On the Quantitative Hardness of CVP

Abstract

For odd integers p ≥ 1 (and p = ∞), we show that the Closest Vector Problem in the p norm (CVP p ) over rank n lattices cannot be solved in 2 (1−ε)n time for any constant ε > 0 unless the Strong Exponential Time Hypothesis (SETH) fails. We then extend this result to "almost all" values of p ≥ 1, not including the even integers. This comes tantalizingly close to settling the quantitative time complexity of the important special case of CVP 2 (i.e., CVP in the Euclidean norm), for which a 2 n+o(n) -time algorithm is known. In particular, our result applies for any p = p(n) = 2 that approaches 2 as n → ∞.We also show a similar SETH-hardness result for SVP ∞ ; hardness of approximating CVP p to within some constant factor under the so-called Gap-ETH assumption; and other quantitative hardness results for CVP p 1 WLTB11, Laa15, BDGL16], and there is some reason to believe that the provably correct [ADRS15] algorithm can be improved. In particular, there is a provably correct 2 n/2+o(n) -time algorithm that approximates SVP 2 up to a small constant approximation factor [ADRS15].A different line of work extended the randomized sieving approach of [AKS01] to obtain 2 O(n)time algorithms for SVP in additional norms. In particular, Blömer and Naewe extended it to all p norms [BN09]. Subsequent work extended this further, first to arbitrary symmetric norms [AJ08] and then to the "near-symmetric norms" that arise in integer programming [Dad12].Finally, a third line of work extended the [AKS01] approach to approximate CVP. Ajtai, Kumar, and Sivakumar themselves showed a 2 O(n) -time algorithm for approximating CVP 2 to within any constant approximation factor strictly greater than one [AKS02]. Blömer and Naewe obtained the same result for all p norms [BN09], and Dadush extended it further to arbitrary symmetric norms and again to "near-symmetric norms" [Dad12]. We stress, however, that none of these results apply to exact CVP, and indeed, there are some barriers to extending these algorithms to exact CVP. (See, e.g., [ADS15].) Exact algorithms for CVP.Exact CVP appears to be a much more subtle problem than exact SVP. 2 Indeed, progress on exact CVP has been much slower than the progress on exact SVP. Over a decade after [AKS01], Micciancio and Voulgaris presented the first 2 O(n) -time algorithm for exact CVP 2 [MV13], using elegant new techniques built upon the approach of Sommer, Feder, and Shalvi [SFS09]. Specifically, they achieved a running time of 4 n+o(n) , and subsequent work even showed a running time of 2 n+o(n) for CVP 2 with Preprocessing (in which the algorithm is allowed access to arbitrary advice that depends on the lattice but not the target vector; see Section 2.1) [BD15]. Later, [ADS15] showed a 2 n+o(n) -time algorithm for CVP 2 , so that the current best known asymptotic running time is actually the same for SVP 2 and CVP 2 .However, for p = 2, progress for exact CVP p has been minimal. Indeed, the fastest known algorithms for exact CVP p with p = 2 are still the n O(n) -time enumeration algorithms first d...

(Gap/S)ETH hardness of SVP

“…To rule out such algorithms, we typically rely on a fine-grained complexity-theoretic hypothesissuch as the Strong Exponential Time Hypothesis (SETH, see Section 2.3) or the Exponential Time Hypothesis (ETH). To that end, Bennett, Golovnev, and Stephens-Davidowitz recently showed quantitative hardness results for the Closest Vector Problem in p norms (CVP p ) [BGS17], which is a close relative of SVP p that is known to be at least as hard (so that this was a necessary first step towards proving similar results for SVP p ). In particular, assuming SETH, [BGS17] showed that there is no 2 (1−ε)n -time algorithm for CVP p or SVP ∞ for any ε > 0 and "almost all" 1 ≤ p ≤ ∞ (not including p = 2).…”

“…To that end, Bennett, Golovnev, and Stephens-Davidowitz recently showed quantitative hardness results for the Closest Vector Problem in p norms (CVP p ) [BGS17], which is a close relative of SVP p that is known to be at least as hard (so that this was a necessary first step towards proving similar results for SVP p ). In particular, assuming SETH, [BGS17] showed that there is no 2 (1−ε)n -time algorithm for CVP p or SVP ∞ for any ε > 0 and "almost all" 1 ≤ p ≤ ∞ (not including p = 2). Under ETH, [BGS17] showed that there is no 2 o(n) -time algorithm for CVP p for any 1 ≤ p ≤ ∞.…”

“…To prove this theorem, we give a (randomized) reduction from the CVP p instances created by the reduction of [BGS17] to SVP p that only increases the rank of the lattice by a constant factor. As we describe in Section 1.3, our reduction is surprisingly simple.…”

“…We can instead rely on the analogous assumption for Max-k-SAT, which is potentially weaker. (We inherit this property directly from [BGS17]. See Section 4.…”

“…We now show that (A, G)-CVP p is SETH-hard. We first observe that the SETH-hard CVP p instances from [BGS17] "have a copy of Z n embedded in them." This fact will allow us to compute A (p) r,s quite accurately.…”