Cryptanalysis of RSA Factorization - Library(ISI Kolkata) - Indian ...

29 2.4 Lattice and LLL Algorithm
When L is full rank, then det(L) = |det(M)|, where M is a matrix corresponding
to L. For our purpose, we consider only full rank lattices in this thesis.
Example 2.16. Consider two vectors v 1 = (1,2),v 2 = (3,4). Then 〈v 1 ,v 2 〉 =
1 · 3 + 2 · 4 = 11, and ||v 1 || = √ 5. The lattice L generated by v 1 ,v 2 is L =
{v ∈ Z 2 ( | v = ) a 1 v 1 + a 2 v 2 with a 1 ,a 2 ∈ Z}. Matrix M corresponding to L
1 2
is M = and B = {v 1 ,v 2 } is a basis of L. Since v 1 ,v 2 are linearly
3 4
independent, the dimension of L is 2 and L is a full rank lattice. Therefore,
det(L) = |det(M)| = 2.
A problem of interest in the theory of lattices is the Shortest Vector Problem
(SVP) [89]. This problem has been studied for ages and no exact solution to this
has been found till date. The problem is as follows.
Problem 2.17 (SVP). Given a lattice L generated by a basis B, find the shortest
vector v ∈ L with respect to a predetermined norm.
Though no one could ever produce an algorithm that will solve SVP in polynomial
time, there had been a lot of research in this area. A well known result by
Minkowski [92] deals with this problem as well.
Theorem 2.18 (Minkowski). Every n-dimensional lattice L contains a nonzero
vector v with ||v|| ≤ √ n(det(L)) 1 n .
Finding the shortest nonzero vector in a lattice is very hard in general. However,
one can use the famous LLL reduction algorithm [77] of A. K. Lenstra, H.
W. Lenstra Jr., and L. Lovász to approximate the shortest vector. The technique
is as presented in Algorithm 6. LLL algorithm performs some elementary row
operations on the matrix M corresponding to L, and produces an alternate basis
with certain nice properties, as follows [77].
Definition 2.19 (LLL Reduced Basis). We say that a set of basis vectors B =
{r 1 ,r 2 ,...,r n } is LLL reduced if
(i) |µ ij | ≤ 1 for all 1 ≤ i ≤ n and j < i,
2
3
(ii)
4 ||r i ∗ || 2 ≤ ||µ i+1,i r ∗ i +r ∗ i+1 || 2 for all 1 ≤ i ≤ n.