Development of a Dual Version of DeepBKZ and Its Application to Solving the LWE Challenge

Yasuda, Masaya; Yamaguchi, Junpei; Ooka, Michiko; Nakamura, Satoshi

doi:10.1007/978-3-319-89339-6_10

Cited by 7 publications

(8 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We used the int data type for B, and long double for both µ and (B i ) 1≤i≤n . To keep track of the GSO information in DeepLLL and dual DeepLLL, we implemented pseudo-codes of [18,Algorithm 4] and [19,Algorithm 2], respectively. We also implemented [8,Algorithm 2] and Algorithm 3 in Appendix A for primal and dual enumerations, respectively.…”

Section: Methodsmentioning

confidence: 99%

“…With this construction, we expect that our self-dual DeepBKZ could find a basis satisfying a condition close to Mordell's reduction. In particular, like DeepBKZ [18], we hope that our self-dual DeepBKZ could find a shorter b 1 (resp., longer b * n ) with help of DeepLLL (resp., dual DeepLLL [19]) than the original self-dual BKZ [11].…”

Section: Mathematical Background and Our Motivationmentioning

confidence: 99%

“…It is a dual version of DeepBKZ proposed in [19]. It consists of the dual enumeration in self-dual BKZ [11] and a dual version of DeepLLL to reduce the dual basis of an input basis.…”

Section: Dual Deepbkzmentioning

confidence: 99%

“…(However, from [11,Figure 2], the output quality of the slide reduction algorithm is worse than both BKZ and self-dual BKZ in practice.) In order to describe the basic idea of our self-dual DeepBKZ, consider [19] in backward tours, equivalently, it reduces the dual basis by DeepBKZ. With this construction, we expect that our self-dual DeepBKZ could find a basis satisfying a condition close to Mordell's reduction.…”

Section: Mathematical Background and Our Motivationmentioning

confidence: 99%

“…, b * n ] denotes the Gram-Schmidt orthogonalization of B. In our self-dual DeepBKZ, DeepLLL and dual DeepLLL [19] are respectively called to reduce [b 1 , . .…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Self-dual DeepBKZ for finding short lattice vectors

Yasuda

2020

Journal of Mathematical Cryptology

Self Cite

View full text Add to dashboard Cite

AbstractIn recent years, the block Korkine-Zolotarev (BKZ) and its variants such as BKZ 2.0 have been used as de facto algorithms to estimate the security of a lattice-based cryptosystem. In 2017, DeepBKZ was proposed as a mathematical improvement of BKZ, which calls LLL with deep insertions (DeepLLL) as a subroutine alternative to LLL. DeepBKZ can find a short lattice vector by smaller blocksizes than BKZ. In this paper, we develop a self-dual variant of DeepBKZ, as in the work of Micciancio and Walter for self-dual BKZ. Like DeepBKZ, our self-dual DeepBKZ calls both DeepLLL and its dual variant as main subroutines in order to accelerate to find a very short lattice vector. We also report experimental results of DeepBKZ and our self-dual DeepBKZ for random bases on the Darmstadt SVP challenge.

show abstract

Section: Methodsmentioning

confidence: 99%

Section: Mathematical Background and Our Motivationmentioning

confidence: 99%

“…It is a dual version of DeepBKZ proposed in [19]. It consists of the dual enumeration in self-dual BKZ [11] and a dual version of DeepLLL to reduce the dual basis of an input basis.…”

Section: Dual Deepbkzmentioning

confidence: 99%

Section: Mathematical Background and Our Motivationmentioning

confidence: 99%

“…, b * n ] denotes the Gram-Schmidt orthogonalization of B. In our self-dual DeepBKZ, DeepLLL and dual DeepLLL [19] are respectively called to reduce [b 1 , . .…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Self-dual DeepBKZ for finding short lattice vectors

Yasuda

2020

Journal of Mathematical Cryptology

Self Cite

View full text Add to dashboard Cite

show abstract

A Survey of Solving SVP Algorithms and Recent Strategies for Solving the SVP Challenge

Yasuda

2020

Mathematics for Industry

Self Cite

View full text Add to dashboard Cite

Recently, lattice-based cryptography has received attention as a candidate of post-quantum cryptography (PQC). The essential security of lattice-based cryptography is based on the hardness of classical lattice problems such as the shortest vector problem (SVP) and the closest vector problem (CVP). A number of algorithms have been proposed for solving SVP exactly or approximately, and most of them are useful also for solving CVP. In this paper, we give a survey of typical algorithms for solving SVP from a mathematical point of view. We also present recent strategies for solving the Darmstadt SVP challenge in dimensions higher than 150.

show abstract