Some Sieving Algorithms for Lattice Problems
|
|
- Shannon Nash
- 5 years ago
- Views:
Transcription
1 Foundations of Software Technology and Theoretical Computer Science (Bangalore) Editors: R. Hariharan, M. Mukund, V. Vinay; pp - Some Sieving Algorithms for Lattice Problems V. Arvind and Pushkar S. Joglekar Institute of Mathematical Sciences C.I.T Campus,Chennai , India {arvind,pushkar}@imsc.res.in ABSTRACT. We study the algorithmic complexity of lattice problems based on Ajtai-Kumar-Sivakumar sieving technique [AKS01]. Given a k-dimensional subspace M R n and a full rank integer lattice L Q n, the subspace avoiding problem SAP, defined by Blömer and Naewe [BN07], is to find a shortest vector in L \ M. We first give a 2 O(n+k log k) time algorithm to solve the subspace avoiding problem. Then, applying this algorithm we obtain the following results: 1. We give a 2 O(n) time algorithm to compute i th successive minima of a full rank lattice L Q n if i is O( n log n ). 2. We give a 2 O(n) time algorithm to solve a restricted closest vector problem CVP where the inputs fulfil a promise about the distance of the input vector from the lattice. 3. We also show that unrestricted CVP has a 2 O(n) exact algorithm if there is a 2 O(n) time exact algorithm for solving CVP with additional input v i L, 1 i n, where v i p is the i th successive minima of L for each i. We give a new approximation algorithm for SAP and the Convex Body Avoiding problem which is a generalization of SAP. Several of our algorithms work for all gauge functions as metric with a natural restriction, where the gauge function is queried as oracle. 1 Introduction Fundamental algorithmic problems concerning integer lattices are the shortest vector problem (SVP) and the closest vector problem(cvp). Given a lattice L R n by a basis, the shortest vector problem (SVP) is to find a shortest non zero vector in L w.r.t. some metric given by a gauge function in general (usually the l p norm for some p). Likewise, the closest vector problem (CVP) takes as input a lattice L R n and vector v R n and asks for a u L closest to v w.r.t. a given metric. These problems have polynomial-time approximation algorithms based on the celebrated LLL algorithm for basis reduction [LLL82]. The fastest known deterministic algorithms for these problem have running time 2O(n log n) ([Kan87], [Bl00]). More recently, in a seminal paper [AKS01] Ajtai, Kumar and Sivakumar gave a 2 O(n) time randomized exact algorithm for SVP. Subsequently, in [AKS02] they gave a 2 O(n) time randomized approximation algorithm for CVP. Their algorithms are based on a generic sieving procedure (introduced by them) that exploits the underlying geometry. Recently, Blömer and Naewe [BN07] gave a different 2 O(n) time randomized approximation algorithm for CVP, also based on the AKS sieving technique. For 1 i n, the i th successive minima λ i (L) is defined as the smallest r such that a ball of radius r around origin contains at least i linearly independent lattice vectors. The successive minimas c V. Arvind and Pushkar S. Joglekar; licensed under Creative Commons License-NC-ND
2 λ i (L) are important lattice parameters. A classical problem is the successive minima problem SMP of finding, for a given lattice L, n linearly independent vectors v 1, v 2,..., v n L such that v i is at most λ i (L). This problem clearly subsumes shortest independent vector problem SIVP where given a lattice L one wants to find linearly independent vectors v 1, v 2,..., v n L such that v i λ n (L). Given a k-dimensional subspace M R n and a full rank integer lattice L Q n, the subspace avoiding problem SAP, is to find a shortest vector in L \ M. The paper [BN07] gives 2 O(n) time approximation algorithm for these problems. No exact 2 O(n) time randomized algorithm is known for CVP or SMP. Recently, it is shown by Micciancio in [Mi08] that CVP is equivalent to several other lattice problems including shortest independent vector problem (SIVP), successive minima problem (SMP), under deterministic polynomial time rank-preserving reductions. This perhaps explains the apparent difficulty of finding a 2 O(n) time exact algorithm for CVP or SMP, because SVP reduces to all of these problems but no reduction is known in the other direction. In particular, the reductions in [Mi08] implies a 2 O(n log n) time exact algorithm for SAP, SMP and SIVP, whereas [BN07] gives 2 O(n) time randomized approximation algorithm for these problems. Our results In this paper we consider some natural restrictions of these problems that can be exactly solved in 2 O(n) time. We obtain these results giving a 2 O(n+k log k) algorithm to solve SAP where n is the rank of the lattice and k is the dimension of the subspace. As our first result we show that given a full rank lattice L Q n there is 2 O(n) time randomized algorithm to compute linearly independent vectors v 1, v 2,..., v i L such that v i = λ i (L) if i is O( n log n ). Given a full rank lattice L Qn and v Q n we also give a 2 O(n) time algorithm to solve CVP(L, v) if the input (v, L) fulfils the promise d(v, L) 3 2 λ O( n log n ) (L). We show that CVP can be solved in 2 O(n) time if there is a 2 O(n) time algorithm to compute a closest vector to v in L where v Q n, L Q n is a full rank lattice and v 1, v 2,..., v n L such that v i p is equal to i th successive minima of L for i = 1 to n are given as an additional input to the algorithm. As a consequence, we can assume that successive minimas are given for free as an input to the algorithm for CVP. We believe that using basis reduction techniques from [Kan87] one might be able to exploit the information about successive minimas of the lattice to get a better algorithm for CVP. We give a new 2 O(n+k log 1/ɛ) time randomized algorithm to solve 1 + ɛ approximation of SAP, where n is rank of the lattice and k is the dimension of subspace. We get better approximation guarantee than the one in [BN07] parametrised on k. We also consider a generalization of SAP (the convex body avoiding problem) and give a singly exponential approximation algorithm for the problem. An important question is whether the AKS sieving technique can be refined to get subexponential time algorithms for the shortest vector problem. The examples considered in this paper show that the AKS sieving technique works for all nice gauge functions. In fact, the algorithms need only an oracle access to the gauge functions. 2
3 2 Preliminaries A lattice L is a discrete additive subgroup of R n, n is called dimension of the lattice. For algorithmic purposes we can assume that L Q n, and even in some cases L Z n. A lattice is usually specified by a basis B = {b 1,, b m }, where b i Q n and b i s are linearly independent. m is called the rank of the lattice. If the rank is n the lattice is said to be a full rank lattice. Although most results in the paper hold for general lattices, for convenience we mainly consider only full-rank lattices. For x Q n let size(x) denote the number of bits for the standard binary representation as an n-tuple of rationals. Let size(l) denote i size(b i ). Next we recall the definition of gauge functions. DEFINITION 1.[gauge function][si45] A function f : R n R is called a gauge function if it satisfies following properties: 1. f (x) > 0 for all x R n \ {0} and f (x) = 0 if x = f (λx) = λ f (x) for all x R n and λ R. 3. f (x + y) f (x) + f (y) for all x, y R n. For v R n we denote f (v) by v f and call it norm of v with respect to gauge function f. It is easy to see that any l p norm satisfies all the above properties. Thus gauge functions generalize the usual l p norms. A gauge function f defines a natural metric d f on R n by setting d f (x, y) = f (x y) for x, y R n. For x R n and r > 0, let B f (x, r) denote the f -ball of radius r with center x with respect to the gauge function f, defined as B f (x, r) = {y R n f (x y) r}. We denote the metric balls with respect to usual l p norm by B p (x, r). Unless specified otherwise we always consider balls in R n. The next well-known proposition characterizes the class of all gauge functions. PROPOSITION 2.[Si45] Let f : R n R be any gauge function then a unit radius ball around origin with respect to f is a n dimensional bounded O-symmetric convex body. Conversely for any n dimensional bounded O-symmetric convex body C, there is a gauge function f : R n R such that B f (0, 1) = C. Given an f -ball of radius r around origin with respect to a gauge function f, from the Proposition 2 it follows that B f (0, r) is an O-symmetric convex body. It is easy to check that for any r > 0 and any constant c we have vol(b f (0, cr)) = c n vol(b f (0, r)), where vol(c) denotes the volume of the corresponding convex body C(see e.g. [Si45]). We now place a natural restriction on the gauge functions f that we consider. For some polynomial p(n), B 2 (0, 2 p(n) ) B f (0, 1) B 2 (0, 2 p(n) ), i.e. there exists a Euclidean sphere of radius 2 p(n) inside the convex body B f (0, 1), and B f (0, 1) is contained inside a Euclidean sphere of radius 2 p(n). We call a gauge function given by a membership oracle as nice gauge function if it satisfies this property. Note that if f is a nice gauge function and v Q n we have size( f (v))=poly(n,size(v)). For a nice gauge function f we can sample points from convex body B f (0, r) almost uniformly at random in poly(size(r),n) time using Dyer-Frieze-Kannan algorithm [DFK91]. It is easy to check that all l p norms p 1 define nice gauge functions. The i th successive minima of a lattice L with respect to l p norm is smallest r > 0 such that B p (0, r) contains at least i linearly independent lattice vectors. It is denoted by λ p i (L). Remarks: In this paper we consider lattice problems with respect to nice gauge functions. Let L be a lattice with basis {b 1, b 2,..., b n } and f be a nice gauge function. Suppose B is a full rank n n matrix with columns b 1, b 2,..., b n. Note that the linear transformation B 1 maps lattice L isomorphically to the standard lattice Z n. Furthermore, it is easy to see that the set C = B 1 (B f (0, 1)) is 3
4 an O-symmetric convex body. So, by Proposition 2, C = B g (0, 1) for some gauge function g. As f is a nice gauge function, simple calculations shows that g is also a nice gauge function. Thus, our algorithms that work for nice gauge functions can be stated for the the standard lattice Z n and a nice gauge function g. However, some of our results hold only for l p norms. Thus, to keep uniformity we allow our algorithms to take arbitrary lattices as input even when the metric is give by a nice gauge function. 3 A Sieving Algorithm for SAP In this section we present a different analysis of the AKS sieving [AKS01, Re04] applied to the Subspace Avoiding Problem (SAP). Our analysis is quite different from that due to Blömer and Naewe [BN07] and gives us improved running time for computing a 1 + ɛ approximate solution. Recall that an input instance of the subspace avoiding problem (SAP) consists of (L, M) where L Q n is a full rank lattice and M R n is a subspace of dimension k. The SAP problem is to find a vector v L \ M with least norm with respect to a nice gauge function f. We give an intuitive outline of our approximation algorithm: Our analysis of AKS sieving will use the fact that the sublattice L M of L is of rank k. We will use the AKS sieving procedure to argue that we can sample 2 O(n+k log(1/ɛ)) points from some coset of L M in 2 O(n+k log(1/ɛ)) time. We can then apply a packing argument in the coset (which is only k-dimensional) to obtain points in the coset that are close to each other. Then, with a standard argument following the original AKS result [AKS01] we can conclude that their differences will contain a good approximation. Suppose, without loss of generality, that the input lattice L R n is n-dimensional given by a basis {b 1,, b n }, so that L = n i=1 Z b i. Let us fix a nice gauge function f and let v L denote a shortest vector in L \ M with respect to gauge function f, i.e. f (x) for x L \ M attains minimum value at x = v. Let s = size(l, M) denote the input size (which is the number of bits for representing the vectors b i and the basis for M). As v is a shortest vector in L \ M and f is a nice gauge function it is quite easy to see that size( f (v)) is bounded by a polynomial in s. Thus, we can scale the lattice L to ensure that 2 f (v) 3. More precisely, we can compute polynomially many scaled lattices from L, so that 2 f (v) 3 holds for at least one scaled lattice. Thus, we can assume that 2 f (v) 3 holds for the lattice L. We first describe the AKS sieving procedure [AKS01] for any gauge function, analyze its running time and explain its key properties. The following lemma is crucially used in the algorithm. LEMMA 3.[Sieving Procedure] Let f : R n R be any gauge function. Then there is a sieving procedure that takes as input a finite set of points {v 1, v 2, v 3,..., v N } B f (0, r), and in N O(1) time it outputs a subset of indices S [N] such that S 5 n and for each i [N] there is a j S with f (v i v j ) r/2. Proof. The sieving procedure is exactly as described in O. Regev s lecture notes [Re04]. The sieving procedure is based on a simple greedy strategy. We start with S = and run the following step for all elements v i, 1 i N. At the i th step we consider v i. If f (v i v j ) > r/2 for all j S include i in the set S and increment i. After completion, for all i [N] there is a j S such that f (v i v j ) r/2. The bound on S follows from a packing argument combined with the fact that vol(b f (0, cr)) = c n vol(b f (0, r)) for any r > 0 and a constant c > 0. More precisely, for any two points v i, v j S we have f (v i v j ) > r/2. Thus, all the convex bodies B f (v i, r/4) for 4
5 v i S are mutually disjoint and are contained in B f (0, r + r/4). Also note that vol(b f (0, dr)) = d n vol(b f (0, r)) for any constant d > 0. It follows that 5 n vol(b f (v i, r/4)) vol(b f (0, r + r/4)). Hence, S 5 n. The second property of S is guaranteed by the sieving procedure. Next, our algorithm follows the usual AKS random sampling procedure. Let R = n max i b i f. It is clear that size(r) is polynomial in s since f is a nice gauge function. Let B f (0, 2) denote the f -ball of radius 2 around the origin. Since we have an oracle for membership in B f (0, 2) and f is a nice gauge function we can almost uniformly sample from B f (0, 2) using a well-known algorithm [DFK91]. Let x 1, x 2,, x N denote such a random sample, for N = 2 c (n+k log(1/ɛ)) log R where the constant c > 0 will be suitably chosen. Now, using the lattice L we can round off the points x i. More precisely, we express x i = Σ j α ij b j for rationals α ij. Then, from each vector x i we compute the vector y i = Σ j β ij b j, where 0 β ij < 1, by adding appropriate integral multiples of the b j s to the expression for x i. Thus, the points y 1,, y N are in the interior of the fundamental parallelepiped of L, and each x i y i L. We denote this by y i = x i (mod L). We now have the set of N pairs P = {(x i, y i ) i [N]}, where x i y i are lattice points. Since y i lie inside the fundamental parallelepiped we have y i f n max i b i f = R for i = 1 to N. Now, we apply the AKS sieving procedure in Lemma 3 to the set {y 1, y 2,, y N }. The result is a subset S [N] of at most 5 n indices such that for each i [N] there is some j S such that f (y i y j ) R/2. We remove from P all (x j, y j ) for j S and replace each remaining (x i, y i ) P by a corresponding (x i, y i (y j x j )), where j S is the first index such that f (y i y j ) R/2. After the sieving round, the set P has the property that for each (x i, z i ) P we have x i z i L and f (x i z i ) 4 + R/2, and P has shrunk in size by at most 5 n. We continue with O(log R) sieving rounds so that we are left with a set P with N O(log R)5 n pairs (x i, z i ) such that x i z i L and f (x i z i ) 8. We can ensure that P 2 c (n+k log(1/ɛ)) for an arbitrary constant c by appropriately choosing constant c. The vectors, x i z i for (x i, z i ) P follows some distribution among lattice points inside B f (0, 8). Next we need following simple proposition. PROPOSITION 4. Let L R n be a rank n lattice, v L such that 2 f (v) 3 for a nice gauge function f. Consider the convex regions C = B f ( v, 2) B f (0, 2) and C = B f (v, 2) B f (0, 2). Then C = C + v and vol(c) = vol(c ) = Ω( vol(b f (0,2)) 2 O(n) ). The Proposition 4, immediately follows since B f ( v/2, 1/2) C, B f (v/2, 1/2) C. Note that we have picked x 1,..., x N uniformly at random from B f (0, 2),where N = 2 c (n+k log(1/ɛ)) log R. By proposition 4 x i C with probability at least 2 O(n). Hence by choosing c large enough we can ensure that with high probability there is Z P such that Z 2 c 1(n+k log(1/ɛ)) for a constant c 1 and for all (x i, z i ) Z, x i C. We now prove the main theorem of this section. THEOREM 5. Let L Q n is a full rank lattice and let v L \ M such that 2 f (v) 3 for a given gauge function f and f (v) f (x) for all x L \ M. Let ɛ > 0 is an arbitrary constant. Then there is a randomized algorithm that in time 2 O(n+klog(1/ɛ)).poly(size(L)) computes a set P of pairs (x i, z i ) such that P 2 c (n+k log(1/ɛ)) for a constant c and f (x i z i ) 8 for all (x i, z i ) P. Moreover, z i x i L are such that with probability 1 2 O(n) there is a pair of points (x i, z i ), (x j, z j ) P such that v + u = (x i z i ) (x j z j ) for a vector u L M with f (u) ɛ. Proof. 5
6 Consider the set P of pairs (x i, z i ), obtained after the AKS sieving as described above, such that P 2 c (n+k log(1/ɛ)), and f (x i z i ) 8 for all (x i, z i ) P. We know that by choosing c large enough we can ensure that with high probability there is Z P such that Z 2 c 1(n+k log(1/ɛ)) for any constant c 1 and for all (x i, z i ) Z, x i C. Note that L M is a rank k sublattice of L. We will now analyze Z using the cosets of the sublattice L M. Write Z as a partition Z = m j=1 Z j, where for each Z j there is a distinct coset (L M) + v j of L M in L such that z i x i (L M) + v j for all (x i, z i ) Z j. Let Z j = {z i x i (x i, z i ) Z j }. Suppose u j Z j (L M) + v j for j = 1 to m. CLAIM 6.[Coset sampling] By choosing constant c 1 large enough we can ensure that there is an index t, 1 t m such that Z t 2 c 2(n+k log(1/ɛ)) for any constant c 2. Proof of Claim Note that u i and u j for i = j lie in different cosets of L M. So u i u j / M. Since v is a shortest f-vector in L \ M with 2 f (v) 3, we have f (u i u j ) 2. Hence unit radius f -balls around u i s are disjoint. Note that B f (u i, 1) B f (0, 9) for i = 1 to m. Since vol(b f (0, 9))/vol(B f (0, 1)) 2 dn for some constant d, we have m 2 dn. We have Z 2 c 1(n+k log(1/ɛ)) and Z is partitioned as Z = m j=1 Z j. So it is clear that by choosing c 1 large enough we can ensure that there is an index t, 1 t m such that Z t 2 c 2(n+k log(1/ɛ)) for any constant c 2. By renumbering the indices assume that Z t = {(x 1, z 1 ),..., (x q, z q )}, q 2 c 2(n+k log(1/ɛ)). Let β i = z i x i for (x i, z i ) Z t. So all β i s lie in the same coset (L M) + v l. CLAIM 7.[Packing argument] By choosing the constant c 2 large enough we can ensure that there exists (x i, z i ), (x j, z j ) Z t, i = j such that f (β i β j ) ɛ. Proof of Claim Suppose for all (x i, z i ), (x j, z j ) Z t, i = j f (β i β j ) ɛ. We also have f (β i β j ) 16 for i, j [q]. Let γ i = β i v l L M M for i = 1 to q. It is clear that f (γ i γ j ) = f (β i β j ) for i, j [q]. Let {b 1,..., b k } is an orthonormal basis of M. Consider linear transformation T : M R k such that T(b i ) = e i for i = 1 to k, where {e 1, e 2,..., e k } is a standard basis of R k. Let δ i = T(γ i ) for i = 1 to q. From standard linear algebra it follows that T preserves distances between point with respect to any norm. In particular we have f (γ i γ j ) = f (δ i δ j ) for i, j [q]. So we have ɛ/2 f (δ i δ j ) 16. As δ i R k for i [q], k dimensional balls of radius ɛ/2 around δ i s are all disjoint. By packing argument this implies, Z t (16+ɛ/2)k = 2 f (k log(1/ɛ)) for a constant f. This is a contradiction since choosing c (ɛ/2) k 2 large enough we can ensure that Z t 2 c 2(n+k log(1/ɛ)) > 2 f (k log(1/ɛ)). We now complete the proof with a standard argument from [AKS01, Re04] using a modified distribution. We have (x i, z i ), (x j, z j ) Z t Z, i = j, x i, x j C such that f (β i β j ) ɛ and β i β j L M. Now, we apply the argument as explained in Regev s notes [Re04] to reason with a modified distribution of the x i. Note that in the sieving procedure described before Theorem 5 x i s are chosen uniformly at random from B f (0, 2). Now, notice that we can replace the original distribution of x i with a modified distribution in which we output x i if it lies in B f (0, 2) \ (C C ) and if x i C it outputs either x i or x i + v with probability 1/2 each. Similarly, if x i C = C + v it outputs either x i or x i v with probability 1/2 each. By Proposition 4 it is clear that this modified distribution is 6
7 also uniform on B f (0, 2) and is introduced only for the purpose of analysis. And importantly we can replace x i by the modified distribution just before it is used in the algorithm first time. Main reason for this is distribution of y i s remains same even if we replace x i by modified distribution because y i = x i (modl) and v L. For details refer to O. Regev s lecture notes [Re04]. Now recall that we have (x i, z i ), (x j, z j ) Z with x i, x j C and f (β i β j ) ɛ. Putting it together with the above argument, we have with good probability (x i, z i ), (x j + v, z j ) P where P is set of tuples left after sieving. This is easily seen to imply that with high probability we are likely to see v + (β i β j ) as the difference of z i x i and z j x j for some two pairs (x i, z i ), (x j, z j ) P. Statement of the theorem follows as f (β i β j ) ɛ. By choosing M as 0 dimensional subspace we get 2 O(n) algorithm for SVP with respect to arbitrary gauge function f. An immediate consequence of the Theorem 5 we get 1 + ɛ approximation algorithm for SAP problem that runs in time 2 O(n+k log 1 ɛ ) poly(size(l, M)). Remarks: The 1 + ɛ approximation algorithm in [BN07] for SAP has running time 2 O(n log 1 ɛ ) poly(size(l, M))). Our algorithm has running time 2 O(n+k log 1 ɛ ) for computing 1 + ɛ approximate solution. Put another way, for k = o(n) we get a 2 O(n) time algorithm for obtaining n/k approximate solutions to SAP. There is a crucial difference in our analysis of the AKS sieving and that in [BN07]. In [BN07] it is shown that with probability 1 2 O(n) the sieving procedure outputs a 1 + ɛ approximate solution u L \ M. On the other hand, we show in Claim 6 that with probability 1 2 O(n) the sieving procedure samples 2 O(n+k log(1/ɛ) lattice points in some coset of the sublattice L M in L. Then we argue that with probability 1 2 O(n) the sample contains a lattice point u in L M + v such that such that d(u, v) is small, for some shortest vector v in L \ M. We argue this in Claim 7 by a packing argument in the coset of L M. As L M has rank k, the packing argument in k dimensions gives the improved running time for our approximation algorithm for the problem. The fact that the AKS sampling contains many points from the same coset of L M also plays crucial role in our exact algorithm for SAP shown in Theorem 12. COROLLARY 8. Given a rank n lattice L and a k-dimensional subspace M R n, there is 1 + ɛ randomized approximation algorithm for SAP (for any nice gauge function) with running time 2 O(n+k log 1 ɛ ) poly(size(l, M)). Proof. The algorithm will examine all (z i x i ) (z j x j ) for (x i, z i ), (x j, z j ) P obtained after sieving and output that element in L \ M of minimum f -value. The proof of correctness and running time guarantee follows immediately from Theorem 5. 4 Convex Body Avoiding Problem In this section we consider a generalization of SAP: given a lattice L and a convex body C the problem is to find a shortest vector (w.r.t. l p norm) in L \ C. We consider convex bodies C that are bounded and O-symmetric. We refer to this problem as the Convex body Avoiding Problem (CAP). A set S R n is O-symmetric if x S if and only if x S. Notice that a subspace M R n is convex and O-symmetric (but not bounded). 7
8 The input to CAP is the lattice L and the convex body C, where C is given by a membership oracle. An algorithm can query the oracle for any x R n to test if x C. We give an approximation algorithm to solve CAP. THEOREM 9. Given an integer lattice L of rank n and an O-symmetric convex body C in R n given by a membership oracle, there is 1 + ɛ factor approximation algorithm to solve CAP (w.r.t. any l p norm) with running time 2 O(n) log(1/ɛ) poly(size(l)). Proof. It suffices to solve the problem for the case when C is n-dimensional. To see this, suppose C is contained in some k-dimensional subspace M of R n. We can find a basis for M with high probability by sampling vectors from C using the polynomial-time almost uniform sampling algorithm described in [DFK91]. Next, we compute the sublattice L M and find a (1 + ɛ) approximate solution u for the k-dimensional convex body avoidance for the lattice L M and C. We also solve the SAP instance (L, M) and find a (1 + ɛ) approximate solution v L \ M using Theorem 5. The smaller of u and v is clearly a (1 + ɛ) approximate solution for the input CAP instance. Thus, we can assume C is n-dimensional. Let v be a shortest vector in L \ C which, as before, we can assume satisfies 2 v p 3 by considering polynomially many scalings of the lattice and the convex body. As in Theorem 5, we pick random points x 1,, x N from B p (0, 2) for N = 2 cn log(1/ɛ) poly(s). The constant c > 0 will be suitably chosen later. Let y i = x i (mod L) for i = 1 to N. We apply several rounds of the AKS sieving on the set {(x 1, y 1 ),, (x N, y N )} until we are left with a set S of 2 c 1n log(1/ɛ) pairs (x i, z i ) such that x i z i p 8. From proposition 4 it follows easily that with good probability we have Z S such that Z 2 c 2n log(1/ɛ) and for all (x i, z i ) Z we have x i D D where D = B p (0, 2) B p ( v, 2) and D = B p (0, 2) B p (v, 2). Note that the the constant c 2 can be chosen as large as we like by appropriate choice of c. Let Z = {z i x i (x i, z i ) Z}. Now consider l p ball of radius ɛ/2 centered at each lattice point β Z. It is clear that for all β Z, B p (β, ɛ/2) B p (0, 8 + ɛ/2). If for all β Z l p balls B p (β, ɛ/2) are mutually disjoint, by packing argument we get Z (8+ɛ/2)n = 2 (ɛ/2) c n log(1/ɛ) for a n constant c. We choose constant c appropriately to ensure that c 2 > c. This implies that there exists tuples (x i, z i ), (x j, z j ) Z such that β i β j ɛ, where β i = z i x i and β j = z j x j. Let β = β i β j. We claim that it is not possible that both β + v, β v lie inside the convex body C. Because this implies v β C since C is O-symmetric. Therefore v = (β+v)+(v β) 2 C, which contradicts with assumption v / C. So without loss of generality assume that β + v / C. Note that without loss of generality we can also assume that x i D with good probability. Now, we apply the argument as explained in Regev s notes [Re04] to reason with a modified distribution of the x i. As x i D we can replace x i by x i v. So it is easy to see that after sieving with good probability there exists tuples (x i, z i ), (x j, z j ) S such that r i,j = (z i x i ) (z j x j ) = v + β i β j. So r i,j = v + β / C and clearly r i,j p (1 + ɛ) v p since β i β j p ɛ. It is easy to see that the algorithm runs in time 2 O(n log(1/ɛ)) poly(size(l)). This completes the proof of the theorem. 5 Applications The results of this section are essentially applications of ideas from Theorem 5 and Section 3. First we describe an exact algorithm for SAP. We prove our result for full rank lattices, but it is easy to see that the result holds for general lattices as well. Let L Q n is a full rank integer 8
9 lattice given by a basis {b 1,, b n } and let M R n is a subspace of dimension k < n. For the l p norm, we give a randomized 2 O(n+k log k) poly(s) time algorithm to find a shortest vector in L \ M, where s = size(l, M). Our exact algorithm uses the same sieving procedure and analysis described in the proof of Theorem 5 in Section 3. As before, by considering polynomially many scalings of the lattice, we can assume that a shortest vector v L \ M satisfies 2 v p 3. We now describe the algorithm. 1. Let N = 2 cn log(n.max i b i p ) and pick x 1, x 2,, x N uniformly at random from B p (0, 2). 2. Let y i = x i (mod L) and apply the AKS sieving procedure on the set {(x 1, y 1 ),, (x N, y N )} as described in the Section 3 until for all tuples (x i, z i ) left after the sieving, x i z i p Let P = {(x i, z i ) i T}, T [N] be the set of tuples left after the sieving procedure. For all i, j T compute lattice points v i,j = (z i x i ) (z j x j ). 4. Let w i,j is a closest lattice vector to v i,j in the rank k lattice L M and let r i,j = v i,j w i,j. Output a vector of least non zero l p norm among all the vectors r i,j for i, j T. First we prove the correctness of the algorithm. LEMMA 10. For an appropriate choice of the constant c in the algorithm, it outputs a shortest non zero vector in L \ M with respect to l p norm. Proof. Let v be a shortest vector in L \ M. Consider the set of tuples P = {(x i, z i ) i T}, T [N], that remains after the sieving procedure in Step 3 of the algorithm. If we choose ɛ as a constant in Theorem 5, it follows that there is a constant c such that with probability 1 2 O(n) there exists (x i, z i ), (x j, z j ) P such that v + u = β i β j for some u L M where β i = z i x i and β j = z j x j. So in Step 3 of the the algorithm we have some v i,j = v + u for some vector u L M, i.e. v i,j and v lie in same coset of L M. Let w i,j L M be a closest vector to v i,j. So we have d(v i,j, w i,j ) d(v i,j, u) = v p, i.e. v i,j w i,j p v p. But since we have v i,j / L M and w i,j L M clearly v i,j w i,j / L M and since v is a shortest vector in L \ M, this implies v i,j w i,j p = v p. So with probability 1 2 O(n) the algorithm will output (in Step 4) a vector r i,j with r i,j p = v p. This proves the correctness of the algorithm. Next we argue that the running time of the algorithm is 2 O(n+k log k) poly(s) where s is the input size. In Step 1 of the algorithm we are sampling N = 2 O(n) points from B p (0, 2), a ball of radius 2 with respect to l p norm. Since B p (0, 2) is a convex body, the task can be accomplished using Dyer-Frieze-Kannan algorithm [DFK91] in time 2 O(n) poly(s). It easily follows that the sieving procedure in Step 2 can be performed in 2 O(n) time. Note that L M is a rank k lattice and basis of it can be computed efficiently. We need the following easy lemma from [Mi08]. LEMMA 11.[Mi08, Lemma 1] There is a polynomial time algorithm which on input a lattice L Q n and a subspace M R n of dimension k < n outputs a basis for rank k lattice L M. From the above lemma it is clear that a basis for L M can be efficiently computed in polynomial time. In Step 4 of the algorithm we are solving 2 O(n) many instances of CVP for the rank k lattice L M. For i, j S a closest vector to v i,j in the rank k lattice L M can be computed in 2 O(k log k) time using Kannan s algorithm for CVP [Kan87]. Hence the Step 4 takes 2 O(n+k log k) time. Therefore the overall running time of the algorithm is 2 O(n+k log k) poly(s). Note that by repeating above algorithm 2 O(n) times we can make the success probability of the algorithm exponentially close to 1. 9
10 THEOREM 12. Given a full rank lattice L Q n and a subspace M R n of dimension k < n, There is a randomized algorithm to finds v L \ M with least possible l p norm. The running time of the algorithm is 2 O(n+k log k) times a polynomial in the input size and it succeeds with probability 1 2 cn for an arbitrary constant c. Given an integer lattice L, Blömer and Naewe [BN07] gave 2 O(n) time 1 + ɛ factor approximation algorithm to solve SMP and SIVP. As a simple consequence of Theorem 12 we get a 2 O(n) time randomized algorithm to partially solve SMP: we can compute the first O( n log n ) successive minima in 2 O(n) time. More precisely, we can compute a set of i linearly independent vectors {v 1, v 2,..., v i } L such that v j p = λ p n j (L) for j = 1 to i if i is O( log n ). Given a lattice L, let M R n be a subspace of dimension zero generated by 0 R n and consider SAP instance (L, M). It is clear that v 1 is a shortest vector in L \ M so using Theorem 12 we can compute v 1 in 2 O(n) time. Now inductively assume that we have computed linearly independent vectors v 1, v 2,..., v k L such that v j p = λ p j (L). Next consider (L, M) as instance of SAP where M is space generated by v 1,..., v k and compute v L \ M using Theorem 12 in time 2 O(n+k log k). It is clear that v p = λ p k+1 (L) and as v / M the vectors v 1, v 2,..., v k, v are linearly independent. If k is O( n log n ) it is clear that algorithm takes 2O(n) time this proves Corollary 13. COROLLARY 13. Given a full rank lattice L Q n and a positive integer i cn log n for a constant c, there is a randomized algorithm with running time 2 O(n) poly(size(l)) to compute linearly independent vectors v 1, v 2,..., v i L such that v j p = λ p j (L) for j = 1 to i. Closest vector problem can be reduced to SAP as noted in [BN07]. Recently D. Micciancio ([Mi08]) has shown that in fact CVP, SAP and SMP are polynomially equivalent(theorem in [Mi08]). Our algorithm computes v L \ M with least norm by solving 2 O(n) instances of CVP. We have basically given a randomized 2 O(n) time Turing reduction from SAP to CVP. An interesting property of our reduction is that we are solving instance (L, M) of SAP by solving 2 O(n) many CVP instances (L M, v) where L M is a rank k lattice, where k is dimension of M. Whereas for the CVP instance (N, v) produced by the SAP to CVP reduction in [BN07], the lattice N has rank O(n). As a consequence of this property of our reduction we get the Corollary 14 which states that it suffices to look for a 2 O(n) randomized exact algorithm for CVP that also has access to all the successive minimas of the input lattice. COROLLARY 14. Suppose for all m there is a 2 O(m) randomized exact algorithm for CVP that takes as input a CVP instance (M, v) where M is full rank lattice of rank m and v R m (along with the extra input v i M such that v i p = λ p i (M) for i = 1 to m where λp i (M) is ith successive minima in M). Then, in fact, there is a 2 O(n) randomized exact algorithm for solving CVP on any rank n lattice. Proof. By [Mi08] CVP is poly-time equivalent to successive minima problem(smp). Consider full rank lattice L Q n as input to SMP. So it suffices to compute linearly independent v 1,..., v n L with v i p = λ p i (L) for i = 1 to n in 2O(n) time. We proceed as in the proof of Corollary 13. Inductively assume that we have already computed linearly independent vectors v 1,..., v k L with v i p = λ p i (L). Let M is space generated by v 1,..., v k. As in proof of Theorem 12 we can solve (L, M) an instance of SAP by solving 2 O(n) many instances of CVP (L M, v ). Note that L M is rank k lattice and it is clear that v i p λ p i (L M) for i = 1 to k. So we can solve these instances in 10
11 2 O(n) time.( Note that though L M is not full rank lattice, but it is not difficult to convert all these instances of CVP to full rank by applying suitable orthonormal linear transformation.) This takes time 2 O(n+k) which is at most 2 O(n). So it is clear that we can compute linearly independent vectors v 1,..., v n L with v i p = λ p i (L) in time n 2O(n). This proves the Corollary. In the next corollary we give a 2 O(n) time algorithm to solve certain CVP instances (L, v) for any l p norm. We prove the result only for l 2 norm and it is easy to generalize it for general l p norms. Let λ i (L) denotes i th successive minima of the lattice L with respect to l 2 norm. COROLLARY 15. Let (L, v) be a CVP instance such that L is full rank with the promise that d(v, L) < 3/2λ t (L), t cn log n. Then there is a 2O(n) poly(size(l)) time randomized algorithm that solves the CVP instance exactly. Proof.. By Corollary 13 we first compute λ t (L). We now use ideas from Kannan s CVP to SVP reduction [Kan87]. Let b 1, b 2,, b n be a basis for L. We obtain new vectors c i Q n+1 for i = 1 to n by letting ci T = (bi T, 0). Likewise, define u Qn+1 as u T = (v T, λ t /2). Let M be the lattice generated by the n + 1 vectors u, c 1, c 2, c n. Compute the vectors v j M such that v j 2 = λ j (M) for j = 1 to t using Corollary 13 in time 2 O(n) poly(size(l)). Write vectors v j as v j = u j + α j u, u j L(c 1,, c n ) and α j Z. Clearly, α j 1 since u has λ t /2 as its (n + 1) th entry. As d(v, L) < 3/2λ t (L) we have d(u, M) < λ t (L). Hence, there is at least one index i, 1 i t such that α i = 1. Consider the set S = {u i 1 i t, α i = 1}and let u j be the shortest vector in S. Writing u j = (w T j, 0), it is clear that the vector w j L is closest vector to v if α j = 1 and w j is a closest vector to v if α j = 1. References [AKS01] M. AJTAI, R. KUMAR, D. SIVAKUMAR, A sieve algorithm for the shortest lattice vector. In Proceedings of the 30th Annual ACM Symposium on Theory of Computing, , [AKS02] M. AJTAI, R. KUMAR, D. SIVAKUMAR, Sampling short lattice vectors and the closest lattice vector problem. In Proceedings of the 17th IEEE Annual Conference on Computational Complexity-CCC, 53-57, [Bl00] J. BLÖMER, Closest vectors, successive minima, and dual HKZ-bases of lattices. In Proceedings of th 17th ICALP, Lecture Notes in Computer Science 1853, , Springer, [BN07] J. BLÖMER, S. NAEWE Sampling Methods for Shortest Vectors, Closest Vectors and Successive Minima of lattices. In Proceedings of ICALP, 65-77, [DFK91] M. DYER, A. FRIEZE, R. KANNAN A random polynomial time algorithm for approximating the volume of convex bodies. Journal of the ACM, 38(1):1-17, [Kan87] R. KANNAN Minkowski s convex body theorem and integer programing. Mathematics of Operational Rearch,12(3): , [LLL82] A. K. LENSTRA, H. W. LENSTRA, JR. AND L. LOVASZ, Factoring Polynomials with Rational Coefficients, Mathematische Annalen, 261: , [MG02] D. MICCIANCIO, S. GOLDWASSER, Complexity of Lattice Problems. A Cryptographic Perspective, Kluwer Academic Publishers, [Mi08] D. MICCIANCIO, Efficient reductions among lattice problems,soda,2008,
12 [Re04] O. REGEV, Lecture Notes - Lattices in Computer Science, lecture 8, odedr/teaching/lattices fall 2004/index.html. [Si45] C. L. SIEGEL Lectures on Geometry of Numbers. Springer-Verlag publishing company, This work is licensed under the Creative Commons Attribution- NonCommercial-No Derivative Works 3.0 License. 12
Algorithmic Problems for Metrics on Permutation Groups
Algorithmic Problems for Metrics on Permutation Groups V. Arvind and Pushkar S. Joglekar Institute of Mathematical Sciences C.I.T Campus,Chennai 600 113, India {arvind,pushkar}@imsc.res.in Abstract. Given
and the polynomial-time Turing p reduction from approximate CVP to SVP given in [10], the present authors obtained a n=2-approximation algorithm that
Sampling short lattice vectors and the closest lattice vector problem Miklos Ajtai Ravi Kumar D. Sivakumar IBM Almaden Research Center 650 Harry Road, San Jose, CA 95120. fajtai, ravi, sivag@almaden.ibm.com
Shortest Vector Problem (1982; Lenstra, Lenstra, Lovasz)
Shortest Vector Problem (1982; Lenstra, Lenstra, Lovasz) Daniele Micciancio, University of California at San Diego, www.cs.ucsd.edu/ daniele entry editor: Sanjeev Khanna INDEX TERMS: Point lattices. Algorithmic
1 Shortest Vector Problem
Lattices in Cryptography University of Michigan, Fall 25 Lecture 2 SVP, Gram-Schmidt, LLL Instructor: Chris Peikert Scribe: Hank Carter Shortest Vector Problem Last time we defined the minimum distance
Dimension-Preserving Reductions Between Lattice Problems
Dimension-Preserving Reductions Between Lattice Problems Noah Stephens-Davidowitz Courant Institute of Mathematical Sciences, New York University. noahsd@cs.nyu.edu Last updated September 6, 2016. Abstract
CSE 206A: Lattice Algorithms and Applications Spring Minkowski s theorem. Instructor: Daniele Micciancio
CSE 206A: Lattice Algorithms and Applications Spring 2014 Minkowski s theorem Instructor: Daniele Micciancio UCSD CSE There are many important quantities associated to a lattice. Some of them, like the
Lecture 5: CVP and Babai s Algorithm
NYU, Fall 2016 Lattices Mini Course Lecture 5: CVP and Babai s Algorithm Lecturer: Noah Stephens-Davidowitz 51 The Closest Vector Problem 511 Inhomogeneous linear equations Recall that, in our first lecture,
COS 598D - Lattices. scribe: Srdjan Krstic
COS 598D - Lattices scribe: Srdjan Krstic Introduction In the first part we will give a brief introduction to lattices and their relevance in some topics in computer science. Then we show some specific
Hard Instances of Lattice Problems
Hard Instances of Lattice Problems Average Case - Worst Case Connections Christos Litsas 28 June 2012 Outline Abstract Lattices The Random Class Worst-Case - Average-Case Connection Abstract Christos Litsas
CSE 206A: Lattice Algorithms and Applications Spring Basis Reduction. Instructor: Daniele Micciancio
CSE 206A: Lattice Algorithms and Applications Spring 2014 Basis Reduction Instructor: Daniele Micciancio UCSD CSE No efficient algorithm is known to find the shortest vector in a lattice (in arbitrary
Solving All Lattice Problems in Deterministic Single Exponential Time
Solving All Lattice Problems in Deterministic Single Exponential Time (Joint work with P. Voulgaris, STOC 2010) UCSD March 22, 2011 Lattices Traditional area of mathematics Bridge between number theory
Hardness of the Covering Radius Problem on Lattices
Hardness of the Covering Radius Problem on Lattices Ishay Haviv Oded Regev June 6, 2006 Abstract We provide the first hardness result for the Covering Radius Problem on lattices (CRP). Namely, we show
Lattice-Based Cryptography: Mathematical and Computational Background. Chris Peikert Georgia Institute of Technology.
Lattice-Based Cryptography: Mathematical and Computational Background Chris Peikert Georgia Institute of Technology crypt@b-it 2013 1 / 18 Lattice-Based Cryptography y = g x mod p m e mod N e(g a, g b
Practical Analysis of Key Recovery Attack against Search-LWE Problem
Practical Analysis of Key Recovery Attack against Search-LWE Problem The 11 th International Workshop on Security, Sep. 13 th 2016 Momonari Kudo, Junpei Yamaguchi, Yang Guo and Masaya Yasuda 1 Graduate
From the Shortest Vector Problem to the Dihedral Hidden Subgroup Problem
From the Shortest Vector Problem to the Dihedral Hidden Subgroup Problem Curtis Bright December 9, 011 Abstract In Quantum Computation and Lattice Problems [11] Oded Regev presented the first known connection
satisfying ( i ; j ) = ij Here ij = if i = j and 0 otherwise The idea to use lattices is the following Suppose we are given a lattice L and a point ~x
Dual Vectors and Lower Bounds for the Nearest Lattice Point Problem Johan Hastad* MIT Abstract: We prove that given a point ~z outside a given lattice L then there is a dual vector which gives a fairly
Lecture 7 Limits on inapproximability
Tel Aviv University, Fall 004 Lattices in Computer Science Lecture 7 Limits on inapproximability Lecturer: Oded Regev Scribe: Michael Khanevsky Let us recall the promise problem GapCVP γ. DEFINITION 1
Locally Dense Codes. Daniele Micciancio. August 26, 2013
Electronic Colloquium on Computational Complexity, Report No. 115 (2013) Locally Dense Codes Daniele Micciancio August 26, 2013 Abstract The Minimum Distance Problem (MDP), i.e., the computational task
How to Factor N 1 and N 2 When p 1 = p 2 mod 2 t
How to Factor N 1 and N 2 When p 1 = p 2 mod 2 t Kaoru Kurosawa and Takuma Ueda Ibaraki University, Japan Abstract. Let N 1 = p 1q 1 and N 2 = p 2q 2 be two different RSA moduli. Suppose that p 1 = p 2
CSC 2414 Lattices in Computer Science September 27, Lecture 4. An Efficient Algorithm for Integer Programming in constant dimensions
CSC 2414 Lattices in Computer Science September 27, 2011 Lecture 4 Lecturer: Vinod Vaikuntanathan Scribe: Wesley George Topics covered this lecture: SV P CV P Approximating CVP: Babai s Nearest Plane Algorithm
1: Introduction to Lattices
CSE 206A: Lattice Algorithms and Applications Winter 2012 Instructor: Daniele Micciancio 1: Introduction to Lattices UCSD CSE Lattices are regular arrangements of points in Euclidean space. The simplest
CSE 206A: Lattice Algorithms and Applications Winter The dual lattice. Instructor: Daniele Micciancio
CSE 206A: Lattice Algorithms and Applications Winter 2016 The dual lattice Instructor: Daniele Micciancio UCSD CSE 1 Dual Lattice and Dual Basis Definition 1 The dual of a lattice Λ is the set ˆΛ of all
The Shortest Vector Problem (Lattice Reduction Algorithms)
The Shortest Vector Problem (Lattice Reduction Algorithms) Approximation Algorithms by V. Vazirani, Chapter 27 - Problem statement, general discussion - Lattices: brief introduction - The Gauss algorithm
Solving Closest Vector Instances Using an Approximate Shortest Independent Vectors Oracle
Tian CL, Wei W, Lin DD. Solving closest vector instances using an approximate shortest independent vectors oracle. JOURNAL OF COMPUTER SCIENCE AND TECHNOLOGY 306): 1370 1377 Nov. 015. DOI 10.1007/s11390-015-
On the Complexity of Computing Units in a Number Field
On the Complexity of Computing Units in a Number Field V. Arvind and Piyush P Kurur Institute of Mathematical Sciences C.I.T Campus,Chennai, India 600 113 {arvind,ppk}@imsc.res.in August 2, 2008 Abstract
Solving the Shortest Lattice Vector Problem in Time n
Solving the Shortest Lattice Vector Problem in Time.465n Xavier Pujol 1 and Damien Stehlé 1 Université de Lyon, Laboratoire LIP, CNRS-ENSL-INRIA-UCBL, 46 Allée d Italie, 69364 Lyon Cedex 07, France CNRS,
Cryptanalysis of the Quadratic Generator
Cryptanalysis of the Quadratic Generator Domingo Gomez, Jaime Gutierrez, Alvar Ibeas Faculty of Sciences, University of Cantabria, Santander E 39071, Spain jaime.gutierrez@unican.es Abstract. Let p be
CSC 2414 Lattices in Computer Science October 11, Lecture 5
CSC 244 Lattices in Computer Science October, 2 Lecture 5 Lecturer: Vinod Vaikuntanathan Scribe: Joel Oren In the last class, we studied methods for (approximately) solving the following two problems:
A Randomized Sieving Algorithm for Approximate Integer Programming
Noname manuscript No. (will be inserted by the editor) A Randomized Sieving Algorithm for Approximate Integer Programming Daniel Dadush the date of receipt and acceptance should be inserted later Abstract
Corrigendum: The complexity of counting graph homomorphisms
Corrigendum: The complexity of counting graph homomorphisms Martin Dyer School of Computing University of Leeds Leeds, U.K. LS2 9JT dyer@comp.leeds.ac.uk Catherine Greenhill School of Mathematics The University
Reduction of Smith Normal Form Transformation Matrices
Reduction of Smith Normal Form Transformation Matrices G. Jäger, Kiel Abstract Smith normal form computations are important in group theory, module theory and number theory. We consider the transformation
Learning convex bodies is hard
Learning convex bodies is hard Navin Goyal Microsoft Research India navingo@microsoft.com Luis Rademacher Georgia Tech lrademac@cc.gatech.edu Abstract We show that learning a convex body in R d, given
Lattice Basis Reduction Part 1: Concepts
Lattice Basis Reduction Part 1: Concepts Sanzheng Qiao Department of Computing and Software McMaster University, Canada qiao@mcmaster.ca www.cas.mcmaster.ca/ qiao October 25, 2011, revised February 2012
Enumeration. Phong Nguyễn
Enumeration Phong Nguyễn http://www.di.ens.fr/~pnguyen March 2017 References Joint work with: Yoshinori Aono, published at EUROCRYPT 2017: «Random Sampling Revisited: Lattice Enumeration with Discrete
BOUNDS FOR SOLID ANGLES OF LATTICES OF RANK THREE
BOUNDS FOR SOLID ANGLES OF LATTICES OF RANK THREE LENNY FUKSHANSKY AND SINAI ROBINS Abstract. We find sharp absolute consts C and C with the following property: every well-rounded lattice of rank 3 in
Note on shortest and nearest lattice vectors
Note on shortest and nearest lattice vectors Martin Henk Fachbereich Mathematik, Sekr. 6-1 Technische Universität Berlin Straße des 17. Juni 136 D-10623 Berlin Germany henk@math.tu-berlin.de We show that
M4. Lecture 3. THE LLL ALGORITHM AND COPPERSMITH S METHOD
M4. Lecture 3. THE LLL ALGORITHM AND COPPERSMITH S METHOD Ha Tran, Dung H. Duong, Khuong A. Nguyen. SEAMS summer school 2015 HCM University of Science 1 / 31 1 The LLL algorithm History Applications of
Density of Ideal Lattices
Density of Ideal Lattices - Preliminary Draft - Johannes Buchmann and Richard Lindner Technische Universität Darmstadt, Department of Computer Science Hochschulstraße 10, 64289 Darmstadt, Germany buchmann,rlindner@cdc.informatik.tu-darmstadt.de
Solving Systems of Modular Equations in One Variable: How Many RSA-Encrypted Messages Does Eve Need to Know?
Solving Systems of Modular Equations in One Variable: How Many RSA-Encrypted Messages Does Eve Need to Know? Alexander May, Maike Ritzenhofen Faculty of Mathematics Ruhr-Universität Bochum, 44780 Bochum,
On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem
On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem Vadim Lyubashevsky 1 and Daniele Micciancio 2 1 School of Computer Science, Tel Aviv University Tel Aviv 69978, Israel.
Lattice Cryptography
CSE 206A: Lattice Algorithms and Applications Winter 2016 Lattice Cryptography Instructor: Daniele Micciancio UCSD CSE Lattice cryptography studies the construction of cryptographic functions whose security
Computational complexity of lattice problems and cyclic lattices
Computational complexity of lattice problems and cyclic lattices Lenny Fukshansky Claremont McKenna College Undergraduate Summer Research Program ICERM - Brown University July 28, 2014 Euclidean lattices
Sampling Contingency Tables
Sampling Contingency Tables Martin Dyer Ravi Kannan John Mount February 3, 995 Introduction Given positive integers and, let be the set of arrays with nonnegative integer entries and row sums respectively
A Fast Phase-Based Enumeration Algorithm for SVP Challenge through y-sparse Representations of Short Lattice Vectors
A Fast Phase-Based Enumeration Algorithm for SVP Challenge through y-sparse Representations of Short Lattice Vectors Dan Ding 1, Guizhen Zhu 2, Yang Yu 1, Zhongxiang Zheng 1 1 Department of Computer Science
Additive Combinatorics Lecture 12
Additive Combinatorics Lecture 12 Leo Goldmakher Scribe: Gal Gross April 4th, 2014 Last lecture we proved the Bohr-to-gAP proposition, but the final step was a bit mysterious we invoked Minkowski s second
Deterministic Truncation of Linear Matroids
Deterministic Truncation of Linear Matroids Daniel Lokshtanov Pranabendu Misra Fahad Panolan Saket Saurabh Abstract Let M = (E, I) be a matroid. A k-truncation of M is a matroid M = (E, I ) such that for
Model Counting for Logical Theories
Model Counting for Logical Theories Wednesday Dmitry Chistikov Rayna Dimitrova Department of Computer Science University of Oxford, UK Max Planck Institute for Software Systems (MPI-SWS) Kaiserslautern
QUANTUM COMPUTATION AND LATTICE PROBLEMS
QUATUM COMPUTATIO AD LATTICE PROBLEMS ODED REGEV Abstract. We present the first explicit connection between quantum computation and lattice problems. amely, our main result is a solution to the Unique
COMPLEXITY OF LATTICE PROBLEMS A Cryptographic Perspective
COMPLEXITY OF LATTICE PROBLEMS A Cryptographic Perspective THE KLUWER INTERNATIONAL SERIES IN ENGINEERING AND COMPUTER SCIENCE COMPLEXITY OF LATTICE PROBLEMS A Cryptographic Perspective Daniele Micciancio
Lattices Part II Dual Lattices, Fourier Transform, Smoothing Parameter, Public Key Encryption
Lattices Part II Dual Lattices, Fourier Transform, Smoothing Parameter, Public Key Encryption Boaz Barak May 12, 2008 The first two sections are based on Oded Regev s lecture notes, and the third one on
An algebraic perspective on integer sparse recovery
An algebraic perspective on integer sparse recovery Lenny Fukshansky Claremont McKenna College (joint work with Deanna Needell and Benny Sudakov) Combinatorics Seminar USC October 31, 2018 From Wikipedia:
Lattices that Admit Logarithmic Worst-Case to Average-Case Connection Factors
1 / 15 Lattices that Admit Logarithmic Worst-Case to Average-Case Connection Factors Chris Peikert 1 Alon Rosen 2 1 SRI International 2 Harvard SEAS IDC Herzliya STOC 2007 2 / 15 Worst-case versus average-case
On the Quantitative Hardness of CVP
On the Quantitative Hardness of CVP Huck Bennett huckbennett@gmail.com Alexander Golovnev alexgolovnev@gmail.com Noah Stephens-Davidowitz noahsd@gmail.com Abstract For odd integers p 1 (and p = ), we show
On the complexity of approximate multivariate integration
On the complexity of approximate multivariate integration Ioannis Koutis Computer Science Department Carnegie Mellon University Pittsburgh, PA 15213 USA ioannis.koutis@cs.cmu.edu January 11, 2005 Abstract
Deterministic Approximation Algorithms for the Nearest Codeword Problem
Deterministic Approximation Algorithms for the Nearest Codeword Problem Noga Alon 1,, Rina Panigrahy 2, and Sergey Yekhanin 3 1 Tel Aviv University, Institute for Advanced Study, Microsoft Israel nogaa@tau.ac.il
Lower bounds of shortest vector lengths in random knapsack lattices and random NTRU lattices
Lower bounds of shortest vector lengths in random knapsack lattices and random NTRU lattices Jingguo Bi 1 and Qi Cheng 2 1 Lab of Cryptographic Technology and Information Security School of Mathematics
U.C. Berkeley CS294: Spectral Methods and Expanders Handout 11 Luca Trevisan February 29, 2016
U.C. Berkeley CS294: Spectral Methods and Expanders Handout Luca Trevisan February 29, 206 Lecture : ARV In which we introduce semi-definite programming and a semi-definite programming relaxation of sparsest
A Digital Signature Scheme based on CVP
A Digital Signature Scheme based on CVP Thomas Plantard Willy Susilo Khin Than Win Centre for Computer and Information Security Research Universiy Of Wollongong http://www.uow.edu.au/ thomaspl thomaspl@uow.edu.au
A Deterministic Single Exponential Time Algorithm for Most Lattice Problems based on Voronoi Cell Computations
Electronic Colloquium on Computational Complexity, Revision 1 of Report No. 14 (2010) A Deterministic Single Exponential Time Algorithm for Most Lattice Problems based on Voronoi Cell Computations Daniele
Lecture 6: Lattice Trapdoor Constructions
Homomorphic Encryption and Lattices, Spring 0 Instructor: Shai Halevi Lecture 6: Lattice Trapdoor Constructions April 7, 0 Scribe: Nir Bitansky This lecture is based on the trapdoor constructions due to
Primitive sets in a lattice
Primitive sets in a lattice Spyros. S. Magliveras Department of Mathematical Sciences Florida Atlantic University Boca Raton, FL 33431, U.S.A spyros@fau.unl.edu Tran van Trung Institute for Experimental
The cocycle lattice of binary matroids
Published in: Europ. J. Comb. 14 (1993), 241 250. The cocycle lattice of binary matroids László Lovász Eötvös University, Budapest, Hungary, H-1088 Princeton University, Princeton, NJ 08544 Ákos Seress*
Lattices that Admit Logarithmic Worst-Case to Average-Case Connection Factors
Lattices that Admit Logarithmic Worst-Case to Average-Case Connection Factors Chris Peikert Alon Rosen November 26, 2006 Abstract We demonstrate an average-case problem which is as hard as finding γ(n)-approximate
Upper Bound on λ 1. Science, Guangzhou University, Guangzhou, China 2 Zhengzhou University of Light Industry, Zhengzhou, China
Λ A Huiwen Jia 1, Chunming Tang 1, Yanhua Zhang 2 hwjia@gzhu.edu.cn, ctang@gzhu.edu.cn, and yhzhang@zzuli.edu.cn 1 Key Laboratory of Information Security, School of Mathematics and Information Science,
A Note on the Density of the Multiple Subset Sum Problems
A Note on the Density of the Multiple Subset Sum Problems Yanbin Pan and Feng Zhang Key Laboratory of Mathematics Mechanization, Academy of Mathematics and Systems Science, Chinese Academy of Sciences,
Inapproximability Results for the Closest Vector Problem with Preprocessing over l Norm
Electronic Colloquium on Computational Complexity, Report No. 52 (2006) Inapproximability Results for the Closest Vector Problem with Preprocessing over l Norm Wenbin Chen Jiangtao Meng Abstract We show
Computing Machine-Efficient Polynomial Approximations
Computing Machine-Efficient Polynomial Approximations N. Brisebarre, S. Chevillard, G. Hanrot, J.-M. Muller, D. Stehlé, A. Tisserand and S. Torres Arénaire, LIP, É.N.S. Lyon Journées du GDR et du réseau
Dwork 97/07, Regev Lyubashvsky-Micciancio. Micciancio 09. PKE from worst-case. usvp. Relations between worst-case usvp,, BDD, GapSVP
The unique-svp World 1. Ajtai-Dwork Dwork 97/07, Regev 03 PKE from worst-case usvp 2. Lyubashvsky-Micciancio Micciancio 09 Shai Halevi, IBM, July 2009 Relations between worst-case usvp,, BDD, GapSVP Many
From the shortest vector problem to the dihedral hidden subgroup problem
From the shortest vector problem to the dihedral hidden subgroup problem Curtis Bright University of Waterloo December 8, 2011 1 / 19 Reduction Roughly, problem A reduces to problem B means there is a
Generalized Lowness and Highness and Probabilistic Complexity Classes
Generalized Lowness and Highness and Probabilistic Complexity Classes Andrew Klapper University of Manitoba Abstract We introduce generalized notions of low and high complexity classes and study their
Kolmogorov Complexity in Randomness Extraction
LIPIcs Leibniz International Proceedings in Informatics Kolmogorov Complexity in Randomness Extraction John M. Hitchcock, A. Pavan 2, N. V. Vinodchandran 3 Department of Computer Science, University of
Sub-Linear Root Detection for Sparse Polynomials Over Finite Fields
1 / 27 Sub-Linear Root Detection for Sparse Polynomials Over Finite Fields Jingguo Bi Institute for Advanced Study Tsinghua University Beijing, China October, 2014 Vienna, Austria This is a joint work
A note on the minimal volume of almost cubic parallelepipeds
A note on the minimal volume of almost cubic parallelepipeds Daniele Micciancio Abstract We prove that the best way to reduce the volume of the n-dimensional unit cube by a linear transformation that maps
Optimal compression of approximate Euclidean distances
Optimal compression of approximate Euclidean distances Noga Alon 1 Bo az Klartag 2 Abstract Let X be a set of n points of norm at most 1 in the Euclidean space R k, and suppose ε > 0. An ε-distance sketch
Background: Lattices and the Learning-with-Errors problem
Background: Lattices and the Learning-with-Errors problem China Summer School on Lattices and Cryptography, June 2014 Starting Point: Linear Equations Easy to solve a linear system of equations A s = b
Lattice-based Cryptography
Lattice-based Cryptography Oded Regev Tel Aviv University, Israel Abstract. We describe some of the recent progress on lattice-based cryptography, starting from the seminal work of Ajtai, and ending with
DISCRETE SUBGROUPS, LATTICES, AND UNITS.
DISCRETE SUBGROUPS, LATTICES, AND UNITS. IAN KIMING 1. Discrete subgroups of real vector spaces and lattices. Definitions: A lattice in a real vector space V of dimension d is a subgroup of form: Zv 1
Spanning and Independence Properties of Finite Frames
Chapter 1 Spanning and Independence Properties of Finite Frames Peter G. Casazza and Darrin Speegle Abstract The fundamental notion of frame theory is redundancy. It is this property which makes frames
Lattices. A Lattice is a discrete subgroup of the additive group of n-dimensional space R n.
Lattices A Lattice is a discrete subgroup of the additive group of n-dimensional space R n. Lattices have many uses in cryptography. They may be used to define cryptosystems and to break other ciphers.
Further Results on Implicit Factoring in Polynomial Time
Further Results on Implicit Factoring in Polynomial Time Santanu Sarkar and Subhamoy Maitra Indian Statistical Institute, 203 B T Road, Kolkata 700 108, India {santanu r, subho}@isical.ac.in Abstract.
Parameterizing orbits in flag varieties
Parameterizing orbits in flag varieties W. Ethan Duckworth April 2008 Abstract In this document we parameterize the orbits of certain groups acting on partial flag varieties with finitely many orbits.
Lecture 15: The Hidden Subgroup Problem
CS 880: Quantum Information Processing 10/7/2010 Lecture 15: The Hidden Subgroup Problem Instructor: Dieter van Melkebeek Scribe: Hesam Dashti The Hidden Subgroup Problem is a particular type of symmetry
European Journal of Combinatorics
European Journal of Combinatorics 30 (2009) 1686 1695 Contents lists available at ScienceDirect European Journal of Combinatorics ournal homepage: www.elsevier.com/locate/ec Generalizations of Heilbronn
Fundamental Domains, Lattice Density, and Minkowski Theorems
New York University, Fall 2013 Lattices, Convexity & Algorithms Lecture 3 Fundamental Domains, Lattice Density, and Minkowski Theorems Lecturers: D. Dadush, O. Regev Scribe: D. Dadush 1 Fundamental Parallelepiped
DS-GA 1002 Lecture notes 0 Fall Linear Algebra. These notes provide a review of basic concepts in linear algebra.
DS-GA 1002 Lecture notes 0 Fall 2016 Linear Algebra These notes provide a review of basic concepts in linear algebra. 1 Vector spaces You are no doubt familiar with vectors in R 2 or R 3, i.e. [ ] 1.1
Carathéodory Bounds for Integer Cones
Carathéodory Bounds for Integer Cones Friedrich Eisenbrand, Gennady Shmonin Max-Planck-Institut für Informatik Stuhlsatzenhausweg 85 66123 Saarbrücken Germany [eisen,shmonin]@mpi-inf.mpg.de 22nd September
Solving the Closest Vector Problem in 2 n Time The Discrete Gaussian Strikes Again!
Solving the Closest Vector Problem in n Time The Discrete Gaussian Strikes Again! Divesh Aggarwal Divesh.Aggarwal@epfl.ch Daniel Dadush dadush@cwi.nl Noah Stephens-Davidowitz noahsd@cs.nyu.edu Abstract
The Euclidean Distortion of Flat Tori
The Euclidean Distortion of Flat Tori Ishay Haviv Oded Regev June 0, 010 Abstract We show that for every n-dimensional lattice L the torus R n /L can be embedded with distortion O(n log n) into a Hilbert
Math 320-2: Midterm 2 Practice Solutions Northwestern University, Winter 2015
Math 30-: Midterm Practice Solutions Northwestern University, Winter 015 1. Give an example of each of the following. No justification is needed. (a) A metric on R with respect to which R is bounded. (b)
A proof of Freiman s Theorem, continued. An analogue of Freiman s Theorem in a bounded torsion group
A proof of Freiman s Theorem, continued Brad Hannigan-Daley University of Waterloo Freiman s Theorem Recall that a d-dimensional generalized arithmetic progression (GAP) in an abelian group G is a subset
Discrepancy Theory in Approximation Algorithms
Discrepancy Theory in Approximation Algorithms Rajat Sen, Soumya Basu May 8, 2015 1 Introduction In this report we would like to motivate the use of discrepancy theory in algorithms. Discrepancy theory
CS Topics in Cryptography January 28, Lecture 5
CS 4501-6501 Topics in Cryptography January 28, 2015 Lecture 5 Lecturer: Mohammad Mahmoody Scribe: Ameer Mohammed 1 Learning with Errors: Motivation An important goal in cryptography is to find problems
Lattice Reduction Algorithms: Theory and Practice
Lattice Reduction Algorithms: Theory and Practice Phong Q. Nguyen INRIA and ENS, Département d informatique, 45 rue d Ulm, 75005 Paris, France http://www.di.ens.fr/~pnguyen/ Abstract. Lattice reduction
arxiv:cs/ v1 [cs.cc] 7 Sep 2006
Approximation Algorithms for the Bipartite Multi-cut problem arxiv:cs/0609031v1 [cs.cc] 7 Sep 2006 Sreyash Kenkre Sundar Vishwanathan Department Of Computer Science & Engineering, IIT Bombay, Powai-00076,
Problem Set 6: Solutions Math 201A: Fall a n x n,
Problem Set 6: Solutions Math 201A: Fall 2016 Problem 1. Is (x n ) n=0 a Schauder basis of C([0, 1])? No. If f(x) = a n x n, n=0 where the series converges uniformly on [0, 1], then f has a power series
Lower Bounds of Shortest Vector Lengths in Random NTRU Lattices
Lower Bounds of Shortest Vector Lengths in Random NTRU Lattices Jingguo Bi 1,2 and Qi Cheng 2 1 School of Mathematics Shandong University Jinan, 250100, P.R. China. Email: jguobi@mail.sdu.edu.cn 2 School
The Dual Lattice, Integer Linear Systems and Hermite Normal Form
New York University, Fall 2013 Lattices, Convexity & Algorithms Lecture 2 The Dual Lattice, Integer Linear Systems and Hermite Normal Form Lecturers: D. Dadush, O. Regev Scribe: D. Dadush 1 Dual Lattice
Definitions. Notations. Injective, Surjective and Bijective. Divides. Cartesian Product. Relations. Equivalence Relations
Page 1 Definitions Tuesday, May 8, 2018 12:23 AM Notations " " means "equals, by definition" the set of all real numbers the set of integers Denote a function from a set to a set by Denote the image of
A Robust APTAS for the Classical Bin Packing Problem
A Robust APTAS for the Classical Bin Packing Problem Leah Epstein 1 and Asaf Levin 2 1 Department of Mathematics, University of Haifa, 31905 Haifa, Israel. Email: lea@math.haifa.ac.il 2 Department of Statistics,
Complexity Theory VU , SS The Polynomial Hierarchy. Reinhard Pichler
Complexity Theory Complexity Theory VU 181.142, SS 2018 6. The Polynomial Hierarchy Reinhard Pichler Institut für Informationssysteme Arbeitsbereich DBAI Technische Universität Wien 15 May, 2018 Reinhard