Short Vectors of Planar Lattices via Continued Fractions. Friedrich Eisenbrand Max-Planck-Institut für Informatik
|
|
|
- Chloe Rice
- 6 years ago
- Views:
Transcription
1 Short Vectors of Planar Lattices via Continued Fractions Friedrich Eisenbrand Max-Planck-Institut für Informatik
2 Outline Lattices Definition of planar integral lattices Shortest Vectors Applications The Gaussian algorithm
3 Lattices Outline Definition of planar integral lattices Shortest Vectors Applications The Gaussian algorithm Short vectors and best approximations Hermite normal form Shortest vectors and best approximations Best approximations and convergents A naive shortest vector algorithm based on euclid
4 Lattices Outline Definition of planar integral lattices Shortest Vectors Applications The Gaussian algorithm Short vectors and best approximations Hermite normal form Shortest vectors and best approximations Best approximations and convergents A naive shortest vector algorithm based on euclid Fast basis reduction Identifying the shortest convergent Computing shortest convergent w.r.t. l -norm with Schönages speedup Reduced bases Fast basis reduction via (Schönhage 1971) and (Gauß 1801)
5 Lattices Lattice generated by A: Λ(A)={Ax x Z 2 }, where A Z 2 2 nonsingular
6 Lattices Lattice generated by A: Λ(A)={Ax x Z 2 }, where A Z 2 2 nonsingular A basis of Λ
7 Lattices Lattice generated by A: Λ(A)={Ax x Z 2 }, where A Z 2 2 nonsingular A basis of Λ b 2 b 1
8 Lattices Lattice generated by A: Λ(A)={Ax x Z 2 }, where A Z 2 2 nonsingular A basis of Λ b 2 b 1
9 Shortest vectors Shortest vector of Λ: v Λ with v 0and v u for all u Λ u 0
10 Shortest vectors Shortest vector of Λ: v Λ with v 0and v u for all u Λ u 0 Applications Integer programming in fixed dimension Lenstra (1983) Factorization of rational polynomials Lenstra, Lenstra & Lovász (1982) Strongly polynomial time algorithms in combinatorial optimization Frank & Tardosz (1987)
11 Shortest vectors Shortest vector of Λ: v Λ with v 0and v u for all u Λ u 0 Applications Integer programming in fixed dimension Lenstra (1983) Factorization of rational polynomials Lenstra, Lenstra & Lovász (1982) Strongly polynomial time algorithms in combinatorial optimization Frank & Tardosz (1987)
12 Shortest vectors Shortest vector of Λ: v Λ with v 0and v u for all u Λ u 0 Applications Integer programming in fixed dimension Lenstra (1983) Factorization of rational polynomials Lenstra, Lenstra & Lovász (1982) Strongly polynomial time algorithms in combinatorial optimization Frank & Tardosz (1987)
13 Unimodular transformations Unimodular transformation of basis A: A U, where U Z 2 2 with det(u)=±1,.i.e., U unimodular
14 Unimodular transformations Unimodular transformation of basis A: A U, where U Z 2 2 with det(u)=±1,.i.e., U unimodular Matrix A basis of Λ if and only if A U basis of Λ, U unimodular
15 Unimodular transformations Unimodular transformation of basis A: A U, where U Z 2 2 with det(u)=±1,.i.e., U unimodular Matrix A basis of Λ if and only if A U basis of Λ, U unimodular Examples of unimodular transformations swapping of columns
16 Unimodular transformations Unimodular transformation of basis A: A U, where U Z 2 2 with det(u)=±1,.i.e., U unimodular Matrix A basis of Λ if and only if A U basis of Λ, U unimodular Examples of unimodular transformations swapping of columns adding integral multiples of one column to another
17 The Gaussian reduction algorithm GAUSS(b 1,b 2 ) repeat arrange that b 1 is the shorter vector of b 1 and b 2 find k Z such that b 2 kb 1 is of minimal euclidean length b 2 (b 2 kb 1 ) (normalization step) until k = 0 return (b 1,b 2 ) k in repeat-loop is nearest integer to (b T 1 b 2)/(b T 1 b 1)
18 A normalization step b 2 b 1
19 A normalization step b 2 kb 1 b 2 b 1
20 A normalization step b 2 kb 1 b 1
21 Complexity of GAUSS Lagarias (1980): Complexity of GAUSS O(n 3 )
22 Complexity of GAUSS Lagarias (1980): Complexity of GAUSS O(n 3 ) Schönhage (1991) and Yap (1992) new reduction algorithm: Complexity O(M(n)logn) where M(n): complexity of n-bit integer multiplication;
23 Complexity of GAUSS Lagarias (1980): Complexity of GAUSS O(n 3 ) Schönhage (1991) and Yap (1992) new reduction algorithm: Complexity O(M(n)logn) where M(n): complexity of n-bit integer multiplication; algorithms fairly involved
24 Complexity of GAUSS Lagarias (1980): Complexity of GAUSS O(n 3 ) Schönhage (1991) and Yap (1992) new reduction algorithm: Complexity O(M(n)logn) where M(n): complexity of n-bit integer multiplication; algorithms fairly involved This talk: Fast basis reduction via Schönhage s (1971) classical gcd-speedup and GAUSS
25 The Hermite Normal Form Given lattice basis A = ( a 1 a 2 a 3 a 4 ) Z 2 2, compute integers x, y with gcd(a 3,a 4 )=d = xa 3 + ya 4 ( a4 /d x a 3 /dy) unimodular
26 The Hermite Normal Form Given lattice basis A = ( a 1 a 2 a 3 a 4 ) Z 2 2, compute integers x, y with gcd(a 3,a 4 )=d = xa 3 + ya 4 ( a4 /d x a 3 /dy) unimodular Then a 1 a 2 4/d a 3 a 4 a 3 /d x = y a b Z c
27 The Hermite Normal Form Given lattice basis A = ( a 1 a 2 a 3 a 4 ) Z 2 2, compute integers x, y with gcd(a 3,a 4 )=d = xa 3 + ya 4 ( a4 /d x a 3 /dy) unimodular Then a 1 a 2 4/d a 3 a 4 a 3 /d x = y a b Z c We can assume that c > 0anda > b 0 Hermite normal form
28 Complexity of Hermite normal form Given integers a and b one can compute integers x and y with gcd(a,b)=xa + yb in time O(M(n)logn) (Schönhage 1971) Complexity of HNF: O(M(n)logn)
29 Complexity of Hermite normal form Given integers a and b one can compute integers x and y with gcd(a,b)=xa + yb in time O(M(n)logn) (Schönhage 1971) Complexity of HNF: O(M(n)logn) Assuming: Lattice is given by its Hermite normal form
30 Best approximations For α Q, fraction x/y is best approximation if all other fractions x /y with y y satisfy y α x > yα x
31 Shortest vectors and best approximations Λ = a b x x,y Z 0 c y Theorem. There exists a shortest vector ( ) xa+yb yc, x N0, y N + of Λ such that at least one of the following conditions is satisfied.
32 Shortest vectors and best approximations Λ = a b x x,y Z 0 c y Theorem. There exists a shortest vector ( ) xa+yb yc, x N0, y N + of Λ such that at least one of the following conditions is satisfied. The fraction x/y is a best approximation to the number b/a.
33 Shortest vectors and best approximations Λ = a b x x,y Z 0 c y Theorem. There exists a shortest vector ( ) xa+yb yc, x N0, y N + of Λ such that at least one of the following conditions is satisfied. The fraction x/y is a best approximation to the number b/a. If the fraction p/q is the reduced representation of b/a, then p is odd, q is even, x { p/2, p/2 } and y = q/2.
34 Best approximations via euclidean algorithm x/y best approximation of b/a, then x/y is a convergent of b/a
35 Best approximations via euclidean algorithm x/y best approximation of b/a, then x/y is a convergent of b/a Convergents of α Q inductively defined
36 Best approximations via euclidean algorithm x/y best approximation of b/a, then x/y is a convergent of b/a Convergents of α Q inductively defined α
37 Best approximations via euclidean algorithm x/y best approximation of b/a, then x/y is a convergent of b/a Convergents of α Q inductively defined α α + 1/c,wherec convergent of 1/(α α )
38 The Gregorian calendar The earth turns around the sun in / days. First convergent is 365
39 The Gregorian calendar The earth turns around the sun in / days. First convergent is 365 Second convergent: /4, since 4 is first convergent of / = /104629
40 The Gregorian calendar The earth turns around the sun in / days. First convergent is 365 Second convergent: /4, since 4 is first convergent of / = / Leap year all 4 years
41 The Gregorian calendar Pope Gregor XIII (1582) used fifth convergent = /
42 The Gregorian calendar Pope Gregor XIII (1582) used fifth convergent = / Every 800 years skip 6 leap years; every year divisible by 100 but not by 400
43 The Gregorian calendar Pope Gregor XIII (1582) used fifth convergent = / Every 800 years skip 6 leap years; every year divisible by 100 but not by 400 The first year the in which calendar is 1 day ahead is 4915
44 Computing convergents Euclidean algorithm EXGCD(a,b) M n 0 while (b 0) do q a/b M M q (a,b) (b,a qb) n n + 1 return (d = a, x =( 1) n M 2,2, y =( 1) n+1 M 1,2 )
45 Computing convergents Let M (k), k 0, denote M after k-th iteration of while-loop
46 Computing convergents Let M (k), k 0, denote M after k-th iteration of while-loop Well known fact: k-th convergent of a/b is M (k) 1,1 /M(k) 2,1
47 Naive shortest vector algorithm Compute Hermite normal form ( ab 0 c ) of A
48 Naive shortest vector algorithm Compute Hermite normal form ( ab 0 c ) of A Compute reduced fraction p/q of b/a and vectors ( p/2 a + q/2 b, q/2 c) T and (a,0) T store shortest one in MIN
49 Naive shortest vector algorithm Compute Hermite normal form ( ab 0 c ) of A Compute reduced fraction p/q of b/a and vectors ( p/2 a + q/2 b, q/2 c) T and (a,0) T store shortest one in MIN Compute convergents g k /h k of b/a with EXGCD(b,a) and compare the length of the induced vector ( g k a + h k b,h k c) T with MIN. If shorter, replace MIN
50 Naive shortest vector algorithm Compute Hermite normal form ( ab 0 c ) of A Compute reduced fraction p/q of b/a and vectors ( p/2 a + q/2 b, q/2 c) T and (a,0) T store shortest one in MIN Compute convergents g k /h k of b/a with EXGCD(b,a) and compare the length of the induced vector ( g k a + h k b,h k c) T with MIN. If shorter, replace MIN In the end MIN contains a shortest vector
51 Naive shortest vector algorithm Compute Hermite normal form ( ab 0 c ) of A Compute reduced fraction p/q of b/a and vectors ( p/2 a + q/2 b, q/2 c) T and (a,0) T store shortest one in MIN Compute convergents g k /h k of b/a with EXGCD(b,a) and compare the length of the induced vector ( g k a + h k b,h k c) T with MIN. If shorter, replace MIN In the end MIN contains a shortest vector Linear search through all convergents of b/a
52 Finding shortest vector w.r.t l -norm Consider set of vectors g k a + h k b k = 0,...,t h k c, (1) where β k = g k /h k, 0 k t are the convergents of b/a. Proposition. Shortest vector in (1) w.r.t. l is last convergent of b/a outside the interval [(b c)/a,(b + c)/a] or first convergent of b/a inside [(b c)/a,(b + c)/a].
53 Finding shortest vector w.r.t l -norm Common convergent of interval [α 1,α 2 ]: Convergent β k of α 1 and α 2 where k maximal
54 Finding shortest vector w.r.t l -norm Common convergent of interval [α 1,α 2 ]: Convergent β k of α 1 and α 2 where k maximal Schönhage (1971): One can compute common convergent β k and corresponding matrix M (k) of two rationals α 1,α 2 Q in time O(M(n) logn)
55 Finding shortest vector w.r.t l -norm Common convergent of interval [α 1,α 2 ]: Convergent β k of α 1 and α 2 where k maximal Schönhage (1971): One can compute common convergent β k and corresponding matrix M (k) of two rationals α 1,α 2 Q in time O(M(n) logn) Proposition. Let β k = g k /h k common convergent of [(b c)/a,(b + c)/a]. Then k-th, k + 1-st or k + 2-nd convergent of b/a is shortest vector in (1) w.r.t. the l -norm.
56 Compute HNF ( ab 0 c ) of A Fast shortest vector algorithm
57 Compute HNF ( ab 0 c ) of A Fast shortest vector algorithm Compute reduced representation p/q of b/a and vectors (a,0) T, ( p/2 a + q/2 b, q/2 c) T ; store shortest nonzero one in a container MIN
58 Compute HNF ( ab 0 c ) of A Fast shortest vector algorithm Compute reduced representation p/q of b/a and vectors (a,0) T, ( p/2 a + q/2 b, q/2 c) T ; store shortest nonzero one in a container MIN Compute common convergent β k of [(b c)/a,(b + c)/a] and corresponding matrix M (k). Compute next two convergents of b/a with EXGCD; Replace MIN if one of convergents yields shorter vector
59 Reduced bases Lattice basis (b 1,b 2 ) is reduced if enclosed angle in range 90 ± 30 b 2 b 1
60 Reduced bases Lattice basis (b 1,b 2 ) is reduced if enclosed angle in range 90 ± 30 b 2 kb 1 b 2 α b 1
61 Reduced bases Lattice basis (b 1,b 2 ) is reduced if enclosed angle in range 90 ± 30 d h b 2 kb 1 α b 2 b 1 d 1/2 b 1 and h = sinα b 2 suppose α < 60
62 Reduced bases Lattice basis (b 1,b 2 ) is reduced if enclosed angle in range 90 ± 30 d h b 2 kb 1 α b 2 b 1 d 1/2 b 1 and h = sinα b 2 suppose α < 60 b 2 kb 1 2 = h 2 + d 2 = 1/4 b 1 2 +(sinα) 2 b 2 2 (1/4 +(sinα) 2 ) b 2 2
63 Reduced bases Lattice basis (b 1,b 2 ) is reduced if enclosed angle in range 90 ± 30 d h b 2 kb 1 α b 2 b 1 d 1/2 b 1 and h = sinα b 2 suppose α < 60 b 2 kb 1 2 = h 2 + d 2 = 1/4 b 1 2 +(sinα) 2 b 2 2 (1/4 +(sinα) 2 ) b 2 2 < b 2 2
64 Almost reduced basis Proposition. There exists O(M(n)logn) time algorithm that computes basis B of Λ defined by A Z 2 2, with property that the first column of B is shortest vector w.r.t. l -norm.
65 Almost reduced basis Proposition. There exists O(M(n)logn) time algorithm that computes basis B of Λ defined by A Z 2 2, with property that the first column of B is shortest vector w.r.t. l -norm. Analysis of Gaussian algorithm (Lagarias 1980) reveals this basis almost reduced
66 Almost reduced basis Proposition. There exists O(M(n)logn) time algorithm that computes basis B of Λ defined by A Z 2 2, with property that the first column of B is shortest vector w.r.t. l -norm. Analysis of Gaussian algorithm (Lagarias 1980) reveals this basis almost reduced Corollary. There exists O(M(n)logn) time algorithm that computes reduced basis B of Λ defined by A Z 2 2
67 Summary of results Shortest vector corresponds to best approximation of a rational defined by the lattice Shortest vectors can be found with the euclidean algorithm Fast basis reduction can be solely based on Schönhage s (1971) result and reduction algorithm of Gauss (1801)
68 Summary of results Shortest vector corresponds to best approximation of a rational defined by the lattice Shortest vectors can be found with the euclidean algorithm Fast basis reduction can be solely based on Schönhage s (1971) result and reduction algorithm of Gauss (1801)
69 Summary of results Shortest vector corresponds to best approximation of a rational defined by the lattice Shortest vectors can be found with the euclidean algorithm Fast basis reduction can be solely based on Schönhage s (1971) result and reduction algorithm of Gauss (1801)
70 Open Problem What about shortest vector problem in arbitrary fixed dimension?
71 Open Problem What about shortest vector problem in arbitrary fixed dimension? Fastest known algorithm of Kannan (1987) runs in time O(M(n)n)
72 Open Problem What about shortest vector problem in arbitrary fixed dimension? Fastest known algorithm of Kannan (1987) runs in time O(M(n)n) Challenge: Prove that shortest vector problem in arbitrary fixed dimension can be solved in time O(M(n) logn)
Fast Reduction of Ternary Quadratic Forms
1:01 Fast Reduction of Ternary Quadratic Forms 1:02 1:0 1:04 1:05 1:06 Friedrich Eisenbrand 1 and Günter Rote 2 1 Max-Planck-Institut für Informatik, Stuhlsatzenhausweg 85, 6612 Saarbrücken, Germany, eisen@mpi-sb.mpg.de
F (X 1,...,X d )=(X 1,...,X d ) A (X 1,...,X d ) T,
Fast Reduction of Ternary Quadratic Forms Friedrich Eisenbrand 1 and Günter Rote 2 1 Max-Planck-Institut für Informatik Stuhlsatzenhausweg 85, 66123 Saarbrücken, Germany eisen@mpi-sb.mpg.de 2 Institut
The Shortest Vector Problem (Lattice Reduction Algorithms)
The Shortest Vector Problem (Lattice Reduction Algorithms) Approximation Algorithms by V. Vazirani, Chapter 27 - Problem statement, general discussion - Lattices: brief introduction - The Gauss algorithm
How to Factor N 1 and N 2 When p 1 = p 2 mod 2 t
How to Factor N 1 and N 2 When p 1 = p 2 mod 2 t Kaoru Kurosawa and Takuma Ueda Ibaraki University, Japan Abstract. Let N 1 = p 1q 1 and N 2 = p 2q 2 be two different RSA moduli. Suppose that p 1 = p 2
M3P14 LECTURE NOTES 8: QUADRATIC RINGS AND EUCLIDEAN DOMAINS
M3P14 LECTURE NOTES 8: QUADRATIC RINGS AND EUCLIDEAN DOMAINS 1. The Gaussian Integers Definition 1.1. The ring of Gaussian integers, denoted Z[i], is the subring of C consisting of all complex numbers
1. Factorization Divisibility in Z.
8 J. E. CREMONA 1.1. Divisibility in Z. 1. Factorization Definition 1.1.1. Let a, b Z. Then we say that a divides b and write a b if b = ac for some c Z: a b c Z : b = ac. Alternatively, we may say that
Reduction of Smith Normal Form Transformation Matrices
Reduction of Smith Normal Form Transformation Matrices G. Jäger, Kiel Abstract Smith normal form computations are important in group theory, module theory and number theory. We consider the transformation
CSE 206A: Lattice Algorithms and Applications Spring Basic Algorithms. Instructor: Daniele Micciancio
CSE 206A: Lattice Algorithms and Applications Spring 2014 Basic Algorithms Instructor: Daniele Micciancio UCSD CSE We have already seen an algorithm to compute the Gram-Schmidt orthogonalization of a lattice
Two Fast Parallel GCD Algorithms of Many Integers. Sidi Mohamed SEDJELMACI
Two Fast Parallel GCD Algorithms of Many Integers Sidi Mohamed SEDJELMACI Laboratoire d Informatique Paris Nord, France ISSAC 2017, Kaiserslautern, 24-28 July 2017 1 Motivations GCD of two integers: Used
47-831: Advanced Integer Programming Lecturer: Amitabh Basu Lecture 2 Date: 03/18/2010
47-831: Advanced Integer Programming Lecturer: Amitabh Basu Lecture Date: 03/18/010 We saw in the previous lecture that a lattice Λ can have many bases. In fact, if Λ is a lattice of a subspace L with
Lattice Basis Reduction and the LLL Algorithm
Lattice Basis Reduction and the LLL Algorithm Curtis Bright May 21, 2009 1 2 Point Lattices A point lattice is a discrete additive subgroup of R n. A basis for a lattice L R n is a set of linearly independent
Chapter 5: The Integers
c Dr Oksana Shatalov, Fall 2014 1 Chapter 5: The Integers 5.1: Axioms and Basic Properties Operations on the set of integers, Z: addition and multiplication with the following properties: A1. Addition
x y B =. v u Note that the determinant of B is xu + yv = 1. Thus B is invertible, with inverse u y v x On the other hand, d BA = va + ub 2
5. Finitely Generated Modules over a PID We want to give a complete classification of finitely generated modules over a PID. ecall that a finitely generated module is a quotient of n, a free module. Let
Elementary Algebra Chinese Remainder Theorem Euclidean Algorithm
Elementary Algebra Chinese Remainder Theorem Euclidean Algorithm April 11, 2010 1 Algebra We start by discussing algebraic structures and their properties. This is presented in more depth than what we
Basic Algorithms in Number Theory
Basic Algorithms in Number Theory Algorithmic Complexity... 1 Basic Algorithms in Number Theory Francesco Pappalardi Discrete Logs, Modular Square Roots & Euclidean Algorithm. July 20 th 2010 Basic Algorithms
Finite Fields. Mike Reiter
1 Finite Fields Mike Reiter reiter@cs.unc.edu Based on Chapter 4 of: W. Stallings. Cryptography and Network Security, Principles and Practices. 3 rd Edition, 2003. Groups 2 A group G, is a set G of elements
Lattice Basis Reduction Part 1: Concepts
Lattice Basis Reduction Part 1: Concepts Sanzheng Qiao Department of Computing and Software McMaster University, Canada qiao@mcmaster.ca www.cas.mcmaster.ca/ qiao October 25, 2011, revised February 2012
Hermite normal form: Computation and applications
Integer Points in Polyhedra Gennady Shmonin Hermite normal form: Computation and applications February 24, 2009 1 Uniqueness of Hermite normal form In the last lecture, we showed that if B is a rational
2. THE EUCLIDEAN ALGORITHM More ring essentials
2. THE EUCLIDEAN ALGORITHM More ring essentials In this chapter: rings R commutative with 1. An element b R divides a R, or b is a divisor of a, or a is divisible by b, or a is a multiple of b, if there
CS 4424 GCD, XGCD
CS 4424 GCD, XGCD eschost@uwo.ca GCD of polynomials First definition Let A and B be in k[x]. k[x] is the ring of polynomials with coefficients in k A Greatest Common Divisor of A and B is a polynomial
1 Shortest Vector Problem
Lattices in Cryptography University of Michigan, Fall 25 Lecture 2 SVP, Gram-Schmidt, LLL Instructor: Chris Peikert Scribe: Hank Carter Shortest Vector Problem Last time we defined the minimum distance
1 Fractured Lattices, Integer Programming, and Diophantine Approximation
1 Fractured Lattices, Integer Programming, and Diophantine Approximation Günter Rote dedicated to Prof. Dr. Rainer Burkard (Graz) on the occasion of his 6th birthday Institut für Informatik, Freie Universität
Another View of the Gaussian Algorithm
Another View of the Gaussian Algorithm Ali Akhavi and Céline Moreira Dos Santos GREYC Université de Caen, F-14032 Caen Cedex, France {ali.akhavi,moreira}@info.unicaen.fr Abstract. We introduce here a rewrite
Remainders. We learned how to multiply and divide in elementary
Remainders We learned how to multiply and divide in elementary school. As adults we perform division mostly by pressing the key on a calculator. This key supplies the quotient. In numerical analysis and
CSE 206A: Lattice Algorithms and Applications Spring Basis Reduction. Instructor: Daniele Micciancio
CSE 206A: Lattice Algorithms and Applications Spring 2014 Basis Reduction Instructor: Daniele Micciancio UCSD CSE No efficient algorithm is known to find the shortest vector in a lattice (in arbitrary
4 Powers of an Element; Cyclic Groups
4 Powers of an Element; Cyclic Groups Notation When considering an abstract group (G, ), we will often simplify notation as follows x y will be expressed as xy (x y) z will be expressed as xyz x (y z)
Math1a Set 1 Solutions
Math1a Set 1 Solutions October 15, 2018 Problem 1. (a) For all x, y, z Z we have (i) x x since x x = 0 is a multiple of 7. (ii) If x y then there is a k Z such that x y = 7k. So, y x = (x y) = 7k is also
Chapter 5.1: Induction
Chapter.1: Induction Monday, July 1 Fermat s Little Theorem Evaluate the following: 1. 1 (mod ) 1 ( ) 1 1 (mod ). (mod 7) ( ) 8 ) 1 8 1 (mod ). 77 (mod 19). 18 (mod 1) 77 ( 18 ) 1 1 (mod 19) 18 1 (mod
Short multipliers for the extended gcd problem
Short multipliers for the extended gcd problem Keith Matthews Abstract For given non zero integers s 1,, s m, the problem of finding integers a 1,, a m satisfying s = gcd (s 1,, s m ) = a 1 s 1 + + a m
Carathéodory Bounds for Integer Cones
Carathéodory Bounds for Integer Cones Friedrich Eisenbrand, Gennady Shmonin Max-Planck-Institut für Informatik Stuhlsatzenhausweg 85 66123 Saarbrücken Germany [eisen,shmonin]@mpi-inf.mpg.de 22nd September
Divisibility. Def: a divides b (denoted a b) if there exists an integer x such that b = ax. If a divides b we say that a is a divisor of b.
Divisibility Def: a divides b (denoted a b) if there exists an integer x such that b ax. If a divides b we say that a is a divisor of b. Thm: (Properties of Divisibility) 1 a b a bc 2 a b and b c a c 3
CSE 206A: Lattice Algorithms and Applications Winter The dual lattice. Instructor: Daniele Micciancio
CSE 206A: Lattice Algorithms and Applications Winter 2016 The dual lattice Instructor: Daniele Micciancio UCSD CSE 1 Dual Lattice and Dual Basis Definition 1 The dual of a lattice Λ is the set ˆΛ of all
Factoring univariate polynomials over the rationals
Factoring univariate polynomials over the rationals Tommy Hofmann TU Kaiserslautern November 21, 2017 Tommy Hofmann Factoring polynomials over the rationals November 21, 2017 1 / 31 Factoring univariate
Extended gcd and Hermite normal form algorithms via lattice basis reduction
Extended gcd and Hermite normal form algorithms via lattice basis reduction George Havas School of Information Technology The University of Queensland Queensland 4072, Australia URL: http://www.it.uq.edu.au/personal/havas/
Short solutions for a linear Diophantine equation
Lecturas Matemáticas Volumen 27 (2006), páginas 5 16 Short solutions for a linear Diophantine equation H. Esmaeili Bu-Ali Sina University, Hamedan, Iran Abstract. It is known that finding the shortest
Sec$on Summary. Mathematical Proofs Forms of Theorems Trivial & Vacuous Proofs Direct Proofs Indirect Proofs
Section 1.7 Sec$on Summary Mathematical Proofs Forms of Theorems Trivial & Vacuous Proofs Direct Proofs Indirect Proofs Proof of the Contrapositive Proof by Contradiction 2 Proofs of Mathema$cal Statements
2WF15 - Discrete Mathematics 2 - Part 1. Algorithmic Number Theory
1 2WF15 - Discrete Mathematics 2 - Part 1 Algorithmic Number Theory Benne de Weger version 0.54, March 6, 2012 version 0.54, March 6, 2012 2WF15 - Discrete Mathematics 2 - Part 1 2 2WF15 - Discrete Mathematics
Intermediate Math Circles February 29, 2012 Linear Diophantine Equations I
Intermediate Math Circles February 29, 2012 Linear Diophantine Equations I Diophantine equations are equations intended to be solved in the integers. We re going to focus on Linear Diophantine Equations.
Hard Instances of Lattice Problems
Hard Instances of Lattice Problems Average Case - Worst Case Connections Christos Litsas 28 June 2012 Outline Abstract Lattices The Random Class Worst-Case - Average-Case Connection Abstract Christos Litsas
Primitive sets in a lattice
Primitive sets in a lattice Spyros. S. Magliveras Department of Mathematical Sciences Florida Atlantic University Boca Raton, FL 33431, U.S.A spyros@fau.unl.edu Tran van Trung Institute for Experimental
Continued Fractions: Introduction and Applications
PROCEEDINGS OF THE ROMAN NUMBER THEORY ASSOCIATION Volume 2, Number, March 207, pages 6-8 Michel Waldschmidt Continued Fractions: Introduction and Applications written by Carlo Sanna The continued fraction
Column Basis Reduction, Decomposable Knapsack. and Cascade Problems. Gábor Pataki. joint work with Bala Krishnamoorthy. What is basis reduction?
Column Basis Reduction, Decomposable Knapsack and Cascade Problems Slide 1 Gábor Pataki Dept. of Statistics and Operations Research UNC, Chapel Hill joint work with Bala Krishnamoorthy Dept. of Mathematics,
Basic Algorithms in Number Theory
Basic Algorithms in Number Theory Algorithmic Complexity... 1 Basic Algorithms in Number Theory Francesco Pappalardi #2-b - Euclidean Algorithm. September 2 nd 2015 SEAMS School 2015 Number Theory and
M4. Lecture 3. THE LLL ALGORITHM AND COPPERSMITH S METHOD
M4. Lecture 3. THE LLL ALGORITHM AND COPPERSMITH S METHOD Ha Tran, Dung H. Duong, Khuong A. Nguyen. SEAMS summer school 2015 HCM University of Science 1 / 31 1 The LLL algorithm History Applications of
Example: This theorem is the easiest way to test an ideal (or an element) is prime. Z[x] (x)
![Example: This theorem is the easiest way to test an ideal (or an element) is prime. Z[x] (x)](/thumbs/96/126601816.jpg "Example: This theorem is the easiest way to test an ideal (or an element) is prime. Z[x] (x)")
Math 4010/5530 Factorization Theory January 2016 Let R be an integral domain. Recall that s, t R are called associates if they differ by a unit (i.e. there is some c R such that s = ct). Let R be a commutative
Ch 4.2 Divisibility Properties
Ch 4.2 Divisibility Properties - Prime numbers and composite numbers - Procedure for determining whether or not a positive integer is a prime - GCF: procedure for finding gcf (Euclidean Algorithm) - Definition:
NOTES ON INTEGERS. 1. Integers
NOTES ON INTEGERS STEVEN DALE CUTKOSKY The integers 1. Integers Z = {, 3, 2, 1, 0, 1, 2, 3, } have addition and multiplication which satisfy familar rules. They are ordered (m < n if m is less than n).
Lecture notes: Algorithms for integers, polynomials (Thorsten Theobald)
Lecture notes: Algorithms for integers, polynomials (Thorsten Theobald) 1 Euclid s Algorithm Euclid s Algorithm for computing the greatest common divisor belongs to the oldest known computing procedures
cse547, math547 DISCRETE MATHEMATICS Professor Anita Wasilewska
cse547, math547 DISCRETE MATHEMATICS Professor Anita Wasilewska LECTURE 12 CHAPTER 4 NUMBER THEORY PART1: Divisibility PART 2: Primes PART 1: DIVISIBILITY Basic Definitions Definition Given m,n Z, we say
Ehrhart polynomial for lattice squares, cubes, and hypercubes
Ehrhart polynomial for lattice squares, cubes, and hypercubes Eugen J. Ionascu UWG, REU, July 10th, 2015 math@ejionascu.ro, www.ejionascu.ro 1 Abstract We are investigating the problem of constructing
CS 290G (Fall 2014) Introduction to Cryptography Oct 21st, Lecture 5: RSA OWFs
CS 290G (Fall 2014) Introduction to Cryptography Oct 21st, 2014 Instructor: Rachel Lin 1 Recap Lecture 5: RSA OWFs Scribe: Harichandan Pulagam In the last class, we continued the discussion of One-Way
Looking back at lattice-based cryptanalysis
September 2009 Lattices A lattice is a discrete subgroup of R n Equivalently, set of integral linear combinations: α 1 b1 + + α n bm with m n Lattice reduction Lattice reduction looks for a good basis
1: Introduction to Lattices
CSE 206A: Lattice Algorithms and Applications Winter 2012 Instructor: Daniele Micciancio 1: Introduction to Lattices UCSD CSE Lattices are regular arrangements of points in Euclidean space. The simplest
Worst case complexity of the optimal LLL algorithm
Worst case complexity of the optimal LLL algorithm ALI AKHAVI GREYC - Université de Caen, F-14032 Caen Cedex, France aliakhavi@infounicaenfr Abstract In this paper, we consider the open problem of the
a = qb + r where 0 r < b. Proof. We first prove this result under the additional assumption that b > 0 is a natural number. Let
2. Induction and the division algorithm The main method to prove results about the natural numbers is to use induction. We recall some of the details and at the same time present the material in a different
Diophantine equations via weighted LLL algorithm
Cryptanalysis of a public key cryptosystem based on Diophantine equations via weighted LLL algorithm Momonari Kudo Graduate School of Mathematics, Kyushu University, JAPAN Kyushu University Number Theory
Elementary Number Theory Review. Franz Luef
Elementary Number Theory Review Principle of Induction Principle of Induction Suppose we have a sequence of mathematical statements P(1), P(2),... such that (a) P(1) is true. (b) If P(k) is true, then
Selected Math 553 Homework Solutions
Selected Math 553 Homework Solutions HW6, 1. Let α and β be rational numbers, with α 1/2, and let m > 0 be an integer such that α 2 mβ 2 = 1 δ where 0 δ < 1. Set ǫ:= 1 if α 0 and 1 if α < 0. Show that
Lattices and the Shortest Vector Problem
Lecture 18 Lattices and the Shortest Vector Problem December, 004 Lecturer: Kamal Jain Notes: Chris Ré 18.1 Overview In this lecture, we will show first that every lattice has a basis that can be found
NUMBER SYSTEMS. Number theory is the study of the integers. We denote the set of integers by Z:
NUMBER SYSTEMS Number theory is the study of the integers. We denote the set of integers by Z: Z = {..., 3, 2, 1, 0, 1, 2, 3,... }. The integers have two operations defined on them, addition and multiplication,
Notes on Continued Fractions for Math 4400
. Continued fractions. Notes on Continued Fractions for Math 4400 The continued fraction expansion converts a positive real number α into a sequence of natural numbers. Conversely, a sequence of natural
Solutions Math 308 Homework 9 11/20/2018. Throughout, let a, b, and c be non-zero integers.
Throughout, let a, b, and c be non-zero integers. Solutions Math 308 Homework 9 11/20/2018 1. Consider the following statements: i. a is divisible by 3; ii. a is divisible by 9; iii. a is divisible by
Arithmetic Algorithms, Part 1
Arithmetic Algorithms, Part 1 DPV Chapter 1 Jim Royer EECS January 18, 2019 Royer Arithmetic Algorithms, Part 1 1/ 15 Multiplication à la Français function multiply(a, b) // input: two n-bit integers a
HW2 Solutions
8.024 HW2 Solutions February 4, 200 Apostol.3 4,7,8 4. Show that for all x and y in real Euclidean space: (x, y) 0 x + y 2 x 2 + y 2 Proof. By definition of the norm and the linearity of the inner product,
INTEGERS. In this section we aim to show the following: Goal. Every natural number can be written uniquely as a product of primes.
INTEGERS PETER MAYR (MATH 2001, CU BOULDER) In this section we aim to show the following: Goal. Every natural number can be written uniquely as a product of primes. 1. Divisibility Definition. Let a, b
Lecture 7.5: Euclidean domains and algebraic integers
Lecture 7.5: Euclidean domains and algebraic integers Matthew Macauley Department of Mathematical Sciences Clemson University http://www.math.clemson.edu/~macaule/ Math 4120, Modern Algebra M. Macauley
CSE20: Discrete Mathematics
Spring 2018 Today Greatest Common Divisor (GCD) Euclid s algorithm Proof of Correctness Reading: Chapter 4.3 Primes and GCD Universe: U = N = {0, 1, 2,...} a divides b (written a b) iff k.b = ak Set of
9 Knapsack Cryptography
9 Knapsack Cryptography In the past four weeks, we ve discussed public-key encryption systems that depend on various problems that we believe to be hard: prime factorization, the discrete logarithm, and
The Fundamental Theorem of Arithmetic
Chapter 1 The Fundamental Theorem of Arithmetic 1.1 Primes Definition 1.1. We say that p N is prime if it has just two factors in N, 1 and p itself. Number theory might be described as the study of the
Gaussian integers. 1 = a 2 + b 2 = c 2 + d 2.
Gaussian integers 1 Units in Z[i] An element x = a + bi Z[i], a, b Z is a unit if there exists y = c + di Z[i] such that xy = 1. This implies 1 = x 2 y 2 = (a 2 + b 2 )(c 2 + d 2 ) But a 2, b 2, c 2, d
COS 598D - Lattices. scribe: Srdjan Krstic
COS 598D - Lattices scribe: Srdjan Krstic Introduction In the first part we will give a brief introduction to lattices and their relevance in some topics in computer science. Then we show some specific
CHAPTER I. Rings. Definition A ring R is a set with two binary operations, addition + and
CHAPTER I Rings 1.1 Definitions and Examples Definition 1.1.1. A ring R is a set with two binary operations, addition + and multiplication satisfying the following conditions for all a, b, c in R : (i)
ALGEBRA HANDOUT 2.3: FACTORIZATION IN INTEGRAL DOMAINS. In this handout we wish to describe some aspects of the theory of factorization.
ALGEBRA HANDOUT 2.3: FACTORIZATION IN INTEGRAL DOMAINS PETE L. CLARK In this handout we wish to describe some aspects of the theory of factorization. The first goal is to state what it means for an arbitrary
A Hybrid Method for Lattice Basis Reduction and. Applications
A Hybrid Method for Lattice Basis Reduction and Applications A HYBRID METHOD FOR LATTICE BASIS REDUCTION AND APPLICATIONS BY ZHAOFEI TIAN, M.Sc. A THESIS SUBMITTED TO THE DEPARTMENT OF COMPUTING AND SOFTWARE
Part IX ( 45-47) Factorization
Part IX ( 45-47) Factorization Satya Mandal University of Kansas, Lawrence KS 66045 USA January 22 45 Unique Factorization Domain (UFD) Abstract We prove evey PID is an UFD. We also prove if D is a UFD,
Senior Math Circles Cryptography and Number Theory Week 2
Senior Math Circles Cryptography and Number Theory Week 2 Dale Brydon Feb. 9, 2014 1 Divisibility and Inverses At the end of last time, we saw that not all numbers have inverses mod n, but some do. We
Chapter 14: Divisibility and factorization
Chapter 14: Divisibility and factorization Matthew Macauley Department of Mathematical Sciences Clemson University http://www.math.clemson.edu/~macaule/ Math 4120, Summer I 2014 M. Macauley (Clemson) Chapter
Prof. Ila Varma HW 8 Solutions MATH 109. A B, h(i) := g(i n) if i > n. h : Z + f((i + 1)/2) if i is odd, g(i/2) if i is even.
1. Show that if A and B are countable, then A B is also countable. Hence, prove by contradiction, that if X is uncountable and a subset A is countable, then X A is uncountable. Solution: Suppose A and
A Disaggregation Approach for Solving Linear Diophantine Equations 1
Applied Mathematical Sciences, Vol. 12, 2018, no. 18, 871-878 HIKARI Ltd, www.m-hikari.com https://doi.org/10.12988/ams.2018.8687 A Disaggregation Approach for Solving Linear Diophantine Equations 1 Baiyi
Congruence of Integers
Congruence of Integers November 14, 2013 Week 11-12 1 Congruence of Integers Definition 1. Let m be a positive integer. For integers a and b, if m divides b a, we say that a is congruent to b modulo m,
3 Finite continued fractions
MTH628 Number Theory Notes 3 Spring 209 3 Finite continued fractions 3. Introduction Let us return to the calculation of gcd(225, 57) from the preceding chapter. 225 = 57 + 68 57 = 68 2 + 2 68 = 2 3 +
Induction. Induction. Induction. Induction. Induction. Induction 2/22/2018
The principle of mathematical induction is a useful tool for proving that a certain predicate is true for all natural numbers. It cannot be used to discover theorems, but only to prove them. If we have
Modular Arithmetic and Elementary Algebra
18.310 lecture notes September 2, 2013 Modular Arithmetic and Elementary Algebra Lecturer: Michel Goemans These notes cover basic notions in algebra which will be needed for discussing several topics of
satisfying ( i ; j ) = ij Here ij = if i = j and 0 otherwise The idea to use lattices is the following Suppose we are given a lattice L and a point ~x
Dual Vectors and Lower Bounds for the Nearest Lattice Point Problem Johan Hastad* MIT Abstract: We prove that given a point ~z outside a given lattice L then there is a dual vector which gives a fairly
Topics in Basis Reduction and Integer Programming
Topics in Basis Reduction and Integer Programming Mustafa Kemal Tural A dissertation submitted to the faculty of the University of North Carolina at Chapel Hill in partial fulfillment of the requirements
Objective Type Questions
DISTANCE EDUCATION, UNIVERSITY OF CALICUT NUMBER THEORY AND LINEARALGEBRA Objective Type Questions Shyama M.P. Assistant Professor Department of Mathematics Malabar Christian College, Calicut 7/3/2014
Lecture Notes Math 371: Algebra (Fall 2006) by Nathanael Leedom Ackerman
Lecture Notes Math 371: Algebra (Fall 2006) by Nathanael Leedom Ackerman October 17, 2006 TALK SLOWLY AND WRITE NEATLY!! 1 0.1 Factorization 0.1.1 Factorization of Integers and Polynomials Now we are going
Homework 7 Solutions, Math 55
Homework 7 Solutions, Math 55 5..36. (a) Since a is a positive integer, a = a 1 + b 0 is a positive integer of the form as + bt for some integers s and t, so a S. Thus S is nonempty. (b) Since S is nonempty,
Solutions to Homework Set 1
Solutions to Homework Set 1 1. Prove that not-q not-p implies P Q. In class we proved that A B implies not-b not-a Replacing the statement A by the statement not-q and the statement B by the statement
Note on shortest and nearest lattice vectors
Note on shortest and nearest lattice vectors Martin Henk Fachbereich Mathematik, Sekr. 6-1 Technische Universität Berlin Straße des 17. Juni 136 D-10623 Berlin Germany henk@math.tu-berlin.de We show that
NOTES ON FINITE FIELDS
NOTES ON FINITE FIELDS AARON LANDESMAN CONTENTS 1. Introduction to finite fields 2 2. Definition and constructions of fields 3 2.1. The definition of a field 3 2.2. Constructing field extensions by adjoining
Branching proofs of infeasibility in low density subset sum problems
Branching proofs of infeasibility in low density subset sum problems Gábor Pataki and Mustafa Tural We prove that the subset sum problem Abstract ax = β x {0, 1} n (SUB) has a polynomial time computable
Block Korkin{Zolotarev Bases. and Successive Minima. C.P. Schnorr TR September Abstract
Block Korkin{Zolotarev Bases and Successive Minima P Schnorr TR-9-0 September 99 Abstract A lattice basis b ; : : : ; b m is called block Korkin{Zolotarev with block size if for every consecutive vectors
Cryptanalysis via Lattice Techniques
Cryptanalysis via Lattice Techniques Alexander May Horst Görtz Institute for IT-Security Faculty of Mathematics Ruhr-University Bochum crypt@b-it 2010, Aug 2010, Bonn Lecture 1, Mon Aug 2 Introduction
5: The Integers (An introduction to Number Theory)
c Oksana Shatalov, Spring 2017 1 5: The Integers (An introduction to Number Theory) The Well Ordering Principle: Every nonempty subset on Z + has a smallest element; that is, if S is a nonempty subset
Course 2316 Sample Paper 1
Course 2316 Sample Paper 1 Timothy Murphy April 19, 2015 Attempt 5 questions. All carry the same mark. 1. State and prove the Fundamental Theorem of Arithmetic (for N). Prove that there are an infinity
Katz, Lindell Introduction to Modern Cryptrography
Katz, Lindell Introduction to Modern Cryptrography Slides Chapter 8 Markus Bläser, Saarland University Weak factoring experiment The weak factoring experiment 1. Choose two n-bit integers x 1, x 2 uniformly.
Public Key Encryption
Public Key Encryption 3/13/2012 Cryptography 1 Facts About Numbers Prime number p: p is an integer p 2 The only divisors of p are 1 and p s 2, 7, 19 are primes -3, 0, 1, 6 are not primes Prime decomposition
Algorithmic number theory. Questions/Complaints About Homework? The division algorithm. Division
Questions/Complaints About Homework? Here s the procedure for homework questions/complaints: 1. Read the solutions first. 2. Talk to the person who graded it (check initials) 3. If (1) and (2) don t work,
1. multiplication is commutative and associative;
Chapter 4 The Arithmetic of Z In this chapter, we start by introducing the concept of congruences; these are used in our proof (going back to Gauss 1 ) that every integer has a unique prime factorization.