CryptoBook
  • CryptoBook
  • Book Plan
  • Style Guide
    • Sample Page
  • Contributors
  • Fundamentals
    • Mathematical Notation
    • Division and Greatest common divisor
      • Euclidean Algorithm
    • Modular Arithmetic
      • Theorems of Wilson, Euler, and Fermat
        • Fermat's Little Theorem in Detail
        • Euler's Theorem in Detail
      • Quadratic Residues
    • Continued Fractions
  • Number Theory
  • Ideals
  • Polynomials With Shared Roots
  • Integer Factorization
    • Pollard rho
    • Sieves
  • Abstract algebra
    • Groups
      • Another take on groups
      • Discrete Log Problem
    • Rings
    • Fields
    • Polynomials
  • Elliptic Curves
    • Untitled
  • Lattices
    • Introduction
    • LLL reduction
      • Gram-Schmidt Orthogonalization
      • Lagrange's algorithm
      • LLL reduction
    • Lattice reduction
      • Minkowski reduced
      • HKZ reduced
      • LLL reduced
    • Applications
      • Coppersmith algorithm
      • Extensions of Coppersmith algorithm
    • Hard lattice problems
    • Lattices of interest
    • Cryptographic lattice problems
      • Short integer solutions (SIS)
      • Learning with errors (LWE)
      • Ring-LWE
      • NTRU
    • Interactive fun
    • Resources and notations
  • Asymmetric Cryptography
  • RSA
    • Proof of correctness
    • RSA application
    • Low Private Component Attacks
      • Wiener's Attack
      • Boneh-Durfee Attack
    • Common Modulus Attack
    • Recovering the Modulus
  • Diffie-Hellman
    • MITM
  • Elliptic Curve Cryptography
  • Symmetric Cryptography
    • Encryption
    • The One Time Pad
    • AES
      • Rijndael Finite Field
      • Round Transformations
  • Hashes
    • Introduction / overview
    • The Birthday paradox / attack
  • Isogeny Based Cryptography
    • Introduction to Isogeny Cryptography
    • Isogenies
    • Isogeny and Ramanujan Graphs
  • Appendices
    • Sets and Functions
    • Probability Theory
Powered by GitBook
On this page
  • Definition
  • Bounds
  • Exercises

Was this helpful?

Export as PDF
  1. Lattices
  2. Lattice reduction

Minkowski reduced

PreviousLattice reductionNextHKZ reduced

Last updated 4 years ago

Was this helpful?

Definition

The basis{bi}i=1d\left\{b_i\right\}_{i=1}^d{bi​}i=1d​ is Minkowski-reduced if bib_ibi​has minimum length among all vectors in LLL linearly independent from{bj}j=1i−1\left\{b_j\right\}_{j=1}^{i-1}{bj​}j=1i−1​. Equivalently, bib_ibi​has minimum length among all vectors vvvsuch that {b1,…,bi−1,v}\left\{b_1,\dots,b_{i-1},v\right\}{b1​,…,bi−1​,v}can be extended to form a basis ofLLL. Such a notion is strongest among all lattice reduction notions and is generally extremely hard to compute. Another equivalent definition is

∥bi∥≤∥∑j=idcjbj∥gcd⁡(cj)=1\left\lVert b_i\right\rVert\leq\left\lVert\sum_{j=i}^dc_jb_j\right\rVert\quad\gcd\left(c_j\right)=1∥bi​∥≤​j=i∑d​cj​bj​​gcd(cj​)=1

Bounds

λi(L)2≤∥bi∥2≤max⁡(1,(54)i−4)λi(L)2\lambda_i(L)^2\leq\left\lVert b_i\right\rVert^2\leq\max\left(1,\left(\frac54\right)^{i-4}\right)\lambda_i(L)^2λi​(L)2≤∥bi​∥2≤max(1,(45​)i−4)λi​(L)2

The proof presented here is based off [Waerden 1956]. We proceed by induction. Letbib_ibi​be a Minkowski-reduced basis for some latticeLLL. The lower bound is immediate and for i=1i=1i=1, the upper bound is immediate as well.

Let v1,v2…viv_1,v_2\dots v_iv1​,v2​…vi​be linearly independent vectors such that∥vj∥=λj(L)\left\lVert v_j\right\rVert=\lambda_j(L)∥vj​∥=λj​(L). Let Li−1L_{i-1}Li−1​be the sublattice generated by b1,b2,…bi−1b_1,b_2,\dots b_{i-1}b1​,b2​,…bi−1​. Evidently somekkkmust exist such thatvkv_kvk​is not in Li−1L_{i-1}Li−1​. Consider the new lattice L′=L∩span(b1,b2,…bi−1,vk)L'=L\cap\text{span}\left(b_1,b_2,\dots b_{i-1},v_k\right)L′=L∩span(b1​,b2​,…bi−1​,vk​). Letvk′v'_kvk′​be the shortest vector inL′−Li−1L'-L_{i-1}L′−Li−1​such thatb1,b2,…,bi−1,vk′b_1,b_2,\dots,b_{i-1},v'_kb1​,b2​,…,bi−1​,vk′​is a basis for L′L'L′and we have

vk=a1b1+a2b2+⋯+ai−1bi−1+nvk′ai,n∈Z∥bi∥≤∥vk′∥v_k=a_1b_1+a_2b_2+\dots+a_{i-1}b_{i-1}+nv'_k\quad a_i,n\in\mathbb Z\\ \left\lVert b_i\right\rVert\leq\left\lVert v'_k\right\rVertvk​=a1​b1​+a2​b2​+⋯+ai−1​bi−1​+nvk′​ai​,n∈Z∥bi​∥≤∥vk′​∥

Furthermore, since

Exercises

1) Show that both definitions of Minkowski-reduced lattice are equivalent

Ifn=1n=1n=1, then we are done sincevkv_kvk​can be extended to a basis of LLL, so ∥bi∥≤∥vk∥=λk(L)≤λi(L)\left\lVert b_i\right\rVert\leq\left\lVert v_k\right\rVert=\lambda_k(L)\leq\lambda_i(L)∥bi​∥≤∥vk​∥=λk​(L)≤λi​(L). Otherwise, we have n2≥4n^2\geq4n2≥4. Let vk′=p+qv_k'=p+qvk′​=p+qwherepppis the projection ofvk′v'_kvk′​inLi−1L_{i-1}Li−1​. Since by definition we have∥p∥2≤∥p±bi∥2\left\lVert p\right\rVert^2\leq\left\lVert p\pm b_i\right\rVert^2∥p∥2≤∥p±bi​∥2, we must have

∥p∥2≤14∑j=1i−1∥bj∥2\left\lVert p\right\rVert^2\leq\frac14\sum_{j=1}^{i-1}\left\lVert b_j\right\rVert^2∥p∥2≤41​j=1∑i−1​∥bj​∥2
λk2=∥vk∥2=∥a1b1+a2b2+…ai−1bi−1+p∥2+n2∥q∥2\lambda_k^2=\left\lVert v_k\right\rVert^2=\left\lVert a_1b_1+a_2b_2+\dots a_{i-1}b_{i-1}+p\right\rVert^2+n^2\left\lVert q\right\rVert^2λk2​=∥vk​∥2=∥a1​b1​+a2​b2​+…ai−1​bi−1​+p∥2+n2∥q∥2

we have ∥q∥2≤14λk2\left\lVert q\right\rVert^2\leq\frac14\lambda_k^2∥q∥2≤41​λk2​, hence we have

∥bi∥≤14∑j=1i−1∥bj∥2+14λk2≤14∑j=1i−1max⁡(1,(54)i−4)λj(L)2+14λk(L)2≤14(1+∑j=1i−1max⁡(1,(54)i−4))λi(L)2{=max⁡(1,(54)i−4)λi(L)2i≥4<λi(L)2i=2,3\begin{align*} \left\lVert b_i\right\rVert&\leq\frac14\sum_{j=1}^{i-1}\left\lVert b_j\right\rVert^2+\frac14\lambda_k^2\\ &\leq\frac14\sum_{j=1}^{i-1}\max\left(1,\left(\frac54\right)^{i-4}\right)\lambda_j(L)^2+\frac14\lambda_k(L)^2\\ &\leq\frac14\left(1+\sum_{j=1}^{i-1}\max\left(1,\left(\frac54\right)^{i-4}\right)\right)\lambda_i(L)^2\\ &\begin{cases}=\max\left(1,\left(\frac54\right)^{i-4}\right)\lambda_i(L)^2&i\geq4\\<\lambda_i(L)^2&i=2,3\end{cases}\\ \end{align*}∥bi​∥​≤41​j=1∑i−1​∥bj​∥2+41​λk2​≤41​j=1∑i−1​max(1,(45​)i−4)λj​(L)2+41​λk​(L)2≤41​(1+j=1∑i−1​max(1,(45​)i−4))λi​(L)2{=max(1,(45​)i−4)λi​(L)2<λi​(L)2​i≥4i=2,3​​

but since λi(L)2≤∥bi∥2\lambda_i(L)^2\leq \left\lVert b_i\right\rVert^2λi​(L)2≤∥bi​∥2by definition, the case of i=2,3i=2,3i=2,3cannot occur here (hence n=1n=1n=1in these cases).

2) Consider the lattice L=(2000002000002000002011111)L=\begin{pmatrix}2&0&0&0&0\\0&2&0&0&0\\0&0&2&0&0\\0&0&0&2&0\\1&1&1&1&1\end{pmatrix}L=​20001​02001​00201​00021​00001​​. We have showed in a previous exercise that the successive minima are all222but no basisbib_ibi​can satisfy ∥bi∥=λi\left\lVert b_i\right\rVert=\lambda_i∥bi​∥=λi​, show that for any Minkowski reduced basis bib_ibi​, the basis must satisfy ∥bi∥2=max⁡(1,(54)i−4)λi(L)2\left\lVert b_i\right\rVert^2=\max\left(1,\left(\frac54\right)^{i-4}\right)\lambda_i(L)^2∥bi​∥2=max(1,(45​)i−4)λi​(L)2