On a recursive decoding algorithm for lattices Annika Meyer - PowerPoint PPT Presentation

On a recursive decoding algorithm for lattices Annika Meyer Workshop on lattices, codes and modular forms Aachen, 27.09.2011 Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 1 / 14

Overview Introduction 1 Iterative lattice decoding 2 Upper bounds on the number of lattice points in a small sphere 3 Examples 4 Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 2 / 14

Introduction Lattice Decoding: The Closest Vector Problem (CVP) r Given a lattice L in R n and x ∈ R n , the CVP consists in finding ℓ ∈ L such that ℓ ′ ∈ L | x − ℓ ′ | , | x − ℓ | = min where | · | denotes the usual Euclidian length. Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 3 / 14

Introduction Lattice Decoding: The Closest Vector Problem (CVP) r Given a lattice L in R n and x ∈ R n , the CVP consists in finding ℓ ∈ L such that ℓ ′ ∈ L | x − ℓ ′ | , | x − ℓ | = min where | · | denotes the usual Euclidian length. r The CVP is NP hard in its exact version. Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 3 / 14

Introduction Lattice Decoding: The Closest Vector Problem (CVP) r Given a lattice L in R n and x ∈ R n , the CVP consists in finding ℓ ∈ L such that ℓ ′ ∈ L | x − ℓ ′ | , | x − ℓ | = min where | · | denotes the usual Euclidian length. r The CVP is NP hard in its exact version. r Solving the CVP with approximation factor δ ≥ 1 ∈ R means finding ℓ ∈ L such that, for all ℓ ′ ∈ L , | x − ℓ | ≤ δ · | x − ℓ ′ | . Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 3 / 14

Introduction Lattice Decoding: The Closest Vector Problem (CVP) r Given a lattice L in R n and x ∈ R n , the CVP consists in finding ℓ ∈ L such that ℓ ′ ∈ L | x − ℓ ′ | , | x − ℓ | = min where | · | denotes the usual Euclidian length. r The CVP is NP hard in its exact version. r Solving the CVP with approximation factor δ ≥ 1 ∈ R means finding ℓ ∈ L such that, for all ℓ ′ ∈ L , | x − ℓ | ≤ δ · | x − ℓ ′ | . r The best known approximation factor for a deterministic polynomial time algorithm to solve the CVP approximately is 2 n ( log log n ) 2 / 2 log n (Schnorr 1985). Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 3 / 14

Iterative lattice decoding Babai’s Nearest Plane Procedure (BNPP) Given a basis B = ( b 1 , . . . , b n ) of L and x ∈ R n , BNPP approximates x in L . Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 4 / 14

Iterative lattice decoding Babai’s Nearest Plane Procedure (BNPP) Given a basis B = ( b 1 , . . . , b n ) of L and x ∈ R n , BNPP approximates x in L . An approximation factor 2 n / 2 is achieved if B is LLL reduced. Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 4 / 14

Iterative lattice decoding Babai’s Nearest Plane Procedure (BNPP) Given a basis B = ( b 1 , . . . , b n ) of L and x ∈ R n , BNPP approximates x in L . An approximation factor 2 n / 2 is achieved if B is LLL reduced. (1) Let L ′ = � b 1 , . . . , b n − 1 � Z , then L = ∪ z ∈ Z z · b 1 + L ′ . Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 4 / 14

Iterative lattice decoding Babai’s Nearest Plane Procedure (BNPP) Given a basis B = ( b 1 , . . . , b n ) of L and x ∈ R n , BNPP approximates x in L . An approximation factor 2 n / 2 is achieved if B is LLL reduced. (1) Let L ′ = � b 1 , . . . , b n − 1 � Z , then L = ∪ z ∈ Z z · b 1 + L ′ . (2) Choose H = zb 2 + L ′ ⊗ R closest to x and h ∈ H closest to x . Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 4 / 14

Iterative lattice decoding Babai’s Nearest Plane Procedure (BNPP) Given a basis B = ( b 1 , . . . , b n ) of L and x ∈ R n , BNPP approximates x in L . An approximation factor 2 n / 2 is achieved if B is LLL reduced. (1) Let L ′ = � b 1 , . . . , b n − 1 � Z , then L = ∪ z ∈ Z z · b 1 + L ′ . (2) Choose H = zb 2 + L ′ ⊗ R closest to x and h ∈ H closest to x . (3) Iteratively, find an approximation y ′ of h − zb 2 in L ′ . Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 4 / 14

Iterative lattice decoding Babai’s Nearest Plane Procedure (BNPP) Given a basis B = ( b 1 , . . . , b n ) of L and x ∈ R n , BNPP approximates x in L . An approximation factor 2 n / 2 is achieved if B is LLL reduced. (1) Let L ′ = � b 1 , . . . , b n − 1 � Z , then L = ∪ z ∈ Z z · b 1 + L ′ . (2) Choose H = zb 2 + L ′ ⊗ R closest to x and h ∈ H closest to x . (3) Iteratively, find an approximation y ′ of h − zb 2 in L ′ . (4) Output the approximation y = y ′ + zb 2 . Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 4 / 14

Iterative lattice decoding Babai’s Nearest Plane Procedure (BNPP) Given a basis B = ( b 1 , . . . , b n ) of L and x ∈ R n , BNPP approximates x in L . An approximation factor 2 n / 2 is achieved if B is LLL reduced. (1) Let L ′ = � b 1 , . . . , b n − 1 � Z , then L = ∪ z ∈ Z z · b 1 + L ′ . (2) Choose H = zb 2 + L ′ ⊗ R closest to x and h ∈ H closest to x . (3) Iteratively, find an approximation y ′ of h − zb 2 in L ′ . (4) Output the approximation y = y ′ + zb 2 . Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 4 / 14

Iterative lattice decoding BNPP as an iterative decoding algorithm Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 5 / 14

Iterative lattice decoding BNPP as an iterative decoding algorithm Let B ′ = ( b ′ 1 , . . . , b ′ n ) be the Gram Schmidt orthonormalisation of B and define an isometry ϕ : b ′ i �→ e n − i + 1 , where ( e 1 , . . . , e n ) is the standard basis of R n . Write Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 5 / 14

Iterative lattice decoding BNPP as an iterative decoding algorithm Let B ′ = ( b ′ 1 , . . . , b ′ n ) be the Gram Schmidt orthonormalisation of B and define an isometry ϕ : b ′ i �→ e n − i + 1 , where ( e 1 , . . . , e n ) is the standard basis of R n . Write  ϕ ( b n )    α 1 , 1 . . . α 1 , n . . ... . .  =  .     . .   ϕ ( b 1 ) 0 α n , n Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 5 / 14

Iterative lattice decoding BNPP as an iterative decoding algorithm Let B ′ = ( b ′ 1 , . . . , b ′ n ) be the Gram Schmidt orthonormalisation of B and define an isometry ϕ : b ′ i �→ e n − i + 1 , where ( e 1 , . . . , e n ) is the standard basis of R n . Write  ϕ ( b n )    α 1 , 1 . . . α 1 , n . . ... . .  =  .     . .   ϕ ( b 1 ) 0 α n , n With ϕ ( x ) = ( u 1 , . . . , u n ) , BNPP is the following: Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 5 / 14

Iterative lattice decoding BNPP as an iterative decoding algorithm Let B ′ = ( b ′ 1 , . . . , b ′ n ) be the Gram Schmidt orthonormalisation of B and define an isometry ϕ : b ′ i �→ e n − i + 1 , where ( e 1 , . . . , e n ) is the standard basis of R n . Write  ϕ ( b n )    α 1 , 1 . . . α 1 , n . . ... . .  =  .     . .   ϕ ( b 1 ) 0 α n , n With ϕ ( x ) = ( u 1 , . . . , u n ) , BNPP is the following: (1) Find the optimal approximation ℓ 1 = z α 1 , 1 of u 1 in Z α 1 , 1 . Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 5 / 14

Iterative lattice decoding BNPP as an iterative decoding algorithm Let B ′ = ( b ′ 1 , . . . , b ′ n ) be the Gram Schmidt orthonormalisation of B and define an isometry ϕ : b ′ i �→ e n − i + 1 , where ( e 1 , . . . , e n ) is the standard basis of R n . Write  ϕ ( b n )    α 1 , 1 . . . α 1 , n . . ... . .  =  .     . .   ϕ ( b 1 ) 0 α n , n With ϕ ( x ) = ( u 1 , . . . , u n ) , BNPP is the following: (1) Find the optimal approximation ℓ 1 = z α 1 , 1 of u 1 in Z α 1 , 1 . (2) Iteratively, approximate ( u 2 − z α 1 , 2 , . . . , u n − z α 1 , n ) ∈ R n − 1 in L ′ = � ϕ ( b 2 ) , . . . , ϕ ( b n ) � Z with ℓ ′ . Annika Meyer ( Workshop on lattices, codes and modular forms Aachen, 27.09.2011) On a recursive decoding algorithm for lattices 5 / 14