Algorithms for hard lattice problems Thijs Laarhoven ts - - PowerPoint PPT Presentation

▶
algorithms for hard lattice problems
SMART_READER_LITE
LIVE PREVIEW

Algorithms for hard lattice problems Thijs Laarhoven ts - - PowerPoint PPT Presentation

Nov 01, 2023 216 likes •1.59k views

Algorithms for hard lattice problems Thijs Laarhoven ts ttts Tenerife PQCrypto Conference (January 31, 2018) Lattices What is a lattice? O Lattices What

slide-1
SLIDE 1

Algorithms for hard lattice problems

Thijs Laarhoven

♠❛✐❧❅t❤✐❥s✳❝♦♠ ❤tt♣✿✴✴✇✇✇✳t❤✐❥s✳❝♦♠✴

Tenerife PQCrypto Conference

(January 31, 2018)

slide-2
SLIDE 2

O

Lattices

What is a lattice?

slide-3
SLIDE 3

O b1 b2

Lattices

What is a lattice?

slide-4
SLIDE 4

O b1 b2

Lattices

What is a lattice?

slide-5
SLIDE 5

O b1 b2 s

Lattices

Shortest Vector Problem (SVP)

slide-6
SLIDE 6

O b1 b2 s

  • s

Lattices

Shortest Vector Problem (SVP)

slide-7
SLIDE 7

O b1 b2 t

Lattices

Closest Vector Problem (CVP)

slide-8
SLIDE 8

O b1 b2 t v

Lattices

Closest Vector Problem (CVP)

slide-9
SLIDE 9

O r1 r2 b1 b2

Lattices

Lattice basis reduction

slide-10
SLIDE 10

Lattices

Hard lattice problems [LvdPdW12]

CVPγ BDD1/γ USVPγ HSVPγ SVPγ GapSVPγ SBPγ SIVPγ LWEn,q,m,α SISn,q,m,ν 2 * γ √n/log n √n √n √n/2 √γn * * *

slide-11
SLIDE 11

Lattices

Lattice-based cryptography

Problem: Security of lattice-based cryptographic primitives

  • Lattice-based crypto relies on hardness of lattice problems
  • Most lattice problems reducible to (approximate) SVP
  • State-of-the-art: BKZ basis reduction [Sch87, SE94, ...]

◮ BKZ uses exact SVP algorithm as subroutine ◮ Complexity of BKZ dominated by exact SVP calls

SVP costs =⇒ BKZ costs =⇒ Security estimates =⇒ Parameters Problem: How hard is SVP in high dimensions?

slide-12
SLIDE 12

Outline

SVP algorithms Enumeration Sieving SVP hardness Theory Practice NIST submissions Conclusion

slide-13
SLIDE 13

Outline

SVP algorithms Enumeration Sieving SVP hardness Theory Practice NIST submissions Conclusion

slide-14
SLIDE 14

O b1 b2

Enumeration

  • 1. Determine possible coefficients of b2
slide-15
SLIDE 15

O b1 b2

Enumeration

  • 1. Determine possible coefficients of b2
slide-16
SLIDE 16

O b1 b2

Enumeration

  • 1. Determine possible coefficients of b2
slide-17
SLIDE 17

O b1 b2 b2

*

Enumeration

  • 1. Determine possible coefficients of b2
slide-18
SLIDE 18

O b1 b2 b2

*

Enumeration

  • 1. Determine possible coefficients of b2
slide-19
SLIDE 19

O b1 b2 b2

*

Enumeration

  • 2. Find short vectors for each coefficient of b2
slide-20
SLIDE 20

O b1 b2 b2

*

Enumeration

  • 2. Find short vectors for each coefficient of b2
slide-21
SLIDE 21

O b1 b2 b2

*

v1

  • v1

Enumeration

  • 2. Find short vectors for each coefficient of b2
slide-22
SLIDE 22

O b1 b2 b2

*

v1

  • v1

Enumeration

  • 2. Find short vectors for each coefficient of b2
slide-23
SLIDE 23

O b1 b2 b2

*

v1

  • v1

v2 v3

Enumeration

  • 2. Find short vectors for each coefficient of b2
slide-24
SLIDE 24

O b1 b2 b2

*

v1

  • v1

v2 v3

Enumeration

  • 2. Find short vectors for each coefficient of b2
slide-25
SLIDE 25

O b1 b2 b2

*

v1

  • v1

v2 v3 v4 v5

Enumeration

  • 2. Find short vectors for each coefficient of b2
slide-26
SLIDE 26

O b1 b2 b2

*

v1

  • v1

v2 v3 v4 v5

Enumeration

  • 2. Find short vectors for each coefficient of b2
slide-27
SLIDE 27

O b1 b2 b2

*

v1

  • v1

v2 v3 v4 v5 v6

Enumeration

  • 2. Find short vectors for each coefficient of b2
slide-28
SLIDE 28

O b1 b2 b2

*

v1

  • v1

v2 v3 v4 v5 v6

Enumeration

  • 2. Find short vectors for each coefficient of b2
slide-29
SLIDE 29

O b1 b2 b2

*

v1

  • v1

v2 v3 v4 v5 v6

  • v2
  • v3
  • v4
  • v5
  • v6

Enumeration

  • 2. Find short vectors for each coefficient of b2
slide-30
SLIDE 30

O b1 b2 b2

*

v1

  • v1

v2 v3 v4 v5 v6

  • v2
  • v3
  • v4
  • v5
  • v6

Enumeration

  • 2. Find short vectors for each coefficient of b2
slide-31
SLIDE 31

O b1 b2 b2

*

v1

  • v1

v2 v3 v4 v5 v6

  • v2
  • v3
  • v4
  • v5
  • v6

Enumeration

  • 3. Find a shortest vector among all found vectors
slide-32
SLIDE 32

O b1 b2 b2

*

v1

  • v1

v3 v4 v5 v6

  • v3
  • v4
  • v5
  • v6

v2

  • v2

Enumeration

  • 3. Find a shortest vector among all found vectors
slide-33
SLIDE 33

O b1 b2 b2

*

v1

  • v1

v3 v4 v5 v6

  • v3
  • v4
  • v5
  • v6

v2

  • v2

Enumeration

Overview

slide-34
SLIDE 34

O b1 b2 b2

*

v1

  • v1

v3 v4 v5 v6

  • v3
  • v4
  • v5
  • v6

v2

  • v2

Enumeration

Overview

Theorem (Fincke–Pohst, Math. of Comp. ’85)

Lattice enumeration solves SVP in time 2O(n2) and space poly(n).

slide-35
SLIDE 35

O b1 b2 b2

*

v1

  • v1

v3 v4 v5 v6

  • v3
  • v4
  • v5
  • v6

v2

  • v2

Enumeration

Overview

Theorem (Fincke–Pohst, Math. of Comp. ’85)

Lattice enumeration solves SVP in time 2O(n2) and space poly(n). Essentially reduces SVPn (CVPn) to 2O(n) instances of CVPn−1.

slide-36
SLIDE 36

O b1 b2

Enumeration

Better bases

slide-37
SLIDE 37

O r1 r2

Enumeration

Better bases

slide-38
SLIDE 38

O r1 r2

Enumeration

Better bases

slide-39
SLIDE 39

O r1 r2

Enumeration

Better bases

slide-40
SLIDE 40

O r1 r2 r2

*

Enumeration

Better bases

slide-41
SLIDE 41

O r1 r2 r2

*

Enumeration

Better bases

slide-42
SLIDE 42

O r1 r2 r2

*

Enumeration

Better bases

slide-43
SLIDE 43

O r1 r2 r2

*

v1

  • v1

Enumeration

Better bases

slide-44
SLIDE 44

O r1 r2 r2

*

v1

  • v1

Enumeration

Better bases

slide-45
SLIDE 45

O r1 r2 r2

*

v1

  • v1

Enumeration

Better bases

slide-46
SLIDE 46

O r1 r2 r2

*

v1

  • v1

Enumeration

Better bases

slide-47
SLIDE 47

O r1 r2 r2

*

v1

  • v1

Enumeration

Better bases

Theorem (Kannan, STOC’83)

Combining enumeration with stronger basis reduction, one can solve SVP in time 2O(nlogn) and space poly(n).

slide-48
SLIDE 48

O r1 r2 r2

*

v1

  • v1

Enumeration

Better bases

Theorem (Kannan, STOC’83)

Combining enumeration with stronger basis reduction, one can solve SVP in time 2O(nlogn) and space poly(n). “Our algorithm reduces an n-dimensional problem to polynomially many (instead of 2O(n)) (n − 1)-dimensional

  • problems. [...] The algorithm we propose, first finds a more
  • rthogonal basis for a lattice in time 2O(nlogn).”

– Kannan, STOC’83

slide-49
SLIDE 49

O b1 b2

Enumeration

Pruning the enumeration tree

slide-50
SLIDE 50

O b1 b2 b2

*

Enumeration

Pruning the enumeration tree

slide-51
SLIDE 51

O b1 b2 b2

*

Enumeration

Pruning the enumeration tree

slide-52
SLIDE 52

O b1 b2 b2

*

v1

  • v1

v2 v3

  • v2
  • v3

Enumeration

Pruning the enumeration tree

slide-53
SLIDE 53

O b1 b2 b2

*

v1

  • v1

v3

  • v3

v2

  • v2

Enumeration

Pruning the enumeration tree

slide-54
SLIDE 54

O b1 b2 b2

*

v1

  • v1

v3

  • v3

v2

  • v2

Enumeration

Pruning the enumeration tree

slide-55
SLIDE 55

O b1 b2 b2

*

v1

  • v1

v3

  • v3

v2

  • v2

Enumeration

Pruning the enumeration tree

“Well-chosen bounding functions lead asymptotically to an exponential speedup of about 2n/4 over basic enumeration, maintaining a success probability ≥ 95%.” – Gama–Nguyen–Regev, EUROCRYPT’10

slide-56
SLIDE 56

O b1 b2 b2

*

v1

  • v1

v3

  • v3

v2

  • v2

Enumeration

Pruning the enumeration tree

“Well-chosen bounding functions lead asymptotically to an exponential speedup of about 2n/4 over basic enumeration, maintaining a success probability ≥ 95%.” – Gama–Nguyen–Regev, EUROCRYPT’10 “With extreme pruning, the probability of finding the desired vector is actually rather low (say, 0.1%), but surprisingly, the running time of the enumeration is reduced by a much more significant factor (say, much more than 1000).” – Gama–Nguyen–Regev, EUROCRYPT’10

slide-57
SLIDE 57

O

Sieving

  • 1. Sample a list L of random lattice vectors
slide-58
SLIDE 58

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

  • 1. Sample a list L of random lattice vectors
slide-59
SLIDE 59

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-60
SLIDE 60

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 O

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-61
SLIDE 61

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v1

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-62
SLIDE 62

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v2

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-63
SLIDE 63

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v3

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-64
SLIDE 64

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v4

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-65
SLIDE 65

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v5

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-66
SLIDE 66

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v6

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-67
SLIDE 67

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v7

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-68
SLIDE 68

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v8

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-69
SLIDE 69

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v9

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-70
SLIDE 70

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v10

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-71
SLIDE 71

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v11

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-72
SLIDE 72

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v12

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-73
SLIDE 73

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v13

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-74
SLIDE 74

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v14

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-75
SLIDE 75

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v15

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-76
SLIDE 76

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v16

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-77
SLIDE 77

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

  • 2. Split L into centers C and reducible vectors R
slide-78
SLIDE 78

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

  • 3. Repeat with reduced vectors until we find a shortest vector
slide-79
SLIDE 79

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

  • 3. Repeat with reduced vectors until we find a shortest vector
slide-80
SLIDE 80

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

  • 3. Repeat with reduced vectors until we find a shortest vector
slide-81
SLIDE 81

O v1 v2 v3 v4 v5 v6 v7 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7

Sieving

  • 3. Repeat with reduced vectors until we find a shortest vector
slide-82
SLIDE 82

O v1 v2 v3 v4 v5 v6 v7 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7

Sieving

Overview

slide-83
SLIDE 83

O v1 v2 v3 v4 v5 v6 v7 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7

Sieving

Overview

Heuristic (Nguyen–Vidick, J. Math. Crypt. ’08)

Sieving solves SVP in time (4/3)n+o(n) and space (4/3)n/2+o(n).

slide-84
SLIDE 84

O v1 v2 v3 v4 v5 v6 v7 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7

Sieving

Overview

Heuristic (Nguyen–Vidick, J. Math. Crypt. ’08)

Sieving solves SVP in time (4/3)n+o(n) and space (4/3)n/2+o(n). The list size comes from heuristic packing/saturation arguments, the time complexity is quadratic in the list size.

slide-85
SLIDE 85

O

Sieving

Near neighbor techniques

slide-86
SLIDE 86

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Near neighbor techniques

slide-87
SLIDE 87

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Near neighbor techniques

slide-88
SLIDE 88

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Near neighbor techniques

slide-89
SLIDE 89

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 O

Sieving

Near neighbor techniques

slide-90
SLIDE 90

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v1

Sieving

Near neighbor techniques

slide-91
SLIDE 91

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v2

Sieving

Near neighbor techniques

slide-92
SLIDE 92

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v3

Sieving

Near neighbor techniques

slide-93
SLIDE 93

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v4

Sieving

Near neighbor techniques

slide-94
SLIDE 94

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v5

Sieving

Near neighbor techniques

slide-95
SLIDE 95

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v6

Sieving

Near neighbor techniques

slide-96
SLIDE 96

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v7

Sieving

Near neighbor techniques

slide-97
SLIDE 97

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v8

Sieving

Near neighbor techniques

slide-98
SLIDE 98

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v9

Sieving

Near neighbor techniques

slide-99
SLIDE 99

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v10

Sieving

Near neighbor techniques

slide-100
SLIDE 100

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v11

Sieving

Near neighbor techniques

slide-101
SLIDE 101

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v12

Sieving

Near neighbor techniques

slide-102
SLIDE 102

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v13

Sieving

Near neighbor techniques

slide-103
SLIDE 103

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v14

Sieving

Near neighbor techniques

slide-104
SLIDE 104

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v15

Sieving

Near neighbor techniques

slide-105
SLIDE 105

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v16

Sieving

Near neighbor techniques

slide-106
SLIDE 106

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Near neighbor techniques

slide-107
SLIDE 107

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Near neighbor techniques

slide-108
SLIDE 108

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Near neighbor techniques

slide-109
SLIDE 109

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Near neighbor techniques

slide-110
SLIDE 110

O v1 v2 v3 v4 v5 v6 v7 v9 v10 v11 v12 v13 v14 v15 v16 v1 v2 v3 v4 v5 v6

Sieving

Near neighbor techniques

slide-111
SLIDE 111

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Random hyperplanes

slide-112
SLIDE 112

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Random hyperplanes

slide-113
SLIDE 113

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Random hypercones

slide-114
SLIDE 114

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Random hypercones

slide-115
SLIDE 115

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Random hypercones

slide-116
SLIDE 116

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Random hypercones

slide-117
SLIDE 117

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Random hypercones

slide-118
SLIDE 118

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Random hypercones

slide-119
SLIDE 119

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Random hypercones

slide-120
SLIDE 120

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Random hypercones

slide-121
SLIDE 121

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Random hypercones

slide-122
SLIDE 122

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Random hypercones

slide-123
SLIDE 123

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Random hypercones

slide-124
SLIDE 124

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Randomly rotated cross-polytopes

slide-125
SLIDE 125

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Randomly rotated cross-polytopes

slide-126
SLIDE 126

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Randomly rotated cross-polytopes

slide-127
SLIDE 127

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Randomly rotated cross-polytopes

slide-128
SLIDE 128

O v1 v2 v3 v4 v5 v6 v7 v8 v9 v10 v11 v12 v13 v14 v15 v16

Sieving

Randomly rotated cross-polytopes

slide-129
SLIDE 129

Outline

SVP algorithms Enumeration Sieving SVP hardness Theory Practice NIST submissions Conclusion

slide-130
SLIDE 130

SVP hardness

Theory

Algorithm log2(Time) log2(Space)

Proven SVP

Enumeration [Poh81, Kan83, ..., MW15, AN17] O(nlogn) O(logn) AKS-sieve [AKS01, NV08, MV10, HPS11] 3.398n 1.985n ListSieve [MV10, MDB14] 3.199n 1.327n Birthday sieves [PS09, HPS11] 2.465n 1.233n Enumeration/DGS hybrid [CCL17] 2.048n 0.500n Voronoi cell algorithm [AEVZ02, MV10b] 2.000n 1.000n Quantum sieve [LMP13, LMP15] 1.799n 1.286n Quantum enum/DGS [CCL17] 1.256n 0.500n Discrete Gaussian sampling [ADRS15, ADS15, AS18] 1.000n 1.000n

Sieving

The Nguyen–Vidick sieve [NV08] 0.415n 0.208n GaussSieve [MV10, ..., IKMT14, BNvdP16, YKYC17] 0.415n 0.208n Triple sieve [BLS16, HK17] 0.396n 0.189n Leveled sieving [WLTB11, ZPH13] 0.3778n 0.283n Overlattice sieve [BGJ14] 0.3774n 0.293n Quantum sieve [LMP13] 0.312n 0.208n

Sieving + NNS

Triple sieve with NNS [HK17, HKL18] 0.359n 0.189n Hyperplane LSH [Cha02, Laa15, ..., LM18, Duc18] 0.337n 0.337n Graph-based NNS [EPY99, DCL11, MPLK14, Laa18] 0.327n 0.282n Hypercube LSH [TT07, Laa17] 0.322n 0.322n May–Ozerov NNS [MO15, BGJ15] 0.311n 0.311n Spherical LSH [AINR14, LdW15] 0.298n 0.298n Cross-polytope LSH [TT07, AILRS15, BL16, KW17] 0.298n 0.298n Spherical LSF [BDGL16, MLB17, ALRW17, Chr17] 0.293n 0.293n Quantum NNS sieve [LMP15, Laa16] 0.265n 0.265n

slide-131
SLIDE 131

SVP hardness

Practice ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■ ■

▼▼ ▼ ▼ ▼ ▼ ▼ ▼▼ ▼ ▼ ▼ ▼ ▼▼▼▼ ▼▼

★ ★★★★★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ★ ■ Enumeration (continuous pruning)

▼ Enumeration (discrete pruning)

★ Sieving

80 100 120 140 160 100 104 106 108 1010 → Lattice dimension → Single core timings (seconds) 1 hour 1 day 1 year 1 century

slide-132
SLIDE 132

SVP hardness

NIST submissions

Title S E O Submitters

CRYSTALS–Dilithium

  • Lyubashevsky, Ducas, Kiltz, Lepoint, Schwabe, Seiler, Stehlé

CRYSTALS–Kyber

  • Schwabe, Avanzi, Bos, Ducas, Kiltz, Lepoint, Lyubashevsky, Schanck, ...

Ding Key Exchange

  • Ding, Takagi, Gao, Wang

DRS

  • Plantard, Sipasseuth, Dumondelle, Susilo

(R.)EMBLEM

  • Seo, Park, Lee, Kim, Lee

FALCON

  • Prest, Fouque, Hoffstein, Kirchner, Lyubashevsky, Pornin, Ricosset, ...

FrodoKEM

  • Naehrig, Alkim, Bos, Ducas, Easterbrook, LaMacchia, Longa, Mironov, ...

Giophantus

  • Akiyama, Goto, Okumura, Takagi, Nuida, Hanaoka, Shimizu, Ikematsu

HILA5

  • Saarinen

KCL

  • Zhao, Jin, Gong, Sui

KINDI

  • El Bansarkhani

LAC

  • Lu, Liu, Jia, Xue, He, Zhang

LIMA

  • Smart, Albrecht, Lindell, Orsini, Osheter, Paterson, Peer

Lizard

  • Cheon, Park, Lee, Kim, Song, Hong, Kim, Kim, Hong, Yun, Kim, Park, ...

LOTUS

  • Phong, Hayashi, Aono, Moriai

NewHope

  • Pöppelmann, Alkim, Avanzi, Bos, Ducas, De La Piedra, Schwabe, Stebila

NTRUEncrypt

  • Zhang, Chen, Hoffstein, Whyte

NTRU-HRSS-KEM

  • Schanck, Hülsing, Rijneveld, Schwabe

NTRU Prime

  • Bernstein, Chuengsatiansup, Lange, Van Vredendaal

Odd Manhattan

  • Plantard

pqNTRUSign

  • Zhang, Chen, Hoffstein, Whyte

qTESLA

  • Bindel, Akleylek, Alkim, Barreto, Buchmann, Eaton, Gutoski, Krämer, ...

Round2

  • Garcia-Morchon, Zhang, Bhattacharya, Rietman, Tolhuizen, Torre-Arce

SABER

  • D’Anvers, Karmakar, Roy, Vercauteren

Three Bears

  • Hamburg

Titanium

  • Steinfeld, Sakzad, Zhao

Totals: 21 3 2 Total: 26 proposals with SVP hardness estimates *Not included in the overview: Compact LWE, Mersenne, Ramstake, ...

slide-133
SLIDE 133

SVP hardness

NIST submissions

Most common hardness estimates:

  • Ignore space complexity, ignore o(n) in time complexity
  • Classical sieving: 20.292n time
  • Quantum sieving: 20.265n time
  • “Paranoid bound”: 20.208n time

◮ Note: 20.208n is not a “lower bound” (Frodo, ...)

  • Complexity of BKZ(β) ≥ Complexity of SVP(β)
slide-134
SLIDE 134

Conclusion

Summary

  • Lattice-based crypto relies on hardness of finding short vectors
  • State-of-the-art basis reduction: BKZ with fast SVP subroutine
  • Enumeration for SVP:

◮ Brute-force all combinations of basis vectors ◮ Memory-efficient ◮ Fast pruning heuristics

  • Sieving for SVP:

◮ Consider pairwise combinations of many lattice vectors ◮ Large memory requirement ◮ Practical near neighbor speed-ups

  • Theory: Sieving superior in high dimensions
  • Practice: Enumeration superior in low dimensions
  • Hardness estimates: Commonly based on sieving
slide-135
SLIDE 135

Conclusion

Open problems

Challenges in provable SVP algorithms

  • Sieving: Control distribution of lattice vectors
  • DGS: Combine vectors more efficiently
  • Obtain proven bounds for “random” lattices

Challenges in heuristic SVP algorithms

  • Enumeration: Find best pruning methods
  • Sieving: Find best near neighbor techniques
  • Effective time–memory trade-offs

Challenges in SVP hardness estimation

  • Analyze sieving in a more realistic memory model
  • Lower bounds (SVP

, sieving, enumeration, ...)

  • Consensus on attack model/memory costs
slide-136
SLIDE 136

Questions?