CryptoBook
  • CryptoBook
  • Book Plan
  • Style Guide
    • Sample Page
  • Contributors
  • Fundamentals
    • Mathematical Notation
    • Division and Greatest common divisor
      • Euclidean Algorithm
    • Modular Arithmetic
      • Theorems of Wilson, Euler, and Fermat
        • Fermat's Little Theorem in Detail
        • Euler's Theorem in Detail
      • Quadratic Residues
    • Continued Fractions
  • Number Theory
  • Ideals
  • Polynomials With Shared Roots
  • Integer Factorization
    • Pollard rho
    • Sieves
  • Abstract algebra
    • Groups
      • Another take on groups
      • Discrete Log Problem
    • Rings
    • Fields
    • Polynomials
  • Elliptic Curves
    • Untitled
  • Lattices
    • Introduction
    • LLL reduction
      • Gram-Schmidt Orthogonalization
      • Lagrange's algorithm
      • LLL reduction
    • Lattice reduction
      • Minkowski reduced
      • HKZ reduced
      • LLL reduced
    • Applications
      • Coppersmith algorithm
      • Extensions of Coppersmith algorithm
    • Hard lattice problems
    • Lattices of interest
    • Cryptographic lattice problems
      • Short integer solutions (SIS)
      • Learning with errors (LWE)
      • Ring-LWE
      • NTRU
    • Interactive fun
    • Resources and notations
  • Asymmetric Cryptography
  • RSA
    • Proof of correctness
    • RSA application
    • Low Private Component Attacks
      • Wiener's Attack
      • Boneh-Durfee Attack
    • Common Modulus Attack
    • Recovering the Modulus
  • Diffie-Hellman
    • MITM
  • Elliptic Curve Cryptography
  • Symmetric Cryptography
    • Encryption
    • The One Time Pad
    • AES
      • Rijndael Finite Field
      • Round Transformations
  • Hashes
    • Introduction / overview
    • The Birthday paradox / attack
  • Isogeny Based Cryptography
    • Introduction to Isogeny Cryptography
    • Isogenies
    • Isogeny and Ramanujan Graphs
  • Appendices
    • Sets and Functions
    • Probability Theory
Powered by GitBook
On this page
  • Overview
  • Exercises

Was this helpful?

Export as PDF
  1. Lattices
  2. LLL reduction

Gram-Schmidt Orthogonalization

PreviousLLL reductionNextLagrange's algorithm

Last updated 4 years ago

Was this helpful?

Overview

Gram-Schmidt orthogonalization is an algorithm that takes in a basis {bi}i=1n\left\{b_i\right\}_{i=1}^n{bi​}i=1n​ as an input and returns a basis {bi∗}i=1n\left\{b_i^*\right\}_{i=1}^n{bi∗​}i=1n​where all vectors are orthogonal, i.e. at right angles. This new basis is defined as

bi∗=bi−∑j=1i−1μi,jbj∗μi,j=⟨bi,bj∗⟩⟨bj∗,bj∗⟩b_i^*=b_i-\sum_{j=1}^{i-1}\mu_{i,j}b_j^*\quad\mu_{i,j}=\frac{\langle b_i,b_j^*\rangle}{\langle b_j^*,b_j^*\rangle}bi∗​=bi​−j=1∑i−1​μi,j​bj∗​μi,j​=⟨bj∗​,bj∗​⟩⟨bi​,bj∗​⟩​

where μi,j\mu_{i,j}μi,j​is the Gram-Schmidt coefficients.

One can immediately check that this new basis is orthogonal, meaning

⟨bi∗,bj∗⟩={0i≠j∥bi∗∥2i=j\langle b_i^*,b_j^*\rangle=\begin{cases}0&i\neq j\\\left\lVert b_i^*\right\rVert^2&i=j\end{cases}⟨bi∗​,bj∗​⟩={0∥bi∗​∥2​i=ji=j​

Let B\mathcal BBbe the matrix where the iiith row is given by bib_ibi​andB∗\mathcal B^*B∗be the matrix where the iiith row is given by bi∗b_i^*bi∗​, then the Gram-Schmidt orthogonalization gives us B=μB∗\mathcal B=\mu\mathcal B^*B=μB∗where μi,i=1,μj,i=0\mu_{i,i}=1,\mu_{j,i}=0μi,i​=1,μj,i​=0and μi,j\mu_{i,j}μi,j​is the Gram-Schmidt coefficient. As an example, consider the basis of a subspace of R4\mathbb R^4R4:

b1=(−1−231)b2=(−6−451)b3=(551−3)\begin{matrix} b_1 &= & (&-1&-2&3&1&)\\ b_2 &= & (&-6&-4&5&1&)\\ b_3 &= & (&5&5&1&-3&) \end{matrix}b1​b2​b3​​===​(((​−1−65​−2−45​351​11−3​)))​

Instead of doing the Gram-Schmidt orthogonalization by hand, we can get sage to do it for us:

B = Matrix([
[-1, -2, 3, 1],
[-6, -4, 5, 1],
[5, 5, 1, -3]])

B.gram_schmidt()
(
[-1 -2  3  1]  [ 1  0  0]
[-4  0 -1 -1]  [ 2  1  0]
[ 0  3  3 -3], [-1 -1  1]
)

A useful result is that

Intuitively, this tells us that the more orthogonal a set of basis for a lattice is, the shorter it is as the volume must be constant.

Exercises

2) Verify that the output of sage is indeed correct.

This outputs two matrices, B∗\mathcal B^*B∗and μ\muμ:

One can quickly verify that B=μB∗\mathcal B=\mu\mathcal B^*B=μB∗ and that the rows of B∗\mathcal B^*B∗are orthogonal to each other.

det⁡(BBT)=det⁡(B∗B∗T)=∏i∥bi∗∥\det\left(\mathcal B\mathcal B^T\right)=\det\left(\mathcal B^*\mathcal B^{*T}\right)=\prod_i\left\lVert b_i^*\right\rVertdet(BBT)=det(B∗B∗T)=i∏​∥bi∗​∥

1) Show that the basis bi∗b_i^*bi∗​is orthogonal.

3) Show that μμT=1\mu\mu^T=1μμT=1and B∗B∗T\mathcal B^*\mathcal B^{*T}B∗B∗T is a diagonal matrix whose entries are ∥bi∗∥\left\lVert b_i^*\right\rVert∥bi∗​∥. Conclude that det⁡(BBT)=det⁡(B∗B∗T)=∏i∥bi∗∥\det\left(\mathcal B\mathcal B^T\right)=\det\left(\mathcal B^*\mathcal B^{*T}\right)=\prod_i\left\lVert b_i^*\right\rVertdet(BBT)=det(B∗B∗T)=∏i​∥bi∗​∥.

4*) Given the Iwasawa decomposition B=LDO\mathcal B=LDOB=LDOwhere LLLis a lower diagonal matrix with 111on its diagonal, DDDis a diagonal matrix and OOOan orthogonal matrix, meaning OOT=1OO^T=1OOT=1, show that B∗=DO\mathcal B^*=DOB∗=DOand μ=L\mu=Lμ=L. Furthermore, prove that such a decomposition is unique.