Fast Lattice Point Enumeration with Minimal Overhead

Abstract

Enumeration algorithms are the best currently known methods to solve lattice problems, both in theory (within the class of polynomial space algorithms), and in practice (where they are routinely used to evaluate the concrete security of lattice cryptography). However, there is an uncomfortable gap between our theoretical understanding and practical performance of lattice point enumeration algorithms. The algorithms typically used in practice have worst-case asymptotic running time 2 O(n 2 ) , but perform extremely well in practice, at least for all values of the lattice dimension for which experimentation is feasible. At the same time, theoretical algorithms (Kannan, Mathematics of Operation Research 12(3): 1987) are asymptotically superior (achieving 2 O(n log n) running time), but they are never used in practice because they incur a substantial overhead that makes them uncompetitive for all reasonable values of the lattice dimension n. This gap is especially troublesome when algorithms are run in practice to evaluate the concrete security of a cryptosystem, and then experimental results are extrapolated to much larger dimension where solving lattice problems is computationally infeasible.We introduce a new class of (polynomial space) lattice enumeration algorithms that simultaneously achieve asymptotic efficiency (meeting the theoretical n O(n) = 2 O(n log n) time bound) and practicality, matching or surpassing the performance of practical algorithms already in moderately low dimension. Key technical contributions that allow us to achieve this result are a new analysis technique that allows us to greatly reduce the number of recursive calls performed during preprocessing (from super exponential in n to single exponential, or even polynomial in n), a new enumeration technique that can be directly applied to projected lattice (basis) vectors, without the need to remove linear dependencies, and a modified block basis reduction * Research supported in part by the DARPA PROCEED program and NSF grant CNS-1117936. Opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not necessarily reflect the views of DARPA or NSF.† University of California, San Diego, email: {daniele, miwalter}@eng.ucsd.edu method with fast (logarithmic) convergence properties. The last technique is used to obtain a new SVP enumeration procedure withÕ(n n/2e ) running time, matching (even in the constant in the exponent) the optimal worst-case analysis (Hanrot and Stehlé, CRYPTO 2007) of Kannan's theoretical algorithm, but with far superior performance in practice.We complement our theoretical analysis with a preliminary set of experiments that not only support our practicality claims, but also allow to estimate the crossover point between different versions of enumeration algorithms, as well as asymptotically faster (but not quite practical) algorithms running in single exponential 2 O(n) time and space.

Solving the Shortest Vector Problem in 2 n Time Using Discrete Gaussian Sampling

“…The best running time known for polynomial-space algorithms is the n O(n) obtained by enumeration-based methods [21,19,17,35].…”

“…The first class, developed by Kannan [21] and refined by many others [19,17,35], is based on combining strong basis reduction with exhaustive enumeration inside Euclidean balls. The fastest current algorithm in this class solves SVP in O(n n/(2e) ) time while using poly(n) space [17].…”

Sieving for Shortest Vectors in Lattices Using Angular Locality-Sensitive Hashing

“…This method has a low (polynomial) space complexity, but its runtime is superexponential (2 Ω(n log n) ), which is known to be suboptimal: sieving [5], the Voronoi cell algorithm [39], and the recent discrete Gaussian sampling approach [2] all run in single exponential time (2 O(n) ). The main drawbacks of the latter methods are that their space complexities are exponential in n as well, and due to larger hidden constants in the exponents enumeration is commonly still considered more practical than other methods in moderate dimensions n [20,41]. For the NV-sieve, we can further process the hash tables sequentially to obtain a speedup rather than a trade-off (blue point).…”

Solving the Closest Vector Problem in 2^n Time -- The Discrete Gaussian Strikes Again!

“…HKZ bases are extremely well-studied by the basis reduction community [5], [31], [45], [32], [33], and this idea is used in essentially all enumeration algorithms for CVP. However, there are examples where the standard basis enumeration techniques require n Ω(n) time to solve CVP.…”