Lattice problem

This is an illustration of the shortest vector problem (basis vectors in blue, shortest vector in red).

In the SVP, a basis of a vector space V and a norm N (often L²) are given for a lattice L and one must find the shortest non-zero vector in V, as measured by N, in L. In other words, the algorithm should output a non-zero vector v such that ${\displaystyle \|v\|_{N}=\lambda (L)}$.

In the γ-approximation version SVP_γ, one must find a non-zero lattice vector of length at most ${\displaystyle \gamma \cdot \lambda (L)}$ for given ${\displaystyle \gamma \geq 1}$.

The problem GapSVP_β consists of distinguishing between the instances of SVP in which the length of the shortest vector is at most ${\displaystyle 1}$ or larger than ${\displaystyle \beta }$, where ${\displaystyle \beta }$ can be a fixed function of the dimension of the lattice ${\displaystyle n}$. Given a basis for the lattice, the algorithm must decide whether ${\displaystyle \lambda (L)\leq 1}$ or ${\displaystyle \lambda (L)>\beta }$. Like other promise problems, the algorithm is allowed to err on all other cases.

Yet another version of the problem is GapSVP_{ζ, γ} for some functions ${\displaystyle \zeta ,\gamma }$. The input to the algorithm is a basis ${\displaystyle B}$ and a number ${\displaystyle d}$. It is assured that all the vectors in the Gram–Schmidt orthogonalization are of length at least 1, and that ${\displaystyle \lambda (L(B))\leq \zeta (n)}$ and that ${\displaystyle 1\leq d\leq \zeta (n)/\gamma (n)}$ where ${\displaystyle n}$ is the dimension. The algorithm must accept if ${\displaystyle \lambda (L(B))\leq d}$, and reject if ${\displaystyle \lambda (L(B))\geq \gamma (n).d}$. For large ${\displaystyle \zeta }$ (i.e. ${\displaystyle \zeta (n)>2^{n/2}}$), the problem is equivalent to GapSVP_γ because[20] a preprocessing done using the LLL algorithm makes the second condition (and hence, ${\displaystyle \zeta }$) redundant.

This is an illustration of the closest vector problem (basis vectors in blue, external vector in green, closest vector in red).

In CVP, a basis of a vector space V and a metric M (often L²) are given for a lattice L, as well as a vector v in V but not necessarily in L. It is desired to find the vector in L closest to v (as measured by M). In the ${\displaystyle \gamma }$-approximation version CVP_γ, one must find a lattice vector at distance at most ${\displaystyle \gamma }$.

This problem is similar to the GapSVP problem. For GapSVP_β, the input consists of a lattice basis and a vector ${\displaystyle v}$ and the algorithm must answer whether one of the following holds:

• there is a lattice vector such that the distance between it and ${\displaystyle v}$ is at most 1.
• every lattice vector is at a distance greater than ${\displaystyle \beta }$ away from ${\displaystyle v}$.

The opposite condition is that the closest lattice vector is at a distance ${\displaystyle 1<\lambda (L)\leq \beta }$, hence the name GapCVP.

Given a lattice L of dimension n, the algorithm must output n linearly independent ${\displaystyle v_{1},v_{2},\ldots ,v_{n}}$ so that ${\displaystyle \max \|v_{i}\|\leq \max _{B}\|b_{i}\|}$ where the right hand side considers all bases ${\displaystyle B=\{b_{1},\ldots ,b_{n}\}}$ of the lattice.

In the ${\displaystyle \gamma }$-approximate version, given a lattice L with dimension n, find n linearly independent vectors ${\displaystyle v_{1},v_{2},\ldots ,v_{n}}$ of length ${\displaystyle \max \|v_{i}\|\leq \gamma \lambda _{n}(L)}$, where ${\displaystyle \lambda _{n}(L)}$ is the ${\displaystyle n}$'th successive minimum of ${\displaystyle L}$.

This problem is similar to CVP. Given a vector such that its distance from the lattice is at most ${\displaystyle \lambda (L)/2}$, the algorithm must output the closest lattice vector to it.

Given a basis for the lattice, the algorithm must find the largest distance (or in some versions, its approximation) from any vector to the lattice.

Many problems become easier if the input basis consists of short vectors. An algorithm that solves the Shortest Basis Problem (SBP) must, given a lattice basis ${\displaystyle B}$, output an equivalent basis ${\displaystyle B'}$ such that the length of the longest vector in ${\displaystyle B'}$ is as short as possible.

The approximation version SBP_γ problem consist of finding a basis whose longest vector is at most ${\displaystyle \gamma }$ times longer than the longest vector in the shortest basis.

Average case hardness of problems forms a basis for proofs-of-security for most cryptographic schemes. However, experimental evidence suggests that most NP-hard problems lack this property: they are probably only worst case hard. Many lattice problems have been conjectured or proven to be average-case hard, making them an attractive class of problems to base cryptographic schemes on. Moreover, worst-case hardness of some lattice problems have been used to create secure cryptographic schemes. The use of worst-case hardness in such schemes makes them among the very few schemes that are very likely secure even against quantum computers.

The above lattice problems are easy to solve if the algorithm is provided with a "good" basis. Lattice reduction algorithms aim, given a basis for a lattice, to output a new basis consisting of relatively short, nearly orthogonal vectors. The Lenstra–Lenstra–Lovász lattice basis reduction algorithm (LLL) was an early efficient algorithm for this problem which could output an almost reduced lattice basis in polynomial time.[33] This algorithm and its further refinements were used to break several cryptographic schemes, establishing its status as a very important tool in cryptanalysis. The success of LLL on experimental data led to a belief that lattice reduction might be an easy problem in practice. However, this belief was challenged when in the late 1990s, several new results on the hardness of lattice problems were obtained, starting with the result of Ajtai.[2]

In his seminal papers, Ajtai showed that the SVP problem was NP-hard and discovered some connections between the worst-case complexity and average-case complexity of some lattice problems.[2][3] Building on these results, Ajtai and Dwork created a public-key cryptosystem whose security could be proven using only the worst case hardness of a certain version of SVP,[34] thus making it the first result to have used worst-case hardness to create secure systems.[35]

• Learning with errors
• Short integer solution problem

• Agrell, E.; Eriksson, T.; Vardy, A.; Zeger, K. (2002). "Closest Point Search in Lattices". IEEE Trans. Inf. Theory. 48 (8): 2201–2214. doi:10.1109/TIT.2002.800499.
• Micciancio, Daniele (2001). "The Shortest Vector Problem is {NP}-hard to approximate to within some constant". SIAM Journal on Computing. 30 (6): 2008–2035. CiteSeerX 10.1.1.93.6646. doi:10.1137/S0097539700373039. S2CID 42794945.
• Nguyen, Phong Q.; Stern, Jacques (2000). "Lattice Reduction in Cryptology: An Update". Proceedings of the 4th International Symposium on Algorithmic Number Theory. Springer-Verlag. pp. 85–112. ISBN 978-3-540-67695-9.