Improved Progressive BKZ Algorithms and Their Precise Cost Estimation by Sharp Simulator

Aono, Yoshinori; Wang, Yuntao; Hayashi, Takuya; Takagi, Tsuyoshi

doi:10.1007/978-3-662-49890-3_30

Cited by 78 publications

(56 citation statements)

References 38 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Different methods have been used over the years (see [16,10,7,9]). In this section, we present the method that we used to generate bounding functions that try to minimize the enumeration cost, under the constraint that the success probability is greater than a given p 0 > 0.…”

Section: Efficient Upper Bounds Based On Cross-entropymentioning

confidence: 99%

“…[11,7] for a given basis B, radius R, and target probability p 0 , minimize the cost (5) subject to the constraint that the probability (6) is greater than p 0 . The variables are R 1 , .…”

Section: Our Formulation and Previous Algorithmsmentioning

confidence: 99%

“…A heuristic random perturbation is implemented in the progressive BKZ library [7], and an outline of the cross-entropy method is mentioned in Chen's thesis [10]. 2.…”

Section: Our Formulation and Previous Algorithmsmentioning

confidence: 99%

“…The most sensitive issue is the evaluation of the cost of a subroutine to find shortest or nearly shortest lattice vectors in certain dimensions (typically the blocksize of blockwise reduction algorithms). In state-of-the-art lattice reduction software [11,7,9], this subroutine is implemented by lattice enumeration with extreme pruning, introduced at Eurocrypt '10 by Gama, Nguyen and Regev [16] as a generalization of pruning methods introduced by Schnorr et al [34,35] in the 90s. Yet, most lattice-based…”

Section: Introductionmentioning

confidence: 99%

“…By combining our lower bounds with models of strongly-reduced lattice bases introduced in [26,11,7] and quantum speed-ups for enumeration [6], we obtain more sound comparisons with sieving: see Fig. 1 for an overview.…”

Section: Introductionmentioning

confidence: 99%

See 4 more Smart Citations

Lower Bounds on Lattice Enumeration with Extreme Pruning

Aono

Nguyêñ

Seito

et al. 2018

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

Abstract. At Eurocrypt '10, Gama, Nguyen and Regev introduced lattice enumeration with extreme pruning: this algorithm is implemented in state-of-the-art lattice reduction software and used in challenge records. They showed that extreme pruning provided an exponential speed-up over full enumeration. However, no limit on its efficiency was known, which was problematic for long-term security estimates of lattice-based cryptosystems. We prove the first lower bounds on lattice enumeration with extreme pruning: if the success probability is lower bounded, we can lower bound the global running time taken by extreme pruning. Our results are based on geometric properties of cylinder intersections and some form of isoperimetry. We discuss their impact on lattice security estimates.

show abstract

Section: Efficient Upper Bounds Based On Cross-entropymentioning

confidence: 99%

“…[11,7] for a given basis B, radius R, and target probability p 0 , minimize the cost (5) subject to the constraint that the probability (6) is greater than p 0 . The variables are R 1 , .…”

Section: Our Formulation and Previous Algorithmsmentioning

confidence: 99%

“…A heuristic random perturbation is implemented in the progressive BKZ library [7], and an outline of the cross-entropy method is mentioned in Chen's thesis [10]. 2.…”

Section: Our Formulation and Previous Algorithmsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Lower Bounds on Lattice Enumeration with Extreme Pruning

Aono

Nguyêñ

Seito

et al. 2018

Lecture Notes in Computer Science

Self Cite

View full text Add to dashboard Cite

show abstract

SimAnMo—A parallelized runtime model generator

Burger

Nguyen

Bischof

2021

Concurrency and Computation

View full text Add to dashboard Cite

In this article, we present the novel features of the recent version of SimAnMo, the Simulated Annealing Modeler. The tool creates models that correlate the size of one input parameter of an application to the corresponding runtime and thus SimAnMo allows predictions for larger input sizes. A focus lies on applications whose runtime grows exponentially in the input parameter size. Such programs are, for example, of high interest for cryptanalysis to analyze practical security of traditional and post-quantum secure schemes. However, SimAnMo also generates reliable models for the widespread case of polynomial runtime behavior and also for the important case of factorial runtime increase. SimAnMo's model generation is based on a parallelized simulated annealing procedure and heuristically minimizes the costs of a model. Those may rely on different quality metrics. Insights into SimAnMo's software design and its usage are provided. We demonstrate the quality of SimAnMo's models for different algorithms from various application fields. We show that our approach also works well on ARM architectures.

show abstract