Note on shortest and nearest lattice vectors

Transcription

1 Note on shortest and nearest lattice vectors Martin Henk Fachbereich Mathematik, Sekr. 6-1 Technische Universität Berlin Straße des 17. Juni 136 D Berlin Germany We show that with respect to a certain class of norms the so called shortest lattice vector problem is polynomial-time Turing (Cook) reducible to the nearest lattice vector problem. This gives a little more insight in the relationship of these two fundamental problems in the computational geometry of numbers. Key words: Computational Geometry, shortest lattice vector, nearest lattice vector, polar lattice. 1 Introduction Throughout this paper let R n be the real n-dimensional vector space equipped with a norm f K ( ), where K is the gauge-body of the norm, i.e. K = {x R n : f K (x) 1}. K is a centrally symmetric convex body with nonempty interior and f K ( ) is also called the distance function of K because f K (x) = min{ρ R 0 : x ρk}. The Euclidean norm is denoted by f B ( ), where B is the n-dimensional unit ball, and the associated inner product is denoted by,. Finally, we denote by C the cube with edge length 2 and center 0, and thus f C ( ) denotes the maximum norm. As usual we denote by x the smallest integer not less than x R. Let b 1,..., b n Q n be n linearly independent vectors. The set { } n Λ = x Q n : x = z i b i, z i Z, 1 i n i=1 Preprint submitted to Elsevier Preprint 30 September 2007

2 is called the lattice generated by the basis b 1,..., b n. Now, the shortest lattice vector problem with respect to a norm f K ( ) SVP K is the following task (cf. [5]): SVP K : Let Λ Q n be a lattice given by a basis b 1,..., b n. Find a lattice vector b Λ\{0} with minimal distance to 0, i.e. f K (b) = min{f K (w) : w Λ\{0}}. The length of a shortest nonzero vector of a lattice Λ with respect to a norm f K ( ) is denoted by λ K (Λ). The nearest vector problem with respect to the norm f K ( ) NVP K is in a certain sense the inhomogeneous counterpart to SVP K : NVP K : Let Λ Q n be a lattice given by a basis b 1,..., b n and let v Q n. Find a lattice vector c Λ with minimal distance to v, i.e. f K (c v) = min{f K (w v) : w Λ}. Observe that in the SVP K we are looking for a nonzero lattice vector, whereas in the NVP K the zero vector is a solution for all sufficiently small vectors v. Geometrically speaking the NVP K is the task to find a lattice point c such that the given point v is contained in the honeycomb c+h K (Λ), where H K (Λ) is given by: H K (Λ) = {x R n : f K (x) f K (x w), w Λ}. H K (Λ) is a centrally symmetric ray set, i.e. if x H K (Λ), then ρx H K (Λ) for all ρ with 1 ρ 1. In the Euclidean case, but not in general, H K (Λ) is a convex set. Moreover, it is easy to see that the inradius of H K (Λ) with respect to f K ( ) is one half of the length of a shortest lattice vector. Analogously, the circumradius µ K (Λ) of a honeycomb is equal to the so called inhomogeneous minimum of Λ and f K ( ) (cf. [6]), which is defined as the maximal distance of a point to the lattice, i.e. µ K (Λ) = max y R n min w Λ f K (w y) = max{f K (x) : x H K (Λ)}. Thus λ K (Λ) K H K (Λ) µ K (Λ)K. (1) 2 It is known that the nearest vector problem is N P-hard for the norms f B ( ) and f C ( ), see van Emde Boas [3] and Kannan [7]. Probably the shortest vector problem is also N P-hard, but up to now this has only been established with respect to the maximum norm (cf. [3]). The purpose of this note is to prove that for a certain class of norms SVP K is not harder than NVP K : 2

3 Theorem 1.1 Let Λ Q n be a lattice given by a basis b 1,..., b n and let f K ( ) be a norm with the property that f C (x) f K (x) f B (x), x R n. (2) With polynomially many calls to a subroutine solving NVP K and polynomial additional time we can solve SVP K. At a first sight this class of norms appears to very special, but for example all p-norms x p = ( n i=1 x i p ) 1/p are part of this class for p 2. We assume that the function f K ( ) is computable in polynomial time. The input size of our problem is given by the input size of the vectors b 1,..., b n. For detailed information about complexity and numerical computation we refer to the book [5] and for notation concerning lattices we refer to [6]. Finally, we note that (2) is equivalent to B K C, and thus implies that 1 n f B (x) f K (x) f B (x), (3) f K (e i ) = 1, 1 i n, (4) where e i denotes the i-th unit vector. 2 Proof of Theorem 1.1 Now we state an algorithm which reduces the problem SVP K to NVP K. Since the algorithm works inductively the input is given by an m-dimensional lattice Λ embedded in R n, where we assume m > 1. Otherwise it is trivial to compute a shortest nonzero lattice vector. The linear hull of Λ is denoted by lin(λ). Procedure SVP K by NVP K : Input: An m-dimensional lattice Λ generated by the basis b 1..., b m Q n and a norm f K ( ) on R n such that (2) is satisfied. Output: A shortest nonzero vector b of the lattice Λ with respect to f K ( ). (i) With respect to the Euclidean norm find an almost shortest nonzero lattice vector b in the polar lattice Λ = {z lin(λ) : z, w Z, w Λ} 3

4 of Λ by calls of the subroutine NVP K, i.e. find a primitive vector b Λ such that (ii) Find a basis b 1,..., b m of Λ such that λ B (Λ ) f B(b ) 2n. (5) b i, b = 0, 1 i m 1, and b m, b = 1. (6) (iii) Let H i = {x lin(λ) : b, x = i}, i Z. For 1 i 2n 3/2 m find a shortest lattice vector u m,i in the affine hyperplane H i using the subroutine NVP K. (iv) Let u m be a lattice vector of minimal length among the vectors u m,i. (v) Find a shortest lattice vector u m 1 in the plane H 0 by applying the procedure SVP K by NVP K to the (m 1)-dimensional lattice Λ m 1 generated by the vectors b 1,..., b m 1 and the norm f K ( ). (vi) Let b be the shorter one of u m and u m 1. Then f K (b) = λ K (Λ). Proof of Theorem 1.1 Without loss of generality we may assume Λ Z n. First we prove the correctness of the algorithm. Obviously, a shortest lattice vector of Λ is contained in i=0h i. It remains to show that it suffices to consider the planes H i, 0 i 2n 3/2 m. By a result of Banaszczyk [1] (see also Bourgain & Milman [2]) we have λ B (Λ) λ B (Λ ) m. Since B K by (2) we have λ B (Λ) λ K (Λ) and thus λ K (Λ) m λ B (Λ ). On account of (5) we obtain λ K (Λ) 2n m f B (b ). (7) On the other hand we have for each vector y H i that f B (y) i/f B (b ) and so (cf. (3)) f K (y) i nfb (b ). Hence for i > 2n 3/2 m the length of a shortest lattice vector in a plane H i is greater than λ K (Λ). In the sequel we show how the single steps of the algorithm can be done. 4

5 Step (i): Let b m+1,..., b n be an orthogonal basis of the orthogonal complement of lin(λ). Such a basis can be found in polynomial time via the Gram-Schmidt orthogonalization (cf. [5]). Let B be the matrix with columns b 1,..., b n. Then the first m columns of the matrix (B T ) 1 form a basis of Λ. Let the columns of (B T ) 1 be denoted by b 1,..., b n and let Λ be the n-dimensional lattice generated by b 1,..., b m, σb m+1,..., σb n with 2n σ = min{f B (b j ) : m + 1 j n} f B(b 1 ) + 1 (8) In what follows we construct a vector b Λ \{0} such that (5) holds with Λ instead of Λ, i.e. λ B ( Λ ) f B(b ) 2n. (9) Then by the choice of σ we will see that b belongs to Λ and thus the vector satisfies (5). Since the parallelepiped P spanned by b 1,..., b m, σb m+1,..., σb n generates a lattice tiling with respect to Λ the width ω(p ) of P is a lower bound for λ B ( Λ ). Now ω(p ) = min { 1/f B (b 1 ),..., 1/f B (b m ), σ/f B (b m+1 ),..., σ/f B (b n ) } and so { λ B ( Λ 1 ) ω(p ) γ := min f B (b i ), 1 i n }. With ν 0 = γ/ 2 n we obtain for 1 i n (cf. (4)) f K (ν 0 e i ) = ν 0 λ B( Λ ) 2 n λ K( Λ ). (10) 2 Thus the vectors ν 0 e i belong to the honeycomb H K ( Λ ) (cf. (1)) and the origin is the unique nearest lattice vector to ν 0 e i. Moreover for ν 1 = m i=1 f B (b i ) + n i=m+1 f B (σb i ) we obtain (cf. [6]) f K (ν 1 e i ) = ν 1 > 1 m f K (b i ) + 2 i=1 n i=m+1 f K (σb i ) µ K ( Λ ). (11) 5

6 Hence the vectors ν 1 e i are not contained in H K ( Λ ). On account of (1) and since H K ( Λ ) is a ray set the output of the subroutine NVP K with input Λ and νe i is a nonzero lattice vector for ν ν 1. So by applying the subroutine NVP K to the sequence of points 2 k ν 0 e i, k = 0,..., we can find after at most log 2 (ν 1 ) log 2 (ν 0 ) calls of NVP K a positive scalar ɛ i with ν 0 ɛ i ν 1 and a nonzero lattice vector v i such that ɛ i e i H K ( Λ ) and 2ɛ i e i v i + H K ( Λ ). The last relation implies f K (2ɛ i e i v i ) f K (2ɛ i e i ) and thus f K (v i ) 4ɛ i. Now let ɛ k = min{ɛ i : 1 i n} and let b = v k. In the sequel we show that b satisfies (9). For abbreviation we write ɛ instead of ɛ k. On account of (3) we get f B (b ) 4ɛ n. (12) H K ( Λ ) is a centrally symmetric ray set and thus ±ɛ e i H K ( Λ ). Hence (cf. (4)) f B (ɛe i ) = ɛ = f K (ɛe i ) f K (ɛe i u ) f B (ɛe i u ) (13) for all lattice vectors u Λ. That means that the vectors ±ɛe i, 1 i n, are contained in the honeycomb H B ( Λ ) which is a convex set. So the width of the cross polytope with vertices ±ɛ e i is a lower bound for λ B ( Λ ): λ B ( Λ ) 2ɛ n. Together with (12) we obtain λ B ( Λ ) f B(b ) 2n. Now suppose b / Λ. Then by the definition of Λ and σ we have f B (b ) σ min{f B (b j ) : l + 1 j n} > 2nf B (b 1 ) 2n λ B ( Λ ) which contradicts the choice of b. Obviously, we may assume that b is primitive. Step (ii): 6

7 In order to find a basis of Λ such that (6) is satisfied we first construct a basis b 1 m,..., b of Λ containing b. Furthermore, without loss of generality we may assume that the matrix M with columns b, b 2,..., b m has rank m. Let A be the integer (m m)-matrix such that M = B A, where B is the matrix with columns b 1,..., b m. It is well known that the Hermite normal form of a A can be computed in polynomial time (cf. [4], [8] or [10]) and thus we can find an unimodular matrix U and an integer upper triangle matrix T with A = U T. Hence M = (B U) T and the columns b 1,..., b m of B U form a basis of Λ. Since b is primitive b is the first column vector of B U. Now, let b m+1,..., b n be an orthogonal basis of the orthogonal complement of lin(λ) and B be the matrix with columns b 1,..., b m, b m+1,..., b n. Then the first m columns of ( B T ) 1 form a basis of Λ such that (6) is satisfied. Step (iii): Obviously, H i Λ = {x Λ : x = m 1 j=1 z j bj + i b m }. Hence, for i 1 the shortest vector problem in the plane H i is the task to find a lattice vector of Λ m 1 which is nearest to i b m. That can be done by applying the procedure NVP K to the input vector ib m and a suitable n-dimensional lattice ˆΛ. For example, let g m,..., g n be an orthogonal basis of the orthogonal complement of lin(λ m 1 ) and let χ = 2 n 2n 3/2 f B (b m ) m + 1 min{f B (g j ) : m j n} We claim that a nearest lattice vector of the lattice ˆΛ generated by b 1,..., bm 1, χg m,..., χg n to ib m belongs to Λ m 1. Suppose the opposite and let z 1 b 1 + +z m 1 b m 1 +z m χg m + +z n χg n be a nearest lattice vector to ib n with some z j 0, say z n, for m j n. Then f K (z 1 b z m 1 b m 1 + z m χg m + + z n χg n ib l ) if K (b m ) and on account of (3) we get z n χf B (g n ) n if K (b m ) f B(z 1 b z m 1 b m 1 + z m χg m + + z n χg n ) n if K (b m ) f K (z 1 b z m 1 b m 1 + z m χg m + + z n χg n ib m ) if K (b m ). It follows χ 2 nif B (b m )/f B (g n ) 2 n 2n 3/2 m f B (b m )/f B (g n ) which contradicts the choice of χ. To analyze the encoding length of the numbers arising in the procedure let A be the input size of the algorithm and let Λ i be the i-dimensional lattice constructed in the (m i)-th call of the procedure SVP K by NVP K. Furthermore, let b i be the almost shortest lattice vector of the appropriate dual 7

8 lattices Λ i constructed in step (i). Then det(λ j 1 ) = det(λ j )f B (b j ) and by (5) and Minkowski s convex body theorem (cf. [5]) det(λ j 1 ) = det(λ j )f B (b j ) det(λ j )2nλ B (Λ j ) det(λ j )2n j det(λ j ) 1/j det(λ j )2n j. So det(λ j 1 ) < det(λ m )(2n) 2m. Before we call the procedure SVP K by NVP K we can make an LLL-reduction and obtain a basis c 1,..., c j Z n of Λ j with (cf. [5]) f B (c 1 ) f B (c j ) 2 j2 det(λ j ). Hence, for each vector c j we have the bound f B (c j ) 2 m2 (2n) 2m det(λ m ). This implies that we can always find a basis of the lattice Λ j whose input size is bounded by O( A 3 ). Finally, it is easy to check that the numbers arising in the steps (i) (iv) of the procedure SVP K by NVP K are bounded by a polynomial in the input size of the given basis at the beginning of the execution of the steps (i) (iv) (cf. [5]). 3 Remarks The crucial point for the special choice of the norms given by (2) is relation (13). For example, if f K ( ) is the 1-norm, i.e., K is the cross polytope with edge length 2 then, in general, it is not true that f K (ɛe i u ) f B (ɛe i u ). Hence we do not know whether ±ɛe i, 1 i n, are contained in H B ( Λ ) and we can not show that b is an almost shortest lattice vector as required in step (i) (cf. proof of Theorem 1.1). On the other hand if K is an arbitrary centrally symmetric convex body and if we have oracles solving NVP K and NVP B, then SVP K can be solved in oracle polynomial time, because by the subroutine solving NVP B we can easily find such an almost shortest lattice vector. However, we believe that SVP K is polynomial reducible to NVP K at least for any p-norm. The above algorithm works also for any norm f K( ) for which an affine transformation L exists such that B L K C because f L K(x) = f K(L 1 x). Finally, we remark that in the Euclidean case the problem to find a Korkin- Zolotarev reduced basis of a lattice is polynomial reducible to the shortest 8

9 lattice vector problem SVP B (cf. [9]). By Theorem 1.1 we obtain that this problem can also be reduced to NVP B in polynomial time. References [1] W. Banaszczyk, New bounds in some transference theorems in the geometry of numbers, Math. Ann. 296 (1993), no. 4, [2] J. Bourgain and V.D. Milman, Sections euclidiennes et volume des corps symétriques convexes dans R n, C.R. Acad. Sci. Paris Sér. I Math. 300 (1985), [3] P. van Emde Boas, Another N P-complete partition problem and the complexity of computing short vectors in a lattice, Report 81-04, Mathematical Institute, University of Amsterdam (1981). [4] M.A. Frumkin, An algorithm for the reduction of a matrix of integers to triangular form with power complexity of the computations, Èkonomika i Matematicheskie Metody 12 (1976), (Russian). [5] M. Grötschel, L. Lovász, and A. Schrijver, Geometric Algorithms and Combinatorial Optimization, Springer, Berlin, [6] P.M. Gruber and C.G. Lekkerkerker, Geometry of Numbers, 2.nd ed., North- Holland, Amsterdam, [7] R. Kannan, Minkowski s convex body theorem ad integer programming, Math. Operations Research 12 (1987), no. 3, [8] R. Kannan and A. Bachem, Polynomial algorithms for computing the Smith and Hermite normal forms of an integer matrix, SIAM Journal on Computing 8 (1979), [9] L. Lovász, An Algorithmic Theory of Numbers, Graphs and Convexity, (CBMS-NSF Regional Conference Series in Applied Mathematics 50), SIAM, Philadelphia, Pennsylvania, [10] M. Pohst and H. Zassenhaus, Algorithmic Algebraic Number Theory, Cambridge Univ. Press, Cambridge,