 Okay, thank you. First comment, people in the back, there are plenty of seats up here toward the front. I know no one likes sitting in front, but I won't be calling on people, so don't worry about it. Second, so my name's Joe Silverman. This is actually the title for sort of the five lectures. There'll be individual titles. Welcome to PCMI Graduate Summer School, probably the first time for most of you. It's also my first time, so we can figure out logistics together. There will be a problem session for this series of lectures. Today, Tuesday, Wednesday, and Friday, directly after this lecture, in the really big tent with the circular tables, not the little tent that was all dusty where people ended up having breakfast. Okay, if you haven't downloaded the PDF for these talks, you should do so, and even if you did, you should download it again, because there's an updated version that a few people, including our wonderful TA, pointed out some typos, including math errors. And those notes include some problems to work on for each lecture, so those can be only starting points for the problem sessions. And on that note, I should apologize. I'm sure there are lots more typos in them. I actually noticed a couple typos in my slides, so that's life, right? That's math. Okay, so the five lectures this week in this series, today we're gonna talk about lattices sort of in a theoretical sense. Tomorrow, lattice is in a practical sense. How do you do computations with them? Wednesday is gonna be what I call crypto 101. It's a quick introduction to public key cryptography. It will probably overlap, whoops, to some extent with Christelle's lecture this afternoon, but that's good, it's always nice to see things from different perspectives. And then Thursday and Friday, I'll talk about lattices and how they're used in cryptography. So that's the agenda. If you have urgent questions during the talk, you can put up your hand, I will, if I notice you have to try to, I'll call in you, otherwise after the talk, but also during the problem session, I'll be around there also. Feel free to come up with questions. I like questions. Okay, and having said that, any logistical questions, that sound good? Okay, so the first lecture is about lattices and hard lattice problems. So let's start, what is a lattice? And I'm gonna warn you, this slide has lots of definitions, the next slide has the picture that will make it clearer. So a lattice of dimension n, it's a discrete subgroup of n-dimensional real space, sort of a regularly arranged space of dots or vectors. Okay, or another way to say it is just pick n linearly independent vectors in Rn, and in linear algebra, you're used to taking the R linear spans of those, so it's a basis, you get every vector that way, but here I'm just gonna take the spans with integer coefficients. So now you get a discrete set of points. And the vectors I'm using to generate this lattice are called a basis for the lattice, and lattices have lots of different bases, some of them better than others, and in fact, that will be the theme for the week, good bases versus bad bases. One key concept for a lattice is that of a fundamental domain, which you've probably seen fundamental domains in a lot of contexts, this would be a set of vectors in real space so that every vector is equal to some lattice translate. So we can get a fundamental domain by just taking the, again, linear span of these basis vectors, but now the coefficients are real numbers between zero and one. And if you can imagine this in two-dimensional space, you get a parallelogram, which you'll see on the next slide. But before going there, associated to a fundamental domain is its area. So parallelogram has area, three-dimensional parallelogram, people know that word, parallel piped, it's a mouthful, and then higher-dimensional analogs of that. And I'll let the determinant of L will be the volume of one of these fundamental domains, where if you take the basis vectors and put them in as column vectors in a matrix, you just take the determinant. There's a sign, you know, you might get a minus sign, so take the absolute value, and that gives you the volume of the fundamental domain. And I keep, this clicker doesn't actually work with my computer, but I'm holding it so that I can point at things. Anyway, so here's a picture of a two-dimensional lattice. The two basis vectors that I chose were the vector connecting these two dots and these two dots. And you can see the fundamental domain is the parallelogram. And you can get translated fundamental domains like there's one up here and so on. And you could also choose a different basis, a different Z basis for the lattice, and you get a different parallelogram. It might be skinnier or wider or whatever. Okay? So everyone got a mental picture of what a lattice is, I hope, at least in two dimensions. The problem is in cryptography you use lattices of roughly 500 to 1,000 dimensions. So you want to imagine two and three-dimensional lattices and then work with them algebraically to handle them in 1,000 dimensions. So here are two closely related, and in some sense really the fundamental hard problems associated with lattices of this sort. So let's let L be a lattice as on the previous couple of slides of dimension N. And the first of these is called the shortest vector problem, abbreviated SVP. And it's not complicated, in fact the name gives it away. You want to find the shortest vector in the lattice. Well, that's silly, zero's in the lattice. So the shortest non-zero vector in the lattice. Okay? The closest vector problem is similar. It would be I give you some target vector just in real space and you have to find the lattice point that's closest to it, so the dot that's closest. Okay? So more generally, since these problems tend to be very hard, we can ask, well, I'm not gonna make you solve it exactly but just reasonably closely. So for the shortest vector problem, maybe I won't ask you to find the shortest non-zero vector but something that's no more than 10 times longer than the shortest vector. Okay? Or 100 times longer, whatever. And similarly, you don't have to find the closest vector, lattice point to the target, but just something that's no more than 10 or 20 or 100 or 1,000 times further away. So here, I'm gonna illustrate these two problems. Well, actually, no, I guess I'm not gonna illustrate the shortest vector problem. So I'll do that with this. What's the shortest non-zero vector in the lattice? It's this point, right? But actually, that was a badly phrased sentence. That's not the shortest vector, it's a shortest vector. Negative that vector is in the lattice and it has the same length. And you can have lattices that have a whole bunch of shortest vectors, you know, even pointing different directions. But this is a shortest vector. All right. So let's try to solve the closest vector problem. Here's my target vector. What's the closest lattice point? Well, pretty easy to see, it's that point, right? But imagine the thousand dimensions rather than two, it gets harder. So the idea is to take, well, actually, I guess I'm slightly changing my definition of fundamental domain. This would have been the fundamental domain here and this is a translated fundamental domain. So you draw a translated fundamental domain that contains the target point and then you try to find one of the vertices of that translated fundamental domain