A Note on the Concrete Hardness of the Shortest Independent Vector in Lattices

Blömer and Seifert [9] showed that $\mathsf{SIVP}_{2}$ is NP-hard by giving a reduction from $\mathsf{CVP}_{2}$ to $\mathsf{SIVP}_{2}$. This reduction can easily be extended to all $\ell_{p}$ norms, and increases the rank of the lattice by $1$. Thus, combined with the SETH hardness result from [8, ABGS19], it implies the following observation.

A closer look at their reduction reveals that it cannot be extended to showing NP-hardness of approximate $\mathsf{SIVP}$ directly (even though $\mathsf{CVP}$ is known to be NP-hard for almost polynomial approximation factors). The reason for this is that for the lattice $\mathcal{L}$, when given as a part of a $\mathsf{CVP}$ instance, $\lambda_{n}(\mathcal{L})$ might be much larger than the distance of the target from the lattice, in which case, an oracle for approximating $\mathsf{SIVP}$ up to a constant factor, does not tell anything about the distance of the target from the lattice.

To overcome this difficulty, it was shown in  [9] that the $\mathsf{CVP}$ instance obtained from a reduction from the minimum label cover problem has a guarantee that for the CVP instance $(\mathcal{L},\mathbf{t})$, $\lambda_{n}(\mathcal{L})$ is “not much larger” than the distance of $\mathbf{t}$ from $\mathcal{L}$.

We introduce a new computational problem called the Gap Closest Vector Problem with Bounded Minima ($\mathsf{GapCVP}^{\tau}$), which captures the above mentioned requirement on the CVP instance that $\lambda_{n}(\mathcal{L})$ has an upper bound depending on the parameter $\tau$. We observe that the reduction from $\mathsf{Gap\text{-}3\text{-}SAT}$ to $\mathsf{GapCVP}$ in [8] (which implies hardness of $\mathsf{GapCVP}$) is actually a reduction from $\mathsf{Gap\text{-}3\text{-}SAT}$ to $\mathsf{GapCVP}^{\tau}$ for an appropriate choice of $\tau$. We then show a reduction similar to [9] from $\mathsf{GapCVP}^{\tau}$ to $\mathsf{SIVP}$, which implies the following result.

Let $\mathbb{R}^{n}$ be a real vector space, with an $\ell_{p}$-norm on the vectors such that $\vec{v}\in\mathbb{R}^{n},\left\lVert\vec{v}\right\rVert_{p}^{p}:=\sum_{i=1}^{n}|\vec{v}_{i}|^{p}$.

A lattice $\mathcal{L}\subset\mathbb{R}^{d}$ is the set of integer linear combinations

of linearly independent basis vectors $\mathbf{B}=(\vec{b}_{1},\ldots,\vec{b}_{n})\in\mathbb{R}^{d\times n}$. We call $\mathbf{B}$ a basis of the lattice $\mathcal{L}$, $n$ the rank of the lattice, and $d$ the dimension of the lattice $\mathcal{L}$. If $n=d$, then we say that the lattice is full-rank.

Since we wish to have inputs of bounded size, we assume that the coordinates of lattice vectors are rational numbers. Moreover, by appropriately scaling the lattice, we assume without loss of generality, that a $d$-dimensional lattice $\mathcal{L}$ is generated by basis vectors from $\mathbb{Z}^{d}$.

For a lattice $\mathcal{L}$ of rank $n$, for $1\leq i\leq n$, we denote by $\lambda_{i}^{(p)}(\mathcal{L})$ the $i^{th}$ successive minimum which is the smallest $\ell$ such that there are $i$ linearly independent lattice vectors that have $\ell_{p}$ norm at most $\ell$. More formally,

We omit the superscript in $\lambda_{i}^{(p)}$, when the norm is clear from the context.

Minkowski’s second theorem states the following with regards to the successive minima:

Gap-Closest Vector Problem ($\gamma$-$\mathsf{GapCVP}_{p}$): Given a lattice $\mathcal{L}$, a target vector $\vec{t}\in\mathbb{Z}^{n}$ (which may or may not be in the lattice) and a value $r>0$, output YES if there exists a vector $\vec{v}$ in the lattice such that $\left\lVert\vec{v}-\vec{t}\ \right\rVert_{p}\leq r$ (i.e. the closest vector in the lattice to the vector $\vec{t}$ has a distance less than $r$ to the target), and output NO if all the vectors in the lattice have distance greater than $\gamma\cdot r$ to the target.

Gap-Closest Vector Problem with Bounded Minima ($\gamma$-$\mathsf{GapCVP}_{p}^{\tau}$): Given a lattice $\mathcal{L}$, a target vector $\vec{t}\in\mathbb{Z}^{n}$ (which may or may not be in the lattice) with the added guarantee that $\lambda_{n}(\mathcal{L})^{p}\leq\tau r^{p}$, and a value $r$ output YES if there exists a vector $\vec{v}$ in the lattice such that $\left\lVert\vec{v}-\vec{t}\ \right\rVert_{p}\leq r$ (i.e. the closest vector in the lattice to the vector $\vec{t}$ has a distance less than $r$ to the target), and output NO if all the vectors in the lattice have distance greater than $\gamma\cdot r$ to the target.

Gap-Shortest Independent Vector Problem ($\gamma$-$\mathsf{SIVP}_{p}$): Given a lattice $\mathcal{L}$, and value $r$, output YES if there exists a set of linearly independent vectors $\{\vec{v}_{1},\vec{v}_{2},...,\vec{v}_{n}\}$ that are in $\mathcal{L}$ such that $\max_{i=1}^{n}\|\vec{v}_{i}\|_{p}\leq r$, and output NO if for all such sets, $\max_{i=1}^{n}\|\vec{v}_{i}\|_{p}>\gamma r$.

If we want to talk about the exact variant of these problems (i.e., $\gamma=1$), then we will omit the prefix $\gamma$.

$\mathsf{k\text{-}SAT}$: Given a boolean formula in conjunctive normal form over $n$ variables, i.e. as a conjunction of $m$ clauses where each clause is a disjunction of $k$ literals, decide if there is an assignment of the $n$ variables such that the boolean formula evaluates to true.

$(\delta,\>\varepsilon)$-$\mathsf{Gap\text{-}k\text{-}SAT}$: Given a boolean formula in conjunctive normal form with each clause having $k$ literals, and two parameters $0\leq\delta<\varepsilon\leq 1$, output YES if there exists an assignment such that it satisfies at least $\varepsilon$ fraction of the clauses, and output NO if no assignment satisfies more than $\delta$ fraction of the clauses. For convenience at times the ($\delta$, $\varepsilon$)-prefix may be omitted when it is clear from the context.

The following hypotheses were introduced in [15], and will be the basis of our hardness results.

Additionally, [10] and [20] introduced a “gap” version of ETH. The following formulation is from [8].

Additionally, Bennett et al. used Dinur’s result in [10] to derive the following result:

This implies it is almost always possible to reduce the number of clauses in $(\delta,1)$-$\mathsf{Gap\text{-}k\text{-}SAT}$ instances so that reductions that run linear in $m$ may also be considered linear in $n$, so that Gap-ETH may still apply. However, since the reduction is randomised, existence of sub-exponential time algorithms that solve the resulting instances only imply the existence of randomised sub-exponential time algorithms for $(\delta,1)$-$\mathsf{Gap\text{-}k\text{-}SAT}$ in the general case (i.e. when $m=\omega(n))$.