HAL Id: hal-01184797
https://hal.inria.fr/hal-01184797
Submitted on 17 Aug 2015
HAL is a multi-disciplinary open access archive for the deposit and dissemination of sci- entific research documents, whether they are pub- lished or not. The documents may come from teaching and research institutions in France or abroad, or from public or private research centers.
L’archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d’enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.
realistic probabilistic models
Brigitte Vallée, Antonio Vera
To cite this version:
Brigitte Vallée, Antonio Vera. Lattice reduction in two dimensions: analyses under realistic proba- bilistic models. 2007 Conference on Analysis of Algorithms, AofA 07, 2007, Juan les Pins, France.
pp.197-234. �hal-01184797�
Hamming distance from irreducible polynomials overF2
Lattice reduction in two dimensions:
analyses under realistic probabilistic models
Brigitte Vall´ee and Antonio Vera
CNRS UMR 6072, GREYC, Universit´e de Caen, F-14032 Caen, France
The Gaussian algorithm for lattice reduction in dimension 2 is precisely analysed under a class of realistic probabilistic models, which are of interest when applying the Gauss algorithm “inside” the LLL algorithm. The proofs deal with the underlying dynamical systems and transfer operators. All the main parameters are studied: execution parameters which describe the behaviour of the algorithm itself as well as output parameters, which describe the geometry of reduced bases.
Keywords:Lattice Reduction, Gauss’ algorithm, LLL algorithm, Euclid’s algorithm, probabilistic analysis of algo- rithms, Dynamical Systems, Dynamical analysis of Algorithms.
1 Introduction
The lattice reduction problem consists in finding a short basis of a lattice of Euclidean space given an initially skew basis. This reduction problem plays a primary rˆole in many areas of computer science and computational mathematics: for instance, modern cryptanalysis [18], computer algebra [24], integer linear programming [14], and number theory [7].
In the two-dimensional case, there exists an algorithm due to Lagrange and Gauss which computes in linear time a minimal basis of a lattice. This algorithm is in a sense optimal, from both points of view of the time-complexity and the quality of the output. It can be viewed as a generalization of the Euclidean Algorithm to the two dimensional-case. Forn≥3, the LLL algorithm [13] due to Lenstra, Lenstra and Lov´asz, computes a reduced basis of ann-dimensional lattice in polynomial time. However, the notion of reduction is weaker than in the casen= 2, and the exact complexity of the algorithm (even in the worst- case, and for small dimensions) is not precisely known. The LLL algorithm uses as a main procedure the Gauss Algorithm.
This is why it is so important to have a precise understanding of the Gauss Algorithm. First, because this is a central algorithm, but also because it plays a primary rˆole inside the LLL algorithm. The geometry of then-dimensional case is involved, and it is easier to well understand the (hyperbolic) geometry of the complex plane which appears in a natural way when studying the Gauss Algorithm.
1365–8050 c2007 Discrete Mathematics and Theoretical Computer Science (DMTCS), Nancy, France
The previous results. Gauss’ algorithm has been analyzed in the worst case by Lagarias, [11], then Vall´ee [20], who also describes the worst-case input. Then, Daud´e, Flajolet and Vall´ee [8] completed the first work [9] and provided a detailed average-case analysis of the algorithm, in a natural probabilistic model which can be called a uniform model. They study the mean number of iterations, and prove that it is asymptotic to a constant, and thus essentially independent of the length of the input. Moreover, they show that the number of iterations follows an asymptotic geometric law, and determine the ratio of this law. On the other side, Laville and Vall´ee [12] study the geometry of the outputs, and describe the law of some output parameters, when the input model is the previous uniform model.
The previous analyses only deal with uniform-distributed inputs and it is not possible to apply these results
“inside” the LLL algorithm, because the distribution of “local bases” which occur along the execution of the LLL algorithm is far from uniform. Akhavi, Marckert and Rouault [2] showed that, even in the uniform model where all the vectors of the input bases are independently and uniformly drawn in the unit ball, the skewness of “local bases” may vary a lot. It is then important to analyse the Gauss algorithm in a model where the skewness of the input bases may vary. Furthermore, it is natural from the works of Akhavi [1] to deal with a probabilistic model where, with a high probability, the modulus of the determinantdet(u, v) of a basis(u, v)is much smaller than the product of the lengths|u| · |v|. More precisely, a natural model is the so–called model of valuationr, where
P
(u, v); |det(u, v)|
max(|u|,|v|)2 ≤y
= Θ(yr+1), with (r >−1).
Remark that, whenrtends to -1, this model tends to the “one dimensional model”, whereuandvare colinear. In this case, the Gauss Algorithm “tends” to the Euclidean Algorithm, and it is important to precisely describe this transition. This model “with valuation” was already presented in [21, 22] in a slightly different context, but not deeply studied.
Our results. In this paper, we perform an exhaustive study of the main parameters of Gauss algorithm, in this scale of distributions, and obtain the following results:
(i)We first relate the output density of the algorithm to a classical object of the theory of modular forms, namely the Eisenstein series, which are eigenfunctions of the hyperbolic Laplacian [Theorem 2].
(ii)We also focus on the properties of the output basis, and we study three main parameters: the first minimum, the Hermite constant, and the orthogonal projection of a second minimum onto the orthogonal of the first one. They all play a fundamental rˆole in a detailed analysis of the LLL algorithm. We relate their “contour lines” with classical curves of the hyperbolic complex plane [Theorem 3] and provide sharp estimates for the distribution of these output parameters [Theorem 4].
(iii)We finally consider various parameters which describe the execution of the algorithm (in a more precise way than the number of iterations), namely the so–called additive costs, the bit-complexity, the length decreases, and we analyze their probabilistic behaviour [Theorems 5 and 6].
Along the paper, we explain the rˆole of the valuationr, and the transition phenomena between the Gauss Algorithm and the Euclidean algorithms which occur whenr→ −1.
Towards an analysis of the LLL algorithm. The present work thus fits as a component of a more global enterprise whose aim is to understand theoretically how the LLL algorithm performs in practice, and to quantify precisely the probabilistic behaviour of lattice reduction in higher dimensions.
Figure 1:On the left: experimental results for the ratio(1/n) log |b1|
(detL)1/n [here,nis the dimension,b1is the first vector of the LLL reduced basis anddetLis the determinant of the latticeL]. On the right, the output distribution of
“local bases” for the LLL algorithm (see Sections 3.8 and 4.7).
We are particularly interested in understanding the results of experiments conducted by Stehl´e [19] which are summarized in Figure 1. We return to these experiments and their meanings in Section 3.8. We explain in Section 4.7 how our present results may explain such phenomena and constitute a first (important) step in the probabilistic analysis of the LLL algorithm.
Plan of the paper.We first present in Section 2 the algorithms to be analyzed and their main parameters.
Then, we present a complex version of these algorithms, which leads to view each algorithm as a dynami- cal system. Finally, we perform a probabilistic analysis of such parameters: Section 4 is devoted to output parameters, whereas Section 5 focuses on execution parameters.
2 The lattice reduction algorithm in the two dimensional-case.
A latticeL ⊂ Rn of dimensionpis a discrete additive subgroup ofRn. Such a lattice is generated by integral linear combinations of vectors from a familyB:= (b1, b2, . . . bp)ofp≤nlinearly independent vectors ofRn, which is called a basis of the latticeL. A lattice is generated by infinitely many bases that are related to each other by integer matrices of determinant±1. Lattice reduction algorithms consider a Euclidean lattice of dimensionpin the ambient spaceRn and aim at finding a “reduced” basis of this lattice, formed with vectors almost orthogonal and short enough.
The LLL algorithm designed in [13] uses as a sub–algorithm the lattice reduction algorithm for two dimensions (which is called the Gauss algorithm) : it performs a succession of steps of the Gauss algorithm on the “local bases”, and it stops when all the local bases are reduced (in the Gauss sense). This is why it is important to precisely describe and study the two–dimensional case. This is the purpose of this paper.
The present section describes the particularities of the lattices in two dimensions, provides two versions of the two–dimensional lattice reduction algorithm, namely the Gauss algorithm, and introduces its main parameters of interest.
Figure 2: A lattice and three of its bases represented by the parallelogram they span. The basis on the left is minimal (reduced), whereas the two other ones are skew.
2.1 Lattices in two dimensions.
Up to a possible isometry, a two–dimensional lattice may always be considered as a subset ofR2. With a small abuse of language, we use the same notation for denoting a complex numberz∈Cand the vector of R2whose components are(<z,=z). For a complexz, we denote by|z|both the modulus of the complex zand the Euclidean norm of the vectorz; for two complex numbersu, v, we denote by(u·v)the scalar product between the two vectorsuandv. The following relation between two complex numbersu, vwill be very useful in the sequel
v
u =(u·v)
|u|2 +idet(u, v)
|u|2 . (1)
Alatticeof two dimensions in the complex planeCis the setLof elements ofC(also called vectors) defined byL =Zu⊕Zv ={au+bv; a, b∈Z},where(u, v), called abasis, is a pair ofR–linearly independent elements ofC. Remark that in this case, due to (1), one has=(v/u)6= 0.
Amongst all the bases of a latticeL, some that are called reduced enjoy the property of being formed with “short” vectors. In dimension 2, the best reduced bases areminimalbases that satisfy optimality properties: defineuto be a first minimum of a latticeLif it is a nonzero vector ofLthat has smallest Euclidean norm; the length of a first minimum ofLis denoted byλ1(L). A second minimumv is any shortest vector amongst the vectors of the lattice that are linearly independent ofu; the Euclidean length of a second minimum is denoted byλ2(L). Then a basis isminimalif it comprises a first and a second mininum (See Figure 2). In the sequel, we focus on particular bases which satisfy one of the two following properties:
(P)it has a positive determinant [i.e.,det(u, v)≥0or=(v/u)≥0]. Such a basis is calledpositive.
(A)it has a positive scalar product [i.e.,(u·v)≥0or<(v/u)≥0]. Such a basis is calledacute.
Without loss of generality, we may always suppose that a basis is acute (resp. positive), since one of(u, v) and(u,−v)is.
The following result gives characterizations of minimal bases. Its proof is omitted.
Proposition 1.[Characterizations of minimal bases.]
(P)[Positive bases.] Let(u, v)be a positive basis. Then the following two conditions(a)and(b)are equivalent:
(a)the basis(u, v)is minimal;
(b)the pair(u, v)satisfies the three simultaneous inequalities:
(P1) : |v
u| ≥1, (P2) : |<(v u)| ≤ 1
2 and (P3) : =(v u)≥0
(A)[Acute bases.] Let (u, v)be an acute basis. Then the following two conditions (a)and (b)are equivalent:
(a)the basis(u, v)is minimal;
(b)the pair(u, v)satisfies the two simultaneous inequalities:
(A1) : |v
u| ≥1, and (A2) : 0≤ <(v u)≤1
2.
2.2 The Gaussian reduction schemes.
There are two reduction processes, according as one focuses on positive bases or acute bases. According as we study the behaviour of the algorithm itself, or the geometric characteristics of the output, it will be easier to deal with one version than with the other one: for the first case, we will choose the positive framework, and, for the second case, the acute framework.
The positive Gauss Algorithm. The positive lattice reduction algorithm takes as input a positive ar- bitrary basis and produces as output a positive minimal basis. The positive Gauss algorithm aims at satisfying simultaneously the conditions(P)of Proposition 1. The conditions(P1)and(P3)are simply satisfied by an exchange between vectors followed by a sign changev :=−v. The condition(P2)is met by an integer translation of the type:
v:=v−qu with q:=bτ(v, u)e, τ(v, u) :=<(v
u) =(u·v)
|u|2 , (2)
wherebxerepresents the integer nearest to the realx(i). After this translation, the new coefficientτ(v, u) satisfies0≤τ(v, u)≤(1/2).
PGAUSS(u, v)
Input.A positive basis(u, v)ofCwith |v| ≤ |u|, |τ(v, u)| ≤(1/2).
Output.A positive minimal basis(u, v)ofL(u, v)with|v| ≥ |u|.
While |v| ≤ |u|do (u, v) := (v,−u);
q:=bτ(v, u)e, v:=v−qu;
(i)The functionbxeis defined asbx+ 1/2cforx≥0andbxe=−b−xeforx <0.
On the input pair(u, v) = (v0, v1), the positive Gauss Algorithm computes a sequence of vectorsvi defined by the relations
vi+1=−vi−1+qivi with qi:=bτ(vi−1, vi)e. (3) Here, each quotientqiis an integer ofZ,P(u, v) =pdenotes the number of iterations, and the final pair (vp, vp+1)satisfies the conditions(P)of Proposition 1. Each step defines a unimodular matrixMiwith detMi= 1,
Mi=
qi −1
1 0
, with
vi+1
vi
=Mi
vi
vi−1
,
so that the Algorithm produces a matrixMfor which vp+1
vp
=M v1
v0
with M:=Mp· Mp−1·. . .· M1. (4) The acute Gauss Algorithm. The acute reduction algorithm takes as input an arbitrary acute basis and produces as output an acute minimal basis. This AGAUSSalgorithm aims at satisfying simultaneously the conditions(A)of Proposition 1. The condition(A1)is simply satisfied by an exchange, and the condition (A2)is met by an integer translation of the type:
v:=(v−qu) with q:=bτ(v, u)e, =sign(τ(v, u)− bτ(v, u)e),
whereτ(v, u)is defined as in (2). After this transformation, the new coefficientτ(v, u)satisfies 0 ≤ τ(v, u)| ≤(1/2).
AGAUSS(u, v)
Input.An acute basis(u, v)ofCwith|v| ≤ |u|, 0≤τ(v, u)≤(1/2).
Output.An acute minimal basis(u, v)ofL(u, v)with|v| ≥ |u|.
While |v| ≤ |u|do (u, v) := (v, u);
q:=bτ(v, u)e;:=sign(τ(v, u)− bτ(v, u)e), v:=(v−qu);
On the input pair(u, v) = (w0, w1), the Gauss Algorithm computes a sequence of vectorswidefined by the relations wi+1=i(wi−1−qeiwi) with
qei:=bτ(wi−1, wi)e, i=sign(τ(wi−1, wi)− bτ(wi−1, wi)e). (5) Here, each quotientqei is a positive integer,p ≡ p(u, v)denotes the number of iterations [this will be the same as the previous one], and the final pair(wp, wp+1)satisfies the conditions(A)of Proposition 1.
Each step defines a unimodular matrixNiwithdetNi=i=±1, Ni=
−ieqi i
1 0
, with
wi+1
wi
=Ni
wi
wi−1
,
so that the algorithm produces a matrixN for which wp+1
wp
=N w1
w0
with N :=Np· Np−1·. . .· N1.
Comparison between the two algorithms. These algorithms are closely related, but different. The AGAUSSAlgorithm can be viewed as a folded version of the PGAUSSAlgorithm, in the sense defined in [4]. We shall come back to this fact in Section 3.3. And the following is true:
Consider two bases: a positive basis(v0, v1), and an acute basis (w0, w1) that satisfyw0 = v0 and w1=η1v1withη1=±1. Then the sequences of vectors(vi)and(wi)computed by the two versions of the Gauss algorithm (defined in Eq.(3),(5)) satisfywi=ηivifor someηi=±1and the quotientqeiis the absolute value of quotientqi.
Then, when studying the two kinds of parameters –execution parameters, or output parameters– the two algorithms are essentially the same. As already said, we shall use the PGAUSSAlgorithm for studying the output parameters, and the AGAUSSAlgorithm for the execution parameters.
2.3 Main parameters of interest.
The size of a pair(u, v)∈Z[i]×Z[i]is
`(u, v) := max{`(|u|2), `(|v|2)}=` max{|u|2,|v|2} , where`(x)is the binary length of the integerx. The Gram matrixG(u, v)is defined as
G(u, v) =
|u|2 (u·v) (u·v) |v|2
.
In the following, we consider subsetsΩMwhich gather all the (valid) inputs of sizeM relative to each ver- sion of the algorithm. They will be endowed with some discrete probabilityPM, and the main parameters become random variables defined on these sets.
All the computations of the Gauss algorithm are done on the Gram matrices G(vi, vi+1) of the pair (vi, vi+1). Theinitializationof the Gauss algorithm computesthe Gram Matrix of the initial basis: it computes three scalar products, which takes aquadratic time(ii)with respect to the length of the input
`(u, v). After this, all the computations of thecentral partof the algorithmare directly doneon these matrices; more precisely, each step of the process is a Euclidean division between the two coefficients of the first line of the Gram matrixG(vi, vi−1)of the pair(vi, vi−1)for obtaining the quotientqi, followed with the computation of the new coefficients of the Gram matrixG(vi+1, vi), namely
|vi+1|2:=|vi−1|2−2qi(vi·vi−1) +qi2|vi|2, (vi+1·vi) :=qi|vi|2−(vi−1·vi).
Then the cost of thei-th step is proportional to`(|qi|)·`(|vi|2), and the bit-complexity of the central part of the Gauss Algorithm is expressed as a function of
B(u, v) =
p(u,v)
X
i=1
`(|qi|)·`(|vi|2), (6)
(ii)we consider the naive multiplication between integers of sizeM, whose bit-complexity isO(M2).
wherep(u, v)is the number of iterations of the Gauss Algorithm. In the sequel,B will be called the bit-complexity.
The bit-complexityB(u, v)is one of our parameters of interest, and we compare it to other simpler costs.
Define three new costs, the quotient bit-costQ(u, v), the difference costD(u, v), and the approximate difference costD:
Q(u, v) =
p(u,v)
X
i=1
`(|qi|), D(u, v) =
p(u,v)
X
i=1
`(|qi|)
`(|vi|2)−`(|v0|2)
, (7)
D(u, v) := 2
p(u,v)
X
i=1
`(|qi|) lg
vi
v , which satisfyD(u, v)−D(u, v) =O(Q(u, v))and
B(u, v) =Q(u, v)`(|u|2) +D(u, v) + [D(u, v)−D(u, v)]. (8) We are then led to study two main parameters related to the bit-cost, that may be of independent interest:
(a) The so-called additive costs, which provide a generalization of costQ. They are defined as the sum of elementary costs, which only depend on the quotientsqi. More precisely, from a positive elementary costcdefined onN, we consider the total cost on the input(u, v)defined as
C(c)(u, v) =
p(u,v)
X
i=1
c(|qi|). (9)
When the elementary costcsatisfiesc(m) =O(logm), the costCis said to be of moderate growth.
(b) The sequence of thei-th length decreasesdi(fori∈[1..p]) and the total length decreased:=dp, defined as
di:=
vi
v0
2
, d:=
vp
v0
2
. (10)
Finally, the configuration of the output basis(ˆu,ˆv)is described via its Gram–Schmidt orthogonalized ba- sis, that is the system(ˆu?,vˆ?)whereuˆ?:= ˆuandˆv?is the orthogonal projection ofˆvonto the orthogonal of<u >. There are three main output parameters closely related to the minima of the latticeˆ L(u, v),
λ(u, v) :=λ1(L(u, v)) =|u|,ˆ µ(u, v) :=|det(u, v)|
λ(u, v) =|ˆv?|, (11)
γ(u, v) := λ2(u, v)
|det(u, v)| =λ(u, v) µ(u, v) = |ˆu|
|ˆv?|. (12)
We come back later to these output parameters.
3 The Gauss Algorithm in the complex plane.
We now describe a complex version for each of the two versions of the Gauss algorithms. This leads to view each algorithm as a dynamical system, which can be seen as a (complex) extension of (real) dynamical systems relative to the centered Euclidean algorithms. We provide a precise description of linear fractional transformations (LFTs) used by each algorithm. We finally describe the (two) classes of probabilistic models of interest.
3.1 The complex framework.
Many structural characteristics of lattices and bases are invariant under linear transformations —similarity transformations in geometric terms— of the formSλ : u7→λuwithλ∈C\ {0}.
(a) A first instance is the execution of the Gauss algorithm itself: it should be observed that translations performed by the Gauss algorithms only depend on the quantityτ(v, u)defined in (2), which equals
<(v/u). Furthermore, exchanges depend on|v/u|. Then, ifvi(orwi) is the sequence computed by the algorithm on the input(u, v), defined in Eq. (3), (5), the sequence of vectors computed on an input pairSλ(u, v)coincides with the sequenceSλ(vi)(orSλ(wi)). This makes it possible to give a formulation of the Gauss algorithm entirely in terms of complex numbers.
(b) A second instance is the characterization of minimal bases given in Proposition 1 that only depends on the ratioz=v/u.
(c) A third instance are the main parameters of interest: the execution parameters D, C, d defined in (7,9,10) and the output parametersλ, µ, γ defined in (11,12). All these parameters admit also complex versions: ForX ∈ {λ, µ, γ, D, C, d}, we denote byX(z)the value ofXon basis(1, z).
Then, there are close relations betweenX(u, v)andX(z)forz=v/u:
X(z) =X(u, v)
|u| , for X ∈ {λ, µ}, X(z) =X(u, v), for X ∈ {D, C, d, γ}.
It is thus natural to consider lattice bases taken up to equivalence under similarity, and it is sufficient to restrict attention to lattice bases of the form(1, z). We denote byL(z)the latticeL(1, z). In the complex framework, the geometric transformation effected by each step of the algorithm consists of an inversion- symmetryS : z 7→1/z, followed by a translationz 7→T−qzwithT(z) = z+ 1, ans a possible sign changeJ :z7→ −z.
The upper half planeH:={z∈C; =(z)>0}plays a central rˆole for the PGAUSSAlgorithm, while the right half plane{z∈C; <(z)≥0,=(z)6= 0}plays a central rˆole in the AGAUSSalgorithm. Remark just that the right half plane is the unionH+∪JH−whereJ:z7→ −zis the sign change and
H+:={z∈C; =(z)>0,<(z)≥0}, H− :={z∈C; =(z)>0,<(z)≤0}.
3.2 The dynamical systems for theGAUSSalgorithms.
In this complex context, the PGAUSSalgorithm bringszinto the vertical stripB+∪ B−with B=
z∈H; |<(z)| ≤ 1 2
, B+:=B ∩H+, B−:=B ∩H−,
reduces to the iteration of the mapping U(z) =−1
z +
<
1 z
=−1 z −
<
−1 z
(13) and stops as soon aszbelongs to the domainF=F+∪ F−with
F =
z∈H; |z| ≥1, |<(z)| ≤ 1 2
, F+:=F ∩H+, F− :=F ∩H−. (14) Such a domain, represented in Figure 3, is familiar from the theory of modular forms or the reduction theory of quadratic forms [17].
Consider the pair(B, U)where the mapU :B → Bis defined in (13) forz∈ B \ F and extended toF withU(z) =zforz ∈ F. This pair(B, U)defines a dynamical system, andFcan be seen as a “hole”:
since the PGAUSS algorithm terminates, there exists an indexp ≥ 0which is the first index for which Up(z)belongs toF. Then, any complex number ofBgives rise to a trajectoryz, U(z), U2(z), . . . , Up(z) which “falls” in the holeF, and stays insideFas soon it attainsF. Moreover, sinceFis a fundamental domain of the upper half planeHunder the action ofP SL2(Z)(iii), there exists a tesselation ofHwith transforms ofF of the formh(F)withh∈P SL2(Z). We will see later that the geometry ofB \ F is compatible with the geometry ofF.
(−12,0) (12,0)
B \ F F
+F
−B \e Fe F+
JF−
(0,0) (0,1)
(0,−1)
Figure 3: The fundamental domainsF,Feand the stripsB,B.e
(iii)We recall thatP SL2(Z)is the set of LFT’s of the form(az+b)/(cz+d)witha, b, c, d∈Zandad−bc= 1.
In the same vein, the AGAUSSalgorithm bringszinto the vertical strip Be=
z∈C; =(z)6= 0, 0≤ <(z)≤1 2
=B+∪JB−,
reduces to the iteration of the mapping Ue(z) =
1 z
1 z −
<
1 z
with (z) :=sign(<(z)− b<(z)e), (15) and stops as soon aszbelongs to the domainFe
Fe=
z∈C; |z| ≥1 0≤ <(z)≤1 2
=F+∪JF−. (16)
Consider the pair(B,eUe)where the mapUe :B →e Beis defined in (15) forz∈B \e Feand extended toFe withUe(z) =zforz∈Fe. This pair(B,eUe)also defines a dynamical system, andFecan also be seen as a
“hole”.
3.3 Relation with the centered Euclid Algorithm.
It is clear (at least in an informal way) that each version of Gauss algorithm is an extension of the (cen- tered) Euclid algorithm:
(i)for the PGAUSS algorithm, it is related to the Euclidean division of the form v = qu+rwith
|r| ∈[0,+u/2]
(ii)for the AGAUSSalgorithm, it is based on the Euclidean division of the formv = qu+rwith :=±1, r∈[0,+u/2].
If, instead of pairs, that are the old pair(u, v)and the new pair(r, u), one considers rationals, namely the old rationalx =u/v or the new rationaly = r/u, each Euclidean division can be written with a map that expresses the new rationaly as a function of the old rationalx, asy = V(x)(in the first case) or y = Ve(x)(in the second case). WithI := [−1/2,+1/2]andeI := [0,1/2], the maps V : I → I or Ve :I →e Ieare defined as follows
V(x) := 1 x−
1 x
, forx6= 0, V(0) = 0, (17)
Ve(x) = 1
x 1 x−
1 x
, forx6= 0, Ve(0) = 0. (18) [Here,(x) := sign(x− bxe)]. This leads to two (real) dynamical systems(I, V)and(eI,Ve)whose graphs are represented in Figure 4. Remark that the tilded system is obtained by a folding of the untilded one (or unfolded one), (first along thexaxis, then along theyaxis), as it is explained in [4]. The folded system is called the F-EUCLIDsystem (or algorithm), whereas the unfolded one is called the U-EUCLID
system (or algorithm).
Of course, there are close connections betweenU and−V on the one hand, andUe andVe on the other hand: Even if the complex systems(B, U)and(B,e U)e are defined on strips formed with complex numbers
Figure 4: The two dynamical systems underlying the centered Euclidean algorithms: on the left, the unfolded one (U-EUCLID); on the right, the folded one (F-EUCLID)
zthat are not real (i.e.,=z 6= 0), they can be extended to real inputs “by continuity”: This defines two new dynamical systems(B, U)andB,eUe), and the real systems(I,−V)and(eI,Ve)are just the restriction of the extended complex systems to real inputs. Remark now that the fundamental domainsF,Feare no longer “holes” since any real irrational input stays inside the real interval and never “falls” in them. On the contrary, the trajectories of rational numbers end at 0, and finally each rational is mapped toi∞.
3.4 The LFT’s used by thePGAUSSalgorithm.
The complex numbers which intervene in the PGAUSSalgorithm on the inputz0=v1/v0are related to the vectors(vi)defined in (3) via the relationzi =vi+1/vi. They are directly computed by the relation zi+1:=U(zi), so that the oldzi−1is expressed with the new onezias
zi−1=h[mi](zi), with h[m](z) := 1 m−z. This creates a continued fraction expansion for the initial complexz0, of the form
z0=h(zp) with h:=h[m1]◦h[m2]◦. . . h[mp],
which expresses the inputz =z0 as a function of the outputzˆ=zp. More generally, thei-th complex numberzisatisfies
zi=hi(zp) with hi:=h[mi+1]◦h[mi+2]◦. . . h[mp].
Proposition 2. The set G of LFTs h : z 7→ (az+b)/(cz +d)defined with the relation z = h(ˆz) which sends the output domainF into the input domainB \ F is characterized by the setQof possible quadruples(a, b, c, d). A quadruple(a, b, c, d)∈Z4withad−bc= 1belongs toQif and only if one of the three conditions is fulfilled
Figure 5: On the left, the “central” festoon F(0,1). On the right, three festoons of the strip B, relative to (0,1),(1,3),(−1,3)and the two half-festoons at(−1,2)and(1,2).
(i)(c= 1orc≥3) and (|a| ≤c/2);
(ii)c= 2, a= 1, b≥0, d≥0;
(iii)c= 2, a=−1, b <0, d <0.
There exists a bijection betweenQand the setP ={(c, d); c≥1,gcd(c, d) = 1}.On the other hand, for each pair(a, c)in the set
C:={(a, c); a
c ∈[−1/2,+1/2], c≥1; gcd(a, c) = 1}, (19) any LFT ofG which admits(a, c) as coefficients can be written ash = h(a,c)◦Tq withq ∈ Zand h(a,c)(z) = (az+b0)/(cz+d0), with|b0| ≤ |a/2|,|d0| ≤ |c/2|.
Definition. [Festoons] IfG(a,c) denotes the set of LFT’s of G which admit (a, c) as coefficients, the domain
F(a,c)= [
h∈G(a,c)
h(F) =h(a,c)
[
q∈Z
TqF
(20)
gathers all the transforms ofh(F)which belong toB \ Ffor whichh(i∞) =a/c. It is called the festoon ofa/c.
Remark that, in the case whenc= 2, there are two half-festoons at1/2and−1/2(See Figure 5).
3.5 The LFT’s used by theAGAUSSalgorithm.
In the same vein, the complex numbers which intervene in the AGAUSS algorithm on the inputz0 = w1/w0are related to the vectors(wi)defined in (5) via the relationzi =wi+1/wi. They are computed
by the relationzi+1:=Ue(zi), so that the oldzi−1is expressed with the new onezias zi−1=hhmi,ii(zi) with hhm,i(z) := 1
m+z. This creates a continued fraction expansion for the initial complexz0, of the form
z0=eh(zp) with eh:=hhm1,1i◦hhm2,2i◦. . . hhmp,pi. More generally, thei-th complex numberzisatisfies
zi=ehi(zp) with ehi:=hhmi+1,i+1i◦hhmi+2,i+2i◦. . . hhmp,pi. (21) We now explain the particular rˆole which is played by the diskDof diameterIe = [0,1/2]. Figure 6 shows that the domainB \ De decomposes as the union of six transforms of the fundamental domainF,e namely
B \e De= [
h∈K
h(Fe) with K:={I, S, ST J, ST, ST2J, ST2J S}. (22) This shows that the diskDitself is also a union of transforms of the fundamental domainF. Remarke that the situation is different for the PGAUSSalgorithm, since the frontier ofDlies “in the middle” of transforms of the fundamental domainF(see Figure 6).
D ST2JF+
STF− ST JF+ SF−
F+
ST2J SF−
Figure 6: On the left, the six domains which constitute the domainB+\ D+. On the right, the diskDis not compatible with the geometry of transforms of the fundamental domainsF.
As Figure 7 shows it, there are two main parts in the execution of the AGAUSSAlgorithm, according to the position of the current complexziwith respect to the diskDwhose equation is
D:={z; <
1 z
≥2}.
