Classical and Quantum 3 and 4-Sieves to Solve SVP with Low Memory

Chailloux, André; Loyer, Johanna

doi:10.1007/978-3-031-40003-2_9

Search citation statements

Order By: Relevance

Paper Sections

Select...

Citation Types

Supporting

Mentioning

Contrasting

Year Published

2024

Publication Types

Select...

Book1

Other1

Article1

Relationship

Self Cite0

Independent3

Authors

Journals

Cited by 3 publications

References 14 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

A Survey of Algorithms for Addressing the Shortest Vector Problem (SVP)

He,

Xu,

et al. 2024

Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

View full text Add to dashboard Cite

A Survey of Algorithms for Addressing the Shortest Vector Problem (SVP)

He,

Xu,

et al. 2024

Lecture Notes of the Institute for Computer Sciences, Social Informatics and Telecommunications Engineering

View full text Add to dashboard Cite

Pump-BSKZ: A Novel Sieve Algorithm to Solve Shortest Vector Problem

Pan,

Jiang,

Pei

et al. 2024

2024 7th International Conference on Computer Information Science and Application Technology (CISAT)

View full text Add to dashboard Cite

Memory adds no cost to lattice sieving for computers in 3 or more spatial dimensions

Jaques

2024

IACR CiC

View full text Add to dashboard Cite

The security of lattice-based crytography (LWE, NTRU, and FHE) depends on the hardness of the shortest-vector problem (SVP). Sieving algorithms give the lowest asymptotic runtime to solve SVP, but depend on exponential memory. Memory access costs much more in reality than in the RAM model, so we consider a computational model where processors, memory, and meters of wire are in constant proportions to each other. While this adds substantial costs to route data during lattice sieving, we modify existing algorithms to amortize these costs and find that, asymptotically, a classical computer can achieve the previous RAM model cost of 2 0.2925 d + o ( d ) to sieve a d -dimensional lattice for a computer existing in 3 or more spatial dimensions, and can reach 2 0.3113 d + o ( d ) in 2 spatial dimensions, where “spatial dimensions” are the dimensions of the physical geometry in which the computer exists. Since this result implies an increased cost in 2 spatial dimensions, we make several assumptions about the constant terms of memory access and lattice attacks so that we can give bit security estimates for Kyber and Dilithium. These estimates support but do not increase the security categories claimed in the Kyber and Dilithium specifications, at least with respect to known attacks.

show abstract

Classical and Quantum 3 and 4-Sieves to Solve SVP with Low Memory

Cited by 3 publications

References 14 publications

A Survey of Algorithms for Addressing the Shortest Vector Problem (SVP)

A Survey of Algorithms for Addressing the Shortest Vector Problem (SVP)

Pump-BSKZ: A Novel Sieve Algorithm to Solve Shortest Vector Problem

Memory adds no cost to lattice sieving for computers in 3 or more spatial dimensions

Contact Info

Product

Resources

About