Faster Sieving for Shortest Lattice Vectors Using Spherical Locality-Sensitive Hashing

Abstract

To overcome the large memory requirement of classical lattice sieving algorithms for solving hard lattice problems, Bai-Laarhoven-Stehlé [ANTS 2016] studied tuple lattice sieving, where tuples instead of pairs of lattice vectors are combined to form shorter vectors. Herold-Kirshanova [PKC 2017] recently improved upon their results for arbitrary tuple sizes, for example showing that a triple sieve can solve the shortest vector problem (SVP) in dimension d in time 2 0.3717d+o(d) , using a technique similar to locality-sensitive hashing for finding nearest neighbors.In this work, we generalize the spherical locality-sensitive filters of Becker-Ducas-Gama-Laarhoven [SODA 2016] to obtain space-time tradeoffs for near neighbor searching on dense data sets, and we apply these techniques to tuple lattice sieving to obtain even better time complexities. For instance, our triple sieve heuristically solves SVP in time 2 0.3588d+o(d) . For practical sieves based on Micciancio-Voulgaris' GaussSieve [SODA 2010], this shows that a triple sieve uses less space and less time than the current best near-linear space double sieve.

On the concrete hardness of Learning with Errors

“…The third row is based on [Laa14] which reports a time complexity of 2 0.3366 k+o(k) asymptotically and 2 0.45 k−19 seconds in practical experiments on a 2.66GHz CPU for small k. Note that the leading coefficient in these experiments is bigger than 0.3366 from the asymptotic statement because of the +o(k) term in the asymptotic expression. We brush over this difference and simply estimate the cost of sieving as 2 0.3366 k+c operations where we derive the additive constant c from timings derived from practical experiments in [Laa14].…”

“…We brush over this difference and simply estimate the cost of sieving as 2 0.3366 k+c operations where we derive the additive constant c from timings derived from practical experiments in [Laa14]. name data source log(t k ) fplll fplll 4.0.4 0.0135 k 2 − 0.2825 k + 21.02 enum [CN12] 0.270189 k log(k) − 1.0192 k + 16.10 sieve [Laa14] 0.3366 k + 12.31 Table 1. Estimates for the cost in clock cycles to solve SVP in dimension k.…”

Efficient (Ideal) Lattice Sieving Using Cross-Polytope LSH

“…Even more recently, a new line of research was initiated which combines the ideas of sieving with a technique from the literature of nearest neighbor searching, called locality-sensitive hashing (LSH) [26]. This led to a practical algorithm with heuristic time and space complexities of only 2 0.337n+o(n) (the HashSieve [32,41]), and an algorithm with even better asymptotic complexities of only 2 0.298n+o(n) (the SphereSieve [33]). However, for both methods the polynomial speedups that apply to the GaussSieve for ideal lattices [12,27,54] do not seem to apply, and the latter algorithm may be of limited practical interest due to large hidden order terms in the LSH technique and the fact that this technique seems incompatible with the GaussSieve [43] and only works with the less practical NV-sieve [46].…”

“…The exact trade-off between the time and memory is shown in Figure 1. The low polynomial cost of computing hashes and the fact that this algorithm is based on the GaussSieve (rather than the NV-sieve [46]) indicate that this algorithm is more practical than the SphereSieve [33], while in moderate dimensions this method will be faster than both the GaussSieve and the HashSieve due to its better asymptotic time complexity. Ideal lattices.…”

“…The heuristic space-time trade-off of various previous heuristic sieving algorithms from the literature (the red points and curves), and the heuristic trade-off between the space and time complexities obtained with our algorithm (the blue curve). The referenced papers are: NV'08 [46] (the NV-sieve), MV '10 [43] (the GaussSieve), WLTB'11 [61] (two-level sieving), ZPH'13 [62] (three-level sieving), BGJ'14 [10] (the decomposition approach), Laa'15 [32] (the HashSieve), LdW'15 [33] (the SphereSieve). Note that the trade-off curve for the CPSieve (the blue curve) overlaps with the asymptotic trade-off of the SphereSieve of [33].…”