Abstract:Lattice-based cryptography has recently emerged as a prime candidate for efficient and secure post-quantum cryptography. The two main hard problems underlying its security are the shortest vector problem (SVP) and the closest vector problem (CVP). Various algorithms have been studied for solving these problems, and for SVP, lattice sieving currently dominates in terms of the asymptotic time complexity: one can heuristically solve SVP in time $$2^{0.292d + o(d)}$$ in high dimensions d [Becker–Ducas–Gama–Laarhoven, SODA’16]. Although several SVP algorithms can also be used to solve CVP, it is not clear whether this also holds for heuristic lattice sieving methods. The best time complexity for CVP is currently $$2^{0.377d + o(d)}$$ [Becker–Gama–Joux, ANTS’14].In this paper we revisit sieving algorithms for solving SVP, and study how these algorithms can be modified to solve CVP and its variants as well. Our first method is aimed at solving one problem instance and minimizes the overall time complexity for a single CVP instance with a time complexity of $$2^{0.292d + o(d)}$$. Our second method minimizes the amortized time complexity for several instances on the same lattice, at the cost of a larger preprocessing cost. Using nearest neighbor searching with a balanced space-time tradeoff, with this method we can solve the closest vector problem with preprocessing (CVPP) with $$2^{0.636d + o(d)}$$ space and preprocessing, in $$2^{0.136d + o(d)}$$ time, while the query complexity can be further reduced to $$2^{0.059d + o(d)}$$ at the cost of $$2^{d + o(d)}$$ space and preprocessing, or even to $$2^{\varepsilon d + o(d)}$$ for arbitrary $$\varepsilon > 0$$, at the cost of preprocessing time and memory complexities of $$(1/\varepsilon )^{O(d)}$$.For easier variants of CVP, such as approximate CVP and bounded distance decoding (BDD), we further show how the preprocessing method achieves even better complexities. For instance, we can solve approximate CVPP with large approximation factors $$\kappa $$ with polynomial-sized advice in polynomial time if $$\kappa = \varOmega (\sqrt{d / \log d})$$. This heuristically closes the gap between the decision-CVPP result of [Aharonov–Regev, FOCS’04] (with equivalent $$\kappa $$) and the search-CVPP result of [Dadush–Regev–Stephens-Davidowitz, CCC’14] (which required larger $$\kappa $$).

p3Enum: A New Parameterizable and Shared-Memory Parallelized Shortest Vector Problem Solver

Quantum Lattice Sieving

Solving the Shortest Vector Problem in Lattices Faster Using Quantum Search

On the practicality of quantum sieving algorithms for the shortest vector problem

Finding Short Vectors in Structured Lattices with Reduced Quantum Resources

Variational quantum solutions to the Shortest Vector Problem

Space-efficient classical and quantum algorithms for the shortest vector problem

Improved Classical and Quantum Algorithms for the Shortest Vector Problem via Bounded Distance Decoding

Lattice sieving via quantum random walks

Two quantum Ising algorithms for the shortest-vector problem

Sieving for Closest Lattice Vectors (with Preprocessing)

Two quantum Ising algorithms for the Shortest Vector Problem: one for now and one for later

Fast and Practical Quantum-Inspired Classical Algorithms for Solving Linear Systems.

A Hierarchical Parallel Discrete Gaussian Sampler for Lattice-Based Cryptography

3-Regular 3-XORSAT Planted Solutions Benchmark of Classical and Quantum Heuristic Optimizers

Quantum Algorithm for Optimization and Polynomial System Solving over Finite Field and Application to Cryptanalysis

On the Shortness of Vectors to Be Found by the Ideal-SVP Quantum Algorithm

Towards Efficient Implementation of Lattice-Based Public-Key Encryption on Modern CPUs

Finding Shortest Lattice Vectors in the Presence of Gaps

Realistic Runtime Analysis for Quantum Simplex Computation

Increasing the Hardness of Posiform Planting Using Random QUBOs for Programmable Quantum Annealer Benchmarking