On the asymptotic complexity of solving LWE

Abstract

We provide for the first time an asymptotic comparison of all known algorithms for the search version of the Learning with Errors (LWE) problem. This includes an analysis of several lattice-based approaches as well as the combinatorial BKW algorithm. Our analysis of the lattice-based approaches defines a general framework, in which the algorithms of Babai, Lindner-Peikert and several pruning strategies appear as special cases. We show that within this framework, all lattice algorithms achieve the same asymptotic complexity. For the BKW algorithm, we present a refined analysis for the case of only a polynomial number of samples via amplification, which allows for a fair comparison with lattice-based approaches. Somewhat surprisingly, such a small number of samples does not make the asymptotic complexity significantly inferior, but only affects the constant in the exponent. As the main result we obtain that both, lattice-based techniques and BKW with a polynomial number of samples, achieve running time 2 O(n) for n-dimensional LWE, where we make the constant hidden in the big-O notion explicit as a simple and easy to handle function of all LWE-parameters. In the lattice case this function also depends on the time to compute a BKZ lattice basis with block size Θ (n). Thus, from a theoretical perspective our analysis reveals how LWE's complexity changes as a function of the LWE-parameters, and from a practical perspective our analysis is a useful tool to choose LWE-parameters resistant to all known attacks.

On the Complexity of the LWR-Solving BKW Algorithm

“…||0). As reported in [19], improved variants of BKW such as [20], [21] are some of the asymptotically fastest algorithms. Although some algorithms [22] based on lattice reduction outperform these BKW-like algorithms for some parameter-sets (q, σ), it allows a heuristic [19].…”

Substantiation of promising post-quantum national lattice-based electronic signature standard

“…Отже, виходячи з [1, табл. 1], де для ( , ) (6,5) kl  , 3   зазначено оцінку стійкості 174 2 , можна припустити, що для стійкості 256 2 достатньо покласти ( , ) (9,8) kl  , 3   .…”

The Asymptotic Complexity of Coded-BKW with Sieving Using Increasing Reduction Factors

“…With access to only a polynomial number of samples the complexity exponent of lattice-based algorithms changes to 2λc q /(c q − c s ) 2 [5].…”

“…There are mainly three types of algorithms for solving the LWE problem. For surveys on the concrete and asymptotic complexity of these algorithms see [4] and [5] respectively.…”