Computing an LLL-reduced Basis of the Orthogonal Lattice Jingwei - PowerPoint PPT Presentation

Computing an LLL-reduced Basis of the Orthogonal Lattice Jingwei Chen Damien Stehl´ e Gilles Villard Chongqing Institute of Green and Intelligent Technology, Chinese Academy of Sciences Laboratoire LIP (UMR CNRS - ENS Lyon - UCB Lyon 1 - INRIA 5668) The 43rd ISSAC @ CUNY Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 1 / 14

Motivation The problem: Given A ∈ Z n × k , consider using LLL to reduce   K · a 1,1 K · a 1,2 · · · K · a 1,n . . . ...   . . .  . . .      K · a k,1 K · a k,2 · · · K · a k,n   � � rank( A )= k , LLL ∗ 0     . · · · 1 0 0 → − − − − − − − − − − − −   ∗ C n × ( n − k ) K large enough   · · ·  0 1 0     . . ...  . .   . . 0     0 0 · · · 1 Then C gives short vectors of � � m ∈ Z n : A T m = 0 L ⊥ ( A ) = = ker ( A T ) ∩ Z n , which we call the orthogonal lattice of A (kernel lattice of A T ). Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 2 / 14

Motivation The problem: Given A ∈ Z n × k , consider using LLL to reduce   K · a 1,1 K · a 1,2 · · · K · a 1,n . . . ...   . . .  . . .      K · a k,1 K · a k,2 · · · K · a k,n   � � rank( A )= k , LLL ∗ 0     . · · · 1 0 0 → − − − − − − − − − − − −   ∗ C n × ( n − k ) K large enough   · · ·  0 1 0     . . ...  . .   . . 0     0 0 · · · 1 Then C gives short vectors of � � m ∈ Z n : A T m = 0 L ⊥ ( A ) = = ker ( A T ) ∩ Z n , which we call the orthogonal lattice of A (kernel lattice of A T ). Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 2 / 14

Motivation The problem: Given A ∈ Z n × k , consider using LLL to reduce   K · a 1,1 K · a 1,2 · · · K · a 1,n . . . ...   . . .  . . .      K · a k,1 K · a k,2 · · · K · a k,n   � � rank( A )= k , LLL ∗ 0     . · · · 1 0 0 → − − − − − − − − − − − −   ∗ C n × ( n − k ) K large enough   · · ·  0 1 0     . . ...  . .   . . 0     0 0 · · · 1 Then C gives short vectors of � � m ∈ Z n : A T m = 0 L ⊥ ( A ) = = ker ( A T ) ∩ Z n , which we call the orthogonal lattice of A (kernel lattice of A T ). Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 2 / 14

Motivation The problem: LLL reducing ( K · A , I n ) T . • How large should the scaling parameter K be? n − 1 n − k 2 ·� A � k , where � A � = max � a i � . 2 · ( n − k ) • Sufficient: K > 2 • Heuristic: K > 2 Ω ( n ) · � A � k n − k . • How does K impact the complexity bound of LLL? asz ’82] : #iterations = O ( n 2 log ( K � A T � )) . [Lenstra, Lenstra, Lov´ • Example: n = 4 , k = 2 . T    8 69 99 29 A =  − 31 44 92 67 • sufficient K > 253 600 ; heuristic K > 2 015 ; best K = 233 . • When K > 458 , the number of LLL iterations remains. Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 3 / 14

Motivation The problem: LLL reducing ( K · A , I n ) T . • How large should the scaling parameter K be? n − 1 n − k 2 ·� A � k , where � A � = max � a i � . 2 · ( n − k ) • Sufficient: K > 2 • Heuristic: K > 2 Ω ( n ) · � A � k n − k . • How does K impact the complexity bound of LLL? asz ’82] : #iterations = O ( n 2 log ( K � A T � )) . [Lenstra, Lenstra, Lov´ • Example: n = 4 , k = 2 . T    8 69 99 29 A =  − 31 44 92 67 • sufficient K > 253 600 ; heuristic K > 2 015 ; best K = 233 . • When K > 458 , the number of LLL iterations remains. Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 3 / 14

Motivation The problem: LLL reducing ( K · A , I n ) T . • How large should the scaling parameter K be? n − 1 n − k 2 ·� A � k , where � A � = max � a i � . 2 · ( n − k ) • Sufficient: K > 2 • Heuristic: K > 2 Ω ( n ) · � A � k n − k . • How does K impact the complexity bound of LLL? asz ’82] : #iterations = O ( n 2 log ( K � A T � )) . [Lenstra, Lenstra, Lov´ • Example: n = 4 , k = 2 . T    8 69 99 29 A =  − 31 44 92 67 • sufficient K > 253 600 ; heuristic K > 2 015 ; best K = 233 . • When K > 458 , the number of LLL iterations remains. Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 3 / 14

Motivation The problem: LLL reducing ( K · A , I n ) T . • How large should the scaling parameter K be? n − 1 n − k 2 ·� A � k , where � A � = max � a i � . 2 · ( n − k ) • Sufficient: K > 2 • Heuristic: K > 2 Ω ( n ) · � A � k n − k . • How does K impact the complexity bound of LLL? asz ’82] : #iterations = O ( n 2 log ( K � A T � )) . [Lenstra, Lenstra, Lov´ • Example: n = 4 , k = 2 . T    8 69 99 29 A =  − 31 44 92 67 • sufficient K > 253 600 ; heuristic K > 2 015 ; best K = 233 . • When K > 458 , the number of LLL iterations remains. Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 3 / 14

Motivation The problem: LLL reducing ( K · A , I n ) T . • How large should the scaling parameter K be? n − 1 n − k 2 ·� A � k , where � A � = max � a i � . 2 · ( n − k ) • Sufficient: K > 2 • Heuristic: K > 2 Ω ( n ) · � A � k n − k . • How does K impact the complexity bound of LLL? asz ’82] : #iterations = O ( n 2 log ( K � A T � )) . [Lenstra, Lenstra, Lov´ • Example: n = 4 , k = 2 . T    8 69 99 29 A =  − 31 44 92 67 • sufficient K > 253 600 ; heuristic K > 2 015 ; best K = 233 . • When K > 458 , the number of LLL iterations remains. Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 3 / 14

Motivation The problem: LLL reducing ( K · A , I n ) T . • How large should the scaling parameter K be? n − 1 n − k 2 ·� A � k , where � A � = max � a i � . 2 · ( n − k ) • Sufficient: K > 2 • Heuristic: K > 2 Ω ( n ) · � A � k n − k . • How does K impact the complexity bound of LLL? asz ’82] : #iterations = O ( n 2 log ( K � A T � )) . [Lenstra, Lenstra, Lov´ • Example: n = 4 , k = 2 . T    8 69 99 29 A =  − 31 44 92 67 • sufficient K > 253 600 ; heuristic K > 2 015 ; best K = 233 . • When K > 458 , the number of LLL iterations remains. Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 3 / 14

Motivation The problem: LLL reducing ( K · A , I n ) T . • How large should the scaling parameter K be? n − 1 n − k 2 ·� A � k , where � A � = max � a i � . 2 · ( n − k ) • Sufficient: K > 2 • Heuristic: K > 2 Ω ( n ) · � A � k n − k . • How does K impact the complexity bound of LLL? asz ’82] : #iterations = O ( n 2 log ( K � A T � )) . [Lenstra, Lenstra, Lov´ • Example: n = 4 , k = 2 . T    8 69 99 29 A =  − 31 44 92 67 • sufficient K > 253 600 ; heuristic K > 2 015 ; best K = 233 . • When K > 458 , the number of LLL iterations remains. Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 3 / 14

Contribution captures the behavior of LLL more accurately A new potential function for the LLL algorithm. • a variant of the classic one A better bound on #iterations of LLL for computing a reduced • basis of the orthogonal lattice L ⊥ ( A ) . • We prove that #iterations is independent of K for large K . • [Pohst ’87], [Havas, Majewski & Matthews ’98] Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 4 / 14

Contribution captures the behavior of LLL more accurately A new potential function for the LLL algorithm. • a variant of the classic one A better bound on #iterations of LLL for computing a reduced • basis of the orthogonal lattice L ⊥ ( A ) . • We prove that #iterations is independent of K for large K . • [Pohst ’87], [Havas, Majewski & Matthews ’98] Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 4 / 14

Contribution captures the behavior of LLL more accurately A new potential function for the LLL algorithm. • a variant of the classic one A better bound on #iterations of LLL for computing a reduced • basis of the orthogonal lattice L ⊥ ( A ) . • We prove that #iterations is independent of K for large K . • [Pohst ’87], [Havas, Majewski & Matthews ’98] Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 4 / 14