On Nearly Orthogonal Lattice Bases and ... - Researcher - IBM

the other basis vectors. Thenλ(L) ≥min ‖b i‖sin θ i . (2)i∈{1,2,...,m}Therefore, a θ-orthogonal basis has a basis vector whose length is no more than λ(L)/sin θ; if θ = π 3 , thisbound becomes 2 λ(L) √3. This shows that nearly orthogonal lattice bases contain short vectors.Gauss proved that in R 2 , every π 3-orthogonal lattice basis indeed contains a shortest lattice vector andprovided a polynomial time algorithm to determine such a basis in a rational lattice; see [32] for a nicedescription. We first show that Gauss’s shortest lattice vector result can be extended to higher-dimensionallattices.Theorem 1 Let B = (b 1 ,b 2 ,... ,b m ) be an ordered basis of a lattice L. If B is weakly ( π3 + ɛ) -orthogonal,for 0 ≤ ɛ ≤ π 6, then a shortest vector in B is a shortest non-zero vector in L. More generally,∥ min ‖b m∑ ∥∥∥∥m∑j‖ ≤uj∈{1,2,...,m} ∥ i b i for all u i ∈ Z with |u i | ≥ 1, (3)i=1with equality possible only if ɛ = 0 or ∑ mi=1 |u i| = 1.Corollary 1 If 0 < ɛ ≤ π 6 , then a weakly ( π3 + ɛ) -orthogonal basis contains every shortest non-zero latticevector (up to multiplication by ±1).Theorem 1 asserts that a θ-orthogonal lattice basis is guaranteed to contain a shortest lattice vector if θ ≥ π 3 .In fact, the bound π 3is tight because for any ɛ > 0, there exist lattices where some θ-orthogonal basis, withθ = π 3 − ɛ, does not contain the shortest lattice vector. For example, consider a lattice in R2 defined by thebasis {b 1 ,b 2 }, with ‖b 1 ‖ = ‖b 2 ‖ = 1, and the angle between them equal to π 3 − ɛ. Obviously b 2 − b 1 haslength less than 1.For a rational lattice defined by some basis B 1 , a weakly π 3 -orthogonal basis B 2 = B 1 U, with U polynomiallybounded in size, provides a polynomial-size certificate for λ(L). However, we do not expect allrational lattices to have such bases because this would imply that NP=co-NP, assuming SVP is NP-complete.For example, the lattice L spanned by the basis⎡ ⎤11 021B = ⎢ 0 1 2 ⎥(4)⎣ ⎦10 0 √2does not have any weakly π 3 -orthogonal basis. It is not difficult to verify that [1 0 0]T is a shortest latticevector. Thus, λ(L) = 1. Now, assume that L possesses a weakly π 3 -orthogonal basis ˜B = (b 1 ,b 2 ,b 3 ). Letθ 1 be the angle between b 2 and b 1 , and let θ 2 be the angle between b 3 and the subspace spanned by b 1 andb 2 . Since b 1 ,b 2 and b 3 have length at least 1,det( ˜B) = ‖b 1 ‖ ‖b 2 ‖ ‖b 3 ‖ |sin θ 1 | |sin θ 2 | ≥ sin 2 π 3 = 3 4 . (5)But det(B) = 1 √2< det( ˜B), which shows that the lattice L with basis B in (4) has no weakly π 3 -orthogonalbasis.Our second observation describes the conditions under which a lattice contains the unique (modulopermutations and sign changes) set of nearly orthogonal lattice basis vectors.i=14