Extreme Enumeration on GPU and in Clouds

Abstract

Abstract. The complexity of the Shortest Vector Problem (SVP) in lattices is directly related to the security of NTRU and the provable level of security of many recently proposed lattice-based cryptosystems. We integrate several recent algorithmic improvements for solving SVP and take first place at dimension 120 in the SVP Challenge Hall of Fame. Our implementation allows us to find a short vector at dimension 114 using 8 NVIDIA video cards in less than two days.Specifically, our improvements to the recent Extreme Pruning in enumeration approach, proposed by Gama et al. in Eurocrypt 2010, include: (1) a more flexible bounding function in polynomial form; (2) code to take advantage of Clouds of commodity PCs (via the MapReduce framework); and (3) the use of NVIDIA's Graphics Processing Units (GPUs). We may now reasonably estimate the cost of a wide range of SVP instances in U.S. dollars, as rent paid to cloud-computing service providers, which is arguably a simpler and more practical measure of complexity.

A Parallel Evolutionary Search for Shortest Vector Problem

“…In paper [26], the multi-threading approach is the balanced dedicating of enumeration branches in one enumeration tree to different processing threads for the maximum speedup. In paper [27], the multi-threading approach is massive run of so much threads which be dedicated to the extreme pruned enumeration samples over one lattice block. Also, newly  The OpenMP standard be used to incorporate the MIMD in implementation of our algorithm (this standard uses Fork-Join model of parallelization).…”

“…In some studies (such as [27]), the use of graphic cards for solving SVP were discussed. In the case of pruned enumeration function as SVP oracle, we faced with the worst scenario of warp divergence!…”

Using Progressive Success Probabilities for Sound-pruned Enumerations in BKZ Algorithm

“…Currently, there are various researches which parallelized lattice enumerations as a single running of parallel enumeration [18][19][20][21] (which should be considered as a subroutine of lattice reduction algorithms in high dimensional lattices). The parallelization of extreme pruned enumeration consists of so much single threaded enumerations on each randomized BKZ reduced blocks [22], while on other side, the parallelization of nonextreme sound pruned enumeration (and Schnorr's enumeration) run a single enumeration on many threads.…”

“…Also, since the size of enumeration trees are not necessarily similar for each running of extreme pruned enumeration on randomized blocks, a simple solution for this challenge is to maintain threads busy by generating new instances of extreme pruned enumeration (applying new re-randomization on the local block, then performing preprocess reduction and corresponding enumeration). By using a good parallelizing algorithm and high performance processing hardware, we can reach to efficiency ratio of almost 100% in BKZ 2.0 (one of the researches in this area is [22]). This ratio for non-extreme sound pruned enumeration in proposed parallelization approach is less than 100% (see experimental results achieved in [18][19][20][21]).…”

Orthogonalized lattice enumeration for solving SVP

“…For example, it is a fundamental tool in the popular mathematical library NTL [14]. It is noted that many security assessments [15][16][17][18] and SVP searching methods [19,20] of lattice cryptosystems are based on BKZ implementation of NTL. Therefore, a further improvement to the enumeration technique is of significant importance for SVP searching.…”