发表机构
State Key Laboratory of Mathematical Sciences, Academy of Mathematics and Systems Science（数学科学学院，中国科学院数学与系统科学研究院）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
本文通过从X3C的多项式时间多归约，证明模4余3素数对应的秩-2分圆模上的ℓ₂范数SVP判定问题是NP完全的，同时得出搜索型SVP在多项式时间图灵归约下也具NP困难性。
AI 中文摘要
令q为模4余3的素数，ζ_q为q次本原单位根，记K=ℚ(ζ_q)，其整数环为𝒪_K=ℤ[ζ_q]。本文通过从3集合精确覆盖问题（X3C）出发的确定性多项式时间多归约，证明了在𝒪_K²的满秩自由子模上，ℓ₂范数下的最短向量问题（SVP）的判定版本是NP完全的，且该模的秩固定为2。作为ℤ-格，该模的秩为2(q-1)，随q增长。主要障碍是𝒪_K作用下的封闭性：包含非零向量的模也包含该向量与𝒪_K中非零元素的所有标量倍，其中部分标量倍可能更短。本文用三个思路克服此障碍：第一，将Bennett–Peikert Reed–Solomon格映射到一个主分圆理想，并利用Wan的点计数估计证明该理想的一个陪集包含大量二元系数代表；第二，基于二次高斯和的校验器将X3C方程转化为规范平方范数；第三，该校验器与第二个模坐标结合理想陪集的分离界，排除𝒪_K作用产生的所有非预期向量。每个构造实例由一个q≡3(mod4)的素数、两个整生成元（其2×2生成矩阵行列式非零）和一个整数平方阈值组成。该构造还给出了多项式时间图灵归约下搜索型SVP的NP困难性。
英文摘要
Let $q$ range over primes congruent to $3$ modulo $4$. Let $ζ_q$ be a primitive $q$th root of unity, and put $K=\mathbb{Q}(ζ_q)$, with ring of integers $\mathcal{O}_K=\mathbb{Z}[ζ_q]$. We prove that the decision version of the Shortest Vector Problem ($\mathrm{SVP}$) in the $\ell_2$-norm is $\mathrm{NP}$-complete on full-rank free submodules of $\mathcal{O}_K^2$ by a deterministic polynomial-time many-one reduction from Exact Cover by 3-Sets (X3C). The module rank is fixed at two. As a $\mathbb{Z}$-lattice, the module has rank $2(q-1)$, which grows with $q$. The main obstacle is closure under the action of $\mathcal{O}_K$. A module containing a nonzero vector also contains every scalar multiple of that vector by a nonzero element of $\mathcal{O}_K$, and some of these multiples may be shorter. Three ideas overcome this obstacle. First, we map the Bennett--Peikert Reed--Solomon lattice to a principal cyclotomic ideal and use Wan's point-count estimates to prove that a coset of this ideal contains many binary coefficient representatives. Second, a checker based on a quadratic Gauss sum turns the X3C equations into a canonical squared norm. Third, the checker and a second module coordinate combine with a separation bound for ideal cosets to rule out every unintended vector created by the $\mathcal{O}_K$-action. Each constructed instance consists of a prime $q\equiv3\pmod4$, two integral generators whose $2\times2$ generator matrix has nonzero determinant, and an integer squared threshold. The construction also gives $\mathrm{NP}$-hardness of search-$\mathrm{SVP}$ under polynomial-time Turing reductions.
