The Closest Vector is Hard to Approximate and now, for unlimited time only with Pre - Processing !! Nisheeth vishnoi Subhash Khot Michael Alekhnovich Joint work with Guy Kindler Microsoft Research

In this talk: In this talk: Lattices Lattices The closest vector problem: background The closest vector problem: background Our results: NP-hardness for CV-PP Our results: NP-hardness for CV-PP Proving hardness with preprocessing Proving hardness with preprocessing Something about our proof: new property of PCPs Something about our proof: new property of PCPs

 A lattice, L: A discrete additive subgroup of R n.  A basis for L: b 1,…,b n 2 R n, s.t. L={  i a i b i : a 1,..,a n 2 Z }.

The Closest Vector Problem ( CVP )

 CVP : Given a lattice L and a target vector t, find the point in L closest to t in  l p distance.  [Regev Ronen 05] Hardness results in l 2 carry for any l p.  [Ajtai Kumar Sivakumar 01]: 2 O(nloglog(n)/log n) =2 o(n) approx.  [Dinur Kindler Raz Safra 98]: n O(1/loglog n) =n o(1) hardness.  [Lagarias Lenstra Schnorr 90, Banaszczyk 93, Goldreich Goldwasser 00, Aharonov Regev 04] NP-hardness of (n/log n) 1/2 would collapse the polynomial hierarchy.

Motivation for studying CVP  [Ajtai 96]: Worst case to average case reductions for lattice problems.  [Ajtai Dwork 97] Based cryptosystems on lattice problems.  [Goldreich Goldwasser Halevi 97] Cryptosystem based on CVP.  [Micciancio Vadhan 03] Identification scheme based on (n/log n) 1/2 hardness for CVP. t L t – message. L – coding function: known in advance, and reused.

Is it safe to reuse L as key?  CV-PP : Preprocess L for unlimited time, Given t, solve CVP on L,t.  [Kannan 87, Lagarias Lenstra Schnorr 90, Aharonov Regev ] O(n 1/2 )-approx. for CV-PP.  [Feige Micciancio 02] (5/3) 1/p approx. hardness for CV-PP.  [Regev 03] 3 1/p approx. hardness for CV-PP.

Our Results  Thm: CV-PP in NP-hard(!) to approximate within any constant. Also applies to NC-PP.  Unless NP µ DTIME(2 polylog n ), NC-PP is hard to approximate within (log n) 1-  NC-PP is hard to approximate within (log n) 1-  CV-PP is hard to approximate within (log n) (1/p)-  CV-PP is hard to approximate within (log n) (1/p)-   1st Proof : By reduction from E-k-HVC [DGKR 03].  2nd proof: Using PCP-PP constructions, plus smoothing technique of [Khot 02].

Proving hardness with preprocessing  Hardness of approximation within gap g: I 2 ¦ ) dist(t,L) · d I  ¦ ) dist(t,L) ¸ d ¢ g I : Instance of ¦ 2 NPC Reduction L, t

Proving hardness with preprocessing I : Instance of ¦ 2 NPC Reduction L, t  Hardness of approximation within g, with preprocessing: Size of I Partial Input Generator Preprocessed L CV-PP t t I 2 ¦ ) dist(t,L) · d I  ¦ ) dist(t,L) ¸ d ¢ g  Hardness of approximation within gap g:

Size of I Partial Input Generator I : Instance of ¦ 2 NPC Reduction PCP with preprocessing ( PCP-PP ) Preprocessed L t t CV-PP LEFT RIGHT PCP-PP I 2 ¦ ) dist(t,L) · d I  ¦ ) dist(t,L) ¸ d ¢ g  PCP : Gap version of Q uadratic equations. x 2 +2xy=7 x 2 +z 2 =5..

Size of I Partial Input Generator I : Instance of ¦ 2 NPC Reduction PCP with preprocessing ( PCP-PP ) LEFT RIGHT PCP-PP I 2 ¦ ) opt(LEFT,RIGHT)=1 I  ¦ ) opt(LEFT,RIGHT) · c<1  PCP : Gap version of Q uadratic equations. x 2 +2xy=7 x 2 +z 2 =5..

Size of I Partial Input Generator I : Instance of ¦ 2 NPC Reduction PCP with preprocessing ( PCP-PP ) LEFT RIGHT PCP-PP  PCP : Gap version of Q uadratic equations.

Size of I I : Instance of ¦ 2 NPC PCP with preprocessing ( PCP-PP ) LEFT RIGHT Preprocessed L t t CV-PP  PCP : Gap version of Q uadratic equations. PCP-PP

PCP with preprocessing ( PCP-PP ) LEFT RIGHT PCP-PP  PCP : Gap version of Q uadratic equations.

PCP-PP construction LEFT RIGHT PCP-PP  PCP : Gap version of Q uadratic equations. Just (carefully) apply usual PCP construction!

Open problems  Get better hardness parameters for CV-PP (perhaps using methods from [DKRS 98] ).  Get improved hardness results for lattice problems, under stronger assumptions than NP  P.  Find more uses for PCP-PP constructions.