## On the Hardness of the Shortest Vector Problem (1998)

Citations: | 12 - 1 self |

### BibTeX

@TECHREPORT{Micciancio98onthe,

author = {Daniele Micciancio},

title = {On the Hardness of the Shortest Vector Problem},

institution = {},

year = {1998}

}

### OpenURL

### Abstract

An n-dimensional lattice is the set of all integral linear combinations of n linearly independent vectors in R^m. One of the most studied algorithmic problems on lattices is the shortest vector problem (SVP): given a lattice, find the shortest non-zero vector in it. We prove that the shortest vector problem is NP-hard (for randomized reductions) to approximate within some constant factor greater than 1 in any norm l_p (p>1). In particular, we prove the NP-hardness of approximating SVP in the Euclidean norm within any factor less than sqrt 2. The same NP-hardness results hold for deterministic non-uniform reductions. A deterministic uniform reduction is also given under a reasonable number theoretic conjecture concerning the distribution of smooth numbers. In proving the NP-hardness of SVP we develop a number of technical tools that might be of independent interest. In particular, a lattice packing is constructed with the property that the number of unit spheres contained in an n-dimensional ball of radius greater then 1 + (sqrt 2) grows exponentially in n, a new constructive version of Sauer's lemma(a combinatorial result somehow related to the notion of VC-dimension) is presented, considerably simplifying all previously known constructions.

### Citations

2303 |
The art of computer programming
- Knuth
- 1969
(Show Context)
Citation Context ...e algorithmic point of view. The first algorithm to solve the shortest vector 9 problem (in dimension 2) dates back to Gauss [27], and efforts to algorithmically solve this problem continued till now =-=[68, 21, 48, 22, 73, 81, 46]-=-. At the beginning of the 80's, a major breakthrough in algorithmic geometry of numbers, the development of the LLL lattice reduction algorithm [59], had a deep impact in many areas of computer scienc... |

739 | Factoring polynomials with rational coefficients
- LENSTRA, LENSTRA, et al.
- 1982
(Show Context)
Citation Context ... problem continued till now [68, 21, 48, 22, 73, 81, 46]. At the beginning of the 80's, a major breakthrough in algorithmic geometry of numbers, the development of the LLL lattice reduction algorithm =-=[59]-=-, had a deep impact in many areas of computer science, ranging from integer programming, to cryptography. Using the LLL reduction algorithm it was possible to solve integer programming in a fixed numb... |

424 |
Sphere packings, lattices and groups
- CONWAY, SLOANE
- 1988
(Show Context)
Citation Context ...ere packing problem: I want to pack as many unit sphere as possible in a ball of radius slightly bigger than 1+ p 2. Connections between lattices and sphere packing problems have long been known (see =-=[17]-=- for an excellent exposition of the subject) and lattices have been used to efficiently pack spheres for centuries. Here I look at sphere packing problems and lattices from a new and interesting persp... |

244 |
On Lov~z' lattice reduction and the nearest lattice point problem
- BABAI
- 1986
(Show Context)
Citation Context ...llapses. The closest vector problem had a similar history, except that polynomial time (approximation) algorithms were harder to find and stronger hardness results were more easily established. Babai =-=[8]-=- modified the LLL reduction algorithm to approximate in polynomial time CVP within a factor 2 n . The approximation factor was improved to 2 ffln in [69, 45, 71]. Kannan [46] gave a polynomial time al... |

244 | JR.: Integer programming with a fixed number of variables
- LENSTRA
- 1983
(Show Context)
Citation Context ...act in many areas of computer science, ranging from integer programming, to cryptography. Using the LLL reduction algorithm it was possible to solve integer programming in a fixed number of variables =-=[60, 59, 44]-=-, factor polynomials over the rationals [59, 57, 72], finite fields [56] and algebraic number fields [58], disprove century old conjectures in mathematics [65], break the Merkle-Hellman crypto-system ... |

210 | A public-key cryptosystem with worst-case/average-case equivalence
- Ajtai, Dwork
- 1997
(Show Context)
Citation Context ... optimization problems. In the last few years one more reason emerged to study lattices specifically from the computational complexity point of view: the design of provably secure crypto-systems (see =-=[4, 6, 31, 64, 32]-=-). The security of cryptographic protocols depends on the intractability of certain computational problems. The theory of NP-completeness offers a framework to give evidence that a problem is hard. No... |

154 | The hardness of approximate optima in lattices, codes, and systems of linear equations
- Arora, Babai, et al.
- 1997
(Show Context)
Citation Context ...mate CVP within a polynomial factor is a major open problem in the area. Regarding the hardness of the closest vector problem, van Emde Boas [78] proved that CVP is NP-hard for any l p norm (ps1). In =-=[7]-=-, Arora et al. used the machinery from Probabilistically Checkable Proofs to show that approximating CVP within any constant factor is NP-hard, and approximating it within 2 lg 1\Gammaffl n is almost ... |

132 |
Minkowski's convex body theorem and integer programming
- KANNAN
- 1987
(Show Context)
Citation Context ...e algorithmic point of view. The first algorithm to solve the shortest vector 9 problem (in dimension 2) dates back to Gauss [27], and efforts to algorithmically solve this problem continued till now =-=[68, 21, 48, 22, 73, 81, 46]-=-. At the beginning of the 80's, a major breakthrough in algorithmic geometry of numbers, the development of the LLL lattice reduction algorithm [59], had a deep impact in many areas of computer scienc... |

126 | Public-key Cryptosystems from Lattice Reduction Problems
- Goldreich, Goldwasser, et al.
- 1997
(Show Context)
Citation Context ... optimization problems. In the last few years one more reason emerged to study lattices specifically from the computational complexity point of view: the design of provably secure crypto-systems (see =-=[4, 6, 31, 64, 32]-=-). The security of cryptographic protocols depends on the intractability of certain computational problems. The theory of NP-completeness offers a framework to give evidence that a problem is hard. No... |

123 |
Probability of error for optimal codes in a Gaussian channel
- Shannon
- 1959
(Show Context)
Citation Context ...ice with minimum distance , an exponential lower bounds for any =ae ! p 2 is already implicit in Gilbert bound [28] for binary codes. Non-constructive proofs for spherical codes were given by Shannon =-=[75]-=- and Wyner [80]. However, the points generated by these constructions do not form a lattice. We give a proof of lower bound 3 in which the points are vertices of the fundamental parallelepiped of a la... |

119 |
A hierarchy of polynomial time lattice basis reduction algorithms
- Schnorr
- 1987
(Show Context)
Citation Context ... the development of the LLL basis reduction algorithm [60, 59] it was possible to approximate SVP in polynomial time within a factor 2 n=2 . The approximation factor was improved to 2 ffln by Schnorr =-=[69]-=- using a modification of the LLL basis reduction algorithm. The LLL algorithm, and its variants, can also be used to find in polynomial time exact solutions to SVP for any fixed number of dimensions. ... |

109 | Polynomial algorithms for computing the Smith and Hermite normal forms of an integer matrix - Kannan, Bachem - 1979 |

108 | Solving low-density subset sum problems
- Lagarias, Odlyzko
- 1985
(Show Context)
Citation Context ...8], disprove century old conjectures in mathematics [65], break the Merkle-Hellman crypto-system [74, 2, 11, 50, 51, 63], check the solvability by radicals [55], solve low density subset-sum problems =-=[54, 24, 20]-=-, heuristically factor integers [70, 18] and solve many other Diophantine and cryptanalysis problems (e.g., [52, 19, 35, 25, 10]). The first and preeminent reason to study the computational complexity... |

93 | Generating Hard Instances of Lattice Problems (Extended Abstract
- Ajtai
- 1996
(Show Context)
Citation Context ... optimization problems. In the last few years one more reason emerged to study lattices specifically from the computational complexity point of view: the design of provably secure crypto-systems (see =-=[4, 6, 31, 64, 32]-=-). The security of cryptographic protocols depends on the intractability of certain computational problems. The theory of NP-completeness offers a framework to give evidence that a problem is hard. No... |

91 |
Finding a Small Root of a Univariate Modular Equation
- Coppersmith
- 1996
(Show Context)
Citation Context ..., check the solvability by radicals [55], solve low density subset-sum problems [54, 24, 20], heuristically factor integers [70, 18] and solve many other Diophantine and cryptanalysis problems (e.g., =-=[52, 19, 35, 25, 10]-=-). The first and preeminent reason to study the computational complexity of lattice problems is therefore the wide applicability of lattice based techniques to solve a variety of combinatorial and opt... |

87 |
Improved algorithms for integer programming and related lattice problems
- Kannan
- 1983
(Show Context)
Citation Context ...act in many areas of computer science, ranging from integer programming, to cryptography. Using the LLL reduction algorithm it was possible to solve integer programming in a fixed number of variables =-=[60, 59, 44]-=-, factor polynomials over the rationals [59, 57, 72], finite fields [56] and algebraic number fields [58], disprove century old conjectures in mathematics [65], break the Merkle-Hellman crypto-system ... |

85 | Improved low-density subset sum algorithms
- Coster, Joux, et al.
- 1992
(Show Context)
Citation Context ...8], disprove century old conjectures in mathematics [65], break the Merkle-Hellman crypto-system [74, 2, 11, 50, 51, 63], check the solvability by radicals [55], solve low density subset-sum problems =-=[54, 24, 20]-=-, heuristically factor integers [70, 18] and solve many other Diophantine and cryptanalysis problems (e.g., [52, 19, 35, 25, 10]). The first and preeminent reason to study the computational complexity... |

84 | On the limits of nonapproximability of lattice problems
- Goldreich, Goldwasser
- 1998
(Show Context)
Citation Context ...imating SVP is now clear: if approximating the shortest vector in a lattice within a factor n c were NP-hard, then we could base cryptography on the P versus NP question [30]. The results in [53] and =-=[29]-=- point out some difficulties in bridging the gap between the approximation factors for which we can hope to prove the NP-hardness of SVP, and those required by current lattice based crypto-systems. St... |

78 | Solving Simultaneous Modular Equations of Low Degree
- H̊astad
- 1988
(Show Context)
Citation Context ..., check the solvability by radicals [55], solve low density subset-sum problems [54, 24, 20], heuristically factor integers [70, 18] and solve many other Diophantine and cryptanalysis problems (e.g., =-=[52, 19, 35, 25, 10]-=-). The first and preeminent reason to study the computational complexity of lattice problems is therefore the wide applicability of lattice based techniques to solve a variety of combinatorial and opt... |

77 |
Finding a Small Root of a Bivariate Integer Equation; Factoring with high bits known
- Coppersmith
- 1996
(Show Context)
Citation Context ...ematics [65], break the Merkle-Hellman crypto-system [74, 2, 11, 50, 51, 63], check the solvability by radicals [55], solve low density subset-sum problems [54, 24, 20], heuristically factor integers =-=[70, 18]-=- and solve many other Diophantine and cryptanalysis problems (e.g., [52, 19, 35, 25, 10]). The first and preeminent reason to study the computational complexity of lattice problems is therefore the wi... |

77 |
Korkine-Zolotarev bases and successive minima of a lattice and its reciprocal lattice
- Lagarias, Lenstra, et al.
- 1990
(Show Context)
Citation Context ...of approximating SVP is now clear: if approximating the shortest vector in a lattice within a factor n c were NP-hard, then we could base cryptography on the P versus NP question [30]. The results in =-=[53]-=- and [29] point out some difficulties in bridging the gap between the approximation factors for which we can hope to prove the NP-hardness of SVP, and those required by current lattice based crypto-sy... |

73 |
Geometrie der zahlen
- Minkowski
- 1910
(Show Context)
Citation Context ...lem in arbitrary dimension was formulated by Dirichlet in 1842, and studied by Hermite ([37], 1845), and Korkine and Zolotareff ([49], 1873). The subject of Geometry of Numbers, founded by Minkowski (=-=[62], 1910), w-=-as mainly concerned with the study of the existence of short non-zero vectors in lattices. Minkowski's "Convex Body Theorem" directly implies the existence of short vectors in any lattice. A... |

72 |
New bounds in some transference theorems in the geometry of numbers
- Banaszczyk
- 1993
(Show Context)
Citation Context ...tice vector close to y gives an upper bound on the distance of y from the lattice. Lagarias, Lenstra and Schnorr [53] proved that approximating CVP within n 1:5 is in coNP. Hastad [34] and Banaszczyk =-=[9]-=- improved the approximation factor to n. Goldreich and Goldwasser [29] showed that approximating CVP within a factor p n is in coAM. Again, these verifiability results are usually regarded as evidence... |

66 |
Approximating CVP to within almost-polynomial factors is np-hard
- Dinur, Kindler, et al.
- 1998
(Show Context)
Citation Context ...bilistically Checkable Proofs to show that approximating CVP within any constant factor is NP-hard, and approximating it within 2 lg 1\Gammaffl n is almost NP-hard. Recently, Dinur, Kindler and Safra =-=[23]-=- proved that approximating CVP within that same factor is NP-hard. The decisional version of CVP is clearly in NP: any lattice vector close to y gives an upper bound on the distance of y from the latt... |

64 |
A polynomial time algorithm for breaking the basic Merkle-Hellman cryptosystem
- Shamir
- 1983
(Show Context)
Citation Context ..., factor polynomials over the rationals [59, 57, 72], finite fields [56] and algebraic number fields [58], disprove century old conjectures in mathematics [65], break the Merkle-Hellman crypto-system =-=[74, 2, 11, 50, 51, 63]-=-, check the solvability by radicals [55], solve low density subset-sum problems [54, 24, 20], heuristically factor integers [70, 18] and solve many other Diophantine and cryptanalysis problems (e.g., ... |

63 |
Sur les formes quadratiques
- KORKINE, ZOLOTAREFF
(Show Context)
Citation Context ...onal lattices was already given by Gauss ([27], 1801). The general problem in arbitrary dimension was formulated by Dirichlet in 1842, and studied by Hermite ([37], 1845), and Korkine and Zolotareff (=-=[49], 187-=-3). The subject of Geometry of Numbers, founded by Minkowski ([62], 1910), was mainly concerned with the study of the existence of short non-zero vectors in lattices. Minkowski's "Convex Body The... |

60 |
The computational complexity of simultaneous diophantine approximation problems
- Lagarias
- 1985
(Show Context)
Citation Context ..., check the solvability by radicals [55], solve low density subset-sum problems [54, 24, 20], heuristically factor integers [70, 18] and solve many other Diophantine and cryptanalysis problems (e.g., =-=[52, 19, 35, 25, 10]-=-). The first and preeminent reason to study the computational complexity of lattice problems is therefore the wide applicability of lattice based techniques to solve a variety of combinatorial and opt... |

57 |
Another NP -complete problem and the complexity of computing short vectors in a lattice
- Boas
- 1981
(Show Context)
Citation Context ...l time algorithm is known to approximate SVP within a factor polynomial in the dimension of the lattice. Evidence of the intractability of the shortest vector problem was first given by van Emde Boas =-=[78]-=- who proved that SVP is NP-hard in the l 1 norm and conjectured the NP-hardness in the Euclidean norm. Recently, Ajtai proved that SVP is NP-hard for randomized reductions, and approximating SVP withi... |

56 | An Improved Worst-Case to Average-Case Connection for Lattice Problems
- Cai, Nerurkar
- 1997
(Show Context)
Citation Context ...polynomial-time algorithm to find a "good basis" and in particular a vector of length within a fixed polynomial factor n c from the shortest (the exponent c equals 8 in [4] and was improved =-=to 3:5 in [14]-=-). 10 The importance of studying the hardness of approximating SVP is now clear: if approximating the shortest vector in a lattice within a factor n c were NP-hard, then we could base cryptography on ... |

54 |
A comparison of signalling alphabets
- Gilbert
- 1952
(Show Context)
Citation Context ... Figure 4-3: The octahedral packing 37 If we don't ask for the points to belong to a lattice with minimum distance , an exponential lower bounds for any =ae ! p 2 is already implicit in Gilbert bound =-=[28]-=- for binary codes. Non-constructive proofs for spherical codes were given by Shannon [75] and Wyner [80]. However, the points generated by these constructions do not form a lattice. We give a proof of... |

46 |
Fourier Analysis of Uniform Random Number Generators
- Coveyou, McPherson
- 1967
(Show Context)
Citation Context ...e algorithmic point of view. The first algorithm to solve the shortest vector 9 problem (in dimension 2) dates back to Gauss [27], and efforts to algorithmically solve this problem continued till now =-=[68, 21, 48, 22, 73, 81, 46]-=-. At the beginning of the 80's, a major breakthrough in algorithmic geometry of numbers, the development of the LLL lattice reduction algorithm [59], had a deep impact in many areas of computer scienc... |

45 | Worst-case complexity bounds on algorithms for computing the canonical structure of finite abelian groups and the Hermite and Smith normal forms of an integer matrix
- Iliopoulos
- 1989
(Show Context)
Citation Context ... of homogeneous linear Diophantine equations. Notice that this set of solutions is a lattice because is closed under subtraction and discrete. For polynomial time algorithms to solve this problem see =-=[26, 47, 38, 39]-=-. Problem 3 can be easily solved using techniques from any of the other problems mentioned here. For algorithms to solve these and related problems see [47, 16, 40]. 2.1 Two Computational Problems on ... |

44 | Algorithmic geometry of numbers
- Kannan
- 1987
(Show Context)
Citation Context ...ess results were more easily established. Babai [8] modified the LLL reduction algorithm to approximate in polynomial time CVP within a factor 2 n . The approximation factor was improved to 2 ffln in =-=[69, 45, 71]-=-. Kannan [46] gave a polynomial time algorithm to solve CVP exactly in any fixed number of dimensions. The dependency of the running time on the dimension is again 2 n ln n . Finding a polynomial time... |

41 |
Factoring multivariate polynomials over finite fields
- Lenstra
(Show Context)
Citation Context ...integer programming, to cryptography. Using the LLL reduction algorithm it was possible to solve integer programming in a fixed number of variables [60, 59, 44], factor polynomials over the rationals =-=[59, 57, 72]-=-, finite fields [56] and algebraic number fields [58], disprove century old conjectures in mathematics [65], break the Merkle-Hellman crypto-system [74, 2, 11, 50, 51, 63], check the solvability by ra... |

39 |
The shortest vector problem in 2 is NP-hard for randomized reductions
- Ajtai
- 1998
(Show Context)
Citation Context ...same problem is NP-hard in any to other l p norm (ps1). 11 The NP-hardness of SVP in the l p (p ! 1) norm (most notably the Euclidean norm l 2 ), was a long standing open question, finally settled in =-=[5]-=- where Ajtai proved that the shortest vector problem (in l 2 ) is NP-hard for randomized reductions. The result in [5] also shows that SVP is hard to approximate within some factor rapidly approaching... |

35 |
Solvability by radicals is in polynomial time
- Landau, Miller
- 1985
(Show Context)
Citation Context ...e fields [56] and algebraic number fields [58], disprove century old conjectures in mathematics [65], break the Merkle-Hellman crypto-system [74, 2, 11, 50, 51, 63], check the solvability by radicals =-=[55]-=-, solve low density subset-sum problems [54, 24, 20], heuristically factor integers [70, 18] and solve many other Diophantine and cryptanalysis problems (e.g., [52, 19, 35, 25, 10]). The first and pre... |

33 |
Algorithms for the solution of systems of linear diophantine equations
- CHOU, COLLINS
- 1982
(Show Context)
Citation Context ...ithms to solve this problem see [26, 47, 38, 39]. Problem 3 can be easily solved using techniques from any of the other problems mentioned here. For algorithms to solve these and related problems see =-=[47, 16, 40]-=-. 2.1 Two Computational Problems on Lattices Two problems on lattices for which no polynomial time algorithm is known are the following: ffl Shortest Vector Problem (SVP): Given a lattice , find the s... |

33 |
The closest packing of spherical caps in n dimensions
- Rankin
- 1955
(Show Context)
Citation Context ...ly 2n. 3. For any ae ? p 2, one can pack exponentially many points. Upper bounds 1 and 2 actually hold even if we drop the requirements for the points to belong to a lattice, and were first proved in =-=[67]-=- for spherical codes (i.e., a sphere packing problem with the additional constraint that all points must be at the same distance from the origin). 36 2 2 2 p 3 Figure 4-2: The cubic packing p 2 p 2 2 ... |

32 |
On the lagarias-odlyzko algorithm for the subset sum problem
- Frieze
- 1986
(Show Context)
Citation Context ...8], disprove century old conjectures in mathematics [65], break the Merkle-Hellman crypto-system [74, 2, 11, 50, 51, 63], check the solvability by radicals [55], solve low density subset-sum problems =-=[54, 24, 20]-=-, heuristically factor integers [70, 18] and solve many other Diophantine and cryptanalysis problems (e.g., [52, 19, 35, 25, 10]). The first and preeminent reason to study the computational complexity... |

32 |
Reconstructing truncated integer variables satisfying linear congruences
- Frieze, Hastad, et al.
- 1988
(Show Context)
Citation Context |

32 |
Factorization of univariate integer polynomials by Diophantine approximation and an improved basis reduction algorithm
- Schönhage
- 1984
(Show Context)
Citation Context ...integer programming, to cryptography. Using the LLL reduction algorithm it was possible to solve integer programming in a fixed number of variables [60, 59, 44], factor polynomials over the rationals =-=[59, 57, 72]-=-, finite fields [56] and algebraic number fields [58], disprove century old conjectures in mathematics [65], break the Merkle-Hellman crypto-system [74, 2, 11, 50, 51, 63], check the solvability by ra... |

31 | Factoring integers and computing discrete logarithms via diophantine approximations
- Schnorr
- 1991
(Show Context)
Citation Context ...ematics [65], break the Merkle-Hellman crypto-system [74, 2, 11, 50, 51, 63], check the solvability by radicals [55], solve low density subset-sum problems [54, 24, 20], heuristically factor integers =-=[70, 18]-=- and solve many other Diophantine and cryptanalysis problems (e.g., [52, 19, 35, 25, 10]). The first and preeminent reason to study the computational complexity of lattice problems is therefore the wi... |

28 |
How to Calculate Shortest Vectors in Lattice
- Dieter
- 1975
(Show Context)
Citation Context |

28 |
An algorithm to generate the basis of solutions to homogeneous Diophantine equations
- Huet
- 1978
(Show Context)
Citation Context ... of homogeneous linear Diophantine equations. Notice that this set of solutions is a lattice because is closed under subtraction and discrete. For polynomial time algorithms to solve this problem see =-=[26, 47, 38, 39]-=-. Problem 3 can be easily solved using techniques from any of the other problems mentioned here. For algorithms to solve these and related problems see [47, 16, 40]. 2.1 Two Computational Problems on ... |

27 |
Capabilities of Bounded Discrepancy Decoding
- Wyner
- 1965
(Show Context)
Citation Context ...m distance , an exponential lower bounds for any =ae ! p 2 is already implicit in Gilbert bound [28] for binary codes. Non-constructive proofs for spherical codes were given by Shannon [75] and Wyner =-=[80]-=-. However, the points generated by these constructions do not form a lattice. We give a proof of lower bound 3 in which the points are vertices of the fundamental parallelepiped of a lattice with mini... |

25 |
Block reduced lattice bases and successive minima
- Schnorr
- 1994
(Show Context)
Citation Context ...ess results were more easily established. Babai [8] modified the LLL reduction algorithm to approximate in polynomial time CVP within a factor 2 n . The approximation factor was improved to 2 ffln in =-=[69, 45, 71]-=-. Kannan [46] gave a polynomial time algorithm to solve CVP exactly in any fixed number of dimensions. The dependency of the running time on the dimension is again 2 n ln n . Finding a polynomial time... |

21 | Eliminating decryption errors in the Ajtai-Dwork cryptosystem
- Goldreich, Goldwasser, et al.
- 1997
(Show Context)
Citation Context |

21 |
Factoring multivariate polynomials over algebraic number fields
- Lenstra
- 1987
(Show Context)
Citation Context ... algorithm it was possible to solve integer programming in a fixed number of variables [60, 59, 44], factor polynomials over the rationals [59, 57, 72], finite fields [56] and algebraic number fields =-=[58]-=-, disprove century old conjectures in mathematics [65], break the Merkle-Hellman crypto-system [74, 2, 11, 50, 51, 63], check the solvability by radicals [55], solve low density subset-sum problems [5... |

20 | Knapsack-type public key cryptosystems and Diophantine approximation, (Extended Abstract
- Lagarias
- 1984
(Show Context)
Citation Context ..., factor polynomials over the rationals [59, 57, 72], finite fields [56] and algebraic number fields [58], disprove century old conjectures in mathematics [65], break the Merkle-Hellman crypto-system =-=[74, 2, 11, 50, 51, 63]-=-, check the solvability by radicals [55], solve low density subset-sum problems [54, 24, 20], heuristically factor integers [70, 18] and solve many other Diophantine and cryptanalysis problems (e.g., ... |

20 |
Fast reduction and composition of binary quadratic forms
- Schönhage
- 1991
(Show Context)
Citation Context |