Sieving for Shortest Vectors in Lattices Using Angular Locality-Sensitive Hashing

120

Abstract. Several ideal-lattice-based cryptosystems have been broken by recent attacks that exploit special structures of the rings used in those cryptosystems. The same structures are also used in the leading proposals for post-quantum lattice-based cryptography, including the classic NTRU cryptosystem and typical Ring-LWE-based cryptosystems. This paper (1) proposes NTRU Prime, which tweaks NTRU to use rings without these structures; (2) proposes Streamlined NTRU Prime, a public-key cryptosystem optimized from an implementation perspective, subject to the standard design goal of IND-CCA2 security; (3) finds high-security post-quantum parameters for Streamlined NTRU Prime; and (4) optimizes a constant-time implementation of those parameters. The resulting sizes and speeds show that reducing the attack surface has very low cost.

Section: Proof Of Theorem 21mentioning

confidence: 99%

NTRU Prime: Reducing Attack Surface at Low Cost

Bernstein

Chuengsatiansup

Lange

et al. 2017

120

“…end if 17: until v is a shortest vector of the lattice Note that to actually prove (heuristically) that our proposed algorithm achieves a certain heuristic time and space complexity, one should apply the same techniques to the sieve algorithm of Nguyen and Vidick [46] as previously outlined in [32]. Nguyen and Vidick's algorithm comes with heuristic bounds on the time complexity (not based on conjectures on the kissing constant or on the conjectured absence of collisions), and the speedup we obtain applies to that algorithm in the same way.…”

Section: Algorithm 1 the Gausssieve Algorithmmentioning

confidence: 99%

“…Nguyen and Vidick's algorithm comes with heuristic bounds on the time complexity (not based on conjectures on the kissing constant or on the conjectured absence of collisions), and the speedup we obtain applies to that algorithm in the same way. However, similar to [32] we are interested in designing the fastest and most practical sieving algorithm possible for solving SVP rather than the best provable heuristic algorithm, and so in the remainder of this paper we will focus on the GaussSieve. But one should keep in mind that for theoretical arguments these ideas may also be applied to the NV-sieve [46] which actually leads to provable bounds under suitable heuristic assumptions.…”

Section: Algorithm 1 the Gausssieve Algorithmmentioning

confidence: 99%

“…Even more recently, a new line of research was initiated which combines the ideas of sieving with a technique from the literature of nearest neighbor searching, called locality-sensitive hashing (LSH) [26]. This led to a practical algorithm with heuristic time and space complexities of only 2 0.337n+o(n) (the HashSieve [32,41]), and an algorithm with even better asymptotic complexities of only 2 0.298n+o(n) (the SphereSieve [33]). However, for both methods the polynomial speedups that apply to the GaussSieve for ideal lattices [12,27,54] do not seem to apply, and the latter algorithm may be of limited practical interest due to large hidden order terms in the LSH technique and the fact that this technique seems incompatible with the GaussSieve [43] and only works with the less practical NV-sieve [46].…”

Section: Introductionmentioning

confidence: 99%

“…The heuristic space-time trade-off of various previous heuristic sieving algorithms from the literature (the red points and curves), and the heuristic trade-off between the space and time complexities obtained with our algorithm (the blue curve). The referenced papers are: NV'08 [46] (the NV-sieve), MV '10 [43] (the GaussSieve), WLTB'11 [61] (two-level sieving), ZPH'13 [62] (three-level sieving), BGJ'14 [10] (the decomposition approach), Laa'15 [32] (the HashSieve), LdW'15 [33] (the SphereSieve). Note that the trade-off curve for the CPSieve (the blue curve) overlaps with the asymptotic trade-off of the SphereSieve of [33].…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Efficient (Ideal) Lattice Sieving Using Cross-Polytope LSH

Becker

Laarhoven

2016

Self Cite

Abstract. Combining the efficient cross-polytope locality-sensitive hash family of Terasawa and Tanaka with the heuristic lattice sieve algorithm of Micciancio and Voulgaris, we show how to obtain heuristic and practical speedups for solving the shortest vector problem (SVP) on both arbitrary and ideal lattices. In both cases, the asymptotic time complexity for solving SVP in dimension n is 2 0.298n+o(n) . For any lattice, hashes can be computed in polynomial time, which makes our CPSieve algorithm much more practical than the SphereSieve of Laarhoven and De Weger, while the better asymptotic complexities imply that this algorithm will outperform the GaussSieve of Micciancio and Voulgaris and the HashSieve of Laarhoven in moderate dimensions as well. We performed tests to show this improvement in practice. For ideal lattices, by observing that the hash of a shifted vector is a shift of the hash value of the original vector and constructing rerandomization matrices which preserve this property, we obtain not only a linear decrease in the space complexity, but also a linear speedup of the overall algorithm. We demonstrate the practicability of our cross-polytope ideal lattice sieve IdealCPSieve by applying the algorithm to cyclotomic ideal lattices from the ideal SVP challenge and to lattices which appear in the cryptanalysis of NTRU.

Quantum Lattice Enumeration and Tweaking Discrete Pruning

Aono

Nguyêñ

Shen

2018

Enumeration is a fundamental lattice algorithm. We show how to speed up enumeration on a quantum computer, which affects the security estimates of several lattice-based submissions to NIST: if T is the number of operations of enumeration, our quantum enumeration runs in roughly √ T operations. This applies to the two most efficient forms of enumeration known in the extreme pruning setting: cylinder pruning but also discrete pruning introduced at Eurocrypt '17. Our results are based on recent quantum tree algorithms by Montanaro and Ambainis-Kokainis. The discrete pruning case requires a crucial tweak: we modify the preprocessing so that the running time can be rigorously proved to be essentially optimal, which was the main open problem in discrete pruning. We also introduce another tweak to solve the more general problem of finding close lattice vectors.