Parallel Gauss Sieve Algorithm T.Ishiguro, S.Kiyomoto, Y.Miyake, Parallel Gauss Sieve Algorithm : Solving the Ideal T.Takagi Lattice Challenge of 128 dimensions Outline Background Proposed Tsukasa Ishiguro 1 Shinsaku Kiyomoto 1 Algorithm Improvements Yutaka Miyake 1 Tsuyoshi Takagi 2 Experiment KDDI R&D Laboratories Inc. 1 Institute of Mathematics for Industry, Kyushu University 2 2014/3/28 1 / 15
Parallel Gauss Background Sieve Algorithm • Some contests from TU Darmstadt T.Ishiguro, S.Kiyomoto, - SVP Challenge, Ideal Lattice Challenge, Lattice Challenge Y.Miyake, T.Takagi Outline Background Proposed Algorithm Improvements Experiment 2 / 15
Parallel Gauss Background Sieve Algorithm • Some contests from TU Darmstadt T.Ishiguro, S.Kiyomoto, - SVP Challenge, Ideal Lattice Challenge, Lattice Challenge Y.Miyake, T.Takagi Outline Background Proposed Algorithm Improvements Experiment Our contributions · A parallel version of an algorithm for solving SVP · Improvements using ideal structures · Solving the 128 dimensional SVP over ideal lattice 2 / 15
b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b Parallel Gauss n dimensional lattice and SVP Sieve Algorithm T.Ishiguro, S.Kiyomoto, • Lattice basis Y.Miyake, T.Takagi ( b 1 , . . . , b n ) ∈ Z n × n , B = Outline b i ∈ Z n Background Proposed Algorithm • Lattice b 1 Improvements b 2 Experiment � � � L ( B ) = α i b i , α i ∈ Z 1 ≤ i ≤ n Shortest vectors • (Euclidean) norm of v = ( v 1 , .., v n ) � � v 2 || v || = i 1 ≤ i ≤ n Definition (Shortest Vector Problem(SVP)) Given a lattice L ( B ) , find a shortest non-zero vector in L ( B ) . 3 / 15
b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b b Parallel Gauss n dimensional ideal lattice Sieve Algorithm T.Ishiguro, S.Kiyomoto, • Polynomial representation Y.Miyake, T.Takagi v = ( v 1 , . . . , v n ) ∈ L ( B ) Outline v i x i − 1 ∈ Z [ x ] � Background ⇔ v ( x ) = Proposed 1 ≤ i ≤ n Algorithm Improvements • Vector rotation v Experiment rot ( v ) = x v ( x ) mod g ( x ) rot(v) g ( x ) : monic, deg( g ( x )) = n rot 2 (v) • If rot ( v ) ∈ L ( B ) for all v ∈ L ( B ) , then the L ( B ) is called ideal lattice 4 / 15
Parallel Gauss Gauss-reduced Sieve Algorithm T.Ishiguro, Definition (Gauss-reduced) S.Kiyomoto, Y.Miyake, If two different vectors a , b ∈ L ( B ) satisfy T.Takagi || a ± b || ≥ max( || a || , || b || ) , then a , b are called Gauss-reduced. Outline Background Proposed Algorithm a + b Improvements a + b ′ Reduce Experiment b − a a a − b ′ a b b b ′ = a − b a , b are not Gauss-reduced. a , b ′ are Gauss-reduced. We say that b (or b ′ ) was reduced by a . 5 / 15
Parallel Gauss Pairwise-reduced Sieve Algorithm T.Ishiguro, Definition (Pairwise-reduced) S.Kiyomoto, Y.Miyake, Let A be a set of d vectors in L ( B ) . If every pair of two vectors T.Takagi ( a i , a j ) in A for i , j = 1 , . . . , d , i � j is Gauss-reduced, then the A Outline is called pairwise-reduced. Background Proposed Algorithm Improvements Experiment Any pair of vectors are Gauss-reduced Set of vectors 6 / 15
Parallel Gauss Gauss Sieve Algorithm[Micciancio, 2009] Sieve Algorithm L is always pairwise-reduced T.Ishiguro, S.Kiyomoto, Y.Miyake, T.Takagi ℓ 1 Outline Background ℓ 2 ℓ 5 Proposed Algorithm Improvements Experiment ℓ 4 ℓ 3 Stack S Vector v List L (1) chosen at random or popped from stack S 7 / 15
Parallel Gauss Gauss Sieve Algorithm[Micciancio, 2009] Sieve Algorithm L is always pairwise-reduced T.Ishiguro, S.Kiyomoto, Y.Miyake, T.Takagi ℓ 1 Outline Background ℓ 2 ℓ 5 Proposed Algorithm (2) check and reduce v Improvements (3) if v was reduced, move v into stack S Experiment ℓ 4 ℓ 3 Stack S Vector v List L 7 / 15
Parallel Gauss Gauss Sieve Algorithm[Micciancio, 2009] Sieve Algorithm L is always pairwise-reduced T.Ishiguro, (4) check and reduce ℓ i S.Kiyomoto, Y.Miyake, (5) if ℓ i was reduced, move ℓ i into stack S T.Takagi ℓ 1 Outline Background ℓ 2 ℓ 5 Proposed Algorithm Improvements Experiment ℓ 4 ℓ 3 Stack S Vector v List L 7 / 15
Parallel Gauss Gauss Sieve Algorithm[Micciancio, 2009] Sieve Algorithm L is always pairwise-reduced T.Ishiguro, S.Kiyomoto, Y.Miyake, T.Takagi ℓ 1 Outline Background ℓ 2 ℓ 5 Proposed Algorithm Improvements Experiment ℓ 4 (6) append v to L ℓ 3 Stack S Vector v List L 7 / 15
Parallel Gauss Gauss Sieve Algorithm[Micciancio, 2009] Sieve Algorithm L is always pairwise-reduced T.Ishiguro, S.Kiyomoto, Y.Miyake, T.Takagi ℓ 1 Outline Background ℓ 2 ℓ 5 Proposed Algorithm Improvements Experiment ℓ 4 ℓ 3 Stack S Vector v List L Gauss Sieve algorithm constructs a big list L of lattice vectors, which is always pairwise-reduced. Finally, a shortest vector appeared in the list L . 7 / 15
Parallel Gauss Parallelization? Sieve Algorithm T.Ishiguro, • The Gauss Sieve algorithm is not easy to be parallelized S.Kiyomoto, Y.Miyake, • Milde and Schneider proposed a parallel implementation T.Takagi of the Gauss Sieve[Milde and Schneider, ’10] Outline • Them algorithm does not keep the list L pairwise-reduced Background • When they used 10 threads, the list L doubled size of Proposed Algorithm original algorithm Improvements Experiment 8 / 15
Parallel Gauss Parallelization? Sieve Algorithm T.Ishiguro, • The Gauss Sieve algorithm is not easy to be parallelized S.Kiyomoto, Y.Miyake, • Milde and Schneider proposed a parallel implementation T.Takagi of the Gauss Sieve[Milde and Schneider, ’10] Outline • Them algorithm does not keep the list L pairwise-reduced Background • When they used 10 threads, the list L doubled size of Proposed Algorithm original algorithm Improvements Experiment Our goal We propose a fully parallelized Gauss Sieve algorithm. 8 / 15
Parallel Gauss Parallelization? Sieve Algorithm T.Ishiguro, • The Gauss Sieve algorithm is not easy to be parallelized S.Kiyomoto, Y.Miyake, • Milde and Schneider proposed a parallel implementation T.Takagi of the Gauss Sieve[Milde and Schneider, ’10] Outline • Them algorithm does not keep the list L pairwise-reduced Background • When they used 10 threads, the list L doubled size of Proposed Algorithm original algorithm Improvements Experiment Our goal We propose a fully parallelized Gauss Sieve algorithm. Our strategy Our algorithm always keeps the list L pairwise-reduced without reference to the number of threads. 8 / 15
Parallel Gauss Parallel Gauss Sieve Algorithm Sieve Algorithm L is always pairwise-reduced T.Ishiguro, S.Kiyomoto, Y.Miyake, T.Takagi ℓ 1 Outline Background ℓ 5 ℓ 2 Proposed v 4 Algorithm Improvements v 3 Experiment ℓ 4 v 2 ℓ 3 v 1 Stack S List V List L (1) choose at random or popped from stack S 9 / 15
Parallel Gauss Parallel Gauss Sieve Algorithm Sieve Algorithm L is always pairwise-reduced T.Ishiguro, S.Kiyomoto, Y.Miyake, T.Takagi ℓ 1 (2) check and reduce v i Outline (3) if v i was reduced, move v i into stack S Background ℓ 5 ℓ 2 Proposed v 4 Algorithm Improvements v 3 Experiment ℓ 4 v 2 ℓ 3 v 1 Stack S List V List L 9 / 15
Parallel Gauss Parallel Gauss Sieve Algorithm Sieve Algorithm L is always pairwise-reduced T.Ishiguro, S.Kiyomoto, Y.Miyake, T.Takagi ℓ 1 (4) check and reduce v i Outline (5) if v i was reduced, move v i into stack S Background ℓ 5 ℓ 2 Proposed v 4 Algorithm Improvements v 3 Experiment ℓ 4 v 2 ℓ 3 v 1 Stack S List V List L 9 / 15
Parallel Gauss Parallel Gauss Sieve Algorithm Sieve Algorithm L is always pairwise-reduced T.Ishiguro, S.Kiyomoto, Y.Miyake, T.Takagi ℓ 1 (6) check and reduce ℓ i Outline (7) if ℓ i was reduced, move ℓ i into stack S Background ℓ 5 ℓ 2 Proposed v 4 Algorithm Improvements v 3 Experiment ℓ 4 v 2 ℓ 3 v 1 Stack S List V List L 9 / 15
Parallel Gauss Parallel Gauss Sieve Algorithm Sieve Algorithm L is always pairwise-reduced T.Ishiguro, S.Kiyomoto, Y.Miyake, T.Takagi ℓ 1 Outline (8) append v i to L Background ℓ 5 v 4 ℓ 2 Proposed v 4 Algorithm v 3 Improvements v 3 Experiment v 2 ℓ 4 v 2 v 1 ℓ 3 v 1 Stack S List V List L 9 / 15
Parallel Gauss Is a new L pairwise-reduced? Sieve Algorithm T.Ishiguro, S.Kiyomoto, ℓ 1 ℓ 1 Y.Miyake, T.Takagi ℓ 5 ℓ 5 v 4 Outline ℓ 2 ℓ 2 Background v 4 v 3 Proposed Algorithm v 3 v 2 Improvements + ℓ 4 ℓ 4 Experiment v 2 v 1 ℓ 3 ℓ 3 v 1 List L a new L = List V ∪ L List V · L and V are pairwise-reduced, respectivery · All pairs ( ℓ i , v j ) are Gauss-reduced → V ∪ L is pairwise-reduced 10 / 15
Parallel Gauss Solving the 72 dimensional SVP Sieve Algorithm T.Ishiguro, 1200 S.Kiyomoto, Total time Y.Miyake, T.Takagi 1000 Outline 800 Background Time (minutes) Proposed Algorithm 600 Improvements 400 Experiment 200 0 4 8 12 16 20 24 28 32 The number of threads · This instance has 16 cores · The running time dereases until 16 threads · The sizes of the list L are most of the same 11 / 15
Recommend
More recommend
