Log In Sign Up

On the computation of the HNF of a module over the ring of integers of a number field

by   Jean-François Biasse, et al.
Technische Universität Kaiserslautern
University of South Florida

We present a variation of the modular algorithm for computing the Hermite normal form of an O_K-module presented by Cohen, where O_K is the ring of integers of a number field K. An approach presented in (Cohen 1996) based on reductions modulo ideals was conjectured to run in polynomial time by Cohen, but so far, no such proof was available in the literature. In this paper, we present a modification of the approach of Cohen to prevent the coefficient swell and we rigorously assess its complexity with respect to the size of the input and the invariants of the field K.


page 1

page 2

page 3

page 4


Polynomial XL: A Variant of the XL Algorithm Using Macaulay Matrices over Polynomial Rings

Solving a system of m multivariate quadratic equations in n variables (t...

Formalizing the Ring of Adèles of a Global Field

The ring of adèles of a global field and its group of units, the group o...

Formalizing the Ring of Witt Vectors

The ring of Witt vectors 𝕎 R over a base ring R is an important tool in ...

Cubical Cohomology Ring of 3D Photographs

Cohomology and cohomology ring of three-dimensional (3D) objects are top...

Algorithms for the solution of systems of linear equations in commutative ring

Solution methods for linear equation systems in a commutative ring are d...

The Module Isomorphism Problem for Finite Rings and Related Results

Let R be a finite ring and let M, N be two finite left R-modules. We pre...

Cryptanalysis of ITRU

ITRU cryptosystem is a public key cryptosystem and one of the known vari...

1 Introduction

Algorithms for modules over the rational integers such as the Hermite normal form algorithm are at the core of all methods for computations with rings and ideals in finite extensions of the rational numbers. Following the growing interest in relative extensions, that is, finite extensions of number fields, the structure of modules over Dedekind domains became important. On the theoretical side, it was well known that the framework of finitely generated projective modules was well suited for these problems, but explicit algorithms were lacking for a long time. Based on the pioneering work of of Bosma and Pohst Bosma and Pohst (1991), the computation of a Hermite normal form (HNF) over principal ideal domains was generalized to finitely generated modules over Dedekind domains by Cohen Cohen (1996) (for a comparison between the work of Bosma–Pohst and Cohen, see (Hoppe, 1998, Chap. 6)). It was conjectured that Cohen’s algorithm (Cohen, 1996, Algorithm 3.2) for computing this so-called pseudo-Hermite normal form (pseudo-HNF) has polynomial complexity (see (Cohen, 1996, Remark after Algorithm 3.2)): “…and it seems plausible that …this algorithm is, in fact, polynomial-time.” The polynomial complexity of a (modified) version of Cohen’s algorithm was conjectured in the folklore but not formally proved until the preliminary version of this study in the ISSAC proceedings Biasse and Fieker (2012). The difficulties in establishing this formally were two-fold: The original algorithm does not control the size of the coefficient ideals, and, most of the underlying field and ideal operations themselves have not been analyzed completely. While the ideal operations, which are based on Hermite normal forms over the rational integers, are known to have polynomial complexity, the exact complexity was previously not investigated in detail hence a byproduct of this discussion is a computational model for algebraic number fields together with an analysis of basic field and ideal operations.

Based on our careful analysis we also compare the complexity of algorithms for finitely generated projective modules over the ring of integers of a number field based on the structure as -modules with algorithms based on the structure as free -modules of larger rank. In practice, algebraic number fields of large degree are carefully constructed as relative extensions . The computational complexity of element and ideal operations in depend on both and . Ideals of the ring of integers of are naturally -modules of rank and therefore ideal arithmetic is reduced to computation of -modules of rank . On the other hand, the ring of integers and its ideals are finitely generated projective modules of rank over the Dedekind domain . Thus the ideal arithmetic in can be performed using the pseudo-HNF algorithm and it is only natural then to ask which method to prefer.

In addition, Fieker and Stehlé’s recent algorithm for computing a reduced basis of -modules relies on the conjectured possibility to compute a pseudo-HNF for an -module with polynomial complexity (Fieker and Stehlé, 2010, Th. 1). This allows a reduction algorithm for -modules with polynomial complexity, similar to the LLL algorithm for -modules.

In the same way as for -modules, where the HNF can be used to compute the Smith normal form, the pseudo-HNF enables us to determine a pseudo-Smith normal form. The pseudo-Smith normal form gives the structure of torsion -modules, and is used to study the quotient of two modules. Applications include the investigation of Galois cohomology McQuillan (1976).

In all of our algorithms and the analysis we assume that the maximal order, , is part of the input.

Our contribution

Let be a number field with ring of integers . We present in this paper the first algorithm for computing a pseudo-HNF of an -module which has a proven polynomial complexity. Our algorithm is based on the modular approach of Cohen (Cohen, 2000, Chap. 1) extending and correcting the version from the ISSAC proceedings Biasse and Fieker (2012). We derive bounds on its complexity with respect to the size of the input, the rank of the module and the invariants of the field.

As every -module is naturally a -module (of larger rank), we then compare the complexity of module operations as -modules to the complexity of the same operations as -modules. In particular, we show that the complexity of the -module approach with respect to the degree of the field is (much) worse than in the -module approach. This is due to the (bad) performance of our key tool: An algorithm to establish tight bounds on the norms of the coefficient ideals during the pseudo-HNF algorithm.

As an application of our algorithm, we extend the techniques to also give an algorithm with polynomial complexity to compute the pseudo-Smith normal form associated to -modules, which is a constructive variant of the elementary divisor theorem for modules over . Similarly to the pseudo-HNF, this is the first algorithm for this task that is proven to have polynomial complexity.


In order to discuss the complexity of our algorithms, we start by introducing our computational model and natural representations of the involved objects. Next, suitable definitions for size of the objects are introduced and the behavior under necessary operations is analyzed.

Once the size of the objects is settled, we proceed to develop algorithms for all basic operations we will encounter and prove complexity results for all algorithms. In particular, this section contains algorithms and their complexity for most common ideal operations in number fields. While most of the methods are folklore, this is the first time their complexity has been stated.

Next, the key new technique, the normalization of the coefficient ideals, is introduced and analyzed. Finally, after all the tools are in place, we move to the module theory. Similar to other modular algorithms, we first need to find a suitable modulus. Here this is the determinantal ideal, which is the product of fractional ideals and the determinant of a matrix with entries in . In Section 5 we present a Chinese remainder theorem based algorithm for the determinant computation over rings of integers and analyze its complexity.

In Section 6, we get to the main result: An explicit algorithm that will compute a pseudo-HNF for any full rank module over the ring of integers. The module is specified via a pseudo-generating system (pairs of fractional ideals of the number field

and vectors in

). Under the assumption that the module has full rank and that it is contained in , we prove the following (see Theorem 34):


There exists an algorithm (Algorithm 5), that given pseudo-generators of an -module of full rank contained in , computes a pseudo-HNF with polynomial complexity.

Actually, a more precise version is proven. The exact dependency on the ring of integers , the dimension of the module and the size of the generators is presented. Note that we assume that certain data of the number field is precomputed, including an integral basis of the ring of integers (see Section 3).

In the final section, we apply the pseudo-HNF algorithm to derive a pseudo-Smith normal form algorithm and analyze its complexity, achieving polynomial time complexity as well (Algorithm 6 and Proposition 43).

2 Preliminaries

Number fields

Let be a number field of degree and signature . That is admits real embeddings and complex embeddings. We can embed in and extend all embeddings to . The -dimensional real vector space carries a Hermitian form defined by for , where the sum runs over all embeddings, and an associated norm defined by for . The ring of algebraic integers is the maximal order of and therefore a -lattice of rank with . Given any -basis of , the discriminant of the number field is defined as , where denotes the trace of the finite field extension . The norm of an element is defined by and is equal to the usual field norm of the algebraic extension . For , denotes the rational matrix corresponding to , with respect to a -basis of and is called the regular representation of . Here, using a fixed -basis of , elements are identified with row-vectors in .

To represent -modules we rely on a generalization of the notion of ideal, namely the fractional ideals of . They are defined as finitely generated -submodules of . When a fractional ideal is contained in , we refer to it as an integral ideal, which is in fact an ideal of the ring . Otherwise, for every fractional ideal of , there exists such that is integral. The minimal positive integer with this property is defined as the denominator of the fractional ideal and is denoted by . The sum of two fractional ideals of is the usual sum as -modules and the product of two fractional ideals , is given by the -module generated by with and . The set of fractional ideals of forms a monoid with identity and where the inverse of is . Each fractional ideal of is a free -module of rank and given any -basis matrix we define the norm of to be . The norm is multiplicative, and in the case is an integral ideal the norm of is equal to , the index of in . Also note that the absolute value of the norm of agrees with the norm of the principal ideal .

-modules and the pseudo-Hermite normal form over Dedekind domains

In order to describe the structure of modules over Dedekind domains we rely on the notion of pseudoness introduced by Cohen Cohen (1996), see also (Cohen, 2000, Chapter 1). Note that, different to Cohen (1996), our modules are generated by row vectors instead of column vectors and we therefore perform row operations. Let be a non-zero finitely generated torsion-free -module and , a finite dimensional -vector space containing . An indexed family consisting of and fractional ideals of is called a pseudo-generating system of if

and a pseudo-basis of if

A pair consisting of a matrix and a list of fractional ideals is called a pseudo-matrix. Denoting by the rows of , the sum is a finitely generated torsion-free -module associated to this pseudo-matrix. Conversely every finitely generated torsion-free module gives rise to a pseudo-matrix whose associated module is . In case of finitely generated torsion-free modules over principal ideal domains, the task of finding a basis of the module can be reduced to finding the Hermite normal form (HNF) of the associated matrix. If the base ring is a Dedekind domain there exists a canonical form for pseudo-matrices, the pseudo-Hermite normal form (pseudo-HNF), which plays the same role as the HNF for principal ideal domains allowing us to construct pseudo-bases from pseudo-generating systems. More precisely let be of rank , a pseudo-matrix and the associated -module. Then there exists an matrix over and non-zero fractional ideals of satisfying

  1. for all we have ,

  2. the ideals satisfy ,

  3. the matrix is of the form

    where is an lower triangular matrix over with ’s on the diagonal and

    denotes the zero matrix of suitable dimensions.

  4. where are the rows of .

The pseudo-matrix is called a pseudo-Hermite normal form (pseudo-HNF) of resp. of . Note that with this definition, a pseudo-HNF of an -module is not unique. In Bosma and Pohst (1991); Cohen (1996); Hoppe (1998), reductions of the coefficients of modulo certain ideals provide uniqueness of the pseudo-HNF when the reduction algorithm is fixed.

Throughout the paper will make the following restriction: We assume that the associated module is a subset of . For if there exists an integer such that . In case of a square pseudo-matrix the determinantal ideal is defined as to be . For a pseudo-matrix , of rank , we define the determinantal ideal to be the of all determinantal ideals of all sub-pseudo-matrices of (see Cohen (1996)).

3 Size and costs in algebraic number fields

In order to state the complexity of the pseudo-HNF algorithm, we will now describe representations and algorithms of elements and ideals in number fields, which are the objects we have to compute with. The algorithms and representations chosen here are by no means optimal for all problems involving algebraic number fields. We have chosen the linear algebra heavy approach since it allows for efficient algorithms of the normalization of ideals and reduction of elements with respect to ideals, which are crucial steps in the pseudo-HNF algorithm. For different approaches to element arithmetic we refer the interested reader to (Cohen, 1993, 4.2) and Belabas (2004). For ideal arithmetic (in particular ideal multiplication) fast Las Vegas type algorithm are available making use of a 2-element ideal representation (see Cohen (1993); Belabas (2004)). As our aim is a deterministic polynomial time pseudo-HNF algorithm, we will not make use of them.

A notion of size.

To ensure that our algorithm for computing a pseudo-HNF basis of an -module runs in polynomial time, we need a notion of size that bounds the bit size required to represent ideals and field elements. We assume that the maximal order of is given by a fixed -basis with .

Size of ideals

A non-zero integral ideal is a -dimensional -submodule of and will be represented by its unique (lower triangular) HNF basis with respect to the fixed integral basis . The size required to store the matrix is therefore bounded by , where denotes the binary logarithm. Since we assume that is set to the value is actually equal to . (For we denote by .) The latter is the well known minimum of the integral ideal , which is denoted by and can be characterized as the unique positive integer with . Based on this observation we define

to be the size of . If is a fractional ideal of , where and is the denominator of , we define the size of by

The weight on the denominator is introduced to have a nice behavior with respect to the common ideal operations. Before we show that, we need to recall some basic facts about the minimum of integral ideals. The weight can also be seen as viewing the ideal as given by a rational matrix directly.

Proposition 1.

Let be integral ideals and , . Then the following holds:

  1. divides .

  2. divides .

  3. The denominator of is equal to .

  4. .

  5. divides .


Follows from the definition. ∎

The properties of the minimum translate easily into corresponding properties of the size of integral ideals. The next proposition shows that in fact the same relations hold also for fractional ideals.

Proposition 2.

Let be fractional ideals and , . Then the following holds:

  1. .

  2. .

  3. .


Note that if and are integral ideals then (1), (2) and (3) follow immediately from the properties of the minimum obtained in Proposition 1. Write and with and the denominator of and respectively.
(1): We have

(2): As the sum is equal to we obtain

(3): We have

(4): Consider first the integral case: We know that . Thus the principal ideal is divided by and there exists an integral ideal with , i. e.,

Note that and therefore . As is the denominator of by Proposition 1 (4) we obtain

Returning to the general case we have . Then

Size of elements.

The integral basis allows us to represent an integral element by its coefficient vector satisfying . The size to store the element is therefore bounded by

which we call the size of with respect to . This can be faithfully generalized to elements . Writing with the denominator of we define

to be the size of . Similarly to the ideals above, as added the weight to the denominator to achieve a nicer transformation behavior under the standard operations. Its justification also comes from viewing elements in as rational vectors rather than integral elements with a common denominator.

In order to relate our function to the multiplicative structure on we need to recall that the notion of size of elements is closely related to norms on the -vector space . More precisely, the fixed integral basis gives rise to an isomorphism

onto the -dimensional real vector space. Equipping with the -norm we have for . But this is not the only way to identify with a normed real vector space. Denote the real embeddings by and the complex embeddings by . We use the usual ordering of the complex embeddings, such that for . Using these embeddings we define

yielding for , where denotes the -norm on . Since is complete, any two norms on are equivalent. Thus there exists constants depending on and the chosen basis with


for all . Moreover we have the inequalities


for all and applying the geometric arithmetic mean inequality yields


Another important characteristic of an integral basis is the size of the structure constants , which are defined by the relations

for . We denote the maximum value by .

Remark 3.

Note that there is a situation in which we are able to estimate the constants

. Assume that is LLL-reduced with respect to and LLL parameter . Then by (Belabas, 2004, Proposition 5.1) the basis satisfies

for all . Moreover the structure constants satisfy

and thus we can choose

By (Fieker and Stehlé, 2010, Lemma 2) we have for all allowing for .

Using the preceding discussion we can now describe the relation between size and the multiplicative structure of . If and are integral elements the product is equal to with

Thus for the size of we obtain

The constant therefore measures the increase of size when multiplying two integral elements.

The second multiplicative operation is the inversion of integral elements. Let with the denominator of and . Using and Inequality (3) we obtain . Since

for every embedding we get by Inequality (2). Combining this with the estimate for the denominator yields

Again we see that there is a constant depending on describing the increase of size during element inversion. We define by

to obtain a constant incorporating both operations. Since we work with a fixed basis we drop the from the index and denote this constant just by . So far the obtained bounds on the size are only valid for integral elements and it remains to prove similar relations for the whole of . We begin with the multiplicative structure.

Proposition 4.

For all and , , the following holds:

  1. .

  2. ,

  3. .


We write and with and the denominator of and respectively. Note that by the choice of items (2) and (3) hold for integral elements. (1): From the definition of the size it follows that . Since the denominator of is bounded by we have

(2): Since the denominator of is bounded by we obtain

(3): The inverse of is equal to . Therefore using (1) we get

We now investigate the additive structure.

Proposition 5.

If and are elements of then .


It is easy to see that if and are integral elements. Now write and with and the denominator of and respectively. Then we obtain and finally

Finally we need the mixed operation between ideals and elements.

Proposition 6.

Let and be a fractional ideal. Then .


We consider first the integral case and . Using Inequalities (1) and (3) the minimum of the principal ideal can be bounded by . Thus we have

Now let and with and the denominator of and respectively. Using the integral case we obtain

Calculating in .

In this section, we evaluate the complexity of the basic operations performed during the pseudo-HNF algorithm. To simplify the representation of complexity results, we use soft-Oh notation : We have if and only if there exists such that . We multiply two integers of bit size with complexity in using the Schönhage–Strassen algorithm Schönhage and Strassen (1971). While the addition of such integers is in , their division has complexity in .

As most of our algorithms are going to be based on linear algebra over rings, mainly , we start be collecting the complexity of the used algorithms. The basic problem of determining the unique solution to the equation with non-singular, can be done using Dixon’s -adic algorithm Dixon (1982) in .

As we represent integral ideals using the HNF basis, the computation of this form is at the heart of ideal arithmetic. Note, that in contrast to the standard case in the literature Hafner and McCurley (1991); Storjohann and Labahn (1996) we do not want to state the complexity in terms of the determinant (or multiples thereof) but in terms of the elementary divisors. As we will see, in our applications, we always know small multiples of the elementary divisors and thus obtain tighter bounds. Important to the algorithms is the notion of a Howell form of a matrix as defined in Howell (1986). The Howell form generalizes the Hermite normal form to and restores uniqueness in the presence of zero divisors. For a matrix of rank we denote by the unique Hermite form of the matrix (with the off-diagonal elements reduced into the positive residue system modulo the diagonal), while will denote the Howell form for . In Storjohann and Mulders (1998) a naive algorithm is given that computes in time operations in . We also need the following facts:

Lemma 7.

Let and such that where denotes the -module generated by the rows of . Then the following holds:

  1. We have

  2. We have , that is, the canonical lifting of the Howell form over yields the Hermite form over .


Since, by assumption,

and the Hermite form is an invariant of the module, the first claim is clear.

To show the second claim, it is sufficient to show that the reduction of modulo has all the properties of the Howell form. Once this is clear, the claim follows from the uniqueness of the Howell form as an invariant of the module and the fact that all entries in are non-negative and bounded by . The only property of the Howell form that needs verification, is the last claim: any vector in having first coefficients zero is in the span of the last rows of the Howell form. This follows directly from the Hermite form: any lift of such a vector is a sum of a vector in and an element in starting with the same number of zeroes as the initial element. Such an element is clearly in the span of the last rows of since the Hermite form describes a basis and the linear combination carries over modulo . The other properties of the Howell form are immediate: the reduction modulo the diagonal as well as the overall shape is directly inherited from the Hermite form. The final property, the normalization of the diagonal namely to divide follows too from the Hermite form: since is contained in the module, the diagonal entries of the Hermite form have to be divisors of , hence of . We note, that the reason we chose over is to avoid problems with vanishing diagonal elements: as all diagonal entries of the Hermite form are divisors of , none of them can vanish in . ∎

We can now derive the complexity of the HNF computation in terms of .

Corollary 8.

Let be a matrix and such that . Then the Hermite normal form of can be computed with complexity in .


The Lemma 7 links the Hermite normal form to the Howell form, while Storjohann’s naive algorithm Storjohann and Mulders (1998) will compute the Howell form with the complexity as stated. ∎

We will see, that in our applications, we naturally know and control a multiple of the largest elementary divisor, hence we can use this rather than the determinant in our complexity analysis.

Note that due to Storjohann and Mulders Storjohann and Mulders (1998) there exists asymptotically fast algorithms for computing the Howell form based on fast matrix multiplication. Since our pseudo-HNF algorithm is a generalization of a non-asymptotically fast HNF algorithm over the integers and eventually we want to compare our pseudo-HNF algorithm with the absolute HNF algorithm it is only reasonable to not use asymptotically fast algorithms for the underlying element and ideal arithmetic.

Concerning our number field , we take the following precomputed data for granted:

  • An integral basis of the maximal order satisfying .

  • The structure constants of .

  • The matrix , where and is the denominator of . Moreover using (Fieker and Stehlé, 2010, Theorem 3) we compute a LLL-reduced -element representation of the ideal generated by the rows of with the property

    for . In addition we compute the regular representations and .

  • A primitive element of with minimal polynomial , such that and . Such an element can be found as follows: By a theorem of Sonn and Zassenhaus Sonn and Zassenhaus (1967) there exist such that is a primitive element of the field extension . Note that with the currently known methods finding such an element is exponentially costly with respect to . Applying the embeddings we obtain

    Using these estimates for the conjugates of we get the following bound on the coefficients of the minimal polynomial of : Since the elements , , are exactly the roots of we obtain

    for , where denotes the elementary symmetric polynomial of degree . Therefore the height of can by estimated by

    As we have a bound for the absolute values of its roots, we can moreover derive the following estimate for the discriminant of :

    Taking logarithms on both sides we obtain

We do not impose any further restrictions on our integral basis . All dependency on is captured by .

Field arithmetic

During our pseudo-HNF computation we need to perform additions, multiplications, and inversions of elements of . Although algorithms for these operations are well known (see Cohen (1993); Belabas (2004)) and many implementations can be found, there is a lack of references on the complexity. While multiplication in was investigated by Belabas Belabas (2004), all the other operations are missing. We address the complexity issues in the rest of this section and begin with the additive structure.

Proposition 9.

Let and . We can

  1. compute the product with complexity in .

  2. compute the quotient with complexity in .

  3. compute the sum with complexity in .


Let us write and with and the denominator of and respectively.

(1): Computing the GCD of and as well as and have complexity in . This is followed by computing which has complexity in and dominates the computation.

(2): Let be the coefficient vector of and . The quotient is then given by . As the costs of computing are in and the products can be computed in and the claim follows.

(3): The complexity obviously holds for integral elements. By (1) the computation of and has complexity in and the complexity of adding and is in . Computing has complexity in . The last thing we have to do is making sure that the coefficients of the numerator and the denominator are coprime. This is done by GCD computations and divisions with complexity in . ∎

Proposition 10.

Let , an integral element and . We can

  1. compute the regular representation of with complexity in .

  2. compute the product with complexity in if the regular representation of the numerator of is known.

  3. compute the product with complexity in

  4. compute the products , , with complexity in .

  5. compute the inverse with complexity in if .


Let us write and with and the denominator of and respectively.

(1): If