Lattice Basis Reduction Part 1: Concepts Sanzheng Qiao Department - - PowerPoint PPT Presentation

▶
lattice basis reduction part 1 concepts
SMART_READER_LITE
LIVE PREVIEW

Lattice Basis Reduction Part 1: Concepts Sanzheng Qiao Department - - PowerPoint PPT Presentation

Mar 29, 2024 238 likes •762 views

Introduction Applications Notions of Reduced Bases Examples Lattice Basis Reduction Part 1: Concepts Sanzheng Qiao Department of Computing and Software McMaster University, Canada qiao@mcmaster.ca www.cas.mcmaster.ca/ qiao October 25,

slide-1
SLIDE 1

Introduction Applications Notions of Reduced Bases Examples

Lattice Basis Reduction Part 1: Concepts

Sanzheng Qiao

Department of Computing and Software McMaster University, Canada qiao@mcmaster.ca www.cas.mcmaster.ca/˜qiao

October 25, 2011, revised February 2012 Joint work with W. Zhang and Y. Wei, Fudan University

slide-2
SLIDE 2

Introduction Applications Notions of Reduced Bases Examples

Outline

1

Introduction

2

Applications

3

Notions of Reduced Bases

4

Examples

slide-3
SLIDE 3

Introduction Applications Notions of Reduced Bases Examples

Outline

1

Introduction

2

Applications

3

Notions of Reduced Bases

4

Examples

slide-4
SLIDE 4

Introduction Applications Notions of Reduced Bases Examples

An optimization problem

Integer least squares (ILS) problem min

x∈Z n Ax − b2 2

A: real, full column rank b: real

slide-5
SLIDE 5

Introduction Applications Notions of Reduced Bases Examples

Example

A = −1 4 −2 3

  • ,

b = −0.4 4

slide-6
SLIDE 6

Introduction Applications Notions of Reduced Bases Examples

Example

A = −1 4 −2 3

  • ,

b = −0.4 4

slide-7
SLIDE 7

Introduction Applications Notions of Reduced Bases Examples

A naive approach

Solve for the real solution, then round it to its nearest integer. A−1b = −3.44 −0.96

  • →

−3 −1

slide-8
SLIDE 8

Introduction Applications Notions of Reduced Bases Examples

A naive approach

Solve for the real solution, then round it to its nearest integer. A−1b = −3.44 −0.96

  • →

−3 −1

slide-9
SLIDE 9

Introduction Applications Notions of Reduced Bases Examples

A naive approach

Solve for the real solution, then round it to its nearest integer. A−1b = −3.44 −0.96

  • →

−3 −1

  • Is this the ILS solution?
slide-10
SLIDE 10

Introduction Applications Notions of Reduced Bases Examples

Lattices and Bases

A brute force approach:

slide-11
SLIDE 11

Introduction Applications Notions of Reduced Bases Examples

Lattices and Bases

A brute force approach: The set L = {Az | z ∈ Z n} is call the lattice generated by A. Basis: Formed by the columns of A (generator matrix).

slide-12
SLIDE 12

Introduction Applications Notions of Reduced Bases Examples

Lattices and bases

For a given lattice, its basis is not unique. B = −1 2 −2 −1

slide-13
SLIDE 13

Introduction Applications Notions of Reduced Bases Examples

Lattices and bases

Two bases are related by AZ = B: −1 4 −2 3 1 2 1

  • =

−1 2 −2 −1

  • Z: Unimodular matrix, a nonsingular integer matrix whose

inverse is also integer. (An integer matrix whose determinant is ±1.)

slide-14
SLIDE 14

Introduction Applications Notions of Reduced Bases Examples

Lattices and bases

Two bases are related by AZ = B: −1 4 −2 3 1 2 1

  • =

−1 2 −2 −1

  • Z: Unimodular matrix, a nonsingular integer matrix whose

inverse is also integer. (An integer matrix whose determinant is ±1.) For any two generator matrices A and B of the same lattice, | det(A)| = | det(B)|, called the determinant (volume) of the lattice.

slide-15
SLIDE 15

Introduction Applications Notions of Reduced Bases Examples

Naive approach revisited

B−1b = −1.52 −0.96

  • →

−2 −1

slide-16
SLIDE 16

Introduction Applications Notions of Reduced Bases Examples

Naive approach revisited

B−1b = −1.52 −0.96

  • →

−2 −1

  • A closer (closest) lattice point (1.077 vs 1.166).
slide-17
SLIDE 17

Introduction Applications Notions of Reduced Bases Examples

Naive approach revisited

B−1b = −1.52 −0.96

  • →

−2 −1

  • A closer (closest) lattice point (1.077 vs 1.166).

Finding a closest vector (CVP) is an NP problem.

slide-18
SLIDE 18

Introduction Applications Notions of Reduced Bases Examples

Lattice basis reduction

Lattice basis reduction problem: Given a basis for a lattice, find a basis consisting of short vectors. Lattice basis reduction algorithm: Given a basis matrix A, compute a unimodular matrix Z that transforms the basis into a new basis matrix B = AZ whose column vectors (basis vectors) are short.

slide-19
SLIDE 19

Introduction Applications Notions of Reduced Bases Examples

Outline

1

Introduction

2

Applications

3

Notions of Reduced Bases

4

Examples

slide-20
SLIDE 20

Introduction Applications Notions of Reduced Bases Examples

Wireless communication

Source signal (code) s, integer vector. Communication channel is represented by H, real/complex matrix. Noise is represented by v, real vector. The received signal y = Hs + v Given H and y, find s (decoding) using the naive approach called zero forcing (fast).

slide-21
SLIDE 21

Introduction Applications Notions of Reduced Bases Examples

Wireless communication

Source signal (code) s, integer vector. Communication channel is represented by H, real/complex matrix. Noise is represented by v, real vector. The received signal y = Hs + v Given H and y, find s (decoding) using the naive approach called zero forcing (fast). When H is reduced, we have better chance of recovering s (lattice aided decoding).

slide-22
SLIDE 22

Introduction Applications Notions of Reduced Bases Examples

Cryptography

Lattice based cryptosystems: GGH (Goldreich, Goldwasser, Halevi) public-key cryptosystem. Private key: A reduced basis matrix, e.g., diagonal, A. Public key: An ill-conditioned basis matrix B = AZ.

slide-23
SLIDE 23

Introduction Applications Notions of Reduced Bases Examples

Cryptography

Lattice based cryptosystems: GGH (Goldreich, Goldwasser, Halevi) public-key cryptosystem. Private key: A reduced basis matrix, e.g., diagonal, A. Public key: An ill-conditioned basis matrix B = AZ. Encrypt: e = Bc + v, c clear text, v noise. Decrypt: A−1e → Zc. (B−1e gives wrong result.)

slide-24
SLIDE 24

Introduction Applications Notions of Reduced Bases Examples

Cryptography

Lattice based cryptosystems: GGH (Goldreich, Goldwasser, Halevi) public-key cryptosystem. Private key: A reduced basis matrix, e.g., diagonal, A. Public key: An ill-conditioned basis matrix B = AZ. Encrypt: e = Bc + v, c clear text, v noise. Decrypt: A−1e → Zc. (B−1e gives wrong result.) Lattice basis reduction is an NP problem.

slide-25
SLIDE 25

Introduction Applications Notions of Reduced Bases Examples

Outline

1

Introduction

2

Applications

3

Notions of Reduced Bases

4

Examples

slide-26
SLIDE 26

Introduction Applications Notions of Reduced Bases Examples

Matrix representation

Given a generator matrix A, compute the QRZ decomposition A = QRZ −1 Q: orthonormal columns, preserving vector length R: upper triangular Z: unimodular

slide-27
SLIDE 27

Introduction Applications Notions of Reduced Bases Examples

Matrix representation

Given a generator matrix A, compute the QRZ decomposition A = QRZ −1 Q: orthonormal columns, preserving vector length R: upper triangular Z: unimodular Thus QR is the QR decomposition of AZ, reduced (the columns of R or AZ are short).

slide-28
SLIDE 28

Introduction Applications Notions of Reduced Bases Examples

Hermite reduction

Hermite-reduced, also called size-reduced. Hermite, 1850. Hermite-reduced A lattice basis {b1, b2, . . . , bn} is called size-reduced if its QR decomposition satisfies |ri,i| ≥ 2|ri,j|, for all 1 ≤ i < j ≤ n,

slide-29
SLIDE 29

Introduction Applications Notions of Reduced Bases Examples

Hermite reduction

Hermite-reduced, also called size-reduced. Hermite, 1850. Hermite-reduced A lattice basis {b1, b2, . . . , bn} is called size-reduced if its QR decomposition satisfies |ri,i| ≥ 2|ri,j|, for all 1 ≤ i < j ≤ n, The off-diagonal of R is small.

slide-30
SLIDE 30

Introduction Applications Notions of Reduced Bases Examples

HKZ reduction

HKZ-reduced, strengthened Hermite-reduced. Korkine and Zolotarev, 1873. HKZ-reduced A lattice basis {b1, b2, . . . , bn} is called HKZ-reduced if it is size-reduced and for each trailing (n − i + 1) × (n − i + 1), 1 ≤ i < n, submatrix of R in the QR decomposition, its first column is a shortest nonzero vector in the lattice generated by the submatrix.

slide-31
SLIDE 31

Introduction Applications Notions of Reduced Bases Examples

HKZ reduction

HKZ-reduced ri,i ri,i+1 · · · ri,n ri+1,i+1 · · · ri+1,n ... . . . rn,n

slide-32
SLIDE 32

Introduction Applications Notions of Reduced Bases Examples

LLL reduction

LLL-reduced Lenstra, Lenstra, and Lov´ asz, 1982 LLL-reduced A lattice basis {b1, b2, . . . , bn} is called LLL-reduced if it is size-reduced and R in the QR decomposition satisfies r2

i+1,i+1 + r2 i,i+1 ≥ ω r2 i,i

slide-33
SLIDE 33

Introduction Applications Notions of Reduced Bases Examples

HKZ and LLL

HKZ-reduced and LLL-reduced ri,i ri,i+1 · · · ri,n ri+1,i+1 · · · ri+1,n ... . . . rn,n

slide-34
SLIDE 34

Introduction Applications Notions of Reduced Bases Examples

HKZ and LLL

HKZ-reduced and LLL-reduced ri,i ri,i+1 · · · ri,n ri+1,i+1 · · · ri+1,n ... . . . rn,n LLL-reduced is weaker than HKZ-reduced, HKZ-reduced implies LLL-reduced for any ω: 0; .25 < ω < 1.0 Easier to compute (fast). Practically, it produces reasonably short bases.

slide-35
SLIDE 35

Introduction Applications Notions of Reduced Bases Examples

Minkowski minima

Minkowski, 1891 Short vectors Minkowski minima We say that λk, 1 ≤ k ≤ n, is the k-th successive minimum wrt a lattice if λk is the lower bound of the radius λ of the sphere ||Bz||2 ≤ λ that contains k linearly independent lattice points.

slide-36
SLIDE 36

Introduction Applications Notions of Reduced Bases Examples

Minkowski minima

Minkowski, 1891 Short vectors Minkowski minima We say that λk, 1 ≤ k ≤ n, is the k-th successive minimum wrt a lattice if λk is the lower bound of the radius λ of the sphere ||Bz||2 ≤ λ that contains k linearly independent lattice points. λ1: the length of a shortest nonzero lattice vector b1

slide-37
SLIDE 37

Introduction Applications Notions of Reduced Bases Examples

Minkowski minima

Minkowski, 1891 Short vectors Minkowski minima We say that λk, 1 ≤ k ≤ n, is the k-th successive minimum wrt a lattice if λk is the lower bound of the radius λ of the sphere ||Bz||2 ≤ λ that contains k linearly independent lattice points. λ1: the length of a shortest nonzero lattice vector b1 Is there always a basis {b1, b2, . . . , bn} so that bi = λi simultaneously?

slide-38
SLIDE 38

Introduction Applications Notions of Reduced Bases Examples

Minkowski minima

No. Consider a lattice formed by columns of       2 1 2 1 2 1 2 1 1       . Minkowski minima λ1 = ... = λ5 = 2.

slide-39
SLIDE 39

Introduction Applications Notions of Reduced Bases Examples

Minkowski minima

No. Consider a lattice formed by columns of       2 1 2 1 2 1 2 1 1       . Minkowski minima λ1 = ... = λ5 = 2. The columns of 2I5 do not form a basis for the lattice (determinants do not equal).

slide-40
SLIDE 40

Introduction Applications Notions of Reduced Bases Examples

Minkowski reduction

Minkowski-reduced A lattice basis {b1, b2, . . . , bn} is called Minkowski-reduced if for each bk, k = 1, ..., n, bk2 is the lower bound of the radius ρ of the sphere ||Bz||2 ≤ ρ that contains k lattice vectors that can be extended to a basis for the lattice.

slide-41
SLIDE 41

Introduction Applications Notions of Reduced Bases Examples

Minkowski reduction

Minkowski-reduced A lattice basis {b1, b2, . . . , bn} is called Minkowski-reduced if for each bk, k = 1, ..., n, bk2 is the lower bound of the radius ρ of the sphere ||Bz||2 ≤ ρ that contains k lattice vectors that can be extended to a basis for the lattice. Properties bi is a shortest nonzero vector in the sublattice generated by {bi, bi+1, . . . , bn}; λ1 = ||b1||2 ≤ ||b2||2 ≤ · · · ≤ ||bn||2; ||bi||2 ≥ λi for 1 ≤ i ≤ n.

slide-42
SLIDE 42

Introduction Applications Notions of Reduced Bases Examples

Minkowski reduction

Another (weaker or equivalent?) notion Minkowski-reduced A lattice basis {b1, b2, . . . , bn} is called Minkowski-reduced if for each bi, i = 1, 2, . . . , n, its length ||bi||2 = min(||ˆ bi||2, ||ˆ bi+1||2, . . . , ||ˆ bn||2)

  • ver all sets {ˆ

bi, ˆ bi+1, . . . , ˆ bn} of lattice points such that {b1, b2, . . . , bi−1, ˆ bi, ˆ bi+1, . . . , ˆ bn} form a basis for the lattice.

slide-43
SLIDE 43

Introduction Applications Notions of Reduced Bases Examples

Minkowski reduction

Another (weaker or equivalent?) notion Minkowski-reduced A lattice basis {b1, b2, . . . , bn} is called Minkowski-reduced if for each bi, i = 1, 2, . . . , n, its length ||bi||2 = min(||ˆ bi||2, ||ˆ bi+1||2, . . . , ||ˆ bn||2)

  • ver all sets {ˆ

bi, ˆ bi+1, . . . , ˆ bn} of lattice points such that {b1, b2, . . . , bi−1, ˆ bi, ˆ bi+1, . . . , ˆ bn} form a basis for the lattice. In words, each bi, for i = 1, 2, . . . , n − 1, is a shortest nonzero lattice vector such that {b1, b2, . . . , bi} can be extended to a basis for the lattice.

slide-44
SLIDE 44

Introduction Applications Notions of Reduced Bases Examples

Outline

1

Introduction

2

Applications

3

Notions of Reduced Bases

4

Examples

slide-45
SLIDE 45

Introduction Applications Notions of Reduced Bases Examples

Examples

  1 − 1

2

− 1

2

1 − 1

2

1   HKZ, thus LLL, reduced, but not Minkowski-reduced.

slide-46
SLIDE 46

Introduction Applications Notions of Reduced Bases Examples

Examples

  1 − 1

2

− 1

2

1 − 1

2

1   HKZ, thus LLL, reduced, but not Minkowski-reduced. B =   1 − 1

2

1

1 2

1   =   1 − 1

2

− 1

2

1 − 1

2

1     1 1 1 1 1   Minkowski-reduced, also HKZ-reduced.

slide-47
SLIDE 47

Introduction Applications Notions of Reduced Bases Examples

Examples

      2 1 2 1 2 1 2 1 1       Minkowski-reduced, but not LLL-reduced for ω > 0.5, thus not HKZ-reduced.

slide-48
SLIDE 48

Introduction Applications Notions of Reduced Bases Examples

Next talk

Preview

Algorithms for computing reduced bases.

slide-49
SLIDE 49

Introduction Applications Notions of Reduced Bases Examples

Thank you!

slide-50
SLIDE 50

Introduction Applications Notions of Reduced Bases Examples

Thank you! Questions?