10

A recent eprint paper claims to bound $\lambda_1(\Lambda^\perp(\mathbf{A}))$ for $\mathbf{A}\in\mathbb{Z}^{n\times m}$, a uniformly random matrix, by $O(1)$, specifically by $4$. This has applications to solving $\mathsf{SIS}_{n,m,q,4}$ in $\mathsf{P}$.

I'm no expert in this area, but it seems to me this contradicts the common thought that $\lambda_1(\Lambda^\perp(\mathbf{A})) = \Omega(\sqrt{n\log q})$ (see, for example, section 2.4.2 of this paper).

As getting into the details of the recent paper is likely off topic for this forum, I'm interested instead in another question --- what concrete/experimental evidence has been collected for the asymptotics of $\lambda_1(\Lambda^\perp(\mathbf{A}))$? Looking into data such as this would be an easy way to gain intuition for whether we're in an $O(1)$ regime or $\Omega(\sqrt{n\log q})$ one, and I had assumed that someone had papers along these lines, but don't actually recall seeing any of it myself.

Ella Rose
  • 19,971
  • 6
  • 56
  • 103
Mark Schultz-Wu
  • 15,089
  • 1
  • 22
  • 53

2 Answers2

15

The first inequality at the bottom of page 3 of the paper is false. For example, Conway and Thompson proved the existence of "self-dual" $n$-dimensional lattices $L$ (i.e., $L^* = L$) where $\lambda_1(L) = \lambda_1(L^*) = \Omega(\sqrt{n})$, hence $\eta_{2^{-n}}(L) = O(1)$ but $\tilde{bl}(L) \geq \lambda_1(L) = \Omega(\sqrt{n})$.

The statement and proof of Conway and Thompson's result can be found as Theorem 9.5 in https://www.springer.com/us/book/9783642883323 .

Chris Peikert
  • 5,893
  • 1
  • 26
  • 28
13

Independently of the algorithmic claim, I indeed have serious doubts about Theorem 2. Here is a counterargument (using standard techniques) cooked up with Yang Yu and Wessel van Woerden:

Suppose that $q$ is prime, and suppose that the minimum distance in the 2-norm is indeed bounded by $b=O(1)$. There are at most $Binom[m,b] \cdot (2b+1)^b = poly(m)$ elements x in $\mathbb Z^m \setminus \{0\}$ with $||x||^2_2 \leq b$. But every such vector has only probability $q^{-n}$ to be part of the lattice over the randomness of $A$. By a union bound this means that the probability that any such vector is part of the lattice over the randomness of $A$ is at most $poly(m) \cdot q^{-n}$ which is negligible unless m itself is exponential in $n$.

LeoDucas
  • 1,466
  • 7
  • 12