Skip to main content
SpringerLink
Log in

Analysis of DeepBKZ reduction for finding short lattice vectors

  • Published:
Designs, Codes and Cryptography Aims and scope Submit manuscript

Abstract

Lattice basis reduction is a mandatory tool for solving lattice problems such as the shortest vector problem. The Lenstra–Lenstra–Lovász reduction algorithm (LLL) is the most famous, and its typical improvements are the block Korkine–Zolotarev algorithm and LLL with deep insertions (DeepLLL), both proposed by Schnorr and Euchner. In BKZ with blocksize \(\beta \), LLL is called many times to reduce a lattice basis before enumeration to find a shortest non-zero vector in every block lattice of dimension \(\beta \). Recently, “DeepBKZ” was proposed as a mathematical improvement of BKZ, in which DeepLLL is called as a subroutine alternative to LLL. In this paper, we analyze the output quality of DeepBKZ in both theory and practice. Specifically, we give provable upper bounds specific to DeepBKZ. We also develop “DeepBKZ 2.0”, an improvement of DeepBKZ like BKZ 2.0, and show experimental results that it finds shorter lattice vectors than BKZ 2.0 in practice.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1
Fig. 2
Fig. 3

Similar content being viewed by others

Notes

  1. The library is available at http://www2.nict.go.jp/security/pbkzcode/index.html. The authors would like to thank Yuntao Wang, a member of developers of the library, for his embedding a part of the progressive-BKZ library into our DeepBKZ library.

References

  1. Albrecht, M., Ducas, L., Herold, G., Kirshanova, E., Postlethwaite, E.W., Stevens, M.: The general sieve kernel and new records in lattice reduction. In: Advances in Cryptology—EUROCRYPT 2019. Lecture Notes in Computer Science, vol. 11477, pp. 717–746. Springer, Berline (2019)

  2. Albrecht, M.R., Curtis, B.R., Deo, A., Davidson, A., Player, R., Postlethwaite, E.W., Virdia, F., Wunderer, T.: Estimate all the LWE, NTRU schemes! In: Security and Cryptography for Networks (SCN 2018). Lecture Notes in Computer Science, vol. 11035, pp. 351–367 (2018)

  3. Aono, Y., Wang, Y., Hayashi, T., Takagi, T.: Improved progressive BKZ algorithms and their precise cost estimation by sharp simulator. In: Advances in Cryptology—EUROCRYPT 2016. Lecture Notes in Computer Science, vol. 9665, pp. 789–819. Springer, New York (2016). Progressive BKZ library is available from https://www2.nict.go.jp/security/pbkzcode/.

  4. Bremner M.R.: Lattice Basis Reduction: An Introduction to the LLL Algorithm and Its Applications. CRC Press, Boca Raton (2011).

    Book  Google Scholar 

  5. Chen, Y.: Réduction de réseau et sécurité concrete du chiffrement completement homomorphe. Ph.D. thesis, Paris 7 (2013)

  6. Chen, Y., Nguyen, P.Q.: BKZ 2.0: better lattice security estimates. In: Advances in Cryptology—ASIACRYPT 2011. Lecture Notes in Computer Science, vol. 7073, pp. 1–20. Springer, New York (2011)

  7. Cohen H.: A Course in Computational Algebraic Number Theory, Graduate Texts in Math, vol. 138. Springer-Verlag, Berlin, Heidelberg (1993).

    Book  Google Scholar 

  8. Ding, J., Kim, S., Takagi, T., Wang, Y.: LLL and stochastic sandpile models. arXiv:1804.03285v3 (2018).

  9. Ducas, L.: Shortest vector from lattice sieving: a few dimensions for free. In: Advances in Cryptology—EUROCRYPT 2018. Lecture Notes in Computer Science, vol. 10820, pp. 125–145. Springer, New York (2018)

  10. Fontein F., Schneider M., Wagner U.: PotLLL: a polynomial time version of LLL with deep insertions. Designs Codes Cryptogr. 73(2), 355–368 (2014).

    Article  MathSciNet  Google Scholar 

  11. Galbraith S.D.: Mathematics of Public Key Cryptography. Cambridge University Press, Cambridge (2012).

    Book  Google Scholar 

  12. Gama, N., Nguyen, P.Q.: Predicting lattice reduction. In: Advances in Cryptology—EUROCRYPT 2008. Lecture Notes in Computer Science, vol. 4965, pp. 31–51. Springer, New York (2008)

  13. Gama, N., Nguyen, P.Q., Regev, O.: Lattice enumeration using extreme pruning. In: Advances in Cryptology—EUROCRYPT 2010. Lecture Notes in Computer Science, vol. 6110, pp. 257–278. Springer, New York (2010)

  14. Hanrot, G., Pujol, X., Stehlé, D.: Analyzing blockwise lattice algorithms using dynamical systems. In: Advances in Cryptology—CRYPTO 2011. Lecture Notes in Computer Science, vol. 6841, pp. 447–464. Springer, New York (2011)

  15. Lenstra A.K., Lenstra H.W., Lovász L.: Factoring polynomials with rational coefficients. Math. Ann. 261(4), 515–534 (1982).

    Article  MathSciNet  Google Scholar 

  16. Li, J.: On the smallest ratio problem of lattice bases. IACR ePrint 2016/847 (2016)

  17. Martinet, J.: Perfect lattices in Euclidean spaces. Comprehensive Studies in Mathematics, vol. 327. Springer Science & Business Media, New York (2013)

  18. Micciancio D., Goldwasser S.: Complexity of Lattice Problems: A Cryptographic Perspective, vol. 671. Springer Science & Business Media, Berlin (2012).

    MATH  Google Scholar 

  19. Micciancio, D., Walter, M.: Practical, predictable lattice basis reduction. In: Advances in Cryptology—EUROCRYPT 2016. Lecture Notes in Computer Science, vol. 9665, pp. 820–849. Springer, New York (2016)

  20. Milnor J.W., Husemoller D.: Symmetric Bilinear Forms, vol. 60. Springer, New York (1973).

    Book  Google Scholar 

  21. Nguyen, P.Q.: Hermite’s constant and lattice algorithms. In: The LLL Algorithm, pp. 19–69. Springer, New York (2009)

  22. Pohst M.: A modification of the LLL reduction algorithm. J. Symbol. Comput. 4(1), 123–127 (1987).

    Article  MathSciNet  Google Scholar 

  23. Schnorr C.P.: A hierarchy of polynomial time lattice basis reduction algorithms. Theoret Comput. Sci. 53(2–3), 201–224 (1987).

    Article  MathSciNet  Google Scholar 

  24. Schnorr, C.P.: Block Korkin–Zolotarev bases and successive minima. International Computer Science Institute (1992)

  25. Schnorr, C.P.: Lattice reduction by random sampling and birthday methods. In: Symposium on Theoretical Aspects of Computer Science–STACS 2003. Lecture Notes in Computer Science, vol. 2607, pp. 145–156. Springer, New York (2003)

  26. Schnorr C.P., Euchner M.: Lattice basis reduction: improved practical algorithms and solving subset sum problems. Math. Program. 66, 181–199 (1994).

    Article  MathSciNet  Google Scholar 

  27. Shoup, V.: NTL: A Library for Doing Number Theory. http://www.shoup.net/ntl/.

  28. The FPLLL development team: FPLLL, a lattice reduction library (2016). https://github.com/fplll/fplll

  29. TU Darmstadt: SVP challenge. https://www.latticechallenge.org/svp-challenge/.

  30. Yamaguchi, J., Yasuda, M.: Explicit formula for Gram-Schmidt vectors in LLL with deep insertions and its applications. In: International Conference on Number-Theoretic Methods in Cryptology—NuTMiC 2017. Lecture Notes in Computer Science, vol. 10737, pp. 142–160. Springer, Berlin (2017)

  31. Yasuda, M.: Self-dual DeepBKZ for finding short lattice vectors. To appear in a MathCrypt special issue of J. Math. Cryptol.

  32. Yasuda M., Yamaguchi J.: A new polynomial-time variant of LLL with deep insertions for decreasing the squared-sum of Gram-Schmidt lengths. Designs Codes Cryptogr. 87, 2489–2505 (2019).

    Article  MathSciNet  Google Scholar 

  33. Yasuda, M., Yamaguchi, J., Ooka, M., Nakamura, S.: Development of a dual version of DeepBKZ and its application to solving the LWE challenge. In: Progress in Cryptology—AFRICACRYPT 2018. Lecture Notes in Computer Science, vol. 10831, pp. 162–182. Springer, New York (2018)

  34. Yasuda M., Yokoyama K., Shimoyama T., Kogure J., Koshiba T.: Analysis of decreasing squared-sum of Gram–Schmidt lengths for short lattice vectors. J. Math. Cryptol. 11(1), 1–24 (2017).

    Article  MathSciNet  Google Scholar 

Download references

Author information

Authors and Affiliations

  1. Institute of Mathematics for Industry, Kyushu University, Fukuoka, Japan

    Masaya Yasuda

  2. Faculty of Mathematics, Kyushu University, Fukuoka, Japan

    Satoshi Nakamura

  3. Fujitsu Laboratories Ltd, Fujitsu, Japan

    Junpei Yamaguchi

Authors
  1. Masaya Yasuda
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Satoshi Nakamura
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Junpei Yamaguchi
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Masaya Yasuda.

Additional information

Communicated by J. Buchmann.

Publisher's Note

Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.

This work was supported by JST CREST Grant Number JPMJCR14D6, Japan. A part of this work was also supported by JSPS KAKENHI Grant Number JP16H02830.

Appendices

Efficient update algorithm of Gram–Schmidt information

figure b

Let \(\mathbf {B} = [\mathbf {b}_1, \dots , \mathbf {b}_n]\) be a basis of a lattice L, and let \(\mathbf {w} = \sum _{i=1}^r v_i \mathbf {b}_i \in L\) be a lattice vector with \(v_i \in \mathbb {Z}\) for \(1 \le i \le r-1\) and \(v_r = \pm 1\). For an insertion index k with \(1 \le k \le r \le n\), the n linearly independent vectors

$$\begin{aligned} {[}\mathbf {b}_1, \dots , \mathbf {b}_{k-1}, \mathbf {w}, \mathbf {b}_k, \dots , \mathbf {b}_{r-1}, \mathbf {b}_{r+1}, \dots , \mathbf {b}_n] \end{aligned}$$
(12)

give a new basis of L. In Algorithm 2, we show an efficient algorithm to update Gram-Schmidt information of the new basis (12). This is available after every insertion of a new lattice vector in DeepBKZ (or BKZ). The algorithm is based on the formula of [34, Proposition 4.2] on Gram-Schmidt information, and it is a generalization of the update algorithm in DeepLLL [30, Algorithm 4]. (When \(\mathbf {w} = \mathbf {b}_r\), the basis (12) coincides with the ordered basis \(\sigma _{k, r}(\mathbf {B})\) by a deep insertion.)

Short lattice vectors in the SVP challenge

In this appendix, we list short lattice vectors in the SVP challenge [29] for dimensions 100, 105, 110 and 115 with seeds 0–9. These lattice vectors were found mainly by DeepBKZ with blocksizes up to 45 (and pruned enumeration [13]). For every vector \(\mathbf {v}\) in an n-dimensional lattice L, we show its Euclidean norm \(\Vert \mathbf {v} \Vert \) and its approximation factor defined by

$$\begin{aligned} \dfrac{ \Vert \mathbf {v} \Vert \sqrt{\pi }}{\left( \varGamma (n/2 + 1) \cdot \mathrm {vol}(L) \right) ^{1/n}} \end{aligned}$$

where \(\varGamma \) is the Gamma function. If the factor is less than 1.05, the lattice vector can be submitted to the hall of fame in the SVP challenge. Furthermore, to enter the hall of fame, the vector is required to be shorter than a previous one in the same dimension with possibly different seed. We hope that these data would be a target to find a shorter lattice vector in every dimension and seed. (The below vectors are not necessarily the shortest.)

1.1 Dimension 100

  • Seed 0: Norm 2571 (Approximation Factor 1.01252)

    figure c

  • Seed 1: Norm 2526 (Approximation Factor 0.99609)

    figure d

  • Seed 2: Norm 2590 (Approximation Factor 1.02146)

    figure e

  • Seed 3: Norm 2532 (Approximation Factor 0.99715)

    figure f

  • Seed 4: Norm 2481 (Approximation Factor 0.97400)

    figure g

  • Seed 5: Norm 2554 (Approximation Factor 1.00344)

    figure h

  • Seed 6: Norm 2555 (Approximation Factor 1.00179)

    figure i

  • Seed 7: Norm 2555 (Approximation Factor 1.00391)

    figure j

  • Seed 8: Norm 2509 (Approximation Factor 0.98725)

    figure k

  • Seed 9: Norm 2598 (Approximation Factor 1.02173)

    figure l

1.2 Dimension 105

  • Seed 0: Norm 2648 (Approximation Factor 1.01586)

    figure m

  • Seed 1: Norm 2604 (Approximation Factor 1.00237)

    figure n

  • Seed 2: Norm 2644 (Approximation Factor 1.01482)

    figure o

  • Seed 3: Norm 2617 (Approximation Factor 1.00450)

    figure p

  • Seed 4: Norm 2652 (Approximation Factor 1.01729)

    figure q

  • Seed 5: Norm 2622 (Approximation Factor 1.00824)

    figure r

  • Seed 6: Norm 2544 (Approximation Factor 0.97655)

    figure s

  • Seed 7: Norm 2621 (Approximation Factor 1.00747)

    figure t

  • Seed 8: Norm 2656 (Approximation Factor 1.02005)

    figure u

  • Seed 9: Norm 2641 (Approximation Factor 1.01238)

    figure v

1.3 Dimension 110

  • Seed 0: Norm 2647 (Approximation Factor 0.99636)

    figure w

  • Seed 1: Norm 2716 (Approximation Factor 1.01894)

    figure x

  • Seed 2: Norm 2636 (Approximation Factor 0.99285)

    figure y

  • Seed 3: Norm 2630 (Approximation Factor 0.99003)

    figure z

  • Seed 4: Norm 2621 (Approximation Factor 0.98360)

    figure aa

  • Seed 5: Norm 2710 (Approximation Factor 1.01887)

    figure ab

  • Seed 6: Norm 2685 (Approximation Factor 1.01055)

    figure ac

  • Seed 7: Norm 2682 (Approximation Factor 1.00640)

    figure ad

  • Seed 8: Norm 2690 (Approximation Factor 1.00976)

    figure ae

  • Seed 9: Norm 2659 (Approximation Factor 0.99626)

    figure af

1.4 Dimension 115

  • Seed 0: Norm 2727 (Approximation Factor 1.00244)

    figure ag

  • Seed 1: Norm 2742 (Approximation Factor 1.00949)

    figure ah

  • Seed 2: Norm 2729 (Approximation Factor 1.00407)

    figure ai

  • Seed 3: Norm 2699 (Approximation Factor 0.99339)

    figure aj

  • Seed 4: Norm 2704 (Approximation Factor 0.99570)

    figure ak

  • Seed 5: Norm 2788 (Approximation Factor 1.02803)

    figure al

  • Seed 6: Norm 2769 (Approximation Factor 1.02161)

    figure am

  • Seed 7: Norm 2775 (Approximation Factor 1.02310)

    figure an

  • Seed 8: Norm 2720 (Approximation Factor 1.00291)

    figure ao

  • Seed 9: Norm 2752 (Approximation Factor 1.01189)

    figure ap

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Yasuda, M., Nakamura, S. & Yamaguchi, J. Analysis of DeepBKZ reduction for finding short lattice vectors. Des. Codes Cryptogr. 88, 2077–2100 (2020). https://doi.org/10.1007/s10623-020-00765-4

Download citation

  • Received:

  • Revised:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s10623-020-00765-4

Keywords

Mathematics Subject Classification

Search

Navigation