Improved Reduction from BDD to uSVP Shi Bai; Damien Stehl; Weiqiang - PowerPoint PPT Presentation

Rump Session 2016 Improved Reduction from BDD to uSVP Shi Bai; Damien Stehlé; Weiqiang Wen ENS de Lyon

Improved reduction from BDD to U SVP –Shi Bai, Damien Stehl´ e and Weiqiang Wen Bounded Distance Decoding (BDD α ) Let α > 0. Given as inputs a lattice basis B and a vector t such that dist ( t , L ( B )) ≤ α · λ 1 ( B ) , the goal is to find a lattice vector v ∈ L ( B ) closest to t . Unique Shortest Vector Problem ( U SVP γ ) Let γ ≥ 1. Given as input a lattice basis B such that λ 2 ( B ) ≥ γ · λ 1 ( B ) , the goal is to find a non-zero vector v ∈ L ( B ) of norm λ 1 ( L ( B )) . 1 / 6

Improved reduction from BDD to U SVP BDD 1 /α U SVP γ U SVP γ ≤ BDD 1 /γ [LM09] ◮ α = 2 γ , Lyubashevsky and Micciancio, 2009. ◮ Slightly smaller α , Liu et al , 2014. ◮ (Even) slightly smaller α (more), Galbraith; Micciancio, 2015. √ ◮ Our result: α = 2 γ . 2 / 6

Improved reduction from BDD to U SVP 1 /α Lyubashevsky and Micciancio, CRYPTO, 2009 0.7 Liu et al , Inf. Process. Lett., 2014 Folklore (Galbraith; Micciancio) Bai, Stehl´ e, Wen, ICALP, 2016 0.6 0.5 0.4 0.3 0.2 0.1 γ 1 1.2 1.4 1.6 1.8 2 2.2 2.4 3 / 6

Improved reduction from BDD to U SVP ◮ Kannan’s embedding. [LM09] BDD 1 U SVP γ 2 γ 4 / 6

Imporved reduction from BDD to U SVP ◮ Kannan’s embedding + Khot’s *lattice* sparsification . New reduction BDD U SVP γ 1 √ 2 γ 5 / 6

Conjecture ◮ First conjecture: BDD and U SVP are computationally identical. BDD c · γ = U SVP γ 1 Note: for some constant c . √ ◮ Second conjecture: c = 2 . In order to prove it, we need to improve the reduction from U SVP to BDD. 6 / 6