Sieve, Enumerate, Slice, and Lift: Hybrid Lattice Algorithms for SVP - PowerPoint PPT Presentation

Sieve, Enumerate, Slice, and Lift: Hybrid Lattice Algorithms for SVP via CVPP Emmanouil Doulgerakis, Thijs Laarhoven, and Benne de Weger Technische Universiteit Eindhoven July 2020 AfricaCrypt 2020, Cairo, Egypt

Outline Introduction 1 Enumeration 2 The slicer algorithms 3 Hybrid algorithms 4 AfricaCrypt 2020 1

Outline Introduction 1 Enumeration 2 The slicer algorithms 3 Hybrid algorithms 4 AfricaCrypt 2020 1

What is a lattice? Definition A lattice L is a discrete additive subgroup of R n . AfricaCrypt 2020 2

What is a lattice? Definition A lattice L is a discrete additive subgroup of R n . AfricaCrypt 2020 2

What is a lattice? A lattice is an infinite grid of points in the n -dimensional space. AfricaCrypt 2020 3

What is a lattice? A lattice: The set of all integer linear combinations of some basis B where B = { b 1 , . . . , b n } ⊂ R n . b 2 b 1 O AfricaCrypt 2020 3

What is a lattice? A lattice: The set of all integer linear combinations of some basis B where B = { b 1 , . . . , b n } ⊂ R n . A lattice has many bases. b 2 b 4 b 3 b 1 O AfricaCrypt 2020 3

The Shortest Vector Problem (SVP) Shortest Vector Problem (SVP) Given an arbitrary basis for L , find a shortest non-zero vector s in L i.e. � s � = min v ∈L\{ 0 } � v � . We denote λ 1 ( L ) = min v ∈L\{ 0 } � v � . b 2 b 1 s O AfricaCrypt 2020 4

The Closest Vector Problem (CVP) Closest Vector Problem (CVP) Given an arbitrary basis for L and a target vector t , find the closest lattice vector v in L such that � t − v � = d ( t , L ). b 2 b 1 t AfricaCrypt 2020 5

The Closest Vector Problem (CVP) Closest Vector Problem (CVP) Given an arbitrary basis for L and a target vector t , find the closest lattice vector v in L such that � t − v � = d ( t , L ). b 2 b 1 t v AfricaCrypt 2020 5

The Approximate Closest Vector Problem (CVP κ ) Approximate Closest Vector Problem (CVP κ ) Given an arbitrary basis for L , a target vector t and an approximation factor κ ≥ 1, find a lattice vector v in L such that � t − v � ≤ κ d ( t , L ). b 2 b 1 t AfricaCrypt 2020 6

The Closest Vector Problem with Pre-processing (CVPP) The CVPP variant Given an arbitrary basis for L , compute some pre-processing data such that when later given a target vector t , it will be ”easy” to solve the CVP for t . b 2 t v b 1 AfricaCrypt 2020 7

Outline Introduction 1 Enumeration 2 The slicer algorithms 3 Hybrid algorithms 4 AfricaCrypt 2020 8

Solving SVP Let L be a lattice with basis B = { b 1 , . . . , b n } ⊂ R n . Question: Find s in L with � s � = λ 1 ( L ). AfricaCrypt 2020 9

Solving SVP Let L be a lattice with basis B = { b 1 , . . . , b n } ⊂ R n . Question: Find s in L with � s � = λ 1 ( L ). As s ∈ L then ∃ x 1 , . . . , x n ∈ Z such that s = x 1 b 1 + · · · + x n b n . AfricaCrypt 2020 9

Solving SVP Let L be a lattice with basis B = { b 1 , . . . , b n } ⊂ R n . Question: Find s in L with � s � = λ 1 ( L ). As s ∈ L then ∃ x 1 , . . . , x n ∈ Z such that s = x 1 b 1 + · · · + x n b n . We know that λ 1 ( L ) ≤ � b 1 � . Enumeration explores all the choices of the x i such that � x 1 b 1 + · · · + x n b n � ≤ � b 1 � . AfricaCrypt 2020 9

Enumeration tree (example) root 0 b n − 1 0 1 ( − 1 , − 1)(0 , − 1) ( − 1 , 0) (0 , 0) (1 , 0) (0 , 1) (1 , 1) b n − 1 . ( − 1 , 1 , 0)(0 , 1 , 0) (1 , 1 , 0) . . . . . b 1 AfricaCrypt 2020 10

Enumeration costs in small depth Lemma (Costs of enumeration HS07) Let B be a strongly reduced basis of a lattice. Then the number of nodes E k at depth k = o ( n ) , k = n 1 − o (1) , satisfies: E k = n k / 2+ o ( k ) . Enumerating all these nodes can be done in time T enum and space S enum , with: T enum = E k · n O (1) , S enum = n O (1) . AfricaCrypt 2020 11

Outline Introduction 1 Enumeration 2 The slicer algorithms 3 Hybrid algorithms 4 AfricaCrypt 2020 12

Solving CVP(P) We have t ∈ t + L and t ′ = t − s so t ′ ∈ t + L as well... It suffices to find t ′ . b 2 t ′ b 1 t O s AfricaCrypt 2020 13

The iterative slicer (ideal case) Create a list L ⊆ L . Keep reducing t by the vectors r in the list L until the result cannot be reduced any more. Then we have found t ′ . r 2 r 1 r 3 t ′ t r 6 r 4 O s r 5 AfricaCrypt 2020 14

The iterative slicer (ideal case) Create a list L ⊆ L . Keep reducing t by the vectors r in the list L until the result cannot be reduced any more. Then we have found t ′ . r 2 r 1 r 3 t O − 4 r 1 AfricaCrypt 2020 15

The iterative slicer (ideal case) Create a list L ⊆ L . Keep reducing t by the vectors r in the list L until the result cannot be reduced any more. Then we have found t ′ . r 2 r 1 r 3 t O +3 r 2 AfricaCrypt 2020 15

The iterative slicer (ideal case) Create a list L ⊆ L . Keep reducing t by the vectors r in the list L until the result cannot be reduced any more. Then we have found t ′ . r 2 r 1 r 3 − 2 r 1 t O AfricaCrypt 2020 15

The iterative slicer (ideal case) Create a list L ⊆ L . Keep reducing t by the vectors r in the list L until the result cannot be reduced any more. Then we have found t ′ . r 2 r 1 r 3 + r 3 t ′ t O AfricaCrypt 2020 15

The iterative slicer (in practice) Computing t ′ correctly depends on the list L . Computing “the proper” list L is too costly. We can use approximations instead. r 1 r 2 r 3 r 4 t AfricaCrypt 2020 16

The iterative slicer (in practice) Computing t ′ correctly depends on the list L . Computing “the proper” list L is too costly. We can use approximations instead. Disadvantage: We might get a wrong t ′ . r 1 r 2 r 3 r 4 t AfricaCrypt 2020 16

The randomized slicer Create a list L of lattice vectors (e.g. by running a sieving algorithm). r 1 r 2 r 3 r 4 t AfricaCrypt 2020 17

The randomized slicer Create a list L of lattice vectors (e.g. by running a sieving algorithm). Randomize t sufficiently many times (as t i ) and reduce it. t 3 t 2 r 1 r 2 t 4 r 3 r 4 t 1 t 5 AfricaCrypt 2020 17

The randomized slicer Create a list L of lattice vectors (e.g. by running a sieving algorithm). Randomize t sufficiently many times (as t i ) and reduce it. Keep the shortest t ′ i found as t ′ . t 3 t 2 t 4 t 1 t 5 AfricaCrypt 2020 17

The randomized slicer algorithm AfricaCrypt 2020 18

Costs of preprocessing Lemma (Costs of lattice sieving BDGL16) Given a basis B of a lattice L , the LDSieve heuristically returns a list L ⊂ L containing the (4 / 3) n / 2+ o ( n ) shortest lattice vectors, in time T sieve and space S sieve with: T sieve = (3 / 2) n / 2+ o ( n ) , S sieve = (4 / 3) n / 2+ o ( n ) . With the LDSieve we can therefore solve SVP with the above complexities. AfricaCrypt 2020 19

Costs of the randomized slicer Lemma (single target DLW20) Given a list of the (4 / 3) n / 2+ o ( n ) shortest vectors of a lattice L and a target t ∈ R n , the randomized slicer solves CVP for t in time T slice and space S slice , with: T slice = 2 ζ n + o ( n ) , S slice = (4 / 3) n / 2+ o ( n ) . In our case ζ = 0 . 2639 . . . AfricaCrypt 2020 20

Costs of the randomized slicer Lemma (many targets DLW20) Given a list of the (4 / 3) n / 2+ o ( n ) shortest vectors of a lattice L and a batch of N ≥ (13 / 12) n / 2+ o ( n ) target vectors t 1 , . . . , t N ∈ R n , the batched randomized slicer solves CVP for all targets t i in total time T slice and space S slice , with: T slice = N · (18 / 13) n / 2+ o ( n ) , S slice = (4 / 3) n / 2+ o ( n ) . AfricaCrypt 2020 21

Outline Introduction 1 Enumeration 2 The slicer algorithms 3 Hybrid algorithms 4 AfricaCrypt 2020 22

Solving SVP via CVPP (Part 1) Let L be a lattice with basis B = { b 1 , . . . , b n } ⊂ R n . Question: Find s in L with � s � = λ 1 ( L ). AfricaCrypt 2020 23

Solving SVP via CVPP (Part 1) Let L be a lattice with basis B = { b 1 , . . . , b n } ⊂ R n . Question: Find s in L with � s � = λ 1 ( L ). Choose 0 ≤ k ≤ n and split B as B = B bot ∪ B top where B bot := { b 1 , . . . , b n − k } and B top := { b n − k +1 , . . . , b n } . AfricaCrypt 2020 23

Solving SVP via CVPP (Part 1) Let L be a lattice with basis B = { b 1 , . . . , b n } ⊂ R n . Question: Find s in L with � s � = λ 1 ( L ). Choose 0 ≤ k ≤ n and split B as B = B bot ∪ B top where B bot := { b 1 , . . . , b n − k } and B top := { b n − k +1 , . . . , b n } . This partitions the lattice as L = L bot ⊕ L top where L bot := L ( B bot ) and L top := L ( B top ). AfricaCrypt 2020 23

Solving SVP via CVPP (Part 1) Let L be a lattice with basis B = { b 1 , . . . , b n } ⊂ R n . Question: Find s in L with � s � = λ 1 ( L ). Choose 0 ≤ k ≤ n and split B as B = B bot ∪ B top where B bot := { b 1 , . . . , b n − k } and B top := { b n − k +1 , . . . , b n } . This partitions the lattice as L = L bot ⊕ L top where L bot := L ( B bot ) and L top := L ( B top ). As s ∈ L then ∃ x 1 , . . . , x n ∈ Z such that s = x 1 b 1 + · · · + x n b n . AfricaCrypt 2020 23