Pith. sign in

REVIEW 2 major objections 8 minor 50 references

Some Mathematical Problems Behind Lattice-Based Cryptography

T0 review · 2 major / 8 minor · reviewed 2026-08-06 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read This review argues that the security of the standardized lattice-based post-quantum cryptosystems rests on three classical mathematical lenses—ball packing, ball covering, and positive definite quadratic forms—so progress on their open…

desk verdict Competent expository survey of lattice geometry problems behind PQC, but the cryptographic motivation overstates the link to deployed structured-lattice schemes and there is a factual error on Ajtai's SIS; worth reviewing as an expository piece, needs revision. read the letter →

arxiv 2506.23438 v1 pith:YRLAPWN4 submitted 2025-06-30 math.MG math.NT

Chuanming Zong This is my paper · ORCID
classification math.MGmath.NT MSC 11H3111H5552C1794A60
keywords lattice-basedcryptographyshortestvectorproblemclosestspherepackingcoveringpositivedefinitequadraticformsgeometryofnumberspost-quantum
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Lattice-based cryptography was selected as the backbone of post-quantum encryption, and this review argues that its security is not a new phenomenon but a restatement of classical geometry of numbers. The shortest vector problem (SVP) is a ball packing problem; the closest vector problem (CVP) is a ball covering problem; and both are equivalent to arithmetic questions about positive definite quadratic forms. The paper's purpose is to tell mathematicians that these problems—packing and covering densities, reduction theory, and the constants attached to quadratic forms—are the real bottlenecks, so contributions to them are contributions to cryptography. A sympathetic reader cares because this turns an urgent practical question into open problems with centuries of mathematical tools already aimed at them.

What carries the argument

The machinery that carries the argument is the correspondence between lattices, ball packings and coverings, and positive definite quadratic forms. The form $Q(z)=zAA'z'$ encodes every squared lattice length, so the geometry of the lattice is fully captured by an arithmetic minimization problem; the packing lens identifies the shortest vector with the maximal radius for disjoint unit balls, and the covering lens identifies the covering radius $\rho(\Lambda)$ with the minimal radius for covering space by translates of the ball $B^n$. The bridge constants are the Hermite constant $\gamma_n$, the lattice packing density $\delta^*(B^n)=\omega_n\gamma_n/2^{2n}$, the lattice covering density $\theta^*(B^n)$, and the ratio $\phi^*(B^n)=2\rho(\Lambda)/\ell(\Lambda)$, while reduction theory supplies the algorithms and obstructions that turn these constants into practical hardness statements.

What would settle it

A polynomial-time quantum algorithm that approximates SVP or CVP within a polynomial factor would refute the conjectures the paper identifies as guaranteeing security; so would a successful classical or quantum attack on the standardized parameter sets that obtains secret keys without solving a shortest-vector or closest-vector instance.

Watch

Extended reading notes

Core claim

On its own terms, the paper's central claim is a dictionary. A lattice $\Lambda=\{zA:z\in\mathbb Z^n\}$ can be read geometrically as a discrete set of points, as an arrangement of equal balls around those points, and arithmetically through the positive definite quadratic form $Q(z)=zAA'z'$. SVP asks for the largest radius $r$ such that $rB^n+\Lambda$ is a ball packing, equivalently for the minimum of $Q(z)$ over nonzero integer vectors; CVP asks for the smallest radius $\rho$ such that $\rho B^n+\Lambda$ covers all of $\mathbb E^n$, equivalently for the minimum of $Q(y-z)$ over $z\in\mathbb Z^n$. The paper then assembles the known complexity theorems, exact small-dimensional constants, asymptotic bounds for $\delta^*(B^n)$ and $\theta^*(B^n)$, the universal bound on the ratio $\phi^*(B^n)=2\rho(\Lambda)/\ell(\Lambda)$, and the reduction-theoretic quantities known to matter for lattice algorithms, presenting them as the mathematical core on which the security of the lattice-based post-quantum schemes rests.

Load-bearing premise

The load-bearing premise is that the structured, average-case lattices used in the standardized schemes inherit the hardness of general worst-case shortest-vector and closest-vector problems.

Editorial extensions

If this is right

  • Tight estimates of the densest lattice packing density $\delta^*(B^n)$ would translate directly into bounds on the shortest vector length, and hence on the concrete hardness of SVP-based schemes.
  • New values or bounds for the thinnest lattice covering density $\theta^*(B^n)$ would feed the covering radius problem, the densest sublattice problem, and the shortest diagonal problem, all listed as security-relevant.
  • If no polynomial-time quantum algorithm approximates SVP or CVP within a polynomial factor, the related lattice-based cryptosystems remain secure in the quantum era; the paper records this as the operative pair of conjectures.
  • Improving the universal bound $\phi^*(B^n)\le 2+o(1)$ to $\phi^*(B^n)\le 2-c$ would improve the known lower bound on the packing density, and finding a dimension with $\phi^*(B^n)\ge 2$ would separate the densest lattice packing from the densest unrestricted packing.
  • Reduction theory is presented as the key tool for security analysis, so efficient reductions for quantum computation, or proofs that none exist, are posed as the central open algorithmic problem.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Editorial: the paper stops short of numerical translation; if the asymptotic constants in the packing and covering bounds were determined, they could be converted into concrete estimates of the gap between shortest-vector and covering-radius hardness in realistic dimensions.
  • Editorial: the same dictionary suggests a concrete benchmark—generate lattices from exact optimal packings and coverings in dimensions 8 and 24 and test whether standard basis-reduction algorithms recover the predicted shortest vectors, giving a laboratory check of how the pure constants govern attack behavior.
  • Editorial: the universal bound on $\phi^*(B^n)$ implies the covering radius and packing radius of every lattice are within a constant factor; a cryptographic reading the paper leaves implicit is that worst-case CVP-style attacks gain only bounded advantage over SVP-style attacks, so parameter choices should reflect that ratio.
  • Editorial: one can test the paper's framing directly by taking a fixed lattice family and comparing solver performance on SVP against solver performance on CVP as dimension grows; if one problem scales systematically differently, the assumed equivalence of their cryptographic roles would need refinement.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

2 major / 8 minor

Summary. This paper is an expository survey of classical mathematical problems that, the author argues, are the foundations of lattice-based post-quantum cryptography. It reviews the shortest and closest vector problems (SVP, CVP), their approximation and decision versions, seven related basis and sublattice problems, and the connections of SVP and CVP to ball packing, ball covering, and positive definite quadratic forms. The survey collects theorems and tables of exact constants (δ*(B_n), θ*(B_n), γ_n, φ*(B_n), ω_n), lists several open problems, and discusses reduction theory. The stated equivalences—SVP with the densest lattice ball packing problem, CVP with lattice ball covering, and both with arithmetic problems for positive definite quadratic forms—are classical and are presented in a way that is mostly faithful to the literature.

Significance. Taken on its own terms as a survey for mathematicians, the paper is useful: the tables of exact constants are correct and well documented, the open problems are stated concretely, and the bibliography gives a good entry point to the geometry-of-numbers literature. The explicit identification of packing and covering densities, Hermite constants, and reduction theory as objects behind SVP/CVP is a service to readers outside cryptography. However, the paper's cryptographic hook is currently overstated: the passage from the security of lattice-based cryptosystems to the listed general worst-case lattice problems is not made precise, and the structured lattices actually used in NIST standards are never discussed. Since the stated motivation of the manuscript is to convince mathematicians that progress on these classical problems matters for post-quantum security, this gap is consequential. The mathematical content itself does not depend on the cryptographic hook, and the survey can be fixed by a clarifying discussion of worst-case-to-average-case reductions and structured lattices.

major comments (2)
  1. [Abstract and Section 2 (pp. 2–3)] The central motivating claim that the security of lattice-based cryptosystems relies on SVP and CVP and their generalizations is not supported as stated. The NIST-selected schemes Kyber, Dilithium, and Falcon are based on Module-LWE and NTRU, which involve structured module and ideal lattices; the classical worst-case hardness of SVP/CVP in arbitrary lattices does not by itself transfer to these average-case structured problems. LWE has a worst-case-to-average-case reduction from GapSVP/SIVP with polynomial approximation factors, but that reduction does not make the exact constants δ*(B_n), γ_n, or ω_n the operative hardness parameter, and NTRU has no analogous reduction. Consequently, Conjectures 2.2 and 2.3, which concern worst-case SVP and CVP, do not directly guarantee the security of the deployed schemes. The paper should either spell out the actual reduction chain, including approximation factors and the structured-vs-unstructured gap, or explicitly narrow its motivational claim to the classical lattice problems that historically underpin the area.
  2. [Section 2, p. 3] The paragraph beginning 'In 2004, Ajtai introduced a new problem, called the short integer solution (SIS) problem' contains a historical error and an imprecise reduction statement. Ajtai's SIS problem and the worst-case-to-average-case reduction appeared in his 1996 STOC paper 'Generating hard instances of lattice problems,' not in 2004; the cited item [3] is a later republication. The following sentence, stating that SIS is 'at least as hard as approximating the shortest vector problem for any lattice,' is also imprecise: the reduction is from worst-case approximate SVP (or SIVP) to average-case SIS for specified approximation factors. The same paragraph's claim that 'the security of both NTRU and LWE does rely on the complexity of approximating versions of the SVP' overstates the situation for NTRU, which lacks such a worst-case reduction, and for LWE, whose reduction is to GapSVP/SIVP rather than to SVP itself. These details matter because they are part of the paper's bridge to cryptography.
minor comments (8)
  1. [Abstract and Section 1] The statement that 'In 2007, D-Wave demonstrated the first quantum computer' is contested; the D-Wave device is a quantum annealer and is not universally regarded as a quantum computer in the sense underlying Shor's algorithm. The wording should be qualified.
  2. [Section 1, p. 1] The text contains the typo 'the L WE' in the sentence introducing LWE; it should read 'the LWE by O. Regev'.
  3. [Section 3, p. 4] The word 'spaned' in the definition of the b_i projections should be 'spanned'.
  4. [Section 3, p. 5] In the table of θ*(B_n), 'Kersshner' should be 'Kershner'.
  5. [Section 4, p. 8] In the passage defining CVP in quadratic form, the lattice is written as Λ = {zA : z ∈ E^n}; this should be z ∈ Z^n, since with z ranging over E^n the set is all of E^n rather than a lattice.
  6. [Section 4, p. 9] The text 'Lestra-Lenstra-Lovazs reduction' should be 'Lenstra–Lenstra–Lovász reduction'; likewise 'leaded' should be 'led'.
  7. [Section 4, table of γ_n] The root notation in the table of Hermite constants is garbled: for example, n = 3 should read ∛2, n = 5 should read the fifth root of 8, n = 6 should read the sixth root of 64/3, and n = 7 should read the seventh root of 64. The current typography is likely to confuse readers.
  8. [Section 4, discussion of ω_n] The sentence 'Clearly, to determine the values of ω(Q) or ϖ(B) are equivalent to the quasi orthogonal basis problem' is imprecise: the quasi orthogonal basis problem is an algorithmic problem for a given lattice, whereas ω_n and ϖ_n are dimension-dependent constants. It would be clearer to say that computing ω(Q) or ϖ(B) for a fixed lattice is what the quasi orthogonal basis problem asks for.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the paper is a survey whose equivalences are standard textbook mathematics, and its few self-citations are not load-bearing.

full rationale

This paper is a review article, not a derivation of new results. The claimed connections—SVP as ball packing, CVP as ball covering, and both as quadratic-form problems—are classical, externally established equivalences. The bounds in Theorem 3.1 and Theorem 3.2 follow directly from the definitions of packing and covering density; for example, the ball packing of radius ℓ(Λ)/2 centered at lattice points has density ω_n(ℓ/2)^n/det(Λ), which is at most δ*(B_n), yielding the stated inequality. Similarly, Hermite's constant is defined as the supremum over forms of m(Q)/dis(Q)^{1/n}, so Theorem 4.1 is true by definition and poses the genuine, open problem of determining or estimating γ_n. No parameter is fitted and no prediction is extracted from the paper's own assumptions. The paper's self-citations, [47], [48], and [49], are contextual pointers to the author's other surveys and talks; they carry none of the mathematical load of the reviewed statements, which are attributed to Ajtai, Khot, Dinur et al., Kabatiansky–Levenshtein, Cohn–Kumar, Viazovska, and other named external sources. The one substantive concern—that the security of deployed NIST schemes depends on structured, average-case instances rather than general worst-case SVP/CVP—is a question of correctness or scope of the motivational bridge, not circularity. The paper does not claim to derive any cryptanalytic consequence from the geometric problems, and it makes no circular reduction. Therefore the circularity score is 0.

Assumptions & free parameters 0 free parameters · 3 assumptions · 0 invented entities

The paper contributes no new formulas or fitted numbers. It relies on named classical theorems and on unproven cryptographic hardness conjectures that make the reviewed problems relevant. The weakest element is the implicit transfer from general worst-case lattice problems to the structured average-case instances of real schemes.

assumptions (3)
  • domain assumption No polynomial-time quantum algorithm approximates SVP or CVP within a polynomial factor (Conjectures 2.2 and 2.3).
    The cryptographic significance of the reviewed problems depends on these conjectures. The paper lists them as conjectures and does not prove them.
  • domain assumption Hardness transfers from worst-case SVP to average-case SIS, LWE, and the NTRU or Module-LWE instances actually used in practice.
    The paper states in Section 2 that the security of NTRU and LWE relies on approximating SVP. This transfer is a theorem with parameter losses for SIS and LWE, but the deployed schemes use structured lattices, and the paper does not address the gap.
  • standard math Classical results in geometry of numbers quoted in the tables are correct and attributed correctly.
    The survey relies on named results from Lagrange, Gauss, Korkin and Zolotarev, Blichfeldt, Cohn and Kumar, Viazovska, Rogers, and Coxeter, Few, and Rogers for its constant tables; none are derived in the paper.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Some Mathematical Problems Behind Lattice-Based Cryptography." pith.science (2026). https://pith.science/paper/YRLAPWN4

@misc{pith2026250623438,
  author       = {Pith},
  title        = {Pith review of: Some Mathematical Problems Behind Lattice-Based Cryptography},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/YRLAPWN4}},
  note         = {Machine review of arXiv:2506.23438}
}
abstract

In 1994, P. Shor discovered quantum algorithms which can break both the RSA cryptosystem and the ElGamal cryptosystem. In 2007, D-Wave demonstrated the first quantum computer. These events and further developments have brought a crisis to secret communication. In 2016, the National Institute of Standards and Technology (NIST) launched a global project to solicit and select a handful of encryption algorithms with the ability to resist quantum computer attacks. In 2022, it announced four candidates, CRYSTALS-Kyber, CRYSTALS-Dilithium, Falcon and Sphincs$+$ for post-quantum cryptography standards. The first three are based on lattice theory and the last on the Hash function. It is well known that the security of the lattice-based cryptosystems relies on the computational complexity of the shortest vector problem (SVP), the closest vector problem (CVP) and their generalizations. In fact, the SVP is a ball packing problem and the CVP is a ball covering problem. Furthermore, both SVP and CVP are equivalent to arithmetic problems for positive definite quadratic forms. Therefore, post-quantum cryptography provides unprecedented opportunities for mathematicians to make contributions in modern technology. This paper will briefly review the mathematical problems on which the lattice-based cryptography is built up, so that mathematicians can see that they are indeed in the game.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

50 extracted references · 49 canonical work pages

  1. [49]

    Zong, Some mathematical mysteries in lattices (Abstract of a plenary talk), ASIACRYPT 2012, LNCS, 7658, 2-3

    C. Zong, Some mathematical mysteries in lattices (Abstract of a plenary talk), ASIACRYPT 2012, LNCS, 7658, 2-3

    work page 2012

  2. [3]

    Ajtai, Generating hard instances of lattice problems

    M. Ajtai, Generating hard instances of lattice problems. Quaderni di Matematica, 13 (2004), 1-3

    work page 2004

  3. [1]

    Aggarwal, Y

    D. Aggarwal, Y. Chen, R. Kumar and Y. Shen, Improved classical and quantum algorithms for the shortest vector problem via bounded distance decoding, SIAM J. Comput.54 (2025), 233-278

    work page 2025

  4. [2]

    Ajtai, The shortest vector problem in L2 is NP-hard for randomized reductions

    M. Ajtai, The shortest vector problem in L2 is NP-hard for randomized reductions. Proc. 30th Annual ACM Symp. Theory of Computing, 10-19, Dallas, Texas, 1998

    work page 1998

  5. [4]

    Ajtai and C

    M. Ajtai and C. Dwork, A public-key cryptosystem with worst-case/average-case equivalence, Proc. 29th Annual ACM Symp. Theory of Computing, 284-293, El Paso, Texas, 1997

    work page 1997

  6. [5]

    A Survey on Post-Quantum Cryptography: State-of-the-Art and Challenges

    M. Alvarado, L. Gayler, A. Seals, T. Wang and T. Hou, A survey on post-quantum cryptography: State-of-the-art and challenges, arXiv: 2312.10430

    work page Pith review arXiv

  7. [6]

    Babai, On Lov´ asz’ lattice reduction and the nearest lattice point problem

    L. Babai, On Lov´ asz’ lattice reduction and the nearest lattice point problem. Combinatorica 6 (1986), 1-13

    work page 1986

  8. [7]

    B. E. Baaquie and L.-C. Kwek, Quantum Computers, Theory and Algorithms. Springer, Singapore, 2023

    work page 2023

Show all 50 references
  1. [8]

    H. Cohn, A. Kumar, S. D. Miller, D. Radchenko and M. Viazovska, The sphere packing problem in dimension

  2. [9]

    Deutsch and R

    D. Deutsch and R. Jozsa, Rapid solution of problems by quantum computation. Proc. Roy. Soc. London Ser. A 439 (1992), 553-558

    1992

  3. [10]

    Diffie and M

    W. Diffie and M. E. Hellman, New directions in cryptography. IEEE Trans. Inf. Theory22 (1976), 644-654

    1976

  4. [11]

    Dinur, G

    I. Dinur, G. Kindler, R. Raz and S. Safra, Approximating CVP to within almost-polynomial factors is NP-hard. Combinatorica 23 (2003), 205-243

    2003

  5. [12]

    ElGamal, A public key cryptosystem and a signature scheme based on discrete logarithms

    T. ElGamal, A public key cryptosystem and a signature scheme based on discrete logarithms. IEEE Trans. Inf. Theory 31 (1985), 469-472

    1985

  6. [13]

    Gentry, Fully homomorphic encryption using ideal lattices

    C. Gentry, Fully homomorphic encryption using ideal lattices. STOC’09, Proc. 2009 ACM Int. Symp. Theory of Computing, 169-178

    2009

  7. [14]

    Goldreich, S

    O. Goldreich, S. Goldwasser and S. Halevi, Public-key cryptosystems from lattice reduction problems, Advances in Cryptology, CRYPTO’97, Santa Barbara. LNCS, 1297 (1997), 112-131

    1997

  8. [15]

    Goldreich, D

    O. Goldreich, D. Micciancio, S. Safra and J.-P. Seifert, Approximating shortest lattice vectors is not harder than approximating closest lattice vectors. Inform. Process. Lett.71 (1999), 55-61

    1999

  9. [16]

    Goldwasser, Mathematical foundations of modern cryptography: computational complexity perspective

    S. Goldwasser, Mathematical foundations of modern cryptography: computational complexity perspective. Proc. ICM, Vol. I, 245-272. Higher Education Press, Beijing, 2002

    2002

  10. [17]

    Hoffstein, J

    J. Hoffstein, J. Pipher and J. H. Silverman, NTRU: a ring-based public key cryptosystem, Algorithmic Number Theory, Portland, 1998. LNCS, 1423 (1998), 267-288

    1998

  11. [18]

    Hoffstein, J

    J. Hoffstein, J. Pipher and J. H. Silverman, An Introduction to Mathematical Cryptography, Springer-Verlag, New York, 2008, 2014

    2008

  12. [19]

    Kannan and L

    R. Kannan and L. Lov´ asz, Covering minima and lattice-point-free convex bodies.Ann. of Math.(2) 128 (1988), no. 3, 577-602

    1988

  13. [20]

    Khot, Hardness of approximating the shortest vector problem in lattices

    S. Khot, Hardness of approximating the shortest vector problem in lattices. J. ACM 52 (2005), 789-808

    2005

  14. [21]

    Klartag, Lattice packing of spheres in high dimensions using a stochastically evolving ellipsoid, arXiv:2504.05042

    B. Klartag, Lattice packing of spheres in high dimensions using a stochastically evolving ellipsoid, arXiv:2504.05042

  15. [22]

    Koblitz, Elliptic curve cryptosystems

    N. Koblitz, Elliptic curve cryptosystems. Math. Comput. 48 (1987), 203-209

    1987

  16. [23]

    J. M. Landsberg, Quantum Computation and Quantum Information, AMS, Providence, 2024. 11

    2024

  17. [24]

    of Math.(2) 185 (2017), no

    Ann. of Math.(2) 185 (2017), no. 3, 1017-1033

    2017

  18. [25]

    A. K. Lenstra, H. W. Lenstra Jr. and L. Lov´ asz, Factoring polynomials with rational coefficients. Math. Ann. 261 (1982), 515-534

    1982

  19. [26]

    E. S. Malygina, A. V. Kutsenko, S. A. Novoselov, N. S. Kolesnikov, A. O. Bakharev, I. S. Khilchuk, A. S. Shaporenko and and N. N. Tokareva, Post-Quantum Cryptosystems: Open Problems and Solutions. Lattice- Based Cryptosystems, J. Appl. Ind. Math., 17 (2023), 767-790

    2023

  20. [27]

    Micciancio, Almost perfect lattices, the covering radius problem, and applications to Ajtai’s connection factor, SIAM J

    D. Micciancio, Almost perfect lattices, the covering radius problem, and applications to Ajtai’s connection factor, SIAM J. Comput.34 (2004), 118-169

    2004

  21. [28]

    Micciancio and S

    D. Micciancio and S. Goldwasser, Complexity of Lattice Problems: A Cryptographic Perspective. Kluwer Aca- demic, Boston, 2002

    2002

  22. [29]

    Micciancio and O

    D. Micciancio and O. Regev, Lattice-based cryptography. Post-quantum cryptography, Springer-Verlag, Berlin, 2009, 147-191

    2009

  23. [30]

    V. S. Miller, Use of elliptic curves in cryptography, Advances in Cryptology, CRYPTO’85, Santa Barbara, 1985. LNCS, 218 (1986), 417-426

    1986

  24. [31]

    P. O. Nguyen and D. Stehl´ e, Low-dimensional lattice basis reduction revisited. ACM Trans. Algorithms 5 (2009), no. 4, Art. 46, 48 pp

    2009

  25. [32]

    Ordentlich, O

    O. Ordentlich, O. Regev and B. Weiss, New bounds on the density of lattice coverings. J. Amer. Math. Soc. 35 (2022), no. 1, 295-308

    2022

  26. [33]

    Peikert, A Decade of Lattice Cryptography, Found

    C. Peikert, A Decade of Lattice Cryptography, Found. Trends Theor. Comput. Sci.10 (2014), no.4, 283-424

    2014

  27. [34]

    Proos and C

    J. Proos and C. Zalka, Shor’s discrete logarithm quantum algorithm for elliptic curves. Quantum Inf. Comput. 3 (2003), 317-344

    2003

  28. [35]

    R. A. Rankin, On positive definite quadratic forms. J. London Math. Soc.28 (1953), 309-314

    1953

  29. [36]

    Regev, On lattices, learning with errors, random linear codes, and cryptography

    O. Regev, On lattices, learning with errors, random linear codes, and cryptography. Proc. 37th ACM Symp. Theory of Computing(2005), 84-93

    2005

  30. [37]

    Regev, An Efficient Quantum Factoring Algorithm, J

    O. Regev, An Efficient Quantum Factoring Algorithm, J. ACM 72 (2025), no. 1, Art. 10, 13 pp

    2025

  31. [38]

    R. L. Rivest, A. Shamir and L. Adleman, A method for obtaining digital signatures and public-key cryptosys- tems. Commun. ACM 21 (1978), 120-126

    1978

  32. [39]

    C. A. Rogers, Packing and Covering, Cambridge University Press, Cambridge, 1964

    1964

  33. [40]

    Schnorr, A hierarchy of polynomial time lattice basis reduction algorithms

    C.-P. Schnorr, A hierarchy of polynomial time lattice basis reduction algorithms. Theor. Comput. Sci. 53 (1987), 201-224

    1987

  34. [41]

    P. W. Shor, Algorithms for quantum computation: discrete logarithms and factoring, 35th Annual Symp. Found. Computer Sci., Santa Fe, 1994 (IEEE Computer Society, Los Alamitos, 1994), 124-134

    1994

  35. [42]

    S¨ odergren, On the distribution of angles between the N shortest vectors in a random lattice,J

    A. S¨ odergren, On the distribution of angles between the N shortest vectors in a random lattice,J. Lond. Math. Soc. 84 (2011), 749-764

    2011

  36. [43]

    van Emde Boas, Another NP-complete problem and the complexity of computing short vectors in a lattice

    P. van Emde Boas, Another NP-complete problem and the complexity of computing short vectors in a lattice. Technical Report81-04 (1981), Math. Institute, University of Amsterdam

    1981

  37. [44]

    Viazovska, The sphere packing problem in dimension 8

    M. Viazovska, The sphere packing problem in dimension 8. Ann. of Math.(2) 185 (2017), no. 3, 991-1015

    2017

  38. [45]

    X. Wang, G. Xu and Y. Yu, Lattice-Based Cryptography: A Survey, Chin. Ann. Math. Ser. B 44 (2023), 945-960

    2023

  39. [46]

    Zhang and Z

    J. Zhang and Z. Zhang, Lattice-Based Cryptosystems-A Design Perspective, Springer-Verlag, Singapore, 2020

    2020

  40. [47]

    Zong, Sphere Packings, Springer-Verlag, New York, 1999

    C. Zong, Sphere Packings, Springer-Verlag, New York, 1999

    1999

  41. [48]

    Zong, From deep holes to free planes, Bull

    C. Zong, From deep holes to free planes, Bull. Amer. Math. Soc.39 (2002), 533-555

    2002

  42. [50]

    Zong, The mathematical foundation of post-quantum cryptography, arXiv:2404.19186

    C. Zong, The mathematical foundation of post-quantum cryptography, arXiv:2404.19186. Submitted. Chuanming Zong, Center of Applied Mathematics, Tianjin University, Tianjin 300072, China. Email: cmzong@math.pku.edu.cn

    arXiv

Pith tools

Reviewed August 6, 2026 · model on record in the stance chip above.