Lattices and Applications
Abstract
A lattice in \(\mathbb {R}^{n}\) is a set of points (vectors) composed by all integer linear combinations of independent vectors.
A lattice in \(\mathbb {R}^{n}\) is a set of points (vectors) composed by all integer linear combinations of independent vectors.
Definition 2.1
We may also consider the set \(\left \{ (0,\ldots ,0)\right \} \subset \mathbb {R}^{n}\) as a (degenerate) lattice of rank 0.
Definition 2.2
In other words, \(\varLambda =\left \{ B\mathbf {u}:\mathbf {u}\in \mathbb {Z}^{m}\right \} \), where \(\mathbb {Z}^{m}\) denotes the set of muples of integers. Note that in the above definition, B is a matrix of rank m and it is not unique, since a lattice, for m ≥ 2, has infinitely many bases (as it will be seen next).
Example 2.1
Example 2.2
The cubic lattice \(\mathbb {Z}^{n}\subset \mathbb {R}^{n}\) (also called the integer lattice) is the set of all nuples of integers. A basis for \(\mathbb {Z}^{n}\) is the canonical basis of \(\mathbb {R}^{n}\) \(,\left \{ \mathbf {e}_{1},\ldots ,\mathbf {e}_{n}\right \} \), where e_{1} = (1, 0, …, 0), e_{2} = (0, 1, 0…, 0), …, e_{ n } = (0, 0, …, 0, 1). The first lattice \(\mathbb {Z}^{2}\) of Example 2.1 is the particular case when n = 2.
Example 2.3
Example 2.4

closure: if x, y ∈ Λ, then x + y ∈ Λ,

for every vector x ∈ Λ, −x ∈ Λ.
Theorem 2.1 ([20, p. 78])
A subset of \(\mathbb {R}^{n}\) is a lattice if and only if it is a discrete additive subgroup.
Through the last proposition, we can see that a set composed by linear integer combinations of dependent vectors is not always a lattice. For instance, for n = 1, let A be the set of linear integer combinations of v_{1} = 1 and \(v_{2}=\sqrt {2}\). This set is not a lattice, since it is not discrete.
Theorem 2.2
Two matrices B and \(\overline {B}\) generate the same lattice if and only if there exists a unimodular matrix U such that \(\overline {B}=BU\).
Proof
Conversely, if \(\overline {B}=BU\), with U unimodular, then \(\overline {\varLambda }\subseteq \varLambda \) and \(B=\overline {B}U^{1}\) where U^{−1} has integer entries, which implies that \(\varLambda \subseteq \overline {\varLambda }\), concluding the proof.
Example 2.5
Note that the above theorem provides a way to check if two full rank square matrices A and B generate the same lattice: this will happen if and only if B^{−1}A is a unimodular matrix (see Exercise 2.3).
Definition 2.3
Given a generator matrix B for a lattice Λ, we define its associated Gram matrix by G = B^{ T }B.
Each element G_{ ij } is the inner product between the basis vectors b_{ i } and b_{ j }, \(G_{ij}=\left \langle \mathbf {b}_{i},\mathbf {b}_{j}\right \rangle \). It follows from Theorem 2.2 that, for m ≥ 2, a lattice has infinitely many Gram matrices; in fact, any G′ = U^{ T }GU, where U is unimodular, is also a Gram matrix for Λ. However the determinant of a Gram matrix is the same for all bases of Λ, since \(\det U=1\). We can then define the determinant of Λ as the determinant of any of its Gram matrices. Since this is always a positive number, we can define:
Definition 2.4
The volume of a lattice Λ, denoted by V (Λ), is the (positive) square root of the determinant of a Gram matrix for Λ.
Example 2.6
 (i)$$\displaystyle \begin{aligned} \mbox{If }\mathbf{x},\mathbf{y}\in\varLambda,\mathbf{x}\neq\mathbf{y}\mbox, { \ then }\left(\mathbf{x}+\mathcal{P}(B)\right){\displaystyle \bigcap\left(\mathbf{y}+\mathcal{P}(B)\right)=\varnothing\mbox{ and }} \end{aligned}$$
 (ii)$$\displaystyle \begin{aligned} {\displaystyle \bigcup_{\mathbf{x}\in\varLambda}\left(\mathbf{x}+\mathcal{P}(B)\right)=\mathbb{R}^{n}.} \end{aligned} $$(2.7)
Definition 2.5
2.1 Sphere Packing and Covering
One of the main subjects of research on lattices is their association with the hard problem of finding dense packings in the Euclidean space, which has many applications.
From the fact that a lattice is a discrete additive subgroup of \(\mathbb {R}^{n}\) (Theorem 2.1), it can be shown that any lattice has a nonvanishing vector of minimum norm λ > 0.
The ratio \(\text{vol } \mathcal {B}^{n}(\rho )/V(\varLambda )\) describes how much of the Voronoi region is occupied by \(\mathcal {B}^{n}(\rho )\). Due to the lattice homogeneity, the percentage of the space \(\mathbb {R}^{n}\) covered by translates of \(\mathcal {B}^{n}(\rho )\) by lattice points is given by the same ratio.
Definition 2.6
Example 2.7
Definition 2.7
The center density of a lattice is defined as \(\delta (\varLambda )=\varDelta (\varLambda )/\mbox{vol }\mathcal {B}^{n}(1)=\rho ^{n}/V(\varLambda )\).
The center density provides a way of comparing lattices in the same dimension that avoids the complicated formula (2.14).
Attached to a sphere packing is the concept of kissing number.
Definition 2.8
The kissing number of a lattice is the number of packing balls that touch a fixed one, which corresponds to the number of lattice points having the minimum nonvanishing norm.
For our three lattices in Figs. 2.5, 2.6, and 2.7, this number is 4, 6, and 2, respectively.
A “dual” concept to sphere packing is the one of sphere covering which also has several applications. In the covering problem, we ask for the thinnest possible arrangement of spheres that cover all points of \(\mathbb {R}^{n}\). More formally:
Definition 2.9
Definition 2.10
For n ≥ 2, the covering density is always greater than 1, while the packing density is always smaller than 1. Figure 2.11 illustrates the covering density of our three different lattices in \(\mathbb {R}^{2}\).
2.1.1 Equivalent Lattices
All lattice parameters discussed in this section remain unchanged under some transformations. For example, if we scale all lattice vectors by the same constant c, the lattice volume will be scaled by c^{ n } and the (packing and covering) radii by c. Therefore, the packing and covering densities (as well as the kissing number) do not change. The same happens if we rotate all lattice points. Therefore, it makes sense to treat these lattices as equivalent. Equivalent lattices are obtained by rotating, reflecting, or scaling the original one. A formal definition is stated next. We recall that an n × n matrix Q is orthogonal if Q^{ T }Q = QQ^{ T } = I_{ n }, where I_{ n } is the n × n identity matrix. Orthogonal matrices are associated with linear maps which preserve angles and lengths, defining rotations or reflections in \(\mathbb {R}^{n}\).
Definition 2.11
Two lattices Λ_{1} and Λ_{2} contained in \(\mathbb {R}^{n}\) are equivalent if there exist an orthogonal matrix Q, a real number c, and generator matrices B_{1} and B_{2} for Λ_{1} and Λ_{2}, respectively, such that B_{1} = cQB_{2}. In particular, Λ_{1} and Λ_{2} are called congruent if \(\left c\right =1\).
We write Λ_{1} ∼ Λ_{2} for two equivalent lattices.
Remark 2.1
If we consider the Gram matrices G_{1} and G_{2} associated with the specific generator matrices B_{1} and B_{2} in the last definition, we have G_{1} = c^{2}G_{2}. Furthermore, it can be shown that two lattices which have Gram matrices related to specific bases satisfying G_{1} = c^{2}G_{2} must be congruent, and therefore this can be taken as an alternative definition of equivalent lattices. Then congruent lattices must have identical Gram matrices related to some specific generator matrices.
Remark 2.2
Given Λ_{1} and Λ_{2} with arbitrary generator matrices B_{1} and B_{2}, Λ_{1} ∼ Λ_{2} if and only if there are matrices Q orthogonal and U unimodular such that B_{1} = cQB_{2}U. Accordingly, two arbitrary Gram matrices G_{1} and G_{2} for equivalent lattices must satisfy G_{1} = c^{2}U^{ t }G_{2}U, with U unimodular.
Example 2.8
Remark 2.3
The definition above can be extended to compare lattices which are originally contained in different dimensions by identifying a lattice in \(\mathbb {R}^{n}\) with its natural inclusion in \(\mathbb {R}^{t}\), t > n, which adds (t − n) zeros in the coordinates of its vectors.
Example 2.9
View the hexagonal lattice of Example 2.1 as included in \(\mathbb {R}^{3}\), generated by \(\left \{ (1,0,0),(1/2,\sqrt {3}/2,0)\right \} \). We can show that it is equivalent to the lattice A_{2} given in Example 2.3. In fact, for the generator matrix B_{1} associated with this basis and another generator matrix B_{2} for the lattice A_{2} associated with the basis {(1, −1, 0), (0, −1, 1)}, we can see that the Gram matrices of the two lattices related to these bases are multiples: \(B_{2}^{T}B_{2}=2B_{1}^{T}B_{1}\), which implies their equivalence (Remark 2.1). We can also write explicitly the equivalence of these lattices as described in Remark 2.2 by starting from the generator matrix for A_{2} as given in Example 2.3: \(\left [\begin {array}{rr} 1 & 0\\ 1 & 1\\ 0 & 1 \end {array}\right ]=\sqrt {2}Q\left [\begin {array}{rr} 1 & \frac {1}{2}\\ 0 & \frac {\sqrt {3}}{2}\\ 0 & 0 \end {array}\right ]U\), where Q is the 3 × 3 orthogonal matrix having for its columns the vectors \({{(1/\sqrt {2},1/\sqrt {2},0)}}\), \({{(1/\sqrt {6},1/\sqrt {6,}2/\sqrt {6})}}\), and \({{(1/\sqrt {3},1/\sqrt {3},1/\sqrt {3})}}\), while U is the 2 × 2 unimodular matrix having for its columns the vectors (1, 0) and (0, −1). You may use similar arguments in Exercise 2.7 to check another example of equivalent lattices.
2.2 Sublattices
Given lattices Λ′ and Λ such that Λ′⊆ Λ, Λ′ is said to be a sublattice of Λ. A subset of a lattice is a sublattice if and only if it is an additive subgroup (i.e., for any x and y in \(\varLambda ^{'}\), x + y and −y also are in Λ′).
Let \(\varLambda \subset \mathbb {R}^{n}\) be a full rank lattice with generator matrix B, and let M be an n × n integer matrix. If \(\det {(M)}\neq 0\), then BM is a generator matrix of a full rank sublattice \(\varLambda ^{'}\) of Λ. Reciprocally any generator matrix A of a full rank sublattice \(\varLambda ^{'}\) of Λ can be written as BM for some integer matrix M: Λ and Λ′ are said to form a nested lattice pair , where Λ is the fine lattice and Λ′ is the coarse lattice .
Example 2.10
Example 2.11
The lattices D_{ n } described in Sect. 2.4 are sublattices of the integer lattice \(\mathbb {Z}^{n}\).
Nested lattices have been used in several applications. In this book, they appear in the construction of wiretap codes in Chap. 3, spherical codes in Chap. 5, and index codes in Chap. 6.
Any integer squared ndimensional matrix M can be decomposed into the socalled Smith normal form : M = UDW where U and W are unimodular matrices and D = {d_{i,j}} is a diagonal matrix where d_{j,j} ∈ \(\mathbb {N}\mathbb {}\), d_{i,i}d_{i+1,i+1} [21, Sect. 2.4].
The Smith normal form can be used to extract special bases of a pair of nested full rank lattices.
Theorem 2.3
Given a nested pair of full rank lattices Λ′⊆ Λ, there exist special bases {w_{1}, …, w_{ n }} of Λ′ and {v_{1}, …, v_{ n }} of Λ such that w_{ i } = k_{ i }v_{ i }, for i = 1, …, n, k_{ i } ∈ \(\mathbb {N}\mathbb {}\).
Proof
Let B be a generator matrix of Λ and BM be a generator matrix of Λ′. Consider the Smith decomposition, M = UDW where W, U are unimodular lattices. According to Theorem 2.2, BMW^{−1} = (BU)D is also a generator matrix of Λ′, and BU is a generator matrix of Λ, since U and W^{−1} are unimodular matrices. If we take {w_{1}, …, w_{ n }} and {v_{1}, …, v_{ n }} as the columns of the matrices BMW^{−1} and BU, respectively, we get w_{ i } = d_{i,i}v_{ i }. Take k_{ i } = d_{i,i}.
Example 2.12
For a nested pair Λ′⊆ Λ with generator matrices B and BM, the diagonal matrix of the Smith normal form of M also classifies the abelian quotient group \(\tfrac {\varLambda }{\varLambda '}\), and this will be used in Chap. 5 to describe spherical codes.
2.3 The Dual of a Lattice
The dual of a lattice plays an important role in understanding its structure.
Definition 2.12
Example 2.13
The lattice \(\mathbb {Z}^{n}\) is equal to its dual.
Example 2.14
 1
If B is a generator matrix for Λ, then (B^{ T })^{−1} is a generator matrix for Λ^{∗}.
 2
In the same way, if G is a Gram matrix for Λ, G^{−1} is a Gram matrix for Λ^{∗}.
 3
V (Λ^{∗}) = V (Λ)^{−1}.
 4
If Λ_{1} ∼ Λ_{2}, then \(\varLambda _{1}^{*}\sim \varLambda _{2}^{*}\).
Definition 2.13
We say that Λ is integral if it has a Gram matrix with integer entries. Note that this condition is equivalent to saying that the inner product between any two lattice vectors is an integer or that Λ ⊆ Λ^{∗}.
In fact, for integer lattices we have \(\varLambda \subseteq \varLambda ^{*}\subseteq (\frac {1}{V(\varLambda )^{2}})\varLambda \).
Definition 2.14
If Λ = Λ^{∗}, we say that Λ is unimodular , and this means that any of its Gram matrices is unimodular.
2.4 Important Lattices and Their Duals
Relevant parameters for a lattice Λ in \( \mathbb {R}^{n}\) with generator matrix B
Notation  Name  Reference 

\(\mathcal {P}(B)\)  Fundamental parallelotope  (2.5) 
\(V(\varLambda )=\sqrt {\det (BB^{T})}\)  Volume  (2.6) 
\(\mathcal {V}(\varLambda )\)  Voronoi region  (2.9) 
\(\mathcal {B}^{n}(1)\)  Ball of radius 1 around the origin  (2.11) 
λ =min_{x ∈Λ,x ≠ 0}x  Minimum norm (distance)  (2.10) 
ρ = λ/2  Packing radius  (2.12) 
Δ(Λ)  Packing density  (2.13) 
δ(Λ) = ρ^{ n }/V (Λ)  Center density  Def. 2.7 
μ  Covering radius  Def. 2.9 
θ(Λ)  Covering density  (2.15) 
The Cubic Lattice \( \mathbb {Z}^{n}\)
This lattice is unimodular, \((\mathbb {Z}^{n})^{*}=\mathbb {Z}^{n}\) It has minimum distance \(\min _{\mathbf {x}\in \mathbb {Z}^{n},\mathbf {x}\neq \mathbf {0}}\) x = 1, packing radius ρ = 1/2, covering radius \(\sqrt {n}/2\) (a typical deep hole is (1/2, …, 1/2)) and kissing number 2n. Its Voronoi region is a cube, its packing density is \(\tfrac {\mbox{vol }\mathcal {B}^{n}(1)}{2^{n}}\), and its covering density \(n^{\tfrac {n}{2}}\frac {\mbox{vol }\mathcal {B}^{n}(1)}{2^{n}}\).
The Lattice D_{ n }
The checkerboard lattice D_{ n } is defined in Example 2.4 as the full rank sublattice of \(\mathbb {Z}^{n}\) where the sum of coordinates is even. As such, it has for basis {v_{1}, …, v_{ n }} with v_{1} = (−1, −1, 0, …, 0), v_{2} = (1, −1, 0, …, 0), v_{3} = (0, 1, −1, 0, …, 0), and …, v_{ n } = (0, 0, …, 0, 1, −1). Its minimum distance is \(\sqrt {2}\), its volume is V (D_{ n }) = 2 (\(\det {(D_{n})}=4\)), its center density is \(\delta (D_{n})=2^{\frac {n}{2}2}\), its kissing number is 2n(n − 1), its covering radius is μ = 1, for n = 3, and \(\mu =\sqrt {\frac {n}{4}}\), for n ≥ 4. As it can be seen in Table 2.4, D_{ n } has the greatest lattice packing density in \(\mathbb {R}^{n}\) for n = 3 (FCC), 4 and 5. The dual \(D_{n}^{*}\) has minimum distance \(\frac {\sqrt {3}}{2}\), for n = 3, and 1, for n ≥ 4.
The Lattice A_{ n }
This lattice, defined in Example 2.3, is a rankn sublattice of \(\mathbb {Z}^{n+1}\) lying in the hyperplane H where the sum of the coordinates is zero (A_{ n } ⊂ D_{n+1} ⊂ \(\mathbb {Z}^{n+1}\)). It has for basis {v_{1}, …, v_{ n }} given by v_{1} = (−1, 1, 0, …, 0), v_{2} = (0, −1, 1, 0, …, 0), v_{3} = (0, 0, −1, 1, 0, …, 0),…, v_{ n } = (0, 0, …, 0, −1, 1). If we consider the (n + 1) × n generator matrix B whose columns are these basis vectors, we can see that its volume is \(V(A_{n})=(\det (B^{T}B))^{\frac {1}{2}}=n+1\). It has minimum distance \(\sqrt {2}\) (minimum distance vectors are in fact given by permuting all the components of v_{1}), center packing density \(\delta =2^{\frac {n}{2}}(n+1)^{\frac {1}{2}}\), kissing number n(n + 1), and covering radius \(\mu =\frac {\sqrt {2}}{2}(\frac {2a(n+1a)}{n+1})^{\frac {1}{2}}\), where a = [(n + 1)/2] is the integer part of (n + 1)/2. As mentioned in Example 2.9, A_{2} is equivalent to the hexagonal lattice. Also A_{3} is equivalent the lattice D_{3} or the FCC lattice (see Exercise 2.7). Both A_{2} and A_{3} are the densest lattices in their dimensions. The dual lattice \(A_{n}^{*}\), considered in the hyperplane H, has a very special Voronoi region given by the permutohedra with vertices being all the permutations of \(\frac {1}{(n+1)}(n,n+2,n+4,\ldots ,n2,n)\). As seen in Table 2.4, the lattices \(A_{n}^{*}\) have the smallest covering density known in several dimensions including dimensions n = 3 (\(A_{n}^{*}=D_{n}^{*}=\)BCC), n = 4, 5, and 9 ≤ n ≤ 23. For n = 6, 7, and 8, the covering densities of \(A_{n}^{*}\) are 2.551, 3.060, and 3.666, respectively, and these densities were known to be the smallest in their dimensions until the results of [90] displayed in Table 2.4.
The Lattices E_{6}, E_{7} , and E_{8}
They can be considered as lattices in \(\mathbb {R}^7\) and \(\mathbb {R}^8\) and they are known to have the best lattice packing density in their dimensions.
The BarnesWall Lattice Λ_{16}
A generator matrix for the BarnesWall lattice
\( \left (\frac {1}{\sqrt {2}}\right )\left[\ensuremath{\begin{array}{cccccccccccccccc} 4 & 2 & 2 & 2 & 2 & 2 & 2 & 2 & 2 & 2 & 2 & 1 & 0 & 0 & 0 & 1\\ 0 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 1 & 0 & 0 & 1\\ 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 1 & 1 & 0 & 1\\ 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 1 & 1 & 1 & 1\\ 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 1 & 1 & 1\\ 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 1 & 1 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 1 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 1 & 0 & 1 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 1 & 1 & 0 & 1 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 1 & 1 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 1 & 1 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 1 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 \end{array}}\right]\) 
The Leech Lattice Λ_{24}
A generator for the Leech lattice Λ_{24} scaled by \(2 \sqrt {2}\)
\( \left [\begin {array}{cccccccccccccccccccccccc} 8 & 4 & 4 & 4 & 4 & 4 & 4 & 2 & 4 & 4 & 4 & 2 & 4 & 2 & 2 & 2 & 4 & 2 & 2 & 2 & 0 & 0 & 0 & 3\\ 0 & 4 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 2 & 2 & 0 & 0 & 1\\ 0 & 0 & 4 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 0 & 2 & 0 & 0 & 2 & 0 & 0 & 2 & 0 & 0 & 1\\ 0 & 0 & 0 & 4 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 0 & 2 & 0 & 2 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 4 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 2 & 2 & 2 & 0 & 2 & 2 & 2 & 2 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 4 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 4 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 4 & 0 & 0 & 2 & 0 & 2 & 2 & 2 & 0 & 2 & 2 & 2 & 2 & 2 & 2 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 4 & 0 & 2 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 4 & 2 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 4 & 2 & 2 & 2 & 0 & 0 & 0 & 0 & 2 & 2 & 2 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 4 & 2 & 2 & 2 & 2 & 2 & 2 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 2 & 2 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 \end {array}\right ] \) 
2.4.1 Table of Record Lattices
Best known (record) lattices with respect to packing density, kissing number, covering density, and quantization
Dim  Packing density  Kissing number  Covering density  Quantization 

1  \(\mathbb {Z}\)  \(\mathbb {Z}\)  \(\mathbb {Z}\)  \(\mathbb {Z}\) 
1^{(†)}  2^{(†)}  1^{(†)}  0.0833^{(†)}  
2  A _{2}  A _{2}  A _{2}  A _{2} 
0.9069^{(†)}  6^{(†)}  1.2092^{(†)}  0.0802^{(†)}  
3  A_{3} ∼ D_{3}  A _{3}  \(A_{3}^{*}\sim D_{3}^{*}\)  \( A_{3}^{*}\sim D_{3}^{*}\) 
0.7450^{(†)}  12^{(†)}  1.4635^{(†)}  0.0785  
4  D _{4}  D _{4}  \(A_{4}^{*}\)  D _{4} 
0.6169^{(†)}  24^{(†)}  1.7655^{(†)}  0.0766  
5  D _{5}  D _{5}  \(A_{5}^{*}\)  \(D_{5}^{*}\) 
0.4653^{(†)}  40^{(†)}  2.1243^{(†)}  0.0756  
6  E _{6}  E _{6}  \(Q_{6}^{1}\)  \(E_{6}^{*}\) 
0.3730^{(†)}  72^{(†)}  2.4648^{∗}  0.0742  
7  E _{7}  E _{7}  \(Q_{7}^{1}\)  \(E_{7}^{*}\) 
0.2953^{(†)}  126^{(†)}  2.9000  0.0731  
8  E _{8}  E _{8}  \(Q_{8}^{1}\)  E _{8} 
0.2537^{(†)}  240^{(†)}  3.2013  0.0717  
16  Λ _{16}  Λ _{16}  \( A_{16}^{*}\)  Λ _{16} 
0.0147  4320  15.3109  0.0683  
24  Λ _{24}  Λ _{24}  Λ _{24}  Λ _{24} 
0.0019^{(†)}  196560^{(†)}  7.9035^{(†)}  0.0657 
The marked boxes (†) display the lattices which were proved to be the best regarding the respective parameter among all the lattices in that dimension. The lattices A_{2}, A_{3} ∼ D_{3} ∼ FCC, E_{8}, and Λ_{24} were proved to have the best packing density in their dimensions among all packings (not only lattice packings).
It was long believed that \(A_{6}^{*}\) was the best 6dimensional covering. Recently, Schurmann and Vallentin [90] have found over 40 lattices with smaller covering density than \(A_{6}^{*}\) along with the record covering in dimensions 7, 8. We denote the best known lattice coverings presented in [90] in dimensions n = 6, 7, 8 by \(Q_{n}^{1}\).
Asymptotically, a theorem by Minkowski and Hlawka (cf [20]) guarantees that there exist packings with density lower bounded by Δ ≥ ζ(n)/2^{n−1}, where ζ(n) = 1 + 1/2^{ n } + 1/3^{ n } + … is the Riemman zeta function. Improving this lower bound is still an active subject of research.
Remark 2.4
The classical notations for the lattices A_{ n }, D_{ n }, and E_{ n } used here come from the fact that those lattices are associated with root systems in the context of the theory of Lie algebras which are known by the same symbols [1, 14]. These lattices are then called root lattices . The symbol Λ_{ n } is used for a laminated lattice [26, Chap. 6] in dimension n. This concept was introduced in [24] to describe a lattice in dimension n constructed from layers of a suitable lattice in dimension n − 1 in order to get the best possible density, starting from the onedimensional lattice of even integer points and keeping the same minimum norm. We have that \(\varLambda _{1}\sim \mathbb {Z}\), Λ_{2} ∼ A_{2}, Λ_{ k } ∼ D_{ k } for 3 ≤ k ≤ 5 and Λ_{ k } ∼ E_{ k } for 6 ≤ k ≤ 8. We also have that the BarnesWall lattice and the Leech lattice are the unique laminated lattices in dimensions 16 and 24, respectively [26, Chap. 6].
2.5 Applications
2.5.1 Coding
Thus if all points x are equally likely to be sent, the error probability P_{ e } for S of decoding a lattice point \(\hat {\mathbf {x}}\neq \mathbf {x}\) when x is sent is 1 minus the above probability. We thus want to find, given σ, the ndimensional lattice of volume normalized to 1 for which the error probability P_{ e } is minimized. Unfortunately, the above expression is hard to compute in a closedform expression. It is thus usual to bound it using the socalled union bound .
2.5.2 Quantization
This process can be extended by using extra dimensions to reduce the quantization error. Given a point \(\mathbf {x}\in \mathbb {R}^{n}\) and a lattice \(\varLambda \subset \mathbb {R}^{n}\), we define Q_{ Λ }(x) as the closest lattice point^{3} to y. Equivalently Q_{ Λ }(y) = x if and only if \(\mathbf {y}\in \mathcal {V}_{\varLambda }(\mathbf {x})\).
Best Quantizers
How small can the normalized second moment be? For a given volume V (Λ) = V , the integral in Eq. (2.25) is lower bounded by the integral over an ndimensional ball of volume V . This gives the bound \(\mathcal {G}(\varLambda )>1/(2\pi e)\sim 0.059\) (e.g., [23]). The best lattices in terms of quantization are therefore, roughly speaking, the ones whose Voronoi cell resembles a ball.
Comparing with Table 2.1, it can be seen that, as the dimension increases, the best normalized second moment decreases. In fact, the ratio between the second moment of the onedimensional lattice \(\mathbb {Z}\) and the best possible quantizer is only^{4} 1.42 and can be approached in very high dimensions. This ratio may be interpreted as the gain of using a good highdimensional lattice over the simple quantizer that only rounds the coordinate of a vector in each dimension. Explicit constructions of lattices exhibiting the full gain are very challenging and not yet known.
2.5.3 Computational Problems and Cryptography
The parameters introduced so far, such as the minimum norm, the packing radius, or the center density, have a clean mathematical formulation, and lattices with record parameters according to them have been listed in Table 2.4 for dimensions up to 8, 16, and 24. Computing these parameters in higher dimensions becomes a computational problem. How easy is it algorithmically to compute, say the density of a given lattice? The answer is that it is usually hard. The main difficulty lies in the fact that calculating the density depends on knowing the packing radius (or equivalently, the minimum norm (2.10)) of a lattice which, in turn, depends on the description of the given lattice Λ.
Problem 2.1
(SVP) Given a matrix B, find the minimum norm of the lattice Λ generated by B.
A related problem is the following, known as CVP (Closest Vector Problem) .
Problem 2.2
(CVP) Given a generator matrix B for a lattice \(\varLambda \subset \mathbb {R}^{n}\) and a vector \(\mathbf {y}\in \mathbb {R}^{n}\), find the closest lattice point to y.
The two problems CVP and SVP, and their many variants, have been employed for cryptographic purposes since 1996 [3]. We provide next a general idea of how publickey cryptography can be performed using lattices. Suppose a user (usually called Alice in the cryptography literature) has access to a “good” generator matrix B for a highdimensional lattice \(\varLambda \subset \mathbb {R}^{n}\). From B, Alice generates a “bad” basis H and makes H publicly available while keeping B secret. Now anyone (say, Bob) with access to H can send an encrypted message \(\mathbf {u}\in \mathbb {Z}^{n}\) as follows. Bob generates a noise vector n and sends the vector y = Hu + n to Alice. Noticing that x = Bu is a lattice point, if n is “small” enough, Alice can recover x by finding the closest lattice point to y. Roughly speaking, a “good” basis is one such that the (very efficient) rounding procedure explained in the previous paragraph will work, whereas for “bad” basis it is hard to guess the correct vector x (for instance, the rounding procedure will output a vector far from x, as in Exercise 2.12). Therefore, an intruder that intercepts y and has access to H is not expected to efficiently guess the sent message x.
Of course the above highlevel description depends critically on how to choose the noise vector, the “good” and the “bad” basis or, in other words, the privatekey B and the publickey H. For further information on this and on other applications of lattices to cryptography, the reader is referred to [73]. We close this section with a word on two relevant notions: special bases and bounds on the shortest vector.
Special Bases
The rounding procedure described in this section is not sufficient to solve the closest vector problem and, depending on the chosen basis, may produce very crude estimates. To overcome this problem, we might want to preprocess the basis given to us before trying to find the closest lattice point x to a given point \(\mathbf {y}\in \mathbb {R}^{n}\). For example, the best possible basis for the integer lattice \(\mathbb {Z}^{n}\) in terms of complexity of finding the closest vector is the canonical basis. However not all lattices possess such a neat basis. Intuitively, a good basis for a lattice Λ is as close as possible from being “orthogonal,” with small norm vectors. This notion has been quantified and formalized in several different ways. We present below the notion of Minkowskireduced basis, arguably the most intuitive way of defining a “good” basis.
We say that a set of vectors \(\left \{ \mathbf {b}_{1},\ldots ,\mathbf {b}_{i}\right \} \subset \varLambda \) is primitive if it can be extended to a basis of Λ, i.e., if there exist \(\left \{ \mathbf {b}_{i+1},\ldots ,\mathbf {b}_{n}\right \} \) such that \(\left \{ \mathbf {b}_{1},\ldots ,\mathbf {b}_{i},\mathbf {b}_{i+1},\ldots ,\mathbf {b}_{n}\right \} \) is a basis for Λ.
Definition 2.15 (MinkowskiReduced Basis)
 (i)
b _{1} is a shortest vector in Λ and
 (ii)
for any i = 1, …, n − 1, b_{i+1} is a shortest vector in Λ such that \(\left \{ \mathbf {b}_{1},\ldots ,\mathbf {b}_{i},\mathbf {b}_{i+1}\right \} \) is primitive.
Given a basis \(\alpha =\left \{ \mathbf {b}_{1},\ldots ,\mathbf {b}_{n}\right \} \), the above conditions (i) and (ii) will imply inequalities to be satisfied by its associated Gram matrix \(G=\{b_{ij}\}=\left \langle \mathbf {b}_{i},\mathbf {b}_{j}\right \rangle \) for this basis to be Minkowskireduced. Some of these inequalities are [26, Chap. 15, 10.1]:
 (A)
0 < b_{11} ≤ b_{22} ≤… ≤ b_{ nn } If v = b_{ t } −∑_{s ∈ S}𝜖_{ s }b_{ s } (for some set S of subscripts s < t and 𝜖_{ s } = ±1), the inequality \(\left \ \mathbf {b}_t\right \ \leq \left \ \mathbf {v} \right \\) becomes
 (B)
\(2\left {\textstyle {\displaystyle \sum _{s\in S}}\epsilon _{s}b_{st}{\displaystyle \sum _{r,s\in S}}}\epsilon _{r}\epsilon _{s}b_{rs}\right \leq {\displaystyle \sum _{s\in S}}b_{ss}\). For the cases S = {i}, S = {i, j}, and S = {i, j, k}, the above condition B can be written as:
 (B1)
\(2\left b_{ij}\right \leq b_{ii}\), (i < j);
 (B2)
\(2\left b_{ij}\pm b_{ik}\pm b_{jk}\right \leq b_{ii}+b_{jj}\), (i < j < k); and
 (B3)
\(2\left \epsilon _{1}b_{ir}+\epsilon _{2}b_{jr}+\epsilon _{3}b_{kr}\epsilon _{1}\epsilon _{2}b_{ij}\epsilon _{1}\epsilon _{3}b_{ik}\epsilon _{2}\epsilon _{3}b_{jk}\right \leq b_{ii}+b_{jj}+b_{kk}\), (i < j < k < r)
For n = 2, n = 3, and n = 4, the simultaneous conditions A and B1; A, B1, and B2; and A, B1, B2, and B3, respectively, are also sufficient to assure that the basis is Minkowskireduced [26]. These characterizations can be used in Exercises 2.3 and 2.8. Note that condition B is related to the “more orthogonal” characteristic required for such bases. As it can be shown in Exercise 2.3, {(1, 1, 0), (1, 0, 1), (0, 1, 1)} is a basis for the FCC lattice composed by vectors of minimum norm, but it is not Minkowskireduced since condition B2 is not verified.
Any lattice has a Minkowskireduced basis, but unfortunately, for high dimensions, there is no simple characterization, and producing such a basis is computationally hard. It entails, for instance, calculating the shortest vector and, therefore, should be at least as hard as solving SVP [2]. One widely used relaxation in the literature is the definition of LLL reduced basis [73], which provides relatively small vectors and can be computed with fast algorithms. For a thorough formal complexity discussion on reduced bases and other computational aspects, the reader is referred to [73].
Minkowski Theorem
If we were to search the shortest lattice vector to solve Problem 2.1 by looking at all points inside a ball, how large should the radius of this ball be? The following fundamental bound due to Minkowski gives a first approach to this question.
Theorem 2.4
Before proving the theorem, we perform a quick sanity check. If Λ is scaled by α > 0, then its minimum norm is also scaled by α > 0, while its volume is scaled by α^{ n }. The term V (αΛ)^{1/n} = αV (Λ)^{1/n} then guarantees that the bound scales appropriately.
Proof
Remark 2.5
The ratio λ^{2}/V (Λ)^{2/n} is called the Hermite parameter of Λ (and is of course, closely related to the packing density). The previous discussions show that the Hermite parameter of the densest ndimensional lattice should grow linearly with n.
For the closest vector Problem 2.2, bounds of the same nature as that of Theorem 2.26 for the SVP are far more complicated. From the definition of the covering radius μ, the distance from any point to a closest lattice point should not exceed μ. However, there is no simple way of bounding μ. A very useful (nontrivial) bound is μλ^{∗}≤ n/2; here λ^{∗} is the minimum norm of Λ^{∗}. A proof for this result is out of the scope of the book and can be found in [6].
Exercises
Exercise 2.1
Verify that the sets {(1, 1), (−1, 1)} and {{(2, 0, 0), (1, 1, 0), (1, 0, 1)} in Example 2.4 are bases for D_{2} and D_{3}, according to the definition of D_{ n }.
Exercise 2.2
Show that an m × m matrix is unimodular (has integer entries and determinant 1 or − 1) if and only if it has integer entries and is invertible and its inverse matrix has also integer entries. (Hint: Recall determinant properties and the expression for the inverse of a matrix in terms of its cofactors.)
Exercise 2.3
Show as a direct consequence of Theorem 1.2 that two full rank square matrices A and B generate the same lattice if and only if B^{−1}A is a unimodular matrix and use this result to check if the sets α = {(−1, −1, 0), (1, −1, 0), (0, 1, −1)} and β = {(1, 1, 0), (1, 0, 1), (0, 1, 1)} are bases for the FCC lattice and if the set γ = {(1, −1, 1), (1, 1, −1), (1, 1, 1)} is a basis for the BCC lattice (see Example 2.4). Show also (checking the conditions A, B1, and B2 just after Definition 2.15) that α and γ are Minkowskireduced bases for these lattices but β is not.
Exercise 2.4
Exercise 2.5
Consider a full rank lattice Λ. Prove that a fundamental parallelotope \(\mathcal {P}(B)\) of Λ tiles \(\mathbb {R}^{n}\) by verifying (i) and (ii) (Eq. (2.7)).
Exercise 2.6
Prove that if Λ_{1} ∼ Λ_{2}, then \(\varLambda _{1}^{*}\sim \varLambda _{2}^{*}\).
Exercise 2.7
Show that the lattice A_{3} introduced in Example 2.3 is equivalent to the lattice D_{3} from Example 2.4 (which is also the lattice FCC). You may use the technique of Example 2.9.
Exercise 2.8
 (a)
Look for a “good” basis and find the minimum distance of the lattice. Is your basis a Minkowskireduced one?
 (b)
Describe a fundamental parallelotope of your choice, the Voronoi region and another fundamental region.
 (c)
Find the packing and the covering radii, the kissing number, and the packing and covering densities of Λ.
 (d)
Find a rectangular sublattice \(\varLambda ^{'}\) of Λ and the coset classes of \(\frac {\varLambda }{\varLambda ^{'}}\).
 (e)
Determine the dual lattice, Λ^{∗}, and its relevant parameters.
 (f)
Illustrate the relation \(\varLambda \subseteq \varLambda ^{*}\subseteq (\frac {1}{V(\varLambda )^{2}})\varLambda \) (since Λ is an integer lattice). What lattice do you think is “better,” in some sense, Λ or \(\varLambda ^{'}\)?
Exercise 2.9
Prove that the probability that n is closer to a point of norm m than to the origin is upper bounded by \((1/2)e^{m^{2}/8\sigma ^{2}}\). (Hint: First show that the inner product \(\left \langle \mathbf {n},\mathbf {x}\right \rangle \) has normal distribution with variance \(\left \Vert \mathbf {x}\right \Vert ^{2}\sigma ^{2}\).)
Exercise 2.10
Show that the dual of the hexagonal lattice is equivalent to itself. Identify the associated rotation and scaling factor.
Exercise 2.11
Exercise 2.12
 (a)
Using the matrix B and the rounding procedure described in Sect. 2.5.1, find an estimate for the closest point to the lattice generated by Λ.
 (b)
Check that the lattice generated by B is equal to \(\mathbb {Z}^{2}\). Compare the solution to a) with the actual closest lattice point.
Exercise 2.13
 a)
The normalized second moment (2.25) of Λ × Λ equals \(\mathcal {G}(\varLambda )\)
 b)
For any lattice Λ, \(\mathcal {G}(\alpha \varLambda )=\mathcal {G}(\varLambda )\).
Exercise 2.14
(*) Calculate \(\mathcal {G}(A_{2})\). (Hint: Use the Voronoi cell computation of Exercise 2.4.)
Footnotes
 1.
Some authors use the row convention of considering basis vectors as rows of a generator matrix; we follow here the column convention.
 2.
In several textbooks and papers, the minimum norm is defined as the square of this number.
 3.
Strictly speaking, there might be more than one closest vector to y, which might cause ambiguities. In order for Q_{ Λ }(y) to be well defined, one has to break the ties, i.e., to decide which “faces” of the Voronoi cell to use. In order to simplify notation, we will avoid such a technicality and consider that ties are broken according to some welldefined systematic rule. Considering this rule we will also, by abuse of notation, sometimes say “the” closest lattice point to y. Notice that the faces of the Voronoi cell (i.e., the ambiguous points) have measure zero in \(\mathbb {R}^n\).
 4.
Or approximately 1.53, in decibels. This number is sometimes referred to as the ultimate shaping gain of a lattice.
References
 1.J.F. Adams, Lectures on Lie Groups (Midway Reprints Series) (University of Chicago Press, Chicago, 1983)Google Scholar
 2.E. Agrell, T. Eriksson, A. Vardy, K. Zeger, Closest point search in lattices. IEEE Trans. Inf. Theory 48(8), 2201–2214 (2002)MathSciNetCrossRefzbMATHGoogle Scholar
 3.M. Ajtai, Generating hard instances of lattice problems, in Proceedings of the TwentyEighth Annual ACM Symposium on Theory of Computing, STOC ’96, New York, NY (ACM, 1996), pp. 99–108Google Scholar
 6.W. Banaszczyk, New bounds in some transference theorems in the geometry of numbers. Math. Ann. 296(1), 625–635 (1993)MathSciNetCrossRefzbMATHGoogle Scholar
 8.E.S. Barnes, G.E. Wall, Some extreme forms defined in terms of abelian groups. J. Aust. Math. Soc. 1(1), 47–63 (1959)MathSciNetCrossRefzbMATHGoogle Scholar
 14.N. Bourbaki, Lie Groups and Lie Algebras: Chapters 4–6 (Elements of Mathematics) (Springer, Berlin, 2002)CrossRefzbMATHGoogle Scholar
 20.J.W.S. Cassels, An Introduction to the Geometry of Numbers (Springer, Berlin, 1997)zbMATHGoogle Scholar
 21.H. Cohen, A Course in Computational Algebraic Number Theory (Springer, New York, 1996)Google Scholar
 23.J. Conway, N. Sloane, Voronoi regions of lattices, second moments of polytopes, and quantization. IEEE Trans. Inf. Theory 28(2), 211–226 (1982)MathSciNetCrossRefzbMATHGoogle Scholar
 24.J.H. Conway, N.J.A. Sloane, Laminated lattices. Ann. Math. 116(3), 593–620 (1982)MathSciNetCrossRefzbMATHGoogle Scholar
 25.J.H. Conway, N.J.A. Sloane, On the voronoi regions of certain lattices. SIAM J. Algebr. Discret. Methods 5(3), 294–305, (1984)MathSciNetCrossRefzbMATHGoogle Scholar
 26.J.H. Conway, N.J.A. Sloane, SpherePackings, Lattices, and Groups (Springer, New York, 1998)zbMATHGoogle Scholar
 72.D. Micciancio, S. Goldwasser, Complexity of Lattice Problems. The Kluwer International Series in Engineering and Computer Science, vol. 671 (Kluwer Academic Publishers, Boston, MA, 2002). A cryptographic perspectiveGoogle Scholar
 73.D. Micciancio, O. Regev, LatticeBased Cryptography. PostQuantum Cryptography (Springer, Berlin, 2009)CrossRefzbMATHGoogle Scholar
 77.G. Nebe, E.M. Rains, N.J.A. Sloane, A simple construction for the barneswall lattices, in Codes, Graphs, and Systems (Springer, Berlin, 2002), pp. 333–342zbMATHGoogle Scholar
 86.C.A. Rogers, Packing and Covering (Cambridge University Press, Cambridge, 1964)zbMATHGoogle Scholar
 90.A. Schurmann, F. Vallentin, Computational approaches to lattice packing and covering problems. Discret. Comput. Geom. 35(1), 73–116 (2006)MathSciNetCrossRefzbMATHGoogle Scholar
 98.N.J.A. Sloane, The sphere packing problem. Doc. Math. Extra Volume ICM, 387–396 (1998)Google Scholar