On the Asymptotics of Solving the LWE Problem Using Coded-BKW With Sieving

Abstract

The Learning with Errors problem (LWE) has become a central topic in recent cryptographic research. In this paper, we present a new solving algorithm combining important ideas from previous work on improving the Blum-Kalai-Wasserman (BKW) algorithm and ideas from sieving in lattices. The new algorithm is analyzed and demonstrates an improved asymptotic performance. For the Regev parameters q = n 2 and noise level σ = n 1.5 /( √ 2π log 2 2 n), the asymptotic complexity is 2 0.893n in the standard setting, improving on the previously best known complexity of roughly 2 0.930n . The newly proposed algorithm also provides asymptotic improvements when a quantum computer is assumed or when the number of samples is limited.

The Asymptotic Complexity of Coded-BKW with Sieving Using Increasing Reduction Factors

“…Proof: The theorem is a slight restatement of Theorem 7 from [14], to make it more similar to Theorem 2 of this paper. Theorem 7 from [14] includes both the proof and the underlying heuristic assumptions the proof is based on.…”

“…Proof: This proof is generalization of the proof of Theorem 1, as proven in [14]. The proof structure is similar, but the proof is also much longer.…”

“…A micro picture of how one step of coded-BKW with sieving works. Slightly changed version of Figure 1 from [14]. Each sample gets mapped to one list L j out of K lists.…”

“…The proof structure is similar, but the proof is also much longer. To avoid making it longer than necessary, some notation is borrowed from the proof in [14].…”

Making the BKW Algorithm Practical for LWE

“…For surveys on the concrete and asymptotic complexity of solving LWE, see [7] and [22,24], respectively. In essence, BKW-style algorithms have a better asymptotic performance than lattice-based approaches for parameter choices with large noise.…”