**Lattice Reduction for Modules, or How to Reduce ModuleSVP to ModuleSVP**

*Tamalika Mukherjee and Noah Stephens-Davidowitz *

**Abstract: **We show how to generalize lattice reduction algorithms to module lattices in order to reduce $\gamma$-approximate ModuleSVP over module lattices with rank $k \geq2$ to $\gamma'$-approximate ModuleSVP over module lattices with rank $2 \leq \beta \leq k$. To do so, we modify the celebrated slide-reduction algorithm of Gama and Nguyen to work with module filtrations, a higher-dimensional analogue of the ($\mathbb{Z}$-)basis of a lattice.
The particular value of $\gamma$ that we achieve depends on the underlying number field $K$, the ring $R \subset K$, and the embedding (as well as, of course, $k$ and $\beta$). However, for reasonable choices of these parameters, the approximation factor that we achieve is surprisingly close to the one achieved by ``plain'' lattice reduction algorithms, which require an arbitrary SVP oracle in the same dimension. In other words, we show that ModuleSVP oracles are nearly as useful as SVP oracles for solving approximate ModuleSVP in higher dimensions.
Our result generalizes the recent independent result of Lee, Pellet-Mary, Stehlé, and Wallet, which works in the important special case when $\beta = 2$ and $R = \mathcal{O}_K$ is the ring of integers of $K$ under the canonical embedding. Indeed, at a high level our reduction can be thought of as a generalization of theirs in roughly the same way that slide reduction generalizes LLL reduction.

**Category / Keywords: **foundations / Lattices, modules, ModuleSVP, Ring-LWE

**Date: **received 2 Oct 2019, last revised 17 Feb 2020

**Contact author: **noahsd at gmail com,tmukherj@purdue edu

**Available format(s): **PDF | BibTeX Citation

**Version: **20200217:131058 (All versions of this report)

**Short URL: **ia.cr/2019/1142

[ Cryptology ePrint archive ]