In computer science, lattice problems are a class of optimization problems related to mathematical objects called lattices. The conjectured intractability of such problems is central to the construction of secure lattice-based cryptosystems: lattice problems are an example of NP-hard problems which have been shown to be average-case hard, providing a test case for the security of cryptographic algorithms. In addition, some lattice problems which are worst-case hard can be used as a basis for extremely secure cryptographic schemes. The use of worst-case hardness in such schemes makes them among the very few schemes that are very likely secure even against quantum computers. For applications in such cryptosystems, lattices over vector spaces) or free modules) are generally considered.

For all the problems below, assume that we are given (in addition to other more specific inputs) a basis for the vector space V and a norm N. The norm usually considered is the Euclidean norm L2. However, other norms (such as Lp) are also considered and show up in a variety of results.

denote the length of the shortest non-zero vector in the lattice L: that is,

Shortest vector problem (SVP)

In the SVP, a basis of a vector space V and a norm N (often L2) are given for a lattice L and one must find the shortest non-zero vector in V, as measured by N, in L. In other words, the algorithm should output a non-zero vector v such that . In the following, the size of the problem is specified by n, the dimension of the vector space V.

In the γ-approximation version SVPγ for given .

Hardness results

In 1998, Miklós Ajtai proved that exact SVP in the Euclidean norm is NP-hard under randomized polynomial-time reductions. Subsequent work established randomized hardness of approximation for every constant factor, as well as larger factors under stronger complexity assumptions. The corresponding problem with respect to the uniform norm is known unconditionally to be NP-hard.

In 2025, Isaac Hair and Amit Sahai is permitted.

A 2026 preprint by Daqing Wan.

Algorithms for the Euclidean norm

) in the lattice dimension. The former class of algorithms most notably includes lattice enumeration and random sampling reduction, while the latter includes lattice sieving, computing the Voronoi cell of the lattice, and discrete Gaussian sampling.) and requiring memory scaling polynomially in the lattice dimension.

To solve the γ-approximation version SVPγ for the Euclidean norm, the best known approaches are based on using lattice basis reduction. For large , the Lenstra–Lenstra–Lovász (LLL) algorithm, the Block Korkine-Zolotarev algorithm (BKZ)), and its overall complexity is closely related to the costs of these SVP calls in dimension .

GapSVP

The problem GapSVPβ or larger than can be a fixed function of the dimension of the lattice or . Like other promise problems, the algorithm is allowed to err on all other cases.

Yet another version of the problem is GapSVPζ,γ. It is assured that all the vectors in the Gram–Schmidt orthogonalization and that is the dimension. The algorithm must accept if , and reject if (i.e. ), the problem is equivalent to GapSVPγ because a preprocessing done using the LLL algorithm makes the second condition (and hence, ) redundant.

Closest vector problem (CVP)

In CVP, a basis of a vector space V and a metric M (often L2) are given for a lattice L, as well as a vector v in V but not necessarily in L. It is desired to find the vector in L closest to v (as measured by M-approximation version CVPγ.

Relationship with SVP

The closest vector problem is a generalization of the shortest vector problem. It is easy to show that given an oracle for CVPγ (defined below), one can solve SVPγ by making some queries to the oracle. The naive method to find the shortest vector by calling the CVPγ oracle to find the closest vector to0 does not work because 0 is itself a lattice vector and the algorithm could potentially output0.

The reduction from SVPγ to CVPγ is as follows: Suppose that the input to the SVPγ be the vector returned by is the shortest vector in the given lattice.

Hardness results

Goldreich et al. showed that any hardness of SVP implies the same hardness for CVP. Using PCP tools, Arora..

In 2026, OpenAI is NP-hard, and released a formalization of the result in Lean.

Sphere decoding

Algorithms for CVP, especially the Fincke and Pohst variant, have been used for data detection in multiple-input multiple-output (MIMO) wireless communication systems (for coded and uncoded signals). In this context it is called sphere decoding due to the radius used internal to many CVP solutions.

Integer ambiguity resolution of carrier-phase GNSS

It has been applied in the field of the integer ambiguity resolution of carrier-phase GNSS (GPS). It is called the LAMBDA method in that field. In the same field, the general CVP problem is referred to as Integer Least Squares.

GapCVP

This problem is similar to the GapSVP problem. For GapSVPβ, and the algorithm must answer whether one of the following holds:

• is at most 1, and

• .

, hence the name GapCVP.

Known results

The problem is trivially contained in NP for any approximation factor.

Schnorr..

In 1993, Banaszczyk showed that GapCVPn. puts the problem in both NP and coAM..

.

Shortest independent vectors problem (SIVP)

Given a lattice L of dimension n, the algorithm must output n linearly independent of the lattice.

-approximate version, given a lattice L with dimension n, one must find n linearly independent of length is the th successive minimum of .

Bounded distance decoding

, the algorithm must output the closest lattice vector to it.

Covering radius problem

Given a basis for the lattice, the algorithm must find the largest distance (or in some versions, its approximation) from any vector to the lattice.

Shortest basis problem

Many problems become easier if the input basis consists of short vectors. An algorithm that solves the Shortest Basis Problem (SBP) must, given a lattice basis is as short as possible.

The approximation version SBPγ times longer than the longest vector in the shortest basis.

Use in cryptography

Average-case hardness of problems forms a basis for proofs-of-security for most cryptographic schemes. However, experimental evidence suggests that most NP-hard problems lack this property: they are probably only worst case hard. Many lattice problems have been conjectured or proven to be average-case hard, making them an attractive class of problems to base cryptographic schemes on. Moreover, worst-case hardness of some lattice problems have been used to create secure cryptographic schemes. The use of worst-case hardness in such schemes makes them among the very few schemes that are very likely secure even against quantum computers.

The above lattice problems are easy to solve if the algorithm is provided with a "good" basis. Lattice reduction algorithms aim, given a basis for a lattice, to output a new basis consisting of relatively short, nearly orthogonal vectors. The Lenstra–Lenstra–Lovász lattice basis reduction algorithm (LLL) was an early efficient algorithm for this problem which could output an almost reduced lattice basis in polynomial time. This algorithm and its further refinements were used to break several cryptographic schemes, establishing its status as a very important tool in cryptanalysis. The success of LLL on experimental data led to a belief that lattice reduction might be an easy problem in practice; however, this belief was challenged in the late 1990s, when several new results on the hardness of lattice problems were obtained, starting with the result of Ajtai.

In his seminal papers, Ajtai showed that the SVP problem was NP-hard and discovered some connections between the worst-case complexity and average-case complexity of some lattice problems. Building on these results, Ajtai and Dwork created a public-key cryptosystem whose security could be proven using only the worst case hardness of a certain version of SVP, thus making it the first result to have used worst-case hardness to create secure systems.

See also

• Learning with errors

• Short integer solution problem

References

Further reading