Shortest Vector from Lattice Sieving: a Few Dimensions for Free eo - PowerPoint PPT Presentation

Shortest Vector from Lattice Sieving: a Few Dimensions for Free eo Ducas 1 L´ Cryptology Group, CWI, Amsterdam, The Netherlands EUROCRYPT 2018 Tel Aviv, April 30th 1 Supported by a Veni Innovational Research Grant from NWO (639.021.645). L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 1 / 23

Two class of Algorithms for SVP The Shortest Vector Problem I : The basis B of an n -dimensional lattice L O: A shortest non-zero vector v ∈ L Algorithm Running time Memory n n / 2 e · 2 O ( n ) Enumeration poly( n ) Sieving 2 [2 . 292 n + o ( n ) , 2 . 415 n + o ( n ) ] [2 . 2075 n + o ( n ) , 2 . 292 n + o ( n ) ] The paradox In theory, Sieving is faster. In pratice it is quite slower. 2 Given complexity are heuristic, heavily supported by experiments. L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 2 / 23

Two class of Algorithms for SVP The Shortest Vector Problem I : The basis B of an n -dimensional lattice L O: A shortest non-zero vector v ∈ L Algorithm Running time Memory n n / 2 e · 2 O ( n ) Enumeration poly( n ) Sieving 2 [2 . 292 n + o ( n ) , 2 . 415 n + o ( n ) ] [2 . 2075 n + o ( n ) , 2 . 292 n + o ( n ) ] The paradox In theory, Sieving is faster. In pratice it is quite slower. 2 Given complexity are heuristic, heavily supported by experiments. L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 2 / 23

Two class of Algorithms for SVP The Shortest Vector Problem I : The basis B of an n -dimensional lattice L O: A shortest non-zero vector v ∈ L Algorithm Running time Memory n n / 2 e · 2 O ( n ) Enumeration poly( n ) Sieving 2 [2 . 292 n + o ( n ) , 2 . 415 n + o ( n ) ] [2 . 2075 n + o ( n ) , 2 . 292 n + o ( n ) ] The paradox In theory, Sieving is faster. In pratice it is quite slower. 2 Given complexity are heuristic, heavily supported by experiments. L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 2 / 23

Many trade-offs 2 0.45 n 8 0 0 ' 1 V ' N V M 1 1 ' 2 0.40 n B 3 4 T 1 1 L ' ' H W J P G Z B Time complexity Laa '15 ◮ Our main contribution can also 2 0.35 n LdW '15 / BL '15 be applied to other sieving BDGL16 algorithms. e c BGJ '15 a p 2 0.30 n ◮ Implementation limited to the S = e version of m i T [Micciancio Voulgaris 2010] . 2 0.25 n 2 0.20 n 2 0.25 n 2 0.30 n 2 0.35 n Space complexity L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 3 / 23

Many trade-offs 2 0.45 n 8 0 In this 0 ' 1 V ' N V work M 1 1 ' 2 0.40 n B 3 4 T 1 1 L ' ' H W J P G Z B Time complexity Laa '15 ◮ Our main contribution can also 2 0.35 n LdW '15 / BL '15 be applied to other sieving BDGL16 algorithms. e c BGJ '15 a p 2 0.30 n ◮ Implementation limited to the S = e version of m i T [Micciancio Voulgaris 2010] . 2 0.25 n 2 0.20 n 2 0.25 n 2 0.30 n 2 0.35 n Space complexity L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 3 / 23

Results Heuristic claim, asymptotic One can solve SVP in dimension n with a call to Sieve in dimension n − d where d = Θ( n / log n ) . Heuristic claim, concrete One can solve SVP in dimension n making a call to Sieve in dimension i for each i = 1 . . . n − d for d ≈ n · ln(4 / 3) ( d ≈ 15 for n = 80) ln( n / 2 π e ) Experimental claim: A bogey A Sieve implem. almost on par with enumeration (within a factor 4 in dims 70–80), with still much room for improvements. L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 4 / 23

Results Heuristic claim, asymptotic One can solve SVP in dimension n with a call to Sieve in dimension n − d where d = Θ( n / log n ) . Heuristic claim, concrete One can solve SVP in dimension n making a call to Sieve in dimension i for each i = 1 . . . n − d for d ≈ n · ln(4 / 3) ( d ≈ 15 for n = 80) ln( n / 2 π e ) Experimental claim: A bogey A Sieve implem. almost on par with enumeration (within a factor 4 in dims 70–80), with still much room for improvements. L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 4 / 23

Results Heuristic claim, asymptotic One can solve SVP in dimension n with a call to Sieve in dimension n − d where d = Θ( n / log n ) . Heuristic claim, concrete One can solve SVP in dimension n making a call to Sieve in dimension i for each i = 1 . . . n − d for d ≈ n · ln(4 / 3) ( d ≈ 15 for n = 80) ln( n / 2 π e ) Experimental claim: A bogey A Sieve implem. almost on par with enumeration (within a factor 4 in dims 70–80), with still much room for improvements. L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 4 / 23

Table of Contents 1 Dimensions for free 2 Implementation and performances L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 5 / 23

Table of Contents 1 Dimensions for free 2 Implementation and performances L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 6 / 23

Sieving Algorithm 1 Sieve ( L ) L ← a set of N random vectors from L where N ≈ (4 / 3) n / 2 . while ∃ ( v , w ) ∈ L 2 such that � v − w � < � v � do v ← v − w end while return L The above runs in heuristic time (4 / 3) n + o ( n ) . Many concrete and asymptotic improvements: [Nguyen Vidick 2008, Micciancio Voulgaris 2010, Laarhoven 2015, Becker Gamma Joux 2015, Becker D. Gamma Laarhoven 2015, . . . ] . L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 7 / 23

Sieving Algorithm 2 Sieve ( L ) L ← a set of N random vectors from L where N ≈ (4 / 3) n / 2 . while ∃ ( v , w ) ∈ L 2 such that � v − w � < � v � do v ← v − w end while return L The above runs in heuristic time (4 / 3) n + o ( n ) . Many concrete and asymptotic improvements: [Nguyen Vidick 2008, Micciancio Voulgaris 2010, Laarhoven 2015, Becker Gamma Joux 2015, Becker D. Gamma Laarhoven 2015, . . . ] . L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 7 / 23

More than SVP Note that Sieve returns N ≈ (4 / 3) n short vectors, not just a shortest vector. Definition (Gaussian Heuristic: Expected length of the shortest vector) � n / 2 π e · vol( L ) 1 / n . gh( L ) = Observation (heuristic & experimental) � The output of Sieve contains almost all vectors of length ≤ 4 / 3 · gh ( L ): � � � L := Sieve ( L ) = x ∈ L s.t. � x � ≤ 4 / 3 · gh( L ) . L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 8 / 23

Sieve then Lift Main idea: Sieve in a projected sub-lattice, and lift all candidate solutions. SubSieve ( L , d ) ◮ Set L ′ = L ( b 1 , . . . , b d ) “left part of L ”, dim= d ◮ Set L ′′ = π ⊥ L ′ ( L ) “right part of L ”, dim= n − d ◮ Compute L = Sieve ( L ′′ ) ◮ Hope that π ⊥ L ′ ( s ) ∈ L (1) ◮ Lift all v ∈ L from L ′′ to L and take the shortest (Babai alg.) Pessimistic prediction for (1) Optimistic prediction for (1) � n − d � � · gh( L ) ≤ 4 / 3 · gh( L d ) . gh( L ) ≤ 4 / 3 · gh( L d ) . n Similar to linear pruning for enum. L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 9 / 23

Sieve then Lift Main idea: Sieve in a projected sub-lattice, and lift all candidate solutions. SubSieve ( L , d ) ◮ Set L ′ = L ( b 1 , . . . , b d ) “left part of L ”, dim= d ◮ Set L ′′ = π ⊥ L ′ ( L ) “right part of L ”, dim= n − d ◮ Compute L = Sieve ( L ′′ ) ◮ Hope that π ⊥ L ′ ( s ) ∈ L (1) ◮ Lift all v ∈ L from L ′′ to L and take the shortest (Babai alg.) Pessimistic prediction for (1) Optimistic prediction for (1) � n − d � � · gh( L ) ≤ 4 / 3 · gh( L d ) . gh( L ) ≤ 4 / 3 · gh( L d ) . n Similar to linear pruning for enum. L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 9 / 23

Sieve then Lift Main idea: Sieve in a projected sub-lattice, and lift all candidate solutions. SubSieve ( L , d ) ◮ Set L ′ = L ( b 1 , . . . , b d ) “left part of L ”, dim= d ◮ Set L ′′ = π ⊥ L ′ ( L ) “right part of L ”, dim= n − d ◮ Compute L = Sieve ( L ′′ ) ◮ Hope that π ⊥ L ′ ( s ) ∈ L (1) ◮ Lift all v ∈ L from L ′′ to L and take the shortest (Babai alg.) Pessimistic prediction for (1) Optimistic prediction for (1) � n − d � � · gh( L ) ≤ 4 / 3 · gh( L d ) . gh( L ) ≤ 4 / 3 · gh( L d ) . n Similar to linear pruning for enum. L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 9 / 23

Sieve then Lift Main idea: Sieve in a projected sub-lattice, and lift all candidate solutions. SubSieve ( L , d ) ◮ Set L ′ = L ( b 1 , . . . , b d ) “left part of L ”, dim= d ◮ Set L ′′ = π ⊥ L ′ ( L ) “right part of L ”, dim= n − d ◮ Compute L = Sieve ( L ′′ ) ◮ Hope that π ⊥ L ′ ( s ) ∈ L (1) ◮ Lift all v ∈ L from L ′′ to L and take the shortest (Babai alg.) Pessimistic prediction for (1) Optimistic prediction for (1) � n − d � � · gh( L ) ≤ 4 / 3 · gh( L d ) . gh( L ) ≤ 4 / 3 · gh( L d ) . n Similar to linear pruning for enum. L´ eo Ducas (CWI, Amsterdam) SVP from Sieving: a Few Dims for Free 30 April 2018 9 / 23