Lattice Vector Problem Research Articles

Lattice Enumeration with Discrete Pruning: Improvements, Cost Estimation and Optimal Parameters

Lattice enumeration is a linear-space algorithm for solving the shortest lattice vector problem (SVP). Extreme pruning is a practical technique for accelerating lattice enumeration, which has a mature theoretical analysis and practical implementation. However, these works have yet to be applied to discrete pruning. In this paper, we improve the discrete pruned enumeration (DP enumeration) and provide a solution to the problem proposed by Léo Ducas and Damien Stehlé regarding the cost estimation of discrete pruning. We first rectify the randomness assumption to more precisely describe the lattice point distribution of DP enumeration. Then, we propose a series of improvements, including a new polynomial-time binary search algorithm for cell enumeration radius, a refined cell-decoding algorithm and a rerandomization and reprocessing strategy, all aiming to lift the efficiency and build a more precise cost-estimation model for DP enumeration. Based on these theoretical and practical improvements, we build a precise cost-estimation model for DP enumeration by simulation, which has good accuracy in experiments. This DP simulator enables us to propose an optimization method of calculating the optimal parameters of DP enumeration to minimize the running time. The experimental results and asymptotic analysis both show that the discrete pruning method could outperform extreme pruning, which means that our optimized DP enumeration might become the most efficient polynomial-space SVP solver to date. An open-source implementation of DP enumeration with its simulator is also provided.

Application of Discrete Pruned Enumeration in Solving BDD

The bounded distance decoding (BDD) is a fundamental problem in lattice-based cryptography which is derived from the closest vector problem (CVP). In this paper, we adapt the lattice enumeration with discrete pruning, a burgeoning method for the shortest lattice vector problem (SVP), to solve BDD in various cryptanalysis scenarios using direct method. We first transfer the basic definition involved in discrete pruning technique from SVP to CVP, prove corresponding properties and give the specific procedures of the algorithm. Additionally, we use the discrete pruning technique to interpret the classical CVP algorithms, including Babai’s nearest plane and Lindner–Peikert nearest planes, which can be regarded as discrete pruned enumeration on some special pruning sets. We propose three probability models in the runtime analysis to accurately estimate the cost of our algorithm in different application scenarios. We study the application of discrete pruned enumeration for BDD mainly on LWE-based cryptosystem and DSA with partially known nonces. The experimental results show that our new algorithm has higher efficiency than the previous algorithms which directly solve BDD, including the nearest plane(s) algorithms and the lattice enumeration with classical pruning strategies, and we are able to recover the DSA secret with less leaked information than the previous works.

Long Prediction Horizon FCS-MPC for Power Converters and Drives

Finite control set model predictive control (FCS-MPC) is a salient control method for power conversion systems that has recently enjoyed remarkable popularity. Several studies highlight the performance benefits that long prediction horizons achieve in terms of closed-loop stability, harmonic distortions, and switching losses. However, the practical implementation is not straightforward due to its inherently high computational burden. To overcome this obstacle, the control problem can be formulated as an integer least-squares optimization problem, which is equivalent to the closest point search or closest vector problem in lattices. Different techniques have been proposed in the literature to solve it, with the sphere decoding algorithm (SDA) standing out as the most popular choice to address the long prediction horizon FCS-MPC. However, the state of the art in this field offers solutions beyond the conventional SDA that will be described in this article alongside future trends and challenges in the topic.

Minimizing Convex Functions with Rational Minimizers

Given a separation oracle SO for a convex function f defined on ℝ n that has an integral minimizer inside a box with radius R , we show how to find an exact minimizer of f using at most O(n (n log log (n)/ log (n) + log ( R ))) calls to SO and poly ( n , log ( R )) arithmetic operations, or O(n log (nR) calls to SO and exp ( O(n) ) ⋅ poly (log (R) ) arithmetic operations. When the set of minimizers of f has integral extreme points, our algorithm outputs an integral minimizer of f . This improves upon the previously best oracle complexity of O(n 2 ( n + log ( R ))) for polynomial time algorithms and O(n 2 log ( nR ) for exponential time algorithms obtained by [Grötschel, Lovász and Schrijver, Prog. Comb. Opt. 1984, Springer 1988] over thirty years ago. Our improvement on Grötschel, Lovász and Schrijver’s result generalizes to the setting where the set of minimizers of f is a rational polyhedron with bounded vertex complexity. For the Submodular Function Minimization problem, our result immediately implies a strongly polynomial algorithm that makes at most O(n 3 log log ( n )/log ( n )) calls to an evaluation oracle, and an exponential time algorithm that makes at most O(n 2 log ( n )) calls to an evaluation oracle. These improve upon the previously best O(n 3 log 2 ( n )) oracle complexity for strongly polynomial algorithms given in [Lee, Sidford and Wong, FOCS 2015] and [Dadush, Végh and Zambelli, SODA 2018], and an exponential time algorithm with oracle complexity O(n 3 log ( n )) given in the former work. Our result is achieved via a reduction to the Shortest Vector Problem in lattices. We show how an approximately shortest vector of an auxiliary lattice can be used to effectively reduce the dimension of the problem. Our analysis of the oracle complexity is based on a potential function that simultaneously captures the size of the search set and the density of the lattice, which we analyze via tools from convex geometry and lattice theory.

Approximate CVPp in time 20.802n

We show that a constant factor approximation of the shortest and closest lattice vector problem in any ℓp-norm can be computed in time 2(0.802+ε)n. This matches the currently fastest constant factor approximation algorithm for the shortest vector problem in the ℓ2 norm. To obtain our result, we combine the latter algorithm for ℓ2 with geometric insights related to coverings.

Lattice Attacks on NTRU Revisited

NTRU cryptosystem was proposed by J. Hoffstein, J.Pipher and J.H. Silverman in 1996, whose security is related to the hardness of finding sufficient short vectors in NTRU lattice with dimension $2N$ . Many researchers conjecture that the private key vector is indeed the shortest vector in the lattice in most cases. However, no formal proof has been provided in the literature before to the best of our knowledge. In this paper, we revisit the lattice attack on NTRU and present a new dimension reduction attack on NTRU without considering the pattern of private polynomials. More precisely, we show that one can recover a group of equivalent private keys by solving shortest vector problem in a new dimension-reduced lattice with dimension $N+k, k , where $k$ is related to the specific parameters selected. As a corollary of our attack, we prove that the private key vector and its rotations are the shortest vectors of the original NTRU lattice with an overwhelming probability, which confirms the conjecture of the length of the shortest vector of the original NTRU lattice.

A Review of Sieve Algorithms in Solving the Shortest Lattice Vector Problem

As a category of algorithms to solve the shortest lattice vector problem, sieve algorithms have drawn more and more attention due to the prominent performance in recent years. Enumeration algorithms used to perform better in practice even though sieve algorithms are asymptotically faster. Combined with techniques like locality-sensitive hashing and rank reduction, sieve algorithms now are capable of competing with enumeration algorithms. In this work, we study sieve algorithms in solving the shortest vector problem on lattices by categorizing various sieve algorithms and elaborating on ideas and techniques used to improve sieve algorithms. In addition, we present several prospective directions worth future research.

Meta-heuristic approaches to solve shortest lattice vector problem

We present the aptness of population based meta-heuristic approaches to compute a shortest non-zero vector in a lattice for solving the Shortest lattice Vector Problem (SVP). This problem has a great many applications such as optimization, communication theory, cryptography, etc. At the same time, SVP is notoriously hard to predict, both in terms of running time and output quality. The SVP is known to be NP-hard under randomized reduction and there is no polynomial time solution for this problem. Though LLL algorithm is a polynomial time algorithm, it does not give the optimal solutions. In this paper, we present the application of Particle Swarm Optimization (PSO) and Genetic Algorithm (GA) to solve the SVP on an appropriate search space. We have implemented the PSO, GA and LLL algorithm for the SVP. The comparison results shows that our algorithm works for all instances.

The closest vector problem in tensored root lattices of type A and in their duals

In this work we consider the closest vector problem (CVP)—a problem also known as maximum-likelihood decoding—in the tensor of two root lattices of type A ((Formula presented.)), as well as in their duals ((Formula presented.)). This problem is mainly motivated by lattice based cryptography, where the cyclotomic rings (Formula presented.) (resp. its co-different (Formula presented.)) play a central role, and turn out to be isomorphic as lattices to tensors of (Formula presented.) lattices (resp. A root lattices). In particular, our results lead to solving CVP in (Formula presented.) and in (Formula presented.) for conductors of the form (Formula presented.) for any two odd primes p, q. For the primal case (Formula presented.), we provide a full characterization of the Voronoi region in terms of simple cycles in the complete directed bipartite graph (Formula presented.). This leads—relying on the Bellman-Ford algorithm for negative cycle detection—to a CVP algorithm running in polynomial time. Precisely, our algorithm performs (Formula presented.) operations on reals, where l is the number of bits per coordinate of the input target. For the dual case, we use a gluing-construction to solve CVP in sub-exponential time (Formula presented.).

Binomial ideal associated to a lattice and its label code

In coding theory the study of the binomial ideal derived from an arbitrary code is currently of great interest; see for example [5]. This is mainly because of a known relation between binomial ideals and lattices or codes. Also, studying the relation between binomial ideals associated to a lattice and its label code helps to solve the closest vector problem in lattices as well as decoding binary and non-binary codes [1, 3] and finding a label code of a lattice, as we do in this work. Every lattice Λ can be described in terms of a label code L and an orthogonal sublattice Λ′ such that Λ/Λ′ ∼= L [2]. We assign binomial ideals IΛ and IL to an integer lattice Λ and its label code L, respectively. In this work, we identify the binomial ideal associated to an integer lattice and then establish the relation IΛ = IΛ′ + IL between the ideal of the lattice and its label code. In this work, we define a binomial ideal for an integer lattice and its label code slightly different from [1, 3, 4, 7]. Let K[X] = K[x1, . . . , xn] denote the polynomial ring, where K is an arbitrary field. Consider ≺ as a fixed total degree compatible term order with x1 x2 · · · xn. The monomials in K[X] are denoted by X = x1 1 . . . x bn n where b = (b1, . . . , bn) is an element of N0 and N0 is the set of non-negative integers. We use the notation

Tightly Secure Signatures From Lossy Identification Schemes

In this paper, we present three digital signature schemes with tight security reductions in the random oracle model. Our first signature scheme is a particularly efficient version of the short exponent discrete log-based scheme of Girault et al. (J Cryptol 19(4):463---487, 2006). Our scheme has a tight reduction to the decisional short discrete logarithm problem, while still maintaining the non-tight reduction to the computational version of the problem upon which the original scheme of Girault et al. is based. The second signature scheme we construct is a modification of the scheme of Lyubashevsky (Advances in Cryptology--ASIACRYPT 2009, vol 5912 of Lecture Notes in Computer Science, pp 598---616, Tokyo, Japan, December 6---10, 2009. Springer, Berlin, 2009) that is based on the worst-case hardness of the shortest vector problem in ideal lattices. And the third scheme is a very simple signature scheme that is based directly on the hardness of the subset sum problem. We also present a general transformation that converts what we term $$lossy $$lossy identification schemes into signature schemes with tight security reductions. We believe that this greatly simplifies the task of constructing and proving the security of such signature schemes.

Point Multiplication using Integer Sub-Decomposition for Elliptic Curve Cryptography

In this work, we proposed a new approach called integer sub-decomposition (ISD) based on the GLV idea to compute any multiple kP of a point P of order n lying on an elliptic curve E. This approach uses two fast endomorphisms ψ1 and ψ2 of E over prime field Fp to calculate kP. The basic idea of ISD method is to sub-decompose the returned values k1 and k2 lying outside the range p n from the GLV decomposition of a multiplier k into integers k11, k12, k21 and k22 with − p n < k11, k12, k21, k22 < p n. These integers are computed by solving a closest vector problem in lattice. The new proposed algorithms and implementation results are shown and discussed in this study.

ANALYSIS ON THE ELLIPTIC SCALAR MULTIPLICATION USING INTEGER SUB-DECOMPOSITION METHOD

Abstract: This study proposes a new approach called, integer sub-decomposition (ISD), to compute any multiple kP of a point P of order n lying on an elliptic curve. Our method depends, in computations, on fast endomorphisms ψ1 and ψ2 of elliptic curve over prime fields. The integer sub-decomposition to multiple kP , when the value of k is decomposed into two values k1 and k2, where both values or one of them is not bounded by ±C √n, is illustrated in the following formula: kP = k11P + k12[λ1]P + k21P + k22[λ2]P = k11P + k12ψ1(P ) + k21P + k22ψ2(P ). where −C√n < k11, k12, k21, k22 < C √ n. The integers k11, k12, k21 and k22 are computed by solving a closest vector problem in lattice. Consequently, as for this sub-decomposition, we have managed to increase the percentage of a successful computation of kP . Moreover, the gap in the proof of the bound of kernel K vectors of the reduction map T : (a, b) → a + λb(mod n) on ISD method will be filled through the analysis of the multiplier k, using two fast endomorphisms with minimal polynomials X2 + rXi + si for i = 1, 2, 3. In particular, we prove an integer sub-decomposition (ISD) with explicit constant

Fully Homomorphic Encryption, Approximate Lattice Problem and LWE

In this paper, we first introduce a new concept of approximate lattice problem (ALP), which is an extension of learning with errors (LWE). Next, we propose two ALP-based public key encryption schemes. Then, we construct two new fully homomorphic encryption scheme (FHE) based on respectively approximate principal ideal lattice problem with related modulus (APIP-RM) and approximate lattice problem with related modulus (ALP-RM). Moreover, we also extend our ALP-RM-based FHE to the ALP problem with unrelated modulus (ALP-UM). Our work is different from previous works in three aspects: (1) We extend the LWE problem to the ALP problem. This ALP problem is similar to the closest vector problem in lattice. We believe that this problem is independent of interest. (2) We construct a new FHE by using a re-randomizing method, which is different from the squashing decryption in previous works. (3) The expansion rate is merely O( k ) with k a security parameter in Our FHE, which can be improved to O(log k ) by using dimension reduction [BV11], whereas all previous schemes are at least O( k* log k ) [BV11, Gen11, LNV11]. Our method can also decrease a factor k of the expansion rate in their schemes.

Convex minization over [formula omitted

We present an algorithm for minimizing a convex function over all integer vectors in the plane. This problem generalizes both the nearest lattice vector problem and the integer programming problem in the plane.

Bounding the sum of square roots via lattice reduction

Let $k$ and $n$ be positive integers. Define $R(n,k)$ to be the minimum positive value of $$ | e_i \sqrt{s_1} + e_2 \sqrt{s_2} + ... + e_k \sqrt{s_k} -t | $$ where $ s_1, s_2, ..., s_k$ are positive integers no larger than $n$, $t$ is an integer and $e_i\in \{1,0, -1\}$ for all $1\leq i\leq k$. It is important in computational geometry to determine a good lower and upper bound of $ R(n,k)$. In this paper we show that this problem is closely related to the shortest vector problem in certain integral lattices and present an algorithm to find lower bounds based on lattice reduction algorithms. Although we can only prove an exponential time upper bound for the algorithm, it is efficient for large $k$ when an exhaustive search for the minimum value is clearly infeasible. It produces lower bounds much better than the root separation technique does. Based on numerical data, we formulate a conjecture on the length of the shortest nonzero vector in the lattice, whose validation implies that our algorithm runs in polynomial time and the problem of comparing two sums of square roots of small integers can be solved in polynomial time. As a side result, we obtain constructive upper bounds for $R(n,k)$ when $ n$ is much smaller than $2^{2k}$.

More on Security of Public-Key Cryptosystems Based on Chebyshev Polynomials

Recently, a public-key cryptosystem based on Chebyshev polynomials has been proposed, but it has been later analyzed and shown insecure. This paper addresses some unanswered questions about the cryptosystem. We deal with the issue of computational precision. This is important for two reasons. Firstly, the cryptosystem is defined on real numbers, but any practical data communication channel can only transmit a limited number of digits. Any real number can only be specified to some precision level, and we study the effect of that. Secondly, we show that the precision issue is related to its security. In particular, the algorithm previously proposed to break the cryptosystem may not work in some situations. Moreover, we introduce another method to break the cryptosystem with general precision settings. We extend the method to show that a certain class of cryptosystems is insecure. Our method is based on the known techniques on the shortest vector problem in lattice and linear congruences.

Hardness of approximating the shortest vector problem in lattices

Let p &gt; 1 be any fixed real. We show that assuming NP ⊈ RP, there is no polynomial time algorithm that approximates the Shortest Vector Problem (SVP) in ℓ p norm within a constant factor. Under the stronger assumption NP ⊈ RTIME(2 poly (log n ) ), we show that there is no polynomial-time algorithm with approximation ratio 2 (log n ) 1/2−ϵ where n is the dimension of the lattice and ϵ &gt; 0 is an arbitrarily small constant.We first give a new (randomized) reduction from Closest Vector Problem (CVP) to SVP that achieves some constant factor hardness. The reduction is based on BCH Codes. Its advantage is that the SVP instances produced by the reduction behave well under the augmented tensor product , a new variant of tensor product that we introduce. This enables us to boost the hardness factor to 2 (log n ) 1/2-ϵ .

Universal lattice decoding: principle and recent advances

AbstractThe idea of formulating the detection of a lattice‐type modulation, such as M‐PAM and M‐QAM, transmitted over a linear channel as the so‐called universal lattice decoding problem dates back to at least the early 1990s. The applications of such lattice decoders have proliferated in the last few years because of the growing importance of some linear channel models such as multiple‐antenna fading channels and multi‐user CDMA channels. The principle of universal lattice decoding can trace its roots back to the theory and algorithms developed for solving the shortest/closest lattice vector problem for integer programming and cryptoanalysis applications. In this semi‐tutorial paper, such a principle as well as some related recent advances will be reviewed and extended. It will be shown that the lattice basis reduction algorithm of Lenstra, Lenstra and Lovász (LLL) can significantly improve the performance of suboptimal lattice decoders such as the zero‐forcing and VBLAST detectors. In addition, new implementation of the optimal lattice decoder that is particularly efficient at moderate signal‐to‐noise ratios will also be presented. Copyright © 2003 John Wiley &amp; Sons, Ltd.

The Insecurity of the Digital Signature Algorithm with Partially Known Nonces

We present a polynomial-time algorithm that provably recovers the signer's secret DSA key when a few consecutive bits of the random nonces k (used at each signature generation) are known for a number of DSA signatures at most linear in log q (q denoting as usual the small prime of DSA), under a reasonable assumption on the hash function used in DSA. For most significant or least significant bits, the number of required bits is about log1/2 q , but can be decreased to log log q with a running time qO(1/log log q) subexponential in log q , and even further to two in polynomial time if one assumes access to ideal lattice basis reduction, namely an oracle for the lattice closest vector problem for the infinity norm. For arbitrary consecutive bits, the attack requires twice as many bits. All previously known results were only heuristic, including those of Howgrave-Graham and Smart who recently introduced that topic. Our attack is based on a connection with the hidden number problem (HNP) introduced at Crypto '96 by Boneh and Venkatesan in order to study the bit-security of the Diffie--Hellman key exchange. The HNP consists, given a prime number q , of recovering a number ? ? Fq such that for many known random t ? Fq a certain approximation of t ? is known. To handle the DSA case, we extend Boneh and Venkatesan's results on the HNP to the case where t has not necessarily perfectly uniform distribution, and establish uniformity statements on the DSA signatures, using exponential sum techniques. The efficiency of our attack has been validated experimentally, and illustrates once again the fact that one should be very cautious with the pseudo-random generation of the nonce within DSA.