On (Non-)Isomorphism of Self-Dual Lattices and Codes

Abstract: A recent line of work motivated by cryptographic applications has studied the complexity of the Lattice Isomorphism Problem (LIP). In this work, we study LIP on self-dual lattices $\cal{L} \subset \mathbb{R}^n$, which appear naturally in many applications. Our main results are a $2^{n/2 + o(n)}$-time randomized algorithm for LIP and a $\mathsf{coNP}$ protocol for LIP on a broad class of self-dual lattices. These results extend recent work on ZLIP, the problem of deciding whether a lattice is isomorphic to $\mathbb{Z}^n$. In particular, the former result extends the $2^{n/2 + o(n)}$-time algorithms for ZLIP of Bennett, Ganju, Peetathawachai, and Stephens-Davidowitz (Eurocrypt, 2023) and of Ducas (Des. Codes Cryptogr., 2024). The latter result extends the $\mathrm{ZLIP} \in \mathsf{coNP}$ result of Hunkenschröder (Math. Prog. Series A, 2024). Our results leverage two key structural properties of self-dual lattices $\cal{L} \subset \mathbb{R}^n$: (1) every such lattice $\cal{L}$ is isomorphic to $\cal{L}_0 \oplus \mathbb{Z}^r$ for some self-dual lattice $\cal{L}_0$ with $λ_1(\cal{L}_0)^2 \geq 2$, and (2) every such lattice $\cal{L}$ has \emph{characteristic vectors}, i.e., there exist vectors $\mathbf{w} \in \cal{L}$ such that for every $\mathbf{v} \in \cal{L}$, $\langle\mathbf{v}, \mathbf{w}\rangle \equiv \langle\mathbf{v}, \mathbf{v}\rangle \pmod{2}$. Our results use a line of work by Elkies and Gaulter on lattices with long shortest characteristic vectors, and can be strengthened assuming a positive answer to a related question of Elkies (Math. Res. Lett., 1995). We also study Permutation Code Equivalence (PCE) on self-dual codes, and we observe that similar structural properties imply a polynomial-time algorithm for PCE on certain such codes. This gives a natural class of codes with large hull for which PCE is easy.

• The paper introduces a 2^(n/2+o(n))-time randomized algorithm for isomorphism testing on self-dual lattices, extending results from Z^n to a broader class.
• The paper presents a coNP protocol by utilizing characteristic vector parameters and decomposition techniques, enabling robust non-isomorphism certification.
• The paper's findings impact cryptographic constructions by identifying tractable subclasses in self-dual lattices and codes, while raising key open complexity questions.

Summary of "On (Non-)Isomorphism of Self-Dual Lattices and Codes" (2606.18662)

Introduction and Motivation

This paper investigates the computational complexity of the Lattice Isomorphism Problem (LIP) with a particular focus on self-dual lattices, which are of central importance in number theory, topology, sphere packing, and cryptography. While much of the recent cryptographic attention has focused on the hardness of LIP in specialized classes (such as $\mathbb{Z}^n$ or module lattices), this work systematically extends algorithmic and complexity-theoretic results to the broader, structurally richer class of self-dual lattices and their code analogues.

Self-dual lattices are those $\mathcal{L} \subseteq \mathbb{R}^n$ for which $\mathcal{L} = \mathcal{L}^*$, where the dual is defined with respect to the standard inner product. Significant cryptographic primitives, including the HAWK digital signature (a NIST candidate), are reliant on the hardness of LIP on self-dual (often module) lattices. Understanding how the additional structure of self-duality affects isomorphism and equivalence algorithms is both of theoretical and practical relevance.

Main Results

The authors establish new algorithms and protocols for LIP and the Permutation Code Equivalence Problem (PCE) under self-dual assumptions:

• Randomized Algorithm for LIP on Self-Dual Lattices:

A $2^{n/2+o(n)}$-time randomized algorithm for the search version of LIP on self-dual lattices, matching the best known runtime for $\mathbb{Z}^n$-isomorphism and extending it to a substantially wider class. The algorithm leverages structural decompositions and reductions to low-rank instances.

• coNP Protocol for LIP:

A coNP protocol for certifying non-isomorphism in a broad class of self-dual lattices, notably those with "long" shortest characteristic vectors (parameterized by $s(\mathcal{L})$), underpinned by deep results of Elkies and Gaulter concerning bounds on characteristic vector lengths. This generalizes prior work that only established such results for $\mathbb{Z}^n$.

• Algorithm for Permutation Code Equivalence (PCE) on Self-Dual Codes:

Polynomial-time and $2^{2n_0+o(n_0)}$-time algorithms for PCE in self-dual codes with small reductions, using code analogues of the lattice constructions and properties. Large hull codes, which are generally hard for PCE, are identified for which the problem becomes tractable.

Structural Insights

Two critical structural properties of self-dual lattices and codes are exploited:

1. Decomposition: Every self-dual lattice is isomorphic to a direct sum of a reduced self-dual lattice (no short vectors, minimum squared length at least 2) and a rotation of $\mathbb{Z}^r$. The same holds in the code setting.
2. Characteristic Vectors: Every self-dual lattice (and code) admits characteristic vectors serving as algebraic witnesses of non-isomorphism, with their minimal norm or weight quantifiable and preserved under isomorphism/equivalence.

These properties, especially the existence and quantification of characteristic vectors, enable both the algorithmic reductions and the construction of concise witnesses for the coNP protocol.

Extensions and Technical Advances

• Parameterization by Characteristic Vector Norms: By parameterizing the difficulty of LIP and PCE in terms of the minimal norm of characteristic vectors (quantities $s(\mathcal{L})$ and $\mathcal{L} \subseteq \mathbb{R}^n$0) and relating these to bounds $\mathcal{L} \subseteq \mathbb{R}^n$1 and $\mathcal{L} \subseteq \mathbb{R}^n$2 on reduced lattice/code rank, the paper gives a framework for amplifying efficient algorithms and protocols when inputs are "far from worst case".
• Complexity Implications: The coNP protocol for non-isomorphism on these self-dual lattices brings LIP closer to the complexity status of the Graph Isomorphism problem (GI). Through reductions, coNP membership of LIP implies the same for GI, which is a notable complexity-theoretic milestone.
• Algorithmic Improvements for Codes: For self-dual codes with "large" characteristic vectors, the authors provide an explicit, constructive decomposition algorithm enabling efficient PCE testing, thus identifying a subclass with both maximal hulls and algorithmically tractable equivalence.

Numerical and Complexity Results

• Algorithmic Complexity: The main search-LIP algorithm runs in $\mathcal{L} \subseteq \mathbb{R}^n$3 time, where $\mathcal{L} \subseteq \mathbb{R}^n$4 is the reduction rank. For small-$\mathcal{L} \subseteq \mathbb{R}^n$5 (notably, $\mathcal{L} \subseteq \mathbb{R}^n$6), this matches the best known runtimes for isomorphism of $\mathcal{L} \subseteq \mathbb{R}^n$7.
• coNP and NP Protocols: For $\mathcal{L} \subseteq \mathbb{R}^n$8 such that $\mathcal{L} \subseteq \mathbb{R}^n$9, the decisional SDLIP$\mathcal{L} = \mathcal{L}^*$0 is in NP $\mathcal{L} = \mathcal{L}^*$1 coNP. Existing work shows this bound holds unconditionally for $\mathcal{L} = \mathcal{L}^*$2.
• PCE on Self-Dual Codes: The algorithm achieves polynomial time for code lengths $\mathcal{L} = \mathcal{L}^*$3. The construction relies on combinatorial decompositions and utilizes Babai's algorithm for the hard core.

Strong Claim Highlight:

The results unconditionally extend $\mathcal{L} = \mathcal{L}^*$4-time isomorphism testing from $\mathcal{L} = \mathcal{L}^*$5 to all self-dual lattices and provide NP $\mathcal{L} = \mathcal{L}^*$6 coNP evidence for isomorphism in a broader parameter regime than previously known.

Implications and Open Questions

These advances reshape both the algorithmic landscape for LIP (and codes) and its foundations for cryptographic construction:

• Practical Implications: Cryptosystems relying on self-dual LIP hardness must justify their parameter choices to avoid subclasses admitting these new efficient algorithms.
• Complexity Landscape: The demonstrated reductions and parameterizations suggest a fine-grained complexity landscape for LIP and PCE, with some subclasses as hard as GI and others susceptible to efficient algorithms.
• Theoretical Avenues: A key open problem is whether an algorithm for LIP on arbitrary self-dual lattices exists with truly sub-exponential complexity. Determining the finiteness of $\mathcal{L} = \mathcal{L}^*$7 and $\mathcal{L} = \mathcal{L}^*$8 for all $\mathcal{L} = \mathcal{L}^*$9 remains central for further improvements.

Future directions include refining algorithms for more general classes of self-dual lattices and codes (e.g., with arbitrary hull dimension), leveraging characteristic vector search, and tightening the relationship between LIP, PCE, and GI in both classical and quantum computational settings.

Conclusion

The paper provides an extensive and technically deep treatment of isomorphism and equivalence in self-dual lattices and codes, advancing algorithmic understandings and delineating broader complexity-theoretic implications. The extensions to $2^{n/2+o(n)}$0-time algorithms and NP $2^{n/2+o(n)}$1 coNP protocols for large classes of structured lattices and codes establish a new baseline for both theoretical and applied investigations, especially in cryptographically motivated settings. Continued exploration of the structural invariants and their algorithmic ramifications is likely to yield further advances in computational lattice theory and code-based cryptography.