Algorithms for hard lattice problems Thijs Laarhoven ts - PowerPoint PPT Presentation

v 9 v 9 Sieving v 12 v 12 2. Split L into centers C and reducible vectors R v 5 v 5 v 13 v 13 v 13 v 16 v 7 v 7 v 15 v 1 v 1 v 3 v 3 v 8 v 8 v 2 v 2 O v 6 v 6 v 11 v 11 v 10 v 10 v 14 v 4 v 4

v 9 v 9 Sieving v 12 v 12 2. Split L into centers C and reducible vectors R v 5 v 5 v 13 v 13 v 16 v 7 v 7 v 15 v 1 v 1 v 3 v 3 v 8 v 8 v 2 v 2 O v 6 v 6 v 11 v 11 v 10 v 10 v 14 v 14 v 14 v 4 v 4

v 9 v 9 Sieving v 12 v 12 2. Split L into centers C and reducible vectors R v 5 v 5 v 13 v 13 v 16 v 7 v 7 v 15 v 15 v 15 v 1 v 1 v 3 v 3 v 8 v 8 v 2 v 2 O v 6 v 6 v 11 v 11 v 10 v 10 v 14 v 14 v 4 v 4

v 9 v 9 Sieving v 12 v 12 2. Split L into centers C and reducible vectors R v 5 v 5 v 13 v 13 v 16 v 16 v 16 v 7 v 7 v 15 v 15 v 1 v 1 v 3 v 3 v 8 v 8 v 2 v 2 O v 6 v 6 v 11 v 11 v 10 v 10 v 14 v 14 v 4 v 4

v 9 v 9 Sieving v 12 v 12 2. Split L into centers C and reducible vectors R v 5 v 5 v 13 v 13 v 16 v 16 v 7 v 7 v 15 v 15 v 1 v 1 v 3 v 3 v 8 v 8 v 2 v 2 O v 6 v 6 v 11 v 11 v 10 v 10 v 14 v 14 v 4 v 4

v 9 v 9 Sieving v 12 v 12 3. Repeat with reduced vectors until we find a shortest vector v 5 v 5 v 13 v 13 v 16 v 16 v 7 v 7 v 15 v 15 v 1 v 1 v 3 v 3 v 8 v 8 v 2 v 2 O v 6 v 6 v 11 v 11 v 10 v 10 v 14 v 14 v 4 v 4

v 9 Sieving v 12 3. Repeat with reduced vectors until we find a shortest vector v 5 v 13 v 16 v 7 v 15 v 1 v 5 v 1 v 3 v 4 v 2 v 7 O v 3 v 2 v 6 v 6 v 11 v 10 v 14 v 4

v 9 Sieving v 12 Overview v 5 v 13 v 16 v 7 v 15 v 1 v 5 v 1 v 3 v 4 v 2 v 7 O v 3 v 2 v 6 v 6 v 11 v 10 v 14 v 4

v 9 Sieving v 12 Overview v 5 v 13 v 16 v 7 v 15 Heuristic (Nguyen–Vidick, J. Math. Crypt. ’08) Sieving solves SVP in time ( 4 / 3 ) n + o ( n ) and space ( 4 / 3 ) n / 2 + o ( n ) . v 1 v 5 v 1 v 3 v 4 v 2 v 7 O v 3 v 2 v 6 v 6 v 11 v 10 v 14 v 4

v 9 Sieving v 12 Overview v 5 v 13 v 16 v 7 v 15 Heuristic (Nguyen–Vidick, J. Math. Crypt. ’08) Sieving solves SVP in time ( 4 / 3 ) n + o ( n ) and space ( 4 / 3 ) n / 2 + o ( n ) . v 1 v 5 v 1 v 3 v 4 v 2 v 7 O The list size comes from heuristic packing / saturation arguments, v 3 the time complexity is quadratic in the list size. v 2 v 6 v 6 v 11 v 10 v 14 v 4

Sieving Near neighbor techniques O

v 9 Sieving v 12 Near neighbor techniques v 5 v 13 v 16 v 7 v 15 v 1 v 3 v 8 v 2 O v 6 v 11 v 10 v 14 v 4

v 9 Sieving v 12 Near neighbor techniques v 5 v 13 v 16 v 7 v 15 v 1 v 3 v 8 v 2 O O v 6 v 11 v 10 v 14 v 4

v 9 Sieving v 12 Near neighbor techniques v 5 v 13 v 16 v 7 v 15 v 1 v 1 v 1 v 3 v 8 v 2 O v 6 v 11 v 10 v 14 v 4

v 9 Sieving v 12 Near neighbor techniques v 5 v 13 v 16 v 7 v 15 v 1 v 1 v 3 v 8 v 2 v 2 v 2 O v 6 v 11 v 10 v 14 v 4

v 9 Sieving v 12 Near neighbor techniques v 5 v 13 v 16 v 7 v 15 v 1 v 1 v 3 v 3 v 3 v 8 v 2 v 2 O v 6 v 11 v 10 v 14 v 4

v 9 Sieving v 12 Near neighbor techniques v 5 v 13 v 16 v 7 v 15 v 1 v 1 v 3 v 3 v 8 v 2 v 2 O v 6 v 11 v 10 v 14 v 4 v 4 v 4

v 9 Sieving v 12 Near neighbor techniques v 5 v 5 v 5 v 13 v 16 v 7 v 15 v 1 v 1 v 3 v 3 v 8 v 2 v 2 O v 6 v 11 v 10 v 14 v 4 v 4

v 9 Sieving v 12 Near neighbor techniques v 5 v 5 v 13 v 16 v 7 v 15 v 1 v 1 v 3 v 3 v 8 v 2 v 2 O v 6 v 6 v 6 v 11 v 10 v 14 v 4 v 4

v 9 Sieving v 12 Near neighbor techniques v 5 v 5 v 13 v 16 v 7 v 7 v 7 v 15 v 1 v 1 v 3 v 3 v 8 v 2 v 2 O v 6 v 6 v 11 v 10 v 14 v 4 v 4

v 9 Sieving v 12 Near neighbor techniques v 5 v 5 v 13 v 16 v 7 v 7 v 15 v 1 v 1 v 3 v 3 v 8 v 8 v 8 v 2 v 2 O v 6 v 6 v 11 v 10 v 14 v 4 v 4

v 9 v 9 v 9 Sieving v 12 Near neighbor techniques v 5 v 5 v 13 v 16 v 7 v 7 v 15 v 1 v 1 v 3 v 3 v 8 v 8 v 2 v 2 O v 6 v 6 v 11 v 10 v 14 v 4 v 4

v 9 v 9 Sieving v 12 Near neighbor techniques v 5 v 5 v 13 v 16 v 7 v 7 v 15 v 1 v 1 v 3 v 3 v 8 v 8 v 2 v 2 O v 6 v 6 v 11 v 10 v 10 v 10 v 14 v 4 v 4

v 9 v 9 Sieving v 12 Near neighbor techniques v 5 v 5 v 13 v 16 v 7 v 7 v 15 v 1 v 1 v 3 v 3 v 8 v 8 v 2 v 2 O v 6 v 6 v 11 v 11 v 11 v 10 v 10 v 14 v 4 v 4

Algorithms for hard lattice problems Thijs Laarhoven ts - PowerPoint PPT Presentation

Algorithms for hard lattice problems Thijs Laarhoven ts ttts Tenerife PQCrypto Conference (January 31, 2018) Lattices What is a lattice? O Lattices What

Greedy Algorithms Solve problems with the simplest possible algorithm CSE 421 The hard

Hard Problems Some problems are hard to solve. No polynomial time algorithm is known.

Approximation algorithms Some optimisation problems are hard, little chance of finding

NP complete problems Some figures, text, and pseudocode from: - Introduction to Algorithms, by

HydroCare HC-44 HydroCare HC-44 Hard Water Problems Hard Water Problems Hard Water Costs You

Algorithms for Lattice Transforms and 2348 2349 Lattice Transforms for 234 248 239

Fundamentals of Lattice-Based Cryptography Chris Peikert University of Michigan 2nd Crypto

Cryptography Hard Problems encryption message encryption key algorithm Some problems are

Cryptography Hard Problems encryption message encryption key algorithm Some problems are

Automating the Configuration of Algorithms for Solving Hard Computational Problems Ph.D. Thesis

Parametrized Genetic Algorithms for NP-hard problems on Data Envelopment Analysis Juan Aparicio 1

Chapter 7 Approximation Algorithms CS 573: Algorithms, Fall 2013 September 17, 2013 7.0.0.1

Exploring the parameter space in lattice attacks Daniel J. Bernstein Tanja Lange Based on

The Shortest Vector Problem (Lattice Reduction Algorithms) Approximation Algorithms by V.

Limits on the Hardness of Lattice Problems in p Norms Chris Peikert SRI International

Phase Fluctuations and Sign Problems Michael Wagman MIT Lattice 2018 East Lansing, Michigan

Using Python to Solve Computationally Hard Problems Using Python to Solve Computationally Hard

Sampling Algorithms for Lattice Gaussian Codes based on joint work with J.-C. Belfiore

More NP-Complete Problems NP-Hard Problems Tautology Problem Node Cover Knapsack 1 Next Steps

Introduction I So far, we have focused on problems with efficient algorithms I I.e.,

a ; 90 o c -face centered lattice, having the

Analyzing Blockwise Lattice Algorithms using Dynamical Systems Guillaume Hanrot, Xavier Pujol,

6-vertex model, Lipschitz functions, proper colorings and other lattice models with hard

Exponential-Time Approximation of Hard Problems Lukasz Kowalik joint work with: Marek Cygan,