Rings of integers of number fields are fundamental rings in computational number theory. Similar to algorithms over the integers, a common computational tool is the transfer to quotient rings. This is for example done to prevent intermediate coefficient explosion (Hermite form), allow techniques based on the Chinese remainder theorem (CRT) (utilize the field structure of suitable quotients) or limit the precision in -adic computations. For quotients , , of
, the rational integers, this has a rich history, in particular normal forms for matrices or modules over quotients have been studied extensively, both in their own right and as a means to classify matrices and modules overitself. An important observation was the fact that can be given the structure of a Euclidean ring thus allowing the use of general algorithms designed for this class of rings. In contrast to this situation, in rings of integers of number fields, the only properties of quotient rings that have been exploited so far are the fact that residue class rings of prime ideals are fields (CRT based algorithms) and the obvious fact that quotients rings are finite, thus can be used to avoid intermediate coefficient swell (by reducing modulo some ideal every now and then). However, the algorithms, e.g., the modular pseudo Hermite normal form of Cohen , or Biasse–Fieker  only add the reduction at crucial steps while still basically maintaining the old, underlying, non-modular algorithm.
In this paper, we revive the fact that quotient rings of rings of integers are in fact Euclidean rings allowing for efficient operations. As a result, over such quotient rings, we can immediately use the rich history of algorithms for Euclidean rings. In particular, that allows a much wider class of quotients to be used for non-trivial computations than just the residue class fields. In fact, a short study will immediately show that, since deterministic polynomial factorization over finite fields is very slow, this gives rise to deterministic algorithms for the computation of say determinants, of much better complexity.
We illustrate our new ideas by giving a new, truly modular, algorithm for the computation of normal forms over rings of integers. Our algorithm, by utilizing the Euclidean structure of suitable quotients, does not need the complicated (and slow) operations of pseudomatrices and ideals necessary in the classical approach. In fact, for random matrices over rings of integers, the new algorithm has a much better expected runtime than the algorithms on the corresponding -module.
Starting with the Euclidean structure of quotient rings, we then study matrix normal forms under projections before applying everything to matrix normal forms over rings of integers.
For the rest of the paper we fix an algebraic number field of degree with ring of integers . If is a non-trivial ideal , we denote by the ideal norm of , i.e., . The main goal of this section is the description of the Euclidean structure of , where is a non-trivial ideal of , based on . The first step consists of defining the Euclidean structure in case is a prime ideal power , exploiting the special properties of the ring . Finally a CRT based procedure is applied to obtain a Euclidean structure on the whole of for arbitrary .
Recall that a commutative ring is called Euclidean if there exists a function satisfying the following property: For all there exist such that
In this case is called a Euclidean function and (1) is called Euclidean division. Note that this is not the definition of Euclidean rings but one that suits our purpose. We refer the interested reader to  for an overview of possible definitions and relations between them.
Beginning with a prime ideal power of , let us recall some facts about . Let be an element of , the set of -uniformizers. Then is a special principal ideal ring, i.e., a ring with unique maximal ideal which is nilpotent, and every ideal is of the form with .
Fixing a set of coset representatives of modulo it is well known that every element of can be uniquely written in the form
with . Moreover is invertible if and only if is a unit modulo . Using this representation it is easy to compute the cardinality of various objects.
If is an ideal of , then and .
The number of generators of is if and if .
By [10, Proposition 7] the function defines a Euclidean function on . For the sake of completeness we sketch the argument: The above representation of elements of shows that every element can be written as for some unit and unique integer (in fact ). If and are elements of with , then
is a Euclidean division. Composing this Euclidean function with the monotone increasing function yields
also turning into a Euclidean ring. Moreover we extend the function to the whole of by setting , such that for all .
Now we can put everything together. For each prime divisor of denote by the Euclidean function defined in the previous paragraph and by the -component of an element under the natural isomorphism .
The ring together with
is a Euclidean ring.
The proof of [10, Proposition 6] shows that is a Euclidean ring with Euclidean function . But it is easy to see that the proof remains valid if the sum is replaced by , where is any monotonic multivariate function. The result then follows by choosing to be the product and noting that .
We end this section with some remarks on division in . First note that due to the presence of zero-divisors the division in is not unique. To illustrate the occurring pitfalls we consider an example in . It is easy to see that and satisfy with . This shows that is a greatest common divisor of and . We now want to divide by : While the equations and show that and are valid quotients, they are not coprime in as . This is in total contrast to the situation of integral domains, where dividing by a greatest common divisor produces coprime elements. Here we can try to find coprime quotients by choosing different ones. Now and show that and will also do and they are fortunately coprime in .
We now prove that this is always possible by choosing the quotients as small as possible with respect to the Euclidean function.
Let . Then the following holds:
The element divides if and only if is an integral ideal.
An element satisfies if and only if .
If satisfies , then divides .
Let such that . Then is equivalent to .
Let be a greatest common divisor of , i.e., . Assume that are elements of such that , , and . Then and are coprime, i.e., .
(i): This follows from the fact the is equivalent to for all prime divisors of .
(ii): For each prime divisor of we have . If (and therefore ) this is equivalent to . If then this is equivalent to . If and , then this is equivalent to . Now the claim follows.
(iii) and (iv): This follows from (ii).
(v): Note that . By (ii) the assumption on the Euclidean function implies and . From this one deduces that , i.e., .
3 Basic operations
In order to describe the complexity of our algorithms we will rely on a modified notion of basic operations introduced by Mulders and Storjohann in . Let be a Euclidean ring and . Then a basic operation is one of the following:
For return .
If divides in return an element such that .
If return such that with or .
Return such that , , and , i.e.,
and the transformation matrix is unimodular.
Return such that .
Note that in  it is shown that in case of operations (B1) through (B5) can be performed using bit operations, where is a bound on the number of bit operations required to multiply two -bit integers.
We now turn to the case , for which there exists an additional basic operation.
Given an integral ideal of , return an element such that in .
We now want to show how each basic operation (Bi) in , , can be solved algorithmically using basic operation in , where is the norm of . We assume that we are given -bases and of and respectively such that with integers , , i.e., the basis matrix of is diagonal. Then the map
is an isomorphism of abelian groups which we use to identify with .
Evaluating the canonical map at an element consists of divisions with remainder and the addition of two elements in consists of additions in . As the above map is not multiplicative, multiplication of two elements , is more involved. More precisely the element with is given by
where denotes the structure constants of the -algebra with respect to the basis . Thus for each we need basic operations in to compute .
To accomplish (B2), denote by the representation matrix of with respect to , where each entry is reduced modulo , and by the diagonal basis matrix of . Then for some element if and only if the equation is solvable. As this linear system can be solved modulo , we need basic operations in . Note that the kernel of this matrix is (the lift) of , the annihilator of in .
So far we have shown that operations (B1) and (B2) can be performed using basic operations in (for the sake of simplicity a basic operation in with is counted as a basic operation in ).
We now turn to the more involved operations (Bi), , the big difference to (B1) being the non-uniqueness of the operations (again mainly due to the presence of zero-divisors). Using the Chinese remainder theorem we will see that the defining properties of the operations can be stated purely in terms of valuations at each prime ideal dividing . Therefore the main task will be the construction of integral elements with prescribed behavior at a finite set of prime ideals. While there exist deterministic algorithms for these kind of problems, they have the major flaw that they need a costly prime ideal factorization of . To overcome this difficulty, in this article we will pursue the idea of probabilistic algorithms. More precisely our algorithms will be of Las Vegas type with expected polynomial running time, which can be easily turned into Monte Carlo algorithms if wished. The running time of our algorithms will depend on the value
In Section 5 we will discuss the size of and the applicability of the presented algorithms.
We assume that we have access to an oracle producing random elements in any finite ring of the form , . During the complexity analysis we will omit the costs of calling this oracle.
3.1 Euclidean function and division with remainder
Let . Computing can be done using basic operations in .
We first compute the products for using basic operations in . Denoting by the canonical lifts of these elements we know that constitute a -generating system of . Computing the Hermite normal form basis of this generating system then can be done using basic operations in while the norm computation takes such operations.
Algorithm 1 ((Probabilistic Euclidean division))
Let , . The following steps return .
Choose uniformly distributed and compute .
If go to Step (i).
Let such that does not divide . For each prime divisor of define
Then the following holds:
If is an element such that for all prime divisors of , then .
We have .
If is uniformly distributed in
, then the probability thatis a Euclidean division is at least .
(i): Let . In the second and third case we have while in the first case we have . Since does not divide there exists a prime divisor of such that implying that . Thus we have .
(ii): It remains to show in the case . If , then and we are done. Therefore let and consider the natural map . The set is the complement of the set of solutions with . As this equation has solutions we have . It follows that .
(iii): This follows from (ii).
Algorithm 1 is correct and the expected number of basic operations in is .
We need to count the expected number of repetitions of Step (i). It is easy to see that for , with probability the number of repetitions of Step (i) is . Thus the expected number is . Now the claim follows as Step (i) needs basic operations in .
3.2 Finding a generator of an ideal and computing the annihilator
Let be an ideal of . It is easy to see that for an element the equation holds if and only if for all prime divisors of we have .
Let be an integral of . The following steps return such that .
Choose uniformly distributed.
If go to Step (ii).
Algorithm 2 is correct and the expected number of basic operations in is .
We prove the following: If is an integral ideal of and is chosen uniformly in , then the probability that is . Let and fix one prime divisor of . We want to count the elements such that . Note that and therefore is equivalent to . Counting the elements in these sets we see that probability that an element satisfies is .
Note that Step (i) needs basic operations in . We have already shown that the expected number of executions of Step (iii) is . As each execution consists of basic operations in , the claim follows.
Let . Then we can compute with an expected number of basic operations in .
After computing the annihilator as the kernel of modulo (as for (B2)) using basic operations, we apply Algorithm 2 to obtain a generator.
3.3 Extended GCD computation
We now turn to the problem. In case of the rational integers the task is easy: If is a greatest common divisor of two integers we can compute such that . Then
and we are done. While we can of course just use the normal Euclidean algorithm to find the cofactors, this is, in our case, rather expensive as each Euclidean division requires a random search. On the other hand, computing the GCD directly using ideals takes only one random search.
As the underlying idea is that dividing by a greatest common divisor produces coprime elements, the example at the end of Section 2 shows that we cannot blindly adapt this in the presence of zero-divisors. Fortunately Proposition 3 shows that there exists minimal quotients with respect to the Euclidean function such that , and . In particular there exists such that . A quick calculation shows that
is a unimodular transformation implying that is valid.
In order to apply this we need to explain how to find minimal quotients and how to express a greatest common divisor as a linear combination.
Let be a divisor of . An element with and can be computed using an expected number of basic operations in .
Let be such that . Then with can be computed using basic operations in .
Let . Then can be computed with an expected number of basic operations.
(i): Using (B2) we can compute a fixed quotient . Moreover we have seen that at the same time we obtain a basis of an ideal of with . Invoking (B6) we can compute a generator of the ideal . Now we choose uniformly distributed elements until . If this is the case then is a quotient which is minimal with respect to the Euclidean function. Proposition 3 shows that if is uniformly distributed in , then is uniformly distributed in . Now the claim follows from Lemma 1.
(ii): As in the case of division, we see that the set of tuples with is the set of solutions of a matrix with entries in . As in addition this system can be solved modulo , the task of finding a suitable tuple can be solved using basic operations in .
(iii): Follows from (ii) and (iii).
Any basic operation in can be performed with an expected number of basic operations in .
4 Applications to matrix normal forms
When working with algebraic number fields the objects of desire often carry the structure of finitely generated torsion-free modules over . While the structure theorem for modules over asserts the freeness of such modules, the Hermite normal form (HNF) and algorithms for computing it bring them fully under control. They not only allow for the computation of a basis given a generating set, but they also enable us to solve various algorithmic problems.
Based on the extended GCD, it is straight forward to formulate a naive algorithm for computing the HNF over . Unfortunately, as in the case of Gaußian elimination over , coefficient swell occurs. Although there are various techniques to handle this circumstance, the most natural one is the use of residual methods, which goes back to Iliopoulos  and Domich, Kannan and Trotter : Instead of computing the HNF over , one computes a normal form over for some and lifts the result back to . If is chosen to be a multiple of the determinant of the lattice spanned by the rows of the matrix, this will yield a correct result.
The aim of this section is to introduce residual methods to the computation of normal forms of -modules by passing to a quotient ring for some suitable integral ideal and by lifting the result back to .
4.1 Strong echelon form for principal ideal rings
Given a ring and a matrix denote by the row span of . The idea of attaching a unique matrix normal form to submodules of , where is a principal ideal ring, goes back to Howell . He introduced a normal form (now called the Howell normal form) of submodules of and an algorithm for computing it, such that two modules are equal if and only if their Howell normal forms coincide. In his PhD thesis Storjohann  has generalized this notion to arbitrary principal ideal rings.
In this article we will adapt the Howell normal form to our needs. For an -module and we define to be the set of all elements of with last entries zero. For convenience we set if is matrix over with columns.
Let be an -module. A matrix , , is called strong echelon form of if and only if
For the -th row of is zero or . For the -th row of is zero.
For the rows generate .
To illustrate the definitions consider the following matrices over :
It is easy to see that they have the same span. While the matrix has a minimal number of non-zero rows the element