Finding the closest lattice vector when it's unusually close

Abstract

1 I n t r o d u c t i o n The closest lattice vector problem, also called the nearest lattice point problem, is NP-hard [2], and no polynomialt ime approximat ion algori thm is known with a performance ratio bet ter than exponential. It seems worthwhile to identify circumstances in which the problem can be solved optimally. As an example of where this arises, Furst and Kannan [3] give a distribution of n-dimensional instances of SubsetSum problems for which there is an a lgor i thm that runs in polynomial t ime almost always. One ingredient in their result is an algori thm that, given a vector v and a basis of a lattice, finds the vector in the lattice that is closest to to v assuming the following condition holds: the distance from v to the lattice is less than half the length of the shortest Gram-Schmidt vector. Indeed, they show that, assuming this condition holds, there is a unique vector closest to v. Here the Gram-Schmidt vectors corresponding to a basis b x , . . . , b n are the vectors b i , . . . ,bin where b~ is the projection of b | orthogonal to the vector space generated by b l , . . . , b i -x . These are the vectors found by the Gram-Schmidt algori thm for orthogonalization. 1 Our result can be viewed as a generalization of this a lgor i thm-there is an algori thm that for any given k --*r-esearch s u p p o r t e d by NSF G r a n t CCR-9700146. 1Often the G r a m S c h m i d t a l g o r i t h m is used to find an orthonormal basis , i.e. where the o u t p u t vectors have n o r m 1. Here we a s sume no such n o r m a l i z a t i o n is performed. runs in n k2+O(1) t ime and that finds the closest vector to v if the following condition holds: the distance from v to the lattice is at most k times the length of the shortest Gram-Schmidt vector. 1.1 R e l a t e d r e s u l t s Some related results will help to put our result in perspective. For comparison, Kannan [5] gives a closestvector algori thm that runs in t ime poly(n)n n where n is the dimension of the lattice. Thus the algorithm presented here is only useful when k = o ( v ~ ) . On the other hand, as mentioned above, Furst and Kannan gave an algorithm that runs in polynomial t ime and finds the closest vector when k 1/2. For any lattice basis and any vector v, the distance of v from the lattice is no more than half the sum of the lengths of the Gram-Schmidt vectors; furthermore, this bound is achievable. Thus our algori thm is useful only when the vector v is unusually close to the lattice. How small can the smallest Gram-Schmidt vector be? One can choose a lattice and a basis for it so as to make the smallest Gram-Schmidt vector arbitrarily small in comparison to the shortest vector in the lattice. On the other hand, Lagarias, Lenstra, and Sehnorr [6] have shown that for every lattice there exists a basis (the Korkin-Zolotarev basis) where the smallest GramSchmidt vector is at least 3/2n times the length of the shortest vector in the lattice. Even in this case, for our algorithm to be useful, the distance between the input vector and the lattice must be significantly less than the length of the shortest vector. 2 N o t a t i o n We use the following notation. Vectors are signified by bold face. For vectors b l , . . . , b n , we denote by V ( b l , . . . , bn) the vector space generated by these vectors, and we denote by L ( b l , . . . , b n ) the lattice they generate. The Gram-Schmidt vectors corresponding to b x , . . , bn are denoted b I . . . . ,btn. By definition, b~