<?xml version="1.0" encoding="iso-8859-1"?>
<?xml-stylesheet href="paper.xsl" type="text/xsl"?>

<paper xmlns="http://www.cse.ucsd.edu/daniele/XML">

  <filename>LatticeHash</filename>

  <title>Almost perfect lattices, the covering radius problem, and
  applications to Ajtai's connection factor</title>

  <author>Daniele Micciancio</author>

  <reference>
    <link>http://epubs.siam.org/sam-bin/dbq/toclist/SICOMP</link>
    <journal>SIAM J. on Computing</journal>
    <volume>34</volume>
    <number>1</number>
    <pages>118-169</pages>
    <year>2004</year>
    <note>Preliminary version in STOS 2002</note>
    <doi>10.1137/S0097539703433511</doi>
  </reference>

  <abstract> 
    <p xmlns="http://www.w3.org/1999/xhtml">
      Lattices have received considerable attention as a potential
      source of computational hardness to be used in cryptography,
      after a breakthrough result of <cite>[Ajtai, STOC 1996]</cite>
      connecting the average-case and worst-case complexity of various
      lattice problems. The purpose of this paper is twofold. On the
      expository side, we present a rigorous self contained proof of
      results along the lines of Ajtai's seminal work.  At the same
      time, we explore to what extent Ajtai's original results can be
      quantitatively improved. As a by-product, we define a random
      class of lattices such that computing short nonzero vectors in
      the class with non-negligible probability is at least as hard as
      approximating the length of the shortest nonzero vector in
      <em>any</em> n-dimensional lattice within worst-case
      approximation factors <em>gamma(n)=n<sup>3</sup> omega(sqrt{log
      n log log n})</em>.  This improves previously known best
      connection factor <em>gamma(n)=n<sup>4+epsilon</sup></em> 
      <cite>[Cai and Nerurkar, FOCS 1997]</cite> by more that
      <em>omega(n)</em>. We also show how our reduction implies the
      existence of collision resistant cryptographic hash functions
      based on the worst-case inapproximability of the shortest vector
      problem within factors <em>gamma(n)= n<sup>3</sup>
      omega(sqrt{log n log log n})</em>.

      In the process we distill various new lattice problems that
      might be of independent interest, related to the covering
      radius, the bounded distance decoding problem, approximate
      counting of lattice points inside convex bodies, and the
      efficient construction of lattices with good geometric and
      algorithmic decoding properties. We also show how further
      investigation of these new lattice problems might lead to even
      stronger connections between the average-case and worst-case
      complexity of the shortest vector problem, possibly leading to
      connection factors as low as 
      <em>gamma(n)=n<sup>1.5</sup> omega(log n)</em>.
    </p>
  </abstract>
    
  <note>Preliminaty versions in <eccc year="2003" number="TR03-066"/>,
  <link doi="10.1145/509907.509995">STOC 2002</link> and 
  <link doi="10.1109/CCC.2002.1004324">CCC 2002</link>
  </note>
</paper>
