Algorithms for the Densest Sublattice Problem Daniele Micciancio (UCSD) (Joint work with D. Dadush – SODA 2013) January 2013 Daniele Micciancio Algorithms for the Densest Sublattice Problem
(Point) Lattices Traditional area of mathematics ◦ ◦ ◦ Lagrange Gauss Minkowski Daniele Micciancio Algorithms for the Densest Sublattice Problem
(Point) Lattices Traditional area of mathematics ◦ ◦ ◦ Lagrange Gauss Minkowski Key to many algorithmic applications Cryptanalysis (e.g., breaking low-exponent RSA) Coding Theory (e.g., wireless communications) Optimization (e.g., Integer Programming with fixed number of variables) Cryptography (e.g., Cryptographic functions from worst-case complexity assumptions, Fully Homomorphic Encryption) Daniele Micciancio Algorithms for the Densest Sublattice Problem
Outline Daniele Micciancio Algorithms for the Densest Sublattice Problem
Lattices: Definition e 1 e 2 The simplest lattice in n -dimensional space is the integer lattice Λ = Z n Daniele Micciancio Algorithms for the Densest Sublattice Problem
Lattices: Definition b 1 e 1 b 2 e 2 The simplest lattice in Other lattices are obtained by n -dimensional space is the applying a linear transformation integer lattice Λ = B Z n ( B ∈ R d × n ) Λ = Z n Daniele Micciancio Algorithms for the Densest Sublattice Problem
Lattice Determinant / Density b 1 e 1 b 2 e 2 Definition (Determinant) The determinant of a lattice is the volume of a fundamental region 1 det( B Z n ) = vol n ( B [0 , 1) n ) = density(Λ) Daniele Micciancio Algorithms for the Densest Sublattice Problem
The Densest Sublattice Problem (DSP) Definition (Densest Sublattice Problem ( k -DSP)) Given a lattice Λ, find a k -dimensional sublattice Λ ′ ⊆ Λ that minimizes det(Λ ′ ). Daniele Micciancio Algorithms for the Densest Sublattice Problem
The Densest Sublattice Problem (DSP) Definition (Densest Sublattice Problem ( k -DSP)) Given a lattice Λ, find a k -dimensional sublattice Λ ′ ⊆ Λ that minimizes det(Λ ′ ). Λ ′ = Λ ∩ S , dim( S ) = k Λ ′ = b Z and det(Λ ′ ) = � b � Daniele Micciancio Algorithms for the Densest Sublattice Problem
The Densest Sublattice Problem (DSP) Definition (Densest Sublattice Problem ( k -DSP)) Given a lattice Λ, find a k -dimensional sublattice Λ ′ ⊆ Λ that minimizes det(Λ ′ ). Λ ′ = Λ ∩ S , dim( S ) = k Λ ′ = b Z and det(Λ ′ ) = � b � Small det ⇔ High density Daniele Micciancio Algorithms for the Densest Sublattice Problem
The Densest Sublattice Problem (DSP) Definition (Densest Sublattice Problem ( k -DSP)) Given a lattice Λ, find a k -dimensional sublattice Λ ′ ⊆ Λ that minimizes det(Λ ′ ). Λ ′ = Λ ∩ S , dim( S ) = k Λ ′ = b Z and det(Λ ′ ) = � b � Small det ⇔ High density 1-DSP = SVP (Shortest Vector Problem) Daniele Micciancio Algorithms for the Densest Sublattice Problem
Lattice rounding Gram-Schmidt orthogonalization B ∗ [0 , 1] n b ∗ b 2 2 b ∗ 1 = b 1 Daniele Micciancio Algorithms for the Densest Sublattice Problem
Lattice rounding Gram-Schmidt orthogonalization B ∗ [0 , 1] n is also a fundamental region for Λ b ∗ b 2 2 b ∗ 1 = b 1 Daniele Micciancio Algorithms for the Densest Sublattice Problem
Lattice rounding Gram-Schmidt orthogonalization B ∗ [0 , 1] n is also a fundamental region for Λ Daniele Micciancio Algorithms for the Densest Sublattice Problem
Lattice rounding Gram-Schmidt orthogonalization B ∗ [0 , 1] n is also a fundamental region for Λ Any t can be efficiently rounded to v ∈ Λ Daniele Micciancio Algorithms for the Densest Sublattice Problem
Lattice rounding Gram-Schmidt orthogonalization B ∗ [0 , 1] n is also a fundamental region for Λ Any t can be efficiently rounded to v ∈ Λ � t − v � ≤ 1 i � b ∗ �� i � 2 2 Daniele Micciancio Algorithms for the Densest Sublattice Problem
Lattice rounding Gram-Schmidt orthogonalization B ∗ [0 , 1] n is also a fundamental region for Λ Any t can be efficiently rounded to v ∈ Λ � t − v � ≤ 1 i � b ∗ �� i � 2 2 v solves CVP when � t − v � ≤ min � b ∗ i � / 2 Daniele Micciancio Algorithms for the Densest Sublattice Problem
Lattice rounding Gram-Schmidt orthogonalization B ∗ [0 , 1] n is also a fundamental region for Λ Any t can be efficiently rounded to v ∈ Λ � t − v � ≤ 1 i � b ∗ �� i � 2 2 v solves CVP when � t − v � ≤ min � b ∗ i � / 2 Lemma (Nearest Plane Algorithm [Babai 1986]) Rounding w.r.t B ∗ approximates CVP within √ n · max i � b ∗ i � min i � b ∗ i � Daniele Micciancio Algorithms for the Densest Sublattice Problem
Basis reduction Definition (Basis reduction problem) Given a lattice, find a basis such that � b ∗ i � ≈ det(Λ) 1 / n , or, more generally, the � b ∗ i � do not decrease too quickly. Daniele Micciancio Algorithms for the Densest Sublattice Problem
Basis reduction Definition (Basis reduction problem) Given a lattice, find a basis such that � b ∗ i � ≈ det(Λ) 1 / n , or, more generally, the � b ∗ i � do not decrease too quickly. Sort � b 1 � ≤ � b 2 � ≤ . . . ≤ � b n � Daniele Micciancio Algorithms for the Densest Sublattice Problem
Basis reduction Definition (Basis reduction problem) Given a lattice, find a basis such that � b ∗ i � ≈ det(Λ) 1 / n , or, more generally, the � b ∗ i � do not decrease too quickly. Sort � b 1 � ≤ � b 2 � ≤ . . . ≤ � b n � Still, typically � b ∗ 1 � > � b ∗ 2 � > . . . > � b ∗ n � Daniele Micciancio Algorithms for the Densest Sublattice Problem
Basis reduction Definition (Basis reduction problem) Given a lattice, find a basis such that � b ∗ i � ≈ det(Λ) 1 / n , or, more generally, the � b ∗ i � do not decrease too quickly. Sort � b 1 � ≤ � b 2 � ≤ . . . ≤ � b n � Still, typically � b ∗ 1 � > � b ∗ 2 � > . . . > � b ∗ n � This is unavoidable, even for k = 2, e.g., for “exagonal” lattice 2 � = � b 1 � 2 � b 1 � 2 � = � b 1 � · � b 1 � 2 det(Λ) ≤ γ 2 = √ ≈ 1 . 1547 � b ∗ � b 1 � · � b ∗ 3 Daniele Micciancio Algorithms for the Densest Sublattice Problem
Basis reduction Definition (Basis reduction problem) Given a lattice, find a basis such that � b ∗ i � ≈ det(Λ) 1 / n , or, more generally, the � b ∗ i � do not decrease too quickly. Sort � b 1 � ≤ � b 2 � ≤ . . . ≤ � b n � Still, typically � b ∗ 1 � > � b ∗ 2 � > . . . > � b ∗ n � This is unavoidable, even for k = 2, e.g., for “exagonal” lattice 2 � = � b 1 � 2 � b 1 � 2 � = � b 1 � · � b 1 � 2 det(Λ) ≤ γ 2 = √ ≈ 1 . 1547 � b ∗ � b 1 � · � b ∗ 3 Minimizing � b 1 � / � b ∗ 2 � is equivalent to SVP Daniele Micciancio Algorithms for the Densest Sublattice Problem
Basis reduction Definition (Basis reduction problem) Given a lattice, find a basis such that � b ∗ i � ≈ det(Λ) 1 / n , or, more generally, the � b ∗ i � do not decrease too quickly. Sort � b 1 � ≤ � b 2 � ≤ . . . ≤ � b n � Still, typically � b ∗ 1 � > � b ∗ 2 � > . . . > � b ∗ n � This is unavoidable, even for k = 2, e.g., for “exagonal” lattice 2 � = � b 1 � 2 � b 1 � 2 � = � b 1 � · � b 1 � 2 det(Λ) ≤ γ 2 = √ ≈ 1 . 1547 � b ∗ � b 1 � · � b ∗ 3 Minimizing � b 1 � / � b ∗ 2 � is equivalent to SVP Hemite constant: � 2 � � b 1 � γ n = sup inf = Θ( n ) det(Λ) 1 / n B Λ Daniele Micciancio Algorithms for the Densest Sublattice Problem
LLL basis reduction algorithm Theorem (Lenstra, Lenstra, Lovasz (LLL) 1982) Every lattice has an efficiently computable basis such that i � for all i, and max i � b ∗ i � � b ∗ γ 2 · � b ∗ i � = 2 O ( n ) i +1 � ≥ ˜ min i � b ∗ Daniele Micciancio Algorithms for the Densest Sublattice Problem
LLL basis reduction algorithm Theorem (Lenstra, Lenstra, Lovasz (LLL) 1982) Every lattice has an efficiently computable basis such that i � for all i, and max i � b ∗ i � � b ∗ γ 2 · � b ∗ i � = 2 O ( n ) i +1 � ≥ ˜ min i � b ∗ B = [ b 1 , . . . , b n ] Daniele Micciancio Algorithms for the Densest Sublattice Problem
LLL basis reduction algorithm Theorem (Lenstra, Lenstra, Lovasz (LLL) 1982) Every lattice has an efficiently computable basis such that i � for all i, and max i � b ∗ i � � b ∗ γ 2 · � b ∗ i � = 2 O ( n ) i +1 � ≥ ˜ min i � b ∗ B = [ b 1 , . . . , b n ] Locally modify each 2-dim sublattice [ b i , b i +1 ] so � b ∗ i � is (almost) minimal Daniele Micciancio Algorithms for the Densest Sublattice Problem
LLL basis reduction algorithm Theorem (Lenstra, Lenstra, Lovasz (LLL) 1982) Every lattice has an efficiently computable basis such that i � for all i, and max i � b ∗ i � � b ∗ γ 2 · � b ∗ i � = 2 O ( n ) i +1 � ≥ ˜ min i � b ∗ B = [ b 1 , . . . , b n ] Locally modify each 2-dim sublattice [ b i , b i +1 ] so � b ∗ i � is (almost) minimal LLL terminates because each local modification makes “progress” towards reducing the basis Daniele Micciancio Algorithms for the Densest Sublattice Problem
Recommend
More recommend
