Simultaneous diophantine approximation

3.10.3 Simultaneous diophantine approximation

Simultaneous diophantine approximation is concerned with approximating a vector ( q 1 q , q 2 q , ..., q n q ) of rational numbers (more generally, a vector (α 1 ,α 2 ,...,α n ) of real numbers) by a vector ( p 1 p , p 2 p ,..., p n p ) of rational numbers with a smaller denominator p. Algorithms for finding simultaneous diophantine approximation have been used to break some knap-

sack public-key encryption schemes ( §8.6). 3.106 Definition Let δ be a real number. The vector ( p 1 p , p 2 p ,..., p n p ) of rational numbers is said

to be a simultaneous diophantine approximation of q 1 q 2 q δ-quality to the vector ( n q , q ,..., q ) of rational numbers if p < q and

q −p i

−δ for i = 1, 2, . . . , n.

(The larger δ is, the better is the approximation.) Furthermore, it is an unusually good si-

multaneous diophantine approximation (UGSDA) if δ> 1 n .

Fact 3.107 shows that an UGSDA is indeed unusual. 3.107 Fact For n ≥ 2, the set

S n (q) =

, ,..., |0≤q i < q, gcd(q 1 ,q 2 ,...,q n q , q) = 1 q q has at least 1 2 q n members. Of these, at most O(q n(1−δ)+1 ) members have at least one δ-

quality simultaneous diophantine approximation. Hence, for any fixed δ> 1 n , the fraction of members of S n (q) having at least one UGSDA approaches 0 as q → ∞.

Algorithm 3.108 reduces the problem of finding a δ-quality simultaneous diophantine approximation, and hence also a UGSDA, to the problem of finding a short vector in a lat- tice. The latter problem can (usually) be solved using the L 3 -lattice basis reduction.

Handbook of Applied Cryptography by A. Menezes, P. van Oorschot and S. Vanstone.

122 Ch. 3 Number-Theoretic Reference Problems

3.108 Algorithm Finding a δ -quality simultaneous diophantine approximation INPUT: a vector w=( q 1 q 2 q q n , q ,..., q ) of rational numbers, and a rational number δ > 0.

OUTPUT: a p 1 p 2 p δ-quality simultaneous diophantine approximation ( n p , p ,..., p ) of w.

1. Choose an integer

λ≈q δ .

B for the (n + 1)-dimensional lattice L which is generated by the rows of the matrix

2. Use Algorithm 3.101 to find a reduced basis

3. For each v = (v 1 ,v 2 ,...,v n ,v n+1 ) in B such that v n+1 6= q, do the following:

3.1 p←v n+1 .

3.2 For i from 1 to n, set p i 1 v ← i q λ + pq i .

−δ for each

i, 1 ≤ i ≤ n, then return( p , p ,..., p ).

4. Return(FAILURE). (Either no δ-quality simultaneous diophantine approximation ex- ists, or the algorithm has failed to find one.)

Justification. Let the rows of the matrix

A be denoted by b 1 ,b 2 ,...,b n+1 . Suppose that ( q 1 q , q 2 q n

q ,..., q ) has a δ-quality approximation ( p , p ,..., p ). Then the vector

x=p 1 b 1 +p 2 b 2 +···+p n b n + pb n+1

= (λ(p 1 q − pq 1 ), λ(p 2 q − pq 2 ), . . . , λ(p n q − pq n ), p) is in

L and has length less than approximately ( n + 1)q. Thus x is short compared to the original basis vectors, which are of length roughly q 1+δ . Also, if v = (v 1 ,v 2 ,...,v n+1 ) is

a vector in p 1 p 2 p L of length less than q, then the vector ( n p , p ,..., p ) defined in step 3 is a δ- quality approximation. Hence there is a good possibility that the L 3 -algorithm will produce

a reduced basis which includes a vector v that corresponds to a δ-quality approximation.