Solving All Lattice Problems in Deterministic Single Exponential - - PowerPoint PPT Presentation

▶
solving all lattice problems in deterministic single
SMART_READER_LITE
LIVE PREVIEW

Solving All Lattice Problems in Deterministic Single Exponential - - PowerPoint PPT Presentation

Jan 11, 2023 350 likes •1.44k views

Solving All Lattice Problems in Deterministic Single Exponential Time Daniele Micciancio (UCSD) (Joint work with P. Voulgaris, STOC 2010) Barriers II Workshop, Princeton August 27, 2010 CVP in deterministic 2 O ( n ) time Daniele Micciancio

slide-1
SLIDE 1

Solving All Lattice Problems in Deterministic Single Exponential Time

Daniele Micciancio (UCSD) (Joint work with P. Voulgaris, STOC 2010)

Barriers II Workshop, Princeton

August 27, 2010

Daniele Micciancio CVP in deterministic 2O(n) time

slide-2
SLIDE 2

Lattices

Traditional area of mathematics

Bridge between number theory and geometry Studied by Lagrange, Gauss, ..., Minkowski, ...

Key to many algorithmic applications

Cryptanalysis, Coding Theory, Integer Programming

Foundation of Lattice based Cryptography

Exponentially hard to break, even by quantum adversary Asymptotically fast and easily parallelizable cryptographic functions Secure based on conjectured hardness of worst-case problems Extremely versatile: CPA/CCA encryption, digital signature, . . . ring signatures, threshold encryption, IBE, . . . , HIBE, . . . , fully homomorphic encryption

Daniele Micciancio CVP in deterministic 2O(n) time

slide-3
SLIDE 3

Complexity of Lattice problems

Finding exact solutions Best known algorithms run in exponential time NP-hard: no subexponential time solution is expected Finding good (nO(1)) approximations Foundation of lattice based cryptography Not known how to solve substantially faster than exact version Finding exponential (2O(n)) approximations Extensively used in cryptanalysis Polynomial time algorithms, based on exact solution of small dimensional subproblems

Daniele Micciancio CVP in deterministic 2O(n) time

slide-4
SLIDE 4

Complexity of Lattice problems

Finding exact solutions Best known algorithms run in exponential time NP-hard: no subexponential time solution is expected Finding good (nO(1)) approximations Foundation of lattice based cryptography Not known how to solve substantially faster than exact version Finding exponential (2O(n)) approximations Extensively used in cryptanalysis Polynomial time algorithms, based on exact solution of small dimensional subproblems

Daniele Micciancio CVP in deterministic 2O(n) time

slide-5
SLIDE 5

Outline

1

Introduction Lattices Lattice Problems Algorithmic Techniques

2

New Algorithm Overview Voronoi Cell CVPP Algorithm

3

Final Remarks and Open Problems

Daniele Micciancio CVP in deterministic 2O(n) time

slide-6
SLIDE 6

1

Introduction Lattices Lattice Problems Algorithmic Techniques

2

New Algorithm Overview Voronoi Cell CVPP Algorithm

3

Final Remarks and Open Problems

Daniele Micciancio CVP in deterministic 2O(n) time

slide-7
SLIDE 7

Point Lattices

b1

  • b2

A lattice is the set of all integer linear combinations of (linearly independent) basis vectors B = { b1, . . . , bn} ⊂ Rn: Λ =

n

  • i=1
  • bi · Z

Daniele Micciancio CVP in deterministic 2O(n) time

slide-8
SLIDE 8

Point Lattices

b1

  • b2

A lattice is the set of all integer linear combinations of (linearly independent) basis vectors B = { b1, . . . , bn} ⊂ Rn: Λ =

n

  • i=1
  • bi · Z = {B

x : x ∈ Zn}

Daniele Micciancio CVP in deterministic 2O(n) time

slide-9
SLIDE 9

Point Lattices

b1

  • b2
  • c1
  • c2

A lattice is the set of all integer linear combinations of (linearly independent) basis vectors B = { b1, . . . , bn} ⊂ Rn: Λ =

n

  • i=1
  • bi · Z = {B

x : x ∈ Zn} The same lattice has many bases Λ =

n

  • i=1
  • ci · Z

Daniele Micciancio CVP in deterministic 2O(n) time

slide-10
SLIDE 10

Point Lattices

A lattice is the set of all integer linear combinations of (linearly independent) basis vectors B = { b1, . . . , bn} ⊂ Rn: Λ =

n

  • i=1
  • bi · Z = {B

x : x ∈ Zn} The same lattice has many bases Λ =

n

  • i=1
  • ci · Z

Definition (Lattice)

Discrete additive subgroup of Rn

Daniele Micciancio CVP in deterministic 2O(n) time

slide-11
SLIDE 11

Shortest Vector Problem (SVP)

  • b1
  • b2

Definition (SVP)

Given a lattice L(B), find a (nonzero) lattice vector B x (with

  • x ∈ Zk) of minimal length B

x Input: A lattice basis B

Daniele Micciancio CVP in deterministic 2O(n) time

slide-12
SLIDE 12

Shortest Vector Problem (SVP)

  • b1
  • b2

Definition (SVP)

Given a lattice L(B), find a (nonzero) lattice vector B x (with

  • x ∈ Zk) of minimal length B

x Input: A lattice basis B Output: A shortest nonzero vector s ∈ Λ

Daniele Micciancio CVP in deterministic 2O(n) time

slide-13
SLIDE 13

Shortest Vector Problem (SVP)

  • b1
  • b2

Definition (SVP)

Given a lattice L(B), find a (nonzero) lattice vector B x (with

  • x ∈ Zk) of minimal length B

x Input: A lattice basis B Output: A shortest nonzero vector s ∈ Λ The problem is hard when dimension n is high and basis is skewed

Daniele Micciancio CVP in deterministic 2O(n) time

slide-14
SLIDE 14

Shortest Vector Problem (SVP)

  • b1
  • b2

Definition (SVP)

Given a lattice L(B), find a (nonzero) lattice vector B x (with

  • x ∈ Zk) of minimal length B

x Input: A lattice basis B Output: A shortest nonzero vector s ∈ Λ The problem is hard when dimension n is high and basis is skewed Shortest vector can be much shorter than basis vectors

Daniele Micciancio CVP in deterministic 2O(n) time

slide-15
SLIDE 15

Shortest Independent Vectors Problem (SIVP)

  • b1
  • b2

Definition (SIVP)

Given a lattice L(B), find n linearly independent lattice vectors s1, . . . , sn of minimal length maxi si Input: A lattice basis B

Daniele Micciancio CVP in deterministic 2O(n) time

slide-16
SLIDE 16

Shortest Independent Vectors Problem (SIVP)

  • b1
  • b2

Definition (SIVP)

Given a lattice L(B), find n linearly independent lattice vectors s1, . . . , sn of minimal length maxi si Input: A lattice basis B Output: n shortest linearly independent lattice vectors

  • s1, . . . ,

sn ∈ Λ

Daniele Micciancio CVP in deterministic 2O(n) time

slide-17
SLIDE 17

Shortest Independent Vectors Problem (SIVP)

  • b1
  • b2

Definition (SIVP)

Given a lattice L(B), find n linearly independent lattice vectors s1, . . . , sn of minimal length maxi si Input: A lattice basis B Output: n shortest linearly independent lattice vectors

  • s1, . . . ,

sn ∈ Λ The problem is hard when dimension n is high and basis is skewed

Daniele Micciancio CVP in deterministic 2O(n) time

slide-18
SLIDE 18

Closest Vector Point (CVP)

  • t

Inhomogeneous version of SVP

Definition (CVP)

Given a lattice L(B) and a target point t, find a lattice vector B x which minimizes the distance B x − t Input: A lattice Λ(B), and a target vector t

Daniele Micciancio CVP in deterministic 2O(n) time

slide-19
SLIDE 19

Closest Vector Point (CVP)

  • t
  • c

Inhomogeneous version of SVP

Definition (CVP)

Given a lattice L(B) and a target point t, find a lattice vector B x which minimizes the distance B x − t Input: A lattice Λ(B), and a target vector t Output: A closest lattice point c ∈ Λ

Daniele Micciancio CVP in deterministic 2O(n) time

slide-20
SLIDE 20

Closest Vector Point (CVP)

  • t
  • c

Inhomogeneous version of SVP

Definition (CVP)

Given a lattice L(B) and a target point t, find a lattice vector B x which minimizes the distance B x − t Input: A lattice Λ(B), and a target vector t Output: A closest lattice point c ∈ Λ NP-hard [vEB’81], even for fixed lattice [M’01]

Daniele Micciancio CVP in deterministic 2O(n) time

slide-21
SLIDE 21

Complexity of SVP, SIVP, CVP

Efficient (dimension preserving) reductions

SVP, SIVP ≤ CVP [GMSS’99, M’08]

Fastest previous algorithm

SVP,SIVP,CVP : [Kannan’87] runs in nO(n) time SVP: [AKS’01] runs in randomized 2O(n) time and space Algorithms work in any ℓp norm [BN’07]

Daniele Micciancio CVP in deterministic 2O(n) time

slide-22
SLIDE 22

Complexity of SVP, SIVP, CVP

Efficient (dimension preserving) reductions

SVP, SIVP ≤ CVP [GMSS’99, M’08]

Fastest previous algorithm

SVP,SIVP,CVP : [Kannan’87] runs in nO(n) time SVP: [AKS’01] runs in randomized 2O(n) time and space Algorithms work in any ℓp norm [BN’07]

Barriers

Can CVP, SIVP also be solved in 2c·n time? What is the smallest constant c? [NV’09,MP’10,PS’10]: c < 2.5 for SVP in ℓ2. Is randomization and exponential space useful/necessary?

Daniele Micciancio CVP in deterministic 2O(n) time

slide-23
SLIDE 23

Complexity of SVP, SIVP, CVP

Efficient (dimension preserving) reductions

SVP, SIVP ≤ CVP [GMSS’99, M’08]

Fastest previous algorithm

SVP,SIVP,CVP : [Kannan’87] runs in nO(n) time SVP: [AKS’01] runs in randomized 2O(n) time and space Algorithms work in any ℓp norm [BN’07]

Barriers

Can CVP, SIVP also be solved in 2c·n time? Yes! (for ℓ2) What is the smallest constant c? [NV’09,MP’10,PS’10]: c < 2.5 for SVP in ℓ2. c ≤ 2 for SVP,SIVP,CVP! Is randomization and exponential space useful/necessary? Randomization is not!

Daniele Micciancio CVP in deterministic 2O(n) time

slide-24
SLIDE 24

Complexity of SVP, SIVP, CVP

Efficient (dimension preserving) reductions

SVP, SIVP ≤ CVP [GMSS’99, M’08]

Fastest previous algorithm

SVP,SIVP,CVP ,IP: [Kannan’87] runs in nO(n) time SVP: [AKS’01] runs in randomized 2O(n) time and space Algorithms work in any ℓp norm [BN’07]

Barriers

Can CVP, SIVP also be solved in 2c·n time? Yes! (for ℓ2) What is the smallest constant c? [NV’09,MP’10,PS’10]: c < 2.5 for SVP in ℓ2. c ≤ 2 for SVP,SIVP,CVP! Is randomization and exponential space useful/necessary? Randomization is not! What about other norms and Integer Programming (IP)?

Daniele Micciancio CVP in deterministic 2O(n) time

slide-25
SLIDE 25

1

Introduction Lattices Lattice Problems Algorithmic Techniques

2

New Algorithm Overview Voronoi Cell CVPP Algorithm

3

Final Remarks and Open Problems

Daniele Micciancio CVP in deterministic 2O(n) time

slide-26
SLIDE 26

Size Reduction

  • b
  • c
  • b: (short) lattice vector
  • c: arbitrary point

Daniele Micciancio CVP in deterministic 2O(n) time

slide-27
SLIDE 27

Size Reduction

  • b
  • c
  • b: (short) lattice vector
  • c: arbitrary point

Can make c shorter by subtracting b from it

Daniele Micciancio CVP in deterministic 2O(n) time

slide-28
SLIDE 28

Size Reduction

  • b
  • c
  • c′
  • b: (short) lattice vector
  • c: arbitrary point

Can make c shorter by subtracting b from it Repeat until c closer to than to b

Daniele Micciancio CVP in deterministic 2O(n) time

slide-29
SLIDE 29

Size Reduction

  • b
  • c
  • c′
  • b: (short) lattice vector
  • c: arbitrary point

Can make c shorter by subtracting b from it Repeat until c closer to than to b or − b Remarks

  • c −

c′ ∈ Λ Key step in [LLL’82] basis reduction algorithm Technique is used in most

  • ther lattice algorithms

Daniele Micciancio CVP in deterministic 2O(n) time

slide-30
SLIDE 30

Rank reduction

  • t

Goal: Solve CVP(Λn, t)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-31
SLIDE 31

Rank reduction

b1

  • b2
  • t

Λ1 Goal: Solve CVP(Λn, t) Partition Λn into layers of the form: Λn−1 + c bn, c = 2, 1, 3, 0, . . .

Daniele Micciancio CVP in deterministic 2O(n) time

slide-32
SLIDE 32

Rank reduction

  • t
  • t1
  • v1

Λ1 Goal: Solve CVP(Λn, t) Partition Λn into layers of the form: Λn−1 + c bn, c = 2, 1, 3, 0, . . . Find lattice point vi in each layer closest to (the projection of) t

Daniele Micciancio CVP in deterministic 2O(n) time

slide-33
SLIDE 33

Rank reduction

  • t
  • t2
  • v1
  • v2

Λ1 Goal: Solve CVP(Λn, t) Partition Λn into layers of the form: Λn−1 + c bn, c = 2, 1, 3, 0, . . . Find lattice point vi in each layer closest to (the projection of) t

Daniele Micciancio CVP in deterministic 2O(n) time

slide-34
SLIDE 34

Rank reduction

  • t
  • t3
  • v1
  • v2
  • v3

Λ1 Goal: Solve CVP(Λn, t) Partition Λn into layers of the form: Λn−1 + c bn, c = 2, 1, 3, 0, . . . Find lattice point vi in each layer closest to (the projection of) t

Daniele Micciancio CVP in deterministic 2O(n) time

slide-35
SLIDE 35

Rank reduction

  • t
  • t4
  • v1
  • v2
  • v3
  • v4

Λ1 Goal: Solve CVP(Λn, t) Partition Λn into layers of the form: Λn−1 + c bn, c = 2, 1, 3, 0, . . . Find lattice point vi in each layer closest to (the projection of) t

Daniele Micciancio CVP in deterministic 2O(n) time

slide-36
SLIDE 36

Rank reduction

  • t
  • v1
  • v2
  • v3
  • v4

Λ1 Goal: Solve CVP(Λn, t) Partition Λn into layers of the form: Λn−1 + c bn, c = 2, 1, 3, 0, . . . Find lattice point vi in each layer closest to (the projection of) t Only need to consider nearby layers

Dual LLL: 2n layers Dual SVP: n layers

Daniele Micciancio CVP in deterministic 2O(n) time

slide-37
SLIDE 37

Rank reduction

  • t
  • v1
  • v2
  • v3
  • v4

Λ1 Goal: Solve CVP(Λn, t) Partition Λn into layers of the form: Λn−1 + c bn, c = 2, 1, 3, 0, . . . Find lattice point vi in each layer closest to (the projection of) t Only need to consider nearby layers

Dual LLL: 2n layers Dual SVP: n layers

Select the best solution v1

Daniele Micciancio CVP in deterministic 2O(n) time

slide-38
SLIDE 38

Rank reduction: CVP(Λn) ≤ 2n · CVP(Λn−1)

  • t
  • v1
  • v2
  • v3
  • v4

Λ1 Goal: Solve CVP(Λn, t) Partition Λn into layers of the form: Λn−1 + c bn, c = 2, 1, 3, 0, . . . Find lattice point vi in each layer closest to (the projection of) t Only need to consider nearby layers

Dual LLL: 2n layers Dual SVP: n layers

Select the best solution v1 Notice: All layers contain same lattice Λn−1

Daniele Micciancio CVP in deterministic 2O(n) time

slide-39
SLIDE 39

1

Introduction Lattices Lattice Problems Algorithmic Techniques

2

New Algorithm Overview Voronoi Cell CVPP Algorithm

3

Final Remarks and Open Problems

Daniele Micciancio CVP in deterministic 2O(n) time

slide-40
SLIDE 40

Solving CVP by rank reduction

Rank reduction CVP(Λn) ≤ k · CVP(Λn−1)

LLL: k = 2n, SVP: k = n,

Daniele Micciancio CVP in deterministic 2O(n) time

slide-41
SLIDE 41

Solving CVP by rank reduction

Rank reduction CVP(Λn) ≤ k · CVP(Λn−1)

LLL: k = 2n, T = 2n2 SVP: k = n, T = nn

Iterate: CVP(Λn) ≤ k · CVP(Λn−1) ≤ · · · ≤ knCVP(Λ1) = kn

Daniele Micciancio CVP in deterministic 2O(n) time

slide-42
SLIDE 42

Solving CVP by rank reduction

Rank reduction CVP(Λn) ≤ k · CVP(Λn−1)

LLL: k = 2n, T = 2n2 SVP: k = n, T = nn

Iterate: CVP(Λn) ≤ k · CVP(Λn−1) ≤ · · · ≤ knCVP(Λ1) = kn Our approach

Exploit the fact that recursive calls use the same lower dimensional sublattices Preprocess the lattice to speed up the solution of many CVP instances

Daniele Micciancio CVP in deterministic 2O(n) time

slide-43
SLIDE 43

CVP with Preprocessing (CVPP)

Problem (CVPP)

Find a function π and an efficient algorithm CVPP such that CVPP(π(Λ), t) = CVP(Λ, t) Only the running time of CVPP counts. The function π is arbitrary.

Daniele Micciancio CVP in deterministic 2O(n) time

slide-44
SLIDE 44

CVP with Preprocessing (CVPP)

Problem (CVPP)

Find a function π and an efficient algorithm CVPP such that CVPP(π(Λ), t) = CVP(Λ, t) Only the running time of CVPP counts. The function π is arbitrary. Complexity

Still NP-hard [M’01]! [LLS’93,AR’04] approximates within nO(1) in polynomial time Polynomial time solutions require |π(Λ)| ≤ nO(1)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-45
SLIDE 45

CVP with Preprocessing (CVPP)

Problem (CVPP)

Find a function π and an efficient algorithm CVPP such that CVPP(π(Λ), t) = CVP(Λ, t) Only the running time of CVPP counts. The function π is arbitrary. Complexity

Still NP-hard [M’01]! [LLS’93,AR’04] approximates within nO(1) in polynomial time Polynomial time solutions require |π(Λ)| ≤ nO(1)

Our work:

CVPP(π(Λ), t) runs in 2O(n) time

Daniele Micciancio CVP in deterministic 2O(n) time

slide-46
SLIDE 46

CVP with Preprocessing (CVPP)

Problem (CVPP)

Find a function π and an efficient algorithm CVPP such that CVPP(π(Λ), t) = CVP(Λ, t) Only the running time of CVPP counts. The function π is arbitrary. Complexity

Still NP-hard [M’01]! [LLS’93,AR’04] approximates within nO(1) in polynomial time Polynomial time solutions require |π(Λ)| ≤ nO(1)

Our work:

CVPP(π(Λ), t) runs in 2O(n) time π(Λ) has size 2O(n)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-47
SLIDE 47

CVP with Preprocessing (CVPP)

Problem (CVPP)

Find a function π and an efficient algorithm CVPP such that CVPP(π(Λ), t) = CVP(Λ, t) Only the running time of CVPP counts. The function π is arbitrary. Complexity

Still NP-hard [M’01]! [LLS’93,AR’04] approximates within nO(1) in polynomial time Polynomial time solutions require |π(Λ)| ≤ nO(1)

Our work:

CVPP(π(Λ), t) runs in 2O(n) time π(Λ) has size 2O(n) π(Λ) can also be computed in time 2O(n)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-48
SLIDE 48

Overview of CVP algorithm

Building blocks: π(Λ) = V(Λ): Voronoi cell of the lattice

Daniele Micciancio CVP in deterministic 2O(n) time

slide-49
SLIDE 49

Overview of CVP algorithm

Building blocks: π(Λ) = V(Λ): Voronoi cell of the lattice Our approach: CVP(Λn) ≤ CVPP(V(Λn)) + V(Λn)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-50
SLIDE 50

Overview of CVP algorithm

Building blocks: π(Λ) = V(Λ): Voronoi cell of the lattice Our approach: CVP(Λn) ≤ CVPP(V(Λn)) + V(Λn) CVPP(V(Λn)) algorithm with running time 2n

Daniele Micciancio CVP in deterministic 2O(n) time

slide-51
SLIDE 51

Overview of CVP algorithm

Building blocks: π(Λ) = V(Λ): Voronoi cell of the lattice Our approach: CVP(Λn) ≤ CVPP(V(Λn)) + V(Λn) CVPP(V(Λn)) algorithm with running time 2n Voronoi cell computation V(Λn) ≤ 2nCVP(Λn)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-52
SLIDE 52

Overview of CVP algorithm

Building blocks: π(Λ) = V(Λ): Voronoi cell of the lattice Our approach: CVP(Λn) ≤ CVPP(V(Λn)) + V(Λn) CVPP(V(Λn)) algorithm with running time 2n Voronoi cell computation V(Λn) ≤ 2nCVP(Λn) Dimension reduction CVP(Λn) ≤ 2n · CVP(Λn−1)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-53
SLIDE 53

Overview of CVP algorithm

Building blocks: π(Λ) = V(Λ): Voronoi cell of the lattice Our approach: CVP(Λn) ≤ CVPP(V(Λn)) + V(Λn) CVPP(V(Λn)) algorithm with running time 2n Voronoi cell computation V(Λn) ≤ 2nCVP(Λn) Dimension reduction CVP(Λn) ≤ 2n · CVP(Λn−1) Computing the Voronoi cell of a lattice: V(Λn)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-54
SLIDE 54

Overview of CVP algorithm

Building blocks: π(Λ) = V(Λ): Voronoi cell of the lattice Our approach: CVP(Λn) ≤ CVPP(V(Λn)) + V(Λn) CVPP(V(Λn)) algorithm with running time 2n Voronoi cell computation V(Λn) ≤ 2nCVP(Λn) Dimension reduction CVP(Λn) ≤ 2n · CVP(Λn−1) Computing the Voronoi cell of a lattice: V(Λn)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-55
SLIDE 55

Overview of CVP algorithm

Building blocks: π(Λ) = V(Λ): Voronoi cell of the lattice Our approach: CVP(Λn) ≤ CVPP(V(Λn)) + V(Λn) CVPP(V(Λn)) algorithm with running time 2n Voronoi cell computation V(Λn) ≤ 2nCVP(Λn) Dimension reduction CVP(Λn) ≤ 2n · CVP(Λn−1) Computing the Voronoi cell of a lattice: V(Λn) ≤ 2O(n)CVP(Λn)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-56
SLIDE 56

Overview of CVP algorithm

Building blocks: π(Λ) = V(Λ): Voronoi cell of the lattice Our approach: CVP(Λn) ≤ CVPP(V(Λn)) + V(Λn) CVPP(V(Λn)) algorithm with running time 2n Voronoi cell computation V(Λn) ≤ 2nCVP(Λn) Dimension reduction CVP(Λn) ≤ 2n · CVP(Λn−1) Computing the Voronoi cell of a lattice: V(Λn) ≤ 2O(n)CVP(Λn)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-57
SLIDE 57

Overview of CVP algorithm

Building blocks: π(Λ) = V(Λ): Voronoi cell of the lattice Our approach: CVP(Λn) ≤ CVPP(V(Λn)) + V(Λn) CVPP(V(Λn)) algorithm with running time 2n Voronoi cell computation V(Λn) ≤ 2nCVP(Λn) Dimension reduction CVP(Λn) ≤ 2n · CVP(Λn−1) Computing the Voronoi cell of a lattice: V(Λn) ≤ 2O(n)CVP(Λn) ≤ 2O(n) · 2O(n) · CVP(Λn−1)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-58
SLIDE 58

Overview of CVP algorithm

Building blocks: π(Λ) = V(Λ): Voronoi cell of the lattice Our approach: CVP(Λn) ≤ CVPP(V(Λn)) + V(Λn) CVPP(V(Λn)) algorithm with running time 2n Voronoi cell computation V(Λn) ≤ 2nCVP(Λn) Dimension reduction CVP(Λn) ≤ 2n · CVP(Λn−1) Computing the Voronoi cell of a lattice: V(Λn) ≤ 2O(n)CVP(Λn) ≤ 2O(n) · 2O(n) · CVP(Λn−1)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-59
SLIDE 59

Overview of CVP algorithm

Building blocks: π(Λ) = V(Λ): Voronoi cell of the lattice Our approach: CVP(Λn) ≤ CVPP(V(Λn)) + V(Λn) CVPP(V(Λn)) algorithm with running time 2n Voronoi cell computation V(Λn) ≤ 2nCVP(Λn) Dimension reduction CVP(Λn) ≤ 2n · CVP(Λn−1) Computing the Voronoi cell of a lattice: V(Λn) ≤ 2O(n)CVP(Λn) ≤ 2O(n) · 2O(n) · CVP(Λn−1) ≤ 2O(n) · 2O(n) · CVPP(V(Λn−1)) + V(Λn−1)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-60
SLIDE 60

Overview of CVP algorithm

Building blocks: π(Λ) = V(Λ): Voronoi cell of the lattice Our approach: CVP(Λn) ≤ CVPP(V(Λn)) + V(Λn) CVPP(V(Λn)) algorithm with running time 2n Voronoi cell computation V(Λn) ≤ 2nCVP(Λn) Dimension reduction CVP(Λn) ≤ 2n · CVP(Λn−1) Computing the Voronoi cell of a lattice: V(Λn) ≤ 2O(n)CVP(Λn) ≤ 2O(n) · 2O(n) · CVP(Λn−1) ≤ 2O(n) · 2O(n) · CVPP(V(Λn−1)) + V(Λn−1)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-61
SLIDE 61

Overview of CVP algorithm

Building blocks: π(Λ) = V(Λ): Voronoi cell of the lattice Our approach: CVP(Λn) ≤ CVPP(V(Λn)) + V(Λn) CVPP(V(Λn)) algorithm with running time 2n Voronoi cell computation V(Λn) ≤ 2nCVP(Λn) Dimension reduction CVP(Λn) ≤ 2n · CVP(Λn−1) Computing the Voronoi cell of a lattice: V(Λn) ≤ 2O(n)CVP(Λn) ≤ 2O(n) · 2O(n) · CVP(Λn−1) ≤ 2O(n) · 2O(n) · CVPP(V(Λn−1)) + V(Λn−1) ≤ 2O(n)2O(n)2O(n) + V(Λn−1)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-62
SLIDE 62

Overview of CVP algorithm

Building blocks: π(Λ) = V(Λ): Voronoi cell of the lattice Our approach: CVP(Λn) ≤ CVPP(V(Λn)) + V(Λn) CVPP(V(Λn)) algorithm with running time 2n Voronoi cell computation V(Λn) ≤ 2nCVP(Λn) Dimension reduction CVP(Λn) ≤ 2n · CVP(Λn−1) Computing the Voronoi cell of a lattice: V(Λn) ≤ 2O(n)CVP(Λn) ≤ 2O(n) · 2O(n) · CVP(Λn−1) ≤ 2O(n) · 2O(n) · CVPP(V(Λn−1)) + V(Λn−1) ≤ 2O(n)2O(n)2O(n) + V(Λn−1) = 2O(n) + V(Λn−1)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-63
SLIDE 63

Overview of CVP algorithm

Building blocks: π(Λ) = V(Λ): Voronoi cell of the lattice Our approach: CVP(Λn) ≤ CVPP(V(Λn)) + V(Λn) CVPP(V(Λn)) algorithm with running time 2n Voronoi cell computation V(Λn) ≤ 2nCVP(Λn) Dimension reduction CVP(Λn) ≤ 2n · CVP(Λn−1) Computing the Voronoi cell of a lattice: V(Λn) ≤ 2O(n)CVP(Λn) ≤ 2O(n) · 2O(n) · CVP(Λn−1) ≤ 2O(n) · 2O(n) · CVPP(V(Λn−1)) + V(Λn−1) ≤ 2O(n)2O(n)2O(n) + V(Λn−1) = 2O(n) + V(Λn−1) ≤ 2O(n) + 2O(n) + V(Λn−2) ≤ . . . ≤ 2O(n)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-64
SLIDE 64

1

Introduction Lattices Lattice Problems Algorithmic Techniques

2

New Algorithm Overview Voronoi Cell CVPP Algorithm

3

Final Remarks and Open Problems

Daniele Micciancio CVP in deterministic 2O(n) time

slide-65
SLIDE 65

Voronoi Cell

Definition (Voronoit Cell)

Set of points in Rn closer to 0 than to any other lattice point V(Λ) = { x : ∀ v ∈ Λ, x ≤ x− v}

Daniele Micciancio CVP in deterministic 2O(n) time

slide-66
SLIDE 66

Representing the Voronoi cell

  • v1

Each v ∈ Λ defines H

v = {

x : x ≤ x − v}

Daniele Micciancio CVP in deterministic 2O(n) time

slide-67
SLIDE 67

Representing the Voronoi cell

  • v1
  • v2

Each v ∈ Λ defines H

v = {

x : x ≤ x − v} V is the intersection V =

  • v∈Λ

H

v

Daniele Micciancio CVP in deterministic 2O(n) time

slide-68
SLIDE 68

Representing the Voronoi cell

  • v1
  • v2
  • v3

Each v ∈ Λ defines H

v = {

x : x ≤ x − v} V is the intersection V =

  • v∈Λ

H

v

Daniele Micciancio CVP in deterministic 2O(n) time

slide-69
SLIDE 69

Representing the Voronoi cell

  • v1
  • v2
  • v3
  • v4

Each v ∈ Λ defines H

v = {

x : x ≤ x − v} V is the intersection V =

  • v∈Λ

H

v

Daniele Micciancio CVP in deterministic 2O(n) time

slide-70
SLIDE 70

Representing the Voronoi cell

  • v1
  • v2
  • v3
  • v4
  • v5

Each v ∈ Λ defines H

v = {

x : x ≤ x − v} V is the intersection V =

  • v∈Λ

H

v

Daniele Micciancio CVP in deterministic 2O(n) time

slide-71
SLIDE 71

Representing the Voronoi cell

  • v1
  • v2
  • v3
  • v4
  • v5
  • v6

Each v ∈ Λ defines H

v = {

x : x ≤ x − v} V is the intersection V =

  • v∈Λ

H

v

Daniele Micciancio CVP in deterministic 2O(n) time

slide-72
SLIDE 72

Representing the Voronoi cell

  • v1
  • v2
  • v3
  • v4
  • v5
  • v6

Each v ∈ Λ defines H

v = {

x : x ≤ x − v} V is the intersection V =

  • v∈R

H

v, R ⊂ Λ

Not all v ∈ Λ are needed

Daniele Micciancio CVP in deterministic 2O(n) time

slide-73
SLIDE 73

Representing the Voronoi cell

  • v1
  • v2
  • v3
  • v4
  • v5
  • v6

Each v ∈ Λ defines H

v = {

x : x ≤ x − v} V is the intersection V =

  • v∈R

H

v, R ⊂ Λ

Not all v ∈ Λ are needed

Theorem (Voronoi)

The numer of relevant points is at most |R| ≤ 2 · (2n − 1)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-74
SLIDE 74

Computing V(Λn)

  • v1

− v1

  • v2

− v2

  • v3

− v3 Why is |R| ≤ 2 · (2n − 1)?

Daniele Micciancio CVP in deterministic 2O(n) time

slide-75
SLIDE 75

Computing V(Λn)

Why is |R| ≤ 2 · (2n − 1)? Partition Λ into cosets modulo 2Λ

Daniele Micciancio CVP in deterministic 2O(n) time

slide-76
SLIDE 76

Computing V(Λn)

Why is |R| ≤ 2 · (2n − 1)? Partition Λ into cosets modulo 2Λ There are 2n − 1 nonzero cosets

Daniele Micciancio CVP in deterministic 2O(n) time

slide-77
SLIDE 77

Computing V(Λn)

Why is |R| ≤ 2 · (2n − 1)? Partition Λ into cosets modulo 2Λ There are 2n − 1 nonzero cosets From each coset, select the pair v, − v closest to

Daniele Micciancio CVP in deterministic 2O(n) time

slide-78
SLIDE 78

Computing V(Λn)

  • v1

− v1 Why is |R| ≤ 2 · (2n − 1)? Partition Λ into cosets modulo 2Λ There are 2n − 1 nonzero cosets From each coset, select the pair v, − v closest to

Daniele Micciancio CVP in deterministic 2O(n) time

slide-79
SLIDE 79

Computing V(Λn)

  • v1

− v1 Why is |R| ≤ 2 · (2n − 1)? Partition Λ into cosets modulo 2Λ There are 2n − 1 nonzero cosets From each coset, select the pair v, − v closest to

Daniele Micciancio CVP in deterministic 2O(n) time

slide-80
SLIDE 80

Computing V(Λn)

  • v1

− v1

  • v2

− v2 Why is |R| ≤ 2 · (2n − 1)? Partition Λ into cosets modulo 2Λ There are 2n − 1 nonzero cosets From each coset, select the pair v, − v closest to

Daniele Micciancio CVP in deterministic 2O(n) time

slide-81
SLIDE 81

Computing V(Λn)

  • v1

− v1

  • v2

− v2 Why is |R| ≤ 2 · (2n − 1)? Partition Λ into cosets modulo 2Λ There are 2n − 1 nonzero cosets From each coset, select the pair v, − v closest to

Daniele Micciancio CVP in deterministic 2O(n) time

slide-82
SLIDE 82

Computing V(Λn)

  • v1

− v1

  • v2

− v2

  • v3

− v3 Why is |R| ≤ 2 · (2n − 1)? Partition Λ into cosets modulo 2Λ There are 2n − 1 nonzero cosets From each coset, select the pair v, − v closest to

Daniele Micciancio CVP in deterministic 2O(n) time

slide-83
SLIDE 83

Computing V(Λn) ≤ 2nCVP(Λn)

  • v1

− v1

  • v2

− v2

  • v3

− v3 Why is |R| ≤ 2 · (2n − 1)? Partition Λ into cosets modulo 2Λ There are 2n − 1 nonzero cosets From each coset, select the pair v, − v closest to R is the set of all such pairs Each pair is found by a CVP computation in lattice 2Λ CVP(2Λ) is equivalent to CVP(Λ)

Daniele Micciancio CVP in deterministic 2O(n) time

slide-84
SLIDE 84

1

Introduction Lattices Lattice Problems Algorithmic Techniques

2

New Algorithm Overview Voronoi Cell CVPP Algorithm

3

Final Remarks and Open Problems

Daniele Micciancio CVP in deterministic 2O(n) time

slide-85
SLIDE 85

CVP and Voronoi cell

  • t
  • v

Definition (CVP)

Given Λ and t, find v ∈ Λ such that t ∈ v + V

Daniele Micciancio CVP in deterministic 2O(n) time

slide-86
SLIDE 86

CVP and Voronoi cell

  • t
  • v
  • t’

Definition (CVP)

Given Λ and t, find v ∈ Λ such that t ∈ v + V

  • t ∈

v + V ≡ t − v ∈ V

Daniele Micciancio CVP in deterministic 2O(n) time

slide-87
SLIDE 87

CVP and Voronoi cell

  • t
  • v
  • t’

Definition (CVP)

Given Λ and t, find v ∈ Λ such that t ∈ v + V

  • t ∈

v + V ≡ t − v ∈ V CVP goal: bring t inside V by shifting it by v ∈ Λ

Daniele Micciancio CVP in deterministic 2O(n) time

slide-88
SLIDE 88

CVP and Voronoi cell

  • t
  • v
  • t’

Definition (CVP)

Given Λ and t, find v ∈ Λ such that t ∈ v + V

  • t ∈

v + V ≡ t − v ∈ V CVP goal: bring t inside V by shifting it by v ∈ Λ Algorithm [SFS’09]:

While t / ∈ V: Select v ∈ R . t / ∈ H

v

size reduce t using v

Daniele Micciancio CVP in deterministic 2O(n) time

slide-89
SLIDE 89

CVP and Voronoi cell

  • t
  • v
  • t’

Definition (CVP)

Given Λ and t, find v ∈ Λ such that t ∈ v + V

  • t ∈

v + V ≡ t − v ∈ V CVP goal: bring t inside V by shifting it by v ∈ Λ Algorithm [SFS’09]:

While t / ∈ V: Select v ∈ R . t / ∈ H

v

size reduce t using v

[SFS’09] only proves termination

Daniele Micciancio CVP in deterministic 2O(n) time

slide-90
SLIDE 90

CVP and Voronoi cell

  • t
  • v
  • t’

Definition (CVP)

Given Λ and t, find v ∈ Λ such that t ∈ v + V

  • t ∈

v + V ≡ t − v ∈ V CVP goal: bring t inside V by shifting it by v ∈ Λ Algorithm [SFS’09]:

While t / ∈ V: Select v ∈ R . t / ∈ H

v

size reduce t using v

[SFS’09] only proves termination Question: What is a good selection strategy for v ∈ R?

Daniele Micciancio CVP in deterministic 2O(n) time

slide-91
SLIDE 91

Our selection strategy

  • t

Assume t∈ 2V

Daniele Micciancio CVP in deterministic 2O(n) time

slide-92
SLIDE 92

Our selection strategy

  • t

Assume t∈ 2V Goal: find t′ ∈ t − Λ ∩ V:

Daniele Micciancio CVP in deterministic 2O(n) time

slide-93
SLIDE 93

Our selection strategy

  • t
  • u1

Assume t∈ 2V Goal: find t′ ∈ t − Λ ∩ V: Strategy:

Compute smallest k ∈ R such that t ∈ kV

Daniele Micciancio CVP in deterministic 2O(n) time

slide-94
SLIDE 94

Our selection strategy

  • t
  • u1
  • t′

Assume t∈ 2V Goal: find t′ ∈ t − Λ ∩ V: Strategy:

Compute smallest k ∈ R such that t ∈ kV Subtract the relevant vector associated to corresponding facet

Daniele Micciancio CVP in deterministic 2O(n) time

slide-95
SLIDE 95

Our selection strategy

  • t
  • u1
  • t′

Assume t∈ 2V Goal: find t′ ∈ t − Λ ∩ V: Strategy:

Compute smallest k ∈ R such that t ∈ kV Subtract the relevant vector associated to corresponding facet

Why does it work?

Daniele Micciancio CVP in deterministic 2O(n) time

slide-96
SLIDE 96

Our selection strategy

  • t
  • u1
  • t′

Assume t∈ 2V Goal: find t′ ∈ t − Λ ∩ V: Strategy:

Compute smallest k ∈ R such that t ∈ kV Subtract the relevant vector associated to corresponding facet

Why does it work?

The new vector t′ is shorter than t

Daniele Micciancio CVP in deterministic 2O(n) time

slide-97
SLIDE 97

Our selection strategy

  • t
  • u1
  • t′

Assume t∈ 2V Goal: find t′ ∈ t − Λ ∩ V: Strategy:

Compute smallest k ∈ R such that t ∈ kV Subtract the relevant vector associated to corresponding facet

Why does it work?

The new vector t′ is shorter than t still t′ ∈ 2V

Daniele Micciancio CVP in deterministic 2O(n) time

slide-98
SLIDE 98

Our selection strategy

  • t
  • u1
  • t′

Assume t∈ 2V Goal: find t′ ∈ t − Λ ∩ V: Strategy:

Compute smallest k ∈ R such that t ∈ kV Subtract the relevant vector associated to corresponding facet

Why does it work?

The new vector t′ is shorter than t still t′ ∈ 2V |( t − Λ) ∩ 2V| ≤ 2n

Daniele Micciancio CVP in deterministic 2O(n) time

slide-99
SLIDE 99

Doubling the Voronoi Cell

  • t

Solve CVP for any t: Find k ∈ Z such that

  • t ∈ 2kV

Use CVP2V to go from 2kV to 2k−1V

Daniele Micciancio CVP in deterministic 2O(n) time

slide-100
SLIDE 100

Doubling the Voronoi Cell

  • t

Solve CVP for any t: Find k ∈ Z such that

  • t ∈ 2kV

Use CVP2V to go from 2kV to 2k−1V

Daniele Micciancio CVP in deterministic 2O(n) time

slide-101
SLIDE 101

Doubling the Voronoi Cell

  • t
  • t1

Solve CVP for any t: Find k ∈ Z such that

  • t ∈ 2kV

Use CVP2V to go from 2kV to 2k−1V

Daniele Micciancio CVP in deterministic 2O(n) time

slide-102
SLIDE 102

Doubling the Voronoi Cell

  • t
  • t1

Solve CVP for any t: Find k ∈ Z such that

  • t ∈ 2kV

Use CVP2V to go from 2kV to 2k−1V

Daniele Micciancio CVP in deterministic 2O(n) time

slide-103
SLIDE 103

Doubling the Voronoi Cell

  • t
  • t1
  • t2

Solve CVP for any t: Find k ∈ Z such that

  • t ∈ 2kV

Use CVP2V to go from 2kV to 2k−1V

Daniele Micciancio CVP in deterministic 2O(n) time

slide-104
SLIDE 104

Doubling the Voronoi Cell

  • t
  • t1
  • t2

Solve CVP for any t: Find k ∈ Z such that

  • t ∈ 2kV

Use CVP2V to go from 2kV to 2k−1V

Daniele Micciancio CVP in deterministic 2O(n) time

slide-105
SLIDE 105

Doubling the Voronoi Cell

  • t
  • t1
  • t2
  • t3

Solve CVP for any t: Find k ∈ Z such that

  • t ∈ 2kV

Use CVP2V to go from 2kV to 2k−1V

Daniele Micciancio CVP in deterministic 2O(n) time

slide-106
SLIDE 106

Summary

CVP can be solved deterministically in time 2c·n Algorithms for SVP, SIVP and many other problems follow by reduction Question: what is the best possible c?

Under ETH, c = Ω(1) In this talk, we didn’t optimize c With some more work, we can reduce c = 2

SVP: improves previous c < 2.5, deterministically! CVP: First 2O(n) time algorithm, and first asymptotic improvement since [K’87]

Daniele Micciancio CVP in deterministic 2O(n) time

slide-107
SLIDE 107

Open Problems

Practical barrier in lattice cryptography:

Evaluate appropriate key size to achieve security Current state of the art lattice reduction algorithms are poorly understood Problem: find better, practical lattice algorithms that allow to extrapolate running time/complexity of approximation to very high dimension

Reduce space complexity to polynomial Design polynomial time CVPP approximation algorithms based on approximate Voronoi cell Extend to ℓ∞

Most relevant norm for cryptanalysis Application to Integer Proramming

Question

Is the number of ℓ∞-relevant points still bounded by 2O(n)

Daniele Micciancio CVP in deterministic 2O(n) time