[PPT] - Computing an LLL-reduced Basis of the Orthogonal Lattice Jingwei PowerPoint Presentation

SLIDE 1

Computing an LLL-reduced Basis of the Orthogonal Lattice

Jingwei Chen Damien Stehl´ e Gilles Villard

Chongqing Institute of Green and Intelligent Technology, Chinese Academy of Sciences Laboratoire LIP (UMR CNRS - ENS Lyon - UCB Lyon 1 - INRIA 5668) The 43rd ISSAC @ CUNY

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 1 / 14

SLIDE 2

Motivation

The problem: Given A ∈ Zn×k, consider using LLL to reduce

                K · a1,1 K · a1,2 · · · K · a1,n . . . . . . ... . . . K · ak,1 K · ak,2 · · · K · ak,n 1 · · · 1 · · · . . . . . . ... · · · 1                

rank(A)=k, LLL − − − − − − − − − − − − → K large enough

∗

Cn×(n−k) ∗

.

Then C gives short vectors of L⊥(A) =

m ∈ Zn : ATm = 0
= ker(AT) ∩ Zn,

which we call the orthogonal lattice of A (kernel lattice of AT).

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 2 / 14

SLIDE 3

Motivation

The problem: Given A ∈ Zn×k, consider using LLL to reduce

                K · a1,1 K · a1,2 · · · K · a1,n . . . . . . ... . . . K · ak,1 K · ak,2 · · · K · ak,n 1 · · · 1 · · · . . . . . . ... · · · 1                

rank(A)=k, LLL − − − − − − − − − − − − → K large enough

∗

Cn×(n−k) ∗

.

Then C gives short vectors of L⊥(A) =

m ∈ Zn : ATm = 0
= ker(AT) ∩ Zn,

which we call the orthogonal lattice of A (kernel lattice of AT).

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 2 / 14

SLIDE 4

Motivation

The problem: Given A ∈ Zn×k, consider using LLL to reduce

                K · a1,1 K · a1,2 · · · K · a1,n . . . . . . ... . . . K · ak,1 K · ak,2 · · · K · ak,n 1 · · · 1 · · · . . . . . . ... · · · 1                

rank(A)=k, LLL − − − − − − − − − − − − → K large enough

∗

Cn×(n−k) ∗

.

Then C gives short vectors of L⊥(A) =

m ∈ Zn : ATm = 0
= ker(AT) ∩ Zn,

which we call the orthogonal lattice of A (kernel lattice of AT).

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 2 / 14

SLIDE 5

Motivation

The problem: LLL reducing (K · A, In)T.

How large should the scaling parameter K be?
Sufficient: K > 2

n−1 2 ·(n−k) n−k 2 ·Ak, where A = max ai.

Heuristic: K > 2Ω(n) · A

k n−k .

How does K impact the complexity bound of LLL?
[Lenstra, Lenstra, Lov´

asz ’82]: #iterations = O(n2 log(KAT)) .

Example: n = 4, k = 2.

A =

  8

69 99 29 44 92 −31 67

 

T

sufficient K > 253 600; heuristic K > 2 015; best K = 233.
When K > 458, the number of LLL iterations remains.

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 3 / 14

SLIDE 6

Motivation

The problem: LLL reducing (K · A, In)T.

How large should the scaling parameter K be?
Sufficient: K > 2

n−1 2 ·(n−k) n−k 2 ·Ak, where A = max ai.

Heuristic: K > 2Ω(n) · A

k n−k .

How does K impact the complexity bound of LLL?
[Lenstra, Lenstra, Lov´

asz ’82]: #iterations = O(n2 log(KAT)) .

Example: n = 4, k = 2.

A =

  8

69 99 29 44 92 −31 67

 

T

sufficient K > 253 600; heuristic K > 2 015; best K = 233.
When K > 458, the number of LLL iterations remains.

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 3 / 14

SLIDE 7

Motivation

The problem: LLL reducing (K · A, In)T.

How large should the scaling parameter K be?
Sufficient: K > 2

n−1 2 ·(n−k) n−k 2 ·Ak, where A = max ai.

Heuristic: K > 2Ω(n) · A

k n−k .

How does K impact the complexity bound of LLL?
[Lenstra, Lenstra, Lov´

asz ’82]: #iterations = O(n2 log(KAT)) .

Example: n = 4, k = 2.

A =

  8

69 99 29 44 92 −31 67

 

T

sufficient K > 253 600; heuristic K > 2 015; best K = 233.
When K > 458, the number of LLL iterations remains.

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 3 / 14

SLIDE 8

Motivation

The problem: LLL reducing (K · A, In)T.

How large should the scaling parameter K be?
Sufficient: K > 2

n−1 2 ·(n−k) n−k 2 ·Ak, where A = max ai.

Heuristic: K > 2Ω(n) · A

k n−k .

How does K impact the complexity bound of LLL?
[Lenstra, Lenstra, Lov´

asz ’82]: #iterations = O(n2 log(KAT)) .

Example: n = 4, k = 2.

A =

  8

69 99 29 44 92 −31 67

 

T

sufficient K > 253 600; heuristic K > 2 015; best K = 233.
When K > 458, the number of LLL iterations remains.

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 3 / 14

SLIDE 9

Motivation

The problem: LLL reducing (K · A, In)T.

How large should the scaling parameter K be?
Sufficient: K > 2

n−1 2 ·(n−k) n−k 2 ·Ak, where A = max ai.

Heuristic: K > 2Ω(n) · A

k n−k .

How does K impact the complexity bound of LLL?
[Lenstra, Lenstra, Lov´

asz ’82]: #iterations = O(n2 log(KAT)) .

Example: n = 4, k = 2.

A =

  8

69 99 29 44 92 −31 67

 

T

sufficient K > 253 600; heuristic K > 2 015; best K = 233.
When K > 458, the number of LLL iterations remains.

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 3 / 14

SLIDE 10

Motivation

The problem: LLL reducing (K · A, In)T.

How large should the scaling parameter K be?
Sufficient: K > 2

n−1 2 ·(n−k) n−k 2 ·Ak, where A = max ai.

Heuristic: K > 2Ω(n) · A

k n−k .

How does K impact the complexity bound of LLL?
[Lenstra, Lenstra, Lov´

asz ’82]: #iterations = O(n2 log(KAT)) .

Example: n = 4, k = 2.

A =

  8

69 99 29 44 92 −31 67

 

T

sufficient K > 253 600; heuristic K > 2 015; best K = 233.
When K > 458, the number of LLL iterations remains.

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 3 / 14

SLIDE 11

Motivation

The problem: LLL reducing (K · A, In)T.

How large should the scaling parameter K be?
Sufficient: K > 2

n−1 2 ·(n−k) n−k 2 ·Ak, where A = max ai.

Heuristic: K > 2Ω(n) · A

k n−k .

How does K impact the complexity bound of LLL?
[Lenstra, Lenstra, Lov´

asz ’82]: #iterations = O(n2 log(KAT)) .

Example: n = 4, k = 2.

A =

  8

69 99 29 44 92 −31 67

 

T

sufficient K > 253 600; heuristic K > 2 015; best K = 233.
When K > 458, the number of LLL iterations remains.

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 3 / 14

SLIDE 12

Contribution

captures the behavior of LLL more accurately

A new potential function for the LLL algorithm.

a variant of the classic one

A better bound on #iterations of LLL for computing a reduced

basis of the orthogonal lattice L⊥(A).

We prove that #iterations is independent of K for large K.
[Pohst ’87], [Havas, Majewski & Matthews ’98]

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 4 / 14

SLIDE 13

Contribution

captures the behavior of LLL more accurately

A new potential function for the LLL algorithm.

a variant of the classic one

A better bound on #iterations of LLL for computing a reduced

basis of the orthogonal lattice L⊥(A).

We prove that #iterations is independent of K for large K.
[Pohst ’87], [Havas, Majewski & Matthews ’98]

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 4 / 14

SLIDE 14

Contribution

captures the behavior of LLL more accurately

A new potential function for the LLL algorithm.

a variant of the classic one

A better bound on #iterations of LLL for computing a reduced

basis of the orthogonal lattice L⊥(A).

We prove that #iterations is independent of K for large K.
[Pohst ’87], [Havas, Majewski & Matthews ’98]

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 4 / 14

SLIDE 15

Contribution

captures the behavior of LLL more accurately

A new potential function for the LLL algorithm.

a variant of the classic one

A better bound on #iterations of LLL for computing a reduced

basis of the orthogonal lattice L⊥(A).

We prove that #iterations is independent of K for large K.
[Pohst ’87], [Havas, Majewski & Matthews ’98]

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 4 / 14

SLIDE 16

Contribution

captures the behavior of LLL more accurately

A new potential function for the LLL algorithm.

a variant of the classic one

A better bound on #iterations of LLL for computing a reduced

basis of the orthogonal lattice L⊥(A).

We prove that #iterations is independent of K for large K.
[Pohst ’87], [Havas, Majewski & Matthews ’98]

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 4 / 14

SLIDE 17

Background

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 5 / 14

SLIDE 18

Lattices and LLL reduced basis

An n-dim. lattice: Λ =
Z · bi for linearly indep. (bi)i≤n.
Lattice basis: B = (b1, b2, · · · , bn).
SVP: Given a basis of Λ, find a shortest non-zero vector.
SVP is hard.
But, approximations (e.g., LLL-reduced bases) are still useful.

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 6 / 14

SLIDE 19

Lattices and LLL reduced basis

An n-dim. lattice: Λ =
Z · bi for linearly indep. (bi)i≤n.
Lattice basis: B = (b1, b2, · · · , bn).
SVP: Given a basis of Λ, find a shortest non-zero vector.
SVP is hard.
But, approximations (e.g., LLL-reduced bases) are still useful.

LLL-reduced basis

Let b1, . . . , bn be a basis for a lattice Λ, b∗

i the ith GS vector, and

µi,j the GS coefficients. Then we call the basis is LLL-reduced if (1) |µi,j| ≤ 1 2 for 1 ≤ j ≤ i ≤ n, (2) b∗

i 2 ≤ 2b∗ i+12 for 1 ≤ i ≤ n − 1. [Siegel condition]

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 6 / 14

SLIDE 20

Lattices and LLL reduced basis

An n-dim. lattice: Λ =
Z · bi for linearly indep. (bi)i≤n.
Lattice basis: B = (b1, b2, · · · , bn).
SVP: Given a basis of Λ, find a shortest non-zero vector.
SVP is hard.
But, approximations (e.g., LLL-reduced bases) are still useful.

b1 b2

n = 2

LLL-reduced is “nice”

not too far from orthogonal
GS lengths do not drop “too” fast
short first vector: b1 ≤ 2

n−1 2 λ1(Λ),

where λ1(Λ) = min{b ∈ Λ \ 0}.

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 6 / 14

SLIDE 21

Lattices and LLL reduced basis

An n-dim. lattice: Λ =
Z · bi for linearly indep. (bi)i≤n.
Lattice basis: B = (b1, b2, · · · , bn).
SVP: Given a basis of Λ, find a shortest non-zero vector.
SVP is hard.
But, approximations (e.g., LLL-reduced bases) are still useful.

b1 b2

n = 2

LLL-reduced is “nice”

not too far from orthogonal
GS lengths do not drop “too” fast
short first vector: b1 ≤ 2

n−1 2 λ1(Λ),

where λ1(Λ) = min{b ∈ Λ \ 0}.

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 6 / 14

SLIDE 22

The LLL algorithm [Lenstra, Lenstra, Lov´

asz ’82]

Input: A basis (bi)i≤n of a lattice Λ ⊆ Zm. Output: An LLL-reduced basis of Λ.

1 k := 1. 2 While k ≤ n − 1 do

a. Size-reduce bk+1 with respect to bk.
b. If the Siegel condition holds for k, then k := k + 1.
c. Else SWAP bk and bk+1; set k := max{k − 1, 1}.

3 Return the current basis (bi)i≤n.

The cost ≈ “#iterations” × “the cost of per iteration”

#iterations ≤ 2#swaps+n; #swaps = O(n2 log B).

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 7 / 14

SLIDE 23

The LLL algorithm [Lenstra, Lenstra, Lov´

asz ’82]

Input: A basis (bi)i≤n of a lattice Λ ⊆ Zm. Output: An LLL-reduced basis of Λ.

1 k := 1. 2 While k ≤ n − 1 do

a. Size-reduce bk+1 with respect to bk.
b. If the Siegel condition holds for k, then k := k + 1.
c. Else SWAP bk and bk+1; set k := max{k − 1, 1}.

3 Return the current basis (bi)i≤n.

The cost ≈ “#iterations” × “the cost of per iteration”

#iterations ≤ 2#swaps+n; #swaps = O(n2 log B).

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 7 / 14

SLIDE 24

The LLL algorithm [Lenstra, Lenstra, Lov´

asz ’82]

Input: A basis (bi)i≤n of a lattice Λ ⊆ Zm. Output: An LLL-reduced basis of Λ.

1 k := 1. 2 While k ≤ n − 1 do

a. Size-reduce bk+1 with respect to bk.
b. If the Siegel condition holds for k, then k := k + 1.
c. Else SWAP bk and bk+1; set k := max{k − 1, 1}.

3 Return the current basis (bi)i≤n.

The cost ≈ “#iterations” × “the cost of per iteration”

#iterations ≤ 2#swaps+n; #swaps = O(n2 log B).

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 7 / 14

SLIDE 25

The classic potential for LLL

Let B be a basis of an n-dimensional lattice. Define Π(B) =

n−1

i=1

(n − i) log b∗

i .

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 8 / 14

SLIDE 26

The classic potential for LLL

Let B be a basis of an n-dimensional lattice. Define Π(B) =

n−1

i=1

(n − i) log b∗

i .

Properties

At the begining, Π(B) can be bounded from above.
Each LLL swap decreases Π(B) by a constant.
At the end, Π(B) can be bounded from below.

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 8 / 14

SLIDE 27

The classic potential for LLL

Let B be a basis of an n-dimensional lattice. Define Π(B) =

n−1

i=1

(n − i) log b∗

i .

Figure: Sandpile model for LLL (Figure courtesy of Brigitte Vall´ ee)

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 8 / 14

SLIDE 28

The new potential

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 9 / 14

SLIDE 29

Observations

log b∗

i ’s

k n − k Figure: At the beginning n − k k Figure: At the end

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 30

Observations

max

i

log b∗

i

min

i

log b∗

i

log b∗

i ’s

n − k k Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 31

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 32

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 33

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 34

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 35

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 36

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 37

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 38

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 39

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 40

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 41

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 42

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 43

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 44

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 45

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 46

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 47

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 48

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 49

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 50

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 51

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 52

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 53

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 54

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 55

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 56

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 57

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 58

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 59

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 60

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 61

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 62

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 63

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 64

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 65

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 66

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 67

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 68

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 69

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 70

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 71

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 72

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 73

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 74

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 75

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 76

Observations

log b∗

i ’s

n − k k max

i

log b∗

i

min

i

log b∗

i

Figure: An example

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 10 / 14

SLIDE 77

Basic idea: capture the unbalance

Observation

Those vectors with small GS lengths do not interfere much with those vectors with large GS lengths.

Partition the vectors into two groups by their GS lengths
the k vectors with larger GS length
the other n − k vectors with smaller GS length
Partition all swaps into three kinds
small ↔ small
large ↔ large
small ↔ large
[van Hoeij & Novocin ’10]

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 11 / 14

SLIDE 78

Basic idea: capture the unbalance

Observation

Those vectors with small GS lengths do not interfere much with those vectors with large GS lengths.

Partition the vectors into two groups by their GS lengths
the k vectors with larger GS length
the other n − k vectors with smaller GS length
Partition all swaps into three kinds
small ↔ small
large ↔ large
small ↔ large
[van Hoeij & Novocin ’10]

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 11 / 14

SLIDE 79

Basic idea: capture the unbalance

Observation

Those vectors with small GS lengths do not interfere much with those vectors with large GS lengths.

Partition the vectors into two groups by their GS lengths
the k vectors with larger GS length
the other n − k vectors with smaller GS length
Partition all swaps into three kinds
small ↔ small
large ↔ large
small ↔ large
[van Hoeij & Novocin ’10]

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 11 / 14

SLIDE 80

The new potential function

Let k ≤ n ≤ m and B ∈ Rm×n.
s1 < · · · < sn−k: the indices of the n − k smallest GS lengths
ℓ1 < · · · < ℓk: the indices of the other k GS lengths

We define Πk(B) =

k−1

j=1

(k − j) log b∗

ℓj − n−k

i=1

i log b∗

si + n−k

i=1

si . large ↔ large small ↔ small large ↔ small

Πn(B) = Π(B).

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 12 / 14

SLIDE 81

The new potential function

Let k ≤ n ≤ m and B ∈ Rm×n.
s1 < · · · < sn−k: the indices of the n − k smallest GS lengths
ℓ1 < · · · < ℓk: the indices of the other k GS lengths

We define Πk(B) =

k−1

j=1

(k − j) log b∗

ℓj − n−k

i=1

i log b∗

si + n−k

i=1

si . large ↔ large small ↔ small large ↔ small

Πn(B) = Π(B).

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 12 / 14

SLIDE 82

The new potential function

Let k ≤ n ≤ m and B ∈ Rm×n.
s1 < · · · < sn−k: the indices of the n − k smallest GS lengths
ℓ1 < · · · < ℓk: the indices of the other k GS lengths

We define Πk(B) =

k−1

j=1

(k − j) log b∗

ℓj − n−k

i=1

i log b∗

si + n−k

i=1

si . large ↔ large small ↔ small large ↔ small

Πn(B) = Π(B).

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 12 / 14

SLIDE 83

The new potential function

Let k ≤ n ≤ m and B ∈ Rm×n.
s1 < · · · < sn−k: the indices of the n − k smallest GS lengths
ℓ1 < · · · < ℓk: the indices of the other k GS lengths

We define Πk(B) =

k−1

j=1

(k − j) log b∗

ℓj − n−k

i=1

i log b∗

si + n−k

i=1

si . large ↔ large small ↔ small large ↔ small

Πn(B) = Π(B).

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 12 / 14

SLIDE 84

The new potential function

Let k ≤ n ≤ m and B ∈ Rm×n.
s1 < · · · < sn−k: the indices of the n − k smallest GS lengths
ℓ1 < · · · < ℓk: the indices of the other k GS lengths

We define Πk(B) =

k−1

j=1

(k − j) log b∗

ℓj − n−k

i=1

i log b∗

si + n−k

i=1

si . large ↔ large small ↔ small large ↔ small

Πn(B) = Π(B).

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 12 / 14

SLIDE 85

The new potential function

Let k ≤ n ≤ m and B ∈ Rm×n.
s1 < · · · < sn−k: the indices of the n − k smallest GS lengths
ℓ1 < · · · < ℓk: the indices of the other k GS lengths

We define Πk(B) =

k−1

j=1

(k − j) log b∗

ℓj − n−k

i=1

i log b∗

si + n−k

i=1

si . large ↔ large small ↔ small large ↔ small

Πn(B) = Π(B).

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 12 / 14

SLIDE 86

The new potential function

Let k ≤ n ≤ m and B ∈ Rm×n.
s1 < · · · < sn−k: the indices of the n − k smallest GS lengths
ℓ1 < · · · < ℓk: the indices of the other k GS lengths

We define Πk(B) =

k−1

j=1

(k − j) log b∗

ℓj − n−k

i=1

i log b∗

si + n−k

i=1

si . large ↔ large small ↔ small large ↔ small

Πn(B) = Π(B).

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 12 / 14

SLIDE 87

The new potential function

Let k ≤ n ≤ m and B ∈ Rm×n.
s1 < · · · < sn−k: the indices of the n − k smallest GS lengths
ℓ1 < · · · < ℓk: the indices of the other k GS lengths

We define Πk(B) =

k−1

j=1

(k − j) log b∗

ℓj − n−k

i=1

i log b∗

si + n−k

i=1

si . large ↔ large small ↔ small large ↔ small

Πn(B) = Π(B).

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 12 / 14

SLIDE 88

Properties of Πk(B)

Monotonicity

Let B and B′ be the current n-dimensional lattice bases before and after an LLL swap. Then for any k ≤ n, we have Πk(B) − Πk(B′) ≥ log(2/ √ 3).

Bounding #swaps

Given full column rank matrix B as input, LLL returns B′. Then #swaps that LLL performs is no greater than min

1≤k≤n

Πk(B) − Πk(B′) log

2

√ 3

.

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 13 / 14

SLIDE 89

Properties of Πk(B)

Monotonicity

Let B and B′ be the current n-dimensional lattice bases before and after an LLL swap. Then for any k ≤ n, we have Πk(B) − Πk(B′) ≥ log(2/ √ 3).

Bounding #swaps

Given full column rank matrix B as input, LLL returns B′. Then #swaps that LLL performs is no greater than min

1≤k≤n

Πk(B) − Πk(B′) log

2

√ 3

.

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 13 / 14

SLIDE 90

Applying Πk(B) to (K · A, In)T

The main result

Let K be a sufficiently large integer. Then, given (K · A, In)T as input, LLL computes (as a submatrix of the returned basis) an LLL-reduced basis of L⊥(A) after at most O(k3 + k(n − k)(1 + log A)) LLL swaps.

Future work

Apply to more general bit complexity studies of LLL.
Apply to more special input bases for LLL.

Thanks

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 14 / 14

SLIDE 91

Applying Πk(B) to (K · A, In)T

The main result

Let K be a sufficiently large integer. Then, given (K · A, In)T as input, LLL computes (as a submatrix of the returned basis) an LLL-reduced basis of L⊥(A) after at most O(k3 + k(n − k)(1 + log A)) LLL swaps.

Future work

Apply to more general bit complexity studies of LLL.
Apply to more special input bases for LLL.

Thanks

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 14 / 14

SLIDE 92

Applying Πk(B) to (K · A, In)T

The main result

Let K be a sufficiently large integer. Then, given (K · A, In)T as input, LLL computes (as a submatrix of the returned basis) an LLL-reduced basis of L⊥(A) after at most O(k3 + k(n − k)(1 + log A)) LLL swaps.

Future work

Apply to more general bit complexity studies of LLL.
Apply to more special input bases for LLL.

Thanks

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 14 / 14

SLIDE 93

Applying Πk(B) to (K · A, In)T

The main result

Let K be a sufficiently large integer. Then, given (K · A, In)T as input, LLL computes (as a submatrix of the returned basis) an LLL-reduced basis of L⊥(A) after at most O(k3 + k(n − k)(1 + log A)) LLL swaps.

Future work

Apply to more general bit complexity studies of LLL.
Apply to more special input bases for LLL.

Thanks

Jingwei Chen (CAS) Computing an LLL-reduced Basis of the Orthogonal Lattice 2018/07/18 14 / 14