On the Lattice Isomorphism Problem

We study the Lattice Isomorphism Problem (LIP), in which given two lattices L_1 and L_2 the goal is to decide whether there exists an orthogonal linear transformation mapping L_1 to L_2. Our main result is an algorithm for this problem running in time n^{O(n)} times a polynomial in the input size, where n is the rank of the input lattices. A crucial component is a new generalized isolation lemma, which can isolate n linearly independent vectors in a given subset of Z^n and might be useful elsewhere. We also prove that LIP lies in the complexity class SZK.Comment: 23 pages, SODA 201

On the Lattice Isomorphism Problem

Abstract We study the Lattice Isomorphism Problem (LIP), in which given two lattices L 1 and L 2 the goal is to decide whether there exists an orthogonal linear transformation mapping L 1 to L 2 . Our main result is an algorithm for this problem running in time n O(n) times a polynomial in the input size, where n is the rank of the input lattices. A crucial component is a new generalized isolation lemma, which can isolate n linearly independent vectors in a given subset of Z n and might be useful elsewhere. We also prove that LIP lies in the complexity class SZK

On the Lattice Distortion Problem

We introduce and study the \emph{Lattice Distortion Problem} (LDP). LDP asks how "similar" two lattices are. I.e., what is the minimal distortion of a linear bijection between the two lattices? LDP generalizes the Lattice Isomorphism Problem (the lattice analogue of Graph Isomorphism), which simply asks whether the minimal distortion is one. As our first contribution, we show that the distortion between any two lattices is approximated up to a $n^{O(\log n)}$ factor by a simple function of their successive minima. Our methods are constructive, allowing us to compute low-distortion mappings that are within a $2^{O(n \log \log n/\log n)}$ factor of optimal in polynomial time and within a $n^{O(\log n)}$ factor of optimal in singly exponential time. Our algorithms rely on a notion of basis reduction introduced by Seysen (Combinatorica 1993), which we show is intimately related to lattice distortion. Lastly, we show that LDP is NP-hard to approximate to within any constant factor (under randomized reductions), by a reduction from the Shortest Vector Problem.Comment: This is the full version of a paper that appeared in ESA 201

Lattice map for Anderson t-motives : first approach

There exists a lattice map from the set of pure uniformizable Anderson t-motives to the set of lattices. It is not known what is the image and the fibers of this map. We prove a local result that sheds the first light to this problem and suggests that maybe this map is close to 1 -- 1. Namely, let $M(0)$ be a t-motive of dimension $n$ and rank $r=2n$ \ --- \ the $n$-th power of the Carlitz module of rank 2, and let $M$ be a t-motive which is in some sense "close" to $M(0)$. We consider the lattice map $M \mapsto L(M)$, where $L(M)$ is a lattice in $C^n$. We show that the lattice map is an isomorphism in a "neighborhood" of $M(0)$. Namely, we compare the action of monodromy groups: (a) from the set of equations defining t-motives to the set of t-motives themselves, and (b) from the set of Siegel matrices to the set of lattices. The result of the present paper gives that the size of a neighborhood, where we have an isomorphism, depends on an element of the monodromy group. We do not know whether there exists a universal neighborhood. Method of the proof: explicit solution of an equation describing an isomorphism between two t-motives by a method of successive approximations using a version of the Hensel lemma.Comment: 26 pages. Minor improvement

Hull Attacks on the Lattice Isomorphism Problem

The lattice isomorphism problem (LIP) asks one to find an isometry between two lattices. It has recently been proposed as a foundation for cryptography in two independent works [Ducas & van Woerden, EUROCRYPT 2022, Bennett et al. preprint 2021]. This problem is the lattice variant of the code equivalence problem, on which the notion of the hull of a code can lead to devastating attacks. In this work we study the cryptanalytic role of an adaptation of the hull to the lattice setting, namely, the $s$-hull. We first show that the $s$-hull is not helpful for creating an arithmetic distinguisher. More specifically, the genus of the $s$-hull can be efficiently predicted from $s$ and the original genus and therefore carries no extra information. However, we also show that the hull can be helpful for geometric attacks: for certain lattices the minimal distance of the hull is relatively smaller than that of the original lattice, and this can be exploited. The attack cost remains exponential, but the constant in the exponent is halved. This second result gives a counterexample to the general hardness conjecture of LIP proposed by Ducas & van Woerden. Our results suggests that one should be very considerate about the geometry of hulls when instantiating LIP for cryptography. They also point to unimodular lattices as attractive options, as they are equal to their dual and their hulls, leaving only the original lattice to an attacker. Remarkably, this is already the case in proposed instantiations, namely the trivial lattice $\mathbb{Z}^n$ and the Barnes-Wall lattices

An equivalence of two constructions of permutation-twisted modules for lattice vertex operator algebras

The problem of constructing twisted modules for a vertex operator algebra and an automorphism has been solved in particular in two contexts. One of these two constructions is that initiated by the third author in the case of a lattice vertex operator algebra and an automorphism arising from an arbitrary lattice isometry. This construction, from a physical point of view, is related to the space-time geometry associated with the lattice in the sense of string theory. The other construction is due to the first author, jointly with C. Dong and G. Mason, in the case of a multi-fold tensor product of a given vertex operator algebra with itself and a permutation automorphism of the tensor factors. The latter construction is based on a certain change of variables in the worldsheet geometry in the sense of string theory. In the case of a lattice that is the orthogonal direct sum of copies of a given lattice, these two very different constructions can both be carried out, and must produce isomorphic twisted modules, by a theorem of the first author jointly with Dong and Mason. In this paper, we explicitly construct an isomorphism, thereby providing, from both mathematical and physical points of view, a direct link between space-time geometry and worldsheet geometry in this setting.Comment: 35 pages. Further exposition added, with the referee's helpful comments taken into account. Final version to appear in Journal of Pure and Applied Algebr

On the Complexity of Polytope Isomorphism Problems

We show that the problem to decide whether two (convex) polytopes, given by their vertex-facet incidences, are combinatorially isomorphic is graph isomorphism complete, even for simple or simplicial polytopes. On the other hand, we give a polynomial time algorithm for the combinatorial polytope isomorphism problem in bounded dimensions. Furthermore, we derive that the problems to decide whether two polytopes, given either by vertex or by facet descriptions, are projectively or affinely isomorphic are graph isomorphism hard. The original version of the paper (June 2001, 11 pages) had the title ``On the Complexity of Isomorphism Problems Related to Polytopes''. The main difference between the current and the former version is a new polynomial time algorithm for polytope isomorphism in bounded dimension that does not rely on Luks polynomial time algorithm for checking two graphs of bounded valence for isomorphism. Furthermore, the treatment of geometric isomorphism problems was extended.Comment: 16 pages; to appear in: Graphs and Comb.; replaces our paper ``On the Complexity of Isomorphism Problems Related to Polytopes'' (June 2001