2. SVP in Hard to Approximate to within some constant Based on Article by Daniele Micciancio - 1998 IEEE Symposium on Foundations of Computer Science (FOCS ‘98)

3. OverviewCVP NP-hard to approximate  app. alg. 1O(logn) n O(1) 2 n/2 O(1) 22 1+1/n  2 loglog n n 1/ loglog n SVP  app. alg.

4. Approximate SVP & CVP GapSVP g (B,d) B is a Lattice base in R n, d  R –Yes Instances  z  Z n \{0} || Bz ||  d –No Instances  z  Z n \{0} || Bz || > gd GapCVP g (B,y,d) B  Z kxn, y  R k, d  R Yes Instances  z  Z n || Bz - y||  d No Instances  z  Z n || Bz - y|| > gd We actually want to prove: GapSVP  2 is NP-Hard

5. n GapCVP g (B,y,d) B  Z kxn, y  R k, d  R –Yes Instances  z  {0,1} n || Bz - y||  d –No Instances  z  Z n, w  Z n \{0}|| Bz - wy|| > gd Modified CVP GapCVP and GapCVP’ were proven NP-Hard[Babai97] We show a reduction GapCVP c (B,y,d)  GapSVP g (V,t) g=  2(1+2  ) c=  2/  ) t=  1+2 

6. n There is a probabilistic ploy-time algorithm which creates  >0, for input 1 k (input size k) the following: Sauer’s Lemma s.t. with probability arbitrarily close to 1 -  z  Z m || Lz|| 2 > 2 -  x  {0,1} m,  z  Z m s.t. Cz=x and ||Lz-s|| > 1+  LatticeL  R (m+1) x m Vectors  R (m+1) MatrixC  Z k x m 0 -b -s   logP 1  logP 2  logP m  0 0 logP 1  logP m L m+1 x m+1 -y-y  CVP lattice BnxkBnxk ° CkxmCkxm y  Z n, B  Z nxk

7. Sauer’s Lemma Sauer’s Lemma (visualization) Copied from Micc98 article.

8. Proving GapSVP NP-hardness (B,y,d) and c =  (2/  )  (V,t) and g =  (2/1+2  ) t =  (2/1+2  )  =  /d Yes Instance 1. (B,y,d) is Yes Instance   a s.t. ||Va|| 2 < t 2 0 b   logP 1  logP 2  logP m  0 0 logP 1  logP m  =  /d BnxkBnxk ° CkxmCkxm -y-y V =  a=[z 1]  Z m+1 (for some z  Z m) ||Va|| 2 = ||Lz-s|| 2 +  2 ||Bx-y|| 2 t 2  1+2  = t 2 1+     /d 2  d 2

9. Proving GapSVP NP-hardness (cont) (B,y,d) and c=  (2/  )  (V,t) and g=  (2/1+2  ) No Instance 2. (B,y,d) is No Instance  a=[z w] z  Z m ||Va|| 2 > g 2 t 2 = 2 ||Va|| 2 > ||Lz|| 2 > 2 !! z  0 I. w=0 without CVP help II. w  0 with CVP help ||Va|| 2 >  2 ||Bz-wy|| 2   2 c 2 d 2 = 2  /d 2 2/  0 b -y-y  logP 1  logP 2  logP m  0 0 logP 1  logP m BnxkBnxk ° CkxmCkxm [ z w ]   =  /d