New bounds of the smoothing parameter for lattices

TL;DR

This paper improves the upper bound of the smoothing parameter in lattice-based cryptography, making it more efficient for practical use.

Contribution

A new upper bound for the smoothing parameter is established, improving upon classical results for both low and high-dimensional lattices.

Findings

A more precise upper bound is achieved for one-dimensional integer lattices under optimized conditions.

A new upper bound is derived for high-dimensional lattices with large dimensions and specific error parameters.

The new bound allows for a smaller and more natural error parameter setting in practical cryptographic applications.

Abstract

The smoothing parameter on lattices is crucial for lattice-based cryptographic design. In this study, we establish a new upper bound for the lattice smoothing parameter, which represents an improvement over several significant classical findings. For one-dimensional integer lattices, under specific and optimized conditions, we have achieved a more precise upper bound compared to previous research. Regarding general high-dimensional lattices, when the lattice dimension is large enough and the error parameter is within a particular range, we have derived a new upper bound. In the practical applications of lattice-based cryptography, where the lattice dimension is typically large, our new bound enables a more natural and smaller setting for the error parameter, thereby improving the upper bounds on all known smoothing parameters.

Figures

Equations

Full text

1 Introduction

In recent decades, the concept of a lattice has played a crucial role in post-quantum cryptography [1]. An n-dimensional (full-rank) lattice can be regarded as a discrete additive subgroup of $[eqn]$ or a $[eqn]$ -module. Specifically, a lattice $[eqn]$ can be written as

$$[eqn]$$

where $[eqn]$ is a matrix composed of n linearly independent vectors, known as the generating matrix of lattice $[eqn]$ , and $[eqn]$ is called a basis for the lattice. The dual lattice $[eqn]$ of a lattice $[eqn]$ is defined as:

$$[eqn]$$

Lattice-based cryptography relies on the assumption that certain problems on lattices in $[eqn]$ are hard, which serves as the cornerstone of secure cryptographic systems. Two of the most typical hard problems are the Shortest Vector Problem (SVP) and the Closest Vector Problem (CVP). It is currently believed that hard problems on lattices can effectively withstand quantum attacks. As a result, public-key cryptosystems based on lattice-based hard problems have become fundamental approaches and technologies in the field of post-quantum cryptography.

In lattice-based cryptography research, the discrete Gaussian measure defined on lattices is a highly important analytical tool. The discrete Gaussian measure was first used for this purpose by Regev and Micciancio [2,3] and was also developed on the basis of Banaszczyk’s proof of the transference theorems [4–6]. In [3], Micciancio and Regev defined an important concept related to the discrete Gaussian measure: the smoothing parameter $[eqn]$ . For any arbitrary n-dimensional lattice $[eqn]$ and any given $[eqn]$ , the smoothing parameter of lattice $[eqn]$ is defined as:

$$[eqn]$$

where $[eqn]$ is the discrete Gaussian distribution, which is defined formally in Definition 4. With the advancement of lattice cryptography, the smoothing parameter plays an increasingly crucial role in lattice sampling and hardness reductions (for details, see [3,7–10]). It can be argued that the concept of the smoothing parameter is equally important to the shortest vector, the successive minima of a lattice, and the covering radius.

In the study of smoothing parameters, one of the most important tasks is the estimation of bounds for the smoothing parameter. This is because, in lattice-based cryptography, improving the upper bound of the smoothing parameter generally enhances the security proofs of cryptographic systems and optimizes parameter settings, thereby improving the efficiency of cryptographic schemes (for details, see [3,7,8,10]). The originators of the smoothing parameter, Regev and Micciancio, first provided two estimation results in [3]. The first one is: for any lattice $[eqn]$ ,

$$[eqn]$$

where $[eqn]$ . In [11] (see Chapter 1), Zheng and Tian provided two tighter results under the same conditions:

$$[eqn]$$

where $[eqn]$ . Regev and Micciancio provided the second non-trivial but very important conclusion in [3]:

$$[eqn]$$

where $[eqn]$ is the n-th successive minimum. Subsequently, in [12], Peikert combined the conclusion from Banaszczyk [5] to provide a tighter bound for $[eqn]$ under the $[eqn]$ -norm:

$$[eqn]$$

Let $[eqn]$ be a basis of $[eqn]$ , $[eqn]$ is the Gram-Schmidt orthogonalization of $[eqn]$ Define $[eqn]$ as :

$$[eqn]$$

In [8], Gentry, Peikert, and Vaikuntanathan established the result

$$[eqn]$$

thus, they derived a new bound:

$$[eqn]$$

Among (1), (2), and (3), it is evident that (2) provides the best estimate.

In recent research [13], Zhongxiang Zheng, Guangwu Xu, and Chunhuan Zhao derived an estimate of the smoothing parameter for the one-dimensional integer lattice $[eqn]$ :

$$[eqn]$$

with $[eqn]$ . Next, they established a relationship between the one-dimensional integer lattice $[eqn]$ and a general lattice $[eqn]$ , achieving significant improvements when $[eqn]$ :

$$[eqn]$$

In other works [10,14–17], Kai-Min Chung et al. approximated the complexity of the smoothing parameter within a constant factor [15]. Thomas Espitau et al. [10], Wei et al. [14], Elena Kirshanova et al. [16], and Zheng Zhiyong et al. [17] provided corresponding bounds for the smoothing parameter for certain special lattices. Each of these results has had a significant impact in its respective article.

Contributions. In this paper, we obtain a new upper bound. First, for the one-dimensional integer lattice $[eqn]$ , when $[eqn]$ , where $[eqn]$ , we have:

$$[eqn]$$

Secondly, for a general n-dimensional lattice $[eqn]$ , when n is sufficiently large such that $[eqn]$ , we have:

$$[eqn]$$

Our results outperform those in [8] and [13], and a detailed discussion will be presented in the section entitled "Comparative Analysis of Smoothness Parameter Bounds".

It is worth noting that, in our proof process, we can derive the following relationship between a general n-dimensional lattice $[eqn]$ and the n-dimensional integer lattice $[eqn]$ :

$$[eqn]$$

Furthermore, we can prove that for the smoothing parameter $[eqn]$ of the n-dimensional integer lattice $[eqn]$ , under the same conditions,

$$[eqn]$$

Organization. The rest of the paper is organized as follows. In the second section, we introduce the necessary basic concepts and preliminary knowledge. In Sect 3, we present the new upper bounds for the smoothing parameter $[eqn]$ of the one-dimensional integer lattice, $[eqn]$ of the n-dimensional integer lattice, and $[eqn]$ of the general n-dimensional lattice. Sect 4 presents a comparison of numerical results. The final part is a summary.

2 Preliminaries

2.1 General notation

The bold capital $[eqn]$ represents the integer ring. The symbol $[eqn]$ denotes the n-dimensional real linear space. Lowercase letters in bold, such as $[eqn]$ and b, represent vectors in $[eqn]$ . The standard inner product in $[eqn]$ is denoted by $[eqn]$ . The Euclidean norm of a vector $[eqn]$ is

$$[eqn]$$

For any $[eqn]$ , if $[eqn]$ denote its columns, then we define

$$[eqn]$$

Let $[eqn]$ denote the unit ball in $[eqn]$ , that is $[eqn]$ . A lattice $[eqn]$ is a discrete geometry in $[eqn]$ , in other words, there is a positive constant $[eqn]$ , and a nonzero vector $[eqn]$ such that

$$[eqn]$$

We call $[eqn]$ the ith successive minimum distance of lattice $[eqn]$ if

$$[eqn]$$

For any lattice $[eqn]$ with basis matrix B whose columns are $[eqn]$ , the set

$$[eqn]$$

is the basic neighborhood of the lattice $[eqn]$ . Therefore, a basic neighborhood $[eqn]$ of a lattice $[eqn]$ is the set of representative elements of the additive quotient group $[eqn]$ , and any basic neighborhood $[eqn]$ of an arbitrary lattice $[eqn]$ forms an additive group $[eqn]$ $[eqn]$ . Let the determinant of the lattice be $[eqn]$ and the volume of basic neighborhood be $[eqn]$ , then $[eqn]$ . If f(x) is a function defined on $[eqn]$ and $[eqn]$ is a countable set, denote $[eqn]$

2.2 Discrete Gaussian measure and related conclusions

In this subsection, we will directly provide the definition and related properties of the discrete Gaussian measure, which will play an important role in the third section.

Definition 1. Let s>0 be a given positive real number, $[eqn]$ be a given vector. With c as the center, the Gaussian function $[eqn]$ with parameter s is defined as:

$$[eqn]$$

Definition 2. If $[eqn]$ , the Fourier transform $[eqn]$ of $[eqn]$ is defined as:

$$[eqn]$$

The following are some of the most commonly used and basic properties of the Fourier transform [11].

Lemma 3. If $[eqn]$ , $[eqn]$ , and $[eqn]$ , then

(1) $[eqn]$

(2) *If $[eqn]$ , then $[eqn]$ *

(3) *If $[eqn]$ , $[eqn]$ , then $[eqn]$ *

Therefore, the Fourier transform of the Gaussian functions $[eqn]$ and $[eqn]$ is: $[eqn]$ and $[eqn]$ , respectively.

Definition 4. Let $[eqn]$ and s>0 be a given positive real number, $[eqn]$ be a given vector. The discrete Gaussian measure $[eqn]$ defined on lattice $[eqn]$ is:

$$[eqn]$$

In other words, $[eqn]$ represents the probability of a single lattice point. Below we provide two very useful lemmas, which are proved in detail in [11].

Lemma 5. If $[eqn]$ , and the following two conditions are satisfied:

(1) $[eqn]$ * converges uniformly with respect to* c in any closed region of $[eqn]$ ;

(2) Assume that the series $[eqn]$ converges. Then we have

$$[eqn]$$

Lemma 6. For any n-dimensional lattice $[eqn]$ , s>0, $[eqn]$ , there is $[eqn]$ .

3 New upper bound on smoothing parameter

In this section, we will prove the new upper bound on smoothing parameters. Following [13], we begin with the one-dimensional integer lattice $[eqn]$ and then extend to the general lattice $[eqn]$ .

3.1 New upper bound on the smoothing parameter for the integer lattice ℤ

In [13], Zheng et al. provide the relationship between $[eqn]$ for general lattices and $[eqn]$ for the one-dimensional integer lattice $[eqn]$ , emphasizing the importance of determining an upper bound for $[eqn]$ . Additionally, in lattice sampling, the one-dimensional integer lattice $[eqn]$ serves as a basis for sampling higher-dimensional lattices, as detailed in [10,18–22]. Therefore, achieving a more accurate computation of $[eqn]$ will be of considerable importance.

Let’s start with a few lemmas.

Lemma 7. If $[eqn]$ , then $[eqn]$ . Furthermore, if $[eqn]$ , then $[eqn]$ .

Proof: Since $[eqn]$ is a self-dual lattice, according to the definition of the smoothing parameter, $[eqn]$ . If

$$[eqn]$$

then, $[eqn]$ , which implies $[eqn]$ . Furthermore, if $[eqn]$ , then $[eqn]$ , which means $[eqn]$ , and thus $[eqn]$ . $[eqn]$

Lemma 8. *If x>0, then $[eqn]$ *

Proof: To prove that $[eqn]$ for x>0 is equivalent to proving that $[eqn]$ . We define the function f(x) = e^x^−ex for x>0. Taking the derivative of f(x), we get:

$$[eqn]$$

Thus, when x>1, $[eqn]$ , and when $[eqn]$ , $[eqn]$ . This shows that f(x) is decreasing for $[eqn]$ and increasing for x>1, which implies that f(x) attains its minimum value at x = 1. Therefore, $[eqn]$ , which leads to the conclusion that for x>0, $[eqn]$ . $[eqn]$

Lemma 9. If $[eqn]$ , and $[eqn]$ , then

$$[eqn]$$

Proof: To prove (6), it is equivalent to proving

$$[eqn]$$

which means proving:

$$[eqn]$$

According to Lemma 8, when x > 0, it holds that $[eqn]$ . Therefore,

$$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$

The last equality holds because, by the assumption $[eqn]$ , we have $[eqn]$ , which implies $[eqn]$ . This completes the proof. $[eqn]$

We will now directly prove our result. Compared to the method in [13], our proof is more optimized and concise.

Theorem 10. Let $[eqn]$ . When $[eqn]$ , we have:

$$[eqn]$$

Proof: Let $[eqn]$ . It is evident that $[eqn]$ . When $[eqn]$ , we have $[eqn]$ . Let $[eqn]$ . We will now prove that

$$[eqn]$$

Substitute $[eqn]$ into the expression, and let $[eqn]$ , where $[eqn]$ . Then,

$$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$

When $[eqn]$ , we have

$$[eqn]$$

Therefore,

$$[eqn]$$

Note that the coefficient of the $[eqn]$ term on the right side of the inequality is exactly 64. Therefore, (7) holds.

According to Lemma 9, when $[eqn]$ , it follows that

$$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$

Therefore,

$$[eqn]$$

Proof complete. $[eqn]$

Remark 1.

(1) Compared to (4), our conclusions improve for the same choice of $[eqn]$ when m>44.

(2) Additionally, since m can vary, our results also have a broader applicability in the estimation of one-dimensional integer lattice smoothing parameters.

As an application of Theorem 10, we derive a new upper bound for the smoothing parameter of a general one-dimensional lattice $[eqn]$ .

Corollary 11. Let $[eqn]$ , and $[eqn]$ . For $[eqn]$ with $[eqn]$ , then for any one-dimensional lattice $[eqn]$ , we have

$$[eqn]$$

Proof: The dual lattice of a one-dimensional lattice $[eqn]$ is $[eqn]$ . By the definition of the smoothing parameter,

$$[eqn]$$

By following the proof process of Theorem 10, we obtain

$$[eqn]$$

$[eqn]$

At the end of this subsection, we note that the formal upper bound of the smoothing parameter $[eqn]$ for the n-dimensional integer lattice $[eqn]$ can be derived from Theorem 10, and which provides a basis for finding a more precise upper bound for $[eqn]$ in the next section.

Corollary 12. Let $[eqn]$ , then:

$$[eqn]$$

*where $[eqn]$ *

Proof: In Theorem 10, by setting m = 3, and for $[eqn]$ , we have

$$[eqn]$$

Note that $[eqn]$ is also self-dual, and the series appearing in the following equations are all absolutely convergent. Therefore,

$$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$

Let $[eqn]$ then $[eqn]$ . When $[eqn]$ , then $[eqn]$ , Therefore

$$[eqn]$$

$[eqn]$

3.2 The new upper bound on the smoothing parameter for the n-dimensional integer lattice ℤn and general lattice ℒ

This subsection mainly presents two results. Firstly, it provides a new upper bound for the smoothing parameter of the n-dimensional integer lattice $[eqn]$ (Theorem 15). Secondly, we obtain that $[eqn]$ and $[eqn]$ satisfy a certain inequality (Lemma 16), which allows us to derive a new upper bound for the smoothing parameter $[eqn]$ of a general lattice $[eqn]$ (Theorem 17).

For readability, we will reintroduce some of the notation.

Let $[eqn]$ be a basis for the lattice $[eqn]$ . $[eqn]$ represents the Gram-Schmidt orthogonalization of this basis, i.e.,

$$[eqn]$$

Then, there exists an upper triangular matrix

$$[eqn]$$

such that $[eqn]$

Define $[eqn]$ as

$$[eqn]$$

Before proving the result, let us first present some necessary lemmas.

Lemma 13. If $[eqn]$ , k is a positive integer, and $[eqn]$ , then

$$[eqn]$$

Proof: Let $[eqn]$ , $[eqn]$ Then,

$$[eqn]$$ $$[eqn]$$

Since $[eqn]$ , then $[eqn]$ , hence $[eqn]$ , thus $[eqn]$ .

Note that $[eqn]$ , thus,

$$[eqn]$$

So, $[eqn]$ is monotonically decreasing. Furthermore, since $[eqn]$ , it follows that $[eqn]$ , thus f(x) is also monotonically decreasing. Since $[eqn]$ , it follows that $[eqn]$ . That is, we have:

$$[eqn]$$

$[eqn]$

Lemma 14. If $[eqn]$ , n is a positive integer, then

$$[eqn]$$

Proof: Please note that the following equation holds true:

$$[eqn]$$ $$[eqn]$$ $$[eqn]$$

Therefore, combining the equation $[eqn]$ and Lemma 13, we have:

$$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$

$[eqn]$

Next, we can provide a more precise upper bound for the smoothing parameter of the n-dimensional integer lattice $[eqn]$ .

Theorem 15. When n is sufficiently large such that $[eqn]$ , then

$$[eqn]$$

Proof: In Theorem 10, let m = 8. Then, when $[eqn]$ , we have

$$[eqn]$$

According to the definition of the smoothing parameter, then

$$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$

Let $[eqn]$ . Then, according to Lemma 14, we have $[eqn]$ . Next, we will prove that when $[eqn]$ , we have $[eqn]$ .

$$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$

Therefore, if

$$[eqn]$$

then

$$[eqn]$$

Therefore,

$$[eqn]$$

$[eqn]$

The following lemma shows the relationship between the smoothing parameter $[eqn]$ of an n-dimensional integer lattice $[eqn]$ and the smoothing parameter $[eqn]$ of a general lattice $[eqn]$ .

Lemma 16. If $[eqn]$ is n-dimensional full-rank lattice, then

$$[eqn]$$

Proof: Assume $[eqn]$ , where $[eqn]$ , and

$$[eqn]$$

Let $[eqn]$ . By the definition of a lattice, there exist integers $[eqn]$ , such that $[eqn]$ . Combining the equation $[eqn]$ , we obtain

$$[eqn]$$ $$[eqn]$$ $$[eqn]$$

Let $[eqn]$ , then

$$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$

Therefore, according to Lemma 6, we conclude that:

$$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$

According to Lemma 5, we have

$$[eqn]$$

Let i0 be such that $[eqn]$ . Then,

$$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$ $$[eqn]$$

When $[eqn]$ , it follows that $[eqn]$ . Therefore, when $[eqn]$ , we have

$$[eqn]$$

Thus, we have $[eqn]$ . The proof is complete $[eqn]$

Theorem 17. Let $[eqn]$ be a full-rank lattice. When n is sufficiently large such that $[eqn]$ , then

$$[eqn]$$

Proof: According to Lemma 16, it directly follows that

$$[eqn]$$

$[eqn]$

4 Comparative analysis of smoothness parameter bounds

In this section, we will illustrate, through some numerical comparisons, that the upper bound on the smoothing parameter (Eq (8)) obtained by us is superior to the results in References [8] and [13] (that is, Eqs (3) and (5)).

Theoretically, when $[eqn]$ and $[eqn]$ , all three values will approach $[eqn]$ . Therefore, the differences among them can be neglected at this time.

In lattice-based cryptographic constructions, the parameter n typically takes values within [512,8192] (see [10,23–25]). Since most practical schemes require $[eqn]$ and to minimize $[eqn]$ (where $[eqn]$ ), we focus specifically on n is equal to 2048, 4096, and 8192. This selection is also practically motivated.

As shown in Table 1 (the numerical results are provided in detail in Supporting Information S1_Table), after removing a common factor $[eqn]$ , when $[eqn]$ is set to 0.11, 0.22 and 0.33 respectively, our results outperform those in [13] and [8] in terms of numerical precision. Specifically, compared with [8], our results exhibit a more pronounced $[eqn]$ -sensitivity at fixed values of n—as the error $[eqn]$ increases, the performance advantage grows. This implies that our results are more applicable in scenarios where higher errors are tolerable. Although in comparison with [13], our method does not maintain a significant advantage across all combinations of parameters $[eqn]$ and n it has achieved a systematic improvement in numerical precision. Based on this, our results can serve as an effective alternative estimator to [13] for the parameter configuration requirements of high-dimensional lattice-based cryptosystems.

Table 1: Comparison of smoothing parameter bounds.

In summary, for the common parameter range ( $[eqn]$ ) in high-dimensional lattice-based cryptographic systems, our method significantly outperforms Reference [8] in terms of numerical precision and achieves systematic improvements compared with Reference [13]. It provides better theoretical support for practical applications.

5 Conclusion

The smoothing parameter $[eqn]$ was proposed by Micciancio and Regev[3] as a technical tool useful for proving reductions between hard problems on lattices. Since then, it has played a central role in the analysis of lattice-based cryptographic constructions. In this paper, we derive new upper bounds for the smoothing parameter on lattices.

We first consider the case of the one-dimensional integer lattice $[eqn]$ , and under certain conditions, we present a more refined upper bound for the smoothing parameter of the one-dimensional integer lattice (see Theorem 10). Then, by establishing an inequality relationship between the smoothing parameters of general n-dimensional lattices and n-dimensional integer lattices, we extend this result to general n-dimensional lattices, and obtain an improved upper bound for the smoothing parameter of general lattices (see Theorem 17). Our results improve upon prior results in the regime of parameters relevant for lattice-based cryptography.

There is still much work that can be attempted regarding the estimation of the upper bounds of the smoothing parameter of lattices. For example, in this paper, how to make the value of $[eqn]$ not be restricted by n without relaxing the bounds. Secondly, how to obtain a more refined upper bound for the smoothing parameter of general n-dimensional lattices through other mathematical methods. Or whether better results can be obtained on some special lattices, such as integer lattice $[eqn]$ .

Supporting information

S1 TableMATLAB code for calculating the data in Table 1.(PDF)