CSE A Lattice Algorithms and Applications Winter  IntroductiontoLattices Instructor DanieleMicciancio UCSD CSE Lattices are regular arrangements of p oints in Euclidean space
165K - views

CSE A Lattice Algorithms and Applications Winter IntroductiontoLattices Instructor DanieleMicciancio UCSD CSE Lattices are regular arrangements of p oints in Euclidean space

They naturally o ccur in many settings like crystallography sphere packings stacking oranges etc They have many applications in computer science and mathematics including the solution of inte ger programming problems diophantine approximation crypta

Download Pdf

CSE A Lattice Algorithms and Applications Winter IntroductiontoLattices Instructor DanieleMicciancio UCSD CSE Lattices are regular arrangements of p oints in Euclidean space

Download Pdf - The PPT/PDF document "CSE A Lattice Algorithms and Application..." is the property of its rightful owner. Permission is granted to download and print the materials on this web site for personal, non-commercial use only, and to display it on your personal computer provided you do not modify the materials and that you retain all copyright notices contained in the materials. By downloading content from our website, you accept the terms of this agreement.

Presentation on theme: "CSE A Lattice Algorithms and Applications Winter IntroductiontoLattices Instructor DanieleMicciancio UCSD CSE Lattices are regular arrangements of p oints in Euclidean space"— Presentation transcript:

Page 1
CSE 206A: Lattice Algorithms and Applications Winter 2010 1:IntroductiontoLattices Instructor: DanieleMicciancio UCSD CSE Lattices are regular arrangements of p oints in Euclidean space. They naturally o ccur in many settings, like crystallography, sphere packings (stacking oranges), etc. They have many applications in computer science and mathematics, including the solution of inte- ger programming problems, diophantine approximation, cryptanalysis, the design of error correcting co des for multi antenna systems, and many more. Recently, lattices have also attracted much

attention as a source of computational hardness for the design of secure cryptographic functions. This course oers an intro duction to lattices. We will study the b est currently known algorithms to solve the most imp ortant lattice problems, and how lattices are used in several representative applications. We b egin with the denition of lattices and their most imp ortant mathematical prop erties. 1. Lattices Denition 1. lattice is a discrete additive subgroup of , i.e., it is a subset satisfying the following prop erties: (subgroup) is closed under addition and subtraction, (discrete)

there is an  > such that any two distinct lattice p oints are at distance at least k Not every subgroup of is a lattice. Example 1. is a subgroup of , but not a lattice, b ecause it is not discrete. The simplest example of lattice is the set of all -dimensional vectors with integer entries. Example 2. The set is a lattice b ecause integer vectors can b e added and subtracted, and clearly the distance b etween any two integer vectors is at least Other lattices can b e obtained from by applying a (nonsingular) linear transformation. For example, if has full column rank (i.e., the columns of are

linearly indep en- dent), then ) = Bx is also a lattice. Clearly this set is closed under addition and subtraction. Later we will show that it is also discrete, and moreover all lattices can b e expressed as for some , so an equivalent denition of lattice is the following. Denition 2. Let = [ ,..., b e linearly indep endent vectors in . The lattice generated by is the set ) = Bx =1 of all the integer linear combinations of the columns of . The matrix is called a basis for the lattice . The integers and are called the dimension and rank of the lattice. If then is called a fullrank lattice.

Page 2
Denition 2 is the most commonly used in comptuer science as it gives a natural way to represent a lattice by a nite ob ject: lattices are represented by a basis matrix that generates the lattice, and the basis matrix typically has integer or rational entries. Notice the similarity b etween the denition of a lattice ) = and the denition of vector space generated by span ) = The dierence is that in a vector space you can combine the columns of with arbitrary real co ecients, while in a lattice only

integer co ecients are allowed, resulting in a discrete set of p oints. Notice that, since vectors ,..., are linearly indep endent, any p oint span can b e written as a linear combination in a unique way. Therefore ∈L if and only if ,...,x If is a basis for the lattice , then it is also a basis for the vector space span However, not every basis for the vector space span is also a lattice basis for . For example is a basis for span as a vector space, but it is not a basis for as a lattice b ecause vector ∈L (for any ) is not an integer linear combination of the vectors in The

denition ) = Bx can b e extended to matrices whose columns are not linearly indep endent. However, in this case, the resulting set of p oints is not always a lattice b ecause it may not b e discrete. Still, we will see that if is a matrix with rational entries, then is always a lattice, and a basis for can b e computed from in p olynomial time. Exercise 1. Find a set of vecotrs such that is not a lattice. [Hint:thesevectors mustnecessarilybelinearlydependentandirrational.] 2. Latticebases Theorem 1. Let and betwobases.Then ) = ifandonlyifthereexistsa unimodularmatrix

(i.e.,asquarematrixwithintegerentriesanddeterminant )such that CU Proof. First assume CU for some unimo dular matrix . Notice that if is unimo dular, then is also unimo dular. In particular, b oth and are integer matrices, and CU and BU . It follows that ⊆L and ⊆L , i.e., the two matrices and generate the same lattice. Now assume and are two bases for the same lattice ) = . Then, by denition of lattice, there exist integer square matrices and such that CW and BV Combining these two equations we get BVW , or equivalently, VW ) = . Since vectors are linearly indep endent, it must b

e VW , i.e., VW . In particular, det( det( ) = det( ) = det( ) = 1 . Since matrices and have integer entries, det( det( , and it must b e det( ) = det( ) = A simple way to obtain a basis of a lattice from another is to apply (a sequence of ) elementary column op erations, as dened b elow. It is easy to see that elementary column op erations do not change the lattice generated by the basis b ecause they can b e expressed as right multiplication by a unimo dular matrix. Elementary (integer) column op erations are:
Page 3
(1) Swap the order of two columns in (2) Multiply a column by

(3) Add an integer multiple of a column to another column: where and Moreover, any unimo dular transformation can b e expressed as a sequence of elementary integer column op erations. Exercise 2. Show that two lattice bases are equivalent precisely when one can b e obtained from the other via elementary integer column op erations. [Hint:showthatanyunimodular matrixcanbetransformedintotheidentitymatrixusingelementaryoperations,andthen reversethesequenceofoperations.] 3. Gram-Schmidtorthogonalization Any basis can b e transformed into an orthogonal basis for the same vector space using the

well-known Gram-Schmidt orthogonalization metho d. Supp ose we have vectors = [ ... generating a vector space span . These vectors are not nec- essarily orthogonal (or even linearly indep endent), but we can always nd an orthogonal basis = [ ... for where is the comp onent of orthogonal to span ,..., Denition 3. For any sequence of vectors = [ ,..., , dene the orthogonalized vectors = [ ... iteratively according to the formula j i,j where i,j In matrix notation, where is the upp er triangular matrix with 1 along the diagonal and j,i i,j for all j < i . It also follows that BM where is also

upp er triangular with 1 along the diagonal. Note that the columns of are orthogonal ( = 0 for all ). Therefore the (non-zero) columns of are linearly indep endent and form a basis for the vector space span . However they are generally not a basis for the lattice Example 3. The Gram-Schmidt orthogonalization of the basis = [(2 0) (1 2) is [(2 0) (0 2) . However this is not a lattice basis for b ecause the vector (0 2) do es not b elong to the lattice. contains a sublattice generated by a pair of orthogonal vectors (2 0) and (0 4) , but no pair of orthogonal vectors generate the entire lattice

So, while vector spaces always admit an orthogonal basis, this is not true for lattices. 4. Thedeterminant Denition 4. Given a basis = [ ,..., , the fundamentalparallelepiped asso ci- ated to is the set of p oints ) = [0 1) =1 : 0 Remark Note that is half-op en, so that the translates ) + (for ∈L form a partition of the whole space . More precisely, for any , there exists a unique lattice p oint ∈L , such that )) We now dene a fundamental quantity asso ciated to any lattice, the determinant.
Page 4
Denition 5. Let b e a basis. The determinant of a lattice det( )) is

dened as the -dimensional volume of the fundamental parallelepip ed asso ciated to det( )) = vol )) = where is the Gram-Schmidt orthogonalization of The ab ove formula for the determinant of a lattice is a generalization of the well known formula for the area of a parallelepip ed. Geometrically, the determinant represents the inverse of the density of lattice p oints in space (e.g., the numb er of lattice p oints in a large and suciently regular region of space should b e approximately equal to the volume of divided by the determinant.) In particular, the determinant of a lattice do es not

dep ent on the choice of the basis. We will prove this formally later in this lecture. The next simple upp er b ound on the determinant (Hadamardinequality) immediately follows from the fact that k≤k Prop osition 1. Foranylattice det( )) In the next lecture we will prove that the Gram-Schmidt orthogonalization of a basis can b e computed in p olynomial time. So, the determinant of a lattice can b e computed in p oly- nomial time by rst computing the orthogonalized vectors , and then taking the pro duct of their lengths. But there are simpler ways to express the determinant of a lattice

that do not involve the Gram-Schmidt orthogonalized basis. The following prop osition shows that the determinant of a lattice can b e obtained from a simple matrix determinant computation. Prop osition 2. Foranylatticebasis det( )) = det( Inparticular,if isa(non-singular)squarematrixthen det( )) = det( Proof. Rememb er the Gram-Schmidt orthogonalization pro cedure. In matrix notation, it shows that the orhogonalized vectors satisfy , where is an upp er triangular matrix with 's on the diagonal, and the i,j co ecients at p osition j,i for all j < i . So, our formula for the determinant of a

lattice can b e written as det( ) = det( ∗> ) = det( ) det( ∗> ) det( The matrices are triangular, and their determinant can b e easily computed as the pro duct of the diagonal elements, which is . Now consider ∗> . This matrix is diagonal b ecause the columns of are orthogonal. So, its determinant can also b e computed as the pro duct of the diagonal elements which is det( ∗> ) = = ( = det( )) Taking the square ro ot we get det( ) det( ∗> ) det( ) = det( )) Recallthatthedeterminantofamatrixcanbecomputedinpolynomialtimebycomputing det(

Page 5
Now it is easy to show that the determinant do es not dep end on the particular choice of the basis, i.e., if two bases generate the same lattice then their lattice determinants have the same value. Theorem 2. Suppose arebasesofthesamelattice ) = .Then, det( ) = det( Proof. Supp ose ) = . Then where is a unimo dular matrix. Then det ) = det(( CU CU )) = det( ) det( ) det( ) = det(( b ecause det( ) = 1 We conclude this section showing that although not every lattice has an orthogonal basis, every

integer lattice contains an orthogonal sublattice. Theorem 3. Foranynonsingular ,let det( .Then ⊆L Proof. Let b e any vector in . We know for some integer vector We want to prove that ∈L , i.e., for some integer vector . Since is non-singular, we can always nd a solution to the system over the reals. We would like to show that is in fact an integer vector, so that ∈L . We consider the elements and use Cramer's rule: det ([ ,..., ,d ,..., ]) det( det ([ ,..., ,..., ]) det( = det ([ ,..., ,..., ]) So, is an integer vector. We may say that any integer lattice is p erio dic mo

dulo the determinant of the lattice, in the sense that for any two vectors , if (mod det( ))) , then ∈L if and only if ∈L 5. MinimumDistance Denition 6. For any lattice Λ = , the minimum distance of is the smallest distance b etween any two lattice p oints: (Λ) = inf {k We observe that the minimum distance can b e equivalently dened as the length of the shortest nonzero lattice vector: (Λ) = inf {k \{ }} This follows from the fact that lattices are additive subgroups of , i.e., they are closed under addition and subtraction. So, if and are distinct lattice p oints,

then is a nonzero lattice p oint. The rst thing we want to prove ab out the minimum distance is that it is always achieved by some lattice vector, i.e., there is a lattice vector of length exactly (Λ) . To prove this, we need rst to establish a lower b ound on (Λ)
Page 6
Theorem 4. Foreverylatticebasis anditsGram-Schmidtorthogonalization )) min Proof. Note that are not lattice vectors. Let us consider a generic lattice vector Bx ∈L \{ where \{ and let b e the biggest index such that = 0 . We prove that (1) Bx k≥k k min In order to prove (1), we take the scalar

pro duct of our lattice vector and . Using the orthogonality of and (for i ) we get Bx By Cauchy-Shwartz, Bx kk k≥| Bx 〉|≥| |k Using | and dividing by , we get Bx k≥k An immediate consequence of Theorem 4 is that for any matrix with full column rank, the set is a lattice according to denition Denition Notice that the lower b ound min dep ends on the choice of the basis. We will see later in the course that some bases give b etter lower b ounds than others, but at this p oint any nonzero lower b ound will suce. We want to show that there is a lattice vector of

length . Consider a sphere of radius . Clearly, in the denition of = inf {k \{ }} we can restrict to range over all lattice vectors inside this sphere. We observe that (by a volume argument) the sphere contains only nitely many lattice p oints. (Details b elow.) It follows that we can replace the inf op eration with a min , and there is a p oint in the set achieving the smallest p ossible norm. How can we use a volume argument, when p oints have volume ? Put an op en sphere of radius λ/ around each lattice p oint. Since lattice p oints are at distance at least , the spheres are

disjoint. The spheres with centers in are also contained in a sphere of radius . So, since the volume of the small spheres (which is prop ortional to ) cannot exceed the volume of the big sphere (which has volume prop ortional to ), there are at most lattice p oints. 6. Minkowski'stheorem We now turn to estimating the value of from ab ove. Clearly, for any basis , we have min , b ecause each column of is a nonzero lattice vector. We would like to get a b etter b ound, and, sp ecically, a b ound that do es not dep end on the choice of the basis. We will prove an upp er b ound of the form

(Λ) ) det(Λ) /n Why det(Λ) /n ? The reason we lo ok for b ounds of this form is that the expression det(Λ) /n scales linearly with the lattice, i.e., if we multiply a lattice by a factor , then we obtain Λ) = c (Λ) and det( Λ) /n det(Λ) /n The upp er b ound on (Λ) we are going to prove was originally proved by Minkowski. Here we follow a dierent approach, by rst proving a theorem of Blichfeldt from which Minkowski's theorem can b e easily derived as a corollary.
Page 7
Theorem 5. Givenalattice andaset ifvol det( then contains twopoints

,z suchthat ∈L Proof. Consider the sets )) , where ∈L . Notice that these sets form a partition of , i.e., they are pairwise disjoint and ∈L In particular we have vol ) = ∈L vol Notice that the transtated sets = ( ∩P are all contained in . We want to prove that the cannot b e all mutually disjoint. Since vol ) = vol , we have vol )) vol ) = ∈L vol ) = ∈L vol The facts that ⊆P and ∈L vol vol )) imply that these sets cannot b e disjoint, i.e. there exist two distinct vectors ∈ L such that = 0 Let b e any vector in the (non-empty)

intersection and dene S. These two vectors satisfy ∈L As a corollary to Blichfeldt theorem we immediately get a result originally due to Minkowski that gives a b ound on the length of the shortest vector in a lattice. Corollary 1. [Minkowski'sconvexbodytheorem]If isaconvexsymmetricbodyofvolume vol det( ,then containsanon-zerolatticepoint. Proof. Consider the set S/ 2 = : 2 . The volume of S/ satises vol S/ 2) = 2 vol det( By Blichfeldt theorem there exist ,z S/ such that ∈L \{ . By denition of S/2, . Since is symmetric, also and by convexity, is a non-zero lattice vector

contained in the set The relation b etween Minkowski theorem and b ounding the length of the shortest vector in a lattice is easily explained. Consider rst the norm: = max . We show that every (full rank, -dimensional) lattice always contains a nonzero vector k det(Λ) /n . Let = min {k \{ }} and assume for contradition l> det(Λ) /n . Take the hyp ercub e < l . Notice that is convex, symmetric, and has volume vol ) = (2
Page 8
det(Λ) . So, by Minkowski's theorem, contains a nonzero lattice vector . By denition of , we have , a contradiction to the minimality of For

any full dimensionsional there exists a lattice p oint ∈L such that det( /n Using inequality k (valid for any -dimensional vector ), we get a corresp ond- ing b ound in the norm. It is easy to see that for Euclidean norm the full dimensionality condition is not necessary b ecause one can pro ject a lattice of rank to while preserving the minimum distance. Corollary 2. Foranylattice thereexistsalatticepoint ∈L \{ suchthat det( /n We could have proved the b ound for the Euclidean norm directly, using a sphere instead of a cub e, and then plugging in the formula for the volume of an

-dimensional sphere. This can b e useful to get slighly b etter b ounds. For example, in two dimensions, for any lattice , the disk < (Λ) contains no nonzero lattice p oint. So, by Minkowki's theorem, the area of can b e at most det(Λ) = 4 det(Λ) . But we know that the area of is . So, (Λ) det(Λ) / , which is strictly smaller than 2 det(Λ) /n We remark that a lattice can contain vectors arbitrarily shorter than Minkowski's b ound det(Λ) /n . Consider for example the two dimensional lattice generated by the vectors (1 0) and (0 ,N , where is a large integer.

The lattice contains a short vector of length = 1 . However, the determinant of the lattice is , and Minkowski's b ound is much larger than It can also b e shown that Minkowski's b ound cannot b e asymptotically improved, in the sense that there is a constant such that for any dimension there is a -dimensional lattice such that (Λ) >c det(Λ) /n . (See homework assignment.) So, up to constant factors, ) det(Λ) /n is the b est upp er b ound one can p ossibly prove on the length of the shortest vector of any -dimensional lattice. 7. Asimpleapplication As an application of

Minkowski's theorem we show that any prime numb er congruent to 1 mo d 4 can b e written as the sum of two squares. Theorem 6. Foreveryprime 1 mod 4 thereexistintegers a,b suchthat Proof. Let b e a prime such that 1 mod 4 . Then is a group such that ) = . Therefore, there exists an element of multiplicative order , and is a quadratic residue mo dulo , i.e. there exists an integer such that 1 (mod . It immediately follows that (2) + 1 Now dene the lattice basis 1 0 i p
Page 9
By Minkowski's theorem there exists an integer vector such that Bx det( . Squaring this equation yields (3)

Bx det( ) = 2 p. The middle term expands to (4) ix px + ( ix px If we let and ix px , (2) b ecomes (5) Hence if we can show that mo d , by necessity . Expanding the right side of (3) pro duces + 2 ix px , which can b e factored into px + 2 ix ) + + 1) Obviously divides the rst term, and by (1) divides the second term. Thus mo d , and therefore by (4) This application shows how lattices can b e used to prove non-trivial facts in numb er theory. A similar theorem that can b e proved with the same lattice techniques is the following. Theorem 7. a,b,c,d ∈Z The pro of is left to the reader

as an excercise. As you can easily guess, the pro ofs involves a 4-dimensional lattice. 8. SuccessiveMinima Denition 7. For any lattice and integer rank (Λ) , let (Λ) b e the smallest r > such that contains at least linearly indep endent vectors of length b o ounded by The successive minima of a lattice generalize the minimum distance . By the same volume argument used to show that there exists vectors of length , one can show that there exist (linearly indep endent) lattice vectors ,..., of lengths ,..., . Minkowski's theorem can also b e generalized to provide a b ound not just on

, but on the geometric mean of all successive minima. Theorem 8. Foranylattice =1 det( vol ,where isthe -dimensionalunitball. Proof. Assume for contradiction this is not the case, i.e., det( vol and let ,..., b e linearly indep endent vectors such that . Consider the orthogonalized vectors and dene the transformation ) = that expands co ordinate by the factor . If we apply to the op en unit ball we get a symmetric convex b o dy of volume vol det( . By Minkowski's rst theorem contains a lattice p oint (with ) dierent from the origin. Let and . Since is not zero, some is not zero. Let the

largest index such that = 0 . Notice that is linearly indep endent from ,...,
Page 10
b ecause . We now show that < , contradicting the denition of for some <