Tensor-based hardness of the shortest vector problem to within almost polynomial factors

Abstract. We prove the equivalence, up to a small polynomial approximation factor n/ log n, of the lattice problems uSVP (unique Shortest Vector Problem), BDD (Bounded Distance Decoding) and GapSVP (the decision version of the Shortest Vector Problem). This resolves a longstanding open problem about the relationship between uSVP and the more standard GapSVP, as well the BDD problem commonly used in coding theory. The main cryptographic application of our work is the proof that the Ajtai-Dwork ([2]) and the Regev ([33]) cryptosystems, which were previously only known to be based on the hardness of uSVP, can be equivalently based on the hardness of worst-case GapSVP O(n 2.5 ) and GapSVP O(n 2 ) , respectively. Also, in the case of uSVP and BDD, our connection is very tight, establishing the equivalence (within a small constant approximation factor) between the two most central problems used in lattice based public key cryptography and coding theory.

show abstract

“…The GapSVP γ problem is NPhard for any constant γ [19,14]. The fastest algorithm for solving GapSVP γ for 1 ≤ γ ≤ poly(n) takes time 2 O(n) [3].…”

Section: Gapsvpmentioning

confidence: 99%

On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem

Lyubashevsky

Micciancio

2009

Lecture Notes in Computer Science

100

View full text Add to dashboard Cite

show abstract

“…In particular an oracle for ρ ≤ c ′ log(n)/ log log(n) would imply an improvement over Karmarkar-Karp's algorithm, where c ′ > 0 is a small enough constant. Again, we would like to stress that the NP-hardness bounds of [HR07] for Shortest Vector do not apply for such lattices where a solution is guaranteed to exist.…”

Section: Contributionmentioning

confidence: 99%

“…The famous LLL-algorithm [LLL82] can find a 2 n/2 -approximation in polynomial time (the generalized block reduction method of Schnorr [Sch87] brings the factor down to 2 n log log(n)/ log(n) ). As a rarity in theoretical computer science, the shortest vector problem admits (NP ∩ coNP)-certificates for a value that is at most a factor O( √ n) away from the optimum [AR05], while the best known hardness lies at a subpolynomial bound of n Θ(1/ log log n) [HR07]. Using the pigeonhole principle one can show that a lattice Λ contains a vector of length at most O( √ n) · det(Λ) 1/n .…”

Section: Introductionmentioning

confidence: 99%

Number Balancing is as Hard as Minkowski’s Theorem and Shortest Vector

Hoberg

Ramadas

Rothvoß

et al. 2017

Integer Programming and Combinatorial Optimization

View full text Add to dashboard Cite

The number balancing (NBP) problem is the following: given real numbers a1, . . . , an ∈ [0, 1], find two disjoint subsets I1, I2 ⊆ [n] so that the difference | i∈I 1 ai − i∈I 2 ai| of their sums is minimized. An application of the pigeonhole principle shows that there is always a solution where the difference is at most O( √ n 2 n ). Finding the minimum, however, is NP-hard. In polynomial time, the differencing algorithm by Karmarkar and Karp from 1982 can produce a solution with difference at most n −Θ(log n) , but no further improvement has been made since then.In this paper, we show a relationship between NBP and Minkowski's Theorem. First we show that an approximate oracle for Minkowski's Theorem gives an approximate NBP oracle. Perhaps more surprisingly, we show that an approximate NBP oracle gives an approximate Minkowski oracle. In particular, we prove that any polynomial time algorithm that guarantees a solution of difference at most 2 √ n /2 n would give a polynomial approximation for Minkowski as well as a polynomial factor approximation algorithm for the Shortest Vector Problem.

show abstract

“…For the hardness of SVP, Ajtai first proved that SVP is NP-hard under a randomized reduction [2] and his result was strengthened in [15] [4][10] [7]. An upper bound for the length of the shortest vector is given in the famous Minkowski Convex Body Theorem.…”

Section: Introductionmentioning

confidence: 99%

Lower bounds of shortest vector lengths in random NTRU lattices

Cheng

2014

Theoretical Computer Science

View full text Add to dashboard Cite

Abstract. Finding the shortest vector of a lattice is one of the most important problems in computational lattice theory. For a random lattice, one can estimate the length of the shortest vector using the Gaussian heuristic. However, no rigorous proof can be provided for some classes of lattices, as the Gaussian heuristic may not hold for them. In this paper, we propose a general method to estimate lower bounds of the shortest vector lengths for random integral lattices in certain classes, which is based on the incompressibility method from the theory of Kolmogorov complexity. As an application, we can prove that for a random NTRU lattice, with an overwhelming probability, the ratio between the length of the shortest vector and the length of the target vector, which corresponds to the secret key, is at least a constant, independent of the rank of the lattice.

show abstract

Tensor-based hardness of the shortest vector problem to within almost polynomial factors

Cited by 81 publications

References 24 publications

On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem

On Bounded Distance Decoding, Unique Shortest Vectors, and the Minimum Distance Problem

Number Balancing is as Hard as Minkowski’s Theorem and Shortest Vector

Lower bounds of shortest vector lengths in random NTRU lattices

Contact Info

Product

Resources

About