Improved Reduction from BDD to uSVP Shi Bai; Damien Stehl; Weiqiang - - PowerPoint PPT Presentation

Rump Session 2016

Improved Reduction from BDD to uSVP

Shi Bai; Damien Stehlé; Weiqiang Wen

ENS de Lyon

Improved reduction from BDD to USVP

–Shi Bai, Damien Stehl´ e and Weiqiang Wen

Bounded Distance Decoding (BDDα)

Let α > 0. Given as inputs a lattice basis B and a vector t such that

dist(t, L(B)) ≤ α · λ1(B), the goal is to find a lattice vector v ∈ L(B)

closest to t.

Unique Shortest Vector Problem (USVPγ)

Let γ ≥ 1. Given as input a lattice basis B such that λ2(B) ≥ γ · λ1(B), the goal is to find a non-zero vector v ∈ L(B) of norm λ1(L(B)).

1 / 6

Improved reduction from BDD to USVP

BDD1/α

USVPγ USVPγ ≤ BDD1/γ[LM09] ◮ α = 2γ, Lyubashevsky and Micciancio, 2009. ◮ Slightly smaller α, Liu et al, 2014. ◮ (Even) slightly smaller α (more), Galbraith; Micciancio, 2015. ◮ Our result: α =

√

2γ.

2 / 6

Improved reduction from BDD to USVP

0.1 0.2 0.3 0.4 0.5 0.6 0.7 1 1.2 1.4 1.6 1.8 2 2.2 2.4 1/α γ Lyubashevsky and Micciancio, CRYPTO, 2009 Liu et al, Inf. Process. Lett., 2014 Folklore (Galbraith; Micciancio) Bai, Stehl´ e, Wen, ICALP, 2016

3 / 6

Improved reduction from BDD to USVP

◮ Kannan’s embedding.

BDD 1

2γ

USVPγ

[LM09]

4 / 6

Imporved reduction from BDD to USVP

◮ Kannan’s embedding + Khot’s *lattice* sparsification.

BDD

1 √ 2γ

USVPγ

New reduction

5 / 6

Conjecture

◮ First conjecture: BDD and USVP are computationally identical.

BDD

1 c·γ = USVPγ

Note: for some constant c.

◮ Second conjecture: c =

√

2 . In order to prove it, we need to improve the reduction from USVP to BDD.

6 / 6