Dissection-BKW

Esser, Andre; Heuer, Felix; Kübler, Robert; May, Alexander; Sohler, Christian

doi:10.1007/978-3-319-96881-0_22

Cited by 15 publications

(7 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It starts from the list of samples and repeatedly finds partial collisions, cancelling bits in the , until it produces a list of samples with a single nonzero bit. In [ 19 ], the authors find that there are many advantages of combining samples at a time, that is, using a c -list algorithm in place of a simple 2-list merge operation. First of all, this reduces the memory used, which is crucial for practical implementations of the BKW algorithm.…”

Section: Applicationsmentioning

confidence: 99%

“…The c -sum-BKW algorithm is build upon the c -Sum-Problem as defined in [ 19 , Definition 3.1]: given a list L of N uniformly random b -bit strings, given find at least N distinct c -tuples of elements of L that xor to t .…”

Section: Applicationsmentioning

confidence: 99%

“…• QACM (quantum-accessible classical memory): there are qRAM gates, but the data accessed must be classical. This is the model required by the collision-finding algorithm of [13] or the QBKW algorithm of [19]. Some authors [27] consider it more relevant than the QAQM model.…”

Section: Quantum Computing Model and Preliminariesmentioning

confidence: 99%

See 2 more Smart Citations

Optimal Merging in Quantum $$k$$-xor and k-sum Algorithms

Naya-Plasencia

Schrottenloher

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

The k -xor or Generalized Birthday Problem aims at finding, given k lists of bit-strings, a k -tuple among them XORing to 0. If the lists are unbounded, the best classical (exponential) time complexity has withstood since Wagner’s CRYPTO 2002 paper. If the lists are bounded (of the same size) and such that there is a single solution, the dissection algorithms of Dinur et al. (CRYPTO 2012) improve the memory usage over a simple meet-in-the-middle. In this paper, we study quantum algorithms for the k -xor problem. With unbounded lists and quantum access, we improve previous work by Grassi et al. (ASIACRYPT 2018) for almost all k . Next, we extend our study to lists of any size and with classical access only. We define a set of “merging trees” which represent the best known strategies for quantum and classical merging in k -xor algorithms, and prove that our method is optimal among these. Our complexities are confirmed by a Mixed Integer Linear Program that computes the best strategy for a given k -xor problem. All our algorithms apply also when considering modular additions instead of bitwise xors. This framework enables us to give new improved quantum k -xor algorithms for all k and list sizes. Applications include the subset-sum problem, LPN with limited memory and the multiple-encryption problem.

show abstract

Section: Applicationsmentioning

confidence: 99%

Section: Applicationsmentioning

confidence: 99%

See 1 more Smart Citation

Optimal Merging in Quantum $$k$$-xor and k-sum Algorithms

Naya-Plasencia

Schrottenloher

2020

Lecture Notes in Computer Science

View full text Add to dashboard Cite

show abstract

“…One drawback of BKW is its high memory-usage. To remedy this, time-memory trade-offs for the BKW algorithm were recently studied in [15,17,18].…”

Section: Related Workmentioning

confidence: 99%

Making the BKW Algorithm Practical for LWE

Budroni

Guo

Johansson

et al. 2020

Progress in Cryptology – INDOCRYPT 2020

View full text Add to dashboard Cite

The Learning with Errors (LWE) problem is one of the main mathematical foundations of post-quantum cryptography. One of the main groups of algorithms for solving LWE is the Blum-Kalai-Wasserman (BKW) algorithm. This paper presents new improvements for BKW-style algorithms for solving LWE instances. We target minimum concrete complexity and we introduce a new reduction step where we partially reduce the last position in an iteration and finish the reduction in the next iteration, allowing non-integer step sizes. We also introduce a new procedure in the secret recovery by mapping the problem to binary problems and applying the Fast Walsh Hadamard Transform. The complexity of the resulting algorithm compares favourably to all other previous approaches, including lattice sieving. We additionally show the steps of implementing the approach for large LWE problem instances. The core idea here is to overcome RAM limitations by using large file-based memory.

show abstract

“…However, in [38], it has been shown that the dependence between sums of 2 LPN samples, which are the counterpart of simplified samples with w = 2, merely affect the asymptotic time complexity of the LPN solving algorithm. Moreover, the authors of [39] proposed a variant of LPN-solving BKW with improved memory complexity under the heuristic that sums of w(> 2) LPN samples also merely affects the asymptotic time complexity of the LPN-solving BKW algorithm. They has also presented precise experimental results that verify the heuristic in the paper.…”

mentioning

confidence: 99%

On the Complexity of the LWR-Solving BKW Algorithm

Okada

Takayasu

Fukushima

et al. 2020

IEICE Trans. Fundamentals

View full text Add to dashboard Cite

The Blum-Kalai-Wasserman algorithm (BKW) is an algorithm for solving the learning parity with noise problem, which was then adapted for solving the learning with errors problem (LWE) by Albrecht et al. Duc et al. applied BKW also to the learning with rounding problem (LWR). The number of blocks is a parameter of BKW. By optimizing the number of blocks, we can minimize the time complexity of BKW. However, Duc et al. did not derive the optimal number of blocks theoretically, but they searched for it numerically. Duc et al. also showed that the required number of samples for BKW for solving LWE can be dramatically decreased using Lyubashevsky's idea. However, it is not shown that his idea is also applicable to LWR. In this paper, we theoretically derive the asymptotically optimal number of blocks, and then analyze the minimum asymptotic time complexity of the algorithm. We also show that Lyubashevsky's idea can be applied to LWR-solving BKW, under a heuristic assumption that is regularly used in the analysis of LPNsolving BKW. Furthermore, we derive an equation that relates the Gaussian parameter σ of LWE and the modulus p of LWR. When σ and p satisfy the equation, the asymptotic time complexity of BKW to solve LWE and LWR are the same.

show abstract

Dissection-BKW

Cited by 15 publications

References 28 publications

Optimal Merging in Quantum $$k$$-xor and k-sum Algorithms

Optimal Merging in Quantum $$k$$-xor and k-sum Algorithms

Making the BKW Algorithm Practical for LWE

On the Complexity of the LWR-Solving BKW Algorithm

Contact Info

Product

Resources

About