The irreducible vectors of a lattice:

The main idea behind lattice sieving algorithms is to reduce a sufficiently large number of lattice vectors with each other so that a set of short enough vectors is obtained. It is therefore natural to study vectors which cannot be reduced. In this work we give a concrete definition of an irreducible vector and study the properties of the set of all such vectors. We show that the set of irreducible vectors is a subset of the set of Voronoi relevant vectors and study its properties. For extremal lattices this set may contain as many as 2n\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$2^n$$\end{document} vectors, which leads us to define the notion of a complete system of irreducible vectors, whose size can be upper-bounded by the kissing number. One of our main results shows that modified heuristic sieving algorithms heuristically approximate such a set (modulo sign). We provide experiments in low dimensions which support this theory. Finally we give some applications of this set in the study of lattice problems such as SVP, SIVP and CVPP. The introduced notions, as well as various results derived along the way, may provide further insights into lattice algorithms and motivate new research into understanding these algorithms better.


Introduction
The need for quantum-resistant cryptography has led to rapid developments in the area of lattice-based cryptography, mainly spurred by the NIST PQ-Crypto competition. Large scale deployment of lattice-based cryptosystems in the near future becomes realistic. This continues to make the deeper understanding of lattice problems an urgent research topic.
In 2010 Micciancio and Voulgaris, based also on previous work [1], described deterministic O(2 2n )-time andÕ(2 n )-space algorithms to solve some of the most important lattice problems (such as SVP, SIVP and CVP) [23] in dimension n. This result mainly relies on an algorithm to compute the set of relevant vectors of (the Voronoi cell of) a lattice. Even though this is a very interesting result, the constants in the exponents of time and space complexities of the Micciancio-Voulgaris algorithm make it impractical, even for moderate dimensions.
The set of relevant vectors was first introduced in 1908 by Voronoi [35]. It provides a useful representation of the Voronoi cell of a lattice. Even though the set of relevant vectors seems to hold the key for solving many lattice problems, its expected size makes it impractical. This becomes even more clear when that size is compared to the (time and) space complexity of algorithms used in practice for solving lattice problems such as [2,6,14].
In this work, we introduce a different set of lattice vectors, which appears to serve as a bridge between the provable results relying on the set of relevant vectors and heuristic sieving algorithms [3,24,28].
Notions of irreducibility are considered to be fundamental in many areas. Often irreducibility is defined with respect to multiplication. Since a lattice is an additive object, we will however use an additive notion of irreducibility. Clearly the notion of lattice basis could be seen as such a construct, but it has been observed to be a too weak notion to provide, on its own, interesting results for lattice problems. Our new notion of irreducible vectors provides us with a set of lattice vectors, larger than a basis but smaller than the set of relevant vectors, and possessing interesting properties. To the best of our knowledge this definition is new in the area of lattices.

Contributions
In this paper we define a notion of irreducibility for a lattice vector. As a first result we show that every irreducible vector of a lattice belongs to the lattice's set of relevant vectors. Hence, the set of irreducible vectors which we denote by Irr(L ) is finite. Additionally, it is shown that the set of irreducible vectors generates the lattice and also contains vectors achieving all the successive minima of the lattice. Finally, the sets of irreducible vectors of the root lattices A n , D n and their duals A * n , D * n are examined as they prove to be interesting extreme cases. As it turns out, the set Irr(L ) can be as big as the set of relevant vectors. In order to get a set of cardinality provably smaller than 2 n , a complete system of irreducible vectors is defined, which is denoted by P(L ). This set inherits the aforementioned properties of the set Irr(L ) and also it is proved that | P(L )| < 2 0.402n where n is the rank of the lattice. Heuristically it is expected that P(L ) will have a cardinality of 2 0.21n . From a computational point of view, it is shown that slightly modified versions of already existing sieving algorithms asymptotically output such a set (modulo sign). This statement is further supported by experimental results. Finally, we discuss the applicability of P(L ) in showing that sieving algorithms like the ones described in [3,24] can be used for tackling SVP, SIVP and computing the kissing number of a lattice. Additionally we discuss the applicability of P(L ) as preprocessing data in a CVPP algorithm which we call "the tuple slicer". The tuple slicer can provide a time-memory trade-off without the use of rerandomisations.
The datasets generated during and/or analysed during the current study are available from the corresponding author on reasonable request.

Motivation-future work
We believe that the notion of irreducibility will motivate further research on the field of lattices. In this work we focus only on pairwise irreducibility of vectors, even though a definition of higher order irreducibility is also given. In particular, pairwise irreducibility appears to have a close relation to lattice sieving algorithms. Thus, it could be that the set P(L ) can provide further insight on this area. An interesting question would be if the usage of the set P(L ) (under some heuristic assumptions on its size) enables the proof of an upper bound on the time complexity of the GaussSieve [24]. Examining the properties and the utility of higher order irreducibility is left for future research.
The implications of P(L ) in cryptanalytic attacks could be an interesting topic to investigate. The set P(L ) is expected to be affected by an underlying structure in the lattice L . It can thus be expected that structured lattices end up with a smaller set P(L ) than "average-case" lattices. Many of the modern lattice-based cryptosystems possess such underlying structures and hence they could serve as interesting cases to examine from this point of view.
In Sect. 5.1 we argue that computing P(L ) by "brute force" can take up toÕ(2 2n ) time. Therefore, this can serve as an upper bound. However, this bound may not be tight as discussed in Sect. 5.2. In Sect. 5.2 modified sieving algorithms were utilised in order to show how to compute P(L ) asymptotically. But the question of how to compute it exactly or approximately in practice remains open. Such a result would also imply the ability to compute a subset of R(L ) (of heuristically exponential size) without requiring the set R(L ).
The set P(L ) can be used as a tool in proving a behaviour of a lattice algorithm but could also be used itself (e.g. as preprocessing data of a CVPP algorithm). In Sect. 6 we propose the use of the "tuple slicer" in order to utilise the set P(L ) in the CVPP framework. However this algorithm introduces a new question, namely what size of tuples should be considered during this algorithm. Figure 4 attempts to give some preliminary experimental evidence on this problem. However, a theoretical analysis of this question is left for future work.
Appendix B provides some experimental evidence showing that the size of a set P(L ) could vary a lot in some cases. An "average-case" result implying that if the underlying lattice is not "special" then the size of P(L ) cannot vary a lot would be of interest. A potential tool to reaching such a result could be lattice theta functions [12]. This is due to the fact that the coefficients in a lattice's theta function actually represent the number of lattice vectors of a specific length. Therefore this property reveals the connection to the definition of P(L ). Outline. The rest of the paper is organised as follows. In Sect. 2 we introduce notation and give some background about lattices. Section 3 includes some prior work on the set of relevant vectors. The definition of irreducible vectors is given in Sect. 4 along with the first results regarding this new notion. In Sect. 5 we mention theoretical as well as experimental results on computing a complete system of irreducible vectors. Section 6 provides some initial arguments about the link between the new notions defined and the study of lattice algorithms and problems.

Preliminaries
To fix notation, let B = { b 1 , . . . , b n } ⊂ R n be a set of linearly independent vectors, which we may also interpret as a matrix with columns b i . The lattice generated by B is defined as L = L ( B):={ B x : x ∈ Z n }. In this paper we deal with full rank lattices unless indicated otherwise. We assume that the reader is familiar with notions such as the volume Vol(L ):=| det( B)|, the successive minima λ i (L ):= min{max i x i | x 1 , . . . , x i ∈ L are linearly independent}, in particular the first successive minimum λ 1 (L ) = min v∈L \{ 0} v . We refer to [22] for further details on these basic notions.
Definition 1 (First shell) Let L be a lattice. We define We call S 1 (L ) the first shell of L .
The following two well known concepts will be of major importance for our work, so we define them explicitly.
Definition 2 (Voronoi cell) The Voronoi cell V (L ) of a full rank lattice L is the set of points in R n which are closer to the origin than to any other lattice point, i.e.
If it's clear what L is, we may use V instead of V (L ). Closely related to the Voronoi cell of the lattice is the set of relevant vectors.

Definition 3 (Relevant vectors) Let
Let B( x, r ):={ y ∈ R n | y − x ≤ r } denote the closed n-dimensional ball with center x and radius r . Finally we have the kissing number τ n , defined as the maximum number of equal n-dimensional spheres that can be made to touch another central sphere of the same size without intersecting. See [22] for an overview of the main hard lattice problems that we will consider in this paper, namely the Shortest Vector Problem (SVP), determining the kissing number, the Shortest Independent Vector Problem (SIVP), and the Closest Vector Problem (CVP) and its Preprocessing variant (CVPP).

Previous work
In this section we give an overview of known results on the set of relevant vectors. This is done for a matter of completeness but also in order to indicate what kind of results we would like to obtain for the set of irreducible vectors which we will define later. For to relate the Voronoi cell of a lattice to its relevant vectors.

Proposition 1 (Relevant vectors)
Let L be a full rank lattice in R n . The set of relevant vectors R(L ) is the minimal set L ⊂ L such that In order to get a more practical description of the relevant vectors the following theorem is used.
Theorem 1 (Identifying relevant vectors [35]) Let L be a full rank lattice in R n and v ∈ L \ { 0}. Then v ∈ R(L ) if and only if 0 and v are the only closest vectors of L to 1 2 v. This implies that

Remark 2
The condition v, x < x 2 needs to be checked only for x ∈ L \ { 0} such that x < v , because otherwise it is trivially true.
For checking if a vector is relevant, the following lemma is useful.
Lemma 1 (Identifying non-relevant vectors [23]) Let L be a full rank lattice in R n , and v Also a lower bound for the set R(L ) can be obtained by the following trivial lemma.
Lemma 2 (All shortest vectors are relevant) Let L be a full rank lattice in R n . It holds that Equality in the above lemma holds for a very special type of lattices called root lattices (see [8,Chapter 4]).
Theorem 2 (Root lattices [29]) The following theorem by Minkowski gives an upper bound on the size of R(L ).
Apart from an upper bound we can also obtain a lower bound on | R(L )|.

Remark 3
For the lattice Z n it is true that |R(Z n )| = 2n (see [8]). As the set R(L ) needs to have n linearly independent vectors in order the volume of V (L ) to be finite then 2n ≤ | R(L )| is a tight lower bound.

The set of irreducible vectors
Inspired by number theoretic notions of (multiplicative) irreducibility, we introduce a similar concept for lattices (additively structured).
For the special case k = 2, v will be just called irreducible.

Remark 4
The definition of k-irreducible vectors implies that if a vector is k-irreducible then it is also (k − 1)-irreducible. This observation allows the construction of a chain of subsets based on the notion of irreducibility.
In this work we are going to focus on the properties of 2-irreducibility. Further research on the notion of k-irreducibility for k > 2 is left for future research.
Definition 5 (Set of irreducible vectors) Let L be a full rank lattice in R n . We define The above properties hold for the set of relevant vectors as well and this is not a coincidence as we will see. First we show that this set is not empty, and indeed that it also contains vectors achieving the first successive minimum.
Lemma 3 (Shortest vectors are irreducible) Let L be a full rank lattice in R n . It holds that: As v ∈ S 1 (L ) this implies that v i < λ 1 (L ) and thus v i = 0. Hence, we get v 1 = v 2 = 0, which contradicts v = 0.

Remark 6
It can be easily checked that Lemma 3 would still hold under the notion of kirreducibility for k > 2. Therefore we can conclude that k-irreducibility is not leading to a trivially empty set of vectors for k > 2. One may expect that it will also include a lattice basis.
We show that something similar occurs for the rest of the successive minima as well.
Definition 6 (Sublattice spanned by short vectors) Let L be a full rank lattice in R n and 1 ≤ i ≤ n. We define L λ to be the sublattice spanned by all the vectors in L with norm strictly less than λ. Proposition 4 (Identifying irreducible vectors) Let L be a full rank lattice in R n , and v ∈ L Proof It has been already proven in Lemma 3 that this is true for i = 1 so we can consider Remark 7 Proposition 4 points out that a lattice vector achieving a successive minimum is not necessarily irreducible. An enlightening example of such an occasion is the following. Consider the lattice L = L ( B) generated by the matrix Then but v is not irreducible as it can be written as a sum of shorter lattice vectors i.e. v = (6, 0, 0) + (0, 8, 0). The reason why v fails to be irreducible is that it belongs to the sublattice L λ 3 . Proof By Proposition 4 it suffices to show that for every i = 1, . . . , n there exists a vector v ∈ L such that v = λ i (L ) and v / ∈ L λ i . Assume that for every vector v ∈ L such that v = λ i (L ) for some fixed 2 ≤ i ≤ n it holds that v ∈ L λ i . For convenience we define λ 0 (L ) = 0. Let k be min 1≤ j≤i j such that λ j (L ) = λ i (L ) and therefore λ k−1 (L ) < λ k (L ) = λ i (L ). Then L λ i has rank k − 1 as λ k−1 (L ) < λ k (L ). If k − 1 = 0 then we are done as this would imply v = 0. If k − 1 ≥ 1 then v belongs to the sublattice containing all the shorter vectors than it, L λ i and this sublattice is of rank k − 1. Thus any choice of k − 1 vectors such that max{ v 1 , . . . , v k−1 , v } = v will result in a linearly dependent set. Hence it cannot be that λ k (L ) = v , contradiction.
Apart from vectors reaching the successive minima, it can be shown that the set Irr(L ) contains a generating set of the lattice as well.
Proposition 5 (Irreducible vectors generate the lattice) Let L be a full rank lattice in R n . There exists a generating set G of L such that G ⊆ Irr(L ).
Proof We will prove that the set Irr(L ) spans the lattice and therefore it includes a generating set.
If the v i ∈ Irr(L ) then we are done. If not then further reduce the vectors v i such that they are written as a sum of two strictly shorter vectors. As in each step the length of the vectors strictly reduces and there is a finite number of lattice points in B( 0, v ), after a finite number of steps we will reach a state where v = p i and p i ∈ Irr(L ). This concludes the proof.
Given the result of Proposition 5 the following conjecture can be formulated.

Conjecture 1
Let L be a full rank lattice in R n . The set Irr(L ) contains a basis of L . 1 Our next goal is to derive some more explicit descriptions of the set Irr(L ). Lemma 4 (Characterizing the set of irreducible vectors) Let L be a full rank lattice in R n . It holds that and v ∈ L with v < p . Then as p ∈ Irr(L ) we get p − v ≥ p because otherwise p would have a decomposition into two shorter vectors, thus p ∈ A. This gives 1 ≥ v and hence we do not get a decomposition of v in two shorter vectors. If v 1 ≥ v this is trivially true. Thus v ∈ Irr(L ). This implies equality (10) and equality (11) is an immediate consequence. This concludes the proof.
Even though this lemma is rather straightforward it implies an interesting result for the set Irr(L ).
Proposition 6 (Irreducible vectors are relevant) Let L be a full rank lattice in R n . Every irreducible vector of L is also a relevant vector of L , hence: Proof As we already saw by Theorem 1, we can write the set R(L ) as R v}} and we can further improve that description to For the set of irreducible vectors we got from Lemma 4 that Thus by carefully checking these two descriptions for the sets R(L ) and Irr(L ) it suffices to If v, x ≤ 0 this is trivially true as x = 0. Also if v, x > 0 then v, x < 2 v, x and the result follows.

Remark 8
Combining the result of Lemma 3 and Proposition 6 we get that S 1 (L ) ⊆ Irr(L ) ⊆ R(L ). Therefore Irr(L ) is finite.
We already saw that for the case of root lattices it holds that S 1 (L ) = R(L ). This implies that for the root lattices it also holds that S 1 (L ) = Irr(L ) = R(L ). Thus, the sets S 1 (L ) and R(L ) are tight inclusions of Irr(L ).
We expect that in general though it will hold S 1 (L ) Irr(L ) R(L ). A question that might be of interest is when and if S 1 (L ) = Irr(L ) R(L ) or S 1 (L ) Irr(L ) = R(L ) are possible.
We believe that lattices satisfying either of these properties will be very special and highly symmetric. The reason why we believe this, is that some already well known very special families of lattices satisfy these properties. Namely, in Appendix A we will prove the following two theorems.
Theorem 6 (The root lattices A * n ) Let n ∈ N with n ≥ 3. Then for the lattice A * n it holds that Additionally the famous Leech lattice Λ 24 [8, p. 131] satisfies the property S 1 (Λ 24 ) = Irr(Λ 24 ) R(Λ 24 ). We will actually be able to prove in the next subsection that for every lattice that reaches the kissing number τ n it holds that S 1 (L ) = Irr(L ).

A complete system of irreducible vectors
The special family of lattices D * n indicates that the set Irr(L ) can become as big as R(L ) and actually grow as much in size as 2 n . However, our goal is to obtain a subset of Irr(L ) which is closely related to it but also provably smaller than 2 n . Definition 7 (Equivalence relation on Irr(L )) Let L be a full rank lattice in R n . We define an equivalence relation on Irr(L ) in the following way.
From each equivalence class we will consider at least two representatives. We choose them in the following way and we will explain afterwards why.  (13) we choose a subsetS ⊆ S such that the following two conditions hold: The main motivation is that the new set of vectors which will be built under these rules will include irreducible vectors whose pairwise angle is "big" as we will prove later. However, there are several details of this definition which should be clarified. First of all, from the definition it follows that for an equivalence class we consider at least two representatives, which is not usually done. The reasons for this are the following. Initially, for the subset of Irr(L ) which we are trying to define, we would like it to inherit the property of Irr(L ) that if v belongs to it then also − v belongs to it. A second, more important reason is that choosing only one representative per equivalence class could lead to a set that does not even span the lattice (for example in the case of root lattices, or whenever S 1 (L ) = Irr(L )).
The second condition of the definition implies that for every element v of a class S which is not included inS there exists a vector˜ v ∈ L such that v −˜ v < v . From this point of view the remaining elements of a class S which are not included inS can be generated by the elements ofS plus some strictly shorter vector. In order to ensure that this holds we takẽ S to be maximal. Also by takingS to be maximal we make sure that the setS contains as much information about the class as possible.

Remark 9
Choosing a representative setS of a class S can be translated into a graph problem. We define a graph where the set of vertices is the equivalence class, and there exists an edge between two vertices iff the difference of the corresponding vectors is strictly shorter than both of them. Then choosing a set of representatives translates to finding a maximal subset of vertices that are not adjacent, while keeping the symmetry about 0. In terms of graph theory this can be phrased as finding a special independent set of the graph. This idea is further analysed in Appendix B.
Definition 9 (Complete system of irreducible vectors) Let L be a full rank lattice in R n . We define a set P ⊆ Irr(L ) to be a complete system of irreducible vectors of L if it is of the form: Remark 10 Below we denote by P(L ) any one of the complete systems of irreducible vectors of L . It is clear that there always exists such a set P(L ) and it is not necessarily unique. In fact, even the size of P(L ) can vary.

Remark 11
By the fact that for each class S of Irr(L )/∼ we haveS ⊆ S we get that P(L ) ⊆ Irr(L ). Also the class of Irr(L )/∼ containing all the shortest vectors i.e. S 1 (L ) will be entirely included in P(L ) as any pairwise sum of vectors (for non-trivial pairs) in this class will be longer or equally long by definition. Thus we can conclude that We will also give an example in order to illustrate this definition.
Example 1 Let L = L ( B) be the lattice generated by the columns of the matrix We find the sets S 1 (L ), P(L ), Irr(L ), R(L ).
In fact B is an LLL-reduced basis [20] of the lattice. By means of enumeration one could verify that S 1 (L ) = {±(0, −1, 0, 1, 0)}. By running an algorithm that computes the set of relevant vectors like [34] in SAGE [9] we get (each line has vectors of equal norm). The next step is to find the set of irreducible vectors Irr(L ). We consider the subset of R(L ) containing relevant vectors which cannot be written as a sum of two strictly shorter vectors (by cross-checking with the set of relevant vectors). It turns out that this set just contains all the vectors achieving the successive minima thus it must be that this is Irr(L ).
The set Irr(L ) contains 5 equivalence classes according to the equivalence relation (13). We denote them by C i for i = 1, . . . , 5. As we can see for the first three of them, computing a set of representativesC 1 ,C 2 ,C 3 is trivial as in these cases it will beC 1 = C 1 ,C 2 = C 2 Fig. 1 The graph of the class C 5 Fig. 2 The graph of the class C 4 andC 3 = C 3 . The cases of C 4 and C 5 are more interesting. We start by examining C 5 as it contains less vectors. We set v 1 = (3, 1, 0, 0, 1) and v 2 = (3, 0, 0, 1, 1). Next we draw the corresponding graph with vertices the ± v 1 , ± v 2 and edges if the pairwise differences are strictly shorter than v 1 . The graph in Fig. 1 shows that we can take eitherC 5 We are now going to do the same for the class C 4 . We The graph in Fig. 2 shows that we can takeC 4 = {± v i } for any i = 1, 2, 3, 4. Therefore one choice for the set P(L ) is the following.

Remark 12
The above example should not mislead the reader to the assumption that the corresponding graph of each equivalence class will always have at least two connected components. It can happen that the graph of a class is connected. One such example can be derived from the family of lattices examined in Theorem 10.
One property of the set Irr(L ) was that it includes a generating set of L . We can show that P(L ) inherits that property.
Proposition 7 (Complete system generates the lattice) Let L be a full rank lattice in R n . Then for every P(L ) ⊆ Irr(L ) there exists a generating set G of L such that G ⊆ P(L ).
Proof As in the proof of Proposition 5 for the set Irr(L ) we will prove that the set P(L ) spans the lattice and therefore it includes a generating set. However, in this case the proof is more technical. Let P(L ) be a complete system of irreducible vectors of L as defined in (14). We have already shown that Irr(L ) is finite as Irr(L ) ⊆ R(L ) and thus we can define t:=| Irr(L )/∼|. We further set C i for i = 1, . . . , t to be the equivalence classes in Irr(L )/∼. Hence, the set P(L ) can be written as P(L ) = ∪ t i=1C i . Each equivalence class C i contains all irreducible vectors of a specific length μ i , and we can assume that we have ordered the C i according to increasing μ i . We define the following sequence of subsets of Irr(L ): As for every i it holds thatC i ⊆ C i then it follows that A i (L ) ⊆ A i+1 (L ) and thus We will prove by induction that each term of this sequence of sets spans the lattice L .
The set Irr(L ) = A t+1 spans the lattice as it was already shown in Proposition 5.
Induction hypothesis Assume that it holds for some i = k, i.e. A k spans the lattice for some k ∈ {2, . . . , t + 1}. Induction step Prove that A k−1 spans the lattice. By the definition of the sets A i we can conclude that . By the induction hypothesis it suffices to show that the vectors in C k−1 \C k−1 can be generated by the vectors in As Furthermore as w < v then w is either irreducible or can be written as a sum of irreducible vectors shorter than v . We use the ordering of the C i . Thus by its definition the set A k−1 contains all the vectors in Irr(L ) which are shorter than v . Hence as, w < v this implies that w can be generated by the vectors in Proposition 8 (Properties of complete system) Let L be a full rank lattice in R n , and p 1 , p 2 ∈ P(L ) such that p 1 = ± p 2 . Then it holds that Proof (Part i) By Lemma 4 we have that Let p 1 , p 2 ∈ P(L ) such that p 1 = ± p 2 . Without loss of generality we assume that p 2 ≤ p 1 . Initially we will prove that p 1 + p 2 ≥ max{ p 1 , p 2 }. Case 1 If p 2 < p 1 . Then p 1 , p 2 ∈ Irr(L ) and they are not in the same class. Using the description of Lemma 4 with v = p 1 ∈ Irr(L ) and x = − p 2 we get p 1 + p 2 ≥ p 1 . But as p 2 < p 1 we can conclude that p 1 + p 2 ≥ max{ p 1 , p 2 }. Case 2 If p 2 = p 1 . Then p 1 , p 2 ∈ Irr(L ) and they are in the same class. Let S ∈ Irr(L )/∼ such that p 1 , p 2 ∈ S. Then as p 1 , p 2 ∈ P(L ) we get that p 1 , p 2 belong to the samẽ S. Thus, by the definition ofS we can again conclude that p 1 + p 2 ≥ max{ p 1 , p 2 }. The result follows from the fact that for every v ∈ P(L ) also − v ∈ P(L ). (Part ii) Let p 1 , p 2 ∈ P(L ) such that p 1 = ± p 2 . Without loss of generality we assume that p 2 ≤ p 1 . By part (i) we get that p 1 ± p 2 ≥ p 1 . This in turn implies that 2| p 1 , p 2 | ≤ p 2 2 . Hence, We will use the following theorem in order to bound | P(L )|.
Theorem 7 (Upper bound on kissing constant [18]) Let A(n, φ 0 ) be the maximal size of any set C of points in R n such that the angle between any two distinct vectors Proposition 9 (Upper bound on | P(L )|) Let L be a full rank lattice in R n . It holds that | P(L )| < 2 0.402n .
Proposition 8 states the same condition that is also satisfied by the output of the GaussSieve algorithm described in [24]. As in the paper describing the GaussSieve algorithm [24] the size of P(L ) can actually be bounded by the kissing number τ n . Following the same arguments as in [24] we can argue that in practice we expect P(L ) ≈ 2 0.21n which is a factor 2 smaller in the exponent than the provable bound | P(L )| < 2 0.402n .
A result that might be of interest in the search for lattices reaching the kissing number is the following.
Theorem 8 (Lattices achieving the kissing number) Let L be a full rank lattice in R n . If the lattice L is such that it reaches the kissing number τ n then S 1 (L ) = Irr(L ).
Proof As the lattice L reaches the kissing number τ n , that implies |S 1 (L )| = τ n . By Proposition 8 we can conclude that the angle between any two vectors in P(L ) is at least π/3. This is also the minimal possible angle between the centers of two equal n-dimensional spheres which touch another central sphere of the same size without intersecting. Hence | P(L )| ≤ τ n . Combining this with S 1 (L ) ⊆ P(L ) and |S 1 (L )| = τ n implies that P(L ) = S 1 (L ). As the set P(L ) was build from classes of Irr(L ) and we showed that it actually contains only vectors of norm λ 1 (L ) that means that there is only one class in Irr(L )/∼, namely the class of S 1 (L ). But in this class there is no pair of vectors that adds to a shorter one, thus the whole class is included in P(L ). That implies that Irr(L ) = P(L ) = S 1 (L ).

Remark 13
A similar result for the set R(L ) is not possible. For example for the root lattice E 8 reaching the kissing number in dimension 8 it holds that S 1 (E 8 ) = R(E 8 ) but for the Leech lattice Λ 24 it holds that S 1 (Λ 24 ) R(Λ 24 ) (see [8]).

Computation of the set P(L )
In the previous sections we investigated some properties of the set P(L ) and its relation to the set R(L ). Ultimately we aim for using it in the study of lattice problems instead of R(L ) due to its provably smaller cardinality (see Sect. 6). However, in order to actually benefit from this replacement an algorithm that computes P(L ) without using the set R(L ) is needed. The goal of this section is to examine ways of computing the set P(L ).

The "brute force" approach
If the set Irr(L ) is given then the set P(L ) can be computed by means of a graph-based technique already described in Remark 9 and further analysed in Appendix B. Thus, it suffices to describe an algorithm which computes the set Irr(L ). The naive approach is to use the fact that Irr(L ) ⊆ R(L ). Hence, as a first step one can run the algorithm described in [23] in order to get the set R(L ). Then having a superset of Irr(L ) it suffices to remove all the reducible vectors from it. This can be done by iterating through R(L ) and checking for each r ∈ R(L ) if there exists a v ∈ R(L ) such that v < r and r − v < r . If r ∈ Irr(L ) then by definition there will not exist a vector v ∈ L such that v < r and r − v < r and thus the algorithm will not discard any of the irreducible vectors. If the vector r is reducible then we need the following heuristic assumption.

Assumption 1 (Witness of reducibility) Let
Heuristic assumption 1 can be considered as the analogue of Lemma 1 for the set Irr(L ). Lemma 1 guaranteed that for every non-relevant vector there would exist a relevant vector acting as a "witness" of "non-relevancy". Heuristic assumption 1 speculates that for every reducible relevant vector there exists a relevant vector acting as a "witness" of reducibility. This claim can be further supported by the heuristic expectation for the set R(L ) to include most of the "short" lattice vectors. Some experimental support can be derived for low dimensional lattices from Table 1 and Fig. 3(a).

Remark 14 Under
Heuristic assumption 1 and the result of [23] on computing the set R(L ) we can conclude that computing the set Irr(L ) by "brute-force" can take up toÕ(2 2n )-time andÕ(2 n )-space. This complexity can serve as an upper bound on the computation of the set Irr(L ). Combining this observation with the discussion in Appendix B can give an upper bound in the complexity of computing P(L ). Namely, for lattices which are not extremely structured (i.e. max S∈Irr(L )/∼ |S| = poly(n) ) we can conclude that computing P(L ) from Irr(L ) can take O(poly(n)| Irr(L )|) time. Therefore the computation of Irr(L ) dominates the time complexity, leading to an overall upper bound for P(L ) ofÕ(2 2n )-time.
However the approach in the next section could offer a better performance.

Using the GaussSieve/MinkowskiSieve algorithms
As it was already mentioned in Sect. 4.2, it is expected that the output of the GaussSieve algorithm [24] will be closely related to a set P(L ). This expectation was motivated by the fact that both sets, P(L ) and the output of the GaussSieve, possess the property min{ v 1 ± v 2 } ≥ max{ v 1 , v 2 } for any pair of v 1 = ± v 2 in the set. At this point it should be clarified that for our purposes we will consider a slightly modified version of the GaussSieve algorithm which will be described here. 2 For our purposes we will use the GaussSieve algorithm 5.2 but with the modified version of the GaussReduce function 2. In this way the following conditions are met.

Algorithm 1
The GaussSieve algorithm as described in [24] Require: A basis B of a lattice L ( B) and a c > 0. while S.push( v i ± p) 8: end while 9: return p 10: end function (i) Any irreducible vector which has been added to the GaussSieve list L will never be removed from it. (ii) Any irreducible vector encountered by the algorithm will be added to L provided that it can extend its class representative set already in L. Thus the algorithm should encounter another vector v i ∈ L such that v i ≤ p and p ± v i < p . The case where v i < p and p ± v i < p violates the irreducibility of p and thus can be disregarded. This leaves only one possible case, namely v i = p and p ± v i < p . This condition implies that v i and p belong to the same equivalence class and they are adjacent. Therefore this pair of vectors cannot belong to any set P(L ) of L . Hence p should not be included in L anyway and the algorithm correctly further reduces it.

Remark 15
If the PrimeGaussReduce function in line 5 was the same as in the original GaussReduce, then the algorithm could encounter an instance where it would enter the loop . This could be possible if an equivalence class in Irr(L ) was not trivial. In this case the algorithm would remove the vector v i from the list and add its equivalent v i − p to S. As a result for these non-trivial classes the algorithm could behave in a bad way by repetitively removing and adding representatives of the same class.

Remark 16
If the PrimeGaussReduce function in line 2 was the same as in the original GaussReduce, then the algorithm could encounter an instance where it would enter the loop with v i ≤ p , p− v i = p and p, p− v i ∈ Irr(L ). Thus, p and p− v i are equivalent. In case v i < p then p and p − v i are also adjacent in the class graph and therefore in this case the algorithm would cycle through the adjacent vectors of p. Therefore there is no need to perform a reduction in this case. In case v i = p then all three p, v i , p − v i are equivalent but not adjacent. Hence in this case the algorithm does not make any progress by replacing p by p − v i . Thus, there is no need to perform a reduction in this case as well. 3 We consider the GaussSieve algorithm 5.2 equipped with the PrimeGaussReduce function (Algorithm 2). As stated in the description of GaussSieve algorithm 5.2, it terminates after reaching a number of c "collisions" (i.e. reductions to the zero vector). If for one run of the algorithm we let c tend to infinity then its list L will converge to a specific list of vectors as output. We denote by GaussSieve(L ) such a list of vectors created by GaussSieve and possessing the property that it cannot be further modified by the algorithm. In the sequel, when we will refer to the convergence of the output of a sieving algorithm, it will be according to this notion of convergence.
In order to relate the sets GaussSieve(L ) and P(L ) we give the following definition.
Definition 10 (Partitioning P(L ) by sign) Let L be a full rank lattice in R n . Given a P(L ) ⊆ Irr(L ) we define P + (L ) and P − (L ) to be a partition of P(L ) according to sign.
In other words, we take for P + (L ) some subset of P(L ) such that of each pair ± v ∈ P + (L ) exactly one is in P + (L ). Of course, there are many choices for P + (L ) and P − (L ), any one will do.
Even though the output of GaussSieve converges to a set which is maximal in L under the property min{ v 1 ± v 2 } ≥ max{ v 1 , v 2 }, the same is not true in general for the set P + (L ) as shown by experiments (Table 1). In particular, we can conclude by Lemma 5 that if we allow this modified version of the GaussSieve to run long enough i.e. it samples "enough" vectors, then the output will converge to a set GaussSieve(L ), which will contain a P + (L ).
Hence we cannot claim that the output of GaussSieve converges to a set P + (L ) but only to a superset of it. The fact that a P + (L ) is not maximal in L under the property min{ v 1 ± v 2 } ≥ max{ v 1 , v 2 } implies the existence of vectors which are not irreducible but they also cannot be reduced by any of the vectors in P(L ).
The definition below of the set P 2 (L ) will help us in bounding the output of the GaussSieve algorithm. Also, the definition of the sets P k (L ) for k > 2 will help us in bounding the output of modified versions of "higher" sieving algorithms like the Triple and Quadruple MinkowskiSieve, described in [3].
Definition 11 (Pairwise irreducible system) Let L be a full rank lattice in R n . Given a P(L ) ⊆ Irr(L ) we define A first remark on this definition is that as P(L ) ⊆ L also P(L ) ⊆ P 2 (L ). The output of the (modified) GaussSieve converges to a set GaussSieve(L ) including a set P + (L ). Therefore, every v ∈ GaussSieve(L ) cannot be reduced by any p ∈ P + (L ) and as GaussSieve(L ) ⊆ L we can conclude that GaussSieve(L ) can be bounded as follows: Under this set inequality GaussSieve(L ) can be viewed in the following way. A set GaussSieve(L ) can be considered as the closure of a P + (L ) in P 2 (L ) under the property of Gauss-reduction. In more detail GaussSieve(L ) can be viewed as the minimal (according to included vector norms) subset of a P 2 (L ) including P + (L ) and being a maximal subset of P 2 (L ) with the property of Gauss-reduction (i.e. min{ v 1 ± v 2 } ≥ max{ v 1 , v 2 }).

Remark 17
It is unclear if the set P 2 (L ) is a finite or an infinite set.
Definition 12 (k-wise irreducible system) Let L be a full rank lattice in R n and k ∈ N with k ≥ 2. Given a P(L ) ⊆ Irr(L ) we define and P (1) (L ):= P(L ).
Lemma 6 (Relating k-wise irreducible systems) Let L be a full rank lattice in R n and P(L ) be a subset of Irr(L ). Then for the sequence P k (L ) given in Definition 12 it holds that So, in one line: Proof First of all, as we chose a random but fixed P(L ) ⊆ Irr(L ) the sets P k (L ) are well-defined. Part (i) of the lemma is an immediate consequence of the definition of P k (L ).
Initially we show that Irr(L ) ⊆ P k (L ) for every k ≥ 2. This follows directly by the definition of P k (L ) and the fact that P (k) (L ) ⊆ L . By the (recursive) definition of P k (L ) it follows that it includes all vectors v ∈ L such that they can not be reduced by any shorter vector in ∪ k−1 i=1 P (i) (L ). Thus for part (ii) of the lemma it suffices to show that lim k→∞ ∪ k i=1 P (i) (L ) = L . As P (i) (L ) ⊆ L for every i ≥ 1 it follows that lim k→∞ ∪ k i=1 P (i) (L ) ⊆ L . It is only left proving the converse inequality. Let v ∈ L , it suffices to show that ∃k ≥ 1 such that v ∈ P (k) (L ).
A vector v ∈ L can be repeatedly reduced as in the proof of Proposition 5 until it is written as a sum v = l i=1 p i of shorter vectors p i ∈ Irr(L ) for some l ≥ 1. This decomposition satisfies the recursive condition implied by the definition of the P (k) (L ). If all the vectors p i ∈ Irr(L ) actually belong to P(L ) then v ∈ P (l) (L ) and we are done. If there exists some p i ∈ Irr(L ) \ P(L ) then p i =˜ p i + p i where˜ p i ∈ P(L ) and p i < p i , p i = ˜ p i by the definition of P(L ). Thus, p i can be further get decomposed into shorter vectors (like v) and as p i < p i progress was made which implies that this decomposition will finish after finitely many steps as there is a finite number of lattice points in B( 0, v ). Therefore v can be repeatedly reduced until it is written as a sum of vectors in P(L ), concluding the proof.
We are now going to describe the "higher" sieving algorithms which we will consider. We have already mentioned the Triple and the Quadruple MinkowskiSieve described in [3]. The difference between the GaussSieve algorithm and these higher ones lies in the reduction function. Hence, if we equip Algorithm 5.2 with function PrimeMinkowskiReduce (Algorithm 3), we get the modified MinkowskiSieve which we are interested in.
The modification compared to the description in [3] appears in lines 10 and 21 of Algorithm 3, where the extra conditions w ≤ p and w < v k−1 respectively are added. By adding these conditions it is guaranteed to get an output list which will satisfy properties (i) and (ii) like in Lemma 5 for the GaussSieve. Hence, based on these properties it can be concluded that the output list of vectors will again contain a set P + (L ). In order to ease our exposition we set the following notation.
Let k ∈ N with k ≥ 2. We consider the k-MinkowskiSieve algorithm equipped with the function PrimeMinkowskiReduce (Algorithm 3). We denote by MinkowskiSieve k (L ) a list of vectors L created by this algorithm and possessing the property that L cannot be further modified by the algorithm. Note that for k = 2 one has MinkowskiSieve 2 (L ) = GaussSieve(L ).

Remark 18
The output of the modified k-MinkowskiSieve algorithm will not be a list of vectors which will be k-Minkowski-reduced if k > 2 (for the Minkowski-reduced definition see [27]). If this was desired, then the lines 10 and 21 of Algorithm 3 should be modified in order to allow reductions by longer vectors as well. For a k-Minkowski-reduced list with k > 4 lines 9,10 and 20,21 of Algorithm 3 should also allow for the coefficients of the vectors v i , p and v k−1 to take more values than ±1 (see for example [27, Theorem 2.2.2]).
The "higher" sieving algorithms which we considered by making the generalisation from the GaussSieve towards the MinkowskiSieve will contribute towards an asymptotic computational argument. But first we state a heuristic assumption which we will use. Assumption 2 (Convergence of the MinkowskiSieve) Consider the k-MinkowskiSieve algorithm equipped with the function PrimeMinkowskiReduce (Algorithm 3). Then the output of this algorithm will converge to a set MinkowskiSieve k (L ).

Remark 19
Heuristic assumption 2 actually claims that the k-MinkowskiSieve does not diverge or enter an infinite loop. The experimental results in Sect. 5.3 (see Fig. 3) indicate that for k ∈ {2, 3, 4} this seems to be a valid assumption. However, this is the only argument we have in favour of this assumption. We leave the investigation for concrete arguments supporting this heuristic assumption as an open problem for future research. if k > 2 then 6: PrimeMinkowskiReduce( p, L, S, k − 1) 7:  Proof In order to simplify the proof and avoid ambiguities we make the following convention. Both sets P + (L ) and MinkowskiSieve k (L ) are defined/constructed in such a way that for a vector v only one of ± v belongs to the set. This allows many possible choices for these sets. In order to avoid this kind of ambiguities we make the convention that a vector v is included in the aforementioned sets only if its first non-zero coordinate is positive.
Initially we will prove that for every k ≥ 2 there exists a set P + (L ) and a set P k (L ) such that Let k ≥ 2 and MinkowskiSieve k (L ) be the converging set of an execution of the k-MinkowskiSieve. As mentioned before, we can transfer Lemma 5 from the case of GaussSieve to the k-MinkowskiSieve algorithm described in this section. This implies that for every MinkowskiSieve k (L ) there will exist a set P + (L ) such that P + (L ) ⊆ MinkowskiSieve k (L ). We fix this set P + (L ).
Let v ∈ MinkowskiSieve k (L ) and p 1 , . . . , p k−1 ∈ P + (L ) with p i < v . As the set MinkowskiSieve k (L ) is k-reduced according to the notion implied by Algorithm 3 we can conclude that v cannot be reduced by any vector of the form l i=1 (−1) a i p i for 1 ≤ l ≤ k −1. As the vectors p 1 , . . . , p k−1 belong to the set MinkowskiSieve k (L ) as well, they are k − 1-reduced. This in turn implies that the vectors of the form l i=1 (−1) a i p i belong to the set P (l) (L ) for 1 ≤ l ≤ k − 1. This holds for any tuple of l vectors in P + (L ). Hence, the set of vectors emerging from the union of all { l i=1 (−1) a i p i } will be exactly P (l) (L ). This implies that v cannot be reduced by any vector in ∪ k−1 i=1 P (i) (L ). This is equivalent to the condition a vector v has to satisfy according to definition 12 in order to belong to P k (L ). Thus we can conclude that MinkowskiSieve k (L ) is included in the P k (L ) implied by the set P(L ) = P + (L ) ∪ (− P + (L )). This concludes the first part of the proof.
For the second part of the proof we distinguish between the cases of Irr(L ) = P(L ) and Irr(L ) = P(L ). If it holds that Irr(L ) = P(L ) then apart from P(L ) being uniquely determined the same holds for the sets P k (L ). Hence, for every k ≥ 2 the boundary sets in (17) are uniquely determined. This enables a direct use of Lemma 6. As k increases the set MinkowskiSieve k (L ) will be contained to even smaller and smaller sets P k (L ) which converge to Irr(L ) according to (i) and (ii) of Lemma 6. Therefore for the limit case it could be stated that But we assumed Irr(L ) = P(L ) and thus we can conclude that lim k→∞ MinkowskiSieve k (L ) = P + (L ).
In order to finish the proof we have to deal with the case Irr(L ) = P(L ). In this case, the sets P + (L ) and P k (L ) used in inequality (17) are not uniquely determined and therefore Lemma 6 cannot be used directly. In Lemma 6 it was shown that given the sequence of P k (L ) implied by any P(L ) then lim k→∞ P k (L ) = Irr(L ). Hence any P k (L ) belongs to a sequence converging to the same limit, Irr(L ). Interchanging terms (P k (L )) among these sequences does not affect their limit. Therefore, we can again use inequality (17) and "take limits" leading to a result like (18). We have to be careful though. The right hand-side limit (i.e. Irr(L )) is well-defined but the left one can cycle over all choices of P + (L ). This is expected as the limit of the sequence MinkowskiSieve k (L ) as k → ∞ is not unique but depends on the choice of representatives made for each non-trivial class of vectors. For convenience we assume that ∀k > k 0 for some k 0 this choice stabilises to some random but fixed choice. Thus, we have again reached inequality (18).
We examine the sets in inequality (18) according to the Gauss-reduced property. Let k ≥ 2, the set MinkowskiSieve k (L ) is a set in which the output of the algorithm converges to and also possesses the Gauss-reduced property by construction. This holds for every k ≥ 2 and thus transfers to the limit as well, as k → ∞. The set P + (L ) is not a maximal subset of L satisfying the Gauss-reduced property but due to its construction it is maximal in the set Irr(L ). Hence, inequality (18) and maximality of P + (L ) in Irr(L ) imply the result.
The conclusion in Theorem 9 is supported by the experimental results given in Table 1.

Remark 20
Theorem 9 describes asymptotic behaviour of the modified MinkowskiSieve algorithm with the goal of providing a faster way of computing sets P + (L ). Even though, asymptotically, the algorithm possesses the desired behaviour, this does not make it immediately a computational tool for P + (L ). There are two obstacles towards that goal. The first one is, given a lattice L in dimension n, to find for which k ≥ 2 to run k-MinkowskiSieve. This k should not be too high in order to be computationally efficient to run the algorithm. The second problem is finding for how long this k-MinkowskiSieve should run in order to approximate well enough a set MinkowskiSieve k (L ).

Experimental results
In this section we provide some experimental results which support our claims in the previous subsections. In particular, as a first step we computed the sets R(L ), Irr(L ), P(L ) for 10 lattices in dimension 20 and afterwards we computed the output of the GaussSieve, the Triple and the Quadruple MinkowskiSieve. In order to generate 10 lattices in dimension 20 we used the Sage computer algebra system [9]. In particular we used Sage's "Hard lattice generator" with the following choice of parameters, sage.crypto.gen_lattice(type='random', n=1, m=20, q=10ˆ42, seed=seed) and 10 different values of seed. Initially, using the OpenMP parallel implementation build for the projects [5,13] we computed the set of relevant vectors R(L ) for each lattice. On top of this code (which the authors were so kind to provide us) we implemented the method described in Sect. 5.1 and computed the set Irr(L ). As for our experiments the lattices used were generated randomly, they did not possess any specific structure and hence P(L ) = Irr(L ) for all of them. This part of the experiments was performed on a node of the Lisa cluster [32] with a 16-core CPU (2.10GHz) and 96 GB of RAM. The computation of the sets R(L ) and Irr(L ) using the aforementioned implementation and hardware took about 5.5 seconds per lattice.
Finally, by modifying the already existing sieve implementations in FPLLL [33] we computed the output of the GaussSieve, Triple and Quadruple MinkowskiSieve as described in Sect. 5.2 for the same 10 lattices. The modifications which we made to the already existing FPLLL implementations were: -A vector is allowed to be reduced only by a shorter vector.
-The termination condition is changed to a fixed number of collisions: 5 · 10 5 for the GaussSieve and 10 5 for the Triple and Quadruple MinkowskiSieve. These numbers were chosen to ensure the created list by the algorithm remains unchanged for "many" iterations before the algorithm terminates. These choices seem to not be optimal according to our experimental data and could possibly be further reduced.
This part of the experiments was performed on a Lenovo X250 laptop with 4 Intel Core i3-5010U CPU (2.10GHz) and 8 GB of RAM. The output of these experiments is summarised in Table 1. Table 1 motivates a number of remarks about the involved sets. Initially, the number of relevant vectors observed was indeed close to the expected number 2 · (2 20 − 1). Also, the sets Irr(L ) and P(L ) were equal in all 10 cases, as we had assumed for random lattices without any underlying structure. The size of P(L ) (and Irr(L ) in this case) was observed to be some orders of magnitude smaller than the size of R(L ) making it more appealing to use in practice.
The right part of Table 1 justifies our idea to try and correlate the output of sieving algorithms with the set of irreducible vectors. Even though we cannot display here the lists of vectors which we computed but rather only their sizes, we observed the following behaviour. The list of vectors outputted by the GaussSieve contained the set P(L ) in 8 out of the 10 cases and in the other two of them there was only 1 vector missing. This supports our claim that the output of GaussSieve converges to a superset of P(L ). Also, as we moved to "higher" sieving algorithms like our modified version of the Triple and Quadruple MinkowskiSieve the output of the sieving algorithms approximated even closer the set P(L ). Actually, it is not a coincidence that the numbers in the columns "4-red" and "| Irr(L )|, | P(L )|" in Table 1 differ only by a factor of 2, since the output of the Quadruple MinkowskiSieve in all 10 cases gave exactly a set P + (L ) as for every vector v it stores only one of ± v. Table 1 The following tables describe the sizes of the lists involved in our experiments with 10 random lattices in dimension 20 Another question which could be investigated experimentally is how the expected size of P(L ) behaves as the dimension of L increases. In order to develop an intuition about this behaviour we performed a number of experiments in dimensions 20-65, the results of which are shown in Fig. 3. Likewise in our experiments in dimension 20 we used the modified OpenMP parallel implementation from [5,13] and the modified sieve implementations in FPLLL [33]. For each dimension we depict the average value amongst 10 lattices. However, as in this case we dealt with higher dimensions we reduced the number of collisions in the termination condition of the sieve algorithms to -GaussSieve: 10,000 collisions -Triple MinkowskiSieve: 2500 collisions -Quadruple MinkowskiSieve: 2000 collisions.
Therefore the results in Fig. 3 related to sieving algorithms should only be interpreted as approximations of the algorithm's converging set size. As we will discuss later, estimating the accuracy of this approximation is left for future research. Figure 3a illustrates the result of our experiments in dimensions 20-26. We believe that for these "smaller" dimensions the approximations are "more" accurate and that is why we show them separately. Another reason is that running the OpenMP Voronoi implementation beyond these dimensions has a substantial memory requirement (tens of GB).
Computing a least squares fit for the points in the blue curve (which indicates the correct expected values for | P(L )| under Assumption 1) gives the formula 2 0.237n+1.286 which reasonably matches the heuristic expectation for the size of P(L ), namely 2 0.21n . Furthermore Fig. 3a reveals that the GaussSieve gives only a superset of P(L ) even for small dimensions. The Triple and Quadruple MinkowskiSieve are much closer to the blue curve. The difference between the Triple and Quadruple MinkowskiSieve is that the one lies above the blue curve and the other below it. As we already observed in Table 1 the Triple MinkowskiSieve will probably remain above it. However the Quadruple MinkowskiSieve possess the potential to reach the "correct" curve asymptotically. Of course this could also be far from the truth for higher dimensions.
In order to put these curves more into perspective we created Fig. 3b which shows the average output sizes of the GaussSieve and Triple MinkowskiSieve for dimensions 20-65. We did not draw the curve of the Quadruple MinkowskiSieve as it also turns out to be quite time costly for dimensions higher than 30. At this point we must emphasize that the used modified sieving algorithms take more time in order to terminate due to the modifications which aim not in solving SVP but computing close approximations of P(L ). For instance the modified Triple MinkowskiSieve in dimension 65 took on average 3 days in order to terminate for each lattice. However this is only the average observed time. Actually one of the ten lattices used proved to be an "easier case", terminating in under 2 h.
Even though these results provide some intuition on what kind of relation it could be expected between the set of irreducible vectors and sieving algorithms, they also raise some questions.
A first question which would be interesting is examining the termination condition for the sieving algorithm. In our experiments we made a specific choice on the number of collisions but this was done by trial and error and could be possibly improved. In other words, we ask for a termination condition, which if it is satisfied by a sieving algorithm (as used in this section) it guarantees that the algorithm has reached a list of vectors which cannot be further modified by the algorithm.
A second question that arises is up to what level of sieving we should get in order to either get exactly a set P(L ) or a "very good" approximation of it. In this case the Quadruple MinkowskiSieve was enough, but this might not be the case for higher dimensional lattices. Thus it would be interesting to know how does this index increase according to the dimension. So, given some termination condition, how close can a sieving algorithm approximate a set P(L )?
If these questions receive an answer it will help in making sieving algorithms a way to either compute exactly or approximately a set P(L ) of a lattice L . This would be very interesting as it will provide a way to compute a set P(L ) (exactly or approximately) without having to compute the set R(L ) which is a very costly computation.

Applications of P(L )
Even though the sets Irr(L ) and P(L ) might be of interest in their own, examining their relation to already existing lattice problems and algorithms is a natural question that arises. We choose to focus on the set P(L ) as it seems to be the easier to compute/approximate with existing lattice algorithms.

P(L ) in the study of shortest vector(s) problems
The results in Sect. 4 provide some interesting conclusions about the relation of the set P(L ) to well known lattice problems. A first observation in Sect. 4.2 was that S 1 (L ) is included in P(L ). This leads to the following result.
Proposition 10 (Finding P(L ) implies solving SVP) Let L be a full rank lattice in R n . Computing a set P(L ) provides a solution to the SVP and the kissing number problem.
The relation S 1 (L ) ⊆ P(L ), implies that two classic lattice problems can be solved given a P(L ). Of course this holds for any superset of P(L ) as well. We combine this observation with the inclusion P + (L ) ⊆ MinkowskiSieve k (L ) for k ≥ 2 shown in the proof of Theorem 9. This provides some extra (heuristic) evidence that some sieving algorithms will indeed output a solution to SVP or the kissing number problem if they run long enough. This is no surprise as sieving algorithms were devised for solving SVP.
Examining the relation of SIVP to the set P(L ) is probably a more interesting question. By Corollary 1 we know that for every i = 1, . . . , n there exists a vector v ∈ Irr(L ) such that v = λ i (L ). The following proposition completes this result.
Proposition 11 (Finding P(L ) implies solving SIVP) Let L be a full rank lattice in R n . Computing a set P(L ) provides a solution to the SIVP.

Proof
Let v 1 , . . . , v n be a set of linearly independent vectors in L such that v i = λ i (L ) for i = 1, . . . , n. We distinguish two cases.
Then by S 1 (L ) ⊆ P(L ) it follows that v 1 , . . . , v k belong to P(L ). In addition, by Corollary 1 and the definition of P(L ) it follows that all the v k+1 , . . . , v n will be included in P(L ). Case 2 ∃i ≥ 2 such that λ 1 (L ) ≤ λ i−1 (L ) < λ i (L ) = λ i+1 (L ). Let i ≥ 2 such that the condition holds. We set k = max{ j > i |λ i (L ) = λ j (L )}. Hence, We will show that v i , . . . , v k ∈ P(L ). Let j ∈ {i, . . . , k} we set L λ j to be the sublattice of L spanned by all the vectors in L strictly shorter than λ j . As λ i (L ) = λ j (L ) it follows that L λ j = L λ i which has rank i − 1. Assume that v j ∈ L λ j . Then we would get that the set { v 1 , . . . , v i−1 , v j } is a set of linearly dependent vectors. Contradiction. Thus v j / ∈ L λ j and by Proposition 4 we get that v j ∈ Irr(L ). This holds for any i ≤ j ≤ k and therefore we get that all v j with i ≤ j ≤ k belong to Irr(L ). In order to show that they also do belong to a P(L ) it suffices to show that for every μ, ν such that i ≤ μ < ν ≤ k it holds that v ν − v μ ≥ λ i (L ). Assume that there exist μ, ν such that i ≤ μ < ν ≤ k and v ν − v μ < λ i (L ). Then it follows that v ν − v μ ∈ L λ i . The set of vectors { v 1 , . . . , v i−1 , v μ , v ν } is a linearly independent set and thus the same holds for This implies a set of i linearly independent vectors in the lattice L λ i which is of rank i − 1, contradiction. Concluding, let v l belong to the considered linearly independent set of vectors achieving the successive minima. If v l = v l+1 or v l = v l−1 then v l ∈ P(L ) by the proof in "case 2". If v l−1 < v l < v l+1 then v l ∈ P(L ) by the same argument used in "case 1".

Remark 21
Obtaining a set of the shortest vector(s), given a set P(L ), amounts to scanning the entire set P(L ) a number of times. Thus, sorting P(L ) can be avoided.

Using P(L ) in CVPP algorithms
One main problem in lattice theory is the closest vector problem. A straightforward way of using the set R(L ) in order to solve CVPP was described in [31]. In that work, an algorithm called the iterative slicer is given which takes as input the set R(L ) and a target vector t and outputs a closest lattice vector to t (Algorithm 4). The main idea behind this algorithm is to iteratively reduce the target vector t by the relevant vectors until the resulting vector t is contained in the Voronoi cell V (L ) of the lattice. Once this condition is satisfied it is known that t − t is a closest lattice point to t. This algorithm is shown to terminate after a finite number of iterations.

Algorithm 4
The iterative slicer [31] Require: The set R(L ) and a target vector t. Ensure: A vector s ∈ L closest to t. 1: t ← t 2: for every r ∈ R(L ) do 3: if t ± r < t then 4: t ← t ± r 5: restart the for loop 6: end if 7: end for 8: s = t − t 9: return s Inspired by the iterative slicer, in [23] an algorithm is described to provably solve the CVPP inÕ(2 2n )-time by using the set R(L ) as the preprocessing data. The difference between Algorithm 4 and the algorithm in [23] is that the latter selects the relevant vectors in a specific order for reduction. This results in aÕ(2 2n )-time andÕ(2 n )-space algorithm. This work was further improved in [4] by optimising the use of the preprocessing data.
However, using the set R(L ) in practice is not convenient due to its expected size of about 2 n+1 − 2 vectors. One way to reduce the memory requirements could be the use of a compact

Algorithm 5 The tuple slicer
Require: A set P(L ), a C ∈ N and a target vector t. Ensure: A vector s ∈ L closest to t. 1: t ← t 2: for l = 1 to C do 3: restart the outer for loop 8: end if 9: end for 10: end for 11: s = t − t 12: return s representation of R(L ) like the one described in [17]. In such a scenario a superset of R(L ) would be generated on the fly by a CVPP algorithm which would only use a smaller set of vectors in order to generate R(L ).
Another way would be to use a subset of R(L ) instead of the entire set. Such an approach was introduced in [19]. In that work an approximate Voronoi cell is defined as the cell implied by a list of short lattice vectors which is potentially a subset of the set R(L ). That lead to a heuristic algorithm for CVPP using the approach of Micciancio-Voulgaris but with more practical time and space complexities.
We describe a CVPP algorithm (the tuple slicer, Algorithm 5) using the set P(L ), and we discuss its advantages and disadvantages against already existing approaches. We distinguish two cases.
If C = 1 in Algorithm 5 then it just uses a subset of R(L ). In this case the analysis of the algorithm just follows under the "approximate Voronoi cell" approach where a specific choice has been made on the used subset. The advantage in this case is that it is guaranteed that the used list of vectors is a subset of R(L ).
If C > 1 Algorithm 5 behaves similar to the tuple sieving approach in [3]. A vector is reduced not only by a single vector but also by the sums of small tuples of vectors in the used list. Hence, a target vector t is reduced by a superset of P(L ). If this superset includes the set R(L ) then [31,Lemma 5] guarantees the correctness of the algorithm. This depends on the value of C. We can prove that there always exists a value of C which guarantees the inclusion of R(L ) in the generated superset.

Remark 22 In line 3 of Algorithm 5 it considers sets of vectors
Definition 13 (k-wise sum of P(L )) Let L be a full rank lattice in R n and k a positive integer. We define k P(L ) = j i=1 p i | p i ∈ P(L ) and j = 1, . . . , k .
Proposition 12 (Finding R(L ) via k P(L )) Let L be a full rank lattice in R n and P(L ) a complete system of irreducible vectors of it. Then there exists a positive integer n 0 ∈ N such that R(L ) ⊆ n 0 P(L ).  20, 21, 22, 23, 24. For each dimension the algorithm was tested with input C = 1, 2, 3 against 10,000 CVP instances. Each of the 10,000 CVP blocks was formed by 10 smaller blocks of 1000 CVPs corresponding to 10 lattices. Each point in the graph corresponds to the ratio of correct answers out of the 10,000 CVP instances Proof By Proposition 7 there exists a generating set G ⊆ P(L ) with | G| = l ≥ n. Let r ∈ R(L ), then there exists an x ∈ Z l such that G Then r ∈ m r P(L ). Set m = max r ∈R(L ) {m r }. As R(L ) is finite then m is finite and ∀ r ∈ R(L ) it holds that r ∈ m P(L ).
The used superset is computed on the fly. This allows for a time-memory trade-off. The algorithm loses on time complexity as it examines a larger list of vectors but it gains on the memory requirement as it stores a provably smaller subset of R(L ). In more detail the space complexity of the algorithm is proportional to | P(L )| which can be bounded by O(τ n ). The time complexity will depend on the size of P(L ) but also on the parameter C. Following the analysis of [23] we can argue that the time complexity of Algorithm 5 will be O(| P(L )| C · 2 n poly(n)).

Remark 23
From Theorem 12 it follows that if Algorithm 5 was to be applied to the lattice family A * n , it should consider a value of C as high as (n + 1)/2 in order for R(A * n ) to be included in the used superset. Therefore, a provable upper bound on C alone will not lead to any good bound for the time complexity of Algorithm 5 in a provable setting.
Considering Algorithm 5 in a heuristic setting seems to be a more appealing choice. In such a scenario the requirements of the algorithm can be relaxed in mainly two directions. The first one is using an approximation (a superset) of P(L ) instead of the set itself. Hence, the output of the MinkowskiSieve as described in Sect. 5.2 could serve as such a choice. Furthermore, choosing a specific approximation of P(L ) can allow fixing the value of the parameter C in the following way.
By a heuristic result of [19] we know that if a list L containing 2 n/2+o(n) lattice vectors of norm less than √ 2λ 1 (L ) is used as input to the iterative slicer then the success probability of the algorithm is close to 1. Following this guideline, a value for the parameter C can be chosen in a way that guarantees that the set of all vectors used for reduction in Algorithm 5 contains a list of 2 n/2+o(n) shortest lattice vectors.
Further options can be examined if it is allowed for the used slicing algorithm to succeed with probability much smaller than 1. In such a case the results in [10,11] provide a way of relating the success probability to size of the used preprocessed list and hence in our case C.
We briefly experimented on the relation of the success probability of Algorithm 5 and the parameter C. The results can be found in Fig. 4. From these results we get a first indication that the success probability of Algorithm 5 increases as the value of C increases. Unfortunately, extending these experiments to moderate dimensions was infeasible, as the exact computation of P(L ) would require hundreds or thousands of GB of RAM (using a "brute force" approach). Therefore, obtaining a specific guideline on how to choose a value for C remains an open question.
The "defining property" of the lattice L n , that if v = (v 1 , . . . , v n ) ∈ L n then v i ≡ v j (mod 2) for all 1 ≤ i, j ≤ n, will be used throughout the proof.
Step 1 Obtaining that S 1 (L n ) = {±2e i | 1 ≤ i ≤ n} is trivial and is left as an exercise to the reader.
Step 2 Let v / ∈ R(L n ) and v = 0. Then by Theorem 1 we know that there exists a vector x ∈ L n \{ 0, v} such that v, x ≥ x 2 . We will prove that for every vector v ∈ L n \( We already showed in step 1 of the proof that the shortest vectors with odd coordinates are the {±1} n . As v does not belong to this set, |v i | ≥ 1 for all v i , and there exists at least one v j such that |v j | ≥ 3. Consider the vector x = (sign(v 1 ), . . . , sign(v n )). This is a valid lattice vector as As v is a non-zero vector then it has at least one non-zero coordinate, let it be v j . Also as v j is even we can conclude that |v j | ≥ 2. We consider the vector x = 2 sign(v j )e j . This is a valid lattice vector as This proves that again v / ∈ R(L n ) concluding the proof of the second step.
Step 3 In this step we want to prove that {±2e i | 1 ≤ i ≤ n} ∪ {±1} n ⊆ Irr(L n ). In step 1 we already showed that S 1 (L n ) = {±2e i | 1 ≤ i ≤ n} and we know that S 1 (L n ) ⊆ Irr(L n ) hence, we only have to show that {±1} n ⊆ Irr(L n ). Assume that v ∈ {±1} n and v / ∈ Irr(L n ). Thus there are two strictly shorter vectors v 1 and v 2 such that v = v 1 + v 2 . In step 1 of the proof we showed that the vectors in {±1} n are the shortest ones among those with odd coordinates. Therefore as v 1 and v 2 are strictly shorter than v then it must be that they have even coordinates. This implies that v can be written as a sum of vectors with even coordinates. This is a contradiction, as a sum of even numbers is never odd.
As a scaling of a lattice L has the same properties as L we get Theorem 5 already mentioned in Sect. 4.1.
We leave it to the reader to verify our claim for these three lattices. Our next goal is to derive a similar result for the case S 1 (L ) = Irr(L ) R(L ). In order to do so we will use a scaling of the lattices A * n . For n ∈ N with n ≥ 3, we write Then a basis of M n is formed by the columns of B n (see [8, p. 115]), where is an (n + 1) × n matrix.

Remark 24
By the given basis B n for M n we can immediately observe Theorem 12 (Properties of M n ) For every n ∈ N with n ≥ 3, Proof We set A = {±(α β , (−β) α ) | β = n + 1 − α , 1 ≤ α ≤ (n + 1)/2}. We will prove this theorem in four steps. The first step is to show that S 1 (M n ) = {±(−n 1 , 1 n )}. The second step will be to show that R(M n ) ⊆ A. The third step will be to show that Irr(M n ) ⊆ {±(−n 1 , 1 n )} and finally in the fourth step we will show that A ⊆ R(M n ).
Step 1 The vectors {±(−n 1 , 1 n )} have squared length n 2 + n and hence we get λ 2 1 (L ) ≤ n 2 + n. This implies that a vector achieving λ 1 (L ) cannot have a coordinate v j such that |v j | ≥ n + 1. Therefore a vector achieving λ 1 (L ) belongs to A. The squared length of a vector in A is βα 2 + αβ 2 = (n + 1)αβ which minimizes for α = 1.
Step 2 Let v ∈ M n \ (A ∪ { 0}) and write it as v = (v 1 , . . . , v n+1 ). Then there will exist at least one coordinate of v, let it be v j , such that |v j | ≥ n + 1. This can be proved by a contradiction argument. Assume that there was no coordinate in v such that |v j | ≥ n + 1 then it would hold that |v i | ≤ n for all 1 ≤ i ≤ n and by the fact that v i ≡ v j (mod n + 1) we can conclude that there would be at most two possible values for |v i |. But the set A contains all such vectors of the lattice, hence that would imply v ∈ A, contradiction. We set x to be the vector having sign(v j )n in the j-th position and − sign(v j ) in all other places. This is a valid lattice vector and x = v as v ∈ M n \ A. We check the inner product of v and x: This proves that v / ∈ R(M n ) concluding the proof of the second step.
Step 3 Let v ∈ M n \ ({±(−n 1 , 1 n )} ∪ { 0}) and write it as v = (v 1 , . . . , v n+1 ). Then we will show that v is reducible. By step 2 of the proof we know that R(M n ) ⊆ A and as we know that Irr(M n ) ⊆ R(M n ) we can restrict our choice to v ∈ A \ {±(−n 1 , 1 n )}.
As v ∈ A we can write v = ±(α β , (−β) α ) with β = n + 1 − α for some 1 < α ≤ (n + 1)/2. By Lemma 4 it suffices to find a lattice vector x with x < v and such that 2 v, x > x 2 . Let γ = max{|α|, |β|} and the j-th coordinate of v be such that |v j | = γ . Consider x to be the vector with sign(v j )n in the j-th position and − sign(v j ) in all other places. This is a valid lattice vector and as γ ≥ (n + 1)/2. This proves that v / ∈ Irr(M n ) and therefore Irr(M n ) ⊆ {±(−n 1 , 1 n )}.
Step 4 By [7, Theorem 3] and the fact that the vectors (−n 1 , 1 n ) form a strictly obtuse superbasis of M n (see [7]) it follows that A ⊆ R(M n ) and finally R(M n ) = A.
This implies Theorem 6 already mentioned in Sect. 4.1.
This proves that S 1 (L ) = Irr(L ) R(L ) is possible for every dimension n ≥ 3. In order to complete the result from this point of view we give another lattice in dimension n = 2 that possess the same property: We leave it to the reader to verify this.

Appendix B Some graph-theoretical aspects
In Sect. 4.2 we introduced the notion of a complete system of irreducible vectors and we gave an example of how the set P(L ) can be computed. In that example the use of graph theoretical tools was demonstrated in order to compute the set P(L ) given the set Irr(L ). A natural question that arises is how costly this step can be.
In order to answer this question a few graph theory definitions are necessary. Graphs will de denoted by Γ = (V , E), where V is the set of vertices and E is the set of edges. If e = {u, v} ∈ E then we say that u and v are adjacent. Definition 14 (Independent set) Given a simple graph Γ = (V , E) an independent set is a subset of vertices U ⊆ V , such that no two vertices in U are adjacent. An independent set is maximal if no vertex can be added without violating independence. An independent set of maximum cardinality is called maximum and its cardinality is denoted by α(Γ ).
Definition 15 (Class graph) Let L be a full rank lattice in R n and S ∈ Irr(L )/∼. We define Γ L (S) to be the graph where the set of vertices V = S and there exists an edge between v 1 , v 2 ∈ V iff v 1 − v 2 < v 1 .
Computing P(L ) out of Irr(L ) amounts to solving a maximal independence set instance in Γ L (S) for every class S ∈ Irr(L )/∼. Therefore the complexity of this task highly depends on the size of the equivalence classes S ∈ Irr(L )/∼ and | Irr(L )/∼|. For average-case lattices the computational step from Irr(L ) to P(L ) should almost always be trivial, i.e. P(L ) = Irr(L ), as for all S ∈ Irr(L )/∼ it is expected that |S| = 2. In these cases the set P(L ) is uniquely determined.
However, in case the underlying lattice L possesses any kind of structure or symmetries it is expected that there will be equivalence classes S ∈ Irr(L )/∼ with |S| > 2. In these cases the computational task of finding a maximal independent set in the corresponding class graph is not trivial anymore. In such cases the first step is to construct the corresponding graph Γ L (S), which will take time O(|S| 2 ). Then, naively computing a maximal independent set (which should always include both ± v) will take time O(|S|m) where m is the number of edges in Γ L (S) but, there are better performing algorithms for this task [21]. If we denote by h the maximum size of a class in Irr(L )/∼ then the time complexity of computing P(L ) out of Irr(L ) will be bounded by O(h 2 | Irr(L )|).
Thus if there does not exist a class S with |S| exponential to the dimension n then computing P(L ) out of Irr(L ) will take timeÕ(| Irr(L )|). In practice, stumbling upon a lattice L possessing a class S ∈ Irr(L )/∼ where |S| is exponential to the dimension n is highly unlikely as such a lattice would be extremely structured. For the sake of mathematical curiosity (and nice graph pictures) we briefly investigate such a case of lattices, namely the L n for n ≥ 5 defined in Appendix A. For our exposition we will need the following definition. If T = T −1 (T is closed under inverse) then Cay(G, T ) is an undirected graph.
In Appendix A we saw that Irr(L n ) = {±2 e i | 1 ≤ i ≤ n} ∪ {±1} n . Hence Irr(L n ) contains two equivalence classes of sizes 2n and 2 n respectively. The class S 2 :={±1} n which we will study can be viewed as the group G = Z n 2 . Two elements of S 2 are connected if their difference is shorter than √ n, thus it is a sum of less than n/4 elements from the set {±2 e i | 1 ≤ i ≤ n}. In turn this implies that two elements of S 2 are connected in Γ L n (S 2 ) if they differ by a sign in less than n/4 of their coordinates. Thus we can now use the following observation.
Γ L n (S 2 ) ∼ = Cay(G, T n/4 (G)) Where G = Z n 2 and T n/4 (G):={ x ∈ G | 1 ≤ | supp( x)| < n/4 } and supp( x) denotes the support of x. In our case T n/4 (G) = T −1 n/4 (G) and thus Cay(G, T n/4 (G)) is an undirected graph. 5 We are interested in the maximal independent sets of the graph Γ L n (S 2 ), but not in Fig. 5 The uncoloured Cayley graph Cay(Z 4 2 , ϕ(T 1 (Z 5 2 ))) with generating set ϕ(T 1 (Z 5 2 )) = {(0, 0, 0, 1), (0, 0, 1, 0), (0, 1, 0, 0), (1, 0, 0, 0), (1, 1, 1, 1)}. For convenience, instead of labelling the vertices of the graph by the elements of Z 4 2 , we consider the elements of Z 4 2 as binary representations and assign the corresponding integer (e.g. (1, 0, 0, 0) maps to 8). This graph can be used in order to compute a representative setS 2 for the class S 2 = {±1} 5 in the L 5 = 2D * 5 lattice. One such set is implied by the black vertices of the graph. The graph possesses 40 maximal independent sets of cardinality 4 and 16 maximal independent sets of cardinality 5 (maximum) all of them. It is additionally required that for every vector v ∈S 2 also − v ∈S 2 . This could be phrased as we work "modulo sign". This property can be translated algebraically by working in the quotient group H = Z n 2 / (1, . . . , 1) instead of G = Z n 2 . Using the group isomorphism ϕ : Z n 2 / (1, . . . , 1) → Z n−1 we can transfer the problem to the graph Γ sign = Cay(Z n−1 2 , ϕ(T n/4 (G))). Each independent set in Γ sign implies an independent set in Γ L n (S 2 ) which possesses the extra property of the "sign symmetry". A first remark regarding the set of maximal independent sets of Γ sign is that it is invariant under the group action of Z n−1 2 . For example, if we consider the graph in Fig. 5, all 16 maximal independent sets of cardinality 5 can be generated by acting with Z 4 2 to the given independent set formed by the black vertices. We briefly experimented with Γ sign for the first few values n = 5, 6, 7 in order to get a first indication of how many maximal independent sets such a graph may have and how much their size can vary ( Table 2).
As the number of maximal independent sets seems to grow super-exponentially in the dimension n we stopped at n = 7. Even though experimental results are useful in order to get intuition, theoretical results are those which give the final answer to a question. In our case there are some theoretical results, originating both from graph theory and coding theory which bound the sizes we experimented with.
-Let Γ = (V , E) be a graph with |V | = N . In [26] it is proven that Γ can have up to 3 N /3 maximal cliques in the worst case, a bound which is tight. Complementary this also proves that a graph Γ with N vertices can possess up to 3 N /3 maximal independent sets in the worst case. The results in the same work also imply that the number of different sizes of maximal Table 2 Using SAGE [9] we computed all possible sizes of a maximal independent set of Cay(Z n−1 2 , ϕ(T n/4 (Z n 2 ))) for n = 5, 6, 7 and the corresponding frequency of these sizes independent sets is upper bounded by N − log 2 N which is shown to be tight in the worst case. -Let Γ be an m-regular graph with N vertices. In [30] it is shown that α(Γ ) can be upper bounded by min{ N /2 , N − m}. This bound is obtainable. In the same work, a lower bound for α(Γ ) is given, depending on m and N . However this bound is not uniform but depends on number theoretic properties of N , m. In our case the appropriate lower bound for α(Γ ) would be N /(m + 1) . -As the graph family in question, Γ L n (S 2 ) (and Γ sign ) is specific, better upper bounds can be obtained than the general ones given in [30]. This is achieved with the use of coding theory [16]. In more detail, α(Γ L n (S 2 )) = A 2 (n, n/4 ). This equality enables the use of already known upper bounds on A 2 (n, n/4 ) from coding theory such as the Hamming bound [15]. The lower bound implied by [30] for α(Γ L n (S 2 )) is equivalent to the Gilbert-Varshamov bound for A 2 (n, n/4 ).