1LATTICEGEN(1) User Commands LATTICEGEN(1)
2
6 latticegen – utility for generating matrices
7
9 latticegen [-randseed [int | time]] options
10
12 latticegen(1) is a utility for generating matrices (rows form input
13 lattice basis vectors).
14
16 Note that by default, the random bits always use the same seed, to en‐
17 sure reproducibility. The seed may be changed with the option -rand‐
18 seed integer or by using the current time (in seconds) -randseed time.
19 If you use this option, it must be the first one on the command line.
20 r d b generates a knapsack like matrix of dimension d × (d+1) and b
22 bits (see, e.g. D. Stehle. Floating-Point LLL: Theoretical and
23 Practical Aspects. The LLL Algorithm 2009: 179–213): the i-th
24 vector starts with a random integer of bit-length <=b and the
25 rest is the i-th canonical unit vector.
26 s d b b2
28 generates a d × d matrix of a form similar to that is involved
29 when trying to find rational approximations to reals with the
30 same small denominator (see, e.g., A. K. Lenstra,
31 H. W. Lenstra, Jr. and L. Lovasz. Factoring polynomials with
32 rational coefficients. Math. Ann., 261: 515–534 (1982)): the
33 first vector starts with a random integer of bit-length <=b2 and
34 continues with d-1 independent integers of bit-lengths <=b; the
35 i-th vector for i>1 is the i-th canonical unit vector scaled by
36 a factor 2^b.
37 u d b generates a d × d matrix whose entries are independent integers
39 of bit-lengths <=b.
40 n d b c
42 generates an ntru-like matrix. If char is ‘b’, then it first
43 samples an integer q of bit-length <=b, whereas if char is ‘q’,
44 then it sets q to the provided value. Then it samples a uniform
45 h in the ring Z_q[x]/(x^n-1). It finally returns the 2 × 2
46 block matrix [[I, Rot(h)], [0, q*I]], where each block is d × d,
47 the first row of Rot(h) is the coefficient vector of h, and the
48 i-th row of Rot(h) is the shift of the (i-1)-th (with last entry
49 put back in first position), for all i>1. Warning: this does
50 not produce a genuine ntru lattice with h a genuine public key
51 (see J. Hoffstein, J. Pipher, J. H. Silverman. NTRU: A Ring-
52 Based Public Key Cryptosystem. ANTS 1998: 267–288).
53 N d b c
55 as the previous option, except that the constructed matrix is
56 [[q*I, 0], [Rot(h), I]].
57 q d k b c
59 generates a q-ary matrix. If char is ‘b’, then it first samples
60 an integer q of bit-length <=b; if char is ‘p’, it does the same
61 and updates q to the smallest (probabilistic) prime that is
62 greater; if char is ‘q’, then it sets q to the provided value.
63 It returns a 2 × 2 block matrix [[I, H], [0, q*I]], where H is
64 (d-k) k and uniformly random modulo q. These bases correspond
65 to the SIS/LWE q-ary lattices (see D. Micciancio and O. Regev.
66 Post-Quantum Cryptography. Chapter of Lattice-based Cryptogra‐
67 phy, 147–191 (2009)). Goldstein-Mayer lattices correspond to
68 k=1 and q prime (see D. Goldstein and A. Mayer. On the equidis‐
69 tribution of Hecke points. Forum Mathematicum, 15:165–189
70 [1m(2003)).
71 t d f generates a d × d lower-triangular matrix B with
73 B_ii = 2^(d-i+1)^f for all i, and B_ij is uniform between
74 -B_jj/2 and B_jj/2 for all j<i.
75 T d also takes as input a d-dimensional vector vec read from a file.
77 It generates a d × d lower-triangular matrix B with
78 B_ii = vec[i] for all i and B_ij is uniform between -B_jj/2 and
79 B_jj/2 for all j<i.
80
82 The generated matrix is printed in stdout.
83
85 fplll(1)
86 December 2022 LATTICEGEN(1)