Alain Fouque

Adeline Roux-Langlois

Gildas Avoine

Léo Ducas

Radan Kučera

Andrea Lesavourey

Tuong-Huy Nguyen

Olivier Bernard

Approx Ideal-Svp Olivier Bernard

Using the Product Formula to Solve Approx-SVP in Ideal Lattices

Keywords: Ideal lattices, Approx-SVP, S-unit attacks, Twisted-PHS algorithm Cyclotomic fields, Stickelberger ideal, short basis, relative class number. Links: [ math.NT] 10 ] [BLNR21] Ideal lattices, Approx-SVP, Stickelberger, S-unit attacks, Twisted-PHS algorithm Ideal lattices, Approx-SVP, S-unit attacks, Twisted-PHS algorithm Cyclotomic fields, Stickelberger ideal, short basis, relative class number math.NT] 10 ] [BLNR21] Ideal lattices, Approx-SVP, Stickelberger, S-unit attacks, Twisted-PHS algorithm Ideal lattices, Approx-SVP, S-unit attacks, Twisted-PHS algorithm Ideal lattices, Approx-SVP, Stickelberger, S-unit attacks, Twisted-PHS algorithm

uccessful works always require the support of many people, and this is especially true for completing a PhD thesis, a particularly heavy life project. My first thanks go to my supervisors Pierre-

Résumé en français

Résumé en français P oussée par la menace hypothétique de la construction dans les prochaines décennies d'un ordinateur quantique à grande échelle, la communauté cryptographique a été amenée à considérer de nouveaux problèmes mathématiques sur lesquels fonder la sécurité des cryptosystèmes à clé publique dits post-quantiques. En 2016, l'agence américaine National Institute of Standards and Technology (NIST) a lancé une compétition de standardisation pour la cryptographie post-quantique, afin d'évaluer et standardiser des algorithmes à clé publiques résistants à l'ordinateur quantique. Pas loin de 70 propositions ont été reçues, utilisant plusieurs objets mathématiques comme, pour n'en nommer que quelques-uns, les réseaux euclidiens, les codes correcteurs d'erreurs ou les graphes d'isogénies entre courbes elliptiques supersingulières.

La famille des réseaux euclidiens, qui fait l'objet d'un grand nombre de soumissions, représente l'une des solutions post-quantiques les plus prometteuses. Plusieurs problèmes difficiles sont utilisés afin de prouver la sécurité de ces cryptosystèmes, comme le problème Ntru [START_REF] Hoffstein | NTRU: A ring-based public key cryptosystem[END_REF], le problème Short Integer Solution (Sis) [START_REF] Ajtai | Generating hard instances of lattice problems[END_REF] ou le problème Learning With Errors (Lwe) [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF], ainsi que leurs variantes algébriquement structurées ring (Ring-Sis [START_REF] Lyubashevsky | Micciancio: Generalized compact knapsacks are collision resistant[END_REF][START_REF] Peikert | Efficient collision-resistant hashing from worst-case assumptions on cyclic lattices[END_REF], Ring-Lwe [START_REF] Stehlé | Efficient public key encryption based on ideal lattices[END_REF][START_REF] Lyubashevsky | On ideal lattices and learning with errors over rings[END_REF]) ou Module (Module-Sis, Module-Lwe [START_REF] Langlois | Stehlé: Worst-case to average-case reductions for module lattices[END_REF]). Typiquement, les variantes algébriquement structurées ont l'avantage d'offrir de meilleures performances, au prix d'une possible perte de sécurité. En fin de compte, leur sécurité repose sur la difficulté de résoudre le problème du presque plus court vecteur, ou Approximate Shortest Vector Problem (Approx-Svp), dans la classe réduite des réseaux euclidiens algébriquement structurés.

Dans le cas de réseaux arbitraires, Svp est un problème NP-difficile [START_REF] Ajtai | The Shortest Vector Problem in L2 is N P -hard for randomized reductions[END_REF] extensivement étudié. Sa version approchée consiste, pour tout réseau de rang n, à trouver un vecteur non nul du réseau dont la norme euclidienne diffère d'un petit facteur multiplicatif de la longueur du plus court vecteur non nul du réseau. Le meilleur compromis dans ce cas est donné par la hiérarchie de Schnorr [START_REF] Schnorr | A hierarchy of polynomial time lattice basis reduction algorithms[END_REF], qui permet d'atteindre un facteur d'approximation 2 O(n ω ) en temps 2 O(n 1-ω ) , pour tout ω ∈ (0, 1). En pratique, le meilleur algorithme connu qui est proche de ce compromis est l'algorithme Block Korkin-Zolotarev (BKZ) [START_REF] Schnorr | Lattice basis reduction: Improved practical algorithms and solving subset sum problems[END_REF], qui peut être vu comme une amélioration de l'algorithme bien connu LLL [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF], dû à A. Lenstra, H. Lenstra et L. Lovász.

Cependant, ces hypothèses structurées (p. ex., Ring-Lwe) pourraient se révéler triviales si les variantes sous-jacentes d'Approx-Svp s'avéraient plus faciles dans le cas spécifique des réseaux algébriquement structurés. Ainsi, une cible naturelle pour la cryptanalyse est le problème du plus court vecteur dans les réseaux idéaux, ou Ideal Shortest Vector Problem (id-Svp), c.-àd., restreint aux réseaux images par le plongement de Minkowski d'idéaux fractionnaires de l'anneau des entiers O K d'un corps de nombres K. Pendant une longue période, le meilleur algorithme connu pour résoudre Approx-Svp dans les réseaux idéaux a été le même que pour les réseaux non structurés. Cependant, une série récente de travaux [CGS14, EHKS14, BS16, CDPR16, CDW17, DPW19, PHS19a] tend à montrer que la résolution de ce problème pourrait se révéler plus facile dans les réseaux idéaux, en particulier dans un monde quantique.

vii viii

Résumé en franc ¸ais

Algorithmes quantiques pour la théorie des nombres

En effet, la découverte de nouveaux algorithmes quantiques en temps polynomial pour la théorie des nombres a attiré de plus en plus d'attention sur la manière dont la forte structure algébrique de ces réseaux idéaux pourrait être utilisée pour s'attaquer à id-Svp plus efficacement que par le truchement des algorithmes traditionnels de réduction de réseaux comme LLL ou BKZ. Tout a commencé avec la note de Campbell, Groves et Shepherd [START_REF] Campbell | Soliloquy: A cautionary tale[END_REF], qui a fait grand bruit et a revendiqué, toutefois sans preuves, une attaque en temps polynomial quantique contre un schéma nommé Soliloquy, qui résout des instances très spécifiques d'Approx-Svp sur des réseaux idéaux principaux. Leur algorithme comporte deux étapes successives :

• la première résout le problème de l'idéal principal, ou Principal Ideal Problem (Pip), qui consiste à trouver n'importe quel générateur d'un idéal principal, • la deuxième réduit ce générateur autant que possible, grâce aux unités algébriques du corps de nombres, ce qui revient à résoudre un problème du plus proche vecteur, ou Closest Vector Problem (Cvp) dans le réseau log-unité. Les auteurs affirment que la première étape peut être effectuée en temps quantique polynomial, et que la deuxième étape est suffisamment facile pour permettre de casser le schéma dans le cas des corps cyclotomiques, grâce aux unités circulaires.

La première partie de leurs revendications a été prouvée indépendamment dans [START_REF] Eisenträger | A quantum algorithm for computing the unit group of an arbitrary degree number field[END_REF], qui décrit une généralisation de l'algorithme de Shor [START_REF] Shor | Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer[END_REF], pour calculer le groupe des unités de corps de nombres de degrés arbitraires en temps quantique polynomial. Plus tard, en se basant sur [START_REF] Eisenträger | A quantum algorithm for computing the unit group of an arbitrary degree number field[END_REF], Biasse et Song [START_REF] Biasse | Efficient quantum algorithms for computing class groups and solving the principal ideal problem in arbitrary degree number fields[END_REF] ont étendu ce résultat au calcul du groupe des classes et des S-unités. Plus précisément, ils montrent comment calculer des S-unités, une généralisation des unités algébriques d'un corps de nombres dépendant d'un ensemble S d'idéaux premiers, en temps quantique polynomial en la taille du discriminant ∆ K du corps de nombres K, et en la taille de la base de facteurs S. Ils montrent également comment la résolution du Pip, ainsi que le calcul du groupe des classes ou du groupe des unités, peuvent être réduits à ces calculs de S-unités pour des bases de facteurs S convenablement choisies.

Cryptanalyses algébriques de id-SVP

En ce qui concerne la seconde revendication de [START_REF] Campbell | Soliloquy: A cautionary tale[END_REF], Cramer, Ducas, Peikert et Regev [START_REF] Cramer | Recovering short generators of principal ideals in cyclotomic rings[END_REF] ont prouvé que, dans le cas des corps cyclotomiques de conducteur égal à une puissance d'un nombre premier, les plongements logarithmiques de l'ensemble des unités circulaires [START_REF] Washington | Introduction to Cyclotomic Fields[END_REF] §8] induisent une base de suffisamment bonne qualité d'un sous-réseau d'indice relativement petit dans le réseau log-unité. Cette propriété fondamentale leur permet de conclure qu'il existe un algorithme quantique polynomial qui, en moyenne, résout Approx-Svp dans des réseaux idéaux principaux pour un facteur d'approximation 2 O( √ n) , où n est la dimension de l'idéal. Cette première cryptanalyse algébrique a ensuite donné lieu à plusieurs généralisations, à toute classe d'idéaux fractionnaires [START_REF] Cramer | Short Stickelberger class relations and application to Ideal-SVP[END_REF], tous corps cyclotomiques [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF] et tout corps de nombres [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF]. Pour tout idéal challenge b d'un corps de nombres K, toutes ces approches partent d'une solution au problème du logarithme discret dans le groupe des classes, ou Class Group Discrete Logarithm Problem (ClDlp). Ce problème de représentation consiste, à partir d'un ensemble fixé de places finies correspondant à des idéaux premiers p 1 , . . . , p k de K, à trouver, s'ils existent, α ∈ K et e 1 , . . . , e k ∈ Z tels que :

α = b • 1≤i≤k p ei i .
Ce problème revient à calculer un certain groupe de S-unités, ce qui selon la discussion précédente

Résumé en français

Résumé en franc ¸ais ix peut donc être résolu facilement dans un monde quantique. Ainsi, la partie la plus délicate de ces cryptanalyses réside dans le fait de réduire la norme euclidienne de α, c.-à-d., de trouver une plus courte solution au ClDlp ci-dessus, ou de manière équivalente, le plus court représentant de la classe de α modulo le groupe multiplicatif H finiment engendré par les relations de classes entre les p i 's. En utilisant un plongement logarithmique adapté, cela revient à résoudre une instance Cvp dans le réseau image de H par ce plongement logarithmique. À la fin, l'espoir est que ce plus court représentant soit un élément suffisamment petit de l'idéal challenge. Par conséquent, il est particulièrement important de choisir soigneusement le plongement logarithmique, de telle sorte qu'il convoie toutes les informations utiles sur la taille de α, et de sorte que la base du réseau obtenu ne soit pas de trop mauvaise qualité pour l'oracle Cvp. Remarquons que l'algorithme de [START_REF] Campbell | Soliloquy: A cautionary tale[END_REF][START_REF] Cramer | Recovering short generators of principal ideals in cyclotomic rings[END_REF] suit exactement cette procédure pour k = 0, auquel cas une solution au ClDlp existe si et seulement si b est principal.

Ces cryptanalyses algébriques peuvent se regrouper en deux lignes de travaux, qui utilisent des outils différents pour estimer et garantir la taille de leurs sorties, et n'ont pas la même portée :

• L'algorithme CDW, par Cramer, Ducas et Wesolowski [START_REF] Cramer | Short Stickelberger class relations and application to Ideal-SVP[END_REF][START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF], résout id-Svp pour un facteur d'approximation exp O( √ n) dans les corps cyclotomiques de degrés n, en temps quantique polynomial. Ce compromis est prouvé à l'aide d'heuristiques soigneusement justifiées. L'algorithme utilise l'idéal de Stickelberger d'un corps cyclotomique, un idéal spécial qui fournit gratuitement des relations courtes dans la partie relative du groupe des classes. Ces relations courtes permettent de trouver un proche multiple principal de tout idéal challenge, c.-à-d., un multiple principal dont la norme algébrique, divisée par la norme de l'idéal challenge, est relativement petite. De là, la routine de [START_REF] Cramer | Recovering short generators of principal ideals in cyclotomic rings[END_REF] peut être appliquée à un générateur de ce multiple principal, dans l'espoir que sa sortie soit suffisamment petite.

• Ces deux étapes peuvent en fait être combinées dans une unique instance Cvp, ce qui a donné naissance à ce qui est maintenant appelé les attaques par S-unités : l'idée est de trouver de cette manière un multiple principal qui n'est pas seulement de petite norme algébrique, mais qui est également généré par un petit élément. C'est l'idée centrale de l'algorithme PHS par Pellet-Mary, Hanrot and Stehlé [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF], qui s'applique à tout corps de nombres et que nous détaillons dans la section suivante. En ce qui concerne l'algorithme CDW, son impact en pratique a été évalué dans [START_REF] Ducas | On the shortness of vectors to be found by the Ideal-SVP quantum algorithm[END_REF] grâce à de nombreuses simulations pour la résolution du Cvp dans chacun des deux réseaux impliqués. À partir de ces résultats expérimentaux, les auteurs dérivent une borne inférieure volumétrique [DPW19, Eq. (5) et Tab. 1] et en concluent que l'algorithme CDW devrait battre BKZ 300 pour des corps cyclotomiques de degrés plus grands que 7000. 5

Attaques par S-unités

Nous décrivons plus en détails l'algorithme PHS [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF], d'après Pellet-Mary, Hanrot et Stehlé, qui est à notre connaissance la première attaque par S-unités décrite et prouvée dans la littérature, même si le formalisme des S-unités n'est pas directement utilisé dans [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF].

La principale caractéristique de leur algorithme est de combiner dans une unique instance Cvp les deux étapes principales de l'algorithme CDW [START_REF] Cramer | Short Stickelberger class relations and application to Ideal-SVP[END_REF][START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF], plus précisément le problème du proche multiple principal ou Close Principal Multiple Problem (Cpmp) d'une part, et le problème du plus court générateur, ou Shortest Generator Problem (Sgp) d'autre part. Ceci garantit dans une certaine mesure que la sortie de l'algorithme de résolution du Cpmp

x Résumé en franc ¸ais possède un générateur qui n'est "pas beaucoup plus grand " que son plus court élément non nul. Malheureusement, cela n'est rendu possible qu'au prix d'un précalcul exponentiel, dépendant uniquement du corps de nombres K. En effet, afin de garantir la taille de la sortie et la complexité temporelle de l'algorithme, un ingrédient fondamental de la preuve réside dans l'utilisation d'un oracle Cvp avec données de précalcul dû à Laarhoven [START_REF] Laarhoven | Sieving for closest lattice vectors (with preprocessing)[END_REF]. Plus formellement, l'algorithm PHS se divise en deux phases : 1. La phase de précalcul construit un réseau spécifique, ne dépendant que du corps K, qui peut être vu comme un réseau log-S-unité sous un plongement logarithmique particulier, ainsi qu'une donnée permettant de résoudre efficacement Approx-Cvp dans ce réseau. En notant ∆ K le discriminant de K, cette phase s'exécute en temps 2 O(log|∆ K |) et produit une donnée V de taille 2 O(log 1-2ω |∆ K |) , où ω ∈ 0, 1 2 paramétrise le compromis entre le temps d'exécution et le facteur d'approximation obtenu par la phase suivante. 2. La phase de requête réduit chaque challenge pour Approx-id-Svp à la résolution d'une instance Approx-Cvp dans ce réseau log-S-unité fixé. Elle prend en entrée n'importe quel idéal de O K , dont la norme algébrique est de taille bornée par 2 poly(log|∆ K |) , ainsi que la donnée précalculée V, et s'exécute en temps 2 O(log 1-2ω |∆ K |) + T Su (K). La sortie est un élément non nul de l'idéal qui est une solution d'Approx-Svp pour un facteur d'approximation 2 O(log ω+1 |∆ K |/n) , où n est le degré de K. Ici, T Su (K) désigne le temps d'exécution des calculs de groupes de S-unités, c.-à-d., dans un monde quantique, T Su (K) = O ln|∆ K | est polynomial [START_REF] Biasse | Efficient quantum algorithms for computing class groups and solving the principal ideal problem in arbitrary degree number fields[END_REF], tandis que dans un monde classique, T Su (K) reste sous-exponentiel en ln|∆ K |, soit T Su (K) = exp O(ln α |∆ K |), où α = 1/2 pour les corps cyclotomiques [BEF + 17],6 et α = 2/3 dans le cas général [START_REF] Biasse | Subexponential class group and unit group computation in large degree number fields[END_REF], récemment réduit à α = 3/5 par Gélin [START_REF] Gélin | Calcul de groupes de classes d'un corps de nombres et applications à la cryptologie[END_REF].

En omettant le coût exponentiel du précalcul, la phase de requête bat la traditionnelle hiérarchie de Schnorr [START_REF] Schnorr | A hierarchy of polynomial time lattice basis reduction algorithms[END_REF] quand log|∆ K | ≤ O(n 1+ε ) avec ε = 1/3 dans le cas quantique, et ε = 1/11 dans le cas classique [PHS19a, Fig. 5.3]. Cependant, ces bornes sur le discriminant ne sont pas homogènes quand le facteur d'approximation varie, c.-à-d., pour un facteur d'approximation fixé à 2 √ n , la complexité temporelle de l'algorithme PHS bat asymptotiquement la hiérarchie de Schnorr uniquement dans le cas quantique et uniquement pour ε ≤ 1/6.

Contributions de cette thèse

Les contributions de cette thèse se placent dans le contexte des attaques par S-unités. Tout d'abord, nous utilisons le formalisme des S-unités pour définir l'algorithme Twisted-PHS, une version pondérée de l'algorithme PHS qui se révèle extrêmement puissante en pratique. Puis, les contributions suivantes font, pour tous les corps cyclotomiques, la jonction entre les deux lignes décrites précédemment de travaux de cryptanalyse : en utilisant des techniques avancées portant sur le réseau de Stickelberger, nous supprimons d'une part des étapes quantiques de l'algorithme CDW, et d'autre part approchons expérimentalement l'algorithme Twisted-PHS en moyenne dimension, où les phénomènes asymptotiques commencent à s'exprimer pleinement.

Twisted-PHS : utilisation de la Formule du Produit

En fait, le réseau particulier utilisé dans l'algorithme PHS correspond à un réseau spécial appelé le réseau log-S-unité, c.-à-d., un réseau obtenu à partir des images de S-unités par un plongement Résumé en franc ¸ais xi logarithmique adapté, où S peut être identifié à une base de facteurs FB d'idéaux premiers. Il s'avère que choisir soigneusement le plongement logarithmique utilisé est particulièrement important en pratique. Ainsi, notre première contribution consiste à proposer une nouvelle version tordue de l'algorithme PHS, dénommée Twisted-PHS, dont l'idée principale consiste à identifier un plongement logarithmique préservant les propriétés algébriques naturelles des S-unités. Plus précisément, nous incluons les poids standards de la théorie des nombres induits par la Formule du Produit aux coordonnées du plongement logarithmique. Ainsi, pour tout α du corps de nombres K, nous partons de la formule suivante :

Log S α = [K σ : R] • ln|σ(α)| σ∈S ∞ , -v p (α) • ln N (p) p∈FB ,
où K σ = R (resp. C) pour tout plongement σ ∈ S ∞ réel (resp. complexe) allant de K dans R (resp. C), et pour tout idéal premier p ∈ FB, N (p) désigne sa norme algébrique et v p (α) désigne la valuation de α en p. Par contraste, le plongement logarithmique sur lequel se base [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF] n'inclut pas les poids ln N (p) sur les dernières coordonnées. En utilisant ce formalisme des S-unités, nous prouvons que notre algorithme Twisted-PHS réalise le même compromis temps d'exécution v.s. facteur d'approximation que l'algorithme PHS, grâce au même oracle Cvp avec précalcul dû à Laarhoven [START_REF] Laarhoven | Sieving for closest lattice vectors (with preprocessing)[END_REF] pour résoudre efficacement les instances Approx-Cvp dans le réseau log-S-unité. À titre de contribution secondaire, nous proposons également plusieurs améliorations de l'algorithme PHS.

Intuitivement, le fait d'ajouter des poids ln N (p) aux valuations entières pour chaque idéal premier p capture l'idée qu'utiliser une relation augmentant les valuations pour un idéal de grande norme est plus coûteux qu'utiliser une relation impliquant des idéaux de plus petite norme. Ceci encode également dans le réseau log-S-unité l'information sur la longueur et la norme algébrique des S-unités, contrairement au plongement logarithmique utilisé dans [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF] n'impliquant que les valuations entières. In fine, ces éléments tendent à indiquer que l'oracle Cvp dans le réseau log-S-unité tordu combine plus efficacement l'objectif de chercher un idéal multiple principal de petite norme algébrique tout en minimisant la longueur de son générateur.

Une autre conséquence fondamentale de l'utilisation d'un plongement logarithmique convenablement normalisé tient à ce que nous appelons le phénomène de base de facteurs optimale, c.-à-d., nous prouvons qu'il existe une base de facteurs S pour laquelle la densité du réseau log-S-unité est maximale, et donnons un algorithme pour la calculer.

Sur le plan pratique, nous fournissons une implémentation de bout en bout de l'algorithme Twisted-PHS, où l'oracle Cvp de Laarhoven est remplacé par l'algorithme Nearest Plane de Babai [START_REF] Babai | On Lovász' lattice reduction and the nearest lattice point problem[END_REF]. Cette implémentation est publiquement disponible sur GitHub: ob3rnard/Twisted-PHS 7 . Pour la première fois, ceci a permis d'exécuter complètement des attaques par S-unités sur une palette significative d'exemples concrets. Les résultats de nos expériences suggèrent, pour des corps cyclotomiques de conducteurs premiers et des corps NTRU Prime de petites dimensions, plus précisément jusqu'en dimension 70, que :

• avec la normalisation standard de la théorie de nombres, les réseaux log-S-unités présentent des caractéristiques géométriques très particulières et semblent extrêmement faciles à réduire avec BKZ ; • les facteurs d'approximation exacts obtenus sont particulièrement petits et croissent très lentement avec la dimension, "de manière potentiellement sous-exponentielle ou même meilleure". À notre connaissance, il s'agit des toutes premières preuves expérimentales de la particularité géométrique des réseaux log-S-unités tordus ainsi que du potentiel des attaques par S-unités en

Résumé en français xii

Résumé en franc ¸ais pratique. Malheureusement, à cause de la complexité du calcul des S-unités dans un monde classique, les dimensions atteintes ne permettent pas de conjecturer concrètement le comportement asymptotique de l'algorithme Twisted-PHS.

Une base courte de l'idéal de Stickelberger Dans la contribution suivante, nous verrons que calculer explicitement les générateurs de Stickelberger est utile dans au moins deux situations : la première intervient pour supprimer la dernière étape quantique dans l'algorithme CDW [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF], la seconde intervient pour approcher le réseau log-S-unité utilisé dans l'algorithme Twisted-PHS. Dans cette dernière situation, certaines étapes de calcul, en particulier la procédure de 2-saturation utilisée pour densifier le réseau, deviennent rapidement irréalisables avec la croissance des coefficients des éléments. Ceci incite à contraindre à la fois le nombre et la taille des générateurs de Stickelberger impliqués. C'est ici que notre seconde contribution s'avère particulièrement utile. Notre résultat principal consiste à décrire pour la première fois une base courte explicite de l'idéal de Stickelberger S m du m-ième corps cyclotomique pour tout conducteur m, c.-à-d., une base qui n'est constituée que d'éléments courts. Par définition, un élément de Z[G m ], où G m désigne le groupe de Galois du m-ième corps cyclotomique, est dit court s'il s'écrit sous la forme :

σ∈Gm ε σ • σ ∈ S m ⊂ Z G m , avec ε σ ∈ {0, 1} pour tout σ ∈ G m .
Dans le cas où le conducteur est premier, notre base courte coïncide avec la base donnée dans [Sch08, Th. 9.3(i)]. Un ingrédient d'intérêt indépendant de la preuve consiste à décrire une vaste famille d'éléments courts de S m , qui contient l'ensemble identifié dans [CDW21, §4.2].

Cette description utilise un critère arithmétique très simple, dans l'esprit de [START_REF] Washington | Introduction to Cyclotomic Fields[END_REF]Lem. 16.3] quand m est une puissance d'un nombre premier impair. Nous obtenons notre base courte en choisissant astucieusement certains éléments α m (b) parmi cette grande famille d'éléments courts. Nous montrons également comment calculer explicitement les entiers algébriques qui génèrent L αm(b) , pour tout idéal premier non ramifié L et tout élément α m (b) de notre base courte. Ces générateurs s'expriment comme des sommes de Jacobi qui s'avèrent extrêmement plus efficaces à calculer que les générateurs donnés p. ex., dans [Was97, §6.2].

Pour terminer, une conséquence théorique intéressante de notre résultat consiste à dériver une borne supérieure sur le nombre de classes relatives du m-ième corps cyclotomique. La preuve de notre borne donne également un algorithme pour calculer le nombre de classes relatives grâce au déterminant d'un multiple d'une matrice de Hadamard : incidemment, cette méthode semble significativement plus efficace que d'utiliser la formule analytique traditionnelle quand le nombre de facteurs premiers distincts de m est petit.

Réseaux log-S-unités à partir de générateurs explicites de Stickelberger

Dans notre dernière contribution, nous étendons les expériences de Twisted-PHS à tous les corps cyclotomiques de degrés allant jusqu'à 210. Ceci fait sauter la barrière des petites dimensions et permet d'atteindre des tailles de paramètres où les phénomènes asymptotiques, p. ex., la croissance exponentielle du nombre de classes, commencent à s'exprimer pleinement.

Cette percée est obtenue grâce à des améliorations à la fois théoriques et d'implémentation. Tout d'abord, nous montrons comment obtenir une famille de S-unités indépendantes et de rang plein à partir d'un ensemble de S + -unités fondamentales du sous-corps réel maximal, par l'adjonction de générateurs explicites correspondant à une base de l'idéal de Stickelberger. Grâce aux techniques avancées développées précédemment sur l'idéal de Stickelberger, il s'avère que Résumé en franc ¸ais xiii ces générateurs s'expriment toujours comme des sommes de Jacobi, qui sont particulièrement petites et faciles à calculer. Cette famille de rang plein génère un sous-groupe des S-unités d'indice explicitement calculable, dont nous explicitons et prouvons la valeur exacte. Cet indice contient une large puissance de 2 qui peut être retirée grâce à des techniques classiques de 2saturation, pour lesquelles les nouveaux résultats sur l'idéal de Stickelberger sont essentiels. Ainsi, nous obtenons des sous-réseaux du réseau log-S-unité complet sur lesquels tester l'algorithme Twisted-PHS. Nous fournissons ici aussi une implémentation complète, publiquement disponible à l'adresse GitHub: ob3rnard/Tw-Sti8 . Les facteurs d'approximation obtenus par nos expériences ne montrent ni un impact catastrophique des attaques par S-unités, ni ne permettent d'écarter la menace. En effet, le mode approché utilisé au-delà de la dimension 80 donne seulement une borne supérieure sur les performances de l'algorithme Twisted-PHS. Néanmoins, nous observons une forte corrélation entre la densité du sous-réseau log-S-unité utilisé et le facteur d'approximation obtenu par l'algorithme Twisted-PHS : plus le réseau est dense, meilleures sont les performances. Nous sommes également en mesure de confirmer la nature géométrique très particulière du réseau log-S-unité déjà observée en petite dimension, pour tous les corps cyclotomiques, tous les sous-réseaux log-S-unités et toutes les bases de facteurs considérés. Ces observations récurrentes dans des régimes très différents suggèrent que ceci est possiblement l'émanation de phénomènes algébriques plus profonds, une observation qui a été récemment développée par Bernstein et Lange [START_REF] Bernstein | Non-randomness of S-unit lattices[END_REF].

Quoi qu'il en soit, le fait de rassembler toutes ces données en dimensions suffisamment grandes est d'une importance capitale afin de mieux comprendre les performances des attaques par Sunités, et doit être vu comme une première étape avant d'obtenir une estimation fiable du comportement asymptotique de l'algorithme Twisted-PHS, ou plus généralement des attaques par S-unités dans n'importe quel régime.

Dans un résultat complémentaire, nous utilisons la connaissance explicite de ces générateurs de Stickelberger, ainsi que le réseau de toutes les relations de classes réelles, pour enlever presque toutes les étapes quantiques de l'algorithme CDW tout en prouvant le même facteur d'approximation, sous l'hypothèse relativement inoffensive que la partie réelle du nombre de classes vérifie

h + m ≤ O( √ m).
Chapter 1

Introduction

O bliged by the hypothetic threat of the construction of a large scale quantum computer in the next few decades, the cryptographic community has been driven to consider new mathematical problems to serve as the security foundations for so-called post-quantum publickey cryptosystems. In 2016, the U.S. National Institute of Standards and Technology (NIST) launched the Post-Quantum Cryptography Standardization competition to evaluate and standardize quantum-resistant public-key algorithms. Around 70 proposals were received, involving several mathematical objects such as, to name a few, Euclidean lattices, error-correcting codes or supersingular isogeny graphs.

As shown by the large number of submissions for this family, one of the most promising post-quantum solution is based on Euclidean lattices. Several hard problems are used to prove the security of these cryptosystems, such as the Ntru problem [START_REF] Hoffstein | NTRU: A ring-based public key cryptosystem[END_REF], the Short Integer Solution (Sis) problem [START_REF] Ajtai | Generating hard instances of lattice problems[END_REF] or the Learning With Errors (Lwe) problem [START_REF] Regev | On lattices, learning with errors, random linear codes, and cryptography[END_REF], and their algebraically structured variants Ring (Ring-Sis [LM06, PR06], Ring-Lwe [SSTX09, LPR10]) or Module (Module-Sis, Module-Lwe [START_REF] Langlois | Stehlé: Worst-case to average-case reductions for module lattices[END_REF]). Typically, the structured variants offer the advantage of a better efficiency, at the price of possibly losing some of the security, which is ultimately relying on the hardness of the Approximate Shortest Vector Problem (Approx-Svp) in the restricted corresponding class of algebraically structured Euclidean lattices.

In the case of arbitrary lattices, Svp is a well-studied NP-hard problem [START_REF] Ajtai | The Shortest Vector Problem in L2 is N P -hard for randomized reductions[END_REF]. Its Approximate version consists, for any lattice of rank n, in finding a non-zero vector of the lattice, whose Euclidean norm is within a small multiplicative factor from the length of the shortest non-zero vector in the lattice. The best trade-off in this case is given by Schnorr's hierarchy [START_REF] Schnorr | A hierarchy of polynomial time lattice basis reduction algorithms[END_REF], which allows to reach an approximation factor 2 O(n ω ) in time 2 O(n 1-ω ) for any ω ∈ (0, 1), as represented on Fig. 1.1a. In practice, the best known algorithm that is close to this trade-off is the Block Korkin-Zolotarev (BKZ) algorithm [START_REF] Schnorr | Lattice basis reduction: Improved practical algorithms and solving subset sum problems[END_REF], which can be seen as an improvement of the well-known LLL algorithm [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF] due to A. Lenstra, H. Lenstra and L. Lovász.

However, these structured assumptions (e.g., Ring-Lwe) could become vacuous if the underlying variants of Approx-Svp become easier on the specific class of algebraically structured lattices. Hence, a natural target for cryptanalysis is the Ideal Shortest Vector Problem (id-Svp) which focuses on ideal lattices corresponding, under the Minkowski embedding, to fractional ideals of the ring of integers O K of a number field K. For a long time, the best known algorithm to solve Approx-Svp in ideal lattices was the same as for arbitrary lattices, but recently, a series of works [CGS14, EHKS14, BS16, CDPR16, CDW17, DPW19, PHS19a] tends to show that solving this problem could be easier in ideal lattices, in particular in the quantum setting.

1 poly poly e O( √ n) e O( √ n) e O(n) e O(n) Cryptography Approximation Factor Time B K Z (a) Schnorr's hierarchy [Sch87] (unstructured case) poly poly e O( √ n) e O( √ n) e O(n) e O(n) Cryptography Approximation Factor Time Quantum Classical B K Z (b) CDW algorithm [CDW21] (cyclotomic fields) poly poly e O( √ n) e O( √ n) e O(n) e O(n) Precomp.

Cryptography

Approximation Factor Time Quantum Classical (c) PHS algorithm [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF] (cyclotomic fields)

poly poly t = 1 t = 1 t = 1 2 1 + 3ε 1 + ε 2(1+ε) 3 1+7ε 6 1+3ε 2
Precomp.

Cryptography

Quantum Algorithms for Number Theory

Indeed, the discovery of new number-theoretic polynomial-time quantum algorithms showcased how the strong algebraic structure of these ideal lattices could be used to tackle id-Svp more efficiently than by relying on traditional lattice reduction algorithms.

Everything started with the buzzing note of Campbell, Groves and Shepherd [START_REF] Campbell | Soliloquy: A cautionary tale[END_REF], that claimed, without proofs, a quantum polynomial-time attack against a scheme named Soliloquy, solving specific instances of the Approx-Svp on principal ideal lattices. Their algorithm has two successive steps:

• the first one is solving the Principal Ideal Problem (Pip) that asks for any generator of a principal ideal, • the second one is shortening this generator as much as possible using the algebraic units of the field, which reduces to solving a Closest Vector Problem (Cvp) in the log-unit lattice. The former is claimed to run in quantum polynomial-time, and the latter is claimed to be sufficiently easy in the case of cyclotomic fields using circular units to practically break the scheme.

The first claim was proven independently in [START_REF] Eisenträger | A quantum algorithm for computing the unit group of an arbitrary degree number field[END_REF], where the authors described a generalization of Shor's algorithm [START_REF] Shor | Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer[END_REF], to compute unit groups of number fields of arbitrary degree in quantum polynomial time. Later on, building upon [START_REF] Eisenträger | A quantum algorithm for computing the unit group of an arbitrary degree number field[END_REF], Biasse and Song [START_REF] Biasse | Efficient quantum algorithms for computing class groups and solving the principal ideal problem in arbitrary degree number fields[END_REF] extended this result to the computation of class groups and S-unit groups of arbitrary degree number fields. More precisely, they showed how to compute S-units, a generalization of the algebraic units of a number field depending on a set S of prime ideals, in quantum polynomial time in the size of the discriminant ∆ K of the number field K and in the size of the factor base S. They also showed how the Pip resolution, as well as computing class groups or unit groups, can be reduced to these S-unit computations for adequately chosen prime ideals in S.

Algebraic Cryptanalyses of id-SVP

As for the second claim of [START_REF] Campbell | Soliloquy: A cautionary tale[END_REF], Cramer, Ducas, Peikert and Regev [START_REF] Cramer | Recovering short generators of principal ideals in cyclotomic rings[END_REF] proved that, in prime-power cyclotomic fields, logarithmic embeddings of circular units [Was97, §8] yield a sufficiently good basis of a sublattice of relatively small finite index inside the log-unit lattice. This key property allowed them to conclude that there exists a polynomial-time quantum algorithm that, on average, solves Approx-Svp on principal ideal lattices for an approximation factor 2 O( √ n) , where n is the dimension of the ideal. Subsequently, this first algebraic cryptanalysis led to several generalizations, extending to any class of fractional ideal [START_REF] Cramer | Short Stickelberger class relations and application to Ideal-SVP[END_REF], any cyclotomic fields [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF] and to any number field [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF]. For any challenge ideal b of a number field K, all approaches start from a solution to the Class Group Discrete Logarithm Problem (ClDlp). This representation problem asks, given a fixed set of finite places corresponding to prime ideals p 1 , . . . , p k of K, to find, if they exist, α ∈ K and e 1 , . . . , e k ∈ Z such that:

α = b • 1≤i≤k p ei i .
This problem reduces to some S-unit group computation, hence is not hard to solve in a quantum world according to the previous discussion. So, the most difficult part of these cryptanalyses resides in reducing the Euclidean norm of α, i.e., to find a shortest solution to the ClDlp above, or equivalently, the shortest coset representative modulo the finitely generated multiplicative group H of class group relations between the p i 's. Using a suitable logarithmic embedding, this boils down to solve a Cvp instance in the image lattice of H under this logarithmic embedding. At the end, this shortest coset representative is hoped to be a sufficiently small element of the challenge ideal. Therefore, the choice of the logarithmic embedding is particularly important, since it must convey all useful informations on the size of α, and since the obtained lattice basis must not be too bad for the Cvp solver. Note that [START_REF] Campbell | Soliloquy: A cautionary tale[END_REF][START_REF] Cramer | Recovering short generators of principal ideals in cyclotomic rings[END_REF] exactly follow this procedure for k = 0, in which case a solution to the ClDlp exist if and only if b is principal.

For our purpose, we will separate these algebraic cryptanalyses between two lines of work, that use different tools to guarantee the output size, and have different scopes:

• The CDW algorithm, by Cramer, Ducas and Wesolowski [CDW17, CDW21], solves id-Svp for approximation factors exp O( √ n) in cyclotomic fields of degree n, in quantum polynomial time. This trade-off, depicted in Fig. 1.1b, is proven under "carefully justified heuristics". The algorithm uses the Stickelberger ideal of a cyclotomic field, a special ideal providing free short relations in the relative part of the ideal class group. These short relations allow to find a close principal multiple for any challenge ideal, i.e., a principal multiple whose algebraic norm is relatively small when divided by the challenge ideal norm. Then, the [START_REF] Cramer | Recovering short generators of principal ideals in cyclotomic rings[END_REF] routine is applied to a generator of this multiple, hoping that its output is sufficiently short.

• These two steps can actually be combined in a single Cvp instance, giving rise to what are now called S-unit attacks: the idea is to find in this way a principal multiple which is not only of small algebraic norm, but is also generated by a small element. This was the core idea of the algorithm of Pellet-Mary, Hanrot and Stehlé (PHS) [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF], which applies to any number field, and which we detail in the next section. Chapter 1. Introduction

The practical impact of the CDW algorithm was evaluated in [START_REF] Ducas | On the shortness of vectors to be found by the Ideal-SVP quantum algorithm[END_REF] by running numerous simulations for the Cvp in each of the two lattices involved. From these experimental results, they heuristically derive a volumetric lower bound [DPW19, Eq. ( 5) and Tab. 1] and conclude that the CDW algorithm should beat BKZ 300 for cyclotomic fields of degree larger than 7000.13

S-unit Attacks

We describe in more detail the PHS algorithm [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF], by Pellet-Mary, Hanrot and Stehlé, which is to our knowledge the first S-unit attack described and proven in the literature, even though this S-unit formalism was not directly used in [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF].

The main feature of their algorithm is to combine in a single Cvp instance the two principal resolution steps of the CDW algorithm [START_REF] Cramer | Short Stickelberger class relations and application to Ideal-SVP[END_REF][START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF], namely the Cpmp (Close Principal Multiple Problem) and the Sgp (Shortest Generator Problem). This provides some guarantee that the output of the Cpmp solver has a generator which is "not much larger " than its shortest nonzero vector. Unfortunately, this comes at the price of an exponential amount of preprocessing, depending only on the number field K. Indeed, in order to guarantee the output size and the running time of the algorithm, a key ingredient is to use a Cvp with preprocessing hint algorithm due to Laarhoven [START_REF] Laarhoven | Sieving for closest lattice vectors (with preprocessing)[END_REF]. More formally, the PHS algorithm is split in two phases:

1. The preprocessing phase builds a specific lattice, depending only on the field K, which can be viewed as a log-S-unit lattice under a particular logarithmic embedding, together with some hint allowing to efficiently solve Approx-Cvp instances inside this lattice. Denoting by ∆ K the discriminant of K, this phase runs in time 2 O(log|∆ K |) and outputs a hint

V of bit-size 2 O(log 1-2ω |∆ K |)
, where ω ∈ 0, 1 2 is the trade-off parameter. 2. The query phase reduces each Approx-id-Svp challenge to an Approx-Cvp instance in this fixed lattice. It takes as inputs any ideal of O K , whose algebraic norm has bitsize bounded by 2 poly(log|∆ K |) , the hint V, and runs in time 2 O(log 1-2ω |∆ K |) + T Su (K). It outputs a non-zero element of the ideal which solves Approx-Svp with an approximation factor 2 O(log ω+1 |∆ K |/n) , where n is the degree of K. Here, T Su (K) denotes the running time for S-unit groups related computations, i.e., in a quantum world, T Su (K) = O ln|∆ K | is polynomial [START_REF] Biasse | Efficient quantum algorithms for computing class groups and solving the principal ideal problem in arbitrary degree number fields[END_REF], whereas in a classical world, it remains subexponential in ln|∆ K |, i.e., T Su (K) = exp O(ln α |∆ K |), where α = 1/2 for cyclotomic fields [BEF + 17],14 and α = 2/3 in the general case [START_REF] Biasse | Subexponential class group and unit group computation in large degree number fields[END_REF], recently lowered to 3/5 by Gélin [START_REF] Gélin | Calcul de groupes de classes d'un corps de nombres et applications à la cryptologie[END_REF].

This trade-off is shown on Fig. 1.1c and 1.1d on resp. cyclotomic fields and number fields K with log|∆ K | ≤ O(n 1+ε ). Ignoring the preprocessing cost, the query phase beats the traditional Schnorr's hierarchy [START_REF] Schnorr | A hierarchy of polynomial time lattice basis reduction algorithms[END_REF] when log|∆ K | ≤ O(n 1+ε ) with ε = 1/3 in the quantum case, and ε = 1/11 in the classical case [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF]Fig. 5.3]. It should be noted however that these bounds on the discriminant are not uniform as the approximation factor varies, e.g., for an approximation factor set to 2 √ n , the time complexity of the PHS algorithm asymptotically beats Schnorr's hierarchy only in the quantum case and only for ε ≤ 1/6.

Contributions of this Thesis

The contributions of this thesis take place in the context of S-unit attacks. First, the S-unit formalism is used to propose a twisted version of the PHS algorithm that reveals extremely powerful in practice. Then, the following contributions join for all cyclotomic fields the two lines of cryptanalyses described above, by using extended techniques related to the Stickelberger lattice to both remove quantum steps from the CDW algorithm and experimentally approximate the Twisted-PHS algorithm in medium dimensions, where asymptotic phenomena start to express.

Twisted-PHS: using the product formula

In fact, the particular lattice used in the PHS algorithm corresponds to a special lattice called the log-S-unit lattice, i.e., a lattice obtained by applying some logarithmic embedding on S-units, where S can be identified to a factor base FB of prime ideals. As it turns out, choosing carefully the used logarithmic embedding is particularly important in practice.

Hence, our first contribution is to propose in Ch. 3 a new twisted version of the PHS algorithm, that we call Twisted-PHS, whose core idea consists in identifying a logarithmic embedding preserving the natural algebraic properties of S-units. More precisely, we include the standard number-theoretic weights coming from the Product Formula (see e.g., §2.1.2) to the coordinates of the logarithmic embedding, i.e., for any α in a number field K, we start from:

Log S α = [K σ : R] • ln|σ(α)| σ∈S ∞ , -v p (α) • ln N (p) p∈FB ,
where K σ = R (resp. C) for any real (resp. complex) embedding σ ∈ S ∞ from K to R (resp. C), and for any prime ideal p ∈ FB, N (p) is its algebraic norm and v p (α) is the valuation of α at p. By contrast, the log-embedding on which is based [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF] does not include the ln N (p) weights.

Using this S-unit formalism, we prove in Th. 3.14 that our Twisted-PHS algorithm reaches the same asymptotic trade-off between runtime and approximation factor than the PHS algorithm, using the same Cvp solver with preprocessing hint due to Laarhoven [START_REF] Laarhoven | Sieving for closest lattice vectors (with preprocessing)[END_REF] to efficiently solve Approx-Cvp instances in the log-S-unit lattice. As a secondary contribution, we also propose several improvements of the PHS algorithm, in an optimized version described in §3.2.3.

Intuitively, adding weights ln N (p) to integer valuations at any prime ideal p captures the fact that using a relation increasing the valuations at big norm ideals costs more than using a relation involving smaller norm ideals. This also encodes in the log-S-unit lattice the information on the length and algebraic norm of the S-units, unlike the log-embedding used in [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF] involving only the integer valuations. In the end, these rationales indicate that the Cvp solver in the twisted log-S-unit lattice combines more efficiently the goal of searching for a principal multiple of small algebraic norm while still minimizing the size of its generator.

Another fundamental consequence of using a properly normalized logarithmic embedding is what we call the optimal factor base phenomenon, i.e., we prove that there exists a factor base S for which the density of the log-S-unit lattice is maximal. Such a basis is computed by Alg. 3.3.

On the practical side, we provide a fully functional end-to-end implementation of the Twisted-PHS algorithm, where Laarhoven's Cvp oracle is replaced by Babai's Nearest Plane algorithm [START_REF] Babai | On Lovász' lattice reduction and the nearest lattice point problem[END_REF]. This implementation is publicly available at GitHub: ob3rnard/Twisted-PHS7 . For the first time, this allowed to run complete S-unit attacks on a significant range of concrete examples. Our experiments suggested, for prime conductor cyclotomic fields and NTRU Prime fields of small dimensions, namely up to 70, that:

• under the proper number-theoretic normalization, the log-S-unit lattices at hand have a very particular geometric behaviour and seem very easy to reduce (see § §3.4.1 and 3.4.2); • the obtained exact approximation factors increase very slowly with the dimension (see e.g., Fig. 1.2), "in a way that could reveal subexponential or even better ".

Chapter 1. Introduction

To our knowledge, these were the first experimental evidence of the geometric peculiarity of properly normalized log-S-unit lattices and of the practical potential of S-unit attacks. Unfortunately, due to the classical complexity of computing S-units, the attained dimensions are not sufficient to conjecture the asymptotic behaviour of the Twisted-PHS algorithm.

A short basis of the Stickelberger ideal

In the next contribution, we shall see that explicitly computing Stickelberger generators is useful in at least two situations: the first one occurs for removing the last Pip quantum step in the CDW algorithm [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF], the second one occurs when approximating the log-S-unit lattice used in the Twisted-PHS algorithm. In the latter, some of the computational steps, notably the 2-saturation procedure to obtain denser lattices, become quickly intractable as the bit size of the elements coefficients grows. This motivates us to constrain both the number of Stickelberger generators we use and their size. This is where our second contribution, given in Ch. 4, reveals extremely useful. Our main result (see Th. 4.29) is to provide the first explicit short basis of the Stickelberger ideal S m of cyclotomic fields of any conductor m, i.e., a basis containing only short elements. By definition, an element of Z[G m ], where G m denotes the Galois group of the m-th cyclotomic field, is called short whenever it writes as:

σ∈Gm ε σ • σ ∈ S m ⊂ Z G m ,
where ε σ ∈ {0, 1} for all σ ∈ G m .

In the prime conductor case, our short basis coincides with the basis given in [Sch08, Th. 9.3(i)]. One ingredient of independent interest in the proof is Pr. 4.15, which describes a large family of short elements of S m that encompasses the set from [CDW21, §4.2]. This description uses a very simple arithmetic criterion in the spirit of [START_REF] Washington | Introduction to Cyclotomic Fields[END_REF]Lem. 16.3] when m is an odd prime power.

Picking wisely some elements α m (b) in this large family yields our proposed short basis. We also show how to explicitly compute algebraic integers generating L αm(b) , for any unramified prime ideal L and any element α m (b) of our short basis. These generators can be expressed as Jacobi sums that turn out to be drastically more efficient to compute than the generators given e.g., in [Was97, §6.2].

Finally, a nice theoretical consequence of our result is to derive an explicit upper bound on the relative part of the class number of the m-th cyclotomic field, given in Cor. 4.32. The proof of our bound also gives an algorithm to compute the relative class number by computing the determinant of some scaled Hadamard matrix: incidentally, this method seems to be significantly more efficient than when using the traditional analytic formula (see e.g., Eq. (2.10)), when the number t of prime factors of m is small.

[BK21] A short basis of the Stickelberger ideal of a cyclotomic field. Olivier Bernard and Radan Kučera.

Submitted to AMS :: Mathematics of Computation (American Mathematical Society).

Log-S-unit lattices using explicit Stickelberger generators

In our last contribution, given in Ch. 5, we extend the experiments of Ch. 3 to cyclotomic fields of any conductor m and of degree up to 210. This effectively breaks the small dimension barrier and reaches ranges of parameters where asymptotic phenomena, e.g., the exponential growth of the class number, start to express. This breakthrough is obtained as the result of both theoretical and implementational improvements. First, we prove in Th. 5.14 that a full-rank family of independent S-units can be lifted from a set of fundamental S + -units of the maximal real subfield by adjoining the explicit generators corresponding to a basis of the Stickelberger ideal. Using results from Ch. 4, it turns out these generators are always expressed by Jacobi sums, which are particularly small and easy to compute. This full-rank family generates an S-unit subgroup of explicitly computable index, as we also prove in Th. 5.14. This index contains a large power of 2 that can be removed using classical 2-saturation techniques, for which using the results of Ch. 4 is essential. At the end, we obtain sublattices of the full log-S-unit lattice on which to test the Twisted-PHS algorithm. We also provide a full implementation, publicly available at GitHub: ob3rnard/Tw-Sti 8 . The approximation factors obtained in our experiments are detailed in Fig. 1.3. We stress that this graph does neither show a catastrophic impact of S-unit attacks, nor does it clear the threat. Indeed, the approximated mode used beyond dimension 80 only gives a practical upper bound on the performance of the Twisted-PHS algorithm. Nevertheless, we observe a strong correlation between the density of the used log-S-unit sublattice and the approximation factor obtained by the Twisted-PHS algorithm: the denser, the better. We are also able to confirm the peculiar geometric nature of the log-S-unit lattice already observed in Ch. 3, across all considered cyclotomic fields, log-S-unit sublattices and factor bases. These recurrent observations in very different regimes suggest that this phenomenon has a possibly deep explanation, an observation that has been recently developed by Bernstein and Lange in [START_REF] Bernstein | Non-randomness of S-unit lattices[END_REF].

Anyhow, gathering these extensive data in meaningful dimensions is of utmost importance to better understand the performance of S-unit attacks, and should be seen as a first step towards getting a sound estimation of the asymptotic behaviour of the Twisted-PHS algorithm or S-unit attacks with any kind of parameters.

As a side result, we use the knowledge of these explicit Stickelberger generators, as well as the full lattice of real class group relations, to remove almost all quantum steps in the CDW algorithm, under the mild restriction that the plus part of the class number verifies

h + m ≤ O( √ m).
Chapter 2

Preliminaries N umber-theoretic objects and properties required within this thesis are recalled in this chapter. The first section introduces S-unit groups and the properties of their associated log-S-unit lattices; in particular, the Product Formula plays a central role in our cryptanalyses. Then, the special case of cyclotomic fields, for which many remarkable properties are known, is detailed. The third section deals with algorithmic number theory, including several numbertheoretic bounds that are needed in the complexity proofs, and we finish by a piece of Euclidean lattices theory, notably on how to evaluate the quality of a lattice basis w.r. Notations. Let Z, Q, R and C denote the integers, rational, real and complex numbers respectively. For any i, j ∈ Z with i ≤ j, let i, j denote the set {k ∈ Z; i ≤ k ≤ j} of all integers between i and j. For any x ∈ Q, let {x} (resp. [x]) denote its fractional (resp. integral) part, i.e., such that 0 ≤ {x} < 1 and [x] = x -{x} ∈ Z. Any vector is designated by a bold letter v, its i-th coordinate by v i and its p -norm, for p ∈ N * ∪ {∞}, by v p . As a special case, the n-dimensional vector whose coefficients are all 1's is written 1 n . All matrices will be given using row vectors, D v is the diagonal matrix with coefficients v i on the diagonal, I n is the identity and 1 n×n denotes the square matrix of dimension n filled with 1's.

On S-unit Groups

Number fields, ideals and class groups

In this thesis, K always denotes a number field of degree n over Q and O K its maximal order.The algebraic trace and norm of α ∈ K, resp. denoted by Tr(α) and N (α), are defined as the trace and determinant of the endomorphism x → αx of K, viewed as a Q-vector space. The discriminant of K is written ∆ K and can be defined, for any Z-basis ω 1 , . . . , ω n of O K , as det Tr(ω i ω j ) i,j . Most complexities of number-theoretic algorithms depend on ln|∆ K |.

Class groups.

The fractional ideals of K are designated by gothic letters, like b, and form a multiplicative group I K containing the normal subgroup P K := α ; α ∈ K of principal ideals. The quotient group I K P K is called the class group of K and denoted by Cl K . The class group is a finite group, whose order h K is called the class number of K. For any ideal b ∈ I K , the class of b in Cl K is denoted by b .

Finally, for any set of prime ideals L i ; i ∈ 1, k , we denote by h K,(L1,...,L k ) the cardinal of the subgroup of Cl K generated by the k classes L i , i.e., the determinant of the kernel of:

f L1,...,L k : e 1 , . . . , e k ∈ Z k -→ 1≤i≤k L i ei ∈ Cl K .
Specific families of number fields.

We will specifically target two families of number fields, widely used in cryptography [START_REF] Peikert | A decade of lattice cryptography[END_REF]: cyclotomic fields Q(ζ m ), where ζ m := e 2iπ/m is a primitive m-th root of unity, and NTRU Prime [START_REF] Bernstein | NTRU Prime: Reducing attack surface at low cost[END_REF] fields Q(z q ), where z q is a root of x q -x -1 for q prime. Both families have discriminants of order n n . The case of cyclotomic fields is developed in §2.2; in particular, O Q(ζm) = Z[ζ m ] and their discriminant is explicitly known from the factorization of m. For NTRU Prime fields, the situation is marginally more involved, as Z[z q ] is maximal if and only if its polynomial discriminant

D 0 = q q -(q -1) q-1 [Swa62, Th. 2] is squarefree [Kom75, Th. 4] : ∆ Q(zq) = p|D0 p vp(D0) mod 2
, where p vp(D0) divides exactly D 0 .

Note however that there is strong evidence that such D 0 's are generically squarefree, say with probability roughly 0.99 [BMT15, Conj. 1.1]. Actually, we checked that the conductor of Z[z q ] is not divisible by any of the first 10 6 primes for all q ≤ 1000 outside the set {257, 487}, for which 59 2 | D 0 .

The Product Formula

Places of the number field K are usually split into two parts: the set S ∞ of infinite places can be identified with the embeddings of K into R or C, up to conjugation; the set S 0 of finite places is specified by the infinite set of prime ideals of K.

Let (r 1 , r 2 ) be the signature of K with n = r 1 + 2r 2 . The real embeddings of K are numbered from σ 1 to σ r1 , whereas the complex embeddings come in pairs σ j , σ j for j ∈ r 1 + 1, r 2 . Each embedding σ of K into C induces an Archimedean absolute value |•| σ on K, such that for α ∈ K, |α| σ = |σ(α)|; two complex conjugate embeddings yield the same absolute value. Thus, it is common to identify the set S ∞ of infinite places of K with the embeddings of K into C up to conjugation, so that S ∞ = σ 1 , . . . , σ r1 , σ r1+1 , . . . , σ r1+r2 . The completion of K with respect to the absolute value induced by an infinite place σ ∈ S ∞ is denoted by K σ ; it is R (resp. C) for real places (resp. complex places).

Likewise, let p be a prime ideal of O K above p ∈ Z of residue degree f . For α ∈ K, the largest power of p that divides α is called the valuation of α at p, and denoted by v p (α); this defines a non-Archimedean absolute value |•| p on K such that |α| p = p -vp(α) . This absolute value can also be viewed as induced by any of the f embeddings of K into its p-adic completion K p ⊆ C p , which is an extension of Q p of degree f . Hence, any place v ∈ S ∞ ∪ S 0 induces an absolute value |•| v on K, and Ostrowski's theorem for number fields ([Con, Th. 3], [Nar04, Th. 3.3]) shows that all possible absolute values on K are obtained in this way. A remarkable fact is that all these absolute values are tied together by the Product Formula ([Con, Th. 4], [Nar04, Th. 3.5]):

σ∈S ∞ |α| [Kσ:R] σ • p∈S 0 ⊃pZ |α| [Kp:Qp] p = |N (α)| • p∈S 0 N (p) -vp(α) = 1.
(2.1)

As all but finitely many of the |α| v 's, for v ∈ S ∞ ∪ S 0 , are 1, their product is really a finite product. Note that the S ∞ part of this product is |N (α)|, and each term of the S 0 part can be written as N (p) -vp(α) . This formula is actually a natural generalization to number fields of the innocuous looking product formula for r ∈ Q, written as: |r| • p prime p -vp(r) = 1.

Logarithmic S-embeddings

The idea of using S-units for the cryptanalysis of id-Svp is implicitly underlying the work of [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF], and is formalized in [START_REF] Bernard | Twisted-PHS: Using the product formula to solve Approx-SVP in ideal lattices[END_REF] (see Ch. 3). We introduce log-S-unit lattices and discuss the proper normalization induced by the Product Formula that was at the heart of the practical improvements presented in Ch. 3.

S-unit groups structure.

Fix a finite set S of places; in this thesis we shall consider that S always contains S ∞ , hence S can be written as S = S ∞ ∪ p 1 , . . . , p k , where each p i ∈ S 0 corresponds to a prime ideal of K. For convenience, we sometimes call the finite places of S the factor base, denoted by FB, i.e., FB = S ∩ S 0 = p 1 , . . . , p k . Note that we allow k = 0, in which case S = S ∞ is omitted. The so-called S-unit group of K, denoted by O × K,S , is the multiplicative subgroup of K generated by all elements whose valuations are non zero only at the finite places of S. Formally:

O × K,S = α ∈ K; α = p∈S∩S 0 p vp(α) Chapter 2. Preliminaries
Note that when S = S ∞ , we obtain the definition of the unit group O × K as the multiplicative subgroup of invertible algebraic integers of O K . Both (S-)unit groups always contain the finite torsion subgroup of roots of unity of K, denoted by µ O × K . Theorem 2.2 (Dirichlet-Chevalley-Hasse [Nar04, Th. III.3.12, Cor. 1]). The S-unit group is the direct product of the group of roots of unity µ O × K and a free abelian group with S -1 generators. There exists a fundamental system of S-units ε 1 , . . . , ε S-1 s.t. any S-unit ε ∈ O × K,S uniquely writes as ε = µ • S-1 i=1 ε ki i , where µ ∈ µ O × K is a root of unity and k i ∈ Z. In particular, using S = S ∞ , we recover Dirichlet's unit theorem [Nar04, Th. 3.13], which states that O × K is a finitely generated abelian group of rank ν := r 1 + r 2 -1. We shall assume that the fundamental elements ε 1 , . . . , ε S-1 of Th. 2.2 are ordered so that:

O × K µ O × K × ε Z 1 × • • • × ε Z ν and O × K,S O × K × ε Z ν+1 × • • • × ε Z ν+k .
Log-S-unit lattices.

A fundamental ingredient of the proof of this theorem is to build an embedding of O × K,S into R S , whose kernel is µ O × K and whose image is a lattice of dimension S -1 . This embedding is called the logarithmic S-embedding, and its image is called the log-S-unit lattice.

Several equivalent definitions of this logarithmic S-embedding are acceptable for the proof. However, for cryptanalytic purposes, experimental evidence given in Ch. 3 suggests that it is crucial to use a properly normalized embedding for the decodability of the log-S-unit lattice. Thus, we define [Nar04, §3, p.98] the following log-S-embedding from K × to R r1+r2+k :

Log S α = [K v : Q v ] • ln|α| v v∈S = [K σ : R] • ln|σ(α)| σ∈S ∞ , -v p (α) • ln N (p) p∈FB .
For S = S ∞ , this corresponds to the classical definition of the logarithmic embedding Log (see e.g., [Coh93, Def. 4.9.6]) from K to R r1+r2 . From the definition of O × K,S and Eq. (2.1), it is easy to see that Log S O × K,S lies in the trace zero hyperplane orthogonal to 1 S , i.e.: Log S O × K,S ⊂ R S 0 := y ∈ R S ; i y i = 0 . Showing that its dimension is at least S -1 is more involved. Likewise, for any α ∈ K, the sum of the coordinates of Log α is precisely ln|N (α)|, so that Log O × K lies in the trace zero hyperplane orthogonal to 1 r1+r2 , i.e., Log O × K ⊂ R r1+r2 0 = y ∈ R r1+r2 ; i y i = 0 . A row basis Λ K,S of the log-S-unit lattice Log S O × K,S is given by the images of the fundamental system of S-units of Th. 2.2 under the log-S-embedding, i.e., Λ K,S = Log S ε i 1≤i≤ S-1 . In particular, let Λ K = (Log ε i ) 1≤i≤ν be any Z-basis of Log O × K . Since for any ε ∈ O × K , Log S ε is uniformly zero on coordinates corresponding to finite places, the shape of Λ K,S is:

Λ K,S :=             Λ K 0 Log ε ν+1 . . . -v pj (ε ν+i ) ln N (p j ) 1≤i,j≤k Log ε ν+k             . (2.3)
Actually, we shall use that for any maximal set of independent S-units, their images under any logarithmic S-embedding form a full-rank sublattice of the corresponding log-S-unit lattice.

Expanded log-S-embeddings.

As mentioned in [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF][START_REF] Boer | Random self-reducibility of Ideal-SVP via Arakelov random walks[END_REF], a convenient trick in the context of the cryptanalysis of id-Svp is to consider an expanded version of the log-S-embedding, halving and repeating twice S ∞ -coordinates corresponding to complex embeddings, namely, for any α ∈ K × :

Log S α = ln|σ i (α)| i∈ 1,r1 , ln|σ r1+j (α)|, ln|σ r1+j (α)| j∈ 1,r2 , -v p (α) • ln N (p) p∈FB .
As for j ∈ 1, r 2 , |α| σr 1 +j = |α| σr 1 +j , the image Log K × in R n spans the (r

1 + r 2 )-dimensional space L 0 = y ∈ R n ; y r1+2j-1 = y r1+2j , j ∈ 1, r 2 . Similarly, the image Log S K × in R n+k spans the (r 1 + r 2 + k)-dimensional space L = L 0 × R k .
For convenience, we denote by H 0 (resp. H) the span of the log-unit (resp. log-S-unit) lattice under these expanded embeddings, i.e., H 0 = L 0 ∩ R n 0 and H = L ∩ R n+k 0 . In particular, we shall see in Pr. 2.8 that using these expanded log-S-embeddings reduces the volume of the log-S-unit lattice. In practice though, we did not observe any significant difference between the approximation factors obtained using Log S or Log S .

Regulators

The (S-)regulator of K quantifies the density of the (S-)unit group in K. We begin by a technical linear algebra lemma, whose result reveals particularly useful for the volume computations of non-square matrices involved in this thesis, e.g., of Λ K,S .

Lemma 2.4. Let n ≥ 1 and a 1 , . . . , a n ∈ R * . Then, with 1 n×n being the square matrix of dimension n filled with 1's, and D a1,...,an the diagonal matrix with coefficients a i :

det 1 n×n + D a1,...,an = 1 + n i=1 1 a i • n k=1 a k .
Note that the result is also valid if any of the a i 's is zero by expanding the formula and using the formal simplification a i /a i = 1. Writing it down in this form would only be much more noisy.

Proof. We prove the result for any a 1 , . . . , a n ∈ R by induction using the minor expansion formula on the last column for the determinant. Let M [a 1 , . . . , a n ] := 1 n×n + D a1,...,an , and let δ j,n be its (j, n)-minor. The result is obviously true for n = 1 using det M [a 1 ] = 1 + a 1 = a 1 (1 + 1/a 1 ), the last equality being valid for a 1 = 0.

Suppose the result true for matrices of dimension (n -1). The minors δ j,n , for j ∈ 1, n -1 are determinants of matrices M [a 1 , . . . , a j-1 , a j+1 , . . . , a n-1 , 0] whose columns are permuted by a permutation of sign (-1) n-j+1 . Using the induction hypothesis (with ∅ = 1 for n = 2):

∀j ∈ 1, n -1 , δ j,n = (-1) n-j+1 1≤k≤n-1 k =j a k .
Meanwhile, the last minor δ n,n is det M [a 1 , . . . , a n-1 ], which we expand to avoid divisions by 0:

δ n,n = 1≤k≤n-1 a k + n-1 j=1 1≤k≤n-1 k =j a k . 14 Chapter 2. Preliminaries Finally, the determinant of M [a 1 , . . . , a n ] is (1 + a n )δ n,n + n-1
j=1 (-1) n-j δ j,n . A bit of calculation yields the following equation, which is the developed form of the lemma's formula:

det M [a 1 , . . . , a n ] = 1≤k≤n a k + 1≤i≤n 1≤k≤n k =i a k .
Definition 2.5 (S-regulator). The S-regulator of K with respect to S, written R K,S , is defined as the absolute value of any of the (r 1 + r 2 + k) minors of Λ K,S , i.e., as the absolute value of the determinant of Λ (j) K,S for any j ∈ 1, S , where Λ (j) K,S is the submatrix of Λ K,S without the j-th coordinate.

We stress that the S-regulator could not be consistently defined anymore if the twistings by the ln N (p)'s were removed from the log-S-embedding definition, as in this case, the property that all columns sum to 0 disappears.

The value of the S-regulator R K,S is linked to the classical regulator R K of K (obtained for S = S ∞ ) according to the following proposition: Proposition 2.6. Let h K,(FB) the cardinal of the subgroup Cl (FB) K of Cl K generated by classes of ideals in FB = S ∩ S 0 . Then, the S-regulator R K,S verifies:

R K,S = h K,(FB) R K • p∈FB ln N (p).
Proof. Note that R K,S is the determinant, e.g., of Λ

(r1+r2) K,S
where the (r 1 + r 2 )-th column is removed, so is the product of det Λ (r1+r2) K = R K and of the determinant of the (unchanged) square bottom right part of Λ K,S . By definition of O × K,S , the matrix -v pj (ε ν+i ) i,j generates the lattice of all relations in Cl K between ideals of FB, i.e., is the kernel of the following map:

f FB : (e 1 , . . . , e k ) ∈ Z k -→ j p j ej ∈ Cl K ,
whose image is precisely Cl (FB) K

. Thus, det(ker f FB ) is h K,(FB) = Z k / ker f FB , and twisting each column by ln N (p) for p ∈ FB yields the result.

Log-S-unit lattice volumes.

The volume of the log-S-unit lattice is tied to the S-regulator R K,S by the following proposition, which generalizes the classical formula (see e.g., [Neu99, Pr. I.7.5]) linking

R K to Vol Log O × K : Proposition 2.7. Vol Log S O × K,S = √ 1 + ν + k • R K,S . Proof. By definition, Vol Log S O × K,S = √ det(Λ K,S Λ T K,S ). Consider Λ (r1+r2+k) K,S
, removing the last coordinate, whose determinant is R K,S . The concatenated matrix P = I ν+k -1 ν+k verifies Λ K,S = Λ (r1+r2+k) K,S

• P , and a simple induction shows that det(P P T ) = 1 + ν + k (use Lem. 2.4 with all a i 's equal to 1).

Using expanded log-S-embeddings impacts the volume of the log-S-unit lattices given in Pr. 2.7. It is given in following proposition, which generalizes [BDPW20, Lem. A.1]: Proposition 2.8. Under the expanded log-S-embedding, the log-S-unit lattice has volume:

Vol Log S O × K,S = √ n + k • 2 -r2/2 • R K,S .
Using an empty factor basis, this implies Vol Log

O × K = √ n • 2 -r2/2 • R K .
Proof. Let Λ K,S be a row basis of Log S O × K,S , whose shape is the same as Λ K,S in Eq. (2.3) except that Log is systematically used instead of Log. The proof explicits the transition matrix from the truncated matrix Λ

(ν+1+k) K,S
, whose determinant is R K,S , to Λ K,S , and computes its volume.

Let P = I ν+k -1 ν+k be such that Λ K,S = Λ (r1+r2+k) K,S

• P . Obtaining Λ K,S from Λ K,S requires to halve and expand the coordinates corresponding to complex places, all other coordinates staying identical. Let F be the transition matrix verifying Λ K,S = Λ K,S • F , i.e., the block diagonal matrix with three blocks: I r1 , the (r 2 × 2r 2 ) block of vectors (. . . , 1/2, 1/2, . . . ), and

I k . Then Λ K,S = Λ (r1+r2+k) K,S
• (P F ). For k ≥ 1, or k = 0 and r 2 = 0, (P F ) writes as F -1 -1 ν+k , where F -1 is F without its last column and its last row. We compute:

(P F )(P F ) T = 1 (ν+k)×(ν+k) + D (1r 1 (1/2)•1r 2 1 k-1 ) .
Using Lem. 2.4 to obtain that the determinant of this matrix is (n + k)2 -r2 completes the proof, except in the case k = 0, r 2 > 0. In this specific case, (P F ) writes as the first (n -2) columns of F -1 , concatenated twice with (-1/2) • 1 ν , so that (P F )(P

F ) T = 1 2 • 1 ν×ν + D (2•1r 1 1r 2 -1
) . This last matrix has volume n • 2 -r2 as expected.

Cyclotomic Fields

An important special case of number fields is the family of cyclotomic fields, for which many additional properties are known.

For any positive integer m > 1, we denote the cyclotomic field of conductor m, or the m-th cyclotomic field, by K m = Q(ζ m ), where ζ m = e 2iπ/m is a primitive m-th root of unity. It has degree n = ϕ(m), its maximal order is O Km = Z ζ m ([Was97, Th. 2.6]), and its discriminant, which has the same order of magnitude as n n , is given precisely by ([Was97, Pr. 2.7]):

∆ Km = (-1) ϕ(m)/2 m ϕ(m) p|m p ϕ(m)/(p-1)
For convenience, when it comes to cyclotomic fields, we will index ideal and class groups as well as class numbers by the cyclotomic field conductor, i.e., by m instead of K m . Hence, the multiplicative group of fractional ideals of K m is denoted by I m instead of I Km ; likewise, the normal subgroup of principal ideals is written P m := α ; α ∈ K m . The class group of K m is written Cl m , and the class number is simply denoted by h m instead of h Km . Note that if m is odd, we have that K m = K 2m , so we can further assume m ≡ 2 mod 4 without any loss of generality. We shall also write the prime factorization of m as m = p e1 1 p e2 2 • • • p et t and let q i = p ei i for all i ∈ 1, t . In particular, m has exactly t distinct prime divisors. Remark 2.9. Note that we implicitly fix an ordering on the factors q i of m. All our results hold true for any ordering as long as it stays consistent through all subsets of the q i 's. However, if this ambiguity was a problem in an application, we could simply fix an ordering by p 1 < • • • < p t . Chapter 2. Preliminaries

Two special arithmetic subsets of 1, m

We recall here from [START_REF] Kučera | On bases of the Stickelberger ideal and of the group of circular units of a cyclotomic field[END_REF]p.293] the definition of two subsets M + m and M - m of 1, m that are useful to describe resp. a fundamental family of circular units and a short Z-basis of the Stickelberger ideal of K m .

Let X m be the set of all positive integers a < m that are either divisible by q i or relatively prime to q i for each i ∈ 1, t , i.e.:

X m = a ∈ Z; 0 < a < m, a, m (a,m) = 1 . Let M ± m ⊆ X m be the sets of all a ∈ X m satisfying ([Kuč92, p.293]): 15 • for all i ∈ 1, t , if q i a then a ≡ -(a, m) mod q i , • if a m, let k = max i ∈ 1, t ; a ≡ (a, m) mod q i , then a (a,m)q k < 1 2 , • if a | m
then the set i ∈ 1, t ; q i a has an even (resp. odd) number of elements when defining M + m (resp. when defining

M - m ). Note that M + m (resp. M - m ) contains ϕ(m)

2

-1 elements (resp. ϕ(m) 2 elements). Both sets are obviously easy to compute, using only simple arithmetic criteria.

Galois group and maximal real subfield

Let G m denote the Galois group of K m , which can be written explicitly as ([Was97, Th. 2.5]):

G m = σ m,s : ζ m -→ ζ s m ; 0 < s < m, (s, m) = 1 Z/mZ × .
In particular, we denote by σ m,s ∈ G m the automorphism sending any m-th root of unity to its s-th power. For convenience, the automorphism induced by complex conjugation is written τ = σ m,-1 , and we will omit m most of the time, when no ambiguity is possible. The algebraic norm of α ∈ K m is defined by N (α) = σ∈Gm σ(α), hence the absolute norm element in the integral group ring Z[G m ] writes as N m = σ∈Gm σ.

For any positive integers m, r such that r | m we have the usual restriction and corestriction maps between the group rings Q[G m ] and Q[G r ]:

Res Km/Kr : Q[G m ] → Q[G r ], Cor Km/Kr : Q[G r ] → Q[G m ].
The restriction map is the ring homomorphism sending each automorphism σ ∈ G m to its restriction σ| Kr ; the corestriction map is the linear map determined for any ρ ∈ G r by: Cor Km/Kr (ρ) = Maximal real subfield.

The maximal real subfield of K m , denoted by K + m , is the fixed subfield of K m under complex conjugation, i.e., K +

m := K τ m = Q ζ m +ζ -1 m . Its maximal order is given by O K + m = Z ζ m +ζ -1 m
(see e.g., [Was97, Pr. 2.16]). By Galois theory, since τ is a normal subgroup of G m , the maximal real subfield of K m is a Galois extension of Q with Galois group G + m := Gal K + m /Q isomorphic to G m τ . We will consistently identify G + m with the following system of representatives modulo τ restricted to K + m :

G + m = σ s | K + m ; 0 < s < m 2 , (s, m) = 1 .
Technically, each

σ s | K + m ∈ G + m extends in G m to
s.t. b ∈ Cl - m , b 1+τ ∩ K + m is principal. Concretely, it implies that h m = h + m • h - m
is the product of the so-called plus part and relative part of the class number.

Relative part of the class number.

As mentioned earlier, not much is generally known about the class number of a number field, and the analytic class number formula recalled in Eq. (2.34) only allows to obtain a rough upper bound

h m ≤ O |∆ Km | .
In the case of cyclotomic fields though, the structure of the relative class group is better understood [START_REF] Fung | Computation of the first factor of the class number of cyclotomic fields[END_REF]. Using analytic means, the relative class number has the following explicit expression [START_REF] Washington | Introduction to Cyclotomic Fields[END_REF]Th. 4.17]:

h - m = Qw • χ odd -1 2 B 1,χ , (2.10)
where

w = 2m if m is odd and w = m if m is even, Q = 1 if m is a prime power and Q = 2 otherwise, and B 1,χ is defined by 1 f f a=1 a • χ(a) for any odd primitive Dirichlet character χ modulo m of conductor f dividing m.
Computing this value is in practice very efficient, using adequate representations of Dirichlet characters. We shall also introduce in Ch. 4 an algorithmically basic way to obtain h - m via a determinant computation that is especially competitive when m has few distinct prime divisors. 120 1 285 144 1 400 160 1 245 168 1 209 180 1 576 192 1 248 120 4 296 144 1 440 160 5 261 168 1 217 180 1 612 192 1 308 120 1 304 144 1 492 160 1 392 168 1 279 180 1 672 192 1 372 120 1 380 144 1 528 160 1 516 168 1 297 180 1 275 200 1 396 120 1 432 144 1 600 160 1 588 168 1 235 184 1 375 200 1 384 128 1 444 144 1 660 160 1 267 176 1 564 184 1 500 200 [START_REF]Sage Developers: SageMath, the Sage Mathematics Software System (Version 9.0)[END_REF], each in less than 3 hours on a Intel ® Core™ i7-8650U @3.2GHz CPU.

Plus part of the class number.

The really hard part of cyclotomic class numbers computations is to obtain the plus part h

The fact that the plus part of the class number seems so much smaller than the relative part is striking. On the theoretical side, Weber's conjecture claims that h + 2 e = 1 for any e > 1, and Buhler, Pomerance and Robertson [START_REF] Buhler | Heuristics for class numbers of prime-power real cyclotomic fields[END_REF] argue, based on Cohen-Lenstra heuristics, that for all but finitely many pairs (p, e), where p is a prime and e is a positive integer, h + p e+1 = h + p e ; hence, for prime power conductors, this conjecture claims that the plus part is asymptotically constant.

On the practical side, these conjectures are backed up by Schoof's extensive calculations [START_REF] Schoof | Class numbers of real cyclotomic fields of prime conductor[END_REF] in the prime conductor case, and by the above explicit values. In particular, under GRH, Miller proved Weber's conjecture up to m = 512, and we note that according to Schoof's table, the inequality h + m ≤ √ m holds for more than 96.6% of all prime conductors m = p < 10000.

Circular units

Circular units are sometimes called cyclotomic units in the literature, as in [START_REF] Washington | Introduction to Cyclotomic Fields[END_REF]§8]. We prefer to use the historical terminology from algebraic number theory, see e.g., Sinnott [Sin78, §4] and Kučera [Kuč92, §2], in order to avoid any confusion with the whole unit group O × Km of the m-th cyclotomic field.

Definition 2.11 (Circular units [Was97, §8.1]). Let V m be the multiplicative subgroup of K × m generated by: 1 -ζ a m ; 1 ≤ a ≤ m .
The group of circular units is the intersection

C m := V m ∩ O × Km . Note that C m contains the torsion of K m , since -ζ m = 1 -ζ m 1 -ζ -1 m .
The circular units form a subgroup of O × Km of finite index, more precisely:

Proposition 2.12 ([Sin78, Th. p.107]). The index of C m in O × Km is finite: O × Km : C m = 2 b • h + m , with b = 0 if t = 1, 2 t-2 + 1 -t otherwise.
where t is the number of distinct prime factors of m.

Hence, circular units provide a very large subgroup of O ×

Km : indeed, the real part of the class number is expected to be small ( §2.2.3), and the other factor generically grows linearly in m (see [START_REF] Hardy | An Introduction to the Theory of Numbers[END_REF]Th. 430 and 431] for a precise statement).

An explicit system of fundamental circular units for any m has been given in [START_REF] Gold | Bases for cyclotomic units[END_REF] and independently in [Kuč92, Th. 6.1]. More precisely, for 0 < a < m, define the following special circular units, where m i = m/p ei i [Kuč92, p.176]:

v a =    1 -ζ a m if ∀i ∈ 1, t , m i a, 1 -ζ a m 1 -ζ mi m otherwise, for the unique m i | a.
(2.13)

Theorem 2.14 ([Kuč92, Th. 6.1]). The set v a ; a ∈ M + m is a system of fundamental circular units of K m : for any circular unit η ∈ C m , there exist uniquely determined k(a) ∈ Z and root of unity

µ ∈ ±ζ m s.t. η = µ • a∈M + m v k(a) a
.

A crucial point for the cryptanalysis of id-Svp in [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF] is that the logarithmic embedding of these elements is short. Namely, computing explicitly the constants that appear in the proof of [CDW21, Lem. 3.5], we have, for any 0

< a < m, that Log(1 -ζ a m ) 2 ≤ 1.32 • √ m.

Stickelberger ideal

In this section, we decribe the Stickelberger ideal of a cyclotomic field K m , that provides free relations in the class group. Following Sinnott [START_REF] Sinnott | On the Stickelberger ideal and the circular units of an abelian field[END_REF], for any a ∈ Z, let:

θ m (a) = s∈(Z/mZ) × - as m • σ -1 m,s ∈ Q G m , (2.15)
and let N m be the absolute norm element N m = σ∈Gm σ. Hence, an easy observation gives:

a ≡ b (mod m) =⇒ θ m (a) = θ m (b). (2.16)
Moreover, if m | a, θ m (a) = 0, whereas if m a we get the following relation:

θ m (a) + θ m (-a) = N m .
(2.17) Definition 2.18 (Stickelberger ideal [Sin80, p.189]). Let S m be the subgroup of the additive group of Q G m generated by θ (m) r (a); a, r ∈ Z, r > 0 , where:

θ (m) r (a) = Cor Km/K (m,r) Res Kr/K (m,r) θ r (a) . The Stickelberger ideal of K m is the intersection S m = S m ∩ Z G m .
In fact, S m is Sinnott's group S from [Sin80, p.189], for the abelian field k being the cyclotomic field K m . The following lemma allows us to simplify the previous definition.

Lemma 2.19. For any positive integer m, the group S m is the subgroup of

Q[G m ] generated by θ m (a); 0 < a < m ∪ 1 2 N m . Chapter 2. Preliminaries Proof. On one hand, θ m (a) = θ (m)
m (a) ∈ S m . On the other hand, let us consider any positive integer r = m and let d = (m, r). For any a ∈ Z, using [Kuč96, Lem. 12],

Res Kr/K d θ r (a) ∈ θ d (b); 0 < b < d ∪ 1 2 N d .

It is easy to see that Cor

Km/K d 1 2 N d = 1 2 N m . Considering θ d (b), 0 < b < d, Cor Km/K d θ d (b) = Cor Km/K d 0<s≤d (s,d)=1 - bs d • σ -1 d,s = 0<s≤m (s,m)=1 - bs d • σ -1 m,s = θ m bm d .
(2.20)

As Cor Km/K d is a group homomorphism, the lemma follows from

θ (m) r (a) = Cor Km/K d Res Kr/K d θ r (a) ∈ θ m (a); 0 < a < m ∪ 1 2 N m .
Remark 2.21. For clarity, let us explain that even though S m is slightly different from Sinnott's group S from [START_REF] Sinnott | On the Stickelberger ideal and the circular units of a cyclotomic field[END_REF], the Stickelberger ideal

S = S ∩Z[G m ] defined in [Sin78] coincides with S m . Indeed, S is defined as the subgroup of Q[G m ] generated by the set θ m (a); 0 < a < m , so Lem. 2.19 implies that S m = S + 1 2 N m • Z. If m is even, then 1 2 N m = θ m ( m 2 ) ∈ S , which implies S m = S . Let us suppose that m is odd. Then all generators of S have 2-integral coefficients, so 1 2 N m / ∈ S , but we have that N m = θ m (1) + θ m (-1) ∈ S . Any β ∈ S m can be written as β = α + k • 1 2 N m , for some α ∈ S and k ∈ Z. If β ∈ Z[G m ],
then the fact that the coefficients of α are 2-integral implies that k is even, which means that β ∈ S . Hence, in this case we also have

S m = S m ∩ Z[G m ] = S ∩ Z[G m ] = S.
As in [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF], we shall refer to the Stickelberger lattice when S m is viewed as a Z-module. Note that in some references, like in [Was97, §6.2], the Stickelberger ideal is defined as the smaller ideal Z G m ∩ θ m (-1)Z G m , which coincides with Def. 2.18 if and only if m is a prime power [START_REF] Kučera | On a certain subideal of the Stickelberger ideal of a cyclotomic field[END_REF]Pr. 4.3].

One of the most important feature of the Stickelberger ideal is to give free relations in the class group of K m , as stated by Stickelberger's theorem, given below. An outstanding point is that the proof of this important result is completely explicit, i.e., for any α ∈ S m , and any fractional ideal b of K m , an explicit γ ∈ K m such that γ = b α is constructed. We shall see in §4.5 that when α is a short element of S m , i.e., when α = σ∈Gm ε σ σ with all ε σ ∈ {0, 1}, this explicit generator is very efficiently computable.

On the rank of the Stickelberger lattice.

A consequence of, e.g., [Kuč92, Th. 6.2], is that the rank of S m in Z G m , viewed as a Z-module, is only ϕ(m)/2 + 1 ; in particular, it is not full rank, therefore it cannot be directly used as a lattice of class relations.

However, as noted in [CDW21, §4.3], the Stickelberger lattice modulo (1 + τ ) is a lattice of class relations for the relative class group, which we recall is the kernel of the relative norm map N Km/K + m : Cl m → Cl + m . We shall follow a quite different exposition here, using Sinnott's formalism from [START_REF] Sinnott | On the Stickelberger ideal and the circular units of a cyclotomic field[END_REF][START_REF] Sinnott | On the Stickelberger ideal and the circular units of an abelian field[END_REF].

Let R m = Z G m . For any submodule M ⊆ R m , the kernel of the multiplication by (1 + τ ) in M is denoted by M -. In particular:

R - m = α ∈ R m ; (1 + τ )α = 0 and S - m = α ∈ S m ; (1 + τ )α = 0 . Clearly, we have R - m = (1 -τ )R m and (1 -τ )S m S - m . Let π : R m -→ R - m be the natural projection that associates (1 -τ )α ∈ R - m to any α ∈ R m . A basis of R - m
, as a Z-module, is given by [Kuč86, Th. 3.1]:

β s ; 0 < s < m 2 , (s, m) = 1 , where β s = π σ s = σ s -σ -s . (2.23) Hence, R - m is isomorphic, as a Z-module, to Z ϕ(m)/2
. Note that the map π defined above corresponds to the projection map R m → R m 1 + τ of [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF], as shown by the expression given in the proof of [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF]Lem. 4.6].

Theorem 2.24 ([Sin78, Th. p.107]). The index of S - m in R - m is finite: R - m : S - m = 2 a • h - m , where a = 0 if t = 1, 2 t-2 -1 if t ≥ 2. In particular, S - m has full rank ϕ(m) 2 in R - m .
The restriction to the relative class group means that the action of (1 + τ ) factors through the projection in S - m , hence S - m can be used as a lattice of class relations for G m -orbits of Cl - m . Remark 2.25. We note that the projected Stickelberger lattice (1 -τ )S m used in [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF] is

strictly smaller than S - m = S m ∩ R - m . In fact, a consequence of the proof of Lem. 5.15 is that its index is S - m : (1 -τ )S m = 2 ϕ(m)/2-1 .
Technical lemmata on S m .

In this paragraph, we recall some technical results that will be useful mainly to explicit and prove the correctness of our short basis of the Stickelberger ideal. First, the index of the Stickelberger ideal in S m is related to torsion units as follows:

Lemma 2.26. For any integer m > 1, m ≡ 2 (mod 4), the index w = [S m : S m ] is equal to the number of roots of unity in the m-th cyclotomic field K m , i.e., w = 2m if m is odd, and w = m if m is even.

Proof. This is a part of [Sin80, Pr. 2.1].

We now introduce auxiliary elements that allow to write relations that are useful for the proof of Th. 4.2. For any a ∈ Z, we set

ω m (a) = θ m (a) -1 2 N m , if m a, 0, if m | a.
(2.27) Adapting Eqs. (2.16), (2.17

Cor Km/K d ω d (b) = Cor Km/K d θ d (b) -1 2 N d = ω m bm d . ( 2
ω m (a) = d-1 i=0 ω m (k + ir) = ω m (kd).
Proof. The lemma follows from the following well-known identity

d-1 i=0 - s(k + ir) m = - skd m + d -1 2 ,
valid for any s ∈ Z relatively prime to m.

Recall that m = q 1 q 2 . . . q t , where q i = p ei i > 2 for each i ∈ 1, t , is the prime factorization of m. Let i ∈ Z satisfy p i i ≡ 1 (mod m qi ), and i ≡ 1 (mod q i ). Lemma 2.31 implies the following result: Lemma 2.32. For the chosen m, for any i ∈ 1, t and any a ∈ X m , we have

k≡1 (mod m/qi) 0<k≤m, pi k ω m (ka) = ϕ(q i ) • ω m (a), if q i | a, ω m (aq i ) -ω m (aq i i ), if q i a,
where ϕ() is Euler's totient function.

Algorithmic Number Theory

In this thesis, we will consistently assume the Generalized Riemann Hypothesis (GRH), on which rely many useful number-theoretic bounds and algorithmic complexities.

Heuristic 2.33 (Generalized Riemann Hypothesis (GRH)). The Dedekind zeta function of K, defined for s ∈ C \ {1} as ζ K (s) = a⊆O K 1 N (a) s when R(s) > 1 and as its analytic continuation elsewhere, is zero-free in the half plane R(s) > 1/2.

Number-theoretic bounds

This section presents several number-theoretic bounds that are useful to control namely the volume of log-S-unit lattices, and the algebraic norm of the factor base prime ideals.

Analytic class number formula.

The residue κ K = lim s→1 (s -1)ζ K (s) is linked to h K R K through the so-called analytic class number formula [Neu99, Cor. 5.11(ii)], which states that:

κ K = 2 r1 (2π) r2 R K h K w K |∆ K | , (2.34)
where w K = µ O × K . Actually, computing κ K is much easier than computing directly h K or R K (see e.g., [START_REF] Belabas | Computing the residue of the Dedekind zeta function[END_REF]) and is generally performed as a first step towards these quantities.

The best currently known explicit bound is

κ K ≤ e ln|∆ K | 2(n-1)
n-1 by [Lou00, Th. 1]. It implies the following upper bound on h K R K , as precisely shown in [BDPW20, Lem. 2.3], which can then be used to control the volume of the log-S-unit lattice:

ln n 2 r 2 • h K R K ≤ 1 2 ln|∆ K | + n ln ln|∆ K | + n(1 -ln n).
(2.35)

Class Group Generators.
When picking a set of prime ideals in the algorithms of this thesis, an important feature is that they generate Cl K . It is hence useful to bound both h K and the norms of the generating prime ideals. Note that, as for any finite group, any non redundant generating set of Cl K must have at most log h K elements. Not much is generically known about the class number, so that the analytic estimation above is traditionally used to obtain

h K ≤ O |∆ K | .
Let L max be any prime ideal of maximum norm inside a generating set of Cl K which has the smallest possible maximum norm. Bach proved that [Bac90, Th. 4]:

N (L max ) ≤ 12 ln 2 |∆ K |.
(2.36)

In practice though, this upper bound on the ratio t K := N (L max )/ ln 2 |∆ K | ≤ 12 seems very pessimistic. Experimental evidence suggests that t K > 0.7 only occurs in pathological cases [BDF08, §6], and as noted in [BDF08, p.1186], "it even looks plausible that the average value of N (L max ) as the discriminant of K increases is O(ln|∆ K |) 1+ε for any ε > 0". On the other hand, let us consider the relative part Cl - m of the class group of a cyclotomic field K m . In this case, prime ideals belong to Cl - m only with probability roughly 1/h + m , so we expect that searching for generators of the subgroup Cl - m mechanically increases the provable upper bound on generators. More precisely, writing as

L - max the biggest ideal of a generating set of Cl - m , Wesolowski proved [Wes18, Rem. 2] that N (L - max ) ≤ 2.71h + m • ln|∆ Km | + 4.13 2 .
Prime Ideal Theorem.

In order to constitute sufficiently large sets of prime ideals of polynomially bounded norms, it is useful to know the density of prime ideals in K. This is the object of the Prime Ideal Theorem, which states that prime ideals have more or less the same asymptotic behaviour as prime numbers. Let π K (x) = p : p prime ideal, N (p) ≤ x , and ϑ K (x) = N (p)≤x ln N (p). In [Lan03, §II.4-5], Landau proved the following asymptotic equivalences:

π K (x) ∼ x→∞ x 2 dt ln t , and ϑ K (x) ∼ x→∞ x.
(2.37)

The general rough intuition is that each prime p ∈ Z yields on average one prime ideal in K of norm p. Of course, this global behaviour is not valid locally: for instance in cyclotomic fields Q(ζ m ), ideals of prime norm p come in batches of ϕ(m) elements for primes p ≡ 1 mod m, whose density is by Dirichlet's arithmetic progression theorem about 1/ϕ(m). Unfortunately, whereas even for reasonably small bounds these asymptotic estimations yield astonishingly good results in practice, only effective versions are rigorously applicable.

Theorem 2.38 (Explicit Prime Ideal Theorem [GM16, Cor. 1.4]). Under GRH, ∀x ≥ 3:

π K (x) -π K (3) - x 3 dt ln t ≤ √ x • c 1 (x) • ln|∆ K | + c 2 (x) • n ln x + c 3 (x) , Chapter 2. Preliminaries with c 1 (x) = 1 2π -ln ln x π ln x + 5.8 ln x , c 2 (x) = 1 8π -ln ln x 2π ln x + 3.6 ln x , c 3 (x) = 0.3+ 14 log x .
This can be used to show that a polynomial bound in ln|∆ K | yields sufficiently many prime ideals, like in [PHS19a, Cor. 2.9]. A precise version of that statement is given in [BDPW20, Lem. A.3]: for x ≥ max (12 ln|∆ K |+8n+28) 4 , 3•10 11 , π K (x) ≥ x 2 ln x . Note how this theoretical condition on x seems unnecessarily large in practice.

Hard problems in number theory

For our exposition, the most important problem to be considered is probably the Class Group Discrete Logarithm Problem (ClDlp). Solving this problem remains the major bottleneck in the classical query complexity of the Approx-id-Svp algorithms proposed in [CDW17, [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF][START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF] and in this thesis.

Problem 2.39 (Class Group Discrete Logarithm Problem (ClDlp) [START_REF] Biasse | Efficient quantum algorithms for computing class groups and solving the principal ideal problem in arbitrary degree number fields[END_REF]). Given a set of prime ideals L 1 , . . . , L k , and a challenge ideal b, find, if they exist, α ∈ K and integers v

1 , . . . , v k such that α = b • i L vi i .
In this definition, we also require an explicit generator α ∈ K, which slightly differs from the definition of e.g., [CDW17, Pr. 2]. Nevertheless, we note that in both quantum and classical worlds, the standard way to solve this problem boils down to computing S-units, for S containing b and the L i 's, so that this explicit element is really a byproduct of the resolution. Furthermore, it is worth noting that the Principal Ideal Problem (Pip), i.e., that asks for a generator of b if it exists, is encompassed in this definition of the ClDlp problem, using an empty set of ideals [BS16, Alg. 2].

Given a principal ideal described by some generator α, the Shortest Generator Problem (Sgp) asks for the shortest generator α such that α = α . The Sgp resolution can be reduced to a closest vector problem in the log-unit lattice, as is folklore in computational number theory. Similarly, we define:

Problem 2.40 (Shortest Class Group Discrete Logarithm (S-ClDlp)). Given α = b • i L vi i a solution to the ClDlp, find positive w 1 , . . . , w k ∈ Z ≥0 and α ∈ K such that α is the smallest possible element such that α = b • i L wi i .
The condition for the w i 's to be positive is crucial. Note that all recent algorithms for Approxid-Svp that are not bound to principal ideals eventually output an approximate solution of the S-ClDlp [CDW21, PHS19a, BR20]. If the set of prime ideals is sufficiently large compared to b, then S-ClDlp is exactly id-Svp.

Finally, we mention the Close Principal Multiple Problem (Cpmp) which, given an ideal b, asks to find c such that bc is principal and N (c) is "reasonably small" [CDW17, §2.2]. This specific problem also appears in [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF], where the authors prove that under GRH, using a factor base containing all prime ideals of norm up to m 4+o(1) , guarantees that a solution c exists that satisfies

N (c) ≤ exp O(m 1+o(1) ) [CDW21, §1.3.4].

S-unit groups computations

As shown in [START_REF] Biasse | Efficient quantum algorithms for computing class groups and solving the principal ideal problem in arbitrary degree number fields[END_REF], the computation of class groups, unit groups, class group discrete logarithms and principal ideal generators can all be reduced to S-units computations for appropriate sets of places S. Thus, we are mostly interested in the running time of S-unit groups related computations in K, which is denoted by T Su (K). Under the GRH:

• in the quantum world, T Su (K) = O ln|∆ K | is polynomial, as shown in [START_REF] Biasse | Efficient quantum algorithms for computing class groups and solving the principal ideal problem in arbitrary degree number fields[END_REF], building upon generalizations of Shor's algorithm from [START_REF] Eisenträger | A quantum algorithm for computing the unit group of an arbitrary degree number field[END_REF];

• in the classical world, it remains subexponential in ln|∆ K |, i.e., T Su (K) = exp O(ln α |∆ K |)
where α = 1/2 for cyclotomic fields [BEF + 17],14 and α = 2/3 in the general case [START_REF] Biasse | Subexponential class group and unit group computation in large degree number fields[END_REF], recently lowered to 3/5 by Gélin [START_REF] Gélin | Calcul de groupes de classes d'un corps de nombres et applications à la cryptologie[END_REF]. Note that by abuse of notations, we omit here polynomial factors in S and max p∈S∩S 0 ln N (p).

Euclidean Lattices

Let L be a lattice. For any p ∈ N * ∪{∞} and 1

≤ i ≤ dim L, the i-th minimum λ (p) i (L) of L for the p -norm is the minimum radius r > 0 such that {v ∈ L : v p ≤ r} has rank i [NV10, Def. 2.13].
For any t in the span of L, the distance between t and L is dist p (t, L) = inf v∈L tv p , and the covering radius of L w.r.t. the p -norm is µ p (L) = sup t∈L⊗R dist p (t, L). For the Euclidean norm, we occasionnally omit p = 2.

Estimating approximation factors

An ideal lattice of K is the full-rank image under the Minkowski embedding in R n of a fractional ideal b of K, where n is the degree of K. Its volume is given by Vol

(b) = N (b) • |∆ K |.
Unlike generic lattices, a lower bound of the first minimum is implied by the arithmetic-geometric mean inequality, using that for any α ∈ b, N (b) divides |N (α)|. Thus, we obtain:

√ n • N (b) 1/n ≤ λ 1 (b) ≤ √ n • N (b) 1/n |∆ K | 1/n , (2.41)
where the right inequality is Minkowski's inequality [NV10, Th. Applying the Gaussian Heuristic to ideal lattices yields a pretty good estimation of the shortness of vectors, even though λ 1 (b) is not known precisely in general. This hypothesis is commonly used for the analysis of cryptosystems based on structured lattices, and the exact solutions found during the Twisted-PHS algorithm experiments in §3.4.3 match this heuristic.

For any x ∈ b, let γ(x) = x 2 /λ 1 (b) denote the approximation factor reached by x in the ideal lattice b. As λ 1 (b) is not known, the approximation factor af(x) is not directly accessible, but Eq. (2.41) implies the bounds γ inf (x) ≤ γ(x) ≈ γ gh (x) ≤ γ sup (x), where:

γ inf (x) := x 2 √ n • Vol 1/n (b) , γ sup (x) := x 2 √ n • N (b) 1/n , γ gh (x) := √ 2πe • γ inf (x).
(2.42)

Computational problems

We will consider the following algorithmic lattice problems. Both problems can be readily restricted to ideal lattices under the labels Approx-id-Svp and Approx-id-Cvp.

Problem 2.43 (Approximate Shortest Vector Problem (Approx-Svp) [NV10, Pb. 2.2]). Given a lattice L and an approximation factor γ ≥ 1,

find a vector v ∈ L such that v 2 ≤ γ • λ 1 (L). Problem 2.44 (Approximate Closest Vector Problem (Approx-Cvp) [NV10, Pb. 2.5]). Given a lattice L, a target t ∈ L ⊗ R and an approximation factor γ ≥ 1, find a vector v ∈ L such that t -v 2 ≤ γ • dist 2 (t, L).
Actually, it will be more convenient to work with a slightly modified version of Approx-Cvp, where the output is required to be at distance absolutely bounded by some B, independently of the target distance to the lattice. By abuse of terminology, we still call this variant Approx-Cvp. A practical Approx-Cvp oracle is given by Babai's Nearest Plane algorithm [START_REF] Babai | On Lovász' lattice reduction and the nearest lattice point problem[END_REF], [Gal12, §18.1, Alg. 26].

Quality of a lattice basis

Evaluating the quality of a lattice basis is actually a tricky task that depends partly on the targeted problem (see e.g., [START_REF] Xu | Experimental quality evaluation of lattice basis reduction methods for decorrelating low-dimensional integer least squares problems[END_REF]), and several indicators have been used in the literature to attempt to measure this quality w.r.t. the Svp or the Cvp.

Let B = (b 1 , . . . , b n ) be a basis of a full-rank n-dimensional lattice L, and let the Gram-Schmidt Orthogonalization (GSO) of B be GSO(B) = (b 1 , . . . , b n ). Approximation algorithms usually attempt to compute a good basis of the given lattice, i.e., whose vectors are as short and as orthogonal as possible. These lattice reduction algorithms, such as LLL [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF] or BKZ [START_REF] Chen | BKZ 2.0: Better lattice security estimates[END_REF], try to limit the decrease of the Gram-Schmidt norms b i 2 : intuitively, a wide gap in the sequence ln b i 2 at i ≥ 2 reveals that b i is rather not orthogonal to the previously generated subspace b 1 , . . . , b i-1 . We will also consider the following standard quantities:

1. the root-Hermite factor δ 0 is widely used to measure the performance of lattice reduction algorithms [NS06, GN08, CN11], especially for solving Svp-like problems:

δ n 0 (B) = b 1 2 Vol 1/n B . ( 2
δ n (B) = n i=1 b i 2 Vol 1/n B . (2.46)
For purely orthogonal bases δ = 1, and by Minkowski's second theorem [NV10, Th. 2.5], its smallest possible value is i λ i (L)/ Vol L 1/n ≤ 1 + n 4 . 3. the minimum vector basis angle, defined as [Xu13, Eq. ( 15)]:

θ min (B) = min 1≤i<j≤n min θ ij , π -θ ij for θ ij = arccos b i , b j b i 2 b j 2 . (2.47)
We propose to consider also the mean vector basis angle θ avg (B), which averages over all min θ ij , π -θ ij . Combining these two steps in a single Cvp instance provides some guarantee that the output of the Cpmp solver has a generator which is "not much larger " than its shortest non-zero vector.

Contents

In order to guarantee the output size and the running time of the PHS algorithm, a key ingredient is to use a Cvp with preprocessing hint algorithm due to Laarhoven [START_REF] Laarhoven | Sieving for closest lattice vectors (with preprocessing)[END_REF], which represents the most costly part of the preprocessing phase.

Our contributions

Our main contribution is to propose a new "twisted" version of the PHS [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF] algorithm, that we call Twisted-PHS. As a minor contribution, we also propose several improvements of the PHS algorithm, in a optimized version described in §3.2.3. On the theoretical side, we prove that our Twisted-PHS algorithm reaches the same asymptotic trade-off between runtime and approximation factor as the original PHS algorithm, using the same Cvp solver with preprocessing hint by Laarhoven [START_REF] Laarhoven | Sieving for closest lattice vectors (with preprocessing)[END_REF].

On the practical side though, we provide a full implementation of our algorithm, which suggests that much better approximation factors are achieved and that the given lattice bases are much more orthogonal than the ones used in [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF]. To our knowledge, this is the first time that this type of algorithm is completely implemented and tested for fields of degrees up to 60. As a point of comparison, experiments of [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF] constructed the log-S-unit lattice for cyclotomic fields of degrees at most 24, all but the last two being principal [PHS19a, Fig. 4.1]. We shall also mention the extensive simulations performed by [START_REF] Ducas | On the shortness of vectors to be found by the Ideal-SVP quantum algorithm[END_REF] using the Stickelberger lattice in prime power cyclotomic fields. Adapting these results to our construction is not immediate, as we need explicit S-units to compute our lattice. This is left for future work.

We explain our experiments in §3.4, where we evaluate three algorithms instantiated with the same practical Cvp oracle: the original PHS algorithm with the lattice implemented in [START_REF] Pellet-Mary | Published code of "Approx-SVP in ideal lattices with pre-processing[END_REF]; our optimized version Opt-PHS ( §3.2.3), and our new twisted variant Twisted-PHS ( §3.3). We target two families of number fields, namely non-principal cyclotomic fields Q(ζ m ) of prime conductors m ∈ 23, 71 , and NTRU Prime fields Q(z q ) where z q is a root of x q -x -1, for q ∈ 23, 47 prime. These correspond to the range of what is feasible in a reasonable amount of time in a classical setting. For cyclotomic fields, we managed to compute S-units up to Q(ζ 71 ) for all factor bases, and all log-S-unit lattice variants up to Q(ζ 61 ). For NTRU Prime fields, we managed all computations up to Q(z 47 ).

Experiments

We chose to perform three experiments to test the performance of our Twisted-PHS algorithm, and to compare it with the two other algorithms:

• We first evaluate the geometric characteristics of the lattice output by the preprocessing phase: the root Hermite factor δ 0 , the orthogonality defect δ, and the average vector basis angle θ avg , as described in detail in §2.4.2. The last one seems difficult to interpret as it gives similar results in all cases, but the two other seem to show that the lattice output by Twisted-PHS is of better quality than in the two other cases. It shows significantly better root Hermite factor and orthogonality defect than any other lattice. • For our second experiment, we evaluate the Gram-Schmidt log norms of each produced lattice. We propose two comparisons, the first one is before and after BKZ 40 reduction to see the evolution of the norms in each case: it shows that the two curves are almost identical for Twisted-PHS but not for the other PHS variants. The second one is between the lattices output by the different algorithms, after BKZ 40 reduction. The experiments emphasises that the decrease of the log norms seems much smaller in the twisted case than in the two other. Those two observations seem to corroborate the fact that the Twisted-PHS lattice is already quite orthogonal. • Finally, we implemented all three algorithms from end to end and used them on numerous challenges to estimate their practically achieved approximation factors. This is to our knowledge the first time that these types of algorithms are completely run on concrete examples. The results of the experiments, shown in Fig. 3.1, suggest that the approximation factor reached by our algorithm increases very slowly with the dimension, in a way that could reveal subexponential or even better. We think that this last feature would be particularly interesting to prove.

Technical overview

We first quickly recall the principle of the PHS algorithm described in [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF], which is split in two phases. The first phase consists in building a lattice that depends only on the number field K and allows to express any Approx-id-Svp instance in K as an Approx-Cvp instance in the lattice. This preprocessing chooses a factor base FB, and builds an associated lattice consisting in the Chapter 3. Twisted-PHS: Using the Product Formula diagonal concatenation of some log-unit related lattice and the lattice of relations in the class group Cl K between ideals of FB, with explicit generators. It then computes a hint of constrained size for the lattice to facilitate forthcoming Approx-Cvp queries. Concretely, they suggest to use Laarhoven's algorithm [START_REF] Laarhoven | Sieving for closest lattice vectors (with preprocessing)[END_REF], which for any ω ∈ [0, 1/2] outputs a hint V of bit-size bounded by 2 O(log 1-2ω |∆ K |) that allows to deliver answers for approximation factors O(log|∆ K | ω ) in time bounded by the bit-size of V [Laa16, Cor. 1-2]. The second phase reduces the resolution of Approx-id-Svp to a single call to an Approx-Cvp oracle in the lattice output by the preprocessing phase, for any challenge ideal b in the maximal order of K. The main idea of this reduction is to multiply the principal ideal output by the ClDlp of b on FB by ideals in FB until a "better" principal ideal is reached, i.e., having a short generator. Our first contribution is to propose three improvements of the PHS algorithm. The first one consists in writing an explicit candidate for the isometry used in the computation of the lattice, and using its geometric properties to derive a smaller lattice dimension, while still guaranteeing the same proven approximation factor. The last two respectively modify the composition of the factor base and the definition of the target vector in a way that significantly improves the approximation factor experimentally achieved by the second phase of the algorithm. Although these improvements do not modify the core of PHS algorithm and have no impact on the asymptotics, they nevertheless are of importance in practice, as shown by our experiments in §3. 4.

We now explain our main contribution, called Twisted-PHS, which is based on the PHS algorithm. As in PHS algorithm, our algorithm relies on the so-called log-S-unit lattice with respect to a collection FB of prime ideals, called the factor base. This lattice captures local informations on FB, not only on (infinite) embeddings, to reduce a close principal multiple of a target ideal b to a principal ideal containing b which is guaranteed to have a somehow short generator. The main feature of our algorithm is to use the Product Formula to describe this log-S-unit lattice. This induces two major changes in PHS algorithm:

1. The first one is twisting the p-adic valuations by ln N (p), giving weight to the fact that using a relation increasing the valuations at big norm ideals costs more than a relation involving smaller norm ideals. 2. The second one is projecting the target directly inside the log-S-unit lattice and not only into the unit log-lattice corresponding to fundamental units. Actually, the way our twisted version uses S-units with respect to FB to reduce the solution of the ClDlp problem can be viewed as a natural generalization of the way classical algorithms reduce principal ideal generators using regular units.

Adding weights ln N (p) to integer valuations at any prime ideal p intuitively allows to make a more relevant combination of the S-units we use to reduce the output of the ClDlp, quantifying the fact that increasing valuations at big norm prime ideals costs more than increasing valuations at small norm prime ideals. Besides, the product formula induces the possibility to project elements on the whole log-S-unit lattice instead of projecting only on the subspace corresponding to the log-unit lattice. As a consequence, it maintains inside the lattice the size and the algebraic norm logarithm of the S-units. At the end, the Cvp solver in this alternative lattice combines more efficiently the goal of minimizing the algebraic norm for the Cpmp while still guaranteeing a small size for the Sgp solution in the obtained principal multiple.

In §3.3, we describe two versions of our Twisted-PHS algorithm. The first one, composed by A (Laa) tw-pcmp and A (Laa) tw-query is proven to reach the same asymptotic trade-off between runtime and approximation factor as the original PHS algorithm, using the same Cvp solver with preprocessing hint by Laarhoven. In practice, we propose two alternative algorithms A Babai's Nearest Plane algorithm for the Cvp solver role. Experimental evidence in §3.4 suggest that these algorithms perform remarkably well, because the twisted description of the log-S-unit lattice seems much more orthogonal than expected. Proving this property would remove, in a quantum setting, the only part that is not polynomial in ln|∆ K |.

The PHS Algorithm

This section describes the PHS algorithm, as introduced by Pellet-Mary, Hanrot and Stehlé in [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF] for solving Approx-id-Svp, and discusses several improvements. The PHS algorithm extends the techniques from [START_REF] Cramer | Recovering short generators of principal ideals in cyclotomic rings[END_REF][START_REF] Cramer | Short Stickelberger class relations and application to Ideal-SVP[END_REF] to any number field K and is split in two phases:

1. the preprocessing phase A pre-proc , described in §3.2.1, builds a specific lattice together with some hint allowing to efficiently solve Approx-Cvp instances; 2. the query phase A query , detailed in §3.2.2, reduces each Approx-id-Svp challenge to an Approx-Cvp instance in this fixed lattice. More precisely, under the GRH and several heuristic assumptions detailed in [PHS19a, Heur. 1-6], they prove the following theorem:

Theorem 3.1 ([PHS19a, Th. 1.1]). Let ω ∈ [0, 1/2]
and K be a number field of degree n and discriminant ∆ K with a known basis of O K . Under some conjectures and heuristics, there exist two algorithms A pre-proc and A query such that:

• Algorithm A pre-proc takes as input O K , runs in time 2 O(log|∆ K |) and outputs a hint V of bit-size 2 O(log 1-2ω |∆ K |) ;
• Algorithm A query takes as inputs any ideal b of O K , whose algebraic norm has bit-size bounded by 2 poly(log|∆ K |) , and the hint V output by A pre-proc , runs in time 2 O(log 1-2ω |∆ K |) + T Su (K), and outputs a non-zero element x ∈ b such that

x 2 ≤ 2 O(log ω+1 |∆ K |/n) • λ 1 (b).
We start by describing the preprocessing phase A pre-proc in §3.2.1, then the query phase A query in §3.2.2, and recall the proof of Th. 3.1 in detail. We thereafter discuss several algorithmic and theoretical minor improvements in §3.2.3.

Preprocessing of the number field

From a number field K and a size parameter ω ∈ [0, 1/2], the preprocessing phase consists in building and preparing a lattice L phs that depends only on the number field K and allows to express any Approx-id-Svp instance in K as an Approx-Cvp instance in L phs . The most significant part of this preprocessing is devoted to the computation of a hint of constrained size that can be used to facilitate those forthcoming Approx-Cvp queries.

We first define the lattice which is used in [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF], discuss how the authors derive its dimension from volume considerations, and then expose the full preprocessing algorithm.

Definition of the lattice L phs .

Let FB = p 1 , . . . , p k be a set of prime ideals generating the class group Cl K . The lattice L phs proposed in [PHS19a, §3.1] consists in the diagonal concatenation of some log-unit related lattice and the lattice of relations in Cl K between ideals of FB, with explicit generators. Formally, it is Chapter 3. Twisted-PHS: Using the Product Formula generated by the (ν + k) rows of the following square matrix:

B Lphs :=             c • B Λ 0 c • f H0 (h (0) η1 ) . . . ker f FB = -v pj (η i ) 1≤i,j≤k c • f H0 (h (0) η k )             , (3.2)
• where f H0 is an isometry from

H 0 ⊂ R n to R ν , where H 0 is the intersection of the span L 0 of Log O K , i.e., L 0 = y ∈ R n : y r1+2i-1 = y r1+2i , i ∈ 1, r 2 , and of the trace zero hyperplane R n 0 = 1 ⊥ n ; • the matrix B Λ is a row basis of f H0 Log O × K ;
• the bottom right part of B Lphs generates the lattice of all relations in Cl K between ideals of FB, i.e., is the kernel of f FB : e 1 , . . . , e k ∈ Z k → j p j ej ;

• each row vector

v i = (v i1 , . . . , v ik ) of ker f FB is associated to η i ∈ K s.t. η i • j p vij j = O K , thus v ij = -v pj (η i ), and h (0)
ηi = π H0 Log η i , where π H0 is the projection on H 0 in R n ; • c is a scaling parameter whose value depends on f H0 (set later to n 3/2 /k). Note that this definition differs from the one given in [PHS19a, §3.1] by a sign change in the last k coordinates. This is a purely editorial detail allowing to use the same convention through the exposition of the algorithm and its proof.

The condition that the factor base generates Cl K guarantees that for any challenge ideal there exists a solution to the ClDlp on FB. It can be relaxed to some extent to generate only a small index subgroup of Cl K like in [START_REF] Cramer | Short Stickelberger class relations and application to Ideal-SVP[END_REF].

The isometry f H0 happens to play an important role in the proof of A query . It forces the introduction of the scaling factor c, whose value is non-negligible and indirectly implies the use of a larger factor base. Note that this isometry is not explicitly defined in [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF], whereas the associated code [START_REF] Pellet-Mary | Published code of "Approx-SVP in ideal lattices with pre-processing[END_REF] uses a pruning strategy which removes the r 2 + 1 coordinates corresponding to the conjugates of complex places plus an arbitrary one. We stress that this implemented pruning strategy could negatively impact the quality of the Approx-Cvp solver, as it hides potentially huge size variations of the S-units on the removed coordinate. That's the reason why we thoroughly study in §3.2.3 a candidate isometry for f H0 that also induces lower values for c. Furthermore, note that the projection on H 0 removes out of the picture the logarithm of the algebraic norms of the (non-regular) S-units; hence, it seems that this partial information prevents L phs from optimally achieving its initial goal of minimizing the algebraic norm for the Cpmp while guaranteeing a Sgp solution of small length. Our new algorithm, detailed in §3.3, aims in particular at fixing these flaws.

Finally, we aggregate the material present in [PHS19a, fn. 3, Lem. 3.1] to propose a simpler and more concise way to define L phs ; using the same notations as above, let ϕ phs be the following map from

K to R ν × Z k : ϕ phs (α) = c • f H0 • π H0 Log α , -v pi (α) 1≤i≤k . (3.3)
Then, L phs can be seen as the full-rank lattice generated by the images under ϕ phs of the fundamental elements generating the S-unit group O × K,S , as given by Th. 2.2, with S = S ∞ ∪ FB and for each i ∈ 1, k , ε ν+i = η i . It is easy to see that both definitions coincide: for regular units ε ∈ O × K , all finite valuations are zero, so is the last part of ϕ phs (ε), and π H0 Log ε = Log ε.

Using the homomorphism properties of ϕ phs on K, namely ϕ phs (αα ) = ϕ phs (α) + ϕ phs (α ) and ∀λ ∈ Z, ϕ phs (α λ ) = λ • ϕ phs (α), proving that each element of L phs corresponds to an element of O × K,S [PHS19a, Lem. 3.1] becomes tautological. Further, we stress that ϕ phs is injective on O × K,S µ O × K and therefore defines an isomorphism between O × K,S /µ O × K and L phs .

Volume of L phs and cardinality of FB.

It remains to derive an explicit value for the cardinality k of the factor base FB; in [PHS19a, §4.1], this is done by considering the smallest k such that the root volume Vol 1/(ν+k) L phs is at most constant. By Minkowski's inequality, this quantity bounds the first minimum in ∞ -norm, and under the heuristic that L phs behaves like a random lattice [PHS19a, Heur. 4], it also controls the ∞ -norm covering radius µ ∞ (L phs ). First, we evaluate the volume of L phs , which writes as

c ν • det B Λ • det(ker f FB ) by definition of B Lphs . The determinant of ker f FB is h K = Z k / ker f FB . On the other hand, remark that B Λ is the image under f H0 of a basis of Log O × K , whose volume is √ n • 2 -r2/2
• R K by Pr. 2.8. Finally, the isometry f H0 stabilizes L 0 ∩ R n 0 , thus preserves the volume of B Λ ; hence, we get:

Vol L phs = c ν • √ n 2 r2/2 • h K R K .
(3.4)

Note that [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF] only gives an asymptotic bound on Vol L phs , whereas Eq. (3.4) is exact.

The idea is then to choose k such that Vol 1/(ν+k) = O(1), e.g., taking (ν + k) = ln Vol L phs .

Using the number-theoretic bound given by Eq. (2.35), and using the fact that c will be later set to n 3/2 /k, Vol L phs is asymptotically bounded by exp O ln|∆ K | + n ln ln|∆ K | ; therefore, (ν + k) can be set to:

ν + k = max ν + log h K , ln|∆ K | + n ln ln|∆ K | . (3.5)
The log h K part is there as a sufficient but not necessary condition ensuring that Cl K can be generated by k

≥ log h K ideals [PHS19a, Lem. 2.7]. As h K ≤ O( |∆ K |)
, we remark that the second term dominates, so the maximum in the above formula can be ignored; in the associated code [START_REF] Pellet-Mary | Published code of "Approx-SVP in ideal lattices with pre-processing[END_REF], (k + ν) is explicitly set to ln|∆ K | . We stress that in practice the dimension of L phs is quite sensitive to small changes in the value of c or the targeted root volume. We refer to §3.2.3 for more details and examples.

Preprocessing algorithm.

Algorithm 3.1 details the complete preprocessing procedure that, from a number field and some precomputation size parameter, chooses a factor base FB, builds the associated matrix B Lphs , and processes L phs in order to facilitate Approx-Cvp queries.

The dimension k of the factor base and the scaling factor c are set in step 1 as in the published code [START_REF] Pellet-Mary | Published code of "Approx-SVP in ideal lattices with pre-processing[END_REF]. Steps 2 and 3 are a concise version of [PHS19a, Alg. 3.1, steps 1-5]; it basically enlarges a generating set of Cl K of size k ≤ log h K by picking (k -k ) random prime ideals of bounded norms. The crucial point is to invoke the prime ideal theorem to show that taking a bound which is polynomial in k and log|∆ K | [PHS19a, Cor. 2.10] is actually sufficient.

The last step consists in preprocessing L phs in order to solve Approx-Cvp instances efficiently. As noted in [PHS19a, p.6], the problem is easy without any constraint on the size of the output hint. To guarantee a hint size that is not exceeding the query phase time, they suggest to use Laarhoven's algorithm [START_REF] Laarhoven | Sieving for closest lattice vectors (with preprocessing)[END_REF], which outputs a hint V of bit-size bounded by 2 O((ν+k) 1-2ω ) , i.e., 2 O(log 1-2ω |∆ K |) using (ν + k) = O(log|∆ K |), allowing to deliver the answer for approximation factors (ν + k) ω in time bounded by the bit-size of V [Laa16, Cor. 1-2].

Algorithm 3.1 PHS Preprocessing A pre-proc Input: A number field K of degree n and a parameter ω ∈ [0, 1/2]. Output: The basis B Lphs with the preimages of its rows in O × K,S , and Laarhoven's hint V(L phs ).

1: Set k = ln|∆ K | -ν and c = n 3/2 /k . 2: Compute Cl K = p 1 , . . . , p k , with k ≤ log h K .
3: Randomly extend p 1 , . . . , p k by prime ideals of bounded norm to get FB = p 1 , . . . , p k . 4: Compute fundamental elements ε 1 , . . . , ε ν+k of O × K,S as in Th. 2.2. 5: Create the matrix B Lphs whose rows are ϕ phs (ε 1 ), . . . , ϕ phs (ε ν+k ) as defined in Eq. (3.2). 6: Use Laarhoven's algorithm to compute a hint

V = V(L phs ) of size 2 O(log 1-2ω |∆ K |) . 7: return O × K,S , B Lphs , V(L phs ) .
Proof of the first part of Th. 3.1. Costly steps of Alg. 3.1 are steps 2, 4 and 6 that compute the class group Cl K , the S-unit group O × K,S and the hint V(L phs ). The former two are S-unit group related computations that cost T Su (K) ≤ 2 O(log 2/3 |∆ K |) each; the latter runs independently of ω in time 2 O(ν+k) = 2 O(log|∆ K |) . Note that in a quantum setting, only Laarhoven's algorithm is not polynomial in n; in a classical setting, it remains the dominating exponential part.

Query phase: solving id-SVP using the preprocessing

This section describes the query phase A query of PHS algorithm; for any challenge ideal b ⊆ K having a polynomial description in log|∆ K |, it reduces the resolution of Approx-id-Svp in b to a single call to an Approx-Cvp oracle in L phs as output by the preprocessing phase.

The main idea of this reduction is to multiply the principal ideal output by the ClDlp of b on FB by ideals in FB until a "better" principal ideal is reached, i.e., having a short generator. In L phs , it translates into adding vectors of L phs to some target vector derived from b until the result is short, hence into solving a Cvp instance. This is formalized in Alg. 3.2, which rewrites [PHS19a, Alg.

= c • f H0 • π H0 Log α , -v i + β 1≤i≤k . 3: Use the Approx-Cvp solver with V(L phs ) to output w ∈ L phs s.t. t -w ∞ ≤ β. 4: Compute s = ϕ -1 phs (w) ∈ O × K,S
, using the preimages of B Lphs rows. 5: return α/s.

Note that the output of the ClDlp in step 1 is an S-unit if and only if b is only divisible by prime ideals in the factor base. Each exponent v i can be expressed as v i = v pi (α) -v pi (b). Then, the target defined in step 2 can be viewed as a drifted by β image of α in L phs ; using the formalism we introduced in Eq. (3.3), it writes simply as t = ϕ phs (α)+b phs , where b phs = (0, . . . , 0, β, . . . , β) is non zero only on the k last coordinates. We stress that the role of b phs in the definition of the target serves a unique purpose: guarantee that α/s ∈ b. In practice, this is not an anecdotic condition, and choosing β carefully has a significant impact on the length of the output, as we will see in §3.2.3.

The rest of this section is devoted to recall the proof of correctness, quality and running time of Alg. 3.2. These make an extensive use of the following log-unit structure lemma, which is classical and freely used e.g., in [CDPR16, §6.1]: Lemma 3.6 ([PHS19a, Lem. 2.11-2.12]). Define h (0) α := π H0 Log α , for α ∈ K. Then we have Log α = h (0) α + ln|N (α)| n • 1 n . Further, the length of α is bounded by:

α 2 ≤ √ n • |N (α)| 1/n • exp h (0) α ∞ ≤ √ n • |N (α)| 1/n • exp h (0) α 2 . Proof. Recall that R n 0 = 1 ⊥ n and Log α ∈ L 0 , hence Log α decomposes as π H0 Log α + a • 1 n , with a = Log α, 1 n / 1 n 2 2 = ln|N (α)|/n,
by definition of the projection on R n 0 . Moreover, generically we have α 2 ≤ √ n • α ∞ ; using the above decomposition coordinate-wise, the j-th coordinate of Log α writes Log α j = (h (0) α ) j + ln|N (α)| n and therefore:

α ∞ = max σ∈S ∞ |σ(α)| = exp max σ∈S ∞ ln|σ(α)| ≤ exp ln|N (α)| n + max 1≤j≤n (h (0) α ) j . Using max j (h (0) α ) j ≤ h (0) α ∞ and h (0) α ∞ ≤ h (0) α 2 concludes.
Notice how well the ∞ -norm apparently behaves with respect to the logarithm embedding. We stress however that logarithms of small infinite valuations can become large negatives, so h (0) α ∞ could be really far from max 1≤j≤n (h (0) α ) j . This bounding method also somehow hides the fact that complex valuations count twice in the final Euclidean norm.

Theorem 3.7 ([PHS19a, Th. 3.3]). Given access to an Approx-Cvp oracle that, on any input, outputs w ∈ L phs at infinity distance at most β, algorithm A query computes x ∈ b \ {0} such that:

x 2 ≤ √ n • N (b) 1/n • exp O β • k • ln ln|∆ K | n .
Proof. Let w i = v pi (s), so that w = ϕ phs (s) = c • f H0 (h (0) s ), {-w i } 1≤i≤k . The first step is to prove correctness, i.e., that x = (α/s) is indeed in b \ {0}. By definition, we have s = pi∈FB p wi i , thus:

α/s = b• pi∈FB p vi-wi i . As t -w ∞ ≤ β, for each i we have |w i -v i + β| ≤ β, hence 0 ≤ v i -w i ≤ 2β.
The second step is to bound the 2 -norm of the output using Lem. 3.6. Hence, it is necessary to bound |N (α/s)| and h (0) α/s ∞ . Bounding the former uses again that 0 ≤ v i -w i ≤ 2β, as well as the fact that the maximal norm N (L max ) of FB is bounded by Bach's bound O(ln

2 |∆ K |): |N (α/s)| 1/n ≤ N (b) 1/n • N (L max ) i (vi-wi)/n ≤ N (b) 1/n • exp O β • k • ln ln|∆ K | n .
As for the latter,

h (0) α/s ∞ ≤ h (0) α/s 2 = f H0 (h (0) α -h (0) s ) 2 ≤ √ n/c • t -w ∞ ≤ √ nβ/c.
The value of c should then be set so that this bound is not greater than the previous

β•k•ln ln|∆ K | n . Taking c = n 3/2 k as in [PHS19a] is sufficient.
Before proving the second part of Th. 3.1, we remark that, taking the least possible values derived in §3.2.1 for k = ln|∆ K | n ln n and µ ∞ (L phs ) ≈ 1, and also assuming a perfect CVP solver in infinity norm for β = µ ∞ (L phs ), Th. 3.7 can at best only assess for a subexponential n ln n approximation factor; polynomial approximation factors are not provably reached. Chapter 3. Twisted-PHS: Using the Product Formula Proof of the second part of Th. 3.1. It breaks down to plugging k = O(ln|∆ K |) and a value for β into Th. 3.7. In [PHS19a, §4.2], deriving this β relies on several heuristics [PHS19a, Heur. 4-6] implying that µ 2 (L phs ) = O( √ ν + k), and that on average v ∞ ≤ ln ν+k √ ν+k • v 2 . The Approx-Cvp solver from Laarhoven's algorithm using V(L phs ) outputs a lattice vector at Euclidean distance which is at most O (ν + k) ω • µ 2 (L phs ) . Using the above heuristics, the infinity distance of the output is therefore O (ν + k) ω = O(ln ω |∆ K |), giving the claimed bound.

As for the running time of Alg. 3.2, it is essentially determined by those of steps 1 and 3. Solving the ClDlp problem requires to compute S-units for an extended factor basis containing FB and prime factors of b, hence costs T Su (K). Note that in a quantum setting, T Su (K) is polynomial, but in a classical world it remains subexponential in the discriminant; furthermore, since it depends on the challenge, this cost cannot be mitigated by some preprocessing effort. On the other hand, solving Approx-Cvp with Laarhoven's algorithm runs in time bounded by 2 O(log 1-2ω |∆ K |) , the size of V . Finally, the total run time of A query is bounded by 2 O(log 1-2ω |∆ K |) + T Su (K).

Optimizing PHS parameters

In this section, we propose three improvements of the PHS algorithm. The first one consists in writing an explicit candidate for f H0 and using its geometric properties to derive a smaller lattice dimension, while still guaranteeing the same proven approximation factor. The last two respectively modify the composition of the factor base and the definition of the target vector in a way that drastically improves the approximation factor experimentally achieved by A query .

Although these improvements do not modify the core of PHS algorithm and have no impact on the asymptotics, they nevertheless are of importance in practice, as we will see in §3.4.

Expliciting the isometry: towards smaller factor bases.

We exhibit an explicit candidate for the isometry f H0 going from H 0 = R n 0 ∩ L 0 ⊆ R n to R ν and evaluate its effect on the infinity norm; it allows to lower the value of c in the proof of Th. 3.7 from n √ n/k to n(1 + ln n)/k, which in turn implies using a smaller factor base for the same proven approximation factor. We define the isometry f H0 as the linear map represented by GSO T (M H0 ), with:

M H0 := -1 1 -1 1 . . . . . . -1 1                         ν + 1 ν • Ir 1 1 2 1 2 1 2 1 2 . . . . . . 1 2 1 2                                       r1 2r2 r1 r2 . (3.8)
Actually, M H0 is simply a basis of R n 0 ∩ L 0 in R n , constituted of vectors that are orthogonal to 1 n and to each of the r 2 independent vectors v j , j ∈ 1, r 2 , that sends any y ∈ L 0 to 0 by substracting y r1+2j from its copy y r1+2j-1 and forgetting every other coordinate. Proposition 3.9. Let f H0 be the isometry represented by GSO T (M H0 ). Then:

∀h ∈ H 0 , h ∞ ≤ (1 + ln n) • f H0 (h) ∞ , f H0 (h) ∞ ≤ 2 √ 2 • h ∞ . Proof. Let h ∈ R n 0 ∩L 0 , and v = f H0 (h) ∈ R ν . We prove f -1 H0 (v) ∞ ≤ (1+ln n)• v ∞ , which is trivially equivalent. By definition, f -1 H0 (v) = v • GSO(M H0 ),
     ∀i ∈ 1, r 1 -1 : b i = -1 √ i(i+1) , . . . , i i+1 , 0, . . . , ∀j ∈ 0, r 2 -1 , i = r 1 + 2j: b r1+j = - √ 2 √ i(i+2) , . . . , √ i √ 2(i+2) , √ i √ 2(i+2) , 0, . . . ,
where in each configuration the first i coordinates are equal, and zeroes pad to dimension n.

Bounding each b i 1 by 2 √ 2 is trivial from these formulas, proving the second inequality. Let c 1 , . . . , c n be the columns of GSO(M H0 ). We claim that

c n 1 ≤ c n-1 1 ≤ • • • ≤ c 1 1 . Indeed, c 1 1 = c 2 1 , and for all i ≥ 2, c i 1 -c i+1 1 = |(b i-1 ) i | + |(b i ) i | -|(b i ) i+1 | ≥ 0. Using 1 i(i+1) < 1 i and 2 i(i+2) ≤ 1 √ 2 1 i + 1 i+1 yields c 1 1 ≤ n-1 i=1 1 i ≤ 1 + ln(n -1).
As a consequence, we can directly inject this result into the proof of Th. 3.7 to bound the ∞norm

h (0) α/s ∞ by (1 + ln n)/c • t -w ∞ ≤ (1 + ln n)β/c instead of √ nβ/c
. We also use the following refined practical bound on the algebraic norm of α/s. Indeed, when conducting experiments, FB is known and there is no need to suffer from Bach's generic bound for N (L max ):

|N (α/s)| 1/n ≤ N (b) 1/n • pi∈FB N (p i ) (vi-wi)/n ≤ N (b) 1/n • exp 2β • p∈FB ln N (p) n . (3.10)
Then, as a smaller value of c implies a smaller volume of L phs hence a smaller factor base, it should be chosen as the smallest s.t. the former bound (1 + ln n)β/c on h (0) α/s ∞ is below the above

2β• p∈FB ln N (p) n
, which implies c ≥ (1+ln n)n p∈FB ln N (p) . Nevertheless, as there is no reason to artificially increase the bound on h (0) α/s ∞ using c < 1 when the other already dominates, we should also ensure c ≥ 1. This finally leads us to choose:

c = max 1, (1 + ln n)n p∈FB ln N (p) . (3.11)
To quantify the gain obtained by this new value of c, we computed factor base dimensions in different settings for two families of number fields: Tab. 3.1 deals with non-principal cyclotomic fields Q(ζ m ) of prime conductors m ∈ 23, 71 ; Tab. 3.2 handles NTRU Prime fields Q(z q ), where z q is a root of x q -x -1, for q prime in 23, 61 . These correspond to the range of explicit computations feasible within a limited amount of time. By contrast, experiments reported in [PHS19a, Fig. 4.1] were limited to cyclotomic fields of degree at most 24, most of them being principal. For each field, we compare the expected factor base dimensions in four situations: Chapter 3. Twisted-PHS: Using the Product Formula ): using Eq. (3.5); using Eq. (3.4) with same root volume target V 1/(ν+k) as in [START_REF] Pellet-Mary | Published code of "Approx-SVP in ideal lattices with pre-processing[END_REF] and given values of c. Table 3.2 -Values of k for K = Q(z q ): using Eq. (3.5); using Eq. (3.4) with same root volume target V 1/(ν+k) as in [START_REF] Pellet-Mary | Published code of "Approx-SVP in ideal lattices with pre-processing[END_REF] and given values of c.

m ln V 1/(ν+k) Eq. (3.5) c = n 3/2 /k c = (1+ln n)n k c = max 1, (1+ln n)n ln N (p) [PHS19b] [PHS19a] [
q ln V 1/(ν+k) Eq. (3.5) c = n 3/2 /k c = (1+ln n)n k c = max 1, (1+ln n)n ln N (p) [PHS19b] [PHS19a] [
first, for completeness we use Eq. (3.5), taken from [PHS19a, §4.1]; then we report the value used by [START_REF] Pellet-Mary | Published code of "Approx-SVP in ideal lattices with pre-processing[END_REF], i.e., k = ln|∆ K | -ν, and provide the resulting root volume Vol 1/(ν+k) L phs corresponding to c = n 3/2 k for reference. Finally, we target this reference root volume using on one hand c = (1+ln n)n k , hence mimicking the proof of Th. 3.7, and on the other hand using our recommended value given by Eq. (3.11).

The last experiment, dealing with Eq. (3.11), simulates all factor bases of cardinality k by taking the k prime ideals of smallest norms. This choice might not be directly suitable for a factor base, as it gives no theoretical insurance to generate Cl K . Nevertheless, in all experiments the obtained k is well above log h K , the maximum number of generators of Cl K [PHS19a, Lem. 2.7], so that replacing some of these ideals by bigger norm representatives of missing classes until the set generates Cl K would only reduce the value of c by increasing p∈FB ln N (p). Thus, the given factor base dimensions remain in any case an upper bound of the correct dimension.

To end this section, we remark that there might exist better ∞ -norm preserving isometries than GSO(M H0 ) T ; nevertheless, as the value of c derived from Eq. (3.11) is already equal to 1 most of the time, we cannot expect a substantial gain from this. Furthermore, it should be stressed that the complexity of known lattice reduction algorithms only depends on the rank of the lattice, and not on the ambient space dimension, so that this isometry can be removed in practice. It however serves the theoretical purpose of being able to transpose Minkowski's inequalities and heuristics on covering radii that are valid only for full-rank lattices.

Lowering the factor base weight.

Second, we suggest choosing the k elements of the factor base as the k prime ideals of least possible norm, instead of randomly picking them up to some polynomial bound. As shown by Eq. (3.10), this incidentally lowers the approximation factor, which depends on p∈FB N (p).

Formally, this only modifies step 3 of Alg. 3.1 as follows. Let p 1 , . . . , p k be a generating set of Cl K , with k ≤ log h K , as obtained by the previous step 2. As in Alg. 3.1, using the prime ideal theorem yields that we can choose some bound B polynomial in k and log|∆ K | such that the set of prime ideals of norm bounded by B contains at least k elements. Then, we order this set by increasing norms, choosing an arbitrary permutation for isonorm ideals, and remove ideals that were already present in p 1 , . . . , p k . It remains to extract the first (k -k ) elements to obtain our factor base.

There is one issue to consider, namely adapting the justification of [PHS19a, Heur. 4], relying on L phs being a "somehow random" lattice to derive that µ ∞ (L phs ) is close to λ (∞) 1 (L phs ). We argue that in practice (as discussed with more details for Heur. 3.28 in §3.3.2), it is always possible to empirically upper bound the infinity covering radius of L phs to verify that this heuristic holds. For example, as described in [PHS19a, §4.1]: take sufficiently many random samples t i in the span of L phs from a continuous Gaussian distribution of sufficiently large deviation; solve Approx-Cvp for the 2 -norm for each of them to obtain vectors w i ∈ L phs close to t i ; finally, majorate µ ∞ (L phs ) by max i t i -w i ∞ . Then, if the expected heuristic behaviour is too far from this estimate, we could still replace one ideal of FB by an ideal of bigger norm and iterate the process.

Minimizing the target drift.

Our last suggested improvement modifies the definition of the target vector to take into account the fact that valuations at prime ideals are integers. Hence, the condition enforcing α/s ∈ b, which was written as ∀p ∈ FB, v p (α) -v p (s) ≥ 0, can be replaced by the equivalent requirement that ∀p ∈ FB, v p (α) -v p (s) > -1. Intuitively, this reduces the valuations at prime ideals of the output element by one on average, hence lowering the approximation factor bound in Eq. (3.10). Formally, using the notations of Alg. 3.2, we only modify the definition of the target t in step 2 of Alg. 3.2. For any 0 < ε < 1, let β = (β -1 + ε) and let b phs = (0, . . . , 0, β, . . . , β) with non zero values only on the k last coordinates. The modified target is defined as:

t = ϕ phs (α) + b phs = c • f H0 • π H0 Log α , -v i + β 1≤i≤k .
(3.12)

The remaining steps of Alg. 3.2 stay unchanged. We have to prove that the output is still correct, i.e., that α/s ∈ b, where w = ϕ phs (s) ∈ L phs verifies tw ∞ ≤ β. This is done in the following Pr. 3.13, which adapts Th. 3.7 to benefit from all the improvements of this section. Though this adjustment might seem insignificant at first sight, we stress that the induced gain is of order p∈FB N (p) 1/n , which is roughly subexponential in n, and that its impact is very noticeable experimentally. In fact, the quality of the output is so sensitive to this β that we implemented a dichotomic strategy to find, for each challenge b, the smallest possible translation β that must be applied to ϕ phs (α) to ensure (α/s) ∈ b. Proposition 3.13. Given access to an Approx-Cvp oracle that, on any input, output w ∈ L phs at infinity distance at most β, the modified algorithm A query using the isometry f H0 defined in Eq. (3.8), the value c defined in Eq. (3.11), and for any 0 < ε < 1, the modified target t defined in Eq. (3.12), computes x ∈ b \ {0} such that:

x 2 ≤ √ n • N (b) 1/n • exp (β + 2β -1 ) • p∈FB ln N (p) n .
Proof. As in the proof of Th. 3.7, let w = ϕ phs (s

) = c•f H0 (h (0) s ), {-w i } 1≤i≤k , with w i = v pi (s), be such that t -w ∞ ≤ β. The main point is proving that x = (α/s) ∈ b. Recall that α/s = b • pi∈FB p vi-wi i . As t -w ∞ ≤ β, for each i we have -1 + ε ≤ v i -w i ≤ 2β -1 + ε. Using that v i , w i are in Z and ε > 0 implies 0 ≤ v i -w i ≤ 2β -1 , hence x ∈ b \ {0}.
The 2 -norm of x is upper bounded using again Lem. 3.6. The previous discussion also shows

|N (α/s)| 1/n ≤ N (b) 1/n • exp 2β-1 • p∈FB ln N (p) n
. Using the isometry properties given by Pr. 3.9, we obtain h (0) α/s ∞ ≤ (1 + ln n)β/c, and using c ≥

(1+ln n)n
p∈FB ln N (p) as implied by Eq. (3.11) finally yields the result.

The Twisted-PHS Algorithm

Our main contribution is to propose a twisted version of the PHS algorithm. The main idea consists in using the natural description of the log-S-unit lattice given in Eq. (2.3) and deduced from the product formula in Eq. (2.1). This basically adds weights to each p-adic valuation, which has several valuable consequences.

On the theoretical side, we prove that our Twisted-PHS algorithm reaches the same asymptotic trade-off between runtime and approximation factor as the original PHS algorithm, using the same Cvp solver with preprocessing hint by Laarhoven. Formally, under the GRH and heuristics:

Theorem 3.14. Let ω ∈ [0, 1/2] and K be a number field of degree n and discriminant ∆ K . Assume that a basis of O K is known. Under GRH (Heur. 2.33) and Heur. 3.28 and 3.29, there exist two algorithms A (Laa) tw-pcmp and A (Laa) tw-query such that:

• Algorithm A (Laa) tw-pcmp takes as input O K , runs in time 2 O(log|∆ K |) and outputs a hint V of bit-size 2 O(log 1-2ω |∆ K |) ; • Algorithm A (Laa)
tw-query takes as inputs any ideal b of O K , whose algebraic norm has bit-size bounded by 2 poly(log|∆ K |) , and the hint V output by A (Laa) tw-pcmp , runs in time 2 O(log 1-2ω |∆ K |) + T Su (K), and outputs a non-zero element x ∈ b such that

x 2 ≤ 2 O(log ω+1 |∆ K |/n) • λ 1 (b).
On the practical side though, experimental evidence given in §3.4 suggest that we achieve much better approximation factors than expected, and that the given lattice bases are a lot more orthogonal than the ones used in [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF].

Preprocessing of the number field

As for the PHS algorithm, the preprocessing phase consists, from a number field K and a size parameter ω ∈ [0, 1/2], in building and preparing a lattice L tw that depends only on the number field and allows to express any Approx-id-Svp instance in K as an Approx-Cvp instance in L tw .

Theoretically, the only difference between the original PHS preprocessing and ours resides in the lattice definition and in the factor base elaboration. Its most significant part still consists in computing a hint of constrained size to facilitate forthcoming Approx-Cvp queries. In practice though, we replace this hint computation by merely a few rounds of BKZ with small block size (see §3.4). In a quantum setting this removes the only part that is not polynomial in ln|∆ K |, and in a classical setting avoids the dominating exponential part.

Defining the lattice L tw : a full-rank version of the log-S-unit lattice.

Let FB = p 1 , . . . , p k be a set of prime ideals generating the class group Cl K . The lattice L tw used by our Twisted-PHS algorithm is basically the log-S-unit lattice Log S O × K,S w.r.t. S, where S = S ∞ ∪ FB, under the expanded log-S-embedding, to which we apply an isometric transformation to obtain a full-rank lattice in R ν+k .

Formally, L tw is defined as the lattice generated by the images of the fundamental elements generating the S-unit group O × K,S , as given by Th. 2.2, under the following map ϕ tw from K to R ν+k :

ϕ tw (α) = f H • π H Log S α , (3.15)
• where f H is an isometry from H ⊂ R n+k to R ν+k , with H the intersection of the trace zero hyperplane R n+k 0 = 1 ⊥ n+k , and L = y ∈ R n+k : y r1+2i-1 = y r1+2i , i ∈ 1, r 2 the span of Log S K;

• π H is the projection on H, in particular it is the identity on the S-unit group. This map naturally inherits from the homomorphism properties of Log S , i.e., ϕ tw (αα ) = ϕ tw (α)+ ϕ tw (α ) and ∀λ ∈ Z, ϕ tw (α λ ) = λ•ϕ tw (α), and also defines an isomorphism between

O × K,S µ O × K and L tw .
The isometry f H must be carefully chosen in order to control its effect on the ∞ -norm. Nevertheless, it should be seen as a technicality allowing to work with tools designed for fullrank lattices. Formally, let f H be the linear map represented by GSO T (M H ), which denotes the transpose of the Gram-Schmidt orthonormalization of the following matrix:

M H := -1 1 -1 1 . . . . . . -1 1                         ν + 1 + k ν + k • Ir 1 1 2 1 2 1 2 1 2 . . . . . . 1 2 1 2 I k                                                     r1 2r2 k r1 r2 k . (3.16) Actually, M H is a basis of H = R n+k 0 ∩ L in R n+k
, constituted of vectors that are orthogonal to 1 n+k and to each of the r 2 independent vectors v j , j ∈ 1, r 2 that sends any y ∈ L to 0 by substracting y r1+2j from its copy y r1+2j-1 and forgetting every other coordinate. Hence, Chapter 3. Twisted-PHS: Using the Product Formula graphically, a row basis of L tw is:

B Ltw :=             Λ K 0 Log ε ν+1 . . . -v pj (ε ν+i ) ln N (p j ) 1≤i,j≤k Log ε ν+k             • GSO T (M H ), (3.17)
where the first part is the basis Λ K,S of Log S O × K,S defined in Pr. 2.8.

Volume of L tw and optimal factor base choice.

First, we evaluate the volume of

L tw = f H Log S O × K,S .
As the isometry f H stabilizes the span of the log-S-unit lattice, it preserves its volume, which is given by Pr. 2.8. Using that ideal classes of FB generate the class group, hence h K,(FB) = h K , yields:

Vol L tw = √ n + k • 2 -r2/2 • h K R K 1≤i≤k ln N (p i ). (3.18)
Certainly, the volume of L tw is growing with the log norms of the factor base prime ideals, but a remarkable property is that this growth is at first slower than the lattice density increase induced by the bigger dimension. The meaning of this is that we can enlarge the factor base to densify our lattice up to an optimal point, after which including new ideals becomes counter-productive. Formally, let V k denote the reduced volume Vol 1/(ν+k ) L tw for a factor base of size k ≥ k 0 , where k 0 is the number of generators of Cl K . We have:

V k +1 = V k • 1 + 1 n+k • ln N (p k +1 ) V k 1/(ν+k +1) . (3.19) This shows that V k +1 < V k is equivalent to ln N (p k +1 ) < V k 1 + 1 n+k .
Using this property, Alg. 3.3 outputs a factor base maximizing the density of L tw .

Algorithm 3.3 Twisted-PHS Factor Base Choice A tw-FB Input: A number field K of degree n. Output: An optimal factor base FB generating Cl K that minimizes Vol 1/(ν+k) L tw .

1: Compute Cl K = q 1 , . . . , q k0 , with k 0 ≤ log h K .

2: Compute P(B) = p i : N (p i ) ≤ B \ q 1 , . . . , q k0 ordered by increasing norms, where B is chosen s.

t. π K (B) = poly(ln|∆ K |) ≥ k 0 . 3: FB ← q 1 , . . . , q k0 . 4: i ← 0. 5: while ln N (p i+1 ) < V k0+i 1 + 1 n+k0+i do 6:
Add p i+1 to FB.

7:

i ← i + 1. 8: return FB.

First, for a fixed factor base of size k, we compare the reduced volume V k of L tw with the reduced volume of L phs , denoted

V phs := n 2 r 2 • h K R K 1/(ν+k) . Lemma 3.20. V k V phs ≤ e 1/ne k • p∈FB ln N (p).
This means that the gap between the reduced volume of the twisted lattice and the reduced volume of the untwisted lattice evolves roughly as the arithmetic mean of the ln N (p). We stress that this bound is valid for any k, and remark that e 1/ne ≤ e 1/2e ≈ 1.202.

Proof. The quotient V k /V phs is n+k n ln N (p) 1/(ν+k)
. The square root power is bounded by n+k n 1/(n+k) , as 1 ν+k < 2 n+k , which reaches when k + n = ne its maximum value e 1/ne . On the other hand, 1 ν+k < 1 k , thus by Jensen's inequality:

p∈FB ln N (p) 1/(ν+k) ≤ p∈FB ln N (p) 1/k ≤ 1 k • p∈FB ln N (p).
Although the reduced volume significantly decreases in the first loop iterations, reaching precisely the minimum value can be very gradual, so that it might be clever to early abort the loop in Alg. 3.3 when the gradient is too low, or truncate the output to at most k = O(ln|∆ K |). We quantify the fact that the density loss is at most constant in the worst case in the following result.

Lemma 3.21. Let k = C ln|∆ K | + n ln ln|∆ K | . Let V min be the minimum reduced volume output by A tw-FB , and suppose V min is reached for k > k , then:

V k ≤ e 1/C+1/ne • V min . Proof. By Eq. (2.35), this choice of k implies n 2 r 2 • h K R K 1/(ν+k ) ≤ e 1/C
. Lemma 3.20 thus gives V k ≤ e 1/C+1/ne ln N (p k ). The result follows from the fact that by design, ln

N (p k ) ≤ V min ≤ V k .
In practice, experiments of §3.4 report that the factor bases output by A tw-FB have significantly smaller dimensions than the dimensions showed in Tab. 3.1 and 3.2 for the (optimized) PHS algorithm, so that Lem. 3.21 is never triggered. Proposition 3.22. Algorithm A tw-FB terminates in time T Su (K) + poly(ln|∆ K |) and outputs a factor base of size k = poly(ln|∆ K |) using B = poly(ln|∆ K |).

Proof. We first show termination. If ln N (p 1 ) ≥ V k0 1 + 1 n+k0 , the algorithm stops. Otherwise, by Eq. (3.19), V k0+i+1 < V k0+i at best until ln N (p i+1 ) ≥ V k0+i . Since there are at most n prime ideals of a given norm, ln N (p i ) must increase, so that at some point V k0+i+1 > V k0+i , where the density of L tw decreases.

We now bound B and k. For C > 0, let k = C ln|∆ K | + n ln ln|∆ K | , and let B = N (p k ). By the Prime Ideal Theorem (Th. 2.38), B ≤ poly(ln|∆ K |). Using the same arguments as in the proof of Lem. 3.21, we obtain:

V k ≤ e 1/C • n+k n 1/(ν+k ) • ln k /(ν+k ) N (p k ) ≤ e 1/C+1/ne • ln B .
If ln N (p k +1 ) ≥ V k , we take B = B and k = k . Note that this is generically the case in practice. Otherwise, it is necessary to increase B to at most B = B , with = exp e 1/C+1/ne . This value of verifies that if

k > k is such that N (p k+1 ) ≥ B ≥ N (p k ), then ln N (p k+1 ) ≥ V k > V k ,
and by definition FB ≤ k. Note that this scaling value is small, e.g., for C ≥ 4 and n ≥ 3 we have ≤ 4. The key is now to show that this new k = π K ( B ) is not much larger than k = π K (B ). Actually, provided B is (polynomially in ln|∆ K |) large enough, invoking again the Prime Ideal Theorem yields k = π K (B ) ≥ B 2 ln B [BDPW20, Lem. A.3] and:

k ≤ π K ( B ) ≤ 2n( B ) ln B = (4 n) • B 2 ln B ≤ (4 n) • π K (B ) = poly(ln|∆ K |).
Note that Bach's bound (Eq. (2.36)) is poly(ln|∆ K |), as B and k. Therefore, steps 2-7 run in time poly(ln|∆ K |), and step 1 computes Cl K in time T Su (K).

Preprocessing algorithm.

Algorithm 3.4 details the complete preprocessing procedure that, from a number field and some precomputation size parameter, chooses a factor base FB, builds the associated matrix B Ltw , and processes L tw in order to facilitate Approx-Cvp queries.

Algorithm 3.4 Twisted-PHS Preprocessing A tw-pcmp

Input: A number field K of degree n and a parameter ω ∈ [0, 1/2] or b.

Output: The basis B Ltw with the preimages of its rows in O × K,S , and Laarhoven's hint V(L tw ). 1: Get an optimal factor base FB = A tw-FB (K) of size k = FB. If needed, truncate the output to k = O(ln|∆ K |) as in Lem. 3.21. 2: Compute fundamental elements ε 1 , . . . , ε ν+k of O × K,S as in Th. 2.2. 3: Create B Ltw , whose rows are ϕ tw (ε 1 ), . . . , ϕ tw (ε ν+k ) as defined in Eq. (3.17). 4: Use Laarhoven's algorithm to compute a hint V = V(L tw ) of size 2 O(log 1-2ω |∆ K |) . 5: (or) Use a BKZ of small block size to reduce the basis of L tw .

6: return O × K,S , B Ltw , V(L tw ) .
This Twisted-PHS preprocessing differs from the original PHS preprocessing given in Alg. 3.1 on two aspects: the factor base, output by A tw-FB in step 1 and which is essentially much smaller in practice, and the new twisted lattice in step 3.

The last two alternative steps consists in preprocessing L tw in order to solve Approx-Cvp instances efficiently. Theoretically, we retain in step 4 the same approach as in step 6 of the original PHS preprocessing Alg. 3.1, that guarantees a hint size not exceeding the query phase time using Laarhoven's algorithm [START_REF] Laarhoven | Sieving for closest lattice vectors (with preprocessing)[END_REF]. This outputs a hint V of bit size bounded by 2 O(ν+k) 1-2ω , i.e., 2 O(log 1-2ω |∆ K |) using (ν + k) = O(log|∆ K |), allowing to deliver the answer for approximation factors (ν + k) ω in time bounded by the bit size of V [Laa16, Cor. 1-2]. This theoretical version will be denoted by A (Laa) tw-pcmp . Nevertheless, in practice the twisted lattice output by Alg. 3.4 incidentally appears to be a lot more orthogonal than expected. That's the reason why we suggest to replace the exponential step 4 of Alg. 3.4 by step 5, which performs some polynomial lattice reduction using a small block size BKZ. In a quantum setting this removes the only part that is not polynomial in ln|∆ K |, and in a classical setting avoids the dominating exponential part. This practical version will be denoted by

A (bkz) tw-pcmp .
Proof of the first part of Th. 3.14. The complexity of step 1 is given by Pr. 3.22. Neglecting terms in poly(ln|∆ K |), the other costly steps are steps 2 and 4. The former costs T Su (K) ≤ 2 O(log 2/3 |∆ K |) by §2.3.3; the latter, independently of ω, runs in 2 O(ν+k) = 2 O(log|∆ K |) by the bound on k. Hence, Alg. 3.4 has the same complexity as the original PHS preprocessing, i.e., at most 2 O(log|∆ K |) . Note that in practice, the dimension of L tw is much smaller than the one of L phs , which directly lowers the practical complexity of A (Laa) tw-pcmp and A (bkz) tw-pcmp .

Query phase

This section describes the query phase A tw-query of the Twisted-PHS algorithm. As for the query phase of the original PHS algorithm, it reduces the resolution of Approx-id-Svp in b, for any challenge ideal b ⊆ K having a polynomial description in log|∆ K |, to a single call to an Approx-Cvp oracle in L tw as output by the preprocessing phase. The main idea of this reduction remains to multiply the principal ideal generator output by the ClDlp of b on FB by elements of O × K,S until we reach a principal ideal having a short generator. This translates into adding vectors of L tw to some target vector derived from b until the result is short, hence into solving a Cvp instance in the log-S-unit lattice L tw .

The essential difference of the Twisted-PHS version lies in the definition of this target, which is adapted in order to benefit from the twisted description of the log-S-unit lattice. This is formalized in Alg. 3.5.

Algorithm 3.5 Twisted-PHS Query A tw-query

Input: Challenge b, A tw-pcmp (K, ω) = O × K,S , B Ltw , V , and β > 0 s.t. for any t, the Approx-Cvp oracle using V(L tw ) outputs w ∈ L tw with f -1

H (t -w) ∞ ≤ β. Output: A short element x ∈ b \ {0}. 1: Solve the ClDlp for b on FB, i.e., find α ∈ K s.t. α = b • pi∈FB p vi i , for v i ∈ Z. 2: Define the target t as f -1 H (t) = π H Log α, -v i ln N (p i ) 1≤i≤k + b tw
, where the drift vector b tw ∈ H will be defined in Eq. (3.23).

3: Solve Approx-Cvp with V(L tw ) to get w ∈ L tw s.t. f -1 H (t -w) ∞ ≤ β. 4: (or) Use Babai's Nearest Plane to get w ∈ L tw s.t. f -1 H (t -w) ∞ is small. 5: Compute s = ϕ -1 tw (w) ∈ O × K,S
, using the preimages of the rows of B Ltw . 6: return α/s.

Note that the output of the ClDlp in step 1 is not an S-unit unless b is divisible only by prime ideals of FB; for each i, v i = v pi (α) -v pi (b). For convenience and without any loss of generality we shall assume that b is coprime with all elements of the factor base, i.e., ∀p ∈ FB, v p (b) = 0. In that case, the target in step 2 writes naturally as t = ϕ tw (α) + f H b tw . This target definition calls for a few comments. First, the output of the ClDlp is projected on the whole log-S-unit lattice instead of only on the log-unit sublattice, hence maintaining its length and algebraic norm logarithms in the instance scope. Thus, the way our algorithm uses S-units to reduce the solution of the ClDlp problem can be seen as a smooth generalization of the way traditional Sgp solvers use regular units to reduce the solution of the Pip as in [START_REF] Cramer | Recovering short generators of principal ideals in cyclotomic rings[END_REF]. Second, the sole purpose of the drift by b tw is to ensure that α/s ∈ b. Adapting its definition to the twisted setting is slightly tedious and deferred to the next paragraph. The most notable novelty is that we force the use of a drift that is inside the log-S-unit lattice span. This somehow captures and compensates for the perturbation induced on infinite places for correcting negative valuations on finite places using S-units.

Finally, as already mentioned, L tw seems much more orthogonal in practice than expected, so that we advise to resort to Babai's Nearest Plane algorithm for solving Approx-Cvp in L tw , instead of using Laarhoven's query phase with the precomputed hint. We only keep Laarhoven's algorithm to theoretically prove the correctness and complexity of our new algorithm. The theoretical and practical versions of A tw-query are respectively denoted by A We now detail explicitly our target choice and prove the correctness and the output quality of Alg. 3.5.

Definition of the target vector.

Recall that we assumed that b is coprime with FB, hence f -1 H (t) = π H Log S α + b tw , for some b tw ∈ H that must ensure α/s ∈ b, for s = ϕ -1 tw (w) and when f -1 H (t -w) ∞ ≤ β. Indexing coordinates by places, we exhibit b tw = {b σ } σ∈S ∞ ∪S ∞ , {b p } p∈FB , where:

b σ = -k n ln N (b) n+k + β + 1 n p∈FB ln N (p) for σ ∈ S ∞ ∪ S ∞ , b p = β -ln N (p) + ln N (b) n+k for p ∈ FB. (3.23)
It is easy to verify that all coordinates sum to 0, i.e., b tw ∈ H. We now explain this choice, first showing that under the above hypotheses, Alg. 3.5 is correct. Proposition 3.24. Given access to an Approx-Cvp oracle that on any input t,

outputs w ∈ L tw s.t. f -1 H (t -w) ∞ ≤ β, A tw-query outputs x ∈ b \ {0}. Proof. Recall that x = α/s, where s = ϕ -1 tw (w) ∈ O × K,S
and that for the sake of clarity, b is taken coprime to FB. Therefore, it is sufficient to show that for any fixed p ∈ FB, v p (α/s) ≥ v p (b) = 0. Indexing coordinates of Log S α by places and using the simplified notation α v := (Log S α) v , we have that for

h α = π H Log S α , (h α ) p = α p -ln N (b)
n+k . By hypothesis:

α p -ln N (b) n+k -s p + b p = -v p (α) -v p (s) + 1 ln N (p) + β ≤ β.
Rearranging terms, and using that v p (•) ∈ Z to round integers towards 0:

0 ≤ v p (α/s) ≤ 2 β ln N (p) -1 .
This concludes the correctness proof.

The proof of Pr. 3.24 quantifies the intuition that the output element has smaller valuations at big norm prime ideals. In particular, strictly positive valuations occur only for ideals s.t. ln N (p) ≤ β. This has a very valuable consequence: estimating the ∞ -norm covering radius of L tw allows to control the prime ideal support of any optimal solution. Hence, even if the Approx-Cvp cannot reach µ ∞ (L tw ), it is possible to confine the algebraic norm of each query output by not including in FB the prime ideals whose log-norm would in fine exceed µ ∞ (L tw ), and at which the optimal solution provably has a null valuation. Roughly speaking, this is what A tw-FB tends to achieve in Alg. 3.3.

Translating infinite coordinates.

As already mentioned, one important novelty consists in forcing the drift used to ensure α/s ∈ b to be inside the log-S-unit span. The underlying intuition is that "correcting" negative valuations at finite primes should only involve S-units. We modelize this by splitting the weight of the b p 's evenly across the infinite places coordinates, hence obtaining Eq. (3.23). This heuristically presumes that S-units absolute value logarithms are generically balanced on infinite places. Let us summarize our target definition:

t = f H α σ -1 n k β + ln N (b) -p∈FB ln N (p) σ , α p + β -ln N (p) p∈FB . (3.25)
Quality of the output of A (Laa) tw-query . To bound the quality of the output of Alg. 3.5, the general idea is that minimizing the distance of our target to the twisted lattice directly minimizes the p-adic absolute values -v p (α) ln N (p) instead of minimizing the valuations v p (α) independently of ln N (p).

This makes use of the following log-S-unit lattice structure lemma, adapting its log-unit lattice classical equivalent [PHS19a, Lem. 2.11-2.12], [CDPR16, §6.1]: Lemma 3.26. For α ∈ K, let h α := π H Log S α . Decompose α on FB as b • p∈FB p vp(α) , with b coprime to FB. Then Log S α = h α + ln N (b) n+k • 1 n+k . Furthermore, the length of α is bounded by:

α 2 ≤ √ n • N (b) 1/(n+k) • exp max 1≤j≤n (h α ) j .
Note that using the max of the coordinates of h α instead of its ∞ -norm norm acknowledges for the fact that logarithms of small infinite valuations can become large negatives that should be ignored when evaluating the length of α.

Proof. By definition of the orthogonal projection on H, Log S α decomposes as h α + a • 1 n+k , with a = Log S α, 1 n+k / 1 n+k 2 2 . The scalar product is:

σ∈S ∞ ∪S ∞ ln|σ(α)| - p∈FB v p (α) • ln N (p) = ln N α p∈FB p vp(α) = ln N (b).
Therefore, a = ln N (b) n+k . Moreover, generically we have α 2 ≤ √ n • α ∞ ; using the above decomposition coordinate-wise, the j-th-coordinate of Log S α writes (Log S α) j = (h α ) j + ln N (b) n+k and thus:

α ∞ = exp max σ∈S ∞ ln|σ(α)| ≤ exp ln N (b) n+k + max 1≤j≤n (h α ) j .
Theorem 3.27. Given access to an Approx-Cvp oracle that on any input t, outputs w ∈ L tw s.t. f -1 H (t -w) ∞ ≤ β, A tw-query computes x ∈ b \ {0} such that:

x 2 ≤ √ n • N (b) 1/n • exp (n + k) β -p∈FB ln N (p) n .
This outperforms the bound of Pr. 3.13 if (n + k) • β ≤ 2β • p∈FB ln N (p). In particular, this is implied by Lem. 3.20 if β β ≈ V k V phs for k ≥ n. We will see that under some reasonable heuristics, this is indeed the case when using the same factor base, and that experiments suggest a much broader gap. One intuitive reason for this behaviour is that the covering radius of our twisted lattice grows at a slower pace than the log-norm of the prime ideals of FB.

Proof. The correctness comes from Pr. 3.24. As before, let s = ϕ -1 tw (w), where w verifies

f -1 H (t -w) ∞ ≤ β. It is necessary to bound max σ∈S ∞ (h α/s ) σ in order to invoke Lem. 3.26. Note that h α/s = h α -h s , hence: (h α/s ) σ = α σ -ln N (b)
n+k -s σ . Recalling the target definition given in Eq. (3.23), the σ-coordinate of f -1

H (t -w) writes α σ - ln N (b)
n+k + b σ -s σ = (h α/s ) σ + b σ , and the promise on w yields:

(h α/s ) σ ≤ β -b σ = (n + k) β -p∈FB ln N (p) n + k n(n + k) • ln N (b).
Injecting this bound in Lem. 3.26 using 1 n+k + k n(n+k) = 1 n ends the proof.

Heuristic evaluation of β.

Proving the second part of Th. 3.14 necessitates to evaluate β. This evaluation rely on several heuristics that adapt heuristics [PHS19a, Heur. 4-6]. We argue that the arguments developed in [PHS19a, §4] to support these heuristics can be transposed to our setting, and both heuristics are validated by experiments in §3.4.

Heuristic 3.28 (Adapted from [PHS19a, Heur. 4]). The ∞ -norm covering radius of L tw is bounded by

O Vol 1/(ν+k) L tw . Likewise, µ 2 (L tw ) = O √ ν + k • Vol 1/(ν+k) L tw .
This assumption relies on L tw to behave like a random lattice, implying its successive minima and covering radius to be even. In [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF], the randomness essentially comes from the choice of the factor base, while for L tw , this choice is deterministic. We argue that heuristically, prime ideals of FB represent uniformly random classes in Cl K ,16 and S-units Archimedean absolute value logarithms are likely to be uniform in R n Log O × K . The volumetric arguments of [PHS19a, §4.1] can also be readily adapted, using ln N (p) ≤ Vol 1/(ν+k) L tw by construction. Heuristic 3.29 (Adapted from [PHS19a, Heur. 5-6]). With non-negligible probability over the input target vector t, the vector w output by Laarhoven's algorithm satisfies f -1

H (t -w) ∞ ≤ O ln(n + k)/ √ n + k • t -w 2 .
This heuristic conveys the idea that coefficients of the output of Laarhoven's algorithm are somehow balanced, so that

w 2 ≈ √ n + k • f -1 H (w) ∞ .
-1 H (v) ∞ ≤ ln n+k √ n+k • v 2 .
The Approx-Cvp solver from Laarhoven's algorithm using V(L tw ) outputs a lattice vector at Euclidean distance which is at most O (ν +k) ω •µ 2 (L tw ) . Hence, its infinity distance is

O (ν + k) ω • ln ln|∆ K | , and (k + n) β = O (ν + k) ω+1 • ln ln|∆ K | = O ln ω+1 |∆ K | , as claimed.
As for the running time of Alg. 3.5, it is essentially determined by those of steps 1 and 3. Solving the ClDlp problem requires to compute S-units for an extended factor basis containing FB and prime factors of b, hence costs T Su (K). Note that since it depends on the challenge, this cost cannot be mitigated by some preprocessing effort. On the other hand, solving Approx-Cvp with Laarhoven's algorithm runs in time bounded by 2 O(log 1-2ω |∆ K |) , the size of V . Finally, the total run time of

A (Laa) tw-query is bounded by 2 O(log 1-2ω |∆ K |) + T Su (K).
In practice, as shown in §3.4, the special properties of our twisted lattice L tw suggest replacing Laarhoven's Cvp solving by Babai's Nearest Plane algorithm for solving Approx-Cvp in L tw . In this eventuality, A (np) tw-query would become quantumly polynomial, and classically only subexponential in ln|∆ K |.

1. The S-units w.r.t. FB can have huge coefficients. Computing the absolute values of their embeddings must then be performed at very high precision. All our lattice constructions were conducted using 10000 bits of precision. 2. Computing the target involves the challenge and the ClDlp solution, whose coefficients are potentially huge rational numbers, up to 2 25000 for e.g., Q(ζ 53 ). As above, we adjust the precision in order to obtain sensible values. In all cases, once in the log space the resulting high precision data can be rounded back to the generic precision before lattice reduction or Cvp computations.

Geometric characteristics

First, we evaluated the geometric characteristics of each produced lattice, using indicators recalled in §2.4.2, namely: the root Hermite factor δ 0 , the orthogonality defect δ, and the minimum θ min (resp. average θ avg ) vector basis angle. Each of these indicators is declined before and after BKZ reduction to compare their evolution. We also evaluated experimentally the relevance of Heur. 3.28 and 3.29. Example results are given in Tab. 3.3 and 3.4 for cyclotomic and NTRU Prime fields, aside the lattices dimensions d = ν + k and reduced volumes V 1/d . Extensive data can be found in Tab. 3.5 and 3.6 for both field families.

δ 0 δ θ min θ avg • ∞ / • 2 d V 1/d raw

Orthogonality indicators.

We first remark that minimum and average vector basis angles seem difficult to interpret. They are slightly better for Twisted-PHS on NTRU Prime fields but it is harder to extract a general tendency for cyclotomic fields. After a light BKZ reduction, twisted lattices show significantly better root Hermite factor and orthogonality defect than any other log-S-unit lattice representations, even when the lattices have the same dimension, i.e., when the same factor base is used. Second, the evolution of the orthogonality defect before and after the reduction is more restricted in the twisted case than in the others. In particular, we observe that the BKZ-reduced versions of L (0) opt and L (0) phs can have bigger orthogonality defects than the unreduced L tw . This last observation is true for all NTRU Prime fields we tested except Q(z 23 ).

These two phenomenons (better values and small variations) are particularly clear for NTRU Prime fields. We remark that in this case, the twisted version of the log-S-unit lattice fully expresses, since for NTRU Prime fields most factor base elements have distinct norms. On the contrary, factor bases for our targeted cyclotomic fields are composed of one (or two, as for Q(ζ 59 )) Galois orbits whose elements all have the same norm. Finally, we stress that reducing L tw lattices is much faster in practice than reducing L (0) opt and L (0) phs . This is corroborated by the graphs of the Gram-Schmidt log norms in §3.4.2.

Evaluating heuristic on covering radius (Heur. 3.28).

Computing the covering radius of a given lattice is a very difficult problem in general. To evaluate in practice µ 2 and µ ∞ for our computed lattices, we used a slightly modified version of the strategy of [PHS19a, §4.1]. More precisely, for each lattice L, we picked 500 random target vectors t i in the span of L from a continuous Gaussian distribution of deviation σ = 100 • dim L, then used Babai's Nearest Plane algorithm with the reduced basis of L to obtain vectors w i ∈ L close to t i . Finally, we majorate µ ∞ (L) and µ 2 (L) by respectively max i t i -w i ∞ and max i t i -w i 2 .

Results show that all lattices equally match Heur. 3.28. We noticed, for L phs and for the number fields tested in [PHS19a, Fig. 4.1], a significant gap between our estimations and the published numerical values. We stress that using in our code a standard deviation of only σ = 100 as in [START_REF] Pellet-Mary | Published code of "Approx-SVP in ideal lattices with pre-processing[END_REF] reproduces their results.

Evaluating heuristic on infinity norm (Heur. 3.29).

In order to support Heur. 3.29, we compared the average f -1 H (t i -w i ) ∞ t i -w i 2 with the expected value ln(n+k)/ √ n + k for L tw . The evolution of Heur. 3.29 from [PHS19a, Heur. 5-6] is quantified by relating, for all four PHS log-S-unit variants, the ratio t i -w i ∞ t i -w i 2 to their expected ratio ln(ν + k)/ √ ν + k . The data show that all lattices follow exactly the same behaviour w.r.t. [PHS19a, Heur. 5-6] and Heur. 3.29. All these values are tagged with a unique label " • ∞ / • 2 (real/H. 3.29)" in the tables, but correspond to Heur. 3.29 for Twisted-PHS and to [PHS19a, Heur. 5-6] for PHS.

Plotting Gram-Schmidt log norms

For our second experiment, we evaluate the Gram-Schmidt norms of each produced lattice. We propose two comparisons, the first one is before and after BKZ reduction to see the evolution of the norms for each case at iso factor base in Fig. 3.2; the second one is between the different lattices (after BKZ reduction) in Fig. 3.3. Again, extensive data for other examples can be found in §3.5.2 for both cyclotomic fields and NTRU Prime fields.

We first remark that in Fig. 3.2 the two curves, before and after BKZ reduction, are almost superposed for the Twisted-PHS lattice. This does not seem to be the case for the two other PHS variants we consider here. Since the volume of L tw is bigger, by roughly the average log norm of the factor base elements by Lem. 3.20, the Gram-Schmidt log norms of our bases have bigger values. The important phenomenon to consider is how these log norms decrease. Figure 3.3 emphasises that the decrease of the Gram-Schmidt log norms is very limited in the twisted case, compared to other cases (with iso factor bases on the left, and the original algorithms on the right), where the decrease of the log norms seems significant. This observation seems to corroborate the fact that the Twisted-PHS lattice is already quite orthogonal. Finally, we note that both phenomenons do not depend on the lattices having the same dimension.

Approximation factors

We implemented all three algorithms from end to end and used them on numerous challenges to estimate their practically achieved approximation factors. This is to our knowledge the first time that these types of algorithms are completely run on concrete examples.

Ideal SVP challenges and ClDLP computations.

For each targeted field, we chose 50 prime ideals b of prime norm q. Indeed, these are the most interesting ideals: in the extreme opposite case, taking b inert of norm q n implies that q reaches the lower bound of Eq. (2.41), as q 2 = √ n • q, hence the id-Svp solution is trivial. We then tried to solve the ClDlp for these challenges w.r.t. all targeted factor bases. We stress that, using Magma, S-units computations for the ClDlp become harder as the norm of the challenge grows. This is especially true when the factor base inflates, hence providing an additional motivation for taking as small as possible factor bases. Therefore, we restricted ourselves to challenges of norms around 100 bits. Computing the ClDlp solutions for these challenges revealed much harder than computing S-units on all factor bases, which contain only relatively small prime ideals. As a consequence, we were able to compute the ClDlp step only up to Q(ζ 53 ) (partially) and Q(z 47 ).

Query algorithm.

We exclusively used Babai's Nearest Plane algorithm on the BKZ reduced bases of all log-S-unit lattices to solve the Approx-Cvp instances. Actually, the hardest computational task was to compute the output α/s, which necessitates a multi-exponentiation over huge S-units.

As a particular point of interest, we stress that using directly the drift proposed in [PHS19a] would be especially unfair. Hence, for a challenge b, the target drifts b phs , b phs and b tw were all minimized using an iterative dichotomic approach on β and β, taking a bigger value if the output x / ∈ b, and a smaller value if x ∈ b. After 5 iterations, the shortest x that verified x ∈ b is returned.

Exact approximation factors.

Figures 3.4 and 3.5 report the obtained approximation factors. Note that for these dimensions, it is still possible to exactly solve id-Svp in the Minkowski space, so that these graphs show real approximation factors. We stress that we used a logarithmic scale to represent on the same graphs the performance of the Twisted-, Opt-PHS and PHS algorithms. The figures suggest that the approximation factor reached by our algorithm increases very slowly with the dimension, in a way that could reveal subexponential or even better. This feature would be particularly interesting to prove.

As a final remark, we point out that increasing the factor base for our Twisted-PHS algorithm has very little impact on the quality of the output. This is expected, since the log norm of the prime ideals constrain the valuation of the output, as in the proof of Pr. 3.24. On the contrary, increasing the factor base for the PHS and Opt-PHS variants clearly sabotages the quality of their output, as their lattice description is blind to these prime norms.

Supplementary Experimental Data

This section provides extensive additional data for all targeted fields.

Geometric characteristics

First, Tab. 3.5 and 3.6 extend the example given in Tab. 3.4 to respectively all targeted cyclotomic and NTRU Prime fields. 3.6 -Geometric characteristics of log-S-unit lattices for all targeted NTRU Prime fields Q(z q ), for prime q ∈ 23, 47 .

δ0 δ θ min θavg • ∞/ • 2 d V 1/d raw
These extensive data confirm the discussion made in §3.4.1. Note that these observations are especially valid for NTRU Prime fields. An explanation of this phenomenon might lie in the fact that for NTRU Prime fields, the norms of the factor base prime ideals are almost all distinct, so that the twisted characteristic of our lattices is fully used.

Gram-Schmidt norms of the lattice bases

We also provide the graphs showing the log norms of the Gram-Schmidt vectors for each field and each log-S-unit lattice variant. These graphs confirm the discussion in §3.4.1, namely that in the twisted case, the BKZ reduction has very little impact and that the sequence of norms does not vary much. This corroborates the claim that our twisted lattices are much more orthogonal than expected.

In the case of PHS and its variants, there is always a significant gap between the Gram-Schmidt norms before and after the small block BKZ reduction, and the decrease of the log norms is very pronounced and going down to 0.

Prime conductor cyclotomic fields. opt , L (0) phs , L opt and L phs .

Chapter 4

A Short Basis of the Stickelberger Ideal of a Cyclotomic Field I n this chapter, the material come from a fruitful collaboration with Pr. Radan Kučera, and constitute the second contribution of this thesis.

Introduction

A popular choice for lattice-based cryptography is to consider fractional ideals in some cyclotomic field

K m = Q[ζ m ] of conductor m ≡ 2 (mod 4
), e.g., m = 2048. In the last decade, there has been a significant cryptanalytic effort trying to benefit from this additional algebraic structure to solve Approx-Ideal-Svp, giving rise to a long series of works [CGS14, CDPR16, CDW17, DPW19, PHS19a, BR20, CDW21]. All approaches start from a solution to the Class Group Discrete Logarithm Problem (ClDlp), which is, given a fixed set of finite places corresponding to prime ideals p 1 , . . . , p k of K m , and any challenge ideal b whose class in the class group of K m belongs to the subgroup generated by the classes of the p i 's, to find α ∈ K m and e 1 , . . . , e k ∈ Z such that:

α = b • 1≤i≤k p ei i .
In a quantum world, this problem is not hard to solve [START_REF] Eisenträger | A quantum algorithm for computing the unit group of an arbitrary degree number field[END_REF][START_REF] Biasse | Efficient quantum algorithms for computing class groups and solving the principal ideal problem in arbitrary degree number fields[END_REF], so the most difficult part of these cryptanalyses resides in reducing the Euclidean norm of α.

In the case of cyclotomic fields K m of conductor m, the Stickelberger ideal S m of K m annihilates its class group, by Stickelberger's theorem. Thus, it was proposed in [START_REF] Cramer | Short Stickelberger class relations and application to Ideal-SVP[END_REF][START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF] to use these free relations to help to reduce the algebraic norm of the ClDlp solution. More precisely, since by [START_REF] Sinnott | On the Stickelberger ideal and the circular units of a cyclotomic field[END_REF] (1 -τ )S m , viewed as a Z-module, has full rank in (1 -τ )Z G m , where G m = Gal(K m /Q) and τ ∈ G m is induced by complex conjugation, it is a lattice of class relations for the relative class group. Therefore, choosing a challenge ideal b and prime ideals for the ClDlp in the relative class group, e.g., exactly one Galois orbit p σ for all σ ∈ G m , it is possible to express the reduction of a solution α = b • p eσσ as a closest vector problem in (1 -τ )S m , where the target is the vector (e σ -e τ σ ) σ .

As noticed in [CDW21, Lem. 4.4 and 4.6], this lattice contains many short elements, i.e., elements of Z[G m ] of the form a σ σ, where all a σ ∈ {0, 1}. In fine, this yields a good description for finding sufficiently close vectors. Also, the plus part of the class group seems to be much smaller than the relative part,18 hence every challenge b can be reduced to this case by randomly searching for a small norm ideal c such that the class of cb belongs to the relative class group [CDW21, Alg. 5].

In praise of short Stickelberger bases

Unfortunately, while in the prime conductor case the exhibited set of short elements from [CDW21, §4.2] form a Z-basis of S m , in the general case this family is only known to generate S m as a Z-module. This comes at the expense of constructing a linearly independent subset of vectors [CDW21, 2.2]. Whereas this is certainly possible without any geometric loss, using e.g., [START_REF] Micciancio | Complexity of Lattice Problems[END_REF]Lem. 7.1], it induces a slight growth of the Euclidean norm of the obtained basis vectors. For some applications, this can have dramatic consequences and it is not clear whether it is always possible to find a basis among all subsets of such a short generating set.

A very important point is that the proof of Stickelberger's theorem, i.e., that the Stickelberger ideal annihilates the class group, is completely explicit [Was97, §6.2]. Namely, for any prime ideal p, and any α ∈ S m , it builds an explicit γ ∈ K m such that γ = p α . However, if α has even moderately large coefficients, this has an exponential impact on the height of the coefficients of γ, that renders its computation rapidly intractable. On the contrary, having only short elements in the basis keeps the algebraic norm of the generators as low as possible, namely N (p) ϕ(m)/2 . Explicitly computing Stickelberger generators is useful in at least two situations:

1. the first one is when reducing the algebraic norm of the ClDlp solution as in [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF], as knowing explicit generators prevents to perform a quantum step -or, a classically costly step -to recover the generator of the reduced ideal (see [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF]Th. 5.1] for the complete workflow); 2. the second one occurs when one wants to use the knowledge of the Stickelberger relations to approach some log-S-unit lattice. Indeed, suppose the finite places of S correspond to one split Galois orbit p σ for all σ ∈ G m . Then, from a maximal set of independent real S + -units, where the finite places of S + correspond to all relative norm ideals N Km/K + m p σ , adding explicit generators corresponding to a basis of the Stickelberger ideal, besides the absolute norm, yields a maximal set of independent S-units, at the much smaller cost of finding generators in the maximal real subfield. In the latter case, note that knowing merely a short generating set of S m instead of a Z-basis is not sufficient to provide a full-rank family of independent S-units. Building a basis from such a generating set using e.g., the Hermite Normal Form, an LLL reduction or [MG02, Lem. 7.1], increases dramatically the size of the (possibly rational) coefficients of the respective generators. Not to mention the computational burden to manipulate such elements, this significantly hinders their potential use: for example, in the saturation process (see e.g., §5.2.4) that allows to approach further log-S-unit lattices, it is vital to constrain both the number of elements and their size. Hence, having in the first place an explicit short basis of S m as a Z-module is particularly useful.

Historical results.

The first explicitly known basis of S m , viewed as a Z-module, for any conductor m was given in [Kuč92, Th. 6.2], but elements of this basis have rather large coefficients. In the prime conductor case, a short basis can be found in [Sch08, Th. 9.3(i)], the shortness being proven in [Sch08, Ex. 9.3]. This result has been extended to prime-power conductors in [START_REF] Cramer | Short Stickelberger class relations and application to Ideal-SVP[END_REF], at the price of allowing slightly larger coefficients [CDW17, Lem. 4(2)]. Finally, a large set of short generators has been given in [CDW21, §4.2] in the general case for any conductor.

Contributions

In this work, our main result (see Th. 4.29) is to provide the first explicit basis of the Stickelberger ideal S m for any conductor m, viewed as a Z-module, that is constituted only of short elements, i.e., elements of the form

σ∈Gm a σ σ ∈ S m ⊂ Z G m ,
where a σ ∈ {0, 1} for all σ ∈ G m .

Actually, besides the absolute norm element, all other members of this short basis have exactly ϕ(m)/2 non-zero coordinates. In the prime conductor case, our short basis coincides with the basis given in [Sch08, Th. 9.3(i)]. One ingredient of independent interest in the proof is Pr. 4.15, which describes a large family of short elements of S m that encompasses the set from [CDW21, §4.2], using a very simple arithmetic criterion in the spirit of [START_REF] Washington | Introduction to Cyclotomic Fields[END_REF]Lem. 16.3] when m is an odd prime power. Picking wisely some elements α m (b) in this large family yields our proposed short basis. We also show how to explicitly compute algebraic integers generating L αm(b) , for any unramified prime ideal L and any element α m (b) of our short basis. These generators can be expressed 66 Chapter 4. A Short Basis of the Stickelberger Ideal as Jacobi sums that turn out to be drastically more efficient to compute than the generators given e.g., in [Was97, §6.2].

Finally, a nice theoretical consequence of our result is to derive an explicit upper bound on the relative part h - m of the class number of K m . More precisely, for any conductor m ≡ 2 (mod 4), Cor. 4.32 gives that

h - m ≤ 2 1-a • ϕ(m) 8 ϕ(m)/4
, where

a = 0 if m is a prime-power, 2 t-2 -1 if m has t > 1 prime divisors.
To our knowledge, the best explicit upper bound on the relative class number which is valid for any conductor is given by [START_REF] Louboutin | Upper bounds on relative class number of cyclotomic fields[END_REF]6]. However, whereas our bound is given by a simple formula and easy to manipulate, Louboutin's bound is difficult to instantiate for comparison in the general case. As an example, the special case m = 4p, where p ≥ 3 is an odd prime, is concretely treated in [Lou14, Th. 2], which results in the following upper bound:

h - 4p ≤ 8 √ p • p 16 (p-1)/2
.

We stress that in this example, this upper bound is sharper than ours. We should also mention that the proof of our bound indirectly gives an algorithm to compute the relative class number by computing the determinant of some scaled Hadamard matrix: incidentally, this method seems to be significantly more efficient than when using the traditional analytic formula [Was97, Th. 4.17], when the number t of prime factors of m is small.

On Bases of S m

Recall that m > 1 is a positive integer such that m = q 1 q 2 . . . q t ≡ 2 (mod 4), where q 1 , . . . , q t are pairwise coprime prime powers greater than 2.

A first basis of S m

We first give a basis of S m constructed in the spirit of [Kuč92, Th. 4.2]. Let X m and M - m be the subsets of 1, m defined in §2.2.1, and recall that M - m is exactly the set M -defined in [START_REF] Kučera | On bases of the Stickelberger ideal and of the group of circular units of a cyclotomic field[END_REF]p.293]. This set M - m has the following stability property: Lemma 4.1. Let r | m, 0 < r < m, such that r, m r = 1. Let the set M - m r be defined using the ordering of prime power divisors of m r induced by the chosen ordering of prime power divisors of m. Then

a ∈ M - m ; r | a = rb; b ∈ M - m r = r • M - m r
.

Proof. For any integer b, 0 < b < m r , we have b ∈ X m r if and only if for each i ∈ 1, t such that q i | m r , either (q i , b) = 1 or q i | b. This is the case if and only if for each i ∈ 1, t , either (q i , rb) = 1 or q i | rb, thus if and only if rb ∈ X m .

If q i | m r for some i ∈ 1, t then (q i , r) = 1, and so q i rb if and only if q i b, moreover b ≡ -(b, m r ) (mod q i ) if and only if br ≡ -(br, m) (mod q i ). If b m r then for any i ∈ 1, t such that q i | m r we have b ≡ (b, m r ) (mod q i ) if and only if br ≡ (br, m) (mod q i ). Therefore we get the same k for b ∈ X m r and for br

∈ X m . Moreover b (b, m r )q k = br (br,m)q k . If b | m r then i ∈ 1, t ; q i | m r , q i b} = i ∈ 1, t ; q i rb}.
Theorem 4.2. For any integer m > 1, m ≡ 2 (mod 4), the set

ω m (a); a ∈ M - m ∪ 1 2 N m (4.3) is a Z-basis of S m .
Proof. This can be proved similarly to the part of [Kuč92, Th. ). Therefore, this proof can be used mutatis mutandis to get a basis for any group generated by generators satisfying these relations. Hence, plugging ω * = 1 2 N m and ω(a) = ω m (a), we deduce the theorem from Lem. 2.19, 2.31 and 2.32.

The above basis inherits the stability property given in Lem. 4.1. In particular, for any positive r | m, 1 < r < m, such that r, m r = 1, the corestriction subgroup Cor Km/K m/r S m/r of S m has the following Z-basis

ω m (a); a ∈ r • M - m r ∪ 1 2 N m .

An alternative basis of S m : the prime-power case

In this section we shall suppose that m is a prime power q = p e , where p is a prime and e is a positive integer. Let us mention explicitly that the case p = 2 is allowed whenever e ≥ 2 to ensure q ≡ 2 (mod 4). We set

M q = M p e = 1, . . . , ϕ(p e ) 2 . (4.5)
68 Chapter 4. A Short Basis of the Stickelberger Ideal Theorem 4.6. For any prime power q = p e > 2, the set

ω q (a); a ∈ M q ∪ 1 2 N q (4.7)
is a Z-basis of S q .

Proof. We shall prove the theorem by induction with respect to e. If q is an odd prime or q = 4, we have M q = M - q so this is just a special case of Th. 4.2. Let us suppose that the theorem has been proved for p e > 2 and let us prove it for q = p e+1 . Let H be the subgroup of S q generated by the set (4.7). We shall show that H contains all ω q (a), 0 < a < q, so that it generates S q by Eq. (2.30).

Since ω q (q -a) = -ω q (a) by Eq. (2.28), the subgroup H contains also ω q (a) for each a ∈ Z satisfying q -ϕ(q) 2 ≤ a < q. Suppose a = bp, using Eq. (2.29) we get ω q (a) = Cor Kq/K q/p ω q/p (b) .

Since Cor Kq/K q/p is an injective linear map, the induction hypothesis implies ω q (a) is a linear combination of 1 2 N q and of Cor Kq/K q/p ω q/p (t) = ω q (tp) for t ∈ M q/p , which implies tp ∈ M q . Thus, H contains ω q (a) whenever p | a. As for the remaining cases, let a ∈ Z be such that

ϕ(q) 2 < a < q -ϕ(q)
2 and p a. Lemma 2.31 states that t=0,...,q-1 t≡a (mod q/p)

ω q (t) = ω q (ap) ∈ H. Since q -ϕ(q) 2 -ϕ(q) 2 = q
p , there is only one t in the sum on the left hand side satisfying ϕ(q) 2 < t < q -ϕ(q) 2 , namely t = a. All other summands are known to belong to H, and since we just proved that ω q (ap) ∈ H, we deduce ω q (a) ∈ H.

We have shown that H generates S q . Since M q = M - q , the theorem follows.

An alternative basis of S m : the general case

Now, we return to the general case where m = q 1 q 2 . . . q t ≡ 2 (mod 4). Let us fix i ∈ 1, t . Lemma 4.1 gives that

a ∈ M - m ; m qi | a = m qi • M - qi = mb qi ; p i b, 0 < b < qi 2 .
Since Cor Km/Kq i is an injective linear map, Pr. 4.4 and respectively Th. 4.6 combined with Eq. (2.29) imply that the sets

ω m (a); a ∈ m qi • M - qi ∪ 1 2 N m and ω m (b); b ∈ m qi • M qi ∪ 1 2 N m are Z-
bases of the same subgroup Cor Km/Kq i S qi of S m , so that there is an integral transition matrix between these bases of determinant ±1. We stress that the sets = 1, i.e., r b is the product of all q i , i ∈ 1, t which divide b, and write ω m (b) ∈ S m as a unique Z-linear combination of basis elements (4.10). Then, for each a ∈ M m such that r b a, the coefficient of ω m (a) in this Z-linear combination is equal to zero.

m qi • M - qi (resp. m qi • M qi ) for i ∈ 1, t are pairwise disjoint. Hence, it is natural to define M m = M - m \ t i=1 m qi • M - qi ∪ t i=1 m qi • M qi = a ∈ M - m ; ∀i ∈ 1, t , m qi a ∪ t i=1 mb qi ; 1 ≤ b ≤ ϕ(qi) 2 . ( 4
Finally, keeping in mind that ω m (a) = θ m (a) -1 2 N m if m a, we stress that all results of this whole section are equally valid when replacing ω m (•) by θ m (•), for example: Corollary 4.12. For any integer m > 1, m ≡ 2 (mod 4), the set = 1, i.e., r b is the product of all q i , i ∈ 1, t which divide b, and write θ m (b) ∈ S m as a unique Z-linear combination of basis elements (4.13). Then, for each a ∈ M m such that r b a, the coefficient of θ m (a) in this Z-linear combination is equal to zero.

θ m (a); a ∈ M m ∪ 1 2 N m (4.13) is a Z-basis of S m .

Short Basis of the Stickelberger Ideal

Elements of Z[G m ] are called short if they are of the form

σ∈Gm a σ σ ∈ Z G m ,
where a σ ∈ {0, 1} for all σ ∈ G m .

We first exhibit a large family of short elements of S m . Choosing carefully elements from this family yields a basis (4.22) of S m with almost only short elements and also our short basis (4.30) of the Stickelberger ideal S m = S m ∩ Z G m .

A family of short elements of S m

In this section, we construct numerous short elements of S m ⊂ S m which we shall use later on. (2.17)), we obtain

α = θ m (a) + θ m (b) -θ m (-c) = 0<s≤m (s,m)=1 -as m + -bs m -cs m σ -1 m,s .
Since 0 ≤ {x} < 1, every coefficient in the above sum is trivially bounded by

-1 < -as m + -bs m -cs m < 2. Moreover, let [x] = x -{x} ∈ Z be the integral part of x for any x ∈ Q. Then, -as m + -bs m -cs m = -(a+b+c)s m
--as m --bs m + cs m ∈ Z, which proves that α is short. The last equality of the proposition follows again from Eq. (2.17) and an easy observation that σ m,-1 θ m (a) = θ m (-a).

Bases of S m with many short elements

We first describe the map α m , which associates to any b ∈ Z, 0 < b < m, one short element from the family of Pr. 4.15. For any given b ∈ Z, let r b be the maximal divisor r of (b, m) satisfying the condition (r, m r ) = 1. In other words,

r b = i∈J b q i , where J b = i ∈ 1, t ; q i | b . Let J b = 1, t \ J b = i ∈ 1, t ; q i b
, and let us suppose that 0 < b < m so that J b = ∅. We define α m (b) as follows:

• If J b > 1, let u = q min J b , and v = m ur b . Since (u, v) = 1, the equation ux + vy = -1
has a solution x, y ∈ Z, where x is well-defined modulo v and y modulo u, so bux and bvy are well-defined modulo m. Let

α m (b) = θ m (b) + θ m (bux) + θ m (bvy) -N m . (4.16) • If J b = {j} then b = mc qj for a unique c ∈ Z, 0 < c < q j . If c > 1 we define α m (b) = θ m (-b) + θ m b -m qj + θ m m qj -N m , (4.17)
whereas if c = 1, so that b = m qj , we put

α m (b) = 2θ m m•ϕ(qj ) 2qj + θ m m pj -N m . (4.18)
Intuitively, α m (•) is constructed by means of layers on J b , similarly to what happens for M - m as shown by Lem. 4.1. For J b = 1, we follow the prime power case of Th. 4.6, which is very similar to [Sch08, Th. 9.3(i)] when m = p. For J b > 1 we use Bezout's equality to write -b as the sum of two summands bux and buy in such a way that both J bux and J bvy are strictly smaller than J b , so that both θ m (bux) and θ m (bvy) are generated by basis elements that were already chosen in the previous layers. Any way of achieving this property works. In particular, note that in the case J b > 1 we could use any other decomposition of m r b into the product of relatively prime integers u > 1, v > 1. + m pj = m.

Theorem 4.20. For any integer m > 1, m ≡ 2 (mod 4), the sets

α m (b); b ∈ M m , J b > 1 ∪ θ m (b); b ∈ M m , J b = 1 ∪ 1 2 N m , (4.21)
α m (b); b ∈ M m \ m q1 , . . . , m qt ∪ θ m m q1 , . . . , θ m m qt ∪ 1 2 N m (4.22) are Z-bases of S m .
Proof. By definition of α m (b) in Eqs. (4.16) and (4.17), we know that all elements of these sets belong to S m . We shall show that the transition matrices from the set (4.13) to the set (4.21) and from the set (4.21) to the set (4.22) are, after a suitable reordering of elements of M m , triangular with ±1 on the diagonal, which will prove the theorem.

At first, we deal with the transition matrix from the set (4.13) to the set (4.21) and we shall use induction with respect to J b . If J b = 1 then θ m (b) belongs to both sets (4.13) and (4.21). So suppose that J b > 1. Then the transition from θ m (b) to α m (b) given in Eq. (4.16) uses θ m (bux) and θ m (bvy) and the coefficient of θ m (b) is 1. By Cor. 4.14, θ m (bux) is a Z-linear combination of θ m (a) for a running over M m such that r bux | a. For these a's, we have that

J a ⊆ J r bux = J bux J b , since min J b / ∈ J bux

A basis of S m with only short elements

Recall that the Stickelberger ideal of K m is the intersection

S m = S m ∩ Z[G m ]. Let S m be the subgroup of S m generated by the set α m (a); a ∈ M m ∪ 1 2 N m . (4.23)
We shall prove that S m = S m + 1 2 N m • Z and that Eq. (4.23) is its basis. We shall start by computing its finite index in S m . First, we treat the prime power case.

72

Chapter 4. A Short Basis of the Stickelberger Ideal Lemma 4.24. Let q = p e > 2, where p is a prime and e is a positive integer. Then the index of S q in S q is finite and

[S q : S q ] = q 2 if p = 2, q if p > 2.
Proof. To obtain the index [S q : S q ], let us compute the transition matrix from

θ q (a); a ∈ Z, 1 ≤ a ≤ ϕ(q) 2 ∪ 1 2 N q , (4.25)
which is a Z-basis of S q by Cor. 4.12, to the system of generators of S q , i.e.,

α q (a); a ∈ Z, 1 ≤ a ≤ ϕ(q) 2 ∪ 1 2 N q . (4.26)
This transition matrix is given by Eqs. (4.18) and (4.17). More precisely, using also Eq. (2.17), we obtain in the studied special case that

α q (a) = θ q p e-1 + 2θ q ϕ(q) 2 -N q if a = 1, θ q (1) + θ q (a -1) -θ q (a) if 2 ≤ a ≤ ϕ(q)
2 . Since 1 2 N q belongs to both sets (4.25) and (4.26), we can ignore this element in the computation of the determinant of the transition matrix.

At first, let us assume that p > 3. Then p e-1 < p e-1 • p-1 2 = ϕ(q) 2 . We shall compute the determinant of the following square matrix of dimension ϕ(q)

2            0 0 0 0 • • • 1 • • • 0 0 2 1 0 0 0 • • • 0 • • • 1 -1 0 1 0 0 0 • • • 0 • • • 0 1 -1            , (4.27)
where the 1 in the first row belongs to the p e-1 th column (which is the first column if e = 1).

The sum of all rows but the first one, multiplied by 2, equals

ϕ(q) 0 0 0 • • • 0 • • • 0 0 -2 .
We add this row to the first row of our matrix. If e > 1, we also add to the first row the sum of all rows from the second one to the p e-1 th one, i.e., p e-1 0 0 0

• • • -1 • • • 0 0 0 .
After this computation we get a lower triangular matrix of determinant ±q. As this determinant is nonzero, the set (4.26) is a Z-basis of S q and the index [S q : S q ] equals the absolute value of the determinant. The lemma follows for p > 3. Now, suppose p = 3. Then p e-1 = ϕ(q) 2 and the square transition matrix of dimension 3 e-1 writes as

           0 0 0 0 • • • 0 0 3 2 -1 0 0 • • • 0 0 0 1 1 -1 0 • • • 0 0 0 1 0 1 -1 • • • 0 0 0 . . . . . . . . . . . . . . . . . . . . . 1 0 0 0 • • • 1 -1 0 1 0 0 0 • • • 0 1 -1           
.

If e = 1 then the only entry of our matrix of dimension 1 is 3. If e > 1, the sum of all rows but the first one, multiplied by 3, is equal to

3 e 0 0 0 • • • 0 • • • 0 0 -3 .
Adding this row to the first row, we again get a lower triangular matrix of determinant ±q, which gives the lemma in the case p = 3. Finally, we treat the case p = 2. Then, by Eqs. (2.16) and (2.17), we have θ q (2 e-1 ) = θ q (2 e-1 -q) = θ q (-2 e-1 ) = N q -θ q (2 e-1 ), so θ q (2 e-1 ) = 1 2 N q . Therefore we have got almost the same matrix as written in Eq. (4.27), except that in the first row the only non-zero element is the 2 at the very end. By the same approach as above, we obtain that the determinant of this matrix is equal to ±ϕ(q) = ± q 2 and the lemma in the case p = 2 follows.

Proposition 4.28. For any integer m > 1, m ≡ 2 (mod 4), the set (4.23) is a basis of S m , whose finite index in S m is given by

[S m : S m ] = m 2 if m is even, m if m is odd.
Proof. This is similar to the proof of Th. 4.9. The following sets are pairwise disjoint for i ∈ 1,

t mb qi ; b ∈ M qi = a; a ∈ M m , m qi | a .
Since Cor Km/Kq i is an injective linear map, the transition matrix from the Z-basis (4.21) of S m , given by Th. 4.20, to the system of generators (4.23) of S m is a block diagonal matrix, having (besides plenty of trivial blocks of dimension 1 containing 1) one nontrivial block for each i ∈ 1, t . For a given i, the nontrivial block is equal to the matrix considered in Lem. 4.24 for q = q i . Since the determinant of this transition matrix is equal to the product of determinants of these nontrivial blocks, it is nonzero and the proposition follows.

We are now ready to state our main theorem, which in particular implies the afore-mentioned relation S m = S m + 1 2 N m • Z.

h - m ≤ 2 1-a • ϕ(m) 8 ϕ(m)/4 ,
where ϕ() is Euler's totient function and

a = 0 if t = 1, 2 t-2 -1 if t ≥ 2.
(4.33)

Proof. Recall that, for any integer s relatively prime to m, σ m,s ∈ G m denotes the automorphism of the m-th cyclotomic field K m sending any m-th root of unity to its s-th power. In particular, σ m,-1 is the restriction of the complex conjugation. Following Sinnott, let R m = Z[G m ] and

R - m = {α ∈ R m ; (1 + σ m,-1 )α = 0}, A m = {α ∈ R m ; (1 + σ m,-1 )α ∈ N m Z}.
Moreover, for any submodule M ⊆ R m we define

M -= M ∩ R - m . Using [Sin80, Lem. 1.2(a)], multiplication by 1 + σ m,-1 gives [A m : S m ] = [(1 + σ m,-1 )A m : (1 + σ m,-1 )S m ] • [A - m : S - m ]. It is clear that (1 + σ m,-1 )A m = (1 + σ m,-1 )S m = N m Z and that A - m = R - m .
Therefore, using [Sin78, Th., p.107] and the remark following Lem. 2.19, we have

[A m : S m ] = [R - m : S - m ] = 2 a • h - m , (4.34)
where a is defined by Eq. (4.33). We use our short basis Eq. (4.30) of S m given in Th. 4.29 to get a bound on [A m : S m ]. First, a Z-basis of A m is given by

β m (s); 1 ≤ s < m 2 , (s, m) = 1 ∪ γ m , (4.35)
where β m (s) = σ m,s -σ m,-s and

γ m = 1≤s< m 2 (s,m)=1 σ m,s .
An easy calculation gives determined by the condition that χ L (a) belongs to the class a (N (L)-1)/m . We extend as usual characters to F by setting χ L (0) = 0. For any integer b, we have the following Gauss sum, where Tr : F → F is the trace map in the field extension F F ,

N m = 2γ m - 1≤s< m 2 (s,m)=1 β m (s).
g L (b) = - y∈F χ L (y) b ζ Tr(y) ∈ Z[ζ m ].
For any integers u ≡ 1 (mod m), u, and v ≡ 1 (mod ), (v, m) = 1, an easy computation gives (see e.g., [START_REF] Sinnott | On the Stickelberger ideal and the circular units of an abelian field[END_REF](3.3) and (3.5)])

σ m ,u g L (b) = χ L (u) -b • g L (b), ( 4
α = θ m (a) + θ m (b) -θ m (a + b) ∈ Z[G m ]
be one of the short elements given by Pr. 4.15. Then the Jacobi sum

J L (a, b) = - y∈F χ L (y) a χ L (1 -y) b ∈ Z[ζ m ] satisfies J L (a, b) • Z[ζ m ] = L α .
Proof. By [Was97, Lem. 6.2(d)], we have

J L (a, b) = g L (a)g L (b) g L (a + b) .
Thus, the result directly follows from Eq. (4.40) and the fact

J L (a, b) ∈ Z[ζ m ].
As an example of application of Pr. 4.41, let us consider any b ∈ M m such that J b > 1. Then the short element α m (b) is given by Eq. (4.16), so that

L αm(b) = J L (bux, bvy) • Z[ζ m ],
where u = q min J b , v = m ur b , and x, y ∈ Z satisfy ux + vy = -1. Furthermore, it is clear that u, v, x, y do not depend on b but only on J b . Therefore, having another c ∈ M m such that J c = J b , there is an integer s relatively prime to m satisfying c ≡ sb (mod m), so that Eq. (4.39) gives J L (cux, cvy) = J L (sbux, sbvy) = σ m,s J L (bux, bvy) .

Hence, computing generators of L αm(b) , for all b ∈ M m with J b > 1, comes down to the computation of exactly one representative Jacobi sum per set J b , then applying a suitable automorphism to obtain the generator for L αm(c) whenever J c = J b .

Practical Results

We implemented in practice the computation of our short Stickelberger bases from Th. 4.29 using SageMath [START_REF]Sage Developers: SageMath, the Sage Mathematics Software System (Version 9.0)[END_REF] on an Intel ® Core™ i7-8650U @3.2GHz.

All involved algebraic criteria are very easy to compute, so that obtaining the short bases is actually a matter of seconds for any reasonable conductor. We verified, for all conductors m < 10000, m ≡ 2 (mod 4), such that ϕ(m) ≤ 2000, that the Hermite Normal Form (HNF) of the short basis from Th. 4.29 coincides with the HNF of the large basis from [Kuč92, Th. 6.2].

We stress that using a naive trial-and-error strategy to extract a short basis from a large set of short vectors, e.g., from the set W of [CDW21, §4.2], may converge only after a huge number of iterations, each involving the computation of a costly HNF. This is especially hazardous when the number of prime divisors of m grows, e.g., our brute force experiment for m = 780 = 2 2 • 3 • 5 • 13 never finished despite the relatively small dimension ϕ(m) = 192.

More interestingly, we used the determinant formula for A m : S m given in Eq. ( 4.36) to derive the relative class number h - m from Eq. (4.34). We checked, for the same range of conductors as above, that the obtained values coincide with the values given by the analytic class number formula given in Eq. (2.10). Surprisingly, we observed that the determinant computation is very competitive, especially when the number of distinct prime factors of m is small. Some comparative timings are provided in Tab. 4.1. Finally, we verified that relations L αm(b) = J L (a 1 , a 2 ) • Z[ζ m ] hold true in small dimensions (up to ϕ(m) = 80). We note that computing explicitly such generators using the Jacobi sum formalism is very easy for any m. For instance, taking m = 2003 and = 48073 ≡ 1 (mod m), the computation of all ϕ(m)/2 generators corresponding to L αm(b) , for all b ∈ M m and some L above takes under 15 minutes, i.e., less than 1 second per generator.

m q 1 . . . q t ϕ(m) Time h - m (s) Analytic [A m : S m ]
By contrast, using suitable combinations of Gauss sums to obtain e.g., generators for the relations L (a-σm,a)•θm(-1) of [Was97, 6.9] imposes to work in Q ζ m . Even using all available algorithmic tricks, such as using sparse polynomials modulo x m -1, replacing divisions by the use of the identity g L (b) • g L (-b) = ±N (L) [Was97, 6.1(b)] and profitting from Eq. (4.39), this is arguably intractable in the above case when m = 96 290 219, and still takes over 39 seconds per generator when restricting to the first split prime = 4007.

Chapter 5

Log-S-unit Lattices Using Explicit Stickelberger Generators to Solve Approx Ideal-SVP

Introduction

Even though the theoretically proven trade-off between runtime and approximation factor is the same for the Twisted-PHS algorithm as for the PHS algorithm (see Th. 3.1 and 3.14), experimentally, very significant improvements compared to the original PHS algorithm are illustrated in Fig. 3.4 and 3.5. In particular, the implementation provided in GitHub: ob3rnard/Twisted-PHS 7 allowed us to test the Twisted-PHS algorithm in number fields of degree up to 60, while achieving much better approximation factors than the original [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF] implementation. However, reaching larger degrees was limited by the classical complexity of the algorithm.

Our contributions

Our first contribution is to succeed in performing new experiments on the Twisted-PHS algorithm, in almost all cyclotomic fields up to degree 210, thanks to a novel approach which allows us to significantly improve the running time of the preprocessing phase. The approximation factors obtained in our experiments, as detailed in Fig. 5.1, show that the Twisted-PHS algorithm performs much better (over the considered experimental range) than the CDW algorithm, which was the previously best-known algorithm. More interestingly, the obtained approximation factors are comparable to the volumetric lower bound for the CDW algorithm experimentally obtained in [START_REF] Ducas | On the shortness of vectors to be found by the Ideal-SVP quantum algorithm[END_REF] in the prime conductor case, and sometimes even smaller. We stress that one main goal of our experiments is to break the small dimension barrier and reach ranges of parameters where asymptotic phenomena -e.g., the exponential growth of the class number -start to express. Though experimental data as the one we obtain are not enough to provide an asymptotical result concerning the approximation factor, we stress that pushing experiments up to degree 210 is a significant breakthrough, and to our knowledge, no other experiments of S-unit attacks beyond degree 70 have been publicly reported two years after those presented in Ch. 3. We run the (practical version of the) Twisted-PHS algorithm using full-rank log-S-unit sublattices on simulated random targets to see how the final approximation factor evolves with the dimension in our regime. Additionally, we compute several geometrical parameters on the basis obtained by our implementation to study their quality, as done in §3.4: the root-Hermite factor δ 0 , the orthogonality defect δ and the logarithm of the Gram-Schmidt norms. We are able to confirm the peculiar geometric nature of the log-S-unit lattice already observed in § §3.4.1 and 3.4.2, across all considered cyclotomic fields, sublattices and factor bases. These recurrent observations in very different regimes suggest that this phenomenon has a possibly deep explanation, an observation that has been recently developed by Bernstein and Lange [START_REF] Bernstein | Non-randomness of S-unit lattices[END_REF]. For example, to give an idea of the striking ease of reduction of these log-S-unit sublattices, we report that in our biggest field example, BKZ 40 terminates in around 7 minutes (resp. 30) for our lattices in dimension 1154 (resp. 1574), which is unusually fast at these dimensions. Moreover, we provide a full implementation, which is publicly available at GitHub: ob3rnard/Tw-Sti 8 .

Due to the classical complexity of computing S-units, reaching degrees beyond 100 is not directly possible using the algorithms given in Ch. 3, and is the result of both theoretical and implementational improvements. We compute full-rank sublattices of the log-S-unit lattice for cyclotomic fields K m of any conductor m from degree 20 up to degree 210. To obtain these results, our main theoretical contribution is to exhibit in §5.2 a full-rank family of independent Sunits lifted from the maximal real subfield K + m of K m . One step of this construction is to use explicit Stickelberger generators that are easy to compute using Jacobi sums, as shown in §4.5 and specialized in §5.2.1 with additional insights. Hence, we obtain a full-rank sublattice of the log-S-unit lattice, at the much lower cost of computing class group relations in the maximal real subfield of half degree. We also provide in Th. 5.14 a closed formula for the multiplicative index of this full-rank family inside the whole S-unit group. This index allows to quantify the comparison between our new approach and the previous one from Ch. 3. Though we first obtain sublattices of large index in the full log-S-unit lattice, we are able to mitigate it by using classical saturation techniques recalled in §5.2.4.

As a minor contribution, we apply these results to show in §5.3 how to benefit from these explicit Stickelberger generators to remove most quantum steps of the CDW algorithm [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF]. Namely, we remove the last Pip resolution, and also, under a relatively harmless restriction that the plus part of the class number verifies h + m ≤ O( √ m) (Hyp. 5.18), the random walk to the relative class group, replaced with a single call to a quantum class group computation in dimension ϕ(m)/2. The latter should also yield in practice better approximation factors, by allowing to choose the finite places of S of smallest possible norms.

Technical overview

Let S be a set of places where the finite places correspond to a collection of full Galois orbits of split prime ideals. Our full-rank family F of independent S-units is composed of three parts:

1. circular units, defined e.g., in [Was97, §8] and for which an explicit basis can be found in [Kuč92, Th. 6.1]; 2. Stickelberger generators, as explicitly given by the proof of Stickelberger's theorem, see for example [Sin80, Eq. (3.4)]; 82 Chapter 5. Using Explicit Stickelberger Generators 3. real S + -units (apart from real units), where S + is the set S ∩ K + m of places of S restricted to the maximal real subfield K + m of K m . In the context of the cryptanalysis of id-Svp, the set of circular units has already been used to reduce the size of principal ideal generators in [START_REF] Cramer | Recovering short generators of principal ideals in cyclotomic rings[END_REF][START_REF] Cramer | Short Stickelberger class relations and application to Ideal-SVP[END_REF] for m being a prime power, in [START_REF] Holzer | Recovering short generators of principal fractional ideals in cyclotomic fields of conductor p α q β[END_REF] when m has two distinct prime factors and finally in [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF] in the general case. Using free relations in the class group Cl m coming from Stickelberger's theorem was suggested in [START_REF] Cramer | Short Stickelberger class relations and application to Ideal-SVP[END_REF][START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF], where many short relations were identified [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF]Lem. 4.4]. For the first time, we use for cryptanalysis the main results from Ch. 4:

• the knowledge of an explicit short Z-basis of the Stickelberger ideal for any conductor from Th. 4.29, • the effective computation of generators corresponding to these short relations, using Jacobi sums as in §4.5. Compared to [START_REF] Cramer | Short Stickelberger class relations and application to Ideal-SVP[END_REF][START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF], we stress that only knowing a short generating set of the Stickelberger ideal is not necessarily sufficient for our purpose. Indeed, though it would be possible to build a basis from such a generating set to solve the Cvp like in [CDW21, Cor. 2.2] without any geometric loss, using e.g., [START_REF] Micciancio | Complexity of Lattice Problems[END_REF]Lem. 7.1], the slight Euclidean norm growth of the obtained basis vectors however translates into a dramatic increase of the size of the (possibly rational) coefficients of the corresponding generators, in a way that significantly hinders subsequent computations. In particular, in order to climb dimensions as far as possible and best approach log-S-unit lattices using the saturation process described in §5.2.4, it is crucial to constrain both the number of elements we use and their size, i.e., to use a short basis of the Stickelberger lattice. As for the last part, obtaining a full-rank lattice of class relations was done in [START_REF] Cramer | Short Stickelberger class relations and application to Ideal-SVP[END_REF] using relative norm relations N Km/K + m (L) = L 1+τ , where the L's are chosen in the relative class group, to obtain the so-called "extended Stickelberger lattice". We extend this result by considering the lattice of all real class relations between the relative norms of ideals of any class.

The multiplicative index of this family in the full S-unit group is explicitly given by our Th. 5.14. This index contains a large power of 2 that can be removed using classical 2-saturation techniques of §5.2.4, leading to a family F sat .

Removing quantum steps from the CDW algorithm.

In the context of the CDW algorithm, we first propose in §5.3 an equivalent rewriting of [CDW21, Alg. 7] that enlightens some hidden steps that reveal useful for subsequent modifications. Then, we plug the explicit Stickelberger generators and real generators described above to remove the last call to the quantum Pip solver. Finally, by considering the module of all real class group relations, we remove the need of a random walk mapping any ideal of K m into Cl - m , at the small price of restricting to cyclotomic fields such that h + m ≤ O( √ m) (Hyp. 5.18), whereas [CDW21, Ass. 2] uses h + m ≤ poly(m). Then, only two quantum steps remain: the first is performed only once in dimension ϕ(m) 2 to compute real class group relations and generators, the second is for solving the ClDlp for each query.

Simulating the Twisted-PHS algorithm.

Finally, we apply the practical version of the Twisted-PHS algorithm from §3.3 on our full-rank sublattices of the log-S-unit lattice. This is actually an approximated mode of the Twisted-PHS algorithm, as Twisted-PHS normally uses the full log-S-unit lattice for an optimal number of orbits d = d max maximizing the density of the full log-S-unit lattice, as predicted by Alg. 3.3, which we estimated using the analytic class number formula. However, in our case, the family F sat has index roughly (h - m ) d-1 , which is sufficiently large so that this optimal factor base phenomenon does not hold. More precisely, the density of the log-S-unit sublattice associated to F sat decreases as soon as d > 1.

We fully implement the construction of the lattices associated to F, F sat and to fundamental elements of the full S-unit group F su when available (up to degree 80) for the first d split prime orbits with d ∈ 1, d max , including the computation of Stickelberger generators and real generators. We evaluate the geometry of all these lattices with standard indicators described in §2.4.3, and observe consistently the same phenomenons already observed in § §3.

An Explicit Full-Rank Family of Independent S-units

In this section, we exhibit a full-rank family of independent S-units, where the finite places of S correspond to a collection of full Galois orbits of split prime ideals. As mentioned in introduction, this family is composed of three parts: 1. Circular units are given in §2.2.4 using the material from [Kuč92, Th. 6.1]; 2. Stickelberger generators are given in §4.5 in the general case, and specialized in §5.2.1 in the split case together with additional remarks on their complex embeddings and on how our short basis relates to the results of [CDW17, CDW21]; 3. Real S + -units (apart from real units), where S + = S ∩ K + m , are in §5.2.2. Considering real S + -units and proving in §5.2.3 the multiplicative index of our family in the full S-unit group constitute our main theoretical contributions. Finally, the saturation process used to mitigate this index is described in §5.2.4. Remark 5.2. Recall that the prime factorization of m ≡ 2 mod 4 is written as m = q 1 q 2 • • • q t , where q i = p ei i > 2 for i ∈ 1, t . The rest of the section uses the subsets M + m and M m of 1, m from resp. §2.2.1 and Eq. (4.8) to describe resp. a fundamental family of circular units and a short Z-basis of the Stickelberger ideal of K m .

Stickelberger generators

Recall from §2.2.5 that the Stickelberger ideal provides free relations in the class group of K m , by Stickelberger's fundamental theorem Th. 2.22. In this section, we essentially rephrase Pr. 4.15 and Th. 4.29, giving additional insight on how these results relate to [START_REF] Cramer | Short Stickelberger class relations and application to Ideal-SVP[END_REF][START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF].

A short basis of the Stickelberger lattice.

An element of the integral group ring

Z[G m ] is called short if it is of the form σ∈Gm a σ σ in Z[G m ],
where a σ ∈ {0, 1} for all σ ∈ G m . Short elements of S m have been identified in sums corresponding to the short basis α m (c); c ∈ M m is very fast. As noted in §4.5, the Galois group also acts on the involved Jacobi sums in a way that allows to replace some of the Jacobi sum computations by the application of a suitable automorphism.

Finally, as a direct consequence of [Was97, Lem. 6.1], all these Jacobi sums are -Weil numbers, i.e., they verify the Weil relation J L (a, b)J L (a, b) = , for a and b as above. This implies that for all σ ∈ G m , we actually have σ J L (a, b) = √ , meaning that any of these elements is the shortest generator of its corresponding ideal L α , which has algebraic norm ϕ(m)/2 . Remark 5.7. By Eq. ( 5.3), generators corresponding to the short relations of W write as:

J L (1, a) • O Km = L wa ,
for any a ∈ 2, m -1 .

Real S + -units

Since M m = ϕ(m) 2 , a consequence of Th. 5.5 is that the Stickelberger lattice has rank ϕ(m)

2

+ 1 in Z G m ; in particular, it is not full rank, hence cannot be directly used as a lattice of class relations. In previous works, obtaining a full-rank lattice in Z[G m ] from S m was done by projecting into (1 -τ )S m [CDW21, §4. We generalize this result by considering the module of all real class group relations between relative norm ideals of ideals from the entire class group Cl m . In §5.2.3, we shall prove that the Stickelberger lattice augmented with these real class group relations yields a lattice of class relations for the whole class group. Note that, as opposed to other modules like (1 -τ )S m or S m + (1 + τ )Z G m , real class group relations actually depend on the underlying prime ideals.

On one hand, this affects negatively the shortness of the obtained relation vectors: putting those in Hermite Normal Form, we shall see later that each relation, viewed as a vector of integer valuations, has 2 -norm at most h + m . On the other hand, removing the constraint to belong to the relative class group brings a significant practical and theoretical gap: first, it allows to choose prime ideals of smallest possible norms, which as shown in §3.2.3 or [CDW21, Th. 4.8] lowers in practice the obtained approximation factor; second, whereas prime ideals of norm at most Bach's bound are sufficient to generate the entire class group, prime generators for the relative class group are only proven to be of norm bounded by the larger bound (2.71

• h + m • ln ∆ Km + 4.13) 2 from [Wes18].
Lifting real class group relations.

Let 1 , . . . , d be distinct prime integers satisfying i ≡ 1 mod m, so that i splits in K m . For

each i ∈ 1, d , fix a prime ideal L i | i in K m of norm i , and let l i = N Km/K + m L i = L 1+τ i ∩ K + m be the relative norm ideal of L i . Since L i is a split prime ideal of K m dividing i , the ideal l i is a split prime ideal of K + m of norm i ,
σ i = L (1+τ )σ i ∩ K + m , for any σ ∈ G m .
We are interested in the real class group relations between all prime ideals in the G + m -orbits of the l i , i.e., between the following prime ideals of K + m :

l σs i ; i ∈ 1, d , 0 < s < m 2 , (s, m) = 1 . ( 5
+ τ ) • r 1 , . . . , (1 + τ ) • r d in K m between prime ideals in the G m -orbits L σ i ; i ∈ 1, d , σ ∈ G m as: γ + r • O Km = d i=1 L (1+τ )ri i .
(5.9)

Let C + l1,...,l d denote the lattice of all real class group relations between elements of the G + morbits of {l i ; i ∈ 1, d }. Concretely, it is the kernel of the following map:

f l1,...,l d : r i,s 1≤i≤d, 0<s<m/2,(s,m)=1 ∈ Z d• ϕ(m) 2 -→ i,s l σs i ri,s ∈ Cl + m . (5.10) Using the canonical isomorphism of Z-modules Z d• ϕ(m) 2 Z Z[G + m ] d ,
+ τ )Z[G m ] d .

Euclidean norm of real class relations.

We now identify a real class group relation from C + l1,...,l d to a vector in Z d• ϕ(m)

2

. In other words, we consider only the valuations of these relations on the G + m -orbits of the prime ideals l 1 , . . . , l d . Furthermore, C + l1,...,l d is put in Hermite Normal Form, conveniently for the proof, but better bounds might easily be obtained using e.g., the LLL algorithm. Proposition 5.12. Suppose the lattice C + l1,...,l d of real class relations is in HNF. Then, for all w ∈ C + l1,...,

l d ⊆ Z[G + m ] d , we have w 2 ≤ w 1 ≤ h + m .
This means that (1 + τ ) • C + l1,...,l d can be used in the CDW algorithm instead of (1 + τ )Z[G m ], as we will see in §5.3, while still reaching the same asymptotic approximation factor as long as h + m ≤ O ϕ(m) (Hyp. 5.18). This slightly more restrictive (see the discussion in §2.2.3) hypothesis will be more than compensated by the fact that it removes the need for the l i 's to be principal, which has a significant impact in practice on the algebraic norm of the chosen ideals, and thus on the final approximation factor reached in [CDW21, Alg. 6].

Proof. The image of the map f l1,...,l d given in Eq. (5.10) is a subgroup of Cl + m , so the volume of its kernel C + l1,...,l d is at most h + m . By definition of the Hermite Normal Form, 19 C + l1,...,l d has diagonal elements h 1 , . . . , h ϕ(m)/2 > 0, and the j-th column contains integers c ij such that 0 ≤ c ij < h j for i < j and c ij = 0 for i > j. We shall prove h

i + i<j c ij ≤ h i • i<j h j for any row of fixed index i ∈ 1, ϕ(m)

2

, which yields the result. This is done by induction on the dimension, using repeatedly the fact that for any integers x, y ≥ 1, x + (y -1) ≤ (xy). 19 In this proof, we consider an upper-triangular HNF with row vectors.

Explicit real generators.

For each relation r = r 1 , . . . , r d ∈ C + l1,...,l d , we compute an explicit γ + r ∈ K + m K m that verifies Eq. (5.9). Together with the unit group O × K + m of K + m , they form a fundamental system of S + -units, where the finite places of S + are the G + m -orbits of the relative norm ideals l i . In the next section, we shall see that adding the explicit Stickelberger generators of §5.2.1 to these real generators yields a maximal set of independent S-units in the degree ϕ(m) cyclotomic field K m , at the much smaller cost of computing a fundamental system of real S + -units in K + m of degree only ϕ(m) 2 . In practice, though this remains the main bottleneck of our experimental setting, it allows us to push effectively our experiments up to degree ϕ(m) = 210, whereas the (full) S-units computations of §3.4 were bound to ϕ(m) = 70.

An S-unit subgroup of finite index

As in §5.2.2, let 1 , . . . , d be prime integers satisfying i ≡ 1 mod m; for each i, fix a (split) prime ideal L i | i in K m and let l i = L i ∩ K + m . Let S be a set of places containing, apart the infinite places of K m , all G m -orbits of the L i 's. Combining the results of § §2.2.4, 5.2.1 and 5.2.2, we get the following family of S-units:

F = v a ; a ∈ M + m ∪ γ - Li,b ; i ∈ 1, d , b ∈ M m ∪ γ + r ; r ∈ C + l1,...,l d (5.13)
where the first set is the set of circular units given by Th. 2.14, the second is the set of explicit Stickelberger generators stated at the end of §5.2.1 and the last one is the set of real generators as in Eq. (5.9). This family has ϕ(m)/2 -1 + d • ϕ(m) elements, which matches precisely the multiplicative rank of the full S-unit group modulo torsion O × Km,S µ O × Km . 20 In this section, we prove that these S-units are indeed independent and we compute the index of the subgroup of O × Km,S generated by those elements.

h m • h + m,(l1,...,l d ) h m,(L1,...,L d ) • 2 b • h - m d-1 • 2 ϕ(m) 2 -1 • 2 a d ,
where a = b = 0 if m is a prime power, and a = 2 t-2 -1, b = 2 t-2 + 1 -t whenever m has t distinct prime divisors.

Note that when the G m -orbits of the L i 's generate Cl m , the first term in this index equals h + m . As we shall see in §5.2.4, the powers of 2 can be killed by standard saturation techniques, so the real problem comes from the (h - m ) d-1 part, which has generically huge prime factors. Intuitively, this comes from the fact that the Stickelberger relations miss all class group relations that exist between two (or more) distinct G m -orbits.

First, we show that the lattice obtained by adding one copy of the Stickelberger ideal for each G m -orbit, to the lattice (1 + τ ) • C + l1,...,l d of real class relations, yields a full-rank submodule

Z[G m ] : S m + (1 + τ ) • C + l = 2 ϕ(m)/2-1 • 2 a • h - m • h + m,(l) ,
where a = 0 if t = 1 and a = 2 t-2 -1 otherwise, where m has t prime divisors.

Proof. By definition of C + l as the kernel of the map f l of Eq. (5.10), we have:

Z[G + m ] : C + l = h + m,(l) = (1 + τ ) • Z[G + m ] : (1 + τ ) • C + l .
Note also that N m belongs to (1 + τ )

• C + l ⊆ (1 + τ ) • Z[G + m ]
, hence, again by means of transition matrix:

S m + (1 + τ ) • Z[G + m ] : S m + (1 + τ ) • C + l = (1 + τ ) • Z[G + m ] : (1 + τ ) • C + l .
Finally, putting things together with Lem. 5.15, the result comes from:

Z[G m ] : S m + (1 + τ ) • C + l = Z[G m ] : S m + (1 + τ ) • Z[G + m ] • S m + (1 + τ ) • Z[G + m ] : S m + (1 + τ ) • C + l = 2 ϕ(m)/2-1 • 2 a • h - m • Z[G + m ] : C + l .
Finally, for the case where there are d ≥ 1 orbits, a reasoning very similar to the proofs of Lem. 5.15 and 5.16 leads to: Proposition 5.17. Let h + m,(l1,...,l d ) be the cardinal of the subgroup of Cl + m generated by all G + morbits of l 1 , . . . , l d . Then, the Z-module generated by the lattice

(1 + τ ) • C + l1,...,l d ⊆ (1 + τ ) • Z[G + m ] d of
real class relations between the G m -orbits of the L i 's, and the diagonal block matrix of d copies of S m \ N m Z , verifies:

Z[G m ] d : S d m + (1 + τ ) • C + l1,...,l d = 2 ϕ(m)/2-1 • 2 a • h - m d • h + m,( l1
,...,l d ) . Proof of Th. 5.14. The independence comes from Pr. 5.17 and the trivial fact that circular units are independent from Stickelberger and real generators. The index of the subgroup generated by F in O × Km,S µ O × Km is given by:

O × Km : C m • Z[G m ] d : S d m + (1 + τ ) • C + l1,...,l d det ker f S ,
where ker f S is the lattice of all class group relations between finite places of S. The first term is given by Pr. 2.12, the numerator of the second term is given by Pr. 5.17, and by definition of O × Km,S , the denominator is precisely h m,(L1,...,L d ) . Rearranging terms adequately yields the result.

Saturation

Saturation is a standard tool of computational algebraic number theory that has been used in various contexts like unit and class group computations, and can be traced back at least to [PZ89, §5.7].

Intuitively, the e-saturation procedure applied to F consists in detecting e-th powers in the subgroup generated by F, including their e-th roots in the set, using e.g., the generalized Montgomery's e-th-root algorithm from [Tho12, §3], and rebuilding a basis of multiplicatively independent elements. At the end, the index of the new basis is no longer divisible by e. Remark that the output size does not depend on e, but only on the number and size of the elements of F. However, as the relative class number h - m in the index of Th. 5.14 hides huge prime factors, this strategy is at first glance hopeless in general to obtain the full S-unit group from F.

As the index given by Th. 5.14 is divisible by a large power of 2, it is nonetheles natural to 2saturate F in order to mitigate its exponential growth, obtaining the 2-saturated family F sat . In the following, we briefly describe the 2-saturation procedure we use, and refer to e.g., [BFHP21, §4.3] for a formal exposition.

Chapter 5. Using Explicit Stickelberger Generators

Recognizing squares.

Let U = g 1 , . . . , g k be a finitely generated multiplicative subgroup of O × Km,S . The first step of the 2-saturation process is to recognize squares in U ∩ (O × Km,S ) 2 . This is done by using local information provided by quadratic characters.

Fix a prime p / ∈ S such that N (p) ≡ 1 mod lcm(m, 2). Define χ p as the Legendre symbol such that χ p (a) ≡ a (N (p)-1)/2 mod p for any a ∈ U . As p / ∈ S and a ∈ O × Km,S , we have that χ p (a) ∈ {-1, 1}. If a is a square, χ p (a) = 1 as a is still a square modulo p. The converse is not true, but by considering many characters χ p1 , . . . , χ p N as above, it is expected that at least one of them evaluates to -1. Hence, recognizing squares boils down to compute the kernel of:

log -1,χ : U -→ F N 2 a -→ log -1 χ pi (a); i ∈ 1, N .
An element of this kernel is still not guaranteed to be a square. Nevertheless, a standard heuristic, first stated in the context of integer factorization [BLP93, §8] and also used in multiquadratic fields [BBV + 17, §4.2], [BV18, Heur. 4.3], is to assume that if the p i are all distinct (split) prime ideals, then the log -1 χ pi behave as independent uniform random elements of Hom U U ∩ (K × m ) 2 , F 2 . Concretely, this means that these should span this dual with probability at least 1 -1/2 N -k [BLP93, Lem. 8.2]; in that case, any element of the kernel of log -1,χ is indeed a square. In other words, if 1≤i≤k v i log 1,χ g i = 0, then with high probability the product g = 1≤i≤k g vi i indeed belongs to U ∩ (O × Km,S ) 2 .

Square roots algorithm.

Once we have identified combinations of elements of U that are S-unit squares, it remains to compute their square roots explicitly. First, we note that it is useful to systematically reduce those products modulo all squared circular units C 2 m to contain the coefficients size. This is done as usual by projecting the logarithmic embedding Log g of the obtained g ∈ (O × Km,S ) 2 into 2 • Log C m , finding a closest vector y = Log u 2 and replacing g by g/u 2 .

The traditional method to compute the square root of an element g ∈ (K × m ) 2 is to factor the polynomial x 2 -g in K m [x], using e.g., Trager's method [Coh93, Alg. 3.6.4] or Belabas' padic method [START_REF] Belabas | A relative van Hoeij algorithm over number fields[END_REF]. As, according to Th. 5.14, we have many square roots to compute, we choose instead to use a batch strategy in the spirit of [LPS20, Alg. 5] using complex embeddings approximations.

Since LLL seminal paper [START_REF] Lenstra | Factoring polynomials with rational coefficients[END_REF], it is known that one can retrieve an algebraic number from approximations of one of its complex embeddings. Indeed, fix an embedding σ ∈ G m and a Q-basis ω 1 , . . . , ω n of O Km , and LLL-reduce:

B κ :=       -σ(ω 1 ) C 0 . . . 0 -σ(ω 2 ) 0 C . . . . . . . . . . . . . . . . . . 0 -σ(ω n ) 0 . . . 0 C       .
where C > 0 is a constant and approximations are computed at precision κ ∈ N. Then, for any g ∈ O Km , applying e.g., Babai's Nearest Plane algorithm on the LLL basis of B κ and target σ(g), 0, . . . , 0 gives a combination (g 1 , . . . , g n ) such that g = n i=1 g i ω i . As explained in [START_REF] Lesavourey | Short principal ideal problem in multicubic fields[END_REF], it is possible to mutualize the computation of B κ and reuse the unitary transformation to hasten computations when increasing κ is required.

We use an improvement that benefits from the existence of the maximal real subfield K

+ m . Each g ∈ K m = K + m [ζ m
] can be uniquely written as g = g 0 + g 1 • ζ m , with g 0 , g 1 ∈ K + m . For each σ ∈ G + m , the relative Minkowski embedding of σ w.r.t. to the extension K m /K + m is defined by σ Km/K + m (g σ 0 , g σ 1 ) = g σ , g σ ∈ C 2 . This is a linear homomorphism of C 2 . When g = h 2 , its square root h 0 + h 1 ζ m can be retrieved from approximations of h σ 0 and h σ 1 instead of h σ , as follows:

1. Compute σ Km/K + m (g σ 0 , g σ 1 ) = g σ , g σ ∈ C 2 ; 2. Choose one complex square root z of g σ and apply σ -1 Km/K + m to (z, z) to get potential approximations hσ 0 , hσ 1 of h σ 0 and h σ 1 respectively; 3. Using LLL as above in K + m on hσ 0 and hσ 1 , obtain h0 , h1 in K + m , which are candidates for resp. h 0 and h 1 . 4. If ( h0 + h1 • ζ m ) 2 = g, then increase κ using the fast method of [START_REF] Lesavourey | Short principal ideal problem in multicubic fields[END_REF]. Hence, this method amounts to LLL reducing a matrix of size n 2 × ( n 2 + 1) and decoding using e.g., Babai's Nearest Plane algorithm. This offers a great speed-up compared to reducing a matrix of size n × (n + 1). For further details and generalizations to higher order polynomial roots, we refer the interested reader to [START_REF] Lesavourey | Usability of structured lattices for a post-quantum cryptography: practical computations, and a study of some real Kummer extensions[END_REF].

Rebuilding a basis.

After the square root step, we obtain new elements h 1 , . . . , h r , where r = dim ker log -1,χ . In order to extract a set of k independent elements from the extended set h 1 , . . . , h r , g 1 , . . . , g k , we compute an LLL-basis of the matrix constituted of their valuations at the places of S. Note that this matrix can be computed entirely from the valuations of the initial set {g i } and the basis of ker log -1,χ . Using the same trick as for matrix A in [BBV + 17, Alg. 5.2], this contains the height of the transformation matrix, sufficiently for our needs.

At the end of this process we obtain a maximal set of independent S-units of index given by Th. 5.14 where no factor 2 remains.

Removing Quantum Steps from the CDW Algorithm

The complete material for this section is given in [BLNR21, §B], and the main points are briefly summarized here. The CDW algorithm for solving Approx-Svp was introduced in [CDW17] for cyclotomic fields of prime power conductors, and extended to all conductors in [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF]. Its main feature is the use of some short relations of the Stickelberger ideal.

In this section, we show how to benefit from the results of §5.2.1 and §5.2.2 to remove most quantum steps of [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF]. More precisely, we first propose in [BLNR21, §B.2] an equivalent rewriting of [CDW21, Alg. 7] that enlightens some hidden steps that reveal useful for subsequent modifications. Then, in [BLNR21, §B.3], we plug the explicit generators of §5.2.1 and Eq. (5.9), for relative class group orbits, to remove the last call to the quantum Pip solver. Finally, by considering the module of all real class group relations, using Pr.

α = (α 1 , . . . , α d ) ∈ Z[G m ] d such that ab • i L αi i is principal. 3. Solve the Cpmp by projecting each α i in π(S m ) = (1 -τ )S m , find a vector v i = y i • π(S m )
close to π(α i ), and then lift v i to get some β i s.t. π(β i ) = v i , α -β 1 is small with positive coordinates and ab • i L αi-βi i is principal. 4. Apply the Pip algorithm of [START_REF] Biasse | Efficient quantum algorithms for computing class groups and solving the principal ideal problem in arbitrary degree number fields[END_REF] to get a generator of this principal ideal. 5. Reduce the obtained generator by circular units like in [START_REF] Cramer | Recovering short generators of principal ideals in cyclotomic rings[END_REF]. m) . [CDW21, Th. 5.1]. We focus on the lift procedure of Step 3. In [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF], a vector v ∈ π(S m ) is lifted to β by keeping positive coordinates for β σ and sending opposite of negative coordinates to β τ σ . This works because for any c ∈ Cl - m , [c] -1 = [c τ ], but hides which exact product of relative norm ideals is involved.

This eventually outputs h ∈ a of length h 2 ≤ exp O( √ m) • N (a) 1/ϕ(
We propose a totally equivalent lift procedure: from v = y • π(S m ), consider the preimage vector β = y • S m , from which we remove min βσ , βτσ to each βσ coordinate to obtain β. Now, it is obvious that β is a combination y of relations in S m , and of relative norm relations given by the min part. Details are given in [BLNR21, Alg. B.6].

Using explicit Stickelberger generators ([BLNR21, §B.3]).

Each element w a of the generating set W of S m corresponds to a generator J L (1, a -1) (see §5.2.1). Similarly, each relative norm ideal writes γ + s = L (1+τ )σs (see §5.2.2). Hence, from an (explicit) ClDlp solution g = ab • L α , and given, as rewritten above, a Cpmp solution as

β = y • W + u • (1 + τ ) • Z[G + m ],
we have that a generator of ab • L α-β is directly given by g a J L (1, a -1) ya s (γ + s ) us . Knowing this allows us to remove the quantum Pip in dimension n in step 4 (for each query). In exchange, we need to compute (only once) all real generators for relative norm relations, which can be done in dimension ϕ(m)/2 by [BS16, Alg. 2].

Avoiding the random walk ([BLNR21, §B.4]).

Finally, note that several quantum steps are performed (for each query) in the random walk that maps ideals to Cl - m . Using the results of §5.2.2, we replace the module (1 + τ ) • Z[G m ] d by the module of all real class group relations.

Asymptotically, we prove in [BLNR21, Pr. B.7] as a direct consequence of Pr. 5.12 that this does not change the bound on the approximation factor, as long as: Hypothesis 5.18. We restrict to cyclotomic fields

K m verifying h + m ≤ O( √ m).
Remark 5.19. This assumption is certainly not true in general. Nevertheless, by the discussion in §2.2.3, it is expected to be valid for a very large proportion of cyclotomic fields and is likely to hold when m is a power of 2.

On the other hand, this slightly more restrictive hypothesis is largely compensated by the fact that only two quantum steps remain: one is performed only once in dimension ϕ(m)/2 to compute real class group relations and generators, and the second is solving the ClDlp for each query (see [BLNR21, Tab. B.1]). Moreover, this removes the need for the factor base prime ideals L i to be in the relative class group Cl - m , which happens with probability only roughly 1/h + m . Therefore, we can choose a factor base of prime ideals having the smallest possible norms, which has in practice a significant impact on the algebraic norm of these L i 's (see also Wesolowski

Computing Log-S-unit Sublattices in Higher Dimensions

Our main goal is to simulate the Twisted-PHS algorithm for high degree cyclotomic fields. To this end, we compute full-rank sublattices of the full log-S-unit lattice using the knowledge of the maximal set F of independent S-units defined by Eq. (5.13) and its 2-saturated counterpart F sat from §5.2.4. These sets are lifted from a complete set of real S + -units (see §5.2.2), hence are obtained at the classically subexponential cost of working in the half degree maximal real subfield. We note that by Th. 5.14, the index of these families grows rapidly as the number of orbits increases, hence these approximated modes give an upper bound on the approximation factors that can be expected when using Twisted-PHS. Our experimental setting is detailed in §5.4.1. Then, we analyse in §5.4.2 the geometric characteristics of our log-S-unit sublattices and the obtained approximation factors in §5.4.3.

Experimental settings

Computing the full group of S-units in a classical way is rapidly intractable, even in the case of cyclotomic fields; therefore, the experiments performed on Twisted-PHS in §3.4 were bound to ϕ(m) ≤ 70. We apply the Twisted-PHS algorithm using our full-rank sublattices of the whole log-S-unit lattice induced by the independent family F of Eq. (5.13), its 2-saturated counterpart F sat ( §5.2.4) and, when possible, a fundamental system F su for the full S-unit group. Approximated modes with F or F sat give a glimpse on how Twisted-PHS scales in higher dimensions, where asymptotic phenomena like the growth of h m start to express.

Source code and hardware description. All experiments have been implemented using SageMath v9.0 [START_REF]Sage Developers: SageMath, the Sage Mathematics Software System (Version 9.0)[END_REF], except for the full S-unit groups computations for which we used Magma [BCP97], which appears much faster for this particular task and also offers an indispensable product ("Raw") representation. Moreover, fplll [START_REF]FpLLL development team: fplll, a lattice reduction library[END_REF] was used to perform all lattice reduction algorithms. The entire source code is provided on GitHub: ob3rnard/Tw-Sti 8 .

Most of the computations were performed in less than two weeks on a server with 72 Intel ® Xeon ® E5-2695v4 @2.1GHz with 768GB of RAM, using 2TB of storage for the precomputations. Real class group computations were performed on a single Intel ® Core™ i7-8650U @3.2GHz CPU using 10GB of RAM.

Targetted cyclotomic fields. We consider cyclotomic fields of any conductor m s.t. 20 < ϕ(m) ≤ 210 with known real class number h + m = 1, including those from Tab. 2.1. The restriction to h + m = 1 is only due to technical interface obstructions, i.e., we are not aware of how to access the non-trivial real class group relations internally computed by SageMath. Additionally, for some of the conductors, we were not able to obtain the real class group within a day. Thus, we are left with 210 distinct cyclotomics fields, and Tab. 5.1 lists all ignored conductors. Finite places choice. The optimal set of places computed by Alg. 3.3 yields a number d max of split G m -orbits of smallest norms maximizing the density of the corresponding full log-S-unit lattice. However, the index of our log-S-unit sublattices, given by Th. 5.14, grows too quickly, roughly in (h - m ) d-1 , so that their density always decreases as soon as d > 1. This remark motivates us to compute all log-S-unit sublattices for d = 1 to d max first split G m -orbits. log-S-embedding ϕ tw (of type iso/exp). For all bases, the root-Hermite factor verifies |δ 0 -1| < 10 -3 . log-S-embedding choice among all four options on the Gram-Schmidt logarithm norms of the unreduced basis ϕ(F sat ). As expected, the isometry f H has absolutely no influence on the Gram-Schmidt norms. On the other hand, using Log S or Log S seems to alter only the first norms, very slightly, as can be seen in Fig. 5.8. Again, increasing the number of orbits does not influence these behaviours. We stress that these very peculiar geometric characteristics -shape of the logarithm of the norms of the Gram-Schmidt basis, ease of reduction, very small orthogonality defect (after LLL) -already observed in § §3.4.1 and 3.4.2, are consistently viewed across all conductors, degrees, log-S-unit sublattices and number of orbits. To give a concrete idea of e.g., the striking ease of reduction of these log-S-unit sublattices, we report that for m = 211, BKZ 40 terminates in around 7 minutes (resp. 30 minutes) on the log-S-unit sublattice of dimension k = 1154 (resp. 1574) corresponding to d = 5 (resp. d max = 7), which is unusually fast.

This very broad phenomenon suggests that the explanation is possibly deep, an observation that has been recently developed by Bernstein and Lange [BL21].

Evaluation of the approximation factor

In §3.4.3, evaluating in practice the approximation factors reached by Twisted-PHS is done by choosing random split ideals of prime norm, solving the ClDlp for these challenges and comparing the length of the obtained algebraic integer with the length of the exact shortest element. As the degrees of the fields grow, solving the ClDlp and exact id-Svp becomes rapidly intractable. Hence, we resort to simulating random outputs of the ClDlp, similarly to [DPW19, Hyp. 8], and estimate the obtained approximation factors with inequalities from Eq. (2.42).

Simulation of ClDLP solutions.

To simulate targets that heuristically correspond to the output α of the ClDlp, we assume that for each ideal L i ∈ S, the vector v L σ i (α) σ∈Gm of Z[G m ] is uniform modulo the lattice of class relations, and that after projection along the 1-axis, ln|σ(α)| σ is uniform modulo the log-unit to each coordinate u σ , so that their sum is indeed ln|N (α)|

2

. For each field we thereby generate 100 random targets on which to test Twisted-PHS on all lattice versions.

Reconstruction of a solution.

For any simulated ClDlp solution α, given as a random vector {ln|σ(α)|} σ∈G + m , {v L (α)} L∈S∩S 0 , it is easy to compute ϕ(α) for any log-S-embedding ϕ and to derive a target as in Eq. (3.25), including a drift parameterized by some β. Then, considering e.g., L sat = ϕ(F sat ), given by the BKZ 40 -reduced basis U bkz • ϕ(F sat ), we find a close vector v = (y • U bkz ) • ϕ(F sat ) to this target using Babai's Nearest Plane algorithm, and from y, U bkz and F sat we easily recover, in compact representation, s ∈ O × Km,S s.t. v = ϕ(s) and also α/s. The purpose of the drift parameter β is to guarantee v L (α/s) ≥ 0 on all finite places. As mentioned in §3.4.3, the length of α/s is extremely sensitive to the value of β, so that they searched for an optimal value by dichotomy. However, this positiveness property actually does not seem to be monotonic in β, and in practice, using the same β on each finite place coordinate is too coarse when the dimension grows, which induces unnecessarily large approximation factors. We instead obtained best results using random drifts in ∞ -norm balls of radius 1 centered on the 1 axis. A first sampling of O(ϕ(m)) random points β • 1 + B ∞ (1) for a wide range of random β's allows us to select a β 0 around which we found the best α/s 2 with all v L (α/s) being positive. Then we sample O(ϕ(m)) uniform random points in the neighbourhood of β 0 , namely in [0.9β 0 , 1.1β 0 ] • 1 + B ∞ (1), and output the overall optimal α/s 2 having all v L (α/s) ≥ 0.

Estimator of the approximation factor.

Since we do not have access to the shortest element of a challenge ideal, we cannot compute an exact approximation factor as is done in §3.4.3. Instead, we estimate the retrieved approximation factor using the inequalities implied by Eq. (2.42). We focus on the Gaussian Heuristic, which gives in small dimensions consistent results with the exact approximation factors found in §3.4.3. For each cyclotomic field, the plotted points are the means, over the 100 simulated random targets, of the minimal approximation factors obtained using options iso/noiso and exp/tw. For each family F, F sat and F su , we chose to keep only the factor base that gives the best result. This systematically translated into using d = 1 G m -orbit for F and F sat , whereas we had to use d = d max for F su , as predicted by the Twisted-PHS algorithm.

Figure 5.3 shows the approximation factor γ gh obtained for all lattices L urs , L sat and L su (when applicable) after BKZ 40 reduction. Figure 5.4 is a zoom of Fig. 5.3 that focuses on L sat and L su on small dimensions.

First, we remark that using family F from Eq. (5.13), the retrieved approximation factors are increasing rapidly. Using the 2-saturated family F sat yields much better results, and looking closely at Fig. 5.4 shows that using a basis F su of the full S-unit group, when available, even improves the picture if d max > 1, in which case L su is denser than L sat . For L su , we stress that we obtain estimated approximation factors very similar to the exact ones observed in §3.4.3.

More generally, we observe a very strong correlation between the density of our lattices and the obtained approximation factors -the denser, the better. As an important related remark, the variance seen for γ gh in Fig. 5.3 for distinct fields of same degree follows the variations of the norm of the first split prime, thus of the reduced volume of the considered log-S-unit sublattice. We expect this variance to be smoothed through conductors for the full log-S-unit lattice.

Furthermore, considering m = 211, the F family gives Vol 1/314 L urs ≈ 14.325 and an estimated γ gh ≈ 13170, for F sat we get Vol 1/314 L sat ≈ 11.386 and a much smaller estimated γ gh ≈ 16.4, whereas the optimal number of orbits predicted by the Twisted-PHS Factor Base Choice Algorithm (Alg. 3.3) is d max = 7, which yields a full log-S-unit lattice of reduced volume only Vol 1/1574 L su ≈ 9.635.

Comparison to the CDW algorithm.

Using the same experimental setting, we compute the approximation factors obtained using the CDW algorithm as implemented in [START_REF] Ducas | On the shortness of vectors to be found by the Ideal-SVP quantum algorithm[END_REF] ("Naive version") with additional BKZ 40 lattice reductions, as well as the experimentally derived volumetric lower bound from [DPW19, Eq. ( 5) and Tab. 1]. Those values are also represented in Fig. 5.3 and 5.4.

Our experimental results using the F sat family clearly outperform the CDW algorithm over the experimental range considered, and are even comparable to its volumetric lower bound. Moreover, for some fields, e.g., in dimensions 96, 160, 168, 200, this lower bound is defeated by the (approximated version of the) Twisted-PHS algorithm. Note that this does not invalidate the 98 Chapter 5. Using Explicit Stickelberger Generators lower bound itself, which is stated for the two-phase CDW algorithm, but indicates the power of combining both steps in only one lattice as in the Twisted-PHS algorithm.

Supplementary Experimental Results

Geometry of log-S-unit sublattices

In the following, we provide data regarding the geometry of the log-S-unit sublattices L urs and L sat for additional cyclotomic fields.

Conclusion and Perspectives

E ventually, the results of this thesis take place in the broad context of S-unit attacks against the Shortest Vector Problem (Svp) in ideal lattices. First, we propose in Ch. 3 a new Twisted version of the PHS algorithm [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF], using the S-units formalism and the Product Formula to twist the log-S-embedding with natural number-theoretic weights at finite places. This so-called Twisted-PHS algorithm provably reaches the same asymptotic trade-off between runtime and approximation factor than the PHS algorithm. On the practical side though, we provide the first experimental evidence that under this proper normalization, the log-S-unit lattices at hand seem to behave much better in lattice reduction algorithms, as well as displaying very peculiar geometric characteristics, close to those of orthogonal lattices. The exact approximation factors obtained by our Twisted-PHS algorithm in small dimensions are strikingly small, hinting at a possible subexponential (or better) growth. In order to reach meaningful dimensions where asymptotic phenomena start to express, we exhibit in Ch. 4 a short basis of the Stickelberger ideal of any cyclotomic field, and show how the corresponding explicit algebraic generators are easily computed via Jacobi sums. Finally, using in Ch. 5 these extended Stickelberger techniques and the lattice of all real class group relations, we were able on one hand to remove almost all quantum steps in the CDW algorithm, and on the other hand to approximate the Twisted-PHS algorithm in all cyclotomic fields of degree up to 210. These large degree experiments confirmed our initial observations about the geometric peculiarities of the log-S-unit lattices in all cyclotomic fields of degree up to 210, and allowed us to obtain an upper bound of the performance of Twisted-PHS in meaningful medium dimensions.

Nevertheless, at this point the obtained approximation factors are not sufficient to derive an asymptotic general behaviour for S-unit attacks. Although our results do not show a catastrophic impact of S-unit attacks, they do neither allow to dismiss this particular threat. Whereas gathering these experimental data is of utmost importance to better understand concretely S-unit attacks and back up discussions on the hardness of id-Svp, further investigation is still needed to derive a sound asymptotic estimator.

Hence, we identify two axes for further research: the first is extending the range and scope of experiments to better circumscribe the relevant parameters needed to evaluate the performance of S-unit attacks; the second is to work towards obtaining a sound asymptotic estimator relying on properly identified and verified heuristics.

Further Concrete Experimental Data

At the moment, our experiments constitute a first important step towards assessing the performance of S-unit attacks. There are several directions to explore in order to strengthen our observations in the general case.

Other cyclotomic fields. The simplest improvement is to capture results for cyclotomic fields K m such that h + m > 1. Indeed, the lattice of real class group relations in the case h + m = 1 is equivalent to the concatenation of two identity matrices and solving Cvp in this lattice can be done in an optimal way. We therefore expect on one hand a greater gap between the CDW algorithm and the Twisted-PHS algorithm, and on the other hand a noticeable effect of the h + m part on the approximation factor in both cases. At the moment, this case has not been dealt with for the only technical reason that the real class group relations matrix seems not to be easily accessible in SageMath.

The second obvious improvement would be to make further progress to fields of higher degrees. This necessitates to tweak the parameters of the Pari/GP routine for computing class groups, and to work on a parallelized implementation of the Buchmann algorithm for the search of class group relations. A nice target would be to reach e.g., Q(ζ 512 ), which has degree 256.

Densify log-S-unit sublattices. Due to the h - m part in the index of our full-rank families of independent S-units, our log-S-unit sublattices in medium dimensions are still far from the full log-S-unit lattice. A regrettable consequence is that our log-S-unit lattices reach maximal density for d = 1 orbit of split prime ideals, whereas the Twisted-PHS generally predicts a greater optimum d = d max w.r.t. the log-S-unit lattice density.

Hence, some significant effort should be put to improve the saturation step in order to capture as many prime factors of h - m as is reasonably possible. There are two bottlenecks: the computation of e-th-root characters, which at first glance costs O( √ e), and the e-th-root computation itself. The latter could be virtualized by considering only the absolute values of the complex embeddings while discarding their complex arguments. However, it seems illusory to expect to capture prime factors of h - m significatively larger than 64 bits. For our range of computations, this might still be interesting in a non-negligible proportion of the fields, but note e.g., that h - 197 is divisible by 9398302684870866656225611549, a 93-bit prime! This would in fine allow to verify in medium dimensions the behaviour of the Twisted-PHS algorithm when the density of the log-S-unit lattice is increasing with d > 1.

Guarantee that all finite valuations are positive. A very painful requirement of the algorithm is that the solution vector corresponds to an element of the challenge ideal. In Ch. 3, this was done by applying a diagonal drift on finite place coordinates, searching for an optimum value by dichotomy. As seen in Ch. 5, this method does not scale properly, and we had to use a randomized strategy applying O(n) random drifts in ∞ -norm balls of radius 1 centered on guessed diagonal values. This is quite costly and still not satisfactory as we observe a noticeable variance between two random runs on the same target.

In an ideal world, one could hope for a specifically designed algorithm, like a modified or backtracking Babai's Nearest Plane Algorithm, that guarantees that the close solution which is returned lies in the correct cone w.r.t. the target.

Obtain verifiable examples in medium dimensions. The exact approximation factors shown in Ch. 3 for Twisted-PHS are completely verifiable examples, as the ClDlp step is concretely performed. However, this still represents in practice the main bottleneck in high dimensions, where obtaining a single relation involving a challenge prime ideal of big norm and many small prime ideals in the factor base is significantly harder in practice than obtaining many relations involving only ideals of the factor base. This is why in Ch. 5 we use random targets simulating the output of the ClDlp step. Hence, obtaining verifiable concrete examples would be very useful in order to confirm that the approximation factors estimated via random targets still match the reality beyond the small dimensions reached in Ch. 3. We could think of two possible ways of performing this ClDlp step, that can even be combined together. The first would be to use a special-q strategy, like in the General Number Field Sieve (GNFS) context. However, this requires to sieve in large dimensions, and the algebraic norm of the elements grows extremely rapidly. The second way aims at reducing the dimension of the ClDlp by generalizing the Gentry-Szydlo algorithm to this problem. This Gentry-Szydlo method would probably allow to double the reachable dimension for explicit ClDlp computations, hence this would currently reach dimensions 100 to 120, since we did not yet succeed in performing explicit ClDlp computations beyond dimensions 50 to 60.

Towards an S-unit Attack Asymptotic Simulator

The works of this thesis altogether allowed to reach a state where it becomes possible to extract the meaningful properties of log-S-unit lattices that are not bound to small dimensions pathological phenomena. At this point, we need to address two theoretical questions: first, explain the striking ease of reduction and orthogonality defects of our obtained log-S-unit lattices, then obtain an heuristic estimation of the final approximation factor. The former would allow to establish the concrete running time of the preprocessing phase for these specific lattices, and the latter should give, at least, a lower bound of the performance of the Twisted-PHS algorithm.

The first question can be explored as follows. On the one hand, it seems possible to obtain sensible estimations of the size of the log-S-embeddings of S-units from easily computable number-theoretic values. Further, the Gram-Schmidt orthogonalization matrix has a very specific structure that can be made explicit, due to the special shape of all the vectors of the basis. Indeed, the basis vectors have two fixed balanced parts whose sum is equal to the logarithm of the algebraic norm of the corresponding S-units: on the infinite places, this weight is borne evenly by at most n coordinates; on finite places, this weight is borne by k ≥ n distinct places, each non-zero coordinates being weighted by some ln N (p), a particular distortion which possibly has noticeable consequences.

A pending question is to determine whether this particular shape of the basis vectors is sufficient to explain the geometric behaviour of the log-S-unit lattices, or whether a deeper number-theoretic explanation is mandatory. Simulating the distribution of the coordinates could give important insights. If the approximation factors obtained with these virtual lattices coincide with those of Ch. 5 in medium dimensions, this would allow to extrapolate the performance of Sunit attacks in cryptographically relevant dimensions. This would also offer much freedom to test a wide variety of parameters. In particular, it would allow to test whether extending the factor base beyond the point of maximum density is indeed helpful, as claimed by Bernstein in his talk at SIAM Conference on 20-th August 2021.

  Figure 1.1 -Trade-offs between runtime and approximation factors reached by algebraic cryptanalyses of id-Svp.

Figure 1 . 2 -

 12 Figure 1.2 -Approximation factors reached by Twisted-PHS, Opt-PHS and PHS for cyclotomic fields of conductors 23, 29, 31, 37, 41, 43, 47 and 53 (in log scale).

Figure 1

 1 Figure 1.3 -Approximation factors comparison for cyclotomic fields K m of degree ϕ(m) ≤ 210 with h + m = 1, under the Gaussian Heuristic. Our results, labelled as "2-saturated URS", bound Twisted-PHS from above.

  The integral group ring Z[G m ] acts naturally on I m ; more precisely, for any b ∈ I m and any element α = σ∈Gm a σ σ ∈ Z[G m ], we write b α := σ∈Gm σ b aσ .

  + m , and few values are known. We will use the values from [Was97, Tab. §4], [Mil14, Th. 1.1 and 1

  Theorem 2.22 (Stickelberger's theorem [Sin80, Th. 3.1]). The Stickelberger ideal S m of K m annihilates the class group of K m . Hence, for any ideal b of K m and any α = σ∈Gm a σ σ ∈ S m , the ideal b α = σ∈Gm σ(b) aσ is principal.

  ) and (2.20), we deduce respectively, for d | m and 0 < b < d, ω m (a + m) = ω m (a) and ω m (-a) = -ω m (a), (2.28)

  2.4]. More precisely, the first minimum is bounded by λ 1 (b) ≤ (1 + o(1)) 2n πe • Vol 1/n (b), and the Gaussian Heuristic for full-rank random lattices [NV10, Def. 2.8] actually predicts λ 1 (b) ≈ n 2πe • Vol 1/n (b) on average.

  .45) Experimental evidence suggest that on average, LLL achieves δ LLL 0 ≈ 1.022 [NS06, GN08] and BKZ with block size b achieves δ BKZ b 0 ≈ b 2πe (πb) 1/b 1/(2b-2) for b ≥ 50 [Che13, CN11]. 2. the (normalized) orthogonality defect δ [MG02, Def. 7.5] captures the global quality of the basis, not just of the first vector, and is especially useful for Cvp-like problems e.g., if the lattice possesses abnormally short vectors:

Figure 3

 3 Figure 3.1 -Approximation factors reached by Twisted-PHS, Opt-PHS and PHS for cyclotomic fields of conductors 23, 29, 31, 37, 41, 43, 47 and 53 (in log scale).

  and A (np) tw-query with the following differences. Algorithm A (bkz) tw-pcmp performs a minimal reduction step of the lattice as sole lattice preprocessing to smooth the input basis. Algorithm A (np) tw-query resorts to

  3.2] to take into account our change of conventions in the definition of L phs and the choice of Laarhoven's algorithm as the Approx-Cvp oracle [Laa16, §4.2]. Algorithm 3.2 PHS Query A query Input: A challenge b, A pre-proc (K, ω) = O × K,S , B Lphs , V , and β > 0 s.t. for any t, the Approx-Cvp oracle using V(L phs ) outputs w ∈ L phs with tw ∞ ≤ β. Output: A short element x ∈ b \ {0}. 1: Solve the ClDlp for b on FB, i.e., find α ∈ K s.t. α = b • pi∈FB p vi i . 2: Define the target as t

  hence bounding the 1 -norm of each column of GSO(M H0 ) by (1 + ln n) yields the first inequality. Similarly, bounding the 1 -norm of each row of GSO(M H0 ) by 2 √ 2 proves the second. Let b 1 , . . . , b ν be the row vectors of M H0 ; the Gram-Schmidt orthogonalization (resp. orthonormalization) vectors of M H0 are denoted by b i (resp. b i ). Because of the particular structure of M H0 , b i+1 only depends on b i+1 and b i . Then, a simple induction shows that:

  . Chapter 3. Twisted-PHS: Using the Product Formula

  Typically, continuous Gaussian vectors y of dimension d verify y ∞ / y 2 = O(ln d/ √ d) with good probability, as shown by [PHS19a, Lem. 4.1]. In our setting, this is justified by assuming t is uniformly distributed in R ⊗ L tw /L tw , and can be randomized by multiplying b by small ideals coprime to FB. Proof of the second part of Th. 3.14. It breaks down to plugging into Th. 3.27 a value for k and β. Using Lem. 3.21, we take k = O(ln|∆ K |), so that V k = O(ln N (L max )) = O(ln ln|∆ K |) by Lem. 3.20 and Pr. 3.22. We stress that if A tw-FB terminates with a smaller k, this can by definition only yield a smaller V k . By Heur. 3.28, it implies µ 2 (L tw ) = O( √ ν + k • ln ln|∆ K |), and Heur. 3.29 yield on average f

Figure 3

 3 Figure 3.2 -Log-S-unit lattices for Q(ζ 59 ): Gram-Schmidt log norms before and after BKZ 40 reduction at iso factor base A tw-FB (K) for: (a) L tw ; (b) L (0) opt ; (c) L (0) phs .

Figure 3

 3 Figure 3.3 -Log-S-unit lattices for Q(ζ 59 ): Gram-Schmidt log norms after BKZ 40 reduction: (a) at iso factor base A tw-FB (K); (b) at designed factor bases.

Figure 3 . 4 -

 34 Figure 3.4 -Approximation factors reached by Twisted-PHS, Opt-PHS and PHS for cyclotomic fields of conductors 23, 29, 31, 37, 41, 43, 47 and 53 (in log scale).

Figure 3 . 5 -

 35 Figure 3.5 -Approximation factors reached by Twisted-PHS, Opt-PHS and PHS for NTRU Prime fields of degrees 23, 29, 31 and 37 (in log scale).

Figure 3

 3 Figure 3.6 -Log-S-unit lattices for Q(ζ 23 ), Gram-Schmidt log norms: (a) before and after BKZ 40 reduction at iso factor base A tw-FB (K) for L tw and L (0) phs ; (b) after BKZ 40 reduction for all variants L tw , L (0)opt , L (0) phs , L opt and L phs .

Figure 3

 3 Figure 3.7 -Log-S-unit lattices for Q(ζ 29 ), Gram-Schmidt log norms: (a) before and after BKZ 40 reduction at iso factor base A tw-FB (K) for L tw and L (0) phs ; (b) after BKZ 40 reduction for all variants L tw , L (0)opt , L (0) phs , L opt and L phs .

Figure 3

 3 Figure 3.8 -Log-S-unit lattices for Q(ζ 31 ), Gram-Schmidt log norms: (a) before and after BKZ 40 reduction at iso factor base A tw-FB (K) for L tw and L (0) phs ; (b) after BKZ 40 reduction for all variants L tw , L (0)opt , L (0) phs , L opt and L phs .

Figure 3

 3 Figure 3.9 -Log-S-unit lattices for Q(ζ 37 ), Gram-Schmidt log norms: (a) before and after BKZ 40 reduction at iso factor base A tw-FB (K) for L tw and L (0) phs ; (b) after BKZ 40 reduction for all variants L tw , L (0)opt , L (0) phs , L opt and L phs .

Figure 3 .

 3 Figure 3.10 -Log-S-unit lattices for Q(ζ 41 ), Gram-Schmidt log norms: (a) before and after BKZ 40 reduction at iso factor base A tw-FB (K) for L tw and L (0) phs ; (b) after BKZ 40 reduction for all variants L tw , L (0)opt , L (0) phs , L opt and L phs .

Figure 3 .

 3 Figure 3.11 -Log-S-unit lattices for Q(ζ 43 ), Gram-Schmidt log norms: (a) before and after BKZ 40 reduction at iso factor base A tw-FB (K) for L tw and L (0) phs ; (b) after BKZ 40 reduction for all variants L tw , L (0)opt , L (0) phs , L opt and L phs .

Figure 3 .

 3 Figure 3.12 -Log-S-unit lattices for Q(ζ 47 ), Gram-Schmidt log norms: (a) before and after BKZ 40 reduction at iso factor base A tw-FB (K) for L tw and L (0) phs ; (b) after BKZ 40 reduction for all variants L tw , L (0)opt , L (0) phs , L opt and L phs .

Figure 3 .

 3 Figure 3.13 -Log-S-unit lattices for Q(ζ 53 ), Gram-Schmidt log norms: (a) before and after BKZ 40 reduction at iso factor base A tw-FB (K) for L tw and L (0) phs ; (b) after BKZ 40 reduction for all variants L tw , L (0)opt , L (0) phs , L opt and L phs .

Figure 3 .

 3 Figure 3.14 -Log-S-unit lattices for Q(ζ 59 ), Gram-Schmidt log norms: (a) before and after BKZ 40 reduction at iso factor base A tw-FB (K) for L tw and L (0) phs ; (b) after BKZ 40 reduction for all variants L tw , L (0)opt , L (0) phs , L opt and L phs .

Figure 3 .

 3 Figure 3.15 -Log-S-unit lattices for Q(ζ 61 ), Gram-Schmidt log norms: (a) before and after BKZ 40 reduction at iso factor base A tw-FB (K) for L tw and L (0) phs ; (b) after BKZ 40 reduction for all variants L tw , L (0)opt , L (0) phs , L opt and L phs .

Figure 3 .

 3 Figure 3.16 -Log-S-unit lattices for Q(z 23 ), Gram-Schmidt log norms: (a) before and after BKZ 40 reduction at iso factor base A tw-FB (K) for L tw and L (0) phs ; (b) after BKZ 40 reduction for all variants L tw , L (0)opt , L (0) phs , L opt and L phs .

Figure 3 .

 3 Figure 3.17 -Log-S-unit lattices for Q(z 29 ), Gram-Schmidt log norms: (a) before and after BKZ 40 reduction at iso factor base A tw-FB (K) for L tw and L (0) phs ; (b) after BKZ 40 reduction for all variants L tw , L (0)opt , L (0) phs , L opt and L phs .

Figure 3 .

 3 Figure 3.18 -Log-S-unit lattices for Q(z 31 ), Gram-Schmidt log norms: (a) before and after BKZ 40 reduction at iso factor base A tw-FB (K) for L tw and L (0) phs ; (b) after BKZ 40 reduction for all variants L tw , L (0)opt , L (0) phs , L opt and L phs .

Figure 3 .

 3 Figure 3.19 -Log-S-unit lattices for Q(z 37 ), Gram-Schmidt log norms: (a) before and after BKZ 40 reduction at iso factor base A tw-FB (K) for L tw and L (0) phs ; (b) after BKZ 40 reduction for all variants L tw , L (0)opt , L (0) phs , L opt and L phs .

Figure 3 .

 3 Figure 3.20 -Log-S-unit lattices for Q(z 41 ), Gram-Schmidt log norms: (a) before and after BKZ 40 reduction at iso factor base A tw-FB (K) for L tw and L (0) phs ; (b) after BKZ 40 reduction for all variants L tw , L (0)opt , L (0) phs , L opt and L phs .

Figure 3 .

 3 Figure 3.21 -Log-S-unit lattices for Q(z 43 ), Gram-Schmidt log norms: (a) before and after BKZ 40 reduction at iso factor base A tw-FB (K) for L tw and L (0) phs ; (b) after BKZ 40 reduction for all variants L tw , L (0)opt , L (0) phs , L opt and L phs .

Figure 3 .

 3 Figure 3.22 -Log-S-unit lattices for Q(z 47 ), Gram-Schmidt log norms: (a) before and after BKZ 40 reduction at iso factor base A tw-FB (K) for L tw and L (0) phs ; (b) after BKZ 40 reduction for all variants L tw , L (0)opt , L (0) phs , L opt and L phs .

  4.2] about the Stickelberger ideal, using Lem. 2.19, 2.31 and 2.32 instead of [Kuč92, Lem. 3.1, 3.2 and 3.4]. Indeed, the proof of [Kuč92, Th. 4.2] about the Stickelberger ideal and its preparatory statements [Kuč92, Lem. 3.3 and 4.1 (for Ψ)] need the validity of only the following facts (using notations ω(a) and ω * from [Kuč92]): • the Stickelberger ideal is generated by ω(a); 0 < a < m ∪ ω * as a group ([Kuč92, Lem. 3.1]); • these generators satisfy the relations of Lem. 2.31, where we write ω(a) instead of ω m (a) ([Kuč92, Lem. 3.2]); • these generators satisfy the relations of Lem. 2.32, where we write ω(a) instead of ω m (a) ([Kuč92, Lem. 3.4]

Proposition 4 . 4 ..

 44 For any given b ∈ Z, 0 < b < m, let r b be the maximal divisor of (b, m) satisfying r b , m r b = 1, i.e., r b is the product of all q i , i ∈ 1, t which divide b, and write ω m (b) ∈ S m as a unique Z-linear combination of basis elements (4.3). Then for each a ∈ M - m such that r b a, the coefficient of ω m (a) in this Z-linear combination is equal to zero. Proof. For brevity's sake, let r = r b . By Eq. (2.29), ω m (b) = Cor Km/K m r ω m r ( b r ) . Using Th. 4.2 for m r implies ω m r ( b r ) ∈ S m r is a unique Z-linear combination of ω m r (a); a ∈ M - Since by Eq. (2.29), Cor Km/K m r ω m r (a) = ω m (ra) and Cor Km/K m r N m r = N m , and since the corestriction map Cor Km/K m r is a linear map, the proposition follows from Lem. 4.1.

  .8) which agrees with the previous definition of M p e . Easily adapting the proof of Lem. 4.1 gives that for any r | m, 0 < r < m, such that r, m r = 1, we have a ∈ M m ; r | a = rb; b ∈ M m r = r • M m r . Thus, we have proved that Th. 4.2 and Pr. 4.4 implies the following: Theorem 4.9. For any integer m > 1, m ≡ 2 (mod 4), the set ω m (a); a ∈ M m ∪ 1 2 N m (4.10) is a Z-basis of S m . Proposition 4.11. For any given b ∈ Z, 0 < b < m, let r b be the maximal divisor of (b, m) satisfying r b , m r b

Corollary 4 .

 4 14. For any given b ∈ Z, 0 < b < m, let r b be the maximal divisor of (b, m) satisfying r b , m r b

Proposition 4 .

 4 15. Let a, b, c ∈ Z satisfy m a, m b, m c, m | a + b + c. Then α = θ m (a) + θ m (b) + θ m (c) -N m is a short element of S m . Moreover (1 + σ m,-1 )α = N m , so exactly one half of the coefficients of α are zeros. 70 Chapter 4. A Short Basis of the Stickelberger Ideal Proof. Using θ m (c) + θ m (-c) = N m when m c (see Eq.

Lemma 4 .

 4 19. For any integer m > 1, m ≡ 2 (mod 4), the element α m (b) is short and satisfies (1 + σ m,-1 )α m (b) = N m for each positive integer b < m. Proof. In the former case J b > 1, we have b + bux + bvy = 0. Since u b, we have u bvy; similarly v b implies v bux. Hence α m (b) is short by Pr. 4.15. In the latter case J b = {j} for some j ∈ 1, t , we have that b writes as mc qj with c ∈ Z and 0 < c < q j , then α m (b) is short by Pr. 4.15 again, because -b + (b -m qj ) + m qj = 0 and 2 • m•ϕ(qj ) 2qj

  by definition of u. Hence, all these θ m (a) are covered by induction, and so is θ m (bux). The case of θ m (bvy) can be treated similarly. Now, let us consider the transition matrix from the set (4.21) to the set (4.22). Suppose that J b = {j} and b = mc qj for some c ∈ Z, 1 ≤ c ≤ ϕ(qj ) 2 . If c = 1 then θ m (b) belongs to both sets (4.21) and (4.22). If c > 1 then the transition from θ m (b) to α m (b), by Eqs. (4.17) and (2.17), writes as α m (b) = -θ m (b) + θ m b -m qj + θ m m qj . Since J b-m/qj = J m/qj = J b , both θ m b -m qj = θ m m qj (c -1) and θ m m qj were already covered by induction. The coefficient of θ m (b) is -1.

  Theorem 4.29. For any integer m > 1, m ≡ 2 (mod 4), the set α m (a); a ∈ M m ∪ N m (4.30) is a Z-basis of the Stickelberger ideal S m of K m having only short elements.Proof. Let S m denote the subgroup of S m generated by the set (4.30). Each element of (4.30) is short by Lem. 4.19, in particular it belongs to Z[G m ], so thatS m ⊆ Z[G m ] ∩ S m = S m . (4.31) The indices [S m : S m ] = w and [S m : S m ] = w 2 are given by Lem. 2.26 and Pr. 4.28, respectively. In particular, by Pr. 4.28, the set (4.23) is linearly independent; comparing with the set (4.30), we see that the set (4.30) is also linearly independent and that S m is a subgroup of S m of index [S m : S m ] = 2. Hence, [S m : S m ] = [S m : S m ] • [S m : S m ] = w = [S m : S m ], and the inclusion (4.31) gives S m = S m . The theorem follows. 74 Chapter 4. A Short Basis of the Stickelberger Ideal 4.4 An Upper Bound on the Relative Class Number Our short basis of the Stickelberger ideal S m , given in Th. 4.29, allows to derive a simple upper bound on the relative class number of any cyclotomic field. Corollary 4.32. Let m > 1 be an integer satisfying m ≡ 2 (mod 4), let t be the number of primes dividing m. The relative class number h - m of the m-th cyclotomic field satisfies

For 1 76

 1 each b ∈ M m , let us define integers a b,s , where 1 ≤ s < m, (s, m) = 1, by α m (b) = 1≤s<m (s,m)=1 a b,s σ m,s . By Lem. 4.19, we have a b,s + a b,m-s = 1, so that α m (b) = γ m + 1≤s< m 2 (s,m)=1 (a b,s -1)β m (s). The index [A m : S m ] is given by the absolute value of the determinant of the transition matrix from the basis (4.30) of S m to the basis (4.35) of A m , i.e., A m : S m = det 2 -Chapter 4. A Short Basis of the Stickelberger Ideal

  .38) σ m ,v g L (b) = g L (vb). (4.39) Hence, g L (b) m ∈ Z[ζ m ] by Eq. (4.38). Moreover, we have the well-known Stickelberger factorization (see e.g., [Sin80, (3.4)]) g L (b) m • Z[ζ m ] = L mθm(b) . (4.40) We want to describe an explicit generator of the principal ideal L αm(b) for each b ∈ M m . Since each α m (b) is given by the general construction from Pr. 4.15 (see the proof of Lem. 4.19), we shall start more generally. Proposition 4.41. For any a, b ∈ Z such that m a, m b, m a + b, let

Figure 5 .

 5 Figure 5.1 -Approximation factors comparison for cyclotomic fields K m of degree ϕ(m) ≤ 210 with h + m = 1, under the Gaussian Heuristic. Our results, labelled as "2-saturated URS", bound Twisted-PHS from above.

  3], or by the adjonction of (1 + τ )Z[G m ] [CDW17, Def. 2]. Both can be used as a lattice of class relations for the relative class group Cl - m . In particular, the so-called augmented Stickelberger lattice S m + (1 + τ )Z[G m ] annihilates the relative class group and has full rank in Z[G m ], as shown in [CDW17, Lem. 2].

  and by Kummer-Dedekind's theorem we havel i •O Km = L 1+τ i .This justifies the slight abuse of notation of writing l

Theorem 5 .

 5 14. Let h m,(L1,...,L d ) (resp. h + m,(l1,...,l d ) ) be the cardinal of the subgroup of Cl m (resp. Cl + m ) generated by the G m -orbits of L 1 , . . . , L d (resp. the G + m -orbits of l 1 , . . . , l d ). The family F given in Eq. (5.13) is a maximal set of independent S-units. The subgroup generated by F in O × Km,S µ O × Km has index:

Lemma 5 .

 5 16. Let be a prime integer that splits in K m , let L | in K m and let l = L 1+τ ∩ K + m . Let h + m,(l) be the cardinal of the subgroup of Cl + m generated by the G + m -orbit of l in K + m . The Zmodule generated by S m and the lattice (1 + τ ) • C + l of real class group relations of the G m -orbit of L, has finite index in Z[G m ]:

  's bound on N (L - max ) in §2.3.1), and thus on the final approximation factor reached by the CDW algorithm in [CDW21, Alg. 6].

Figure 5 .

 5 Figure 5.2 -L sat lattices for Q(ζ 152 ) and Q(ζ 211 ): Gram-Schmidt log norms before and after reduction by BKZ 40 .

Figure 5 .

 5 Figure 5.3 -Approximation factors, with Gaussian Heuristic, reached by Twisted-PHS for cyclotomic fields of degree up to 210, on lattices L urs , L sat and L su .

Figure 5 . 4 -

 54 Figure 5.4 -Approximation factors, with Gaussian Heuristic, reached by Twisted-PHS for cyclotomic fields of degree up to 100, on lattices L sat and L su .

Figure 5 .

 5 Figure 5.7 -L sat lattices for Q(ζ 235 ) and Q(ζ 297 ): Gram-Schmidt log norms before and after reduction by BKZ 40 , for d = 2 and d = 4 G m -orbits.

Figure 5 .

 5 Figure 5.8 -L sat lattices for Q(ζ 149 ) and Q(ζ 211 ): effect of the log-S-embedding choices iso/noiso and exp/tw.

  t. the Closest Vector Problem (Cvp).

	Chapter 2. Preliminaries
	Contents
	2.1 On S-unit Groups . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10
	2.1.1 Number fields, ideals and class groups . . . . . . . . . . . . . . . . . . 10
	2.1.2 The Product Formula . . . . . . . . . . . . . . . . . . . . . . . . . . . 11
	2.1.3 Logarithmic S-embeddings . . . . . . . . . . . . . . . . . . . . . . . . 11
	2.1.4 Regulators . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13
	2.2 Cyclotomic Fields . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15
	2.2.1 Two special arithmetic subsets of 1, m . . . . . . . . . . . . . . . . . 16
	2.2.2 Galois group and maximal real subfield . . . . . . . . . . . . . . . . . 16
	2.2.3 Real and relative class groups . . . . . . . . . . . . . . . . . . . . . . . 17
	2.2.4 Circular units . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18
	2.2.5 Stickelberger ideal . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
	2.3 Algorithmic Number Theory . . . . . . . . . . . . . . . . . . . . . . 22
	2.3.1 Number-theoretic bounds . . . . . . . . . . . . . . . . . . . . . . . . . 22
	2.3.2 Hard problems in number theory . . . . . . . . . . . . . . . . . . . . . 24
	2.3.3 S-unit groups computations . . . . . . . . . . . . . . . . . . . . . . . . 24
	2.4 Euclidean Lattices . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
	2.4.1 Estimating approximation factors . . . . . . . . . . . . . . . . . . . . . 25
	2.4.2 Computational problems . . . . . . . . . . . . . . . . . . . . . . . . . . 25
	2.4.3 Quality of a lattice basis . . . . . . . . . . . . . . . . . . . . . . . . . . 26

  either σ s or τ σ s = σ -s . For simplicity, we always choose to liftσ s | K + m ∈ G + m to σ s ∈ G m anddrop the restriction to K + m which should be clear from the context. This slight abuse of notation appears to be very practical. For example, the corestriction Cor Km/K + m σ s | K + m , defined as the sum of all elements of G m that restricts to σ s | K + m , namely σ s + τ σ s , is written using the much simpler expression (1 + τ ) • σ s . The class group and class number of the maximal real subfield K + One important specificity of cyclotomic fields is that the real class group Cl + m embeds into Cl m via the natural inclusion map, which to each ideal class b ∈ Cl + m associates the lifted ideal class b • O Km ∈ Cl m [Was97, Th. 4.14]. The relative norm map N Km/K + m induces a homomorphism from Cl m to Cl +

	by Cl + m and h + m .	m are denoted respectively
	2.2.3 Real and relative class groups

m , whose kernel is hence isomorphic to the so-called relative class group, written Cl - m and of cardinal the relative class number h - m . Thus, by construction, for any b

  Table 2.1 -Additional (publicly unavailable) values of h + m for some m with ϕ(m) ≤ 200.

	1
	201 132 1 540 144 1 243 162 1 345 176 1 291 192 1
	207 132 1 237 156 1 249 164 1 368 176 1 357 192 1

and [BFHP21, Tab. 1], consistently assuming the Generalized Riemann Hypothesis (GRH) (see Heur. 2.33). We also provide 58 additional values in Tab. 2.1, easily obtained using SageMath v9.0 [

  .29) Chapter 2. Preliminaries The last equality uses that Cor Km/K d is a linear map and Cor Km/K d N d = N m . Moreover, by Lem. 2.19, S m is the subgroup of Q[G

m ] generated by ω m (a); 0 < a < m ∪ 1 2 N m . (2.30) Lemma 2.31. Let d, r be positive integers and m = rd. Then for any k ∈ Z we have a=0,...,m-1 a≡k (mod r)

  The PHS Algorithm . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2.1 Preprocessing of the number field . . . . . . . . . . . . . . . . . . . . . 3.2.2 Query phase: solving id-Svp using the preprocessing . . . . . . . . . . 3.2.3 Optimizing PHS parameters . . . . . . . . . . . . . . . . . . . . . . . . 3.3 The Twisted-PHS Algorithm . . . . . . . . . . . . . . . . . . . . . . 3.3.1 Preprocessing of the number field . . . . . . . . . . . . . . . . . . . . . 3.3.2 Query phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4 Experimental Data . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.4.1 Geometric characteristics . . . . . . . . . . . . . . . . . . . . . . . . . 3.4.2 Plotting Gram-Schmidt log norms . . . . . . . . . . . . . . . . . . . . Chapter 3. Twisted-PHS: Using the Product Formula 3.4.3 Approximation factors . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 3.5 Supplementary Experimental Data . . . . . . . . . . . . . . . . . . . 54 3.5.1 Geometric characteristics . . . . . . . . . . . . . . . . . . . . . . . . . 54 3.5.2 Gram-Schmidt norms of the lattice bases . . . . . . . . . . . . . . . . 57 Pellet-Mary, Hanrot and Stehlé [[START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF] proposed an extended version of the cryptanalyses of[START_REF] Cramer | Recovering short generators of principal ideals in cyclotomic rings[END_REF][START_REF] Cramer | Short Stickelberger class relations and application to Ideal-SVP[END_REF], which is proven for any number field K. The main feature of their algorithm is to use an exponential amount of preprocessing, depending only on K, in order to efficiently combine the two principal resolution steps of the CDW algorithm [CDW17, CDW21], namely the Cpmp (Close Principal Multiple Problem) and the Sgp (Shortest Generator Problem).

	3.1 Introduction
	In 2019,

3.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.1 Our contributions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.2 Experiments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.3 Technical overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.2

Table 3

 3

				PHS19b]
	23	0.292	147	55	53	34
	29	0.305	204	77	72	50
	31	0.304	223	85	79	55
	37	0.314	283	109	100	72
	41	0.323	324	125	114	84
	43	0.323	345	134	121	91
	47	0.327	388	151	136	103
	53	0.336	453	177	158	122
	59	0.341	520	204	181	141
	61	0.343	543	213	189	148
	67	0.348	611	241	212	168
	71	0.350	658	260	228	182

.1 -Values of k for K = Q(ζ m

Table 3 .

 3 4 -Geometric characteristics of log-S-unit lattices for some NTRU Prime fields.

			bkz raw bkz raw bkz raw bkz	µ 2	µ ∞ real H. 3.29
		L tw 59 4.825 1.001 1.001 3.596 1.802 11 47 69 81 12.91 5.186 0.615 0.489
		L (0) opt 59 1.786 1.020 1.005 4.525 1.986 34 55 76 83 5.112 2.245 0.629 0.530
	Q(ζ 41 )	L (0) phs 59 2.767 1.037 0.997 8.986 1.809 45 55 79 84 8.535 4.039 0.639 0.530
		L opt 103 1.379 1.013 1.006 6.514 2.592 25 48 66 84 5.301 2.052 0.596 0.456
		L phs 144 1.306 1.012 1.004 7.982 3.651 29 49 71 83 6.536 2.772 0.687 0.414
	Table 3.3 -Geometric characteristics of log-S-unit lattices for some prime conductor cyclo-
		tomic fields.
		d V 1/d	δ 0 raw bkz raw bkz raw bkz raw bkz δ θ min θ avg	µ 2	• ∞ / • 2 µ ∞ real H. 3.29
		L tw 38 4.441 0.911 0.911 1.498 1.357 53 59 82 83 10.64 5.177 0.645 0.528
		L (0) opt 38 5.051 0.937 0.937 4.187 1.865 44 50 81 81 12.50 6.573 0.663 0.590
	Q(z 43 )	L (0) phs 38 9.657 0.952 0.952 7.496 1.877 45 56 81 81 23.73 12.18 0.671 0.590
		L opt 114 1.367 0.979 0.979 5.482 3.256 36 57 79 83 6.119 2.803 0.687 0.443
		L phs 161 1.297 0.987 0.987 9.002 4.135 25 55 79 83 7.484 2.837 0.712 0.400
		L tw 40 4.576 0.913 0.913 1.650 1.358 49 60 82 84 11.04 5.607 0.632 0.519
		L (0) opt 40 6.231 0.938 0.938 4.628 1.915 37 57 81 81 16.59 8.398 0.658 0.583
	Q(z 47 )	L (0) phs 40 12.06 0.951 0.951 7.908 1.946 38 55 81 81 30.85 15.50 0.662 0.583
		L opt 129 1.376 0.981 0.981 6.189 3.632 21 56 80 83 6.575 2.925 0.696 0.427
		L phs 180 1.309 0.989 0.989 10.15 4.527 31 53 80 83 8.022 2.882 0.704 0.387

Table 3 .

 3 5 -Geometric characteristics of log-S-unit lattices for all non-principal cyclotomic fields Q(ζ m ) of prime conductor m ≤ 61.

		bkz raw bkz raw bkz raw bkz	µ2	µ∞ real H. 3.29
		Ltw 32 3.796 0.999 0.999 1.667 1.437 31 50 69 77 7.637 4.349 0.636 0.570
		L (0) opt 32 1.515 1.030 1.009 2.477 1.615 40 60 76 81 3.120 1.706 0.676 0.612
	Q(ζ23)	L (0) phs 32 2.083 1.056 0.998 4.689 1.490 34 60 75 81 4.287 2.621 0.690 0.612
		Lopt 44 1.334 1.023 1.009 2.711 1.843 37 58 76 82 3.244 1.451 0.640 0.570
		L phs 65 1.246 1.021 1.002 3.141 2.067 21 58 76 82 3.703 1.588 0.640 0.517
		Ltw 41 4.175 1.001 1.001 1.622 1.579 47 50 77 81 9.594 4.214 0.633 0.537
		L (0) opt 41 1.616 1.025 1.005 2.742 1.870 40 41 78 82 3.772 1.925 0.660 0.580
	Q(ζ29)	L (0) phs 41 2.333 1.047 0.996 5.885 1.664 34 48 77 83 5.850 3.175 0.675 0.580
		Lopt 63 1.350 1.018 1.006 3.116 2.143 43 48 78 83 3.910 1.546 0.617 0.522
		L phs 90 1.271 1.017 1.005 4.211 2.560 36 30 77 82 4.547 2.123 0.664 0.474

Table 4 .

 4 1 -Comparative timings for computing the relative class number h - m using resp. the analytic formula Eq. (2.10) and the index formula for [A m : S m ] in Eq. (4.36), for a few representative examples.

	1139 17 • 67	1056	12.6	8.1
	1495 5 • 13 • 23	1056	7.6	7.9
	4140 2 2 • 3 2 • 5 • 23 1056	4.8	8.5
	2283 3 • 761	1520	25.1	21.8
	2865 3 • 5 • 191	1520	16.3	21.0
	1951 1951	1950	78.8	60.3
	2171 13 • 167	1992	57.6	35.6
	2495 5 • 499	1992	53.8	41.7
	6012 2 2 • 3 2 • 167 1992	28.3	40.2

  4.1 and 3.4.2, that indicate close to orthogonal lattices. Moreover, as computing ClDlp solutions for random ideals is not possible, we simulate the query phase via random targets. The approximation factors obtained in this mode give an upper bound on what can be expected when using Twisted-PHS. Notably, they are already much smaller than the ones obtained using the CDW algorithm, and sometimes beat the volumetric lower bound experimentally derived in[START_REF] Ducas | On the shortness of vectors to be found by the Ideal-SVP quantum algorithm[END_REF]. We stress that, up to degree 80 when the full S-unit group is computable, our results match, under the Gaussian Heuristic, the exact approximation factors obtained by Fig.3.4.Remark 5.1. Similar techniques for the construction of S-units may be used in a concurrent work by Bernstein, Eisenträger, Rubin, Silverberg and van Vredendaal, as announced in a talk by Bernstein on 20 th August 2021 at SIAM Conference in the power of 2 conductor case up to degree 64 assuming h + 2 e = 1.

  the lattice of real class group relations C + l1,...,l d may be viewed as a Z-submodule of Z[G + m ] d . Lifting all these relations back to K m as in Eq. (5.9), we therefore obtain the submodule(1 + τ ) • C + l1,...,l d ⊆ (1 + τ )Z[G m ] d ,that we shall call the lattice of real class group relations between the G m -orbits of {L i ; i ∈ 1, d }. Remark 5.11. When h + m = 1, C + l1,...,l d is isomorphic to d copies of the integral group ring Z[G + m ] and the lattice of real class relations is simply (1

  5.17, we remove in [BLNR21, §B.4] the need of a random walk mapping any ideal of K m into Cl - Solve the ClDlp of ab on G m -orbits of the prime ideals L 1 , . . . , L d of Cl - m . This gives a vector

	92	Chapter 5. Using Explicit Stickelberger Generators
	2.
	restricting to cyclotomic fields such that h + m ≤ O( √	m) (Hyp. 5.18).	m , at the (small) price of
	An equivalent rewriting of CDW ([BLNR21, §B.2]).
	Omitting details, the CDW algorithm works as follows, for any challenge ideal a of K m [CDW21,
	Alg. 7]:
	1. Random walk to Cl -m : find b such that ab ∈ Cl -m .

Table 5 .

 5 2 -Geometric characteristics of L urs , L sat and L su for Q(ζ 152 ) and Q(ζ 211 ) using

	m d set k Vol 1/k	δ raw LLL bkz 40	max 1≤i≤k b i 2 raw LLL	bkz 40
			urs 107 8.691 2.016 1.570 1.551	45.007 38.466 38.202
		1	sat 107 6.928 4.398 1.787 1.822	752.306 23.280 21.720
	152		su 107 6.928 28.396 1.805 1.828 urs 179 9.683 2.157 1.623 1.590	3163.723 21.953 21.446 48.754 41.313 41.404
		2	sat 179 7.384 7.670 1.885 1.896	6273.562 23.280 22.772
			su 179 6.816 65.355 2.226 2.322	3427.134 23.221 24.741
		1	urs 314 14.325 2.672 2.291 2.257 sat 314 11.386 9.998 2.581 2.562	96.068 97.930 96.569 9742.552 59.387 59.578
	211	5	urs 1154 18.232 3.118 2.542 2.497 sat 1154 13.341 19.443 2.918 2.901 32067.612 71.428 72.752 118.124 119.160 115.888
		7	urs 1574 18.976 3.161 2.557 2.512 sat 1574 13.771 26.841 2.927 2.910 530646.708 71.428 72.752 120.838 121.129 119.020

Table 5 .

 5 m d ϕ tw -type k Vol 1/k δ max 1≤i≤k b i 2 raw LLL bkz 40 raw LLL bkz 40 221 9.697 12.473 2.305 2.244 12554.466 44.327 44.326 iso/tw 221 10.883 15.626 2.672 2.602 17754.669 49.653 49.399 noiso/exp 221 9.697 12.473 2.307 2.266 12554.466 43.736 45.013 noiso/tw 221 10.883 15.626 2.668 2.612 17754.669 49.143 48.693 2 iso/exp 369 10.150 14.472 2.507 2.467 12554.466 47.719 46.438 iso/tw 369 10.878 18.958 2.982 2.936 17754.669 52.622 53.154 noiso/exp 369 10.150 14.472 2.509 2.483 12554.466 48.576 47.820 noiso/tw 369 10.878 18.958 2.982 2.949 17754.669 54.041 50.666 3 iso/exp 517 10.410 22.211 2.569 2.531 85211.593 47.719 48.556 iso/tw 517 10.938 29.658 3.084 3.050 120507.386 52.788 53.154 noiso/exp 517 10.410 22.211 2.569 2.552 85211.593 48.576 48.778 noiso/tw 517 10.938 29.658 3.085 3.058 120507.386 54.041 52.131 4 iso/exp 665 10.632 20.731 2.606 2.576 85211.593 47.768 48.556 iso/tw 665 11.050 27.968 3.149 3.117 120507.386 53.017 53.154 noiso/exp 665 10.632 20.731 2.606 2.594 85211.593 48.576 48.778 noiso/tw 665 11.050 27.968 3.149 3.128 120507.386 54.041 52.385 587 10.845 13.713 3.168 3.167 13498.373 56.763 56.892 noiso/exp 587 10.321 10.348 2.617 2.615 9544.834 51.019 51.870 noiso/tw 587 10.845 13.713 3.169 3.167 13498.373 54.998 57.177 4 iso/exp 755 10.650 12.682 2.652 2.652 26820.239 54.045 52.543 iso/tw 755 11.068 16.973 3.221 3.219 37929.528 58.551 56.892 noiso/exp 755 10.650 12.682 2.649 2.650 26820.239 51.019 51.870 noiso/tw 755 11.068 16.973 3.221 3.220 37929.528 57.437 57.177 4 -Geometric characteristics of L sat for some cyclotomic fields. Comparison between choices iso/noiso and exp/tw.

		iso/exp 259 9.572 6.902 2.028 2.036	3168.773 36.062 35.703
	2	iso/tw 259 10.258 8.805 2.313 2.337 noiso/exp 259 9.572 6.902 2.024 2.024	4481.257 38.437 37.670 3168.773 35.579 35.802
	159	noiso/tw 259 10.258 8.805 2.317 2.334 iso/exp 363 9.978 7.602 2.066 2.066	4481.257 37.723 38.596 3168.773 37.480 37.132
	3	iso/tw 363 10.484 9.857 2.373 2.397 noiso/exp 363 9.978 7.602 2.064 2.064	4481.257 39.327 39.938 3168.773 38.643 38.255
		noiso/tw 363 10.484 9.857 2.376 2.392	4481.257 39.286 41.548
	149 iso/exp 516 1 1 iso/exp 251 9.395 6.508 2.341 2.359 iso/tw 251 10.544 8.112 2.739 2.733 noiso/exp 251 9.395 6.508 2.342 2.354 noiso/tw 251 10.544 8.112 2.730 2.739 2 iso/exp 419 9.818 8.208 2.550 2.565 iso/tw 419 10.522 10.682 3.059 3.062 noiso/exp 419 9.818 8.208 2.549 2.557 noiso/tw 419 10.522 10.682 3.055 3.064	4850.233 44.290 43.783 6859.195 49.680 50.548 4850.233 42.774 44.385 6859.195 52.260 50.964 5761.443 46.559 46.426 8147.832 51.931 53.538 5761.443 46.306 47.683 8147.832 52.534 51.448
		iso/exp 587 10.321 10.348 2.620 2.623	9544.834 49.096 49.971
	3	iso/tw

In fine, this PhD thesis has been largely financed thanks to the European Union PROMETHEUS project (Horizon

Research and Innovation Program, grant 780701).2 My PhD thesis mascot, a now-vegetarian Cryptosaur named after a maliciously-designed elliptic curve family, now trying to survive the quantum apocalypse.i

Alas, I was not able to refute Lch's infamous statistics.

La première version publiée de [DPW19] présentait un point de rencontre au degré 12000. Après la correction d'une erreur d'implémentation, découverte par Bernstein et rendue publique le 20 Août 2021 dans une présentation à la conférence SIAM, ce point de rencontre a été réévalué à 7000 [DPW19, Fig. 5].

Pour des raisons historiques, l'article [BEF + 17] est écrit spécifiquement pour les corps cyclotomiques de conducteurs une puissance de nombre premier, mais s'adapte directement au cas général pour le calcul des groupes de S-unités.

https://github.com/ob3rnard/Tw-Sti

The first published version of[START_REF] Ducas | On the shortness of vectors to be found by the Ideal-SVP quantum algorithm[END_REF] reported a crossover point at degree 12 000. After fixing a bug in the implementation, which was pointed out by Bernstein on 20 th August 2021 in a talk at SIAM Conference, this crossover point has been reevaluated to 7000 [DPW19, Fig.5].

The article [BEF + 17] is written for prime-power cyclotomic fields for historical reasons, but readily adapts to the general case for class group computations.

https://github.com/ob3rnard/Twisted-PHS

https://eprint.iacr.org/2020/1081 7 https://github.com/ob3rnard/Twisted-PHS

https://arxiv.org/abs/2109.13329 8 https://github.com/ob3rnard/Tw-Sti

https://eprint.iacr.org/2021/1384 8 https://github.com/ob3rnard/Tw-Sti

https://www.h2020prometheus.eu/dissemination/blog

2.1. On S-unit Groups

2.2. Cyclotomic Fields

Actually, the set M + defined in[START_REF] Kučera | On bases of the Stickelberger ideal and of the group of circular units of a cyclotomic field[END_REF] p.293] is M + = M + m ∪ {0}.

The article [BEF + 17] is written for prime-power cyclotomic fields for historical reasons, but readily adapts to the general case for class group computations.

3.2. The PHS Algorithm

This is at the heart of the analytic class number formula.

Note that SageMath is significantly faster than Magma for computing class groups, but behaves surprisingly poorly when it comes to computing S-units.7 https://github.com/ob3rnard/Twisted-PHS

3.5. Supplementary Experimental Data

This is backed up by several theoretical and computational observations, see e.g., Weber's conjecture h + 2 e = 1, Buhler, Pomerance and Robertson's conjecture for odd prime powers[START_REF] Buhler | Heuristics for class numbers of prime-power real cyclotomic fields[END_REF], and Schoof's extensive calculations in [Was97, Tab., §4] and[START_REF] Schoof | Class numbers of real cyclotomic fields of prime conductor[END_REF].

4.2. On Bases of S m

-1 0 0 • • • 0 • • • 0 0 0 1 1 -1 0 • • • 0 • • • 0 0 0 1 0 1 -1 • • • 0 • • • 0 0 0 . . . . .. . . . . . . . . . . . . . . . . . .

Note that for our purpose, the torsion units play no role and can thus be put aside.

m d set k Vol 1/k δ

Figure 5.6 -L sat lattices for Q(ζ 187 ) and Q(ζ 249 ): Gram-Schmidt log norms before and after reduction by BKZ 40 , for d = 1 and d = 2 G m -orbits.

Acknowledgements

Acknowledgements pandemic situation made everything more chaotic than necessary. Thanks to you all for putting up with me during this 3-years fulltime-absorbing task, and my most sincere apologies to the ones that were lost on track. I hope we will catch up again! Needless to say, I am immensely grateful for the exceptional love stars 3 that successively stood by me, pushed me and made me happy through thick and thin.

As a final wink, it is impossible for me not to deliver a tribute to all my plush animals, whose unconditional support even in the harshest moments was very comforting. 4 Rennes, June 2022

Chapter 3

Twisted-PHS: Using the Product Formula to Solve Approx-SVP in Ideal Lattices T his chapter is based on an extended version of the first contribution of this thesis, which is a joint work with Adeline Roux-Langlois.

Experimental Data

This is the first time to our knowledge that this type of algorithm is completely implemented and tested for fields of degrees up to 60. As a point of comparison, the experiments of [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF] constructed the log-S-unit lattice L phs for cyclotomic fields of degrees at most 24 and h K ≤ 3, all but the last two being principal [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF]Fig. 4.1].

Hardware and library description. All S-units and class group computations, for the log-S-unit lattice description and the ClDlp resolution, were performed using Magma v2.24-10 [BCP97]. 17 The BKZ reductions and Cvp/Svp computations used fplll v5.3.2 [START_REF]FpLLL development team: fplll, a lattice reduction library[END_REF]. All other parts of the experiments rely on SageMath v9.0 [START_REF]Sage Developers: SageMath, the Sage Mathematics Software System (Version 9.0)[END_REF]. All the sources and scripts are available as supplementary material on GitHub: ob3rnard/Twisted-PHS 7 . The experiments took less than a week on a server with 36 cores and 768 GB RAM.

Number fields. As announced in §2.1.1, we consider two families of number fields, namely non-principal cyclotomic fields Q(ζ m ) of prime conductors m ∈ 23, 71 , and NTRU Prime fields Q(z q ) where z q is a root of x q -x -1, for q ∈ 23, 47 prime. These correspond to the range of what is feasible in a reasonable amount of time, as the asymptotics of T Su (K) rapidly express in a classical setting.

For cyclotomic fields, we managed to compute S-units up to Q(ζ 71 ) for all factor bases in less than a day, and all log-S-unit lattice variants up to Q(ζ 61 ). For NTRU Prime fields, we managed all computations up to Q(z 47 ).

Targeted lattices. We evaluate the lattices computed by three algorithms: the original PHS algorithm, as implemented in [START_REF] Pellet-Mary | Published code of "Approx-SVP in ideal lattices with pre-processing[END_REF]; our optimized version Opt-PHS from §3.2.3, and our new twisted variant Twisted-PHS described in §3.3. This yields three different lattices, denoted by resp. L phs , L opt and L tw . There are a few differences between [START_REF] Pellet-Mary | Stehlé: Approx-SVP in ideal lattices with pre-processing[END_REF] and its implementation [START_REF] Pellet-Mary | Published code of "Approx-SVP in ideal lattices with pre-processing[END_REF], but we chose to stick to the provided implementation as much as possible.

In order to separate the improvements due to A tw-FB outputting smaller factor bases from those purely induced by our specific use of the product formula to describe the log-S-unit lattice, we also built lattices L (0) phs and L (0) opt corresponding to PHS and Opt-PHS algorithms, but using the same factor base as L tw .

BKZ reductions and CVP solving. We applied the same reduction strategy to all of our lattices. Namely, lattices of dimension less than 60 were HKZ reduced, while lattices of greater dimension were reduced using at most 300 loops of BKZ with block size 40. This yields reasonably good bases for a small computational cost [CN11, p.2]. The loop limit was in practice never hit.

For Cvp computations, we applied with these reduced bases Babai's Nearest Plane algorithm, as described in [Gal12, §18.1, Alg. 26].

Precision issues. Choosing the right bit precision for floating point arithmetic in the experiments is particularly tricky. We generically used at most 500 bits of precision in our experiments (corresponding to the lattice volume logarithm in base 2 plus some extra margin). There are two notable exceptions:

By Lem. 4.19 we know that a b,s ∈ {0, 1}, and so a b,s -1 2 ∈ -1 2 , 1 2 . So the length of each row of this matrix, as a vector in the Euclidean space of dimension ϕ(m) 2 , is equal to

2 . Therefore, by Hadamard's inequality,

.

A comparison with Eq. (4.34) gives the corollary.

Remark 4.37. For the marginal cases where 4

2 , better bounds exist for these scaled Hadamard matrices (see [START_REF] Browne | Catháin: A survey of the Hadamard maximal determinant problem[END_REF]) that directly translate into slightly better bounds for h - m . We do not dive into the details here.

Effective Short Stickelberger Generators

Let m > 1 satisfy m ≡ 2 (mod 4). Let be any prime such that ( , m) = 1 and let L be a fixed (unramified) prime ideal above of inertia degree f in the m-th cyclotomic field K m . The aim of this section is to describe an algebraic integer of K m generating the principal ideal L αm(b) for each b ∈ M m .

Of course, we shall use Gauss sums. Recall that for any positive integer r, we let ζ r = e 2πi/r . Let F = Z[ζ m ] L be the finite field of cardinality N (L) = f , and let χ L be the m-th power Legendre symbol with respect to L, i.e., for any a ∈ F × , the m-th root of unity χ L (a) ∈ ζ m is Chapter 5. Using Explicit Stickelberger Generators [Sch08, Th. 9.3(i) and Ex. 9.3] in the prime conductor case, and the proof has been adapted to any conductor in [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF]Lem. 4.4] to prove the shortness of the following generating set: W = w a ; a ∈ 2, m , with w a = θ m (1) + θ m (a -1) -θ m (a).

(5.3) Note that using θ m (a)+θ m (-a) = N m when m a, we obtain w a = w m-a+1 whenever 1 < a < m, and that w m = N m using also θ m (m) = 0. Hence, W is the set w a ; 2 ≤ a ≤ m 2 ∪ N m . We emphasize that only knowing a generating set of short elements as in [START_REF] Cramer | Mildly short vectors in cyclotomic ideal lattices in quantum polynomial time[END_REF] is not necessarily sufficient. Indeed, though it would be possible to build a basis from this generating set to solve the Cvp like in [CDW21, Cor. 2.2] without any geometric loss using e.g., [START_REF] Micciancio | Complexity of Lattice Problems[END_REF]Lem. 7.1], the slight Euclidean norm growth of the obtained basis vectors however translates into a dramatic increase of the size of the (possibly rational) coefficients of the corresponding generators, in a way that significantly hinders subsequent computations. In particular, in order to climb dimensions as far as possible and best approach log-S-unit lattices using the saturation process described in §5.2.4, it is crucial to constrain both the number of elements we use and their size, i.e., to use a basis of the Stickelberger lattice containing only short elements. Such a basis has been explicitly given in Th. 4.29, and can be computationally easily extracted from a very large family of short elements Pr. 4.15 encompassing W \ {N m } by Eq. ( 5.3):

so exactly one half of the coefficients of α are zeros. We stress that when m is a prime, this basis coincides with the one given by [Sch08, Th. 9.3(i)] and with the set W described in Eq. (5.3).

Note that the second part of the proposition actually specifies

Effective Stickelberger generators using Jacobi sums.

As previously mentioned, the proof of Stickelberger's theorem (see Th. 2.22) is explicit, i.e., for any α ∈ S m and any fractional ideal b of K m , it builds an explicit γ ∈ K m such that γ = b α [Was97, §6.2], [Sin80, §3.1]. Moreover, when α is a short basis element from Th. 5.5, it turns out that γ has a suprisingly simple expression using Jacobi sums as in §4.5.

We briefly specialize §4.5 to the split case here. Let ∈ Z be a prime such that ≡ 1 mod m, and let L be any fixed (split) prime ideal of K m above . Let a, b be such as in Pr. 5.4, then for α = θ m (a) + θ m (b) -θ m (a + b), we have that L α is a principal ideal generated by the following Jacobi sum (see Pr. 4.41:

where Full rank log-S-unit sublattices. The first maximal set of independent S-units that we consider is F from Eq. (5.13). The 2-saturation process of §5.2.4 mitigates the huge index of F, yielding family F sat . A fundamental system F su of the full S-unit group O × Km,S (modulo torsion) is also used whenever it is computable in reasonable time, i.e., up to ϕ(m) < 80. As noted in §2.1.3, their images under any log-S-embedding ϕ form full-rank sublattices resp. L urs , L sat , L su , generated by resp. ϕ(F), ϕ(F sat ), ϕ(F su ), of the corresponding full log-S-unit lattice ϕ(O × Km,S ). We consider several choices of the log-S-embedding ϕ. Namely, we tried to evaluate the advantage of using the expanded Log S (exp) over Log S , labelled tw (as twisted by [C : R] = 2). We also considered versions with (iso) or without (noiso) the isometry f H of Eq. (3.16). This yields four choices for ϕ, e.g., tag noiso/tw is ϕ = Log S and iso/exp gives the original

Compact product representation. In order to avoid the exponential growth of algebraic integers viewed in Z[x] Φ m (x) , we use a compact product representation, so that any element α in F (resp. F sat or F su ) is written on a set g 1 , . . . , g N of N small elements as α = N i=1 g ei i . Hence, besides the g i 's, each α is stored as a vector e ∈ Z N , and for any choice of ϕ, we have that ϕ(α) = N i=1 e i • ϕ(g i ). This allows us to compute ϕ without the coefficient explosion encountered in §3.4, which unlocks the full log-S-unit lattices computations beyond degree 60.

Lattice reductions. For each of the constructed log-S-unit sublattices, i.e., for each number of orbits d ∈ 1, d max , for each family of independent S-units F, F sat and (when available) F su , and for each choice of log-S-embedding, we compare several levels of reduction: no reduction ("raw"), LLL-reduction and BKZ 40 -reduction.

Geometry of the lattices

For all described choices of log-S-unit sublattices, we first evaluate several geometrical parameters (see §2.4.3): reduced volume V 1/k , root-Hermite factor δ 0 , orthogonality defect δ. For clarity's sake, we only give here a few examples giving a glimpse of what happens in general, and additional data can be found in §5.5.1.

Table 5.2 contains data for cyclotomic fields Q(ζ 152 ) and Q(ζ 211 ) of degrees resp. 72 and 210. All values correspond to the iso/exp log-S-embedding, i.e., ϕ = ϕ tw . Indeed, as illustrated by Tab. 5.4, we experimentally note that using (no)iso/exp seems geometrically slightly better than using (no)iso/tw. Notice how small is the normalized orthogonality defect after only LLL reduction, unambiguously below the tight Minkowski bound 1 + k 4 given in §2.4.3. We then look at the logarithm of the Gram-Schmidt norms, for every described choice of log-S-unit sublattices. Figure 5.2 plots the Gram-Schmidt log norms before and after BKZ reduction of the lattices L sat , using the original iso/exp log-S-embedding ϕ tw . As in Fig. 3.6-3.15, for each field the two curves are almost superposed. We also checked the impact of the

Gram-Schmidt logarithm norms

Here, we provide figures showing the Gram-Schmidt log norms for other cyclotomic fields and number of orbits, comparing values before and after reduction. First, we propose a new Twisted version of the PHS algorithm, using the S-units formalism and the Product Formula to twist the log-S-embedding with standard number-theoretic weights at finite places. This so-called Twisted-PHS algorithm provably reaches the same asymptotic trade-off between runtime and approximation factor than the PHS algorithm. On the practical side, we provide the first experimental evidence that using this normalization, the log-S-unit lattices have very peculiar geometric characteristics. Exact approximation factors obtained in small dimensions are strikingly small, in a way that could be subexponential or better. In order to reach dimensions where asymptotic phenomena start to express, we exhibit a short basis of the Stickelberger ideal of any cyclotomic field, and show how its explicit algebraic generators can be computed via Jacobi sums. Finally, using these extended Stickelberger techniques and all real class group relations, we were able to remove almost all quantum steps in the CDW algorithm, and to approximate the Twisted-PHS algorithm in all cyclotomic fields of degree up to 210. This allowed us to confirm the geometric peculiarities of twisted log-S-unit lattices, and to obtain an upper bound of the performance of the Twisted-PHS algorithm in medium dimensions.