Shortest Lattice Vector Research Articles

Compact Instruction Set Extensions for Dilithium

Post-quantum cryptography is considered to provide security against both traditional and quantum computer attacks. Dilithium is a digital signature algorithm that derives its security from the challenge of finding short vectors in lattices. It has been selected as one of the standardizations in the NIST post-quantum cryptography project. Hardware-software co-design is a commonly adopted implementation strategy to address various implementation challenges, including limited resources, high performance, and flexibility requirements. In this study, we investigate using compact instruction set extensions (ISEs) for Dilithium, aiming to improve software efficiency with low hardware overheads. To begin with, we propose tightly coupled accelerators that are deeply integrated into the RISC-V processor. These accelerators target the most computationally demanding components in resource-constrained processors, such as polynomial generation, Number Theoretic Transform (NTT), and modular arithmetic. Next, we design a set of custom instructions that seamlessly integrate with the RISC-V base instruction formats, completing the accelerators in a compact manner. Subsequently, we implement our ISEs in a chip design for the Hummingbird E203 core and conduct performance benchmarks for Dilithium utilizing these ISEs. Additionally, we evaluate the resource consumption of the ISEs on FPGA and ASIC technologies. Compared to the reference software implementation on the RISC-V core, our co-design demonstrates a remarkable speedup factor ranging from 6.95 to 9.96. This significant improvement in performance is achieved by incorporating additional hardware resources, specifically, a 35% increase in LUTs, a 14% increase in FFs, 7 additional DSPs, and no additional RAM. Furthermore, compared to the state-of-the-art approach, our work achieves faster speed performance with a reduced circuit cost. Specifically, the usage of additional LUTs, FFs, and RAMs is reduced by 47.53%, 50.43%, and 100%, respectively. On ASIC technology, our approach demonstrates 12, 412 cell counts. Our co-design provides a better tradeoff implementation on speed performance and circuit overheads.

A Novel Molecular Assembly of a Cobalt-Sulfate Coordination Polymer and Melamine: A Manifestation of Magnetic Anisotropy.

A novel molecular assembly of a cobalt-sulfate coordination polymer and melamine is synthesized under acidic conditions. Bar-shaped pink monocrystals as long as 1 mm are found to align along magnetic field lines in the proximity of a strong magnet. Magnetometry shows no hysteresis at temperatures down to 2 K but instead magnetic anisotropy and antiferromagnetic coupling. X-ray diffraction on a single crystal reveals that the cobalt-sulfate chains are along the shortest lattice vector or the crystal's long axis. The crystal alignment along the magnetic flux can be attributed to single-ion anisotropy that results in longitudinal antiferromagnetic coupling along the chain. Both structurally and magnetically isotropic crystals of metal-organic hybrid materials can be highly useful as elemental components in magneto-optics.

Sieve algorithms for some orthogonal integer lattices

We propose in this work a Sieve algorithm that we called OrthogonalInteger sieve algorithm for some orthogonal integer lattices and particularly the case of integer lattices [Formula: see text], root lattices of type [Formula: see text] ([Formula: see text]) and of type [Formula: see text] ([Formula: see text]). In these cases, we use the famous [Formula: see text] algorithm to find the shortest vector of these lattices. Indeed, in general, a sieve algorithm builds a list of short random vectors which are not necessarily in the lattice, and try to produce short lattice vectors by taking linear combinations of the vectors in the list. But in our case, we built a list of short vectors in the lattice. From the first column of the [Formula: see text]-reduced basis of the considered basis, we have the list of at least [Formula: see text] and at most [Formula: see text] short vectors for the general case (where [Formula: see text] is the dimension of the lattice) of orthogonal integer lattices [Formula: see text] . For the lattices [Formula: see text], [Formula: see text] ([Formula: see text]) and [Formula: see text] ([Formula: see text]), we have, respectively, [Formula: see text], [Formula: see text] and [Formula: see text] short vectors. The proposed sieve algorithm for integer lattice [Formula: see text] runs in space [Formula: see text] and the OrthogonalInteger sieve algorithm performs [Formula: see text] arithmetic operations and is polynomial in space.

On the distribution of angles between increasingly many short lattice vectors

Following Södergren, we consider a collection of random variables on the space Xn of unimodular lattices in dimension n: normalizations of the angles between the N=N(n) shortest vectors in a random unimodular lattice, and the volumes of spheres with radii equal to the lengths of these vectors. We investigate the expected values of certain functions (whose support depends on a parameter K=K(n)) evaluated at these random variables in the regime where K and N are allowed to tend to infinity with n at the rate KN=o(n1/6). Our main result is that as n⟶∞, these random variables exhibit a joint Poissonian and Gaussian behavior.

Analysis of ways to increase stability of cryptographic algorithms on algebraic lattices against time attacks

The aim of this work is to study the algorithms, the stability of which is based on the search for a short lattice vector, as well as to obtain time-resistant parameters of these algorithms. Existing methods for generating keys and choosing parameters for cryptographic transformations on algebraic lattices resistant to time attacks are considered. It is shown that the uniform distribution of coefficients for generating the NTRU algorithm keys has certain shortages, namely, a limited number of parameters suitable for use in cryptographical transformations. This is due to the vulnerability of this algorithm to time attacks. The possibility of using a discrete normal (Gaussian) distribution to form a key pair, which will prevent the sensitivity of the algorithm to time attacks, is considered. This method of generation requires checking the obtained sample for compliance with the properties of the normal distribution. The usage of SAGA tests has been proposed. They make it possible to check the Gaussian samples obtained using the discrete normal distribution. The verification result shows whether or not the sample has properties that are inherent in the normal distribution. The application of the SAGA statistical tests to the NTRU cryptographic transformation polynomials allowed us to conclude that the discrete Gaussian sample makes it possible to generate time-resistant parameters using the norm or the length of the short basis (vector) of the lattice as the mean-square deviation.

Mildly Short Vectors in Cyclotomic Ideal Lattices in Quantum Polynomial Time

In this article, we study the geometry of units and ideals of cyclotomic rings and derive an algorithm to find a mildly short vector in any given cyclotomic ideal lattice in quantum polynomial time, under some plausible number-theoretic assumptions. More precisely, given an ideal lattice of the cyclotomic ring of conductor m , the algorithm finds an approximation of the shortest vector by a factor exp (Õ(√ m )). This result exposes an unexpected hardness gap between these structured lattices and general lattices: The best known polynomial time generic lattice algorithms can only reach an approximation factor exp (Õ(m)). Following a recent series of attacks, these results call into question the hardness of various problems over structured lattices, such as Ideal-SVP and Ring-LWE, upon which relies the security of a number of cryptographic schemes. N OTE . This article is an extended version of a conference paper [11]. The results are generalized to arbitrary cyclotomic fields. In particular, we also extend some results of Reference [10] to arbitrary cyclotomic fields. In addition, we prove the numerical stability of the method of Reference [10]. These extended results appeared in the Ph.D. dissertation of the third author [46].

Isolating a Vertex via Lattices: Polytopes with Totally Unimodular Faces

Related DatabasesWeb of Science You must be logged in with an active subscription to view this.Article DataHistorySubmitted: 21 October 2019Accepted: 11 January 2021Published online: 08 April 2021Keywordsisolation lemma, derandomization, totally unimodular, short lattice vectors, regular matroids, box-TDI polytopesAMS Subject Headings68Q87, 90C27, 90C57, 05B35Publication DataISSN (print): 0097-5397ISSN (online): 1095-7111Publisher: Society for Industrial and Applied MathematicsCODEN: smjcat

Self-dual DeepBKZ for finding short lattice vectors

AbstractIn recent years, the block Korkine-Zolotarev (BKZ) and its variants such as BKZ 2.0 have been used as de facto algorithms to estimate the security of a lattice-based cryptosystem. In 2017, DeepBKZ was proposed as a mathematical improvement of BKZ, which calls LLL with deep insertions (DeepLLL) as a subroutine alternative to LLL. DeepBKZ can find a short lattice vector by smaller blocksizes than BKZ. In this paper, we develop a self-dual variant of DeepBKZ, as in the work of Micciancio and Walter for self-dual BKZ. Like DeepBKZ, our self-dual DeepBKZ calls both DeepLLL and its dual variant as main subroutines in order to accelerate to find a very short lattice vector. We also report experimental results of DeepBKZ and our self-dual DeepBKZ for random bases on the Darmstadt SVP challenge.

Analysis of DeepBKZ reduction for finding short lattice vectors

Lattice basis reduction is a mandatory tool for solving lattice problems such as the shortest vector problem. The Lenstra–Lenstra–Lovasz reduction algorithm (LLL) is the most famous, and its typical improvements are the block Korkine–Zolotarev algorithm and LLL with deep insertions (DeepLLL), both proposed by Schnorr and Euchner. In BKZ with blocksize $$\beta $$ , LLL is called many times to reduce a lattice basis before enumeration to find a shortest non-zero vector in every block lattice of dimension $$\beta $$ . Recently, “DeepBKZ” was proposed as a mathematical improvement of BKZ, in which DeepLLL is called as a subroutine alternative to LLL. In this paper, we analyze the output quality of DeepBKZ in both theory and practice. Specifically, we give provable upper bounds specific to DeepBKZ. We also develop “DeepBKZ 2.0”, an improvement of DeepBKZ like BKZ 2.0, and show experimental results that it finds shorter lattice vectors than BKZ 2.0 in practice.

Meta-heuristic approaches to solve shortest lattice vector problem

We present the aptness of population based meta-heuristic approaches to compute a shortest non-zero vector in a lattice for solving the Shortest lattice Vector Problem (SVP). This problem has a great many applications such as optimization, communication theory, cryptography, etc. At the same time, SVP is notoriously hard to predict, both in terms of running time and output quality. The SVP is known to be NP-hard under randomized reduction and there is no polynomial time solution for this problem. Though LLL algorithm is a polynomial time algorithm, it does not give the optimal solutions. In this paper, we present the application of Particle Swarm Optimization (PSO) and Genetic Algorithm (GA) to solve the SVP on an appropriate search space. We have implemented the PSO, GA and LLL algorithm for the SVP. The comparison results shows that our algorithm works for all instances.

Worst case short lattice vector enumeration on block reduced bases of arbitrary blocksizes

In ICITS 2015, Walter studied the worst case computational cost to enumerate short lattice vectors on two well-known block reduced bases, i.e., BKZ reduced bases and slide reduced bases. Until then, existing works analyzed only extreme preprocessed bases, e.g., LLL reduced bases that are the weakest ones and quasi-HKZ reduced bases that are the strongest ones; hence, Walter tried to interpolate these results. For this purpose, Walter tried to calculate enumeration cost on block reduced bases of arbitrary blocksizes. The topic should be theoretically interesting since hardness of the lattice problem relates to the security of lattice-based cryptography. In this paper, we revisit the problem with refined analyses. For both BKZ and slide reduced bases, we show that the worst case enumeration costs are smaller than Walter’s analyses. In particular, we show that our results are the best possible ones when we follow Walter’s approach. Furthermore, we extend Walter’s result for slide reduced bases. Since Walter only studied the original slide reduced bases proposed by Gama and Nguyen, he did not analyze arbitrary blocksizes. To extend the analyses to arbitrary blocksizes, we use the generalized slide reduction that was defined by Li and Wei. As a side contribution, we also show that the worst case behaviors of the generalized slide reduced bases are better than Li and Wei’s analyses. We obtain all these results by exploiting better geometric properties of block reduced bases.

Minimal condition for shortest vectors in lattices of low dimension

For a lattice, finding a nonzero shortest vector is computationally difficult in general. The problem becomes quite complicated even when the dimension of the lattice is five. There are two related notions of reduced bases, say, Minkowski-reduced basis and greedy-reduced basis. When the dimension becomes d = 5, there are greedy-reduced bases without achieving the first minimum while any Minkowski-reduced basis contains the shortest four linearly independent vectors. This suggests that the notion of Minkowski-reduced basis is somewhat strong and the notion of greedy-reduced basis is too weak for a basis to achieve the first minimum of the lattice. In this work, we investigate a more appropriate condition for a basis to achieve the first minimum for d = 5. We present a minimal sufficient condition, APG+, for a five dimensional lattice basis to achieve the first minimum in the sense that any proper subset of the required inequalities is not sufficient to achieve the first minimum.

An Efficient Algorithm for the Shortest Vector Problem

Lattice is widely used in cryptography since it has potential for defending quantum attacks. One of the significant problems in such cryptography is the shortest vector problem (SVP). This problem is to find the non-zero shortest vector in lattice. The SVP is an NP-hard problem under randomized reductions proven by Ajtai, and many cryptosystems are secure under the assumption that SVP is hard, such as NTRU. On the other hand, some primitives of lattice-based cryptography require relatively short vectors. In this paper, we propose a new SVP algorithm that can be performed in time complexity $O(n^{3})$ . We also prove that the Hermite factor of the proposed algorithm is polynomial-bounded.

Analysis of decreasing squared-sum of Gram–Schmidt lengths for short lattice vectors

Abstract In 2015, Fukase and Kashiwabara proposed an efficient method to find a very short lattice vector. Their method has been applied to solve Darmstadt shortest vector problems of dimensions 134 to 150. Their method is based on Schnorr’s random sampling, but their preprocessing is different from others. It aims to decrease the sum of the squared lengths of the Gram–Schmidt vectors of a lattice basis, before executing random sampling of short lattice vectors. The effect is substantiated from their statistical analysis, and it implies that the smaller the sum becomes, the shorter sampled vectors can be. However, no guarantee is known to strictly decrease the sum. In this paper, we study Fukase–Kashiwabara’s method in both theory and practice, and give a heuristic but practical condition that the sum is strictly decreased. We believe that our condition would enable one to monotonically decrease the sum and to find a very short lattice vector in fewer steps.

Sieving for shortest vectors in ideal lattices: a practical perspective

The security of many lattice-based cryptographic schemes relies on the hardness of finding short vectors in integral lattices. We propose a new variant of the parallel Gauss sieve algorithm to compute such short vectors. It combines favourable properties of previous approaches resulting in reduced run time and memory requirement per node. Our publicly available implementation outperforms all previous Gauss sieve approaches for dimensions 80, 88, and 96. When computing short vectors in ideal lattices, we show how to reduce the number of multiplications and comparisons by using a symbolic Fourier transform. We computed a short vector in a negacyclic ideal lattice of dimension 128 in less than nine days on 1,024 cores, more than twice as fast as the recent record computation for the same lattice on the same computer hardware.

Sieving for shortest vectors in ideal lattices: a practical perspective

The security of many lattice-based cryptographic schemes relies on the hardness of finding short vectors in integral lattices. We propose a new variant of the parallel Gauss sieve algorithm to compute such short vectors. It combines favorable properties of previous approaches resulting in reduced run time and memory requirement per node. Our publicly available implementation outperforms all previous Gauss sieve approaches for dimensions 80, 88, and 96. When computing short vectors in ideal lattices, we show how to reduce the number of multiplications and comparisons by using a symbolic Fourier transform. We computed a short vector in a negacyclic ideal lattice of dimension 128 in less than nine days on 1024 cores, more than twice as fast as the recent record computation for the same lattice on the same computer hardware.

Bounds for the traveling salesman paths of two-dimensional modular lattices

We present tight upper and lower bounds for the traveling salesman path through the points of two-dimensional modular lattices. We use these results to bound the traveling salesman path of two-dimensional Kronecker point sets. Our results rely on earlier work on shortest vectors in lattices as well as on the strong convergence of Jacobi---Perron type algorithms.

A note on short vectors in lattices from function fields

We discuss some properties of the lattices Λ which are associated to function fields over finite fields. In particular we are interested in the lattice vectors of minimum length in Λ and in the sublattice Δ⊆Λ which is generated by these vectors. In the literature, one finds several examples of function fields where Δ and Λ have the same rank (well-rounded lattices). In this paper we construct some interesting classes of function fields with rank(Δ)<rank(Λ).

SLIDE REDUCTION, SUCCESSIVE MINIMA AND SEVERAL APPLICATIONS

AbstractGama and Nguyen [‘Finding short lattice vectors within Mordell’s inequality’, in: Proceedings of the 40th Annual ACM Symposium on Theory of Computing, New York, 2008, 257–278] have presented slide reduction which is currently the best SVP approximation algorithm in theory. In this paper, we prove the upper and lower bounds for the ratios $\Vert { \mathbf{b} }_{i}^{\ast } \Vert / {\lambda }_{i} (\mathbf{L} )$ and $\Vert {\mathbf{b} }_{i} \Vert / {\lambda }_{i} (\mathbf{L} )$, where ${\mathbf{b} }_{1} , \ldots , {\mathbf{b} }_{n} $ is a slide reduced basis and ${\lambda }_{1} (\mathbf{L} ), \ldots , {\lambda }_{n} (\mathbf{L} )$ denote the successive minima of the lattice $\mathbf{L} $. We define generalised slide reduction and use slide reduction to approximate $i$-SIVP, SMP and CVP. We also present a critical slide reduced basis for blocksize 2.

On the distribution of angles between the N shortest vectors in a random lattice

We determine the joint distribution of the lengths of, and angles between, the N shortest lattice vectors in a random n-dimensional lattice as n tends to infinity. Moreover we interpret the result in terms of eigenvalues and eigenfunctions of the Laplacian on flat tori. Finally we discuss the limit distribution of any finite number of successive minima of a random n-dimensional lattice as n tends to infinity.