Faster Enumeration-Based Lattice Reduction: Root Hermite Factor $$k^{1/(2k)}$$ Time $$k^{k/8+o(k)}$$

Albrecht, M.; Bai, Shi; Fouque, Pierre-Alain; Kirchner, Paul; Stehlé, Damien; Wen, Weiqiang

doi:10.1007/978-3-030-56880-1_7

Cited by 22 publications

(11 citation statements)

References 28 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…The former includes the family of so-called enumeration algorithms [93,94] that run in time 2 Θ(n lg n) . Recent result of Albrecht et al [95] shows the runtime exponent of 1 8 n lg n þ oðn lg nÞ beating the longstanding exponent 1 2e n lg n þ oðn lg nÞ from Ref. [86].…”

Section: Algorithms For Svpmentioning

confidence: 96%

“…. Using a more involved preprocessing and tricks [95], one can further improve the runtime exponent to the currently best known In order to set up the radius R, one can, for instance, use Minkowski's upper bound on λ 1 . Such enumeration is rather costly, and one can hope that the projection of the shortest vector might be shorter than λ 1 .…”

Section: Classical Enumerationmentioning

confidence: 99%

See 1 more Smart Citation

Quantum algorithms for attacking hardness assumptions in classical and post‐quantum cryptography

Biasse

Bonnetain

Kirshanova

et al. 2022

IET Information Security

View full text Add to dashboard Cite

In this survey, the authors review the main quantum algorithms for solving the computational problems that serve as hardness assumptions for cryptosystem. To this end, the authors consider both the currently most widely used classically secure cryptosystems, and the most promising candidates for post‐quantum secure cryptosystems. The authors provide details on the cost of the quantum algorithms presented in this survey. The authors furthermore discuss ongoing research directions that can impact quantum cryptanalysis in the future.

show abstract

Section: Algorithms For Svpmentioning

confidence: 96%

Section: Classical Enumerationmentioning

confidence: 99%

Quantum algorithms for attacking hardness assumptions in classical and post‐quantum cryptography

Biasse

Bonnetain

Kirshanova

et al. 2022

IET Information Security

View full text Add to dashboard Cite

show abstract

“…There are two types of lattice reduction algorithms that may be used to implement the SVP "oracle," enumeration and sieving. Enumeration algorithms (see, for example, [296][297][298][299][300]) require small amounts of memory but have run times that are super-exponential in β . Sieving algorithms (see, for example [301][302][303]) have run times that are exponential in β , but also require an exponential amount of memory.…”

Section: On the Concrete Intractability Of Finding Short Lattice Vectorsmentioning

confidence: 99%

Status report on the third round of the NIST Post-Quantum Cryptography Standardization process

Moody¹

2022

144

View full text Add to dashboard Cite

The National Institute of Standards and Technology is in the process of selecting public-key cryptographic algorithms through a public, competition-like process. The new public-key cryptography standards will specify additional digital signature, public-key encryption, and key-establishment algorithms to augment Federal Information Processing Standard (FIPS) 186-4, Digital Signature Standard (DSS), as well as NIST Special Publication (SP) 800-56A Revision 3, Recommendation for Pair-Wise Key-Establishment Schemes Using Discrete Logarithm Cryptography, and SP 800-56B Revision 2, Recommendation for Pair-Wise Key Establishment Using Integer Factorization Cryptography. It is intended that these algorithms will be capable of protecting sensitive information well into the foreseeable future, including after the advent of quantum computers. The first round of the NIST Post-Quantum Cryptography Standardization Process began in December 2017 with 69 candidate algorithms that met both the minimum acceptance criteria and submission requirements. The first round lasted until January 2019, during which candidate algorithms were evaluated based on their security, performance, and other characteristics. NIST selected 26 algorithms to advance to the second round for more analysis. The second round continued until July 2020, after which seven 'finalist' and eight 'alternate' candidate algorithms were selected to move into the third round. This report describes the evaluation and selection process, based on public feedback and internal review, of the third-round candidates. The report summarizes each of the 15 third-round candidate algorithms and identifies those selected for standardization, as well as those that will continue to be evaluated in a fourth round of analysis. The public-key encryption and key-establishment algorithm that will be standardized is CRYSTALS-Kyber. The digital signatures that will be standardized are CRYSTALS-Dilithium, Falcon, and SPHINCS+. While there are multiple signature algorithms selected, NIST recommends CRYSTALS-Dilithium as the primary algorithm to be implemented. In addition, four of the alternate key-establishment candidate algorithms will advance to a fourth round of evaluation: BIKE, Classic McEliece, HQC, and SIKE. These candidates are still being considered for future standardization. NIST will also issue a new Call for Proposals for public-key digital signature algorithms to augment and diversify its signature portfolio.

show abstract

“…Another part of the original paper [70, Section 6.3], and almost all follow-ups [24,25,22,15,21,23], consider however security against adversaries able to do 2 λ operations. However, the condition was copied without change, which possibly explains why a large α was chosen in several implementations 5 .…”

Section: Typementioning

confidence: 99%

“…Since lattice-based cryptography is becoming a strong contender for post-quantum cryptography and offers many interesting functionalities to cryptography, such as efficient Fully Homomorphic Encryption (fhe), new algorithms and implementations of lattice reduction have been designed to give better security estimate for latticebased cryptography. Some improvements mainly target the bkz algorithm since it allows to finely adjust the approximation factor [29,30,35,14,53,5]. Others are heuristic and improve sieving technique for solving svp, use a reduction technique in the lattice dimension [6], exploit subfield structure and symmetries in structured lattices [60,41], or use the tensor core architecture of GPU [26].…”

Section: Introductionmentioning

confidence: 99%

Towards Faster Polynomial-Time Lattice Reduction

Kirchner

Espitau

Fouque

2021

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

The lll algorithm is a polynomial-time algorithm for reducing d-dimensional lattice with exponential approximation factor. Currently, the most efficient variant of lll, by Neumaier and Stehlé, has a theoretical running time in d 4 •B 1+o(1) where B is the bitlength of the entries, but has never been implemented. This work introduces new asymptotically fast, parallel, yet heuristic, reduction algorithms with their optimized implementations. Our algorithms are recursive and fully exploit fast matrix multiplication. We experimentally demonstrate that by carefully controlling the floating-point precision during the recursion steps, we can reduce euclidean lattices of rank d in time Õ(d ω • C), i.e., almost a constant number of matrix multiplications, where ω is the exponent of matrix multiplication and C is the log of the condition number of the matrix. For cryptographic applications, C is close to B, while it can be up to d times larger in the worst case. It improves the running-time of the state-of-the-art implementation fplll by a multiplicative factor of order d 2 • B. Further, we show that we can reduce structured lattices, the socalled knapsack lattices, in time Õ(d ω−1 •C) with a progressive reduction strategy. Besides allowing reducing huge lattices, our implementation can break several instances of Fully Homomorphic Encryption schemes based on large integers in dimension 2,230 with 4 millions of bits.

show abstract

Faster Enumeration-Based Lattice Reduction: Root Hermite Factor $$k^{1/(2k)}$$ Time $$k^{k/8+o(k)}$$

Cited by 22 publications

References 28 publications

Quantum algorithms for attacking hardness assumptions in classical and post‐quantum cryptography

Quantum algorithms for attacking hardness assumptions in classical and post‐quantum cryptography

Status report on the third round of the NIST Post-Quantum Cryptography Standardization process

Towards Faster Polynomial-Time Lattice Reduction

Contact Info

Product

Resources

About