Note that the below material is well-known among experts.

Let be any prime not dividing . Then modulo is invertible, and modulo , the system has a unique solution. Moreover, for any integer , the system has a unique solution modulo : this is true since is also invertible modulo – for that, it suffices to check that the determinant of is a unit, which it is since it is coprime to . Moreover, if is a solution to over the integers, then modulo is the unique solution of modulo . Hence, if we choose such that bounds all coefficients of the solution , we can recover a solution to over the integers from a solution to modulo , by chosing the unique preimages in .

This opens the question on how to solve modulo . For that, a Hensel-like lifting technique can be used. (In fact, this follows from Bourbaki’s generalization since the Jacobian of the map , equals .) Assume that we have an which satisfies . We want to find with . Write with . As , and as is divisible by , we obtain the linear system . Hence, it suffices to solve linear systems over the prime field to solve over .

This yields the following algorithm:

1. Choose p := 2.
2. Solve A x = b modulo p.
3. If a unique solution exists:
   1. Set e = 0 and lift x to the integers with coordinates in .
   2. Compute c := A*x - b.
   3. If c = 0, return x.
   4. Solve A y = c/p^e modulo p.
   5. Set x := x + y*p^e and e := e + 1.
   6. Adjust x modulo such that all coefficients are in .
   7. Go back to Step 3.2.

   Else:

   1. Choose the next prime p and go back to Step 2.

The only subprogram we need is a linear systems solver for with square over a finite field, which returns information on the number of solutions. (Note that is not divisible by if and only if there is a unique solution.) If more information is known on the matrix , for example its determinant has been already computed, this information can be used as well.

Let us analyze the running time of this algorithm. Denote by the smallest prime not dividing , and by the time the linear system solver over needs to solve a system of size . Let (resp. resp. ) denote the largest absolute value of an coefficient of (resp. resp. ).

Clearly, the number of iterations is in . In each iteration, one linear system over of size has to be solved, and has to be evaluated. The former takes operations, and the latter involves multiplications and additions of integers of size and , and substractions of integers of size and . For simplicity, assume that . Finally, to compute , we need multipliations of integers of size and , and additions which can be neglected. Clearly, the multiplications can also be neglected, since the evaluation of already is slower.

Let denote the time a multiplication of two numbers of size needs. Then inside the main loop, we need time units, and the main loop alltogether needs time units. Finding needs time units (using the Prime Number Theorem).

Assuming that we use a naive Gaussian algorithm as well as naive multiplication, i.e. and , we obtain a total running time of Using fast multiplication, i.e. (using FFT methods), and fast linear system solving, i.e. , where , we obtain a total running time of

Now let us try to eliminate from this expression. Clearly, the the second part, we can use that . To eliminate from the first part, we need to find an upper bound. For that, let us first stick to , the smallest prime not dividing the integer . (Letting be a -matrix yields ; in general, using this notation.) Now is divisible by , whence for we have . Note that for integral , , where denotes the Chebyshev function. Using known bounds on , we get Therefore, becomes true for for every . This shows that eventually holds for , yielding and, thus, . Using the Leibniz formula, .

Finally, we can use some linear algebra to bound in terms of and . First note that , where denotes the identity matrix and denotes the adjungate matrix of . As , we see that it suffices to bound . Now the coefficients of are determinants of matrices with coefficients coming from , whence . Therefore, when assuming that .

This can be combined into the following theorem:

Theorem.

Assuming that and , the above algorithm needs time units to compute the unique solution of using naive arithmetic in , , and naive Gaussian elimination to solve linear systems over . Using fast linear algebra and fast multiplication, we only need time units for any .

□

“Given a lattice . How do I find a basis of this lattice?”

(Note that this question is far from being well-posed.) The second question is,

“If is a finite abelian group and , how do I compute the structure of , the subgroup generated by these elements?”

The third question comes up in the description of algorithms, for example of the baby-step giant-step algorithm by D. Shanks, an optimization by D. Terr, and more general algorithms, like the Buchmann-Schmidt algorithm. These algorithms can be described in terms of the first question, making them easier to understand.

We begin with sketching the relation between lattices and finite abelian groups. If is a finite abelian group, and some elements, for example, a set of generators, consider the map This turns out to be a group homomorphism onto . The kernel of , which we will denote by , is called the relation lattice. This is in fact a lattice in of volume note that by the Homomorphism Theorem, . On the other hand, if is a lattice, then is a finite abelian group of elements. Moreover, if the residue class of , the vector consisting of zeroes except a one at the -th position, in is denoted by , then . Therefore, lattices in and finite abelian groups with generators are essentially the same thing.

How is this related to group structure computations? Recall the Smith normal form; this allows to convert a basis of a lattice into another basis, such that if one applies an invertible linear transformation to , this basis is sent to with such that divides , ; then, . Hence, computing the structure of a finite abelian group generated by can be split up in the two parts, (a) computation of a basis of the relation lattice and (b) computation of a Smith normal form of this basis. There exist a lot of algorithms for computation of Smith normal forms; usually, the bottleneck is finding a basis of .

Often, the process of finding a lattice equals determining the relation lattice of a finite abelian group, or something similar. One often has a way to test whether , by computing a unique representation of the residue class ; then, one tries to find two ways of writing the same residue class, but with : then is a non-trivial element of . If one sets , then this means that one seeks for pairs , , where and , such that and .

More generally, assume that is a finite set and is a map such that for all . Our above example, and satisfies this. Moreover, assume that is “mostly injective”, i.e. that implies that one can find such that , , with very little effort. Then one can work with elements with , and try to find two such pairs , with ; then this gives rise to an element of near to .

Which brings us to the subject of explaining algorithms. Consider, for example, Shanks’ baby-step giant-step algorithm. You are given a group element of finite order together with a bound . Then, for the algorithm, one computes , as well as , and compares this elements with the first elements. Any match will result in a multiple of the order of . But why is this the case? One can of course try to prove this; it is actually not very hard, in fact one just needs Fermat’s Little Theorem as well as long division. But one can do better, by visualizing the algorithm in a way which makes the solution looking obvious, and which allows even people who have no understanding of formal mathematics or computer science to immediately realize that the algorithm produces the correct result.

Namely, you might have guessed it, the order of generates the relation lattice . Hence finding the order is equivalent to finding a the smallest positive element in . For this correspondence, we use the pairs with as above. Two pairs with gives a multiple of the order of . Now, the algorithm can be interpreted as translating the set of elements by , , , and checking if a lattice element is contained in any of these translates. If one visualizes this, one immediately sees that this method will eventually find the smallest non-zero element of the lattice. First, this depicts the lattice (gray dots) with its sublattice (black dots), with the set drawn in for :

The next figure depicts the translates of by :

One directly sees that the translates , cover all positive integers, and that every positive integer is contained in exactly one translate. Moreover, one sees that if the first translate contains at most one lattice element, the first translate which contains a lattice element uniquely determines the smallest positive integer. Note that in case is the order of , then one can minimize the number of operations by chosing .

Now let us consider Terr’s modification of the baby-step giant-step algorithm; there, the situation is a bit more complicated. In Terr’s algorithm, the bound from above constantly changes, starting with . Written as pseudo-code, the algorithm looks like this:

1. Let and , and let and .
2. If for some , return .
3. Set , and set .
4. Compute and .
5. Go back to Step 2.

There is no obvious reason why this should work. Note that the test whether means that one translates by the exponent of , which turns out to be . One immediately gets the idea if one draws the first few translates:

This is another tiling of , where every positive integer is contained in exactly one translate. This tiling has the property that the first time occurs for some is when the order of is found, and one no longer has to fix a bound before. The asymptotic complexity of this method is the same as the previous method in case , but in case is chosen the wrong way, the first algorithm will perform worse than the second. Another way to visualize the second agorithm is to depict the set together with , where and , for :

Let be a global field, i.e. an algebraic number field or an algebraic function field with a finite constant field. In the first case, let be the roots of unity and . In the latter case, let be the exact field of constants.

Let be the set of infinite places of . If is a number field, the elements of correspond to embeddings of into up to complex conjugation. Define , and for let be a corresponding embedding. Then define for and if , or otherwise, and define . If is a function field, let , i.e. ; in this case, there exists an element whose poles are exactly the elements of , i.e. are the places of lying above the infinite place of . In all cases, is finite and non-empty.

For a non-archimedean place of , let be the valuation ring and its maximal idea, and denote the discrete valuation by . Then set and , . Define . In the number field case, let , and otherwise .

Denote the set of places of by . The divisor group of is , and for define . This is a homomorphism ; denote its kernel by . For , is a principal divisor; let the group of all these be denoted by . Then is the divisor class group of and its degree zero part.

The support of a divisor is the set . Consider the subgroups then . Moreover, let . The set is a Dedekind domain, whose maixmal ideals correspond to the places in . Moreover, the fractional ideal group is isomorphic to by , in case ; the inverse is given by the restriction of , to . The group of fractional principal ideals equals . The quotient is the ideal class group of . Putting all these things together, we get the following diagram with exact rows and columns: Here, and are essentially defined by the diagram, i.e. are the kernels and cokernels of the respective maps. In the number field case, , and in the function field case, .

A Geometry of Numbers in Global Fields.

Let and . Define If and is the Riemann-Roch space of , then . In particular, the set is finite and invariant under multiplication by elements of ; in case is a function field, is a finite-dimensional -vector space, whose dimension is described by the Riemann-Roch theorem. In the number field case, we can make statements on with Minkowski’s Lattice Point Theorem.

Consider the map Then is a lattice by Dirichlet’s Unit Theorem, and . We get , and is called the unit rank of . This will be the lattice for our -dimensional infrastructure.

Reduced Ideals.

The elements of will be principal reduced fractional ideals, modulo an equivalence relation. We begin by defining minima, which are similar to the ones introduced in the previous post for lattices.

Definition.

Let and . We say that is a minimum of if every with for all satisfies for all . Denote the set of all minima of by .

Using them, we can define reduced ideals:

Definition.

An ideal is said to be reduced if is a minimum. Write for the set of all reduced ideals of . For let .

The equivalence relation we need is defined by for . We then get the following results:

Theorem.

1. We have that is a finite set.
2. In case for some , we get for if, and only if, .
3. We have that acts on by multiplication.
4. The map is a bijection.
5. If and satisfies , then .

□

The proofs of these and the following results or hints to the proofs can be found here. We next construct the map :

Theorem (Infrastructure, Part I).

Fix an ideal . Define and define Then is well-defined and injective.

□

For , write Define and Then is the unrolled version of : if , is the projection, and , , then the following diagram commutes: In particular, is the set from the previous post.

The Reduction Map, -Representations, and the Infrastructure.

We proceed by defining -representations, as giving these is equivalent to give a reduction map. Fix an ideal .

First, define for where is the lexicographic order on .

Definition.

A tuple is said to be an -representation if is a smallest element of with respect to . Denote the set of all -representations by .

One quickly sees that this is well-defined. We have two auxilliary results:

Lemma (Uniqueness).

Let and such that Then for all , i.e. .

□

Lemma (Reduction).

Let . Then there exists a smallest such that . If is minimal with respect to in that , then and .

□

From that, we get the following result:

Theorem (Infrastructure, Part II).

Let . Then the map is a bijection.

□

This allows to equip with a group operation. We will see that the group operation of can be described in a very explicit form. This extends to a broader interpretation of the infrastructure, whence we will do this in the next section.

Before ending this section, we want to state a result which shows that -representations are small.

Theorem.

Let , then , for all and where here, is the genus of in case is a function field, and in case is a number field, denotes the number of places of degree two and is the discriminant of .

□

Therefore, -representations are small.

The Infrastructure and the Divisor Class Group.

Assume for a moment that , or that is a number field. Then we have a short exact sequence and . This means that the divisor class group is covered by copies of , where the copies are indexed by the elements of the divisor class group. If and are in the same ideal class, and differ by a translation, i.e. they give essentially the same infrastructure; in fact, . Hence, one could get the idea to cover by , where ranges over the distinct ideal classes, i.e. by . It turns out that this is indeed the case, and the arithmetic on and turn out to be the same under the bijection we get.

In case is a function field and , we have in general (this is the case if, and only if, ), and does not needs to be surjective. It would be nice to change the above sequence to in any case, but this is not possible with as it is; we have to replace it by something bigger. It turns out that the right replacement is , which is canonically isomorphic to in case . We then get the diagram with exact rows.

The complete result is stated in the following theorem:

Theorem (Infrastructure, Part III).

1. Let be a number field. Then the map where equals , is a bijection.
2. Let be a function field. Then the map is a bijection.

Moreover, is a group homomorphism, where the group structure on is the one induced by the bijection .

□

Finally, we explicitly describe the group operation induced by this bijection on without using the bijection itself.

Theorem.

Let be the bijection from the previous theorem, and let .

1. Set for . There exists a minimal with , and if is a smallest element of with respect to , we get with .
2. Set for . There exists a minimal with , and if is a smallest element of with respect to , we get with .

This shows that the -dimensional infrastructure we defined has a very close connection to the arithmetic of the divisor class group. This connection was first shown for real hyperelliptic curves by H.-G. Rück and S. Paulus, “Real and Imaginary Quadratic Representations of Hyperelliptic Function Fields”. The first relation between the infrastructure of number fields and the Arakelov divisor class group was described by R. Schoof in his paper Computing Arakelov class groups.

What about… Baby Steps?

As I mentioned, there is no known construction for baby steps in general -dimensional infrastructures, but there exists a construction for infrastructures obtained from global fields. I want to describe this construction here.

For and , consider for . There exists a minimal such that . In case , contains exactly one -orbit, which gives a unique element . Otherwise, one has to add an order (lexicographic order as above) to chose an element. In any case, define ; then this gives a function resp. for any . Opposed to the one-dimensional case, this function neither has to be injective nor surjective, as examples below will show.

We begin with a “small” example: the infrastructure of the function field defined by over . The red arrows show , the blue arrows and the green arrows . The small black circles denote usual minima, the larger black circles denote elements of , and the shaded areas denote translates of an fundamental parallelepiped of :

Unfortunately, the second example is too large for WordPress.