Practical, Predictable Lattice Basis Reduction

Bounding basis reduction properties

“…We then introduce a simple way to analyze the self-dual SDBKZ variant of the BKZ reduction algorithm, recently introduced by Micciancio and Walter [21], improving on the dynamical system technique of Hanrot et al [14]. We reprove their bound μ s for the Hermite exponent [matching the first slide inequality in (32)] and prove a polynomial complexity result conjectured in [21].…”

“…We reprove their bound μ s for the Hermite exponent [matching the first slide inequality in (32)] and prove a polynomial complexity result conjectured in [21]. The known techniques seem not sufficient to prove a bound for the approximation exponent of SDBKZ.…”

“…Micciancio and Walter [21] use this technique to partially analyze a self-dual variant of the BKZ algorithm called SDBKZ. In this algorithm, given some block size s (2 < s < n), tours of primal reduction of the blocks B i:i+s−1 for i = 1, .…”

“…Thus one uses in practice block algorithms; they apply strong and expensive reduction techniques on low-dimensional projected subspaces only. Currently the best practical algorithms are the BKZ algorithm (Schnorr and Euchner [32]) and the recent self-dual SDBKZ variant by Micciancio and Walter [21] (called DBKZ there). On the other hand, the best theoretical guarantees for block algorithms are provided by the (at currently practical block sizes apparently inferior) slide reduction algorithm of Gama and Nguyen [11].…”

“…In this paper, the approaches of Hanrot et al [14] (used also in Micciancio and Walter [21]), Schnorr [31], and Gama and Nguyen [11] for the asymptotic worst-case analysis of LLL, BKZ, and SDBKZ are improved. The first improvement replaces the complicated dynamical system arguments of [14] by simpler and sharper induction arguments on a bound on the bit sizes.…”