← Hall of Foundations Exhibit 147 · shortest vector
The Foundation Under Post-Quantum Crypto

A grid that
hides its shortcut

A lattice is an infinite grid of points. Somewhere in it sits a shortest nonzero vector — the point nearest the origin. Finding it, in high dimensions, is believed hard even for a quantum computer. That difficulty is the bedrock beneath Kyber, Dilithium, and the whole post-quantum shelf.

The basis is a disguise. The same lattice can be described by a tidy basis that reveals its short vectors, or a skewed one that hides them — and recovering the short vectors from a skewed description is the hard problem the post-quantum standards are built on. Drag the vectors below and watch the disguise work.
§1

Two vectors, infinite grid

Pick two vectors b₁ and b₂. Every integer combination i·b₁ + j·b₂ is a lattice point. Those two vectors are a basis — but they're not the only basis for the same grid. Drag the arrowheads and the grid stays put while the basis that generates it changes.

—
Drag either arrowhead to change the basis. Reveal marks the true shortest vector (teal). A "bad" basis has long, nearly-parallel vectors that make it hard to spot.
Keyboard alternative: type integer components for each basis vector, then reveal the shortest vector.
§2

Easy in two dimensions, brutal in five hundred

In the plane you can almost eyeball the shortest vector. But cryptographic lattices live in hundreds of dimensions, where the number of candidate combinations explodes beyond any search. The Shortest Vector Problem — and its cousin, finding the closest lattice point to a target — is the hard problem the schemes lean on.

SVP: given a basis, find the shortest nonzero lattice vector
The security gap is the distance between eyeballing it in 2D and searching for it in 500D.
Where this touches your keys

The post-quantum shelf stands here

The deployed post-quantum standards — ML-KEM (Kyber) and ML-DSA (Dilithium), surveyed in Modern Cryptography — all rest on lattice hardness. When factoring and discrete logs fall to quantum computers, this is the ground that's expected to hold. Their keys don't literally publish a bad basis and hide a good one — that's the older GGH/NTRU trapdoor shape. Both standards instead publish noisy linear equations and keep a short secret vector; the CVP exhibit lays that out. What carries over is the hardness: finding short vectors in a high-dimensional lattice is what their security ultimately rests on.

Three views of one problem. §147 is the geometry — why the secret stays hidden. §152 is the decoding — why its owner still gets in. §157 is the algebra — what the keys are actually made of. Read them in that order.