Algebraic and Euclidean Lattices: Optimal Lattice Reduction and Beyond

TL;DR

This paper develops a generalized framework for lattice reduction over module lattices in cyclotomic fields, achieving faster algorithms that improve upon classical methods like LLL, with applications to number theory and cryptography.

Contribution

It introduces a recursive reduction strategy exploiting subfield structures and symplectic geometry, enabling efficient reduction over cyclotomic fields and generalizing to Euclidean lattices.

Findings

Heuristically reduces rank 2 modules over cyclotomic fields within exponential approximation factors.

Achieves reduction time close to matrix multiplication complexity, improving previous algorithms.

Provides speedups for various number theoretical algorithms using the new reduction framework.

Abstract

We introduce a framework generalizing lattice reduction algorithms to module lattices in order to practically and efficiently solve the $\gamma$-Hermite Module-SVP problem over arbitrary cyclotomic fields. The core idea is to exploit the structure of the subfields for designing a doubly-recursive strategy of reduction: both recursive in the rank of the module and in the field we are working in. Besides, we demonstrate how to leverage the inherent symplectic geometry existing in the tower of fields to provide a significant speed-up of the reduction for rank two modules. The recursive strategy over the rank can also be applied to the reduction of Euclidean lattices, and we can perform a reduction in asymptotically almost the same time as matrix multiplication. As a byproduct of the design of these fast reductions, we also generalize to all cyclotomic fields and provide speedups for many previous number theoretical algorithms. Quantitatively, we show that a module of rank 2 over a cyclotomic field of degree $n$ can be heuristically reduced within approximation factor $2^{\tilde{O}(n)}$ in time $\tilde{O}(n^2B)$, where $B$ is the bitlength of the entries. For $B$ large enough, this complexity shrinks to $\tilde{O}(n^{\log_2 3}B)$. This last result is particularly striking as it goes below the estimate of $n^2B$ swaps given by the classical analysis of the LLL algorithm using the so-called potential.