Estimating Quantum Speedups for Lattice Sieves

Albrecht, M.; Gheorghiu, Vlad; Postlethwaite, Eamonn W.; Schanck, John M.

doi:10.1007/978-3-030-64834-3_20

Cited by 27 publications

(27 citation statements)

References 30 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…For the first summand cost estimates in various cost models are available. In particular, estimates in quantum circuit models are available [AGPS20]. Thus, to give precise cost estimates we require quantum circuit costs for the oracles in Algorithm 3.…”

Section: Applicationmentioning

confidence: 99%

“…It is clear that such costs would be substantial when compared with e.g. [AGPS20]. In the latter, the costed circuit is essentially an XOR followed by an adder.…”

Section: Applicationmentioning

confidence: 99%

“…From the perspective of a cryptanalyst equipped with a quantum computer, lattice problems such as LWE are frustrating. Known quantum speedups to solving these problems are tenuous at best [AGPS20]. That is, while Grover's search offers a near quadratic quantum speedup for breaking, say, AES [JNRV20] the gains against lattice problems are significantly more modest.…”

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Quantum Augmented Dual Attack

Albrecht¹,

Shen²

2022

Preprint

Self Cite

View full text Add to dashboard Cite

We present a quantum augmented variant of the dual lattice attack on the Learning with Errors (LWE) problem, using classical memory with quantum random access (QRACM). Applying our results to lattice parameters from the literature, we find that our algorithm outperforms previous algorithms, assuming unit cost access to a QRACM. On a technical level, we show how to obtain a quantum speedup on the search for Fast Fourier Transform (FFT) coefficients above a given threshold by leveraging the relative sparseness of the FFT and using quantum amplitude estimation. We also discuss the applicability of the Quantum Fourier Transform in this context. Furthermore, we give a more rigorous analysis of the classical and quantum expected complexity of guessing part of the secret vector where coefficients follow a discrete Gaussian (mod q).

show abstract

Section: Applicationmentioning

confidence: 99%

“…It is clear that such costs would be substantial when compared with e.g. [AGPS20]. In the latter, the costed circuit is essentially an XOR followed by an adder.…”

Section: Applicationmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Quantum Augmented Dual Attack

Albrecht¹,

Shen²

2022

Preprint

Self Cite

View full text Add to dashboard Cite

show abstract

“…There has been two more recent works on quantum sieving algorithms. First, quantum variants of the k-sieve were studied in [KMPM19], giving interesting time-space trade-off and a recent article [AGPS20] studied more practical speedups of these quantum algorithms, i.e. when do these gains in the exponent actually translate to quantum speedups.…”

Section: Introductionmentioning

confidence: 99%

“…The SVP challenge can be accessed here https://www.latticechallenge.org/svpchallenge.2 At this stage, there are 3 encryption schemes / key encapsulation mechanisms: KYBER, NTRU and SABER as well as two signature schemes: DILITHIUM and FALCON.3 We are talking here only about the asymptotic running time, there are other metrics of interest that have been covered in[KMPM19,AGPS20] where there were some improvements.…”

mentioning

confidence: 99%

Lattice sieving via quantum random walks

Chailloux¹,

Loyer²

2021

Preprint

View full text Add to dashboard Cite

Lattice-based cryptography is one of the leading proposals for post-quantum cryptography. The Shortest Vector Problem (SVP) is arguably the most important problem for the cryptanalysis of latticebased cryptography, and many lattice-based schemes have security claims based on its hardness. The best quantum algorithm for the SVP is due to Laarhoven [Laa16] and runs in (heuristic) time 2 0.2653d+o(d) . In this article, we present an improvement over Laarhoven's result and present an algorithm that has a (heuristic) running time of 2 0.2570d+o(d) where d is the lattice dimension. We also present time-memory trade-offs where we quantify the amount of quantum memory and quantum random access memory of our algorithm. The core idea is to replace Grover's algorithm used in [Laa16] in a key part of the sieving algorithm by a quantum random walk in which we add a layer of local sensitive filtering.

show abstract

Advanced Lattice Sieving on GPUs, with Tensor Cores

Ducas

Stevens

Woerden

2021

Lecture Notes in Computer Science

View full text Add to dashboard Cite

In this work, we study GPU implementations of various state-of-the-art sieving algorithms for lattices (Becker-Gama-Joux 2015, Becker-Ducas-Gama-Laarhoven 2016, Herold-Kirshanova 2017) inside the General Sieve Kernel (G6K, . In particular, we extensively exploit the recently introduced Tensor Cores -originally designed for raytracing and machine learning -and demonstrate their fitness for the cryptanalytic task at hand. We also propose a new dual-hash technique for efficient detection of 'lift-worthy' pairs to accelerate a key ingredient of G6K: finding short lifted vectors. We obtain new computational records, reaching dimension 180 for the SVP Darmstadt Challenge improving upon the previous record for dimension 155. This computation ran for 51.6 days on a server with 4 NVIDIA Turing GPUs and 1.5TB of RAM. This corresponds to a gain of about two orders of magnitude over previous records both in terms of wall-clock time and of energy efficiency.

show abstract

Estimating Quantum Speedups for Lattice Sieves

Cited by 27 publications

References 30 publications

Quantum Augmented Dual Attack

Quantum Augmented Dual Attack

Lattice sieving via quantum random walks

Advanced Lattice Sieving on GPUs, with Tensor Cores

Contact Info

Product

Resources

About