 Hello, everyone. I'm Jian Wei Li. I'm going to talk about sudden action, the visit to the Phoenix Galaxy in SCE Brown Vision. This work is joined with Diversion of Gold War, Feng Gong New Year, and North Stevens, the Ways. Firstly, I will cover some background or lenses. Secondly, I will introduce our main results. Thirdly, I want to show our technical ideas. Finally, I will make our conclusion. Now, let us record Diversion of lenses and basis. An X-ray to B1 to Bn is a set of all individual conditions of an XB1 to Bn. Namely, L is a set of Z1 times Z1 plus Zn times Zn. Each ZI is an illusion. The XB equal to B1 to Bn is called the basis of L. If the rig N is greater than 2, then XL has infinity basis. In lens theory, the most important problem is the shortest path problem. We call it SV for short. In the basis of L, SVP is to find the shortest non-zero value of V in L, such that the norm of V is equal to the L1 of L, which is called for the minimum of lens. There are two nature elections of SVP. There are f of probability of SVP and f of probability of SVP. We call them f of SVP and f of SVP for short. Given that this L, f of SVP asks us to find the non-zero value of V in L, such that the norm of V is less than f times the L1 of L. Given that this L, f of SVP asks us to find the non-zero value of V in L, such that the norm of V is less than f times VL to 1 over N. Here, VL denotes the determinant of L. Based on work of R-type miscellaneous, not HAVEV and ULGAV, we don't know that SVP is energy-hard. More precisely, there is some universal constant C greater than 0, such that N to C over log log N to SVP on N, energy-hard is energy-hard on the reasonable complexity of theoretical subjects. From R-type, 1996's beginning, many L-based cryptographic parameters have been contracted. Whose security is based on the worst-case-hardness of N or N to C SVP for some constant C? For example, NSTQC knows three solutions, include some L-based schemes. Question, how to estimate the complexity of L-based cryptographic themes? The answer is we just need to solve N to C SVP and N to C SVP. To do so, the cancer approach is led-to-relection. Given led-to-relection, it asks us to find a good basis consisting of reasonably short and almost orthogonal factors. For example, in this video, given a bad basis V1, V2, we try to find a reasonable basis U1 and U2. They are reasonably short and almost orthogonal to each other. Led-to-relection is very important because it is a classic approach for solving SVP and F-action SVP. It has proven invariable in many fields of medicines and methodics. Notably, in cryptographic knowledge, it is a popular tool to bolstering the key cryptographic and cryptolysis. Its importance is going because led-based cryptography becomes the most popular candidate for PQC. One of the fundamental led-to-relection parameters in the geometry of numbers is hermit constant GaN, which is developed by MECS-01 of L2-2 over O and ring led-to-L of unit determinant. GaN is typically used to measure all the quality of led-to-relection algorithms. GaN, in the new year, gives the previously best polynomial time led-to-relection algorithm for solving N2C greater than 1 SVP in CLB. More precisely, for N2, for N equal to PK greater than 2K, with the polynomial in the main cost of the result of CLB in L2K, the GaN in the new year is led-to-relection algorithm of all possible basis B1 to BN of the equal to L2Z. The number of B1 is less than 2 times GaNk to N minus 1 over 2 K minus 1 times VL to 1 O N, and the number of B1 is also less than 2 times GaNk to N minus K over K minus 1 times L1N. MECS-01 watcher DBTZ is the previously best polynomial time led-to-relection algorithm for solving N2C greater than 1 over 2 SVP in CLB. More precisely, for N greater than K greater than 2, with the polynomial in main cost of the result of CLB in the K, the MECS-01 watcher DBTZ is always an all-purpose basis B1 to BN of the equal to L2Z. The number of B1 is less than 2 times GaNk to N minus 1 over 2 K minus 1 times VL to 1 O N, and the number of B1 is also less than 2 times GaNk to N minus 1 over K minus 1 times L1N. Let us compare selection with DBTZ. GaNk selection requires an equal to Pk, and the ratio of B1 over L1 over L1 is the best. Yet, DBTZ just requires N greater than K greater than 2. The ratio of B1 over 4L to 1 over N is the best. I think it is necessary to ask the following two questions. First, can we expect GaNk selection always into the case that K may not develop N? If it is always yes, this would imply the selection is up for the N2C SVP over 1 less than C, and the C are a fluctuation of the constant. Second, the best proof of a fluctuation factor for the SVP and L2SVP is not the best thing of them. Can we get the best of both GaNk selection and make sure it is worth DBTZ? We also learned that the security of the main desk based schemes is based on the worst-case handling of N2C SVP with constant C belonging to the interval between 1 over 2 and 1. However, there is no non-true algorithm for PkSVP with some linear factors. Question, is there a non-true algorithm for PkSVP with some linear factors? If it is always yes, it would imply at least the selection is up. All results. All people solved the following two questions. Question one, is there a non-true algorithm for PkSVP with some linear factors? Question two, can we get the DBTZ algorithm into the case that K does not have N? So that we can fast solve N2C SVP over any fluctuation constant C greater than 1. Question three, is there a single algorithm which is the best in theory for solving a boss N2C, greater than 1 SVP and N2C greater than 1 over 2 SVP? To solve those three questions, we are going to make the results or to say two relativistic algorithms. Our first result is an algorithm for opposing SVP with some linear factors. So this 2K, greater than N, greater than K, greater than 2B, greater than N and data greater than 1, there is an algorithm that with polynomially many calls to address your in-ring K, the algorithm offers a non-zero factor B of the electrolysis L such that to know B, the algorithm is less than greater than 1 over L out to the effect of gamma K to N over 2K. This is the first non-true algorithm for solving a SVP with some linear factors N to 1 over 2, less than F, less than N to 1. Actually, we prove the following conclusion. Fright comes to the C, belonging to 1 over 2 and 1. And in fact, the algorithm 1, there is an efficient reduction from data to 2 to C plus 1 N to the times N to C, as seen in ring N, to that as seen in ring N to C. Also, the result is an algorithm for meeting SVP with its identity polynomial factors. That's N, greater than 2K, greater than 4B, greater than N and data greater than 1. There is an algorithm that with polynomial many calls to address your in-ring K, the algorithm offers a basis B1 to BN of the electrolysis L such that to know B1 is less than 2, times data to 2, gamma K to N minus 1 over 2, K minus 1 times 1 over N. And the number of B1 is also less than 2, to data to 2, times gamma K to N minus K over K minus 1 times L over N or L. Essentially, the algorithm is based on a following reduction. For N constant C greater than 1 and any factor data greater than 1, there is an efficient reduction from data to 2C plus 1 and 2C SVP in ring N to that SVP in ring N over C plus 1. I think all work at least has the following impact. Of the two algorithms provided, the current algorithm is the best polynomial on time, like as you mentioned, all algorithms. It achieves the best time quality to solve in theory. With well-chosen SVORX in low-ring, all work impacts the potentially faster approval of the previous algorithm for broadening SV with a factor N to 1 over 2, less than N to O1. This is the region most relevant for cryptography. You can read these two tables for all the special setup. Now, I want to show you all the different ideas. For simplicity, I just described all the different ideas with ZSORX. Yet, it is easy to replace the ZSORX with a positive SORX. We know the cost of basic notions. The first one is grams, meters, all the dimensions. Even if this is B equal to B1 to BN, let's always usually use the algorithm of projection pi. Each factor Bi star equal to pi i or Bi is the grossing effect of B. We use BiG to denote the projected block, pi i or Bi, pi i or Bi plus 1, pi i or BG. Now, I'll introduce some several reduction notions we will use later. Let B be the basis of less L. B is as it will be used if its positive effect is L, short is the non-zero factor of L. B is the SVP reduced if it is still reduced if it is SVP reduced. B, if it is reduced if it is produced by the research waters, if it is always with process K. B is gamma-neutral reduced if it is produced by the gamma-neutral certain large origin with process K. I will now show you all the different ideas behind our first algorithm for positive SVP with some minifactors. Given that it is L or ring N and SV are like a little K, the ring N is going to be double between K and 2K. We first partition the input basis into the two blocks such that the first block has more ring N, mass K, and the second block has ring K, assuming the following feature. We then alternate the nip, and we then ought to necessarily SVP reduced and SVP reduced some project blocks on the input basis, such that the high basis factor B1 to BK become good enough so that the B1 to BK satisfies the following inquiry. Finally, we do an extra simulation on B1 to BK to find the short non-zero factor B in our subject, so B is almost less than gamma K to n of 2K times Z1 of L. I will now introduce all the different ideas behind our algorithm for positive SVP with a little point of effect. To do so, let us first recall the ideas of gamma-neutral reduction. Given that it is B of a ring N, since the ring N equal to PK, gamma and newly-passioned partitions the basis into P blocks of equal ring K, assuming the following feature. In all of the inputs, a basis B of L, L, ring N, and SV are in ring K. Here, N, E is equal to PK plus Q. So we partition B into P blocks such that the first block has a larger ring K plus Q, and the other block has a similar ring K and is still in the future. We then alternately assume and deduce some projected blocks on B, such that the higher projected block B1 to K plus Q becomes equal to BK plus Q. The T-projected block BK plus Q plus 1 N becomes gamma-neutral reduction, and the both blocks are grouped by ebk-reducenies of B to K plus Q plus 1. Finally, all of the basis B1 to BN satisfies the following inquiries. The number of B1 is less than gamma-K to N minus 1 over 2, K minus 1 times YL to 1 over N, and the number of B1 is also less than gamma-K to N minus K over K minus 1 times NL. In summary, we give the best polynomial time length reduction algorithm in theory, including the first non-true algorithm for quality SCP with some ineffective N to 1 over 2, less than F, less than N to 1. This impacts especially fast approval of the first algorithm for quality SCP with effect N to 1 over 2, less than F, less than N to 1. This is the region most relevant for the graphy. IB is useful in less security estimates. For more details, please refer to our paper. Thank you for your attention.