E8, Leech and Other Notable Lattices

Not all lattices are created equal. Certain lattices appear repeatedly in mathematics, physics, and cryptography because they have exceptional properties: maximum packing density, deep algebraic symmetry, or computational structures that make them useful. This section surveys the most important lattice families — concrete examples that ground the abstract theory.

Intuition

Stack oranges at a market and you naturally arrange them in a repeating, interlocking pattern that fits as many as possible into the space. That arrangement is a lattice.

The same question, how densely can equal balls be packed, can be asked in any dimension. In 8 and 24 dimensions it has an exact answer: the E₈ lattice and the Leech lattice give the densest possible packings, as proved in 2016 and 2017. They are among the most studied lattices in mathematics.

The Integer Lattice ℤⁿ

The simplest lattice of all is the standard integer lattice $\mathbb{Z}^n$ : all points in $n$ -dimensional space with integer coordinates. Its basis is the identity matrix $I_n$ , its determinant is 1, and its shortest vector has length 1. Every other lattice can be thought of as a “deformation” of $\mathbb{Z}^n$ by an invertible linear map.

Properties of ℤⁿ

$\det(\mathbb{Z}^n) = 1$ (unit fundamental cell)
$\lambda_1 = 1$ (all coordinate unit vectors have length 1)
$\lambda_1 = \lambda_2 = \cdots = \lambda_n = 1$ (all successive minima equal)
$\mu = \sqrt{n}/2$ (covering radius: the corner of the unit cube)

Self-dual: $(\mathbb{Z}^n)^* = \mathbb{Z}^n$ . The integer lattice is its own dual. This makes it the natural setting for modular arithmetic over integers — the foundation of LWE.

The Hexagonal Lattice A₂ — Densest Packing in 2D

The hexagonal lattice $A_2$ is the two-dimensional root lattice and the solution to the oldest sphere packing problem: how do you arrange circles in the plane to cover the most area? The answer — proven by Thue in 1910 and rigorously confirmed by Fejes Tóth in 1940 — is the hexagonal arrangement, familiar from honeycombs and citrus displays.

The A₂ Lattice — Properties

$A_2$ is spanned by the vectors $b_1 = (1, 0)$ and $b_2 = (1/2, \sqrt{3}/2)$ , or equivalently defined as:

$A_2 = \{ (x_0, x_1, x_2) \in \mathbb{Z}^3 : x_0 + x_1 + x_2 = 0 \}$
embedded into $\mathbb{R}^2$ by projecting onto the plane $x_0 + x_1 + x_2 = 0$ .

Key properties:
$\det(A_2) = \sqrt{3}, \quad \lambda_1 = \sqrt{2}, \quad \text{kissing number} = 6$
Packing density: $\Delta(A_2) = \pi/\sqrt{12} \approx 0.9069$ — the maximum possible in 2D, achieving Hermite’s constant $\gamma_2 = 2/\sqrt{3}$ (see SVP).

$A_2$ is self-dual up to rotation and scaling: $A_2^*$ is a rotated copy of $A_2$ scaled by $1/\sqrt{3}$ . Its Voronoi cells are regular hexagons, making it the most efficient 2D covering lattice as well.

The Root Lattices: Aₙ, Dₙ, and the Exceptional D₄

Root lattices arise from the classification of semisimple Lie algebras. They are the “next simplest” lattices after $\mathbb{Z}^n$ and have important applications in sphere packing, error-correcting codes, and algebraic number theory.

The Aₙ lattice family

$A_n \subset \mathbb{Z}^{n+1}$ : the set of integer vectors $(x_0, \dots, x_n)$ summing to zero.

$\det(A_n) = \sqrt{n+1}, \quad \lambda_1(A_n) = \sqrt{2}$ (Here $\det$ is the volume of a fundamental cell; the Gram determinant is $n+1$ .)
Kissing number of $A_n$ : $n(n+1)$ .

$A_1 = \mathbb{Z}$ (the integers), $A_2$ is the hexagonal lattice (optimal 2D packing), $A_3$ is the face-centered cubic lattice (the familiar cannonball stacking).

The Dₙ lattice and D₄

$D_n \subset \mathbb{Z}^n$ : integer vectors whose coordinate sum is even.

$D_n = \{ x \in \mathbb{Z}^n : x_1 + \cdots + x_n \equiv 0 \pmod{2} \}$ $\det(D_n) = 2, \quad \lambda_1(D_n) = \sqrt{2}$ (Volume 2, since $D_n$ has index 2 in $\mathbb{Z}^n$ ; the Gram determinant is 4.)
Kissing number of $D_n$ : $2n(n-1)$ .

$D_4$ is exceptional: it has kissing number 24 and extraordinary symmetry — its automorphism group has order 1152, three times larger than expected. $D_4$ is related to the quaternions and is the densest known 4D lattice packing.

D₄ and E₈ — Exceptional Lattices and Their Kissing Numbers

$E_8$ is arguably the most remarkable mathematical object in this field. It is the unique densest lattice packing in 8 dimensions, proven optimal by Maryna Viazovska in 2016 (Fields Medal, 2022). It has extraordinary symmetry: 240 minimal vectors (the “roots”), a kissing number of 240, and deep connections to modular forms, string theory, and the Monster group.

The E₈ Lattice — Definition and Properties

$E_8$ can be defined as the set of vectors $(x_1, \dots, x_8) \in \mathbb{R}^8$ such that either:

— All $x_i \in \mathbb{Z}$ and $\sum x_i \equiv 0 \pmod{2}$ , or
— All $x_i \in \mathbb{Z} + 1/2$ and $\sum x_i \equiv 0 \pmod{2}$ .

Key properties:
$\det(E_8) = 1 \quad (\text{self-dual: } E_8^* = E_8)$ $\lambda_1(E_8) = \sqrt{2}, \quad \text{kissing number} = 240$ $\Delta(E_8) = \pi^4/384 \approx 0.2537 \quad (\text{optimal in 8D})$ Hermite ratio: $\lambda_1^2 / \det(E_8)^{2/8} = 2$ , achieving $\gamma_8 = 2$ .

The 240 minimal vectors of $E_8$ form the root system of the exceptional Lie algebra, which appears in heterotic string theory. The automorphism group has order $696{,}729{,}600$ . $E_8$ is the unique even unimodular lattice in dimension 8.

Kissing number comparison: $D_4$ has kissing number 24; $E_8$ has 240; the Leech lattice has 196,560. These are the largest known kissing numbers in their respective dimensions, and in dimensions 4 and 8 they are provably optimal.

The Leech Lattice Λ₂₄ — 196560 Kissing Number and the Monster Group

In dimension 24, the Leech lattice $\Lambda_{24}$ plays the role $E_8$ plays in dimension 8 — and then some. Discovered by John Leech in 1965, it is the densest known 24-dimensional packing (proven optimal by Viazovska et al. 2016), has a kissing number of $196{,}560$ , and its automorphism group is directly related to the Monster group — the largest sporadic finite simple group.

The Leech Lattice — Properties and Monster Group Connection

$\det(\Lambda_{24}) = 1 \quad (\text{even unimodular in dimension 24})$ $\lambda_1(\Lambda_{24}) = 2, \quad \text{kissing number} = 196{,}560$ $\Delta(\Lambda_{24}) = \pi^{12}/479001600 \approx 1.93 \times 10^{-3} \quad (\text{optimal in 24D})$ Hermite ratio: $\lambda_1^2 / \det(\Lambda_{24})^{2/24} = 4$ , achieving $\gamma_{24} = 4$ .

The Leech lattice is the unique even unimodular lattice in dimension 24 with no vectors of squared length 2 (no “roots”). It can be constructed from the $[24,12,8]$ Golay code: arrange codewords as the coordinates of lattice vectors, apply appropriate scaling, and impose an integrality condition.

Connection to the Monster group: The automorphism group of $\Lambda_{24}$ is Conway’s group $\mathrm{Co}_0$ , of order:

$|\mathrm{Co}_0| = 8{,}315{,}553{,}613{,}086{,}720{,}000$
The Monster group $\mathbb{M}$ — the largest sporadic simple group, of order roughly $8 \times 10^{53}$ — acts on a 196,884-dimensional space that decomposes into representations whose dimensions are directly related to the coefficients of the $j$ -function in number theory. This connection, called Monstrous Moonshine (proved by Borcherds, Fields Medal 1998), passes through the Leech lattice and its associated vertex operator algebra. The lattice is thus a bridge between combinatorics, number theory, and the deepest structure in finite group theory.

NTRU Lattices

The NTRU lattice is the algebraic lattice underlying the NTRU cryptosystem (1996) — the oldest lattice-based cryptosystem that remains secure. Unlike the geometric lattices above, NTRU lattices have a specific structure derived from polynomial rings.

Definition 24 — NTRU Lattice

In NTRU with ring $R = \mathbb{Z}[x]/(x^n - 1)$ and modulus $q$ , the public key is a polynomial $h = g \cdot f^{-1} \pmod{q}$ where $f, g$ are small polynomials. The NTRU lattice is:

$\Lambda_h = \{ (u, v) \in R^2 : v \equiv hu \pmod{q} \}$

Its basis matrix is a $2n \times 2n$ circulant block matrix. Since $g \equiv hf$ , the short vector $(f, g)$ is hidden in this lattice; recovering it is the NTRU problem. The Falcon signature scheme (FIPS 206) is built on NTRU lattices.

Cyclotomic Lattices and Ring-LWE

Ring-LWE and Module-LWE operate over rings of integers in cyclotomic number fields. The ring $\mathbb{Z}[x]/(x^n + 1)$ (with $n$ a power of 2) is the ring of integers in the cyclotomic field $\mathbb{Q}(\zeta_{2n})$ , where $\zeta_{2n}$ is a primitive $2n$ -th root of unity.

Elements of this ring correspond to lattice points in $\mathbb{R}^n$ via the canonical embedding, and the ring structure induces a rich algebraic symmetry on the resulting lattice — called an ideal lattice. Every ideal in the ring corresponds to a sublattice, and the structure enables efficient arithmetic via NTT.

Ideal lattices

A lattice $\Lambda$ is an ideal lattice if it corresponds to an ideal in a number ring. It is closed under the ring’s multiplication action: if $v \in \Lambda$ , then multiplying the polynomial $v$ by $X$ gives another point of $\Lambda$ . In the ring $\mathbb{Z}[X]/(X^n+1)$ that multiplication is a negacyclic rotation: the coefficients shift by one place and the one that wraps around changes sign. This structure makes ideal lattices more efficient (NTT multiplication) but potentially more vulnerable to algebraic attacks than general lattices.

Module lattices

A module lattice is a direct sum of ideal lattices. Kyber and Dilithium use module lattices of rank $k$ — $k$ copies of an ideal lattice arranged as a vector. This interpolates between general LWE lattices (rank 1 is Ring-LWE; rank $n$ is close to plain LWE) and provides a more conservative hardness assumption than Ring-LWE alone.

q-ary Lattices Used in LWE-Based Cryptography

Want to check a modular lattice by hand? The q-ary lattice guide works through a small matrix, a basis, and its determinant before connecting it to SIS and LWE.

The lattices that actually appear in LWE and SIS hardness are called q-ary lattices. They are the most practically important family for post-quantum cryptography. Unlike the geometric lattices above (which are studied for their own properties), q-ary lattices are defined to encode a specific computational problem.

q-ary Lattices Λ_q^⊥(A) and Λ_q(A) — Definitions

For a uniformly random matrix $A \in \mathbb{Z}_q^{n \times m}$ (with $m > n$ ) and prime modulus $q$ , define the two complementary q-ary lattices:

$\Lambda_q^\perp(A) = \{ y \in \mathbb{Z}^m : Ay \equiv 0 \pmod{q} \}$
$\Lambda_q(A) = \{ y \in \mathbb{Z}^m : \exists\, s \in \mathbb{Z}^n,\; y \equiv A^\top s \pmod{q} \}$
Both are lattices in $\mathbb{Z}^m$ containing $q\mathbb{Z}^m$ as a sublattice. When $A$ has full rank $n$ modulo $q$ (true with overwhelming probability), their determinants are:

$\det(\Lambda_q^\perp(A)) = q^{n}, \quad \det(\Lambda_q(A)) = q^{m-n}$
The two lattices are dual up to scaling: $\Lambda_q(A)^* = (1/q)\Lambda_q^\perp(A)$ . This duality is why SIS and LWE are dual problems: solving SIS means finding a short vector in $\Lambda_q^\perp(A)$ , while LWE decryption amounts to finding the nearest point in $\Lambda_q(A)$ to a given target.

Why these lattices are hard to attack: The matrix $A$ is public and random, so the lattice is not structured — an attacker sees a random-looking $m \times m$ integer lattice and must find a short vector (SIS) or solve CVP (LWE). By a worst-case to average-case reduction (Regev 2005, Peikert 2009), breaking random q-ary lattices is at least as hard as solving GapSVP in the worst case over all lattices of similar dimension.

In ML-KEM (Kyber), the modulus is $q = 3329$ and the dimension is $n = 256$ per module slot. In ML-DSA (Dilithium), $q = 8380417$ . These choices are carefully calibrated so that the smallest BKZ block size capable of finding a short vector in $\Lambda_q^\perp(A)$ requires at least $2^{128}$ operations.

Check Your Understanding

Q1. E₈ and the Leech lattice are the densest possible packings in 8 and 24 dimensions. Why are they NOT used as the lattices in Kyber or Dilithium?
Q2. What does the “kissing number” of a lattice count?
Q3. Ring-LWE lattices are ideal lattices: multiplying a lattice vector by x (a structured rotation) gives another lattice vector. What is the trade-off?
Q4. In an NTRU lattice, what makes recovering the private key hard?

← Previous1.5Lattice Reduction Next →2.1Shortest Vector ProblemThe hard problem that makes lattice cryptography possible.

Unfamiliar symbol? The math reference explains the notation used across the site.

Found a mistake or something unclear? Report it on GitHub or email hello@ovasylenko.com.