INSTITUTNATIONALDERECHERCHEENINFORMATIQUEETENAUTOMATIQUE Worst-Case Hermite-Korkine-Zolotarev Reduced 8 Lattice Bases 0 0 2 n a GuillaumeHanrot —Damien Stehlé J 4 2 ] T N . h t a m [ N° 6422 2 v 1 Novembre2007 3 3 3 ThèmeSYM . 1 0 8 0 : v i X r a (cid:13) G N apport E + R F de recherche(cid:13) 2-- (cid:13) 2 4 6 R-- R A/ RI N I N R S I 9 9 3 6 9- 4 2 0 N S S I Worst-Case Hermite-Korkine-Zolotarev Reduced Lattice Bases Guillaume Hanrot, Damien Stehlé ∗ ThèmeSYM —Systèmes symboliques Projets Cacao etArénaire Rapport derecherche n°6422— Novembre2007— 25pages Abstract: The Hermite-Korkine-Zolotarev reduction plays a central role in strong lattice reduction algorithms. By building upon a technique introduced by Ajtai, we show the existence of Hermite-Korkine-Zolotarev reduced bases that are arguably least reduced. We prove that for such bases, Kannan’s algorithm solving the shortest lattice vector problem requires dd(1+o(1)) 2e bit operations in dimension d. This matches the best complexity upper bound known for this algorithm. These bases also provide lower bounds on Schnorr’s constants α and β that are d d essentially equal to the best upper bounds. Finally, we also show the existence of particularly bad basesfor Schnorr’shierarchy ofreductions. Key-words: Latticebasisreduction,shortestvectorproblem,HKZ-reduction,BKZ-reduction ∗ CNRSandUniversitédeLyon/ÉNSLyon/LIP,46alléed’Italie,69364LyonCedex07,France. UnitéderechercheINRIALorraine LORIA,TechnopôledeNancy-Brabois,Campusscientifique, 615,rueduJardinBotanique,BP101,54602Villers-Lès-Nancy(France) Téléphone:+33383593000—Télécopie:+33383278319 Bases Hermite-Korkine-Zolotarev réduites “pires cas”. Résumé : La réduction d’Hermite-Korkine-Zolotarevjoue un rôle central dans les algorithmes deréductionfortedesréseaux. EnutilisantunetechniquedueàAjtai,nousprouvonsl’existence de bases Hermite-Korkine-Zolotarev réduites qui sont les plus mal réduites possible. Pour de telles bases, l’algorithme de Kannan pour la résolution du problème du vecteur le plus court nécessite dd(1+o(1)) opérations élémentaires en dimension d, ce qui coïncide avec la meilleure 2e borne supérieure connue pour sa complexité. Ces bases fournissent également des bornes in- férieures pour les constantes de Schnorr α et β , qui coïncident là encore avec les meilleures d d bornes supérieures connues. Enfin, nous montrons l’existencede mauvaises bases réduites pour les algorithmesdelahiérarchiedeSchnorr. Mots-clés: Réductiondesréseaux,problèmeduvecteurlepluscourt,réductionHKZ,réduction BKZ Worst-CaseHermite-Korkine-ZolotarevReduced LatticeBases 3 1 Introduction A lattice L is a discrete subgroup of a euclidean space Rn. Such an object can always be written as the set of integer linear relations of some linearly independent vectors b ,...,b 1 d ∈ Rn. The b ’s form a basis of L. Such a representation is not unique, but all bases share i the same cardinality d, called the lattice dimension. Another lattice invariant is the so-called lattice volume det(L), which is defined as the geometric d-dimensional volume of any paral- lelepiped (b ) = y b ,y [0,1] spanned by a lattice basis (b ) . When d 2, a given P i { i i i i ∈ } i i ≥ latticehasaninfinityofbases,relatedtooneanotherbyunimodulartransformations. Somebases P are better than others, in particular under the light of applications such as algorithmic number theory [5] and cryptography [15, 13]. In these applications, one is mostly interested in lattice bases made of rather short and rather orthogonal vectors. Such bases are called reduced. One oftendistinguishesbetweenreductionsthatareratherweak butcanbecomputingefficientlyand reductions that are strong but that require a much larger amount of computational resources. The main reduction of the first family is the celebrated LLL-reduction [12], whereas the most famous one in the second family is the Hermite-Korkine-Zolotarev reduction (HKZ for short). There exist compromises between LLL and HKZ reductions, such as Schnorr’s Block-Korkine- Zolotarev(BKZ)reductions[19]dependingonaparameterk: the2-BKZreductionisessentially the LLL reduction whereas the d-BKZ reduction is exactly the HKZ reduction. Other compro- miseshavebeen considered in[19, 18,7]. From the algorithmic point of view, LLL-reduction can be reached in time polynomial in the lattice dimension. The other parameters, such as the dimension of the embedding space and the bit-sizeof the initial vectors are of small interest here since all the described algorithms have polynomial complexities with respect to them. On the other extreme, there are two main algorithms to compute an HKZ-reduced basis. The first one is due to Kannan [11] and was improved by Helfrich and Schnorr [9, 19]. Its complexityhas been revised downwards by Han- rot and Stehlé [8] who proved a dd(1+o(1)) upper bound. The other algorithm is due to Ajtai, 2e Kumar and Sivakumar [2] and its complexity upper bound was re-assessed recently by Nguyen and Vidick [16]: its cost is provably bounded by 25.9d. The latter algorithm has a much better · asymptotic complexity upper bound than Kannan’s. However, it suffers from two drawbacks: firstly,it requires an exponentialspace whereas Kannan’s space requirementis polynomial;sec- ondly, it is probabilistic in the sense that there is a tiny probability that the computed basis is not HKZ-reduced, whereas Kannan’s algorithm is deterministic. In practice, for manageable problem sizes, it seems that adaptations of Kannan’s algorithmstilloutperform the algorithmof Ajtai, Kumar and Sivakumar. One of the results of the present paper is to provide a worst-case complexity lower bound to Kannan’s algorithm which is essentially the same as the dd(1+o(1)) 2e complexityupperbound: itprovesthatfromtheworst-casepointofview,Kannan’salgorithmis asymptoticallyworse that the one ofAjtai, Kumarand Sivakumar. In the compromisesbetween LLL and HKZ-reductions, an algorithm computing HKZ-reduced bases (either Kannan’s or the one of Ajtai, Kumar and Sivakumar) is used on k-dimensional bases, where k is the parameter of the compromise. When k is greater than clogd for some constant c, the complexities of the compromisealgorithmsarekO(k) or2O(k) dependingonthechosenHKZ-reduction algorithm. RR n°6422 4 GuillaumeHanrot,Damien Stehlé The main result of the present paper is to prove the existence of HKZ-reduced bases which are arguably least reduced possible. These bases are good corner cases for strong lattice reductions. We prove that given them as input, Kannan’s algorithm costs at least dd(1+o(1)) binary 2e operationsin dimensiond, thuscompletingtheworst-caseanalysisof Kannan’salgorithm. This provesthattheAjtai-Kumar-SivakumaralgorithmisstrictlybetterthanKannan’sfromtheworst- case asymptotic time complexity perspective. These lattice bases also provide lower bounds on Schnorr’sconstantsα andβ whichplayacentralroletoestimatethequalityofSchnorr’shier- k k archies of reductions. As a by-product, we improvethebest knownupperbound for α , and the k lower and upper bounds essentially match. Our lower bound on β match its best known upper k bound, providedby [7]. This gives weight to thefact that theprimal-dual reduction therein may bebetterthanSchnorr’sclassicalhierarchy. Finally,weprovidelatticebasesthatareparticularly bad forSchnorr’s hierarchyofreductionalgorithms. To achieve these results, we simplify and build upon a technique introduced by Ajtai in [1] to show lower bounds on Schnorr’s constants α and β . These lower bounds were of the same k k ordersofmagnitudeasthebestupperbounds,butwithundeterminedconstantsintheexponents. It consists in buildingrandom lattice bases that are HKZ-reduced with non-zero probabilityand suchthatthequantitiesunderinvestigation(e.g.,Schnorr’sconstants)areclosetothebestknown upperbounds. Therandomlatticebases arebuiltfromtheirGram-Schmidtorthogonalisations. ROAD-MAP. In Section 2 we provide the background that is necessary to the understanding to the rest of the article. In Section 3 we simplify Ajtai’s method to generate lattice bases. We use it first in Section 4 to show the existence of worst-case HKZ-reduced bases with respect to the orthogonality of the basis vectors. Using these bases, we provide lower bounds to the worst-case cost of Kannan’s algorithm and to Schnorr’s constants α and β , in Section 5. We k k use Ajtai’s technique a second time in Section 6 to build lattice bases that are particularly bad for Schnorr’s hierarchy of reduction algorithms. Finally, in Section 7, we draw a listof possible natural extensionsofourwork. NOTATION. If y is a real number, we let y denote its closest integer (with any rule for the ⌊ ⌉ ambiguouscases),andwedefine y = y y . Ifa b,weletJa,bKdenotethesetofintegers { } −⌊ ⌉ ≤ belonging to the interval [a,b]. All logarithms used are in basis e. Finally, for x a real number, wedefine(x) := max(x,0). + 2 Background on Lattices Werefer to [4]foracompleteintroductiontolattices. Gram-Schmidt orthogonalisation. Let b ,...,b be linearly independent vectors. We de- 1 d fine b = b µ b with µ = hbi,b∗ji. The b ’s are orthogonal and, for any i, we have t∗ihat thei −linearjkkkkb∗i∗ikk2! . The best known upper bounds on α and β are k1+logk and 1 k2log2Q(see [19, 7]). We will im- k k 10 provethe upper bound on α in Section 5. Any k-BKZ-reduced basis (b ,...,b ) of a lattice L k 1 d satisfies kb1k ≤ min kkd−−11,αkkd−−11−1 λ(L). Ajtai [1] showed that αk ≥ kclogk for some con- (cid:18) (cid:19) stant c, so that the first upper bound is stronger than the second one. Furthermore, every block- 2k-reduced basis(b ,...,b ) ofalatticeL satisfies b √k√β m−1λ(L) (see[19,20]). 1 mk 1 k k k ≤ 3 Ajtai’s Drawing of HKZ-Reduced Bases Consideradimensiond > 0andafunctionf : J1,dK R+ 0 . Bygeneralisingan argument → \{ } duetoAjtai[1],weprovethatonecanbuildad-dimensionallatticebasiswhichisHKZ-reduced and suchthat b = f(i),undera“Minkowski-type”conditionforthevaluesoff. k ∗ik RR n°6422 6 GuillaumeHanrot,Damien Stehlé Theorem 1 Let d > 0 andf : J1,dK R+ 0 . Assumethatforanyj d,onehas → \{ } ≤ j−i j−1 2πe j−2i f(j) 2 2 j f(i) 1 < 1. j i − f(i) f(k) ! ! Xi=1 (cid:18) − (cid:19) (cid:18) (cid:19) + Yk=i Then thereexistsan HKZ-reduced basis(b ,...,b ) with b = f(i). 1 d k ∗ik The condition above might seem intricate at first glance, though it is in fact fairly natural. The term (j i) j−i j f(i) resembles Minkowski’s inequality. It is natural that it should − − 2 k=i f(k) occur for all (i,j), since for an HKZ-reduced basis Minkowski’s inequality is satisfied for all Q bases (b (i),...,b (i)). Another way of stating this is that a necessary condition for a basis to i j beHKZ-reduced wouldbe j−i j−1 j−i f(j) 2 2 j f(i) j d, (4γj i+1)− 2 1 < 1. ∀ ≤ − − f(i) ! f(k)! i=1 (cid:18) (cid:19) k=i X Y This is merely a restatement of the fact that, since Minkowski’s inequality is verified for any pair (i,j), the i-th term is at most 2 (j i), so that the sum is < 1. In view of the fact that − − asymptoticallyγ 1.744d(1+o(1)), weseethatweare notfar froman optimalcondition. d ≤ 2πe Lemma1isthecoreoftheproofofTheorem1. Itboundstheprobabilitythatwhenarandom basis (b ,...,b ) is built appropriately, any lattice vector x b with x = 0 will be longer 1 d i i i d 6 thanb . 1 P Lemma 1 Let (b ,...,b ) bea latticebasisandlet b bea randomvector. Wesupposethat: 1 d 1 d − 1. Foranyi d,we have b = f(i). ≤ k ∗ik 2. Theµ ’sfori < dareindependentrandomvariablesuniformlydistributedin[ 1/2,1/2]. d,i − Let p be the probability that there exists (x ,...,x ) with x = 0 such that x b b . 1 d d 6 k i i ik ≤ k 1k Then: d−1 P 2πe d−21 xf(d) 2 2 f(1) p 1 . ≤ d 1 − f(1) f(i) ! ! (cid:18) − (cid:19) Xx>0 (cid:18) (cid:19) + Yi 0. We can write d d x b = x + µ x b . i i i j,i j ∗i ! i d i d j=i+1 X≤ X≤ X For i d, we define u = x + d µ x and δ = d µ x . Notice that δ = ≤ i i j=i+1 j,i j i j=i+1 j,i j i µd,ixd + dj=−i1+1µj,ixj ismadjePofarandomtemrm(µd,ixd)annPdaconstantteorm( dj=−i1+1µj,ixj). Snincex = 0andsincethoeµ ’saredistributedindependentlyanduniformlyin[ 1/2,1/2],the d 6 P d,i P− INRIA Worst-CaseHermite-Korkine-ZolotarevReduced LatticeBases 7 same holds for the δ ’s (for each fixed choice of (x ,...,x )). The event defining p can thus be i 1 d rewrittenas u Z , (u ,...,u ) Zd 1, (u +δ )2f(i)2 f(1)2 u2f(d)2. ∃ d ∈ >0 ∃ 1 d−1 ∈ − i i ≤ − d i 0 be an arbitrary constant. We can estimate the last upper bound by using the inequality (u +δ )2f(i)2 Pr (u +δ )2f(i)2 f(1)2 u2f(d)2 exp c c i 0 yields thebound that weclaimed. Recall d d − thatthetermscorrespondingto u > f(1)/f(d)do notcontribute. 2 d We now proceed to prove Theorem 1. We build the basis iteratively, starting with b , cho- 1 sen arbitrarily with b = f(1). Assume now that b ,...,b have already been chosen 1 1 j 1 with b = f(i) forki 0 (cid:18) (cid:19) + Yk=i j−i 2πe j−2i f(i) f(j) 2 2 j−1 f(i) 1 ≤ j i f(j) − f(i) f(k) ! ! (cid:18) − (cid:19) (cid:18) (cid:19) (cid:18) (cid:19) + Yk=i j−i 2πe j−2i f(j) 2 2 j f(i) 1 . ≤ j i − f(i) f(k) ! ! (cid:18) − (cid:19) (cid:18) (cid:19) + Yk=i Weconcludetheproofbyobservingthattheprobabilityofnon-HKZ-reducednessof(b ,...,b ) 1 j isatmost p . Byhypothesis,thisquantityis< 1. Overall,thismeansthatthereexistµ ’s i0 (cid:18) (cid:19) + couldbeinterpreted as aRiemannsumcorrespondingto theintegral f(i) π/2 f(i) π sinj i+1xdx . − f(j) · ≈ f(j) · 2(j i+1) Z0 r − Notice however that if one uses the same technique to look for vectors of lengths smaller 1 than √c d f(i) d instead of f(1), one finds that there exists a lattice where there is · · i

Worst-Case Hermite-Korkine-Zolotarev Reduced Lattice Bases

Similar Worst-Case Hermite-Korkine-Zolotarev Reduced Lattice Bases