Speed-Ups and Time–Memory Trade-Offs for Tuple Lattice Sieving

Herold, Gottfried; Kirshanova, Elena; Laarhoven, Thijs

doi:10.1007/978-3-319-76578-5_14

Cited by 23 publications

(17 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…80-110), triple_sieve performs slightly better if the database size is a bit less than 2 0.2075n+o(n) . Furthermore, these experiments are consistent with theoretical results on the high memory regime for 3-sieve: in [HKL18] it was proven that the running time of 3-sieve quickly drops down if allowed slightly more memory, as Figure 2 shows.…”

Section: Sievingsupporting

confidence: 88%

The General Sieve Kernel and New Records in Lattice Reduction

Albrecht

Ducas

Herold

et al. 2019

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

We propose the General Sieve Kernel (G6K, pronounced /Ze.si.ka/), an abstract stateful machine supporting a wide variety of lattice reduction strategies based on sieving algorithms. Using the basic instruction set of this abstract stateful machine, we first give concise formulations of previous sieving strategies from the literature and then propose new ones. We then also give a light variant of BKZ exploiting the features of our abstract stateful machine. This encapsulates several recent suggestions (Ducas at Eurocrypt 2018; Laarhoven and Mariano at PQCrypto 2018) to move beyond treating sieving as a blackbox SVP oracle and to utilise strong lattice reduction as preprocessing for sieving. Furthermore, we propose new tricks to minimise the sieving computation required for a given reduction quality with mechanisms such as recycling vectors between sieves, on-the-fly lifting and flexible insertions akin to Deep LLL and recent variants of Random Sampling Reduction. Moreover, we provide a highly optimised, multi-threaded and tweakable implementation of this machine which we make open-source. We then illustrate the performance of this implementation of our sieving strategies by applying G6K to various lattice challenges. In particular, our approach allows us to solve previously unsolved instances of the Darmstadt SVP (151, 153, 155) and LWE (e.g. (75, 0.005)) challenges. Our solution for the SVP-151 challenge was found 400 times faster than the time reported for the SVP-150 challenge, the previous record. For exact SVP, we observe a performance crossover between G6K and FPLLL's state of the art implementation of enumeration at dimension 70.

show abstract

Section: Sievingsupporting

confidence: 88%

The General Sieve Kernel and New Records in Lattice Reduction

Albrecht

Ducas

Herold

et al. 2019

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

“…In 2018, Herold, Kirshanova and Laarhoven [35] extended their previous work together. With configuration framework and spherical LSF, they offered tunable time-memory tradeoffs for sieve algorithms with arbitrary tuple sizes.…”

Section: E Tuple Sieve Algorithm and Its Improvementsmentioning

confidence: 99%

“…Nevertheless, the exponential memory consumption still restircts the application of sieve algorithms. On this occasion, TupleSieve algorithms [9], [34], [35] were proposed to overcome this obstacle by means of a trade-off between time and memory. In addition, locality-sensitive hashing (LSH), a technique to solve the nearest neighbor search problem, was introduced into sieve algorithms [11], [13], [14], [44], [45], [47] to improve efficiency.…”

Section: Introductionmentioning

confidence: 99%

A Review of Sieve Algorithms in Solving the Shortest Lattice Vector Problem

Sun

Yan

2020

IEEE Access

View full text Add to dashboard Cite

As a category of algorithms to solve the shortest lattice vector problem, sieve algorithms have drawn more and more attention due to the prominent performance in recent years. Enumeration algorithms used to perform better in practice even though sieve algorithms are asymptotically faster. Combined with techniques like locality-sensitive hashing and rank reduction, sieve algorithms now are capable of competing with enumeration algorithms. In this work, we study sieve algorithms in solving the shortest vector problem on lattices by categorizing various sieve algorithms and elaborating on ideas and techniques used to improve sieve algorithms. In addition, we present several prospective directions worth future research.

show abstract

“…By selecting more parents and inheriting the best genes from all of them, stronger offspring can sometimes be generated than with two parents. This idea has been studied in the context of lattice sieving as tuple lattice sieving (Bai et al, 2016;Herold et al, 2018), where tuples of up to k ≥ 2 vectors are recombined to generate shorter lattice vectors. In general, this approach leads to better memory complexities than the standard approach (smaller populations suffice to guarantee a productive evolution process) but to worse time complexities till convergence (finding suitable k-tuples of parents for recombination requires more work).…”

Section: Past Sieving Techniquesmentioning

confidence: 99%

Evolutionary Techniques in Lattice Sieving Algorithms

Laarhoven

2019

Proceedings of the 11th International Joint Conference on Computational Intelligence

Self Cite

View full text Add to dashboard Cite

Lattice-based cryptography has recently emerged as a prominent candidate for secure communication in the quantum age. Its security relies on the hardness of certain lattice problems, and the inability of known lattice algorithms, such as lattice sieving, to solve these problems efficiently. In this paper we investigate the similarities between lattice sieving and evolutionary algorithms, how various improvements to lattice sieving can be viewed as applications of known techniques from evolutionary computation, and how other evolutionary techniques can benefit lattice sieving in practice.

show abstract

Speed-Ups and Time–Memory Trade-Offs for Tuple Lattice Sieving

Cited by 23 publications

References 28 publications

The General Sieve Kernel and New Records in Lattice Reduction

The General Sieve Kernel and New Records in Lattice Reduction

A Review of Sieve Algorithms in Solving the Shortest Lattice Vector Problem

Evolutionary Techniques in Lattice Sieving Algorithms

Contact Info

Product

Resources

About