Shortest Vector from Lattice Sieving: A Few Dimensions for Free

Abstract

Abstract. Asymptotically, the best known algorithms for solving the Shortest Vector Problem (SVP) in a lattice of dimension n are sieve algorithms, which have heuristic complexity estimates ranging from (4/3) n+o(n) down to (3/2) n/2+o(n) when Locality Sensitive Hashing techniques are used. Sieve algorithms are however outperformed by pruned enumeration algorithms in practice by several orders of magnitude, despite the larger super-exponential asymptotical complexity 2 Θ(n log n) of the latter.In this work, we show a concrete improvement of sieve-type algorithms. Precisely, we show that a few calls to the sieve algorithm in lattices of dimension less than n − d solves SVP in dimension n, whereAlthough our improvement is only sub-exponential, its practical effect in relevant dimensions is quite significant. We implemented it over a simple sieve algorithm with (4/3) n+o(n) complexity, and it outperforms the best sieve algorithms from the literature by a factor of 10 in dimensions 70-80. It performs less than an order of magnitude slower than pruned enumeration in the same range.By design, this improvement can also be applied to most other variants of sieve algorithms, including LSH sieve algorithms and tuple-sieve algorithms. In this light, we may expect sieve-techniques to outperform pruned enumeration in practice in the near future.

Evolutionary Techniques in Lattice Sieving Algorithms

“…For finding optimal solutions in the entire search space, some methods in EA have proposed a progressive approach, where initially only a subset of the constraints (search space) is studied to find local solutions, before expanding to a wider search space and finding global solutions (Coello et al, ). Similar ideas have recently been explored in the context of lattice sieving (Laarhoven and Mariano, 2018;Ducas, 2018), starting to sieve in a sublattice of the original lattice before widening the search space. This heuristically and practically accelerates the time until convergence.…”

Learning Strikes Again: The Case of the DRS Signature Scheme

“…The standard reference for estimating the cost enumeration is [10], which gives a cost of 2 0.270β ln β−1.019β+16.10 [3,9] clockcycles. Alternatively, the Gauss-Sieve algorithm [22] with dimension for free and other tricks showed a running time of 2 0.396β+8.4 clock cycles [11]. Those two methods lead respectively to estimates of 2 78 and 2 80 clock-cycles to recover one secret row.…”

The General Sieve Kernel and New Records in Lattice Reduction

“…Our sieving performance is enabled by building on, generalising and extending previous works. In particular, the landscape of enumeration and sieving started to change recently with [Duc18a,LM18]. For example, [Duc18a] speculated that the crossover point, for solving SVP, between the SubSieve proposed there and pruned enumeration would be around d = 90 if combined with faster sieving than [MV10b].…”

“…In particular, the landscape of enumeration and sieving started to change recently with [Duc18a,LM18]. For example, [Duc18a] speculated that the crossover point, for solving SVP, between the SubSieve proposed there and pruned enumeration would be around d = 90 if combined with faster sieving than [MV10b]. A key ingredient for this performance gain was the realisation of several "dimensions for free" by utilising heavy preprocessing and Babai lifting (or size reduction) in said free dimensions.…”

“…In other words, we may consider these improvements as applying lessons learnt from enumeration to sieving algorithms. It is worth recalling here that the fastest enumeration algorithm relies on the input basis being quasi-HKZ reduced [Kan83], but prior to [Duc18a,LM18] sieving was largely oblivious to the quality of the input basis. Furthermore, both [Duc18a,LM18] suggest exploiting the fact that sieving algorithms hold a database of many short vectors, for example by recycling them in future sieving steps.…”