Random Sampling Revisited: Lattice Enumeration with Discrete Pruning

Abstract

In 2003, Schnorr introduced Random sampling to find very short lattice vectors, as an alternative to enumeration. An improved variant has been used in the past few years by Kashiwabara et al. to solve the largest Darmstadt SVP challenges. However, the behaviour of random sampling and its variants is not well-understood: all analyses so far rely on a questionable heuristic assumption, namely that the lattice vectors produced by some algorithm are uniformly distributed over certain parallelepipeds. In this paper, we introduce lattice enumeration with discrete pruning, which generalizes random sampling and its variants, and provides a novel geometric description based on partitions of the n-dimensional space. We obtain what is arguably the first sound analysis of random sampling, by showing how discrete pruning can be rigorously analyzed under the well-known Gaussian heuristic, in the same model as the Gama-Nguyen-Regev analysis of pruned enumeration from EUROCRYPT '10, albeit using different tools: we show how to efficiently compute the volume of the intersection of a ball with a box, and to efficiently approximate a large sum of many such volumes, based on statistical inference. Furthermore, we show how to select good parameters for discrete pruning by enumerating integer points in an ellipsoid. Our analysis is backed up by experiments and allows for the first time to reasonably estimate the success probability of random sampling and its variants, and to make comparisons with previous forms of pruned enumeration. Our work unifies random sampling and pruned enumeration and show that they are complementary of each other: both have different characteristics and offer different trade-offs to speed up enumeration.

Lower Bounds on Lattice Enumeration with Extreme Pruning

“…, b n ) of L and a radius R > 0, Enumeration [29,18,15] outputs L ∩ S where S = Ball n (R) by a depth-first tree search: by comparing all the norms of the vectors obtained, one extracts a shortest non-zero lattice vector. We follow the general pruning framework of [5], which replaces S by a subset of S depending on B. Given a function f : {1, .…”

“…This is the situation studied in [5] and corresponds to the use of cylinder pruning in blockwise lattice reduction. By the Gaussian heuristic, the number of points of L ∩ P f (B, R) is heuristically:…”

“…Enumeration is the simplest algorithm to solve hard lattice problems: it outputs L ∩ B, given a lattice L and an n-dimensional ball B ⊆ R n . It dates back to the early 1980s [29,18,15] but has been significantly improved in practice in the past twenty years, thanks to pruning methods introduced by Schnorr et al [34,35,33], and later revisited and generalized as respectively cylinder pruning by Gama, Nguyen and Regev [16] and discrete pruning by Aono and Nguyen [5]: pruning methods offer a trade-off by enumerating over a special subset S ⊆ B, at the expense of missing solutions. Gama et al [16] introduced the idea of extreme pruning where one repeats pruned enumeration many times over different sets S: this can be globally faster than full enumeration, even if a single enumeration has a negligible probability of returning solutions.…”

“…Our lower bounds are specific to cylinder pruning [16]. It would be interesting to obtain tight lower bounds for discrete pruning [5].…”

Shortest Vector from Lattice Sieving: A Few Dimensions for Free

“…It would also be adequate to compare ourselves to the recent discrete-pruning techniques of Fukase and Kashiwabara [FK15,AN17], but again, we lack matching data. We note that neither the analysis of [AN17] nor the experiments of [TKH18] provide evidences that this new method is significantly more efficient than the method of [GNR10].…”