A sieve algorithm based on overlattices

Abstract

In this paper, we present a heuristic algorithm for solving exact, as well as approximate, shortest vector and closest vector problems on lattices. The algorithm can be seen as a modified sieving algorithm for which the vectors of the intermediate sets lie in overlattices or translated cosets of overlattices. The key idea is hence no longer to work with a single lattice but to move the problems around in a tower of related lattices. We initiate the algorithm by sampling very short vectors in an overlattice of the original lattice that admits a quasi-orthonormal basis and hence an efficient enumeration of vectors of bounded norm. Taking sums of vectors in the sample, we construct short vectors in the next lattice. Finally, we obtain solution vector(s) in the initial lattice as a sum of vectors of an overlattice. The complexity analysis relies on the Gaussian heuristic. This heuristic is backed by experiments in low and high dimensions that closely reflect these estimates when solving hard lattice problems in the average case.This new approach allows us to solve not only shortest vector problems, but also closest vector problems, in lattices of dimension n in time 2 0.3774 n using memory 2 0.2925 n . Moreover, the algorithm is straightforward to parallelize on most computer architectures.

Solving the Shortest Vector Problem in 2 n Time Using Discrete Gaussian Sampling

“…AKS devised a method based on "randomized sieving," whereby exponentially many randomly generated lattice vectors are iteratively combined to create shorter and shorter vectors, to give the first 2 O(n) -time (and space) randomized algorithm for SVP. Many extensions and improvements of their sieving technique have been proposed, both provable [4,33,41,27] and heuristic [38,48,49,6,23], where the fastest provable sieving algorithm [41] for exact SVP requires 2 2.465n+o(n) time and 2 1.233n+o(n) space. It was observed by [27,30,47] that AKS can be modified to obtain a 2 0.802n+o(n) -time and 2 0.401n+o(n) -space algorithm for approximating SVP to within some large constant factor.…”

Sieving for Shortest Vectors in Lattices Using Angular Locality-Sensitive Hashing

“…Proposition 1). The referenced works are: NV'08 [43]; MV '10 [40]; WLTB'11 [55]; ZPH'13 [56]; BGJ'14 [10].…”

“…While the original work of Ajtai et al [5] showed only that sieving solves SVP in time and space 2 O(n) , later work showed that one can provably solve SVP in arbitrary lattices in time 2 2.47n+o(n) and space 2 1.24n+o(n) [22,43,48]. Heuristic analyses of sieving algorithms further suggest that one may be able to solve SVP in time 2 0.42n+o(n) and space 2 0.21n+o(n) [10,40,43], or optimizing for time, in time 2 0.38n+o(n) and space 2 0.29n+o(n) [10,55,56]. Other works have shown how to speed up sieving in practice [15,19,25,35,36,42,49,50], and sieving recently made its way to the top 25 of the SVP challenge hall of fame [51], using the GaussSieve algorithm [29,40].…”

Efficient (Ideal) Lattice Sieving Using Cross-Polytope LSH

“…Out of the latter three methods with a single exponential time complexity, sieving still seems to be the most practical to date; the provable time exponent for sieving may be as high as 2 2.465n+o(n) [23,46,51] (compared to 2 2n+o(n) for the Voronoi cell algorithm, and 2 n+o(n) for the discrete Gaussian combiner), but various heuristic improvements to sieving since 2001 [10,43,46,61,62] have shown that in practice sieving may be able to solve SVP in time and space as little as 2 0.378n+o(n) . Other works on sieving have further shown how to parallelize and speed up sieving in practice with various polynomial speedups [12, 17, 27, 39-41, 45, 53, 54], and how sieving can be made even faster on certain structured, ideal lattices used in lattice cryptography [12,27,54].…”

“…The heuristic space-time trade-off of various previous heuristic sieving algorithms from the literature (the red points and curves), and the heuristic trade-off between the space and time complexities obtained with our algorithm (the blue curve). The referenced papers are: NV'08 [46] (the NV-sieve), MV '10 [43] (the GaussSieve), WLTB'11 [61] (two-level sieving), ZPH'13 [62] (three-level sieving), BGJ'14 [10] (the decomposition approach), Laa'15 [32] (the HashSieve), LdW'15 [33] (the SphereSieve). Note that the trade-off curve for the CPSieve (the blue curve) overlaps with the asymptotic trade-off of the SphereSieve of [33].…”