Lattices. Mathematical background

Transcription

1 Lattces Mathematcal backgroud

2 Lattces : -dmesoal Eucldea space. That s, { T x } x x = (,, ) :,. T T If x= ( x,, x), y = ( y,, y), the xy, = xy (er product of xad y) x = /2 xx, (Eucldea legth or orm of x) x y: Eucldea dstace betwee x ad y. Defto : A lattce L s a dscrete subgroup of. subgroup: f x, y L, the x y L. dscrete: ε > 0 s.t. x y ε for all x y L.

3 Defto 2: A -dmesoal lattce of rak m s a subset { b b } L of the form L= x + + x : x m m where b,, b are learly depedet vectors. m Every vector L s a teger lear combato of b,, b. m ( ) Bass: B= b,, b s called a bass of L. L has full rak f m=. We wll be mostly terested full rak lattces, ad call them m -dmetoal lattces. We deote by L( B) the lattce geerated by B. Thus, { m } f B s a bass, the L ( B) = B m = Bx : x.

4 Let b,, b (ot ecessarly learly depedet). ( b b ) { b + + b } Let L,, x x : x. m m m m ( b b ) Theorem. L,, s a lattce f b,, bm, or f b,, b are learly depedet. ( b b ) m m ( ) ( ) Whe L b,, b s a lattce, b,, b s sad to be m a geerator. If the b 's are further leraly depedet, the,, s a m ba ss. m

5 Example lattces Zero lattce: 0. Lattce of tegers:. Itegral lattces : sublattces of. { m q} m Λ ( A) x : Ax = 0 mod, where A s q a matrx of dmesos m, ad q a teger. L, ( ) = { x+ y xy } 2 2 :, s ot a lattce, for there ( ) exsts a sequece of ratoals x y s.t. x y 2.

6 A Lattce 2 dmesos Source:

7 A dfferet bass for the same lattce Source:

8 Lattce Bases Umodular matrx: determat = ±. square, havg teger etres, ad ( ) If A= a ad det 0, the ( ) j A A = cj, where det A + j c = ( ) det A, j A j = A j wth row j ad colum omted. det A Furthermore, det. A If A s umodular, the A s umodular. =

9 Theorem: Two bases B ad C geerate the same lattce,.e., L( B) = L( C), ff B = CU for some umodular matrx U. Proof: U ( ) Assume B = CU, U umodular. The C = BU umodular. B = CU L( B) L( C) C BU L( C) L( B) = L( B) = L( C). ( ) Assume L( B) = L( C). Each b B s the lattce, hece m b = C v for some v, m, ad B = CV, where V = ( v ). Smlarly, C= BW for some square teger matrx W. Hece ( ) ( l. dep.) B = BWV B I WV = 0 I WV = 0 B det W det V = det WV = det I = det W = det V = ±.,

10 For each >, there s a fte umber of -dmetoal umodular matrces. a a For example, s umodular for ay a. Each lattce of rak > has a fte umber of bases.

11 Fudametal Parallelepped ( ) Let B= b,, b be a full rak bass. Fudametal parallelepped assocated to B : { T B x x } P( B) = : = ( x,, x ), 0 x <. Cetered fudametal parallelepped: C( B) { T B x x x } x x = : = (,, ), 2 < 2. P( B) ad C( B) are half ope.

12 v L( B) { P B + v v L B } The traslates ( ) : ( ) form a partto of the whole space : ( P( B) v) = + For ay t, there exsts a uque pot r P( B) s.t. x r L( B). Ths uque r s deoted by tmod B. tmod B ca be computed effcetly as: tmod B= t B B t where x rouds x's coordates x to x.

13 v L( B) ( C( B) v) { C B + v v L B } Smlarly, the traslates ( ) : ( ) form a partto of the whole space : = + For ay t, there exsts a uque pot r C( B) s.t. x r L( B). Let's deote ths uque r s also by t mod B. tmod B ca be computed effcetly as: tmod B t B B t = where x rouds x's coordates to the earest teger.

14 Gram-Schmdt orthogoalzato ( ) A bass B= b,, b of a vector space s f b, b = 0 for j. B s orthoormal f b, b = δ, where s Kroecker's delta. Ay bass B= ( b,, b ) orthogoal j j δ j ca be trasformed to a ( ) orthogoal bass B = b,, b usg the well-kow Gram-Schmdt orthogoalzato process: b = b. b, b b, b j j = µ, j jwhere µ, j= =. 2 j< b j, b j b j b b b

15 Determat B, C : full rak bases. B : the Gram-Schmdt bass of B. Theorem : If are two bases of the same lattce, the det B= det C. Also, det B b. Defto: The B, C ± = determat of a lattce ( P ) L( B) s det Λ= det L( B) = vol ( B) = b = det B. Λ= Ths quatty s a varat of Λ, depedet of bases.

16 Hermte ormal form A square, o-sgular, teger or ratoal matrx B s Hermte ormal form (HNF) ff B s lower tragular ( b = 0 for < j) For all j<, 0 b < b. j j = ( b ) j Some authors prefer usg upper tragular matrces. Examples: or

17 HNF for sgular or o-square matrces ( ) A teger or ratoal m matrx B = b s HNF f j 2, k, j ( ) ( ) < < < s.t. b 0 j h. For all k < j, 0 b < b. h j j j j Example:

18 The frst h colums are learly depedet. Theorem: lattce, the at the ed). If two matrces B, B HNF geerate the same B= B (except for the umber of zero-colums Theorem: Ay lattce L( B) has a uque bass H HNF, whch ca be costructed from B polyomal tme. HNF s useful for solvg may lattce problems. Bass Pro ble m: Gve a set of ratoal vectors bass for the lattce L( B). B, fd a

19 Good bases ad bad basses ( ) Let B= b,, b be a bass of lattce L. Roughly speakg, B s a good bass f the vectors b the equalty HNF( L) s a bad are reasoably short ad early orthogoal b bass ad s a good choce for the publc lattce bass. It reveals o more fo about L's structure tha ay other bass, because HNF( L) bass polyomal tme. det( L) comes close to equalty. ca be computed from ay

20 Dual Lattce The dual of a (full rak) lattce Λ= L( B) s the set { x xv v } Λ = :, for all Λ. Theorem: bass The dual of a lattce T ( ) ( T) Λ= L( B) s a lattce wth D= B = B. That s, L( D) = Λ. L ( ) D Λ D Λ db j db = D B= I T ( ) j, j. Λ L( D) : If x Λ, the xb, for all j, whch meas j T Bx x B = D = D ( T) L( )

21 Mmum dstace ad shortest vector Defto: The mmum dstace of a lattce Λ= L( B) s the smallest dstace betwee ay two lattce pots: { x y xy x y} λ( Λ ) = m :, Λ,. Note tha t λ( Λ) s equal to the legth of a shortest ozero lattce vector: { x x x 0} λ( Λ ) = λ ( Λ ) = m : Λ,. We ca use m because lattces are dscrete.

22 Successve mma Defto: For ay lattce Λ ad teger k rak( Λ), let λ ( Λ) be the smallest rs.t. the closed ball Br ( ) cotas at k least k learly depedet lattce vectors. That s, { x x x x Λ } λ ( Λ ) = m max,, :,, learly d. k k k //legth of the kth shortest learly depedet vector// Obvously, λ ( Λ) λ ( Λ) λ ( Λ). 2 k λ,, λ are called succesve mma of k frst mmum, secod mmum, ad so o. Λ :

23 Easy Lattce Problems Equvalece problem: Gve two bases B ad B, determe f they geerate Soluto: Sum of lattces: the same lattce, L( B) = L( B ). Compute ad check f HNF( B) = HNF( B ). Gve bases B ad B, fd a bass for the smallest lattce cotag both L( B) ad L( B ), whch s Soluto: { } L( B) + L( B ) = x+y: x L( B), y L( B ). Compute HNF( BB, ). Cotamet problem: Gve two bases B ad B, determe f L( B) L( B ). Soluto: Is HNF( B ) = HN F ( BB, )?

24 Membershp problem: Soluto: Is v L( B)? Check f HNF( Bv, ) = HNF( B). Dual lattce: Gve a lattce bass B, compute ts dual. Soluto: T ( ) ( T) D: = B or B. Itersecto of lattces: Gve two bases B ad B, fd a bass for the tersecto L( B) L( B ). Soluto: If D, D are the dual of B, B, the the dual lattce of L( B) L( B ) s L( DD, ). So, Compute the dual bases D, D of B, B. Compute a bass for L( DD, ) : H: = HNF( DD, ). Compute the dual of H.

25 Cyclc lattce: Let r( x) be the cyclc rotato of vector x,.e., r( x,, x ) = ( x, x,, x ). A lattce Λ s cyclc ff x Λ mples r( x) Λ. (, ) Problem: Gve B= b, b { } j ( x ) 0 ( b ) : 0,, where ( x) x ad m, fd the smallest cyclc lattce cotag L( B). Sol: The lattce geerated by all the vector rotatos r m j r = r ( x) = r r ( ). Problem: Is a gve lattce L( B) cyclc? Sol: ( ) L( B) cyclc r L( B) L( B) r( B) L( B).

26 Some Importat Hard Lattce Problems

27 Shortest Vector Problems Exact Shortest Vector Problem (SVP): Gve a bass for a lattce vector v L of legth λ ( L). of rak, fd a ozero Approxmate Shortest Vector Problem (SVP ): L Gve a bass for a lattce L of rak, fd a ozero vector v L of legth at most γ λ ( L). (The approxmato factor γ may be a fucto of.) γ SVP has bee studed sce the tme of Gauss (80).

28 Hardess of SVP γ NP-hard for ay costat γ. There s o polyomal algorthm uless P = NP. γ = c log log Hard for ( ) for some 0. There s o polyomal algorthm uless NP c > RSUBEXP. Caot be NP-hard for γ ( ) = log uless NP coam. Caot be NP-hard for γ ( ) = uless NP = conp. costat c log log log NP-hard hard ulkely NP-hard ulkely NP-hard

29 SVP ca be solved polyomal tme γ γ ( ) = 2 /2 LLL algorthm (982): for. Determstc algorthm. O( (log log ) log ) Schorr (985) : for γ ( ) = 2. Determstc algorthm. Olog log log Ajta, Kumar, ad Svakumar(200) : γ ( ) = 2. Ramdomzed algorthm wth bouded error. 2 ( ) ( ) Olog log log O( (log log ) log ) /2 ulkely NP-hard BPP P P

30 SVP : ope problems γ It would be a breakthrough f oe ca: Solve SVP polyomal tme for some c > 0. c Prove SVP hard or NP-hard for ε some ε > 0.

31 Two other mportat problems: CVP ad SIVP Closest Vector Problem (CVP ): Gve a bass for a lattce (of rak ) L a vector t, fd a ozero vector v L s. t. t v γ ( ) dst( t, L). γ ad Shortest Idepedet Vectors Problem (SIVP ): Gve a bass for a lattce L of rak, fd learly depedet vectors v γ( ) λ ( ).,, v L of legth at most γ

32 CVP γ s at least as hard as SVP γ Theorem: SVP ca be reduced to CVP : SVP CVP. γ γ γ γ ( b b ) Proof (for γ = ) : Let B=,, be the put to SVP. Wsh to fd a shortest vector s ( L ) = x b L( B) by callg CVP. The dea s to cosder a sublattce L L( B) ad a pot c L L s.t. c+ s L, whch case, dst( c, L ) = s. Thus, f y CVP, c the y c s a a soluto to SVP( L). Based o ths dea, for each, cosder the pot b { } = ( ) ad the sublattce L geerated by B = b,, 2 b,, b. We have ( ) b L L, ad b + s L f x s odd. Let y CVP B, b. The shortest vector y b s a shortest vector L( B).

33 Relatoshp amog SVP, CVP SVP CVP. γ SIVP CVP. γ SVP SIVP. γ γ SIVP γ γ, γ Ope problem: SVP γ SIVP? γ

34 Bouded Dstace Decodg Problem ( BDDP ): Gve a lattce L ad a vector t satsfyg s.t. t ( + ) dst( t, L) < λ ( L) γ( ), v γ ( ) dst( t, L). fd a ozero vector v L γ Same as CVP γ except for the "bouded" codto o t, whch mples a uque soluto. Uqueess: The vector v L wth t v = dst( t, L)) s obvously a soluto, ad ay other w L s ot a soluto sce t w v w v t λ ( ) dst( t, L) ( γ ) > ( ) + dst( t, L) dst( t, L) = γ( ) dst( t, L).

35 Cetered Orthogoalzed Parallelepped ( ) m Let B= b,, b be a bass. ( ) Let B = b,, b be the Gram-Schmdt matrx of B. Cetered orthogoalzed parallelepped: T ( B ) = B x: x= (,, ), C x x { x } < 2 2. v L ( B) ( ) C( B ) s a fudametal rego: Spa( B) = C( B ) + v. Nearest plae algorthm: Gve a target pot t Spa( B), fd the uque cell C( B ) + v that cotas t.

36 A Lattce 2 dmesos Source:

37 Nearest Plae Algorthm Gve B ad t, fd a lattce pot v= cb + + c b L( B) 2 [ ) s.t. t v, b b 2, 2 for all. I partcular, f t Spa( B), the t C( B ) + v. Let L( B ) be the sublattce geerated by B = b,, b. L( B) ca be decomposed to "sublattces" ( ) ( ) L( B) = cb + L( B) cb + spa( B) c c ( ) The hyperplae cb + spa( B ) closest to t s whe c= 2 t, b b. We choose c = c.

38 ( ) Algorthm NearestPlae( B= b,, b, t) f = 0 the retur 0 else B Gram-Schmdt( B) c t, b b 2 ( ) retur cb + NearestPlae( b,, b, t cb )

39 Correstess Proof By ducto. For = 0, the output meets the requremet. Assume the algorthm returs a correct aswer for raks <. ( ) ( ) ( ) Let C= b,, b ad B= C, b. The B = C, b. By IH, the recursve call returs a lattce pot v L( C) s.t. [ ) ( t cb ) v, b 2, 2 b for all =,...,. The output of the algorthm s v = v + cb. 2 [ ) Need to prove t v, b 2, 2 b for all. 2

40 For t v, b = t ( v + cb ), b = ( t cb ) v, b. For =,, t follows from the IH sce t ( v + cb ), b = t, b v, b c b, b b 2 2 b t, b = c 2 2 [, 2 ). b where we have used v, b = 0 ad b, b = b. 2

41 Nearest Plae Algorthm ad Closest Vector Problem ( L B ) Fact: λ ( ) m b. The fudametal rego C( B ) cotas a sphere cetered at ( L ) 0 of radus ρ = m b 2 λ ( B) 2. Thus, f a pot t s wth dstace ρ of a lattce pot v L( B), the v s the closest lattce pot to t. NearestPlae( Bt, ) wll solve the CVP.

42 Recall RSA Cryptosystem Key geerato: (a) Radomly geerate : = pq for large prmes p, q. (b) Publc key: e, coprme to ϕ( ). (c) Secret key: : mod ( ). d = e ϕ The securty of RSA requres that breakg RSA s hard for all (but a eglgble porto of) staces. By breakg RSA we mea fdg the secret key. It depeds o the assumpto that factorg g e erated semprme = pq s hard. a radomly

43 Ajta's worst-case to average-case reducto Worst-case to worst-case reducto, say P P2: If there s a algorthm that solves P2 the worst case, the there s a algorthm that slove P the worst case. Worst-case to average-case reducto, say P P2: If there s a algorthm that solves a radomly geerated stace of P2 wth oeglgble probablty, the there s a algorthm that solves the worst case of P wth probablty. I 996, Ajta establshed such a worst-case to average-case reducto for some lattce problems.

44 m Let A be a matrx of dmesos m, ad q a c2 teger, where log ad. Defe Λ q m= c q= ( A) x : Ax 0 mod. Ajta showed { m = q} c worst -case -uque-svp o a -dmetoal lattce average-case SVP o Λ q ( A) for some c ad c. 2 Based o ths reducto, Ajta ad Dwork 997 costructed a publc-key cryptosystem whose securty depeds o the (cojectured) worst-case hardess of uque-svp.

45 Later whe we study FHE schemes, t s mportat to ote whether the securty s based o worst-case or average-case hardess. Q: Is the securty of RSA based o the worst-case hardess or the average-case hardess of semprme factorzato?