On Compact Representations of Voronoi Cells of Lattices

Abstract

In a seminal work, Micciancio & Voulgaris (2010) described a deterministic single-exponential time algorithm for the Closest Vector Problem (CVP) on lattices. It is based on the computation of the Voronoi cell of the given lattice and thus may need exponential space as well. We address the major open question whether there exists such an algorithm that requires only polynomial space.

To this end, we define a lattice basis to be c-compact if every facet normal of the Voronoi cell is a linear combination of the basis vectors using coefficients that are bounded by c in absolute value. Given such a basis, we get a polynomial space algorithm for CVP whose running time naturally depends on c. Thus, our main focus is the behavior of the smallest possible value of c, with the following results: There always exist c-compact bases, where c is bounded by $n^2$ for an n-dimensional lattice; there are lattices not admitting a c-compact basis with c growing sublinearly with the dimension; and every lattice with a zonotopal Voronoi cell has a 1-compact basis.

Appendix

Lemma 3

Let $n \in \mathbb {N}_{\ge 4}$, $a = \lceil n/2 \rceil$, and $\varLambda _n = \varLambda _n(a)$. A vector $v \in \varLambda _n$ is Voronoi relevant if and only if $v = \pm \mathbf {1}$, or there exists $\emptyset \ne S \subsetneq \{1,\dots ,n\}$ s.t.

$$\begin{aligned} v_i&= a-\ell \text { (} i \in S\text {)}, \quad v_j = -\ell \text { (} j \notin S\text {)}, \quad \text {and } \quad \ell \in \{ \lfloor \tfrac{a\vert S \vert }{n} \rfloor , \lceil \tfrac{a\vert S \vert }{n} \rceil \} . \end{aligned}$$

(3)

Proof

(Sketch). Voronoi characterized a strictly Voronoi relevant vector v in a lattice $\varLambda$ by the property that $\pm v$ are the only shortest vectors in the co-set $v + 2 \varLambda$ (cf. [8, p. 477]). We use this crucially to show that Voronoi relevant vectors different from $\pm \mathbf {1}$ are characterized by (3).

The vectors $\pm \mathbf {1}$ are Voronoi relevant as they are shortest vectors of the lattice; if two linearly independent shortest vectors $v_1,v_2$ were in the same co-set $v_1 + 2\varLambda _n$, then $(v_1 + v_2)/2$ would be a strictly shorter vector. To analyze any shortest vector u of some co-set $v + 2\varLambda _n$, $v \in \varLambda _n$, we make the following two observations. First, as $2ae_i \in 2\varLambda _n$, we have $u \in [-a,a]^n$. Due to the definition of $\varLambda _n$, either $u \in \{0,\pm a\}^n$, or $u \in [-a+1,a-1]^n$. In the first case, if we have at least two non-zero entries, we can flip the sign of one entry and obtain a vector of the same length in the same co-set, but linearly independent. Hence, that co-set does not have any Voronoi relevant vectors. In the other case, again due to $v_i \equiv v_j \!\mod a$ for any lattice vector, $u \in \{a-\ell ,-\ell \}^n$ for some $1 \le \ell < n$. Considering the norm of u as a function in $\ell$ and bearing in mind that $\mathbf 1 \in 2\varLambda _n$, we see that $\Vert u \Vert ^2$ is minimized precisely for the choices of $\ell$ given in (3). Due to this line of thought, in order to show that each vector u of shape (3) is indeed Voronoi relevant, it suffices to show that any vector in $\{-a,0,a\}^n$ is either longer than u, or in another residue class.    $\square$

Proof

(Theorem 2). For brevity, we write $c = c(\varLambda _n)$, $Q = {{\,\mathrm{conv}\,}}(\mathcal {F}_{\varLambda _n})$. As $\mathbf {1}\in \varLambda _n$, there exists a $w \in \varLambda _n^\star$ with $\mathbf {1}^\intercal w = 1$, implying that each basis of $\varLambda _n^\star$ contains a vector y such that $\mathbf {1}^\intercal y$ is an odd integer. In particular, by Lemma 1, we know that $c \, Q^\star$ contains such a y. As $Q^\star$ is centrally symmetric, assume $\mathbf {1}^\intercal y \ge 1$. Further, since $\varLambda _n^\star$ is invariant under permutation of the coordinates, we may assume that $y_1 \ge y_2 \ge \dots \ge y_n$. Let us outline our arguments: We split $\mathbf {1}^\intercal y$ into two parts, by setting $A \mathrel {\mathop :}=\sum _{i=1}^{k} y_i$, and $B \mathrel {\mathop :}=\sum _{i>k}^n y_i$, where $k = \lceil n/2 \rceil$. We show that $A \ge B + 1$, and construct a Voronoi relevant vector $v \in \varLambda _n$ by choosing $S = \{1,\dots ,k\}$ and $\ell = \lfloor ak/n \rfloor$. Hence, $(a-\ell ),\ell \approx n/4$ and we obtain $v^\intercal y \gtrsim \frac{n}{4} A - \frac{n}{4} B \ge n/4$ by distinguishing the four cases $n \!\mod 4$.

For showing $A \ge B + 1$, consider $y_k$. As $y \in \varLambda _n^\star$, there is an integer z such that we can write $y_k = \frac{z}{a}$. Note that we have $A \ge k y_k = z$ and $B \le (n-k) \frac{z}{a} \le z$. Let $\alpha , \gamma \ge 0$ such that $A = z + \alpha$ and $B= z - \gamma$. As $A+ B = 2z + \alpha - \gamma$ has to be an odd integer, we have $\vert \alpha - \gamma \vert \ge 1$, implying $\alpha \ge 1$ or $\gamma \ge 1$. Therefore, in fact we have $A \ge \max \{ B + 1 , 1 \}$.    $\square$

We now give the details of the proof of Theorem 3. A dicing $\mathfrak {D}$ in $\mathbb {R}^n$ is an arrangement consisting of families of infinitely many equally-spaced hyperplanes with the following properties: (i) there are n families with linearly independent normal vectors, and (ii) every vertex of the arrangement is contained in a hyperplane of each family. The vertex set of a dicing forms a lattice $\varLambda (\mathfrak {D})$. Erdahl [12, Thm. 3.1] represents a dicing $\mathfrak {D}$ as a set $D = \{\pm d_1,\ldots ,\pm d_r\}$ of hyperplane normals and a set $E = \{\pm e_1,\ldots ,\pm e_s\} \subseteq \varLambda (\mathfrak {D})$ of edge vectors of the arrangement $\mathfrak {D}=\mathfrak {D}(D,E)$ satisfying: (E1) Each pair of edges $\pm e_j \in E$ is contained in a line $d_{i_1}^\perp \cap \ldots \cap d_{i_{n-1}}^\perp$, for some linearly independent $d_{i_1},\ldots ,d_{i_{n-1}} \in D$, and conversely each such line contains a pair of edges; (E2) For each $1 \le i \le r$ and $1 \le j \le s$, we have $d_i^\intercal e_j\in \{0,\pm 1\}$.

Proof

(Theorem 3). We start by reviewing the Delaunay tiling of the lattice $\varLambda$. A sphere $B_c(R) = \{x \in \mathbb {R}^n : \Vert x - c\Vert ^2 \le R^2\}$ is called an empty sphere of $\varLambda$ (with center $c \in \mathbb {R}^n$ and radius $R \ge 0$), if every point in $B_c(R) \cap \varLambda$ lies on the boundary of $B_c(R)$. A Delaunay polytope of $\varLambda$ is defined as the convex hull of $B_c(R) \cap \varLambda$, and the family of all Delaunay polytopes induces a tiling $\mathcal{{D}}_\varLambda$ of $\mathbb {R}^n$ which is the Delaunay tiling of $\varLambda$. This tiling is in fact dual to the Voronoi tiling.

Erdahl [12, Thm. 2] shows that the Voronoi cell of a lattice is a zonotope if and only if its Delaunay tiling is a dicing. More precisely, the tiling $\mathcal{{D}}_\varLambda$ induced by the Delaunay polytopes of $\varLambda$ is equal to the tiling induced by the hyperplane arrangement of a dicing $\mathfrak {D}= \mathfrak {D}(D,E)$ with normals $D = \{\pm d_1,\ldots ,\pm d_r\}$ and edge vectors $E = \{\pm e_1,\ldots ,\pm e_s\}$. By the duality of the Delaunay and the Voronoi tiling, an edge of $\mathcal{{D}}_\varLambda$ containing the origin corresponds to a facet normal of the Voronoi cell $\mathcal {V}_\varLambda$. Therefore, the edge vectors E are precisely the Voronoi relevant vectors of $\varLambda$.

Now, choosing n linearly independent normal vectors, say $d_1,\ldots ,d_n \in D$, the properties (E1) and (E2) imply the existence of edge vectors, say $e_1,\ldots ,e_n \in E$, such that $d_i^\intercal e_j = \delta _{ij}$, with $\delta _{ij}$ being the Kronecker delta. Moreover, the set $B = \{e_1,\ldots ,e_n\}$ is a basis of $\{x \in \mathbb {R}^n : d_i^\intercal x \in \mathbb {Z}, 1 \le i \le n \}$, which by property E2) equals the whole lattice $\varLambda$. Hence, $\{d_1,\ldots ,d_n\}$ is the dual basis of B and every Voronoi relevant vector $v \in \mathcal {F}_\varLambda = E$ fulfills $d_i^\intercal v \in \{0,\pm 1\}$. In view of Lemma 1 (iii), this means that B is a compact basis of $\varLambda$ consisting of Voronoi relevant vectors, as desired.    $\square$

Proof

(Corollary 1). By Proposition 1(ii), every lattice of rank $\le 3$ has a compact basis. Thus, let $\varLambda \subseteq \mathbb {R}^4$ be of full rank. If $\varLambda$ is zonotopal, then by Theorem 3 $c(\varLambda )=1$. Voronoi’s reduction theory shows that if $\varLambda$ is not zonotopal, then its Voronoi cell $\mathcal {V}_\varLambda$ has the 24-cell as a Minkowski summand (cf. [28, Ch. 3]). Up to isometries and scalings, the only lattice whose Voronoi cell is combinatorially equivalent to the 24-cell, is the root lattice $D_4$. Thus, we have a decomposition $\mathcal {V}_\varLambda = \mathcal {V}_\varGamma + Z(U)$, for some generators $U=\{u_1,\ldots ,u_r\} \subseteq \mathbb {R}^4$ and a lattice $\varGamma$ that is isometric to $D_4$. Hence, by Proposition 2, we get $c(\varLambda ) \le \chi (\varLambda ) \le \chi (\varGamma ) = \chi (D_4)$. Engel et al. [11] computed that $\chi (D_4) = 1$, which finishes our proof.    $\square$