# Lattices and Applications

• Sueli I. R. Costa
• Frédérique Oggier
• Antonio Campello
• Jean-Claude Belfiore
• Emanuele Viterbo
Chapter
Part of the SpringerBriefs in Mathematics book series (BRIEFSMATH)

## Abstract

A lattice in $$\mathbb {R}^{n}$$ is a set of points (vectors) composed by all integer linear combinations of independent vectors.

A lattice in $$\mathbb {R}^{n}$$ is a set of points (vectors) composed by all integer linear combinations of independent vectors.

### Definition 2.1

Let b1, b2, …, b m be linearly independent vectors in $$\mathbb {R}^{n}$$. A lattice Λ with basis $$\left \{ \mathbf {b}_{1},\mathbf {b}_{2},\ldots ,\mathbf {b}_{m}\right \}$$ is defined as
\displaystyle \begin{aligned} \varLambda=\left\{ u_{1}\mathbf{b}_{1}+\cdots+u_{m}\mathbf{b}_{m}:u_{1},\ldots,u_{m}\in\mathbb{Z}\right\}. \end{aligned}
(2.1)
The integer m is called the rank of Λ. If m = n, we say that Λ is full rank.

We may also consider the set $$\left \{ (0,\ldots ,0)\right \} \subset \mathbb {R}^{n}$$ as a (degenerate) lattice of rank 0.

### Definition 2.2

A generator matrix B for a lattice Λ is a matrix whose columns1 are a basis for it, i.e.,
\displaystyle \begin{aligned} B=\left[\begin{array}{cccc} \mathbf{b}_{1} & \mathbf{b}_{2} & \ldots & \mathbf{b}_{m}\end{array}\right]. \end{aligned}
A vector $$\mathbf {x}=(x_{1},\ldots ,x_{n})\in \mathbb {R}^{n}$$ is in Λ if and only if it can be written as
\displaystyle \begin{aligned} \left[\begin{array}{c} x_{1}\\ \vdots\\ x_{n} \end{array}\right]=\left[\begin{array}{cccc} \mathbf{b}_{1} & \mathbf{b}_{2} & \ldots & \mathbf{b}_{m}\end{array}\right]\left[\begin{array}{c} u_{1}\\ \vdots\\ u_{m} \end{array}\right],u_{1},\ldots u_{m}\in\mathbb{Z}. \end{aligned}
(2.2)

In other words, $$\varLambda =\left \{ B\mathbf {u}:\mathbf {u}\in \mathbb {Z}^{m}\right \}$$, where $$\mathbb {Z}^{m}$$ denotes the set of m-uples of integers. Note that in the above definition, B is a matrix of rank m and it is not unique, since a lattice, for m ≥ 2, has infinitely many bases (as it will be seen next).

### Example 2.1

We start with three examples of rank 2 lattices in $$\mathbb {R}^{2}$$. In Fig. 2.1a the square lattice $$\mathbb {Z}^{2}$$ is displayed. A natural basis for it is $$\left \{ (1,0),(0,1)\right \}$$. In Fig. 2.1b the so-called hexagonal lattice is displayed. One of its bases is $$\left \{ (1,0),(1/2,\sqrt {3}/2)\right \}$$. A third lattice Λ is depicted in Fig. 2.1c, which has a natural basis given by $$\left \{ (3,0),(1,2)\right \}$$.

### Example 2.2

The cubic lattice $$\mathbb {Z}^{n}\subset \mathbb {R}^{n}$$ (also called the integer lattice) is the set of all n-uples of integers. A basis for $$\mathbb {Z}^{n}$$ is the canonical basis of $$\mathbb {R}^{n}$$ $$,\left \{ \mathbf {e}_{1},\ldots ,\mathbf {e}_{n}\right \}$$, where e1 = (1, 0, …, 0), e2 = (0, 1, 0…, 0), …, e n  = (0, 0, …, 0, 1). The first lattice $$\mathbb {Z}^{2}$$ of Example 2.1 is the particular case when n = 2.

### Example 2.3

Consider the set A2 of all vectors in $$(x_{1},x_{2},x_{3})\in \mathbb {Z}^{3}$$ such that x1 + x2 + x3 = 0. This set is parameterized by letting two coordinates be free and forcing the third one to be the negative sum of the two free coordinates (if we let say x1, x3 free, then x2 = −x1 − x3), showing that we can describe A2 by integer linear combinations of two independent vectors. This is a rank 2 lattice in $$\mathbb {R}^{3}$$, since a generator matrix for it is
\displaystyle \begin{aligned} B=\left[\begin{array}{rr} 1 & 0\\ -1 & 1\\ 0 & -1 \end{array}\right]. \end{aligned}
It turns out that the hexagonal lattices in Example 2.1 and A2 are equivalent lattices, something that will be proven after Definition 2.11 (see Example 2.9). In a similar way, we can define the rank n lattice A n in $$\mathbb {R}^{n+1}$$:
\displaystyle \begin{aligned} A_{n}=\left\{ (x_{1},x_{2},\ldots,x_{n+1})\in\mathbb{Z}^{n+1}:x_{1}+x_{2}+\cdots+x_{n+1}=0\right\}. \end{aligned}
(2.3)

### Example 2.4

The full rank lattice D n  ⊂ $$\mathbb {R}^{n}$$ , also called the checkerboard lattice , is defined as
\displaystyle \begin{aligned} D_{n}=\left\{ (x_{1},x_{2},\ldots,x_{n})\in\mathbb{Z}^{n}:x_{1}+x_{2}+\cdots+x_{n}\mathrm{\;is\;even}\right\}. \end{aligned}
(2.4)
The lattices D2 and D3, shown in Fig. 2.2a, b, have bases {(1, 1), (−1, 1)} and {(2, 0, 0), (1, 1, 0), (1, 0, 1)}, respectively (see Exercise 2.1). The lattice D3 is also known as the face-centered cubic lattice, FCC, since it can be spanned from the vertices and the face centers of a cube with sides of length 2 (Fig. 2.2b). Another lattice in $$\mathbb {R}^{3}$$ “constructed” from cubes is the body-centered cubic (BCC) lattice. For example, {(2, 0, 0), (0, 2, 0), (1, 1, 1)} is a basis for the BCC lattice (Fig. 2.2c).
There is an alternative definition of lattice in terms of groups. We consider the natural group structure of $$\mathbb {R}^{n}$$ with respect to vector addition. Notice that any lattice $$\varLambda \subset \mathbb {R}^{n}$$ is a set of vectors satisfying
• closure: if x, y ∈ Λ, then x + y ∈ Λ,

• for every vector x ∈ Λ,  −x ∈ Λ.

These two facts show that a lattice Λ is an additive subgroup of $$\mathbb {R}^{n}$$. Moreover, a lattice is also a discrete subset of $$\mathbb {R}^{n}$$. This means that there exists a radius r such that the balls in $$\mathbb {R}^{n}$$ centered at lattice points are disjoint. In fact, these two properties provide an equivalent definition of a lattice:

### Theorem 2.1 ([20, p. 78])

A subset of $$\mathbb {R}^{n}$$ is a lattice if and only if it is a discrete additive subgroup.

Through the last proposition, we can see that a set composed by linear integer combinations of dependent vectors is not always a lattice. For instance, for n = 1, let A be the set of linear integer combinations of v1 = 1 and $$v_{2}=\sqrt {2}$$. This set is not a lattice, since it is not discrete.

As mentioned earlier, a lattice Λ has (infinitely) many bases for m ≥ 2. Figure 2.3 illustrates different bases for the integer and for the hexagonal lattices in $$\mathbb {R}^{2}$$. The characterization of when distinct bases generate the same lattice is done next by means of a special type of matrices, called unimodular. An m × m matrix U is said to be unimodular if it has integer entries and its determinant is 1 or  − 1. This is equivalent to saying that the integer matrix U has an inverse with integer entries, as stated in Exercise 2.2.

### Theorem 2.2

Two matrices B and $$\overline {B}$$ generate the same lattice if and only if there exists a unimodular matrix U such that $$\overline {B}=BU$$.

### Proof

Let $$\beta _{1}=\left \{ \mathbf {b}_{1},\ldots ,\mathbf {b}_{m}\right \}$$ and $$\beta _{2}=\left \{ \overline {\mathbf {b}}_{1},\ldots ,\overline {\mathbf {b}}_{m}\right \}$$ be bases for Λ and $$\overline {\varLambda }$$, with associated generator matrices B and $$\overline {B}$$, respectively. Notice that $$\overline {\varLambda }\subseteq \varLambda$$ if and only if we can write all vectors of β1 as integer linear combinations of β2, i.e.,
\displaystyle \begin{aligned} \overline{\mathbf{b}}_{j}=\sum_{i=1}^{m}{\mathbf{b}}_{i}\alpha_{ij}\mbox{, for }j=1,\ldots m,\mbox{ and }\alpha_{ij}\in\mathbb{Z}. \end{aligned}
In other words, $$\overline {B}=BU$$, where U = (α ij ) is an integer matrix. Analogously, $$\varLambda \subseteq \overline {\varLambda }$$ if and only if $$B=\overline {B}V$$, for some integer matrix V . Combining both equations yields
\displaystyle \begin{aligned} \overline{B}=\overline{B}VU\Rightarrow\overline{B}(\mathbf{I}-VU)=\mathbf{0} \end{aligned}
since every column of I − VU defines a linear equation in $$\overline {\mathbf {b}}_{1},\ldots ,\overline {\mathbf {b}}_{m}$$, and recalling that $$\overline {\mathbf {b}}_{1},\ldots ,\overline {\mathbf {b}}_{m}$$ are linearly independent, the corresponding coefficients must be all 0. Thus
\displaystyle \begin{aligned} VU=\mathbf{I}\Rightarrow\det(V)\det(U)=1 \end{aligned}
which, together with the fact that U, V  are matrices with integer coefficients, implies that $$\det (U)=\det (V)=\pm 1$$; therefore U is unimodular.

Conversely, if $$\overline {B}=BU$$, with U unimodular, then $$\overline {\varLambda }\subseteq \varLambda$$ and $$B=\overline {B}U^{-1}$$ where U−1 has integer entries, which implies that $$\varLambda \subseteq \overline {\varLambda }$$, concluding the proof.

### Example 2.5

In Fig. 2.3 distinct bases for two lattices in the plane are illustrated. The generator matrices associated with the two different bases of the lattice $$\mathbb {Z}^{2}$$ exhibited in Fig. 2.3a are
\displaystyle \begin{aligned} B=\left[\begin{array}{cc} 1 & 0\\ 0 & 1 \end{array}\right]\mbox{ and }\overline{B}=\left[\begin{array}{cc} 1 & 2\\ 1 & 3 \end{array}\right]. \end{aligned}
For the lattice of Fig. 2.3b, we have
\displaystyle \begin{aligned} B=\left[\begin{array}{cc} 1 & 1/2\\ 0 & \sqrt{3}/2 \end{array}\right]\mbox{ and }\overline{B}=\left[\begin{array}{cc} 3/2 & 7/2\\ \sqrt{3}/2 & 3\sqrt{3}/2 \end{array}\right]=\left[\begin{array}{cc} 1 & 1/2\\ 0 & \sqrt{3}/2 \end{array}\right]\left[\begin{array}{cc} 1 & 2\\ 1 & 3 \end{array}\right]. \end{aligned}
In both cases, the unimodular matrix that takes a basis into the other is given by
\displaystyle \begin{aligned} U=\left[\begin{array}{cc} 1 & 2\\ 1 & 3 \end{array}\right]. \end{aligned}

Note that the above theorem provides a way to check if two full rank square matrices A and B generate the same lattice: this will happen if and only if B−1A is a unimodular matrix (see Exercise 2.3).

### Definition 2.3

Given a generator matrix B for a lattice Λ, we define its associated Gram matrix by G = B T B.

Each element G ij is the inner product between the basis vectors b i and b j , $$G_{ij}=\left \langle \mathbf {b}_{i},\mathbf {b}_{j}\right \rangle$$. It follows from Theorem 2.2 that, for m ≥ 2, a lattice has infinitely many Gram matrices; in fact, any G′ = U T GU, where U is unimodular, is also a Gram matrix for Λ. However the determinant of a Gram matrix is the same for all bases of Λ, since $$|\det U|=1$$. We can then define the determinant of Λ as the determinant of any of its Gram matrices. Since this is always a positive number, we can define:

### Definition 2.4

The volume of a lattice Λ, denoted by V (Λ), is the (positive) square root of the determinant of a Gram matrix for Λ.

To give a geometric interpretation to the quantity V (Λ), we define the fundamental parallelotope $$\mathcal {P}(B)$$ as
\displaystyle \begin{aligned} \mathcal{P}(B)=\left\{ \alpha_{1}\mathbf{b}_{1}+\cdots+\alpha_{m}\mathbf{b}_{m},0\leq\alpha_{i}<1,i=1,\ldots m\right\}. \end{aligned}
(2.5)
$$\mathcal {P}(B)$$ is contained in the m-dimensional subspace of $$\mathbb {R}^{n}$$ generated by the set of vectors b1, …, b m . The Euclidean volume of $$\mathcal {P}(B)$$ is
\displaystyle \begin{aligned} V(\varLambda)=\sqrt{\det B^{T}B}=|\det B|. \end{aligned}
(2.6)

### Example 2.6

Continuing Example 2.5, the two distinct bases for the hexagonal lattice (Fig. 2.3b) produce different fundamental parallelotopes, illustrated in Fig. 2.4. The area of both parallelotopes is equal to $$\sqrt {3}/2$$, the volume of the hexagonal lattice.
Given a full rank lattice Λ, it is possible to check that the disjoint union of translates of $$\mathcal {P}(B)$$ by vectors of Λ is equal to the whole space $$\mathbb {R}^{n}$$. In other words, the fundamental parallelotope $$\mathcal {P}(B)$$ tiles $$\mathbb {R}^{n}$$ through translations by points of Λ, that is:
1. (i)
\displaystyle \begin{aligned} \mbox{If }\mathbf{x},\mathbf{y}\in\varLambda,\mathbf{x}\neq\mathbf{y}\mbox, { \ then }\left(\mathbf{x}+\mathcal{P}(B)\right){\displaystyle \bigcap\left(\mathbf{y}+\mathcal{P}(B)\right)=\varnothing\mbox{ and }} \end{aligned}

2. (ii)
\displaystyle \begin{aligned} {\displaystyle \bigcup_{\mathbf{x}\in\varLambda}\left(\mathbf{x}+\mathcal{P}(B)\right)=\mathbb{R}^{n}.} \end{aligned}
(2.7)

From now on in this and in the next chapters, in order to simplify the statements, we assume all lattices to be full rank, unless stated otherwise.
Besides the fundamental parallelotope, other regions $$A\subset \mathbb {R}^{n}$$ may as well tile $$\mathbb {R}^{n}$$ through translations by elements of Λ. In fact, item (i) of the tiling condition above can be “relaxed” to (i’) requiring that for x, y ∈ Λ, (x + A) and (y + A) intersect at most on their boundaries. Any region $$A\subset \mathbb {R}^{n}$$ satisfying conditions (i’) and (ii) is called a fundamental region for Λ. Any fundamental region for Λ has volume V (Λ) (see, e.g., [86, p.28, Thm. 1.6]). Another important fundamental region is the Voronoi region . Let $$\left \Vert .\right \Vert$$ denote the standard Euclidean norm of a vector $$\mathbf {x}\in \mathbb {R}^{n}$$,
\displaystyle \begin{aligned} \left\Vert \mathbf{x}\right\Vert =\sqrt{x_{1}^{2}+x_{2}^{2}+\ldots+x_{n}^{2}}. \end{aligned}

### Definition 2.5

The Voronoi region , also called Dirichlet region, $$\mathcal {V}_{\varLambda }(\mathbf {x})$$ at a point x ∈ Λ is the set of all points in $$\mathbb {R}^{n}$$ which are at least as close to x than to any other lattice point, i.e.:
\displaystyle \begin{aligned} \mathcal{V}_{\varLambda}(\mathbf{x})=\left\{ \mathbf{y}\in\mathbb{R}^{n}:\left\Vert \mathbf{x}-\mathbf{y}\right\Vert \leq\left\Vert \mathbf{z}-\mathbf{y}\right\Vert, \mbox{for all }\mathbf{z}\in\varLambda\right\}. \end{aligned}
(2.8)
The Voronoi region at the origin,
\displaystyle \begin{aligned} \mathcal{V}_{\varLambda}(\mathbf{0})=\mathcal{V}(\varLambda), \end{aligned}
(2.9)
is called the Voronoi region of the lattice, and we have that $$\mathcal {V}_{\varLambda }(\mathbf {x})=\mathcal {V}(\varLambda )+\mathbf {x}$$. It should be remarked that although the fundamental parallelotope depends on the choice of basis, the Voronoi region of a lattice is unique and intrinsic to the standard metric structure of $$\mathbb {R}^{n}$$. If a point is in the boundary of a Voronoi region, it is equidistant from at least two lattice points. Figures 2.5, 2.6, and 2.7 illustrate the tilings of three lattices by different fundamental regions including their Voronoi regions on part (b) (see also Exercise 2.4). The Voronoi regions of the lattices $$\mathbb {Z}^{3}$$ and FCC are a cube with sides of length one and a rhombic dodecahedron centered at the origin, respectively. The Voronoi region of a lattice is a convex set of $$\mathbb {R}^{n}$$ enclosed by hyperplanes which are equidistant from the origin and a relevant lattice point. It is usually very hard to determine, particularly in high dimensions. For special classes of lattices such as the so-called root lattices (which include A n and D n ; see (2.4)), they have been determined [25, 26]. Algorithms for numerically determining the Voronoi region have been developed in several references. Those results are important in applications of lattices to communications such as the ones regarding quantizers and channel coding (see this chapter, Sect. 2.5.1, Chap. , and also [26, Chaps. 2 and 3].

## 2.1 Sphere Packing and Covering

One of the main subjects of research on lattices is their association with the hard problem of finding dense packings in the Euclidean space, which has many applications.

The minimum norm (or minimum distance) of a lattice corresponds to the minimum among all norms of non-zero vectors in Λ, i.e.,2:
\displaystyle \begin{aligned} \lambda={\displaystyle \min_{\mathbf{0}\neq\mathbf{x}\in\varLambda}\left\Vert \mathbf{x}\right\Vert .} \end{aligned}
(2.10)

From the fact that a lattice is a discrete additive subgroup of $$\mathbb {R}^{n}$$ (Theorem 2.1), it can be shown that any lattice has a non-vanishing vector of minimum norm λ > 0.

Let $$\mathcal {B}^{n}(r)$$ denote a Euclidean ball of radius r around the origin, i.e.:
\displaystyle \begin{aligned} \mathcal{B}^{n}(r)=\left\{ \mathbf{x}\in\mathbb{R}^{n}:\left\Vert \mathbf{x}\right\Vert \leq r\right\}. \end{aligned}
(2.11)
It is easy to see that r = λ/2 is the largest value for which the translates of the balls $$\mathcal {B}^{n}(\rho )$$ centered at x ∈ Λ have disjoint interiors. We call
\displaystyle \begin{aligned} \rho=\lambda/2 \end{aligned}
(2.12)
the packing radius of Λ. Notice also that the ball $$\mathcal {B}^{n}(\rho )$$ is inside and touches the boundaries of the Voronoi region of Λ. We define a lattice packing as the union of translates of the ball $$\mathcal {B}^{n}(\rho )$$ by points of Λ.

The ratio $$\text{vol } \mathcal {B}^{n}(\rho )/V(\varLambda )$$ describes how much of the Voronoi region is occupied by $$\mathcal {B}^{n}(\rho )$$. Due to the lattice homogeneity, the percentage of the space $$\mathbb {R}^{n}$$ covered by translates of $$\mathcal {B}^{n}(\rho )$$ by lattice points is given by the same ratio.

### Definition 2.6

The packing density of Λ is defined as
\displaystyle \begin{aligned} \varDelta(\varLambda)=\frac{\mbox{vol }{\mathcal{B}^{n}(\rho)}}{V(\varLambda)}. \end{aligned}
(2.13)

### Example 2.7

In Fig. 2.8 we illustrate the lattices of Example 2.1, their packing balls and respective packing densities. The square and the hexagonal lattices both have packing radius equal to 1/2 and packing densities Δ = 0.785 and Δ = 0.906, respectively. The lattice with basis {(3,0), (1,2)} has packing radius equal to $$\sqrt {5}/2$$ and packing density Δ = 0.654.
Notice that $$\mbox{vol }\mathcal {B}^{n}(\rho )=\rho ^{n}\mbox{vol }\mathcal {B}^{n}(1)$$. The volume of the Euclidean ball $$\mathcal {B}^{n}(1)$$, of radius 1, is known [26]:
\displaystyle \begin{aligned} \mbox{vol }\mathcal{B}^{n}(1)=\left\{ \begin{array}{cc} \frac{\pi^{n/2}}{(n/2)!} & \mbox{if }n\mbox{ is even, and}\\ \frac{2^{n}\pi^{(n-1)/2}((n-1)/2)!}{n!} & \mbox{if }n\mbox{ is even} \end{array}\right. \end{aligned}
(2.14)
When n = 2, 3 we recover the area of the unit circle (π) and the volume of the unit sphere (4π/3), respectively.
The packing densities of $$\mathbb {Z}^{3}$$ and of the lattices FCC and BCC are π/6 = 0.5236, π/18 = 0.7405, and $$\pi \sqrt {3}/8=0.6802$$, respectively (see Figs. 2.9 and 2.10).

### Definition 2.7

The center density of a lattice is defined as $$\delta (\varLambda )=\varDelta (\varLambda )/\mbox{vol }\mathcal {B}^{n}(1)=\rho ^{n}/V(\varLambda )$$.

The center density provides a way of comparing lattices in the same dimension that avoids the complicated formula (2.14).

Attached to a sphere packing is the concept of kissing number.

### Definition 2.8

The kissing number of a lattice is the number of packing balls that touch a fixed one, which corresponds to the number of lattice points having the minimum non-vanishing norm.

For our three lattices in Figs. 2.5, 2.6, and 2.7, this number is 4, 6, and 2, respectively.

A “dual” concept to sphere packing is the one of sphere covering which also has several applications. In the covering problem, we ask for the thinnest possible arrangement of spheres that cover all points of $$\mathbb {R}^{n}$$. More formally:

### Definition 2.9

The covering radius of a lattice is defined as the minimum μ such that the translates of the balls $$\mathcal {B}^{n}(\mu )$$ by points of Λ cover $$\mathbb {R}^{n}$$, i.e.:
\displaystyle \begin{aligned}\bigcup_{\mathbf{x}\in\varLambda}\left(\mathcal{B}^{n}(\mu)+\mathbf{x}\right)=\mathbb{R}^{n}.\end{aligned}
If we consider the vertices of the Voronoi region of Λ (called holes), the covering radius is the biggest distance from one of the holes to the origin. (A hole which attains this distance is called a deep hole.) The n-dimensional covering ball $$\mathcal {B}^{n}(\mu )$$ circumscribes the Voronoi region of a lattice, whereas the packing ball is inscribed in it (see Figs. 2.11, 2.7 c).

### Definition 2.10

The covering density is then defined as
\displaystyle \begin{aligned} \theta(\varLambda)=\frac{\mbox{vol }{\mathcal{B}}^{n}(\mu)}{V(\varLambda)}. \end{aligned}
(2.15)

For n ≥ 2, the covering density is always greater than 1, while the packing density is always smaller than 1. Figure 2.11 illustrates the covering density of our three different lattices in $$\mathbb {R}^{2}$$.

### 2.1.1 Equivalent Lattices

All lattice parameters discussed in this section remain unchanged under some transformations. For example, if we scale all lattice vectors by the same constant c, the lattice volume will be scaled by c n and the (packing and covering) radii by c. Therefore, the packing and covering densities (as well as the kissing number) do not change. The same happens if we rotate all lattice points. Therefore, it makes sense to treat these lattices as equivalent. Equivalent lattices are obtained by rotating, reflecting, or scaling the original one. A formal definition is stated next. We recall that an n × n matrix Q is orthogonal if Q T Q = QQ T  = I n , where I n is the n × n identity matrix. Orthogonal matrices are associated with linear maps which preserve angles and lengths, defining rotations or reflections in $$\mathbb {R}^{n}$$.

### Definition 2.11

Two lattices Λ1 and Λ2 contained in $$\mathbb {R}^{n}$$ are equivalent if there exist an orthogonal matrix Q, a real number c, and generator matrices B1 and B2 for Λ1 and Λ2, respectively, such that B1 = cQB2. In particular, Λ1 and Λ2 are called congruent if $$\left |c\right |=1$$.

We write Λ1 ∼ Λ2 for two equivalent lattices.

### Remark 2.1

If we consider the Gram matrices G1 and G2 associated with the specific generator matrices B1 and B2 in the last definition, we have G1 = c2G2. Furthermore, it can be shown that two lattices which have Gram matrices related to specific bases satisfying G1 = c2G2 must be congruent, and therefore this can be taken as an alternative definition of equivalent lattices. Then congruent lattices must have identical Gram matrices related to some specific generator matrices.

### Remark 2.2

Given Λ1 and Λ2 with arbitrary generator matrices B1 and B2, Λ1 ∼ Λ2 if and only if there are matrices Q orthogonal and U unimodular such that B1 = cQB2U. Accordingly, two arbitrary Gram matrices G1 and G2 for equivalent lattices must satisfy G1 = c2U t G2U, with U unimodular.

### Example 2.8

The lattice generated by
\displaystyle \begin{aligned} \left[\begin{array}{cc} 1 & \frac{1}{2}\left(\sqrt{3}+1\right)\\ -1 & \frac{1}{2}\left(\sqrt{3}-1\right) \end{array}\right] \end{aligned}
is equivalent to the hexagonal lattice, since
\displaystyle \begin{aligned} \left[\begin{array}{cc} 1 & \frac{1}{2}\left(\sqrt{3}+1\right)\\ -1 & \frac{1}{2}\left(\sqrt{3}-1\right) \end{array}\right]=\sqrt{2}\left[\begin{array}{cc} \frac{1}{\sqrt{2}} & \frac{1}{\sqrt{2}}\\ -\frac{1}{\sqrt{2}} & \frac{1}{\sqrt{2}} \end{array}\right].\left[\begin{array}{cc} 1 & \frac{1}{2}\\ 0 & \frac{\sqrt{3}}{2} \end{array}\right]. \end{aligned}
It is a clockwise rotation of 45 and an expansion of factor $$\sqrt {2}$$ of the hexagonal lattice.

### Remark 2.3

The definition above can be extended to compare lattices which are originally contained in different dimensions by identifying a lattice in $$\mathbb {R}^{n}$$ with its natural inclusion in $$\mathbb {R}^{t}$$, t > n, which adds (t − n) zeros in the coordinates of its vectors.

### Example 2.9

View the hexagonal lattice of Example 2.1 as included in $$\mathbb {R}^{3}$$, generated by $$\left \{ (1,0,0),(1/2,\sqrt {3}/2,0)\right \}$$. We can show that it is equivalent to the lattice A2 given in Example 2.3. In fact, for the generator matrix B1 associated with this basis and another generator matrix B2 for the lattice A2 associated with the basis {(1, −1, 0), (0, −1, 1)}, we can see that the Gram matrices of the two lattices related to these bases are multiples: $$B_{2}^{T}B_{2}=2B_{1}^{T}B_{1}$$, which implies their equivalence (Remark 2.1). We can also write explicitly the equivalence of these lattices as described in Remark 2.2 by starting from the generator matrix for A2 as given in Example 2.3: $$\left [\begin {array}{rr} 1 & 0\\ -1 & 1\\ 0 & -1 \end {array}\right ]=\sqrt {2}Q\left [\begin {array}{rr} 1 & \frac {1}{2}\\ 0 & \frac {\sqrt {3}}{2}\\ 0 & 0 \end {array}\right ]U$$, where Q is the 3 × 3 orthogonal matrix having for its columns the vectors $${{(1/\sqrt {2},-1/\sqrt {2},0)}}$$, $${{(-1/\sqrt {6},-1/\sqrt {6,}2/\sqrt {6})}}$$, and $${{(1/\sqrt {3},1/\sqrt {3},1/\sqrt {3})}}$$, while U is the 2 × 2 unimodular matrix having for its columns the vectors (1, 0) and (0, −1). You may use similar arguments in Exercise 2.7 to check another example of equivalent lattices.

## 2.2 Sublattices

Given lattices Λ′ and Λ such that Λ′⊆ Λ, Λ′ is said to be a sublattice of Λ. A subset of a lattice is a sublattice if and only if it is an additive subgroup (i.e., for any x and y in $$\varLambda ^{'}$$, x + y and  −y also are in Λ′).

Let $$\varLambda \subset \mathbb {R}^{n}$$ be a full rank lattice with generator matrix B, and let M be an n × n integer matrix. If $$\det {(M)}\neq 0$$, then BM is a generator matrix of a full rank sublattice $$\varLambda ^{'}$$ of Λ. Reciprocally any generator matrix A of a full rank sublattice $$\varLambda ^{'}$$ of Λ can be written as BM for some integer matrix M: Λ and Λ′ are said to form a nested lattice pair , where Λ is the fine lattice and Λ′ is the coarse lattice .

### Example 2.10

For the hexagonal lattice Λ with generator matrix
\displaystyle \begin{aligned} B=\left[\begin{array}{cc} 1 & \frac{1}{2}\\ 0 & \frac{\sqrt{3}}{2} \end{array}\right], \end{aligned}
we may consider
\displaystyle \begin{aligned} M_{1}=\left[\begin{array}{cc} 2 & 0\\ 0 & 2 \end{array}\right]\mbox{ and }M_{2}=\left[\begin{array}{cc} 4 & -2\\ 0 & 4 \end{array}\right] \end{aligned}
and the sublattices Λ1 and Λ2 generated by BM1 and BM2 (coarse lattice) illustrated in Fig. 2.12.

### Example 2.11

The lattices D n described in Sect. 2.4 are sublattices of the integer lattice $$\mathbb {Z}^{n}$$.

Nested lattices have been used in several applications. In this book, they appear in the construction of wiretap codes in Chap. , spherical codes in Chap. , and index codes in Chap. .

Since a sublattice Λ′⊆ Λ is a subgroup, Λ can be partitioned into a set of cosets of Λ′ which form a finite quotient group $$\frac {\varLambda }{\varLambda '}$$ (or Λ/Λ′). Each of these cosets can be identified using a coset leader (or coset representative) in the fundamental parallelotope of the lattice Λ. Each leader also can be chosen in the Voronoi region of Λ, as it will be seen in Chap. . Let B be a generator matrix for Λ and B′ = BM be one for Λ′. The number of elements of $$\frac {\varLambda }{\varLambda '}$$ is given by:
\displaystyle \begin{aligned} \left|\frac{\varLambda}{\varLambda'}\right|=\frac{V(\varLambda')}{V(\varLambda)}=\left|\det{(M)}\right|. \end{aligned}
In Example 2.10 above, we have $$\left |\frac {\varLambda }{\varLambda '}\right |=4$$ and $$\left |\frac {\varLambda }{\varLambda '}\right |=16$$ (see Fig. 2.13).

Any integer squared n-dimensional matrix M can be decomposed into the so-called Smith normal form : M = UDW where U and W are unimodular matrices and D = {di,j} is a diagonal matrix where dj,j ∈ $$\mathbb {N}\mathbb {}$$, di,i|di+1,i+1 [21, Sect. 2.4].

The Smith normal form can be used to extract special bases of a pair of nested full rank lattices.

### Theorem 2.3

Given a nested pair of full rank lattices Λ′ Λ, there exist special bases {w1, …, w n } of Λ′ and {v1, …, v n } of Λ such that w i = k i v i , for i = 1, …, n, k i  ∈ $$\mathbb {N}\mathbb {}$$.

### Proof

Let B be a generator matrix of Λ and BM be a generator matrix of Λ′. Consider the Smith decomposition, M = UDW where W, U are unimodular lattices. According to Theorem 2.2, BMW−1 = (BU)D is also a generator matrix of Λ′, and BU is a generator matrix of Λ, since U and W−1 are unimodular matrices. If we take {w1, …, w n } and {v1, …, v n } as the columns of the matrices BMW−1 and BU, respectively, we get w i  = di,iv i . Take k i  = di,i.

### Example 2.12

In the nested lattice pair Λ2 ⊆ Λ of Example 2.10, we have the following Smith decomposition for M:
\displaystyle \begin{aligned} M=UDW=\left[\begin{array}{cc} -1 & -1\\ 2 & 1 \end{array}\right]\left[\begin{array}{cc} 2 & 0\\ 0 & 8 \end{array}\right]\left[\begin{array}{cc} 2 & 1\\ -1 & 0 \end{array}\right]. \end{aligned}
After calculating A = BMW−1 = (BU)D and BU, we get the basis {v1, v2} of the hexagonal lattice, $$\mathbf {v}_{1}=(0,\sqrt {3})$$, $$\mathbf {v}_{2}=(-\frac {1}{2},\frac {\sqrt {3}}{2})$$ and the basis {w1, w2}, w1 = 2v1, w2 = 8v1 for the lattice Λ2.

For a nested pair Λ′⊆ Λ with generator matrices B and BM, the diagonal matrix of the Smith normal form of M also classifies the abelian quotient group $$\tfrac {\varLambda }{\varLambda '}$$, and this will be used in Chap. to describe spherical codes.

## 2.3 The Dual of a Lattice

The dual of a lattice plays an important role in understanding its structure.

### Definition 2.12

The dual lattice of a lattice Λ is by definition
\displaystyle \begin{aligned} \varLambda^{*}=\left\{ \mathbf{y}\in\mathbb{R}^{n}\,\,|\,\,\left\langle \mathbf{x},\mathbf{y}\right\rangle \in\mathbb{Z}\mbox{ for all }\mathbf{x}\in\varLambda\right\}. \end{aligned}
(2.16)
Dual lattices are sometimes called polar or reciprocal and arise in areas as distinct as crystallography, cryptography, and harmonic analysis. To understand geometrically the notion of dual, let us start with a full rank lattice $$\varLambda \subset \mathbb {R}^{2}$$ generated by the vectors (b11, b21), (b12, b22). From the definition, the scalar product between any vector of the dual and the original lattice must be an integer. In fact, it is enough to ensure this for the basis vectors, since lattice points are obtained by integral linear combinations. Given $$i \in \mathbb {Z}$$, the set of vectors
\displaystyle \begin{aligned} H_{1}^{(i)}=\left\{ (x_{1},x_{2})\in\mathbb{R}^{2} \,\ | \,\ \left\langle (x_{1},x_{2}),(b_{11},b_{21})\right\rangle =x_{1}b_{11}+x_{2}b_{21}=i\right\}. \end{aligned}
is a straight line in $$\mathbb {R}^{2}$$. By changing $$i \in \mathbb {Z}$$, we obtain a set of parallel straight lines. Now imposing the same condition for the second basis vector, we have the set of parallel straight lines
\displaystyle \begin{aligned} H_{2}^{(j)}=\left\{ (x_{1},x_{2})\in\mathbb{R}^{2}\,\ | \,\ \left\langle (x_{1},x_{2}),(b_{12},b_{22})\right\rangle =x_{1}b_{12}+x_{2}b_{22}=j\right\}, \end{aligned}
$$j \in \mathbb {Z}$$. Each straight line $$H_{1}^{(i)}$$ intersects $$H_{2}^{(j)}$$ in precisely one point. The union of all these points is Λ (see Fig. 2.14). The same interpretation holds in $$\mathbb {R}^{n}$$. For each basis vector b k , we have a set of parallel hyperplanes $$H_{k}^{(j)}$$, $$j\in \mathbb {Z}$$. The distance between each pair of consecutive hyperplanes $$H_{k}^{j}$$ and $$H_{k}^{j+1}$$ is $$1/\left \Vert \mathbf {b}_{k}\right \Vert$$. Indeed, if x belongs to $$H_{k}^{j}$$, then $$\mathbf {x}+\mathbf {b}_{k}/\left \Vert \mathbf {b}_{k}\right \Vert ^{2}$$ belongs to $$H_{k}^{j+1}$$. The distance between these points is precisely the distance between the hyperplanes, namely, $$1/\left \Vert \mathbf {b}_{k}\right \Vert$$.

### Example 2.13

The lattice $$\mathbb {Z}^{n}$$ is equal to its dual.

### Example 2.14

Consider the hexagonal lattice, generated by $$(1,0),(1/2,\sqrt {3}/2)$$. A point in its dual has to satisfy
\displaystyle \begin{aligned} \begin{aligned}{}\left\langle (x_{1},x_{2}),(1,0)\right\rangle & =x_{1}=l_{1}\in\mathbb{Z}\mbox{ and }\\ \left\langle (x_{1},x_{2}),\left(\tfrac{1}{2},\tfrac{\sqrt{3}}{2}\right)\right\rangle & =\frac{x_{1}}{2}+\frac{\sqrt{3}x_{2}}{2}=l_{2}\in\mathbb{Z}. \end{aligned} \end{aligned}
Solving the equations for (x1, x2), we conclude that a point in the dual has the form $$(x_{1},x_{2})=(l_{1},(2l_{2}-l_{1})/\sqrt {3})$$, $$l_{1},l_{2}\in \mathbb {Z}$$. In other words, the dual is a two-dimensional lattice generated by the vectors $$(1,-1/\sqrt {3}),(0,2/\sqrt {3})$$. Notice that this lattice is equivalent to the hexagonal itself. See Exercise 2.10.
In general, calculating the dual lattice from the definition, as in Example 2.14, may not be worthwhile. In what follows, we summarize relations to get the parameters of Λ in a simple way (see [26, p.11] for (1)–(3) and Exercise 2.6 for (4)).
1. 1

If B is a generator matrix for Λ, then (B T )−1 is a generator matrix for Λ.

2. 2

In the same way, if G is a Gram matrix for Λ, G−1 is a Gram matrix for Λ.

3. 3

V (Λ) = V (Λ)−1.

4. 4

If Λ1 ∼ Λ2, then $$\varLambda _{1}^{*}\sim \varLambda _{2}^{*}$$.

### Definition 2.13

We say that Λ is integral if it has a Gram matrix with integer entries. Note that this condition is equivalent to saying that the inner product between any two lattice vectors is an integer or that Λ ⊆ Λ.

In fact, for integer lattices we have $$\varLambda \subseteq \varLambda ^{*}\subseteq (\frac {1}{V(\varLambda )^{2}})\varLambda$$.

### Definition 2.14

If Λ = Λ, we say that Λ is unimodular , and this means that any of its Gram matrices is unimodular.

## 2.4 Important Lattices and Their Duals

Important lattices are lattices which have exceptional structures and typically are often encountered in the literature. This subsection provides a summarized description with parameters of well-known lattices, some of which will appear in Table 2.4, which contains “record” lattices. Many more details regarding these lattices as well as other special types of lattices are found in [26, Chap. 4]. We recall the lattice parameters and related concepts that we have introduced so far in Table 2.1.
Table 2.1

Relevant parameters for a lattice Λ in $$\mathbb {R}^{n}$$ with generator matrix B

Notation

Name

Reference

$$\mathcal {P}(B)$$

Fundamental parallelotope

(2.5)

$$V(\varLambda )=\sqrt {\det (BB^{T})}$$

Volume

(2.6)

$$\mathcal {V}(\varLambda )$$

Voronoi region

(2.9)

$$\mathcal {B}^{n}(1)$$

Ball of radius 1 around the origin

(2.11)

λ =minxΛ,x0||x||

Minimum norm (distance)

(2.10)

ρ = λ/2

(2.12)

Δ(Λ)

Packing density

(2.13)

δ(Λ) = ρ n /V (Λ)

Center density

Def. 2.7

μ

Def. 2.9

θ(Λ)

Covering density

(2.15)

### The Cubic Lattice $$\mathbb {Z}^{n}$$

This lattice is unimodular, $$(\mathbb {Z}^{n})^{*}=\mathbb {Z}^{n}$$ It has minimum distance $$\min _{\mathbf {x}\in \mathbb {Z}^{n},\mathbf {x}\neq \mathbf {0}}$$ ||x|| = 1, packing radius ρ = 1/2, covering radius $$\sqrt {n}/2$$ (a typical deep hole is (1/2, …, 1/2)) and kissing number 2n. Its Voronoi region is a cube, its packing density is $$\tfrac {\mbox{vol }\mathcal {B}^{n}(1)}{2^{n}}$$, and its covering density $$n^{\tfrac {n}{2}}\frac {\mbox{vol }\mathcal {B}^{n}(1)}{2^{n}}$$.

### The Lattice D n

The checkerboard lattice D n is defined in Example 2.4 as the full rank sublattice of $$\mathbb {Z}^{n}$$ where the sum of coordinates is even. As such, it has for basis {v1, …, v n } with v1 = (−1, −1, 0, …, 0), v2 = (1, −1, 0, …, 0), v3 = (0, 1, −1, 0, …, 0), and …, v n  = (0, 0, …, 0, 1, −1). Its minimum distance is $$\sqrt {2}$$, its volume is V (D n ) = 2 ($$\det {(D_{n})}=4$$), its center density is $$\delta (D_{n})=2^{-\frac {n}{2}-2}$$, its kissing number is 2n(n − 1), its covering radius is μ = 1, for n = 3, and $$\mu =\sqrt {\frac {n}{4}}$$, for n ≥ 4. As it can be seen in Table 2.4, D n has the greatest lattice packing density in $$\mathbb {R}^{n}$$ for n = 3 (FCC), 4 and 5. The dual $$D_{n}^{*}$$ has minimum distance $$\frac {\sqrt {3}}{2}$$, for n = 3, and 1, for n ≥ 4.

### The Lattice A n

This lattice, defined in Example 2.3, is a rank-n sublattice of $$\mathbb {Z}^{n+1}$$ lying in the hyperplane H where the sum of the coordinates is zero (A n  ⊂ Dn+1 ⊂ $$\mathbb {Z}^{n+1}$$). It has for basis {v1, …, v n } given by v1 = (−1, 1, 0, …, 0), v2 = (0, −1, 1, 0, …, 0), v3 = (0, 0, −1, 1, 0, …, 0),…, v n  = (0, 0, …, 0, −1, 1). If we consider the (n + 1) × n generator matrix B whose columns are these basis vectors, we can see that its volume is $$V(A_{n})=(\det (B^{T}B))^{\frac {1}{2}}=n+1$$. It has minimum distance $$\sqrt {2}$$ (minimum distance vectors are in fact given by permuting all the components of v1), center packing density $$\delta =2^{\frac {-n}{2}}(n+1)^{\frac {-1}{2}}$$, kissing number n(n + 1), and covering radius $$\mu =\frac {\sqrt {2}}{2}(\frac {2a(n+1-a)}{n+1})^{\frac {1}{2}}$$, where a = [(n + 1)/2] is the integer part of (n + 1)/2. As mentioned in Example 2.9, A2 is equivalent to the hexagonal lattice. Also A3 is equivalent the lattice D3 or the FCC lattice (see Exercise 2.7). Both A2 and A3 are the densest lattices in their dimensions. The dual lattice $$A_{n}^{*}$$, considered in the hyperplane H, has a very special Voronoi region given by the permutohedra with vertices being all the permutations of $$\frac {1}{(n+1)}(-n,-n+2,-n+4,\ldots ,n-2,n)$$. As seen in Table 2.4, the lattices $$A_{n}^{*}$$ have the smallest covering density known in several dimensions including dimensions n = 3 ($$A_{n}^{*}=D_{n}^{*}=$$BCC), n = 4, 5, and 9 ≤ n ≤ 23. For n = 6, 7, and 8, the covering densities of $$A_{n}^{*}$$ are 2.551, 3.060, and 3.666, respectively, and these densities were known to be the smallest in their dimensions until the results of [90] displayed in Table 2.4.

### The Lattices E6, E7 , and E8

Also called the Gosset lattice after T. Gosset who was one of the first to study its geometry, the lattice E8 is defined as
\displaystyle \begin{aligned} E_{8}=\left\{ \mathbf{x}=(x_{1},\ldots,x_{8})\in\mathbb{Z}^{8}:\mathbf{x}\in D_{8}\mbox{ or }\mathbf{x}+\left(\frac{1}{2},\ldots,\frac{1}{2}\right)\in D_{8}\right\}. \end{aligned}
(2.17)
A generator matrix for E8 is given by
\displaystyle \begin{aligned} \left[ \begin{array}{rrrrrrrr} 2 & -1 & 0 & 0 & 0 & 0 & 0 & \frac{1}{2}\\ 0 & 1 & -1 & 0 & 0 & 0 & 0 & \frac{1}{2}\\ 0 & 0 & 1 & -1 & 0 & 0 & 0 & \frac{1}{2}\\ 0 & 0 & 0 & 1 & -1 & 0 & 0 & \frac{1}{2}\\ 0 & 0 & 0 & 0 & 1 & -1 & 0 & \frac{1}{2}\\ 0 & 0 & 0 & 0 & 0 & 1 & -1 & \frac{1}{2}\\ 0 & 0 & 0 & 0 & 0 & 0 & 1 & \frac{1}{2}\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & \frac{1}{2} \end{array}\right]. \end{aligned}
The lattice E8 has minimum distance $$\sqrt {2}$$ and packing center density $$\frac {1}{16}$$ and is, up to congruence, the unique lattice in $$\mathbb {R}^{8}$$ with these minimum distance and density. It is a unimodular lattice, $$E_{8}^{*}=E_{8}$$. It is also known to be the unique (up to congruence) unimodular lattice in dimension 8 with even squared minimum distance. (In fact, up to dimension 8, the unique unimodular lattices, up to congruence, are $$\mathbb {Z}^{n}$$ and E8 [26, Chap. 4].) The lattice E8 has the greatest packing density in dimension 8 not only among lattices but for any packing [26, 98]. It has also the smallest known covering density in this dimension. Its name derives from its association with the E8 root system (see [26, Chap. 4]).
The lattices E7 and E6 are lattices of ranks 7 and 6 naturally defined in $$\mathbb {R}^{8}$$ as
\displaystyle \begin{aligned} E_{7} & =\left\{ \mathbf{x}=(x_{1},\ldots,x_{8})\in E_{8}:x_{1}=x_{2}\right\}, \end{aligned}
(2.18)
\displaystyle \begin{aligned} E_{6} & =\left\{ \mathbf{x}=(x_{1},\ldots,x_{8})\in E_{8}:x_{1}=x_{2}=x_{3}\right\}. \end{aligned}
(2.19)

They can be considered as lattices in $$\mathbb {R}^7$$ and $$\mathbb {R}^8$$ and they are known to have the best lattice packing density in their dimensions.

### The Barnes-Wall Lattice Λ16

The so-called Barnes-Wall lattices BW n defined in dimensions n = 2 k , k an integer greater than two, were introduced in [8] and have been constructed since then through several different methods, e.g., via the so-called Construction B from Reed-Muller codes [26]. They have some special properties (see [77]). Λ16 = BW16 has the best known packing density in dimension 16. One of its generator matrices is given in Table 2.2.
Table 2.2

A generator matrix for the Barnes-Wall lattice

 $$\left (\frac {1}{\sqrt {2}}\right )\left[\ensuremath{\begin{array}{cccccccccccccccc} 4 & 2 & 2 & 2 & 2 & 2 & 2 & 2 & 2 & 2 & 2 & 1 & 0 & 0 & 0 & 1\\ 0 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 1 & 0 & 0 & 1\\ 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 1 & 1 & 0 & 1\\ 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 1 & 1 & 1 & 1\\ 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 1 & 1 & 1\\ 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 1 & 1 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 1 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 1 & 0 & 1 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 1 & 1 & 0 & 1 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 1 & 1 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 1 & 1 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 1 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 \end{array}}\right]$$

### The Leech Lattice Λ24

The Leech lattice Λ24, introduced by J. Leech in 1964, is a very special full rank lattice in $$\mathbb {R}^{24}$$. It is unimodular, $$\varLambda _{24}=\varLambda _{24}^{*}$$, has the greatest packing density in dimension 24, even considering non-lattice packings, and has the smallest known covering density in this dimension. Its kissing number is 196, 560. There are many different constructions for this lattice (see [26, Chap. 24]). A generator matrix of the scaled version of the Leech lattice, $$2\sqrt {2}\varLambda _{24}$$, is given in Table 2.3.
Table 2.3

A generator for the Leech lattice Λ24 scaled by $$2 \sqrt {2}$$

 $$\left [\begin {array}{cccccccccccccccccccccccc} 8 & 4 & 4 & 4 & 4 & 4 & 4 & 2 & 4 & 4 & 4 & 2 & 4 & 2 & 2 & 2 & 4 & 2 & 2 & 2 & 0 & 0 & 0 & -3\\ 0 & 4 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 2 & 2 & 0 & 0 & 1\\ 0 & 0 & 4 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 0 & 2 & 0 & 0 & 2 & 0 & 0 & 2 & 0 & 0 & 1\\ 0 & 0 & 0 & 4 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 0 & 2 & 0 & 2 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 4 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 2 & 2 & 2 & 0 & 2 & 2 & 2 & 2 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 4 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 4 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 4 & 0 & 0 & 2 & 0 & 2 & 2 & 2 & 0 & 2 & 2 & 2 & 2 & 2 & 2 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 4 & 0 & 2 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 4 & 2 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 4 & 2 & 2 & 2 & 0 & 0 & 0 & 0 & 2 & 2 & 2 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 4 & 2 & 2 & 2 & 2 & 2 & 2 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 2 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 0 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 2 & 2 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 0 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 2 & 1\\ 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 0 & 1 \end {array}\right ]$$

### 2.4.1 Table of Record Lattices

In Table 2.4 below, the best known lattices (records) are found with respect to packing density, kissing number, and covering density, but also quantization (or more precisely, the normalized second moment (2.25)), to be approached in Sect. 2.5.1 [26, 90].
Table 2.4

Best known (record) lattices with respect to packing density, kissing number, covering density, and quantization

Dim

Packing density

Kissing number

Covering density

Quantization

1

$$\mathbb {Z}$$

$$\mathbb {Z}$$

$$\mathbb {Z}$$

$$\mathbb {Z}$$

1(†)

2(†)

1(†)

0.0833(†)

2

A 2

A 2

A 2

A 2

0.9069(†)

6(†)

1.2092(†)

0.0802(†)

3

A3 ∼ D3

A 3

$$A_{3}^{*}\sim D_{3}^{*}$$

$$A_{3}^{*}\sim D_{3}^{*}$$

0.7450(†)

12(†)

1.4635(†)

0.0785

4

D 4

D 4

$$A_{4}^{*}$$

D 4

0.6169(†)

24(†)

1.7655(†)

0.0766

5

D 5

D 5

$$A_{5}^{*}$$

$$D_{5}^{*}$$

0.4653(†)

40(†)

2.1243(†)

0.0756

6

E 6

E 6

$$Q_{6}^{1}$$

$$E_{6}^{*}$$

0.3730(†)

72(†)

2.4648

0.0742

7

E 7

E 7

$$Q_{7}^{1}$$

$$E_{7}^{*}$$

0.2953(†)

126(†)

2.9000

0.0731

8

E 8

E 8

$$Q_{8}^{1}$$

E 8

0.2537(†)

240(†)

3.2013

0.0717

16

Λ 16

Λ 16

$$A_{16}^{*}$$

Λ 16

0.0147

4320

15.3109

0.0683

24

Λ 24

Λ 24

Λ 24

Λ 24

0.0019(†)

196560(†)

7.9035(†)

0.0657

The marked boxes (†) display the lattices which were proved to be the best regarding the respective parameter among all the lattices in that dimension. The lattices A2, A3 ∼ D3 ∼ FCC, E8, and Λ24 were proved to have the best packing density in their dimensions among all packings (not only lattice packings).

It was long believed that $$A_{6}^{*}$$ was the best 6-dimensional covering. Recently, Schurmann and Vallentin [90] have found over 40 lattices with smaller covering density than $$A_{6}^{*}$$ along with the record covering in dimensions 7, 8. We denote the best known lattice coverings presented in [90] in dimensions n = 6, 7, 8 by $$Q_{n}^{1}$$.

Asymptotically, a theorem by Minkowski and Hlawka (cf [20]) guarantees that there exist packings with density lower bounded by Δ ≥ ζ(n)/2n−1, where ζ(n) = 1 + 1/2 n  + 1/3 n  + … is the Riemman zeta function. Improving this lower bound is still an active subject of research.

### Remark 2.4

The classical notations for the lattices A n , D n , and E n used here come from the fact that those lattices are associated with root systems in the context of the theory of Lie algebras which are known by the same symbols [1, 14]. These lattices are then called root lattices . The symbol Λ n is used for a laminated lattice [26, Chap. 6] in dimension n. This concept was introduced in [24] to describe a lattice in dimension n constructed from layers of a suitable lattice in dimension n − 1 in order to get the best possible density, starting from the one-dimensional lattice of even integer points and keeping the same minimum norm. We have that $$\varLambda _{1}\sim \mathbb {Z}$$, Λ2 ∼ A2, Λ k  ∼ D k for 3 ≤ k ≤ 5 and Λ k  ∼ E k for 6 ≤ k ≤ 8. We also have that the Barnes-Wall lattice and the Leech lattice are the unique laminated lattices in dimensions 16 and 24, respectively [26, Chap. 6].

## 2.5 Applications

### 2.5.1 Coding

Consider the transmission of a vector x belonging to a discrete set of points $$S\subset \mathbb {R}^{n}$$ over an additive white Gaussian noise (AWGN) channel , meaning that the received signal y is of the form
\displaystyle \begin{aligned} \mathbf{y}=\mathbf{x}+\mathbf{n} \end{aligned}
(2.20)
where n is a random vector whose components are independent Gaussian random variables with mean 0 and variance σ2. The Gaussian channel coding problem consists of figuring out (decoding) x from y despite the presence of the noise n. Now if the transmitter had an infinite power at its disposal, given σ2, it would be easy enough to solve this coding problem: just take the set S, and scale all its vectors enough so that they are well apart, meaning that the distance between any two vectors in S is much larger than 2σ2. Then choose for the decoded point the lattice point x which is closest to the received point y. However we do want the transmitter not to waste too much power in transmitting x, which is modeled by a power constraint that all the points of S lie within a sphere of radius $$\sqrt {nP}$$ around the origin (P thus defines a power constraint). Suppose now that S is a subset carved from a lattice Λ. The receiver will make a correct decision to choose the closest lattice point x from y as the decoded point exactly if the noise vector n falls in the Voronoi region $$\mathcal {V}_{\varLambda }(\mathbf {x})$$ of x (see Fig. 2.15), an event of probability
\displaystyle \begin{aligned} \frac{1}{(\sigma\sqrt{2\pi})^{n}}\int_{\mathcal{V}(\varLambda)}e^{-||\mathbf{x}||{}^{2}/2\sigma^{2}}\mbox{d}\mathbf{x}. \end{aligned}

Thus if all points x are equally likely to be sent, the error probability P e for S of decoding a lattice point $$\hat {\mathbf {x}}\neq \mathbf {x}$$ when x is sent is 1 minus the above probability. We thus want to find, given σ, the n-dimensional lattice of volume normalized to 1 for which the error probability P e is minimized. Unfortunately, the above expression is hard to compute in a closed-form expression. It is thus usual to bound it using the so-called union bound .

For the sake of reasoning, suppose that the lattice Λ contains the vector (1, 0, 0…, 0) and we want to decide whether n is closer to (1, 0, …, 0) than to the origin; this is equivalent to checking whether the first component of n is greater than 1/2, an event that has probability
\displaystyle \begin{aligned} \frac{1}{\sigma\sqrt{2\pi}}\int_{1/2}^{\infty}e^{-x^{2}/2\sigma^{2}}\mbox{d}x\leq\frac{1}{2}e^{-1/8\sigma^{2}}. \end{aligned}
This reasoning generalizes to any lattice/lattice point. The probability that n is closer to some lattice point of norm m is bounded by (see Exercise 2.9) $$(1/2)e^{-m^{2}/8\sigma ^{2}}$$. Therefore, the probability of an error event is given by
\displaystyle \begin{aligned} P(\mathbf{n}\mbox{ is closer to some }\mathbf{x}\in\varLambda\mbox{ than the origin})\leq\frac{1}{2}\sum_{\mathbf{x}\in\varLambda\backslash\left\{ 0\right\} }e^{-\left\Vert \mathbf{x}\right\Vert ^{2}/8\sigma^{2}}. \end{aligned}
(2.21)
The dominant terms in the sum in the right-hand side of (2.21) are the ones corresponding to vectors with small norms. Therefore, dropping all terms except the ones of minimum norm, the upper bound can be approximated by
\displaystyle \begin{aligned} \frac{\kappa e^{-\rho^{2}/2}}{2}, \end{aligned}
(2.22)
where we recall that ρ is the packing radius and κ denotes the kissing number of Λ. This expression is minimized if ρ is maximized (a “secondary” objective is that κ is minimized). Intuitively, we expect the number of points in S to be close to the ratio between the volume of a sphere of radius $$\sqrt {nP}$$ and the volume of Λ, i.e., $$\mbox{vol }\mathcal {B}^{n}(1)(nP)^{n}/V(\varLambda )$$. Recalling the formula for the density and the approximation $$|S|\approx \mbox{vol }\mathcal {B}^{n}(\sqrt {n}{P})/V(\varLambda )$$, we can write expression (2.22) for the probability of error as
\displaystyle \begin{aligned} \frac{\kappa e^{-\varDelta^{2/n}|S|{}^{-2/n}}}{2} \end{aligned}
(2.23)
where Δ is the packing density. Therefore, for a fixed number of points, the objective of minimizing the probability of error (or maximizing the probability of correct decision) can be achieved by maximizing the packing density of the underlying lattice.

### 2.5.2 Quantization

Another important application where lattices play an important role is quantization . Suppose we want to represent the set of real numbers $$\mathbb {R}$$ by using finite precision arithmetics and a regular spaced grid. We can assume, up to scaling, that our approximation is going to be performed using the set of integers $$\mathbb {Z}$$. For each point $$y \in \mathbb {R}$$, the closest integer is denoted by $$Q_{\mathbb {Z}}(y)=[y]$$, and the squared error obtained in this approximation is $$(Q_{\mathbb {Z}}(y)-y)^{2}$$. Notice that for any point y ∈ [−1/2, 1/2) (or (−1/2, 1/2], depending on the rounding rule), $$Q_{\mathbb {Z}}(y)=0$$ and the quantization error is y2. Since the integers are regularly spaced, we define the average squared quantization error in the process by picking a point y ∈ (−1/2, 1/2] uniformly at random and taking the average
\displaystyle \begin{aligned} \int_{-1/2}^{1/2}y^{2}\text{d}x=\frac{1}{12}. \end{aligned}

This process can be extended by using extra dimensions to reduce the quantization error. Given a point $$\mathbf {x}\in \mathbb {R}^{n}$$ and a lattice $$\varLambda \subset \mathbb {R}^{n}$$, we define Q Λ (x) as the closest lattice point3 to y. Equivalently Q Λ (y) = x if and only if $$\mathbf {y}\in \mathcal {V}_{\varLambda }(\mathbf {x})$$.

Observe that y − Q Λ (y) is closer to the origin than any non-zero lattice point, therefore $$\mathbf {y}-Q_{\varLambda }(\mathbf {y})\in \mathcal {V}_{\varLambda }(\mathbf {0})$$ for any $$\mathbf {y}\in \mathbb {R}^{n}$$. Hence, subtracting the closest lattice point from y wraps the real vector y into the Voronoi region $$\mathcal {V}_{\varLambda }(\mathbf {0})$$ at the origin. This operation, called the modulo-Λ function, is denoted as
\displaystyle \begin{aligned} \mathbf{y}\mathrm{mod}\varLambda=\mathbf{y}-Q_{\varLambda}(\mathbf{y}). \end{aligned}
The modulo-Λ operation satisfies the property
\displaystyle \begin{aligned} \left(\mathbf{y}_{1}+\mathbf{y}_{2}\right)\mathrm{mod}\varLambda=\left(\mathbf{y}_{1}\mathrm{mod}\varLambda+\mathbf{y}_{2}\right)\mathrm{mod}\varLambda\text{ for any }\mathbf{y}_{1},\mathbf{y}_{2}\in\mathbb{R}^{n}. \end{aligned}
The modulo-Λ operation will be discussed more carefully and applied in Chap. . Analogous to the one-dimensional case, we define, for a point x drawn uniformly at random in the Voronoi cell of Λ, the average quantization error
\displaystyle \begin{aligned} E({\varLambda})=\frac{1}{V(\varLambda)}\int_{\mathcal{V}(\varLambda)}\left\Vert \mathbf{x}\right\Vert ^{2}\text{d}\mathbf{x}, \end{aligned}
(2.24)
where we use the subscript E Λ to indicate that the expectation is with respect to a point uniformly distributed over the Voronoi region of Λ. Equation (2.24) gives the average mean squared quantization error, but is not the best choice to compare different lattices, since it does depend on the volume of Λ. For instance, for any scaling factor αΛ, the quantization error is
\displaystyle \begin{aligned} E({\alpha \varLambda}) = \alpha^{2} E({\varLambda}). \end{aligned}
To allow a fair comparison between lattices with distinct volumes, we define the normalized second moment per dimension as
\displaystyle \begin{aligned} \mathcal{G}(\varLambda)=\frac{1}{nV(\varLambda)^{2/n+1}}\int_{\mathcal{V}(\varLambda)}\left\Vert \mathbf{x}\right\Vert ^{2}\text{d}\mathbf{x}. \end{aligned}
(2.25)
This quantity is independent of the volume and of the dimension (Exercise 2.13) but is fairly hard to calculate in general, as it involves an integration over the Voronoi cell of a lattice. Equation (2.25) was used to calculate the last column of Table 2.1.

### Best Quantizers

How small can the normalized second moment be? For a given volume V (Λ) = V , the integral in Eq. (2.25) is lower bounded by the integral over an n-dimensional ball of volume V . This gives the bound $$\mathcal {G}(\varLambda )>1/(2\pi e)\sim 0.059$$ (e.g., [23]). The best lattices in terms of quantization are therefore, roughly speaking, the ones whose Voronoi cell resembles a ball.

Comparing with Table 2.1, it can be seen that, as the dimension increases, the best normalized second moment decreases. In fact, the ratio between the second moment of the one-dimensional lattice $$\mathbb {Z}$$ and the best possible quantizer is only4 1.42 and can be approached in very high dimensions. This ratio may be interpreted as the gain of using a good high-dimensional lattice over the simple quantizer that only rounds the coordinate of a vector in each dimension. Explicit constructions of lattices exhibiting the full gain are very challenging and not yet known.

### 2.5.3 Computational Problems and Cryptography

The parameters introduced so far, such as the minimum norm, the packing radius, or the center density, have a clean mathematical formulation, and lattices with record parameters according to them have been listed in Table 2.4 for dimensions up to 8, 16, and 24. Computing these parameters in higher dimensions becomes a computational problem. How easy is it algorithmically to compute, say the density of a given lattice? The answer is that it is usually hard. The main difficulty lies in the fact that calculating the density depends on knowing the packing radius (or equivalently, the minimum norm (2.10)) of a lattice which, in turn, depends on the description of the given lattice Λ.

For a concrete example, let us consider the hexagonal lattice (Example 2.1). Consider the basis
\displaystyle \begin{aligned} B=\left[\begin{array}{cc} 1 & 1/2\\ 0 & \sqrt{3}/{2} \end{array}\right]. \end{aligned}
Each vector in the lattice has the form Bu, $$\mathbf {u}\in \mathbb {Z}^{2}$$, and has norm $$u_{1}^{2}+u_{1}u_{2}+u_{2}^{2}$$. Since u1, u2 are integers, it follows that the minimum norm is 1, attained, for instance, by choosing u1 = 1, u2 = 0. However, if we are given instead the generator matrix
\displaystyle \begin{aligned} \overline{B}=\left[\begin{array}{cc} 2401 & 96\sqrt{3}{2}\\ 57649/2 & 2305\sqrt{3}/2 \end{array}\right], \end{aligned}
it is far from easy to compute that the minimum non-zero squared norm for $$5792449u_{1}^{2}+139079089u_{2}u_{1}+834836569u_{2}^{2}$$ is 1, attained by u1 = 2305 and u2 = −192. In fact, if we knew the unimodular transformation that takes B into $$\overline {B}$$, we could easily recover the minimum from the first basis. This tells us that, in some sense, it is easy to “hide” the minimum norm of a vector by transforming a “good” basis into a “bad one.” This high-level idea is the starting point for the constructions of cryptographic primitives based on lattices (the case of public-key cryptography will be explained in more details below). The following problem is known as SVP (Shortest Vector Problem) :

### Problem 2.1

(SVP) Given a matrix B, find the minimum norm of the lattice Λ generated by B.

A related problem is the following, known as CVP (Closest Vector Problem) .

### Problem 2.2

(CVP) Given a generator matrix B for a lattice $$\varLambda \subset \mathbb {R}^{n}$$ and a vector $$\mathbf {y}\in \mathbb {R}^{n}$$, find the closest lattice point to y.

This problem is relevant to coding theory, as it can be regarded as a “decoding problem,” where y is a received signal for a message x ∈ Λ transmitted over a Gaussian channel, as in the previous section. CVP also depends critically on the given basis B. Suppose we start with the lattice $$\mathbb {Z}^{2}$$ and the matrix B associated with the canonical basis. Given a point y = (y1, y2), the closest point x = Bu to y is the one that minimizes
\displaystyle \begin{aligned} \left\Vert \mathbf{y}-\mathbf{x}\right\Vert =(y_{1}-u_{1})^{2}+(y_{2}-u_{2})^{2}, \end{aligned}
obtained by rounding the coordinates of y1, i.e., u1 = [y1] and u2 = [y2]. One can think of a generalization of this algorithm for any generator matrix $$\overline {B}$$ as follows. First solve the system of equations $$\mathbf {y}=\overline {B}\mathbf {u}$$, and then round the solution, outputting the point $$\mathbf {x}=\overline {B}[ \mathbf {u}]$$ (this is sometimes known as the Babai point, after the Hungarian mathematician Laszlo Babai). Unfortunately, even for the lattice $$\mathbb {Z}^{2}$$, depending on the basis, this procedure may fall short of any reasonable estimate, as discussed in Exercise 2.12. In general finding the closest vector point to a given lattice basis is, in computational complexity language, an NP-hard problem [72]. This problem is closely related to the quantization problem in Sect. 2.5.1. In fact, in both cases we want to find the closest vector to a given lattice point. However the main difference lies in the fact that, from a complexity perspective, algorithms that solve CVP for any generator matrix (or for a large enough class) are sought, whereas from a coding theory perspective, we want to design a lattice with an easy CVP solver.

The two problems CVP and SVP, and their many variants, have been employed for cryptographic purposes since 1996 [3]. We provide next a general idea of how public-key cryptography can be performed using lattices. Suppose a user (usually called Alice in the cryptography literature) has access to a “good” generator matrix B for a high-dimensional lattice $$\varLambda \subset \mathbb {R}^{n}$$. From B, Alice generates a “bad” basis H and makes H publicly available while keeping B secret. Now anyone (say, Bob) with access to H can send an encrypted message $$\mathbf {u}\in \mathbb {Z}^{n}$$ as follows. Bob generates a noise vector n and sends the vector y = Hu + n to Alice. Noticing that x = Bu is a lattice point, if n is “small” enough, Alice can recover x by finding the closest lattice point to y. Roughly speaking, a “good” basis is one such that the (very efficient) rounding procedure explained in the previous paragraph will work, whereas for “bad” basis it is hard to guess the correct vector x (for instance, the rounding procedure will output a vector far from x, as in Exercise 2.12). Therefore, an intruder that intercepts y and has access to H is not expected to efficiently guess the sent message x.

Of course the above high-level description depends critically on how to choose the noise vector, the “good” and the “bad” basis or, in other words, the private-key B and the public-key H. For further information on this and on other applications of lattices to cryptography, the reader is referred to [73]. We close this section with a word on two relevant notions: special bases and bounds on the shortest vector.

### Special Bases

The rounding procedure described in this section is not sufficient to solve the closest vector problem and, depending on the chosen basis, may produce very crude estimates. To overcome this problem, we might want to preprocess the basis given to us before trying to find the closest lattice point x to a given point $$\mathbf {y}\in \mathbb {R}^{n}$$. For example, the best possible basis for the integer lattice $$\mathbb {Z}^{n}$$ in terms of complexity of finding the closest vector is the canonical basis. However not all lattices possess such a neat basis. Intuitively, a good basis for a lattice Λ is as close as possible from being “orthogonal,” with small norm vectors. This notion has been quantified and formalized in several different ways. We present below the notion of Minkowski-reduced basis, arguably the most intuitive way of defining a “good” basis.

We say that a set of vectors $$\left \{ \mathbf {b}_{1},\ldots ,\mathbf {b}_{i}\right \} \subset \varLambda$$ is primitive if it can be extended to a basis of Λ, i.e., if there exist $$\left \{ \mathbf {b}_{i+1},\ldots ,\mathbf {b}_{n}\right \}$$ such that $$\left \{ \mathbf {b}_{1},\ldots ,\mathbf {b}_{i},\mathbf {b}_{i+1},\ldots ,\mathbf {b}_{n}\right \}$$ is a basis for Λ.

Definition 2.15 (Minkowski-Reduced Basis)

A basis $$\left \{ \mathbf {b}_{1},\ldots ,\mathbf {b}_{n}\right \}$$ for a lattice Λ is said to be Minkowski-reduced if:
1. (i)

b 1 is a shortest vector in Λ and

2. (ii)

for any i = 1, …, n − 1, bi+1 is a shortest vector in Λ such that $$\left \{ \mathbf {b}_{1},\ldots ,\mathbf {b}_{i},\mathbf {b}_{i+1}\right \}$$ is primitive.

Given a basis $$\alpha =\left \{ \mathbf {b}_{1},\ldots ,\mathbf {b}_{n}\right \}$$, the above conditions (i) and (ii) will imply inequalities to be satisfied by its associated Gram matrix $$G=\{b_{ij}\}=\left \langle \mathbf {b}_{i},\mathbf {b}_{j}\right \rangle$$ for this basis to be Minkowski-reduced. Some of these inequalities are [26, Chap. 15, 10.1]:

1. (A)

0 < b11 ≤ b22 ≤… ≤ b nn If v = b t  −∑sS𝜖 s b s (for some set S of subscripts s < t and 𝜖 s  = ±1), the inequality $$\left \| \mathbf {b}_t\right \| \leq \left \| \mathbf {v} \right \|$$ becomes

2. (B)

$$2\left |{\textstyle {\displaystyle \sum _{s\in S}}\epsilon _{s}b_{st}-{\displaystyle \sum _{r,s\in S}}}\epsilon _{r}\epsilon _{s}b_{rs}\right |\leq {\displaystyle \sum _{s\in S}}b_{ss}$$. For the cases S = {i}, S = {i, j}, and S = {i, j, k}, the above condition B can be written as:

3. (B1)

$$2\left |b_{ij}\right |\leq b_{ii}$$, (i < j);

4. (B2)

$$2\left |b_{ij}\pm b_{ik}\pm b_{jk}\right |\leq b_{ii}+b_{jj}$$, (i < j < k); and

5. (B3)

$$2\left |\epsilon _{1}b_{ir}+\epsilon _{2}b_{jr}+\epsilon _{3}b_{kr}-\epsilon _{1}\epsilon _{2}b_{ij}-\epsilon _{1}\epsilon _{3}b_{ik}-\epsilon _{2}\epsilon _{3}b_{jk}\right |\leq b_{ii}+b_{jj}+b_{kk}$$, (i < j < k < r)

For n = 2, n = 3, and n = 4, the simultaneous conditions A and B1; A, B1, and B2; and A, B1, B2, and B3, respectively, are also sufficient to assure that the basis is Minkowski-reduced [26]. These characterizations can be used in Exercises 2.3 and 2.8. Note that condition B is related to the “more orthogonal” characteristic required for such bases. As it can be shown in Exercise 2.3, {(1, 1, 0), (1, 0, 1), (0, 1, 1)} is a basis for the FCC lattice composed by vectors of minimum norm, but it is not Minkowski-reduced since condition B2 is not verified.

Any lattice has a Minkowski-reduced basis, but unfortunately, for high dimensions, there is no simple characterization, and producing such a basis is computationally hard. It entails, for instance, calculating the shortest vector and, therefore, should be at least as hard as solving SVP [2]. One widely used relaxation in the literature is the definition of LLL -reduced basis [73], which provides relatively small vectors and can be computed with fast algorithms. For a thorough formal complexity discussion on reduced bases and other computational aspects, the reader is referred to [73].

### Minkowski Theorem

If we were to search the shortest lattice vector to solve Problem 2.1 by looking at all points inside a ball, how large should the radius of this ball be? The following fundamental bound due to Minkowski gives a first approach to this question.

Theorem 2.4

The minimum norm λ of a full rank lattice $$\varLambda \subset \mathbb {R}^n$$ satisfies
\displaystyle \begin{aligned} \lambda\leq\sqrt{n}V(\varLambda)^{1/n}. \end{aligned}
(2.26)

Before proving the theorem, we perform a quick sanity check. If Λ is scaled by α > 0, then its minimum norm is also scaled by α > 0, while its volume is scaled by α n . The term V (αΛ)1/n = αV (Λ)1/n then guarantees that the bound scales appropriately.

Proof

From the expression for the density of Λ (2.13), we have
\displaystyle \begin{aligned} \varDelta(\varLambda)=\frac{\mbox{vol }{\mathcal{B}^{n}(\rho)}}{V(\varLambda)}=\left(\frac{\lambda}{2}\right)^{n}\frac{\mbox{vol }{\mathcal{B}^{n}(1)}}{V(\varLambda)}\leq1\Rightarrow \end{aligned}
\displaystyle \begin{aligned} \lambda\leq2V(\varLambda)^{1/n}/\mbox{vol }{\mathcal{B}^{n}(1)}^{1/n}. \end{aligned}
To finish the proof, we have to bound the volume of a unit ball. Notice that a maximal inscribed cube in the ball $$\mathcal {B}^{n}(1)$$ has diagonal length 2 and side length $$2/\sqrt {n}$$ (Exercise 2.11). In particular, we have the inclusion $$[-1/\sqrt {n},1/\sqrt {n}]^{n}\subset \mathcal {B}^{n}(1)$$, which implies the inequality
\displaystyle \begin{aligned} \mbox{vol }{\mathcal{B}^{n}(1)}\geq(2/\sqrt{n})^{n}. \end{aligned}
A slightly tighter upper bound can be obtained by noticing that
\displaystyle \begin{aligned}(\mbox{vol }{\mathcal{B}^{n}(1)})^{1/n} \sim \sqrt{\frac{2\pi e}{n}} \end{aligned}
(2.27)
in high dimensions (this follows from (2.14) and from Stirling’s approximation for the factorial, e.g., [26]). The upper bound (2.26) can be far from tight, even for the simplest example $$\varLambda =\mathbb {Z}^{n}$$. However, the Minkowski-Hlawka lower bound briefly mentioned in Sect. 2.4.1, combined with (2.27), implies that there exist lattices with minimum norm at least $$\sim V(\varLambda )^{1/n} \sqrt {n/2\pi e}$$.

Remark 2.5

The ratio λ2/V (Λ)2/n is called the Hermite parameter of Λ (and is of course, closely related to the packing density). The previous discussions show that the Hermite parameter of the densest n-dimensional lattice should grow linearly with n.

For the closest vector Problem 2.2, bounds of the same nature as that of Theorem 2.26 for the SVP are far more complicated. From the definition of the covering radius μ, the distance from any point to a closest lattice point should not exceed μ. However, there is no simple way of bounding μ. A very useful (nontrivial) bound is μλ≤ n/2; here λ is the minimum norm of Λ. A proof for this result is out of the scope of the book and can be found in [6].

## Exercises

### Exercise 2.1

Verify that the sets {(1, 1), (−1, 1)} and {{(2, 0, 0), (1, 1, 0), (1, 0, 1)} in Example 2.4 are bases for D2 and D3, according to the definition of D n .

### Exercise 2.2

Show that an m × m matrix is unimodular (has integer entries and determinant 1 or  − 1) if and only if it has integer entries and is invertible and its inverse matrix has also integer entries. (Hint: Recall determinant properties and the expression for the inverse of a matrix in terms of its cofactors.)

### Exercise 2.3

Show as a direct consequence of Theorem 1.2 that two full rank square matrices A and B generate the same lattice if and only if B−1A is a unimodular matrix and use this result to check if the sets α = {(−1, −1, 0), (1, −1, 0), (0, 1, −1)} and β = {(1, 1, 0), (1, 0, 1), (0, 1, 1)} are bases for the FCC lattice and if the set γ = {(1, −1, 1), (1, 1, −1), (1, 1, 1)} is a basis for the BCC lattice (see Example 2.4). Show also (checking the conditions A, B1, and B2 just after Definition 2.15) that α and γ are Minkowski-reduced bases for these lattices but β is not.

### Exercise 2.4

1. (a)

Determine the Voronoi regions of the lattices in Examples 2.1, 2.2, and 2.5, and check with Fig. 2.5.

2. (b)

Design the Voronoi region of the BCC and FCC lattices (Examples 2.3 and 2.4).

### Exercise 2.5

Consider a full rank lattice Λ. Prove that a fundamental parallelotope $$\mathcal {P}(B)$$ of Λ tiles $$\mathbb {R}^{n}$$ by verifying (i) and (ii) (Eq. (2.7)).

### Exercise 2.6

Prove that if Λ1 ∼ Λ2, then $$\varLambda _{1}^{*}\sim \varLambda _{2}^{*}$$.

### Exercise 2.7

Show that the lattice A3 introduced in Example 2.3 is equivalent to the lattice D3 from Example 2.4 (which is also the lattice FCC). You may use the technique of Example 2.9.

### Exercise 2.8

This exercise explores several lattice concepts in dimension 2. Consider the lattice Λ in $$\mathbb {R}^{2}$$ generated by {(1, 11), (2, 18)}.
1. (a)

Look for a “good” basis and find the minimum distance of the lattice. Is your basis a Minkowski-reduced one?

2. (b)

Describe a fundamental parallelotope of your choice, the Voronoi region and another fundamental region.

3. (c)

Find the packing and the covering radii, the kissing number, and the packing and covering densities of Λ.

4. (d)

Find a rectangular sublattice $$\varLambda ^{'}$$ of Λ and the coset classes of $$\frac {\varLambda }{\varLambda ^{'}}$$.

5. (e)

Determine the dual lattice, Λ, and its relevant parameters.

6. (f)

Illustrate the relation $$\varLambda \subseteq \varLambda ^{*}\subseteq (\frac {1}{V(\varLambda )^{2}})\varLambda$$ (since Λ is an integer lattice). What lattice do you think is “better,” in some sense, Λ or $$\varLambda ^{'}$$?

### Exercise 2.9

Prove that the probability that n is closer to a point of norm m than to the origin is upper bounded by $$(1/2)e^{-m^{2}/8\sigma ^{2}}$$. (Hint: First show that the inner product $$\left \langle \mathbf {n},\mathbf {x}\right \rangle$$ has normal distribution with variance $$\left \Vert \mathbf {x}\right \Vert ^{2}\sigma ^{2}$$.)

### Exercise 2.10

Show that the dual of the hexagonal lattice is equivalent to itself. Identify the associated rotation and scaling factor.

### Exercise 2.11

A rectangle $$\mathcal {R}\subset \mathbb {R}^{n}$$ is a set of the form
\displaystyle \begin{aligned} \mathcal{R}=\left\{ \mathbf{x}\in\mathbb{R}^{n}:x_{i}\in[a_{i},b_{i}],i=1,\ldots,n\right\} =[a_{1},b_{1}]\times\ldots\times[a_{n},b_{n}], \end{aligned}
for integers a i  < b i . The volume of a rectangle is (b1 − a1) × (b2 − a2) × (b n  − a n ). Show that the rectangle with the smallest volume contained in $$\mathcal {B}^{n}(1)$$ is a cube with $$a_{i}=-1/\sqrt {n}$$ and $$b_{i}=1/\sqrt {n}$$ (or any of its rotations).

### Exercise 2.12

Let B be the matrix
\displaystyle \begin{aligned} \left[\begin{array}{cc} 4390 & 133\\ 439033 & 13301 \end{array}\right] \end{aligned}
and y = (1.3, −1.9).
1. (a)

Using the matrix B and the rounding procedure described in Sect. 2.5.1, find an estimate for the closest point to the lattice generated by Λ.

2. (b)

Check that the lattice generated by B is equal to $$\mathbb {Z}^{2}$$. Compare the solution to a) with the actual closest lattice point.

### Exercise 2.13

The cartesian product between two full rank lattices $$\varLambda _{1}\subset \mathbb {R}^{n_{1}}$$ and $$\varLambda _{2}\subset \mathbb {R}^{n_{2}}$$ is defined as
\displaystyle \begin{aligned} \varLambda_{1}\times\varLambda_{2}=\left\{ (x_{1},\ldots,x_{n_{1}},y_{1},\ldots,y_{n_{2}})\in\mathbb{R}^{n}:(x_{1},\ldots,x_{n_{1}})\in\varLambda_{1}\mbox{ and }(y_{1},\ldots,y_{n_{2}})\in\varLambda_{2}\right\}, \end{aligned}
where n = n1 + n2. For instance, $$\mathbb {Z}\times \mathbb {Z}=\mathbb {Z}^{2}$$. Show that, for any lattice $$\varLambda \subset \mathbb {R}^{n}$$:
1. a)

The normalized second moment (2.25) of Λ × Λ equals $$\mathcal {G}(\varLambda )$$

2. b)

For any lattice Λ, $$\mathcal {G}(\alpha \varLambda )=\mathcal {G}(\varLambda )$$.

### Exercise 2.14

(*) Calculate $$\mathcal {G}(A_{2})$$. (Hint: Use the Voronoi cell computation of Exercise 2.4.)

## Footnotes

1. 1.

Some authors use the row convention of considering basis vectors as rows of a generator matrix; we follow here the column convention.

2. 2.

In several textbooks and papers, the minimum norm is defined as the square of this number.

3. 3.

Strictly speaking, there might be more than one closest vector to y, which might cause ambiguities. In order for Q Λ (y) to be well defined, one has to break the ties, i.e., to decide which “faces” of the Voronoi cell to use. In order to simplify notation, we will avoid such a technicality and consider that ties are broken according to some well-defined systematic rule. Considering this rule we will also, by abuse of notation, sometimes say “the” closest lattice point to y. Notice that the faces of the Voronoi cell (i.e., the ambiguous points) have measure zero in $$\mathbb {R}^n$$.

4. 4.

Or approximately 1.53, in decibels. This number is sometimes referred to as the ultimate shaping gain of a lattice.

## References

1. 1.
J.F. Adams, Lectures on Lie Groups (Midway Reprints Series) (University of Chicago Press, Chicago, 1983)Google Scholar
2. 2.
E. Agrell, T. Eriksson, A. Vardy, K. Zeger, Closest point search in lattices. IEEE Trans. Inf. Theory 48(8), 2201–2214 (2002)
3. 3.
M. Ajtai, Generating hard instances of lattice problems, in Proceedings of the Twenty-Eighth Annual ACM Symposium on Theory of Computing, STOC ’96, New York, NY (ACM, 1996), pp. 99–108Google Scholar
4. 6.
W. Banaszczyk, New bounds in some transference theorems in the geometry of numbers. Math. Ann. 296(1), 625–635 (1993)
5. 8.
E.S. Barnes, G.E. Wall, Some extreme forms defined in terms of abelian groups. J. Aust. Math. Soc. 1(1), 47–63 (1959)
6. 14.
N. Bourbaki, Lie Groups and Lie Algebras: Chapters 4–6 (Elements of Mathematics) (Springer, Berlin, 2002)
7. 20.
J.W.S. Cassels, An Introduction to the Geometry of Numbers (Springer, Berlin, 1997)
8. 21.
H. Cohen, A Course in Computational Algebraic Number Theory (Springer, New York, 1996)Google Scholar
9. 23.
J. Conway, N. Sloane, Voronoi regions of lattices, second moments of polytopes, and quantization. IEEE Trans. Inf. Theory 28(2), 211–226 (1982)
10. 24.
J.H. Conway, N.J.A. Sloane, Laminated lattices. Ann. Math. 116(3), 593–620 (1982)
11. 25.
J.H. Conway, N.J.A. Sloane, On the voronoi regions of certain lattices. SIAM J. Algebr. Discret. Methods 5(3), 294–305, (1984)
12. 26.
J.H. Conway, N.J.A. Sloane, Sphere-Packings, Lattices, and Groups (Springer, New York, 1998)
13. 72.
D. Micciancio, S. Goldwasser, Complexity of Lattice Problems. The Kluwer International Series in Engineering and Computer Science, vol. 671 (Kluwer Academic Publishers, Boston, MA, 2002). A cryptographic perspectiveGoogle Scholar
14. 73.
D. Micciancio, O. Regev, Lattice-Based Cryptography. Post-Quantum Cryptography (Springer, Berlin, 2009)
15. 77.
G. Nebe, E.M. Rains, N.J.A. Sloane, A simple construction for the barnes-wall lattices, in Codes, Graphs, and Systems (Springer, Berlin, 2002), pp. 333–342
16. 86.
C.A. Rogers, Packing and Covering (Cambridge University Press, Cambridge, 1964)
17. 90.
A. Schurmann, F. Vallentin, Computational approaches to lattice packing and covering problems. Discret. Comput. Geom. 35(1), 73–116 (2006)
18. 98.
N.J.A. Sloane, The sphere packing problem. Doc. Math. Extra Volume ICM, 387–396 (1998)Google Scholar

## Authors and Affiliations

• Sueli I. R. Costa
• 1
• Frédérique Oggier
• 2
• Antonio Campello
• 3
• Jean-Claude Belfiore
• 4
• Emanuele Viterbo
• 5
1. 1.Institute of Mathematics, Statistics and Computer ScienceUniversity of CampinasCampinasBrazil
2. 2.Division of Mathematical Sciences, School of Physical and Mathematical SciencesNanyang Technological UniversitySingaporeSingapore
3. 3.Department of Electrical and Electronic EngineeringImperial College LondonLondonUK
4. 4.Communications and Electronics DepartmentTélécom ParisTechParisFrance
5. 5.Department of Electrical and Computer Systems EngineeringMonash UniversityClaytonAustralia