Random Integer Lattice Generation via the Hermite Normal Form

Abstract

Lattices used in cryptography are integer lattices. Defining and generating a “random integer lattice” are interesting topics. A generation algorithm for a random integer lattice can be used to serve as a random input of all the lattice algorithms. In this paper, we recall the definition of the random integer lattice given by G. Hu et al. and present an improved generation algorithm for it via the Hermite normal form. It can be proven that with probability ≥0.99, this algorithm outputs an n-dim random integer lattice within $O\left(n^2\right)$ operations.

1. Introduction

Lattices are discrete subgroups in ${\mathbb{R}}^n$. Since Ajtai’s discovery of the average-case/worst-case connection in lattice problems [1], lattice-based cryptography has attracted much attention [2,3,4,5]. Up to now, lattice-based cryptographic schemes have been considered to be a promising alternative to more traditional ones based on the factoring and discrete logarithm problems since lattice-based schemes can be resistant to efficient quantum algorithms [6]. Lattice algorithms such as LLL [7] and BKZ [8,9] are commonly used in analyzing these lattice-based schemes’ security. The lattices used in cryptography and lattice algorithms are integer lattices (discrete subgroups of ${\mathbb{Z}}^n$). Thus, the problem of suitably defining and generating a random integer lattice is a meaningful topic. In [10], P. Q. Nguyen found that for dimensions up to 50, LLL almost outputs the shortest lattice vector, while in theory, LLL’s output is just an approximately short vector. Once we are able to generate a random integer lattice, such a generation algorithm can be used to serve as a random input for all lattice algorithms to obtain their output qualities on average.

In [1], M. Ajtai defined a family of “random integer lattices” in terms of the worst-case to average-case connection and showed how to generate one from this lattice family. For uniform $\mathbf{A}\in {\mathbb{Z}}_q^{n\times m}$, the lattice family is defined as ${\Lambda }^{\perp }\left(\mathbf{A}\right)=\{\mathbf{Ax}\in {\mathbb{Z}}^m:\mathbf{Ax}=\mathbf{0}\in {\mathbb{Z}}_q^n\}$. In [10], P. Q. Nguyen and D. Stehle gave a definition of the “random integer lattice” in the sense of the Haar measure, which was approximated by the Goldstein–Mayer method [11]. For large number N, this “random integer lattice” is uniformly chosen from the set of all $n\times n$ Hermite normal forms with the determinant equal to N. When N is prime, to generate such a random integer lattice, one only needs to set $h_{nn}=N$, $h_{in}\in [0,N)$ uniformly and $h_{ii}=1$ for $i<n$. This type of “random integer lattice” is used in many cryptographic applications. From the perspective of mathematics, studying whether the requirement that N be a prime can be removed is also a meaningful issue.

In [12], G. Maze studied the probabilistic distribution of the random HNF with a special diagonal structure, where the randomness was derived from a random square matrix whose elements were all chosen uniformly from $[-B,B]$ for large enough B. In [13], G. Hu et al. introduced a different definition of randomness, in which the definition “random integer lattice” means the lattice’s HNF is chosen uniformly from all $n\times n$ HNFs whose determinants are upper bounded by a large number M. In the same paper [13], G. Hu et al. also presented a complete random integer lattice generation algorithm. In this algorithm, the first step is to generate a determinant. To make the final output uniform, it is necessary to compute the total number of HNFs with fixed determinant N. Since the total number can be figured out only in the case that the factorization of N is known, a subroutine to factor integers is necessary in this algorithm. In this paper, we improved this algorithm with the help of the diagonal elements’ distribution in the random HNF. This improved algorithm first generates the diagonal elements $h_{11},\cdots ,h_{n-1,n-1}$ without computing the total number of HNFs with a fixed determinant, then it uses the reverse sampling method to generate the final diagonal element $h_{nn}$. Thus, the factorization subroutine is no longer needed in this improved algorithm, which makes it more efficient.

The remainder of the paper is organized as follows. In Section 2, we give some necessary preliminaries. In Section 3, we recall the definition of the random integer lattice given by G. Hu et al. and discuss the distribution of all the diagonal elements in the random integer lattice’s HNF. For the next section, we present our improved algorithm to generate the random integer lattice via the HNF. Finally, we give our conclusion in Section 5.

2. Preliminaries

We denote by $\mathbb{Z}$ the integer ring and $\mathbb{R}$ the real number field. We use $G{L}_n\left(\mathbb{Z}\right)$ to denote the general linear group over $\mathbb{Z}$. For convenience, we denote the set of all $n\times n$ nonsingular integer matrices by $G{L}_n\left(\mathbb{R}\right)\cap {\mathbb{Z}}^{n\times n}$.

Lattice and the HNF

Given a matrix $B=\left(b_{ij}\right)\in {\mathbb{R}}^{n\times m}$ with rank n, the lattice $\mathcal{L}\left(B\right)$ spanned by the rows of B is:

$$\mathcal{L}\left(B\right)=\{xB=\sum _{i=1}^n{x}_i{b}_i|x_i\in \mathbb{Z}\},$$

where $b_i$ is the i-th row of B. We call m the dimension of $\mathcal{L}\left(B\right)$ and n its rank. The determinant of $\mathcal{L}\left(B\right)$, say $det\left(\mathcal{L}\right(B\left)\right)$, is defined as $\sqrt{det\left(B^{T}B\right)}$. It is easy to see that when B is full-rank ($n=m$), its determinant becomes $|det(B\left)\right|$.

Two lattices $\mathcal{L}\left(B_1\right)$ and $\mathcal{L}\left(B_2\right)$ are exactly the same when there exists a matrix $U\in G{L}_n\left(\mathbb{Z}\right)$ s.t. $B_1=U{B}_2$. Lattices used in cryptography are usually “integer lattices”, whose basis matrices are over $\mathbb{Z}$ instead of $\mathbb{R}$. Thus, the space of all full-rank integer lattices is actually $(G{L}_n\left(\mathbb{R}\right)\cap {\mathbb{Z}}^{n\times n})/G{L}_n\left(\mathbb{Z}\right)$.

The Hermite Normal Form (HNF) is a useful tool to study integer matrices:

Definition 1.

A square nonsingular integer matrix $H\in {\mathbb{Z}}^{n\times n}$ is called in the HNF if:

• H is upper triangular, i.e., $h_{ij}=0$ for all $i>j$;

• All diagonal elements are positive, i.e., $h_{ii}>0$ for all i;

• All nondiagonal elements are reduced modulo the corresponding diagonal element at the same column, i.e., $0\le h_{ij}<h_{jj}$ for all $i<j$.

There exists a famous result for the HNF [14] (Chapter 2, page 66):

Theorem 1.

For every $A\in G{L}_n\left(\mathbb{R}\right)\cap {\mathbb{Z}}^{n\times n}$, there exists a unique $n\times n$ matrix $B\in S_{n,\mathbb{Z}}$ (HNF) of the form $B=UA$ with $U\in G{L}_n\left(\mathbb{Z}\right)$.

By this theorem, an integer lattice corresponds to its unique HNF, implying that generating an integer lattice is actually equivalent to generating an HNF.

3. Random Integer Lattice

3.1. Definition

In this part, we refer to [13] to recall some results related to the random integer lattice.

First, for $M,N\in {\mathbb{Z}}^{+}$,

$$H_n^{\le }\left(M\right)\triangleq \left\{H\mathrm{is}n-\dim \mathrm{HNF}\right|det\left(H\right)\le M\},$$

$$H_n\left(N\right)\triangleq \left\{H\mathrm{is}n-\dim \mathrm{HNF}\right|det\left(H\right)=N\}.$$

Gruber [15] counted the size of $|H_n\left(N\right)|$:

Theorem 2.

If N has prime decomposition $N=p_1^{r_1}\cdots p_t^{r_t}$, then:

$$|H_n\left(N\right)|=\prod _{i=1}^t\prod _{j=1}^{n-1}\frac{p_i^{r_i+j}-1}{p_i^j-1}.$$

There exists an asymptotic estimation for $|H_n^{\le }\left(M\right)|$ in [13]:

Theorem 3.

For large positive integer M,

$$|H_n^{\le }\left(M\right)|=\frac{{\prod }_{s=2}^n\zeta \left(s\right)}{n}{M}^n+O(M^{n-1}logM).$$

H is called an n-dim random nonsingular HNF if for large integer $M>0$, H is chosen from $H_n^{\le }\left(M\right)$ uniformly, and the lattice $\mathcal{L}\left(H\right)$ generated by such an H is called a random integer lattice.

3.2. Diagonal Distribution

In [13], Hu et al. studied the expectation and variance of every entry and the probability distribution of every diagonal entry:

Theorem 4.

Let $H=\left(h_{ij}\right)$ be an n-dim random nonsingular HNF with the determinant bounded by $M>0$ and t be an integer in $[1,n-1]$, given an increasing subset $\{i_1,\cdots ,i_t\}$ of $\{1,\cdots ,n\}$ and its increasing complementary subset $\{j_1,\cdots ,j_{n-t}\}$, for positive integers $b_1\cdots b_t$; when $M\to +\infty$, we have:

$$P(h_{i_k,i_k}=b_k\mathrm{for}\mathrm{all}k)=\left\{\begin{array}{cc}0\hfill & (i_t=n)\hfill \\ \frac{{\prod }_{k=1}^{n-t-1}\zeta (n+1-j_k)}{{\prod }_{s=2}^n\zeta \left(s\right)}\prod _{l=1}^t{b}_l^{i_l-n-1}\hfill & (i_t<n)\hfill \end{array}\right.$$

(1)

If we take $t=1$, a one-element set $T=\left\{i\right\}(i\in [1,n-1\left]\right)$, and positive integers b, then the increasing complementary subset of T in $\{1,2,\cdots ,n\}$ is $\{1,\cdots ,i-1,i+1,\cdots ,n\}$. We apply the above theorem and obtain the following corollary:

Corollary 1.

Let $H=\left(h_{ij}\right)$ be an n-dim random nonsingular HNF with the determinant bounded by $M>0$, then for $i\in [1,n-1]$ and positive integer b, when $M\to +\infty$, we have:

$$P(h_{ii}=b)=\frac{1}{\zeta (n+1-i)·b^{n+1-i}}(b=1,2,\cdots ).$$

We denote this distribution of $h_{ii}$ by $\mathbb{D}(n,i)$.

Remark 1.

Notice that in Theorem 4, when $i_t<n$ and $M\to \infty$, both cases: $t=1$ and $1<t<n$ are valid conditions, which corresponds to the joint distribution of $h_{i_k,i_k}(k=1,\cdots ,t)$ for $1<t<n$ or a marginal distribution of the single variable $h_{i_1,i_1}$ for $t=1$ as in Corollary 1. Considering Theorem 4 and Corollary 1, it can be deduced that when $M\to \infty$, the first $n-1$ diagonal elements $h_{11},\cdots ,h_{n-1,n-1}$ are independent variables.

4. Generating the Random Integer Lattice via the HNF

In this section, we present our random integer lattice generation algorithm via the HNF. Firstly, we introduce the inverse sampling method in probability theory to generate all the diagonal elements. Then, we generate all the nondiagonal elements accordingly.

4.1. Inverse Sampling Method

Given a distribution $\mathbb{D}$ over some ordered set A, we can use the inverse sampling method to generate a random variable according to the distribution $\mathbb{D}$. We present two versions of the inverse sampling method: continuous-ISM and discrete-ISM.

Theorem 5.  

(Continuous-ISM) For distribution $\mathbb{D}$ over interval $[a,b]$ with cumulative distribution function $F_X\left(x\right)$, choose a random y uniformly from $[0,1]$ and compute z s.t. $F\left(z\right)=y$, then the resulting variable Z has distribution $\mathbb{D}$.

Proof. 

Our goal is to prove Z has $F_X$ as its cumulative distribution function. Namely, for any $x\in [a,b]$, we have to prove $P(Z\le x)=F_X\left(x\right)$. Since F is a monotonically increasing function, we have:

$$P(Z\le x)=P(F_Z\left(z\right)\le F_X\left(x\right))=P(y\le F_X\left(x\right))=F_X\left(x\right)$$

where the second equality comes from $F\left(z\right)=y$ and the last one is a direct result of y’s uniformity in $[0,1]$. Thus, the cumulative distribution function of Z is actually $F_X$, which completes the proof.    □

Theorem 6. 

(Discrete-ISM) For distribution $\mathbb{D}$ over finite-ordered set $A={\left\{a_k\right\}}_{k=1}^n\subseteq \mathbb{Z}$ with corresponding density $f_k=P(X=a_k)$, choose a random number y uniformly from $[0,1]$ and compute the minimum j s.t. ${\sum }_{k=1}^j{f}_k\ge y$; then, we let $Z=a_j$, and Z will have distribution $\mathbb{D}$.

Proof. 

For any $a_j\in A$, we need to prove $P(Z=a_j)=f_j$. Since j is the minimum value s.t. ${\sum }_{k=1}^j{f}_k\ge y$, we know that ${\sum }_{k=1}^{j-1}{f}_k<y$. Then, we have:

$$\begin{array}{cc}\hfill P(Z=a_j)& =P(\sum _{k=1}^j{f}_i\ge y,\sum _{k=1}^{j-1}{f}_i<y)\hfill \\ \hfill & =P(\sum _{k=1}^j{f}_k\ge y)-P(\sum _{k=1}^{j-1}{f}_k\ge y))\hfill \\ \hfill & =\sum _{k=1}^j{f}_k-\sum _{k=1}^{j-1}{f}_k(\mathrm{since}y\mathrm{is}\mathrm{uniform}\mathrm{in}[0,1])\hfill \\ \hfill & =f_j\hfill \end{array}$$

which completes the proof.    □

4.2. Generating the Random Integer Lattice via the HNF

From Section 3.1, we can generate a random integer lattice by equivalently generating a random nonsingular HNF. To begin with, we generate the first $n-1$ diagonal elements $h_{11},h_{22},\cdots ,h_{n-1,n-1}$. Then, we generate the last diagonal element $h_{nn}$. Finally, all the nondiagonal elements are generated, and we output the matrix H as a lattice basis for our random integer lattice.

4.2.1. Generating $h_{11},h_{22},\cdots ,h_{n-1,n-1}$

From Corollary 1, we know that for an n-dim nonsingular HNF, when $i\in [1,n-1]$, the distribution of $h_{ii}$ is:

$$\mathbb{D}(n,i):P(X=x)=\frac{1}{\zeta (n+1-i)}·x^{-(n+1-i)}(x=1,2\cdots ).$$

(2)

Therefore, we generate these diagonal elements $h_{11},h_{22},\cdots ,h_{n-1,n-1}$ according to $\mathbb{D}(n,i)$ by discrete-ISM (Theorem 6).

For $i\in [1,n-1]$, we choose y uniformly randomly from $[0,1]$ and increasingly iterate $j_i$ starting from 1 until it satisfies $\frac{1}{\zeta (n+1-i)}{\sum }_{k=1}^{j_i}{k}^{-(n+1-i)}\ge y$. Then, we set $h_{ii}=j_i$. By Theorem 6, each diagonal $h_{ii}$ has distribution $\mathbb{D}(n,i)$, which is what we need.

4.2.2. Generating $h_{nn}$

After generating the first $n-1$ diagonal elements $h_{ii}$, we set $D_{n-1}\triangleq {\prod }_{i=1}^{n-1}{h}_{ii}$. Since the determinant upper bound is M, the last diagonal element $h_{nn}$ should be in $[1,\lfloor \frac{M}{D_{n-1}}\rfloor ]$. We point out that $D_{n-1}$ is a small number compared to M with high probability. More specifically, the following theorem can be proven.

Theorem 7.

Let $H=\left(h_{ij}\right)$ be an n-dim random nonsingular HNF with the determinant bounded by $M>0$; for $D_{n-1}\triangleq {\prod }_{i=1}^{n-1}{h}_{ii}$, we have:

$$E\left(D_{n-1}\right)=\frac{1}{\zeta \left(n\right)}logM+O\left(1\right).$$

Moreover, by Markov’s inequality, we find that:

$$P(D_{n-1}\ge {(logM)}^2)\le \frac{1}{logM}.$$

To prove Theorem 7, the following lemma from [13] is needed.

Lemma 1.

Given an integer $n\ge 4$ and a large integer $M>0$, for any non-negative increasing sequence ${\left(s_i\right)}_{1\le i\le n}$ s.t. $s_n-s_{n-3}\ge 2,s_n-s_{n-2}\ge 1$ and a respective summation:

$$S(M,s_1\cdots s_n)\triangleq \sum _{a_i\in {\mathbb{Z}}^{+},{\prod }_{i=1}^n{a}_i\le M}{a}_1^{s_1}\cdots a_n^{s_n},$$

we have the following

Table 1. Asymptotic formulas of $S(M,s_1\cdots s_n)$ in different cases.

$\mathit{S}(\mathit{M},{\mathit{s}}_1\cdots {\mathit{s}}_{\mathit{n}})$	If
$\frac{{\prod }_{j=1}^{n-1}\zeta (s_n+1-s_j)}{s_n+1}{M}^{s_n+1}+O(M^{s_n}logM)$	$s_{n-3}\le s_{n-2}<s_{n-1}<s_n$
$\frac{{\prod }_{j=1}^{n-1}\zeta (s_n+1-s_j)}{s_n+1}{M}^{s_n+1}+O\left(M^{s_n}{(logM)}^2\right)$	$s_{n-3}<s_{n-2}=s_{n-1}<s_n$
$\frac{{\prod }_{j=1}^{n-2}\zeta (s_n+1-s_j)}{s_n+1}{M}^{s_n+1}logM+O\left(M^{s_n+1}\right)$	$s_{n-3}\le s_{n-2}<s_{n-1}=s_n$

on asymptotic formulas for $S(M,s_1\cdots s_n)$.

where $\zeta \left(s\right)={\sum }_{i=1}^{\infty }{i}^{-s}$ is the well-known Riemann zeta function and the constant in the O notation is only relevant to n.

Now, we start to prove Theorem 7.

Proof. 

For the expectation of $D_{n-1}={\prod }_{i=1}^{n-1}{h}_{ii}$, we find that:

$$\begin{array}{cc}\hfill E\left(D_{n-1}\right)& =\sum _{k\le M}k·P(D_{n-1}=k)\hfill \\ \hfill & =\frac{{\displaystyle \sum _{k\le M}}k·\left|H_{n-1}\left(k\right)\right|·{\displaystyle \sum _{a_n\le M/k}}{a}_n^{n-1}}{|H_n^{\le }\left(M\right)|}\hfill \\ \hfill & =\frac{{\displaystyle \sum _{k\le M}}{\prod }_{j=1}^{n-1}{a}_j{\displaystyle \sum _{{\prod }_{j=1}^{n-1}{a}_j=k}}{\prod }_{j=1}^{n-1}{a}_j^{j-1}{\displaystyle \sum _{a_n\le M/k}}{a}_n^{n-1}}{|H_n^{\le }\left(M\right)|}\hfill \\ \hfill & =\frac{{\displaystyle \sum _{k\le M}}{\displaystyle \sum _{{\prod }_{j=1}^{n-1}{a}_j=k}}{\prod }_{j=1}^{n-1}{a}_j^j{\displaystyle \sum _{a_n\le M/k}}{a}_n^{n-1}}{|H_n^{\le }\left(M\right)|}\hfill \\ \hfill & =\frac{{\displaystyle \sum _{{\prod }_{j=1}^n{a}_j\le M}}{\prod }_{j=1}^{n-1}{a}_j^j·a_n^{n-1}}{{\displaystyle \sum _{{\prod }_{j=1}^n{a}_j\le M}}{\prod }_{j=1}^n{a}_j^{j-1}}\hfill \\ \hfill & =\frac{S(M,1,2,\cdots ,n-2,n-1,n-1)}{S(M,0,1,\cdots ,n-2,n-1)}\left(\mathrm{as}\mathrm{in}\mathrm{Lemma}1\right)\hfill \\ \hfill & =\frac{\frac{{\prod }_{s=2}^{n-1}\zeta \left(s\right)}{n}·M^{n}logM+O\left(M^n\right)}{\frac{{\prod }_{s=2}^{n-1}\zeta \left(s\right)}{n}{M}^n+O(M^{n-1}logM)}\left(\mathrm{by}\mathrm{Lemma}1\right)\hfill \\ \hfill & =\frac{\frac{{\prod }_{s=2}^{n-1}\zeta \left(s\right)}{n}·logM+O\left(1\right)}{\frac{{\prod }_{s=2}^{n-1}\zeta \left(s\right)}{n}+O(logM/M)}\hfill \\ \hfill & =\frac{1}{\zeta \left(n\right)}logM+O\left(1\right),\hfill \end{array}$$

which completes the first part of Theorem 7.

For the second part, recall that for any non-negative random variable X, Markov’s inequality tells us that:

$$P(X\ge a)\le E\left(X\right)/a.$$

Since $D_{n-1}$ is non-negative, we apply Markov’s inequality to it by setting $a={(logM)}^2$ and obtain:

$$P(D_{n-1}\ge {(logM)}^2)\le (\frac{1}{\zeta \left(n\right)}logM+O\left(1\right))/{(logM)}^2\le \frac{1}{logM}$$

which completes the second part of the proof.    □

From Theorem 7, we know that $D_{n-1}$ is small compared to M with high probability; thus, $\lfloor \frac{M}{D_{n-1}}\rfloor$ is still large enough for us to obtain a similar result for $h_{nn}$. We think this is a relatively reasonable way to describe the distribution of $h_{nn}$. Thus, for the random nonsingular HNF with the determinant bounded by M, on the condition that ${\prod }_{i=1}^{n-1}{h}_{ii}=D_{n-1}$, the distribution of $h_{nn}$ is the following:

$$\begin{array}{cc}\hfill \tilde{\mathbb{D}}(n,M,D_{n-1}):& P(X=x)\hfill \\ \hfill & =\frac{1}{{\sum }_{k=1}^{\lfloor M/D_{n-1}\rfloor }{k}^{n-1}}·x^{n-1}\hfill \\ \hfill & =\frac{1}{\frac{1}{n}{\lfloor \frac{M}{D_{n-1}}\rfloor }^n+O({\lfloor \frac{M}{D_{n-1}}\rfloor }^{n-1})}·x^{n-1}(x=1,2\cdots ,\lfloor \frac{M}{D_{n-1}}\rfloor ).\hfill \end{array}$$

(3)

Moreover, the corresponding cumulative distribution function is:

$$\begin{array}{cc}\hfill F_X\left(x\right)& =P(X\le x)\hfill \\ \hfill & =\frac{1}{\frac{1}{n}{\lfloor \frac{M}{D_{n-1}}\rfloor }^n+O({\lfloor \frac{M}{D_{n-1}}\rfloor }^{n-1})}·\sum _{k=1}^x{k}^{n-1}\hfill \\ \hfill & =\frac{\frac{1}{n}{x}^n+O(x^{n-1})}{\frac{1}{n}{\lfloor \frac{M}{D_{n-1}}\rfloor }^n+O({\lfloor \frac{M}{D_{n-1}}\rfloor }^{n-1})}(x=1,2\cdots ,\lfloor \frac{M}{D_{n-1}}\rfloor ).\hfill \end{array}$$

(4)

Since $\lfloor \frac{M}{D_{n-1}}\rfloor$ is still super large, we know that:

$$F_X\left(x\right)\approx \frac{x^n/n}{{\lfloor M/D_{n-1}\rfloor }^n/n}={(\frac{x}{\lfloor M/D_{n-1}\rfloor })}^n\triangleq G_X\left(x\right).$$

As a result, $G_X\left(x\right)$ is a rather good estimation for $F_X\left(x\right)$. In fact, if we define the distribution ${\tilde{\mathbb{D}}}_0(n,M,D_{n-1})$ by the cumulative distribution function $G_X\left(x\right)$ as follows:

$$\begin{array}{cc}\hfill \widetilde{{\mathbb{D}}_0}(n,M,D_{n-1}):& P(X\le x)\hfill \\ \hfill & ={(\frac{x}{\lfloor M/D_{n-1}\rfloor })}^n(x=1,2\cdots ,\lfloor \frac{M}{D_{n-1}}\rfloor ),\hfill \end{array}$$

(5)

then we have the following theorem.

Theorem 8.

For large enough $M\in {\mathbb{Z}}^{+}$ and positive integer $D_{n-1}=o\left(M\right)$, the statistical distance between $\tilde{\mathbb{D}}(n,M,D_{n-1})$ and ${\tilde{\mathbb{D}}}_0(n,M,D_{n-1})$ is at most $n·O(\frac{D_{n-1}}{M})$.

Proof. 

According to (4), the cumulative distribution function of $\tilde{\mathbb{D}}(n,M,D_{n-1})$ is $F_X\left(x\right)=\frac{\frac{1}{n}{x}^n+O\left(x^{n-1}\right)}{\frac{1}{n}{\lfloor \frac{M}{D_{n-1}}\rfloor }^n+O({\lfloor \frac{M}{D_{n-1}}\rfloor }^{n-1})}$, since the cumulative distribution function of ${\tilde{\mathbb{D}}}_0(n,M,D_{n-1})$ is $G_X\left(x\right)={(\frac{x}{\lfloor M/D_{n-1}\rfloor })}^n$; denote $\lfloor \frac{M}{D_{n-1}}\rfloor$ by $\tilde{M}$, then $x\le \tilde{M}$, and for every $x\in [1,\tilde{M}]$, we have:

$$\begin{array}{cc}\hfill & |F_X(x)-G_X(x)|\hfill \\ \hfill =& |\frac{\frac{1}{n}{x}^n+O(x^{n-1})}{\frac{1}{n}{\tilde{M}}^n+O({\tilde{M}}^{n-1})}-{(\frac{x}{\tilde{M}})}^n|\hfill \\ \hfill =& |\frac{x^n+n·O(x^{n-1})}{{\tilde{M}}^n+n·O({\tilde{M}}^{n-1})}-{(\frac{x}{\tilde{M}})}^n|\hfill \\ \hfill =& |\frac{(x^n+n·O(x^{n-1})){\tilde{M}}^n-({\tilde{M}}^n+n·O({\tilde{M}}^{n-1}))x^n}{{\tilde{M}}^{2n}+n·O({\tilde{M}}^{2n-1})}|\hfill \\ \hfill =& |\frac{n·O(x^{n-1}){\tilde{M}}^n-n·O({\tilde{M}}^{n-1})x^n}{{\tilde{M}}^{2n}+n·O({\tilde{M}}^{2n-1})}|\hfill \\ \hfill =& |\frac{n·O({\tilde{M}}^{n-1}){\tilde{M}}^n-n·O({\tilde{M}}^{n-1}){\tilde{M}}^n}{{\tilde{M}}^{2n}+n·O({\tilde{M}}^{2n-1})}|(\sin \mathrm{ce}x\le \tilde{M})\hfill \\ \hfill =& |\frac{n·O({\tilde{M}}^{2n-1})}{{\tilde{M}}^{2n}+n·O({\tilde{M}}^{2n-1})}|\hfill \\ \hfill =& |\frac{n·O(\frac{1}{\tilde{M}})}{1+n·O(\frac{1}{\tilde{M}})}|=n·O(\frac{1}{\tilde{M}})=n·O(\frac{D_{n-1}}{M})\hfill \end{array}$$

which implies that the statistical distances $\tilde{\mathbb{D}}(n,M,D_{n-1})$ and ${\tilde{\mathbb{D}}}_0(n,M,D_{n-1})$ are bounded by $n·O\left(\frac{D_{n-1}}{M}\right)$.    □

Since $\lfloor M/D_{n-1}\rfloor$ is still super large, we can generate $h_{nn}$ according to ${\tilde{\mathbb{D}}}_0(n,M,D_{n-1})$ (close enough to $\tilde{\mathbb{D}}(n,M,D_{n-1})$) by continuous-ISM (Theorem 5).

We choose y uniformly randomly from $[0,1]$ and compute $z\in {\mathbb{R}}^{+}$ s.t.:

$${\left(\frac{z}{\lfloor M/D_{n-1}\rfloor }\right)}^n=y.$$

Then, we set $h_{nn}=\lfloor z\rceil$. By Theorems 6 and 8, the diagonal $h_{nn}$ has distribution ${\tilde{\mathbb{D}}}_0(n,M,D_{n-1})$, which is close enough to $\tilde{\mathbb{D}}(n,M,D_{n-1})$.

4.2.3. Generating $h_{ij}(i\ne j)$

This part is relatively easier. For $i,j=1,\cdots ,n$, let $h_{ij}$ be chosen from $[0,h_{jj})$ uniformly randomly if $i<j$ and let $h_{ij}=0$ if $i>j$.

4.2.4. Correctness

By the discussion above, for large enough $M>0$, the distribution of the diagonal $h_{11},\cdots ,h_{nn}$ generated by this algorithm is close enough to its distribution as a random nonsingular HNF. For $i<j\in [1,n]$, since a random nonsingular HNF’s $h_{ij}$ is uniform in $[0,h_{jj})$ and $h_{ij}$ is generated in the same way, we know that the output of this algorithm is also close enough to a real random nonsingular HNF, which implies the correctness of this algorithm.

4.3. Algorithm 1: Generate Random Integer Lattice

Now we present the Algorithm 1 to generate a random integer lattice.

Algorithm 1: Random Integer Lattice Generation

Require: Dimension n, large integer M

Ensure: n-dim random integer lattice $\mathcal{L}$ with $det\left(\mathcal{L}\right)\le M$

Step 1: Generate $h_{11},\cdots ,h_{n-1,n-1}$

$D_0=1$

for $i=1$ to $n-1$ do

$j_i=1$, $s_i=1$

choose $y_i\in [0,1]$ uniformly

while $s_i<\zeta (n+1-i)·y_i$ do

$j_i=j_i+1$

$s_i=s_i+j_i^{-(n+1-i)}$

end while

$D_i=D_{i-1}·j_i$

set $h_{ii}=j_i$

end for

Step 2: Generate $h_{nn}$

choose $y\in [0,1]$ uniformly

$z=y^{1/n}$

$z=z·\lfloor \frac{M}{D_{n-1}}\rfloor$

set $h_{nn}=\lfloor z\rceil$

Step 3: Generate $h_{ij}(i\ne j)$

for $j=1$ to n do

for $i=1$ to $j-1$ do

choose $h_{ij}\in [0,h_{jj})$ uniformly

end for

for $i=j+1$ to n do

set $h_{ij}=0$

end for

end for

Step 4: Set $H=\left(h_{ij}\right)$, and output $\mathcal{L}\left(H\right)$

4.4. Time Complexity of Algorithm 1

Now, we analyze the time complexity of Algorithm 1. Obviously, the most time-consuming part of Algorithm 1 is the floating-point operations $s_i=s_i+j_i^{-(n+1-i)}$ inside the while iteration for each i in Step 1. Denote the number of computing $s_i=s_i+j_i^{-(n+1-i)}$ in the i-th while iteration by $T\left(i\right)$. Notice that:

$$P(h_{ii}=1)=\frac{1}{\zeta (n+1-i)};$$

since $\zeta \left(s\right)$ converges to one quite fast as s grows, the majority of $h_{ii}$ will be set to one. In fact, by the numerical results, we have following result:

Fact 1: For any integer $n\ge 10$,

$$\frac{1}{{\prod }_{s=10}^n\zeta \left(s\right)}\ge 0.999.$$

By this fact, for $i\le n-10$, all the $h_{ii}$ are very likely to be set to one, implying that $T\left(1\right),T\left(2\right),\cdots ,$$T(n-10)=0$ with probability $\ge 0.999$. Then, we consider $T(n-9),T(n-8),\cdots ,T(n-1)$. If we set the probability bound for each $T\left(i\right)$ to be $0.999$, then by accurate numerical results, we have the following

Table 2. Upper bound for $T\left(i\right)$ with probability$\ge 0.999$.

T(i)	Upper Bound
$T(n-9)$	0
$T(n-8)$	1
$T(n-7)$	1
$T(n-6)$	1
$T(n-5)$	2
$T(n-4)$	3
$T(n-3)$	6
$T(n-2)$	19
$T(n-1)$	607

:

Thus, we have the following theorem:

Theorem 9.

The number of floating-point operations performed in Algorithm 1 is bounded by 1300 with probability $\ge 0.99$.

Proof. 

By the above table, ${\sum }_{i=n-9}^{n-1}T\left(i\right)$ is bounded by 640 with probability $\ge 0.{999}^9$. Since $T\left(1\right),T\left(2\right),\cdots ,T(n-10)=0$ with probability $\ge 0.999$, we know that ${\sum }_{i=1}^{n-1}T\left(i\right)$ is bounded by 640 with probability $\ge 0.{999}^{10}\ge 0.99$. Notice that each $s_i=s_i+j_i^{-(n+1-i)}$ needs two floating-point operations, and it also needs another four floating-point operations to generate $h_{nn}$ in Step 2; thus, with probability $\ge 0.99$, the total number of floating-point operations performed in Algorithm 1 is bounded by $640\times 2+4=1284<1300$, which completes the proof. □

Remark 2.

We point out that the accuracy of the floating-point affects the actual running time of Algorithm 1. By experiments, 150 bit are a suitable option.

It is not hard to see that in Algorithm 1, besides the floating-point operations, the remaining parts of Step 1, Step 2, and Step 3 take $O\left(n^2\right),O\left(1\right)$, and $O\left(n^2\right)$ operations, respectively. Combining this with Theorem 9, we have the following result:

Theorem 10.

Algorithm 1 outputs a random integer lattice within $O\left(n^2\right)$ operations with probability $\ge 0.99$.

5. Conclusions

In this paper, we presented an improved algorithm for generating random integer lattices and discussed its time complexity. We proved that with probability $\ge 0.99$, this algorithm outputs an n-dim random integer lattice within $O\left(n^2\right)$ operations. We pointed out that there is still space for improvement of our algorithm, and we leave this as an open problem.