Quantum Lattice Enumeration and Tweaking Discrete Pruning

Abstract

Enumeration is a fundamental lattice algorithm. We show how to speed up enumeration on a quantum computer, which affects the security estimates of several lattice-based submissions to NIST: if T is the number of operations of enumeration, our quantum enumeration runs in roughly √ T operations. This applies to the two most efficient forms of enumeration known in the extreme pruning setting: cylinder pruning but also discrete pruning introduced at Eurocrypt '17. Our results are based on recent quantum tree algorithms by Montanaro and Ambainis-Kokainis. The discrete pruning case requires a crucial tweak: we modify the preprocessing so that the running time can be rigorously proved to be essentially optimal, which was the main open problem in discrete pruning. We also introduce another tweak to solve the more general problem of finding close lattice vectors.

A Parallel Evolutionary Search for Shortest Vector Problem

“…) can be increased up to after each round by (lines 24,25). The rounds of this step continue the evolutionary search (a Genetic Algorithm) until the termination criteria (line 10) be satisfied and break the loop of the generations.…”

Approximate Voronoi cells for lattices, revisited

“…Over time, the practical hardness of SVP and CVP has been quite well studied, with two classes of algorithms emerging as the most competitive: enumeration [5,6,15,16,19,27], running in superexponential time 2 Θ(d log d) in the lattice dimension d (the main security parameter), using a negligible amount of space; and sieving [3,4,13,18,20,26,28], running in only exponential time 2 Θ(d) , but also requiring an amount of memory scaling as 2 Θ(d) . The best asymptotic time complexities for enumeration (d d/2e+o (d) for SVP, d d/2+o(d) for CVP [17]) and sieving ((3/2) d/2+o (d) for both SVP and CVP [7,21]) have remained unchanged since 2007 and 2016 respectively,¹ and recent work has mainly focused on decreasing second-order terms in the time and space complexities [4,5,13,16,22].…”

“…*Corresponding Author: Thijs Laarhoven: Eindhoven University of Technology, Eindhoven, The Netherlands; Email: mail@thijs.com 1 This statement concerns classical complexities; for quantum complexities, see e.g. [6,23]. algorithms for SVP/CVP [12,16,21], faster approximate-SVP algorithms for ideal lattices [30,39], and even faster isogeny-based cryptography [9], a better understanding of the hardness of CVPP is needed.…”

Practical Implementation of a Quantum Backtracking Algorithm

“…Quantum backtracking. In 2017, Ambainis and Kokainis [3] have dealt with Montanaro's algorithm in depth and in 2018, Aono, Nguyen and Shen [4] used these works to speed up the two most efficient forms of enumeration (a lattice algorithm) known. They claim that it affects the security estimates of several lattice-based submissions to the NIST post-quantum standardization process [8].…”