Quantum Algorithms for the Approximate k-List Problem and Their Application to Lattice Sieving

Kirshanova, Elena; Mårtensson, Erik; Postlethwaite, Eamonn W.; Moulik, Subhayan Roy

doi:10.1007/978-3-030-34578-5_19

Cited by 16 publications

(8 citation statements)

References 31 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To this day, the best complexity for sieving in the QRAM model is obtained by quantum hypercone LSF [Laa16] in 2 0.2653d+o(d) time and 2 0.2075d+o(d) space. Another algorithm [KMPM19] uses k-lists to solve SVP in 2 0.2989d+o(d) time and 2 0.1395d+o(d) space.…”

Section: Sieving Algorithmsmentioning

confidence: 99%

“…There has been two more recent works on quantum sieving algorithms. First, quantum variants of the k-sieve were studied in [KMPM19], giving interesting time-space trade-off and a recent article [AGPS20] studied more practical speedups of these quantum algorithms, i.e. when do these gains in the exponent actually translate to quantum speedups.…”

Section: Introductionmentioning

confidence: 99%

“…The SVP challenge can be accessed here https://www.latticechallenge.org/svpchallenge.2 At this stage, there are 3 encryption schemes / key encapsulation mechanisms: KYBER, NTRU and SABER as well as two signature schemes: DILITHIUM and FALCON.3 We are talking here only about the asymptotic running time, there are other metrics of interest that have been covered in[KMPM19,AGPS20] where there were some improvements.…”

mentioning

confidence: 99%

See 2 more Smart Citations

Lattice sieving via quantum random walks

Chailloux¹,

Loyer²

2021

Preprint

View full text Add to dashboard Cite

Lattice-based cryptography is one of the leading proposals for post-quantum cryptography. The Shortest Vector Problem (SVP) is arguably the most important problem for the cryptanalysis of latticebased cryptography, and many lattice-based schemes have security claims based on its hardness. The best quantum algorithm for the SVP is due to Laarhoven [Laa16] and runs in (heuristic) time 2 0.2653d+o(d) . In this article, we present an improvement over Laarhoven's result and present an algorithm that has a (heuristic) running time of 2 0.2570d+o(d) where d is the lattice dimension. We also present time-memory trade-offs where we quantify the amount of quantum memory and quantum random access memory of our algorithm. The core idea is to replace Grover's algorithm used in [Laa16] in a key part of the sieving algorithm by a quantum random walk in which we add a layer of local sensitive filtering.

show abstract

Section: Sieving Algorithmsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

mentioning

confidence: 99%

See 1 more Smart Citation

Lattice sieving via quantum random walks

Chailloux¹,

Loyer²

2021

Preprint

View full text Add to dashboard Cite

show abstract

“…In 2019, Kirshanova et al [41] studied how to use quantum techniques to speed up variants of Tuple Sieve algorithm. They firstly applied Grover's quantum search [33] algorithm to speed up Tuple Sieve algorithm and its variants.…”

Section: H Sieve Algorithms With Quantum Speedupmentioning

confidence: 99%

“…Inspired by SubSieve technique and progressive sieving, in 2019 Albrecht et al [5] proposed the General Sieve Kernel, which is a stateful machine based on sieve algorithms and solved previously unsolved SVP Challenge instances. Moreover, quantum techniques [41], [49] and evolutionary techniques [46] have been used to improve the efficiency of sieve algorithms in recent years.…”

Section: Introductionmentioning

confidence: 99%

A Review of Sieve Algorithms in Solving the Shortest Lattice Vector Problem

Sun

Yan

2020

IEEE Access

View full text Add to dashboard Cite

As a category of algorithms to solve the shortest lattice vector problem, sieve algorithms have drawn more and more attention due to the prominent performance in recent years. Enumeration algorithms used to perform better in practice even though sieve algorithms are asymptotically faster. Combined with techniques like locality-sensitive hashing and rank reduction, sieve algorithms now are capable of competing with enumeration algorithms. In this work, we study sieve algorithms in solving the shortest vector problem on lattices by categorizing various sieve algorithms and elaborating on ideas and techniques used to improve sieve algorithms. In addition, we present several prospective directions worth future research.

show abstract