← Hall of Foundations Exhibit 147 · shortest vector
The Foundation Under Post-Quantum Crypto

A grid that
hides its shortcut

A lattice consists of integer combinations of basis vectors. The shortest nonzero vector can be hard to find in suitable high-dimensional instances; dimension alone does not make every lattice hard. Related structured lattice problems support ML-KEM and ML-DSA. Other post-quantum families, including hash-based signatures, have different foundations.

Two views of a lattice. A change of basis can obscure short vectors, but arbitrary dragging changes the lattice. The two presets hold the square lattice fixed. This two-dimensional model is efficiently solvable and does not establish cryptographic hardness.
§1

Two vectors, infinite grid

Pick two independent vectors b₁ and b₂. Their integer combinations form a lattice. Arbitrary dragging can change the lattice itself. Only invertible integer changes of basis with determinant ±1 preserve the same lattice. The good and bad preset buttons provide two bases for the same square lattice.

—
Drag either arrowhead to change the basis. Reveal marks the true shortest vector (teal). A "bad" basis has long, nearly-parallel vectors that make it hard to spot.
Keyboard alternative: type integer components for each basis vector, then reveal the shortest vector.
§2

Easy in two dimensions, brutal in five hundred

In two dimensions efficient reduction algorithms find a shortest vector. In high dimensions, known algorithms for many relevant exact or approximation problems can be expensive. Cryptographic security still depends on the instance distribution, approximation target and parameters, not simply on a large dimension.

SVP: given a basis, find the shortest nonzero lattice vector
The security gap is the distance between eyeballing it in 2D and searching for it in 500D.
Where this touches your keys

The lattice-based standards connect here

ML-KEM and ML-DSA use specific module-lattice assumptions, including Module-LWE and, for signatures, Module-SIS-related assumptions. Their keys contain short secret vectors and structured public equations rather than a generic hidden good basis. The picture offers geometric intuition; it is not a proof that breaking either standard is equivalent to solving arbitrary exact SVP.

Three views of one problem. §147 is the geometry — why the secret stays hidden. §152 is the decoding — why its owner still gets in. §157 is the algebra — what the keys are actually made of. Read them in that order.