Algorithms for the Shortest and Closest Lattice Vector Problems

Abstract

Abstract. We present the state of the art solvers of the Shortest and Closest Lattice Vector Problems in the Euclidean norm. We recall the three main families of algorithms for these problems, namely the algorithm by Micciancio and Voulgaris based on the Voronoi cell [STOC'10], the Monte-Carlo algorithms derived from the Ajtai, Kumar and Sivakumar algorithm [STOC'01] and the enumeration algorithms originally elaborated by Kannan [STOC'83] and Fincke and Pohst [EUROCAL'83]. We concentrate on the theoretical worst-case complexity bounds, but also consider some practical facets of these algorithms.

On the concrete hardness of Learning with Errors

“…The typical methods of doing this are computing the Voronoi cell of the lattice, sieving or enumeration [HPS11b]. Below we refer to running any of these algorithms as calling an SVP oracle.…”

On the complexity of the BKW algorithm on LWE

“…Subsequent developments of the AKS algorithm by Regev, Nguyen and Vidick, Micciancio and Voulgaris, Pujol and Stehle delivered algorithms which were of time complexity 2 16n+o(n) , 2 5.9n+o(n) , 2 3.4n+o(n) and 2 2.7n+o(n) , respectively [18].…”

Sieving for Shortest Vectors in Lattices Using Angular Locality-Sensitive Hashing

“…On the other hand, these other SVP algorithms are relatively new, and recent improvements have shown that at least sieving may be able to compete with enumeration in the future. While the original work of Ajtai et al [5] showed only that sieving solves SVP in time and space 2 O(n) , later work showed that one can provably solve SVP in arbitrary lattices in time 2 2.47n+o(n) and space 2 1.24n+o(n) [22,43,48]. Heuristic analyses of sieving algorithms further suggest that one may be able to solve SVP in time 2 0.42n+o(n) and space 2 0.21n+o(n) [10,40,43], or optimizing for time, in time 2 0.38n+o(n) and space 2 0.29n+o(n) [10,55,56].…”