Shortest Vector from Lattice Sieving: a Few Dimensions for

Shortest Vector from Lattice Sievinga Few Dimensions for Free

Leo Ducas1

Cryptology Group CWI Amsterdam The Netherlands

EUROCRYPT 2018Tel Aviv April 30th

1Supported by a Veni Innovational Research Grant from NWO (639021645)Leo Ducas (CWI Amsterdam) SVP from Sieving a Few Dims for Free 30 April 2018 1 23

Two class of Algorithms for SVP

The Shortest Vector Problem

I The basis B of an n-dimensional lattice LO A shortest non-zero vector v isin L

Algorithm Running time Memory

Enumeration nn2e middot 2O(n) poly(n)

Sieving2 [2292n+o(n) 2415n+o(n)] [22075n+o(n) 2292n+o(n)]

The paradox

In theory Sieving is faster In pratice it is quite slower

2Given complexity are heuristic heavily supported by experimentsLeo Ducas (CWI Amsterdam) SVP from Sieving a Few Dims for Free 30 April 2018 2 23

The paradox

Many trade-offs

Time=S

Laa 15LdW15

BL15BGJ 15

BDGL16

2020 n 2025 n 2030 n 2035 n2025 n

2030 n

2035 n

2040 n

2045 n

Space complexity

I Our main contribution can alsobe applied to other sievingalgorithms

I Implementation limited to theversion of[Micciancio Voulgaris 2010]

Leo Ducas (CWI Amsterdam) SVP from Sieving a Few Dims for Free 30 April 2018 3 23

Many trade-offs

Time=S

Laa 15LdW15

BL15BGJ 15

BDGL16

2020 n 2025 n 2030 n 2035 n2025 n

2030 n

2035 n

2040 n

2045 n

Space complexity

In this work

Results

Heuristic claim asymptotic

One can solve SVP in dimension n with a call to Sieve in dimension n minus d

where d = Θ(n log n)

Heuristic claim concrete

One can solve SVP in dimension n making a call to Sieve in dimension ifor each i = 1 n minus d for

d asymp n middot ln(43)

ln(n2πe)(d asymp 15 for n = 80)

Experimental claim A bogey

A Sieve implem almost on par with enumeration (within a factor 4 indims 70ndash80) with still much room for improvements

Results

Table of Contents

1 Dimensions for free

2 Implementation and performances

Table of Contents

Sieving

Algorithm 1 Sieve(L)

Llarr a set of N random vectors from L where N asymp (43)n2while exist(vw) isin L2 such that v minusw lt v do

vlarr v minuswend whilereturn L

The above runs in heuristic time (43)n+o(n)

Many concrete and asymptotic improvements[Nguyen Vidick 2008 Micciancio Voulgaris 2010 Laarhoven 2015Becker Gamma Joux 2015 Becker D Gamma Laarhoven 2015 ]

Sieving

More than SVP

Note that Sieve returns N asymp (43)n short vectors not just a shortestvector

Definition (Gaussian Heuristic Expected length of the shortest vector)

gh(L) =radic

n2πe middot vol(L)1n

Observation (heuristic amp experimental)

The output of Sieve contains almost all vectors of length leradic

43 middot gh(L)

L = Sieve(L) =x isin L st x le

radic43 middot gh(L)

Sieve then Lift

Main idea Sieve in a projected sub-lattice and lift all candidate solutions

SubSieve(L d)I Set Lprime = L(b1 bd) ldquoleft part of Lrdquo dim=d

I Set Lprimeprime = πperpLprime(L) ldquoright part of Lrdquo dim=n minus d

I Compute L = Sieve(Lprimeprime)

I Hope that πperpLprime(s) isin L (1)

I Lift all v isin L from Lprimeprime to L and take the shortest (Babai alg)

Pessimistic prediction for (1)

gh(L) leradic

43 middot gh(Ld)

Optimistic prediction for (1)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Similar to linear pruning for enum

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

With BKZ pre-processing

I To ensure (1) we need the basis to be as reduced as possible

I We can easily afford BKZ preprocessing with block-size b = n2

I Using simple BKZ models3 we can predict gh(L) and gh(Lprime)

Heuristic claim

SubSieve(L d) algorithm will successfully find the shortest vector of L forsome d = Θ(n ln n)

rArr Improve time amp memory by a sub-exponential factor 2Θ(n log n)

3The Geometric Series AssumptionLeo Ducas (CWI Amsterdam) SVP from Sieving a Few Dims for Free 30 April 2018 10 23

Heuristic claim

Quasi-HKZ preprocessing

Idea Attempt stronger pre-processing

Algorithm 3 SubSieve+(L d)

Llarr Sieve(Lprimeprime)L = LiftLprimeprimerarrL(v) for v isin Lfor j = 0 n2minus 1 do

vj = arg minsisinL π(v0vjminus1)perp(s)end forreturn (v0 vn2minus1)

I Insert (v0 vn2minus1) as the new b1 bn2

I Repeat SubSieve+(L d) for d = n minus 1 n minus 2 dmin

I Hope that iteration dmin + 1 provided a quasi-HKZ basis

Concrete prediction with quasi-HKZ preprocessing

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

pessimistic simulationpessimistic approximationoptimistic simulationoptimistic approximation

Figure Predictions of the maximal successful choice of dmin

Table of Contents

Baseline Implementation (V0)

Re-implemented GaussSieve [Micciancio Voulgaris 2010]I No gaussian sampling

I Initial sphericity of L doesnrsquot seem to matterI Initial vectors can be made much shorter rArr speed-up

I Prevent collisions using a hash table

I Terminate when the ballradic

43 middot gh(L) is half-saturatedI Sort only periodically

I Can use faster data-structures

I Vectors represented in bases B and GramSchmidt(B)I Required to work in projected-sublattices

I Kernel in c++ control in pythonI Calls to fpylll to maintain B and GramSchmidt(B)

XOR-POPCNT trick (V0 rarr V1)

Already used in Sieving [Fitzpatrick et al 2015]More generally know as SimHash [Charikar 2002]

Idea Pre-filter pairs (vw) isin L with a fast compressed test

I Choose a spherical code C = c1 ck sub Sn and a threshold t le k2

I Precompute compressions v = Sign(v) isin 0 1k

I Only test v plusmnw le v if

|HammingWeight(v oplusw)minus k2| ge t

I Asymptotic speed-up Θ(n log n)

I In practice k = 128 (2 words) t = 18 about 10 cycles per pairs

Progressive Sieving (V1 rarr V2)

Concurrently and independetly invented in [Mariano Laarhoven 2018]

Idea Increase the dimension progressively

I Recursively Sieve in the lattice L(b1 bnminus1)

I Start the sieve in dimension n with many short-ish vectors

I Fresh vector get reduced much faster thanks to this initial pool

Refer to [Mariano Laarhoven 2018] for a full analysis of this trick

Dimensions for Free (V2 rarr V3)

I Apply the quasi-HKZ preprocessing strategyI Do not force the choice of dmin

I Simply increase d until the shortest vector is found

60 62 64 66 68 70 72 74 76 78 80 82n

pessimistic simulationpessimistic approximationoptimistic simulationoptimistic approximationExperimental average

Figure Predictions experiments for dmin

Performances

40 50 60 70 80n

T (sec )

Fit V0 20 489nminus 21 6

Fit Enum 20 0683n middot lnnminus 17 9

V0 (Sieve)V1 (Sieve)V2 (Sieve)V3 (SubSieve)fpllls Pruned Enum

Figure Our implementation vs fplll pruned enumeration

Comparison to other Sieving implementation

AlgorithmsV0 V1 V2 V3 [MV10] [FBB+14] [ML17] [HK17]

FeaturesXOR-POPCNT trick x x x xpogressive sieving x x

SubSieve xLSH (more mem) xtuple (less mem) x

Dimension Running timesn = 60 227s 49s 8s 09s 464s 79s 13s 1080sn = 70 - - 276s 10s 23933s 4500s 250s 33000sn = 80 - - - 234s - - 4320s 94700s

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

I Exploit all outputs of Sieve rArr Dimensions for Free

I Our implementation is 10x faster than all previous Sieving

I It does not use LSH techniques further speed-up expected

Sieving vs Enumeration

I Only a factor 4x slower than Enum for dimensions 70ndash80

I Guesstimates a cross-over at dim asymp 90 with further improvements(LSHLSF fine-tuning vectorization )

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

Simple Sieving in the Area-Time Model

A claim of P Kirchner4

A simple Sieving algorithm (eg NV) can be implemented with

A = 22075n+o(n) and T = 22075n+o(n)

The circuit is easy to re-invent using shift registers

I No long wires no speed-of-light delays

I Essentially 1-dimensional

v | | | | | darr

vlarr vlarr vlarr vlarrmiddot middot middotlarr vlarr v

4httpsgroupsgooglecomforummsgcryptanalytic-algorithms

BoSRL0uHIjMwAkZQlwRAgAJLeo Ducas (CWI Amsterdam) SVP from Sieving a Few Dims for Free 30 April 2018 22 23

Advanced Sieving in the Area-Time Model

Conjecture Open Question

There exist a sieving circuit with

A = 22075n+o(n) and T le 2142n+o(n)

HintI [Becker Gama Joux 2015] with only on level of filtration

I 3 or 4 layers of 2-dimensions should suffice

I Keep shift-registers not fully saturated for easier on-the-fly insertion

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Implementation and performances

The paradox

Many trade-offs

Time=S

Laa 15LdW15

BL15BGJ 15

BDGL16

2020 n 2025 n 2030 n 2035 n2025 n

2030 n

2035 n

2040 n

2045 n

Space complexity

Many trade-offs

Time=S

Laa 15LdW15

BL15BGJ 15

BDGL16

2020 n 2025 n 2030 n 2035 n2025 n

2030 n

2035 n

2040 n

2045 n

Space complexity

In this work

Results

Table of Contents

Sieving

More than SVP

gh(L) =radic

43 middot gh(L)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

The paradox

Many trade-offs

Time=S

Laa 15LdW15

BL15BGJ 15

BDGL16

2020 n 2025 n 2030 n 2035 n2025 n

2030 n

2035 n

2040 n

2045 n

Space complexity

Many trade-offs

Time=S

Laa 15LdW15

BL15BGJ 15

BDGL16

2020 n 2025 n 2030 n 2035 n2025 n

2030 n

2035 n

2040 n

2045 n

Space complexity

In this work

Results

Table of Contents

Sieving

More than SVP

gh(L) =radic

43 middot gh(L)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

The paradox

Many trade-offs

Time=S

Laa 15LdW15

BL15BGJ 15

BDGL16

2020 n 2025 n 2030 n 2035 n2025 n

2030 n

2035 n

2040 n

2045 n

Space complexity

Many trade-offs

Time=S

Laa 15LdW15

BL15BGJ 15

BDGL16

2020 n 2025 n 2030 n 2035 n2025 n

2030 n

2035 n

2040 n

2045 n

Space complexity

In this work

Results

Table of Contents

Sieving

More than SVP

gh(L) =radic

43 middot gh(L)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Many trade-offs

Time=S

Laa 15LdW15

BL15BGJ 15

BDGL16

2020 n 2025 n 2030 n 2035 n2025 n

2030 n

2035 n

2040 n

2045 n

Space complexity

Many trade-offs

Time=S

Laa 15LdW15

BL15BGJ 15

BDGL16

2020 n 2025 n 2030 n 2035 n2025 n

2030 n

2035 n

2040 n

2045 n

Space complexity

In this work

Results

Table of Contents

Sieving

More than SVP

gh(L) =radic

43 middot gh(L)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Many trade-offs

Time=S

Laa 15LdW15

BL15BGJ 15

BDGL16

2020 n 2025 n 2030 n 2035 n2025 n

2030 n

2035 n

2040 n

2045 n

Space complexity

In this work

Results

Table of Contents

Sieving

More than SVP

gh(L) =radic

43 middot gh(L)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Results

Table of Contents

Sieving

More than SVP

gh(L) =radic

43 middot gh(L)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Results

Table of Contents

Sieving

More than SVP

gh(L) =radic

43 middot gh(L)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Results

Table of Contents

Sieving

More than SVP

gh(L) =radic

43 middot gh(L)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Table of Contents

Sieving

More than SVP

gh(L) =radic

43 middot gh(L)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Table of Contents

Sieving

More than SVP

gh(L) =radic

43 middot gh(L)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Sieving

More than SVP

gh(L) =radic

43 middot gh(L)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Sieving

More than SVP

gh(L) =radic

43 middot gh(L)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

More than SVP

gh(L) =radic

43 middot gh(L)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Sieve then Lift

gh(L) leradic

43 middot gh(Ld)

radicn minus d

nmiddotgh(L) le

radic43middotgh(Ld)

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Heuristic claim

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

d asymp n ln 43

ln(n2π)

d asymp n ln 43

ln(n2πe)

50 100 150 200 250n

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Table of Contents

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

60 62 64 66 68 70 72 74 76 78 80 82n

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Performances

40 50 60 70 80n

T (sec )

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

CPU freq (GHz) 36 36 36 36 40 40 23 23

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Summary

Sieving vs Sieving

To be continued

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Summary

Sieving vs Sieving

To be continued

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Thanks

Question

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

A = 22075n+o(n) and T = 22075n+o(n)

v | | | | | darr

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

A = 22075n+o(n) and T le 2142n+o(n)

Dimensions for free

Documents

Shortest Vector from Lattice Sieving: a Few Dimensions for