Title: Sieving for shortest vectors in ideal lattices: a practical perspective

Authors: Joppe W. Bos; Michael Naehrig; Joop Van De Pol

Addresses: NXP Semiconductors, Leuven, Belgium ' Microsoft Research, Redmond, USA ' Department of Computer Science, University of Bristol, UK

Abstract: The security of many lattice-based cryptographic schemes relies on the hardness of finding short vectors in integral lattices. We propose a new variant of the parallel Gauss sieve algorithm to compute such short vectors. It combines favourable properties of previous approaches resulting in reduced run time and memory requirement per node. Our publicly available implementation outperforms all previous Gauss sieve approaches for dimensions 80, 88, and 96. When computing short vectors in ideal lattices, we show how to reduce the number of multiplications and comparisons by using a symbolic Fourier transform. We computed a short vector in a negacyclic ideal lattice of dimension 128 in less than nine days on 1,024 cores, more than twice as fast as the recent record computation for the same lattice on the same computer hardware.

Keywords: lattice cryptanalysis; parallel Gauss sieve; ideal lattices; ring LWE.

DOI: 10.1504/IJACT.2017.089353

International Journal of Applied Cryptography, 2017 Vol.3 No.4, pp.313 - 329

Received: 30 Aug 2015
Accepted: 07 Jun 2016
Published online: 21 Jan 2018 *

Full-text access for editors Full-text access for subscribers Purchase this article Comment on this article