Improved Algorithms for the Approximate k-List Problem in Euclidean Norm

To overcome the large memory requirement of classical lattice sieving algorithms for solving hard lattice problems, Bai-Laarhoven-Stehlé [ANTS 2016] studied tuple lattice sieving, where tuples instead of pairs of lattice vectors are combined to form shorter vectors. Herold-Kirshanova [PKC 2017] recently improved upon their results for arbitrary tuple sizes, for example showing that a triple sieve can solve the shortest vector problem (SVP) in dimension d in time 2 0.3717d+o(d) , using a technique similar to locality-sensitive hashing for finding nearest neighbors.In this work, we generalize the spherical locality-sensitive filters of Becker-Ducas-Gama-Laarhoven [SODA 2016] to obtain space-time tradeoffs for near neighbor searching on dense data sets, and we apply these techniques to tuple lattice sieving to obtain even better time complexities. For instance, our triple sieve heuristically solves SVP in time 2 0.3588d+o(d) . For practical sieves based on Micciancio-Voulgaris' GaussSieve [SODA 2010], this shows that a triple sieve uses less space and less time than the current best near-linear space double sieve.

Section: Svp Algorithmsmentioning

confidence: 99%

Section: Sieving Complexitiesmentioning

confidence: 99%

Faster Sieving for Shortest Lattice Vectors Using Spherical Locality-Sensitive Hashing

Laarhoven

Weger

2015

“…We compare ourselves to four of them, namely a baseline implementation [MV10], and three advanced sieve implementations [FBB+15,MLB17,HK17], which represent (to the best of our knowledge) the state of the art in three different directions. This is given in Table 1.…”

Section: Performance Comparison To the Literaturementioning

confidence: 99%

“…A long line of work, including [BGJ13,Laa15a,Laa15b,BDGL16] decrease this time complexity down to (3/2) n/2+o(n) at the cost of more memory. Other variants (tuple-sieving) are designed to lower the memory complexity [BLS16,HK17].…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Shortest Vector from Lattice Sieving: A Few Dimensions for Free

Ducas

2018

Abstract. Asymptotically, the best known algorithms for solving the Shortest Vector Problem (SVP) in a lattice of dimension n are sieve algorithms, which have heuristic complexity estimates ranging from (4/3) n+o(n) down to (3/2) n/2+o(n) when Locality Sensitive Hashing techniques are used. Sieve algorithms are however outperformed by pruned enumeration algorithms in practice by several orders of magnitude, despite the larger super-exponential asymptotical complexity 2 Θ(n log n) of the latter.In this work, we show a concrete improvement of sieve-type algorithms. Precisely, we show that a few calls to the sieve algorithm in lattices of dimension less than n − d solves SVP in dimension n, whereAlthough our improvement is only sub-exponential, its practical effect in relevant dimensions is quite significant. We implemented it over a simple sieve algorithm with (4/3) n+o(n) complexity, and it outperforms the best sieve algorithms from the literature by a factor of 10 in dimensions 70-80. It performs less than an order of magnitude slower than pruned enumeration in the same range.By design, this improvement can also be applied to most other variants of sieve algorithms, including LSH sieve algorithms and tuple-sieve algorithms. In this light, we may expect sieve-techniques to outperform pruned enumeration in practice in the near future.

The General Sieve Kernel and New Records in Lattice Reduction

Albrecht

Ducas

Herold

et al. 2019

Self Cite

We propose the General Sieve Kernel (G6K, pronounced /Ze.si.ka/), an abstract stateful machine supporting a wide variety of lattice reduction strategies based on sieving algorithms. Using the basic instruction set of this abstract stateful machine, we first give concise formulations of previous sieving strategies from the literature and then propose new ones. We then also give a light variant of BKZ exploiting the features of our abstract stateful machine. This encapsulates several recent suggestions (Ducas at Eurocrypt 2018; Laarhoven and Mariano at PQCrypto 2018) to move beyond treating sieving as a blackbox SVP oracle and to utilise strong lattice reduction as preprocessing for sieving. Furthermore, we propose new tricks to minimise the sieving computation required for a given reduction quality with mechanisms such as recycling vectors between sieves, on-the-fly lifting and flexible insertions akin to Deep LLL and recent variants of Random Sampling Reduction. Moreover, we provide a highly optimised, multi-threaded and tweakable implementation of this machine which we make open-source. We then illustrate the performance of this implementation of our sieving strategies by applying G6K to various lattice challenges. In particular, our approach allows us to solve previously unsolved instances of the Darmstadt SVP (151, 153, 155) and LWE (e.g. (75, 0.005)) challenges. Our solution for the SVP-151 challenge was found 400 times faster than the time reported for the SVP-150 challenge, the previous record. For exact SVP, we observe a performance crossover between G6K and FPLLL's state of the art implementation of enumeration at dimension 70.