

Proof. The previous proposition. 5 shows:

γ k := Sup L⊂R k γ (L) , is finite.
Therefore, we obtain for Λ k ,

D B,k ≥ min (Λ k ) γ k k ≥ min (L) γ k k .
And the product D B,1 ....D B,m is well bounded from below by a constant and only depends on the lattice L. Note that if B was an integer basis, i.e, B ∈ Z n×m , we can show that the LLL algorithm terminates in an easier way.

As shown above, in each iteration, D B decreases by a multiplicative factor, √ δ. Let D B,0 be the initial value of D B . Since D B is a non zero integer, and in particular at least 1, this means that we can bound from above the number of iterations by

log 1 √ δ D B,0 = log D B,0 log 1 √ δ ≤ 1 log 1 √ δ . m(m + 1) 2 log max i b i . 106 (Since b * i ≤ b i , the initial value of D B can be bounded from above by (max i b i ) m(m+1) 2
). And this bound is for any constant δ < 1. This proves an upper bound on the number of iterations as a function of the initial value of D B . Since D B is computable in polynomial time from the input size, then its size must be polynomial in the input size. We proved that the number of iterations is bounded by a polynomial in the input size. In order to mark the boundary of the running time of the algorithm, we still need to show that each iteration also takes polynomial time. It is not difficult to see that in each iteration we perform only a polynomial number of arithmetic operations (i.e., additions, multiplications, etc.) [START_REF] Lenstra | Factoring Polynomials With Rational Coefficients[END_REF]. Hence, in order to prove a polynomial bound on the running time we only need to show that the size of the numbers involved in the entire computation also is polynomially bounded, see [START_REF] Kaplan | LLL Algorithm[END_REF], [START_REF] Micciancio | The LLL Algorithm[END_REF], [START_REF] Lenstra | Factoring Polynomials With Rational Coefficients[END_REF]. So, we have to prove that the bit length (i.e., the number of binary digits and it is necessary to represent an integer in the binary number system) of the numerators and denominators of the rational numbers b * i 2 , µ i,j and the bit length of the coefficients of the b i ∈ Z m are polynomially bounded throughout the algorithm. An analysis of the algorithm leads to a bound of the form O(m log max i b i 2 ), [START_REF] Lenstra | Factoring Polynomials With Rational Coefficients[END_REF].

The complexity of the LLL algorithm is traditionally assessed by counting the number of iterations, where an iteration is started whenever the Lovász condition is tested. In particular, when the Lovász condition is not satisfied. We had already given an upper bound for the number of iterations of LLL, which is polynomial in the data size, for all values of δ except the optimal value 1. This result depends on a quantity defined by

D := m-1 k=1 k l=1 | rl,l | 2 ,
and which is bounded from below by 1 throughout the execution of the LLL algorithm when the basis matrix has an integer-valued. All of this implies that the number of swap operations carried out by the LLL algorithm is finite and the algorithm always terminates but under the condition that the original basis matrix B is an integer-valued. A similar statement can be made also in the extreme case where δ = 1, although the proof of this statement requires some additional work, see [START_REF] Daudée | An upper bound on the average number of iterations of the LLL algorithm[END_REF], [START_REF] Akhavi | The optimal LLL algorithm is still polynomial in fixed dimension[END_REF]. The complexity analysis for the general case (real or complex valued) of B is complicated by the fact that the quantity D is not necessarily ≥ 1. However, other strictly positive lower (and upper) bounds on D can be found in this case. Based on such bounds, it was shown in [START_REF] Daudée | An upper bound on the average number of iterations of the LLL algorithm[END_REF] that the number of LLL iterations in general is bounded from above by

m 2 log t A a + m, where t = 1 √ δ , A = max l | rl,l | and a = min l | rl,l |.
This bound implies that the LLL algorithm terminates for arbitrary bases. Also this bound was used in [START_REF] Daudée | An upper bound on the average number of iterations of the LLL algorithm[END_REF] to prove polynomial average complexity of the LLL algorithm for special cases, for example, when the basis vectors are uniformly distributed inside the unit sphere in R m , and has been extended to i.i.d. (independent identically distributed) real and complex-valued Gaussian bases in the context of MIMO communications [START_REF] Ling | Effective LLL reduction for lattice decoding[END_REF], [START_REF] Jaldén | Worst-and average case complexity of LLL lattice reduction in MINO wireless systems[END_REF]. It is true, that Minkowski's and HKZ's reductions are the strongest but also the computationally most demanding to obtain. In both, the Minkowski and the HKZ lattice basis (see, definition 8, algorithm 5, definition 7) we notice that the first vector b 1 is the shortest vector in the lattice. This implies that the computation of the Minkowski and HKZ reduced bases are at least as complex as the computation of the shortest lattice vector. Computing an HKZ basis can be achieved by making m calls to an SVP oracle (recursively find a shortest non zero lattice vector in the projected lattice). So, the two problems have the same time complexity up to a factor of m. Zhang, Qiao and Wei, in [START_REF] Zhang | HKZ and Minkowski Reduction Algorithms for Lattice-Reduction-Aided MIMO Detection[END_REF], were the last to propose an algorithm for constructing an HKZ reduced basis. However, the expected complexity of their algorithm is exponential with the lattice dimension m. Therefore, no polynomial time algorithm in the dimension of the lattice is currently known for a HKZ reduced basis neither for a Minkowski reduced basis.

Complexity of HKZ and Minkowski algorithms

In this chapter, we present our algorithm for computing a Minkowski reduced basis up to dimension 5. We begin first with a detailed description of the algorithm then we show its drawbacks in section 4.1 . We compare the different notions of reduction by simple examples in section 4.2 and finally in section 4.3, we measure the quality of their output by what we call the orthogonality defect of lattice reduction algorithms.

A Descripition Of The Algorithm

We now state the following result useful for our algorithm. The goal of lattice reduction algorithms is to determine a sequence of elementary column operations (equivalently, a unimodular matrix Z) that transforms the given basis B into a reduced basis B = BZ according to the specific requirements of the corresponding reduction criterion.

The first Minkowski reduced basis vector m 1 is a shortest non zero lattice vector in L, which can be obtained by applying Schnorr-Euchner enumeration [START_REF] Agrell | Closest point search in lattices[END_REF], [START_REF] Schnorr | Lattice basis reduction: Improved practical algorithms and solving subset sum problems Mathematical Programming[END_REF] and we can extend m 1 to a basis for L by calling Procedure Transform (R, I m , 1, z), (see, Algorithm 6).

Note that if the initial lattice basis Y is a symmetric matrix then the upper triangular matrix R = Chol(Y ). Otherwise, R = Chol(Y Y ).

Where This Idea Comes From?

Suppose that m 1 = Bz, where z ∈ Z m . Therefore, we have to construct an m × m unimodular matrix Z whose first column is z. In other words, Z -1 z = e 1 , which says that Z -1 , also unimodular, transforms z into the first unit vector e 1 . For the special case when m = 2, we have the following algorithm: Procedure 1 (Unim2 (p, q) [START_REF] Luk | A lattice basis reduction algorithm, nstitute for computational Mathematics[END_REF]). Let [p, q] be a non zero integer vector and gcd(p, q) = d. Using the extended Euclidean algorithm, we find integers a and b such that ap + bq = d. The integer matrix

M = p/d -b q/d a
Algorithm 6 Transform (R, Z, k, z) [START_REF] Luk | A lattice basis reduction algorithm, nstitute for computational Mathematics[END_REF] Input: given R ∈ R m×m upper triangular (obtained by Cholesky decomposition), Z ∈ Z m×m unimodular, and an integer vector z ∈ Z m-k+1 , 1 ≤ k ≤ m -1, such that gcd(z i ) = ±1. Output: the updated Z ∈ Z m×m such that the integer vector z is in the kth position.

for j = m -k + 1 : -1 : 2 do l = j + k -1; z 1 = z(j -1); z 2 = z(j); [d, a, b] = gcd(z 1 , z 2 ); M = [[z 1 /d; z 2 /d] , [-b; a]] ; z(j -1) = d; R(1 : l; l -1 : l) = R(1 : l, l -1 : l) × M ; r = R(l -1 : l, l -1); r = r/norm(r); c = r(1); s = r(2); G = [[c s] ; [-s c]] ; R(l -1 : l, l -1 : m) = G × R(l -1 : l, l -1 : n); Z(:, l -1 : l) = Z(:, l -1 : l) × M ; end for
is unimodular and

M -1 p q = d 0 , such that M -1 = a b -q/d p/d .
Thus, if gcd(p, q) = ±1, then z can be transformed by the unimodular matrix M -1 into the first unit vector e 1 . Now, for the general case when m > 2. If Bz is a shortest non zero lattice vector then by applying a sequence of plane unimodular transformations M as above to z, with gcd(z i ) = ±1, z can be transformed into the first unit vector.

Let us go back to lemma 2, suppose that B p is a generator matrix of an m-dim lattice L such that the first p -1 columns of B p can be extended to a Minkowski reduced basis for L. Then it follows from lemma 2 that the pth Minkowski reduced basis vector m p , which can be extended to an Minkowski search radius when a shorter lattice vector satisfying the gcd constraint is found.

After determining the pth Minkowski reduced basis vector m p = B p z, we move to our second problem: how can we extend {m 1 , ...., m p } to a basis for L? Simply, in terms of matrices, it is enough to find a unimodular matrix Z such that

B p+1 = B p Z,
which implies that the first p -1 columns of Z are the first p -1 unit vectors e i , i = 1, ..., p-1 and the pth column of Z is the integer vector z found by the mdecode1 algorithm, so that the first p -1 columns of B p+1 equal the first p -1 columns m 1 , ..., m p-1 and the pth column of B p+1 is m p = B p z as desired. Since gcd(z p , ..., z m ) = 1, we can construct from procedure 1 a unimodular matrix M p whose first column is [z p , ..., z m ] . Now we consider the two m × m unimodular matrices

Z 1 = I p-1 0 0 M p , Z 2 =             z 1 I p-1 . . . 0 z p-1 1 0 . . . 1            
The product Z 1 Z 2 is unimodular since both Z 1 and Z 2 are unimodular and the first p -1 columns of Z 1 Z 2 are the first p -1 unit vectors and the pth column of Z 1 Z 2 is z = [z 1 , ..., z m ] . Therefore, the product Z 1 Z 2 is an unimodular matrix that satisfies B p+1 = B p Z. The application of Z 1 can be performed by the Transform algorithm (see Algorithm 6) and the application of Z 2 is the calculation of a linear combination of the first p columns (see, Z 1 and Z 2 matrices). Putting all things together, the algorithm for constructing a Minkowski reduced basis of a lattice is mred(B, ω), see Algorithm 9.

Note that if B is not a symmetric positive definite matrix, we apply Minkowski on B and as mentioned before we take R = chol(B B) to finally obtain the symmetric definite positive matrix Z B BZ where the latter is a Minkowski reduced matrix. Otherwise, we apply Minkowski on R = chol(B) and we obtain at the end Z T T Z a Minkowski reduced matrix. where R = Chol(Y). First, by mdecode1 (R, 0.5, 1) (see, Algorithm 7), we obtain the shortest lattice vector z 1 ,

z 1 =    1 0 -1    =    z 11 z 12 z 13    ,
and by Transform (1, z 1 ) (see, Algorithm 6), we extend Rz 1 to a basis for L (R),i.e., RZ.

For j = 3 and l = 3, we have z 1 = z 12 , z 2 = z 13 and

M = 0 1 -1 0 z 2 = 1, Z(:, 2 : 3) = Z(:, 2 : 3)M =    0 0 1 0 0 1    M =    0 0 0 1 -1 0    .
Now, for j = 2, l = 2 we have z 1 = z 11 , z 2 = 1

M = 1 -1 1 0
and

Z(:, 1 : 2) = Z(:, 1 : 2)M =    1 0 0 0 0 -1    M =    1 -1 0 0 -1 0    Finally, for p = 1 Z =    1 -1 0 0 0 1 -1 0 0    .
For p = 2. Again, by mdecode1(R, 0.5, 2), we obtain the second integer vector,

z 2 =    -1 0 -1    ,
we have in this case Z = Z 1 Z 2 , where

Z 1 = I 1 0 0 M 2 =    1 0 0 0 z 22 0 z 23    =    1 0 0 0 0 0 -1   
and

Z 2 =    1 z 21 0 0 1 0 0 0 1    =    1 -1 0 0 1 0 0 0 1    .
If we take a look at the Transform algorithm, we notice that j = 3 -2 + 1 and [d, a, b] = gcd(z 21 , z 22 ). However, this should be [d, a, b] = gcd(z 22 , z [START_REF] Braden | Klein's curve[END_REF] ) and

M = 0 1 -1 0 Therefore, Z = Z 1 Z 2 =    1 0 0 0 0 1 0 -1 0       1 -1 0 0 1 0 0 0 1    =    1 -1 0 0 0 1 0 -1 0    .
For the last p, p = 3, we have by mdecode1(R, 0.5, 3),

z 3 =    0 0 -1    and Z =    1 0 z 31 0 1 z 32 0 0 z 33    =    1 0 0 0 1 0 0 0 -1    .
Finally, we multiply all the unimodular matrices obtained at the end of each case,

Z =    1 -1 0 0 0 1 -1 0 0       1 -1 0 0 0 1 0 -1 0       1 0 0 0 1 0 0 0 -1    =    1 -1 1 0 -1 0 -1 1 0    .
Thus, by this Z, we form a new basis matrix for L(R) such that Z R RZ = Z YZ is Minkowski reduced. Looking now at an example for m = 4 For p = 1, by the mdecode1(R, 0.5, 1), we obtain our first integer vector

Y =     
z 1 , z 1 =      0 0 0 -1     
and by the "Transform(1, z 1 )" function, we form our first unimodular matrix ,

Z =      0 -1 0 0 0 0 -1 0 0 0 0 1 -1 0 0 0      such that Z -1 .z 1 =      1 0 0 0     
.

For p = 2, the second integer vector is

z 2 =      0 1 -1 -1      =      z 21 z 22 z 23 z 24     
. Now, how can we form a lattice basis, or in a simple words, how can we form a unimodular matrix Z such that the second integer vector is this z 2 ?

We had already shown that Z = Z 1 Z 2 , where

Z 1 = I 1 0 0 M 3 , Z 2 =      1 z 21 0 0 0 1 0 0 0 0 1 0 0 0 0 1     
and M 3 is a 3 × 3 matrix such that the first vector column must be

z 2 =    z 22 z 23 z 24    , then M 3 =    1 -1 -1    .
In this case, we apply the Transform(1, z 2 ) function.

Then we obtain

M 3 =    1 -1 0 -1 0 1 -1 0 0    .
Therefore,

Z 1 =      1 0 0 0 0 1 -1 0 0 -1 0 1 0 -1 0 0      and Z 2 =      1 0 0 0 0 0 0 1 0 0 0 1      Finally, Z = Z 1 Z 2 =      1 0 0 0 0 1 -1 0 0 -1 0 1 0 -1 0 0      and this Z verifies Z -1 z 2 =      0 1 0 0     
.

If we multiply this Z by the previous one for p = 1, we obtain

     0 -1 1 0 0 1 0 -1 0 -1 0 0 -1 0 0 0      .
Now, what happens in the coded algorithm? For p = 2, we have

z 2 =      0 1 -1 -1      = z
then by Transform(2, z) algorithm, we obtain

Z =      0 0 -1 0 0 -1 0 -1 0 -1 0 0 -1 0 0 0      =      0 -1 0 0 1 -1 0 -1 0 -1 0 0      .
The problem came from z 1 = z(j -1), z 2 = z(j) and z(j -1) = d. In the case p = 2, it has to be z(j) = d and not z(j -1) = d, z 1 = z(j) and z 2 = z(j + 1). There is no problem for p = 3 since j = m -p + 1 = 4 -3 + 1 = 2. However, another problem appears in this case, z 1 and z 2 must be changed from z(j -1) and z(j) to z(j + 1) and z(j + 2).

The same problems arise if we take 5 as the dimension of a lattice. For p = 2, z(j -1) = d must be replaced by z(j) = d and z 1 , z 2 should be replaced by z(j) and z(j + 1). For p = 3, we should take z 1 = z(j + 1), z 2 = z(j + 2) and z(j + 1) = d and finally, for p = 4, z 1 = z(j + 2), z 2 = z(j + 3).

Sometimes, the z obtained by the mcode1 algorithm have a particular shape and cause problems in the algorithm. That is why we had the idea of taking each m independently in an algorithm.

For example if p = 1 and

z =      1 0 0 0     
then we should add in this case, if z 1 = 0 and z 2 = 0 then j = j -1.

Note that after obtaining a Minkowski reduced basis, we have to verify Minkowski's conditions. Also in order that a simple real symmetric Minkowski reduced basis M = (a i,j ) 1≤i,j≤m has a j,j+1 ≥ 0 for all j ∈ {1, .., m -1}, an algorithm. 10 is also given, named Sign2 for m = 2 and Sign3 for m = 3 (see, Algorithm 11). We can also construct such an algorithm for arbitrary m however because of the space occupied by the algorithm for m > 3, we deal only with dimensions 2 and 3.

Note that if B is not a symmetric positive definite matrix, we apply Sign2 on (B, Z).

We illustrate now the simple Minkowski reduction with an example. Let Y be a symmetric positive definite matrix, Output: U an unimodular matrix such that ((RU ) (RU )) i,i+1 ≥ 0.

U = ∅; C = (RZ) (RZ); if C(1, 2) < 0 then U = [-Z(:, 1) Z(:, 2)] ; C = (RU ) (RU ); Z = U ; if C(1, 2) < 0 then U = [-Z(:, 1) -Z(:, 2)] ; C = (RU ) (RU ); Z = U ; end if end if if C(1, 2) >= 0 then U = Z; end if
vector z 1 such that Rz 1 is the shortest lattice vector spanned by R is obtained,

z 1 =    1 2 2    .
To construct a lattice basis such that Rz 1 is the first lattice vector, we call the Transform(1, z 1 ) algorithm, (see, Algorithm 6). This algorithm gives us the following unimodular matrix Z for p = 1:

Z =    1 0 0 2 1 -1 2 1 0   
we go up to the next level p = 2. We start with an update of the upper triangular matrix R, simply by applying Cholesky's decomposition to (RZ) (RZ).

Then, again by the sphere decoding algorithm, we find the second integer vector,

z 2 =    1 -2 -1    .
To form a basis matrix by this lattice vector Rz 2 already obtained. We had shown before that the unimodular matrix Z which transform the basis matrix to a new one had the following form, Z = Z 1 Z 2 where

Z 1 = I 1 M 2
and

Z 2 =    1 z 21 0 0 1 0 0 0 1    .
M 2 is an unimodular matrix whose first column is [z 22 , z 23 ] , thus,

M 2 = -2 1 -1 0
and finally,

Z = Z 1 Z 2 =    1 0 0 0 -2 1 0 -1 0    .    1 1 0 0 1 0 0 0 1    =    1 1 0 0 -2 1 0 -1 0    .
Before moving to the final step, we update the upper triangular matrix R. Finally, for p = 3,

Z =    1 0 z 31 0 1 z 32 0 0 z 33    =    1 0 1 0 1 0 0 0 -1   
. Now, we multiply the unimodular matrices Z obtained at the end of each p,

Z =    1 0 0 2 1 -1 2 1 0    .    1 1 0 0 -2 1 0 -1 0    .    1 0 1 0 1 0 0 0 -1    =    1 1 1 2 1 1 2 0 1    , A = (a ij ) 1≤i<j≤m = (RZ) (RZ) =

Comparison Between Reduction Algorithms

HKZ and LLL: Both, the HKZ reduced basis and the LLL reduced basis require size-reduction. The main difference between them is that for each trailing (n -i + 1) × (n -i + 1) sub-matrix of the upper triangular matrix R of the lattice generating matrix, an HKZ reduced basis requires that its first column be a shortest non-zero vector in the lattice generated by the sub-matrix, while an LLL-reduced basis only requires that its first column scaled by a factor of δ be shorter than its second column. Thus, an HKZ reduced basis, is an LLL reduced basis for any 0.25 < δ < 1. As the previous reduction algorithm, we start by searching the first shortest lattice vector. Note that we adapt here the HKZ algorithm of Zhang, Qiao and Wei, [START_REF] Zhang | Practical HKZ and Minkowski Lattice Reduction Algorithms[END_REF].

HKZ and Minkowski

By the sphere decoding algorithm, we obtain our first shortest vector

z 1 =    1 -1 0   
Then by Transform(1, z), we extend z 1 to a basis of the lattice and we obtain

Z =    1 -1 0 -1 0 0 0 0 -1    And R = chol (RZ) (RZ) =   
0.7861 0.0366 -0.2799 0 0.7998 -0.3532 0 0 0.6648

  
Now, to find a non zero vector z 2 ∈ Z 2 such that R(2 : 3, 2 : 3)z 2 (where R(2 : 3, 2 : 3) is a sub-matrix of R formed by the second and the third rows and the second and the third columns of R) is the shortest vector of the lattice generated by R(2 : 3, 2 : 3), the sphere decoding algorithm is also used, and we obtain as a solution

z 2 = 0 -1
As before, we apply the transform function, Transform(2, z 2 ) and we obtain

M 2 = 0 1 -1 0 Z =    1 0 0 0 0 1 0 -1 0    .
We multiply the unimodular matrices Z obtained at the end of each case

Z =    1 -1 0 -1 0 0 0 0 -1       1 0 0 0 0 1 0 -1 0    =    1 0 -1 -1 0 0 0 1 0    Now,
Z =    1 -1 0 -1 0 0 0 0 -1    .
As we know, for a basis to be reduced in the sense of HKZ, the lattice basis B must verify the size reduction condition which is not the case for the Minkowski This matrix was created using a 4 × 4 matrix L with random entries, and then setting Y = L L. As usual we put Y = R R where the upper triangular matrix R is obtained from Y via a Cholesky decomposition.

To this matrix R, we apply the algorithm for Minkowski reductions discussed above based on a successive finding of shortest lattice vectors. The found matrix Ỹ = R R is then postprocessed to ensure the simple Minkowski reduction condition Ỹi,i+1 ≥ 0, i = 1, 2, 3, i.e., a unimodular matrix Z is constructed such that Z Ỹ Z has positive elements in the right parallel to the diagonal. This leads to the matrix The length of the shortest vector identified by the LLL algorithm is in this example 0.5735, thus longer than the shortest vector of the lattice which is still 0.5321 since both the LLL and the Minkowski reduction of a lattice are obtained via unimodular transformations. The latter obviously do not change the length of the shortest vector. Thus, this example shows that the LLL algorithm can lead to a considerable overestimation of the length of the shortest vector even for small size of the matrix. The effect is known to grow exponentially with the size of the matrix.

Note that in the above example, the shortest vector appears as the second vector in contrast to a Minkowski ordered matrix where the shortest vector is always the first.

Remark. An LLL reduced matrix is always ordered in accordance with the LLL condition. Thus there is no reason why the shortest vector should appear in the first position as in Minkowski reduced matrices. This is especially important in the context of the Siegel algorithm (see, Chapter 5) where the shortest vector is always assumed to be the first of the matrix.

To illustrate this aspect even more, we consider another example of a random matrix, Y = In this case the shortest vector is found by the LLL algorithm in contrast to the previous example, but it appears as the last vector. The first vector has with 0.3753 almost twice the length of the shortest vector, 0.2205. Note that the algorithm [START_REF] Deconinck | Computing Riemann theta functions[END_REF] implemented in Maple uses the LLL algorithm on Y instead of an exact determination of the shortest lattice vector. As discussed above and illustrated below, this is considerably more rapid than an exact determination of the vector, but can lead to exponentially (in the dimension g) growing errors in this context.

The Orthogonality Defect Of Lattice Reduction Algorithms

We denote by δ H,m , δ L,m and δ M,m the upper bounds of the orthogonality defect over all m × m HKZ, LLL (with δ = 3/4) and Minkowski reduced bases, respectively. Then from

m i=1 b i ≤ γ m m m i=1 i + 3 4 1 2 vol(L) (HKZ) m i=1 b i ≤ β m(m-1) 4 vol(L), where β = (δ - 1 4 ) -1 (LLL) m i=1 b i ≤ γ n 2 m 5 4 (m-3)(m-4) 4 vol(L) (Minkowski) γ m ≤ 1 + m 4
, for all m ≥ 1 (Hermite's constant).

128

We obtain,

δ H,m ≤ γ m 2 m m i=1 i + 3 4 1 2 = 2 O(m log m) δ L,m ≤ 2 m(m-1) 4 δ M,m ≤ γ m 2 m 5 4 (m-3)(m-4) 4 = 5 4 m 2 4 +O(m log m)
.

We see from Table 4.1 that the upper bound of the orthogonality defect of Minkowski reduced bases is better (slightly smaller) than that of HKZ reduced bases. However, both are expected to be more orthogonal than LLL, especially for m = 6, 7, 8 and generally for lattices of dimensions m ≤ 8. And we notice that for lattices of high dimension, an HKZ reduced basis is expected to be more orthogonal than a LLL reduced basis or a Minkowski reduced basis, such as m = 24, and the gap between HKZ reduced bases and LLL reduced bases gets larger quickly as the dimension increases.

Chapter 5

On the action of the Symplectic Group on the Siegel Upper Half Space

In his fundamental paper [START_REF] Siegel | Einführung in die Theorie der Modulfunktionen n-ten Grades[END_REF] Siegel introduced a special symmetric space H g of dimension g which is called now the the g-dimensional Siegel upper half space. H 1 is the hyperbolic upper half plane. H g is formally defined as the subset of g × g complex symmetric matrices whose imaginary part is a positive definite matrix.

In fact, the origin of H g goes back to Riemann who defined the Riemann matrix A ∈ H g corresponding to a compact Riemann surface of genus g, endowed with a specific complex structure. Sp(2g, R) is the biholomorphism group of H g . Of special interest is the lattice Γ g = Sp(2g, Z) which is called the Siegel modular group.

The modular group name is related to the fact that the points of the quotient space Γ 1 /H 1 where Γ 1 = SL(2, Z) are moduli (= parameters) for the isomorphism classes of elliptic curves over C. To each point τ ∈ H 1 one can associate the lattice Λ τ = Zτ + Z1 ⊂ C and the quotient space E τ = C/Λ τ , which is an elliptic curve, i.e., it is at the same time a complex curve and an abelian group. Conversely, every elliptic curve over C can be obtained in this way, but not uniquely: if E is such a curve, then E can be written as the quotient C/Λ for some lattice (discrete rank 2 subgroup) Λ ⊂ C which is unique up to "homotheties" Λ → λΛ with λ ∈ C * , and if we choose an oriented basis (ω 1 , ω 2 ) of Λ (one with I(ω 1 /ω 2 ) > 0) and use λ = ω -1 2 for the homothety, then we see that E ∼ = E τ for some τ ∈ H 1 , but choosing a different oriented basis replaces τ by γ.τ for some γ ∈ Γ 1 . The quotient space Γ 1 /H 1 is the simplest example of what is called a moduli space, i.e., an algebraic variety whose points classify isomorphism classes of other algebraic varieties of some fixed type, (see [START_REF] Hain | Lectures on moduli spaces of elliptic curves[END_REF]196]). In this chapter, we would like to introduce the action of Siegel's modular group on the Siegel upper half space, and study the fundamental domain for this action defined for all g. Definition 9. Siegel's fundamental domain F g is the set of Ω = (Ω ij ) ∈ H g that satisfies the three following conditions:

1. |R(Ω ij )| ≤ 1
2 for all i, j ∈ {1, ..., g};

2. I(Ω) is in the fundamental region of Minkowski reductions;

3. |det(CΩ + D)| ≥ 1 for all C, D ∈ G g .
However, this action known as Siegel's fundamental domain seems difficult to obtain for genus greater than 2. For genus 1, we have the well known elliptic fundamental domain and genus 2 is due to Gottschling's work [START_REF] Gottschling | Explizite Bestimmung der Randfächen des Fundamentalbereiches der Modulgruppe zweiten Grades[END_REF]. However, two points prevent us for constructing this fundamental domain for arbitrary g. First, the Minkowski fundamental domain appearing in the second condition of this domain Def 9 is only known for g ≤ 3. For the moment, the case g = 3 is the most promising to study in this context. Secondly, the third condition of Def 9, i.e., finding the finite number of classes {C, D} of coprime symmetric pairs C, D for which the absolute value of det(Cτ + D) ≥ 1. Even less is known about the third condition, it would be interesting to explore the matrices C and D of Def 9 as Gottschling did in genus 2 to compute |det(Cτ + D)| at least for an interesting set of these matrices (say for rank C = 1). Siegel in [START_REF] Siegel | Topics in complex function theory[END_REF] gave an algorithm to approximately reach the fundamental domain. But unfortunately, another problem appears, the shortest vector problem (SVP) for higher dimensions. Siegel's modular group and Siegel's upper half space have many applications [START_REF] Andrianov | Quadratic forms and Hecke operators[END_REF]. For example, theta functions [START_REF] Fay | Theta functions on Riemann surfaces[END_REF][START_REF] Shalit | On special values of theta functions of genus two[END_REF] are classically connected with Riemann surfaces and modular group. An important step in the efficient computation of multi-dimensional theta functions is the construction of appropriate symplectic transformations for a given Riemann matrix assuring a rapid convergence of the theta series. Siegel's algorithm [START_REF] Siegel | Topics in complex function theory[END_REF] is used to approximately map the Riemann matrix to the Siegel fundamental domain. The shortest vector of the lattice generated by the Riemann matrix is identified exactly, and the algorithm ensures that its length is larger than √ 3/2. The approach is based on a previous algorithm by Deconninck et al. [START_REF] Deconinck | Computing Riemann theta functions[END_REF] using the LLL algorithm for lattice reductions. Here, the LLL algorithm is replaced where J = 0 I g -I g 0 , is called the (real) symplectic group of degree g and denoted by Sp(2g, R).

Notice that det(J) = 1, J 2 = -I 2g and J = J -1 = -J. It is often useful for practical purposes to use block-matrix notation and to write M = A B C D where the entries A, B, C and D are g × g matrices.

So M is symplectic if and only if

A C = C A, B D = D B, A D -C B = I g . (5.2)
We notice also if M is symplectic, M is symplectic too since: It follows that we have the equivalences

M JM = M J(JM -1 J -1 ) = -M M -1 (-J) = J. ( 5
M ∈ Sp(2g, R) ⇔ M JM = J ⇔ M JM = J.
We have also the following formula for the inverse of M :

A B C D -1 = D -B -C A , (5.5) such that if M is a symplectic matrix M -1 is symplectic too since (M -1 ) JM -1 = -(M JM ) -1 = J.
Notice that in the case g = 1 the formula above (5.5) reduces to the familiar

M -1 = d -b -c a which is true for every 2 × 2 matrix M = a b c d such that det(ad -bc) = 1.
This implies that for g = 1, we have Sp(2, Z) = SL(2, Z). γ 1 .(γ 2 .τ ) = (γ 1 γ 2 ).τ , for each τ ∈ H g . Hence, the action is well defined.

To prove transitivity, it is enough to find a symplectic map that transforms τ = iI to any X + iY ∈ H g , Y > 0. Hence, we consider the composition of two symplectic maps associated with the following symplectic matrices

ν = √ Y 0 0 √ Y -1 and ξ = I X 0 I such that (ξν).τ = X + iY .
This action is biholomorphic since it is a rational function and the inverse of this action is obtained by acting on γ -1 , i.e., γ -1 .τ = D τ -B -C τ +A where it is a rational function, too.

Sp(2g, Z) acts properly discontinuously on H g . For example, for g = 1, given γ ∈ SL(2, Z), we have γ(F ) ∩ F = ∅ unless γ lies in a finite set of elements of SL(2, Z) which have the fix point η

= 1 2 + i √ 3
2 ∈ H 1 and i ∈ H 1 where F is the fundamental domain for the action of SL(2, Z) on the upper half plane H 1 .

Note that -I 2g acts trivially on H g , i.e, -I 2g .τ = τ for each τ ∈ H g . Therefore, we can consider the action of G g := Sp(2g, Z)/ ±I 2g called " the projective symplectic group", on H g , where Γ g := Sp(2g, Z) is called "the modular group".

Proposition ([133]). The modular group Γ g is generated by the three following classes of generators:

0 I -I 0 , A 0 0 (A -1 ) , I B 0 I
for all A ∈ GL(g, Z) and B a symmetric, integer matrix.

Proof. See, [ [START_REF] Mumford | Tata lectures on Theta. I and II[END_REF], proposition A5, p.210].

Siegel in [START_REF] Siegel | Topics in complex function theory[END_REF] gave, for all g, the following fundamental domain for the action of G on H g . Lemma 3. For all Ω ∈ F g , let Ω 11 be the first diagonal element of Ω, then

I(Ω 11 ) ≥ √ 3 2 . Proof. Let A B C D ∈ G g such that A = 0 0 g-1 0 g-1 I g-1 , B = -1 0 g-1 0 g-1 0 g-1,g-1 ,
(5.10)

C = 1 0 g-1 0 g-1 0 g-1,g-1 , D = 0 0 g-1 0 g-1 I g-1 , ( 5

Genus 1

An early study of this action was done by C. L. Siegel in his 1943 book "Symplectic Geometry" [START_REF] Siegel | Symplectic Geometry[END_REF].

H g and Γ g are meaningful generalizations of the usual upper half plane

H = H 1 = {τ ∈ C | I(τ ) > 0} ,
and the linear fractional transformation group SL(2, R) acting on H, where

SL(2, R) = a b c d | a, b, c, d ∈ R, ad -bc = 1 .
The special linear group acts on H via the "Möbius transformation" (5.7). This action is well defined and

I(γ.τ ) = I(bcτ + adτ ) |cτ + d| 2 = I(τ ) |cτ + d| 2 .
(5.12)

Definition. The projective symplectic group (or elliptic projective symplectic group) is defined by

G 1 = G := Γ 1 / ±I 2 , where Γ 1 = SL(2, Z) It is just the image of SL(2, Z) on P SL(2, R) := SL(2, R)/ ±I 2 ,
where P SL(2, R) acts faithfully on H, i.e., for all τ ∈ H, γ.τ = τ ⇒ γ = e. We will show now the fundamental domain F 1 for the action of G on H and some important properties. Proposition. The set

Definition. G = Γ

F 1 := τ ∈ H | |τ | > 1, |R(τ )| < 1 2 ,
is a fundamental domain for the action of G on H (sometimes called, a fundamental domain for the full modular group Γ 1 ), see. τ . These are the only equivalences for the points on the boundary. Therefore, F1 is defined as the semi-closure of F 1 where only the boundary points with non-positive real part (see, Figure . 5.2) are added. Then every point of H is G 1 -equivalent to a unique point of F1 , i.e., F1 is a strict fundamental domain for the action of G 1 . However, most people use the words "fundamental domain" for the strict fundamental domain or for its closure rather, then for the interior (see, [196]). Therefore, the identity is obtained: 2 , for τ = exp( πi 3 ).

• if γ = 0 -1 1 1 = (ST ), for τ = exp( 2πi 3 ), • if γ = 0 -1 1 -1 = (T S)
If c = -1: we return to c = 1 by simply changing the sign of the coefficients a, b, c, d.

Finally, for τ = i, we have Sτ = -1 i = i, and therefore, we get the identity when γ = S. To summarize, we have that Stabilizer(exp( 2πi3 )) (respectively, Stabilizer(exp( πi 3 )), Stabilizer(i)) is generated by ST , (respectively, T S, S).

We deduce the following corollary:

Corollary 2. The canonical map h : F 1 → H/G 1 is surjective and its restriction on F 1 is injective.

Proof. This action is surjective since for every τ ∈ H, there exists γ ∈ G 1 such that γ.τ ∈ F 1 and injective since for a given τ 1 , τ 2 ∈ F 1 such that τ 2 = γ.τ 1 , these elements are on the boundary of F 1 .

Theorem. Γ 1 is generated by S and T .

Proof. Let Γ 1 be the subgroup of Γ 1 generated by S and T . Pick any point τ 0 in the interior of F 1 , i.e., F 1 . For any γ ∈ Γ 1 , we must show that γ ∈ Γ 1 .

If τ = γ.τ 0 , then there exists a γ ∈ Γ 1 such that γ .τ = γ γ.τ 0 ∈ F 1 . But since τ 0 was chosen in F 1 , and τ 0 , γ γ.τ 0 are both in F 1 , so this implies that γ γ = ±I 2 and hence γ ∈ Γ 1 . given by the subset of τ = τ 1 τ 3 τ 3 τ 2 ∈ H 2 such that:

Genus 2

1. |R(τ j )| ≤ 1 2 for all j ∈ [1, 3], 2. I(τ ) is simple Minkowski reduced. 3. |det(Cτ + D)| ≥ 1 for all symplectic matrices A B C D ∈ {R j } 1≤j≤19 .
Gottschling [START_REF] Gottschling | Explizite Bestimmung der Randfächen des Fundamentalbereiches der Modulgruppe zweiten Grades[END_REF]

|τ 1 + τ 2 -2τ 3 ± 1| ≥ 1.
From (5.2) or (5.4), we can now find the matrices A and B and construct the {R j } 1≤j≤19 symplectic matrices below.

R 1 =      0 0 -1 0 0 0 0 -1 1 0 0 0 0 1 0 0      , R 2 =      0 0 -1 0 0 0 0 -1 1 0 1 0 0 1 0 0      , R 3 =      0 0 -1 0 0 0 -1 1 0 -1 0 1 0      R 4 =      0 0 -1 0 0 0 0 -1 1 0 0 0 0 1 0 1      , R 5 =      0 0 -1 0 0 0 0 -1 1 0 0 0 0 1 0 -1 1 0 0 0 0 1 0 0 1 -1 1 0 -1 1 0 1      R 19 =      -1 0 0 0 0 -1 0 0 1 -1 -1 0 -1 1 0 -1     
.

Gottschling [START_REF] Gottschling | Explizite Bestimmung der Randfächen des Fundamentalbereiches der Modulgruppe zweiten Grades[END_REF] has shown in his article the necessity and sufficiency of these 19 matrices to define Siegel's fundamental domain for genus 2. Subsequently, we will use in this context an algorithm written by Dupont [START_REF] Dupont | Moyenne Arithmético-Géométrique, suites de Borchardt et applications[END_REF] (see, algorithm 12).

where,

R 1 =    I 2 1 0 0 0 0 I 2    , R 2 =    I 2 0 0 0 1 0 I 2    , R 3 =    I 2 0 1 1 0 0 I 2    .
and {R j } 1≤j≤19 are those introduced in theorem 7. This algorithm follows from theorem 7, as well as from the following result:

Lemma. For all τ ∈ H 2 and > 0, the set

λ ≥ | ∃ A B C D ∈ G 2 such that λ = |det(Cτ + D)| is finite Proof. It is a direct consequence of [[ 90
], Lemma1, p.29].

Genus 3

In this section, we present some results concerning the fundamental domain for genus 3, in particular for rank C = 1. Before the discussion of our new results, we state a result due to Gottschling which plays a central role in our work.

We start by giving some definitions that are important for some details in this result.

Definition. Let B be a region containing F 2 which is defined by the following inequalities:

1. The standard limits for the real part of τ =

τ 1 τ 3 τ 3 τ 2 = x 1 x 3 x 3 x 2 + i y 1 y 3 y 3 y 2 ∈ H 2 : - 1 2 ≤ x 1 , x 2 , x 3 ≤ 1 2 ;
2. The simple Minkowski conditions for g = 2:

y 2 ≥ y 1 ≥ 2y 3 ≥ 0; 3. The two inequalities |τ 1 | ≥ 1, |τ 2 | ≥ 1
that correspond to the third condition of F 2 and which are obtained by the following set of matrices:

C = 1 0 0 0 , D = 0 0 0 1 and C = 0 0 0 1 , D = 1 0 0 0 . Definition. Let B 0 be the part of B in which y 2 ≤ 1, B 1 be that part of B 0 in which -1 2 ≤ x 3 ≤ -1 4 and B -1 that part of B 0 in which 1 4 ≤ x 3 ≤ 1 2 .
Lemma 4. In the domain B e where (e = -1, 0, 1), the inequality

|τ 1 + τ 2 -2τ 3 -2e| ≥ 1;
is a sequence of |det(τ + eS)| ≥ 1 with S = 0 1 1 0 .

Proof. See, [lemma 2, p. 109, [START_REF] Gottschling | Explizite Bestimmung der Randfächen des Fundamentalbereiches der Modulgruppe zweiten Grades[END_REF]].

Definition. Two pairs (C, D) and (C 1 , D 1 ) are associated when there is an unimodular matrix U such that (C 1 D 1 ) = U (CD).

F 3

It follows from Siegel's fundamental domain that its third condition in theorem 10 makes this domain not easy to be obtained, specially for g ≥ 3. The task here, is to find a finite set (in other words, a finite number of conditions) for which the inequality, |det(Cτ + D)| ≥ 1, must be verified.

Theorem. For genus 3 and a rank 1 matrix C, we have the following inequalities to be verified: If we replace U by

Writing τ =    τ 1 τ 4 τ 5 τ 4 τ 2 τ 6 τ 5 τ 6 τ 3    then |τ 1 | ≥ 1, |τ 2 | ≥ 1, |τ 3 | ≥ 1, |τ 1 + τ 2 -2τ 4 ± 1| ≥ 1, |τ 2 + τ 3 -2τ 6 ± 1| ≥ 1, |τ 1 + τ 3 + 2τ 5 ± 1| ≥ 1 if I(τ 5 ) < 0, |τ 1 + τ 3 -2τ 5 ± 1| ≥ 1 if I(τ 5 ) > 0, |τ 1 + τ 2 + τ 3 + 2τ 4 - 2τ
   1 d 3 d 4 0 d 1 d 6 0 d 8 d 2    U , then U CV =    c 0 0 0 0 0 0 0 0    and U DV -=    d 0 0 0 1 0 0 0 1    . (5.13) Let V -1 =    p q r s t u v w x    , hence V =    tx -uw rw -qx qu -rt uv -sx px -rv rs -pu sw -tv qv -pw pt -sq    , with p(tx -uw) -q(sx -uv) + r(sw -vt) = 1.
Finally, we obtain We will show now that the assignment between the classes of associated pairs (C, D) with rank C = 1 and the integers c, d, p, q, r is uniquely determined with the properties (5.15). In the first hand, let, in addition of V -1 , V -1 1 be an unimodular matrix with (p, q, r), the first line of this matrix, and we take the following pair of matrices

|det(Cτ + D)| = c(p 2 τ 1 + q 2 τ 2 + r 2 τ 3 + 2pqτ 4 + 2prτ 5 + 2qrτ
C 1 =    c 0 0 0 0 0 0 0 0    V -1 1 , D 1 =    d 0 0 0 1 0 0 0 1    V 1 , (5.17)
similarly to (5.16). It follows from (5.16), and (5.17) that

C 1 = U 1 C, D 1 = U 1 D,
where U 1 is an unimodular matrix of the form

U 1 =    d 0 0 0 1 0 0 0 1    V 1 V -    d -1 0 0 0 1 0 0 0 1    .
Hence, we can deduce that the pairs (C where the first line of V -1 0 is denoted by (p 0 , q 0 , r 0 ) and we apply the corresponding conditions on c, d, p, q, r to the integers c 0 , d 0 , p 0 , q 0 , r 0 . From

U 0 U -1    c 0 0 0 0 0 0 0 0    =    c 0 0 0 0 0 0 0 0 0    V -1 0 V,
and c, c 0 > 0, we deduce that c = c 0 . We have also

V -1 0 V =    ±1 0 0   
which implies that the first lines of V -1 where the integers c, d, p, q, r satisfy the conditions (5.15).

The right-hand side of (5.14) can be estimated by the absolute value of the imaginary part, where the imaginary part is denoted by Since the imaginary part of τ is Minkowski reduced, I(τ ) must satisfy the following Minkowski conditions: we notice from the fundamental domain of Minkowski, see [START_REF] Tammela | On reduction theory of positive quadratic forms, Studies in number theory. Part 3[END_REF], that the 16 systems of linear inequalities have the following condition: However, if c = 1 and y 5 > 0, the following inequalities must be verified: Since p ≥ 0, for each possibility, three cases must be studied:

I(τ ) =   
y 1 ≤ y 2 ≤
• 1.d. p ≥ 0, q ≥ 0 and r ≤ 0,

• 1.e. p ≥ 0, q ≤ 0 and r ≥ 0,

• 1.f . p ≥ 0, q ≤ 0 and r ≤ 0.

We notice in 1.d, that if we replace p by p + 1, q by q + 1 and r by r -1, and by Minkowski's conditions (5.18), then |det(Cτ + D)| ≥ c(p 2 y 1 + q 2 y 2 + r 2 y 3 + 2pqy 4 + 2pry 5 + 2qry 6 ) = c 2 [p 2 y 1 + q 2 y 2 + 4pqy 4 + p 2 y 1 + r 2 y 3 + 4pry 5 + q 2 y 2 + r 2 y 3 + 4qry 6 ] > 1.

In 1.f , similarly, we replace p by p + 1, q by q -1 and r by r -1 and then by Minkowski's conditions (5.18), we deduce that |det(Cτ + D)| > 1. Again, in 1.e, we replace p by p + 1, q by q -1 and r by r + 1. Then by Minkowski's (5.18) and Tammela's (5.19) conditions, we obtain |det(Cτ + D)| ≥ c p 2 y 1 + q 2 y 2 + r 2 y 3 + 2pqy 4 + 2pry 5 + 2qry 6 > 1.

Therefore, it remains to test the first values taken by p, q and r. We deduce from 1.a, in particular, when |p| = 1 + |q| and |q| = |r| that for c = 1 and (p, q, r) = (1, 0, 0), the following inequality should be verified: which correspond to c = 1 with (p, q, r) = (1, -1, 0). But according to lemma 4, we obtain the following inequalities:

|τ 1 | ≥ 1. ( 5
|τ 1 + τ 2 -2τ 4 ± 1| ≥ 1.
(5.28)

Finally, |p| = |q| and |p| = -1 + |r| gives us the last inequality to be verified:

|τ 3 | ≥ 1, (5.29)
and which corresponds to c = 1 with (p, q, r) = (0, 0, 1). This proves the theorem.

Approximation to the Siegel fundamental domain

Whereas Siegel's fundamental domain as defined in Def 10 is an important theoretical concept in symplectic geometry, its practical relevance is limited since no constructive approach exists to actually identify the domain for g > 2:

the first condition on the components of the matrix of the real part of Ω is straight forward. But as discussed in section 5.1, the Minkowski fundamental domain appearing in the second condition of Def 10 is only known for g ≤ 3, and the third condition of Def 10 is, however, the least studied one. For this reason, Siegel in [START_REF] Siegel | Topics in complex function theory[END_REF] gave an algorithm to approximately reach the fundamental domain. Now, we review this algorithm due to Siegel which has been implemented together with the LLL algorithm in [START_REF] Deconinck | Computing Riemann theta functions[END_REF]. This algorithm is used here together with an exact determination of the shortest lattice vector (see, [START_REF] Frauendiener | Efficient computation of multidimensional theta functions[END_REF]). Siegel proved the following: Theorem 8. Any Riemann matrix Ω = X +iY ∈ H g with real and imaginary part X respectively Y = R R, where R is an upper triangular matrix, can be transformed by a symplectic transformation 5.7 to a matrix satisfying the following conditions:

1. |X nm | ≤ 1/2, for n, m = 1, ..g, 2. the squared length of the shortest lattice vector of the lattice generated by Y is greater than or equal to √ 3/2.

The proof in [START_REF] Siegel | Topics in complex function theory[END_REF], see also [START_REF] Deconinck | Computing Riemann theta functions[END_REF], is constructive and leads naturally to an algorithm:

Proof. The first condition can be always achieved by an appropriate choice This leads to the following algorithm:

1. choose A in (5.7) such that the shortest lattice vector appears as the first vector of R;

2. choose B in (5.7) such that the real part of Ω = A ΩA has components Xnm ≤ 1/2, for n, m = 1, ..., g;

3. if Ω11 ≥ 1, terminate the algorithm; if not, apply the quasi-inversion (5.10), (5.11) and continue with step 1 of the algorithm for the resulting Ω.

Because of (5.31) the modulus of the determinant of the imaginary part of the transformed matrix increases with each application of step 3. Since Siegel [START_REF] Siegel | Topics in complex function theory[END_REF] has shown that there exists only a finite number of symplectic transformations leading to increasing |det(Y )| and that this determinant will be eventually greater than or equal to 1, the algorithm terminates after a finite number of steps. Then Y 11 is the squared length of the shortest lattice vector by construction. According to lemma 3, one has Y 11 ≥ √ 3

2 . This proves the theorem. This algorithm can be used to efficiently compute multi-dimensional theta functions.

Theta functions

Definition. Theta functions with characteristics are defined as an infinite series. Let Ω be a g × g Riemann matrix, then Θ pq (z, Ω) = N∈Z g exp {iπ Ω (N + p) , N + p + 2πi z + q, N + p } , (5.32) with z ∈ C g and the characteristics p, q ∈ R g , where •• denotes the Euclidean scalar product N, z = g i=1 N i z i . The positive definiteness of I(Ω) guarantees the convergence of the series (5.32) for all values of z. Then the series (5.32) converges in both z and Ω, and uniformly on compact sets. Therefore, the theta function with characteristics is an entire function of z ∈ C g .

A characteristic is called singular if the corresponding theta function vanishes identically. Of special interest are half-integer characteristics with 2p, 2q ∈ Z g . Such a half-integer characteristic is called even if 4 p, q = 0 mod 2 and odd otherwise. It can be easily shown that theta functions with odd (even) characteristic are odd (even) functions of the argument z. The theta function with characteristic is related to the Riemann theta function Θ, the theta function with zero characteristic Θ := Θ 00 , via Θ pq (z, Ω) = Θ(z + Ωp + q) exp {iπ Ωp, p + 2πi p, z + q } .

(5.33)

From its definition, a theta function has the periodicity properties Θ pq (z+e j ) = e 2πip j Θ pq (z) , Θ pq (z+Ωe j ) = e -2πi(z j +q j )-iπω jj Θ pq (z) , (5.34) where e j is a vector in R g consisting of zeros except for a 1 in jth position. These periodicity properties ( 5.34) can be conveniently used in the computation of the theta function: an arbitrary vector z ∈ C g can be written in the form z = ẑ + N + ΩM with N, M ∈ Z g , where ẑ = Ωp + q with |p i | ≤ 1/2, |q i | ≤ 1/2. Thus, it is enough to compute the theta function for arguments ẑ lying in the fundamental domain of the Jacobian, i.e., C g /Λ, where Λ is the period lattice1 formed by Ω and the g-dimensional identity matrix, ẑ = Ωp + q with |p i | ≤ 1/2, |q i | ≤ 1/2. For general arguments z one computes Θ(ẑ, Ω) and obtains Θ(z, Ω) from the periodicity properties (5.34) by multiplying with an appropriate exponential factor.

The convergence of the series (5.32) depends on the bilinear term, more precisely on the shortest vector N min of the lattice Z g equipped with the inner product defined by the imaginary part Y of the Riemann matrix Ω: N, M Y := Y N, M , N, M ∈ Z g (see, [START_REF] Bobenko | Computational Approach To Riemann Surfaces[END_REF][START_REF] Deconinck | Computing Riemann theta functions[END_REF][START_REF] Frauendiener | Efficient computation of multidimensional theta functions[END_REF]). For a given Riemann matrix the shortest vector N min is then defined in terms of its squared length y min = N min , N min Y := min N∈Z g /{0} Y N, N .

(5.35)

The longer the shortest vector, the more rapid the convergence of the theta series. This idea follows from the fact that the theta series can be approximated by a sum, |N i | ≤ N , i = 1, .., g, where the constant N is chosen such that all omitted terms in (5.32) are smaller than some prescribed value of where = 10 -16 . We sum over a g-dimensional sphere and we take into account that we can choose z in the fundamental domain of the Jacobian because of (5.34), we get with (5.35) for the Riemann theta function the estimate N > -ln πy min + 1 2 , (see, [START_REF] Frauendiener | Efficient computation of multidimensional theta functions[END_REF][START_REF] Bobenko | Computational Approach To Riemann Surfaces[END_REF]). Changing the shortest vector can be achieved by changing the homology basis of the underlying Riemann surface which yields a different but symplectically equivalent Riemann matrix. This can be achieved by using modular transformations, i.e., symplectic transformations with integer coefficients to generate larger norms of the shortest vector in order to accelerate the convergence of a theta series for given Ω. This part corresponds to the step 3 of the algorithm presented in the proof of theorem 8. Since the behavior of theta functions under modular transformations is explicitly known, such transformations can dramatically increase the rate of convergence which is especially important for larger values of g. This approach was for the first time implemented in an algorithm by Deconinck et. al. in [38].

The main task in this context is the identification of the shortest vector in a given g-dimensional lattice known as the shortest vector problem (SVP).

Currently, there is no known algorithm that would solve this problem in polynomial-time. The LLL algorithm yields an approximation to the shortest vector in polynomial-time but with an error growing exponentially with the dimension g (though in practice slowly with g such that it can be used for small genus as an approximation). For this reason in, [START_REF] Deconinck | Computing Riemann theta functions[END_REF] the SVP was solved approximately via the LLL algorithm. However, since we are interest in an evaluation of theta functions in a large number of points, it can be beneficial to identify the shortest vector exactly even for small g. Though it is computationally demanding this knowledge will accelerate the ensuing evaluation of the theta function (5.35). Therefore, we replace the LLL algorithm in [START_REF] Deconinck | Computing Riemann theta functions[END_REF] with an exact Minkowski reduction for g ≤ 5, and with an exact solution to the SVP for higher genus.

Example

As an example we want to study the Riemann matrix of the Fricke-Macbeath surface [START_REF] Fricke | Über eine einfache Gruppe von 504 Operationen[END_REF][START_REF] Macbeath | On a curve of genus 7[END_REF], a surface of genus g = 7 with the maximal number 84(g-1) = 504 of automorphisms. It can be defined via the algebraic curve f (x, y) := 1 + 7yx + 21y2 x 2 + 35x 3 y 3 + 28x 4 y 4 + 2x 7 + 2y 7 = 0. (5.36)

The code [START_REF] Frauendiener | Computational approach to compact Riemann surfaces[END_REF] produces for this curve the following Riemann matrix 2 RieMat = Columns 1 through 4 1.0409 + 1.3005i 0.0530 + 0.3624i 0.3484 + 0.0000i 0.0530 + 0.3624i -0.5636 + 1.0753i 0.0187 -0.5975i 0.3484 + 0.0000i 0.0187 -0.5975i 1.0544 + 1.7911i 0.2077 + 0.6759i 0.6749 + 0.3001i 0.3220 -1.0297i -0.2091 -0.2873i 0.1220 -0.5274i 0.3029 + 0.8379i -0.1064 -0.4257i 0.1205 -0.1783i -0.2297 -0.3668i 0.3590 + 0.5023i 0.1990 -0.1118i 0.3495 -0.0499i

Columns 5 through 7 0.2077 + 0.6759i -0.2091 -0.2873i -0.1064 -0.4257i 0.6749 + 0.3001i 0.1220 -0.5274i 0.1205 -0.1783i 0.3220 -1.0297i 0.3029 + 0.8379i -0.2297 -0.3668i -0.0978 + 1.7041i -0.7329 -0.8055i -0.0714 -0.1766i -0.7329 -0.8055i 1.1824 + 1.0163i 0.4425 + 0.2592i -0.0714 -0.1766i 0.4425 + 0.2592i 0.2815 + 0.7791i -0.0415 + 0.5448i 0.0835 -0.2430i -0.6316 -0.0369i

Columns 7 through 7 0.3590 + 0.5023i 0.1990 -0.1118i 0.3495 -0.0499i -0.0415 + 0.5448i 0.0835 -0.2430i -0.6316 -0.0369i 0.2315 + 0.6895i.

Remark. Since we work with finite precision, rounding is an issue also in the context of lattice reductions. The code [START_REF] Frauendiener | Computational approach to compact Riemann surfaces[END_REF] generally produces results with a tolerance Tol between 10 -10 and 10 -14 , which appears for instance in the form of an asymmetry of the computed Riemann matrix of the order of Tol. Since in lattice reductions the components of the Riemann matrix are multiplied with integers, these errors will be amplified. Thus a rounding of an order of magnitude larger than Tol is necessary in practice.

After LLL reduction the first basis vector of the lattice is found to have squared norm 1.3005 i.e., the first component of the imaginary part of the above Riemann matrix. Note that the lattice basis is almost LLL reduced, there are only minor effects of the LLL algorithm applied to this matrix. Since the norm of the shortest vector is greater than √ 3/2, no quasi-inversion is applied. An ensuing shift of the real part leads to the matrix W = Columns 1 through 3 0.0409 + 1.3005i 0.0530 + 0.3624i -0.4849 -0.6245i 0.0530 + 0.3624i 0.4364 + 1.0753i -0.3594 -0.6598i -0.4849 -0.6245i -0.3594 -0.6598i -0.4706 + 1.3844i quasi-inversion is applied. This time the square of the norm of the shortest vector is 1.0211 For applications, it is important to know how long a certain task takes on a given computer. For the above example, the LLL code is not very efficient, but converges in roughly 1 ms. The SVP code takes in this case 4 -5 times longer, which is still completely negligible compared to what can be gained by applying the above algorithm. If we consider an example of even higher genus, the curve f (x, y) := y 9 + 2x 2 y 6 + 2x 4 y 3 + x 6 + y 2 = 0 (5.37)

of genus 16, we find a similar behavior. Using Siegel's algorithm on the Riemann matrix for this curve computed with the code [START_REF] Frauendiener | Computational approach to compact Riemann surfaces[END_REF], we find that the variant with the LLL algorithm converges within three iterations. The LLL algorithm takes 1 -2ms in each step. The algorithm produces Ω 11 = 0.3314 + 1.0188i, a value clearly larger than 1. The length of the shortest vector generated by the imaginary part of this Riemann matrix as found via SVP is 0.4437, well below the theoretical minimum of √ 3/2 ≈ 0.866. On the other hand Siegel's algorithm with an exact solution of the SVP in each step requires 14 iterations where each SVP takes around 10ms. Finally we get Ω 11 = 0.4748 + 0.8956i, i.e., a shortest vector almost twice as long as what has been found with the LLL algorithm. As we see, the approximative LLL algorithm is for g < 20 only an order of magnitude faster than the SVP algorithm, but finds the shortest vector merely with an error growing exponentially with g.

1. 1

 1 The lattice generated by two different bases . . . . . . . . . . 1.2 GSO . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1.3 Idea behind the sphere decoder for the shortest lattice vector . 1.4 Enumeration tree . . . . . . . . . . . . . . . . . . . . . . . . . 1.5 Gauss's reduction . . . . . . . . . . . . . . . . . . . . . . . . . 1.6 Gauss's algorithm . . . . . . . . . . . . . . . . . . . . . . . . . 1.7 The elliptic fundamental domain [Mumford] . . . . . . . . . . 2.1 Lattice in R 2 . . . . . . . . . . . . . . . . . . . . . . . . . . . 2.2 A "good" basis and a "bad" basis . . . . . . . . . . . . . . . 2.3 Gram-Schmidt orthogonalization . . . . . . . . . . . . . . . . 2.4 Example lattice Z 2 with bases B = 1 00 1 and B = 1 20 1 and associated fundamental parallelograms . . . . 3.1 Illustration of size reduction (red) and Gauss reduction (green) for a two-dimensional lattice L spanned by the basis vectors u = [2.1 1] and v = [3 1] (shown in blue) . . . . . . . . . . . 5.1 F 1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2 F1 . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . List of Tables 4.1 Upper bounds for the orthogonality defect of HKZ, LLL (δ = 3/4) and Minkowski reduced bases. . . . . . . . . . . . . . . . 128 List of Abbreviations 0 1×m-1 the column vector of m -1 zeros 0 n,n the n × n zero matrix det(A) the determinant of a matrix A x the smallest integer greater than x x the nearest integer to x x the greatest integer smaller than x I(x) the imaginary part of a variable x R(x) the real part of a variable x A the complex conjugate of A A(:, i) the ith column of A A(:, i : j) a sub-matrix of A which contains the columns of A from the ith to the jth position A -1 the inverse of a matrix A A ⊥ the orthogonal of A A the transpose of a matrix A A ij the ith row and jth column of A CV P the closest vector problem GL(n, F ) the group of all invertible n × n matrices with entries in F GSO Gram-Schmidt orthogonalization HKZ Hermite-Korkine-Zolotarev i the complex unit, i 2 = -1 I n or simply I the n × n identity matrix LLL Lenstra, Lenstra and Lovász M (n, F ) the space of all n × n matrices with entries in the field F P n the space of positive definite symmetric, real, n × n matrix SV P the shortest vector problem

2 Figure 1 . 1 :

 211 Figure 1.1: The lattice generated by two different bases

  -Schmidt orthogonalized vectors b * 1 ,..., b * g via an iterative process. First, we define b * 1 = b 1 and then for i = 2, .., g we define b * i to be the component of b i orthogonal to Span(b 1 , .., b i-1 ) = Span(b * 1 , .., b * i-1 ), the linear span of the previous vectors, b * i = b i -j<i µ i,j b * j where µ i,j = b i , b * j b * j , b * j .

Figure 1 .

 1 Figure 1.2: GSO

Figure 1 . 6 :

 16 Figure 1.6: Gauss's algorithm

M 1

 1 intersect along the part a 13 ≥ 0 and M 0 and M 2 intersect along the part a 13 ≤ 0 of the face a 11 = a 22 .

  these consitions correspond to rank C = 1 where e = ±1, and for rank C = 2 since C = I 2 , the third condition is replaced by |det(Ω + S)| ≥ 1 where S are the

Figure 2 . 1 :

 21 Figure 2.1: Lattice in R 2

- 1 .Figure 2 . 2 :

 122 Figure 2.2: A "good" basis and a "bad" basis

  follows that the primal and the dual basis vectors are bi-orthogonal, i.e., b l b k = 0 for l = k. Geometrically, this means that the dual basis vector b k is orthogonal to the subspace spanned by the primal basis vector b 1 , ..., b k-1 , b k+1 , ..., b m . This is useful since for any x = Bz ∈ L we can recover the kth integer coefficient via z k = x b k . The cubic lattice Z n is an example of a lattice that is self-dual in the sense that L = L . Note that, instead of applying a particular lattice reduction algorithm to the basis B, a reduction of the dual basis B can be performed. And a reduction of B by a unimodular matrix T corresponds to a reduction of the primal basis B by the unimodular matrix T -1 .

  we have vectors B = [b 1 , .., b m ] ∈ R n×m generating a vector space V = Span (B). These vectors are not necessarily orthogonal, but we can always find an orthogonal basis B * = [b * 1 , ..., b * m ] for V where b * i is the component of b i orthogonal to Span (b 1 , ..., b i-1 ). Definition. For any sequence of vectors B = [b 1 , .., b m ], we define the orthogonalized vectors B * = [b * 1 , ..., b * m ] iteratively according to the formula b

  -Schmidt orthogonalization of the basis B = is not a lattice basis for L (B) because 0 2 does not belong to the lattice. L (B) contains a sublattice generated by a of orthogonal vectors generate the entire lattice L (B).

  is the dual of π i (L(B))? It is the sublattice of L(D) generated by d i , ..., d m Lemma. Let B, D ∈ R n×m be a pair of dual bases. For all i = 1, ..., m, [π i (b i ), .., π i (b m )] and [d i , ..., d m ] are also dual bases. Proof. We only prove the statement for i = 2. The general statement follows easily by induction on i. Therefore, let B = [π 2 (b 2 ), ..., π 2 (b m )] and D = [d 2 , .., d m ]. So, we have to verify first that B and D span the same vector space and secondly that (B ) (D ) = I.

Figure 2 . 4 :

 24 Figure 2.4: Example lattice Z 2 with bases B = 1 0 0 1 and B = 1 2 0 1 and associated fundamental parallelograms

  where B * is the Gram-Schmidt orthogonalization of B. The first part is the definition of the determinant of a lattice which is a generalization of the well known formula for the area of a parallelepiped. A useful application of the Gram-Schmidt process is the following: Let b 1 , ..., b m be a set of m linearly independent vectors in R n and consider the orthonormal basis vectors given by b * 1 / b * 1 , ...., b * m / b * m . In this basis, the vectors b 1 , ..., b m are given as the columns of the n × m matrix

  is non-empty. Then, we restrict . to D: . : D → R. Since D contains a finite number of lattice points, it is compact and . is continuous, D = { d : d ∈ D} ⊂ R is also compact. Since every compact subset of R contains a smallest and a largest element, D contains a smallest say b. By the property of norm, b ≥ 0. Since D contains only non zero vectors, b > 0.

24

 24 It has never been proved that γ m is an increasing function of m. For convenience we define γ m = max {γ i : 1 ≤ i ≤ m} to obtain a non-decreasing function of m.

  " onto b * 1 , where b * 1 denotes the orthogonal complement of the subspace spanned by b 1 . Note that a basis {b 1 , .., b m } of a lattice L is called a HKZ basis if and only if {b 1 , .., b m } is weakly reduced and b * i is a shortest non zero vector in L m-i+1 , i = 1, .., m (see details in Section. 2.4). The basic idea of Kannan enumeration is to first find an HKZ reduced basis for the lattice π 2 (L) by calling itself recursively, and then lift it to a size-reduced basis {b 1 , b 2 , ..., b m } for L such that {π 2 (b 2 ), ..., π 2 (b m )} is an HKZ-reduced basis of π 2 (L) and b 1

2 4Lemma 1 .

 21 +O(m log m) . A lattice generator matrix B := [b 1 , ..., b m ] is called a Minkowski reduced basis if and only if for all 1

  and x j = 0 for at least one j < i. The 36 inequalities of the second kind consist of 28 inequalities which correspond to the inequalities of 3 dimensions. Those in fact tell us that the four rank 3 sub-lattices generated by {b 2 , b 3 , b 4 } , {b 1 , b 3 , b 4 } , {b 1 , b 2 , b 4 } and {b 1 , b 2 , b 3 } are also Minkowski reduced. The other eight inequalities are added to compare b 4 with ±b 1 ± b 2 ± b 3 + b 4 .

1 m

 1 , Neumaier and Stehlé, [135], describe an asymptotically fast variant of LLL lattice reduction algorithm. It takes as input a basis B ∈ Z m×m and returns a reduced basis C of the Euclidean lattice L spanned by B, whose first vector satisfies c 1 ≤ (1 + c)(4/3) for any fixed c > 0. It terminates within O(m 4+ β 1+ ) bit operations for any > 0, with β = log max i b i . Definition. Let δ be a constant with 1 4 < δ ≤ 1. A lattice basis B = {b 1 , ..., b m } is called LLL reduced if and only if:

  last inequality follows from the fact that b j , b * j = b * j , b * j . Proposition. Let b 1 , ..., b m be an LLL reduced basis for a lattice L in R n , δ = 3/4 and let b * 1 , ..., b * m be the Gram-Schmidt orthogonalization. Then we have b j 2

  This proves (2.22). The determinant det (L) of L is defined by det (L) = |det (b 1 , ..., b m )| , It follows from the Gram-Schmidt orthogonalization that det (L) = |det (b * 1 , ..., b * m )| and thus, since the b * i

Theorem 4 .

 4 If [b 1 , .., b m ] is an HKZ basis of a lattice L, then

2 .

 2 NP-Complete Problems. NP-complete problems are special problems in class NP, i.e., a subset of class NP. A problem p is NP-complete if: 1. p ∈ NP (you can solve it in polynomial time by a non-deterministic Turing Machine), All other problems in class NP can be reduced to problem p in polynomial time.

Since |r 1 , 2 |

 12 Reduction: The Cholesky factorization of B B yields = 3.1385 > |r 1,1 /2| = 1.1629, this basis is not size reduced. So we replace v by v = v -µu such that µ = v,u u 2 = 3.1385 2.3259 = 1. This translation leads to a new basis vector

Figure 3 . 1 :

 31 Figure 3.1: Illustration of size reduction (red) and Gauss reduction (green) for a two-dimensional lattice L spanned by the basis vectors u = [2.1 1] and v = [3 1] (shown in blue)

  ..,RED (k, 1), and then we move to the next vector b k+1 . If it is not verified: we swap b k and b k-1 and we go back to the previous case. The swaps, allow to decrease the length of b * k-1 at the expense of b * k , the aim is to shift the weight in B * from the first vectors to the last ones, allowing to minimize the first vectors and improve the basis quality. Note that after this exchange, we have always a lattice basis. However, only the first k -2 vectors are LLL reduced. On the other hand, b * k-1 is modified. SWAP (k) is the procedure which exchanges the vectors b k-1 and b k and updates b * i and the µ ij coefficients. The vectors b * 1

1 3 1 1 102 a

 102 lattice basis matrix. The Cholesky decomposition of B B yields the upper triangular matrix

  When k < i then there is no change in the basis [b 1 , ..., b k ], so the value of det (L (b 1 , ..., b k )) remains the same. On the other hand, if k > i the only change is that two basis vectors in [b 1 , ..., b k ] are swapped, so the lattice L (b 1 , ..., b i ) does not change and the determinant det (L (b 1 , ..., b k )) stays also the same. Therefore, only L (b 1 , ..., b i ) is affected by the swap and only D B,i changes. Consequently, let Λ i , D B,i denote the new values of Λ i and D B,i respectively. We have that

Proposition 5 ..

 5 If L is a lattice of dimension m, then the quotient γ (is bounded from above by a constant depending only on m. Proof. In fact, the quotient measures the density ∆ of the spheres packing associated to a lattice L. Let r = √ min(L) 2

Algorithm 5

 5 HKZ reduction Input: A lattice basis [b 1 , .., b m ]. Output: An HKZ reduced basis. 1. Find the shortest lattice vector of the lattice, b1 . 2. Extend b1 to a lattice basis. 3. Apply HKZ to π 2 ( b2 ), ..., π 2 ( bm ) where π 2 (.) be an orthogonal operator which projects "." onto b * 1 where b * 1 denotes the orthogonal complement of the subspace spanned by b 1 . 4. Size reduce the obtained basis .

Lemma 2 (

 2 [START_REF] Van Der Waerden | Studien Zur Theorie der Quadratischen Formen[END_REF]). Let B = [b 1 , ..., b m ] ∈ R n×m and L be the lattice generated by B. For a vector v = m i=1 v i b i , and any index p, 1 ≤ p ≤ m, there exists a basis for L containing {b 1 , ..., b p-1 , v} if and only if gcd(v p , ..., v m ) = 1.

Algorithm 9 4 . 1 . 2

 9412 mred1 (B, ω) Input: B ∈ R n×m , and the LLL parameter ω,1 4 < ω < 1 Output: a unimodular Z ∈ Z m×m such that the columns of BZ form a Minkowski reduced basis.Cholesky factorization R = chol(B B); Z ← I m ; for k = 1 to m do z ← mdecode1 (R, ω, k) ; if k = m then Z = Z × I m-1 ; 0 1×m-1 z ; else [ , Z] ← Transform (R, Z, z, k) ; Z(:, k) = Z(:, k) + Z(:, 1 : k -1) [z 1 , ..., z k-1 ] ; R = chol (BZ) × (BZ) ; end if end for Why do we change every time the Transform function?This algorithm will be changed including the algorithm named "Transform" (see, Algorithm 6), according to the size of the selected lattice for p ≥ 2. So, as an example we take a 3-dimensional lattice generated by Y.

  We start by calling the sphere decoding algorithm and hence, the first integerAlgorithm 10 Sign2(R, Z)Input: B is a symmetric positive definite matrix, R = Chol(B) an upper triangular matrix and Z the unimodular matrix obtained by Minkowski reduction algorithm.

.

  Since a 23 < 0, we apply U = Sign3(R, Z) =

:

  In dimension 2, HKZ reduction is equivalent to Minkowski's reduction. But, HKZ and Minkowski reduction may differ from dimension 3 on. In particular, when a basis is Minkowski reduced, this basis must verify b 1 ≤ .... ≤ b n , which is not necessarily true for HKZ reduced bases. For this, we take as an example a lattice generated by b 1 = [0.6410; 0.6698; -0.2927], b 2 = [0.6698; 1.3165; -0.5127] and b 3 = [-0.2927; -0.5127; 0.6450] where B = {b 1 , b 2 , b 3 } and the upper triangular matrix R = Chol(Y ).

  we have to verify the size reduction condition: R = chol((RZ) (RZ)) = upper triangular matrix R is size reduced and finally,

. 3 )

 3 And we can always write M ∈ Sp(2g, R) in block-matrix form = BA , CD = DC , AD -BC = I g .(5.4)

3 2 .

 32 .11) where 0 g-1 denotes the column vector of g -1 zeros, we notice that|det(CΩ + D)| = |Ω 11 | . Since Ω ∈ F g ,we have |Ω 11 | ≥ 1 and |R(Ω 11 )| ≤ 1 2 which implies that I(Ω 11 ) ≥ √ Note that since I(Ω) is Minkowski reduced, then √ 3 2 ≤ I(Ω 11 ) ≤ I(Ω 22 )... ≤ I(Ω gg ).

  1 is generated by the two elements S 2 = (ST ) 3 = -I 2 . And the action of S and T on H are given by S : τ → -1 τ , T : τ → τ + 1.

Figure. 5 . 1 .Remark 1 .-1 0 1 Figure 5 . 1 : F 1 x -1 0 1 Figure 5 . 2 :

 5111511152 Figure 5.1: F 1

Proof.

  Let τ ∈ H. Then {mτ + n | m, n ∈ Z} is a lattice in C. We know that every lattice has a point different from the origin of minimal modulus. Let us suppose cτ + d be such a point. The integers c, d must be relatively prime (otherwise we could divide cτ + d by an integer to get a new point in the lattice of even smaller modulus). So, there are integers a and b such that γ 1 = a b c d ∈ G 1 . By (5.12) we deduce that I(γ 1 .τ ) is a maximal member of the set {I(γ.τ ) | γ ∈ G 1 }. Now, we choose an n such that T n (γ.τ ) is shifted into the vertical strip between -1 2 and 1 2 . Then τ = T n (γ.τ ) ∈ F 1 , which implies that a ∈ {0, 1}. Similarly, we show that for d = -1 and τ = exp( πi 3 ), the values of a are {-1, 0}.

G 2 := Γ 2 /Theorem 7 .

 227 ±I 4 acts on the space H 2 via τ → (Aτ + B)/(Cτ + D) -1 for all γ = A B C D ∈ G 2 , where A, B, C and D are 2 × 2 integer matrices.For genus 2, we have the following theorem due to Gottschling[START_REF] Gottschling | Explizite Bestimmung der Randfächen des Fundamentalbereiches der Modulgruppe zweiten Grades[END_REF]: Under this action (5.7) a fundamental domain for H 2 /G 2 is

5 -d d 3 d 4 d 5 d 1 d 6 d 7 d 8 d 2 

 52 2τ 6 + d| ≥ 1, for -4 ≤ d ≤ 4, and I(τ 5 ) > 0, |τ 1 + τ 2 + τ 3 -2τ 4 -2τ 5 + 2τ 6 + d| ≥ 1, for -4 ≤ d ≤ 4, and I(τ 5 ) > 0, |τ 1 + τ 2 + τ 3 -2τ 4 + 2τ 5 -2τ 6 + d| ≥ 1, for -4 ≤ d ≤ 4, Proof. Rank C = 1, therefore, there exist two unimodular matrices U and V such that It follows from (5.4), i.e., CD = DC and DA -CB = I 3 , that d 5 = d 7 = 0, gcd(c, d) = 1 and -d 6 d 8 + d 1 d 2 = 1.

  6 ) + d , (5.14) with gcd(c, d) = 1 and pZ + qZ + rZ = 1symmetric (i.e., CD = DC and DA -CB = I 3 ) and rank C = 1.

1 ,

 1 D 1 ) and (C, D) are associated and by specifying c, d, p, q, r, the class of the pairs associated with C, D, is uniquely determined. On the other hand, let C, D be given (in the inverse way) andU 0 CV 0 =

  d 0 = d. According to (5.14), |det(Cτ + D)| ≥ 1 is equivalent to c(p 2 τ 1 + q 2 τ 2 + r 2 τ 3 + 2pqτ 4 + 2prτ 5 + 2qrτ 6 ) + d ≥ 1

y 1 y 4 y 5 y 4 y 2 y 6 y 5 y 6 y 3 

 3 + D)| ≥ c(p 2 y 1 + q 2 y 2 + r 2 y 3 + 2pqy 4 + 2pry 5 + 2qry 6 ).

1 .

 1 (|p| -|q|) 2 + (|p| -|r|) 2 + (|q| -|r|) 2 = 2, 2. (|p| -|q|) 2 + (|p| -|r|) 2 + (|q| -|r|) 2 = 0. It follows from 2, and p ≥ 0 that |p| = |q| = |r|. Since pZ + qZ + rZ = 1, |p| = |q| = |r| = 1 are the unique possibilities which imply four cases to be studied: (p, q, r) = {(1, 1, 1); (1, -1, 1); (1, 1, -1); (1, -1, -1)} . For (p, q, r) = (1, 1, 1) : we have, |det(Cτ + D)| ≥ c (y 1 + y 2 + y 3 + 2y 4 + 2y 5 + 2y 6 ) > 1. For (p, q, r) = (1, -1, 1) : |det(Cτ + D)| ≥ c (y 1 + y 2 + y 3 -2y 4 + 2y 5 -2y 6 ) ,

y 1 +

 1 y 2 -2y 4 + 2y 5 -2y 6 ≥ 0. (5.19) For c ≥ 2, we notice that |det(Cτ + D)| > 1, this remains the case where c = 1. Now, when c = 1, we obtain |det(Cτ + D)| = |τ 1 + τ 2 + τ 3 -2τ 4 + 2τ 5 -2τ 6 + d| but since gcd(c, d) = 1, we deduce that |det(Cτ + D)| ≥ 1 for |d| ≥ 5. This leaves the following inequalities to be verified:|τ 1 + τ 2 + τ 3 -2τ 4 + 2τ 5 -2τ 6 + d| ≥ 1, for -4 ≤ d ≤ 4.(5.20)For (p, q, r) = (1, 1, -1):we have,|det(Cτ + D)| ≥ c (y 1 + y 2 + y 3 + 2y 4 -2y 5 -2y 6 ) .From Minkowski's conditions (5.18), we notice that |det(Cτ + D)| > 1 for c ≥ 2 and as above it remains the true case where c = 1. For c = 1 and y 5 ≤ 0: |det(Cτ + D)| ≥ y 1 + y 2 + y 3 + 2y 4 -2y 5 -2y 6 > 1.

|τ 1 +From 1 ,

 11 τ 2 + τ 3 + 2τ 4 -2τ 5 -2τ 6 + d| ≥ 1, for -4 ≤ d ≤ 4 and y 5 > 0. (5.21) For (p, q, r) = (1, -1, -1): we obtain, |det(Cτ + D)| ≥ c (y 1 + y 2 + y 3 -2y 4 -2y 5 + 2y 6 ) .As above, from Minkowski's conditions (5.18), we have |det(Cτ + D)| > 1 for c ≥ 2. It remains the true case where c = 1 which implies the following inequalities to be verified:|τ 1 + τ 2 + τ 3 -2τ 4 -2τ 5 + 2τ 6 + d| , for -4 ≤ d ≤4 and y 5 > 0. (5.22) we find three possibilities: • 1.a. |p| -|q| = ±1, |p| -|r| = ±1 and |q| -|r| = 0, • 1.b. |p| -|q| = ±1, |p| -|r| = 0 and |q| -|r| = ±1, • 1.c. |p| -|q| = 0, |p| -|r| = ±1 and |q| -|r| = ±1.

. 23 )

 23 Again, from 1.a, when |p| = -1 + |q| and |q| = |r|, we obtain the following conditions|τ 2 + τ 3 -2τ 6 + d| ≥ 1, (1, d) = 1which correspond to (p, q, r) = (0, 1, -1) and c = 1. And according to lemma 4, it is enough to check the following inequalities:|τ 2 + τ 3 -2τ 6 ± 1| ≥ 1. (5.24)In 1.b, on the one hand, |p| = 1 + |q| and |p| = |r|, implies the following conditions:|τ 1 + τ 3 -2τ 5 + d| ≥ 1, (1,d)=1, and y 5 > 0 which correspond to c = 1 with (p, q, r) = (1, 0, -1).|τ 1 + τ 3 + 2τ 5 + d| ≥ 1, (1,d)=1, and y 5 < 0 which correspond to c = 1 with (p, q, r) = (1, 0, 1). Again, according to lemma 4, it is enough to verify the following inequalities:|τ 1 + τ 3 -2τ 5 ± 1| ≥ 1, for y 5 > 0,(5.25)and |τ 1 + τ 3 + 2τ 5 ± 1| ≥ 1, for y 5 < 0.(5.26)On the other hand, |p| = -1+|q| and |p| = |r|, implies the following inequality:|τ 2 | ≥ 1,(5.27)and which corresponds to c = 1 with (p, q, r) = (0, 1, 0). In 1.c, |p| = |q| and |p| = 1 + |r| implies |τ 1 + τ 2 -2τ 4 + d| ≥ 1, (1, d) = 1

  of the matrix B in G g = A B C D , B = [X], i.e., each component of B is the integer part of the corresponding component of X. For the second condition, we assume that the shortest vector of the lattice generated by R, where R is the Cholesky decomposition of Y = R R, is the first vector of R. It is discussed in the previous chapters 2 and 4 that this can be always achieved. Siegel showed that the determinants of the imaginary part of two matrices Ω = X + i Ỹ and Ω = X + iY related by a symplectic transformation (5.7) satisfy det( Ỹ ) = |det(Y )| |det(CΩ + D)| 2 . (5.30) If one considers the quasi-inversion (5.10), (5.11), equation (5.30) takes the form det( Ỹ ) = |det(Y )| |Ω 11 | 2 .(5.31)

  This example shows that the LLL algorithm gives the shortest lattice vector as a second vector in contrast to a Minkowski ordered matrix where the shortest vector is always the first of the matrix.The second example shows the overestimation of the length of the shortest vector even for small size of the matrix

	The diagonal elements of a Minkowski reduced matrix represent the norm of
	the shortest vectors in ascending order.
	The corresponding LLL reduced matrix (δ = 3/4) takes the form
	0.8102 -0.2759	0.2585 -0.2646
	-0.2759		0.6255 -0.2135 -0.1231
	0.2585 -0.2135	0.6964	0.0255
	-0.2646 -0.1231	0.0255	1.1509.
	Y=
	0.7563	0.4850 0.4806 0.3846
	0.4850	1.3631 0.2669 -0.3084
	0.4806	0.2669 0.7784 -0.4523
	0.3846 -0.3084 -0.4523 1.7538.
	The Minkowski reduction yields
	0.5321	0.2058	-0.1639	0.0181
	0.2058	0.5735	0.0920	0.2634
	-0.1639	0.0920	0.5741	0.1364
	Y= 0.0181	0.2634	0.1364	0.6535.
	1.4903	0.4132 -0.2758	0.6514
	0.4132	1.1509 -0.2646	0.0255
	-0.2758 -0.2646	0.8102	0.2585
	0.6514	0.0255	0.2585	0.6964.
	0.7563	-0.2757	0.3182	-0.1089
	-0.2757	0.5735	0.0920	0.2634
	0.3182 the following Minkowski reduction matrix (it suffices to check Minkowski's 0.0920 0.5741 0.1364 leads to -0.1089 0.2634 0.1364 0.6535.
	conditions to prove it)
		0.6255	0.2135	0.2759	0.1231
		0.2135	0.6964	0.2585	0.0255
		0.2759	0.2585	0.8102 -0.2646
		0.1231	0.0255 -0.2646	1.1509.

Now, to illustrate the difference between our Minkowski reduction algorithm for dimension less or equal to 5 and the LLL algorithm, we consider examples of random matrices, This matrix was created using a 4 × 4 matrix L with random entries, and then setting Y = L L. We put Y = R R where the upper triangular matrix R is obtained from Y via a Cholesky decomposition (see, Definition 3). To this matrix R, we apply our Minkowski reduction algorithm and this It can be seen that the squared length of the shortest lattice vector is 0.5321, the (11) element of the matrix. However, an LLL reduction with δ = 3/4 of the matrix Y leads to

  This step allows to eliminate more points by "shrinking" the search hypersphere. Now we search for a better point than ẑ. If one is found, we update ẑ. We move up to level 2 and choose z 2 to be the next nearest integer to c 2 , where "next" is relative to ẑ2 . If inequality (2.16) holds at level 2, we move down to level 1 and update z 1 ; otherwise, we move up to level 3 and update z 3 . The procedure continues until we reach level m and (2.16) at level m is not satisfied. The last full integer point found is the OILS (Ordinary Integer Least Squares) or the shortest lattice vector solution.

  12 a 13 a 14 a 12 a 22 a 23 a 24 a 13 a 23 a 33 a 34 a 14 a 24 a 34 a 44

	
	   

  a 11 a 33 > a 22 a 11 + a 22 -2a 12 + 2a 13 -2a 23 = 0 a 11 -a 12 + 2a 13 ≤ 0

  This lattice basis is Minkowski reduced, it suffices to check Minkowski's conditions to prove it. But it is not an HKZ reduced basis since r 23 = 62 > We start first by examples to illustrate the difference between an LLL and a Minkowski reduced basis, and for this, we consider a symmetric real 4 × 4 matrix (for the ease of representation, we only give 4 digits)

		reduction.
	Let
		B =		100 49	0	 .
			 	0 100 62 0 0 100	 
	r 22 2 = 50.
	LLL and Minkowski: Y=
	0.7563	0.4850 0.4806 0.3846
	0.4850	1.3631 0.2669 -0.3084
	0.4806	0.2669 0.7784 -0.4523
	0.3846 -0.3084 -0.4523 1.7538

Table 4 .

 4 1: Upper bounds for the orthogonality defect of HKZ, LLL (δ = 3/4) and Minkowski reduced bases.

	m γ m	2/ √	2 3	2	3 1 3	4 √ 2	8	5 1 5	(64/3)	6 1 6	64	7 1 7	8 2	24 4
	δ H,m 1.291 1.937 3.623 7.246	17.75	48.61	161.2 4.26 ×
	δ L,m 1.414 2.828	8	32	181.0 1.45 × 10 3 1.64 × 10 4 3.48 ×
	δ M,m 1.155 1.414	2 3.162	6.455	15.63	48.83 2.51 ×
	The corresponding LLL reduced matrix (δ = 3/4) takes the form
		0.3753		0.0294	-0.1516	0.0351
		0.0294		0.3636	0.1660	-0.0443
	-0.1516		0.1660	0.3688	-0.0342
		0.0351		-0.0443	-0.0342	0.2205.

  has shown that for the case g = 2, the necessary C and D in condition 3 are C = I 2 and D is one of 15 choices, explicitly determined, all with entries 0, e = ±1,

	0 0 0 0	,	e 0 0 0	,	0 0 0 e	,	e 0 0 e	,	e 0 0 -e	,	0 e e 0	,	e e e 0	,	e e e
	or C is a rank 1 matrix in which case, if τ =	τ 1 τ 3 τ 3 τ

2 then |τ 1 | , |τ 2 | ≥ 1 and

  y 3 , 0 ≤ y 4 ≤ All these conditions allow us to write|det(Cτ + D)| = c(p 2 y 1 + q 2 y 2 + r 2 y 3 + 2pqy 4 + 2pry 5 + 2qry 6 ) = c 2 (p 2 y 1 + q 2 y 2 + 4pqy 4 + p 2 y 1 + r 2 y 3 + 4pry 5 + q 2 y 2 + r 2 y 3 + 4qry 6 ) (|p| -|q|) 2 + (|p| -|r|) 2 + (|q| -|r| 2 + (|p| -|r|) 2 + (|q| -|r| 2Clearly, this last inequality is greater or equal to 1 if and only if(|p| -|q|) 2 + (|p| -|r|) 2 + (|q| -|r| 2 ) ≥ 3,and less than 1 when |p|, |q| and |r| are not too far from each other. Hence, two cases must be considered:

	And from lemma 3, we obtain
			y 1 ≥	√ 3 2	.
	≥ y 1 ≥ c 2 c 2 √ 2 3 ≥ √ 3 4 (|p| -|q|) 2 (|p| -|q|) 2 + (|p| -|r|) 2 + (|q| -|r| 2
	y 1 2	, |y 5 | ≤	y 1 2	, and 0 ≤ y 6 ≤	y 2 2	.	(5.18)

  and thus greater than √ 3/2. After a shift of the real part we finally obtain W =

	Columns 1 through 3
	0.3967 + 1.0211i	0.0615 -0.1322i -0.0000 + 0.0000i
	0.0615 -0.1322i	0.3967 + 1.0211i	0.3553 -0.5828i
	-0.0000 + 0.0000i	0.3553 -0.5828i	0.2894 + 1.1656i
	-0.4609 -0.2609i -0.3386 + 0.1933i	0.0905 + 0.2450i
	0.3553 -0.5828i	0.4776 -0.1287i -0.4776 + 0.1287i
	0.1838 + 0.3219i	0.2743 + 0.5669i	0.3871 -0.3736i
	-0.3386 + 0.1933i -0.3386 + 0.1933i -0.1223 -0.4541i
	Columns 4 through 6
	-0.4609 -0.2609i	0.3553 -0.5828i	0.1838 + 0.3219i
	-0.3386 + 0.1933i	0.4776 -0.1287i	0.2743 + 0.5669i
	0.0905 + 0.2450i -0.4776 + 0.1287i	0.3871 -0.3736i
	0.3967 + 1.0211i -0.4776 + 0.1287i	0.0167 -0.3895i
	-0.4776 + 0.1287i	0.2894 + 1.1656i -0.1671 -0.7115i
	0.0167 -0.3895i -0.1671 -0.7115i	0.4414 + 1.2784i
	0.0615 -0.1322i	0.0905 + 0.2450i -0.3386 + 0.1933i
	Columns 7 through 7
	-0.3386 + 0.1933i
	-0.3386 + 0.1933i
	-0.1223 -0.4541i
	0.0615 -0.1322i
	0.0905 + 0.2450i
	-0.3386 + 0.1933i
	0.3967 + 1.0211i.

or the subset sum can be stated as follows: Given a set of r weights W = (w 0 , ..., w r-1 ) and a sum X, find x 0 ,.., x r-1 where each x i ∈ {0, 1}, so that X = x 0 w 0 + x 1 w 1 + ... + x r-1 w r-1 , see[START_REF] Odlyzko | The rise and fall of Knapsack cryptosystems[END_REF]

. Therefore, for any vector of

Note, that this lattice Λ is not to be confused with the lattice generated by the matrix Y discussed in this work.

For the ease of the reader, we present only 4 digits though the Riemann matrix is computed with an error of the order of 10 -10 .

Remerciements

theory of Minkowski reduction. In particular, he obtained in (1938) [START_REF] Mahler | On Minkowski's theory of reduction of positive quadratic forms[END_REF] an estimate for c m for all m, applicable to general convex bodies, and in (1940) [START_REF] Mahler | On reduced positive definite ternary quadratic forms[END_REF] and (1946) [START_REF] Mahler | On reduced positive definite quaternary quadratic forms[END_REF] he gave proofs of the best possible results for m = 3 and m = 4. Best possible results are now known for m ≤ 5; these are So in fact for all m ≤ 5, c m = γ m m where γ m is Hermite's constant; for m = 5, see [START_REF] Van Der Waerden | Das Minimum von D/f 11 f 22 ...f 55 für reduzierte positive quinäre quadratische Formen[END_REF] [START_REF] Van Der Waerden | Das Minimum von D/f 11 f 22 ...f 55 für reduzierte positive quinäre quadratische Formen[END_REF] and [START_REF] Nelson | The reduction of positive definite quinary quadratic forms[END_REF] [START_REF] Nelson | The reduction of positive definite quinary quadratic forms[END_REF].

is further qualified as linear-time, quadratic-time and so on. There is a similar notation for asymptotic lower bounds, the big-omega notation.

Definition. Let f : N ≥k -→ R ≥0 , for some k ∈ N. Ω(f ) is the following set of functions from N ≥l to R ≥0 , for any l ∈ N: Ω(f ):= g: there exist d ∈ R >0 and m 0 ∈ N such that for all n ≥ m 0 , g(n) ≥ d.f (n) Therefore, g ∈ Ω(f ) if for all sufficiently large n (for n ≥ m 0 ) g(n) is bounded from below by f (n)-possibly multiplied by a positive constant. We say f (n) is an asymptotic lower bound for g(n).

Definition.

Θ(f ) := O(f ) ∩ Ω(f ).

Thus, if g(n) ∈ Θ(f ) then g(n) and f (n) are within a constant factor of each other.

Computational Complexity

Computational complexity theory is concerned with how much computational resources are required to solve a given task.

Definition (Polynomial-time solvable algorithms). The significance of polynomialtime algorithms is that they are usually found to be computationally feasible, even for large input.

By contrast, algorithms whose complexity is exponential in the size of the input have running times which render them unusable even her inputs of moderate size. Researchers recognized early on that not all problems can be solved this quickly, but had a hard time figuring out exactly which ones could and which ones could not. There a several so-called NP-hard problems, which most people believe cannot be solved in polynomial time, even though nobody can prove a super-polynomial lower bound. In this connection, a class of problems denoted by NP (standing for nondeterministic polynomial-time) plays an important role. We give here an informal definition of this class: a precise treatment can be found in the book Conjecture. P = NP.

Conjecture. P= NP ∩ co-NP.

The first one is one of the most fundamental open questions in mathematics. (A prize of one million dollar has been offered for its resolution). It is widely (but not universally) believed that the conjecture is true, that there are problems in NP for which no polynomial time algorithms exists. The second one is strongly supported by empirical evidence. Most decision problems which are known to belong to NP ∩ co-NP are also known to belong to P. A particular case is the problem of deciding whether a given integer is prime. Although it had been known for some time that this problem belongs to both NP and co-NP, a polynomial time algorithm for testing primality was discovered only much more recently by Agrawal, Kayal and Saxena, [START_REF] Agrawal | PRIMES is in P[END_REF].

Reducing Problems Sometimes, a common approach to problem-solving is to transform the given problem into one whose solution is already known, and then convert that solution into a solution of the original problem. Of course, this approach is feasible only if the transformation can be made rapidly.

A reduction from problem X to problem Y means that if we have an algorithm for problem Y, we can use it to find an algorithm for problem X.

Using Reductions:

A) we use reductions to find algorithms to solve problems.

Algorithm 2 Gauss reduction

Input: a two dimensional basis matrix B = (b 1 , b 2 ). Output: a Gauss reduced basis B = b1 , b2 .

; end while the form α b1 + β b2 , where α and β are integers, we have:

Thus, b1 is the shortest lattice vector. Now, if b * 2 is the perpendicular projection of b2 , we have b *

We will move now to check that b2 realizes the second successive minimum of the lattice and for it we choose α b1 + β b2 , a linearly independent vector from b1 , i.e, with β = 0. The length of this vector is greater than β 2 b * . As soon as, |β| > 1, this vector is greater than b2 , therefore, even changing the signs of α and β, it can be assumed that β = 1, and in this case, the last step of Gauss's algorithm, ensures that the vector b2 is the shortest one among these of the form b2 -µ b1 . All this proves, that the algorithm calculates a lattice basis, which realizes the successive minima.

The Gauss algorithm performs a number of iterations that is linear in the

Minkowski reduction algorithm

We are interested in lattices of low dimensions. It is desirable to have an algorithm to compute a "good" lattice bases quickly. However, the construction of such bases is a real problem.

Minkowski's reduction is the best one among all the existing lattice reduction algorithms, at least for low-dimensional lattice bases (m ≤ 4). For this reason, we present our Minkowski reduction algorithm which is a modification of the Zhang, Qiao and Wei algorithm [START_REF] Zhang | HKZ and Minkowski Reduction Algorithms for Lattice-Reduction-Aided MIMO Detection[END_REF] and it is practical at least for lattices of low dimensions (m ≤ 5).

Our algorithm simply applies the definition of Minkowski reduction (see, definition 7). This implies a basis that consists of shortest lattice vectors m i which can be extended to a basis of the lattice L. This work is divided into two parts where the first one is related to the shortest lattice vector problem (SVP). Since the enumerative algorithms were considered as the best among all the sphere decoding algorithms at least for low-dimensional lattice bases, we adopt here the Schnorr-Euchner enumeration with a little change in the way of updating the search radius. This algorithm updates the search radius when a shorter lattice vector satisfying the gcd constraint (i.e., gcd(z ii , .., z im ) = 1 where

The second part is about extending {m 1 , ..., m i } to a basis for L. It can be easily obtained by finding a unimodular matrix Z such that B i+1 = B i Z, where B i is a generator matrix of an m-dimensional lattice L such that the first i -1 columns of B i (i.e., {m 1 , ..., m i-1 }) can be extended to a Minkowski reduced basis for L. We construct Z such that the first i -1 columns of B i+1 are the first i -1 columns m 1 , m 2 ,..., m i-1 and the ith column of B i+1 is m i = B i z i where z i is the integer vector obtained by the Schnorr-Euchner enumeration for the ith position.

reduced basis with the first p -1 columns of B p must satisfy

Obviously, the minimization problem can be considered as an SVP with the constraint gcd(z p , ...., z m ) = 1. Thus it is enough to incorporate the gcd constraint into the Schnorr-Euchner enumeration to solve it. A small change is going to take place in the way of updating the search radius. Now, suppose that a basis {m 1 , ..., m p-1 , b p , ..., b m }, 1 < p ≤ m, has been obtained, to extend {m 1 , ..., m p-1 } to a Minkowski reduced basis for L, we have to solve the following two problems:

• Constructing the pth Minkowski reduced basis vector m p .

• Extending {m 1 , ..., m p } to a basis for L.

We can use the length of the pth column as the initial size of the search region, so that at least one lattice point z = e p , (Rz p = R(:, p)) satisfying such a gcd constraint lies inside the search region. To further accelerate the search process, the LLL algorithm can be applied as a preprocessor.

Algorithm 7 mdecode1 (R, ω, p)

Input: R ∈ R m×m , the LLL parameter ω, and an index p, 1 ≤ p ≤ m. Output: a vector z ∈ Z m such that Rz is a shortest lattice point with gcd(z p , ..., z m ) = 1. if m = 1 then return z = 1; end if set the initial size r ← R(:, p) 2 2 ; utilize LLL algorithm to find a unimodular Z and an upper triangular matrix R new such that RZ is LLL reduced and R new is the R-factor of RZ;

The msearch1 algorithm, (see, Algorithm 8), finds a solution for the closest vector problem (CVP) with the constraint gcd (z p , ...., z m ) = 1. We present now a recursive version (see, Algorithm 7, Algorithm 8) of this algorithm as Sph-Dec algorithm.

This algorithm is based on Schnorr-Euchner enumeration with the main difference between them on the way of updating the search radius. The original Schnorr-Euchner enumeration updates the search radius when a shorter lattice vector is found whereas the msearch1 algorithm updates the Algorithm 8 msearch1 (R, Z, x, z in , r, dist, p)

Input: R ∈ R m×m , a vector x ∈ R m to decode, an integral partial solution z in , the current distance record r, the distance between the current lattice vector and the corresponding sub-lattice, and an index p, 1 ≤ p ≤ m. Output: a vector z ∈ Z m such that RZ -1 z is a closest lattice point to x satisfying gcd(z p , .., z m ) = 1, and = RZ -1 z -

for each integer s in the order of increasing distance from the center of

3) < 0 then Z(:, 1) = -Z(:, 1); Z(:, 2) = -Z(:, 2); U = [Z(:, 1)Z(:, 2) -Z(:, 3)] ;

by exact Minkowski reductions for small genus and an exact identification of the shortest lattice vector for larger values of the genus. A good introduction to the Siegel modular group and the Siegel modular forms can be found in Freitag's and Klingen's books, [START_REF] Freitag | Siegelsche Modulfunktionen, Grundlehren der Mathematischen wissenschaften 254[END_REF][START_REF] Klingen | Introductory Lectures on Siegel Modular Forms[END_REF]. In this work, we will need the following definition:

Definition. The action of a group G on a topological space X is said to be properly discontinuous if for any compact set K ⊂ X K ∩ g(K) = ∅, except for a finite number of elements g ∈ G.

In this chapter we focus on Siegel's fundamental domain. In sections 5.1 and 5.2, we give the well known results for genus 1 and 2. In section 5.3, we define Siegel's fundamental domain for general g. In section 5.4, we aim at an exact identification of this domain in genus 3, so we present some results concerning rank C = 1. In section 5.5, we present Siegel's approximative reduction algorithm. We show the relation between Siegel's fundamental domain of symplectic transformations of Riemann matrices and the efficiency of computation of higher dimensional theta functions. We give in this context a different strategy than the existing algorithms illustrated by examples.

Siegel fundamental domain for general g

We first define notions which are the main objects studied in this section.

Definition.

The following subset:

is called the Siegel Upper Half Space of (degree or genus) g. Clearly, it is a generalization of the usual complex upper half plane

Definition. The subgroup of GL(2g, R) defined as

An action of Sp(2g, Z) ⊂ Sp(2g, R), a discrete subgroup called "Siegel modular group", on H g can be defined

where

Proposition. The action of the symplectic group on the Siegel upper half plane is well defined, transitive and biholomorphic.

Proof. For each γ ∈ Sp(2g, Z) and τ ∈ H g , the following two identities can be easily verified:

(5.9)

In order to be sure that the action is well defined, it is necessary first to show that Cτ + D is invertible for each τ ∈ H g and for each γ ∈ Sp(2g, Z). If not, there would be a non zero vector z ∈ C g such that (Cτ + D)z = 0. Then (5.9) would imply

which is impossible since I(τ ) > 0. Now, we prove that γ.τ = (Aτ + B)(Cτ + D) -1 ∈ H g for each τ ∈ H g and for each γ ∈ Sp(2g, Z).

Since Cτ + D is invertible under this hypothesis, (5.8) is equivalent to γ.τ -1 = γ.τ . From this assertion and (5.9), we deduce:

Since τ ∈ H g , it follows that I(γ.τ ) > 0. Therefore, it has been shown that γ.τ is contained in H g . We can immediately verify that I 2g .τ = τ for each τ ∈ H g and if γ 1 , γ 2 belong to Sp(2g, Z), then Definition 10. Siegel's fundamental domain F g is the set of Ω = (Ω ij ) ∈ H g that satisfies the three following conditions:

2 for all i, j ∈ {1, ..., g};

2. I(Ω) is in the fundamental region of Minkowski reductions;

We continue to use the matrix representation of

to denote elements of G g . Note that the third condition in Def 10 can be seen as a condition of maximal height or a highest-point condition, i.e, you choose γ ∈ Γ g to maximize I(γ.τ ), see [START_REF] Klingen | Introductory Lectures on Siegel Modular Forms[END_REF]. It must be satisfied for all the Γ g / ±I 2g matrices. However, it is shown that it is enough for this condition to be satisfied for a certain finite set, for all g see [START_REF] Klingen | Introductory Lectures on Siegel Modular Forms[END_REF], which is only known for g = 1

) and g = 2 (19 matrices due to Gottschling [START_REF] Gottschling | Explizite Bestimmung der Randfächen des Fundamentalbereiches der Modulgruppe zweiten Grades[END_REF]).

Remark. For g = 2, the Minkowski fundamental region, in Def 10. 2, i.e the fundamental domain of the unimodular group, is given by the simple Minkowski reduction. However, for g > 2 the simple Minkowski reduction does not define the Minkowski fundamental domain, see [START_REF] Tammela | On reduction theory of positive quadratic forms, Studies in number theory. Part 3[END_REF]. The fundamental domain for g = 3 is given in [START_REF] Tammela | On reduction theory of positive quadratic forms, Studies in number theory. Part 3[END_REF] and chapter. 2, but the corresponding conditions in higher dimension appear to be unknown. Proposition. F g is a fundamental domain for the action of G g on H g . Then for all Ω ∈ H g , there exists γ ∈ G g such that γ.Ω ∈ F g and this element γ is unique if γ.Ω is an interior point of F g .

Proof. See, [[90], theorem 2 p.34], [START_REF] Siegel | Einführung in die Theorie der Modulfunktionen n-ten Grades[END_REF].

since if not, i.e., |τ | < 1, we would obtain

a larger imaginary part than τ , contradicting the maximality of the imaginary part of γ.τ . Therefore, for every τ ∈ H there exists γ ∈ G 1 such that γ.τ ∈ F 1 . Suppose that given γ ∈ G 1 , τ 1 = τ ∈ F 1 and τ 2 = γ.τ ∈ F 1 as well with γ = ±I 2 . As the pairs (τ, γ) and (γ.τ, γ -1 ) play symmetric roles here. We assume without loss of generality that I(γ.τ ) ≥ I(τ ) which implies from (5.12) that |cτ + d| ≤ 1. γ cannot be of the form T n since this would contradict

2 for all τ ∈ F 1 . Hence, from (5.12) we get

which can only be satisfied if c = ±1. However,

Proposition. To each

3 ), then Stabilizer(τ ) = ST of order 3, • τ = exp( πi 3 ), then Stabilizer(τ ) = T S of order 3.

Proof. We will show first why {0, 1} respectively, {-1, 0} are the only values for which d can be taken for τ = exp( 2πi 3 ) respectively, τ = exp( πi 3 ). For τ = exp( 2πi3 ), |τ | = 1 and Re(τ

More precisely, this gives us exp( 2πi 3 ) + 1 = exp( πi 3 ). Therefore |τ | = |τ + 1| = 1, i.e., |cτ + d| ≤ 1 when d ∈ {0, 1}.

For τ = exp( πi 3 ), this case is similar to the previous one where d ∈ {-1, 0}. If d = 0: we get γ.τ = a -1 τ (c = 1, then b = -1). Hence, for τ = exp( 2πi 3 ), we have a -

Therefore, a ∈ {-1, 0}. For τ = exp( πi 3 ), we apply the same strategy and we get a ∈ {0, 1}. We obtain the identity, i.e., γ.τ = τ in these two cases:

3 ). To determine the values of a, we have:

γ ← R j γ; end if end for end while -0.1064 -0.4257i 0.1205 -0.1783i -0.1946 -0.1178i 0.3590 + 0.5023i 0.1990 -0.1118i -0.0510 -0.0073i -0.4511 + 0.1383i -0.0171 + 0.2485i -0.0543 -0.3239i 0.2684 -0.2975i -0.4161 + 0.2521i 0.0481 + 0.3949i

Columns 4 through 6 -0.1064 -0.4257i 0.3590 + 0.5023i -0.4511 + 0.1383i 0.1205 -0.1783i 0.1990 -0.1118i -0.0171 + 0.2485i -0.1946 -0.1178i -0.0510 -0.0073i -0.0543 -0.3239i 0.2815 + 0.7791i 0.3684 -0.0369i 0.3907 -0.1531i 0.3684 -0.0369i 0.2315 + 0.6895i 0.3656 -0.1563i 0.3907 -0.1531i 0.3656 -0.1563i -0.4318 + 0.6585i -0.2437 -0.3094i -0.2134 -0.1308i -0.1541 + 0.0260i Columns 7 through 7 0.2684 -0.2975i -0.4161 + 0.2521i 0.0481 + 0.3949i -0.2437 -0.3094i -0.2134 -0.1308i -0.1541 + 0.0260i -0.4997 + 1.0021i.

However, the square of the norm of the shortest lattice vector of the imaginary part of the matrix W is 0.6585, well below the threshold √ 3/2. Note that the LLL reduced Ỹ above has the shortest vector in the 6th column (with squared norm 0.6585). One could construct a unimodular matrix Z such that RZ has this vector appearing in the first column (the resulting matrix might not satisfy the LLL condition ). This would be more suited to the application of Siegel's algorithm, but will be still approximate since in general LLL does not identify the shortest lattice vector correctly.

If the same algorithm is applied with an exact determination of the shortest vector, the picture changes considerably: in the first step of the iteration, the shortest lattice vector is correctly identified having the square of the norm 0.6585. Thus after a shift of the real part, a quasi-inversion is applied. The subsequent identification of the shortest vector of the resulting matrix leads to a vector of squared norm 0.7259. After a shift of the real part, another