Faster Enumeration-based Lattice Reduction: Root Hermite Factor k 1 / - PowerPoint PPT Presentation

Faster Enumeration-based Lattice Reduction: Root Hermite Factor k 1 / ( 2 k ) in Time k k / 8 + o ( k ) Martin R. Albrecht 1 , Shi Bai 2 , Pierre-Alain Fouque 3 , Paul Kirchner 3 , Damien Stehlé 4 and Weiqiang Wen 3 1 Royal Holloway, University of London 2 Florida Atlantic University 3 Rennes Univ 4 ENS de Lyon CRYPTO 2020 Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 1 / 19

What is this work about? Enumeration-based lattice reduction algorithms Prior works This work k 2 e + o ( k ) k k 8 + o ( k ) k 1 k 2 k ◮ In case of input lattices of ◮ large dimension: proved under a heuristic assumption; ◮ small dimension: simulation still works for a variant algorithm. Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 2 / 19

Lattices c 2 c 2 n / 1 ) L b 2 b 1 ( l o V c 1 · γ 0 A definition of lattice Given B = { b 1 , · · · , b n } ⊆ Q m a set of linearly independent vectors, the lattice L spanned by the b i ’s is     � u i b i : u ∈ Z n L ( B ) =  .  i ∈ [ n ] Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 3 / 19

Lattices c 2 c 2 n / 1 ) L b 2 b 1 ( l o V c 1 · γ 0 A definition of lattice Given B = { b 1 , · · · , b n } ⊆ Q m a set of linearly independent vectors, the lattice L spanned by the b i ’s is     � u i b i : u ∈ Z n L ( B ) =  .  i ∈ [ n ] Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 3 / 19

Invariants in lattices c 2 c 2 n / 1 ) L b 2 b 1 ( l o Vol( L ( B )) V c 1 · γ λ 1 0 First minimum λ 1 ( L ) = min {� b � : b ∈ L\{ 0 }} . Volume of lattice � det ( B T B ) for any basis B . Vol ( L ( B )) = Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 3 / 19

Lattice problems c 2 c 2 n / 1 ) L b 2 b 1 ( l o V c 1 · γ 0 λ 1 Shortest vector problem ( SVP ) Given B ⊆ Q m a basis of the lattice L , it asks to find a vector s in the lattice such that � s � = λ 1 ( L ) . Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 3 / 19

Lattice problems c 2 c 2 n / 1 ) L b 2 b 1 ( l o V c 1 · γ 0 λ 1 SVP γ -Hermite SVP ( γ - HSVP ) Given B ⊆ Q m a basis of the lattice L , Given B ⊆ Q m a basis of the lattice L , finds a vector s in the lattice such that finds a non-zero vector s in the lattice such that � s � = λ 1 ( L ) . 1 n . � s �≤ γ · Vol ( L ) Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 3 / 19

Lattice problems c 2 c 2 n / 1 ) L n b 2 b 1 / ( 1 l ) o L V ( l c 1 o · V γ · n √ 0 λ 1 Minkowski’s theorem: SVP ⇒ √ n - HSVP . ( λ 1 ≤ √ n · Vol ( L ) 1 / n ) SVP γ -Hermite SVP ( γ - HSVP ) Given B a basis of L , finds a non-zero Given B a basis of L , finds a non-zero vector s in L such that vector s in L such that 1 n . � s � = λ 1 ( L ) . � s �≤ γ · Vol ( L ) Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 3 / 19

Best known solution: reduce the basis Bad basis Good basis c 2 c 2 c 2 c 2 b 2 b 1 b 2 b 1 c 1 c 1 0 0 [less orthogonal] [more orthogonal] Hermite factor Given B = { b 1 , · · · , b n } ⊆ Q m a basis of the lattice L , its Hermite factor is � b 1 � HF ( B ) = n . 1 Vol ( L ) Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 4 / 19

Best known solution: reduce the basis Bad basis Good basis c 2 c 2 c 2 c 2 b 2 b 1 b 2 b 1 c 1 c 1 0 0 [less orthogonal] [more orthogonal] The BKZ lattice reduction is the most practical algorithm to achieve such task! Hermite factor Given B = { b 1 , · · · , b n } ⊆ Q m a basis of the lattice L , its Hermite factor is � b 1 � HF ( B ) = n . 1 Vol ( L ) Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 4 / 19

Introduce root Hermite factor to quantify lattice reduction Bad basis Good basis c 2 c 2 c 2 c 2 b 2 b 1 b 2 b 1 c 1 c 1 0 0 [less orthogonal] [more orthogonal] The BKZ lattice reduction is the most practical algorithm to achieve such task! Hermite factor Root Hermite factor Given B = { b 1 , · · · , b n } ⊆ Q m a basis Given B ⊆ Q m a basis of the lattice L , of the lattice L , its Hermite factor is its root Hermite factor is � b 1 � 1 n − 1 . RHF ( B ) = HF ( B ) HF ( B ) = n . 1 Vol ( L ) Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 4 / 19

Gram-Schmidt orthogonalization Bad basis Good basis c 2 c 2 c 2 c 2 b ∗ 2 b 1 ( b ∗ 1 ) b 2 b 1 c ∗ b 2 2 c 1 c 1 ( c ∗ 1 ) 0 0 [less orthogonal] [more orthogonal] The BKZ lattice reduction is the most practical algorithm to achieve such task! Gram-Schmidt orthogonalization A matrix B ∗ = ( b ∗ 1 , ..., b ∗ n ) is the Gram-Schmidt orthogonalization of B , if � b i , b ∗ j � i = b i − � i − 1 b ∗ j = 1 µ i , j b ∗ j , where µ i , j = j � 2 . � b ∗ Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 4 / 19

Orthogonal projection z b (2) 3 (0 , 0 , 3) b 3 (1 , 1 , 3) y b 1 (1 , 3 , 0) b 2 (3 , 1 , 0) x Notation of projection Given a basis B = ( b 1 , · · · , b n ) ∈ Q m , we let b ( j ) denote the orthogonal i projection over ( b 1 , · · · , b j ) ⊥ of b i . Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 5 / 19

The BKZ algorithm [SE94] SVP solver b k b k +1 b 1 b 2 b n ··· ·· · � � �� 2 � = � b (1) b (1) 2 , b (1) 3 , · · · , b (1) � b ∗ � b ∗ 1 � = � b 1 � = λ 1 ( L ( b 1 , b 2 , · · · , b k )) 2 � = λ 1 L k +1 Notation of projection Given a basis B = ( b 1 , · · · , b n ) ∈ Q m , we let b ( j ) denote the orthogonal i projection over ( b 1 , · · · , b j ) ⊥ of b i . Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 5 / 19

The BKZ algorithm [SE94] SVP solver b k b k +1 b 1 b 2 b n ··· ·· · � � �� 2 � = � b (1) b (1) 2 , b (1) 3 , · · · , b (1) � b ∗ � b ∗ 1 � = � b 1 � = λ 1 ( L ( b 1 , b 2 , · · · , b k )) 2 � = λ 1 L k +1 Notation of projection Given a basis B = ( b 1 , · · · , b n ) ∈ Q m , we let b ( j ) denote the orthogonal i projection over ( b 1 , · · · , b j ) ⊥ of b i . Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 5 / 19

The BKZ algorithm [SE94] SVP solver b k b k +1 b 1 b 2 b n ··· ·· · � � �� 2 � = � b (1) b (1) 2 , b (1) 3 , · · · , b (1) � b ∗ 2 � = λ 1 L k +1 Notation of projection Given a basis B = ( b 1 , · · · , b n ) ∈ Q m , we let b ( j ) denote the orthogonal i projection over ( b 1 , · · · , b j ) ⊥ of b i . Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 5 / 19

The BKZ algorithm [SE94] SVP solver b k b k +1 b 1 b 2 b n ··· ·· · � � �� 2 � = � b (1) b (1) 2 , b (1) 3 , · · · , b (1) � b ∗ 2 � = λ 1 L k +1 The two practical SVP solver families Sieve [BDGL16] Enumeration [Kan83; FP83; HS07; GNR10] exp ( k ) poly ( k ) Space k k / ( 2 e )+ o ( k ) ( ≈ k 0 . 184 k ) 2 0 . 292 k + o ( k ) Time Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 5 / 19

The BKZ algorithm [SE94] SVP solver b k b k +1 b 1 b 2 b n ··· ·· · � � �� 2 � = � b (1) b (1) 2 , b (1) 3 , · · · , b (1) � b ∗ 2 � = λ 1 L k +1 The two practical SVP solver families Sieve [BDGL16] Enumeration [Kan83; FP83; HS07; GNR10] exp ( k ) poly ( k ) Space k k / ( 2 e )+ o ( k ) ( ≈ k 0 . 184 k ) 2 0 . 292 k + o ( k ) Time Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 5 / 19

The prior results and our result (informal) SVP solver b k b k +1 b 1 b 2 b n ··· ·· · � � �� 2 � = � b (1) b (1) 2 , b (1) 3 , · · · , b (1) � b ∗ 2 � = λ 1 L k +1 Performance of enumeration-based (SD)BKZ and ours (SD)BKZ [HPS11; MW16; Neu17] This work (informally) k 1 / ( 2 k ) k 1 / ( 2 k ) RHF k k / ( 2 e )+ o ( k ) k k / 8 + o ( k ) Time Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 5 / 19

Observation on BKZ and SDBKZ reduced bases i � log 2 � b ∗ Line 0 k 2 k 3 k Index i Study of δ i = � b i � / � b i + 1 � for i < n − k BKZ SDBKZ (in this work) [MW16] ⋆ : fixed δ i = γ 2 / ( k − 1 ) , [This work, Appendix]: δ i is not fixed . (E.g., it does not give a line.) given γ - HSVP on k -dim lattice. Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 6 / 19

The SDBKZ reduced basis i � log 2 � b ∗ Kannan’s algorithm Line 0 k 2 k 3 k Index i ◮ Enum _ Cost (’first block’) = k k / 8 + o ( k ) ; ◮ Enum _ Cost (’last block’) = k k / ( 2 e )+ o ( k ) . Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 7 / 19

The SDBKZ reduced basis i � log 2 � b ∗ Kannan’s algorithm Line HKZ curve 0 k 2 k 3 k Index i ◮ Enum _ Cost (’first block’) = k k / 8 + o ( k ) ; ◮ Enum _ Cost (’last block’) = k k / ( 2 e )+ o ( k ) . Weiqiang Wen (Rennes Univ) Faster Enumeration-based Lattice Reduction CRYPTO 2020 7 / 19