Lattice Basis Reduction in Infinity Norm - Technische Universität ...

– z := 0
• ELSE
3. END WHILE
– size-reduce b1, b2, ...., bm
– z := z + 1
OUTPUT: BKZ-reduced basis b1, b2, ...., bm
The same logic is applied here as in the algorithm that works with respect
to the Euclidean norm. j is cyclically shifted through the integers
1, 2, ...., m − 1. The variable z counts the number of positions j which satisfy
the inequality δFj(bj) < ¯ Fj. Here again, if the inequality does not
hold, bnew is inserted into the basis, a size-reduction is done and z is set to
j
0. The term j = m is skipped since for it the inequality always holds. The
basis (b1, b2, ...., bj−1, b new
j
) is extended to (b1, b2, ...., bj−1, b new
j
using the coefficients uj in the representation bnew j
, ...., b new
h )
= � h
i−j uibi. The ma-
trix T ∈ GLh−j+1(Z) with [uj, ...., uh] · T = [1, 0, ...., 0] is computed at this
point and the vectors [bnew j , ...., bnew h ] are set to [bj, ...., bh] · T −1 .
The backbone of the algorithm is again the routine ENUM(j, k), which
computes the minimal point (uj, ...., uk) so that the minimum of ¯ Fj can be
found. Here we are looking for a vector b ∈ L(b1, b2, ..., bm) ⊂ Rn with
� b �p = λ1,�·�p (L). Let ¯ b = �m i−1 uibi be the vector that has the minimum
lp-norm from all enumerated lattice vectors. At the beginning of the algorithm
the vector ¯ b is set to b1 which means that (u1, ...., um) = (1, 0, ...., 0).
We can stop the search for the shortest lattice vector in a partial tree with
a root (ũt, ...., ũm) as soon as Ft(ωt) ≥ � ¯ b �p.
For this stop criterion the minimal point (λt, ...., λm) of the function
f(µt, ...., µm) :=� ¯ b �p� �m i=1 µiωi �q −˜ct, with µi ∈ R and �m i=1 µiωi = ˜ct,
must be first computed. The enumeration could be stopped if f(λt, ...., λm)
is negative. The minimum of this function is calculated in polynomial time
with the help of the Ellipsoid method. The cost of the stop criterion is
comparable to the cost of the computation of the distance functions. Our
purpose is thus to find an optimal range of vectors (λt, ..., λm). For (λt, ...,
λm) = (1, 0, ..., 0) we get
¯ct
�ωt�q ≥ � ¯ b �p=⇒ Ft(ωt) ≥ � ¯ b �p
This gives us a stop criterion which can be tested in linearly many arithmetical
operations.
For (λt, ...., λm) = (1, 0, ...., 0) we have
|ũt + yt| ≥ �¯ b�p� ˆ bt�q
ct
=⇒ Ft(ωt) ≥ � ¯ b �p
In this way we can limit the number of possible values of ũt with constant
(ũt+1, ...., ũm) a priori.
26