Rankin’s Constant and Blockwise Lattice Reduction

Abstract

Abstract. Lattice reduction is a hard problem of interest to both publickey cryptography and cryptanalysis. Despite its importance, extremely few algorithms are known. The best algorithm known in high dimension is due to Schnorr, proposed in 1987 as a block generalization of the famous LLL algorithm. This paper deals with Schnorr's algorithm and potential improvements. We prove that Schnorr's algorithm outputs better bases than what was previously known: namely, we decrease all former bounds on Schnorr's approximation factors to their (ln 2)-th power. On the other hand, we also show that the output quality may have intrinsic limitations, even if an improved reduction strategy was used for each block, thereby strengthening recent results by Ajtai. This is done by making a connection between Schnorr's algorithm and a mathematical constant introduced by Rankin more than 50 years ago as a generalization of Hermite's constant. Rankin's constant leads us to introduce the so-called smallest volume problem, a new lattice problem which generalizes the shortest vector problem, and which has applications to blockwise lattice reduction generalizing LLL and Schnorr's algorithm, possibly improving their output quality. Schnorr's algorithm is actually based on an approximation algorithm for the smallest volume problem in low dimension. We obtain a slight improvement over Schnorr's algorithm by presenting a cheaper approximation algorithm for the smallest volume problem, which we call transference reduction.

Algorithms for the Shortest and Closest Lattice Vector Problems

“…Within blocks, one performs HKZ-reductions (or calls to an SVP solver), and blocks are handled in a LLL-manner. This vague description has been instantiated in several precisely analyzed hierarchies of reduction algorithms [74,22,23] and is also the basis of the famous heuristic BKZ algorithm [75] implemented in NTL [77]. The best complexity/quality trade-off currently known [23] allows one to find a basis…”

A Three-Level Sieve Algorithm for the Shortest Vector Problem

“…Up to now, only approximation algorithms, such as [7,8,13,25], are efficient and all known exact algorithms are proven to cost exponential time. However, almost all known approximation algorithms (such as [8,25]) invoke some exact algorithm for solving SVP on some low dimensional lattices to improve the quantity of their outputs.…”

Rigorous and Efficient Short Lattice Vectors Enumeration

“…When k increases, the cost increases as well, but the quality of the bases improves. The recent hierarchies [9,10] achieve better trade-offs but follow the same general strategy. In practice, the Schnorr-Euchner BKZ algorithm [32] seems to be the best, at least for small values of k. The HKZ reduction uses the Kannan-Fincke-Pohst (KFP) enumeration of short lattice vectors [19,8].…”

“…The main reason is that the algorithmic facet of lattice reduction remains mysterious. In particular, the theoretically best algorithms [9,10] seem to remain slower than heuristic ones such as [32], whose practical behaviors are themselves suspicious. Let us discuss NTL's BKZ routine [33] which implements [32] and is the only publicly available such implementation: when the so-called block-size k is around 30, the number of internal calls to SVP in dimension k seems to explode suddenly (although the corresponding quantity decreases with k in the theoretical algorithms); when k increases, BKZ seems to require more precision for the underlying floating-point computations, although the considered bases should become more orthogonal, which implies a better conditioning with respect to numerical computations.…”