Lattice Basis Reduction Part II: Algorithms Sanzheng Qiao - PowerPoint PPT Presentation

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement Lattice Basis Reduction Part II: Algorithms Sanzheng Qiao Department of Computing and Software McMaster University, Canada qiao@mcmaster.ca www.cas.mcmaster.ca/ ˜ qiao November 8, 2011, revised February 2012 Joint work with W. Zhang and Y. Wei, Fudan University

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement Outline 1 Hermite Reduction 2 LLL Reduction 3 HKZ Reduction 4 Minkowski Reduction 5 A Measurement

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement Outline 1 Hermite Reduction 2 LLL Reduction 3 HKZ Reduction 4 Minkowski Reduction 5 A Measurement

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement Hermite reduction (size reduction) Hermite-reduced A lattice basis { b 1 , b 2 , . . . , b n } is called size-reduced if its QR decomposition satisfies | r i , i | ≥ 2 | r i , j | , 1 ≤ i < j ≤ n , for all

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement Hermite reduction (size reduction) Hermite-reduced A lattice basis { b 1 , b 2 , . . . , b n } is called size-reduced if its QR decomposition satisfies | r i , i | ≥ 2 | r i , j | , 1 ≤ i < j ≤ n , for all Procedure Reduce ( i , j ) � r i , j � r i , j � r i , i � � r i , j � � � � r i , i r i , j − r i , i � 1 − r i , i r i , i = r j , j r j , j 0 1 � r i , j � �� | r i , i | ≥ 2 � r i , j − r i , i � � r i , i �

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement Gauss reduction A unimodular transformation � 1 � � � − µ 1 0 or 0 1 − µ 1 Also called Integer Gauss transformation Integer elementary matrix

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement Outline 1 Hermite Reduction 2 LLL Reduction 3 HKZ Reduction 4 Minkowski Reduction 5 A Measurement

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement LLL reduction LLL-reduced A lattice basis { b 1 , b 2 , . . . , b n } is called LLL-reduced if it is size-reduced and R in the QR decomposition satisfies r 2 i + 1 , i + 1 + r 2 i , i + 1 ≥ ω r 2 i , i

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement LLL reduction LLL-reduced A lattice basis { b 1 , b 2 , . . . , b n } is called LLL-reduced if it is size-reduced and R in the QR decomposition satisfies r 2 i + 1 , i + 1 + r 2 i , i + 1 ≥ ω r 2 i , i Procedure SwapRestore ( i ) Find a Givens plane rotation G : � r i − 1 , i − 1 � � 0 � ˆ r i − 1 , i r i − 1 , i − 1 r i − 1 , i � ˆ � 1 G = . r i , i r i , i ˆ 0 1 0 0 Unimodular transformation: Permutation

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement LLL algorithm k = 2; while k <= n { if |r(k-1,k) / r(k-1,k-1)| > 1/2 if r(k,k)ˆ2 + r(k-1,k)ˆ2 < w*r(k-1,k-1)ˆ2 { } else { } }

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement LLL algorithm k = 2; while k <= n { if |r(k-1,k) / r(k-1,k-1)| > 1/2 Reduce(k-1,k); if r(k,k)ˆ2 + r(k-1,k)ˆ2 < w*r(k-1,k-1)ˆ2 { } else { } }

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement LLL algorithm k = 2; while k <= n { if |r(k-1,k) / r(k-1,k-1)| > 1/2 Reduce(k-1,k); if r(k,k)ˆ2 + r(k-1,k)ˆ2 < w*r(k-1,k-1)ˆ2 { SwapRestore(k); k = max(k-1, 2); } else { } }

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement LLL algorithm k = 2; while k <= n { if |r(k-1,k) / r(k-1,k-1)| > 1/2 Reduce(k-1,k); if r(k,k)ˆ2 + r(k-1,k)ˆ2 < w*r(k-1,k-1)ˆ2 { SwapRestore(k); k = max(k-1, 2); } else { for i = k-2 downto 1 if |r(i,k) / r(i,i)| > 1/2 Reduce(i,k); k = k+1; } }

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement LLL algorithm k = 2; while k <= n { if |r(k-1,k) / r(k-1,k-1)| > 1/2 Reduce(k-1,k); if r(k,k)ˆ2 + r(k-1,k)ˆ2 < w*r(k-1,k-1)ˆ2 { SwapRestore(k); k = max(k-1, 2); } else { for i = k-2 downto 1 if |r(i,k) / r(i,i)| > 1/2 Reduce(i,k); k = k+1; } } Redundant size reductions.

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement An improvement: Delayed size reduction k = 2; while k <= n g = round(r(k-1,k) / r(k-1,k-1)); if r(k,k)ˆ2 + (r(k-1,k) - g*r(k-1,k-1))ˆ2 < w*r(k-1,k-1)ˆ2 ReduceSwapRestore(k); k = max(k-1, 2); else k = k + 1; for k = 2 to n for i = k-1 downto 1 if |r(i,k) / r(i,i)| > 1/2 Reduce(i,k);

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement An improvement: Delayed size reduction k = 2; while k <= n g = round(r(k-1,k) / r(k-1,k-1)); if r(k,k)ˆ2 + (r(k-1,k) - g*r(k-1,k-1))ˆ2 < w*r(k-1,k-1)ˆ2 ReduceSwapRestore(k); k = max(k-1, 2); else k = k + 1; for k = 2 to n for i = k-1 downto 1 if |r(i,k) / r(i,i)| > 1/2 Reduce(i,k); Produces identical results at 50% cost.

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement Outline 1 Hermite Reduction 2 LLL Reduction 3 HKZ Reduction 4 Minkowski Reduction 5 A Measurement

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement HKZ reduction HKZ-reduced A lattice basis { b 1 , b 2 , . . . , b n } is called HKZ-reduced if it is size-reduced and for each trailing ( n − i + 1 ) × ( n − i + 1 ) , 1 ≤ i < n , submatrix of R in the QR decomposition, its first column is a shortest nonzero vector in the lattice generated by the submatrix.

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement HKZ reduction HKZ-reduced A lattice basis { b 1 , b 2 , . . . , b n } is called HKZ-reduced if it is size-reduced and for each trailing ( n − i + 1 ) × ( n − i + 1 ) , 1 ≤ i < n , submatrix of R in the QR decomposition, its first column is a shortest nonzero vector in the lattice generated by the submatrix. Two problems Shortest vector problem (SVP) Expansion to a basis

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement SVP � Bz � 2 min 2 z

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement SVP � Bz � 2 min 2 z Sphere decoding Determine a search sphere � Bz � 2 2 ≤ ρ 2

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement SVP � Bz � 2 min 2 z Sphere decoding Determine a search sphere � Bz � 2 2 ≤ ρ 2 A simple choice of ρ : the length of the first (or shortest) column of B .

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement Example z 1  4 1 5    Rz = z 2 0 4 4     z 3 0 0 3 ρ = 4

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement Example z 1  4 1 5    Rz = z 2 0 4 4     z 3 0 0 3 ρ = 4 A necessary condition for z 3 : | 3 z 3 | ≤ 4. Possible values of z 3 : 0, − 1, 1

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement Example For each possible values of z 3 , say z 3 = 0, � z 1 z 1         4 1 5 4 1 5 � Rz = z 2  = 0 4 4 0 4 + 0 4 z 2        z 3 0 0 3 0 0 3 The problem size is reduced.

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement Example For each possible values of z 3 , say z 3 = 0, � z 1 z 1         4 1 5 4 1 5 � Rz = z 2  = 0 4 4 0 4 + 0 4 z 2        z 3 0 0 3 0 0 3 The problem size is reduced. The necessary condition for z 2 : | 4 z 2 | ≤ 4 Possible values of z 2 : 0, − 1, 1

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement Example The search tree 0 −1 1 z 3 0 −1 1 0 −1 1 z 2 −1 1 1 z 1 The solution       4 1 5 1 0 Rz =  = 0 4 4 1 0      0 0 3 − 1 − 3

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement Expanding to a basis Problem: Transform the basis matrix   4 1 5 A = 0 4 4   0 0 3 into a new basis matrix whose first column is the shortest vector  0  A z = 0   − 3

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement Expanding to a basis Problem: Transform the basis matrix   4 1 5 A = 0 4 4   0 0 3 into a new basis matrix whose first column is the shortest vector  0  A z = 0   − 3 That is, find a unimodular matrix Z : A z = AZ e 1 or z = Z e 1 , Z − 1 z = e 1 Unimodular transformation that introduces zeros into an integer vector.

Hermite Reduction LLL Reduction HKZ Reduction Minkowski Reduction A Measurement A plane unimodular transformation A unimodular transformation (Luk, Zhang, and Q, 2010). gcd ( p , q ) = ± d , ap + bq = ± d . Form the unimodular matrix � � p � d a b � � � = − q / d p / d q 0