# Reduction Theory of Algebraic Modules and their Successive Minima

Lattices defined as modules over algebraic rings or orders have garnered interest recently, particularly in the fields of cryptography and coding theory. Whilst there exist many attempts to generalise the conditions for LLL reduction to such lattices, there do not seem to be any attempts so far to generalise stronger notions of reduction such as Minkowski, HKZ and BKZ reduction. Moreover, most lattice reduction methods for modules over algebraic rings involve applying traditional techniques to the embedding of the module into real space, which distorts the structure of the algebra. In this paper, we generalise some classical notions of reduction theory to that of free modules defined over an order. Moreover, we extend the definitions of Minkowski, HKZ and BKZ reduction to that of such modules and show that bases reduced in this manner have vector lengths that can be bounded above by the successive minima of the lattice multiplied by a constant that depends on the algebra and the dimension of the module. In particular, we show that HKZ reduced bases are polynomially close to the successive minima of the lattice in terms of the module dimension. None of our definitions require the module to be embedded and thus preserve the structure of the module.

## Authors

• 4 publications
• 22 publications
08/08/2021

### Macaulay bases of modules

We define Macaulay bases of modules, which are a common generalization o...
12/10/2019

### Algebraic and Euclidean Lattices: Optimal Lattice Reduction and Beyond

We introduce a framework generalizing lattice reduction algorithms to mo...
05/14/2018

### Some Properties of Successive Minima and Their Applications

A lattice is a set of all the integer linear combinations of certain lin...
04/10/2019

### On the Optimality of Gauss's Algorithm over Euclidean Imaginary Quadratic Fields

In this paper, we continue our previous work on the reduction of algebra...
05/01/2018

### Gröbner Bases of Modules and Faugère's F_4 Algorithm in Isabelle/HOL

We present an elegant, generic and extensive formalization of Gröbner ba...
12/02/2016

### Decision Theory in an Algebraic Setting

In decision theory an act is a function from a set of conditions to the ...
06/08/2018

### Performance Limits of Lattice Reduction over Imaginary Quadratic Fields with Applications to Compute-and-Forward

In this work, we first examine both Hermite's constant and Minkowski's t...
##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1 Introduction

Reduction theory of lattices is the study of representing the basis of a lattice in a manner such that the basis exhibits desirable properties, initially spurred by the study of the minima of positive definite quadratic forms and showing equivalence between two forms. There are a number of more precise definitions of what constitutes a reduced lattice basis, and perhaps the most widely known but distinct definitions of reduced bases are respectfully attributed to Lenstra-Lenstra-Lovàsz, Korkin-Zolotarev and Minkowski (see [2], [28], [1]). The study of lattice reduction has gained traction in recent years due to the rise of cryptosystems based on lattice problems (see e.g. [4], [5]), and also in coding theory (see e.g. [33]). Lately, generalisations of real lattices to those spanned over algebraic fields have emerged as a contender for classical lattices, both in cryptography for their relative compactness in terms of key size required to define them [6] and in coding theory for the fine structure of lattices defined over such algebras [9]. Whilst “weak” definitions of reduced lattices, such as LLL reduced lattices, have been extended to that of their algebraic counterpart (for just a few examples in literature, see [10], [12], [11], [13]), similar research into “strong” definitions of reduced lattice bases is somewhat limited. In this work, we establish the algebraic counterpart of some classical notions of lattice reduction, namely Minkowski, HKZ and BKZ reduced bases, and taking inspiration from [21], [15] and [16] we prove that bases reduced in this manner exhibit properties that are deemed desirable in reduction theory.

## 2 Preliminaries

We begin by defining some familiar concepts in algebraic number theory and lattice theory. For any concepts concerning central division algebras that we have left unexplained, we refer the reader to [22]. Moreover, throughout the paper we assume all division algebras in question are central division algebras. Denote by some division algebra, and let be some order of . We say that is left-Euclidean (respectively right-Euclidean) if there exists a function such that, for all , there exist such that for some , or (respectively, we take instead of is the order is right-Euclidean). In this paper, we will only cover associative division algebras, and so multiplicative operations throughout the paper will be assumed to be associative. The following definition of a lattice will be used throughout the rest of this piece of work. Here, by where , , multiplication by a vector is defined componentwise, where the direction of multiplication is defined by the position of , i.e. , .

###### Definition 2.1.

Let be a division algebra, and some order of . Suppose that is a left- (or right-) module over . We say that is a left-sided lattice (or respectively right-sided lattice) of dimension if has the representation

 Λ=d⨁i=1Obi,

(respectively if is a right-sided lattice), where for some integers , and each is linearly independent over . The set is said to be the basis of .

From now on, we will only refer to left-sided lattices, and we will refer to them simply as “lattices” unless we need to specify otherwise.

###### Definition 2.2.

Let be a division algebra and denote by lattices spanned over an order of with bases , respectively. We say that are equivalent if the two modules are isomorphic, that is, for every element , is also contained in . We say that a set for some and is linearly independent over , is extendable to a basis for if there exists an equivalent lattice with basis where .

###### Proposition 1.

Let be equivalent lattices, and assume is a basis for . Then is also a basis for .

###### Proof.

This follows from the definition of equivalent lattices, since any is also in , and so the basis describing also describes . ∎

###### Proposition 2.

Let be a -dimensional lattice spanned over an order of a division algebra with unit group , and let be a basis for . Then, for any , and , is extendable to a basis for .

###### Proof.

Let be the lattice with the basis . Then, for some , we have

 d∑i=1:i≠kyibi+yk⎛⎝ubk+d∑i=1:i≠kxibi⎞⎠=d∑i=1:i≠k(yi+ykxi)bi+(yku)bk∈Λ,

and for any , we have

 d∑i=1zibi=d∑i=1:i≠kzibi+zkbk=d∑i=1:i≠k(zi−zku−1xi)bi+(zku−1)⎛⎝ubk+d∑i=1:i≠kxibi⎞⎠∈Λ′,

and so we have shown the lattices are equivalent, as required. ∎

For a division algebra , and a set for some integers , for all , define by the space of all linear combinations of over , where multiplication by scalars is performed on the lefthand side of vectors.

###### Definition 2.3.

Let be a lattice of dimension over , some order of a division algebra , and suppose that is a set of elements of that are linearly independent over , . We say that is a primitive system of if, for all , then if and only if , where .

###### Proposition 3.

Let be a division algebra, and let be a right-Euclidean order of , and say that is a lattice of dimension defined over with basis . Then for any set of linearly independent vectors in , , is a primitive system of if and only if is extendable to a basis of .

###### Proof.

The if statement is trivial: if is a subset of a basis of an equivalent lattice , then by the definition of a lattice over , the linear span of over is an element of the lattice only if the elements taken from are in . Now assume that is a primitive system of . We prove by induction, and so begin by taking . Let . Since is an element of , we may use the representation

 s=d∑i=1xibi,

where . Assume that is nonzero, and the smallest nonzero element when ordering the in terms of the Euclidean function . If , then we have

 s=x1b1.

However, by the definition of a primitive system, this can only be true if we have , the unit group of . Now assume there is at least one such where . Assume each is such that , except for those of the . Then, by the definition of a Euclidean ring, we may choose a for each such that either or , and so we have

 s=d∑i=1xibi=x1(b1+d∑i=2qibi)+d∑i=2(xi−x1qi)bi=x1b∗1+d∑i=2x∗ibi,

where and . Since every is such that , and is the smallest nonzero element in terms of the Euclidean function , iterating this procedure a finite number of times yields

 s=mb′,

where is some lattice vector achieved by invertible operations. By definition of a primitive system, we must have , and as such is extendable to a basis of , as we have come by using invertible operations. Now, assume that is a primitive system, and is extendable to a basis of . Let be a basis for . By proposition 1 and the assumption that is extendable to a basis for , we may set . We may use the representation

 sk+1=k∑i=1xisi+d∑i=k+1xibi,

for some , where at least one of is nonzero as the set is linearly independent over . Using Euclidean division with the coefficients as before, we get

 sk+1=k∑i=1xisi+mb∗k+1.

We must have , as is a lattice vector, and if , then

 b∗k+1=m−1(sk+1−k∑i=1xisi)∉Λ,

which is a contradiction. Therefore, since we have come by the vector using invertible operations, we have shown the set is extendable to a basis for . ∎

The following corollaries are an immediate consequence of this proposition.

###### Corollary 0.1.

Let be a lattice of dimension spanned over a right-Euclidean order of some division algebra with basis . Denote by an arbitrary lattice vector such that , . Then there exists a set containing that is extendable to a basis for .

###### Corollary 0.2.

Let be a lattice of dimension spanned over a right-Euclidean order of some division algebra , with basis . Denote by

 sk=d∑i=1xibi

an element of , so . Then, for all , the set forms a primitive system if and only if at least one of is nonzero, and .

## 3 Minkowski Reduction of Algebraic Lattices

In order to ascertain more important properties about algebraic lattices we need to define how we measure the lengths of lattice vectors, and what it means for a lattice basis to be reduced with respect to the norm function.

###### Definition 3.1.

Let be a lattice over an order of some division algebra . A function , is a norm on if it satisfies the following properties:

• , for all ,

• , for all ,

• is the zero vector.

###### Definition 3.2.

Let be a -dimensional lattice with basis over an order of some division algebra , and let be a norm on . We say that is Minkowski reduced if satisfies the following properties:

• is the smallest, nonzero vector with respect to such that is extendable to a basis for ,

• For all , is the shortest nonzero vector with respect to such that is extendable to a basis for .

###### Definition 3.3.

Let be a -dimensional lattice with basis over an order of some division algebra , and let be a norm on . Denote by the elements of such that

• ,

• ,

• For every linearly independent set over , , we have , for all .

We label . Then are referred to as the th successive minima of , for all .

###### Theorem 1.

Let be a -dimensional lattice with basis over a right-Euclidean order of some division algebra , and let be a norm on . Then is Minkowski reduced if and only if, for all , , the following implications hold:

 N(d∑i=1xibi)≥N(bk)⟺gcd(xk,…,xd)=1.
###### Proof.

This follows from Proposition 3 and Corollary 0.2. ∎

Let be a division algebra of degree over some base field , and suppose that is of degree over , where is the number of real places and is the number of pairs of complex places. Denote by the Hamilton quaternion field over , and denote . Denote by the homomorphism . We have

 KR≅Mm2(H)×Mm(R)r1−w×Mm(C)r2,

where is the number of real places at which ramifies. We define by the canonical involution of , which is induced by the canonical involution of the quaternion field on the first factor, the identity map on the second and complex conjugation on the third. It follows that, for any , we have . Associate to the reduced trace function . Then, we define the following bilinear form, for all :

 qα(φ(x),φ(y))=trK/Q(D∑i=1φ(xi)φ(α)φ(yi)∗),

where tr denotes the reduced trace induced by the division algebra, and such that induces a positive-definite quadratic form for all , and . We remark that is positive-definite if and only if and , and we say that is totally positive if it satisfies this property. We denote by the subset of totally positive elements of . For any , by abuse of notation we also let . We note that the square root of acts as a norm for any lattice of dimension over an order of . For convenience of notation, we will write for any . Moreover, for any let us denote by , . Then for some arbitrary lattice vector for a lattice , where , , we have

 qα(φ(v))=qα(d∑i=1φ(xi)φ(bi))=qα(d∑i=1φ(xi)(bi(i)+i−1∑j=1μi,jbj(j))), (1)

where , and , for all .

###### Lemma 2.

For all , we have

where .

###### Proof.

The proof follows closely to that of classical Gram-Schmidt orthogonalisation. First, let’s show the claim for . Letting :

 =trK/Q(D∑i=1(φ(x2)φ(bi,2)φ(α)(φ(x1)φ(bi,1))∗−φ(x2)μ21φ(bi,1)φ(α)(φ(x1)φ(bi,1))∗)) =trK/Q(D∑i=1φ(x2)φ(bi,2)φ(α)φ(bi,1)∗φ(x1)∗−φ(x2)μ21D∑i=1(φ(bi,1)φ(α)φ(bi,1)∗)φ(x1)∗),

which is zero, by the definition of . A similar proof follows if we replace with an arbitrary . Now suppose that for all . Then for some :

 qα(φ(xi)bi(i),φ(xk+1)bk+1(k+1)) =qα(φ(xi)bi(i),φ(xk+1)φ(bk+1))−k∑l=1qα(φ(xi)bi(i),φ(xk+1)μi,lbl(l)) =qα(φ(xi)bi(i),φ(xk+1)φ(bk+1)),

and so the above by an identical argument for the case . ∎

###### Definition 3.4.

Associate to the reduced norm function . Let be the homomorphism that takes . Let be a lattice spanned over an order of in the space and basis . We define the determinant of by

 detα(Λ):=r∏i=1det(Fi)r+s∏i=rdet(Fi)2,

where, if denotes the quadratic form generated by , , , where we associate real automorphisms and pairs of complex automorphisms to , then denotes the matrix made up of the submatrices . Then we define the additive –Hermite invariant of an algebraic lattice of dimension over an order by

 γα,O,d(Λ)=minv∈Λ∖{0}qα(φ(v))detα(Λ)1dnm2.

Since induces a positive-definite quadratic form, the value of the additive –Hermite invariant is bounded for every lattice . We call the additive –Hermite constant. The following theorem can be proven identically to the case in [25].

###### Theorem 3.

Denote by the real Hermite constant in dimension . Then for all positive ,

 γα,O,d≤γdnm2disc(O/Z)1nm2,

where denotes the discriminant of over .

###### Theorem 4.

Let be a lattice of dimension spanned over the order , and let be a quadratic norm defined by some . Denote by the th successive minima, , with respect to the norm , for all . Then

 d∏i=1λ2i≤γdα,O,ddetα(Λ)1nm2.
###### Proof.

Let , be the vectors such that for all . By the definition of the successive minima of the lattice, are linearly independent over , and so every lattice point can be represented by

 v=d∑i=1xisi,

for some . Using the method described in (1), we may decompose into the sum of squares:

 qα(φ(v))=f1(x1,x2,…,xd)2+f2(x2,x3,…,xd)2+⋯+f(xd)2,

where . Now, let us consider an alternative lattice , whose vector lengths generate the quadratic form

 qα(v′)=λ−21f1(x1,x2,…,xd)2+λ−22f2(x2,x3,…,xd)2+⋯+λ−2df(xd)2,

for some . We claim that every nonzero element of has norm . Suppose that is the first nonzero value in , counting backwards from . We must have that is linearly independent of the vectors , as otherwise, by definition we must have that , and hence , which is a contradiction. It therefore holds that , and so

 k∑i=1λ−2if(xi,…,xd)≥λ−2kk∑i=1f(xi,…,xd)≥1.

Since , using the fact that the shortest nonzero vector in has norm , we get

 γdα,O,ddetα(Λ′)1nm2≥1⟺γdα,O,ddetα(Λ)1nm2≥d∏i=1λ2i,

which proves the result. ∎

###### Lemma 5 ([20], Corollary 3.9).

Let be a division algebra of degree over some base number field , and let . Denote by some order of with discriminant over . Then for any , , there exists a such that

 maxx∈Kminy∈Oqα(x−φ(y))≤nm34disc(O/Z)2nm2% nrdK/Q(α)1nm.

From now on, in order to keep our notation concise, we will use the symbol to denote the quantity . Finally, we give the following definition:

###### Definition 3.5.

Let denote the unit group of . We say that the space is left unit reducible (respectively right unit reducible with respect to a norm if, for any , the following implications hold:

 N(v)≤N(uv),∀u∈O×⟺N(v)≤N(qv),∀q∈O∖{0},

(respectively right-hand multiplication for right unit reducible spaces). We say the space is unit reducible if the space is both left- and right- unit reducible.

It is not currently clear which fields admit the unit reducible property and which do not, although we suspect that the value of the regulator of the number field would give a good indication of which fields are unit reducible or not. The property certainly holds for certain cases, and one can find counterexamples for certain fields. Clearly, the rational numbers and any imaginary quadratic or rational quaternion field admits a unit reducible space for any . We give a few examples of unit reducible spaces, and one counterexample.

###### Proposition 4.

Let denote the quadratic norm for any totally positive . For any integer , the space is unit reducible if

 K=Q(√2),Q(√3),Q(√5),Q(ζ8),Q(ζ12).

The space is not unit reducible if .

###### Proof.

See appendices. ∎

We are now equipped to prove some useful properties about Minkowski reduced bases.

###### Theorem 6.

Let be a lattice of dimension spanned over a right-Euclidean order , and assume that is left unit reducible. Denote by , the basis vectors for . Assume that is Minkowski reduced with respect to the norm induced by , for some . Denote by the successive minima of the lattice with respect to this norm. Then, for all , we have

 qα(φ(bk))≤δ2kλ2k,

where

 δ1=1,δ2k=1+ρα,Ok−1∑i=1δ2i.
###### Proof.

By Theorem 1 and the fact that is left unit reducible, we must have that the norm of corresponds to the first successive minima. Denote by the sublattice of generated by the left-linear span of over , for some . By the definition of the successive minima, there exist linearly independent lattice vectors such that , . By the pigeonhole principle, there must exist at least one such that . However, there must exist a lattice vector so that forms a primitive system for a sublattice containing , and therefore by proposition 3, this set must also be extendable to a basis for , and so

 sj=k−1∑i=1xibi+lv∗j,

where . Decompose , where the vector is orthogonal to the space , which must be a nonzero vector. Then

 qα(φ(sj))=λ2j=qα(φ(k−1∑i=1xibi+lp))+qα(φ(lq))=qα(φ(k−1∑i=1xibi+lp))+qα(φ((lu−1)(uq))),

where is chosen to minimise the function . By the assumption that is left unit reducible,

 λ2j≥qα(φ((lu−1)(uq)))≥qα(φ(uq)).

Suppose that , for some . Using the orthogonalisation process detailed in lemma 1, by choosing a carefully so that

 qα(φ(up−y))=qα(k−1∑i=1mibi(i))

where such that . Since is extendable to a basis vector, we have

 qα(φ(bk))≤qα(φ(uv∗j−y))=qα(φ(up−y))+qα(φ(uq)) ≤ρα,Ok−1∑i=1qα(φ(bi))+λ2k≤ρα,Ok−1∑i=1δ2iλ2i+λ2k≤(ρα,Ok−1∑i=1δ2i+1)λ2k,

as required. ∎

An exponential upper bound on the length of the basis vectors in terms of the successive minima immediately follows. By definition, we have

 δ2k=1+ρα,Ok−1∑i=1δ2i=(1+ρα,Ok−2∑i=1