Abstract
Hermite–Korkin–Zolotarev (HKZ) reduction is an important notion of lattice reduction which plays a significant role in number theory (particularly the geometry of numbers), and more recently in coding theory and post-quantum cryptography. In this work, we determine a sharp upper bound on the orthogonality defect of HKZ reduced bases up to dimension 3. Using this result, we determine a general upper bound for the orthogonality defect of HKZ reduced bases of arbitrary rank. This upper bound is sharper than existing bounds in literature, such as the one determined by Lagarias, Lenstra and Schnorr [3].
Similar content being viewed by others
Avoid common mistakes on your manuscript.
1 Introduction
A lattice \(\Lambda \) is a discrete subgroup of \(\mathbb {R}^m\), for some positive integer m. Every lattice \(\Lambda \) has a basis \(B=\{\textbf{b}_1,\textbf{b}_2,\dots , \textbf{b}_n\}\), and each point of \(\Lambda \) may be represented as the linear sum of its basis vectors over \(\mathbb {Z}\), that is,
We say that \(\Lambda \) is of rank n if \(\textbf{b}_1,\dots ,\textbf{b}_n\) are linearly independent over \(\mathbb {R}\) and form a basis for \(\mathbb {R}^n\), and we say that \(\Lambda \) is full-rank if \(n=m\).
The process of moving from a “bad” lattice basis (one in which the vectors are relatively long, non-orthogonal) to a “good” basis (relatively short and nearly orthogonal vectors) is known as lattice reduction. There are many different definitions of what constitutes a reduced lattice basis, and the focus of this paper will be on so-called HKZ reduced bases, named for mathematicians C. Hermite, A. Korkin and G. Zolotarev [1, 2]. Denote by
Then \(B=\{\textbf{b}_1,\textbf{b}_2,\dots ,\textbf{b}_n\}\) is said to be HKZ reduced if the following properties hold:
-
\(|\mu _{i,j}| \le 1/2\), for all \(1 \le j < i \le n\),
-
\(\textbf{b}_1\) is the shortest nonzero lattice vector of \(\Lambda (B)\),
-
\(\{\textbf{b}_2(2),\textbf{b}_3(2),\dots ,\textbf{b}_n(2)\}\) is HKZ reduced.
HKZ reduction is very useful both in theory and in practice. For example, it is used in the study of quadratic forms [10] (see also [9] for the application of a variation of HKZ). HKZ reduction is also widely used in coding theory and lattice-based cryptography to solve the closest vector problem (see, e.g., [5, 8]). HKZ reduction also has applications in the investigation of lattice packings of spheres, see e.g. [11].
The ith successive minimum of a lattice \(\Lambda \), denoted by \(\lambda _i\), is the smallest real number such that there are i linearly independent vectors in \(\Lambda \) of length at most \(\lambda _i\).
Proposition 1
([2]) If \(B=\{\textbf{b}_1,\textbf{b}_2,\dots ,\textbf{b}_n\}\) is HKZ reduced, then for all \(1 \le i \le n-1\),
and for all \(1 \le i \le n-2\),
Proposition 2
([3]) If \(B=\{\textbf{b}_1,\textbf{b}_2,\dots ,\textbf{b}_n\}\) is HKZ reduced, then for all \(1 \le i \le n\),
We define the Hermite invariant of a lattice \(\gamma (B)\) by
and the Hermite constant of rank n, denoted by \(\gamma _n\), is the supremum of all Hermite invariants for rank n lattice bases.
As mentioned, the process of reduction is attaining a basis for a lattice that has “desirable” properties. One way of measuring the quality of a basis is by evaluating its orthogonality defect, which is defined by
It is easily seen that the orthogonality defect is not unique to a lattice, and a basis can be transformed so that the orthogonality defect becomes arbitrarily large. However, it is known that the orthogonality defect can be bounded if the basis is HKZ reduced.
Theorem 1
([3]) If \(B=\{\textbf{b}_1,\textbf{b}_2,\dots ,\textbf{b}_n\}\) is HKZ reduced, then
Whilst Lagarias et. al. managed to show that the orthogonality defect of HKZ reduced bases must be bounded, little is known about the exact value of the supremum of the orthogonality defect for HKZ reduced basis of a given rank. In this work, we calculate this supremum up to dimension 3 HKZ reduced bases, and use this result to improve the bound in Theorem 1.
Theorem 2
Let \(H_n\) denote the space of rank n HKZ reduced lattice bases. Set
Then \(\Delta _1=1\), \(\Delta _2=\frac{4}{3}\), \(\Delta _3=\frac{25}{12}\).
Theorem 3
Using the notation as before, for all \(n \ge 4\),
The orthogonality defect is a quantity that is of significant importance in both the fields of post-quantum cryptography and coding theory [5]. Many post-quantum cryptosystems make use of lattices, and achieving a basis of a lattice that is “relatively orthogonal” makes breaking the cryptosystem significantly easier than being given a relatively non-orthogonal basis. Roughly, the orthogonality defect of a basis is an indication of how orthogonal the basis is as a whole - the lower the orthogonality defect, the closer the basis vectors are to being orthogonal. Moreover, it has been shown that the complexity of quantum lattice enumeration algorithms is directly linked to the orthogonality defect [6, 7]. Achieving bases with small orthogonality defect is therefore of vital importance in these fields.
2 Proof of Theorem 2
The value of \(\Delta _1\) is trivial. For \(\Delta _2\), for any basis \(B=\{\textbf{b}_1,\textbf{b}_2\}\),
and this upper bound is attained by the \(A_2\) lattice.
We now draw our attention to the case where \(n=3\). We will assume without loss of generality that \(\Vert \textbf{b}_1\Vert ^2=1\) (the value of \(\Vert \textbf{b}_1\Vert ^2\) will not affect the orthogonality defect of the lattice), and use the following notations:
Then,
By switching the signs of y, z we may assume without loss of generality that \(\lambda ,\mu \ge 0\). It is easily seen that we have,
Since the basis is HKZ reduced, the following inequalities hold:
From this, we may ascertain the following inequalities:
Now, using the inequalities \(l \ge \frac{2}{3},k \ge \frac{3}{4}\), if \(|\sigma | \le 1/3\) we have
so we may assume without loss of generality that \(1/3 \le |\sigma | \le 1/2\). Assume first that \(\sigma \le -1/3\). By inequalities 3 and 6, we have
Assume first that
Then
Let
so
where
since
for all \(|\sigma |\le 1/2\), and so \(f^{\prime \prime }(k)\) is non-negative for all values of \(\lambda ,k,\sigma , \mu \) over their respective regions, so the maximum value of f(k) occurs either when k is maximum or when it is minimum. Suppose first that f(k) is maximum when k is minimum. Then
Let’s assume a contradiction, so
for some values of \(\mu ,\sigma ,\lambda \). Rearranging gives us the quadratic inequality in \(\sigma \):
Denote by \(r^+,r^-\) respectively the greater and lesser roots of the equation above. Then we need either
However, we can show that the solutions to this equation yield contradictions. Using 9, we have
and so the function is only valid under the boundaries
Using these boundaries, we can numerically show that there cannot exist a valid solution as we would require \(\sigma >-1/3\) for \(\sigma \ge r^+\), or \(\sigma <-1/2\) for \(\sigma \le r^-\). Hence, the inequality 10 cannot exist under the assumptions made.
Now assume that the maximum of f(k) occurs when k is maximum, so
Once again, we assume that we have a contradiction so
which yields the quadratic inequality
Once again, labelling the lesser and greater roots of the above quadratic inequality by \(r^{-},r^+\), we are able to numerically verify that, under the boundary conditions \(0 \le \lambda ,\mu \le 1/2\), there exists no solution to \(\sigma \ge r^{+}\) (under the assumption that \(|\sigma | \ge 1/3\)), and there exists a single exact solution for \(\sigma \le r^{-}\), namely \(\sigma =-1/2\) which is attained when \(\mu =\lambda =1/2\). However, this point attains the value \(\Delta (B)=\frac{25}{12}\) exactly, so this does not constitute a contradiction to our claim.
We may now assume instead that
Then
Clearly the upper bound attains its maximum value when k is minimal, so by inequality 14,
However, this inequality is identical to the inequality in 13, and since we have already shown that this inequality does not rise above \(\frac{25}{12}\) in value for \(0 \le \lambda ,\mu \le 1/2\), we are also done for this case.
We have confirmed our claim for all \(-1/2 \le \sigma \le 1/3\), so now we assume that \(1/3 \le \sigma \le 1/2\). By inequalities 4, 6, we have
Assume first that
Then
Let
Then
where
since
for all \(1/3 \le \sigma \le 1/2\), and so \(F^{\prime \prime }(k)\) is non-negative for all values of \(\lambda ,k,\sigma ,\mu \) over their respective regions, so the maximum value of F(k) occurs either when k is maximum or when it is minimum. Suppose first that F(k) is maximum when k is minimum. Then
Assume that
which gives us the quadratic inequality
Let \(r^{-},r^+\) respectively denote the lesser and greater roots of the quadratic ienquality above. By inequality 15,
and so we obtain the boundary conditions
Again, we need either \(\sigma \le r^{-}\) or \(\sigma \ge r^+\). However, we can numerically verify that under boundary conditions 16,17, the solution \(\sigma \le r^{-}\) requires \(\sigma <1/3\) and the solution \(\sigma \ge r^+\) requires that \(\sigma >1/2\), both of which are clearly contradictions under the assumptions made.
Now, assume that F(k) attains its maximum when k is maximum. Then
Assume that
Rearranging gives us the quadratic inequality
Again, letting \(r^{-},r^+\) denote the lesser and greater roots of the quadratic inequality above, we verify numerically that \(r^{-} < 1/3\) and \(r^+ \ge 1/2\) for all \(0 \le \mu , \lambda \le 1/2\), with equality \(\sigma =1/2\) only when \(\lambda =\mu =1/2\). We have \(\Delta (B)=\frac{25}{12}\) at the point \(\sigma =\mu =\lambda =1/2\) but does not exceed \(\frac{25}{12}\) at any other point, so this does not constitute a contradiction to our claim.
Finally, assume that
so
Clearly the upper bound attains its maximum when k is minimal, so
However, the function determining the upper bound for \(\Delta (B)\) here is identical to that in 18, for which we have verified is less than or equal to \(\frac{25}{12}\) over all values of \(\sigma , \mu , \lambda \) in their relative intervals, so we do not need to deal with this case. Since this exhausts all possible values for all the variables, we have verified that \(\Delta _3=\frac{25}{12}\), and the quadratic form
attains this upper bound, so this is the best possible upper bound on the orthogonality defect for three dimensional HKZ reduced bases.
3 Proof of Theorem 3
Suppose that \(B=\{\textbf{b}_1,\textbf{b}_2,\dots ,\textbf{b}_n\}\) is the basis for a rank \(n \ge 4\) lattice, and assume that B is HKZ reduced. Then note that the subbasis \(\{\textbf{b}_1,\textbf{b}_2,\textbf{b}_3\}\) must also be HKZ reduced, and so
Then
Also note that the lattice generated by the basis \(\{\textbf{b}_4(4),\textbf{b}_5(4),\dots ,\textbf{b}_n(4)\}\) is HKZ reduced, by definition. For any \(i \ge 4\), we have
Using Proposition 1,
so
Lagarias et. al. proved that if B is HKZ reduced, then
for all \(1 \le i \le n\), and so for all \(i \ge 4\), letting \(\lambda _k(4)\) denote the kth successive minima in the lattice generated by \(\{\textbf{b}_4(4),\textbf{b}_5(4),\dots ,\textbf{b}_n(4)\}\),
Then, using Minkowski’s second theorem we get
as required.
4 Summary and future work
In this work, we determined the exact maximal value that the orthogonality defect can take for HKZ reduced bases up to dimension 3, and used this result to calculate an upper bound on the orthogonality defect of HKZ bases of arbitrary rank. The latter result seems to be sharper than any other bounds on the orthogonality defect for HKZ reduced bases in existing literature, according to the authors’ knowledge.
In the future, we will investigate whether the techniques applied in this paper can be used to sharpen the bounds on the orthogonality defect further, and to determine the value of \(\Delta _n\) exactly for \(n \ge 4\). We conjecture that \(\Delta _4=\gamma _4^4\), and preliminary computational results seem to agree with this conjecture, which would be an interesting result, given that \(\Delta _3=\frac{25}{24}\gamma _3^3\).
Data availability
Data sharing not applicable to this article as no datasets were generated or analysed during the current study.
References
Hermite, C.: Extraits de lettres de M. Ch. Hermite à M. Jacobi sur différents objects de la théorie des nombres. Journal für die reine und angewandte Mathematik (Crelles Journal) 1850(40), 261–278 (1850)
Korkine, A., Zolotareff, G.: Sur les formes quadratiques. Mathematische Annalen 6, 366–389 (1873)
Lagarias, J.C., Lenstra, H.W., Schnorr, C.P.: Korkin-Zolotarev bases and successive minima of a lattice and its reciprocal lattice. Combinatorica 10, 333–348 (1990)
Minkowski, H.: Geometrie der Zahlen. B.G. Teubner Verlag, Leipzig-Berlin (1910)
Zhang, W., Qiao, S., Wei, Y.: HKZ and Minkowski reduction algorithms for lattice-reduction-aided MIMO detection. IEEE Trans. Sig. Process. 60(11), 5963–5976 (2012)
Albrecht, M.R. , Prokop, M., Shen, Y., Wallden, P.: “Variational quantum solutions to the shortest vector problem”. arXiv preprint arXiv:2202.06757 (2022)
Dable-Heath, E., Casas, L., Porter, C., Mintert, F., Ling, C.: “Quantum algorithmic solutions to the shortest vector problem on simulated coherent Ising machines”. arXiv preprint arXiv:2304.04075 (2023)
Hanrot, G., Stehle, D.: Improved analysis of Kannan’s shortest lattice vector algorithm. Adv. Cryptol. CRYPTO 2007, 170–186 (2007)
Beli, C.N., Chan, W.K., Icaza, M.I., Liu, J.: On a Waring’s problem for quadratic and Hermitian forms. Trans. Am. Math. Soc. 371, 5505–5527 (2019)
Cassels, J.W.S.: Rational Quadratic Forms. Academic Press, London (1968)
Pendavingh, R.A., van Zwam, S.H.M.: New Korkin-Zolotarev inequalities. Soc. Indust. Appl. Math. 18(1), 364–378 (2007)
Author information
Authors and Affiliations
Corresponding author
Additional information
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Rights and permissions
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder. To view a copy of this licence, visit http://creativecommons.org/licenses/by/4.0/.
About this article
Cite this article
Porter, C., Dable-Heath, E. & Ling, C. A new bound for the orthogonality defect of HKZ reduced lattices. Res. number theory 10, 65 (2024). https://doi.org/10.1007/s40993-024-00554-1
Received:
Accepted:
Published:
DOI: https://doi.org/10.1007/s40993-024-00554-1