On the smallest ratio problem of lattice bases

Transcription

1 On the smallest ratio problem of lattice bases Jianwei Li KLMM, Academy of Mathematics and Systems Science, The Chinese Academy of Sciences, Beijing 0090, China Abstract Let (b,..., b n ) be a lattice basis with Gram-Schmidt orthogonalization (b,..., b n), the quantities b / b i for i =,..., n play important roles in analyzing lattice reduction algorithms and lattice enumeration algorithms. In this paper, we study the problem of minimizing the quantity b / b n over all bases (b,..., b n ) of a given n-dimensional lattice. We first prove that there exists a basis (b,..., b n ) for any lattice L of dimension n such that b = min v L\{0} v, b / b i i and b i / b i i.5 for i n. This leads us to introduce a new NP-hard computational problem, that is, the smallest ratio problem (SRP): given an n-dimensional lattice L, find a basis (b,..., b n ) of L such that b / b n is minimal. The problem inspires the new lattice invariant µ n (L) = min{ b / b n : (b,..., b n ) is a basis of L} and new lattice constant µ n = max µ n (L) over all n-dimensional lattices L: both the minimum and maximum are justified. The properties of µ n (L) and µ n are discussed. We also present an exact algorithm and an approximation algorithm for SRP. To the best of our nowledge, this is the first sound study of SRP. Our wor provides a new perspective on both the quality limits of lattice reduction algorithms and complexity estimates of enumeration algorithms. Keywords. lattice reduction, lattice enumeration algorithms, smallest ratio problem AMS subject classifications. H06, Y6, 68W5 Introduction Let R m be the m-dimensional Euclidean space. A lattice L in R m is a discrete and additive subgroup of R m, or equivalently, the set of all integer linear combinations of n linearly independent vectors b,..., b n in R m (m n): L = { n i= x i b i, x i Z}. Such a set (b,..., b n ) forms a basis of L, which has a unique Gram-Schmidt orthogonalization (b,..., b n). All the bases of L have the same number n of elements, called the dimension of L, and they all have the same n-dimensional volume, called the volume vol(l) or determinant of L. As usual, L(B) or L(b,..., b n ) denotes the lattice spanned by the n columns of a basis B = (b,..., b n ). The most famous computational problem involving lattices is the shortest vector problem (SVP), which ass to find a nonzero lattice vector of smallest norm, given a lattice basis as input. Algorithms for solving SVP either exactly or approximately have proved invaluable in many fields of mathematics and computer science, notably in cryptology (see [,, 8,, 6,, 44, 45, 4]). There are two main algorithmic techniques for SVP (and hence for other related lattice problems). The first and basic approach is the enumeration technique, which dates bac to the early wor by Pohst [47], Kannan [5], and Fince-Pohst [], and is still actively investigated (see [5, 56,, 8, 48, 6, 7, 59, 0, 60, 8, 9]). Intuitively, enumeration algorithms perform an exhaustive search of all extremely short lattice vectors within exponential time or worse. This is unavoidable because of NP-hardness: SVP is nown to be NP-hard under randomized reductions [, 0]. The hardness of SVP has led mathematicians and computer scientists to usually find a short vector instead of the shortest one. It is equivalent to finding good reduced bases consisting of reasonably short and almost orthogonal vectors: this is the second technique, nown as lattice reduction. Lattice reduction was revived with the celebrated LLL algorithm [9], continued with blocwise algorithms [5, 56,, 4], and is still very active in recent years (see, e.g., [7, 7, 46, 5, 0, 9]).

2 From the computational perspective, the most natural reduction is HKZ-reduction introduced by Hermite [] and Korine and Zolotareff [6]. HKZ-reduced bases have very strong quality, but are expensive to compute. Contrarily, LLL-reduction is wea but fairly cheap. HKZ-reduced bases have a classicial property [7, Proposition 4.]: if a basis (b,..., b n ) of an n-dimensional lattice L is HKZ-reduced, then b = λ (L), b / b i i(+ln i)/ and b i / b i i+ ln i for i =,..., n, where λ (L) is the length of the shortest nonzero vector of L. The similar result on LLL-reduced bases is the following [9]: if a basis (b,..., b n ) of a lattice L is LLL-reduced (with factor /), then b (n )/ λ (L), b / b i (i )/ and b i / b i (i )/ for i =,..., n. Since b /vol(l) /n = n i= ( b / b i )/n and b /λ (L) max i n b / b i, the ratios b / b i are crucial to the Hermite factor b /vol(l) /n and approximation factor b /λ (L), both of which are typically used to measure the quality of a basis (b,..., b n ); see [9, 5, 54,, 5, 4, 7]. Since ( n i= b i )/vol(l) = ni= ( b i / b i ), the ratios b i / b i are natively related to the orthogonality defect ( n i= b i )/vol(l), which gives a measure of the orthogonality of a basis (b,..., b n ) [8, 7]. It is natural to as whether there exists a basis (b,..., b n ) for any lattice L of dimension n such that the ratios b /λ (L), b / b i and b i / b i have bounds polynomial in i for i =,..., n. The quantities b / b i are of significant interest to enumeration algorithms and lattice reduction algorithms in both theory and practice: In enumeration algorithms, the cost of enumeration depends on the quality of the basis with respect to the ratios b / b i ; the smaller the quantities b / b i, the faster the enumeration; see, e.g., [5,, 5, 56, 6, 8]). As an example in practice, the preprocessing of local blocs in BKZ.0 [7] speeds up enumeration on the projected lattices L(B [i, j] ) by decreasing the quantity max i j b i / b, where B = (b,..., b n ) denotes the input basis and B [i, j] denotes the projected bloc of the vectors b i,..., b j over span(b,..., b i ). Some classical lattice reduction algorithms follow the paradigm below (see Appendix A for the proof). Proposition. (Paradigm of lattice reduction). Let L be an n-dimensional lattice where n = p with p,. If a basis B = (b,..., b n ) of L satisfies the following two sets of conditions:. Hermite conditions: b i+ g() vol(b [i+,i+]) / for i = 0,..., p ;. Lined conditions: b i+ h( + ) b i++ for i = 0,..., p, where both g() and h() are functions on. Then b g() h( + ) (n )/ vol(l) /n. Furthermore, if b i+ + ελ (L(B [i+,i+] )) for i = 0,..., p with factor ε 0, then b + ε h( + ) (n )/ λ (L). It can be checed that the LLL-reduction [9], BKZ-reduction [5, 56], Schnorr s semi -reduction [5] and Gama-Nguyen s slide reduction [4] follow the paradigm. Interestingly, slide reduction provides the best polynomial-time blocwise algorithm nown, which provably approximates SVP within a factor corresponding to the classical Mordell s inequality [4]. This means that at least in theory, the local ratios b i+ / b i++ may play a more important role on the quality of lattice reduction than the local Hermite factors b i+ /vol(b [i+,i+]) /. In the implementation of lattice reduction algorithms, the extensive experiments provided in [55, 5, 7] obtain good reduced bases by decreasing the quantity max i n b / b i. The ratios b / b i are also useful in analyzing simultaneous reduction [9, 57]. Specifically, given an n- dimensional lattice L, let B = (b,..., b n ) be a basis of L and D = (d,..., d n ) be the dual basis of B, simultaneous reduction is to minimize the quantity S (B) = max i n ( b i d i ) when B is taen over all bases of L: S (B) is locally dominated by the value max i j n b i /b j (see [57, p. 69]).

3 Hence, it is interesting and useful to study the minimality of the ratio b / b i (including in the worst-case) for i = n,...,. These essentially refer to the problem of minimizing the quantity b / b n over all bases (b,..., b n ) of a given n-dimensional lattice. A natural question is whether there exists a basis (b,..., b n ) for any given n- dimensional lattice such that b / b n is minimal. If yes, it becomes interesting to further discuss the hardness and algorithmic aspects of the computational problem of finding such a basis. In mathematics, SVP with respect to the Euclidian norm is tightly related to the study of Hermite s constants γ n, which are defined as γ n = max(λ (L)/vol(L) /n ) over all n-dimensional lattices L. These fundamental parameters in the geometry of numbers are typically used in the study of both enumeration algorithms and lattice reduction algorithms, e.g., to measure the running time [, 8] and output quality [4, 7] respectively. By analogy with this case, one may wonder what should be the lattice parameters related to the problem of minimizing the quantity b / b n This paper first formalizes and answers the aforementioned questions. Our wor is a step towards a clearer understanding of both enumeration algorithms and lattice reduction algorithms, which could inspire faster or improved lattice algorithms. Our results. Our first main result of this paper is the following: Theorem.. For any n-dimensional lattice L R m, there exists a basis (b,..., b n ) of L such that b = λ (L), b i b i for i =,..., n, b i i.5 b i for i =,..., n. Furthermore, finding such a basis is polynomial-time equivalent to solving SVP. Our second main result of this paper is to study the so-called smallest ratio problem (SRP): given an n- dimensional lattice L, find a basis (b,..., b n ) of L such that b / b n is minimal. The existence of such a basis is proved. We further show that SRP is at least as hard as SVP and hence NP-hard under randomized reductions. We define the lattice invariant µ n (L) = min{ b / b n : (b,..., b n ) is a basis of L} and lattice constant µ n = max µ n (L) over all n-dimensional lattices L: the maximum is also justified. We then discuss the properties of µ n (L) and µ n. Interestingly, the new constants µ n have close relation with the classical Hermite s constants γ n, Bergé-Martinet s constants γ n [4] and Korine-Zolotareff s constants γ n [6, 4]: for instance, γ n µ n γ n and µ n γ n/(n ) n γn for n. This implies the following asymptotical bounds on µ n : n πe + log(πn) + o() µ n.744n + o(n). πe πe Our third main result of this paper is to consider the algorithmic aspects of SRP. We first provide an algorithm for solving SRP exactly within poly(log B, m) n n e +o(n) bit operations and space, given an n-dimensional basis B Z m n as input. This algorithm uses Kannan s enumeration algorithm (see [5, 8]) as a subroutine. We then present a new reduction notion, together with a polynomial-time blocwise reduction algorithm, called bloc-ratio reduction. We show that bloc-ratio reduction is an algorithmic version of the new inequality µ n µ (n )/( ) where divides n with. More precisely, given a basis B 0 of an n-dimensional lattice L Z m, a blocsize satisfying n = p( ) + for some p, a reduction factor ε > 0, and an exact SRP-subroutine for any lattice of dimension, bloc-ratio reduction outputs a basis (b,..., b n ) of L within poly(log B 0, m, /ε) bit operations such that b ( + εµ ) (n )/( ) b n, where the number of calls to the SRP-subroutine is O(np (log B 0 )/ε), and the input to the subroutine always has entries of size O(n(n + log B 0 )). Roadmap. In Section, we provide preliminaries on lattices and basic lemmas. In Section, we prove Theorem.. In Section 4, we study SRP and its related lattice parameters. Section 5 is devoted to the algorithmic aspects of SRP. In Appendices A-E, we provide missing details.

4 Bacground Let and, be the Euclidean norm and inner product of R m. We use bold lower case letters to denote column vectors, and use column-representation for matrices which are written in capital letters. The ring of m n matrices with coefficients in the ring A is denoted by A m n, and we identify A m with A m. The n n identity matrix is denoted by I n, and M = det(m)m denotes the adjunct matrix of a nonsingular matrix M. For any integers a and b, we define [a, b] Z = [a, b] Z. We use the bit complexity model without fast integer arithmetic, and the size of an object is the length of its binary representation. For a matrix B = (b i, j ) = (b,..., b n ) of n columns, we denote B = max{ b,..., b n }, B = max i, j b i, j, and F is the Frobenius norm: B F = ni= b i. The notation log( ) stands for the base, and poly(x,..., x i ) means i j= x c j j for some constants c j > 0.. Lattices Orthogonalization. Given a basis B = (b,..., b n ) R m n, consider the orthogonal projections: π i : span(b,..., b n ) span(b,..., b i ) for i =,..., n, where span(b,..., b n ) denotes the space spanned by b,..., b n. Define the projection matrices: P i = I m M i (M t i M i) M t i with M i = (b,..., b i ) for i =,..., n. It is classical that π i (b) = P i b for b R m (see [6, Chapter ]). We will use the notation B [i, j] for the projected bloc (π i (b i ), π i (b i+ ),..., π i (b j )), then B [i, j] = P i (b i,..., b j ). If B is integral, then so is det(mi tm i)b [i, j] : this is because det(mi tm i)p i = det(mi tm i)i m M i(m t i M i )Mi t is integral. The vectors b i = π i (b i ) for i =,..., n are the Gram-Schmidt vectors of B, and the family B = (b,..., b n) is the Gram-Schmidt orthogonalization of B. The Gram-Schmidt coefficients are µ i, j = b i,b j b j,b j for i, j n: we have µ i,i = and µ i, j = 0 for i < j. Let µ denote the unit upper triangular matrix (µ i, j ) t i, j n. Then B has a classical decomposition B = B µ. For any integer basis B = (b,..., b n ) Z m n, the GSO matrices B and µ are rational, both of which can be computed within O(mn 4 log B ) bit operations [9] by the recursion: b = b and b i = b i i j= µ i, jb j with µ i, j = b i,b j b j,b j for i =,..., n. Isometry. Two bases (b,..., b n ) and (c,..., c n ) are isometric if b i, b j = c i, c j for i, j n. Two lattices of the same dimension are isometric if and only if they have isometric bases. Two isometric lattices have the same mathematical properties. Duality. For any n-dimensional lattice L with basis B R m n, the dual lattice of L is defined as L = {y span(b) : x, y Z, x L}. L has basis B t B(B t B), which is called the dual basis of B. The reversed dual basis of B is defined as B s = R m B t R n [], where R n = (r i, j ) i, j n is the reversed identity matrix: r i, j = δ i,n j+ where δ i, j denotes Kronecer s symbol. Write b := R m b = (b m, b m,..., b ) t where b = (b, b,..., b m ) t, and let L := { x : x L}. Then L := (L ) = ( L) is the reversed dual lattice of L, which has basis B s. Clearly, L is isometric to L and hence vol(l) vol( L ) = vol(l) vol(l ) =. In lattice reduction, it is more convenient to consider B s than to consider B t [4, 0]. Hermite s constant. The Hermite invariant of an n-dimensional lattice L is defined by γ n (L) = (λ (L)/vol(L) /n ), where λ (L) = min v L\{0} v is the first minimum of L. Hermite s constant is the maximum γ n = max γ n (L) over all n-dimensional lattices L. Its exact value is nown for n 8 and n = 4, and we have γ n < + n/4 for n ; see [5, p. 4 and p. 5]. Ranin s constant. Let L be an n-dimensional lattice and r n. We will use the notation: m r (L) := min vol(x x,...,xr L,..., x r ). vol(x,...,xr) 0 Ranin [49] introduced the Ranin invariant γ n,r (L) defined as γ n,r (L) = (m r (L)/vol(L) r/n ). Ranin s constant is the maximum γ n,r = max γ n,r (L) over all n-dimensional lattices L. Clearly, m (L) = λ (L), γ n, (L) = γ n (L) and γ n, = γ n. 4

5 Berge Martinet s constant ([4, Definition.]). The Bergé-Martinet invariant of an n-dimensional lattice L is defined by γ n(l) = λ (L)λ (L ). Bergé-Martinet s constant is the maximum γ n = max γ n(l) over all n-dimensional lattices L. Korine Zolotareff s constant ([4, Definition.]). The Korine-Zolotareff invariant of an n-dimensional lattice L is defined by γ n (L) = max b b n over all HKZ-reduced bases (b,..., b n ) of L. Korine-Zolotareff s constant is the maximum γ n = max γ n (L) over all n-dimensional lattices L. Primitive vector. A vector b in a lattice L is primitive for L if and only if it can be extended to a basis of L. In particular, a vector x = (x,..., x n ) t Z n is primitive for Z n if and only if it can be extended to a unimodular matrix, or equivalently, gcd(x,..., x n ) = [58, Theorem ].. Lattice reduction Size reduction. A basis B = (b,..., b n ) is size-reduced if its GSO satisfies: µ i, j for all j < i n. The single vector b i is size-reduced if µ i, j for all j < i. LLL reduction. A basis B = (b,..., b n ) is LLL-reduced [9] with factor ε [0, ) if it is size-reduced and every bloc B [i,i+] satisfies Lovász s condition: b i ( + ε)( b i+ + µ i+,i b i ). This implies Siegel s condition: b i 4(+ε) ε b i+. Given as inputs a basis B Z m n and ε > 0, the LLL algorithm [9] outputs an LLL-reduced basis within O( mn5 log B log(+ε) ) bit operations. SVP reduction. A basis B = (b,..., b n ) is SVP-reduced if the first basis vector b satisfies b = λ (L(B)). Then, b γ n vol(b) /n. DSVP reduction. A basis B = (b,..., b n ) is DSVP-reduced [4] (where D stands for dual) if its reversed dual basis B s is SVP-reduced. Such a reduced basis satisfies vol(b) γn n/ b n n [4]. HKZ reduction. A basis B = (b,..., b n ) is HKZ-reduced [, 6] if it is size-reduced and B [i,n] is SVP-reduced for i =,..., n. Ranin reduction. A basis B of a lattice L is r-ranin-reduced [] if its first r basis vectors reach m r (L). There exist r-ranin reduced bases for any given lattice. By duality, an n-dimensional lattice basis B is (n )-Raninreduced if and only if it is DSVP-reduced.. Basic lemmas We here present some basic lemmas. Lemma.. Let B = (b,..., b n ) be a basis of a lattice L and B s = (d,..., d n ) with the Gram-Schmidt orthogonalization (b,..., b n) and (d,..., d n) respectively. Then the identity holds: b b n = b vol(b [,n ]) = b vol(b [,n ] ) = b vol(l) vol(l) d = d d n. (.) Proof. It is classical that b d n = d b n = (see, e.g., [50, Claim 7]). Therefore, b / b n = b d = d / d n. This proves the identity since the other equalities are trivial. Lemma. ([, Lemma.8]). Let B = (b,..., b n ) be an n-dimensional lattice basis. If the projected bloc B [i, j] is DSVP-reduced for i < j n, then B [, j] is DSVP-reduced for i < j. Lemma. ([9, Lemma.]). Let B be a r-ranin-reduced basis of a lattice L. Then λ (L(B [,r] )) γ r λ (L). The dual strategy used in the classical proof of Mordell s inequality (see [4] or [4, Section.]) inspires the following lemma: Lemma.4. If a basis B = (b,..., b n ) of dimension n is in either of the two cases below:. B is SVP-reduced and B [,n] is DSVP-reduced;. B is DSVP-reduced and B [,n ] is SVP-reduced, then b / b n < 5 n. 5

6 Proof. Cases and have similar proofs, we verify Case. Since B [,n ] is SVP-reduced, then Since B is DSVP-reduced, we have vol(b) γn n/ b n n and therefore Combining (.) and (.), we obtain b n γ (n )/ n vol(b [,n ] ). (.) vol(b [,n ] ) γ n/ n b n n. (.) b / b n γ n γn n/(n ). (.4) Now, it suffices to show that γ n/(n ) n γn < 5n, which is done by distinguishing two cases: For n =,, it can be trivially checed that γ n γn n/(n ) < 5 n using the exact value of γ n. For n 4, we can deduce that ( + n 4 )( + n 4 )n/(n ) < ( 5 n), by considering the derivative of the function f (n) = log( n 5n) log( + 4 ) log( + n 4 )n/(n ). Thus, γ n γn n/(n ) < ( + n 4 )( + n 4 )n/(n ) < ( 5 n). This proved γ n/(n ) n γn < 5n for n, which completes the proof. A new type of reduced basis In this section, we prove Theorem. and formalize its related lattice problem and lattice parameters.. Proof of Theorem. We recall the classical property on HKZ-reduced bases proved in [7]: let B = (b,..., b n ) be a HKZ-reduced basis of a lattice L, then b = λ (L), b i (+ln i)/ b i for i =,..., n, b i i (+ln i)/ b i for i =,..., n. This follows from the facts: B is size-reduced and B [i,n] is SVP-reduced for i =,..., n. Proof of Theorem.. Our goal is to show that there exists a basis B = (b,..., b n ) for any n-dimensional lattice L such that b = λ (L), b i b i for i =,..., n, b i i.5 b i for i =,..., n. Our approach is to inductively combine SVP-reduction and DSVP-reduction. We prove the existence of the desired basis by induction on n. For the initial cases n =,, any HKZ-reduced basis of the lattice is as desired. Assume that the existence holds for n =. Let L be a lattice of dimension n = +. There exists a size-reduced basis C = (c,..., c n ) of L such that C is SVP-reduced, C [,n] is DSVP-reduced and C [,n ] is HKZ-reduced. Let (c,..., c n) be the Gram-Schmidt orthogonalization of C. We have c = λ (L) and c / c n < 5n by Lemma.4. Let i [, n ] Z. Since C [,n] is DSVP-reduced, by Lemma., C [i,n] is DSVP-reduced. C [i,n ] is SVP-reduced since C [,n ] is HKZ-reduced. Applying Lemma.4 to the projected bloc C [i,n], we have c i / c n < (n i + ) for i =,..., n. 5 6

7 Since C is size-reduced, this implies c n c n + n c i 4 < ( + 4 i= n i= 9 5 (n i + ) ) c n < 5 n c n. Thus, c n / c n < n.5. By the induction hypothesis, there exists a basis (b,..., b n ) for the lattice L(C [,n ] ) such that b = λ (L(C [,n ] )) = c = λ (L), b i b i and b i i.5 b i for i =,..., n. Hence, the set B = (b,..., b n, c n ) forms the desired basis of L, since the Gram-Schmidt vector of c n in the set B is still c n. This proved the existence of the desired basis for a lattice of any dimension. The above proof can be easily converted into a recursive algorithm. Specifically, the algorithm finds the basis vectors b, b n, b n,..., b in turn by calling n(n ) SVP-solvers in dimensions n. This completes the proof.. Lattice problem and lattice parameters related to Theorem. Theorem. can be essentially formulated and divided into the subproblems of minimizing the ratio b / b i over all bases (b,..., b i ) of the sublattice L(b,..., b i ) in turn for i = n,...,. This is reminiscent of HKZ-reduction, that is, any HKZ-reduced basis B = (b,..., b n ) of a lattice minimizes the ratio b i /vol(b [i,n]) /(n i+) with respect to the projected lattice L(B [i,n] ) in turn for i =,..., n. The minimization problem related to HKZ-reduction is the well-nown SVP problem. As mentioned in Section, the quantities b / b i are of significant interest to both enumeration algorithms and lattice reduction algorithms. By analogy with SVP, these suggest to formalize the problem of minimizing the quantity b / b n over all bases (b,..., b n ) of a given n-dimensional lattice. Definition. (Smallest Ratio Problem, abbreviated SRP). Given an n-dimensional lattice L, find a basis (b,..., b n ) of L such that b / b n is minimal. The justification of SRP is guaranteed by Theorem 4.. It is natural and interesting to discuss the hardness and algorithmic aspects of SRP, which will be done in the sections below. We then define the lattice parameters related to SRP. Definition.. For any n-dimensional lattice L, the lattice invariant µ n (L) is defined as µ n (L) = inf{ b / b n : (b,..., b n ) is a basis of L}. The lattice constant µ n is defined as µ n = sup µ n (L) over all n-dimensional lattices L. Both the infimum and supremum are well-defined, because any basis (b,..., b n ) of L satisfies b / b n γn (L)γ n,n (L) by the identity (.) and µ n (L) n by Theorem.. Further, both µ n (L) and µ n are reached, which we will show in the next section. The new invariants µ n (L) are different from the classical Hermite invariants γ n (L), Bergé-Martinet invariants γ n(l) and Korine-Zolotareff invariants γ n (L). This is illustrated in the two examples below. Example. Consider the following matrices B and B s where the columns of B span a lattice L: +ɛ + ɛ 0 B = 0 ( + ɛ) and B s = 0 (+ɛ) (+ɛ), 0 0 +ɛ where 0 < ɛ < (4/) /7. It isnot hard to deduce that λ (L) = λ ( L 4 ) =, γ (L) = ( ) /, γ (+ɛ) 4 (L) = and µ (L) = + ɛ. We have γ (L) < µ (L) < γ (L). 7

8 Example. Consider a -dimensional lattice L with HKZ-reduced basis B: 0 0 +ɛ B = (b, b, b ) = 0 + ɛ, 0 0 ( + ɛ) where 0 < ɛ < (4/) /4. We have µ (L) = + ɛ < (+ɛ) = b b γ (L). 4 The smallest ratio problem and its related lattice parameters In this section, we first prove that SRP is solvable and a new NP-hard lattice problem: in particular, the infimum µ n (L) is reached at some basis of any given n-dimensional lattice L. Secondly, we show that the supremum µ n is reached at some n-dimensional lattice. Thirdly, we discuss the properties of lattice parameters µ n (L) and µ n : for instance, we prove µ n µ (n )/( ) if divides n, which has an efficient algorithmic version; see the next section. For simplicity, the set of all bases of a lattice L is denoted by B(L) in what follows. 4. Solvability and hardness of SRP The theorem below shows that SRP is solvable and µ n (L) = min{ b / b n : (b,..., b n ) B(L)}. Theorem 4.. For any n-dimensional lattice L, there exists a basis (b,..., b n ) of L such that b / b n is minimal, that is, µ n (L) = b / b n. Proof. Recall that µ n (L) = inf{ b / b n : (b,..., b n ) B(L)} and any lattice of dimension has infinitely many bases. To prove the theorem, our approach is to express µ n (L) as the infimum of some finite set so that the infimum can be replaced by minimum. Our proof is algorithmic and has four steps. First, there exists a basis C = (c,..., c n ) of L such that C is (n )-Ranin-reduced and C [,n ] is SVP-reduced. Let (c,..., c n) be the Gram-Schmidt orthogonalization of C. We have vol(c [,n ] ) = m n (L) and µ n (L) c c n = c vol(c [,n ] ) vol(c) Let S = { (b,..., b n ) B(L) : b / b n c / c n }. (4.) implies = c m n (L). (4.) vol(l) µ n (L) = inf{ b / b n : (b,..., b n ) S }. (4.) Secondly, for any B = (b,..., b n ) S, it follows from m n (L) vol(b [,n ] ) and (4.) that b c m n (L) b n vol(l) = c m n (L) b n vol(b) = c m n (L) vol(b [,n ] ) c. Let S = {(b,..., b n ) B(L) : b c }. Then S S B(L). By the definition and (4.), we have µ n (L) = inf{ b / b n : (b,..., b n ) S }. (4.) Until now, the set S is still not finite if n. Thirdly, consider the set S = { b L : b is primitive for L such that b c }. Since a lattice is discrete and c γ n λ (L) by Lemma., the set {b L : b c } is finite and so is its subset S. For any b S, define the set B b (L) = {B B(L) : b is the first column of B}. Then, S can be expressed as a union of finitely many subsets: S = B b (L). (4.4) b S 8

9 Fourthly, for each b S, there is a basis G = (b, g,..., g n ) B b (L) with Gram-Schmidt orthogonalization (b, g,..., g n) such that G [,n] is (n )-Ranin-reduced. Thus, vol(g [,n ] ) = m n (L(G [,n] )). For any H = (b, h,..., h n ) B b (L), we have L(H [,n] ) = L(G [,n] ) and therefore vol(g [,n ] ) vol(h [,n ] ). Applying the identity (.), we obtain b h n = b vol(h [,n ] ) b vol(g [,n ] ) = b vol(l) vol(l) g σ(b). n Thus, the set { b / b n : (b,..., b n ) B b (L)} has minimum σ(b). By (4.) and (4.4), this implies µ n (L) = inf b S ( inf { b / b n : (b,..., b n ) B b (L) }) = inf{σ(b) : b S }. Since the set S is finite, we obtain µ n (L) as the minimum of finite set {σ(b) : b S }. That is, µ n (L) = min{σ(b) : b S }. (4.5) Hence, µ n (L) = σ(b) for some b S. Since the real value σ(b) is reached at some basis in the set B b (L), µ n (L) is reached at such a basis. This completes the proof. Theorem 4. allows us to define SRP-reduced bases, which will be useful in the sequel. Definition 4. (SRP-reduction). A basis B = (b,..., b n ) of a lattice L is SRP-reduced if b / b n is minimal, that is, B reaches µ n (L). SRP is a new NP-hard lattice problem, as shown below. Theorem 4.. SRP is at least as hard as SVP. Further, SRP is NP-hard under randomized reductions. Proof. We construct a deterministic reduction from SVP to SRP. Let L be an (n )-dimensional lattice with basis B = (b,..., b n ). Define an n-dimensional lattice L with basis C = (c,..., c n ) := Diag(B, t) where t is a sufficiently large positive constant. Let (c,..., c n) be the Gram-Schmidt orthogonalization of C. Since c / c n = b /t, finding a SRP-reduced basis for L is equivalent to finding a SVP-reduced basis for L. Thus, we can reduce any SVP instance in dimension (n ) to some SRP instance in dimension n. Since SVP is NP-hard under randomized reductions [], so is SRP. This completes the proof. 4. Reachability of µ n Our main result of this subsection is as follows: Theorem 4.4. There exists an n-dimensional lattice L such that µ n = µ n (L). By the theorem, µ n = max µ n (L) over all n-dimensional lattices L. Our proof of Theorem 4.4 uses Lemmas below. Lemma 4.5. Let (b,..., b n ) be an n-dimensional lattice basis such that b b b n and b n i= b i n i= b i (n!). Then /(n!) n b,..., b n (n!) 4. Proof. Since b n n i= b i, we have b (n!) /n. Note that b n i= b i b (n!) b n, then b n (n!) b (n!) +/n. It follows from b n i= b i b b n n that b / b n (n ) /(n!) n. This implies /(n!) n b b b n (n!) +/n, as desired. Lemma 4.6. The set S = { B = (b,..., b n ) R n n : /(n!) n b,..., b n (n!) 4 and det(b) = } is bounded and closed. Proof. Let S = { (b,..., b n ) R n n : /(n!) n b,..., b n (n!) 4} and S = {B R n n : det(b) = }. Clearly, S is a bounded closed set in R n n. Since det( ) is a continuous mapping from R n n to R and {} is a closed set in R, S is closed in R n n. Hence, S = S S is a bounded closed set. 9

10 Lemma 4.7. Let S be the set defined in Lemma 4.6 and f (B) = µ n (L(B)) for every B S. Then f is continuous on S. Proof. For each B S, since vol(l(b)) = det(b) =, by Theorem 4. and Lemma., we have f (B) = µ n (L(B)) = min{ Bu vol(bu [,n ] ) : U = (u,..., u n ) is an n n unimodular matrix}. For any B, C S, we may assume without loss of generality that f (C) f (B) and f (B) = Bu vol(bu [,n ] ) for some unimodular matrix U = (u,..., u n ). Then, f (C) f (B) = f (C) f (B) Cu vol(cu [,n ] ) Bu vol(bu [,n ] ). For ε > 0, since g(b) := Bu vol(bu [,n ] ) is continuous at B, there exists δ > 0 such that g(c) g(b) < ε if C B F < δ. This implies f (C) f (B) < ε if C B F < δ. Thus, f is continuous at B. By the arbitrariness of B, f is continuous on S. Proof of Theorem 4.4. Recall that µ n = sup µ n (L) over all n-dimensional lattices L. Our approach is to express µ n as the supremum of a continuous mapping defined on some bounded closed set, so that the maximum principle immediately implies the conclusion. Define the set L n = {L R n : L is a lattice of dimension n such that vol(l) = and µ n (L) }. It is classical that any n-dimensional lattice in R m is isometric to some n-dimensional lattice in R n (see, e.g., [6, p. 57]). Together with homogeneity and µ n (Z n ) =, we have µ n = sup{µ n (L) : L L n }. (4.6) For any L L n, by Theorem., there exists a basis C = (c,..., c n ) of L such that n c c c n and c c i i= n c i (n!).5 where we used the facts that det(c) = vol(l) = and by Lemma., c n i= c i c vol(c [,n ] ) vol(l)µ n (L). By Lemma 4.5, C S { B = (b,..., b n ) R n n : /(n!) n b,..., b n (n!) 4 and det(b) = }. Thus, L = L(C) {L(B) : B S} and hence L n {L(B) : B S}. Together with (4.6), this implies µ n sup{µ n (L(B)) : B S} µ n. That is, µ n = sup{µ n (L(B)) : B S} (4.7) By Lemmas 4.6 and 4.7, the mapping B µ n (L(B)) is continuous on the bounded closed set S. Applying the maximum principle, there is a basis B 0 S such that µ n (L(B)) µ n (L(B 0 )) for B S. i= By (4.7), this implies µ n = µ n (L(B 0 )) and the conclusion follows. 4. Properties of µ n (L) and µ n In this subsection, we discuss the properties of lattice parameters µ n (L) and µ n including the relations with other classical lattice parameters. Proposition 4.8. Let L be an n-dimensional lattice.. µ n (L) = µ n ( L ) = µ n (L ).. γ n(l) µ n (L) γ n (L).. µ n (L) = µ n (c L) for c R\{0}. 0

11 Proof. By the definition and identity (.), the proof is trivial. The new constants µ n have close relation with Hermite s constants γ n, Bergé-Martinet s constants γ n and Korine-Zolotareff s constants γ n, as shown below. Theorem 4.9. For n, we have:. γ n µ n γ n ;. µ n γ n γn n/(n ) ;. (γ n ) µ n 4 γ n; 4. γ n µ n 4 (γ n + ); 5. 8 µ n+ µ n 8 (µ n+ + ); 6. µ n has the following asymptotical bounds: n πe + log(πn) + o() µ n.744n + o(n). πe πe Proof. Proposition 4.8. and the inequality (.4) imply Properties and, respectively. Since γ n ( 4/) n = γ n [] and γ n γn n/(n ) [4], Property implies µ n γ n γn n/(n ) γ n/(n ) n 4 γ n. (4.8) Let ω n be the volume of the unit Euclidean ball in dimension n and ϑ(n) be the closest integer to ( 5 ω n ) /n. Then ϑ(n) = n πe + log(πn) πe + o() [40, p. ]. By Conway-Thomson s Theorem (see [40, Theorem 9.5]), there is an n-dimensional lattice L with L = L such that λ (L)λ (L ) ϑ(n). Thus, µ n γ n γ n(l) ϑ(n). Since ϑ(n) ( 5 ω n ) /n and ω /n n γ n [5], we have (γ n ) (5 )/n γ n ϑ(n) µ n, 4 γ n µ n γ n 4 ω /n n 4 (ϑ(n) + ) 4 (γ n + ). Together with (4.8), these imply Properties and 4. Applying the relations γ n γ (n+)/n n+ and γ n γ n again, together with Mordell s inequality γ n+ γn n/(n ) [4], we deduce that µ n γ n n n γ n n ( n+ ) γ n+ γ ω /(n+) n+ 8 (ϑ(n + ) + ) 8 (µ n+ + ), µ n γ n γ n+(γ /(n ) n ) 4 γ n+ 8 µ n+, which yield Property 5. Since γ n.744n πe + o(n) [4] and γn /(n ) Property 6. This completes the proof. = + o(), the relation ϑ(n) µ n γ n/(n ) n The following theorem upper bounds the constant µ n in high dimension using µ in low dimension. Theorem 4.0. For n, if divides n, then µ n µ (n )/( ). immediately implies

12 Proof. It suffices to show that µ p( )+ µ p for p, which is done by induction over p. It holds trivially when p =. Assume that it holds for some p. Let L be a lattice of dimension n = (p + )( ) + and B = (b,..., b n ) be an m-ranin-reduced basis of L with m = p( ) +. Let (c,..., c m ) be a SRP-reduced basis of the lattice L(B [,m] ) and C = (c,..., c m, b m+,..., b n ) with Gram-Schmidt orthogonalization (c,..., c m, b m+,..., b n). Then C is a basis of L such that c vol(c [,m ] ) vol(c [,m] ) = µ m (L(B [,m] )) µ m. (4.9) There is a unimodular matrix U such that C [m,n] U is a SRP-reduced basis of the lattice L(C [m,n] ) since = n m +. Let (d m,..., d n ) = (c m, b m+,..., b n )U and D = (c,..., c m, d m,..., d n ) with Gram-Schmidt orthogonalization (c,..., c m, d m,..., d n). Then D is also a basis of L such that D [m,n] = C [m,n] U is SRP-reduced and vol(c [m,n] ) = vol(d [m,n] ). Therefore, d m vol(d [m,n ] ) vol(c [m,n] ) = µ (L(C [m,n] )) µ. (4.0) We claim that c m / d m. Indeed, vol(c [,m] ) = vol(b [,m] ) vol(d [,m] ) since B is m-ranin-reduced. Note that vol(c [,m] ) = vol(c [,m ] ) c m and vol(d [,m] ) = vol(c [,m ] ) d m, this implies c m d m. Then it follows from (4.9) and (4.0) that µ n (L) c vol(d [,n ] ) vol(d) µ m vol(d [m,n ]) = c vol(c [,m ] ) vol(c [,m] ) vol(c [m+,n] ) = µ m d m vol(d [m,n ] ) vol(c [m,n] ) µ m µ. vol(d [m,n ]) vol(c [m+,n] ) c m d m By the inductive hypothesis, µ m µ p. Therefore, µ n(l) µ p+. By the arbitrariness of L, µ n µ p+. Thus, we proved µ p( )+ µ p by induction over p, which completes the proof. Theorem 4. below yields µ 4 > µ /, and hence µ n µ (n )/( ) doesn t always hold for n. Similarly to the classical lattice constants γ n, γ n and γ n, it is hard to determine the exact value of µ n. The following theorem summarizes the explicit values of some µ n in low dimensions. Theorem 4.. µ =, µ =, µ 4 =, µ 5 <, 8 µ 6 9/0, µ /0 7 and µ / 8 =. Proof. By [4, Proposition.], we have γ = γ = γ = /, γ = γ = < = γ and γ 4 = γ 4 = γ 4 =. This implies the exact values of µ, µ and µ 4 by Theorem Since the exact values of γ n and γ n are nown for n 8 (see [4, 5]), together with γ 5 < [6], the inequalities γ n µ n min{γ n, γ n/(n ) n γn } imply the remainder assertions. We provide the critical lattices for µ, µ, µ 4 and µ 8 in Appendix B. 5 Algorithmic aspects of the smallest ratio problem In this section, we present an exact algorithm and an approximation algorithm for SRP in Subsections 5. and 5. respectively. Our main result on the exact SRP algorithm is the following: given as input a basis B 0 of an n-dimensional lattice L Z m, the algorithm outputs a SRP-reduced basis B of L and an n n unimodular matrix U within poly(log B 0, m) n n e +o(n) bit operations and space such that B = B 0 U, B (n )/ B 0 and U (n )/ n n+ B 0 n. Our main result on the SRP-approximation algorithm is as follows: given as inputs a basis B 0 of an n- dimensional lattice L Z m, a blocsize such that divides n, a reduction factor ε > 0, and a SRPsubroutine computing SRP-reduced bases in any lattice of dimension, the algorithm outputs (in time polynomial in (log B 0, m, /ε)) a basis (b,..., b n ) of L such that b ( + εµ ) (n )/( ) b n

13 where the number of calls to the SRP-subroutine and the size of the input are polynomial, and apart from the running time of the subroutine, the algorithm runs in polynomial time. If log n log log n and we use the exact SRP algorithm given in Subsection 5. as the SRP-subroutine, then the whole algorithm runs in polynomial time. 5. An exact SRP algorithm Our exact SRP algorithm is Algorithm, which computes a SRP-reduced basis of a given integer lattice. The main idea stems from the proof of Theorem 4., more precisely, is based on the equality (4.5). Algorithm uses four local algorithms related to SVP: Magliveras et al. s extending algorithm [4, Algorithm A], which extends a primitive vector for Z n to a unimodular matrix. Given as input an integer vector a = (a,..., a n ) t, the algorithm outputs the gcd g = gcd(a,..., a n ) and an n n unimodular matrix U within O(n log a ) bit operations such that a/g is the first column of U and U a. An SVP-algorithm, which finds the shortest vector of a given lattice. Given as input a basis B Z m n, an SVP algorithm outputs a primitive vector x for Z n such that Bx is the shortest vector of L(B). If we tae the Micciancio-Voulgaris algorithm [7] as an SVP algorithm, then it requires poly(log B, m) n bit operations and poly(log B, m) n space. Combining this with Magliveras et al. s extending algorithm, one can HKZ-reduce the basis B within poly(log B, m) n bit operations. A DSVP-algorithm (see Algorithm 4 in Appendix D), which performs a DSVP-reduction of a given bloc. Given as inputs a basis B Z m n and an index i [, n ] Z, Algorithm 4 outputs a basis C of L(B) such that C [,i ] = B [,i ] and C [i,n] is DSVP-reduced. An enumeration algorithm (see, e.g., [8, Fig.]), which given a basis of a lattice L Z m and a bound R, finds the set S = {y L : y R}; see [8] for the optimal complexity analysis. In order to avoid intermediate entries explosion, each Step 7 performs a LLL-reduction. In fact, if we apply the LLL algorithm on a basis (b,..., b n ), the quantity b / b n can never increase. Therefore, there exists a basis for any lattice which is both LLL-reduced and SRP-reduced. The main result on Algorithm is the following: Theorem 5.. Given as input a basis B 0 of an n-dimensional lattice L Z m, Algorithm outputs a SRP-reduced basis B and an n n unimodular matrix U such that B = B 0 U, B (n )/ B 0 and U (n )/ n n+ B 0 n. The algorithm requires poly(log B 0, m) n n e +o(n) bit operations and space. Proof. We first show correctness. If Steps 6-7 occur, the output basis B reaches µ n (L) by Lemma B.. Assume that Step 8 occurs. From the proof of Theorem 4. (mainly (4.5)), we have { µ n (L) c vol(c [,n ] ) } = min : C = (c vol(l),..., c n ) B(L), c S and C [,n] is DSVP-reduced. Thus, Steps -9 output a SRP-reduced basis B, which proves the correctness by Lemma C.. Next, we analyze the complexity. The main issue is to upper bound the magnitudes of intermediate bases occurring during the algorithm. We have B C n n B 0 n at the end of Step, (n )/ B 0 at the end of Step 4, (n )/ B 0 at the end of Step 0, n B 0 n+ at the end of Step 5, n 5n B 0 n (n+) at the end of Step 6, (n )/ B 0 at the end of Step 7. (5.) (5.)

14 Algorithm Computing a SRP-reduced basis of an integer lattice Input: A basis B = (b,..., b n ) of a lattice L in Z m. Output: A SRP-reduced basis of L and the corresponding unimodular transformation. : Store A B and compute the first minimum λ (L) by calling the MV SVP-algorithm [7] on B : DSVP-reduce B using Algorithm 4 and passingly store A s //det(a t A)A s = R m A(A t A)R n Z m n : Compute T R n (A s ) t R m //For matrices M and N, AM = N iff M = (A t A) A t N = T N. 4: HKZ-reduce B [,n ] and then size-reduce b n 5: //The current basis B is LLL-reduced with factor 0 since B [n,n] is SVP-reduced by Lemma.. 6: if b = λ (L) then 7: Go to Line //The current basis B is SRP-reduced by Lemma B.. 8: else 9: Compute φ(b) b vol(b [,n ] ) 0: //Note that b vol(b [,n ] ) is integral but b vol(b [,n ] ) vol(b) may be real. : Compute S {y L\{0} : y b } by calling the enumeration algorithm [8, Fig.] on B : for y S do : Compute x = (x,..., x n ) t Ty //Step implies Ax = y and hence x Z n. 4: Call Magliveras et al. s extending algorithm [4, Algorithm A] to compute g = gcd(x,..., x n ) and an n n unimodular matrix V such that x/g is the first column of V 5: Compute C = (c,..., c n ) AV and remove {i y g : g i g} from S 6: DSVP-reduce C [,n] using Algorithm 4 7: LLL-reduce C with factor / and then compute φ(c) c vol(c [,n ] ) 8: if φ(c) < φ(b) then B C, φ(b) φ(c); else continue Step 9: end for 0: end if : Compute U T B //Step implies B = AU and hence U is unimodular. : return B and U Indeed, since the current basis B = (b,..., b n ) at Step is (n )-Ranin-reduced and B [,n ] is HKZ-reduced, Lemma. implies b γ n λ (L) n B 0. By Lemma C., the matrix V and vector x appearing at Steps -5 satisfy V x n B 0 n. Applying Lemma C. and Theorem D., It is easy to deduce (5.) and (5.). From (5.) and (5.), all intermediate bases during the execution have size poly(log B 0, m). Thus, both Steps -7 and a single execution of Steps -8 require poly(log B 0, m) n bit operations and poly(log B 0, m) n space. It remains to bound the number of elements in the set S and cost of Step. Consider again the current basis B = (b,..., b n ) at Step. Since B is DSVP-reduced and B [,n ] is HKZ-reduced, then max I [,n] Z b I ( n) I i I b i n n max I [,n ] Z b I ( n ) I i I b i by Lemma.4 n ( n ) n e by [8, Theorem ] n n e +. By the Hanrot-Stehlé s analysis [8, Section 4.], the cost of the enumeration occurring at Step is bounded by poly(log B, m) S with S n (e( + π)) n b max I I [,n] Z ( n) I i I b i n.6n n n e. Since Steps -8 occur at most S / times, we conclude that Algorithm totally requires poly(log B 0, m) 5.6n n n e bit operations and poly(log B 0, m).6n n n e space. This completes the proof. Algorithm is unavoidably expensive because of NP-hardness. So, it becomes interesting to find polynomialtime algorithms for approximating SRP, which is done in the next subsection. 4

15 5. An approximation algorithm for SRP Recall that blocwise approximation algorithms for SVP rely on an exact algorithm in low dimension. By analogy, the exact SRP algorithm suggests finding an approximation algorithm for SRP using an exact algorithm in low dimension. We define an SRP-oracle as any algorithm which, given a basis B Z m, outputs a unimodular matrix U such that BU is both SRP-reduced and LLL-reduced with factor ε 0. Forcing the output to be LLL-reduced allows us to bound the coefficients of U using Lemma C.. Obviously, Algorithm is an SRP-oracle. In what follows, we first introduce a new reduction notion called bloc-ratio reduction. Then we present a deterministic polynomial-time reduction algorithm to output bloc-ratio reduced bases. The algorithm approximates SRP in dimension n within a factor essentially µ (n )/( ), using polynomially many calls to the SRP-oracle in dimension, provided that divides n. Hence, bloc-ratio reduction can be viewed as an algorithmic version of Theorem Definition and property We will use a natural relaxation of SRP-reduction: a basis (b,..., b n ) of an n-dimensional lattice L is ( + ε)-srpreduced for ε 0 if b b n + εµ n (L). Definition 5. (Bloc-ratio reduction). A basis B of an n-dimensional lattice L where n = p( ) + with p is bloc-ratio reduced with blocsize and factor ε 0 if it is size-reduced and the bloc B [i( )+,i( )+] is ( + ε)-srp-reduced for i = 0,..., p. Bloc-ratio reduction achieves the new inequality µ n µ (n )/( ) where divides n, lie slide reduction achieved Mordell s inequality γ n γ (n )/( ) for n (see [4]): Theorem 5.. If a basis B = (b,..., b n ) of an n-dimensional lattice L is bloc-ratio reduced with blocsize and factor ε where n = p( ) + with p and ε 0, then b ( + εµ ) (n )/( ) b n. Proof. By the definition, the bloc B [i( )+,i( )+] satisfies: b i( )+ + εµ b i( )+ for i = 0,..., p. This immediately implies the conclusion. Moreover, this approximation factor is essentially tight in the worst-case, see Appendix E. 5.. A reduction algorithm Our bloc-ratio reduction algorithm is Algorithm, which uses one local algorithm based on an SRP-oracle: Algorithm performs a ( + ε)-srp-reduction of a given bloc. Algorithm Bloc-ratio reduction of an integer lattice Input: An integer, a factor ε > 0, and a basis B = (b,..., b n ) Z m n in dimension n = p( ) +. Output: A bloc-ratio reduced basis of L(B) with blocsize and factor ε. : while B is modified by the loop do : // While B is not bloc-ratio reduced : for i = 0 to p do 4: ( + ε)-srp-reduce B [i( )+,i( )+] using Algorithm 5: LLL-reduce B with factor ε and update the GSO matrices B and µ 6: end for 7: end while 8: return B. 5

16 Algorithm SRP-reduction of the bloc B [i( )+,i( )+] Input: A blocsize, a factor ε, and a basis B = (b,..., b n ) Z m n with its GSO matrices B and µ. Output: The bloc B [i( )+,i( )+] becomes ( + ε)-srp-reduced, but none of the basis vectors outside the bloc are modified. : Let j = i( ) : if i = 0 then C B [,] : else 4: Compute B [ j+, j+] (b j+,..., b j+ )(µ ı, j) t j+ ı, j j+ 5: Compute C det((b [, j] ) t B [, j] )B [ j+, j+] 6: end if 7: //Note that C Z m and µ (L(C)) = µ (L(B [ j+, j+] )) Q. 8: Call the SRP-oracle on C to output a unimodular matrix U such that CU is both SRP-reduced and LLL-reduced with factor ε, and then compute µ (L(C)) 9: if ( + ε)µ (L(C)) < b j+ then b j+ 0: Compute (b j+,..., b j+ ) (b j+,..., b j+ )U : end if : return B. We first show correctness of Algorithm : Theorem 5.4. For all ε 0, Algorithm terminates, and outputs a bloc-ratio reduced basis with blocsize and factor ε. Proof. Let B 0 denote the input integer lattice basis and B denote the current basis during the execution. Following the standard analysis of LLL [9], we consider the following integral potential p P(B) = vol(b [,i( )+] ) vol(b [,(i+)( )] ) Z. (5.) i=0 Then, the initial potential satisfies log P(B 0 ) np log B 0 and every operation in Algorithm either preserves or strictly decreases P(B). More precisely, if each ( + ε)-srp-reduction modifies the bloc B [i( )+,i( )+] for some i [0; p ], or each special swap of LLL (in line 5) between two indices (i( ) +, i( ) + ) or ((i + )( ), i( ) + ) occurs, then the integer P(B) is reduced by a multiplicative factor < +ε. Therefore, there is a bounded number of such ( + ε)-srp-reductions and special swaps even if ε = 0. The operations which preserve P(B) cannot modify the basis indefinitely. Hence, Algorithm terminates for all ε 0. It is easy to see that Algorithm finally outputs a bloc-ratio reduced basis with blocsize and factor ε. Indeed, the output basis is size-reduced due to the LLL-reduction; each bloc B [i( )+,i( )+] is ( + ε)-srpreduced due to the use of Algorithm. This completes the proof. 5.. Complexity analysis The following theorem shows that Algorithm is in fact polynomial, in the same sense as blocwise reduction algorithms [5,, 4] to approximate SVP. Theorem 5.5. Given as inputs a blocsize, a reduction factor ε (0, ] Q, and a basis B 0 Z m n of dimension n = p( ) + with p, then any execution of Algorithm satisfies:. The number of calls to the SRP-oracle is O(np (log B 0 )/ε);. The coefficients passed to the SRP-oracle have size O(n(n + log B 0 ));. Apart from the calls to the SRP-oracle, the algorithm only performs arithmetic operations on rational numbers such that the number of arithmetic operations is polynomial in (log B 0, m, /ε), and the size of the rational numbers remains polynomial in (log B 0, n). 6

17 We consider again the integral potential P(B) defined in (5.). Since ε > 0, the number of calls to ( + ε)-srpreduction subroutine and special swap is at most log P(B 0) log(+ε). That is, Algorithm terminates after at most log P(B 0) log(+ε) loops. Since every loop has p SRP-reductions, the total number of calls to the SRP-oracle is at most np log B 0 log(+ε). It remains to bound the size of intermediate numbers and the cost of operations (apart from oracle queries) used by Algorithm. The ey is to upper bound B during the execution with respect to B 0. We have { 4n B B 0 4n at the end of Step 4, n B 0 at the end of Step 5. Indeed, since the current basis B right after Step 5 is LLL-reduced with factor ε (0, ], Lemma C. implies B n B 0. Consider Step 4, where Algorithm is called: for index i [0, p ] Z, the integer matrix C appearing in Algorithm satisfies C ( n B 0 ) i( )+ ( n B 0 ) n and the SRP-oracle outputs a unimodular transformation U such that U + C by Lemma C.; then the current basis B right after Step 4 has magnitude: B U ( n B 0 ) 4n B 0 4n. Therefore, we always have log B 4n(n + log B 0 ) throughout Algorithm : by the classical analysis of the LLL algorithm [9, Proposition.6], a single execution of Steps 4-5 (except the oracle) runs in time polynomial in (log B 0, m, /ε) and wors on rational numbers which have size polynomial in (log B 0, n) during the computation. This completes the proof of Theorem 5.5. We conclude that the running time of Algorithm can be upper bounded by a polynomial factor times the cost of the SRP-oracle. Hence, Algorithm is polynomial in the same sense as blocwise reduction algorithms [5,, 4, 0]. In particular, if the SRP-oracle, then Algorithm runs in polynomial time. References log n log log n and we select Algorithm as [] E. Agrell, T. Erisson, A. Vardy, and K. Zeger. Closest point search in lattices. IEEE Transactions on Information Theory, 48(8):0 4, 00. [] M. Ajtai. Generating hard instances of lattice problems (extended abstract). In Proceedings of STOC 96, pages ACM, 996. [] M. Ajtai. The shortest vector problem in L is NP-hard for randomized reductions (extended abstract). In Proceedings of STOC 98, pages 0 9. ACM, 998. [4] A. M. Bergé and J. Martinet. Sur un problème de dualite lié aux sphères en géométrie des nombres. Journal of Number Theory, :4 4, 989. [5] H. F. Blichfeldt. A new principle in the geometry of numbers, with some applications. Transactions of the American Mathematical Society, 6:7 5, 94. [6] J. Buchmann and M. Pohst. Computing a lattice basis from a system of generating vectors. In Proceedings of the 987 European Conference on Computer Algebra (EUROCAL 87), volume 78 of LNCS, pages Springer-Verlag, 987. [7] Y. Chen and P. Q. Nguyen. BKZ.0: better lattice security estimates. In Proceedings of ASIACRYPT, volume 707 of LNCS, pages 0. Springer-Verlag, 0. [8] H. Cohen. A course in computational algebraic number theory. Springer-Verlag, New Yor, second edition, 995. [9] D. Dadush and D. Micciancio. Algorithms for the densest sub-lattice problem. In Proceedings of SODA, pages 0. SIAM, 0. [0] D. Dadush, C. Peiert, and S. Vempala. Enumerative lattice algorithms in any norm via M-ellipsoid coverings. In Proceedings of FOCS, pages IEEE, 0. 7